Ask Different (Apple)
Q&A for power users of Apple hardware and software
Latest Questions
1
votes
0
answers
44
views
Authorisation Denied Accessing macOS ~/Library/Mail/V10/MailData/Envelope Index
I'm trying to write an AI agent to chat with my mail. The first step is access to the mail items themselves. AppleScript was too slow, so I'm trying to use Python and Sqlite with the code below ``` import os import sqlite3 # Function to connect to the Mail app's SQLite database def connect_to_mail_d...
I'm trying to write an AI agent to chat with my mail. The first step is access to the mail items themselves.
AppleScript was too slow, so I'm trying to use Python and Sqlite with the code below
import os
import sqlite3
# Function to connect to the Mail app's SQLite database
def connect_to_mail_db():
mail_db_path = os.path.expanduser('~/Library/Mail/V10/MailData/Envelope Index')
conn = sqlite3.connect(mail_db_path)
return conn
# Function to fetch email details
def fetch_email_details(conn):
return
# Main script
if __name__ == "__main__":
# Connect to the Mail app's database
conn = connect_to_mail_db()
# Close the database connection
conn.close()
However this is giving an authorisation error.
~/PythonProjects/email_rag ❯ /Users//.pyenv/versions/3.13.1/envs/email_rag/bin/python /Users//PythonProjects/email_rag/export_email_via_sql.py email_rag 3.13.1 system
Traceback (most recent call last):
File "/Users//PythonProjects/email_rag/export_email_via_sql.py", line 14, in
conn = connect_to_mail_db()
File "/Users//PythonProjects/email_rag/export_email_via_sql.py", line 6, in connect_to_mail_db
conn = sqlite3.connect(mail_db_path)
sqlite3.DatabaseError: authorization denied
I can access the database in terminal with
$ sqlite3 Envelope\ Index
and I can access the database with **Native Sqlite Manager**
I suspected SIP, but the fact that **Native** can access the DB would suggest otherwise.
Anyone using code to access the Apple mail.app database?
Andy S
(11 rep)
Jan 21, 2025, 03:46 AM
0
votes
0
answers
49
views
Getting truncated content from Apple Notes SQLite DB
If you run this query on your Mac OS, it prints latest note from Notes app. The issue that there is more content, it gets truncated. I have numbers from 1 to 300, but only 1 to 82 are returned. What is the issue? How to print complete content? Thanks ``` % cd "$HOME/Library/Group Containers/group.co...
If you run this query on your Mac OS, it prints latest note from Notes app. The issue that there is more content, it gets truncated. I have numbers from 1 to 300, but only 1 to 82 are returned. What is the issue? How to print complete content?
Thanks
% cd "$HOME/Library/Group Containers/group.com.apple.notes" && \\
sqlite3 NoteStore.sqlite "SELECT * FROM ZICCLOUDSYNCINGOBJECT ORDER BY Z_PK DESC LIMIT 1"
4882|11|12|0|0|0|0|0|0|||4874|||||||||||||||||||||||||||||||||||||||0|0|0|0|0|||0||4|3|2593||||||||||||||||||||||||||||||||||||||||||758832855.156849|758832855.158181|758228055.158249|758228055.158249|758832855.158247||758834369.024801|-541228980||758835621.195935|||||2D21D111-B939-430E-95BC-55BA145654E6||||||||||||||||||||||||||||||||||1||notes-length-test|notes-length-test
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82||||||||||||||||||||
||||||||||||||||||||||||||
%

laimison
(131 rep)
Jan 17, 2025, 07:50 PM
• Last activity: Jan 17, 2025, 08:38 PM
1
votes
0
answers
101
views
Spotlights Store.db File
Long story short... We have a user whose Notes app bit the dust and they lost everything. Years of work and personal information. No backup either. When we do a search for the notes in Spotlight, however, we can see them. Clicking on each note in Spotlight does nothing. Poking around we noticed this...
Long story short... We have a user whose Notes app bit the dust and they lost everything. Years of work and personal information. No backup either. When we do a search for the notes in Spotlight, however, we can see them. Clicking on each note in Spotlight does nothing. Poking around we noticed this user’s store.db file has the related info in it, yet the file is gibberish. Is there a way to export this into something legible? We've read this may be something SQL or sqlite related. Hoping someone can help.
monaronyc
(31 rep)
Jun 28, 2024, 12:49 PM
• Last activity: Jun 28, 2024, 08:56 PM
5
votes
1
answers
6456
views
Error: unable to open database from Terminal
sqlite3 ~/Library/Mail/V6/MailData/Envelope\ Index vacuum; Error: unable to open database "/Users/Me/Library/Mail/V6/MailData/Envelope Index": unable to open database file This happened after upgrading to Mojave. How can I get access to the database file?
sqlite3 ~/Library/Mail/V6/MailData/Envelope\ Index vacuum;
Error: unable to open database "/Users/Me/Library/Mail/V6/MailData/Envelope Index":
unable to open database file
This happened after upgrading to Mojave. How can I get access to the database file?
