search

SAP / macOS-enterprise-privileges

For Mac users in enterprise environments, this application gives users control over the administration of their machine by elevating their level of access to administrator privileges on macOS. Users can set a timeframe in the application's settings to perform specific tasks, such as installing or removing an application.
Apache License 2.0
1.4k stars 149 forks source link

[Privileges 2] ReasonRequired is not enforced if the dropdown is empty #107

Closed aduffner closed 1 month ago

aduffner commented 1 month ago

Impact

Users can be granted administrator rights without giving a reason, even though ReasonMinLength is set to 20 and ReasonRequired is set to true.

Tested on

Config applied to testing system via mdm on computer level:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>ExpirationInterval</key>
    <integer>5</integer>
    <key>ExpirationIntervalMax</key>
    <integer>60</integer>
    <key>RequireAuthentication</key>
    <true/>
    <key>AllowCLIBiometricAuthentication</key>
    <true/>
    <key>RevokePrivilegesAtLogin</key>
    <true/>
    <key>PostChangeActionOnGrantOnly</key>
    <true/>
    <key>ReasonMinLength</key>
    <integer>20</integer>
    <key>ReasonMaxLength</key>
    <integer>50</integer>
    <key>ReasonRequired</key>
    <true/>
    <key>ReasonPresetList</key>
    <array>
      <dict>
        <key>de</key>
        <string>Um Software zu installieren</string>
        <key>default</key>
        <string>For installing software</string>
      </dict>
      <dict>
        <key>de</key>
        <string>Für Schabernack</string>
        <key>default</key>
        <string>For fun</string>
      </dict>
    </array>
    <!-- TODO: Webhook or RemoteLogging -->
  </dict>
</plist>

Steps of reproduction

Step 1: Click on the Privileges Beta Icon from your Dock, you will get asked the following:

Bildschirmfoto 2024-10-03 um 18 25 21

Step 2: Click into the dropdown:

Bildschirmfoto 2024-10-03 um 18 25 26

Step 3: Click anywhere outside the dropdown:

Bildschirmfoto 2024-10-03 um 18 25 33

✅ Now you are seeing that you can claim admin rights without providing a reason. I guess this is not an expected result.

mthielemann commented 1 month ago

Nice catch! This seems to happen only if the language is set to German. I'll look into it. Thanks!

mthielemann commented 1 month ago

Already fixed. Will be included in the next build.