search

jamf / PPPC-Utility

Privacy Preferences Policy Control (PPPC) Utility
MIT License
730 stars 46 forks source link

Since 11.4 jamf is not getting correct access to System Events #110

Open GabeShack opened 2 years ago

GabeShack commented 2 years ago

Hi, Since around 11.4 (with some security updates apple changed) we have been seeing a mixed sh/apple script cause a message '"Jamf" wants access to control "System Events".'

In the past the TCC Configuration profile I created for both Jamf and OSAScript bypassed this message however after 11.4 this started up, which looks like it requires more PP approval.

I am trying my hardest to narrow down what actually needs to be changed for this to function correctly. I've followed the logging steps in this article: https://krypted.com/mac-os-x/reviewing-tcc-dialog-prompts-using-logs-on-a-mac/

But it doesn't seem to be providing me with many answers.

In the discussions on this on the Jamf forums, one user has said they got around this by changing the code requirement identifier to be more generic IE using the identifier com.jamf.management.daemon, but using the code requirement for the jamf app.

https://community.jamf.com/t5/jamf-pro/quot-jamf-quot-wants-access-to-control-quot-system-events-quot/m-p/258122#M238876

I cannot verify this is working, but wondering if instead of making these intricate jamf config profiles to allow it to work with osascript and system events, instead to have a premade "Jamf" template that allows for all jamf identifiers to interact with all parts of system events and parent processes?

macblazer commented 2 years ago

@GabeShack Can you post here a plain text mobileconfig file (that is, not signed and encrypted), or an excerpt from it that shows the keys that you are using that do not work? It's hard to diagnose a somewhat generic question and distill an entire forum conversation.

GabeShack commented 2 years ago

In reviewing this issue with both Apple and Jamf, it seems this has been a verified issue and its recommended when creating a TCC for any Jamf process, to use the the code identifier of the the parent process (jamf.app) instead of the child process jamfdaemon.

I can submit both the code im trying to run and the jamf tcc i currently use that causes it to prompt for access to system events, however i believe now after speaking with some engineers at apple, that this is not a solvable issue currently.