venturablocker 20221004

.gitignore

@@ -0,0 +1,4 @@
+
+.DS_Store
+*.pkg
+venturablocker-pkg/build-blockerPkg.sh

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing to venturablocker
+
+## Pull Requests (PRs)
+
+If you know of improvements to this app, please post a PR.
+
+## Issues
+
+If you encounter an issue please document it and write an issue.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Hannes Juutilainen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,65 @@
+# Ventura Blocker
+
+Detect when `Install macOS Ventura.app` installer application has launched, terminate the process and display an alert.
+
+![venturablocker](https://raw.githubusercontent.com/Theile/venturablocker/main/screenshot.png)
+
+_This project is totally copied from the original bigsurblocker from which I made montereyblocker, and now also venturablocker._
+
+To fully uninstall `venturablocker`, run the script [venturablocker-remove.sh](venturablocker-remove.sh) (as root or with `sudo`) or deploy through MDM.
+
+_See [hjuutilainen/bigsurblocker](https://github.com/hjuutilainen/bigsurblocker) for the original software for blocking Big Sur and README there._
+
+
+The rest of this README is from that original project:
+
+This project is heavily inspired by Erik Berglund's [AppBlocker](https://github.com/erikberglund/AppBlocker). It uses the same underlying idea of registering and listening for NSWorkspace notifications when app has started up and then checking the CFBundleIdentifier of the launched app to identify a Big Sur installer launch.
+
+# Why
+
+Apple wants end users to upgrade to the latest macOS as soon as it becomes available. Depending on the software and policies your organization uses, this might be unacceptable. As an administrator, you currently have some options:
+- Use an MDM to push a profile to delay updates for maximum of 90 days. This will however postpone _all_ updates, not just the macOS upgrade.
+- If your fleet is enrolled in an MDM, you can use `softwareupdate --ignore` to hide certain updates. This will result in a highly broken user experience where the system thinks it has an update pending but it is unable to download and install it. Apple has also decided that only MDM enrolled systems can use the `--ignore` flag.
+- If you are already using a binary authorization system such as Googles [Santa](https://github.com/google/santa), you should use it but deploying a system like Santa only for blocking Big Sur might be unfeasible.
+
+# How
+
+The `bigsurblocker` binary is installed in `/usr/local/bin` and is launched for each user through a launch agent. This means that the binary is running in the user session and therefore has the privileges of the current user. It runs silently in the background and listens for app launch notifications. As soon as the user launches the macOS installer application, the binary (forcefully) terminates it and displays a warning message.
+
+By design, it will _not_ block the `startosinstall` command line tool.
+
+# Requirements
+
+The binary requires at least macOS 10.9, however it has been tested only on macOS 10.10, 10.11, 10.12, 10.13, 10.14 and 10.15.
+
+Note. It seems that macOS 10.10 and 10.11 have trouble installing a signed and notarized package. Use the unsigned package available from the releases page if deploying on those. The signed and notarized package can be used on macOS 10.12 and later.
+
+# Configuration
+
+All configuration is optional. If needed, the alert title and text can be set through a configuration profile. Use `com.hjuutilainen.bigsurblocker` as the domain and `AlertTitle` and `AlertText` as the keys.
+
+# Installation
+
+On macOS 10.12 and later, download a prebuilt package from the [Releases page](https://github.com/hjuutilainen/bigsurblocker/releases) and deploy with your favorite method. The package is signed and notarized.
+
+On OS X 10.11 and earlier, download and deploy an unsigned package from the [Releases page](https://github.com/hjuutilainen/bigsurblocker/releases) and deploy with your favorite method
+
+# Uninstall
+
+To fully uninstall `bigsurblocker`, run the following (as root or with sudo):
+
+```
+current_user_uid=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/UID :/ && ! /loginwindow/ { print $3 }' )
+
+launchd_item_path="/Library/LaunchAgents/com.hjuutilainen.bigsurblocker.plist"
+launchctl bootout gui/${current_user_uid} "${launchd_item_path}"
+
+rm -f /Library/LaunchAgents/com.hjuutilainen.bigsurblocker.plist
+rm -f /usr/local/bin/bigsurblocker
+
+pkgutil --forget com.hjuutilainen.bigsurblocker
+```
+
+# License
+
+Big Sur Blocker is licensed under [the MIT License](https://github.com/hjuutilainen/bigsurblocker/blob/main/LICENSE).

venturablocker-pkg/payload/Library/LaunchAgents/dk.envo-it.venturablocker.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>dk.envo-it.venturablocker</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/usr/local/bin/venturablocker</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>LimitLoadToSessionType</key>
+	<string>Aqua</string>
+</dict>
+</plist>

venturablocker-pkg/scripts/postinstall

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [[ $3 != "/" ]]; then
+    exit 0
+fi
+
+launchd_item_path="/Library/LaunchAgents/dk.envo-it.venturablocker.plist"
+current_user_uid=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/UID :/ && ! /loginwindow/ { print $3 }' )
+
+launchctl bootout gui/${current_user_uid} "${launchd_item_path}" > /dev/null 2>&1
+launchctl bootstrap gui/${current_user_uid} "${launchd_item_path}"
+
+exit 0

venturablocker-remove.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+current_user_uid=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/UID :/ && ! /loginwindow/ { print $3 }' )
+
+launchd_item_path="/Library/LaunchAgents/dk.envo-it.venturablocker.plist"
+launchctl bootout gui/${current_user_uid} "${launchd_item_path}"
+
+rm -f /Library/LaunchAgents/dk.envo-it.venturablocker.plist
+rm -f /usr/local/bin/venturablocker
+
+pkgutil --forget dk.envo-it.venturablocker