MDM profile

[vaughnhart]

Hi... I have this application block in my MDM profile but it doesn't seem to get enabled - what am I doing wrong?

....
allowFingerprintForUnlock

allowUSBRestrictedMode

familyControlsEnabled

pathBlackList

/System/Applications/News.app
/System/Applications/Siri.app
/System/Applications/Stocks.app
/System/Applications/Freeform.app
/System/Applications/Home.app
/System/Applications/Time\ Machine.app
/System/Applications/Voice\ Memos.app
/System/Applications/Shortcuts.app
/System/Applications/Utilities/Bluetooth\ File\Exchange.app



PayloadDescription
This payload disables iCloudPrivateRelay. Version 1

I have seen, in the past, some of Apple's apps talking on their own/bootup with aApple and I want to block them... plus with the class action lawsuit by the investor who found apple monitoring his investment strategy via Stocks or something on his system, I'd like to block many of their apps.

[brodjieski]

Which payloadtype are you applying these settings to? Also, note that Apple deprecated the pathBlackList key back in macOS 10.15... so your milage may vary.

[vaughnhart]

Ahhh. This was taken from the Ventura guidance. It is part of the application access payload.

[vaughnhart]

I also have a key for disabling Private Relay and they didn't work either, even though it shows in Profile as a restriction. But sure enough Private Relay turned on for the Wi-Fi network I connected to and the option is not greyed out. But these application restrictions don't even show up. I hope that makes sense.

[brodjieski]

For the application restrictions, the payloadtype is com.apple.applicationaccess.new, and not the same com.apple.applicationaccess that the other restrictions are set. Can you verify that you are using this in your profile?

[brodjieski]

@vaughnhart If these still aren't working for you after verify the payloadtype, you may need to look into third-party options.

[vaughnhart]

As you can see Private Relay turned on with this connection... though it has never been on before.

[brodjieski]

If you don't have that service, then how is it showing up on your system? The disabling of private relay does work, as does the application restrictions (to some extent).

[jmahlman]

Limit IP address tracking is not Private relay. Private relay is separate and requires an Apple ID. If you're not using an Apple ID, or blocking the ability to log into an Apple ID, the private relay setting isn't going to have an effect.

Edit: Apparently, Apple considers this part of Private relay [Source]. But as I mention below, they give no way to control it on the device. You need to open feedback on this, it's not a missing control on the project's part.

Also as a note, setting it to false doesn't mean it turns it off, it simply disables the ability to change the setting.

[vaughnhart]

@brodjieski @brodjieski

A) I am using my AppleID (in a limited fashion) and I do not have iCloud+
B) there seems to be three different places for Apple's "Limit IP Address/Private Relay". The one in Wi-Fi, the one in AppleID and the one in Safari, all which seem to be indecently enabled from one another.
C) I have seen and am seeing (without the iCloud+ service) traffic being logged (in Cisco Umbrella) to the mask.iCloud.con and mask-h2.iCloud.com service.
D) there is a Reddit (not as reputable) that someone else has seen the same thing.
D)I am completely able to toggle that Limit IP address switch on and off with the setting. And it turns itself on, even when I don't want it.

[jmahlman]

Limit IP address tracking is not controlled by limiting Private Relay. At present, Apple gives no way to control it on the device. You need to open feedback.

If you want to control it at a network level, Apple has an article for that.

[vaughnhart]

Thank you. I saw the same article... but need to take a deeper look at it an the IETFs for QUIC.

Do you have any suggestions for application control which this Q&A is really about? It a part of the Ventura guidance but it doesn't work. My thought is control the binaries and you control the world.

😭😄

[jmahlman]

There is a note in the the application blocking controls:

Apple has deprecated the use of restriction controls, using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.

If they're not working, you may need to look into a third party solution.

[vaughnhart]

OK... that answers everything. Man... I miss GPO. You can almost do everything on Windows with GPO.

[vaughnhart]

@brodjieski I am not using the new application access restriction payload. It's the old one. That's very important. Thank you!

