mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-22 16:31:28 +02:00
dc89b471fa
## Describe your changes `applyAutostartDefault` gated all MDM enforcement behind the one-time `AutostartInitialized` marker, so MDM `disableAutostart` only affected fresh installs — a policy pushed after autostart had been enabled could not revoke the OS login-item. The PR adds follow-up MDM enforcements at the top of the function: if at any time MDM sets `disableAutostart=true` and the OS registration is present, force `SetEnabled(false)` to align it. Trade-off: once the admin lifts the policy, autostart stays off until the user re-toggles in Settings — consistent with "MDM always wins" behavior of the other managed keys. ## Issue ticket number and link Follow-up to PR https://github.com/netbirdio/netbird/pull/6738 (introduced the `disableAutostart` MDM key with fresh-install-only semantics). ## Stack <!-- branch-stack --> ### Checklist - [x] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [ ] Created tests that fail without the change (if possible) > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [x] I added/updated documentation for this change - [ ] Documentation is **not needed** for this change (explain why) ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: <https://github.com/netbirdio/docs/pull/855> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added an administrative policy to disable client autostart (“Disable Autostart”). - Added support for configuring this policy via macOS MDM, Windows Group Policy (ADMX/ADML), and registry settings. - When enforced, the client prevents new autostart registration on fresh installs and removes existing autostart on the next GUI launch, keeping it disabled until the policy is lifted. - **Bug Fixes** - Improved enforcement logic for managed autostart defaults so policy state is applied consistently during startup and first-run setup. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
164 lines
7.1 KiB
XML
164 lines
7.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
NetBird MDM configuration profile (macOS).
|
|
|
|
Wraps a `com.apple.ManagedClient.preferences` payload that pushes the
|
|
NetBird MDM policy into:
|
|
/Library/Managed Preferences/io.netbird.client.plist
|
|
|
|
Read at runtime by the netbird daemon's macOS loader
|
|
(client/mdm/policy_darwin.go — Phase 2). Key names match the canonical
|
|
lowerCamelCase form used in docs/netbird.admx and the mdm.Key*
|
|
constants in client/mdm/policy.go.
|
|
|
|
Bundle identifier: io.netbird.client
|
|
(confirm against the signed pkg before fleet roll-out)
|
|
|
|
Distribution:
|
|
- sign with `productsign --sign "Developer ID Installer: ..." ...`
|
|
before fleet roll-out (Apple-Configurator-2 won't install an
|
|
unsigned profile on Sonoma+ without user override).
|
|
- For local dev install: `sudo profiles install -path netbird-macos.mobileconfig`.
|
|
- For MDM (Jamf/Kandji/Mosyle/Intune): upload as a Custom Profile.
|
|
|
|
Editing:
|
|
- Replace UUID placeholders below with fresh UUIDs (`uuidgen` on
|
|
macOS) when forking this template for a real fleet — each
|
|
deployment should have unique UUIDs so the OS treats it as a
|
|
distinct profile.
|
|
- Tune the PayloadContent values to the policy you want to enforce.
|
|
- Remove any key you do NOT want to enforce (the daemon treats an
|
|
absent key as "no enforcement" for that field).
|
|
|
|
iOS note:
|
|
This file is macOS-specific. iOS uses managed app config via
|
|
UserDefaults[com.apple.configuration.managed] under a different
|
|
payload type (com.apple.app.configuration.managed); the wrapper
|
|
structure is the same but the inner payload dictionary differs.
