🧹 Add new ALF plist location for macOS 15

providers/os/resources/macos_alf.go

@@ -4,20 +4,44 @@
 package resources
 
 import (
+	"errors"
+
+	"github.com/rs/zerolog/log"
 	"go.mondoo.com/cnquery/v11/llx"
 	"go.mondoo.com/cnquery/v11/providers-sdk/v1/plugin"
 	"go.mondoo.com/cnquery/v11/providers/os/connection/shared"
 	"go.mondoo.com/cnquery/v11/types"
 )
 
+var alfPlistLocations = []string{
+	"/Library/Preferences/com.apple.alf.plist",
+	"/usr/libexec/ApplicationFirewall/com.apple.alf.plist",
+}
+
 func initMacosAlf(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) {
 	conn := runtime.Connection.(shared.Connection)
 
 	if args == nil {
 		args = map[string]*llx.RawData{}
 	}
 
-	f, err := conn.FileSystem().Open("/Library/Preferences/com.apple.alf.plist")
+	var plistLocation string
+	fs := conn.FileSystem()
+	for _, loc := range alfPlistLocations {
+		log.Debug().Str("location", loc).Msg("Checking for ALF configuration")
+		s, err := fs.Stat(loc)
+		if err == nil && !s.IsDir() {
+			log.Debug().Str("location", loc).Msg("Found ALF configuration")
+			plistLocation = loc
+			break
+		}
+	}
+
+	if plistLocation == "" {
+		return nil, nil, errors.New("ALF configuration not found")
+	}
+
+	f, err := fs.Open(plistLocation)
 	if err != nil {
 		return nil, nil, err
 	}