#!/bin/sh

#
# Remove the following:
# - The ChmmodBPF launch daemon
# - The ChmmodBPF script
# - The access_bpf group
#

CHMOD_BPF_PLIST="/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist"
BPF_GROUP="access_bpf"

launchctl bootout system "$CHMOD_BPF_PLIST"

dscl . -read /Groups/"$BPF_GROUP" > /dev/null 2>&1 && \
    dseditgroup -q -o delete "$BPF_GROUP"

rm -rf "/Library/Application Support/Wireshark"

rm -f "$CHMOD_BPF_PLIST"

# ChmodBPF hasn't been a startup item since 2018 (ac4f3c0f4d).
rm -rf /Library/StartupItems/ChmodBPF

# https://gitlab.com/wireshark/wireshark/-/issues/18734
pkgutil --forget org.wireshark.ChmodBPF.pkg