Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address findings from migration testing #91

Merged
merged 1 commit into from
Oct 30, 2024
Merged

Address findings from migration testing #91

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Conf/Package/migration.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
/bin/rm -f /Library/LaunchDaemons/com.google.santa.metricservice.plist
/bin/rm -f /Library/LaunchDaemons/com.google.santa.syncservice.plist
/bin/rm -f /private/etc/asl/com.google.santa.asl.conf
/bin/rm -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf
# Move Google's newsyslog config file in case any changes were made so that the
# same configuration continues to apply.
/bin/mv -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf /private/etc/newsyslog.d/com.northpolesec.santa.newsyslog.conf || true

# Install NPS Santa.
/bin/mv /Library/Caches/com.northpolesec.santa/Santa.app /Applications/Santa.app
Expand Down
5 changes: 5 additions & 0 deletions Conf/Package/postinstall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,11 @@ if [ -z "${GOOGLE_SANTA_ACTIVATED}" ]; then
/Applications/Santa.app/Contents/MacOS/santactl install
fi

# Although Santa isn't running, we still try to move any lingering newsyslog
# config that might exist. If any changes had been made to a previous Santa
# deployment, that same config will continue to be used here.
/bin/mv -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf /private/etc/newsyslog.d/com.northpolesec.santa.newsyslog.conf || true

# Cleanup cache dir.
/bin/rm -rf /Library/Caches/com.northpolesec.santa

Expand Down
11 changes: 9 additions & 2 deletions Conf/install_services.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,18 @@ GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
/bin/rm /Library/LaunchDaemons/com.google.santa.metricservice.plist
/bin/rm /Library/LaunchDaemons/com.google.santa.syncservice.plist
/bin/rm /Library/LaunchDaemons/com.google.santad.plist
# Move Google's newsyslog config file in case any changes were made so that the
# same configuration continues to apply.
/bin/mv -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf /private/etc/newsyslog.d/com.northpolesec.santa.newsyslog.conf || true

################################################################################

# Remove lingering migration launchd plist. This can stick around when upgrading
# NPS Santa due to tamper protections of the previous version of NPS preventing
# the deletion. While this is benign, we can take the opportunity to remove the
# artifact here.
/bin/rm -f /Library/LaunchDaemons/com.northpolesec.santa.migration.plist

# Unload NPS Santa services in preparation for installation / update.
/bin/launchctl remove com.northpolesec.santa.bundleservice || true
/bin/launchctl remove com.northpolesec.santa.metricservice || true
Expand All @@ -51,5 +60,3 @@ GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
/bin/launchctl load -w /Library/LaunchDaemons/com.northpolesec.santa.metricservice.plist
/bin/launchctl load -w /Library/LaunchDaemons/com.northpolesec.santa.syncservice.plist
[[ -n "${GUI_USER}" ]] && /bin/launchctl asuser "${GUI_USER}" /bin/launchctl load /Library/LaunchAgents/com.northpolesec.santa.plist

exit 0
4 changes: 4 additions & 0 deletions Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.mm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,10 @@ void RemoveLegacyLaunchdPlists() {
"/Library/LaunchDaemons/com.google.santa.metricservice.plist",
"/Library/LaunchDaemons/com.google.santa.syncservice.plist",
"/Library/LaunchAgents/com.google.santa.plist",
// Assume that NPS Santa has already migrated any existing Google newsyslog
// config and we can simply remove a new config file that was just laid
// down as part of a Google Santa install that is being prevented from running.
"/private/etc/newsyslog.d/com.google.santa.newsyslog.conf",
};

for (const auto &plist : legacyPlists) {
Expand Down