From a great deal of research, and looking around, I have some data on this issue:
By default, spotlight will not index certain folders:
- /System
- /usr
- hidden files or directories.
- Other user files.
To add a file path to spotlight you can run
mdimport -r /path
man mdimport
has the information on that.
Now, since I am aiming for a poor mans IDS out of all this stuff, this desire being driven by the knowledge that Spotlight indexes my drive all the time, which is what would happen anyway with other host based IDS there were some considerations and other tools to involve.
Considerations:
Spotlight will only show you what your user should see
That's what the documentation says. I can see stuff I installed as root, but I can't see my other user. However,I can see /usr /usr/libexec and the /System tree. That'll do.
Hidden files and folders do not show up in the search
This will be good when the RIAA remotely scans your drives for music without proper credentials ( Trust your feelings you know this to be true. ) but is not the greatest news in this case.
To conclude, there is a lot of stuff to do to use this tool effectively. The secret is that Apple signs everything digitally.
man codesign
will tell you about
codesign -v file
which should return nothing if the file is unmodified. Note that this is not a checksum but a digital certificate from Apple, so only big money will allow this to be faked.
I of course meant to say that it will be quite secure, and easily detectable if a binary program is changed.
Won't stop everything, but it will allow me to periodically bark
"Did anything just change?" , run a spotlight search on the "kMDItemKind" attribute , pipe it through codesign -v and see if something did change, or search on modification time or whatever.
To address the userland statement above, I can check to see I have the same spotlight ( I have copied codesign to my recovery media. ) intact spotlight means that I can trust it to do it's ordinary tasks. Using the mdimport -r /path is indeed a better idea, since that will exit if run as root.
Certainly there is a question of security here, but as mentioned above, spotlight indexes a bunch of things, and shows you what you should see. Your little sister will not be able to find your collection of late 1990 artistic nudes, nor will you be able to find her secrets, but root should be able to see everything. There is a straightforward system of authorizations in OS X that govern which right a program can have, but since this is virtually unknown to most, they simply type in a password when a box comes up to authenticate something they have downloaded, and it installs as root. A certain search engines software does exactly this. Hell, the system is actually more secure than before, I ran the old python importer, and it failed, because it asked for my admin password and tried to run mdimport -r as root! I had to run it myself.
(Oh it's very nice with the python files, lovely really)
Hope this helps somebody else.
Best Answer
Spotlight generally only searches at the beginning of words. It can find barebones because it is right after a period, or textwrangler for the same reason, but not wrangler. (It also understands underscores, hyphens, and CamelCase as marking the beginning of words.)
To work around this, instead of doing a straight up spotlight search do a search in Finder (with cmd+F or cmd+option+space). Leave the search box blank, and click the plus button next to where it says "Save." Then make your query "Name" - "contains" -"wrangler" and you are good.
You also need to be careful because I think the file you are searching for is considered a system file. If you are searching within the Preferences folder you will get the right result, but if you are just searching within the home folder or on the entire hard drive, the system file won't show up, unless you push the plus button again and add to your search query "System files" - "are included." Since "System files" isn't in the dropdown box by default, you will probably need to click "Other..." and then find it. You will have the option of adding it permanently to the dropdown box.