mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
133 lines
4.6 KiB
Bash
133 lines
4.6 KiB
Bash
#!/bin/sh
|
|
|
|
|
|
# execute.disable.fleet.desktop @2024 Fleet Device Management
|
|
# Brock Walters (brock@fleetdm.com)
|
|
|
|
|
|
# variables
|
|
dskplst='/Library/LaunchDaemons/com.fleet.disable.desktop.plist'
|
|
dskscpt='/private/tmp/disable.fleet.desktop.sh'
|
|
fltplst='/Library/LaunchDaemons/com.fleetdm.orbit.plist'
|
|
|
|
|
|
# check Fleet Desktop, exit if not enabled
|
|
if /usr/libexec/PlistBuddy -c 'print EnvironmentVariables:ORBIT_FLEET_DESKTOP' "$fltplst" | /usr/bin/grep -iq 'false'
|
|
then
|
|
printf "Fleet Desktop is not enabled on this host. Exiting...\n"; exit
|
|
else
|
|
printf "Disabling Fleet Desktop...\n"
|
|
fi
|
|
|
|
|
|
printf "Writing out disable Fleet Desktop script...\n"
|
|
/bin/cat << 'EOF' > "$dskscpt"
|
|
#!/bin/sh
|
|
|
|
# logging
|
|
cpuname="$(/usr/sbin/scutil --get ComputerName)"
|
|
srlnmbr="$(/usr/libexec/PlistBuddy -c 'print 0:serial-number' /dev/stdin <<< "$(/usr/sbin/ioreg -ar -d 1 -k 'IOPlatformSerialNumber')")"
|
|
usrcrnt="$(/usr/bin/stat -f %Su /dev/console)"
|
|
logexec="$(/usr/bin/basename "$0")"
|
|
logpath="/private/var/log/${logexec%.*}.log"
|
|
logpipe="/private/tmp/${logexec%.*}.pipe"
|
|
|
|
/usr/bin/mkfifo "$logpipe"
|
|
/usr/bin/tee -a < "$logpipe" "$logpath" &
|
|
exec &> "$logpipe"
|
|
printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [START] logging %s\n computer name: %s\n serial number: %s\n current user: %s\n" "$logexec" "$cpuname" "$srlnmbr" "$usrcrnt" >> "$logpath"
|
|
|
|
logalrt(){
|
|
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [ALERT] %s" >> "$logpath"
|
|
}
|
|
|
|
logexit(){
|
|
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [STOP] logging %s" "$logexec" >> "$logpath"
|
|
/bin/rm -f "$logpipe"; /usr/bin/pkill -ail tee > /dev/null
|
|
}
|
|
|
|
loginfo(){
|
|
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [INFO] %s" >> "$logpath"
|
|
}
|
|
|
|
# variables
|
|
count=0
|
|
dskplst='/Library/LaunchDaemons/com.fleet.disable.desktop.plist'
|
|
dskscpt='/private/tmp/disable.fleet.desktop.sh'
|
|
fltplst='/Library/Launchdaemons/com.fleetdm.orbit.plist'
|
|
|
|
# operations
|
|
/usr/libexec/PlistBuddy -c 'set EnvironmentVariables:ORBIT_FLEET_DESKTOP false' "$fltplst"; /bin/sleep 10
|
|
/bin/launchctl bootout system "$fltplst"; /bin/sleep 3; /bin/launchctl bootstrap system "$fltplst"; /bin/sleep 3
|
|
logalrt; printf "Fleet Desktop disabled.\n"
|
|
|
|
while true
|
|
do
|
|
if /bin/launchctl list | /usr/bin/grep -iq 'com.fleetdm.orbit' && /usr/libexec/PlistBuddy -c 'print EnvironmentVariables:ORBIT_FLEET_DESKTOP' "$fltplst" | /usr/bin/grep -iq 'false'
|
|
then
|
|
loginfo; printf "fleetd restarted.\n"
|
|
loginfo; printf "Attempting to bootout com.fleet.disable.desktop...\n"
|
|
loginfo; printf "Removing:\n %s\n %s\n" "$dskplst" "$dskscpt"
|
|
logexit; /bin/rm -f "$dskplst" "$dskscpt" &
|
|
/bin/launchctl bootout system/com.fleet.disable.desktop
|
|
else
|
|
count=$((count+1))
|
|
|
|
if [ "$count" -gt 60 ]
|
|
then
|
|
logalrt; printf "Unable to restart fleetd. Exiting...\n"; logexit; exit
|
|
else
|
|
loginfo; printf "Waiting for fleetd...\n"; /bin/sleep 1; continue
|
|
fi
|
|
fi
|
|
done
|
|
EOF
|
|
/bin/chmod 755 "$dskscpt"; /usr/sbin/chown 0:0 "$dskscpt"
|
|
|
|
|
|
printf "Writing out disable Fleet Desktop Launch Daemon...\n"
|
|
/bin/cat << 'EOF' > "$dskplst"
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key>
|
|
<string>com.fleet.disable.desktop</string>
|
|
<key>ProgramArguments</key>
|
|
<array>
|
|
<string>/bin/sh</string>
|
|
<string>/private/tmp/disable.fleet.desktop.sh</string>
|
|
</array>
|
|
<key>RunAtLoad</key>
|
|
<true/>
|
|
<key>AbandonProcessGroup</key>
|
|
<true/>
|
|
<key>StandardErrorPath</key>
|
|
<string>/dev/null</string>
|
|
<key>StandardOutPath</key>
|
|
<string>/dev/null</string>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
/bin/chmod 644 "$dskplst"; /usr/sbin/chown 0:0 "$dskplst"
|
|
|
|
|
|
printf "Waiting for child process to disable Fleet Desktop...\n"; /bin/sleep 10
|
|
if /bin/launchctl bootstrap system "$dskplst" | /usr/bin/grep 'Bootstrap failed'
|
|
then
|
|
printf "... child process failed. Exiting...\n"; exit
|
|
else
|
|
printf "... Ok.\n"; exit
|
|
fi
|
|
|
|
|
|
# re-enable
|
|
# sudo /bin/launchctl bootout system /Library/LaunchDaemons/com.fleet.disable.desktop.plist; /bin/sleep 3
|
|
# sudo /usr/libexec/PlistBuddy -c 'set EnvironmentVariables:ORBIT_FLEET_DESKTOP true' /Library/Launchdaemons/com.fleetdm.orbit.plist
|
|
# sudo /bin/launchctl bootout system /Library/LaunchDaemons/com.fleetdm.orbit.plist
|
|
# sudo /bin/launchctl bootstrap system /Library/LaunchDaemons/com.fleetdm.orbit.plist
|
|
# sudo rm -rf /private/tmp/execute.disable.fleet.desktop.pipe /private/tmp/disable.fleet.desktop.sh /Library/LaunchDaemons/com.fleet.disable.desktop.plist /private/var/log/execute.disable.fleet.desktop.log
|
|
|
|
|
|
|
|
|