Interpret test results

LockRattler runs a total of fourteen tests, each of which is reported in a separate section in its window. There is little point in running them more than once on any given day, as they are extremely unlikely to change in that period unless you change your security configuration or force your Mac to update. Results which have changed since you last ran or refreshed LockRattler are shown with red text.

When running El Capitan, the Gatekeeper Disk version is omitted, as that was not introduced until Sierra, and Log private data is omitted, as that only works for the unified log introduced in Sierra.

When running El Capitan, Sierra, or High Sierra, the TCC version is omitted, as this is only (very) important for Mojave and later.

To check SIP , it runs the shell command

csrutil status

This should always return a statement that SIP is enabled, as shown above. If SIP is disabled, you will need to enable it; details are provided in the Eclectic Light Company blog, or you can call Apple Support. In fact, if it is a new Mac, you should call Apple Support so that they know that Macs are shipping without SIP.

To check XProtect blacklist protection, it runs the shell command

spctl --status

This should always return that assessments are enabled. If they are not, contact Apple Support soonest.

To check whether FileVault (disk encryption) is turned on, it runs the shell command

fdesetup status

This is an option which you control in the Security & Privacy pane of System Preferences.

To check whether Software Update is set to Automatic, it runs the shell command

sudo softwareupdate --schedule

with root privileges, which is why you are prompted to enter your admin password.

This is an option which you control in the App Store pane of System Preferences, where the boxes labelled Install system data files and security updates and Automatically check for updates should be checked (enabled).

To check whether Log private data are being saved in your log, it runs the shell command

sudo log config —status

with root privileges, which is why you are prompted to enter your admin password.

This is an option which is controlled from the command line, and in some tools such as Cirrus.

To check whether the firmware password is enabled, it runs the shell command

sudo firmwarepasswd -check

with root privileges, which is why you are prompted to enter your admin password.

This is an option which is normally managed in the Firmware Password Utility in Recovery mode, but can also be managed in Terminal’s command line.

To check the Firmware , it runs two different shell commands

system_profiler SPHardwareDataType

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check

The first, which should work on all Macs, returns the same version number shown in System Information . The second, which is only available on Intel Macs running High Sierra and later which don’t have a T2 chip, uses the new system tool instead. The results are then displayed in the pair of boxes below the Firmware text, in that order. Firmware is only updated by Apple’s macOS installers and updaters, and isn’t available separately. If your Mac has a T2 chip, the upper box should show the new version, and the lower box should report the iBridge version as well.

The other six checks are of the current versions of the data files used by macOS security protection systems. Apple pushes out silent updates to these, but if you have recently applied a Combo update or your Mac has been away from an Internet connection for some time, your data files may not be up to date.

The files in question are:

for XProtect version, /System/Library/CoreServices/XProtect.bundle (in 10.15 /Library/Apple/System/Library/CoreServices/XProtect.bundle)

for Gatekeeper version, /private/var/db/gkopaque.bundle

for Gatekeeper disk version ( GKE in Catalina, /private/var/db/gke.bundle (Sierra and later)

for KEXT block version, /System/Library/Extensions/AppleKextExcludeList.kext (in 10.15 /Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext)

for MRT version, /System/Library/CoreServices/MRT.app (in 10.15 /Library/Apple/System/Library/CoreServices/MRT.app)

for TCC version, /System/Library/Sandbox/TCC_Compatibility.bundle (in 10.15 /Library/Apple/Library/Bundles/TCC_Compatibility.bundle).

The results given for tests are exactly those supplied by macOS, and are not interpreted or altered in any way.

➜ How to interpret information about updates

➜ Welcome

The Eclectic Light Company – https://eclecticlight.co