Some system processes bypass the F-Secure application layer firewall on macOS 11 "Big Sur" - WithSecure Community
<main>
<article class="userContent">
<p> </p>Some system processes bypass the F-Secure application layer firewall on macOS 11 "Big Sur" <p><strong>Note:</strong> Apple has fixed this issue from macOS 11.2 onwards. This is still a relevant issue in macOS 11.0, however, as described in this article. </p> <p>With the macOS 11.0 "Big Sur" release, F-Secure changed to using a new type of Apple network extension API for its firewall implementation. This change has been a mandatory requirement from Apple, which moved away from using a kernel based approach on macOS Catalina 10.15.5. </p> <p>We have since found out that certain system processes bypass the F-Secure application layer firewall as a direct result of using this new network extension API. This issue is an Apple issue and not only affects F-Secure products, but also other firewall products, as well as VPNs. </p> <p>This issue affects the following F-Secure corporate products: </p> <div> <ul><li>Computer Protection and RDR for Mac starting with build 35217 running on macOS 11 Big Sur, and macOS Catalina 10.15.5 or later </li> <li>Client Security 15.00 for Mac running macOS 11.0 Big Sur, and macOS Catalina 10.15.5 or later </li> </ul></div> <p>We have addressed our concerns about this issue with Apple, as have other vendors, and will continue to do so. What we do next and how we tackle this issue in F-Secure products depends on how Apple intends to respond to the issue in future macOS releases. </p> <p>As far as we are aware, the following system processes on macOS are being bypassed: </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Applications/App Store.app/Contents/MacOS/App Store</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/CoreServices/cloudpaird</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/CoreServices/mapspushd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/Frameworks/CoreTelephony.framework/Support/CommCenter</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/ApplePushService.framework/apsd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstoreagent</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstored</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/AssetCacheServices.framework/Versions/A/XPCServices/AssetCacheLocatorService.xpc/Contents/MacOS/AssetCacheLocatorService</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CommerceKit.framework/Resources/commerced</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/commerce</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CoreLSKD.framework/Versions/A/lskdd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CoreParsec.framework/parsecd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/DistributedEvaluation.framework/Versions/A/XPCServices/com.apple.siri-distributed-evaluation.xpc/Contents/MacOS/com.apple.siri-distributed-evaluation</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/FamilyCircle.framework/Versions/A/Resources/familycircled</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/FamilyNotification.framework/FamilyNotification</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/Contents/MacOS/identityservicesd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/IDSFoundation.framework/IDSRemoteURLConnectionAgent.app/Contents/MacOS/IDSRemoteURLConnectionAgent</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/IMCore.framework/imagent.app/Contents/MacOS/imagent</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/IMTransferServices.framework/IMTransferAgent.app/Contents/MacOS/IMTransferAgent</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/MapsSuggestions.framework/MapsSuggestions</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/MapsSupport.framework/MapsSupport</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/MediaStream.framework/MediaStream</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/MusicLibrary.framework/MusicLibrary</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/PassKitCore.framework/passd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/ProtectedCloudStorage.framework/Helpers/ProtectedCloudKeySyncing</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/System/Library/TextInput/kbd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/coreduetd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/diagnosticd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/findmydeviced</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/fmfd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/locationd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/mdmclient</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/mobileactivationd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/mobileassetd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/networkserviceproxy</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/rtcreportingd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/secd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/siriknowledged</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/swcd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/tailspind</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/teslad</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/timed</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/libexec/trustd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">/usr/sbin/securityd</code> </p> <p><code class="code codeInline" spellcheck="false" tabindex="0">com.apple.facetime</code> </p>
</article>
</main>