What is the impact of not approving Full Disk Access (FDA) MacOS
book
Article ID: 284997
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
What is the impact of not approving Full Disk Access (FDA) MacOS
Environment
Carbon Black Cloud Sensor: All Sensor Versions
Apple macOS: 11.0 (Big Sur) and Higher
Resolution
The application may be restricted in reading or writing data to certain directories or files. This could affect its ability to save or retrieve user data.
3.8 and newer sensor, installs and, due to the error, will explicitly enter sensor bypass with “Bypass (Extension Error)” displayed in the console.
Enabling the bypass mode removes all policy enforcement on the device. This applies whether Bypass Mode was enabled by an administrator or the sensor remains in Bypass Mode due to one of the reasons detailed in the Bypass Reasons section.
If the below state is also existing with the above FDA sensorStates flag then SysEXT failed to initialize and entered bypass due to the missing FDA for SysEXT binary.
sensorStates:“DRIVER_INIT_ERROR”
Repmgr not granted FDA: results in the following features restricted: background scan, Live Response, Cert Allow Listing
SysEXT not granted FDA: on newer macOS versions, the operating system fails to initialize SysEXT security subsystems, effectively disabling the core security features.
Additional Information
Apple’s Endpoint Security Framework requires clients attaching to the framework to be granted FDA.