outset icon indicating copy to clipboard operation
outset copied to clipboard
verified publisher icon macadmins

Managed Profiles only processing appears to still be bugged...

Open HowardGMac opened this issue 5 months ago • 5 comments

Describe the bug When you attempt to run outset using only a managed profile as the script source the following Outset action types do not appear to be processing correctly: login-privileged-once login-privileged-every boot-once

In the case of boot-once it will process provided there is a file in the local boot-once outset folder.

To Reproduce Use the attached folder of outset scripts to generate a managed profile: testingoutset.zip using the following command after the folder is placed on the Desktop: /usr/local/outset/Outset.app/Contents/Resources/outset-payload --directory ~/Desktop/testingoutset Create managed profile from the plist and assign it to target machine Ensure Outset version 4.20.21973 is installed. Restart target computer and allow it to startup, then login as any user. Open /Users/Shared/testing.log on the target computer See that only some of the outset action types are processed

Expected behavior All of the outset action types should be processed

System Details:

  • OS: macOS 15.6 and macOS 26b4
  • Architecture: Apple Silicon
  • Version: 4.2.0.21973

Additional context Here are copies of pertinent outset related files from one of the tested machines outset.log testing.log io.macadmins.outset.plist-files.zip

HowardGMac avatar Aug 06 '25 00:08 HowardGMac

hmm - as written, the way boot-once works is you place your script in the boot-once folder and then after it is processed the file is deleted. For all other once processing it is recorded against a user account to not run again for that user.

There's a couple options here in how we can deal with it.

  1. Keep the existing functionality and update documentation etc accordingly. For example this is how on-demand works.
  2. Update the logic to process boot-once the same as other once processing

I'm thinking go with option 2. It will maintain logical consistency with how other items are processed. There will be a bit of adjustment to make that happen but should be worth it.

bartreardon avatar Aug 06 '25 03:08 bartreardon

Looks like solid progress. Finally had a chance to build this version and run it on a test machine. Two runs on 08-07, first one was without resetting the plist preference files, second run was after pulling them. Boot-every seems to trigger twice in the first run, but not in the second. Still no login-privileged run states.

Would running this in debug give you valuable additional information ? This run was before the code changes you added an hour ago. I will regrab, rebuild, and test tomorrow morning.

Here are the log and plist files testing-0807.log outset-0807.log PLIST files-0807.zip

HowardGMac avatar Aug 08 '25 02:08 HowardGMac

running --debug will show you a bunch of stuff (as well as let you put the payloads in the preferences locally instead of requiring MDM delivery)

e.g.

DEBUG: found key script_payloads_testing
INFO: Payload "script_payloads_testing" is managed
DEBUG: found key script_payloads_issue
INFO: Payload "script_payloads_issue" is not managed
INFO: DEBUG is enabled. Payloads in "script_payloads_issue" will be processed
DEBUG: found key script_payloads_login-privileged-every
INFO: Payload "script_payloads_login-privileged-every" is managed
DEBUG: Loading preference file: /Library/Preferences/io.macadmins.Outset.plist
INFO: Processing scheduled runs for privileged login
DEBUG: Checking payloads for login-privileged-once
INFO: Processing scripts for context: login-privileged-once
INFO: Processing login-privileged-once payload script : outsettest6.sh
DEBUG: Wrote payload to /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/E3C32597-0FE0-4150-8853-E51882CE9019
DEBUG: Loading preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: runOnce = ["outsettest2.sh": 2025-08-07 00:02:29 +0000, "outsettest4.sh": 2025-08-08 00:44:54 +0000, "outsettest6.sh": 2025-08-08 01:06:15 +0000]
INFO: Processing run-once outsettest6.sh
DEBUG: checking for override
DEBUG: override for outsettest6.sh dated 2025-08-08 01:05:58 +0000
DEBUG: Storing preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: Cleaned up /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/E3C32597-0FE0-4150-8853-E51882CE9019
DEBUG: Checking payloads for login-privileged-every
INFO: Processing scripts for context: login-privileged-every
INFO: Processing login-privileged-every payload script : outsettest5.sh
DEBUG: Wrote payload to /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/F70A63EA-50FE-4802-B68D-1B9539708B91
DEBUG: Loading preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: runOnce = ["outsettest2.sh": 2025-08-07 00:02:29 +0000, "outsettest4.sh": 2025-08-08 00:44:54 +0000, "outsettest6.sh": 2025-08-08 01:06:15 +0000]
INFO: Processing script outsettest5.sh
DEBUG: Running task /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/F70A63EA-50FE-4802-B68D-1B9539708B91
DEBUG: Completed task /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/F70A63EA-50FE-4802-B68D-1B9539708B91 with status 0
DEBUG: Task output:

DEBUG: Storing preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: Cleaned up /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/F70A63EA-50FE-4802-B68D-1B9539708B91
INFO: Processing login-privileged-every payload script : test.sh
DEBUG: Wrote payload to /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/AA6ADA3D-5F4A-489E-B369-3F515B06FF6E
DEBUG: Loading preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: runOnce = ["outsettest6.sh": 2025-08-08 01:06:15 +0000, "outsettest4.sh": 2025-08-08 00:44:54 +0000, "outsettest2.sh": 2025-08-07 00:02:29 +0000]
INFO: Processing script test.sh
DEBUG: Running task /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/AA6ADA3D-5F4A-489E-B369-3F515B06FF6E
DEBUG: Completed task /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/AA6ADA3D-5F4A-489E-B369-3F515B06FF6E with status 0
DEBUG: Task output:
I'm a managed script running from a config profile

DEBUG: Storing preference file: /Library/Preferences/io.macadmins.Outset.plist
DEBUG: Cleaned up /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/AA6ADA3D-5F4A-489E-B369-3F515B06FF6E

There were a couple of issues a few commits ago with how some data was being stored but seems to be ok for me at the moment

bartreardon avatar Aug 08 '25 03:08 bartreardon

Pulled down the latest code you merged and looks like everything works, with one caveat.

For my test machine in order to get the login-privileged-once and login-privileged-every events to fire with only profiles, the corresponding local folder cannot be empty. Using a simple touch .test command in the corresponding folder then enables them to fire.

Looking at the code changes this morning.

HowardGMac avatar Aug 08 '25 12:08 HowardGMac

weird - on my device here both those directories are empty

% ls -la /usr/local/outset/login-privileged-every /usr/local/outset/login-privileged-once
/usr/local/outset/login-privileged-every:
total 0
drwxr-xr-x   2 root  wheel   64 22 Jul 12:27 .
drwxr-xr-x  16 root  wheel  512  4 Aug 15:53 ..

/usr/local/outset/login-privileged-once:
total 0
drwxr-xr-x   2 root  wheel   64 29 Apr 19:27 .
drwxr-xr-x  16 root  wheel  512  4 Aug 15:53 ..

bartreardon avatar Aug 10 '25 22:08 bartreardon