macOS 14 Sonoma

Is there a thread to discuss issues with Sonoma?

Being new to forum today I haven't read all guidelines etc. Sorry for that.

I'm looking for a solution for a Sonoma+Sophos issue I'm experiencing.
Shall I discuss it here?
Or is there a better way of handling it.
I have seen below thread but don't fully understand whether or not that is my issue too.

RE: no heartbeat from 10.5.0 Mac Endpoint on macOS Sonoma 14.0 

Mine is that Sophos doesn't seem to work properly anymore after upgrading to Sonoma.
I don't seem to have granted FULL DISK ACCESS according to the Self Help App, but when looking into that with a more knowledgeable collegue this IS the case (I DO have granted Sophos App(s) according to the "Privacy & Security" system dialog.

tx in advance!

Tom

Hi Tom,

Sorry to hear you're having issues with the product on Sonoma, I'd be keen to help you out.

Could you elaborate on what you mean by "doesn't seem to work properly"? What problems are you experiencing?

There are a couple of things that would be helpful for me to understand the problem, could you please:

• post a screenshot of the Prerequisites panel in the Self-help app
• provide the output of the following command
  • sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'SELECT service, client, auth_value FROM access WHERE (service = "kTCCServiceSystemPolicyAllFiles" OR service = "kTCCServiceEndpointSecurityClient")' | grep -i sophos

It would be good to know if you are deploying using an MDM solution (such as JAMF) or not.

Feel free to DM me directly if you'd prefer.

Regards,

David

Tx David!
I will DM you and update later for the general public.
T

Thanks Tom. I received your message but the system is not letting me reply to you 

"You cannot currently message this user, either you do not have permission or the user is not accepting messages."

Can you double check your profile/message settings and see if that's the case?

The reply to your DM:

It definitely looks like there's an issue with Full Disk Access. We've seen isolated incidents where a macOS upgrade removes full disk access from previously processes but it doesn't seem unique to Sophos and we haven't been able to nail it down as it's been sporadic and very hard to reproduce.

It definitely looks like Terminal needs to be granted full disk access in order to be able to access the database. Could you grant access and try again?

We'd expect a notification from the product to pop up informing you that full disk access is required and guiding you through the process but if that's not happening perhaps notifications aren't allowed for Sophos, it might be worth checking that in System Settings. Feel free to share as many screenshots as you need.

Hi David, 

I've sent you a friends request, that should fix the DM's being blocked.

On topic: unsure why terminal as an app should be granted anything. Shouldn't the "sudo xxx" command take care of any rights that xxx needs? Will look into it a bit further and get back to you in DM.

That worked, thanks Tom.

The Full Disk Access permission is a security feature introduced in macOS Mojave that prevents non-authorized applications from accessing certain locations that Apple have deemed 'special. It is separate from sudo

Usually, when an application attempts to access one of these protected 'special' places a pop-up prompt would appear, but that doesn't happen when working with the command line.

Feel free to continue the detailed conversation in our DMs and we can update this thread with our results when we've got you up and running again.

That worked, thanks Tom.

The Full Disk Access permission is a security feature introduced in macOS Mojave that prevents non-authorized applications from accessing certain locations that Apple have deemed 'special. It is separate from sudo

Usually, when an application attempts to access one of these protected 'special' places a pop-up prompt would appear, but that doesn't happen when working with the command line.

Feel free to continue the detailed conversation in our DMs and we can update this thread with our results when we've got you up and running again.