mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
53f0e281bf
Related to #12608, this automatically sets the `DeferForceAtUserLoginMaxBypassAttempts` property to `1` on the FileVault profile that's generated by Fleet. This changeset also includes a migration to modify old FileVault profiles that already exist in the database, and by virtue of that a `InstallProfile` command will be issued to hosts that already have FV enabled. During testing we found: 1. This doesn't affect users with FV already installed, they silently get the profile updated without any changes. 2. Since the profile needs to be re-delivered, it'll go through the full "pending" -> "verifying" -> "verified" cycle.
93 lines
2.8 KiB
Go
93 lines
2.8 KiB
Go
package service
|
|
|
|
import "text/template"
|
|
|
|
type fileVaultProfileOptions struct {
|
|
PayloadIdentifier string
|
|
Base64DerCertificate string
|
|
}
|
|
|
|
var fileVaultProfileTemplate = template.Must(template.New("").Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>PayloadContent</key>
|
|
<array>
|
|
<dict>
|
|
<key>Defer</key>
|
|
<true/>
|
|
<key>Enable</key>
|
|
<string>On</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>FileVault 2</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.MCX.FileVault2.3548D750-6357-4910-8DEA-D80ADCE2C787</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.MCX.FileVault2</string>
|
|
<key>PayloadUUID</key>
|
|
<string>3548D750-6357-4910-8DEA-D80ADCE2C787</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>ShowRecoveryKey</key>
|
|
<false/>
|
|
<key>DeferForceAtUserLoginMaxBypassAttempts</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>EncryptCertPayloadUUID</key>
|
|
<string>A326B71F-EB80-41A5-A8CD-A6F932544281</string>
|
|
<key>Location</key>
|
|
<string>Fleet</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>FileVault Recovery Key Escrow</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.security.FDERecoveryKeyEscrow.3690D771-DCB8-4D5D-97D6-209A138DF03E</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.security.FDERecoveryKeyEscrow</string>
|
|
<key>PayloadUUID</key>
|
|
<string>3C329F2B-3D47-4141-A2B5-5C52A2FD74F8</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>PayloadCertificateFileName</key>
|
|
<string>Fleet certificate</string>
|
|
<key>PayloadContent</key>
|
|
<data>{{ .Base64DerCertificate }}</data>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Certificate Root</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.security.root.A326B71F-EB80-41A5-A8CD-A6F932544281</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.security.pkcs1</string>
|
|
<key>PayloadUUID</key>
|
|
<string>A326B71F-EB80-41A5-A8CD-A6F932544281</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>dontAllowFDEDisable</key>
|
|
<true/>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.MCX.62024f29-105E-497A-A724-1D5BA4D9E854</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.MCX</string>
|
|
<key>PayloadUUID</key>
|
|
<string>62024f29-105E-497A-A724-1D5BA4D9E854</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
</array>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Disk encryption</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>{{ .PayloadIdentifier }}</string>
|
|
<key>PayloadType</key>
|
|
<string>Configuration</string>
|
|
<key>PayloadUUID</key>
|
|
<string>74FEAC88-B614-468E-A4B4-B4B0C93B5D52</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
</plist>`))
|