Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Uninstall packages #20320

Closed
4 of 10 tasks
pintomi1989 opened this issue Jul 10, 2024 · 25 comments
Closed
4 of 10 tasks

Uninstall packages #20320

pintomi1989 opened this issue Jul 10, 2024 · 25 comments
Assignees
@getvictor @mostlikelee @jacobshandling
Labels
~apple-mdm-maturity Contributes to maturity in macOS, iOS, or iPadOS MDM product category. ~csa Issue was created by or deemed important by the Customer Solutions Architect. customer-flacourtia customer-reedtimmer ~experimental This feature is experimental, breaking changes may be made. #g-endpoint-ops Endpoint ops product group P2 Prioritize as urgent :product Product Design department (shows up on 🦢 Drafting board) prospect-redwine story A user story defining an entire feature
Milestone
4.57.0

Comments

@pintomi1989
Copy link
Contributor

pintomi1989 commented Jul 10, 2024 •
edited by noahtalerman
Loading

Goal

User story
As a IT admin who no longer wants to manage a software item (package),
I want to uninstall the package from a host
so that I can prevent the host from having outdated and potentially vulnerable software installed.

Context

Changes

Product

Engineering

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Demo videos

QA

Risk assessment

  • Risk level: High
  • Risk description: Risk is high due to the high amount of code changes.

Manual testing steps

Note about EXE installers

They are not standardized and are more likely to have issues. Related issue that's currently being worked on: #20000

@getvictor tested FileZilla:

& "C:\Program Files\FileZilla FTP Client\uninstall.exe" /quiet

Migration

  1. Before migration, start with some installers (1 for each type pkg, exe, msi, deb).
  2. After migration, the uninstall_software_migration cron job should run once (should be within 10 seconds of starting up the server), and update the uninstall scripts for the existing software.
  3. Make sure the scripts are updated -- easiest way is to look at them using the Edit Software feature (which is not merged as of this writing). Another way is to use the API (see video above) and get the software title.

UI

  1. Test installing/uninstalling with each type pkg, exe, msi, deb

API

  1. Follow similar steps as the video above.

GitOps

  1. Try adding software with/without uninstall script.

Testing notes

Confirmation

  1. Engineer (@____): Added comment to user story confirming successful completion of QA.
  2. QA (@____): Added comment to user story confirming successful completion of QA.
@pintomi1989 pintomi1989 added ~feature fest Will be reviewed at next Feature Fest customer-flacourtia labels Jul 10, 2024
@pintomi1989 pintomi1989 changed the title Use Fleet to uninstall software that was installed via Fleet Use Fleet to update software that was installed via Fleet Jul 11, 2024
@pintomi1989 pintomi1989 changed the title Use Fleet to update software that was installed via Fleet Use Fleet to update software that was installed via Fleet without a 3rd party tool Jul 11, 2024
@pintomi1989 pintomi1989 removed ~feature fest Will be reviewed at next Feature Fest customer-flacourtia labels Jul 11, 2024
@pintomi1989 pintomi1989 changed the title Use Fleet to update software that was installed via Fleet without a 3rd party tool Ability to remove an undesirable version of a software from a host Jul 11, 2024
@pintomi1989 pintomi1989 added ~feature fest Will be reviewed at next Feature Fest customer-flacourtia labels Jul 11, 2024
@noahtalerman noahtalerman added the ~apple-mdm-maturity Contributes to maturity in macOS, iOS, or iPadOS MDM product category. label Jul 11, 2024
@noahtalerman noahtalerman changed the title Ability to remove an undesirable version of a software from a host Ability to remove the old (previously deployed version) software from a host Jul 11, 2024
@noahtalerman noahtalerman changed the title Ability to remove the old (previously deployed version) software from a host Remove software from a host Jul 12, 2024
@noahtalerman noahtalerman added :product Product Design department (shows up on 🦢 Drafting board) story A user story defining an entire feature and removed ~feature fest Will be reviewed at next Feature Fest labels Jul 15, 2024
@noahtalerman noahtalerman changed the title Remove software from a host Uninstall software Jul 22, 2024
This was referenced Jul 22, 2024
Merged
Closed
@nonpunctual nonpunctual added the ~csa Issue was created by or deemed important by the Customer Solutions Architect. label Jul 24, 2024
@marko-lisica marko-lisica mentioned this issue Jul 25, 2024
Open
@lukeheath lukeheath added Epic DO NOT USE. Auto-created by ZenHub, cannot be disabled. and removed Epic DO NOT USE. Auto-created by ZenHub, cannot be disabled. labels Jul 29, 2024
@noahtalerman noahtalerman added ~feature fest Will be reviewed at next Feature Fest and removed ~feature fest Will be reviewed at next Feature Fest labels Aug 1, 2024
@noahtalerman
Copy link
Member

