Uninstall packages

[pintomi1989]

Goal

User story
As a IT admin who no longer wants to manage a software item (package),
I want to uninstall the package from a host
so that I can prevent the host from having outdated and potentially vulnerable software installed.

Context

• Requestor(s): @pintomi1989
• Product designer: @marko-lisica

Changes

Product

• [ ] UI changes: Figma link
• [ ] REST API changes: #21548
• [ ] Permissions changes: Maintainers and admins (team and global) can uninstall software on a specific host. (Team roles can uninstall software on hosts assigned to their team(s)).
• [ ] Changes to paid features or tiers: Available in Fleet Premium.

Engineering

• [ ] Reference documentation changes: #21618
• [ ] Usage documentation changes: TODO
• [ ] Database schema migrations: TODO
• [ ] Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. [ ] Engineer (@____): Added comment to user story confirming successful completion of QA.
2. [ ] QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Hey @marko-lisica it sounds like there's another use case we should be designing for when working on this story. We can decided later if we'd ship it separately.

customer-reedtimmer described this use case:

I want to be able to remove any software. Not just software that Fleet installed.

For example, we use the Restricted Software feature in Jamf to delete WeChat anytime it's installed by the end user.

[sharon-fdm]

Early estimations (before design is complete): BE - 8 GOps - 3 FE - 11-12 (13)

[getvictor]

Questions:

• Is there a new state for Uninstalled, or does it go back to Available for Install? How does admin know that there are uninstall details?
• Can admin uninstall software that was not installed by Fleet (if user installed it themselves)?
• What can admin do if uninstall failed -- reinstall? try uninstalling again?

[sharon-fdm]

BE - Victor - 8 points Gitops - Victor - 3 Points FE - Jacob - 13 Points

[marko-lisica]

Hey @RachelElysia and @noahtalerman, here's loom video about what's left to handover this story. I explained how might we solve default install and uninstall script for EXE installers and some suggestion about uninstall status.

[RachelElysia]

@getvictor cc: @sharon-fdm, @noahtalerman

@marko-lisica strongly suggests that #20000 is a bug fix we tackle in this #20320, Confirming with you to add it to our subtasks and assign the BE for estimation. Looks like Victor has 2 point capacity remaining at sprint kickoff.

[marko-lisica]

@getvictor cc: @sharon-fdm, @noahtalerman

@marko-lisica strongly suggests that #20000 is a bug fix we tackle in this #20320, Confirming with you to add it to our subtasks and assign the BE for estimation. Looks like Victor has 2 point capacity remaining at sprint kickoff.

Not sure if I described well in the loom above, but I think it makes sense to solve #20000 in this story. It was too big to solve this as a bug since we needed a way to extract some data from .exe and store it in DB in order to use that data in the uninstall script. As we do this already in this story for every other package type (MSI, PKG, DEB) it makes sense to do for EXE and close #20000.

[sharon-fdm]

@RachelElysia @getvictor Can you please raise this in today's standup? We can estimate together and see if we can take it.

[getvictor]

@RachelElysia Questions:

1. Are uninstall details only available from activity feed?
2. Can admin uninstall software that was not installed by Fleet (if user installed it themselves)? Can admin uninstall software even if it doesn't show up as installed (which may be the case if we fail to match installed software with the package)?
3. What can admin do if uninstall failed -- reinstall? try uninstalling again?
4. Can uninstall be disabled? This is useful for current Fleet software, which does not have uninstall scripts and did not extract PACKAGE_IDs.
   • What happens if uninstall script is empty?

[RachelElysia]

Thanks for being proactive on this ticket @getvictor and all great questions

@noahtalerman / @marko-lisica please chime in on any of this!

Victors questions from comment, asked again with more questions in comment:

1. Are uninstall details only available from activity feed?
2. Can admin uninstall software that was not installed by Fleet (if user installed it themselves)? Can admin uninstall software even if it doesn't show up as installed (which may be the case if we fail to match installed software with the package)?
3. What can admin do if uninstall failed -- reinstall? try uninstalling again?
4. Can uninstall be disabled? This is useful for current Fleet software, which does not have uninstall scripts and did not extract PACKAGE_IDs. What happens if uninstall script is empty?

1. Yes, I questioned this too. But design decided to cut having it from the show details modal so it's only maintained in one spot. Users will see a tooltip on the Failed status pointing them to the activity feed for more details.
2. @noahtalerman / @marko-lisica CMIIW here, right now, we want to uninstall the current package only. A future iteration will likely have uninstall using policy automations such as automated uninstalling software script running it a host fails a policy. Probably want some kind of validation that the uninstall script is for the current software, @marko-lisica did some research into this, so hopefully he can speak to this in more details.
3. If uninstall failed, #20404 will allow the admin to edit software including the uninstall script and try uninstalling again. If uninstall failed, the tooltip will point them to see details in the activity feed.
4. Good question. I believe if the uninstall script is empty (meaning the user intentionally deleted the default script), it should be ignored and uninstall UI should be disabled. Going to add that to design, please chime in otherwise @noahtalerman / @marko-lisica

[marko-lisica]

@RachelElysia I agree with the first 3 items, that's what we want for the first iteration. Uninstall details only in activity feed, uninstall available only for software with package uploaded (soon for VPP), and if uninstall fails user can edit uninstall script and try again.

@getvictor Re 4th item: I think we shouldn't let user to remove uninstall script. Would it be possible to do migration for software uploaded previously?

[RachelElysia]

Design review answer:

4. If the user deletes the uninstall script we will repopulate it with the default uninstall script (similar to the current behavior for install script deleted is repopulated with the default script)

[noahtalerman]

Hey @getvictor, @RachelElysia told me that you had questions on the plan for backfilling uninstall scripts for existing packages (ones that were added to Fleet prior to upgrade).

