Add RemoveApplication method #25078
Add RemoveApplication method #25078
Conversation
|
@jspenc72 Thanks for working on this! I just dropped the checklist down to what should be applicable here once this feature is fleshed out, as I don't think you'll need database migrations or BC bcreaking API changes to make this work. I believe the next step here is to update the uninstall logic to queue up this profile when interacting with an iOS/iPadOS target rather than failing, and then add tests covering the new behavior. Final piece would be to expose this functionality in the web UI. Get as far as you can; it's a question of when rather than if on picking up where you left off and finishing this feature, but my guess is that this would hit in 4.64.0 depending on what's left to build by the time product works through that UI tweaks need to happen here. You'll likely have to rebase/merge from main soonish as we have some failing tests on Adding myself as a watcher on this until it's prioritized, so I'll see any pushes/questions as they come up. |
jspenc72
force-pushed
the
jspenc72/25077-apple-mdm-remove-application
branch
from
66cac37 to
a82a062
Compare
…/github.com/jspenc72/fleet into jspenc72/25077-apple-mdm-remove-application
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #25078 +/- ##
==========================================
- Coverage 63.81% 63.75% -0.07%
==========================================
Files 1616 1619 +3
Lines 153895 154362 +467
Branches 3978 4030 +52
==========================================
+ Hits 98208 98406 +198
- Misses 47870 48132 +262
- Partials 7817 7824 +7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
Hey FleetDM friends! this pr is working as intended but the action is not yet recorded in the database as it should be. A little guidance on how to record the uninstall request would be much appreciated. Rebased as per your suggestion. The latest commit successfully removed the application via apple mdm push notifications. I manually QA'd this on iOS and iPadOS devices. |
| @@ -1091,6 +1100,24 @@ func (svc *Service) UninstallSoftwareTitle(ctx context.Context, hostID uint, sof | |||
| if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{HostTeamID: host.TeamID}, fleet.ActionWrite); err != nil { | |||
| return err | |||
| } | |||
| // Try Apple MDM uninstallation for iOS and iPadOS devices | |||
|
|
|||
| if strings.Contains(host.OSVersion, "iPadOS") || strings.Contains(host.OSVersion, "iOS") { | |||
There was a problem hiding this comment.
Should this work for macOS as well?
There was a problem hiding this comment.
Good question. So i tried enrolling a macOS host using the current iOS/iPad MDM enrollment
instructions to test this. Although i was successful, It looks like there are some
assumptions in the current code that macOS explicitely uses fleetd for software installation and
removal so the MDM commands aren't called when you have a macOS host with MDM enabled. Maybe one of the engineers @fleet can confirm?
There was a problem hiding this comment.
VPP apps are installed with InstallApplication MDM command on macOS. Non-VPP apps are installed/uninstalled using fleetd and scripts. So, on macOS we need to know whether it is a VPP app so we can use RemoveApplication for it.
| return ctxerr.Wrapf(ctx, err, "sending command to uninstall VPP %s application to host with serial %s", vppApp.BundleIdentifier, host.HardwareSerial) | ||
| } | ||
| return nil | ||
| } |
There was a problem hiding this comment.
When MDM command result comes back, we need to process it, similar to what we do for InstallApplication:
fleet/server/service/apple_mdm.go
Line 2976 in a222c38
Update the database
We need to add uninstall column to host_vpp_software_installs and use similar pattern as we do with script-based software installs:
Need to update the vppAppJoin method similar to softwareInstallerJoin:
Add host activity record
Should be able to use ActivityTypeUninstalledSoftware:
fleet/server/fleet/activities.go
Line 1634 in 3123324
There was a problem hiding this comment.
-
ok I implemented code to process the RemoveApplication mdm cmd result when it comes back.
https://github.com/fleetdm/fleet/pull/25078/files#diff-1cc547279489e5119326f2ac15610c2dd7519ef7dada5952552765cefabd41aaR2982 -
Created a new host activity type
fleet.ActivityUnInstalledAppStoreAppwhich captures the same values asfleet.ActivityInstalledAppStoreApp
https://github.com/fleetdm/fleet/pull/25078/files#diff-98831e34347dbbeb9c223562ad18f7b74d82347624017a691861fcd7f382ab51R1643
There was a problem hiding this comment.
@getvictor Wanted to confirm whether we need the uninstall column?
It looks like host_vpp_software_installs already has the column removed which tracks whether or not the software has been uninstalled.
see this migration
server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.goThere was a problem hiding this comment.
@getvictor Wanted to confirm whether we need the
uninstallcolumn?It looks like
host_vpp_software_installsalready has the columnremovedwhich tracks whether or not the software has been uninstalled.see this migration
server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
Yes, I think we need the uninstall column to be consistent with the other table. The removed column is supposed to be used when the user removed the software themselves. I think we need the uninstall column so we can update the status in UI, kind of like it is updated when the install is happening.
There was a problem hiding this comment.
uninstall column has been added.
…/github.com/jspenc72/fleet into jspenc72/25077-apple-mdm-remove-application
…/github.com/jspenc72/fleet into jspenc72/25077-apple-mdm-remove-application
server/datastore/mysql/migrations/tables/20250109074626_AddUninstallToHostVppInstalls_test.go
Outdated
Show resolved
Hide resolved
server/datastore/mysql/migrations/tables/20250109074626_AddUninstallToHostVppInstalls.go
Outdated
Show resolved
Hide resolved
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.