macOS security: FileVault, SIP, permissions

Ten minutes before a client call, a user’s meeting app shows a black square where their screen should be, and the camera light stays off. Neither is a broken Mac: macOS asks the person at the Mac before any app may use the camera, the microphone or the screen, and one switch in Privacy & Security, or one reset of one decision, fixes most of these calls. The same Mac reports four protections, and reading them takes four commands.

You will read whether FileVault, System Integrity Protection, Gatekeeper and the firewall protect a Mac, follow a camera request through the privacy database, work the screen-sharing ticket layer by layer, tell what device management may grant from what only the user can, and explain Lockdown Mode, Find My and Activation Lock to a user.

Four readings say whether a Mac is protected

Four protections cover a Mac against four different losses, and each answers one command:

Apple’s deployment guide says FileVault makes a lost or stolen Mac’s contents unreadable without valid credentials. System Integrity Protection, SIP, uses kernel permissions to keep critical system files read-only; Apple builds it on mandatory access controls, which, unlike ordinary permissions, users cannot override. It has been on by default since OS X 10.11, and its manual says some csrutil commands work only from Recovery. Gatekeeper checks downloaded software, as apps, Gatekeeper and updates shows. The application firewall, in System Settings, Network, Firewall, blocks unwanted connections from other networks; its options include Block all incoming connections, and socketfilterfw, in /usr/libexec/ApplicationFirewall/, also reports stealth modestealth mode: A firewall option of macOS that stops the Mac answering probing requests such as ping, while it still answers authorised apps. with --getstealthmode.

The session reads three of the four on the Mac used for this lesson:

from session import run

# Three of the four protection readings, from the Mac used for this lesson: FileVault, System Integrity Protection and
# Gatekeeper. Each command only reports; none changes a setting.
run(
    """
fdesetup status
csrutil status
spctl --status
"""
)

$ fdesetup status
FileVault is On.
$ csrutil status
System Integrity Protection status: enabled.
$ spctl --status
assessments enabled

All three are on: FileVault is On, SIP is enabled, and Gatekeeper’s assessments are enabled. Where FileVault’s recovery key is kept is a ticket of its own, in BitLocker and FileVault recovery keys. A posture check turns the four readings into gaps. The program below checks two samples, written in the layout macOS prints them: a Mac with gaps, and the same Mac after the fixes:

"""The check a technician runs on a Mac's four protection readings. Two samples, written in the layout macOS prints
them (fdesetup status, csrutil status, spctl --status and socketfilterfw --getglobalstate): one Mac with gaps, and the
same Mac after the fixes. The check must find every gap in the first and none in the second."""

GOOD = {
    "FileVault": lambda text: text.startswith("FileVault is On"),
    "System Integrity Protection": lambda text: text.endswith("status: enabled."),
    "Gatekeeper": lambda text: text == "assessments enabled",
    "Application firewall": lambda text: text.startswith("Firewall is enabled"),
}

WEAK = {
    "FileVault": "FileVault is Off.",
    "System Integrity Protection": "System Integrity Protection status: enabled.",
    "Gatekeeper": "assessments disabled",
    "Application firewall": "Firewall is disabled. (State = 0)",
}

FIXED = {
    "FileVault": "FileVault is On.",
    "System Integrity Protection": "System Integrity Protection status: enabled.",
    "Gatekeeper": "assessments enabled",
    "Application firewall": "Firewall is enabled. (State = 1)",
}


def gaps(readings):
    """The protections whose reading is missing or not the good one, in a fixed order."""
    return [name for name, ok in GOOD.items() if not ok(readings.get(name, "").strip())]


for label, readings in (("before", WEAK), ("after", FIXED)):
    found = gaps(readings)
    print(f"{label}: {len(found)} gap(s)")
    for name in GOOD:
        print(f"  {'GAP' if name in found else 'ok '}  {name}: {readings[name]}")
assert gaps(WEAK) == ["FileVault", "Gatekeeper", "Application firewall"]
assert gaps(FIXED) == []
print("the check fails on the weak sample and passes on the fixed one")

before: 3 gap(s)
  GAP  FileVault: FileVault is Off.
  ok   System Integrity Protection: System Integrity Protection status: enabled.
  GAP  Gatekeeper: assessments disabled
  GAP  Application firewall: Firewall is disabled. (State = 0)
after: 0 gap(s)
  ok   FileVault: FileVault is On.
  ok   System Integrity Protection: System Integrity Protection status: enabled.
  ok   Gatekeeper: assessments enabled
  ok   Application firewall: Firewall is enabled. (State = 1)
the check fails on the weak sample and passes on the fixed one

The weak sample has three gaps, FileVault, Gatekeeper and the firewall, and the fixed one none, so the check fails where it should and passes where it should. Run it the same way before and after a change, and the ticket records both.

The privacy settings decide what each app may reach

Apps reach the camera, the microphone, the screen and the user’s files only with the user’s consent. In System Settings, Privacy & Security lists each kind of access: Camera, Microphone, Screen & System Audio Recording, Files & Folders for the Desktop, Documents and Downloads folders, and Accessibility, which lets an app control the Mac. Each list shows the apps that have asked, with a switch for each. Apple adds that FaceTime, Photo Booth and other apps that come with the Mac have camera access without asking, and that a green light glows beside the camera while it is on.

The answers are kept in the Mac’s privacy database, which man tccutil describes as the store of the decisions the user has made about whether apps may access personal data. Apple’s device management names its payload for it com.apple.TCC, which is why technicians call the database TCCTCC: The name technicians use for the macOS privacy database, after the com.apple.TCC payload that manages it: the store of each user's decisions about which apps may reach the camera, the microphone, the screen and personal files.. Follow one first request:

The request goes to the person at the Mac, and the answer is remembered. tccutil reset with a service and an app’s bundle IDbundle ID: The reverse-DNS name, such as com.example.notes, that identifies one app throughout macOS. It uses only letters, digits, hyphens and periods, and an app's caches, preferences file and support folder are named after it. More in “macOS essentials: Settings, Finder, accounts” clears that one decision, so the app asks again; without a bundle ID it clears the service for every app, which is rarely what a ticket needs. Accessibility deserves the most care: Apple warns that an app given access to control the Mac can also reach contacts, calendars and other information.

A meeting app that cannot share its screen

Back to the black square. The app needs Screen & System Audio Recording, the user decides it, and a web meeting adds a second layer, because the browser and the meeting site each need their own permission. Work the layers in order:

Three habits shorten these calls. Ask first whether the meeting runs in an app or a browser, because the browser is then the app that needs the permission. Test the device before the meeting rather than during it: MySmartCoPilot’s webcam test and mic test check whether the browser receives the camera and the microphone, and the screen recorder whether it can capture the screen, which separates a browser permission from a macOS one. And when a switch is on and nothing works, reset that one decision rather than every app’s.

Device management can deny some permissions but not grant them

Organisations manage privacy settings through a Privacy Preferences Policy Control payloadPrivacy Preferences Policy Control payload: A device management profile setting that can allow apps some kinds of access in advance, such as folders or Accessibility, but can only deny the camera, the microphone and screen recording.. Apple’s reference says only a device management service can install it, and it describes most of the payload’s settings as allowing an app: Accessibility, the Desktop, Documents and Downloads folders, and System Policy All Files, which covers data such as Mail, Messages, Safari and Time Machine backups. For three it says the opposite:

So on a managed Mac the user still answers the camera, microphone and screen recording requests themselves, and the organisation can take that access away. For screen recording, Apple’s payload examples show one more setting: it lets a standard user, who is not an administrator, turn an app’s switch on for themselves. That is the line a support desk explains: “IT can block this app’s camera, but only you can turn it on.”

Lockdown Mode, Find My and Activation Lock in support terms

Lockdown ModeLockdown Mode: An optional, extreme protection on Apple devices for the very few people who may be personally targeted by sophisticated attacks. It limits apps, websites and features, and blocks configuration profiles and device enrolment. is, in Apple’s words, an optional, extreme protection for the very few people who might be personally targeted by the most sophisticated digital threats. A Mac with it on does not work as usual: most message attachments are blocked, some web technologies are blocked, incoming FaceTime calls are blocked unless the user called that person in the past 30 days, and configuration profiles cannot be installed nor the Mac enrolled in device management. That last point explains a ticket: a Mac that refuses enrolment may simply be in Lockdown Mode. It is turned on in Privacy & Security, Lockdown Mode, Turn On, then Turn On & Restart, and an exclusion for a website, app or contact reduces its protection.

Three features in this area reach the help desk, each for a different reason:

Find My and Activation Lock go together. Turning on Find My enables Activation LockActivation Lock: A Mac feature that follows Find My: while it is on, the owner's Apple Account password or the device passcode is required before anyone can turn Find My off, erase the Mac, or reactivate and use it. More in “Install, reinstall and erase macOS”, and from then on nobody can switch Find My off, wipe the Mac or set it up again without the owner’s Apple Account password or the Mac’s passcode. That protects a lost Mac, and it is why a Mac changing hands must leave the old owner’s Find My first; the handover steps are in install, reinstall and erase macOS.

Practise: list a Mac’s protection gaps

The posture check above compared readings with good ones. Write the version a help desk runs over many Macs: it returns each reading that is not good with the reason, off, not read or unrecognised, in a fixed order, so a script can sort a fleet’s results. Its sample tests cover a protected Mac, a Mac with everything off and readings that are missing or say something else. The self-check after it covers every section.

def mac_posture_gaps(readings):
    """Return (key, reason) tuples for each protection reading that is not the good one."""
    return []

from mac_posture import mac_posture_gaps

GOOD = {
    "filevault": "FileVault is On.\n",
    "sip": "System Integrity Protection status: enabled.",
    "gatekeeper": "assessments enabled\n",
    "firewall": "Firewall is enabled. (State = 1)",
}


def with_value(key, value):
    readings = dict(GOOD)
    readings[key] = value
    return readings


def test_a_protected_mac_has_no_gaps():
    assert mac_posture_gaps(GOOD) == []


def test_every_protection_off():
    readings = {
        "filevault": "FileVault is Off.",
        "sip": "System Integrity Protection status: disabled.",
        "gatekeeper": "assessments disabled",
        "firewall": "Firewall is disabled. (State = 0)",
    }
    assert mac_posture_gaps(readings) == [
        ("filevault", "off"), ("sip", "off"), ("gatekeeper", "off"), ("firewall", "off"),
    ]


def test_one_gap_in_the_middle():
    assert mac_posture_gaps(with_value("gatekeeper", "assessments disabled")) == [("gatekeeper", "off")]


def test_a_missing_or_empty_reading_is_not_read():
    readings = dict(GOOD)
    del readings["firewall"]
    assert mac_posture_gaps(readings) == [("firewall", "not read")]
    assert mac_posture_gaps(with_value("sip", "  \n")) == [("sip", "not read")]


def test_other_text_is_unrecognised():
    assert mac_posture_gaps(with_value("filevault", "Error: could not read the status")) == [("filevault", "unrecognised")]


def test_the_order_is_fixed():
    readings = {"firewall": "Firewall is disabled. (State = 0)", "filevault": "FileVault is Off.",
                "sip": GOOD["sip"], "gatekeeper": GOOD["gatekeeper"]}
    assert mac_posture_gaps(readings) == [("filevault", "off"), ("firewall", "off")]

Interview questions

Warm-up (fresher): what does System Integrity Protection protect, in a sentence a user would understand?

It keeps the files macOS depends on from being changed while the Mac is running. Apple describes it as kernel permissions that limit writing to critical system files, built on mandatory access controls that users cannot override, which helps stop malicious code from modifying the system. It has been on by default since OS X 10.11, csrutil status shows it, and some of its commands only work from Recovery. For a user the practical meaning is: it is why an old guide that tells you to copy a file into a system folder fails, and the answer is never to switch it off but to follow a method that works with it.

Two harder tickets follow: 30 users who cannot share their screens after a meeting-app update, and a manager who asks for FileVault or Gatekeeper to be switched off because a tool will not run. Write the first question you would ask in each, then compare it with the opening step on its page:

Key takeaways

• fdesetup status, csrutil status, spctl --status and socketfilterfw --getglobalstate read FileVault, SIP, Gatekeeper and the firewall, and a posture check turns the four readings into gaps.
• Privacy & Security lists each kind of access per app, the person at the Mac grants it, and the privacy database keeps each decision until tccutil reset clears it for one service and one app.
• A meeting app that cannot share the screen needs Screen & System Audio Recording, a restart of the app, and in a browser also the browser’s and the site’s permission.
• A device management payload can allow many kinds of access, but for the camera, the microphone and screen recording it can only deny, so the user grants those themselves.
• Lockdown Mode is an extreme protection that also blocks configuration profiles and enrolment, and Find My turns on Activation Lock, which needs the owner’s Apple Account password to lift.