3

I'm trying to set up a new backup utility on my system, and am getting an error that it cannot get the files in folder /private/var/db/ConfigurationProfiles under macOS 10.13.3.

I don't get the issue under a VM running macOS 10.12 - but if I attempt to read /private/var/db/ConfigurationProfiles/Store, then I get errors:

ComputerName:~ root# cd /private/var/db/ConfigurationProfiles/
ComputerName:ConfigurationProfiles root# ls
.cloudConfigNoActivationRecord
.noActivationRecord
Settings
Setup
Store
com.apple.ManagedClient.enrollagent.plist
ComputerName:ConfigurationProfiles root# cd Store 
-sh: cd: Store: Not a directory
ComputerName:ConfigurationProfiles root# ls -lah
ls: Store: Operation not permitted
total 0
drwxr-xr-x    8 root  wheel   256B 25 Jan 07:51 .
drwxr-xr-x  108 root  wheel   3.4K 14 Feb 12:57 ..
-rw-r--r--    1 root  wheel     0B 13 Dec  2015 .cloudConfigNoActivationRecord
-rw-r--r--    1 root  wheel     0B 17 Dec  2014 .noActivationRecord
drwxr-xr-x@   4 root  wheel   128B 25 Jan 07:51 Settings
drwx------    3 root  wheel    96B 15 Feb 22:17 Setup
-rw-r--r--    1 root  wheel   490B  9 Sep  2014 com.apple.ManagedClient.enrollagent.plist

Getting info on the file in the Finder show unknown permissions:

Get Info for file

I've tried the same in a VM running a macOS 10.13 Beta (so, a completely separate installation), and I get the same issue.

Any ideas what's going on here, if I need to correct it, or if I just need to exclude this path from my backups?

Thanks!

Moisie
  • 41

3 Answers3

2

Yeah definitely is protected by system integrity protection. Disabling it properly shows the file as a directory. Mine had one blank .plist in it.

David Smith
  • 458
  • Yep. If you can't see something when you're logged on as root, suspect SIP every time. – Scott Earle Jun 11 '18 at 04:29
  • Yeah, what's unusual about this file compared to regular SIP protected files is that it can't examined (read, or even stat'd) by anyone, even the root user. Other SIP files typically can all at least be read and their permissions can be viewed. It also shows in Finder as if it's a single file when it's really a directory that contains a number of directories and files. – David Smith Jun 13 '18 at 04:32
  • The SystemKey file contains the actual password for System.keychain, which is why you can't examine it, even as root. For anyone who disables SIP and examines this file, the system password can by extracted very easily using hexdump -s 8 -n 24 -e '1/1 "%.2x"' //private/var/db/SystemKey && echo. – undefined Jul 11 '20 at 17:15
0

This is a read/write permission issue. Try these steps!

Find these keys on your keyboard command+i this will open the get info window

After the window opens scroll down and click on the sharing & permission

Now if you don't see your username in the filed which appears after clicking on sharing & permissions then add your username (Admin) by clicking on the plus sign

Now if this doesn't works then again click on the plus sign and add Administrator (First check is Administrator is visible in the filed or not after clicking sharing and permission)

After pressing command+i you will get to see a window like this after which you will have to click on the lock icon! (I have already unlocked it so there's an unlock sign)

enter image description here

Then enter your password

Now a second overlaying window will appear on your mac screen

Now, You will have to select either your username or administrators and add it to the sharing and permissions field

After that there wouldn't be any permission issue!

enter image description here

Sayan
  • 2,269
  • Thanks for your comments Sayan. Unfortunately I've already escalated to root user in the Terminal output to get maximal permissions, and I'll edit my post to show what the Sharing & Permissions show. – Moisie Feb 17 '18 at 21:58
  • For anyone wanting to add from the full list of system users/groups, hold down alt as you click on the plus button. – undefined Jul 11 '20 at 17:08
-2

Edited: Your kernel is definitely blocking access which is preventing you from reading the file.

I tried lsof -b which avoids kernel blocks and it said that it couldn't open it due to -b being used which indicates the kernel is blocking access.

Seems like this would support a malware theory since I've never set up a configuration profile on my computer. The file was created exactly 10 hours after my operating system was newly reinstalled.

Original: (Apologize if this is too theoretical but most people don't even believe in malware for Macs)

But it seems there's something weird happening here. I personally believe malware/modified BOOTROM/BIOS/kernel (try and cat /dev like "cat /dev"). But yeah nothing works on this file including stat, cat, more, ls, rm, cp, file, ln. It's interesting considering it's a configuration profile related file which seems to imply that there is in fact a configuration profile installed on the computer, which understandably would want to prevent a user from access the configuration profile for the computer..if it were legitimately installed like on a work computer. This is on my personal computer though..yours too?

I see you also have a managedclient .plist file which would be the preferences for a manager account on your computer. Did you set up a user with parental control settings or something? If not are you able to open that file?

It doesn't make sense that the root user can't do anything at all to this file..never seen one so protected. I suppose the next option would be to turn off SIP in Recovery Mode "csrutil disable; reboot" but normally even SIP protected files are readable.

David Smith
  • 458
  • I don't see an answer anywhere in here; it reads more like commentary. Please edit so that it directly answers the OP's question. – Allan Jun 08 '18 at 17:30
  • It was more a comment than an answer. I'm not all that familiar with this site but I considering no one else has any ideas what this issue could be my answer could be understood as: the reason you can't read it is that it is malware and not normal, disabling SIP might be the only way to read the file. – David Smith Jun 09 '18 at 04:29