Bug: macOS Security & Privacy Payloads do not find all profiles with payloads included for FileVault or General&Firewall

[naschenbrenner]

I've included a lot of information to help with diagnosing the issue, but the TL;DR is as the title of this issue says — that Object Info is not finding all profiles with Security & Privacy payloads (both FileVault only and the combined General&Firewall options). My MacBook Pro is running macOS Tahoe 26.1 and I'm running the latest available Object Info version 3.2.0.

I had an issue with a client where there were conflicting profiles setting the Firewall and Stealth Mode settings. I used Object Info to scan for Config Profiles Payload > Computer > Security & Privacy:General&Firewall. It did find a conflicting profile, but upon un-scoping it from our test device we were still seeing in System Settings > Network > Firewall "This setting has been configured by a profile" and seeing a preference list at '/Library/Managed Preferences/com.apple.security.firewall.plist'. I ultimately had to run sudo profiles show and was able to find the conflicting profile. The bug seems to be that Object Info isn't finding all Configuration Profiles that have a FileVault or General&Firewall payload enabled (this could be more widespread than these payloads but I haven't had time to
test).

Some example profiles it did find when running Config Profiles Payload > Computer > Security & Privacy:General&Firewall:

1. A monolithic profile called UK-Security & Privacy endusers added
   to the UK site scoped to All computers with an exclusion for a smart
   group called UK - Conference Rooms with the following payloads:

   • Finder

     • Preferences

       • Finder Menu

         • Full

       • Show these items on the desktop

         • Hard disks

         • External disks

         • CDs, DVDs, and iPods

         • Connected servers

       • Show warning before emptying the Trash

     • Commands

       • Select commands available to users

         • Connect to Server

         • Eject

         • Burn Disc

         • Go to Folder

         • Restart

         • Shut Down

   • Login Window

     • Window

       • Login Prompt

         • List of users able to use these computers

           • Show local users

           • Show computer's administrators

           • Show "Other..."

         • Show Shut Down button

     • Options

       • Show password hint when needed and available

       • Disable automatic login

       • Enable console login

       • Enable Fast User Switching

       • Start screen saver after: 10 Minutes of Inactivity

         • Use screen saver module at path:
           /System/Library/Screen Savers/Flurry.saver

     • Access

       • User

         • Local-only users may log in

         • Combine available workgroup settings

     • Script

       • Login Script

         • Also execute the client computer's LoginHook script

       • Logout Script

         • Also execute the client computer's LogoutHook
           script

   • Privacy & Security

     • General

       • Restrict Send diagnostic and usage data to Apple, and
         sharing crash data and statistics with app developers

       • Allow Unlock macOS computer using an Apple Watch with
         watchOS 3 or later

       • Require Passcode to Unlock Screen immediately

       • Gatekeeper

         • Allow apps downloaded from: Mac App Store and
           identified developers

     • FileVault

       • Disable Require user to unlock FileVault after
         hibernation

     • Firewall

       • Enable Firewall

         • Control incoming connections for specific apps

       • Enable Stealth Mode

   • Software Update

     • Automatically install macOS updates

     • Automatically install app updates from the App Store

     • Automatically check for updates

     • Automatically download new updates when available

     • Automatically install configuration data

     • Automatically install system data files and security updates

2. Another monolithic profile called UK-Security & Privacy Conf room added to the UK site and scoped to a smart group called UK -
   Conference Rooms with the payloads:

   • Finder

     • Preferences

       • Finder Menu

         • Full

       • Show these items on the desktop

         • Hard disks

         • External disks

         • CDs, DVDs, and iPods

         • Connected servers

       • Show warning before emptying the Trash

     • Commands

       • Select commands available to users

         • Connect to Server

         • Eject

         • Burn Disc

         • Go to Folder

         • Restart

         • Shut Down

   • Login Window

     • Window

       • Login Prompt

         • Show local users

         • Show computer's administrators

         • Show "Other..."

