1

I set up Parental Control for a user but said user is still able to download and install additional software from DMG files (among other they downloaded TOR browser which bypasses parental control)..

I would block downloading in parental controls entirely however this would be a problem as certain downloaded files from the web are needed by the non-admin user.

-> Is there a solution to block the opening/downloading of DMG files by the non-admin user (maybe installers more broadly)?

Improve this question
5
  • You had two questions in here. This site works better when there is only one question per question. That way, it's easier for other people to find solutions if they have the same problem. I've edited out your second question, but feel free to ask it separately.
    – nohillside ♦
    Jan 24, 2019 at 10:23
  • Ok understood! I figure answering the first should cover the second anyway...
    – hoffmans25
    Jan 24, 2019 at 10:51
  • Well, you could limit the applications the user is allowed to run to a fixed set. Then even if they download/install TOR they can't use it
    – nohillside ♦
    Jan 24, 2019 at 11:37
  • I thought of that & tried it out. Unfortunately, when I do that a number of background helper apps which are needed are not selectable & therefore Chrome, Evernote and a few others are not able to run. Any ideas to make those accessible in the applications pane in the parental controls? Thanks for the input
    – hoffmans25
    Jan 24, 2019 at 15:16
  • Ah, right. No, don't know how to add additional applications to the pane.
    – nohillside ♦
    Jan 24, 2019 at 15:27

1 Answer 1

Reset to default
1

Here is a solution that may work for you.

Paste this following AppleScript code into a new ScriptEditor.app document then save it as a .scpt file "AutoEjectFolderAction.scpt" to your /Users/your user name/Library/Workflows/Applications/Folder Actions/ ...folder

on adding folder items to theFolder after receiving theNewItems
    -- Add Names of Any USB, Flash Drive, or Disk Image to allow to be mounted
    set allowedDisks to {"Time Machine Backups", "Parallels Desktop 13.2.0 (43213)"} -- examples to be allowed
    tell application "Finder"
        set ejectableDisks to disks whose ejectable is true and local volume is true and name is not in allowedDisks
        eject ejectableDisks
    end tell
end adding folder items to

That new .scpt file will now be used as a folder action that we will attach to the folder... /Volumes

enter image description here

enter image description here

enter image description here

enter image description here

Now every time A new disk image gets mounted, it will trigger the folder action which will run the script that will automatically eject it.

Improve this answer
5
  • Sorry I had to make an edit in order to retract my upvote because this solutions stops the user from being able to use a flash drive or such, like Time Machine on a USB Drive, etc. and is IMO outside the scope of stoping a .dmg file from being mounted.
    – user3439894
    Jan 25, 2019 at 18:24
  • Although my updated code adds an extra step, which may take a couple of minutes for the administrator to set up... I added the ability to define the names of the allowed usb,flash drves, and disk images ... to be mounted (which can be added to overtime If need be)
    – wch1zpink
    Jan 25, 2019 at 19:58
  • Remember the OP said the kid download the TOR Browser, well he/she is probably savvy enough to mount any downloaded .dmg from the command line using e.g. hdiutil attach ~/Downloads/FileName.dmg -mountroot ~ and have access to its contents. So watching /Volumes really isn't going to cut it, even with a white list.
    – user3439894
    Jan 25, 2019 at 23:45
  • @user3439894 Since the OP is the one who set up the parental controls for the non-admin user, couldn't the OP (being the admin) just as easily set up in the parental controls, to restrict access to Terminal.app or the inverse of that which would be allowing access to only the defined applications?
    – wch1zpink
    Jan 27, 2019 at 1:01
  • Prohibiting Terminal isn't going to stop one from using e.g. hdiutil attach ~/Downloads/FileName.dmg -mountroot ~ in Script Editor or Automator, so those would have to be included too. Also, what's to stop the kid from rebooting into Recovery Mode and extracting the contents of the .dmg file there? The real issue here as I see it is the "Second problem:" that was removed from the original OP. If you review the edit history you'll see that I'm talking about. The admin needs to remove information related to the TOR Browser from whatever database it's stored in. That will solve his real issue!
    – user3439894
    Jan 27, 2019 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .