From 322cd63083ce9a37e8080be1ec809dc9d60ccc86 Mon Sep 17 00:00:00 2001 From: Ranbel Sun Date: Wed, 25 Mar 2026 13:33:12 -0400 Subject: [PATCH 1/3] environment variables --- .../client-checks/application-check.mdx | 6 ++++-- .../posture-checks/client-checks/file-check.mdx | 2 ++ .../posture/env-vars-in-file-paths.mdx | 14 ++++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) create mode 100644 src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx index f4c1fbe2380..e1911cb44d4 100644 --- a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/application-check.mdx @@ -33,10 +33,12 @@ The Application Check device posture attribute checks that a specific applicatio 2. **Operating system**: Select your operating system. 3. **Application path**: Enter the file path for the executable that will be running (for example, `C:\Program Files\myfolder\myfile.exe`). + + :::note - Be sure to enter the binary file path, not the application launch path. When checking for an application on macOS, a common mistake is to enter `/Applications/ApplicationName.app`. This will not work as `ApplicationName.app` is a folder. The executable file that will be running is located within the folder, for example `ApplicationName.app/Contents/MacOS/ApplicationName`. - - Some applications change their file path after an update. Ensure that the application is always in a stable location, or use an environment variable to identify a specific folder. For example, Windows provides [recognized environment variables](https://learn.microsoft.com/en-us/windows/deployment/usmt/usmt-recognized-environment-variables) that you can reference in your file path (`%PROGRAMFILES%\myfolder\myfile.exe`). - ::: + - Some applications change their file path after an update. Ensure that the application is always in a stable location or use environment variables. + ::: 5. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint of the publishing certificate](#determine-the-signing-thumbprint) used to sign the binary. Adding this information will enable the check to ensure that the application was signed by the expected software developer. 6. **SHA-256 (optional)**: Enter the [SHA-256 value](#determine-the-sha-256-value) of the binary. This is used to ensure the integrity of the binary file on the device. diff --git a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx index dedfd613808..0759a17a720 100644 --- a/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx +++ b/src/content/docs/cloudflare-one/reusable-components/posture-checks/client-checks/file-check.mdx @@ -32,6 +32,8 @@ The File Check device posture attribute checks for the presence of a file on a d 1. **Name**: Enter a unique name for this device posture check. 2. **Operating system**: Select your operating system. 3. **File Path**: Enter a file path (for example, `c:\my folder\myfile.exe`). + + 4. **Signing certificate thumbprint (recommended)**: Enter the [thumbprint](/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/#determine-the-signing-thumbprint) of the publishing certificate used to sign the file. Adding this information will enable the check to ensure that the file was signed by the expected software developer. 5. **SHA-256 (optional)**: Enter the [SHA-256 value](/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/#determine-the-sha-256-value) of the file. This is used to ensure the integrity of the file on the device. diff --git a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx new file mode 100644 index 00000000000..deaa7a397dc --- /dev/null +++ b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx @@ -0,0 +1,14 @@ +--- +{} +--- + +import { Details } from "~/components"; + +
+ +File paths can include environment variables to account for differences across devices. + +- **Windows**: Use `%VAR%` syntax. For example, `%PROGRAMFILES%\myfolder\myfile.exe`. +- **macOS/Linux**: Use `${VAR}` syntax. For example, `${HOME}/myfolder/myfile`. + +
From db6b4c25a681665a63607dc5739d502ccafeefcb Mon Sep 17 00:00:00 2001 From: Ranbel Sun Date: Wed, 25 Mar 2026 14:15:33 -0400 Subject: [PATCH 2/3] edit unix description --- .../partials/cloudflare-one/posture/env-vars-in-file-paths.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx index deaa7a397dc..e82967a06a7 100644 --- a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx +++ b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx @@ -9,6 +9,6 @@ import { Details } from "~/components"; File paths can include environment variables to account for differences across devices. - **Windows**: Use `%VAR%` syntax. For example, `%PROGRAMFILES%\myfolder\myfile.exe`. -- **macOS/Linux**: Use `${VAR}` syntax. For example, `${HOME}/myfolder/myfile`. +- **macOS/Linux**: Use `${VAR}` syntax. For example, `${RUNTIME_DIRECTORY}/myfolder/myfile`. Environment variables are resolved in the context of the Cloudflare One Client daemon, not the logged-in user. Only variables available to the daemon process at runtime will work. From 0b67ed8d32b99a1d7272dd68081df1f12e70e02b Mon Sep 17 00:00:00 2001 From: Ranbel Sun Date: Wed, 25 Mar 2026 14:26:01 -0400 Subject: [PATCH 3/3] move runtime context note --- .../cloudflare-one/posture/env-vars-in-file-paths.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx index e82967a06a7..4842622a12b 100644 --- a/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx +++ b/src/content/partials/cloudflare-one/posture/env-vars-in-file-paths.mdx @@ -6,9 +6,9 @@ import { Details } from "~/components";
-File paths can include environment variables to account for differences across devices. +File paths can include environment variables to account for differences across devices. Environment variables are resolved in the context of the Cloudflare One Client daemon, not the logged-in user. Only variables available to the daemon process at runtime will work. - **Windows**: Use `%VAR%` syntax. For example, `%PROGRAMFILES%\myfolder\myfile.exe`. -- **macOS/Linux**: Use `${VAR}` syntax. For example, `${RUNTIME_DIRECTORY}/myfolder/myfile`. Environment variables are resolved in the context of the Cloudflare One Client daemon, not the logged-in user. Only variables available to the daemon process at runtime will work. +- **macOS/Linux**: Use `${VAR}` syntax. For example, `${RUNTIME_DIRECTORY}/myfolder/myfile`.