       • Show Shut Down button

     • Options

       • Show password hint when needed and available

       • Disable Apple ID setup during login

       • Disable Siri setup during login

       • Enable console login

       • Enable Fast User Switching

     • Access

       • User

         • Local-only users may log in

         • Combine available workgroup settings

     • Script

       • Login Script

         • Also execute the client computer's LoginHook script

       • Logout Script

         • Also execute the client computer's LogoutHook
           script

   • Passcode

     • Require Passcode

     • Minimum Passcode Length set to 8

   • Privacy & Security

     • General

       • Restrict Set Lock Message

       • Restrict Send diagnostic and usage data to Apple, and
         sharing crash data and statistics with app developers

       • Restrict Unlock macOS computer using an Apple Watch with
         watchOS 3 or later

       • Gatekeeper

         • Allow apps downloaded from: Mac App Store and
           identified developers

     • FileVault

       • Disable Require user to unlock FileVault after
         hibernation

     • Firewall

       • Enable Firewall

         • Control incoming connections for specific apps

       • Disable Stealth Mode

3. Yet another monolithic profile called TEST UK-Security & Privacy Conf room - DNU which is added to the UK site and is not scoped with
   the payloads:

   • Finder

     • Preferences

       • Finder Menu

         • Full

       • Show these items on the desktop

         • Hard disks

         • External disks

         • CDs, DVDs, and iPods

         • Connected servers

       • Show warning before emptying the Trash

     • Commands

       • Select commands available to users

         • Connect to Server

         • Eject

         • Burn Disc

         • Go to Folder

         • Restart

         • Shut Down

   • Login Window

     • Window

       • Login Prompt

         • Show local users

         • Show computer's administrators

         • Show "Other..."

       • Show Shut Down button

     • Options

       • Show password hint when needed and available

       • Disable Apple ID setup during login

       • Disable Siri setup during login

       • Enable console login

       • Enable Fast User Switching

     • Access

       • User

         • Local-only users may log in

         • Combine available workgroup settings

     • Script

       • Login Script

         • Also execute the client computer's LoginHook script

       • Logout Script

         • Also execute the client computer's LogoutHook
           script

   • Passcode

     • Require Passcode

     • Minimum Passcode Length set to 8

   • Privacy & Security

     • General

       • Restrict Set Lock Message

       • Restrict Send diagnostic and usage data to Apple, and
         sharing crash data and statistics with app developers

       • Restrict Unlock macOS computer using an Apple Watch with
         watchOS 3 or later

       • Gatekeeper

         • Allow apps downloaded from: Mac App Store and
           identified developers

     • FileVault

       • Disable Require user to unlock FileVault after
         hibernation

     • Firewall

       • Enable Firewall

         • Control incoming connections for specific apps

       • Enable Stealth Mode

The profile it did not pickup initially when running Config Profiles Payload > Computer > Security & Privacy:General&Firewall is called FileVault - Key Escrow it is not added to any site and is scoped to All computers excluding the smart group UK - Conference Rooms and had the payloads:

• Certificate

  • JSS FileVault Recovery Key Escrow Certificate

  • Allow export from keychain

• Security and Privacy

  • General

    • Require Passcode to Unlock Screen after 5 seconds

  • FileVault

    • Escrow Personal Recovery Key

      • Encryption Method

        • Automatic

      • Escrow Location Description

        • $CompanyName Jamf Pro

• Firewall

  • Enable Firewall

    • Control incoming connections for specific apps

  • Disable Stealth Mode

However I've since broken out some of the components from these profiles to be standalone profiles that only do one thing to help us with isolating/troubleshooting down the line and Object Info still isn't detecting these profiles. I removed the conflicting keys from the profiles UK-Security & Privacy endusers and FileVault - Escrow Key

• Security and Privacy

  • General

    • Require Passcode to Unlock Screen

  • Firewall

    • Enable Firewall

      • Control incoming connections for specific apps

    • Disable Stealth Mode

And I broke each out into their own respective profiles called System Settings - Require Password to Unlock 5 Seconds After Screensaver Starts and System Settings - Enable Firewall and Firewall Stealth Mode but neither are showing when running Config Profiles Payload > Computer > Security & Privacy:General&Firewall. Just for kicks I also tried running Config Profiles Payload > Computer > Security & Privacy:FileVault and am getting no results despite having the previously mentioned profile FileVault - Key Escrow as well as another profile called FileVault - Prevent turning off FileVault which is not assigned a site and is scoped to a smart group called Jamf Setup Manager - Ready for Profile Deployment and the only key that is set for this profile is:

