CalvinBackup/apple-device-management-mdm
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-14 15:50:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Seed5

Browse Source
This commit is contained in:
Cyrus Daboo
2026-08-12 10:12:50 -04:00
parent 97a11a861f
commit 61449b07e2
50 changed files with 992 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
declarative/declarations/configurations/accessibility.settings.yaml
+50
View File
@@ -0,0 +1,50 @@
title: Accessibility Settings
description: The declaration to configure accessibility settings.
payload:
declarationtype: com.apple.configuration.accessibility.settings
supportedOS:
iOS:
introduced: '27.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
sharedipad:
allowed-scopes: []
macOS:
introduced: '27.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
- user
tvOS:
introduced: n/a
visionOS:
introduced: '27.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
watchOS:
introduced: n/a
apply: combined
payloadkeys:
- key: Vision
title: Vision
type: <dictionary>
presence: optional
content: If present, configures vision accessibility settings.
subkeys:
- key: AllowLiveRecognition
title: Allow live recognition
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If `false`, disables the Live Recognition accessibility feature.
examples:
- title: Configuration example
files:
- description: This configuration prevents the use of Live Recognition.
file: examples/declarative/declarations/configurations/accessibility.settings/example1.json
declarative/declarations/configurations/account.exchange.yaml
+32 -25
View File
@@ -87,7 +87,7 @@ payloadkeys:
type: <integer>
presence: optional
content: The port number of the EWS server. The system uses this only when this
declaration has a `HostName` value.
declaration has a `HostName` value. Applicable for "EWS" only.
- key: Path
title: Server path
supportedOS:
@@ -98,7 +98,7 @@ payloadkeys:
type: <string>
presence: optional
content: The path of the EWS server. The system uses this only when this declaration
has a `HostName` value.
has a `HostName` value. Applicable for "EWS" only.
- key: ExternalHostName
title: Server external host name
supportedOS:
@@ -108,7 +108,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The external hostname of the EWS server (or IP address).
content: The external hostname of the EWS server (or IP address). Applicable for
"EWS" only.
- key: ExternalPort
title: Server external port
supportedOS:
@@ -119,7 +120,7 @@ payloadkeys:
type: <integer>
presence: optional
content: The external port number of the EWS server. The system uses this only when
this declaration has a `ExternalHostName` value.
this declaration has an `ExternalHostName` value. Applicable for "EWS" only.
- key: External Path
title: Server external path
supportedOS:
@@ -130,7 +131,7 @@ payloadkeys:
type: <string>
presence: optional
content: The external path of the EWS server. The system uses this only when this
declaration has a `ExternalHostName` value.
declaration has an `ExternalHostName` value. Applicable for "EWS" only.
- key: OAuth
title: Controls use of OAuth
type: <dictionary>
@@ -158,7 +159,7 @@ payloadkeys:
type: <string>
presence: optional
content: The URL that this account uses for token requests with OAuth. The system
ignores this value unless `Enabled` is `true`.
ignores this value unless `Enabled` is `true`. Applicable for "EAS" only.
- key: AuthenticationCredentialsAssetReference
title: Authentication credentials asset reference
type: <string>
@@ -187,19 +188,20 @@ payloadkeys:
introduced: n/a
type: <dictionary>
presence: optional
content: Settings for S/MIME.
content: Settings for S/MIME. Applicable for "EAS" only.
subkeys:
- key: Signing
title: S/MIME signing settings
type: <dictionary>
presence: optional
content: Settings for S/MIME signing.
content: Settings for S/MIME signing. Applicable for "EAS" only.
subkeys:
- key: Enabled
title: Signing enabled
type: <boolean>
presence: required
content: If `true`, the system enables S/MIME signing.
content: If `true`, the system enables S/MIME signing. Applicable for "EAS"
only.
- key: IdentityAssetReference
title: S/MIME signing identity asset reference
type: <string>
@@ -208,32 +210,36 @@ payloadkeys:
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME signing of messages sent from this account.
content: The identifier of an asset declaration containing the identity required
for S/MIME signing of messages sent from this account. Applicable for "EAS"
only.
- key: UserOverrideable
title: Signing user overrideable
type: <boolean>
presence: optional
default: false
content: If `true`, the user can turn S/MIME signing on or off in Settings.
Applicable for "EAS" only.
- key: IdentityUserOverrideable
title: Signing identity user overrideable
type: <boolean>
presence: optional
default: false
content: If `true`, the user can select an S/MIME signing identity in Settings.
Applicable for "EAS" only.
- key: Encryption
title: S/MIME encryption settings
type: <dictionary>
presence: optional
content: Settings for S/MIME encryption.
content: Settings for S/MIME encryption. Applicable for "EAS" only.
subkeys:
- key: Enabled
title: Encryption by default enabled
type: <boolean>
presence: required
content: If `true`, the system enables S/MIME encryption by default, which the
user can't override if `PerMessageSwitchEnabled` is `false`.
user can't override if `PerMessageSwitchEnabled` is `false`. Applicable for
"EAS" only.
- key: IdentityAssetReference
title: S/MIME encryption identity asset reference
type: <string>
@@ -242,31 +248,32 @@ payloadkeys:
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME encryption. The system attaches the public certificate
to outgoing mail to allow the user to receive encrypted mail. When the user
sends encrypted mail, the system uses the public certificate to encrypt the
copy of the mail in their Sent mailbox.
content: The identifier of an asset declaration containing the identity required
for S/MIME encryption. The system attaches the public certificate to outgoing
mail to allow the user to receive encrypted mail. When the user sends encrypted
mail, the system uses the public certificate to encrypt the copy of the mail
in their Sent mailbox. Applicable for "EAS" only.
- key: UserOverrideable
title: Encryption by default user overrideable
type: <boolean>
presence: optional
default: false
content: If `true`, the user can turn S/MIME encryption by default on or off
in Settings.
in Settings. Applicable for "EAS" only.
- key: IdentityUserOverrideable
title: Encryption identity user overrideable
type: <boolean>
presence: optional
default: false
content: If `true`, the user can select an S/MIME signing identity in Settings.
Applicable for "EAS" only.
- key: PerMessageSwitchEnabled
title: Per message switch enabled
type: <boolean>
presence: optional
default: false
content: If `true`, the system enables the per-message encryption switch in
the compose view.
the compose view. Applicable for "EAS" only.
- key: MailServiceActive
title: Mail service active
type: <boolean>
@@ -282,7 +289,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system prevents the user from changing the status of the
mail service for this account.
mail service for this account. Applicable for "EAS" only.
- key: ContactsServiceActive
title: Contacts service active
type: <boolean>
@@ -298,7 +305,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system prevents the user from changing the status of the
address book service for this account.
address book service for this account. Applicable for "EAS" only.
- key: CalendarServiceActive
title: Calendar service active
type: <boolean>
@@ -314,7 +321,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system prevents the user from changing the status of the
calendar service for this account.
calendar service for this account. Applicable for "EAS" only.
- key: RemindersServiceActive
title: Reminders service active
type: <boolean>
@@ -330,7 +337,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system prevents the user from changing the status of the
reminders service for this account.
reminders service for this account. Applicable for "EAS" only.
- key: NotesServiceActive
title: Notes service active
type: <boolean>
@@ -346,7 +353,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system prevents the user from changing the status of the
notes service for this account.
notes service for this account. Applicable for "EAS" only.
related-status-items:
- status-items:
- account.list.exchange
declarative/declarations/configurations/app.managed.yaml
-21
View File
@@ -140,27 +140,6 @@ payloadkeys:
- `User`: The app has a user license.
This key needs to be present for App Store apps, when either `AppStoreID` or `BundleID` are present in the configuration.
- key: VPPType
title: VPP type
supportedOS:
iOS:
removed: '18.0'
macOS:
introduced: n/a
visionOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
- Device
- User
content: |-
The type of VPP license that the app uses for installation through the App Store, which is one of the following values:
- `Device`: The app has a VPP device license.
- `User`: The app has a VPP user license.
This key needs to be present to install an app through the App Store.
- key: Version
title: Version
supportedOS:
declarative/declarations/configurations/app.settings.yaml
+55 -3
View File
@@ -108,7 +108,7 @@ payloadkeys:
title: Code directory hash
type: <string>
presence: optional
content: The code signature code directory hash of the binary.
content: The 40 character code signature code directory hash of the binary.
- key: SigningID
title: Signing ID
type: <string>
@@ -118,7 +118,7 @@ payloadkeys:
title: Team ID
type: <string>
presence: optional
content: The code signature team identifier of the binary. Use the value "*APPLE*"
content: The code signature team identifier of the binary. Use the value "\*APPLE\*"
instead of an empty string for Apple binaries with an empty team identifier.
- key: PathPrefix
title: Path prefix
@@ -202,7 +202,7 @@ payloadkeys:
In iOS, the app identifier is a bundle ID, for example, "com.example.app".
In macOS, the app identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID", "Bundle-ID (Team-ID)", or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the app. "Team-ID" is the team identifier from the app's code signature. "Designated-Requirement" is the designated requirement string from the code signature of the app. For example, "com.example.app" for the bundle ID format, "com.example.app (ABCD1234)" for the team ID format, or "com.example.app {anchor apple generic}" for the designated requirement format. The device only applies defaults for an app if its code signature matches the composed identifier.
In macOS, the app identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the app. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the app. For example, "com.example.app {anchor apple generic}". The device only applies defaults for an app if its code signature matches the composed identifier.
subkeys:
- key: ANY
type: <dictionary>
@@ -359,3 +359,55 @@ examples:
description: This configuration sets various privacy permission defaults for several
apps.
file: examples/declarative/declarations/configurations/app.settings/example2.json
- title: App settings allowlist examples
files:
- tab: Allow apps by code directory hash
description: This configuration allows an app with a specific code directory hash
to run on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-cdhash-base-allowlist-only.json
- tab: Allow apps by team ID
description: This configuration allows any app with a specific team ID to run
on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-team-id-base-allowlist-only.json
- tab: Complex rules in an allowlist
description: This configuration allows any app that matches a set of complex rules
to run on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-complex-allowlist-only.json
- title: App settings denylist examples
files:
- tab: Deny apps by code directory hash
description: This configuration prevents an app with a specific code directory
hash from running on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-cdhash-base-denylist-only.json
- tab: Deny apps by team ID
description: This configuration prevents any app with a specific team ID from
running on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-team-id-base-denylist-only.json
- tab: Deny apps by signing ID
description: This configuration prevents any app with a specific signing ID from
running on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-signing-id-base-denylist-only.json
- tab: Complex rules in a denylist
description: This configuration prevents any app that matches a set of complex
rules from running on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-complex-denylist-only.json
- title: App settings allowlist and denylist examples
files:
- tab: Combine allowlist and denylist rules
description: This configuration allows one set of apps to run, and prevents ome
other apps that would otherwise be allowed from running.
file: examples/declarative/declarations/configurations/app.settings/alr-denylist-and-allowlist-rules.json
- title: App settings managed apps examples
files:
- tab: Always allow managed apps
description: This configuration always allows all managed apps and one other app
to run on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-single-rule-always-allow-managed-apps.json
- title: App settings WebClips examples
files:
- tab: Allow WebClips on macOS
description: This configuration allows only WebClips to be run on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-allow-webclips.json
- tab: Deny WebClips on macOS
description: This configuration prevents all WebClips from running on macOS.
file: examples/declarative/declarations/configurations/app.settings/alr-deny-webclips.json
declarative/declarations/configurations/intelligence.settings.yaml
+21 -1
View File
@@ -73,9 +73,26 @@ payloadkeys:
default: true
combinetype: boolean-and
content: If `false`, disables Personalized Handwriting Results.
- key: AllowVisualIntelligence
title: Allow Visual Intelligence
supportedOS:
iOS:
introduced: '27.0'
macOS:
introduced: '27.0'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If `false`, disables Visual Intelligence.
- key: AllowVisualIntelligenceSummary
title: Allow Visual Intelligence Summary
supportedOS:
iOS:
introduced: '26.4'
deprecated: '27.0'
macOS:
introduced: n/a
visionOS:
@@ -84,7 +101,10 @@ payloadkeys:
presence: optional
default: true
combinetype: boolean-and
content: If `false`, disables Visual Intelligence Summary.
content: |-
If `false`, disables Visual Intelligence Summary.
Deprecated: use the `AllowVisualIntelligence` key.
- key: AllowWritingTools
title: Allow Writing Tools
type: <boolean>
declarative/declarations/configurations/math.settings.yaml
+8
View File
@@ -43,6 +43,7 @@ payloadkeys:
title: Add square root
type: <boolean>
presence: required
default: false
combinetype: boolean-or
content: Add the square root button to the basic calculator by replacing the
+/- button. Normally, the square root button is available in scientific mode,
@@ -58,6 +59,7 @@ payloadkeys:
title: Enabled
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: ProgrammerMode
@@ -74,6 +76,7 @@ payloadkeys:
title: Enabled
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: MathNotesMode
@@ -87,6 +90,7 @@ payloadkeys:
title: Enabled
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: InputModes
@@ -100,6 +104,7 @@ payloadkeys:
title: Unit conversion
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Configures whether unit conversions are enabled.
- key: RPN
@@ -109,6 +114,7 @@ payloadkeys:
introduced: n/a
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Configures whether RPN input is enabled.
- key: SystemBehavior
@@ -121,6 +127,7 @@ payloadkeys:
title: Keyboard suggestions
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Controls whether keyboard suggestions include math solutions. This key
is also supported by the keyboard.settings configuration.
@@ -128,6 +135,7 @@ payloadkeys:
title: Math notes
type: <boolean>
presence: required
default: true
combinetype: boolean-and
content: Controls whether Math Notes is allowed in other apps such as Notes.
examples:
declarative/declarations/configurations/network.dns-proxy.yaml
+1 -1
View File
@@ -55,7 +55,7 @@ payloadkeys:
In iOS and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
- key: ProviderConfiguration
title: Provider configuration
type: <dictionary>
declarative/declarations/configurations/network.dns-settings.yaml
+3 -3
View File
@@ -104,7 +104,7 @@ payloadkeys:
content: |-
A list of domain strings used to determine which DNS queries use the DNS server. If not set, all domains use the DNS server.
The system supports a single wildcard (`*`) prefix, but it's not required. For example, both `*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
The system supports a single wildcard (`\*`) prefix, but it's not required. For example, both `\*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
subkeys:
- key: SupplementalMatchDomainsElement
title: Supplemental match domains element
@@ -179,7 +179,7 @@ payloadkeys:
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a single wildcard (`*`) prefix, but it's not required. For example, both `*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
The system supports a single wildcard (`\*`) prefix, but it's not required. For example, both `\*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
subkeys:
- key: DNSDomainMatchElement
title: DNS domain match element
@@ -191,7 +191,7 @@ payloadkeys:
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the 17.0.0.0/8 subnet.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the 17.0.0.0/8 subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS server address match element
declarative/declarations/configurations/network.relay.yaml
+7 -4
View File
@@ -9,18 +9,20 @@ payload:
- supervised
- device
- user
- local
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- user
- system
macOS:
introduced: '27.0'
allowed-enrollments:
- supervised
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: n/a
visionOS:
@@ -29,6 +31,7 @@ payload:
- supervised
- device
- user
- local
allowed-scopes:
- system
watchOS:
@@ -80,8 +83,8 @@ payloadkeys:
type: <string>
presence: required
content: The HTTP header field value for the corresponding header field name.
- key: CredentialAssetReference
title: Credential asset reference
- key: IdentityAssetReference
title: Identity asset reference
type: <string>
assettypes:
- com.apple.asset.credential.identity
declarative/declarations/configurations/network.vpn.always-on.yaml
+3 -3
View File
@@ -229,7 +229,7 @@ payloadkeys:
content: |-
In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID", "Bundle-ID (Team-ID)", or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Team-ID" is the team identifier from the provider's code signature. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, "com.example.app (ABCD1234)" for the team ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID", "Bundle-ID (Team-ID)", or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Team-ID" is the team identifier from the provider's code signature. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app" for the bundle ID format, "com.example.app (ABCD1234)" for the team ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
- key: Idle
title: Disconnect on idle settings.
type: <dictionary>
@@ -378,7 +378,7 @@ payloadkeys:
presence: optional
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
subkeys:
- key: DNSDomainMatchElement
title: DNS domain match element
@@ -389,7 +389,7 @@ payloadkeys:
presence: optional
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS server address match element
declarative/declarations/configurations/network.vpn.ikev2.yaml
+3 -3
View File
@@ -200,7 +200,7 @@ payloadkeys:
content: |-
In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
- key: NetworkRouting
title: Network routing details
supportedOS:
@@ -409,7 +409,7 @@ payloadkeys:
presence: optional
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
subkeys:
- key: DNSDomainMatchElement
title: DNS domain match element
@@ -420,7 +420,7 @@ payloadkeys:
presence: optional
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS server address match element
declarative/declarations/configurations/network.vpn.ipsec.yaml
+2 -2
View File
@@ -259,7 +259,7 @@ payloadkeys:
presence: optional
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
subkeys:
- key: DNSDomainMatchElement
title: DNS domain match element
@@ -270,7 +270,7 @@ payloadkeys:
presence: optional
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS server address match element
declarative/declarations/configurations/network.vpn.vpn-plugin.yaml
+3 -3
View File
@@ -158,7 +158,7 @@ payloadkeys:
In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.
