mirror of
https://github.com/apple/device-management.git
synced 2026-08-13 12:00:21 +02:00
70 lines
2.4 KiB
YAML
70 lines
2.4 KiB
YAML
title: System Policy Rule
|
|
description: The payload that configures the system policy.
|
|
payload:
|
|
payloadtype: com.apple.systempolicy.rule
|
|
supportedOS:
|
|
iOS:
|
|
introduced: n/a
|
|
macOS:
|
|
introduced: '10.8'
|
|
multiple: true
|
|
devicechannel: true
|
|
userchannel: false
|
|
requiresdep: false
|
|
userapprovedmdm: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: forbidden
|
|
tvOS:
|
|
introduced: n/a
|
|
visionOS:
|
|
introduced: n/a
|
|
watchOS:
|
|
introduced: n/a
|
|
content: This payload allows control over Gatekeeper's system policy rules. The
|
|
keys and functionality are tightly related to the spctl command line tool. For
|
|
more information, see the manual page for spctl.
|
|
payloadkeys:
|
|
- key: Requirement
|
|
type: <string>
|
|
presence: optional
|
|
content: The policy requirement. This key must follow the syntax described in [Code
|
|
Signing Requirement Language](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html#//apple_ref/doc/uid/TP40005929-CH5).
|
|
- key: Comment
|
|
type: <string>
|
|
presence: optional
|
|
content: This string appears in the System Policy UI. If it's missing, the device
|
|
enters `PayloadDisplayName` or `PayloadDescription` into this field before adding
|
|
the rule to the System Policy database.
|
|
- key: Priority
|
|
type: <real>
|
|
presence: optional
|
|
content: The rule's priority.
|
|
- key: Expiration
|
|
type: <date>
|
|
presence: optional
|
|
content: The expiration date for rules being processed.
|
|
- key: OperationType
|
|
type: <string>
|
|
presence: optional
|
|
rangelist:
|
|
- operation:execute
|
|
- operation:install
|
|
- operation:lsopen
|
|
default: operation:execute
|
|
content: The type of operation.
|
|
- key: LeafCertificate
|
|
type: <data>
|
|
presence: optional
|
|
content: The single leaf certificate for the app that's in the allow list.
|
|
notes:
|
|
- title: ''
|
|
content: |-
|
|
This payload allows control over Gatekeeper's system policy rules. The keys and functionality are tightly related to the `spctl` command line tool. For more information, see the manual page for `spctl`.
|
|
|
|
This payload can only exist in a device profile. If the payload is present in a user profile, an error occurs during installation and the profile installation fails.
|
|
examples:
|
|
- title: Profile example
|
|
files:
|
|
- file: examples/mdm/profiles/com.apple.systempolicy.rule/example1.plist
|