[javuto]

Removable media policy for Santa sync

Closes #1167

Problem

osctrl could only turn removable media blocking on or off for an environment (block_usb_mount). The stable v1 sync protocol also supports remounting volumes with restrictive mount options, and a separate policy for encrypted volumes. osctrl offered neither.

Change

Policy

• Each environment now has a removable media policy:
  • ALLOW (default): mounts are not touched.
  • BLOCK: mounts are denied.
  • REMOUNT: mounts are remounted with the selected options (rdonly, noexec, nosuid, nodev, nobrowse, noowners, async, -j).
• An optional override for encrypted volumes takes the same values. When it is not set, encrypted volumes follow the main policy.

Sync (osctrl-tls)

• Preflight sends removable_media_policy, plus encrypted_removable_media_policy when the override is set.
• For Santa clients that predate the new field, preflight also sends the deprecated block_usb_mount and remount_usb_mode, derived from the main policy. Those clients ignore the encrypted override.

API (osctrl-api)

• PUT /api/v1/santa/{env}/config accepts removable_media, removable_media_flags, encrypted_removable_media and encrypted_removable_media_flags.
• Invalid input returns 400: an unknown action, an unknown mount option, REMOUNT without options, or options sent with ALLOW or BLOCK.
• Mount options are trimmed, lowercased and de-duplicated before they are saved.
• Requests that send only block_usb_mount keep working: true is treated as BLOCK.
• The same checks run in santa.Manager.SaveConfig, so callers other than the API handler cannot store an invalid config.

UI

• On the Settings tab, the "Block USB mounts" checkbox is replaced by two dropdowns: Removable media and Encrypted removable media.
• When REMOUNT is selected, a set of mount option checkboxes appears.
• Translation keys were added to all 20 locales.

Schema

• Four new columns on santa_env_configs, added by the startup AutoMigrate.
• A startup backfill fills in the policy for existing rows that have none: block_usb_mount = true becomes BLOCK, any other row becomes ALLOW. Rows that already have a policy are left alone, so running it again changes nothing.

Docs

• pkg/santa/README.md has a new "Removable media" section.
• The root README mentions the policy.
• osctrl-api.yaml has been regenerated.

Security / operational impact

• This is an additive schema change, but the backfill writes to existing rows at startup. Upgrading does not change the effective policy for any existing environment.
• Mount options are checked against the list Santa accepts, so arbitrary strings never reach clients.
• Changing the config still requires environment admin permission and is written to the audit log, as before.
• block_usb_mount is still stored, derived from the policy on every save. Rolling back to an older build therefore keeps the previous blocking behavior. Any REMOUNT setting degrades to a plain block.

Validation

• go test ./pkg/santa/... ./cmd/api/... ./cmd/tls/...
  • New pkg/santa/media_test.go covers validation, the preflight response for each policy and the encrypted override, and the legacy backfill.
  • New handler tests for PUT /config cover the legacy field, the default, flag normalization and rejection cases.
• go vet and golangci-lint (santa package and handlers): 0 issues; gofmt clean.
• make openapi-check passes.
• cd frontend && npm test (786 tests) and npm run check pass. A new test saves a REMOUNT policy with options and leaves the encrypted override unset.

Not verified:

• The Settings tab in a browser.
• A real Santa client.
• The backfill on Postgres or MySQL; it was only run on SQLite.
• The new translations, which have not been reviewed by native speakers.