SAP/macOS-enterprise-privileges 2.6.0

Privileges 2.6.0

on GitHub

What's new?

• Now, you can add a usage policy that users must acknowledge before they can request administrator privileges for the first time. Place a Policy.txt, Policy.rtf, or Policy.rtfd file in the /Library/Application Support/Privileges/ folder, or use the new key UsagePolicy. Please note that the maximum file size supported is 5 MB.

• If you use the RenewalCustomAction key to run a script or binary, you can now use the new ActionExecutableChecksum key to verify its integrity. This also resolves an issue introduced in version 2.5.3, where the RenewalCustomAction failed to execute when PostChangeExecutablePath and PostChangeExecutableChecksum were specified.

• On macOS 14 and higher, the Privileges system extension now also logs when a user or a group is added to the admin group like this:
  
 SAPCorp: User test gained administrator privileges instigated by /System/Library/ExtensionKit/Extensions/UsersGroups.appex/Contents/MacOS/UsersGroups
  
This indicates that the admin rights of the user test were changed using System Settings -> Users & Groups. Whereas the following log entry tells us that the nested group test was removed from the admin group by using the dseditgroup command:
  
 SAPCorp: Group test lost administrator privileges instigated by /usr/sbin/dseditgroup
  
This allows administrators to track when and by which process admin rights were changed, even if the change was not made using Privileges or one of its components.

• The PrivilegesCLI command-line tool has been updated to include a new argument, --history. This new feature allows users to view audit-relevant log entries from the past 30 days. Note that this feature only works with log entries created using Privileges 2.6.0 or newer. Enabling the Privileges System Extension and using the --json argument in addition to the --history argument is recommended for the most detailed reports. For more information about the JSON output, please refer to the Privileges wiki or check out the artice "The power of collaboration: an admin-rights audit trail for every Mac," written by our esteemed colleague Henry Stamerjohann from Fleet.

• To extend the lifespan of relevant log entries, PrivilegesDaemon and the Privileges system extension now use a new logging subsystem. If you want to access the log entries for privilege changes, you can do so by entering the following command:

  sudo log show --predicate 'process == "PrivilegesDaemon" AND subsystem == "com.apple.defaults" AND category == "audit"'

  or by just using:

  PrivilegesCLI --history --privilege-changes-only

• We also added the configuration key, AutoRenewalProcessPaths, which allows you to specify the paths of applications that will trigger an automatic renewal of admin rights. This feature operates independently of the AllowPrivilegeRenewal setting. Therefore, even if you have disabled privilege renewal for your users, you can still use the new automatic renewal feature. If a user's admin rights are about to expire and a specified app is running, their admin rights will be renewed automatically.

• Post-change applications or scripts can now also be set by just dragging the appropriate file onto the popup button in the Privileges settings.

• Added support for automatic updates using our upcoming app, Patcher.

• Fixed an issue that prevented users from quitting Privileges via the File menu or the Command-Q keyboard shortcut when the "Request Privileges" dialog was displayed.

• Fixed an issue that allowed users to create files or folders within the Privileges app bundle even when the Privileges system extension was enabled.

• We updated many localizations to correct translation errors and ensure consistent wording within the app.

• The minimum macOS version for running Privileges was bumped to macOS 12.0.