Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 08:58:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 114

Fix DDM token generation so that only installs are part of the checksum (#20209)

Browse source
This commit is contained in:
Martin Angers 2024-07-03 15:58:09 -04:00 committed by GitHub
parent b077d7e669
commit 3e98147c52
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changes/18849-config-profiles-exclude-labels
View file

@ -2,3 +2,4 @@
* Added the API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`).
* Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting.
* Updated the profile reconciliation logic to handle the new "exclude any" labels.
* Fix bug where macOS declarations were stuck in "to be removed" state indefinitely.

12
server/datastore/mysql/apple_mdm.go
View file

@ -4015,10 +4015,18 @@ FROM
host_mdm_apple_declarations hmad
JOIN mdm_apple_declarations mad ON hmad.declaration_uuid = mad.declaration_uuid
WHERE
hmad.host_uuid = ?`
hmad.host_uuid = ? AND hmad.operation_type = ?`
// NOTE: the token generated as part of this query decides if the DDM session
// proceeds with sending the declarations - if the token differs from what
// the host last applied, it will proceed. That's why we use only the "to be
// installed" declarations for the token generation. If some declarations get
// removed, then they will be ignored in the token generation, which will
// change the token and make the DDM session proceed (and declarations not
// sent get removed).
var res fleet.MDMAppleDDMDeclarationsToken
if err := sqlx.GetContext(ctx, ds.reader(ctx), &res, stmt, hostUUID); err != nil {
if err := sqlx.GetContext(ctx, ds.reader(ctx), &res, stmt, hostUUID, fleet.MDMOperationTypeInstall); err != nil {
return nil, ctxerr.Wrap(ctx, err, "get DDM declarations token")
}