C_McDavid_97
(319 rep)
Oct 15, 2018, 04:32 PM
• Last activity: Jun 18, 2024, 06:31 PM
2
votes
0
answers
105
views
iOS SQLite database name no longer 3d0d7e5fb2ce288813306e4d4636395e047a3d28?
Trying to extract the SQLite db from my iOS phone. Used IExplorer to download the directory `Media/Library/SMS` but could not find the expected file name `3d0d7e5fb2ce288813306e4d4636395e047a3d28`. Has it changed? [![enter image description here][1]][1] [1]: https://i.sstatic.net/LOHloWdr.png
Trying to extract the SQLite db from my iOS phone. Used IExplorer to download the directory
Media/Library/SMS
but could not find the expected file name 3d0d7e5fb2ce288813306e4d4636395e047a3d28
. Has it changed?

bezbiker
(21 rep)
Apr 22, 2024, 01:06 AM
• Last activity: Apr 22, 2024, 03:09 AM
18
votes
4
answers
46745
views
How (specificially) do I read a chat.db file?
Like everyone else who uses Apple's Messages app, I have a chat.db file. I'd like to read the file but nothing seems to yeild the expected results. Here is what I've tried so far: - The CLI approach of cd to ```~/Libray/Messages``` followed by ```open chat.db``` was amongst the best in that somethin...
Like everyone else who uses Apple's Messages app, I have a chat.db file. I'd like to read the file but nothing seems to yeild the expected results.
Here is what I've tried so far:
- The CLI approach of cd to
- Since I now had the db browser for SQLite open, I tried to open the file via that app's gui but because the folder is hidden one, it didn't show.
Has anyone had any success with this? I certainly can't be the first person to have tried and I've seen elsewhere the schema may also be an issue.
~/Libray/Messages
followed by chat.db
was amongst the best in that something was found and there was an attempt to open the file. Unfortunately, it didn't work as hoped.


hrokr
(293 rep)
Jun 1, 2021, 08:17 PM
• Last activity: Jan 18, 2024, 05:19 AM
3
votes
2
answers
2128
views
How can I compile sqlite3 from source on macOS?
I'm trying to build a copy of `sqlite3` from source on my M1 Mac Mini running macOS Monterey 12.4 (21F79). The reason I want to do this (instead of using a [precompiled build](https://www.sqlite.org/download.html) or installing via Homebrew or MacPorts) is that I need to enable the `SQLITE_ENABLE_UP...
I'm trying to build a copy of
sqlite3
from source on my M1 Mac Mini running macOS Monterey 12.4 (21F79). The reason I want to do this (instead of using a [precompiled build](https://www.sqlite.org/download.html) or installing via Homebrew or MacPorts) is that I need to enable the SQLITE_ENABLE_UPDATE_DELETE_LIMIT
flag (see [here](https://www.sqlite.org/compile.html#enable_update_delete_limit)) . It's my understanding that in order to enable that flag, one needs to compile from the [canonical source](https://www.sqlite.org/getthecode.html) , rather than the [amalgamation](https://www.sqlite.org/amalgamation.html) .
I have read the project's page entitled [*"How To Compile SQLite"*](https://www.sqlite.org/howtocompile.html) but I failed to wrap my head around the process. I vaguely understand that I will need some combination of gcc, Tcl, the Lemon parser, a bit of luck, and the right incantations to feed them all.
With regard to that flag, the page specifically states:
> _If this option is defined, then it must also be defined when using the Lemon parser generator tool to generate a parse.c file. Because of this, this option may only be used when the library is built from source, **not from the amalgamation** or from the collection of pre-packaged C files provided for non-Unix like platforms on the website._
I understand this may be an XY problem! Still, I would like to know how to do this—if only to satisfy my curiosity. Does anyone know the steps?
luckman212
(3945 rep)
May 18, 2022, 09:31 PM
• Last activity: Sep 29, 2023, 12:57 PM
6
votes
1
answers
1951
views
Changing Notification Center preferences programatically or from the command line
_(There's plenty of questions about toggling Do Not Disturb programmatically, this is different)_ Is there a plist file or sqlite DB that can be modified to change these settings programmatically? Specifically, "Show notifications on lock screen", "Show in Notification Center", etc. I would like to...
_(There's plenty of questions about toggling Do Not Disturb programmatically, this is different)_
Is there a plist file or sqlite DB that can be modified to change these settings programmatically? Specifically, "Show notifications on lock screen", "Show in Notification Center", etc.
