Linux disk encryption: frontend changes, backend error on update DE setting with missing private key #23714

jacobshandling · 2024-11-12T02:55:06Z

Addresses #22702, #23713, #23756, and #23747

-Note that much of this code as is will render as expected only once integrated with the backend or if manipulated manually for testing purposes

Frontend:

Update banners on my device page, tests
Build new logic for calling endpoint to trigger linux key escrow on clicking Create key
Add CreateLinuxKeyModal to inform user of next steps after clicking Create key
Update banners on host details page, tests
Update the Controls > OS settings section with new logic related to linux disk encryption
Expect and include counts of Linux hosts in aggregate disk encryption stats UI
Add "Linux" column to the disk encryption table
Show disk encryption related UI for supported Linux platforms
- TODO: confirm platform string matching functionality in manual e2e testing
Expand capabilities of SectionHeader component, apply to new UI
Flash "missing private key" error, with clickable link, when trying to update disk encryption enabled while no server private key is present.
- TODO: QA this once other endpoints on Controls > Disk encryption are enabled even when MDM not turned on

-Other TODO:

Update Disk encryption key modal copy - awaiting product guidance on changes being for linux only or for all platforms
Confirm when integrated with API:
- Aggregate disk encryption counts
- Disk encryption table Linux column
- Show disk encryption key action on host details page when expected
- Opens Disk encryption key modal, displays key as expected

Backend:

For "No team" and teams, error when trying to update disk encryption enabled while no server private key is present.
Changes file added for user-visible changes in changes/
Added/updated tests
Manual QA for all new/changed functionality
- Full e2e testing to do when integrated with backend

* Add Linux column to Disk encryption table * Add "linux" to type for expected platforms with disk encryption * Widen capabilities of `SectionHeader` to include: * Vertically aligned title/subtitle * Optional grey subtitle text coloring

codecov · 2024-11-12T17:53:26Z

Codecov Report

Attention: Patch coverage is 57.69231% with 22 lines in your changes missing coverage. Please review.

Project coverage is 63.13%. Comparing base (59c85b6) to head (acc6e2d).
Report is 1 commits behind head on 22074-linux-encryption.

Files with missing lines	Patch %	Lines
...es/hosts/details/DeviceUserPage/DeviceUserPage.tsx	26.66%	11 Missing ⚠️
...erPage/CreateLinuxKeyModal/CreateLinuxKeyModal.tsx	33.33%	4 Missing ⚠️
frontend/services/entities/mdm.ts	0.00%	4 Missing ⚠️
frontend/utilities/endpoints.ts	0.00%	2 Missing ⚠️
...components/DeviceUserBanners/DeviceUserBanners.tsx	91.66%	1 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                     @@
##           22074-linux-encryption   #23714      +/-   ##
==========================================================
- Coverage                   63.14%   63.13%   -0.01%     
==========================================================
  Files                        1557     1558       +1     
  Lines                      147617   147653      +36     
  Branches                     3687     3742      +55     
==========================================================
+ Hits                        93212    93227      +15     
- Misses                      47033    47053      +20     
- Partials                     7372     7373       +1

Flag	Coverage Δ
frontend	`52.30% <57.69%> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

- Allows rendering of Disk Encryption section even when MDM is not enabled

…te key

mostlikelee · 2024-11-13T02:03:05Z

ee/server/service/teams.go

@@ -1523,6 +1523,9 @@ func unmarshalWithGlobalDefaults(b *json.RawMessage) (fleet.Features, error) {
 func (svc *Service) updateTeamMDMDiskEncryption(ctx context.Context, tm *fleet.Team, enable *bool) error {
 	var didUpdate, didUpdateMacOSDiskEncryption bool
 	if enable != nil {
+		if len(svc.config.Server.PrivateKey) == 0 {


more idiomatic to use == "" for string evaluation

I had the same thought, but this follows a pattern set by folks on MDM team, see here, here, and here. Think it's worth changing all of those?

After consulting with MDM, let's use == "" going forward, and update existing len-based checks as we come to them, no need to update now.

iansltx

Looked through this PR to get my bearings about this feature. Some of the questions have probably been answered elsewhere; thanks in advance for answering these for the Nth time.

iansltx · 2024-11-13T15:27:18Z

frontend/pages/hosts/details/DeviceUserPage/CreateLinuxKeyModal/CreateLinuxKeyModal.tsx

+          setup.
+        </li>
+        <li>
+          Close this window and select <b>Refetch</b> on your <b>My device</b>{" "}


@mostlikelee Can we force a refetch on Orbit when the passphrase is entered?

iansltx · 2024-11-13T15:29:42Z

frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx

@@ -353,14 +374,15 @@ const DeviceUserPage = ({
              mdmEnabledAndConfigured={
                !!globalConfig?.mdm.enabled_and_configured
              }
-              mdmConnectedToFleet={!!host.mdm.connected_to_fleet}
-              diskEncryptionStatus={
+              connectedToFleetMdm={!!host.mdm.connected_to_fleet}


Need to verify that this doesn't show up for Linux hosts as there isn't a concept of Linux MDM the same way there is for Mac/Win.

This should be testable now with a Linux host as nothing we're doing on the backend changes the fact that there's no Linux MDM.

This prop is only used in conjunction with (a) macDiskEncryptionStatus === "action_required" to determine whether to (b) showMacDiskEncryptionKeyResetRequired – since (a) should only be possible for darwin hosts, there shouldn't be any issue here.

Here's a clarifying rename that should make those relationships more clear.

Does that make sense or am I missing something?

Will, as noted, test all of this today

iansltx · 2024-11-13T15:41:02Z

frontend/services/entities/mdm.ts

        },
      });
    }
-    return sendRequest("PATCH", teamsEndpoint, {
+    return sendRequest("POST", teamsEndpoint, {


Why did this change?

Updating this call from using a deprecated endpoint to using the latest – see here

Actually looks like we can unify logic for which endpoint to hit here, as the new endpoint supports a nil team ID for editing no-team config, vs. needing to split between a team-specific endpoint and a no-team-specific endpoint. Does that match what you're seeing?

iansltx · 2024-11-13T15:41:31Z

frontend/services/entities/mdm.ts

-          // TODO: API INTEGRATION: remove macos_settings when API change is merged in.
-          macos_settings: { enable_disk_encryption: enableDiskEncryption },
-          // enable_disk_encryption: enableDiskEncryption,
+          enable_disk_encryption: enableDiskEncryption,


Is this supported on the backend, or does this tweak need to be built so we don't lose support for macOS?

Above should answer this question as well

(yes, it's supported 🙂)

…oint

jacobshandling · 2024-11-14T00:03:35Z

server/service/handler.go

@@ -706,8 +706,8 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC

 	// Deprecated: GET /mdm/profiles/summary is now deprecated, replaced by the
 	// GET /configuration_profiles/summary endpoint.
-	mdmAnyMW.GET("/api/_version_/fleet/mdm/profiles/summary", getMDMProfilesSummaryEndpoint, getMDMProfilesSummaryRequest{})
-	mdmAnyMW.GET("/api/_version_/fleet/configuration_profiles/summary", getMDMProfilesSummaryEndpoint, getMDMProfilesSummaryRequest{})


Jacob Shandling added 11 commits November 11, 2024 13:31

Implement logic tree for new host details banners

ec1f4d0

Consolidate props for host details and my device page banners

ca94b0e

My device page logic - some TODOs remain

262df78

Create key banner, modal, POST to trigger (needs finalizing)

