So macOS Catalina is here. I and others have been working on getting our systems ready for Catalina for the last few months… and we’re just about there thank goodness!
There are lots of new features in Catalina… with Data Protection being a big deal when it comes to our anti-virus tool, Sophos. From Apple’s webpage:
macOS Catalina checks with you before allowing an app to access your data in your Documents, Desktop and Downloads folders, iCloud Drive, the folders of third-party cloud storage providers, removable media and external volumes.
Which is a problem for an anti-virus application that expects to have access to the whole disk - to make sure no nasties end up on your computer…
MDM to the rescue?
Apple’s mobile device management (MDM) framework does allow an admin to grant specific applications Full Disk Access to they can continue doing what they need to do.
Our MDM of choice SimpleMDM does allow for adding Privacy Preferences - but the UI didn’t seem to lend itself to adding all of the components required in that Sophos doc.
Open source tools to the rescue?
Enter Erik Berglund’s ProfileCreator - a GUI application for creating Apple configuration profiles. This made quick work of creating a suitable profile that I could upload into SimpleMDM as a “Custom” profile.
It was added at the device level… and appears to be installed correctly by SimpleMDM.
But how do we test that it’s working?
I was expecting to see Sophos or some Sophos components “pre-approved” in the
Security & Privacy –>
Full Disk Access part of system preferences. But, nope - nothing.
So is it working or not?
So - if the eicar test file is downloaded to a user home directory and gets detected as malware - that proves the profile is actually doing something…
so that’s what I tried, running
curl https://secure.eicar.org/eicar.com >> test_file.com to download the test file to a user home directory on a device enrolled in MDM with the Sophos “Full disk access” profile installed.
Bingo! Detected as Malware. Then I repeated the experiment after manually unenrolling, and rebooting for good measure…
…and it looks like Sophos can still see malware and viruses, but what it can’t do is remove or quarantine them.
This is a concern - as we’ve configured Sophos to raise a ticket automatically if it finds malware it can’t remove. In a Sophos install without “Full Disk Access” approval, that’s basically every. Single. Detection… :(
MDM to the rescue!
It’s great for now that we can use the profiles framework and SimpleMDM to ensure Sophos can continue to work as expected.
If you’re a Sophos user - and are interested in what the profile looks like - you’ll find a copy here.