I would like to change these in bulk, and sync those changes between my machines.
(I happen to be using the Venura Beta, but this question applies equally to Monteray).
I found

NCUtil
, but things have changed since it was written.
* It expects there to be a SQLite DB at $(getconf DARWIN_USER_DIR)com.apple.notificationcenter/db/db
,
* but it's now at `$(getconf
DARWIN_USER_DIR)com.apple.notificationcenter/db/db`, which has a different
schema (e.g. there's no more app_info
table with a flags
column)
Alexander
(8387 rep)
Sep 13, 2022, 06:09 PM
• Last activity: Sep 14, 2023, 02:37 AM
1
votes
0
answers
158
views
(MACOS/SQLITE3/KEXT) Want to revoke my MacOS trust on installer (prompt again to allow permission adding kernel component) & dealing read-only error
What do you do when this happens (when trying to delete the entry in database)? “Error: stepping, attempt to write a readonly database (8)” My try (based on @lx07 2020 post: https://apple.stackexchange.com/questions/382216/revoke-permission-to-run-third-party-kernel-extension). (My try (is about an...
What do you do when this happens (when trying to delete the entry in database)?
“Error: stepping, attempt to write a readonly database (8)”
My try (based on @lx07 2020 post: https://apple.stackexchange.com/questions/382216/revoke-permission-to-run-third-party-kernel-extension) .
(My try (is about an external SSD drive [i know how to unload/remove the kext driver, that was easy, but not to make my MacOS feel again all the reinstallation as an strange: if i reinstall the app [is a pkg], after the very first allowance, now goes all the way down without demanding the original System Preferences > Allow external developer… classic step, that i guess we all experienced many times])):
% sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy
Password:
SQLite version 3.37.0 2021-12-09 01:34:53
Enter ".help" for usage hints.
sqlite> SELECT * FROM kext_policy;
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
…
(NOT SHOWED ENTRY, FOR PRIVACY AND CLARITY)
8S33FS7Q5Q|com.samsung.portablessd.driver|1|Samsung Electronics|1
sqlite> DELETE FROM kext_policy_mdm WHERE team_id = '8S33FS7Q5Q';
Error: stepping, attempt to write a readonly database (8)
sqlite> DELETE FROM kext_policy WHERE bundle_id = "com.samsung.portablessd.driver";
Error: stepping, attempt to write a readonly database (8)
sqlite> SELECT * FROM kext_load_history_v3;
/Library/Extensions/….
(NOT SHOWED MAY ENTRIES, FOR PRIVACY AND CLARITY)
(NOT SHOWED MAY ENTRIES, FOR PRIVACY AND CLARITY)
…
(NOT SHOWED MANY ENTRIES, FOR PRIVACY AND CLARITY)
/Library/Extensions/SamsungPortableSSDDriver.kext|8S33FS7Q5Q|com.samsung.portablessd.driver|9DE8C72F-E1AF-4F8B-B30F-B48A1C80689B|2023-02-14 19:26:33|2023-02-14 20:46:36|53|ec8fafd76e3a5741b388e75ead49c896dfe96186
sqlite>
I read in some places on the web about changing permissions in database/s using chmod, but i wasn't feeling trusting those sources.
Author of this post @lx07, looked deep competent and i would prefer his opinion.
Also the “parallel” thing:
“If you wanted to delete all of them you could use delete from kext_policy; then to be tidy delete from kext_load_history_v3; Alternatively you can delete a specific one by comparing one of the fields shown by the .schema command. For example to delete LittleSnitch based on the second field bundle_id;”.
And what about the “PRAM” component of this thing? I didn't understood well what was the point of the PRAM part. Can be avoided? Cannot?
There is always the fear of touching what should not be touched (like naively using, who knows? A chmod transforming a read-only thing [the database, for example] that should be protected read-only thinking that would be a very harmless action, but perhaps was the opposite), by just pretending revoking a very simple thing.
Thank you.
nostromo
(333 rep)
Feb 15, 2023, 09:47 AM
0
votes
0
answers
351
views
How to export links (url's) or other data from specific iPhone chat?
I recently learned how to use sqlite3 in the command line to export a .csv of url's from my icloud_tabs.db I would like to do something similar with a specific iPhone chat. I use Messages as storage for links, quotes, documents, and other data while I work. So I have a chat with myself where I send...
I recently learned how to use sqlite3 in the command line to export a .csv of url's from my icloud_tabs.db
I would like to do something similar with a specific iPhone chat. I use Messages as storage for links, quotes, documents, and other data while I work. So I have a chat with myself where I send myself these notes.
I would like to use the terminal to export all of this data from this one specific Messages chat (as far back as possible). Even better if I can get more granular and export just url's, or just images of a certain file type, or just PDFs (etc.)
