536 lines
18 KiB
YAML
536 lines
18 KiB
YAML
# =============================================================================
|
|
# VesperOS Configuration Profile Schema
|
|
# Package : vesperprofiled-config-schema
|
|
# Version : 1.0.0
|
|
# Installed at: /usr/share/vesperprofiled/schema/profile.schema.yml
|
|
#
|
|
# vesperprofiled reads this file at startup to determine which payload
|
|
# types and fields are valid for this installation. OEMs may ship a
|
|
# trimmed version of this schema to restrict which payloads their build
|
|
# supports — only payload types listed here will be accepted.
|
|
#
|
|
# Schema versioning:
|
|
# schema-version — incremented when fields are added or removed.
|
|
# vesperprofiled checks that its own compiled-in schema-version matches
|
|
# or is compatible with the installed schema package version.
|
|
# Compatibility rule: daemon >= schema version (newer daemon, older schema ok).
|
|
#
|
|
# OEM customisation:
|
|
# To restrict available payload types, create a trimmed copy of this file
|
|
# and ship it as your own vesperprofiled-config-schema package with a
|
|
# custom Provides: field. Remove entire payload blocks for unsupported types.
|
|
# The daemon will reject any profile containing an unlisted payload type.
|
|
# =============================================================================
|
|
|
|
schema-version: "1.0.0"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Allowed payload types for this schema version.
|
|
# Remove entries to restrict what profiles may contain on this platform.
|
|
# ---------------------------------------------------------------------------
|
|
allowed-payload-types:
|
|
- mdm
|
|
- scep
|
|
- pkcs12
|
|
- cert
|
|
- cert-preference
|
|
- cert-transparency
|
|
- wifi
|
|
- ethernet
|
|
- vpn
|
|
- vpn-per-app
|
|
- email
|
|
- exchange
|
|
- caldav
|
|
- calendar-subscription
|
|
- carddav
|
|
- ldap
|
|
- passcode
|
|
- restrictions
|
|
- kiosk
|
|
- asam
|
|
- proxy-http
|
|
- dns-proxy
|
|
- domains
|
|
- network-usage-rules
|
|
- cellular
|
|
- web-filter
|
|
- web-clip
|
|
- font
|
|
- notifications
|
|
- sso
|
|
- active-directory
|
|
- ad-certificate
|
|
- time-server
|
|
- software-update
|
|
- firewall
|
|
- privacy
|
|
- parental-controls
|
|
- removal-password
|
|
- identification
|
|
- google-account
|
|
- home-screen
|
|
- desktop
|
|
- screensaver
|
|
- global-preferences
|
|
- shared-device
|
|
- education
|
|
- airprint
|
|
- airplay
|
|
- airplay-security
|
|
- system-policy
|
|
- system-policy-rule
|
|
- smartcard
|
|
- kernel-extension-policy
|
|
- media-management
|
|
- full-disk-encryption
|
|
- fde-escrow
|
|
- first-boot
|
|
- setup-assistant # alias for first-boot; always include alongside first-boot
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Signing requirements by payload type.
|
|
# Payloads listed here REQUIRE a signed (CMS/PKCS#7) profile envelope.
|
|
# Unsigned profiles containing any of these types will be rejected.
|
|
# ---------------------------------------------------------------------------
|
|
signing-required:
|
|
- mdm
|
|
- removal-password
|
|
- kiosk
|
|
- asam
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Singleton payload types.
|
|
# Only one instance of each of these is permitted per profile.
|
|
# ---------------------------------------------------------------------------
|
|
singletons:
|
|
- mdm
|
|
- passcode
|
|
- restrictions
|
|
- kiosk
|
|
- asam
|
|
- proxy-http
|
|
- web-filter
|
|
- global-preferences
|
|
- shared-device
|
|
- parental-controls
|
|
- removal-password
|
|
- identification
|
|
- home-screen
|
|
- airplay-security
|
|
- system-policy
|
|
- first-boot
|
|
- setup-assistant
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Payload field definitions.
