| // Copyright 2019 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "base/enterprise_util.h" |
| |
| #import <OpenDirectory/OpenDirectory.h> |
| |
| #include <string> |
| #include <vector> |
| |
| #include "base/logging.h" |
| #include "base/mac/foundation_util.h" |
| #include "base/process/launch.h" |
| #include "base/strings/string_split.h" |
| #include "base/strings/string_util.h" |
| #include "base/strings/sys_string_conversions.h" |
| |
| namespace base { |
| |
| bool IsManagedDevice() { |
| // MDM enrollment indicates the device is actively being managed. Simply being |
| // joined to a domain, however, does not. |
| |
| // IsDeviceRegisteredWithManagementNew is only available after 10.13.4. |
| // Eventually switch to it when that is the minimum OS required by Chromium. |
| if (@available(macOS 10.13.4, *)) { |
| base::MacDeviceManagementStateNew mdm_state = |
| base::IsDeviceRegisteredWithManagementNew(); |
| return mdm_state == |
| base::MacDeviceManagementStateNew::kLimitedMDMEnrollment || |
| mdm_state == base::MacDeviceManagementStateNew::kFullMDMEnrollment || |
| mdm_state == base::MacDeviceManagementStateNew::kDEPMDMEnrollment; |
| } |
| |
| base::MacDeviceManagementStateOld mdm_state = |
| base::IsDeviceRegisteredWithManagementOld(); |
| return mdm_state == base::MacDeviceManagementStateOld::kMDMEnrollment; |
| } |
| |
| bool IsEnterpriseDevice() { |
| // Domain join is a basic indicator of being an enterprise device. |
| DeviceUserDomainJoinState join_state = AreDeviceAndUserJoinedToDomain(); |
| return join_state.device_joined || join_state.user_joined; |
| } |
| |
| MacDeviceManagementStateOld IsDeviceRegisteredWithManagementOld() { |
| static MacDeviceManagementStateOld state = [] { |
| @autoreleasepool { |
| std::vector<std::string> profiler_argv{"/usr/sbin/system_profiler", |
| "SPConfigurationProfileDataType", |
| "-detailLevel", |
| "mini", |
| "-timeout", |
| "15", |
| "-xml"}; |
| |
| std::string profiler_stdout; |
| if (!GetAppOutput(profiler_argv, &profiler_stdout)) { |
| LOG(WARNING) << "Could not get system_profiler output."; |
| return MacDeviceManagementStateOld::kFailureAPIUnavailable; |
| }; |
| |
| NSArray* root = base::mac::ObjCCast<NSArray>([NSPropertyListSerialization |
| propertyListWithData:[SysUTF8ToNSString(profiler_stdout) |
| dataUsingEncoding:NSUTF8StringEncoding] |
| options:NSPropertyListImmutable |
| format:nil |
| error:nil]); |
| if (!root) { |
| LOG(WARNING) << "Could not parse system_profiler output."; |
| return MacDeviceManagementStateOld::kFailureUnableToParseResult; |
| }; |
| |
| for (NSDictionary* results in root) { |
| for (NSDictionary* dict in results[@"_items"]) { |
| for (NSDictionary* device_config_profiles in dict[@"_items"]) { |
| for (NSDictionary* profile_item in |
| device_config_profiles[@"_items"]) { |
| if (![profile_item[@"_name"] isEqual:@"com.apple.mdm"]) |
| continue; |
| |
| NSString* payload_data = |
| profile_item[@"spconfigprofile_payload_data"]; |
| NSDictionary* payload_data_dict = |
| base::mac::ObjCCast<NSDictionary>([NSPropertyListSerialization |
| propertyListWithData: |
| [payload_data dataUsingEncoding:NSUTF8StringEncoding] |
| options:NSPropertyListImmutable |
| format:nil |
| error:nil]); |
| |
| if (!payload_data_dict) |
| continue; |
| |
| // Verify that the URL validates. |
| if ([NSURL URLWithString:payload_data_dict[@"CheckInURL"]]) |
| return MacDeviceManagementStateOld::kMDMEnrollment; |
| } |
| } |
| } |
| } |
| |
| return MacDeviceManagementStateOld::kNoEnrollment; |
| } |
| }(); |
| |
| return state; |
| } |
| |
| MacDeviceManagementStateNew IsDeviceRegisteredWithManagementNew() { |
| static MacDeviceManagementStateNew state = [] { |
| if (@available(macOS 10.13.4, *)) { |
| std::vector<std::string> profiles_argv{"/usr/bin/profiles", "status", |
| "-type", "enrollment"}; |
| |
| std::string profiles_stdout; |
| if (!GetAppOutput(profiles_argv, &profiles_stdout)) { |
| LOG(WARNING) << "Could not get profiles output."; |
| return MacDeviceManagementStateNew::kFailureAPIUnavailable; |
| } |
| |
| // Sample output of `profiles` with full MDM enrollment: |
| // Enrolled via DEP: Yes |
| // MDM enrollment: Yes (User Approved) |
| // MDM server: https://applemdm.example.com/some/path?foo=bar |
| StringPairs property_states; |
| if (!SplitStringIntoKeyValuePairs(profiles_stdout, ':', '\n', |
| &property_states)) { |
| return MacDeviceManagementStateNew::kFailureUnableToParseResult; |
| } |
| |
| bool enrolled_via_dep = false; |
| bool mdm_enrollment_not_approved = false; |
| bool mdm_enrollment_user_approved = false; |
| |
| for (const auto& property_state : property_states) { |
| StringPiece property = |
| TrimString(property_state.first, kWhitespaceASCII, TRIM_ALL); |
| StringPiece state = |
| TrimString(property_state.second, kWhitespaceASCII, TRIM_ALL); |