Any insight is much appreciated, ty!
yeet_thiswheat
(1 rep)
Jul 17, 2021, 04:00 PM
• Last activity: Jul 18, 2021, 11:04 AM
0
votes
0
answers
217
views
Where to find the unread message count in chat.db for messages.app
I'm trying to find the number of unread messages in `messages.app`. The number should match the number on the badge of the app. I've approached this by accessing chat.db, a sqlite db which lists all data presented and used in the app. Upon executing `select count(*) from message where is_read = 0;`,...
I'm trying to find the number of unread messages in
messages.app
. The number should match the number on the badge of the app.
I've approached this by accessing chat.db, a sqlite db which lists all data presented and used in the app.
Upon executing select count(*) from message where is_read = 0;
, it returns 3694. Checking for 1
returns 3835. The number of unread messages in the app at the time of execution was 0.
Evidentially, I've approached this incorrectly. I would appreciate any leads on determining the number of unread messages from the cli, accessing chat.db or not.
I'm operating on 11.1 big sur.
text
(1 rep)
Jul 14, 2021, 09:44 AM
• Last activity: Jul 15, 2021, 03:24 AM
1
votes
1
answers
261
views
Help in understanding a command line search of all sqlite files on os x device
I was listening to a [Talk Python To Me](https://talkpython.fm/episodes/show/299/personal-search-engine-with-datasette-and-dogsheep) podcast that had Simon Willison as the guest. Willison discussed two projects he is developing, Datasette and DogSheep Beta, both of which allow you pull in data as an...
I was listening to a [Talk Python To Me](https://talkpython.fm/episodes/show/299/personal-search-engine-with-datasette-and-dogsheep) podcast that had Simon Willison as the guest. Willison discussed two projects he is developing, Datasette and DogSheep Beta, both of which allow you pull in data as an SQLite database (Datasette) and then index and query it (DogSheep Beta). All your data include Apple Watch data, texts, photo data including lat/long and even the scoring Apple uses to rank your photos.
The two links here are really interesting and I recommend them.
The problem I'm having finding .sqlite files. The directions and the YouTube say to install Datasette and point it against a database on your laptop. I know I can use the Finder for files but I'd like to follow along with youtube.
At around 5:31 in his [PyCon AU talk](https://www.youtube.com/watch?v=CPQCD3Qxxik) , he types out:
"kMDItemDisplayName ==*.sqlite" -0 | xargs -0 stat "-f%z %N" | sort -nr | head -n 20
I managed to read the incantation but while I get the gist, there are a number of details that Apple's CLI help pages don't cover.
So, here are my questions:
* What is the -0
flag, specifically? (as opposed to the overly brief example Apple gives)
* What does xargs -0 stat "-f%z %N"
mean?
* -nr
what are the n and r flags for sort?
* finally (and you probably guessed it with order) what is -n
flag for head?
hrokr
(293 rep)
Jan 29, 2021, 04:15 AM
• Last activity: Jan 29, 2021, 02:32 PM
0
votes
0
answers
134
views
Finding encryption key for Apple Messages chat
I'm trying to back up some message transcripts, including photos. I found I the chat transcripts from `~/Library/Messages/` can be opened on another Mac, but the images don't load. I searched my local drive for the image names, and found them in various places in `~/Library/Messages/Attachments`. On...
I'm trying to back up some message transcripts, including photos. I found I the chat transcripts from
~/Library/Messages/
can be opened on another Mac, but the images don't load. I searched my local drive for the image names, and found them in various places in ~/Library/Messages/Attachments
. On a guess, I tried opening the transcript in MesaSQLite, and I was asked for the encryption key.
Is it possible to find that encryption key, and if so, where is it? That's the main question.
I'd also need to find the paths for those attachments. Hopefully they're in the transcript database file. If anyone answering that main question happens to know or have some insight into the attachment paths, that'd be great.
I'm running macOS 10.13.6.
Becca
(259 rep)
Nov 3, 2020, 09:42 PM
• Last activity: Nov 4, 2020, 01:54 AM
1
votes
0
answers
549
views
Is there any way to recover overwritten notes on mac?
I pasted something on top of a note on my Mac that had some moderately important stuff, switched notes (which means no `ctrl-z`), and I'm trying to recover it. My first mistake is that I unfortunately don't have a backup that includes it (iCloud or Time Machine.) So far I've: - tracked down the Note...
I pasted something on top of a note on my Mac that had some moderately important stuff, switched notes (which means no
ctrl-z
), and I'm trying to recover it. My first mistake is that I unfortunately don't have a backup that includes it (iCloud or Time Machine.)
