From 978a3924538171b873a60fbb6ab2204705bec0af Mon Sep 17 00:00:00 2001 From: riccardom Date: Fri, 29 May 2026 16:17:00 +0200 Subject: [PATCH] Return error if trying to modify any config that is gated by MDM --- client/server/server.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/client/server/server.go b/client/server/server.go index 397fb37e4..42a49143b 100644 --- a/client/server/server.go +++ b/client/server/server.go @@ -308,6 +308,14 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled) } + // MDM gate: refuse the whole request if any of its fields is enforced + // by the active MDM policy. The error carries a ManagedFieldsViolation + // detail listing the offending key names. Non-conflicting fields in + // the same request are not applied either. + if err := rejectManagedFieldConflicts(loadMDMPolicy(), requestedManagedKeys(msg)); err != nil { + return nil, err + } + profState := profilemanager.ActiveProfileState{ Name: msg.ProfileName, Username: msg.Username,