From c2f4c9638bc36fcc3e0c4fb283efd6d8bd326b83 Mon Sep 17 00:00:00 2001 From: "kilo-code-bot[bot]" <240665456+kilo-code-bot[bot]@users.noreply.github.com> Date: Mon, 23 Mar 2026 22:09:18 -0500 Subject: [PATCH] Remove WhatsApp block rule and deploy Santa profiles to all Workstations Macs (#42285) ## Summary - **Removed the WhatsApp block rule** from the Santa rules configuration profile (`santa-rules.mobileconfig`). The rule blocked WhatsApp.app via a CDHASH identifier (`54a8ec11bcea48a276b1fdce556a29108ba77de4`) and is no longer needed. - **Expanded Santa profile deployment to all macOS hosts** on the Workstations team. Both `santa-configuration.mobileconfig` and `santa-rules.mobileconfig` were previously scoped only to the `"Santa test devices"` label (4 specific Macs). Removed the `labels_include_any` restriction so these profiles now install on all Macs in the Workstations team. - **Deleted the "Santa test devices" label entirely.** Removed the label definition file (`santa-test-devices.yml`), its reference in `default.yml`, and all remaining `labels_include_any` references to it from the Santa software entry, install-santa-extension policy, and collect-santa-denied-logs report. ## Changes ### `it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig` - Removed the `BLOCKLIST` / `CDHASH` rule entry for WhatsApp.app (identifier `54a8ec11bcea48a276b1fdce556a29108ba77de4`) - The allowlist for North Pole Security (Team ID) and the test block rule for BundleExample.app remain unchanged ### `it-and-security/fleets/workstations.yml` - Removed `labels_include_any: ["Santa test devices"]` from the `santa-configuration.mobileconfig` and `santa-rules.mobileconfig` profile entries - Removed `labels_include_any: ["Santa test devices"]` from the Santa software entry - All Santa-related profiles and software now apply to all macOS hosts on the Workstations team ### `it-and-security/lib/all/labels/santa-test-devices.yml` (deleted) - Removed the manual label definition for "Santa test devices" (previously scoped to 4 specific Macs) ### `it-and-security/default.yml` - Removed the label path reference to `santa-test-devices.yml` ### `it-and-security/lib/macos/policies/install-santa-extension.yml` - Removed `labels_include_any: ["Santa test devices"]` so the policy applies to all macOS hosts ### `it-and-security/lib/macos/reports/collect-santa-denied-logs.yml` - Removed `labels_include_any: ["Santa test devices"]` so the report applies to all macOS hosts --- Built for [Allen Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774320804143629?thread_ts=1774320368.198119&cid=D0AFASNBZMW) by [Kilo for Slack](https://kilo.ai/features/slack-integration) --------- Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> --- it-and-security/default.yml | 1 - it-and-security/fleets/workstations.yml | 6 ------ it-and-security/lib/all/labels/santa-test-devices.yml | 9 --------- .../configuration-profiles/santa-rules.mobileconfig | 9 --------- .../lib/macos/policies/install-santa-extension.yml | 2 -- .../lib/macos/reports/collect-santa-denied-logs.yml | 2 -- 6 files changed, 29 deletions(-) delete mode 100644 it-and-security/lib/all/labels/santa-test-devices.yml diff --git a/it-and-security/default.yml b/it-and-security/default.yml index 69b27afa44..ff6a48fd25 100644 --- a/it-and-security/default.yml +++ b/it-and-security/default.yml @@ -103,7 +103,6 @@ labels: - path: ./lib/all/labels/macs-with-1password-installed.yml - path: ./lib/all/labels/rpm-based-linux-hosts.yml - path: ./lib/all/labels/virtual-machines.yml - - path: ./lib/all/labels/santa-test-devices.yml - path: ./lib/all/labels/x86-based-windows-hosts.yml - path: ./lib/all/labels/apple-silicon-macos-hosts.yml - path: ./lib/all/labels/keynote-14-installed.yml diff --git a/it-and-security/fleets/workstations.yml b/it-and-security/fleets/workstations.yml index d231018e46..e4eeb7ae00 100644 --- a/it-and-security/fleets/workstations.yml +++ b/it-and-security/fleets/workstations.yml @@ -76,11 +76,7 @@ controls: labels_include_any: - "Macs with 1Password installed" - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig - labels_include_any: - - "Santa test devices" - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig - labels_include_any: - - "Santa test devices" - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig labels_include_any: @@ -170,8 +166,6 @@ software: - Security - path: ../lib/macos/software/santa.yml # Santa for macOS self_service: true - labels_include_any: - - Santa test devices categories: - Security - path: ../lib/macos/software/zoom.yml # Zoom for macOS diff --git a/it-and-security/lib/all/labels/santa-test-devices.yml b/it-and-security/lib/all/labels/santa-test-devices.yml deleted file mode 100644 index dce688f376..0000000000 --- a/it-and-security/lib/all/labels/santa-test-devices.yml +++ /dev/null @@ -1,9 +0,0 @@ -- name: Santa test devices - description: Macs testing santa - label_membership_type: manual - platform: darwin - hosts: - - "allens-macbook-pro.local" - - "harrisons-macbook-pro.local" - - "noah-talerman-macbook-pro.local" - - "allens-mac-mini.local" diff --git a/it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig b/it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig index 6b93e6517c..2aa42986c4 100644 --- a/it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig +++ b/it-and-security/lib/macos/configuration-profiles/santa-rules.mobileconfig @@ -34,15 +34,6 @@ rule_type BINARY - - - identifier - 54a8ec11bcea48a276b1fdce556a29108ba77de4 - policy - BLOCKLIST - rule_type - CDHASH - diff --git a/it-and-security/lib/macos/policies/install-santa-extension.yml b/it-and-security/lib/macos/policies/install-santa-extension.yml index b33914ff8d..562ba192c5 100644 --- a/it-and-security/lib/macos/policies/install-santa-extension.yml +++ b/it-and-security/lib/macos/policies/install-santa-extension.yml @@ -6,5 +6,3 @@ run_script: path: ../scripts/install-santa-extension.sh platform: darwin - labels_include_any: - - "Santa test devices" diff --git a/it-and-security/lib/macos/reports/collect-santa-denied-logs.yml b/it-and-security/lib/macos/reports/collect-santa-denied-logs.yml index 4df3b3ea86..5f8078dde3 100644 --- a/it-and-security/lib/macos/reports/collect-santa-denied-logs.yml +++ b/it-and-security/lib/macos/reports/collect-santa-denied-logs.yml @@ -7,5 +7,3 @@ observer_can_run: true platform: "darwin" query: SELECT * FROM santa_denied; - labels_include_any: - - Santa test devices