So far I've:
- tracked down the NoteStore.sqlite (-wal, -shm) which, as far as I can tell from googling, acts as a change log for all your notes along with the -wal which stores overflow
- managed to extract the data stored in blobs from ZICNOTEDATA (hex(zdata) from ZICNOTEDATA
)
- realized each row is the raw version of a .gz (starts with 1F8B0800000...
)
And this is where I'm stuck now, probably because I don't have the right vocabulary to google it. Ideally, I want to put each row of this sqlite column into a "real" gzip in a folder somewhere, unzip them all into .txt files, and view as the original note. If not, I can go one-by-one and unzip them until I find the one I need. Also, I'd like to avoid any external software.
Any ideas or easier ways to do this? Thanks!
SMc
(11 rep)
Aug 3, 2020, 12:02 AM
27
votes
10
answers
30276
views
SQLite frontend for OS X?
I am looking for a preferably free SQLite frontend to use under OS X. Something similar to MySQL Workbench will do. Put separate suggestions in separate answers.
I am looking for a preferably free SQLite frontend to use under OS X.
Something similar to MySQL Workbench will do. Put separate suggestions in separate answers.
sorin
(31160 rep)
Jun 5, 2011, 01:25 PM
• Last activity: May 27, 2020, 10:32 PM
0
votes
0
answers
262
views
In the iPhone's messages list, where does the date come from?
This is maybe a weird question. In the iPhone's "Messages" app, the first view is a list of all the chats, sorted by the most recent messages in each chat. To the right of each chat entry is a date (circled in my screenshot) which is the essence of my question. This date seems to be the date of the...
This is maybe a weird question. In the iPhone's "Messages" app, the first view is a list of all the chats, sorted by the most recent messages in each chat. To the right of each chat entry is a date (circled in my screenshot) which is the essence of my question. This date seems to be the date of the *last* message received in the chat, even when that message has been subsequently deleted from the chat.
Ultimately I was playing around in the sqlite database to see how the messages were represented in there and I can't figure this out. The chat list seems to be sorted by the most recent *current* messages in each chat, but that timestamp shown can be the timestamp of a deleted message, which seems weird.
So, why does the messages app show a timestamp for a message that doesn't exist anymore, and where in the sqlite message database does that timestamp live?

George
(1 rep)
May 13, 2020, 06:05 PM
2
votes
2
answers
4509
views
Is there a way to view/edit Outlook for Mac's SQLite database to edit the signature file?
I am looking to edit the file or reference that is used in the SQLite database that Outlook uses on the Mac. Instead of having to copy and paste an HTML signature in the Outlook program, I would like to paste the HTML code into the database. What programs and or resources would I need to view and ed...
I am looking to edit the file or reference that is used in the SQLite database that Outlook uses on the Mac. Instead of having to copy and paste an HTML signature in the Outlook program, I would like to paste the HTML code into the database.
What programs and or resources would I need to view and edit this portion of the database that Outlook uses?
Database File
Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile/Data/Outlook.sqlite
buzlink
(31 rep)
Nov 21, 2018, 11:04 PM
• Last activity: Mar 10, 2020, 08:56 PM
0
votes
1
answers
1773
views
Pictures are stored but not displayed in Camera Roll
Well, I've been running low space for a long time and this led to a sudden disappearing of old photos (actually 5000 of them - the oldest ones) in camera roll. I don't know how how that worked - maybe iOS tried to free up some space by removing the thumbnails (without asking me???). The main advice...
Well, I've been running low space for a long time and this led to a sudden disappearing of old photos (actually 5000 of them - the oldest ones) in camera roll. I don't know how how that worked - maybe iOS tried to free up some space by removing the thumbnails (without asking me???).
The main advice is to remove the **photos.sqlite** and other similar files from **PhotoData** directory. That did nothing - the restored base is lacking my OLD ones. Still you can find them all in DCIM folder.
How can I add them back to sqlite??? Thanks a lot!!
upd. ios 9.1
jaleya.quinne
(19 rep)
Jul 13, 2019, 10:45 AM
• Last activity: Jul 13, 2019, 01:23 PM
4
votes
0
answers
1183
views
Does Safari browser history DB contain transition type?
The browser history of **Safari** is stored in `~/Library/Safari/History.db` which is a regular **SQLite** database. For example, it can be viewed using [SQLite Browser][1] or queried using [Python][2]. The database contains a table named `history_items`. This lists all *URL*'s, with their *title*,...
The browser history of **Safari** is stored in
~/Library/Safari/History.db
which is a regular **SQLite** database. For example, it can be viewed using SQLite Browser or queried using Python .
The database contains a table named history_items
. This lists all *URL*'s, with their *title*, and *id* and the total number of time the website was *visited*. Another table is named history_visits
. This lists all individual *visits*, with a *timestamp*, *id* and, possibly, information about the source which *redirected* the user to this website.
