kolide
macOS Sequoia `Access Local Network` prompt
We're hearing reports that the new macOS Sequoia beta is causing prompts about Allow osquery to find devices on local networks This would be a horrific customer experience, and we need to understand more about what's happening...
- AFAIK this should only apply to things running in user context and accessing the network
- We run osquery in launchd context
- Except for screenlock, is that's what's happening?
- We run launcher in usercontext for the menu
- An Apple friend tells me there's an occasional bug where this triggers for launchd contexts
Threads:
- https://onepassword.slack.com/archives/C06KP4H82JH/p1723583314739589
- https://forums.developer.apple.com/forums/thread/663858
Reproducing the popup
Upgrade to Sequoia Beta. You will get the popup after upgrade.
To trigger the popup again, uninstall launcher, reboot the machine, and reinstall launcher.
In Privacy & Security => Local Network, you can see osquery is allowed or disallowed depending on how you responded to the prompt.
Actions that do NOT reproduce the popup
- Unloading and reloading launcher
- Refreshing all checks
- Querying the
screenlockandcurltables vialauncher interactive - Uninstalling and reinstalling launcher without a reboot in between
tccutil reset All io.osquery.agent(even with a reboot)
I have not yet found an actual consequence for selecting "Don't Allow". No error logs (osquery, launcher, or in the Console), and no missing data when running checks.
