#1186 Removable media policy for Santa sync Pull request opened by javuto Removable media policy for Santa sync Closes #1167 Problem osctrl could only turn removable media blocking on or off for an environment (

block_usb_mount

). The stable v1 sync protocol also supports remounting volumes with restrictive mount options, and a separate policy for encrypted volumes. osctrl offered neither. Change Policy • Each environment now has a removable media policy: •

ALLOW

(default): mounts are not touched. • `BLOCK`: mounts are denied. • `REMOUNT`: mounts are remounted with the selected options (

rdonly

,

noexec

,

nosuid

,

nodev

,

nobrowse

,

noowners

,

async

,

-j

). • An optional override for encrypted volumes takes the same values. When it is not set, encrypted volumes follow the main policy. Sync (

osctrl-tls

) • Preflight sends

removable_media_policy

, plus

encrypted_removable_media_policy

when the override is set. • For Santa clients that predate the new field, preflight also sends the deprecated

block_usb_mount

and

remount_usb_mode

, derived from the main policy. Those clients ignore the encrypted override. API (

osctrl-api

) •

PUT /api/v1/santa/{env}/config

accepts

removable_media

,

removable_media_flags

,

encrypted_removable_media

and

encrypted_removable_media_flags

. • Invalid input returns `400`: an unknown action, an unknown mount option,

REMOUNT

without options, or options sent with

ALLOW

or

BLOCK

. • Mount options are trimmed, lowercased and de-duplicated before they are saved. • Requests that send only

block_usb_mount

keep working:

true

is treated as

BLOCK

. • The same checks run in

santa.Manager.SaveConfig

, so callers other than the API handler cannot store an invalid config. UI • On the Settings tab, the "Block USB mounts" checkbox is replaced by two dropdowns: Removable media and Encrypted removable media. • When

REMOUNT

is selected, a set of mount option checkboxes appears. • Translation keys were added to all 20 locales. Schema • Four new columns on

santa_env_configs

, added by the startup

AutoMigrate

. • A startup backfill fills in the policy for existing rows that have none:

block_usb_mount = true

becomes

BLOCK

, any other row becomes

ALLOW

. Rows that already have a policy are left alone, so running it again changes nothing. Docs •

pkg/santa/README.md

has a new "Removable media" section. • The root README mentions the policy. •

osctrl-api.yaml

has been regenerated. Security / operational impact • This is an additive schema change, but the backfill writes to existing rows at startup. Upgrading does not change the effective policy for any existing environment. • Mount options are checked against the list Santa accepts, so arbitrary strings never reach clients. • Changing the config still requires environment admin permission and is written to the audit log, as before. •

block_usb_mount

is still stored, derived from the policy on every save. Rolling back to an older build therefore keeps the previous blocking behavior. Any

REMOUNT

setting degrades to a plain block. Validation •

go test ./pkg/santa/... ./cmd/api/... ./cmd/tls/...

• New

pkg/santa/media_test.go

covers validation, the preflight response for each policy and the encrypted override, and the legacy backfill. • New handler tests for

PUT /config

cover the legacy field, the default, flag normalization and rejection cases. •

go vet

and

golangci-lint

(santa package and handlers): 0 issues;

gofmt

clean. •

make openapi-check

passes. •

cd frontend && npm test

(786 tests) and

npm run check

pass. A new test saves a

REMOUNT

policy with options and leaves the encrypted override unset. Not verified: • The Settings tab in a browser. • A real Santa client. • The backfill on Postgres or MySQL; it was only run on SQLite. • The new translations, which have not been reviewed by native speakers. jmpsec/osctrl