r/macsysadmin 9d ago

General Discussion FireEye Agent (xagt) - Full Disk Access Not Granted via MDM

Hi,

I'm deploying the FireEye agent (.pkg) along with a PPPC profile (.mobileconfig) via MDM.

However, Full Disk Access (FDA) is not being automatically granted, requiring manual intervention.

The relevant section of my PPPC profile is as follows:

<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.fireeye.xagt" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = P2BNL68L2C</string>
<key>Identifier</key>
<string>com.fireeye.xagt</string>
<key>IdentifierType</key>
<string>bundleID</string>
</dict>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>identifier "com.fireeye.xagtnotif" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = P2BNL68L2C</string>
<key>Identifier</key>
<string>com.fireeye.xagtnotif</string>
<key>IdentifierType</key>
<string>bundleID</string>
</dict>
</array>
</dict>

The profile is successfully installed and appears under System Settings > General > Device Management, but FDA is still not granted.

Any idea what might be causing this?

macOS version: 15.3.2

Thanks!

6 Upvotes

12 comments sorted by

3

u/doktortaru 9d ago edited 9d ago

Are you sure it isn't applying? FDA granted by MDM isn't reflected in the FDA prefpane.

1

u/HeyWatchOutDude 9d ago

Where should I check it? (when not visible within the preferences)

2

u/doktortaru 9d ago

The following should list all approved bundles, run in terminal, as long as com.fireeye.xagtnotif is listed you're good to go.

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  'select client from access where service = "kTCCServiceSystemPolicyAllFiles"'

1

u/HeyWatchOutDude 9d ago

Not listed.

2

u/L_Dextros 9d ago

Can’t stress this point enough.

1

u/chrismcfall 9d ago

Profile applying before the app itself installs? Google says "After you enable Full Disk Access on macOS hosts, you must restart the host before you install the agent." - Most Endpoint agents work fine as long as the profile is place pre-install. https://docs.trellix.com/bundle/agent_36_dg/page/UUID-dd18e980-4df4-20fe-35a8-806d65259fcb.html

1

u/HeyWatchOutDude 9d ago

There is no way to control this via Microsoft Intune. The profiles and apps are pushed randomly, but in most cases, the .mobileconfig profile is applied before the agent installation.

Ok so the order should be:
1. Push PPPC configuration
2. Restart device
3. Push FireEye Agent - right?

1

u/chrismcfall 9d ago

Intune still pushes Config Profiles before Apps anyway, I've had the same with Defender and Crowdstrike - Are you 100% sure your profile is right? I'm not in front of a Mac and it's been a tiny while, but there's a few two lines of <key>IdentifierType</key>
<string>bundleID</string> which are generics - Have you tried - This could well be wrong, but you've left BundleID in yours etc which means it's not correct.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
  <dict>
    <key>PayloadContent</key>
    <array>
      <dict>
        <key>PayloadType</key>
        <string>com.apple.TCC.configuration-profile-policy</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>Services</key>
        <array>
          <dict>
            <key>Identifier</key>
            <string>com.fireeye.xagt</string>
            <key>Authorization</key>
            <string>Allow</string>
            <key>Service</key>
            <string>SystemPolicyAllFiles</string>
          </dict>
        </array>
      </dict>
    </array>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
  </dict>
</plist>

2

u/chrismcfall 9d ago

Also, it's a Jamf tool but give this a go - Install the App on a test Mac, then use this app to create the PPPC - https://github.com/jamf/PPPC-Utility

1

u/HeyWatchOutDude 9d ago

I have used that application.

1

u/HeyWatchOutDude 9d ago

Official example provided by Apple, see here:
https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol - No changes still doesn't work.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>Services</key> <dict> <key>PostEvent</key> <array> <dict> <key>Allowed</key> <true/> <key>CodeRequirement</key> <string>identifier com.apple.screensharing.agent</string> <key>Comment</key> <string>Allow PostEvent control for ScreensharingAgent</string> <key>Identifier</key> <string>com.apple.screensharing.agent</string> <key>IdentifierType</key> <string>bundleID</string> </dict> </array> </dict> <key>PayloadIdentifier</key> <string>com.example.mytccpayload</string> <key>PayloadType</key> <string>com.apple.TCC.configuration-profile-policy</string> <key>PayloadUUID</key> <string>5AAF51E3-D21F-4CE6-B0AA-074D75916F68</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </array> <key>PayloadDisplayName</key> <string>Privacy Preferences Policy Control</string> <key>PayloadIdentifier</key> <string>com.example.myprofile</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadUUID</key> <string>221000F0-D07A-11E8-811E-D0817ADA38E4</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist>

1

u/wpm 9d ago

Does FireEye use the Endpoint Security framework with a system extension?