22

Is there a way to block a list of specific apps on macOS?

I have looked up solutions such as Cisdem, but there are some holes in the way it works that I don't like.

  1. Unless you also block Activity Monitor, Terminal, and System Preferences, you can simply quit the Cisdem process or create a new user to get around it.
  2. You have to block Activity Monitor, Terminal, and System Preferences to make it work well.

I want to block an app from running or even being installed on my Mac. The app can be installed via the App Store and the web. Not sure how to go about this. Enabling Parental Controls won't work as Administrator privileges are needed.

The specific app I want to block is Apple Configurator.

Any ideas?

Improve this question
0

2 Answers 2

Reset to default
24

Use Gatekeeper to control access to Applications

You can use spctl (Gatekeeper) to create lists of approved and unapproved apps.

For example, suppose you want to allow Mail but block Chrome.

sudo spctl --add --label "ApprovedApps" /Applications/Mail.app 
sudo spctl --add --label "DeniedApps" /Applications/Chrome.app

The above command will will "label" Mail and Chrome as "Approved" and "Denied" respectively (you can use your own descriptors).

Now, to enable/disable apps, you issue the commands:

sudo spctl --enable --label "ApprovedApps" 
sudo spctl --disable --label "DeniedApps"

The advantage this has is that to add another app to either list, you just have to add the appropriate label:

sudo spctl --add --label "ApprovedApps" /Applications/Another.app

Additionally, you can forbid code from the Mac App Store from running (found in the spctl man page - man spctl).

spctl --disable --label "Mac App Store"

This will prevent anyone from downloading an App from the App store and installing/running it.

Dealing with Admins/sudoers

As stated in the comments, anything an Admin can do, another Admin can undo. Using spctl requires root, but editing the sudoers file to restict access to a particular command can prevent other users/admins from undoing your changes.

See How to prevent sudo users from running specific commands? for details on how to configure a "whitelist with exception" in your sudoers file.

For example, to allow user Sam access to all commands except spctl, you would put in the sudoers file:

sam ALL = ALL, !/usr/sbin/spctl

Now, this a "quick and dirty" way of preventing access to spctl but ultimately, it's not effective because if the other admin gets wise to your strategy, all he/she has to do is rename the command and they have access.

From the sudoers man page:

In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any `!' elements in the user specification.

To really lock it down, you would need to either force the other user to su as a different user (i.e. operator) or create a whitelist of allowed commands defaulting to blocking everything else. However, that is time consuming and quite dangerous as you can lock people out of critical functions.

Improve this answer
6
  • 1
    Nice! That is exactly what I was looking for. Good job. Thank you so much!
    – tentmaking
    Commented Jan 27, 2018 at 19:29
  • Really awesome answer Allan - I don’t think that this would be amenable to prevent file access or stop sending a sigkill signal - would it? apple.stackexchange.com/questions/332124/…
    – bmike ♦
    Commented Jul 28, 2018 at 20:09
  • @bmike - Just saw this comment. thx for the kind words. As for sigkill, I don't think you could prevent that because technically, you can kill your own processes.
    – Allan
    Commented Aug 23, 2018 at 21:31
  • 4
    This all sounds great, but it's simply not working for me (on 10.14.3). The changes apply, but I can still launch the apps that I've "denied". Gatekeeper is enabled.
    – BSUK
    Commented Mar 6, 2019 at 14:56
  • 1
    Does not work for me either (on 10.14.1).
    – Student
    Commented May 1, 2019 at 3:02
0

You can use a .mobileconfig that specifies the com.apple.applicationaccess.new PayloadType, see https://apple.stackexchange.com/a/334557/:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadIdentifier</key>
    <string>com.company.macos.blockapps</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>9c24d6b3-6233-4a08-a48d-9068f4f76cf0</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadDisplayName</key>
    <string>Block Apps In User Folder</string>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.applicationaccess.new</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>MCXToProfile.9c24d6b3-6233-4a08-a48d-9068f4f76cf0.alacarte.customsettings.2476221c-1870-4f3e-8c52-52386029c4cf</string>
            <key>PayloadEnabled</key>
            <false/>
            <key>PayloadUUID</key>
            <string>2476221c-1870-4f3e-8c52-52386029c4cf</string>
            <key>PayloadDisplayName</key>
            <string>Blocks all apps in the ~/ directory.</string>
            <key>familyControlsEnabled</key>
            <true/>
            <key>pathBlackList</key>
            <array>
                <string>~/</string>
            </array>
        </dict>
    </array>
</dict>
</plist>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .