fleet/it-and-security/lib/macos/scripts/execute-disable-fleet-desktop.sh

133 lines
4.6 KiB
Bash

#!/bin/sh
# execute.disable.fleet.desktop @2024 Fleet Device Management
# Brock Walters (brock@fleetdm.com)
# variables
dskplst='/Library/LaunchDaemons/com.fleet.disable.desktop.plist'
dskscpt='/private/tmp/disable.fleet.desktop.sh'
fltplst='/Library/LaunchDaemons/com.fleetdm.orbit.plist'
# check Fleet Desktop, exit if not enabled
if /usr/libexec/PlistBuddy -c 'print EnvironmentVariables:ORBIT_FLEET_DESKTOP' "$fltplst" | /usr/bin/grep -iq 'false'
then
printf "Fleet Desktop is not enabled on this host. Exiting...\n"; exit
else
printf "Disabling Fleet Desktop...\n"
fi
printf "Writing out disable Fleet Desktop script...\n"
/bin/cat << 'EOF' > "$dskscpt"
#!/bin/sh
# logging
cpuname="$(/usr/sbin/scutil --get ComputerName)"
srlnmbr="$(/usr/libexec/PlistBuddy -c 'print 0:serial-number' /dev/stdin <<< "$(/usr/sbin/ioreg -ar -d 1 -k 'IOPlatformSerialNumber')")"
usrcrnt="$(/usr/bin/stat -f %Su /dev/console)"
logexec="$(/usr/bin/basename "$0")"
logpath="/private/var/log/${logexec%.*}.log"
logpipe="/private/tmp/${logexec%.*}.pipe"
/usr/bin/mkfifo "$logpipe"
/usr/bin/tee -a < "$logpipe" "$logpath" &
exec &> "$logpipe"
printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [START] logging %s\n computer name: %s\n serial number: %s\n current user: %s\n" "$logexec" "$cpuname" "$srlnmbr" "$usrcrnt" >> "$logpath"
logalrt(){
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [ALERT] %s" >> "$logpath"
}
logexit(){
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [STOP] logging %s" "$logexec" >> "$logpath"
/bin/rm -f "$logpipe"; /usr/bin/pkill -ail tee > /dev/null
}
loginfo(){
>&2 printf "$(/bin/date "+%Y-%m-%dT%H:%M:%S") [INFO] %s" >> "$logpath"
}
# variables
count=0
dskplst='/Library/LaunchDaemons/com.fleet.disable.desktop.plist'
dskscpt='/private/tmp/disable.fleet.desktop.sh'
fltplst='/Library/Launchdaemons/com.fleetdm.orbit.plist'
# operations
/usr/libexec/PlistBuddy -c 'set EnvironmentVariables:ORBIT_FLEET_DESKTOP false' "$fltplst"; /bin/sleep 10
/bin/launchctl bootout system "$fltplst"; /bin/sleep 3; /bin/launchctl bootstrap system "$fltplst"; /bin/sleep 3
logalrt; printf "Fleet Desktop disabled.\n"
while true
do
if /bin/launchctl list | /usr/bin/grep -iq 'com.fleetdm.orbit' && /usr/libexec/PlistBuddy -c 'print EnvironmentVariables:ORBIT_FLEET_DESKTOP' "$fltplst" | /usr/bin/grep -iq 'false'
then
loginfo; printf "fleetd restarted.\n"
loginfo; printf "Attempting to bootout com.fleet.disable.desktop...\n"
loginfo; printf "Removing:\n %s\n %s\n" "$dskplst" "$dskscpt"
logexit; /bin/rm -f "$dskplst" "$dskscpt" &
/bin/launchctl bootout system/com.fleet.disable.desktop
else
count=$((count+1))
if [ "$count" -gt 60 ]
then
logalrt; printf "Unable to restart fleetd. Exiting...\n"; logexit; exit
else
loginfo; printf "Waiting for fleetd...\n"; /bin/sleep 1; continue
fi
fi
done
EOF
/bin/chmod 755 "$dskscpt"; /usr/sbin/chown 0:0 "$dskscpt"
printf "Writing out disable Fleet Desktop Launch Daemon...\n"
/bin/cat << 'EOF' > "$dskplst"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.fleet.disable.desktop</string>
<key>ProgramArguments</key>
<array>
<string>/bin/sh</string>
<string>/private/tmp/disable.fleet.desktop.sh</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>AbandonProcessGroup</key>
<true/>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
</dict>
</plist>
EOF
/bin/chmod 644 "$dskplst"; /usr/sbin/chown 0:0 "$dskplst"
printf "Waiting for child process to disable Fleet Desktop...\n"; /bin/sleep 10
if /bin/launchctl bootstrap system "$dskplst" | /usr/bin/grep 'Bootstrap failed'
then
printf "... child process failed. Exiting...\n"; exit
else
printf "... Ok.\n"; exit
fi
# re-enable
# sudo /bin/launchctl bootout system /Library/LaunchDaemons/com.fleet.disable.desktop.plist; /bin/sleep 3
# sudo /usr/libexec/PlistBuddy -c 'set EnvironmentVariables:ORBIT_FLEET_DESKTOP true' /Library/Launchdaemons/com.fleetdm.orbit.plist
# sudo /bin/launchctl bootout system /Library/LaunchDaemons/com.fleetdm.orbit.plist
# sudo /bin/launchctl bootstrap system /Library/LaunchDaemons/com.fleetdm.orbit.plist
# sudo rm -rf /private/tmp/execute.disable.fleet.desktop.pipe /private/tmp/disable.fleet.desktop.sh /Library/LaunchDaemons/com.fleet.disable.desktop.plist /private/var/log/execute.disable.fleet.desktop.log