|
|
# Each entry documents the fields for one payload type.
|
|
# The daemon uses this for validation — unknown fields in a profile
|
|
# are logged as warnings but do not block installation.
|
|
# Required fields that are missing will block installation.
|
|
# ---------------------------------------------------------------------------
|
|
payloads:
|
|
|
|
# ── Top-level profile fields ─────────────────────────────────────────────
|
|
profile:
|
|
required: [id, uuid, version]
|
|
optional:
|
|
version: { type: integer, value: 1 }
|
|
id: { type: string, pattern: "reverse-dns" }
|
|
uuid: { type: string, pattern: "uuid-v4" }
|
|
scope: { type: enum, values: [system, user], default: user }
|
|
meta: { type: object }
|
|
lifecycle: { type: object }
|
|
consent: { type: object }
|
|
|
|
lifecycle:
|
|
optional:
|
|
removal: { type: enum, values: [free, locked, password], default: free }
|
|
expires-at: { type: string, pattern: "iso8601" }
|
|
expires-after: { type: integer, description: "Seconds from install" }
|
|
ota-refresh-after: { type: string, pattern: "iso8601" }
|
|
|
|
# ── MDM ──────────────────────────────────────────────────────────────────
|
|
mdm:
|
|
required: [server-url, identity-cert-uuid, access-rights, push-topic]
|
|
optional:
|
|
checkin-url: { type: string }
|
|
sign-messages: { type: boolean, default: false }
|
|
checkout-on-removal: { type: boolean, default: false }
|
|
use-development-push: { type: boolean, default: false }
|
|
capabilities: { type: array }
|
|
|
|
# ── SCEP ─────────────────────────────────────────────────────────────────
|
|
scep:
|
|
required: [url, challenge]
|
|
optional:
|
|
instance-name: { type: string }
|
|
subject: { type: array }
|
|
key: { type: object }
|
|
san: { type: object }
|
|
ca-fingerprint: { type: string, encoding: base64 }
|
|
retries: { type: integer, default: 3 }
|
|
retry-delay-seconds: { type: integer, default: 10 }
|
|
|
|
# ── Certificates ─────────────────────────────────────────────────────────
|
|
pkcs12:
|
|
required: [data]
|
|
optional:
|
|
password: { type: string }
|
|
all-apps-access: { type: boolean, default: false }
|
|
|
|
cert:
|
|
required: [data]
|
|
|
|
cert-preference:
|
|
required: [name, cert-uuid]
|
|
|
|
# ── Wi-Fi ────────────────────────────────────────────────────────────────
|
|
wifi:
|
|
required: [ssid]
|
|
optional:
|
|
hidden: { type: boolean, default: false }
|
|
auto-join: { type: boolean, default: true }
|
|
security: { type: object }
|
|
mac-address-mode: { type: enum, values: [hardware, random], default: hardware }
|
|
hotspot: { type: object }
|
|
proxy: { type: object }
|
|
eap: { type: object }
|
|
qos-marking: { type: object }
|
|
|
|
# ── Ethernet ─────────────────────────────────────────────────────────────
|
|
ethernet:
|
|
optional:
|
|
interface: { type: string, default: first-active }
|
|
eap: { type: object }
|
|
|
|
# ── VPN ──────────────────────────────────────────────────────────────────
|
|
vpn:
|
|
optional:
|
|
display-name: { type: string }
|
|
full-tunnel: { type: boolean, default: false }
|
|
on-demand: { type: object }
|
|
ikev2: { type: object }
|
|
l2tp: { type: object }
|
|
custom: { type: object }
|
|
|
|
vpn-per-app:
|
|
required: [vpn-uuid]
|
|
optional:
|
|
app-mappings: { type: array }
|
|
browser-domains: { type: array }
|
|
|
|
# ── Mail accounts ─────────────────────────────────────────────────────────
|
|
email:
|
|
required: [account, incoming, outgoing]
|
|
optional:
|
|
smime: { type: object }
|
|
restrictions: { type: object }
|
|
|
|
exchange:
|
|
required: [server, account]
|
|
optional:
|
|
sync: { type: object }
|
|
smime: { type: object }
|
|
restrictions: { type: object }
|
|
|
|
caldav:
|
|
required: [host, username]
|
|
optional:
|
|
description: { type: string }
|
|
port: { type: integer }
|
|
ssl: { type: boolean, default: true }
|
|
principal-url: { type: string }
|
|
password: { type: string }
|
|
use-oauth: { type: boolean, default: false }
|
|
|
|
calendar-subscription:
|
|
required: [url]
