Interpret test results

LockRattler runs a total of fourteen tests, each of which is reported in a separate section in its window. There is little point in running them more than once on any given day, as they are extremely unlikely to change in that period unless you change your security configuration or force your Mac to update. Results which have changed since you last ran or refreshed LockRattler are shown with red text.

When running El Capitan, the Gatekeeper Disk version is omitted, as that was not introduced until Sierra.

When running El Capitan, Sierra, or High Sierra, the TCC version is omitted, as this is only (very) important for Mojave and later.

To check SIP , it runs the shell command

csrutil status

This should always return a statement that SIP is enabled, as shown above. If SIP is disabled, you will need to enable it; details are provided in the Eclectic Light Company blog, or you can call Apple Support. In fact, if it is a new Mac, you should call Apple Support so that they know that Macs are shipping without SIP.

On Macs which are running Big Sur and later, this also reports whether the current System volume is sealed. If it isn’t, and you haven’t deliberately unsealed it, you should reinstall Big Sur to enable it again. SSV is checked using the shell command

csrutil authenticated-root status

To check XProtect blacklist protection, it runs the shell command

spctl --status

This should always return that assessments are enabled. If they are not, contact Apple Support soonest.

To check whether FileVault (disk encryption) is turned on, it runs the shell command

fdesetup status

This is an option which you control in the Security & Privacy pane of System Preferences.

To check whether Software Update is set to Automatic, it runs the shell command

sudo softwareupdate --schedule

with root privileges, which is why you are prompted to enter your admin password.

This is an option which you control in the App Store pane of System Preferences, where the boxes labelled Install system data files and security updates and Automatically check for updates should be checked (enabled).

To check whether the firmware password is enabled, it runs the shell command

sudo firmwarepasswd -check

with root privileges, which is why you are prompted to enter your admin password. Firmware passwords are not available in Apple Silicon Macs, where this box is used to report Platform Security instead. A summary is shown here, with itemised settings in the lower scrolling text view. These are obtained using the shell command

system_profiler SPiBridgeDataType

The firmware password is an option on Intel Macs which is normally managed in the Firmware Password Utility in Recovery mode, but can also be managed in Terminal’s command line.

To check the Firmware , it runs two different shell commands

system_profiler SPHardwareDataType

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check

The first, which should work on all Macs, returns the same version number shown in System Information . The second, which is only available on Intel Macs running High Sierra and later which don’t have a T2 chip, uses the new system tool instead. The results are then displayed in the pair of boxes below the Firmware text, in that order. Firmware is only updated by Apple’s macOS installers and updaters, and isn’t available separately. If your Mac has a T2 chip, the upper box should show the new version, and the lower box should report the iBridge version as well. If yours is an Apple Silicon Mac, the firmware version is that for iBoot.

To check any connected Studio Display , it obtains the data from system_profiler SPDisplaysDataType . The OS (firmware) version and build number of the first Studio Display detected is then shown in the adjacent box.

The other six checks are of the current versions of the data files used by macOS security protection systems. Apple pushes out silent updates to these, but if you have recently applied a Combo update or your Mac has been away from an Internet connection for some time, your data files may not be up to date.

Note that Gatekeeper data use was discontinued in 2019. Macs which weren’t up to date with those updates normally show a much earlier version such as 94, which is now perfectly normal for all newer Macs including M1 models.

The files in question are:

for XProtect version, /System/Library/CoreServices/XProtect.bundle (in 10.15 /Library/Apple/System/Library/CoreServices/XProtect.bundle)

for Gatekeeper version, /private/var/db/gkopaque.bundle

for Gatekeeper disk version ( GKE in Catalina), /private/var/db/gke.bundle (Sierra and later)

for KEXT block version, /System/Library/Extensions/AppleKextExcludeList.kext (in 10.15 /Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext)

for MRT version, /System/Library/CoreServices/MRT.app (in 10.15 /Library/Apple/System/Library/CoreServices/MRT.app)

for TCC version, /System/Library/Sandbox/TCC_Compatibility.bundle (in 10.15 /Library/Apple/Library/Bundles/TCC_Compatibility.bundle).

The results given for tests are exactly those supplied by macOS, and are not interpreted or altered in any way.

➜ How to interpret information about updates

➜ Welcome

The Eclectic Light Company – https://eclecticlight.co