bastion 0.63.1

client-go/anchorpolicy_darwin.go

@@ -0,0 +1,35 @@
+//go:build darwin
+
+package main
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+)
+
+// anchorPolicyPlist is the machine-wide managed preference domain a
+// configuration profile (MDM) installs for the bastion. The folder is root's
+// and the system writes it; a file there not owned by root is not a policy.
+const anchorPolicyPlist = "/Library/Managed Preferences/ai.privatae.bastion.plist"
+
+func readAnchorPolicyOS() *anchorPolicy {
+	fi, err := os.Lstat(anchorPolicyPlist)
+	if err != nil || !fi.Mode().IsRegular() || fi.Mode().Perm()&0o022 != 0 {
+		return nil
+	}
+	if st, ok := fi.Sys().(*syscall.Stat_t); !ok || st.Uid != 0 {
+		return nil
+	}
+	// defaults reads the binary and the XML form alike.
+	out, err := exec.Command("/usr/bin/defaults", "read", strings.TrimSuffix(anchorPolicyPlist, ".plist"), "AnchorHost").Output()
+	if err != nil {
+		return nil
+	}
+	v := strings.TrimSpace(string(out))
+	if v == "" {
+		return nil
+	}
+	return &anchorPolicy{Host: v, Source: "the managed preference ai.privatae.bastion AnchorHost"}
+}