Don't show macOS hosts as disk encryption verifying when they're also in the action-required group #24844
Conversation
… in the action-required group This happens when the disk encryption profile has been sent successfully and verified by MDM, but we haven't been sent the (encrypted) key via Orbit yet because the end user needs to log out or restart their machine to finish key rotation. For #24244.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #24844 +/- ##
==========================================
+ Coverage 63.57% 63.58% +0.01%
==========================================
Files 1602 1607 +5
Lines 151819 152250 +431
Branches 3900 3900
==========================================
+ Hits 96512 96811 +299
- Misses 47622 47725 +103
- Partials 7685 7714 +29
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
server/datastore/mysql/hosts_test.go
Outdated
| listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{MacOSSettingsDiskEncryptionFilter: fleet.DiskEncryptionFailed}, 0) | ||
| listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{MacOSSettingsDiskEncryptionFilter: fleet.DiskEncryptionRemovingEnforcement}, 0) | ||
|
|
||
| // simulate orbit ping from host 0 with unverified key after key rotation; should switch host to verifying |
There was a problem hiding this comment.
nit, for macOS we ingest escrow key via osquery:
fleet/server/service/osquery_utils/queries.go
Line 744 in 1f39717
There was a problem hiding this comment.
Thanks. I was looking at the right file and somehow got wires crossed that it was orbit rather than osquery. Updating.
There was a problem hiding this comment.
To be fair, it's via osquery with an orbit table :)
This happens when the disk encryption profile has been sent successfully and verified by MDM, but we haven't been sent the (encrypted) key via Orbit yet because the end user needs to log out or restart their machine to finish key rotation.
For #24244.
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)