[vaughnhart]

Thank you guys... I jerry-rigged something together... and it seems to work but there is a bypass. And paths with a space seem to not be working.

[vaughnhart]

Maybe sorted... do you see the discrepancy in Voice Memos... not pictured but it looks different in finder. All I need to find now is the binary for Private Relay. But this might all break in Sonoma.

[vaughnhart]

Thank you. If I didn't say it before. Thanks!

-Vaughn

[vaughnhart]

interesting things I found when Limit IP Address Tracking enabled on my normal connection.... via sudo lsof.

launchd 1 root fp.u systm 0x4026b24b39485ca5 0t0 [ctl com.apple.net.netagent id 2 unit 17] (fileport=0x2d923)
launchd 1 root fp. unknown file type: 524335 (fileport=0x8002f)
launchd 1 root fp. unknown file type: 539651 (fileport=0x83c03)
launchd 1 root fp.u systm 0x4026b24b394859a5 0t0 [ctl com.apple.net.netagent id 2 unit 14] (fileport=0x83d03)
launchd 1 root fp.u systm 0x4026b24b394861a5 0t0 [ctl com.apple.net.netagent id 2 unit 28] (fileport=0x88d63)
launchd 1 root fp.u systm 0x4026b24b39486025 0t0 [ctl com.apple.net.netagent id 2 unit 25] (fileport=0x8a35f)
launchd 1 root fp.u systm 0x4026b24b39485225 0t0 [ctl com.apple.net.netagent id 2 unit 23] (fileport=0x8a45f)
launchd 1 root fp.u systm 0x4026b24b39485e25 0t0 [ctl com.apple.net.netagent id 2 unit 20] (fileport=0x8a523)
launchd 1 root fp.u systm 0x4026b24b39485da5 0t0 [ctl com.apple.net.netagent id 2 unit 19] (fileport=0x8a65f)
launchd 1 root fp.u systm 0x4026b24b39485c25 0t0 [ctl com.apple.net.netagent id 2 unit 15] (fileport=0x8fc27)
launchd 1 root fp.u systm 0x4026b24b39484225 0t0 [ctl com.apple.net.netagent id 2 unit 16] (fileport=0x91b1f)
launchd 1 root fp.u systm 0x4026b24b39485ba5 0t0 [ctl com.apple.flow-divert id 1 unit 1] (fileport=0x9c65f)
launchd 1 root fp.u systm 0x4026b24b39485d25 0t0 [ctl com.apple.net.netagent id 2 unit 18] (fileport=0x9c877)
launchd 1 root fp.u systm 0x4026b24b39485ea5 0t0 [ctl com.apple.net.netagent id 2 unit 21] (fileport=0x9c95f)
launchd 1 root fp.u systm 0x4026b24b39485f25 0t0 [ctl com.apple.net.netagent id 2 unit 22] (fileport=0x9ca23)
launchd 1 root fp.u systm 0x4026b24b39485fa5 0t0 [ctl com.apple.net.netagent id 2 unit 24] (fileport=0x9cb23)
launchd 1 root fp.u systm 0x4026b24b394860a5 0t0 [ctl com.apple.net.netagent id 2 unit 26] (fileport=0x9cc63)
launchd 1 root fp. unknown file type: 675075 (fileport=0xa4d03)
launchd 1 root fp.u systm 0x4026b24b39486125 0t0 [ctl com.apple.net.netagent id 2 unit 27] (fileport=0xa6eab)
launchd 1 root 0w CHR 3,2 0t0 338 /dev/null
launchd 1 root 1u CHR 3,2 0t0 338 /dev/null
launchd 1 root 2w CHR 0,0 0t5905 336 /dev/console
launchd 1 root 3u unix 0x4026b241a0e8eb1d 0t0 /private//var/run/syslog
launchd 1 root 4u unix 0x4026b241a0e8ebe5 0t0 ->0x4026b241a0e8eb1d
launchd 1 root 5w REG 1,13 4371173 1840342 /private/var/log/com.apple.xpc.launchd/launchd.log
launchd 1 root 6u unix 0x4026b241a0e8ecad 0t0 /private/var/run/cupsd
launchd 1 root 7r REG 1,13 358 595398 /private/etc/security/audit_control
launchd 1 root 8u unix 0x4026b241a0e8ed75 0t0 /var/rpc/ncalrpc/NETLOGON
launchd 1 root 9u unix 0x4026b241a0e8ecad 0t0 /private/var/run/cupsd
launchd 1 root 10u unix 0x4026b241a0e8ee3d 0t0 /var/run/vpncontrol.sock
launchd 1 root 11u unix 0x4026b241a0e912f5 0t0 /private/tmp/com.apple.launchd.Zex9oyDTj5/Listeners
launchd 1 root 12u unix 0x4026b241a0e8ef05 0t0 /var/run/portmap.socket
launchd 1 root 13u unix 0x4026b241a0e8ee3d 0t0 /var/run/vpncontrol.sock
launchd 1 root 14u unix 0x4026b241a0e8efcd 0t0 /private/var/run/.sim_diagnosticd_socket
launchd 1 root 15u unix 0x4026b241a0e8ef05 0t0 /var/run/portmap.socket
launchd 1 root 16u unix 0x4026b241a0e8f095 0t0 /var/run/systemkeychaincheck.socket
launchd 1 root 17u unix 0x4026b241a0e8efcd 0t0 /private/var/run/.sim_diagnosticd_socket
launchd 1 root 18u unix 0x4026b241a0e8f15d 0t0 /var/run/mDNSResponder
launchd 1 root 19u unix 0x4026b241a0e913bd 0t0 /var/run/filesystemui.socket
launchd 1 root 20u unix 0x4026b241a0e8f225 0t0 /var/rpc/ncacn_np/lsarpc
launchd 1 root 21u unix 0x4026b241a0e912f5 0t0 /private/tmp/com.apple.launchd.Zex9oyDTj5/Listeners
launchd 1 root 22u unix 0x4026b241a0e8f2ed 0t0 /var/rpc/ncalrpc/lsarpc
launchd 1 root 23u unix 0x4026b241a0e8f3b5 0t0 /var/rpc/ncacn_np/mdssvc
launchd 1 root 24u unix 0x4026b241a0e8f225 0t0 /var/rpc/ncacn_np/lsarpc
launchd 1 root 25u unix 0x4026b241a0e8f2ed 0t0 /var/rpc/ncalrpc/lsarpc
launchd 1 root 26u unix 0x4026b241a0e8f47d 0t0 /var/rpc/ncacn_np/wkssvc

and this from running a grep -R

./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.app-proxy
./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.app-proxy
./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.app-proxy
./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.packet-tunnel
./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.packet-tunnel
./System/iOSSupport/System/Library/Frameworks/NetworkExtensioniOSSupport.framework/Versions/A/Resources/Info.plist: com.apple.networkextension.packet-tunnel

since the private relay is bundled into iOS as well... it might be that harmonizing Apple OS and hardware (chips) means less development and more congruity.

Anyone ever lockout these binaries? Or do you know how to find them? See above.

[robertgendler]

No.

[vaughnhart]

I blocked apple-dns.net and it looks like it also dealt with the some servers for Limit IP address as well.

[vaughnhart]

I'm whitelisting iCloud.com sites as needed and Limit IP address tracking turned on... so I manually had to turn it off, even though I'm blocking mask.icloud.com and mask-h2.icloud.com.

[vaughnhart]

In digging through LSOF I found these paths tied to what seems to be Private Relay/Limit IP Address Tracking:

com.apple.net.netagent
/usr/libexec/wifip2pd
/Users/vaughnhart/Library/Caches/GeoServices
/System/Library/Frameworks/CoreTelephony.framework/Support/CommCenter
com.apple.net.utun_control
com.apple.flow-divert
/usr/libexec/networkserviceproxy
/usr/libexec/nesessionmanager
/var/run/pppconfd
/var/run/vpncontrol.sock