software-update-2019

#!/bin/bash

###################################################################
#
# This script provides a deferral and enforcement mechanism for
# software updates. If updates are available which don't require
# a restart, they are installed silently in the background. If critical
# updates are found which do require a restart, the user is nagged to
# install them and given the option to defer for up to Deferral_Time
# days. Deferral_Time can be set as ${4} in the JSS.
# After Deferral_Time days the warning can't be dismissed until the user
# agrees to install the updates.
#
# If no user is logged in at all (including via SSH), then we lock the
# login screen and install any pending updates.
#
# Date: Thu  1 Aug 2019 14:24:31 BST
# Version: 0.1.7
# Creator: dsavage
#
##################################################################

#set -x

main() {
Network=$(get_network)
if [ ${Network} == "pass" ]; then
	# We have network, do a check
	check_for_updates
else
	# No network, set a flag to check again on network state change.
	touch /Library/MacSD/SUNOTDONE
	exit 0;
fi

Mobility=$(get_mobility)
case $Mobility in
	mobile)
    Battery=$(get_battery)
    if [ ${Battery} == "pass" ]; then
    	echo "Battery greater than 60% or plugged in, proceeding."
    else
    	echo "Battery less than 60% or battery on charge at less than 10%, cannot proceed."
	# Battery fail, set a flag to check again on network state change.
	touch /Library/MacSD/SUNOTDONE
    	exit 0;
    fi
    ;;
    desktop)
    echo "This is a desktop, so power status pass, proceeding."
    ;;
esac

if [ ${User} == "none" ]; then
    echo "No user present, installing"
    install_updates
else
    if [ ${Install_Status} = "recommended" ]; then
    	echo "User present, but updates don't require a restart"
    	install_updates
    else
    	echo "User present and updates require restart, check for deferal before install."
    	check_for_deferral
    fi
fi
}

get_network() {
Active_Adapter=$( route get uoe.jamfcloud.com | grep interface | awk '{print $2}' )
Adapter_Name=$( networksetup -listallhardwareports | grep -B1 "$Active_Adapter" | awk -F': ' '/Hardware Port/{print $NF}' )
# Find out out link status if we are on Ethernet or Wireless, then work out if updates should happen.
if [[ "$Adapter_Name" =~ "Ethernet" ]]; then
		Network="pass"
elif [[ "$Adapter_Name" =~ "Wi-Fi" ]]; then
	Link_Auth=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | awk '/link auth/{print $NF}')
	if [ "$Link_Auth" == "none" ]; then
		Network="fail"
	else
		Network="pass"
	fi
else
	Network="fail"
fi
echo ${Network}
}

get_mobility() {
Product_Name=$(ioreg -l | awk '/product-name/ { split($0, line, "\""); printf("%s\n", line[4]); }')
	if echo "${Product_Name}" | grep -qi "macbook" 
	then
    	Mobility="mobile"
  	else
    	Mobility="desktop"
	fi
echo ${Mobility}
}

get_battery () {
##Check if device is on battery or ac power
Power_Adapter=$( /usr/bin/pmset -g ac )
if [[ ${Power_Adapter} == "No adapter attached." ]]; then
	Battery_Percentage=$( /usr/bin/pmset -g batt | grep "InternalBattery-0" | awk '{print $3}' | awk -F '%' '{print $1}' )
	if [ $Battery_Percentage -le 60 ]; then
		Power_Status="fail"
	else
		# Check if the battery is less than 10% even if on charge.
		if [ $Battery_Percentage -le 10 ]; then
			Power_Status="fail"
		else
			Power_Status="pass"
		fi
	fi
else
    Power_Status="pass"
fi
echo ${Power_Status}
}

check_for_updates () {
echo "Checking for pending system updates..."
updateCheck=$( $SWUPDATE --list )
# Determine whether any critical updates are available, and if any require a restart. If no updates need to be installed, bail out.
if [[ "$updateCheck" == *"[restart]"* ]]; then
	Install_Status="all"
elif [[ "$updateCheck" == *"[recommended]"* ]]; then
    Install_Status="recommended"
else
    echo "No critical updates available."
    clean_up
    exit 0;
fi
}

get_user () {
User=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "\n");'`
if [ -z ${User} ] || [ ${User} == "" ]; then
	User="none"
fi
echo ${User}
}

check_for_deferral () {
Today=$( date  "+%Y-%m-%d" )
if [ -f ${Defer_File} ]; then
	Check_Defer_Limit=$( ${PLISTBUDDY} -x -c "Print DeferOkUntil" ${Defer_File}  | grep "<date>" | awk -F "<date>" '{print $2}' | awk -F "Z" '{print $1}' |  awk -F "T" '{print $1}' )
	#2019-04-10T00:02:39
	Text_Defer_Limit=$( ${PLISTBUDDY} -c "Print  DeferOkUntil" ${Defer_File}  | awk '{print $1 " " $2 " " $3 " " $6}' )
	#Wed Apr 10 01:02:39 GMT 2019
else
	# Defer date will be...
	Text_Defer_Limit=$( date -v +${Deferral_Time}d | awk '{print $1 " " $2 " " $3 " " $4}' )
	Check_Defer_Limit=$( date -v +${Deferral_Time}d "+%Y-%m-%d" )
fi
Software_Update_Icon=$(get_softwareupdate_icon)
if [[ "${Check_Defer_Limit}" > "${Today}" ]]; then
	# User can defer
	Description_Text="One or more software updates require a restart.
	
Updates must be applied regularly. Please save any unsaved work.
You will be required to apply updates and restart after: ${Text_Defer_Limit}"
	Result=`"${JAMFHELPER}" -windowType utility\
 -title "UoE Mac Supported Desktop"\
 -heading "Software Update Available"\
 -icon "${Software_Update_Icon}"\
 -description "${Description_Text}"\
 -button1 "Apply now"\
 -button2 "Apply later"\
 -timeout 7200`
	if [ ${Result} == 0 ]; then
	echo "User has opted not to defer, installing updates."
    	# Install the updates
    	install_updates
	elif [ ${Result} == 2 ]; then
	echo "User has opted to defer, updates must be installed on or after: ${Text_Defer_Limit}."
    	# user is deferring.
    	if ! [ -f ${Defer_File} ]; then
    		Defer_Limit=$( date -v +${Deferral_Time}d "+%m/%d/%y" )
			${PLISTBUDDY} -c "Add :DeferOkUntil date ${Defer_Limit}" ${Defer_File} 
    		exit 0;
    	fi
	fi
else
	# Can't defer any longer
	Description_Text="One or more software updates require a restart.
	
Updates must be applied regularly. Please save any unsaved work.
You are required to apply updates and restart. Deferral limit was: ${Text_Defer_Limit}"
	Result=`"${JAMFHELPER}" -windowType utility\
 -title "UoE Mac Supported Desktop"\
 -heading "Software Update Available"\
 -icon "${Software_Update_Icon}"\
 -description "${Description_Text}"\
 -button1 "Apply now"`
	if [ ${Result} == 0 ]; then
    	#Install the updates
    	install_updates
	fi
fi
}

get_softwareupdate_icon () {
OS_Version=$( sw_vers -productVersion | awk -F '.' '{print $2}' )
case $OS_Version in
	1[012])
	Software_Update_Icon="/System/Library/CoreServices/Software Update.app/Contents/Resources/SoftwareUpdate.icns"
	;;
	13)
	Software_Update_Icon="/System/Library/CoreServices/Install Command Line Developer Tools.app/Contents/Resources/SoftwareUpdate.icns"
	;;
	14)
	Software_Update_Icon="/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/Resources/SoftwareUpdate.icns"
	;;
	*)
	echo "Do nothing, running on the unknown or untested..."
	#exit 0;
	;;
esac
echo "${Software_Update_Icon}"
}

install_updates () {
OS_Version=$( sw_vers -productVersion | awk -F '.' '{print $2}' )
# Switch based on required/all updates being applied.
if [ $Install_Status == "all" ]; then
	warn_applying_updates
    sleep 2
    clean_up
	# flag file for a recon to occur after the restart
	touch /Library/MacSD/SUDONE
    if [ $OS_Version -ge 14 ]; then
    # Install updates (all updates if a restart is required for any, otherwise
	# just recommended updates). Restart option only applies if required. Need
    # to use softwareupdates restart flag as some updates require a shutdown and
    # this should handle that.
		$SWUPDATE --install --$Install_Status --restart --force
    else
    	$SWUPDATE --install --$Install_Status
    	/usr/local/bin/jamf policy -event authenticated-restart
    fi
else
	clean_up
   	$SWUPDATE --install --$Install_Status
fi
}

clean_up () {
# For now just delete the deferal file.
rm -f ${Defer_File}
}

warn_applying_updates () {
Warn_Message="One or more updates which require a restart are being applied.
This Mac will restart momentarily to complete the install. Please wait..."
User=$(get_user)
if [ ${User} == "none" ]; then
	Launch_Agent="/Library/LaunchAgents/ed.is.jamfhelper-swupdate-v2.plist"
	if [ -f ${Launch_Agent} ]; then
		launchctl load -F -S LoginWindow ${Launch_Agent}  &
	else
		${PLISTBUDDY} -c "Add :Disabled bool true" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :Label string ed.is.jamfhelper-swupdate-v2.plist" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :LimitLoadToSessionType array" ${Launch_Agent}
		${PLISTBUDDY} -c "Add :LimitLoadToSessionType: string LoginWindow" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments array" ${Launch_Agent}
		${PLISTBUDDY} -c "Add :ProgramArguments: string ${JAMFHELPER}" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string -windowType" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string fs" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string -heading" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string Installing required macOS updates..." ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string -icon" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string ${Caution_Icon}" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string -description" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :ProgramArguments: string ${Warn_Message}" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :RunAtLoad bool true" ${Launch_Agent} 
		${PLISTBUDDY} -c "Add :keepAlive bool true" ${Launch_Agent} 
		sleep 1
		launchctl load -F -S LoginWindow ${Launch_Agent} &
	fi
else
	"${JAMFHELPER}" -windowType utility\
		-title "UoE Mac Supported Desktop"\
		-heading "Installing required macOS updates..."\
    	-icon ${Caution_Icon}\
    	-timeout 99999\
    	-description "${Warn_Message}" &
fi
}

# Set some globals
JAMFHELPER="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"
if ! [ -e "${JAMFHELPER}" ]; then
	# only for supported macs
	exit 0;
fi
SWUPDATE="/usr/sbin/softwareupdate"
PLISTBUDDY="/usr/libexec/PlistBuddy"
Uni_Logo="/usr/local/jamf/UoELogo.png"
Caution_Icon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertCautionIcon.icns"
User=$(get_user)
Install_Status=""
Defer_File="/var/db/UoESoftwareUpdateDeferral.V2"
Deferral_Time=${4}

# remove the flag file as we are about to run (again).
rm -f /Library/MacSD/SUNOTDONE

# Call the main function
main

exit 0;