• Security and Privacy

  • FileVault

    • User adjustment of FileVault options

      • Prevent FileVault from being disabled

[naschenbrenner]

I just looked at the source code and correct me if I'm wrong, it looks like you're calling the Configuration Profile API, then running each Configuration Profile ID through https://company.jamfcloud.com/JSSResource/osxconfigurationprofiles/id/{id} and searching for <key>PayloadDisplayName</key><string>PreferenceSecurity</string>.

To see if my profile I mentioned above that only sets the Firewall settings (called System Settings - Enable Firewall and Firewall Stealth Mode) I ran an API call to grab the profile and after cleaning up the <payloads></payloads> tag content I examined the XML and found the PayloadDisplayName is simply Firewall.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
  <dict>
    <key>PayloadUUID</key>
    <string>E3E40B7F-D06F-4606-91E2-B3F9558374FA</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadOrganization</key>
    <string>Company</string>
    <key>PayloadIdentifier</key>
    <string>E3E40B7F-D06F-4606-91E2-B3F9558374FA</string>
    <key>PayloadDisplayName</key>
    <string>System Settings - Enable Firewall and Firewall Stealth Mode</string>
    <key>PayloadDescription</key>
    <string/>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>BlockAllIncoming</key>
        <false/>
        <key>EnableFirewall</key>
        <true/>
        <key>EnableStealthMode</key>
        <true/>
        <key>PayloadDisplayName</key>
        <string>Firewall</string>
        <key>PayloadIdentifier</key>
        <string>E9AD78CA-E54A-4E80-96C5-BF39B090D2D2</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.security.firewall</string>
        <key>PayloadUUID</key>
        <string>E9AD78CA-E54A-4E80-96C5-BF39B090D2D2</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>Applications</key>
        <array/>
      </dict>
    </array>
  </dict>
</plist>

I then created a profile for testing that has all keys under Security and Privacy > General selected and ran it through the API and cleaned it up again. You can see below the only keys that gives us a PayloadDisplayName string of PreferenceSecurity are dontAllowLockMessageUI and dontAllowPasswordResetUI. Everything else seems to have a different PayloadDisplayName which would explain why when using Object Info to search for Config Profiles Payload > Computer > Security & Privacy:General&Firewall we are missing results.

Since I also mentioned an issue with the FileVault payload too I also did the same thing with a test profile enabling all the settings under Security and Privacy > FileVault except for Recovery Key Redirection, and it appears from the source code you're looking for <key>PayloadDisplayName</key><string>FileVault</string> and the only keys that use that PayloadDisplayName are Defer and it's subsequent settings, Enable, and ForceEnableInSetupAssistant.

Privacy and Security General Settings:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
  <dict>
    <key>PayloadUUID</key>
    <string>79AD5D38-941C-4C65-96FB-7B992D04C4A7</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadOrganization</key>
    <string>Company</string>
    <key>PayloadIdentifier</key>
    <string>79AD5D38-941C-4C65-96FB-7B992D04C4A7</string>
    <key>PayloadDisplayName</key>
    <string>Test</string>
    <key>PayloadDescription</key>
    <string>Needing this profile to download and view XML data for Object Info, can be deleted if you're reading this. </string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>PayloadDisplayName</key>
        <string>Restrictions</string>
        <key>PayloadIdentifier</key>
        <string>18A0F990-2ED0-4DF6-BDF5-FBACAEF0B021</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.applicationaccess</string>
        <key>PayloadUUID</key>
        <string>18A0F990-2ED0-4DF6-BDF5-FBACAEF0B021</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>allowAutoUnlock</key>
        <false/>
      </dict>
      <dict>
        <key>PayloadDisplayName</key>
        <string>ScreenSaver</string>
        <key>PayloadIdentifier</key>
        <string>125E9ECF-266F-4FD6-8FB9-8CF1EBD64C5B</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.screensaver</string>
        <key>PayloadUUID</key>
        <string>125E9ECF-266F-4FD6-8FB9-8CF1EBD64C5B</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>askForPassword</key>
        <true/>
        <key>askForPasswordDelay</key>
        <integer>0</integer>
      </dict>
      <dict>
        <key>PayloadDisplayName</key>
        <string>PreferenceSecurity</string>
        <key>PayloadIdentifier</key>
        <string>E10866DF-BB84-40D2-A227-56DBC3F54E80</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.preference.security</string>
        <key>PayloadUUID</key>
        <string>E10866DF-BB84-40D2-A227-56DBC3F54E80</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>dontAllowLockMessageUI</key>
        <true/>
        <key>dontAllowPasswordResetUI</key>
        <true/>
      </dict>
      <dict>
        <key>AutoSubmit</key>
        <false/>
        <key>PayloadDisplayName</key>
        <string>SubmitDiagInfo</string>
        <key>PayloadIdentifier</key>
        <string>61993416-915A-4898-940C-2EB54A59D691</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.SubmitDiagInfo</string>
        <key>PayloadUUID</key>
        <string>61993416-915A-4898-940C-2EB54A59D691</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
      </dict>
      <dict>
        <key>AllowIdentifiedDevelopers</key>
        <false/>
        <key>EnableAssessment</key>
        <true/>
        <key>EnableXProtectMalwareUpload</key>
        <false/>
        <key>PayloadDisplayName</key>
        <string>SystemPolicyControl</string>
        <key>PayloadIdentifier</key>
        <string>EF503375-8070-4F2E-978E-5F51C45494E8</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.systempolicy.control</string>
        <key>PayloadUUID</key>
        <string>EF503375-8070-4F2E-978E-5F51C45494E8</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
      </dict>
      <dict>
        <key>DisableOverride</key>
        <true/>
        <key>PayloadDisplayName</key>
        <string>SystemPolicyManaged</string>
        <key>PayloadIdentifier</key>
        <string>CE2CF7E5-69CA-48A9-ACCB-027CEAB876FF</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.systempolicy.managed</string>
        <key>PayloadUUID</key>
        <string>CE2CF7E5-69CA-48A9-ACCB-027CEAB876FF</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
      </dict>
    </array>
  </dict>
</plist>

Privacy and Security FileVault Settings:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
  <dict>
    <key>PayloadUUID</key>
    <string>79AD5D38-941C-4C65-96FB-7B992D04C4A7</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadOrganization</key>
    <string>Company</string>
    <key>PayloadIdentifier</key>
    <string>79AD5D38-941C-4C65-96FB-7B992D04C4A7</string>
    <key>PayloadDisplayName</key>
    <string>Test</string>
    <key>PayloadDescription</key>
    <string>Needing this profile to download and view XML data for Object Info, can be deleted if you're reading this. </string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadEnabled</key>
    <true/>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>PayloadUUID</key>
        <string>515851b2-9b26-4739-9801-0675a7584316</string>
        <key>PayloadType</key>
        <string>com.apple.security.pkcs1</string>
        <key>PayloadOrganization</key>
        <string>Accel</string>
        <key>PayloadIdentifier</key>
        <string>8E31AA4D-B0EF-4AB1-835D-F10AEAAD5FA6</string>
        <key>PayloadDisplayName</key>
        <string>JSS FileVault Recovery Key Escrow Certificate</string>
        <key>PayloadDescription</key>
        <string/>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadCertificateFileName</key>
        <string>FileVault2Comm.cer</string>
        <key>PayloadContent</key>
        <data>CertificateDataRemovedForPrivacy</data>
        <key>AllowAllAppsAccess</key>
        <false/>
      </dict>
      <dict>
        <key>Defer</key>
        <true/>
        <key>DeferDontAskAtUserLogout</key>
        <true/>
        <key>DeferForceAtUserLoginMaxBypassAttempts</key>
        <integer>3</integer>
        <key>Enable</key>
        <string>On</string>
        <key>ForceEnableInSetupAssistant</key>
        <true/>
        <key>PayloadDisplayName</key>
        <string>FileVault</string>
        <key>PayloadIdentifier</key>
        <string>03BA5419-11B2-4876-8B2A-35B961907C04</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.MCX.FileVault2</string>
        <key>PayloadUUID</key>
        <string>03BA5419-11B2-4876-8B2A-35B961907C04</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>ShowRecoveryKey</key>
        <false/>
        <key>UseRecoveryKey</key>
        <true/>
      </dict>
      <dict>
        <key>EncryptCertPayloadUUID</key>
        <string>515851b2-9b26-4739-9801-0675a7584316</string>
        <key>Location</key>
        <string>Company Jamf Pro</string>
        <key>PayloadDisplayName</key>
        <string>FileVault Recovery Key Escrow</string>
        <key>PayloadIdentifier</key>
        <string>53B458AB-F3E2-4CAF-B46D-CCA733E3A320</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.security.FDERecoveryKeyEscrow</string>
        <key>PayloadUUID</key>
        <string>53B458AB-F3E2-4CAF-B46D-CCA733E3A320</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
      </dict>
      <dict>
        <key>DestroyFVKeyOnStandby</key>
        <false/>
        <key>PayloadDisplayName</key>
        <string>MCX</string>
        <key>PayloadIdentifier</key>
        <string>AB0B7893-6FB1-41B6-B81F-55D00C143DDB</string>
        <key>PayloadOrganization</key>
        <string>JAMF Software</string>
        <key>PayloadType</key>
        <string>com.apple.MCX</string>
        <key>PayloadUUID</key>
        <string>AB0B7893-6FB1-41B6-B81F-55D00C143DDB</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>cachedaccounts.askForSecureTokenAuthBypass</key>
        <true/>
        <key>dontAllowFDEDisable</key>
        <true/>
      </dict>
    </array>
  </dict>
</plist>