97226f2

Merge branch 'main' into 22702-LUKS-frontend

ad6d1a5

update banners

598096a

update copy, add tooltips

f22e0e4

fix small bug

492e473

Remove unintended changes to handler.go

0788ac5

change file

9c8ba9e

jacobshandling temporarily deployed to Docker Hub November 12, 2024 02:55 — with GitHub Actions Inactive

fix test

572f974

jacobshandling temporarily deployed to Docker Hub November 12, 2024 17:50 — with GitHub Actions Inactive

jacobshandling changed the base branch from main to 22074-linux-encryption November 12, 2024 19:09

Move TurnOnMDMMessage from OSSettings down to CustomSettings

cbfca60

- Allows rendering of Disk Encryption section even when MDM is not enabled

jacobshandling temporarily deployed to Docker Hub November 12, 2024 22:21 — with GitHub Actions Inactive

Jacob Shandling added 4 commits November 12, 2024 15:36

flash 'missing private key' error

1557e1a

update enable disk encryption call to latest API structure

32613e5

No teams error - missing private key

1c25770

Update team-level update disk encryption call; team error if no priva…

2fd71c0

…te key

jacobshandling temporarily deployed to Docker Hub November 13, 2024 00:16 — with GitHub Actions Inactive

jacobshandling changed the title ~~UI – Linux disk encryption~~ Linux disk encryption: frontend changes, backend error on update DE setting with missing private key Nov 13, 2024

cleanup, update notes

adc2b41

jacobshandling temporarily deployed to Docker Hub November 13, 2024 00:42 — with GitHub Actions Inactive

jacobshandling assigned RachelElysia and mostlikelee Nov 13, 2024

jacobshandling marked this pull request as ready for review November 13, 2024 01:24

jacobshandling requested a review from a team as a code owner November 13, 2024 01:24

mostlikelee reviewed Nov 13, 2024

View reviewed changes

iansltx reviewed Nov 13, 2024

View reviewed changes

clarifying rename

f91266a

jacobshandling temporarily deployed to Docker Hub November 13, 2024 18:44 — with GitHub Actions Inactive

Don't require MDM to be enabled to fetch config profiles summary endp…

acc6e2d

…oint

iansltx temporarily deployed to Docker Hub November 13, 2024 23:21 — with GitHub Actions Inactive

jacobshandling commented Nov 14, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Linux disk encryption: frontend changes, backend error on update DE setting with missing private key #23714

Linux disk encryption: frontend changes, backend error on update DE setting with missing private key #23714

jacobshandling commented Nov 12, 2024 •

edited by iansltx

Loading

codecov bot commented Nov 12, 2024 •

edited

Loading

mostlikelee Nov 13, 2024

jacobshandling Nov 13, 2024 •

edited

Loading

jacobshandling Nov 13, 2024

iansltx left a comment

iansltx Nov 13, 2024

iansltx Nov 13, 2024

iansltx Nov 13, 2024

jacobshandling Nov 13, 2024 •

edited

Loading

jacobshandling Nov 13, 2024

iansltx Nov 13, 2024

jacobshandling Nov 13, 2024

iansltx Nov 13, 2024

jacobshandling Nov 13, 2024

iansltx Nov 13, 2024

jacobshandling Nov 13, 2024

jacobshandling Nov 13, 2024

jacobshandling Nov 14, 2024

Linux disk encryption: frontend changes, backend error on update DE setting with missing private key #23714

Are you sure you want to change the base?

Linux disk encryption: frontend changes, backend error on update DE setting with missing private key #23714

Conversation

jacobshandling commented Nov 12, 2024 • edited by iansltx Loading

Addresses #22702, #23713, #23756, and #23747

codecov bot commented Nov 12, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

jacobshandling Nov 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iansltx left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jacobshandling Nov 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jacobshandling commented Nov 12, 2024 •

edited by iansltx

Loading

codecov bot commented Nov 12, 2024 •

edited

Loading

jacobshandling Nov 13, 2024 •

edited

Loading

jacobshandling Nov 13, 2024 •

edited

Loading