|
|
See docs/netbird-ios.mobileconfig (Phase 5) when shipped.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Outer profile envelope -->
|
|
<key>PayloadType</key>
|
|
<string>Configuration</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>PayloadIdentifier</key>
|
|
<string>io.netbird.client.mdm</string>
|
|
<key>PayloadUUID</key>
|
|
<string>11111111-1111-1111-1111-111111111111</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>NetBird MDM Policy</string>
|
|
<key>PayloadDescription</key>
|
|
<string>Enforces NetBird client configuration. Values written here override any local user / CLI / on-disk setting and are re-applied at every daemon boot and on every 1-minute MDM reload tick.</string>
|
|
<key>PayloadOrganization</key>
|
|
<string>NetBird</string>
|
|
<key>PayloadScope</key>
|
|
<string>System</string>
|
|
<key>PayloadRemovalDisallowed</key>
|
|
<false/>
|
|
|
|
<key>PayloadContent</key>
|
|
<array>
|
|
<dict>
|
|
<!-- Managed preferences payload: writes /Library/Managed Preferences/io.netbird.client.plist -->
|
|
<key>PayloadType</key>
|
|
<string>com.apple.ManagedClient.preferences</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>PayloadIdentifier</key>
|
|
<string>io.netbird.client.mdm.preferences</string>
|
|
<key>PayloadUUID</key>
|
|
<string>22222222-2222-2222-2222-222222222222</string>
|
|
<key>PayloadDisplayName</key>
|
|
<string>NetBird Managed Preferences</string>
|
|
<key>PayloadEnabled</key>
|
|
<true/>
|
|
|
|
<key>PayloadContent</key>
|
|
<dict>
|
|
<key>io.netbird.client</key>
|
|
<dict>
|
|
<key>Forced</key>
|
|
<array>
|
|
<dict>
|
|
<key>mcx_preference_settings</key>
|
|
<dict>
|
|
|
|
<!-- ===== Identity / auth (strings) ===== -->
|
|
<key>managementURL</key>
|
|
<string>https://api.netbird.io:443</string>
|
|
|
|
<!-- Pre-shared key: secret. Remove the entry entirely
|
|
when not used; do NOT leave an empty string. -->
|
|
<!--
|
|
<key>preSharedKey</key>
|
|
<string>REPLACE_ME</string>
|
|
-->
|
|
|
|
<!-- ===== Engine / runtime behavior (bool) =====
|
|
Remove any key to leave the field unmanaged. -->
|
|
<!--
|
|
<key>disableAutoConnect</key>
|
|
<false/>
|
|
<key>disableAutostart</key>
|
|
<false/>
|
|
<key>disableClientRoutes</key>
|
|
<false/>
|
|
<key>disableServerRoutes</key>
|
|
<false/>
|
|
<key>blockInbound</key>
|
|
<false/>
|
|
-->
|
|
<key>allowServerSSH</key>
|
|
<true/>
|
|
<!--
|
|
<key>rosenpassEnabled</key>
|
|
<true/>
|
|
<key>rosenpassPermissive</key>
|
|
<false/>
|
|
-->
|
|
|
|
<!-- ===== WireGuard UDP port (int) =====
|
|
Range 1-65535. Omit to keep the default. -->
|
|
<!--
|
|
<key>wireguardPort</key>
|
|
<integer>51820</integer>
|
|
-->
|
|
|
|
<!-- ===== Split tunnel (Android-only at the daemon level)
|
|
Pushed harmlessly on macOS for fleets with mixed
|
|
desktop+mobile devices; the macOS daemon ignores it. -->
|
|
<!--
|
|
<key>splitTunnelMode</key>
|
|
<string>allow</string>
|
|
<key>splitTunnelApps</key>
|
|
<string>com.acme.app1,com.acme.app2</string>
|
|
-->
|
|
|
|
<!-- ===== UI / kill switches (bool) ===== -->
|
|
<!--
|
|
<key>disableUpdateSettings</key>
|
|
<true/>
|
|
<key>disableProfiles</key>
|
|
<true/>
|
|
<key>disableNetworks</key>
|
|
<true/>
|
|
<key>disableAdvancedView</key>
|
|
<true/>
|
|
<key>disableMetricsCollection</key>
|
|
<false/>
|
|
-->
|
|
|
|
</dict>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</dict>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</plist>
|