In the **Chrome** browser history, the *transition type* is also stored . This notes whether the user arrived at the website via a *link*, a *reload* or whether he *typed* in the address directly. Is such transition information also available in the Safari History.db
?
The table history_visits
also contains integer columns named *origin*, *generation* and *attributes*. However, it is unclear to me what these mean. Is there a documentation available for the Safari browser history database?
LBogaardt
(101 rep)
Apr 25, 2019, 08:58 AM
• Last activity: Apr 27, 2019, 04:53 PM
2
votes
1
answers
1107
views
Macos Kernel Extension whitelisting issues
Trying to whitelist a kernel extension for an agent I'm trying to install. I'm using Mojave as the client machine and Profile Manger on a Mac server I've set up. I can enroll the client machine fine in Profile Manager, and it can receive canned settings like external device restrictions etc, but I c...
Trying to whitelist a kernel extension for an agent I'm trying to install. I'm using Mojave as the client machine and Profile Manger on a Mac server I've set up. I can enroll the client machine fine in Profile Manager, and it can receive canned settings like external device restrictions etc, but I can't seem to get custom settings to work correctly.
The process to get this to work is I've been uploading the following:
PayloadContent
AllowedKernelExtensions
HLGBMCXUS7
com.verdasys.dgagent
AllowedTeamIdentifiers
HLGBMCXUS7
PayloadDescription
Configures Kernel Extension Policy settings
PayloadDisplayName
Kernel Extension Policy
PayloadIdentifier
com.github.erikberglund.ProfileCreator.F508AD6F-E398-402B-9928-1A2300C1E229.com.apple.syspolicy.kernel-extension-policy.69B09342-9C35-4FB8-9C18-6DF2A53E7C0C
PayloadOrganization
PayloadType
com.apple.syspolicy.kernel-extension-policy
PayloadUUID
69B09342-9C35-4FB8-9C18-6DF2A53E7C0C
PayloadVersion
1
PayloadDescription
allows extensions from specific extension Team Identifiers
PayloadDisplayName
DigitalGuardian
PayloadIdentifier
com.github.erikberglund.ProfileCreator.F508AD6F-E398-402B-9928-1A2300C1E229
PayloadOrganization
ProfileCreator
PayloadRemovalDisallowed
PayloadScope
System
PayloadType
Configuration
PayloadUUID
F508AD6F-E398-402B-9928-1A2300C1E229
PayloadVersion
1
as a .plist file using "com.apple.syspolicy.kernel-extension-policy" as a policy domain into Profile Manager, saving the config on profile manager, then downloading a .mobileconfig file.
I move that .mobileconfig file to the already enrolled client, and run the file and except the prompts to install the profile into profile->system prefs. This goes successfully and I see green "verified" at the top
BUT
it doesn't result in adding the team ID into the DB (at least not so far).
I'm using the following code to try to read the sqlite DB to verify:
#!/bin/sh
# Gather list of User Approved Kernel Extensions. 20180313 DM
folder=.
file=checkKEXTs.csv
# Create folder
/bin/mkdir -p ${folder}
/usr/sbin/chown root:admin ${folder}
/bin/chmod 755 ${folder}
/usr/bin/sqlite3 -csv /var/db/SystemPolicyConfiguration/KextPolicy "select team_id,bundle_id from kext_policy" > ${folder}/${file}
exit 0
I do see entries, but they're for VMware. Never for the above products.
Searching Console, I see the following:
rejecting write of key _DKThrottledActivityLast_DKKnowledgeStorageLogging_DKKnowledgeStorageDidInsertEventsNotification:/app/usageActivityDate in { com.apple.contextstored, root, kCFPreferencesAnyHost, no container, managed: 0 } from process 151 because setting preferences outside an application's container requires user-preference-write or file-write-data sandbox access
and
Sandbox: contextstored(151) deny(1) file-write-data /private/var/root/Library/Preferences/com.apple.contextstored.plist
Violation: deny(1) file-write-data /private/var/root/Library/Preferences/com.apple.contextstored.plist
Process: contextstored
Path: /System/Library/PrivateFrameworks/CoreDuetContext.framework/Versions/A/Resources/contextstored
Load Address: 0x1077f3000
Identifier: contextstored
Version: ??? (???)
