Prohibit execution from /tmp #129

New Issue

michael · 2026-01-19T18:29:20Z

michael commented

2026-01-19 18:29:20 +00:00

Originally created by @nihil-admirari on GitHub.

Problem to solve

os_user_app_installation_prohibit prohibits running software from user profile. Unfortunately, users can still install software to /tmp and run it from there.

Further details

<key>pathBlackList</key>
<array>
    <string>/private/tmp/</string>
</array>

doesn't work.

Originally created by @nihil-admirari on GitHub. ### Problem to solve `os_user_app_installation_prohibit` prohibits running software from user profile. Unfortunately, users can still install software to `/tmp` and run it from there. ### Further details ``` <key>pathBlackList</key> <array> <string>/private/tmp/</string> </array> ``` doesn't work.

michael closed this issue

2026-01-19 18:29:20 +00:00

michael commented

2026-01-19 18:29:20 +00:00

@brodjieski commented on GitHub:

Hello!
This rule has a note regarding the functionality, and that it requires third party tools in order to fully implement. Unfortunately, there isn't a good built-in solution for this. It's also limited to only a couple of baselines, so depending on your organization, you may consider omitting the rule altogether.

Apple has deprecated the use of link:eb51fb0cb9/mdm/profiles/com.apple.applicationaccess.new.yaml (L67-L70)[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.

@brodjieski commented on GitHub: Hello! This rule has a note regarding the functionality, and that it requires third party tools in order to fully implement. Unfortunately, there isn't a good built-in solution for this. It's also limited to only a couple of baselines, so depending on your organization, you may consider omitting the rule altogether. Apple has deprecated the use of link:https://github.com/apple/device-management/blob/eb51fb0cb9626cac4717858556912c257a734ce0/mdm/profiles/com.apple.applicationaccess.new.yaml#L67-L70[application restriction controls], using these controls may not work as expected. Third party software may be required to fulfill the compliance requirements.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#129