noahtalerman commented Aug 13, 2024 •
edited
Loading

Hey @marko-lisica it sounds like there's another use case we should be designing for when working on this story. We can decided later if we'd ship it separately.

customer-reedtimmer described this use case:

I want to be able to remove any software. Not just software that Fleet installed.

For example, we use the Restricted Software feature in Jamf to delete WeChat anytime it's installed by the end user.

@nonpunctual
Copy link
Contributor

@marko-lisica @noahtalerman I am pretty sure the Crowdstrike Falcon agent has an uninstaller?

@getvictor getvictor mentioned this issue Sep 9, 2024
Merged
11 tasks
@marko-lisica
Copy link
Member

marko-lisica commented Sep 10, 2024 •
edited
Loading

@marko-lisica @noahtalerman I am pretty sure the Crowdstrike Falcon agent has an uninstaller?

@nonpunctual That's right, I forgot about security agents. Thinking about the default uninstall script, I'm not sure how Fleet can know if the native uninstaller is available for some .pkg. Since we expose the uninstall script, the user can edit and use what vendor provided in docs. I think most probably they will need some token to remove security agents, so they will anyway need to edit uninstall script.

For Crowdstrike Falcon it seems pretty simple to copy the script from their docs (sudo /Library/CS/falconctl uninstall ––maintenance-token). If there are some other examples it would be great to track them in this issue here, and we can always open a feature request to improve uninstall feature in Fleet.

@sharon-fdm sharon-fdm added this to the 4.57.0-tentative milestone Sep 10, 2024
@noahtalerman
Copy link
Member

noahtalerman commented Sep 11, 2024 •
edited
Loading

@nonpunctual thanks for calling this use case out!

@marko-lisica I think mean that the IT admin would take these steps to install and then later uninstall CrowdStrike in Fleet?

  1. Add the CrowdStrike package to available for install software in Fleet
  2. Add a policy to check if the CrowdStrike is installed
  3. To automatically install: In new policy automation: install software (Policy automations: install software #19551), Connect CrowdStrike to the policy
  4. Edit CrowdStrike's uninstall script to the following:
sudo /Library/CS/falconctl uninstall ––maintenance-token
  1. To manually uninstall: on a host's Host details > Software tab, find CrowdStrike and select Actions > Uninstall.

No automatic uninstall in Fleet yet. Today, the IT admin would add a policy to check if Crowdstrike is installed, turn on policy webhooks, and catch webhook and hit Fleet's uninstall API endpoint (coming soon) in Tines (third-party automation tool).

@getvictor getvictor mentioned this issue Sep 11, 2024
Merged
3 tasks
@iansltx iansltx mentioned this issue Sep 11, 2024
Closed
29 tasks
@getvictor getvictor mentioned this issue Sep 12, 2024
Merged
2 tasks
getvictor added a commit that referenced this issue Sep 12, 2024
@getvictor
Uninstall packages (#21892)
8e5d056 
#20320

