hoakley Macs, Technology, Updates

Troubleshooting your Mac’s security with Skint 1.02

Skint version 1.02 adds the following new features to this app that keeps a watchful eye on your Mac’s key security features:

  • a Help book
  • support for those running beta-releases of macOS
  • the ability to disable XPR log checks, so it can be run in a standard user account
  • a log time check to XPR log checks
  • support for auto-update.

This new version is available from here: skint102
from Downloads above, from its Product Page, and it supports auto-update for future versions.

Its ReadMe file and Help book explain each of the checks that it makes, and what you can do to address any problems it finds. The rest of this article steps through them, as a reference.

macOS

Skint checks that your Mac is running the current minor version and patch of the major version of macOS installed on it. If either is older than the current one, it will point that out to you, so you can update using Software Update. This version also tolerates running beta-releases of the next macOS updates: although it will note that a pre-release version is running, it won’t try to get you to change.

Note that Skint is as happy as you are if your Mac is still running Monterey or Ventura, but does expect you to keep up to date with their security updates.

SIP

System Integrity Protection (SIP) was introduced in 2015, long before the modern SSV, to provide additional protection for system and some other critical files, including many that aren’t part of the SSV. This feature also has some other functions such as hardening, used by notarised apps. Sometimes it’s necessary to disable it, and you may forget to enable it afterwards. It’s also a common requirement to be able to use Open Core Legacy Patcher (OCLP) on older Macs, in which case you’ll need to leave it turned off.

To enable SIP, start your Mac up in Recovery, enter Terminal there, and use the command
csrutil enable; reboot
When you press Return, your Mac will restart with SIP enabled. Apple silicon Macs will then normally need to be started again in Recovery, and Startup Security Utility used to return their Boot Security to full.

SSV

The Signed System Volume (SSV) was introduced in Big Sur, and has greatly improved security and reliability of macOS. In the great majority of Macs, Skint should be able to confirm that the SSV is enabled. It may be necessary on older models using OCLP to disable this, but Macs that run supported installations of macOS 11 or later should always have it enabled. In some cases, when there’s more than one bootable system available to a Mac, Skint may be unable to assess SSV status.

If the SSV isn’t enabled, you’ll need to change settings in Startup Security Utility (in Recovery), or install macOS again.

Gatekeeper/XProtect checks

When Gatekeeper and XProtect are enabled, security checks are made on all executable code and apps when they’re run, to ensure they don’t contain known malware. You shouldn’t need to disable that, but if you do and forget to turn it back on, enter the command
sudo spctl --global-enable
which requires you to authenticate using your admin password. Be careful with that command: the hyphens before global-enable aren’t long dashes, but two separate hyphens. That doesn’t need to be done in Recovery, and should have immediate effect.

XProtect

XProtect is a bundle containing security data used by macOS during Gatekeeper checks. Apple updates that data relatively frequently, and Skint checks that the version installed is the latest. If it isn’t, use SilentKnight to check for and install an update.

XProtect Remediator

XProtect Remediator (XPR) is separate, and every day or so runs scans to detect known malware on your Mac, and remediate any found. Skint runs two checks, the first to ensure this is up to date. If it reports that XPR is out of date, use SilentKnight to check for and install an update.

When XPR runs its scans, it doesn’t alert you if it detects or remediates any malware, but records that in the log. Skint will normally check your Mac’s log for the last 36 hours for results of those scans. If it reports any irregularities, use XProCheck to obtain full details so you can decide what to do.

Obtaining these log extracts requires that you run Skint from an admin account; if that’s not possible, there is an option to skip checking XPR’s scans, as explained later.

The most common reasons for not finding any XPR scan reports are that your Mac hasn’t been awake but inactive at the right time for the scans to run, or that its log records don’t go back far enough to find them. When this version of Skint can’t find any scan records in the last 36 hours, it now reports how long the log records are. If they’re less than 24 hours, then records may already have been removed from the log. You can then run XPR manually using XProCheck if you wish, or adjust the time that Skint checks your Mac.

XPR scans are normally run at about the same time each day, when your Mac is awake but is not being used. You can work out when they’re being run by checking more often with XProCheck; when you’ve found them, quit Skint and open it an hour or two after the time that the next scans are run. Then in its daily check, Skint should still be able to read the reports from the last XPR scans.

Skint updates

Each time Skint runs its checks, it also looks to see whether a new version of Skint is available. If it is, it will offer to download that version from this blog using your default browser. As this feature is new with version 1.02, it will work first when Skint 1.03 is released.

Hidden preferences

Skint’s preference file ~/Library/Preferences/co.eclecticlight.Skint contains three settings you can change using a Property List editor. Avoid trying to change these using a text editor, as they are managed by cfprefsd and those are likely to fail.

To disable XPR log checks, set the key dontXPR to <true/> To help you do this, a copy of the property list is supplied with the app.

To change the frequency at which Skint’s checks are run, set the key updateCheckInt to the number of seconds between checks. The default is 86400, which is 24 hours. Setting it to less than 1 will return it to the default.

To change the tolerance for when checks are run, set the key updateCheckTol to the number of seconds. The default is 300, which is 5 minutes. Setting it to less than 1 will return it to the default.

Please feel free to add your comments about this new version. If it’s now fairly complete in its features, I’ll move on to giving it a more convenient interface so you can check your Mac’s status at a glance.