#1167 Santa: send removable_media_policy instead of deprecated block_usb_mount Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem osctrl sends

block_usb_mount

, which is deprecated. The v1 protocol has a richer

removable_media_policy

(allow, block, remount with flags such as read-only or noexec), plus

encrypted_removable_media_policy

and

remount_usb_mode

. Scope • Environment config for the v1

RemovableMediaPolicy

options and

encrypted_removable_media_policy

. • Send `removable_media_policy`; keep

block_usb_mount

only for older clients (document the minimum Santa version). • Settings tab controls; migrate existing

block_usb_mount=true

to the equivalent policy. Acceptance • Clients receive the policy at preflight; tests cover each option. • Depends on: #1184 Protocol Third-party sync servers must use the stable v1 protos (

buf.build/gen/go/northpolesec/protos/protocolbuffers/go/sync

).

syncv2

is internal to North Pole Security and is being removed from the published protos (northpolesec/santa#1270). jmpsec/osctrl