mirror of
https://github.com/apple/device-management.git
synced 2026-07-10 21:13:42 +02:00
Release-v26.1
This commit is contained in:
Cyrus Daboo
@@ -23,16 +23,8 @@ payloadkeys:
|
||||
title: Service Type
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The identifier of the system service with managed configuration files. Use a reverse DNS style for this identifier. However, the system reserves `com.apple.` prefix for built-in services. The available built-in services are:
|
||||
|
||||
- `com.apple.sshd` configures sshd
|
||||
- `com.apple.sudo` configures sudo
|
||||
- `com.apple.pam` configures PAM
|
||||
- `com.apple.cups` configures CUPS
|
||||
- `com.apple.apache.httpd` configures Apache httpd
|
||||
- `com.apple.bash` configures bash
|
||||
- `com.apple.zsh` configures zsh
|
||||
content: The identifier of the system service with managed configuration files.
|
||||
Use a reverse DNS style for this identifier.
|
||||
- key: DataAssetReference
|
||||
title: Data Asset Reference
|
||||
type: <string>
|
||||
@@ -49,3 +41,49 @@ payloadkeys:
|
||||
- Has a `Reference` key that includes the `ContentType` and `Hash-SHA-256` keys, which the system requires
|
||||
|
||||
The system expands the zip archive and stores the data in a well-known location for the service.
|
||||
notes:
|
||||
- title: ''
|
||||
content: |-
|
||||
The device stores the service configurations files from this configuration in a tamper-proof location. Built-in services use these files to override their default configurations.
|
||||
|
||||
The `DataAssetReference` refers to a zip archive that contains configuration files for a specific service. When the device applies the configuration, it downloads the asset data and expands the archive into a service-specific location. If the device updates a configuration, it downloads the new asset data and expands the data to replace what it previously installed. If the device deactivates or removes the configuration, it removes the configuration files from the service-specific directory.
|
||||
|
||||
All files in the expanded archive are set to -r--r--r-- unix file permissions. Any links in the archive will be restricted to referencing files within the service-specific location.
|
||||
|
||||
The following built-in system services use managed configuration files:
|
||||
|
||||
| ServiceType | Manages |
|
||||
|---|---|
|
||||
| com.apple.sshd | /etc/ssh |
|
||||
| com.apple.sudo | /etc/sudoers |
|
||||
| com.apple.pam | /etc/pam.d |
|
||||
| com.apple.cups | /etc/cups |
|
||||
| com.apple.apache.httpd | /etc/apache2 |
|
||||
| com.apple.bash | /etc/profile |
|
||||
| com.apple.zsh | /etc/zprofile |
|
||||
| | /etc/zlogin |
|
||||
| | /etc/zlogout |
|
||||
| | /etc/zshenv |
|
||||
| | /etc/zshrc |
|
||||
| com.apple.cryptoTokenKit | /etc/SmartcardLogin.plist |
|
||||
| com.apple.authorization | /Library/Security/ |
|
||||
|
||||
The files in the zip archive need to mirror the folder structure and configuration files that the service expects to be present starting at the root of the file system. The service uses only the files the declaration provides and ignores the ones in its default directories.
|
||||
|
||||
For example, a configuration with `ServiceType`: `com.apple.sshd` configures sshd to use the files that the `DataAssetReference` provides, instead of the files located at /etc/ssh. The corresponding zip archive needs to contain:
|
||||
|
||||
```
|
||||
etc/
|
||||
└ ssh/
|
||||
├ moduli
|
||||
├ ssh_config
|
||||
├ ssh_config.d/
|
||||
├ sshd_config
|
||||
└ sshd_config.d/
|
||||
└ 100-macos.conf
|
||||
```
|
||||
|
||||
You can create an executable that uses service configuration files by calling the `mcf_service_path_for_service_type` method in the `libmanagedconfigurationfiles.dylib` system library. You pass in an identifier for your service type and the method returns the file system path for the directory that contains the corresponding service configuration files. Use those files to override the standard or default configuration the executable would otherwise use. See libmanagedconfigurationfiles.h in the macOS SDK for more detail.
|
||||
|
||||
> Important:
|
||||
> The system reserves the `com.apple` prefix for built-in services.
|
||||
|
||||
@@ -61,8 +61,8 @@ payloadkeys:
|
||||
- supervised
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: This object configures the deferral of software updates. Rapid Security
|
||||
Responses aren't considered in `Major`, `Minor`, or `System` deferral mechanism.
