Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: 12.3 issue for profiles show #45

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

joncrain
Copy link

From the 12.3 profiles man page:

     show       -type profile_type -user user_name -output output_path
                Show expanded information for profiles.   For an enrollment, this will show the current DEP configuration, and the call may be rate limited to once every 23 hours.

umad currently relies on this command and will detect DEP status as false if the command returns an error. If the command is tried again within 23 hours it will result in an error.

This fix relies on detecting the dot files that this command alters located in /private/var/db/ConfigurationProfiles/Settings

From our testing a machine that requires manual enrollment will always have a .cloudConfigRecordNotFound file. This can be because the machine is not in DEP or because the MDM is not assigned, which does get removed when the command completes and the machine does have a valid MDM assigned.

VMs with invalid serial numbers seem to result in returning a different error as shown:

% cat .cloudConfigRecordFound 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CloudConfigFetchError</key>
	<dict>
		<key>__Error__</key>
...

With this detection, there is potentially a small gap during the first 23 hours after the change where the .cloudConfigRecordFound file will contain invalid information. However, umad does not take this data into consideration.

This should satisfy #44

@erikng
Copy link
Member

erikng commented Mar 21, 2022

wont the other command we run get hit by this though?

@joncrain
Copy link
Author

joncrain commented Mar 21, 2022

The release notes hint at that, but currently in the man page for profiles only show and validate have the rate limit mentioned. And in practice those two return errors after their first check. You can currently run profiles renew multiple times without issues.

profiles status and profiles list only read local data and can also be run multiple times.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants