TRANSPARENCY, CONSENT, AND CONTROL

Size: px

Start display at page:

Download "TRANSPARENCY, CONSENT, AND CONTROL"

Julian Ferguson
5 years ago
Views:

1 TCC IN MOJAVE

apps are doing in relation to user data Always

2 TCC TRANSPARENCY, CONSENT, AND CONTROL Commonly called TCC Has been a thing since 2011/2012 Monitors what apps are doing in relation to user data Always required user to manually allow/deny access to data like Contacts

3 WWDC AND I AM REALLY EXCITED TODAY TO TELL YOU ABOUT THE NEW USER DATA PROTECTIONS IN MACOS MOJAVE. NOW IN MACOS HIGH SIERRA, THESE APIS PROMPT THE USER FOR CONSENT BEFORE ALLOWING APPS TO ACCESS THEIR RESPECTIVE DATA... Kelly Yancy, WWDC 2018 Session Your Apps and the Future of macos Security

4 PRIVACY USER CONSENT

5 SURPRISE, SURPRISE, SURPRISE USER CONSENT Not in Beta s 1 through 6 Beta 7 Kinder Surprise New profile payload

6 SURPRISE, SURPRISE, SURPRISE PRIVACY PREFERENCES POLICY CONTROL PAYLOAD Address Book Calendar Reminders Photos Camera (Deny Only) Microphone (Deny Only) These should not require admin rights. Accessibility PostEvent SystemPolicyAllFiles SystemPolicySysAdminFiles AppleEvents These will required admin rights.

7 SURPRISE, SURPRISE, SURPRISE PRIVACY PREFERENCES POLICY CONTROL PAYLOAD PPPCP managed settings do not appear in the Privacy preference pane Stored in /Library/Application\ Support/com.apple.TCC/ MDMOverrides.plist Profiles must be installed on macos to work AFAIK, only SimpleMDM has mechanism to auto re-install PPPCP profile after a Mac is upgraded from macos 10.13

8 HOW DO I MANAGE THIS?

9 HOW DO I MANAGE THIS? USE THE PROFILES, LUKE... Obi-Wan Kenobi (probably)

12 STEP ONE GET AN MDM

13 STEP ONE GET AN MDM PPPCP requires enrolment in USER APPROVED MDM Apple School Manager or Apple Business Manager (aka DEP) OR end users manually enrolling in your MDM

14 STEP TWO CREATE PROFILES, YO

15 STEP TWO CREATE PROFILES, YO Artisinal handcrafted profiles These suck - painful to write, prone to errors, not readily repeatable tccprofile.py Command line driven, repeatable results, also has GUI JAMF PPPC Utility GUI based, repeatable results, can upload profile to your JAMF instance

16 STEP TWO CREATE PROFILES, YO tccprofile.py Open source Written in python Command line GUI Can create signed profiles if you've got a cert in your keychain

17 STEP TWO CREATE PROFILES, YO tccprofile.py (cont) tccdbread.py - read user and system TCC.db Requires Terminal to have Full Disk Access enabled app_entitlements.py for pretty print out of codesign entitlements for an app* *Entitlements output may not exist depending on if the app is/is not sandboxed, or not compiled with Xcode 10

18 STEP THREE TEST, TEST, AND MORE TEST

19 TEST, TEST, AND MORE TEST VIRTUAL MACHINE, HARDWARE, SCREAM TESTS Install Mojave on a VM Use snapshots, etc, for quick rollback Can reset the TCC database with tccutil or haircut's tccreset - only applies to user approved preferences Get hardware - can't test everything in a VM Don't be the guy that says "but it works in my VM!"

20 TEST, TEST, AND MORE TEST VIRTUAL MACHINE, HARDWARE, SCREAM TESTS Use the scream test Can't test every scenario, those pesky edge cases Educate end users about the changes to privacy in Mojave

21 LOGGING

22 LOGGING LOG STREAM Apple recommends using log stream --debug --predicate 'subsystem == "com.apple.tcc"' Produces A LOT of output. Can use log collect --output [output path] to write log to file

24 LOGGING LOG STREAM Filter using predicates to decrease verbosity on Macadmins Slack) log stream --debug --predicate 'subsystem == "com.apple.tcc" AND eventmessage BEGINSWITH "AttributionChain"'

26 LOGGING Keyword Definition Description ACC RESP Access Responsible Details of app/script attempting to access or control macos that requires user consent. App/script responsible for the app/script attempting to access or control macos REQ Request Action being requested ID Identifier Identifier of the app/script - i.e. com.apple.terminal PID Process ID Process identifier - i.e AUID EUID Actual User ID Effective User ID The real user identifier - i.e. 500 (correlates to UID of a user account) Effective user ID - different to the AUID if a script/app has been run as a different user binary path Path of binary Full path to the binary/script

27 LOGGING LOG STREAM Typically the parent process is what needs to be allowed/ denied, for example: Scripts executed using outset are the child process of outset This is not always true - VMware Fusion Python scripts executed by LaunchDaemons need to either be code signed or have the full interpreter path in the LaunchDaemon

29 LOGGING LOG STREAM Scripts need to have the correct shebang #!/usr/bin/python not #!/usr/bin/env python Must point to a code signed interpreter or shell

30 LOGGING READ THE TCC DATABASE Can read the system or user TCC.db Must give your favourite terminal app Full Disk Access Manually approve an app and read the DB to see what the system configures Doesn't show everything required

31 LOGGING READ THE TCC DATABASE # ~/Desktop/git/tccprofile/tccdbRead.py ~/Library/Application\ Support/com.apple.TCC/TCC.db Service Client ktccserviceaddressbook fr.whitebox.packages ktccserviceappleevents /usr/bin/osascript ktccserviceappleevents com.apple.terminal ktccserviceappleevents com.apple.installer ktccserviceappleevents org.videolan.vlc ktccserviceliverpool com.apple.notes ktccserviceubiquity com.apple.automator ktccserviceubiquity com.apple.clouddocs.mobiledocumentsfileprovider ktccserviceubiquity com.apple.preview ktccserviceubiquity com.apple.quicktimeplayerx ktccserviceubiquity com.apple.scripteditor2 ktccserviceubiquity com.apple.textedit ktccserviceubiquity com.apple.ibooksx ktccserviceubiquity com.apple.ichat ktccserviceubiquity com.apple.imovieapp ktccserviceubiquity com.apple.iwork.keynote ktccserviceubiquity com.apple.iwork.pages ktccserviceubiquity com.apple.mail #

32 LOGGING READ THE TCC DATABASE # sudo ~/Desktop/git/tccprofile/tccdbRead.py /Library/ Application\ Support/com.apple.TCC/TCC.db Service Client ktccserviceaccessibility com.divisiblebyzero.spectacle ktccserviceaccessibility com.hegenberg.bettersnaptool ktccserviceaccessibility com.vmware.fusion ktccservicepostevent com.divisiblebyzero.spectacle ktccservicepostevent com.hegenberg.bettersnaptool ktccservicepostevent com.vmware.fusion ktccservicesystempolicyallfiles com.apple.terminal #

33 CREATING A PROFILE TCCPROFILE.PY

35 CREATING A PROFILE [carl@valkyrie]:profiles # ~/Desktop/git/tccprofile/tccprofile.py --accessibility="/applications/vmware Fusion.app" --allow --pd="vmware Fusion Accessibility TCC Whitelist" --pi="com.github.carlashley" --pn="vmware Fusion Accessibility TCC Whitelist" --po="my Great Company" --payload-version=1 --create-template -o VMwareFusionAccessibility_PPPCP_ mobileconfig [carl@valkyrie]:profiles # ls -lha total 16 drwxr-xr-x 4 carl wheel 128B 19 Nov 11:26. drwxrwxrwt 10 root wheel 320B 19 Nov 11:26.. -rw-r--r-- 1 carl wheel 2.1K 19 Nov 11:26 VMwareFusionAccessibility_PPPCP_ mobileconfig [carl@valkyrie]:profiles #

36 CODE SIGNING WHAT YOU DEPLOY PACKAGING

37 PACKAGES - CODE SIGNING WHAT YOU DEPLOY BEFORE YOU CODE SIGN Are the code/actions/events that trigger User Consent Dialogs (UCD) relevant any more? Get rid of/stop doing things that aren't necessary Eliminate any code/actions/events that will trigger a User Consent Dialog wherever possible Only code sign what you're willing to keep code signing ESPECIALLY IF IT'S THIRD PARTY

38 PACKAGES - CODE SIGNING WHAT YOU DEPLOY CODE SIGNING Can't use any old certificate, it must be a code signing certificate Have to use an Apple certificate if you're signing an app for use on a Mac with Gatekeeper enabled Code sign requirements are stored in Extended Attributes if the item being signed is a "text file" such as a shell/python script

40 PACKAGES - CODE SIGNING WHAT YOU DEPLOY CODE SIGNING Packages app doesn't preserve the extended attributes that code signing uses Can use a tarball embedded as a pkg resource but is a "bodge" pkgbuild has the --preserve-xattr flag (not documented, may not be included in older versions of the binary) Greg Neagle updated munki-pkg to support this

41 JOIN US AND TOGETHER WE CAN RULE THE GALAXY SLACK

42 JOIN US Join the #tcc channel in the Macadmins Slack Check out the pinned items Contribute to the shared Google Drive doc 1sai3Q8qj9HdyDJfcSAchRELD0mOpik1NPYxr0F9AJRc/ edit?usp=sharing

43 PPPCP YO, IT'S WHAT THE COOL KIDS ARE DOING SUMMARY

44 SUMMARY Eliminate anything that triggers User Consent Dialogs if you can Approve/deny what you can't eliminate with new profile payloads Educate your IT team/s and end users on these new changes Code sign cautiously It's not going away, send feedback to improve it Get access to AppleSeed or a Developer account

45 LINKS/ATTRIBUTION WWDC 2018 Session Your Apps and the Future of macos Security Kelly Yancy MDMOverrides.plist - p , Mike Paul tcc-reset.py haircut tccprofile.py Carl Ashley JAMF PPPC JAMF Logging Pexels join_me_and_together_we_can_rule_the_galaxy_as/

Your Apps and the Future of macos Security

#WWDC18 Your Apps and the Future of macos Security Pierre-Olivier Martel, Security Engineering Manager Kelly Yancey, OS Security Garrett Jacobson, Trusted Execution 2018 Apple Inc. All rights reserved.