- key: NetworkRouting
title: Network routing details
supportedOS:
@@ -350,7 +350,7 @@ payloadkeys:
presence: optional
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
subkeys:
- key: DNSDomainMatchElement
title: DNS domain match element
@@ -361,7 +361,7 @@ payloadkeys:
presence: optional
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS server address match element
declarative/declarations/configurations/safari.extensions.settings.yaml
+3 -3
View File
@@ -35,7 +35,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: |-
The dictionary of managed extensions settings. Each key in the dictionary represents a composed identifier for a specific managed extension, or you can specify a single "*" character to match any extension. The dictionary values represent the settings that Safari applies to each extension that matches the key. In order for the extension to be managed, its host app needs to be present on the device.
The dictionary of managed extensions settings. Each key in the dictionary represents a composed identifier for a specific managed extension, or you can specify a single "\*" character to match any extension. The dictionary values represent the settings that Safari applies to each extension that matches the key. In order for the extension to be managed, its host app needs to be present on the device.
The composed identifier of a managed extension uses the format "Identifier (TeamIdentifier)", for example "com.example.app (ABCD1234)". Use `codesign -dv <path_to_appex>` to show the information you need to generate this string on macOS, using the path to the extension bundle located in the "PlugIns" folder inside the app bundle. For other platforms, request this information from the app developer.
subkeys:
@@ -57,7 +57,7 @@ payloadkeys:
- AlwaysOff
combinetype: enum-last
content: |-
Controls whether an extension is allowed. The device uses this key when the extension identifier is a composed identifier or a single "*" character.
Controls whether an extension is allowed. The device uses this key when the extension identifier is a composed identifier or a single "\*" character.
* `Allowed` - The user is allowed to turn the extension on or off.
* `AlwaysOn` - The extension will always be on.
* `AlwaysOff` - The extension will always be off.
@@ -71,7 +71,7 @@ payloadkeys:
- AlwaysOff
combinetype: enum-last
content: |-
Controls whether an extension is allowed in Private Browsing. The device uses this key when the extension identifier is a composed identifier or a single "*" character.
Controls whether an extension is allowed in Private Browsing. The device uses this key when the extension identifier is a composed identifier or a single "\*" character.
* `Allowed` - The user is allowed to turn the extension on or off in Private Browsing.
* `AlwaysOn` - The extension will always be on in Private Browsing if the extension is on outside of Private Browsing.
* `AlwaysOff` - The extension will never be on in Private Browsing.
declarative/declarations/configurations/safari.settings.yaml
+1 -1
View File
@@ -214,7 +214,7 @@ payloadkeys:
- A specific domain such as "example.com" or "www.example.com". The permission defaults apply to that website only.
- A wildcard domain that uses a single "\*" character as a prefix for the domain, such as "\*example.com". The permission defaults apply to both the exact domain "example.com", and any sub-domains such as "www.example.com". It won't match other domains with a similar string suffix such as "myexample.com".
When multiple patterns match a website, Safari uses the most precise pattern. For example, for the website "www.example.com", if rules "www.example.com" and "*example.com" match, Safari uses the former.
When multiple patterns match a website, Safari uses the most precise pattern. For example, for the website "www.example.com", if rules "www.example.com" and "\*example.com" match, Safari uses the former.
subkeys:
- key: ANY
type: <dictionary>
declarative/declarations/configurations/webcontent-filter.plugin.yaml
+3 -3
View File
@@ -162,7 +162,7 @@ payloadkeys:
In iOS and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app {anchor apple generic}".
- key: Packets
title: Packet filter details
supportedOS:
@@ -187,7 +187,7 @@ payloadkeys:
content: |-
The packet provider identifier. This string identifies the filter data provider when the filter starts running. Required when Enabled is true.
The identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
The identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app {anchor apple generic}".
- key: URLs
title: URL filter details
supportedOS:
@@ -219,7 +219,7 @@ payloadkeys:
In iOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string the device uses to match the code signature of the provider. For example, "com.example.app {anchor apple generic}".
- key: PIR
title: Private information retrieval server settings.
type: <dictionary>