mac_user: fixing gid and system properties, and adding hidden property

[chilcote]

Goals:

• mac_user provider will now use the numeric GID when creating a user, instead of passing what was literally in the resource (e.g. it will use 80 instead of "admin")
• brings back support for system true from the old dscl provider.
• adds support for new property hidden which will set the IsHidden value in the user plist.

Description

The GID will fix issues where the system does not recognize the user (for chown operations, or id, etc)

The system: true works, but there are still macOS quirks. For instance, if you run chef manually in terminal, you'll be prompted to give Terminal.app privacy protection rights to be able to set the UID. When run via launchd, which is how most orgs would use chef, macOS just ignores the UID you pass and pulls its own (usually starting at 502 and going up to the next available one). This seems to be a limitation in the sysadminctl tool itself, in conjunction with the added privacy protections around updating a UID for a user. The fix for this behavior would involve signing chef (or chef's ruby) and whitelisting it for SystemPolicySysAdminFiles via MDM.

Since what most of us are interested in is not specifically assigning a UID under 500 (which Apple doesn't even support), I'm also adding in support to this resource for the IsHidden dscl attribute. Setting this to 1 (which, apple terms, means "true"), the account will not show up in System Prefs or at the Login Window.

Related Issue

#9171

Types of changes

• [x ] Bug fix (non-breaking change which fixes an issue)
• [ x] New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• [ x] I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• [x ] All commits have been signed-off for the Developer Certificate of Origin.

[tas50]

@chilcote As of Chef Infra Client 15.8 we will be signing all the binaries in Chef to comply with all the new notarization requirements. So next week we'll be signed

[chilcote]

@tas50 That's very interesting news! Is there info posted on what needs to be added to the kernel extension whitelist full disk access payloads?

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.