I think to make this work as expected you'd need to breakout General and Firewall to separate payloads. Firewall preferences seem to be found under <key>PayloadDisplayName</key><string>Firewall</string> and for General and FileVault you may need to include an if statement that looks for the correct values. I don't know Swift so unfortunately I cannot create a PR, but hopefully this is enough data to help implement a fix.

[BIG-RAT]

Thanks for all the details. As time permits let me know if v3.2.1 resolves the issue.

[naschenbrenner]

Unfortunately it seems there isn't much of a change. After downloading and installing the new version 3.2.1 I signed back in to the customer's server with Object Info and I tried both Firewall & FileVault and am still missing some profiles.

Below is what Object Info found

osxconfigurationprofiles-mac_sec-priv-genfire.txt
Payload Type Profile Name Scope Limitations Exclusions
Security & Privacy:General&Firewall UK-Security & Privacy Conf room computer_groups:["UK - Conference Rooms"]
Security & Privacy:General&Firewall TEST UK-Security & Privacy Conf room - DNU

osxconfigurationprofiles-mac_sec-priv-filevault.txt
Payload Type Profile Name Scope Limitations Exclusions
Security & Privacy:FileVault Test

I won't subject you to parsing through 4 more profiles, but below I've included what I'd expect to find with each query and what I'm seeing in the XML that might be helpful to key off of.

General&Firewall search:

System Settings - Enable Firewall and Firewall Stealth Mode <key>PayloadDisplayName</key><string>Firewall</string> or <key>PayloadType</key><string>com.apple.security.firewall</string>

System Settings - Require Password to Unlock 5 Seconds After Screensaver Starts <key>PayloadDisplayName</key<string>ScreenSaver</string> or <key>PayloadType</key><string>com.apple.screensaver</string>

FileVault search:

FileVault - Key Escrow <key>PayloadDisplayName</key><string>FileVault Recovery Key Escrow</string> and <key>PayloadType</key><string>com.apple.security.FDERecoveryKeyEscrow</string>

FileVault - Prevent turning off FileVault - <key>PayloadDisplayName</key><string>MCX</string> and <key>PayloadType</key><string>com.apple.MCX</string>

I am a Jamf Partner so if you would like me to provide full copies of the Profiles you should be able to get ahold of me via one of the Jamf Partner Slack channels, otherwise let me know if there's anything else I can provide here that would be helpful. I appreciate you taking a look at this and pushing out a new version so quickly.

[naschenbrenner]

Fixed with 3.3.0 release, thank you!