Documentation
¶
Overview ¶
Package mdm reads MDM-managed configuration from platform-native sources (plist on macOS, registry on Windows, UserDefaults on iOS, RestrictionsManager on Android). The returned Policy is consumed by profilemanager.Config.apply() as the highest-priority override layer.
An empty Policy (no source present, or source present with zero keys) means no MDM enforcement is active and the client behaves as if the feature did not exist.
Index ¶
- Constants
- Variables
- type Policy
- func (p *Policy) GetBool(key string) (bool, bool)
- func (p *Policy) GetInt(key string) (int64, bool)
- func (p *Policy) GetString(key string) (string, bool)
- func (p *Policy) GetStringSlice(key string) ([]string, bool)
- func (p *Policy) HasKey(key string) bool
- func (p *Policy) IsEmpty() bool
- func (p *Policy) ManagedKeys() []string
- type Ticker
Constants ¶
const ( KeyManagementURL = "managementURL" KeyDisableUpdateSettings = "disableUpdateSettings" KeyDisableProfiles = "disableProfiles" KeyDisableNetworks = "disableNetworks" KeyDisableClientRoutes = "disableClientRoutes" KeyDisableServerRoutes = "disableServerRoutes" KeyBlockInbound = "blockInbound" KeyDisableMetricsCollection = "disableMetricsCollection" KeyAllowServerSSH = "allowServerSSH" KeyDisableAutoConnect = "disableAutoConnect" KeyRosenpassEnabled = "rosenpassEnabled" KeyRosenpassPermissive = "rosenpassPermissive" KeyWireguardPort = "wireguardPort" // Split tunnel is modeled as a single conceptual policy with two // registry/plist values. KeySplitTunnelMode is the discriminator // ("allow" or "disallow"); KeySplitTunnelApps is a comma-separated // list of package names. The values are mutually exclusive by // construction — only one mode can be set at a time. KeySplitTunnelMode = "splitTunnelMode" KeySplitTunnelApps = "splitTunnelApps" // KeyLazyConnection forces the lazy-connection feature on or off, overriding // the management feature flag. Read as a bool (native bool, or on/off, // true/false, 1/0, yes/no); absent = defer to management. KeyLazyConnection = "lazyConnection" )
Well-known policy keys. Names mirror the corresponding ConfigInput Go field names (lowerCamelCase) so the daemon can map a Policy key directly to a configuration field.
const ( SplitTunnelModeAllow = "allow" SplitTunnelModeDisallow = "disallow" )
Split-tunnel mode literals (KeySplitTunnelMode values).
const DefaultReloadInterval = 1 * time.Minute
DefaultReloadInterval is the production cadence at which the desktop daemon re-reads the OS-native MDM policy. Picked to balance responsiveness against registry/plist I/O overhead. Mobile builds use OS-side notifications instead, hence anticipating the ticker mechanism entirely.
Variables ¶
var SecretKeys = map[string]struct{}{ KeyPreSharedKey: {}, }
SecretKeys lists keys whose values must be redacted in logs.
Functions ¶
This section is empty.
Types ¶
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy holds MDM-managed settings read from the platform source. A nil or empty Policy means no enforcement is active.
func LoadPolicy ¶
func LoadPolicy() *Policy
LoadPolicy reads the platform-native MDM configuration. Returns an empty (but non-nil) Policy when no source is present, the source is empty, or the platform is unsupported.
Diagnostic logging differentiates the three states:
- source absent / unsupported platform: trace log only
- source present, zero keys: info "MDM enrolled (no managed keys)"
- source present, N keys: info "MDM enrolled with N managed keys: [...]"
func NewPolicy ¶
NewPolicy constructs a Policy from a key→value map. Pass nil or an empty map to construct an empty (no-enforcement) Policy. The returned *Policy is always non-nil.
func (*Policy) GetBool ¶
GetBool returns the managed value for key coerced to bool, and whether the key was set. Accepts native bool and string literals (true/false, 1/0, yes/no, on/off), case-insensitively and trimmed of surrounding whitespace.
func (*Policy) GetInt ¶
GetInt returns the managed value for key as int64, and whether the key was set. Accepts native int / int64 (as produced by the Windows registry loader for REG_DWORD/REG_QWORD) and numeric strings (decimal).
func (*Policy) GetString ¶
GetString returns the managed value for key coerced to string, and whether the key was set. A non-string value returns ("", false).
func (*Policy) GetStringSlice ¶
GetStringSlice returns the managed value for key as []string, and whether the key was set. Accepts []string, []any (of strings), and a single string (treated as a one-element list).
func (*Policy) ManagedKeys ¶
ManagedKeys returns the sorted list of managed key names. Returns an empty slice (not nil) on an empty Policy.
type Ticker ¶
type Ticker struct {
// contains filtered or unexported fields
}
Ticker periodically re-reads the OS-native MDM policy via LoadPolicy and invokes the onChange callback (supplied to Run) whenever the observed Policy diverges from the last observation (added / removed / changed keys). Launch with Run from a goroutine; cancel the supplied context to stop.
func NewTicker ¶
NewTicker constructs a Ticker that will re-read the OS-native policy every reloadInterval once Run is called. The initial snapshot is populated by calling policyLoader at construction time so the first tick only fires onChange when the policy actually changed since boot — without this baseline the first tick would report every currently-managed key as "added" and trigger a spurious engine restart.
Source Files