Skip to main content

I'm trying to loop through policy check-ins at first boot so that all software that needs to be installed is run. In plain words, until no more policies are found, continue to run the jamf binary to do a policy check-in. The reason for this is because there may be certain policies that require a computer fall into a certain smart group (maybe its a plug-in that requires an app be installed first) before it can run the policy. But I'm not sure if this is the best way to do it since the loop statement actually needs to run the jamf binary in a subshell to determine whether no policies are found.

I'm trying to run the following at first boot:

jamfPolicyDone="No policies were found for the "recurring check-in" trigger."

#Prevent computer from sleeping
/usr/bin/caffeinate &

#Run jamf binary to check for scoped policies for computer
#Let it loop until no policies are left

until [ "$( /usr/sbin/jamf policy -verbose | grep "$jamfPolicyDone" )" = "$jamfPolicyDone" ]; do
    /usr/sbin/jamf policy -verbose
    sleep 5
done

#Kill caffeinate process
killall caffeinate

Anyone have any advice?

If your jamf client breaks or cannot contact the JSS, it will loop forever unless you add an escape for it (or at least a maximum number of iterations). Also, it will run the policy check twice per loop, one for the "until" statement's check and one inside of the loop.

Loops are dangerous, I wouldn't do this personally. That said, you could simplify the check, since grep returns null if it does not find a match:

until [ "$( /usr/sbin/jamf policy | grep "No policies were found" )" ]; do
    sleep 5
done
Terms & ConditionsCookie settingsAccessibility statement