Allen Houchins
87bc1ce78a
Add a macOS Disk management declaration profile that sets ExternalStorage to ReadOnly, and create a manual label "Macs excluded from external storage restrictions" for opt-outs. Register the new label in default.yml and reference the new Disk management settings.json in the workstations fleet controls, excluding hosts in the manual label so they retain read-write external storage. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes **New Features** - Enforces external storage devices as read-only on macOS, Windows, and Linux systems - Introduces new host labels allowing administrators to selectively exempt specific devices from external storage restrictions <!-- end of auto-generated comment: release notes by coderabbit.ai -->
33 lines
1.3 KiB
Bash
33 lines
1.3 KiB
Bash
#!/bin/bash
|
|
|
|
# Installs a udev rule that forces USB removable block devices (USB sticks,
|
|
# external HDD/SSD presented as removable, SD cards on USB readers, eMMC) to
|
|
# read-only at the kernel level. Auto-mounters (udisks2/GNOME, KDE, etc.) will
|
|
# then mount these devices read-only because the underlying block device has
|
|
# the read-only flag set.
|
|
|
|
set -e
|
|
|
|
RULE_PATH="/etc/udev/rules.d/99-fleet-readonly-removable-storage.rules"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "This script must be run as root." >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat > "$RULE_PATH" <<'EOF'
|
|
# Managed by Fleet. Do not edit by hand.
|
|
# Forces USB removable storage to read-only by setting the block device RO flag.
|
|
ACTION=="add|change", SUBSYSTEMS=="usb", KERNEL=="sd[a-z]", ATTR{removable}=="1", RUN+="/sbin/blockdev --setro /dev/%k"
|
|
ACTION=="add|change", SUBSYSTEMS=="usb", KERNEL=="sd[a-z][0-9]*", RUN+="/sbin/blockdev --setro /dev/%k"
|
|
ACTION=="add|change", SUBSYSTEMS=="usb", KERNEL=="mmcblk[0-9]*", RUN+="/sbin/blockdev --setro /dev/%k"
|
|
ACTION=="add|change", SUBSYSTEMS=="usb", KERNEL=="mmcblk[0-9]*p[0-9]*", RUN+="/sbin/blockdev --setro /dev/%k"
|
|
EOF
|
|
|
|
chmod 644 "$RULE_PATH"
|
|
|
|
udevadm control --reload-rules
|
|
udevadm trigger --action=change --subsystem-match=block || true
|
|
|
|
echo "Installed Fleet read-only removable storage udev rule at $RULE_PATH"
|