Code Type: x86_64 (Native)
Parent Process: launchd
Responsible: /System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/contextstored
User ID: 0
Date/Time: 2019-02-23 17:09:04.228 PST
OS Version: Mac OS X 10.14.3 (18D109)
Report Version: 8
MetaData: {"checker":"cfprefsd","target":"\/private\/var\/root\/Library\/Preferences\/com.apple.contextstored.plist","profile-in-collection":false,"signing-id":"com.apple.contextstored","profile-flags":0,"build":"Mac OS X 10.14.3 (18D109)","errno":1,"primary-filter":"path","responsible-process-path":"\/System\/Library\/PrivateFrameworks\/CoreDuetContext.framework\/Resources\/contextstored","platform-policy":false,"action":"deny","process":"contextstored","sandbox_checker":"cfprefsd","flags":5,"responsible-process-pid":151,"normalized_target":["private","var","root","Library","Preferences","com.apple.contextstored.plist"],"checker-pid":116,"hardware":"Mac","file-flags":0,"process-path":"\/System\/Library\/PrivateFrameworks\/CoreDuetContext.framework\/Versions\/A\/Resources\/contextstored","summary":"deny(1) file-write-data \/private\/var\/root\/Library\/Preferences\/com.apple.contextstored.plist","platform-binary":true,"platform_binary":"yes","vnode-type":"REGULAR-FILE","uid":0,"primary-filter-value":"\/private\/var\/root\/Library\/Preferences\/com.apple.contextstored.plist","operation":"file-write-data","pid":151,"rdev":0,"path":"\/private\/var\/root\/Library\/Preferences\/com.apple.contextstored.plist"}
Thread 0 (id: 809):
0 libsystem_kernel.dylib 0x00007fff6c47117a mach_msg_trap + 10
1 CoreFoundation 0x00007fff3f052158 __CFRunLoopServiceMachPort + 336
2 CoreFoundation 0x00007fff3f0516a6 __CFRunLoopRun + 1661
3 CoreFoundation 0x00007fff3f050dd6 CFRunLoopRunSpecific + 467
4 CoreFoundation 0x00007fff3f050bde CFRunLoopRun + 40
5 contextstored 0x00000001077f6525
6 libdyld.dylib 0x00007fff6c337ed9 start + 1
7 contextstored 0x0000000000000001
Thread 1 (id: 5898):
0 libsystem_kernel.dylib 0x00007fff6c472b6a __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6c52a405 start_wqthread + 13
Thread 2 (id: 5904):
0 libsystem_kernel.dylib 0x00007fff6c472b6a __workq_kernreturn + 10
1 libsystem_pthread.dylib 0x00007fff6c52a405 start_wqthread + 13
2 contextstored 0x0000000054485244
Thread 3 (id: 5923):
0 libsystem_kernel.dylib 0x00007fff6c47117a mach_msg_trap + 10
1 libdispatch.dylib 0x00007fff6c3016ff _dispatch_mach_msg_send + 1087
2 libdispatch.dylib 0x00007fff6c300eeb _dispatch_mach_send_drain + 440
3 libdispatch.dylib 0x00007fff6c2fda5a _dispatch_mach_send_msg + 307
4 libdispatch.dylib 0x00007fff6c2fdd15 _dispatch_mach_send_and_wait_for_reply + 382
5 libdispatch.dylib 0x00007fff6c2fe2ad dispatch_mach_send_with_result_and_wait_for_reply + 53
6 libxpc.dylib 0x00007fff6c569161 xpc_connection_send_message_with_reply_sync + 178
7 CoreFoundation 0x00007fff3f0c03ea __91-[CFPrefsPlistSource sendFullyPreparedMessage:toConnection:settingValue:forKey:retryCount:]_block_invoke + 29
8 CoreFoundation 0x00007fff3f047b4d -[_CFXPreferences withConnectionForRole:performBlock:] + 36
9 CoreFoundation 0x00007fff3f0c03be -[CFPrefsPlistSource sendFullyPreparedMessage:toConnection:settingValue:forKey:retryCount:] + 202
10 CoreFoundation 0x00007fff3f0c0025 -[CFPrefsPlistSource sendMessageSettingValue:forKey:] + 605
11 CoreFoundation 0x00007fff3f0bf60a -[CFPrefsPlistSource alreadylocked_setPrecopiedValues:forKeys:count:from:] + 579
12 CoreFoundation 0x00007fff3f08357b -[CFPrefsSource setValues:forKeys:count:copyValues:removeValuesForKeys:count:from:] + 394
13 CoreFoundation 0x00007fff3f0833eb -[CFPrefsSource setValues:forKeys:count:copyValues:from:] + 28
14 CoreFoundation 0x00007fff3f0c204a -[CFPrefsSearchListSource alreadylocked_setPrecopiedValues:forKeys:count:from:] + 1000
15 CoreFoundation 0x00007fff3f08357b -[CFPrefsSource setValues:forKeys:count:copyValues:removeValuesForKeys:count:from:] + 394
16 CoreFoundation 0x00007fff3f0833eb -[CFPrefsSource setValues:forKeys:count:copyValues:from:] + 28
17 CoreFoundation 0x00007fff3f0bf3ac -[CFPrefsSource setValue:forKey:from:] + 71