Here's the plan @lukeheath and I discussed during design review:

Upon upgrade, after Fleet database migration (DB), a scheduled job populates uninstall scripts for existing packages. Job only runs one time (if successful).

Why job?

• Why not do this during uninstall? We want to present the user with the uninstall script in the Fleet UI before they run it.
• Why not during DB migrations? We need to extract metadata from existing packages to create the uninstall script. We don't want to do this operation during DB migrations. Performance intensive.

Victor, please schedule 30 mins w/ Luke and I if you have questions or you think this isn't the right approach. Thanks!

cc @sharon-fdm

[nonpunctual]

@noahtalerman @marko-lisica @getvictor Since we are inspecting the packages, has anyone put any cycles into looking at whether or not the apps we are supporting have a native uninstaller? It's probably best to make use of the native uninstaller in most cases (unless it's not good, which does happen...) Often it is in its own app bundle with a CLI binary that can be called or is an .app bundle that may be able to be opened with the open command to automatically run its own scripts.

There are some apps for which the native uninstaller does more than just remove files. It will break connections with servers, remove preferences, etc. Maybe this is for phase 2 / 3 of this feature but i wanted to make note of it here. Thanks.

cc @dave @allenhouchins @harrisonravazzolo @ddribeiro

[marko-lisica]

@noahtalerman @marko-lisica @getvictor Since we are inspecting the packages, has anyone put any cycles into looking at whether or not the apps we are supporting have a native uninstaller? It's probably best to make use of the native uninstaller in most cases (unless it's not good, which does happen...) Often it is in its own app bundle with a CLI binary that can be called or is an .app bundle that may be able to be opened with the open command to automatically run its own scripts.

There are some apps for which the native uninstaller does more than just remove files. It will break connections with servers, remove preferences, etc. Maybe this is for phase 2 / 3 of this feature but i wanted to make note of it here. Thanks.

cc @dave @allenhouchins @harrisonravazzolo @ddribeiro

Hey @nonpunctual, thanks for the feedback. I haven't found an app with native uninstallers so far. We looked at some of the most popular apps and ensured the default uninstall script worked for them. Do you have some examples of apps that have native uninstallers, so that I can take a look and understand better how it works?

[nonpunctual]

@marko-lisica @noahtalerman I am pretty sure the Crowdstrike Falcon agent has an uninstaller?

[marko-lisica]

@marko-lisica @noahtalerman I am pretty sure the Crowdstrike Falcon agent has an uninstaller?

@nonpunctual That's right, I forgot about security agents. Thinking about the default uninstall script, I'm not sure how Fleet can know if the native uninstaller is available for some .pkg. Since we expose the uninstall script, the user can edit and use what vendor provided in docs. I think most probably they will need some token to remove security agents, so they will anyway need to edit uninstall script.

For Crowdstrike Falcon it seems pretty simple to copy the script from their docs (sudo /Library/CS/falconctl uninstall ––maintenance-token). If there are some other examples it would be great to track them in this issue here, and we can always open a feature request to improve uninstall feature in Fleet.

[noahtalerman]

@nonpunctual thanks for calling this use case out!

@marko-lisica I think mean that the IT admin would take these steps to install and then later uninstall CrowdStrike in Fleet?

1. Add the CrowdStrike package to available for install software in Fleet
2. Add a policy to check if the CrowdStrike is installed
3. To automatically install: In new policy automation: install software (#19551), Connect CrowdStrike to the policy
4. Edit CrowdStrike's uninstall script to the following:

sudo /Library/CS/falconctl uninstall ––maintenance-token

5. To manually uninstall: on a host's Host details > Software tab, find CrowdStrike and select Actions > Uninstall.

No automatic uninstall in Fleet yet. Today, the IT admin would add a policy to check if Crowdstrike is installed, turn on policy webhooks, and catch webhook and hit Fleet's uninstall API endpoint (coming soon) in Tines (third-party automation tool).

[sharon-fdm]

QA DRI - @mostlikelee

[getvictor]

Related issues for EXE packages: #20000, #22092 (duplicate)

EXE packages that work with default scripts:

FileZilla https://filezilla-project.org/download.php?platform=win64 In uninstall script, use /S as $uninstallArgs

Firefox Get the full installer like: https://download.mozilla.org/?product=firefox-latest&os=win&lang=en-US DO NOT get product=firefox-stub In uninstall script, use -ms as $uninstallArgs

[getvictor]

@marko-lisica @noahtalerman

1. Currently, $PACKAGE_ID is only replaced in the uninstall script. Do we also need to replace it in install/post-install scripts?
2. Did we spec a timeout for install/post-install scripts? I don't see anything in the code.

[marko-lisica]

Hey @getvictor

1. As far as I know there's no use case that $PACKAGE_ID is needed for install or post-install scripts. I would keep it for the uninstall script only until we learn that it's required in other scripts.
2. What's the timeout for regular scripts? We should have the same timeout for software-related scripts.

[mostlikelee]

I'm ok with calling QA on this feature good. There are many error cases where uninstall does not always work against software not installed by Fleet, but based on product feedback these are not bugs and will be filed as feature enhancements.

• cannot uninstall some software not installed by Fleet
• UI error when attempting to uninstall software without an associated software installer in Fleet
• unknown expected behavior when uninstalling software that has multiple versions installed

[noahtalerman]

@zayhanlon and @dherder heads up that this user story was shipped in Fleet 4.57 🙌

[fleet-release]

Uninstall with ease, Secure hosts from old threats, Like leaves in the breeze.