|
|
optional:
|
|
description: { type: string }
|
|
username: { type: string }
|
|
password: { type: string }
|
|
ssl: { type: boolean, default: true }
|
|
|
|
carddav:
|
|
required: [host, username]
|
|
optional:
|
|
description: { type: string }
|
|
port: { type: integer }
|
|
ssl: { type: boolean, default: true }
|
|
principal-url: { type: string }
|
|
password: { type: string }
|
|
use-oauth: { type: boolean, default: false }
|
|
|
|
# ── Directory ─────────────────────────────────────────────────────────────
|
|
ldap:
|
|
required: [host]
|
|
optional:
|
|
description: { type: string }
|
|
ssl: { type: boolean, default: true }
|
|
username: { type: string }
|
|
password: { type: string }
|
|
search-settings: { type: array }
|
|
|
|
# ── Security policies ─────────────────────────────────────────────────────
|
|
passcode:
|
|
optional:
|
|
require: { type: boolean, default: true }
|
|
allow-simple: { type: boolean, default: true }
|
|
require-alphanumeric: { type: boolean, default: false }
|
|
min-length: { type: integer, default: 6 }
|
|
min-complex-chars: { type: integer, default: 0 }
|
|
expiry: { type: object }
|
|
lockout: { type: object }
|
|
force-change-at-next-login: { type: boolean, default: false }
|
|
custom-regex: { type: object }
|
|
|
|
restrictions:
|
|
optional:
|
|
apps: { type: object }
|
|
hardware: { type: object }
|
|
network: { type: object }
|
|
cloud: { type: object }
|
|
browser: { type: object }
|
|
content-ratings: { type: object }
|
|
sharing: { type: object }
|
|
open-in: { type: object }
|
|
user: { type: object }
|
|
input: { type: object }
|
|
|
|
kiosk:
|
|
required: [app]
|
|
optional:
|
|
hardware: { type: object }
|
|
accessibility:{ type: object }
|
|
|
|
asam:
|
|
required: [allowed-apps]
|
|
|
|
removal-password:
|
|
required: [password]
|
|
|
|
# ── Network ───────────────────────────────────────────────────────────────
|
|
proxy-http:
|
|
required: [proxy]
|
|
|
|
dns-proxy:
|
|
required: [app-bundle-id]
|
|
optional:
|
|
extension-bundle-id: { type: string }
|
|
config: { type: object }
|
|
|
|
domains:
|
|
optional:
|
|
email-domains: { type: array }
|
|
web-domains: { type: array }
|
|
tracking-relaxed-domains: { type: array }
|
|
|
|
network-usage-rules:
|
|
required: [rules]
|
|
|
|
cellular:
|
|
optional:
|
|
attach-apn: { type: object }
|
|
apns: { type: array }
|
|
|
|
# ── Content filtering ─────────────────────────────────────────────────────
|
|
web-filter:
|
|
required: [mode]
|
|
optional:
|
|
built-in: { type: object }
|
|
plugin: { type: object }
|
|
|
|
# ── UI shortcuts ──────────────────────────────────────────────────────────
|
|
web-clip:
|
|
required: [label, url]
|
|
optional:
|
|
removable: { type: boolean, default: true }
|
|
full-screen: { type: boolean, default: false }
|
|
icon: { type: string, encoding: base64 }
|
|
target-app: { type: string }
|
|
|
|
font:
|
|
required: [font-name, data]
|
|
|
|
# ── Device experience ─────────────────────────────────────────────────────
|
|
notifications:
|
|
required: [apps]
|
|
|
|
sso:
|
|
optional:
|
|
display-name: { type: string }
|
|
kerberos: { type: object }
|
|
|
|
identification:
|
|
optional:
|
|
full-name: { type: string }
|
|
email: { type: string }
|
|
username: { type: string }
|
|
password: { type: string }
|
|
prompt: { type: string }
|
|
|
|
google-account:
|
|
required: [address]
|
|
optional:
|
|
description: { type: string }
|
|
display-name: { type: string }
|
|
services: { type: object }
|
|
|
|
home-screen:
|
|
optional:
|
|
dock: { type: array }
|
|
pages: { type: array }
|
|
|
|
desktop:
|
|
optional:
|
|
wallpaper: { type: object }
|
|
|
|
screensaver:
|
|
optional:
|
|
module: { type: string }
|
|
idle-seconds: { type: integer, default: 300 }
|
|
locked: { type: boolean, default: false }
|
|
|
|
# ── Enterprise / desktop ──────────────────────────────────────────────────
|
|
active-directory:
|
|
required: [server]
|
|
optional:
|
|
admin-username: { type: string }
|
|
admin-password: { type: string }