18 CoreFoundation 0x00007fff3f02fdb0 __108-[_CFXPreferences(SearchListAdditions) withSearchListForIdentifier:container:cloudConfigurationURL:perform:]_block_invoke + 268
19 CoreFoundation 0x00007fff3f02fa72 -[_CFXPreferences(SearchListAdditions) withSearchListForIdentifier:container:cloudConfigurationURL:perform:] + 337
20 CoreFoundation 0x00007fff3f0c1c39 -[_CFXPreferences setValue:forKey:appIdentifier:container:configurationURL:] + 90
21 CoreFoundation 0x00007fff3f0c1bad _CFPreferencesSetAppValueWithContainerAndConfiguration + 116
22 Foundation 0x00007fff41437ec3 -[NSUserDefaults(NSUserDefaults) setObject:forKey:] + 55
23 CoreDuet 0x00007fff52f61de4 -[_DKActivityThrottler setDate:forKey:] + 116
24 CoreDuet 0x00007fff52f60e74 -[_DKActivityThrottler _performNoMoreOftenInSecondsThan:name:activityBlock:throttleBlock:] + 340
25 CoreDuet 0x00007fff52f616e6 __94-[_DKActivityThrottler _performOrScheduleWithTimeInterval:name:queue:activityBlock:callDepth:]_block_invoke.123 + 48
26 libdispatch.dylib 0x00007fff6c2e8d53 _dispatch_call_block_and_release + 12
27 libdispatch.dylib 0x00007fff6c2e9dcf _dispatch_client_callout + 8
28 libdispatch.dylib 0x00007fff6c2f0124 _dispatch_lane_serial_drain + 618
29 libdispatch.dylib 0x00007fff6c2f0bdc _dispatch_lane_invoke + 388
30 libdispatch.dylib 0x00007fff6c2f9090 _dispatch_workloop_worker_thread + 603
31 libsystem_pthread.dylib 0x00007fff6c52a60b _pthread_wqthread + 409
32 libsystem_pthread.dylib 0x00007fff6c52a405 start_wqthread + 13
Binary Images:
0x1077f3000 - 0x1077f7ff3 contextstored (915.240.4) /System/Library/PrivateFrameworks/CoreDuetContext.framework/Versions/A/Resources/contextstored
0x7fff3f016000 - 0x7fff3f464ff7 com.apple.CoreFoundation (6.9 - 1562) /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x7fff413b9000 - 0x7fff41787fff com.apple.Foundation (6.9 - 1562) /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
0x7fff52e77000 - 0x7fff5304dff3 com.apple.CoreDuet (1.0 - 1) /System/Library/PrivateFrameworks/CoreDuet.framework/Versions/A/CoreDuet
0x7fff6c2e6000 - 0x7fff6c320ff7 libdispatch.dylib (1008.220.2) /usr/lib/system/libdispatch.dylib
0x7fff6c321000 - 0x7fff6c350ff3 libdyld.dylib (655.1) /usr/lib/system/libdyld.dylib
0x7fff6c470000 - 0x7fff6c498ff7 libsystem_kernel.dylib (4903.241.1) /usr/lib/system/libsystem_kernel.dylib
0x7fff6c528000 - 0x7fff6c532fff libsystem_pthread.dylib (330.230.1) /usr/lib/system/libsystem_pthread.dylib
0x7fff6c55f000 - 0x7fff6c58ffff libxpc.dylib (1336.240.2) /usr/lib/system/libxpc.dylib
These log messages appear right at the time of that I install the .mobileconfig file each time, so I suspect there's a correlation. I've tried repairing permissions without success. About the only thing I didn't do is try this on another Mac which I may try as well. I've also tried using a .plist file that only includes configurations for bundle ID's or Team ID's respectively (not combined as in above) without success.
The worst part is that I'm having difficulties troubleshooting the issue. I just don't understand the underlying mechanisms very well so I'm open to troubleshooting tips. It may also be that there's something wrong with my .plist code but I'm just not seeing it. Very open to suggestions there as well. It seems like my test machine is trying to commit the settings, but it's just not working.
Another thing: I noticed errors related to the file "DetachedSignatures" in the logs as well and copied a file from another machine onto the test one in the /var/db (I think) folder and the errors went away. No idea if they're related.
As you can tell, I'm sorta grasping at straws here. Hoping and praying the moderator Gods are kind to me and allow me to keep this post active so I can get help. Thank you so much in advance for reading this and hopefully with your help, I can get beyond this. It's probably something silly I'm missing.
user1197457
(31 rep)
Feb 24, 2019, 03:44 PM
• Last activity: Feb 28, 2019, 05:17 AM
Showing page 1 of 20 total questions