|
||||
content: This object configures the deferral of software updates. Background Security
|
||||
Improvements aren't considered in `Major`, `Minor`, or `System` deferral mechanism.
|
||||
subkeys:
|
||||
- key: CombinedPeriodInDays
|
||||
title: Combined Major/Minor Update Deferral Period
|
||||
@@ -224,7 +224,7 @@ payloadkeys:
|
||||
- `AlwaysOn` - automatic installations are always enabled.
|
||||
- `AlwaysOff` - automatic installations are always disabled.
|
||||
- key: RapidSecurityResponse
|
||||
title: Rapid Security Response Settings
|
||||
title: Background Security Improvement Settings
|
||||
supportedOS:
|
||||
iOS:
|
||||
allowed-enrollments:
|
||||
@@ -235,29 +235,29 @@ payloadkeys:
|
||||
introduced: n/a
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: These configurations set user access to interacting with Rapid Security
|
||||
Responses (RSRs).
|
||||
content: These configurations set user access to interacting with Background Security
|
||||
Improvement.
|
||||
subkeys:
|
||||
- key: Enable
|
||||
title: Enable Rapid Security Response Installation
|
||||
title: Enable Background Security Improvement Installation
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
combinetype: boolean-and
|
||||
content: |-
|
||||
If set to `false`, Rapid Security Responses aren't offered for user installation. The system can still install Rapid Security Responses with `com.apple.configuration.softwareupdate.enforcement.specific` configurations.
|
||||
If set to `false`, Background Security Improvements aren't offered for user installation. The system can still install Background Security Improvements with `com.apple.configuration.softwareupdate.enforcement.specific` configurations.
|
||||
|
||||
If set to `true`, the system offers Rapid Security Responses to the user.
|
||||
If set to `true`, the system offers Background Security Improvements to the user.
|
||||
- key: EnableRollback
|
||||
title: Enable Rapid Security Response Rollbacks
|
||||
title: Enable Background Security Improvement Rollbacks
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
combinetype: boolean-and
|
||||
content: |-
|
||||
If set to `false`, the system doesn't offer Rapid Security Response rollbacks to the user.
|
||||
If set to `false`, the system doesn't offer Background Security Improvement rollbacks to the user.
|
||||
|
||||
If set to `true`, the system offers Rapid Security Response rollbacks to the user.
|
||||
If set to `true`, the system offers Background Security Improvement rollbacks to the user.
|
||||
- key: AllowStandardUserOSUpdates
|
||||
title: Allow Standard User OS Updates
|
||||
supportedOS:
|
||||
|
||||
@@ -54,5 +54,5 @@ payloadkeys:
|
||||
title: Status item value.
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The operating system's build and rapid security response versions in use
|
||||
on the device, for example, `20A123a` or `20B27c`.
|
||||
content: The operating system's build and Background Security Improvement versions
|
||||
in use on the device, for example, `20A123a` or `20B27c`.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
title: Status Device Operating System Supplemental Extra Version
|
||||
description: A status report of the device's operating system's rapid security response
|
||||
identifier.
|
||||
description: A status report of the device's operating system's Background Security
|
||||
Improvement identifier.
|
||||
payload:
|
||||
statusitemtype: device.operating-system.supplemental.extra-version
|
||||
supportedOS:
|
||||
@@ -55,5 +55,5 @@ payloadkeys:
|
||||
title: Status item value.
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The operating system's rapid security response version in use on the device,
|
||||
for example, `a`.
|
||||
content: The operating system's Background Security Improvement version in use on
|
||||
the device, for example, `a`.
|
||||
|
||||
@@ -48,14 +48,14 @@ payloadkeys:
|
||||
title: The OS version
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The OS version of the pending software update, including any rapid security
|
||||
response version. This string is empty if no update is pending.
|
||||
content: The OS version of the pending software update, including any Background
|
||||
Security Improvement version. This string is empty if no update is pending.
|
||||
- key: build-version
|
||||
title: The build version
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The build version of the pending software update, including any rapid
|
||||
security response version. This string is empty if no update is pending.
|
||||
content: The build version of the pending software update, including any Background
|
||||
Security Improvement version. This string is empty if no update is pending.
|
||||
- key: target-local-date-time
|
||||
title: The target local date-time
|
||||
type: <string>
|
||||
|
||||
Reference in New Issue
Block a user