# Demo video(s)
- API demo: https://www.loom.com/share/037c82cbde9743cfa42778eb04612482

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated BE tests
- [ ] Added/updated FE tests
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual BE QA for all new/changed functionality
- [ ] Manual end-to-end QA for all new/changed functionality
@getvictor getvictor mentioned this issue Sep 12, 2024
Merged
getvictor added a commit that referenced this issue Sep 12, 2024
@getvictor
Added GitOps support for uninstall script. (#21969)
b60ebbc 
`fleetctl gitops` subtask for #20320

# Checklist for submitter

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
@lucasmrod lucasmrod mentioned this issue Sep 12, 2024
Merged
lucasmrod added a commit that referenced this issue Sep 12, 2024
@lucasmrod
Fix breaking changes tests (#22054)
92c4c52 
Related to #21467 and #20320
@spokanemac spokanemac mentioned this issue Sep 13, 2024
Closed
1 task
getvictor added a commit that referenced this issue Sep 16, 2024
@getvictor
Added uninstall_script to software/batch (#22040)
970b7b6 
Contributor docs for #20320
@sharon-fdm
Copy link
Collaborator

sharon-fdm commented Sep 16, 2024 •
edited
Loading

QA DRI - @mostlikelee

@getvictor
Copy link
Member

Related issues for EXE packages: #20000, #22092 (duplicate)

EXE packages that work with default scripts:

FileZilla
https://filezilla-project.org/download.php?platform=win64
In uninstall script, use /S as $uninstallArgs

Firefox
Get the full installer like: https://download.mozilla.org/?product=firefox-latest&os=win&lang=en-US
DO NOT get product=firefox-stub
In uninstall script, use -ms as $uninstallArgs

@getvictor
Copy link
Member

getvictor commented Sep 17, 2024 •
edited
Loading

@marko-lisica @noahtalerman

  1. Currently, $PACKAGE_ID is only replaced in the uninstall script. Do we also need to replace it in install/post-install scripts?
  2. Did we spec a timeout for install/post-install scripts? I don't see anything in the code.

@marko-lisica
Copy link
Member

Hey @getvictor

  1. As far as I know there's no use case that $PACKAGE_ID is needed for install or post-install scripts. I would keep it for the uninstall script only until we learn that it's required in other scripts.
  2. What's the timeout for regular scripts? We should have the same timeout for software-related scripts.

@getvictor getvictor mentioned this issue Sep 17, 2024
Closed
@mostlikelee
Copy link
Contributor

I'm ok with calling QA on this feature good. There are many error cases where uninstall does not always work against software not installed by Fleet, but based on product feedback these are not bugs and will be filed as feature enhancements.

  • cannot uninstall some software not installed by Fleet
  • UI error when attempting to uninstall software without an associated software installer in Fleet
  • unknown expected behavior when uninstalling software that has multiple versions installed

@noahtalerman noahtalerman mentioned this issue Sep 23, 2024
Merged
noahtalerman added a commit that referenced this issue Sep 23, 2024
@noahtalerman
API design: Uninstall software (#22318)
be0374c 
API design for: #20320
@lukeheath lukeheath added :product Product Design department (shows up on 🦢 Drafting board) and removed :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. labels Sep 24, 2024
@noahtalerman
Copy link
Member

@zayhanlon and @dherder heads up that this user story was shipped in Fleet 4.57 🙌

@fleet-release
Copy link
Contributor

Uninstall with ease,
Secure hosts from old threats,
Like leaves in the breeze.

@noahtalerman noahtalerman added the ~experimental This feature is experimental, breaking changes may be made. label Oct 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@getvictor getvictor

@mostlikelee mostlikelee

@jacobshandling jacobshandling

Labels
~apple-mdm-maturity Contributes to maturity in macOS, iOS, or iPadOS MDM product category. ~csa Issue was created by or deemed important by the Customer Solutions Architect. customer-flacourtia customer-reedtimmer ~experimental This feature is experimental, breaking changes may be made. #g-endpoint-ops Endpoint ops product group P2 Prioritize as urgent :product Product Design department (shows up on 🦢 Drafting board) prospect-redwine story A user story defining an entire feature
Milestone
4.57.0
Development

No branches or pull requests