Modify the arg checking to suit Jamf Pro policies

[Honestpuck]

Problem to solve

As written the compliance script cannot be run from a Jamf Pro policy as Jamf Pro inserts three arguments before the policy arguments

Intended users

Jamf Pro admins

Further details

Fixing this will be a minor change.

Proposal

At the top of the compliance script (around line 18) I will insert

# set the number of args expected
# if running from a Jamf Pro policy set this to 4
number_of_args=1

Then close to the bottom

# check for command line arguments, if --check or --fix, then just do them.
if (( # >= 2));then
    echo "Too many arguments. Usage: $0 [--check| --fix]"
    exit 1
fi

could have # >= 2 replaced with > $number_of_args

Documentation

Perhaps a note in the Wiki

Testing

I have made the changes and tested from both the command line and a Jamf policy and it all works.

What does success look like, and how can we measure that?

It is easier for Jamf Pro admins to use the compliance script. I will only do it if the team thinks it's acceptable.

Links / references

I couldn't find the spot in the Jamf doco that tells you about the script parameters.

If this is a good idea I can quickly put together a PR. Comments?

[robertgendler]

Check out the dev_monterey_compliance_script branch and see if that works better with Jamf. Changes have been made to make it work more universal.

[Honestpuck]

That removes the check on the number of arguments entirely so that works better than the original. I guess you can argue either way, remove the arg checking entirely or maker the number of args a constant. I went for minimal change.

Is that branch likely to get merged any time soon?

[robertgendler]

Yup. Just needs testing to make sure we haven't broke anything too badly with changes in the script.

[Honestpuck]

I will do some testing early next week.

Next thing I want to do is write a script that generates the EAs and computer groups for Jamf and then uploads them. generate_jamf.py maybe.

[smithjw]

@Honestpuck / @robertgendler I've made a small tweak to the generate_guidance.py script to take this a step further and run multiple functions if an admin passes multiple arguments into the script.

https://github.com/usnistgov/macos_security/pull/141

[Honestpuck]

Brilliant @smithjw. Good change. Is this now in main? When it is I'll edit my HOWTO

[robertgendler]

@Honestpuck this is now in the OS branches. We probably won't merge to main until the fall is my guess with the release of the new version of the OS.

[Honestpuck]

I might leave the HOWTO the way it is now until the merge. Branches might be a task too far for some. Thanks for letting me know.

[golbiga]

This is merged into the OS branches, will be merged into main at ventura release