|
|
computer-name: { type: string }
|
|
organizational-unit: { type: string }
|
|
user-experience: { type: object }
|
|
password-policy: { type: object }
|
|
mobile-accounts: { type: object }
|
|
local-admin-groups: { type: array }
|
|
uid-mapping: { type: string }
|
|
gid-mapping: { type: string }
|
|
trust-change-interval-days: { type: integer }
|
|
restrict-ddns-interfaces: { type: array }
|
|
allow-multi-domain-auth: { type: boolean }
|
|
|
|
ad-certificate:
|
|
required: [server, template, authority]
|
|
optional:
|
|
acquisition: { type: enum, values: [rpc, http], default: rpc }
|
|
description: { type: string }
|
|
key: { type: object }
|
|
renewal: { type: object }
|
|
prompt-for-credentials: { type: boolean, default: false }
|
|
|
|
cert-transparency:
|
|
optional:
|
|
disabled: { type: object }
|
|
required: { type: object }
|
|
|
|
time-server:
|
|
required: [server]
|
|
|
|
software-update:
|
|
optional:
|
|
catalog-url: { type: string }
|
|
automatic: { type: object }
|
|
deferral: { type: object }
|
|
allow-pre-release: { type: boolean, default: false }
|
|
require-admin-to-install: { type: boolean, default: false }
|
|
|
|
firewall:
|
|
optional:
|
|
enabled: { type: boolean, default: false }
|
|
block-all-incoming: { type: boolean, default: false }
|
|
stealth-mode: { type: boolean, default: false }
|
|
apps: { type: array }
|
|
|
|
privacy:
|
|
required: [services]
|
|
|
|
parental-controls:
|
|
optional:
|
|
apps: { type: object }
|
|
web: { type: object }
|
|
time-limits: { type: object }
|
|
content: { type: object }
|
|
|
|
global-preferences:
|
|
optional:
|
|
multi-session-enabled: { type: boolean, default: false }
|
|
|
|
shared-device:
|
|
optional:
|
|
enabled: { type: boolean, default: true }
|
|
temporary-session: { type: object }
|
|
user-session: { type: object }
|
|
quota-mb: { type: integer }
|
|
|
|
education:
|
|
required: [organization]
|
|
optional:
|
|
resource-cert-uuid: { type: string }
|
|
device-groups: { type: array }
|
|
users: { type: array }
|
|
departments: { type: array }
|
|
|
|
# ── AirPlay / AirPrint ────────────────────────────────────────────────────
|
|
airprint:
|
|
required: [printers]
|
|
|
|
airplay:
|
|
optional:
|
|
allowlist: { type: array }
|
|
passwords: { type: array }
|
|
|
|
airplay-security:
|
|
required: [security, access]
|
|
optional:
|
|
password: { type: string }
|
|
|
|
# ── macOS / desktop system policy ─────────────────────────────────────────
|
|
system-policy:
|
|
optional:
|
|
gatekeeper-enabled: { type: boolean, default: true }
|
|
allow-identified-developers: { type: boolean, default: true }
|
|
|
|
system-policy-rule:
|
|
required: [rules]
|
|
|
|
smartcard:
|
|
optional:
|
|
on-token-removal: { type: enum, values: [none, lock, logout], default: none }
|
|
cert-trust: { type: enum, values: [off, basic, ocsp, hard], default: off }
|
|
enabled: { type: boolean, default: true }
|
|
enforce: { type: boolean, default: false }
|
|
user-pairing: { type: boolean, default: true }
|
|
one-card-per-user: { type: boolean, default: false }
|
|
allow-unmapped-users: { type: boolean, default: true }
|
|
|
|
kernel-extension-policy:
|
|
optional:
|
|
allow-user-approvals: { type: boolean, default: false }
|
|
allowed-extensions: { type: array }
|
|
|
|
media-management:
|
|
required: [media]
|
|
|
|
full-disk-encryption:
|
|
optional:
|
|
state: { type: enum, values: [on, off], default: off }
|
|
defer: { type: object }
|
|
recovery-key:{ type: object }
|
|
escrow-cert: { type: string, encoding: base64 }
|
|
cert-uuid: { type: string }
|
|
|
|
fde-escrow:
|
|
required: [location, encrypt-cert-uuid]
|
|
optional:
|
|
device-key: { type: string, default: serial-number }
|
|
|
|
# ── First boot ────────────────────────────────────────────────────────────
|
|
first-boot:
|
|
optional:
|
|
skip: { type: array, description: "Pane names to skip on first boot" }
|
|
|
|
setup-assistant:
|
|
optional:
|
|
skip: { type: array, description: "Alias for first-boot — same fields" }
|