feat(tcc): give MDM fleets a way to answer the network-volume prompt - #193
Open
swarit-stepsecurity wants to merge 2 commits into
Open
feat(tcc): give MDM fleets a way to answer the network-volume prompt#193swarit-stepsecurity wants to merge 2 commits into
swarit-stepsecurity wants to merge 2 commits into
Conversation
Container runtimes expose the guest filesystem through mounts macOS classifies as network volumes — OrbStack's ~/OrbStack, Docker Desktop and Colima shares — so the first scan that walks one fires a SystemPolicyNetworkVolumes prompt naming a process the developer does not recognize. Admins could not pre-answer it: PPPC path identifiers cannot express $HOME and the loader installs per-user under ~/.stepsecurity/bin. Keep walking those mounts by default. That walk is what inventories npm and Python packages inside dev containers, which no other part of the scan reaches, so suppressing the prompt by skipping them would trade away the coverage that made the prompt worth firing. Instead give fleets both exits. include_network_volumes: false (or --no-include-network-volumes) skips every non-local mount, enumerated from the kernel mount table via getfsstat rather than a hard-coded path list, so a newly installed runtime needs no agent change; MNT_NOWAIT keeps a stale server from blocking the enumeration, and reading the mount table cannot itself fire the prompt. The run then warns which mounts it gave up, so the coverage loss shows up in fleet logs instead of going silent. The alternative is packaging/macos's PPPC profile, which pre-answers the prompt fleet-wide (allow or deny) alongside the existing Full Disk Access grant — that route needs a fixed system-wide install path, and the docs now carry the migration steps plus the two dead ends worth naming: a symlink at a stable path does not work because TCC matches the resolved executable, and bundleID identifiers do not apply to a bare CLI binary. The two toggles are independent and default opposite ways: protected dirs stay skip-by-default, network volumes stay walk-by-default. Both resolve through tcc.ForRun, so the ~15 walk sites inherit the new class through the existing Skipper choke point with no per-detector change. Closes step-security#177 Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>
The whole point of defaulting include_network_volumes to walk is that an agent upgrade changes nothing for existing fleets. On macOS, quietly walking something new is how a customer gets a TCC prompt out of nowhere, so assert the property instead of trusting the code to keep it: build the pre-toggle New(home) skipper and the ForRun default side by side and require identical answers for every path, plus a nil skipper for --include-tcc-protected as before. Signed-off-by: Swarit Pandey <swarit@stepsecurity.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #177