usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Modify sysprefs_siri_disable to use "com.apple.assistant.support" instead of "com.apple.ironwood.support" #225

New Issue
Closed
opened 2026-01-19 18:29:43 +00:00 by michael · 9 comments
michael commented 2026-01-19 18:29:43 +00:00
Owner
Copy Link

Originally created by @qharouff on GitHub.

Originally assigned to: @robertgendler on GitHub.

Problem to solve

The sysprefs_siri_disable rule currently recommends the "com.apple.ironwood.support" payload with "Ironwood Allowed" set to "false". Although this control may still function, it was deprecated after macOS 10.13.

The "com.apple.assistant.support" payload now provides support for this functionality in newer version of macOS with the "Assistant Enabled" key set to "false".

Further details

The "com.apple.assistant.support" payload is also used within the "sysprefs_improve_siri_dictation_disable" rule.

This payload should work macOS 10.12 and above.

Proposal

Modify the sysprefs_siri_disable rule to recommend the "com.apple.assistant.support" payload configuration in modern versions of macOS.

Documentation

Apple Developer "com.apple.ironwood.support" Deprecated: https://developer.apple.com/documentation/devicemanagement/parentalcontroldictationandprofanity
Rich Trouton Article on Blocking Siri on macOS Sierra (and higher): https://derflounder.wordpress.com/2016/09/20/blocking-siri-on-macos-sierra/

Testing

Test behavioral functionality in different OS versions. Confirmed working for macOS 12 (Monterey).

Originally created by @qharouff on GitHub. Originally assigned to: @robertgendler on GitHub. ### Problem to solve <!-- What problem do we solve? --> The sysprefs_siri_disable rule currently recommends the "com.apple.ironwood.support" payload with "Ironwood Allowed" set to "false". Although this control may still function, it was deprecated after macOS 10.13. The "com.apple.assistant.support" payload now provides support for this functionality in newer version of macOS with the "Assistant Enabled" key set to "false". ### Further details <!-- Include use cases, benefits, and/or goals (contributes to our vision?) --> The "com.apple.assistant.support" payload is also used within the "sysprefs_improve_siri_dictation_disable" rule. This payload should work macOS 10.12 and above. ### Proposal <!-- How are we going to solve the problem? --> Modify the sysprefs_siri_disable rule to recommend the "com.apple.assistant.support" payload configuration in modern versions of macOS. ### Documentation <!-- Relevant documentation to the feature--> Apple Developer "com.apple.ironwood.support" Deprecated: https://developer.apple.com/documentation/devicemanagement/parentalcontroldictationandprofanity Rich Trouton Article on Blocking Siri on macOS Sierra (and higher): https://derflounder.wordpress.com/2016/09/20/blocking-siri-on-macos-sierra/ ### Testing <!-- What risks does this change pose? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? --> Test behavioral functionality in different OS versions. Confirmed working for macOS 12 (Monterey).
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

We'll have to test to make sure it works happily. But good find!

@robertgendler commented on GitHub: We'll have to test to make sure it works happily. But good find!
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Turns out com.apple.assistant.support does not disable Dictation under Keyboard which uses Siri for diction, sending the data off to Apple's servers to analyze. So while com.apple.assistant.support does disable Siri in the Siri system preference, it does not disable all of Siri services, at least on Monterey

@robertgendler commented on GitHub: Turns out com.apple.assistant.support does not disable Dictation under Keyboard which uses Siri for diction, sending the data off to Apple's servers to analyze. So while com.apple.assistant.support does disable Siri in the Siri system preference, it does not disable all of Siri services, at least on Monterey
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@jeolsen commented on GitHub:

<key>UserHasDeclinedEnable</key><true/> in com.apple.Siri should disable Siri

@jeolsen commented on GitHub: `<key>UserHasDeclinedEnable</key><true/>` in com.apple.Siri should disable Siri
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@jeolsen commented on GitHub:

what about also adding
com.apple.assistant.support: "Assistant Enabled" to FALSE (bool)
com.apple.assistant.support: "Siri Data Sharing Opt-In Status" to "2" (Integer)

@jeolsen commented on GitHub: what about also adding com.apple.assistant.support: "Assistant Enabled" to FALSE (bool) com.apple.assistant.support: "Siri Data Sharing Opt-In Status" to "2" (Integer)
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

com.apple.siri - UserHasDeclinedEnable - this does not appear to disable Siri in my testing.

@robertgendler commented on GitHub: com.apple.siri - UserHasDeclinedEnable - this does not appear to disable Siri in my testing.
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

com.apple.applicationaccess has the key for allowAssistant though supposedly not supported in macOS, but it appears to work in macOS with Ventura at least. This disables Siri and Dictation.

com.apple.assistant.support with the key Assistant Enabled is not an officially supported key. But will disable Siri. Then with allowDictation you can disable Dictation as well.

I think the project for now will continue using Ironwood as that disables both features and is "technically" supported by Apple even though it is deprecated. But if an organization chooses to do it a different way, they are welcome to do that.

We will continue to monitor this due to Section 508 IT Accessibility rules and laws, Apple should provide better methods to disabling Siri, Allowing Dictation, and doing forceOnDeviceOnlyDictation like they do on iOS. Please file feedback to Apple.

@robertgendler commented on GitHub: `com.apple.applicationaccess` has the key for `allowAssistant` though supposedly not supported in macOS, but it appears to work in macOS with Ventura at least. This disables Siri and Dictation. `com.apple.assistant.support` with the key `Assistant Enabled` is not an officially supported key. But will disable Siri. Then with `allowDictation` you can disable Dictation as well. I think the project for now will continue using Ironwood as that disables both features and is "technically" supported by Apple even though it is deprecated. But if an organization chooses to do it a different way, they are welcome to do that. We will continue to monitor this due to Section 508 IT Accessibility rules and laws, Apple should provide better methods to disabling Siri, Allowing Dictation, and doing forceOnDeviceOnlyDictation like they do on iOS. Please file feedback to Apple.
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@jeolsen commented on GitHub:

i didn't think disabling siri and disabling dictation were the same thing. Apple is stating that dictation can be disabled with the "allowDictation" key set to false in com.apple.applicationaccess payload. They stated on 101823390766 that this worked on Ventura during internal testing.

@jeolsen commented on GitHub: i didn't think disabling siri and disabling dictation were the same thing. Apple is stating that dictation can be disabled with the "allowDictation" key set to false in com.apple.applicationaccess payload. They stated on 101823390766 that this worked on Ventura during internal testing.
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@qharouff commented on GitHub:

what about also adding
com.apple.assistant.support: "Assistant Enabled" to FALSE (bool)
com.apple.assistant.support: "Siri Data Sharing Opt-In Status" to "2" (Integer)

This is the configuration I've tested on my end and can confirm @robertgendler's findings. This does not disable dictation on macOS 12.

Thanks for looking into this one Bob!

@qharouff commented on GitHub: > what about also adding > com.apple.assistant.support: "Assistant Enabled" to FALSE (bool) > com.apple.assistant.support: "Siri Data Sharing Opt-In Status" to "2" (Integer) This is the configuration I've tested on my end and can confirm @robertgendler's findings. This does not disable dictation on macOS 12. Thanks for looking into this one Bob!
michael commented 2026-01-19 18:29:43 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

https://github.com/apple/device-management/blob/seed_iOS-16-1_macOS-13-0/mdm/profiles/com.apple.applicationaccess.yaml

According to this allowDictation existed since 10.13. Will do some more testing against Monterey and Ventura.

@robertgendler commented on GitHub: https://github.com/apple/device-management/blob/seed_iOS-16-1_macOS-13-0/mdm/profiles/com.apple.applicationaccess.yaml According to this allowDictation existed since 10.13. Will do some more testing against Monterey and Ventura.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#225
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?