#!/bin/bash
# === CONFIGURATION ===
PKG_NAME="acc-yml.pkg"
INSTALL_PATH="/Library/Application Support/servicenow/agent-clientcollector"
YML_SOURCE_PATH="$HOME/Desktop/acc.yml" # Assuming you have your yml
file on the Desktop folder, change it if needed
# === CREATE BUILD STRUCTURE ===
BUILD_DIR="$HOME/pkgbuild-yml"
PAYLOAD_DIR="$BUILD_DIR/payload$INSTALL_PATH"
# Clean previous build
rm -rf "$BUILD_DIR"
mkdir -p "$PAYLOAD_DIR"
# Copy YAML file into package payload
cp "$YML_SOURCE_PATH" "$PAYLOAD_DIR/"
# === BUILD THE PACKAGE ===
pkgbuild \
--identifier "com.servicenow.acc.yml" \
--install-location "$INSTALL_PATH" \
--root "$BUILD_DIR/payload" \
"$HOME/Desktop/$PKG_NAME"
echo "✅ .pkg created at: $HOME/Desktop/$PKG_NAME"

# === 1. Create sudoers file ===
SUDOERS_FILE="/private/etc/sudoers.d/_servicenow"
cat <<EOF > "$SUDOERS_FILE"
# ServiceNow Agent Collector - Sudoers Configuration for macOS

# Command alias for ServiceNow allowed commands
# These commands can be executed by the _servicenow user with sudo privileges
Cmnd_Alias SN_ALLOWED = /usr/bin/powermetrics, \
                        /usr/bin/mdls, \
                        /usr/bin/log, \
                        /usr/bin/log show *, \
                        /bin/kill, \
                        /usr/bin/defaults, \
                        /usr/local/bin/jamf, \
                        /bin/rm, \
                        /bin/ls, \
                        /usr/bin/pgrep, \
                        /usr/bin/find, \
                        /usr/bin/pmset, \
                        /usr/bin/open, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/app_freeze.sh, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/zscaler_zpa_reconnect.sh, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/clear_google_chrome_browsing_data.sh, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/services.sh, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/restart_service.sh *, \
                        /Applications/Zscaler/Zscaler.app/Contents/PlugIns/zscli, \
                        /Library/Application\ Support/servicenow/agent-client-collector/cache/acc-dex-modules/bin/scripts/sudo/elevate_temporary_admin.sh

# ServiceNow user permissions
# _servicenow user can run osqueryi and all SN_ALLOWED commands without password
# SETENV allows environment variables to be preserved
_servicenow ALL=NOPASSWD: SETENV: /Library/Application\ Support/servicenow/agent-client-collector/cache/osquery/bin/osqueryi *, SN_ALLOWED

# Defaults for _servicenow user
# !requiretty: Allow sudo without a TTY (required for automated scripts)
Defaults:_servicenow !requiretty
EOF
chmod 440 "$SUDOERS_FILE"
echo "[INFO] Sudoers file created at $SUDOERS_FILE"

# === 2. Set permissions for the YAML file ===
YML_PATH="/Library/Application Support/servicenow/agent-clientcollector/
acc.yml"
if [ -f "$YML_PATH" ]; then
chmod 644 "$YML_PATH"
echo "[INFO] Permissions set on acc.yml"
else
echo "[WARN] acc.yml not found at $YML_PATH"
fi
# === 3. Restart ACC service ===
PLIST="/Library/LaunchDaemons/com.sn.acc.plist"
if [ -f "$PLIST" ]; then
echo "[INFO] Stopping ACC service..."
launchctl unload -w "$PLIST" 2>/dev/null
sleep 2
echo "[INFO] Starting ACC service..."
launchctl load -w "$PLIST"
else
echo "[ERROR] LaunchDaemon not found at $PLIST"
fi