seb-mac

seb-mac copied to clipboard

I'm using Mac version 3.0 in a University environment, on MacOS 10.15.7. We're getting the red lock screen when a user uses the 'shake to locate' the pointer, when it magnifies. This only happens the first time a user logs in for an exam. After that, things behave normally.

Given the app is deployed to nearly x100 devices - is this a setting that can be adjusted somewhere in the app or a .SEB file?

Can you please post the exact error message displayed on the red lock screen? SEB can display these lock screens for around 8 different reasons, we always need the error message to be able to analyze the issue (best is to take a picture).

The cause is the same, the error messages are different.

I assume this issue is fixed in SEB 3.1, the release candidate version can be downloaded and tested here, the final release will be available this week.

In the first case it looks like "jamfHelper" tried to display something on the screen while SEB is running. I don't think that this is related to the fast pointer movement (unless you can replicate the first error reliably). We're also using Jamf for deployment, but I never observed such an issue. In case Jamf has some option to display on the screen when it's updating apps, then that would need to be disabled, as SEB obviously cannot allow any other app or tool to display anything on the screen while running in its kiosk/lockdown mode. An alternative would be to use the Assessment Mode (AAC) kiosk/lockdown mode, as there other apps shouldn't be able to display anything.

Regarding Jamf: If you have the (default) setting for "Show menu bar" enabled, SEB attempts to terminate the process of a menu bar item when the user clicks on such a (third party, not macOS) menu bar item (even unintentionally, like when moving the mouse pointer quickly). This is the only way how to prevent menu bar items to display unwanted information. So if you have a menu bar item for Jamf enabled, a student clicks it and SEB cannot terminate Jamf (what makes sense, as it's probably running with administrator rights), then the lock screen will also be displayed.

Thanks for the information so far. We have suppressed any on-screen prompts, or known windows on these iMacs. Opening the exam and specifically shaking the mouse pointer to locate it brings up this repeatable error, in the image attached. It references a 'skylight.framework'. Turning off the feature in: Systems Prefs > Accessibility > Display > Cursor > Shake Mouse pointer to locate stops this red alert screen from appearing. The users are not pressing any additional buttons, menus or clicking anywhere on screen. This happens in SEB v3 and v3.1. This issue occurs once on all exams, and then doesn't occur again after the user has quit SEB and re-opened the exam file.

.

Can you please attach the SEB log file with the date/time this happens (located in ~/Library/Logs/Safe Exam Browser/)?

Time in log: 10:53.24

org.safeexambrowser.SafeExamBrowser 2022-05-24--09-53-11-718.log

Can you please post the output of the following command pasted/executed in Terminal:

codesign -dv --verbose=4 /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer

Something is wrong with the code signature (or the code signature check in SEB) of your WindowServer process when shaking the pointer.

Ok, so to get the SHA-1 hash of the "Software Signing" certificate, which I actually would need to check if there is something wrong with the code signature of your macOS version/WindowServer, there are some other steps necessary:

• Use the command codesign -dvvvv --extract-certificates /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer in Terminal
• In your home directory (as long as you didn't change the path in Terminal), you will find 3 files, add the file extension "der" to the file codesign0 (so its filename is "codesign0.der")
• Drag/import this file into the Keychain Access app
• Find the "Software Signing" certificate in Keychain Access, double click it and scroll down
• Paste the SHA-1 Fingerprint here.

I'll also add some debug log message for this Fingerprint to the next SEB version, as that may help to solve such issues in future.

EF DB C9 13 9D D9 8D BA E5 A9 C7 16 5A 09 65 11 B1 5E AE F9

Ok thanks, this is the same I get for macOS 10.15.7. It looks like there is a bug though in my code, I'll fix it and let you know when there's a version with a fix.

I attempted to fix this issue, although I cannot really test if it doesn't happen anymore (as in my case I observed it only randomly and very rarely). At least I added one fundamental improvement in monitoring those prohibited processes plus more logging. So in case it still happens, the according SEB log files should give me more hints.

So please test the release version of SEB 3.1, see direct link (the website will be updated soon).

Closed for lack of feedback.