You will need to utilize the Jamf Pro API to load legacy KEXTS on BS with Apple Silicon
#!/bin/bash
### Restart computer via MDM command & rebuild kernel cache after installing legacy kext(s) in Big Sur
### You would think this would be easier... but it's not?! Must use Jamf API with a touch of 'the crafty'...
### 2021.04.05 - JW
### WARNING!!! Computer will reboot immediately with zero notification!
### Background: Despite Apple still allowing legacy KEXT installs on Big Sur (via Jamf/MDM), the process is not that smooth.
### The post-install user approval/restart process is still very UGLY.
### Simply pre-approving KEXT ID's via config profile is not enough.
### We need to either automate away the uglies, or leave it to the standard user to do so (blech!)
### Pulling info from here (though needed some significant tweaking):
### https://www.jamf.com/jamf-nation/articles/793/manage-legacy-kernel-extensions-in-macos-11-using-jamf-pro
### And some mechs & ideas from here for api/json formatting etc:
### https://gist.github.com/talkingmoose/327427d23b422000f9d17183f8ef1d22
### This all very rudimentary- take with a grain of salt & LOT'S OF CAUTION!
### -JW
###----------------------------------------------------------------------------------------###
### Custom Variables
###----------------------------------------------------------------------------------------###
jamfProURL="https://ORG.jamfcloud.com"
### API username/pass
### For now, let's use Jamf policy script parameters we can switch to encrypted script creds later.
username="$4"
password="$5"
### Note: the Jamf API user level permissions required are:
### Jamf Pro Server Objects: Computers (Read)
### Jamf Pro Server Actions: Send Mobile Device Restart Device Command
### Jamf Pro Server Actions: View MDM command information in Jamf Pro API
###----------------------------------------------------------------------------------------###
### Get an api authorization token (auth lasts 30 minutes, but we'll expire at end of script)
###----------------------------------------------------------------------------------------###
# create base64-encoded credentials
encodedCredentials=$( printf "$username:$password" | /usr/bin/iconv -t ISO-8859-1 | /usr/bin/base64 -i - )
# generate an authorization bearer token
authToken=$( /usr/bin/curl "$jamfProURL/uapi/auth/tokens" --silent --request POST --header "Authorization: Basic $encodedCredentials" )
# Clean up token to omit expiration details
token=$( /usr/bin/awk -F " '{ print $4 }' <<< "$authToken" | /usr/bin/xargs )
###----------------------------------------------------------------------------------------###
### Do the things...
###----------------------------------------------------------------------------------------###
### 1) Obtain the computer's mdm managementID.
### Why this is such a chore to obtain is beyond me... if anyone ever finds an easier way PLEASE TELL ME!
### https://www.jamf.com/jamf-nation/articles/793/manage-legacy-kernel-extensions-in-macos-11-using-jamf-pro
### Based on details of link above, and a bit of tweaking, this API call will return details of ALL computers!
### (number of devices to return info on is set by size parameter in curl line)
### HOWEVER, we only need our current workstations's managementID from this mass of data!
### Lets grab our computer's serial number and parse/filter the API data found between it (our desired serial) and the key 'isManaged' to obtain our 'managementID'.
serialNumber=$( system_profiler SPHardwareDataType | awk '/Serial/ {print $4}' )
managementID=$( curl -X GET "$jamfProURL/uapi/preview/computers?size=2000" -H "accept: application/json" --header "Authorization: Bearer $token" | awk '/'$serialNumber'/ {p=1; next} /isManaged/ {p=0} {if (p==1) print $0}' | grep 'managementId' | awk '{ print $3}' | sed 's/[,"]//g' )
### testing reference to make sure our values are correct:
echo $serialNumber
echo $managementID
### 2) Restart device via MDM command & rebuild kext cache in the process
### WARNING!!! notifyUser flag does not seem to be working as intended?!? Will reboot immediately!
### As we'll be running this immediately after installing a legacy KEXT, let's give installer 15 sec to finish up... just in case.
sleep 15
### Initiate the restart
curl "$jamfProURL/api/preview/mdm/commands"
--request POST
--header "Authorization: Bearer $token"
--header "Accept: application/json"
--header "Content-Type: application/json"
--data-raw '{
"clientData": [
{
"managementId": "'$managementID'",
"clientType": "COMPUTER"
}
],
"commandData": {
"commandType": "RESTART_DEVICE",
"rebuildKernelCache": "true",
"notifyUser": "true"
}
}'
###----------------------------------------------------------------------------------------###
### Expire our authorization token
###----------------------------------------------------------------------------------------###
curl "$jamfProURL/uapi/auth/invalidateToken"
--silent
--request POST
--header "Authorization: Bearer $token"
