mirror of
https://github.com/apple/device-management.git
synced 2026-08-14 12:30:23 +02:00
95 lines
4.3 KiB
YAML
95 lines
4.3 KiB
YAML
title: Services Configuration Files
|
|
description: The declaration to configure managed configuration files for services.
|
|
payload:
|
|
declarationtype: com.apple.configuration.services.configuration-files
|
|
supportedOS:
|
|
iOS:
|
|
introduced: n/a
|
|
macOS:
|
|
introduced: '14.0'
|
|
allowed-enrollments:
|
|
- supervised
|
|
allowed-scopes:
|
|
- system
|
|
tvOS:
|
|
introduced: n/a
|
|
visionOS:
|
|
introduced: n/a
|
|
watchOS:
|
|
introduced: n/a
|
|
apply: multiple
|
|
payloadkeys:
|
|
- key: ServiceType
|
|
title: Service type
|
|
type: <string>
|
|
presence: required
|
|
content: The identifier of the system service with managed configuration files.
|
|
Use a reverse DNS style for this identifier.
|
|
- key: DataAssetReference
|
|
title: Data asset reference
|
|
type: <string>
|
|
assettypes:
|
|
- com.apple.asset.data
|
|
asset-content-types:
|
|
- application/zip
|
|
presence: required
|
|
content: |-
|
|
The identifier of an asset declaration that contains a reference to the files to use for system service configuration. Ensure that the corresponding asset:
|
|
|
|
- Is of type `com.apple.asset.data`
|
|
- Is a zip archive of an entire directory
|
|
- Has a `Reference` key that includes the `ContentType` and `Hash-SHA-256` keys, which the system requires
|
|
|
|
The system expands the zip archive and stores the data in a well-known location for the service.
|
|
notes:
|
|
- title: ''
|
|
content: |-
|
|
The device stores the service configurations files from this configuration in a tamper-proof location. Built-in services use these files to override their default configurations.
|
|
|
|
The `DataAssetReference` refers to a zip archive that contains configuration files for a specific service. When the device applies the configuration, it downloads the asset data and expands the archive into a service-specific location. If the device updates a configuration, it downloads the new asset data and expands the data to replace what it previously installed. If the device deactivates or removes the configuration, it removes the configuration files from the service-specific directory.
|
|
|
|
All files in the expanded archive are set to -r--r--r-- unix file permissions. Any links in the archive will be restricted to referencing files within the service-specific location.
|
|
|
|
The following built-in system services use managed configuration files:
|
|
|
|
| ServiceType | Manages |
|
|
|---|---|
|
|
| com.apple.sshd | /etc/ssh |
|
|
| com.apple.sudo | /etc/sudoers |
|
|
| com.apple.pam | /etc/pam.d |
|
|
| com.apple.cups | /etc/cups |
|
|
| com.apple.apache.httpd | /etc/apache2 |
|
|
| com.apple.bash | /etc/profile |
|
|
| com.apple.zsh | /etc/zprofile |
|
|
| | /etc/zlogin |
|
|
| | /etc/zlogout |
|
|
| | /etc/zshenv |
|
|
| | /etc/zshrc |
|
|
| com.apple.cryptoTokenKit | /etc/SmartcardLogin.plist |
|
|
| com.apple.authorization | /Library/Security/ |
|
|
|
|
The files in the zip archive need to mirror the folder structure and configuration files that the service expects to be present starting at the root of the file system. The service uses only the files the declaration provides and ignores the ones in its default directories.
|
|
|
|
For example, a configuration with `ServiceType`: `com.apple.sshd` configures sshd to use the files that the `DataAssetReference` provides, instead of the files located at /etc/ssh. The corresponding zip archive needs to contain:
|
|
|
|
```
|
|
etc/
|
|
└ ssh/
|
|
├ moduli
|
|
├ ssh_config
|
|
├ ssh_config.d/
|
|
├ sshd_config
|
|
└ sshd_config.d/
|
|
└ 100-macos.conf
|
|
```
|
|
|
|
You can create an executable that uses service configuration files by calling the `mcf_service_path_for_service_type` method in the `libmanagedconfigurationfiles.dylib` system library. You pass in an identifier for your service type and the method returns the file system path for the directory that contains the corresponding service configuration files. Use those files to override the standard or default configuration the executable would otherwise use. See libmanagedconfigurationfiles.h in the macOS SDK for more detail.
|
|
|
|
> Important:
|
|
> The system reserves the `com.apple` prefix for built-in services.
|
|
examples:
|
|
- title: Configuration example
|
|
files:
|
|
- description: This configuration deploys configuration files for a system service.
|
|
file: examples/declarative/declarations/configurations/services.configuration-files/example1.json
|