| |
| if (property == "Enrolled via DEP") { |
| if (state == "Yes") |
| enrolled_via_dep = true; |
| else if (state != "No") |
| return MacDeviceManagementStateNew::kFailureUnableToParseResult; |
| } else if (property == "MDM enrollment") { |
| if (state == "Yes") |
| mdm_enrollment_not_approved = true; |
| else if (state == "Yes (User Approved)") |
| mdm_enrollment_user_approved = true; |
| else if (state != "No") |
| return MacDeviceManagementStateNew::kFailureUnableToParseResult; |
| } else { |
| // Ignore any other output lines, for future extensibility. |
| } |
| } |
| |
| if (!enrolled_via_dep && !mdm_enrollment_not_approved && |
| !mdm_enrollment_user_approved) { |
| return MacDeviceManagementStateNew::kNoEnrollment; |
| } |
| |
| if (!enrolled_via_dep && mdm_enrollment_not_approved && |
| !mdm_enrollment_user_approved) { |
| return MacDeviceManagementStateNew::kLimitedMDMEnrollment; |
| } |
| |
| if (!enrolled_via_dep && !mdm_enrollment_not_approved && |
| mdm_enrollment_user_approved) { |
| return MacDeviceManagementStateNew::kFullMDMEnrollment; |
| } |
| |
| if (enrolled_via_dep && !mdm_enrollment_not_approved && |
| mdm_enrollment_user_approved) { |
| return MacDeviceManagementStateNew::kDEPMDMEnrollment; |
| } |
| |
| return MacDeviceManagementStateNew::kFailureUnableToParseResult; |
| } else { |
| return MacDeviceManagementStateNew::kFailureAPIUnavailable; |
| } |
| }(); |
| |
| return state; |
| } |
| |
| DeviceUserDomainJoinState AreDeviceAndUserJoinedToDomain() { |
| static DeviceUserDomainJoinState state = [] { |
| DeviceUserDomainJoinState state{false, false}; |
| |
| @autoreleasepool { |
| ODSession* session = [ODSession defaultSession]; |
| if (session == nil) { |
| DLOG(WARNING) << "ODSession default session is nil."; |
| return state; |
| } |
| |
| NSError* error = nil; |
| |
| NSArray<NSString*>* all_node_names = |
| [session nodeNamesAndReturnError:&error]; |
| if (!all_node_names) { |
| DLOG(WARNING) << "ODSession failed to give node names: " |
| << error.localizedDescription.UTF8String; |
| return state; |
| } |
| |
| NSUInteger num_nodes = all_node_names.count; |
| if (num_nodes < 3) { |
| DLOG(WARNING) << "ODSession returned too few node names: " |
| << all_node_names.description.UTF8String; |
| return state; |
| } |
| |
| if (num_nodes > 3) { |
| // Non-enterprise machines have:"/Search", "/Search/Contacts", |
| // "/Local/Default". Everything else would be enterprise management. |
| state.device_joined = true; |
| } |
| |
| ODNode* node = [ODNode nodeWithSession:session |
| type:kODNodeTypeAuthentication |
| error:&error]; |
| if (node == nil) { |
| DLOG(WARNING) << "ODSession cannot obtain the authentication node: " |
| << error.localizedDescription.UTF8String; |
| return state; |
| } |
| |
| // Now check the currently logged on user. |
| ODQuery* query = [ODQuery queryWithNode:node |
| forRecordTypes:kODRecordTypeUsers |
| attribute:kODAttributeTypeRecordName |
| matchType:kODMatchEqualTo |
| queryValues:NSUserName() |
| returnAttributes:kODAttributeTypeAllAttributes |
| maximumResults:0 |
| error:&error]; |
| if (query == nil) { |
| DLOG(WARNING) << "ODSession cannot create user query: " |
| << mac::NSToCFCast(error); |
| return state; |
| } |
| |
| NSArray* results = [query resultsAllowingPartial:NO error:&error]; |
| if (!results) { |
| DLOG(WARNING) << "ODSession cannot obtain current user node: " |
| << error.localizedDescription.UTF8String; |
| return state; |
| } |
| |
| if (results.count != 1) { |
| DLOG(WARNING) << @"ODSession unexpected number of user nodes: " |
| << results.count; |
| } |
| |
| for (id element in results) { |
| ODRecord* record = mac::ObjCCastStrict<ODRecord>(element); |
| NSArray* attributes = |
| [record valuesForAttribute:kODAttributeTypeMetaRecordName |
| error:nil]; |
| for (id attribute in attributes) { |
| NSString* attribute_value = mac::ObjCCastStrict<NSString>(attribute); |
| // Example: "uid=johnsmith,ou=People,dc=chromium,dc=org |
| NSRange domain_controller = |
| [attribute_value rangeOfString:@"(^|,)\\s*dc=" |
| options:NSRegularExpressionSearch]; |
| if (domain_controller.length > 0) { |
| state.user_joined = true; |
| } |
| } |
| |
| // Scan alternative identities. |
| attributes = |
| [record valuesForAttribute:kODAttributeTypeAltSecurityIdentities |
| error:nil]; |
| for (id attribute in attributes) { |
| NSString* attribute_value = mac::ObjCCastStrict<NSString>(attribute); |
| NSRange icloud = |
| [attribute_value rangeOfString:@"CN=com.apple.idms.appleid.prd" |
| options:NSCaseInsensitiveSearch]; |
| if (!icloud.length) { |
| // Any alternative identity that is not iCloud is likely enterprise |
| // management. |
| state.user_joined = true; |
| } |
| } |
| } |
| } |
| |
| return state; |
| }(); |
| |
| return state; |
| } |
| |
| } // namespace base |
