usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

icloud_appleid_system_settings_disable (dev_sonoma) refers to deprecated domain #150

New Issue
Closed
opened 2026-01-19 18:29:24 +00:00 by michael · 9 comments
michael commented 2026-01-19 18:29:24 +00:00
Owner
Copy Link

Originally created by @cipineda on GitHub.

Originally assigned to: @robertgendler on GitHub.

Summary

icloud_appleid_system_settings_disable' looks for the com.apple.systempreferencesdomain which is deprecated. Can it be possible to use thecom.apple.applicationaccessdomain with theallowAccountModification` key instead?

Steps to reproduce

Using `icloud_appleid_system_settings_disable' fails in the scan as I do not use this profile/key on Sonoma systems.

Operating System version

Sonoma 14.0 Beta 7 (23A5337a)

Intel or Apple Silicon

both

What is the current bug behavior?

Not really a bug but rather a questioning as to why still using the old method.

What is the expected correct behavior?

use the com.apple.applicationaccess domain with the allowAccountModification key

Relevant logs and/or screenshots

image

Output of checks

Possible fixes

use the com.apple.applicationaccess domain with the allowAccountModification key as noted on the screenshot.

Originally created by @cipineda on GitHub. Originally assigned to: @robertgendler on GitHub. ### Summary `icloud_appleid_system_settings_disable' looks for the `com.apple.systempreferences` domain which is deprecated. Can it be possible to use the `com.apple.applicationaccess` domain with the `allowAccountModification` key instead? ### Steps to reproduce Using `icloud_appleid_system_settings_disable' fails in the scan as I do not use this profile/key on Sonoma systems. ### Operating System version Sonoma 14.0 Beta 7 (23A5337a) ### Intel or Apple Silicon both ### What is the current *bug* behavior? Not really a bug but rather a questioning as to why still using the old method. ### What is the expected *correct* behavior? use the `com.apple.applicationaccess` domain with the `allowAccountModification` key ### Relevant logs and/or screenshots ![image](https://github.com/usnistgov/macos_security/assets/62953370/35a3551a-b1fc-4a17-91b1-706041f3b116) ### Output of checks ### Possible fixes use the `com.apple.applicationaccess` domain with the `allowAccountModification` key as noted on the screenshot.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@cipineda commented on GitHub:

Yeah, the document is misleading on the new method.
The old one, even though it is deprecated, somehow still works, but I'm trying to stay away, were I can from it.

@cipineda commented on GitHub: Yeah, the document is misleading on the new method. The old one, even though it is deprecated, somehow still works, but I'm trying to stay away, were I can from it.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@cipineda commented on GitHub:

It does for me, check the image...
it is visible but all grayed out (can't edit at all).
image

@cipineda commented on GitHub: It does for me, check the image... it is visible but all grayed out (can't edit at all). ![image](https://github.com/usnistgov/macos_security/assets/62953370/a509565f-0ea4-41a9-96a9-0d1d8804e74a)
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

So that's after you're signed in. Most places who are blocking the system settings pane want to block signing in.

  • Unblock yourself.
  • Sign out
  • block yourself again

You'll see what I mean.

@robertgendler commented on GitHub: So that's after you're signed in. Most places who are blocking the system settings pane want to block signing in. * Unblock yourself. * Sign out * block yourself again You'll see what I mean.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Well that's interesting. I didn't realize allowAccountModification controlled the AppleID pane. When I read it, I assumed it had to do with the user account.

@robertgendler commented on GitHub: Well that's interesting. I didn't realize `allowAccountModification` controlled the AppleID pane. When I read it, I assumed it had to do with the user account.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

I'm not a fan though of how it controls the Apple ID system setting pane. It doesn't gray out anything you just can't click or type anywhere. It's kind of misleading.

@robertgendler commented on GitHub: I'm not a fan though of how it controls the Apple ID system setting pane. It doesn't gray out anything you just can't click or type anywhere. It's kind of misleading.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Ya. So that's why I'm not a fan of it vs blocking the whole pane. Sure it's deprecated but so is auditd and other things.

@robertgendler commented on GitHub: Ya. So that's why I'm not a fan of it vs blocking the whole pane. Sure it's deprecated but so is auditd and other things.
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Closing this issue as we now have included the rule os_account_modification_disable in the Sonoma branch

@robertgendler commented on GitHub: Closing this issue as we now have included the rule `os_account_modification_disable` in the Sonoma branch
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@cipineda commented on GitHub:

I unlocked it, signed out and locked again, and the pane is visible but can't click on anything.
It is misleading though, as it should not show anything but "Apple ID" settings are not available. These settings are controlled by a profile." but it does not, you can see but not click.

image

@cipineda commented on GitHub: I unlocked it, signed out and locked again, and the pane is visible but can't click on anything. It is misleading though, as it should not show anything but "Apple ID" settings are not available. These settings are controlled by a profile." but it does not, you can see but not click. ![image](https://github.com/usnistgov/macos_security/assets/62953370/f3e44be5-ea1a-4ecf-8fd1-37f3a13289fb)
michael commented 2026-01-19 18:29:24 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

This actually solves an older even bigger problem. This also restricts adding Internet Accounts.

@robertgendler commented on GitHub: This actually solves an older even bigger problem. This also restricts adding Internet Accounts.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#150
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?