M@tt asked a question.
After upgrading to Mac OS 10.15, I noticed SnowAgent doesn't have 'Full Disk Access' security permissions (by default).
Is this likely to reduce its effectiveness?
What version of the Mac agent are you using? you shouldn't' need to alter any permissions if you are using the latest agent version that supports Catalina
Hi Joseph. I'm running 6.5.2
(6.5.2+build-2020-06-02-rev-313fdda34d08611e5468b35afe4887407ad2adcc)
Given that version is the latest and supports Catalina i would not worry about the permissions as the agent should have set these correctly on install.
The description of that setting also points more to access to Mail, messages etc. and not installed applications.
Still an issue
When snowagent 7.2.2 runs it uses diskutil on macOS but it will trigger a Full Disk Access request (but not have any impact) but it will be shown to the end user in the GUI
System Settings - Privacy & Security - Full Disk Access
Log command after a snowagent run:
log show --predicate 'eventMessage contains "SystemPolicyAllFiles"' --info --last 1m
Outputs:
tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=597.649, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=no, query=1, client_dict=(null), daemon_dict=<private>
tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{/opt/snow/snowagent}Resp:{TCCDProcess: identifier=snowagent, pid=51638, auid=0, euid=0, responsible_path=/opt/snow/snowagent, binary_path=/opt/snow/snowagent}, ReqResult(Auth Right: Denied (Service Policy), promptType: 1,DB Action:None)
kernel: (Sandbox) sandboxd rejected approval request from diskutil for kTCCServiceSystemPolicyAllFiles (/dev/rdisk0): denied
I was told this from support:
We do use diskutil to get disk info. It seems like it automatically query's more things that we need. Development currently do not intend to investigate if there is a way to avoid this query because it dose not have an impact. You still do not need to do any configuration and can ignore the denied request.
I posted an idea: https://ideas.snowsoftware.com/ideas/SNOW-I-3049
I could preallow in using a PPPC Full Disk access profile.
Given that version is the latest and supports Catalina i would not worry about the permissions as the agent should have set these correctly on install.
The description of that setting also points more to access to Mail, messages etc. and not installed applications.