Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Full support of secret variables in Apple configuration profiles #24925

Merged
merged 9 commits into from
Dec 20, 2024
Merged

Full support of secret variables in Apple configuration profiles #24925

merged 9 commits into from
Dec 20, 2024

Conversation

getvictor
Copy link
Member

@getvictor getvictor commented Dec 19, 2024 •
edited
Loading

For secrets subtask #24548

Fixed secret variables support in Apple configuration profiles.

Checklist for submitter

  • Added/updated tests
  • If database migrations are included, checked table schema to confirm autoupdate
  • For database migrations:
    • Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).
  • Manual QA for all new/changed functionality

@codecov Codecov
Copy link

codecov bot commented Dec 19, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 77.55102% with 44 lines in your changes missing coverage. Please review.

Project coverage is 63.58%. Comparing base (6979fc1) to head (ca8cbf6).
Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
server/mdm/nanomdm/service/nanomdm/service.go 70.58% 7 Missing and 3 partials ⚠️
.../tables/20241220100000_AddSubtypeToNanoCommands.go 57.89% 6 Missing and 2 partials ⚠️
server/service/apple_mdm.go 75.00% 4 Missing and 2 partials ⚠️
server/mdm/apple/commander.go 81.81% 3 Missing and 1 partial ⚠️
server/mdm/nanomdm/storage/file/queue.go 66.66% 3 Missing and 1 partial ⚠️
server/service/mdm.go 92.15% 2 Missing and 2 partials ⚠️
...ver/datastore/mysql/migrations/tables/migration.go 76.92% 2 Missing and 1 partial ⚠️
server/mdm/nanomdm/storage/allmulti/queue.go 0.00% 3 Missing ⚠️
cmd/fleet/serve.go 0.00% 1 Missing ⚠️
server/service/handler.go 66.66% 0 Missing and 1 partial ⚠️
Additional details and impacted files 
@@           Coverage Diff            @@
##             main   #24925    +/-   ##
========================================
  Coverage   63.57%   63.58%            
========================================
  Files        1605     1606     +1     
  Lines      152110   152219   +109     
  Branches     3914     3914            
========================================
+ Hits        96706    96785    +79     
- Misses      47706    47728    +22     
- Partials     7698     7706     +8
Flag Coverage Δ
backend 64.39% <77.55%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@getvictor getvictor force-pushed the victor/24548-secrets-in-config-profiles branch from fb6e5f0 to afad95c Compare December 19, 2024 22:37
@getvictor getvictor changed the title Work in progress Full support of secret variables in Apple configuration profiles Dec 20, 2024
@getvictor getvictor marked this pull request as ready for review December 20, 2024 15:37
@getvictor getvictor requested a review from a team as a code owner December 20, 2024 15:37
@getvictor getvictor force-pushed the victor/24548-secrets-in-config-profiles branch from 1d6631c to ca8cbf6 Compare December 20, 2024 20:38
gillespi314
gillespi314 approved these changes Dec 20, 2024
View reviewed changes
Copy link
Contributor

@gillespi314 gillespi314 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small nit and a more general question about encryption of payloads being sent to the device (not a blocker to merge but something we should clarify with product before we release, I think).

server/mdm/nanomdm/service/nanomdm/service.go
}
switch cmd.Subtype {
case mdm.CommandSubtypeProfileWithSecrets:
// Secrets were expanded above. Now we need to base64 encode and sign the configuration profile before returning it to the caller.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have we looked into encrypting the profile content here? Otherwise, I'm assuming we are ok for this iteration that unencrypted secrets might be accessible in transit or at rest on the device, for example, by a user running profiles in the terminal or via osquery macos_profiles table.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I brought up a similar issue with product.

Are you suggesting there is a way to prevent the device user from viewing profile contents. For example, from viewing the EnrollSecret in our Fleetd configuration profile?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it is possible to encrypt profiles. Here are the Apple docs.

server/service/integration_mdm_profiles_test.go
{Name: "N5", Contents: teamProfiles[1]},
{Name: "NS1", Contents: teamProfiles[2]},
}}
t.Logf("VICTOR: %s", string(teamProfiles[2]))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this log be removed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, will remove in next PR.

@getvictor getvictor merged commit ad6edec into main Dec 20, 2024
27 checks passed
@getvictor getvictor deleted the victor/24548-secrets-in-config-profiles branch December 20, 2024 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gillespi314 gillespi314 gillespi314 approved these changes

Assignees

@gillespi314 gillespi314

Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@getvictor @gillespi314 @dantecatalfamo