0

I'd like to prevent the use of the osascript terminal command by anyone without administrator access. I used to accomplish this by changing the permissions on the executable using sudo chmod 744 /usr/bin/osascript.

The problem now (from what I understand) is that Big Sur does not allow changes to be made to the read-only system volume. I'd therefore like to find a workaround that retains this functionality ie. I don't want it to be possible to run this binary without the use of sudo.

This has been a huge thorn in my side, and I don't want to have to resort to disabling SSV authentication in order to edit the system volume. If there's any way to just elevate the permissions needed then that would be perfect.

1 Answer 1

5

Changing the permissions on the binary is not going to be an effective way of blocking such commands. The user can simply download or copy the osascript binary from a web site or another computer onto your Mac and run it - without sudo.

There's probably some resource that you do not want your users to access - and they have been doing that through the osascript command. But instead of blocking osascript, look at changing the permissions for that resource. That would in turn make it so that osascript cannot access it without sudo.

5
  • That’s just another binary - what is it more specifically that you do not want them using networksetup for? Adding a proxy? Setting the IP configuration of a network interface manually? Or?
    – jksoegaard
    Commented May 18, 2021 at 5:26
  • The actual issue here seems to be that you have given the user administrative privileges from the start. Instead create the user as an ordinary user, and you won’t have these problems.
    – jksoegaard
    Commented May 18, 2021 at 7:01
  • Can you explain why you want to do this? - It is not because I'm questioning your motives, but understanding why you want to do it would help in providing the best solution.
    – jksoegaard
    Commented May 18, 2021 at 7:17
  • In that case, you're trying to go about this in the wrong way. DNS settings are inherently a user-space thing that doesn't require administrative privileges - so your users could just start up Firefox or Chrome and change their DNS setting inside that app - thus making your attempts to block the networksetup command futile. If your problem is specifically with 8.8.8.8 (and similar IPs), I would simply firewall those IPs in your network.
    – jksoegaard
    Commented May 18, 2021 at 7:23
  • Then the user can just run any other browser to circumvent it. If you would like to firewall on the Mac itself, then look into "pf" (packet filter) and the accompanying command "pfctl". Essentially you create a rule like this: "block drop from any to 8.8.8.8" to make it so that you cannot send network packets to that address.
    – jksoegaard
    Commented May 18, 2021 at 7:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .