How to List Location Services Authorized Apps Across All Macs

Introduction

Location Services are a configurable preference on macOS under the Security & Privacy preference pane, which allows full state (Location Services enabled/disabled) and granular control of various services and software which can interact with the Location Services API of your device.

This inventory captures the per-application permissions configured under Location Services, including which apps have requested location permissions, which have been granted, and when they last collected location information from your device.

For more information about macOS Location Services refer to the official Apple support documentation: Manage which apps can detect your Mac location

What Mac Location Services Authorized App Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Mac Location Services Authorized Apps from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Mac Location Services Authorized Apps Schema

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

WITH
location_authorizations AS (
  SELECT 
    bundle_identifier,
    COUNT(*) AS authorized_count
  FROM mac_location_services_authorized_apps 
  WHERE bundle_identifier NOT ILIKE 'com.apple%'
  AND authorized = TRUE
  GROUP BY bundle_identifier
  )
SELECT 
  authorized_count AS authorized_devices_count,
  ma.name AS app_name
FROM location_authorizations
LEFT JOIN mac_apps ma USING(bundle_identifier)
GROUP BY authorized_devices_count, bundle_identifier, ma.name
ORDER BY authorized_devices_count DESC

WITH
location_authorizations AS (
  SELECT 
    bundle_identifier,
    COUNT(*) FILTER (WHERE authorized = FALSE) AS devices_denied,
    COUNT(*) FILTER (WHERE authorized = TRUE) AS devices_authorized
  FROM mac_location_services_authorized_apps
  WHERE bundle_identifier NOT LIKE 'com.apple%'
  GROUP BY bundle_identifier
)
SELECT 
  devices_denied,
  devices_authorized,
  ma.name AS app_name
FROM location_authorizations
LEFT JOIN mac_apps ma USING(bundle_identifier)
GROUP BY devices_authorized, devices_denied, bundle_identifier, ma.name
ORDER BY devices_denied DESC

SELECT 
  mls.device_name, 
  authorized AS find_my_authorized,
  enabled AS location_services_global_state
FROM mac_location_services_authorized_apps mls
LEFT JOIN mac_location_services USING (device_id)
WHERE bundle_identifier = 'com.apple.findmy'
LIMIT 5;

Why Should I Collect Mac Location Services Authorized Apps?

The collection of Location Services configuration information allows an administrator to see which applications on your device have permission to access your Mac's location information. This can be helpful for a variety of reasons, such as determining whether a malicious application is capable of harvesting location information about your Mac

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

This inventory does not capture location information, only the state and configuration of apps which have requested location services permissions.

When you use Kolide to list Mac Location Services Authorized App data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.