#!/bin/bash

# Santa is installed to /var/db/santa/migration/Santa.app. This
# postinstall script moves it to /Applications/Santa.app, if Santa is not
# running, or asks com.northpolesec.santa.daemon to finish the install.

# If the target volume is not /, do nothing
[[ $3 != "/" ]] && exit 0

# Check if an unsupported version of Santa is running.
GOOGLE_SANTA_ACTIVATED="$(/usr/bin/systemextensionsctl list com.apple.system_extension.endpoint_security |
                          /usr/bin/grep -E '^.+EQHXZ8M8AV.+com\.google\.santa\.daemon.+activated.+$')"
if [ -z "${GOOGLE_SANTA_ACTIVATED}" ]; then
  # An unsupported version of Santa IS NOT running, attempt to install.

  # Remove the com.northpolesec.santa.migration launch job, as it is not
  # needed.
  /bin/rm /Library/LaunchDaemons/com.northpolesec.santa.migration.plist
  /bin/rm /Library/LaunchDaemons/com.northpolesec.santa-migration.plist

  # Attempt to remove the current install of Santa, if any. If this command
  # succeeds, Santa is not currently running and this script should finish the
  # install. If Santa is running, its tamper protections will prevent removal
  # of /Applications/Santa.app.
  /bin/rm -rf /Applications/Santa.app
  if [ $? -eq 0 ]; then
    # Removal was successful.
    # Install Santa and load the system extension. The system extension will
    # finish loading the rest of Santa's configs and helper services.
    /bin/mv /var/db/santa/migration/Santa.app /Applications/Santa.app
    /Applications/Santa.app/Contents/MacOS/Santa --load-system-extension
  else
    # Tamper protections are enabled, ask Santa to install the update. If the
    # update is valid, the system extension will take care of finishing the
    # install.

    /bin/chmod +x /Applications/Santa.app/Contents/MacOS/santactl

    SANTA_VERSION=$(/Applications/Santa.app/Contents/MacOS/santactl version | /usr/bin/awk '/^santad/ { print $3 }')
    SANTA_MODE=$(/Applications/Santa.app/Contents/MacOS/santactl status | /usr/bin/awk '/ *Mode/ { print $3 }')

    # For Santa v2024.10 and v2024.11, create allow rules to unblock upgrades in Lockdown mode
    if [[ ("${SANTA_VERSION}" == "2024.10" || "${SANTA_VERSION}" == "2024.11") && "${SANTA_MODE}" != "Monitor" ]]; then
      sb='(version 1)(allow default)(deny mach-lookup (with no-report) (global-name "com.apple.cfprefsd.daemon"))(deny file-read-data (with no-report) (subpath "/Library/Managed Preferences/com.northpolesec.santa.plist"))'

      signing_ids=(
        "ZMCG7MLDV9:com.northpolesec.santa"
        "ZMCG7MLDV9:com.northpolesec.santa.bundleservice"
        "ZMCG7MLDV9:com.northpolesec.santa.ctl"
        "ZMCG7MLDV9:com.northpolesec.santa.daemon"
        "ZMCG7MLDV9:com.northpolesec.santa.metricservice"
        "ZMCG7MLDV9:com.northpolesec.santa.syncservice"
      )

      # Add rules to allow NPS Santa components
      for signing_id in "${signing_ids[@]}"; do
        /usr/bin/sandbox-exec -p "${sb}" /Applications/Santa.app/Contents/MacOS/santactl rule --allow --signingid --identifier "${signing_id}" >/dev/null 2>&1
      done
    fi

    /Applications/Santa.app/Contents/MacOS/santactl install
  fi

  # Although Santa isn't running, we still try to move any lingering newsyslog
  # config that might exist. If any changes had been made to a previous Santa
  # deployment, that same config will continue to be used here.
  /bin/mv -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf /private/etc/newsyslog.d/com.northpolesec.santa.newsyslog.conf || true

  # Cleanup cache dir.
  /bin/rm -rf /var/db/santa/migration

  # Create a symlink for santactl.
  /bin/mkdir -p /usr/local/bin
  /bin/ln -s /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin 2>/dev/null
else
  # An unsupported version of Santa IS running.

  # Load the com.northpolesec.santa.migration launch job. It will wait for the
  # unsupported version of Santa to be removed, then trigger an install of the
  # new version.
  /bin/launchctl load -w /Library/LaunchDaemons/com.northpolesec.santa-migration.plist
fi

exit 0
