OS X El Capitan Support

bump
Are there any updates on this we just upgrade to 9.2.

Just wanted to chime in here – agent version 9.2.5 does not appear to work for us. You can’t launch the UI. A daemon appears to be running in the background and is checking in with the main server, but it doesn’t appear to be able to run any actions.

sorry for the confusion on my last deleted reply. i saw an RFE on el capitan support and mistakenly thought it was for bigfix but on second look, it was not.

ive been seeing similar behavior to jdeangelis where the services are not showing up as running but the agent is checking in to the parent server and console.

in my tests, the services took awhile to start running and checking into the console. but after that, i was able to send tasks and fixlets, which so far have been successfully running, although most of them are basic ones. at least it gives some hope that we can use console actions to update the agents on macs running el capitan. the triggerclientui does not open still and says the services are not running, so there are definitely some issues still happening.

Apple has made some radical changes to El Capitan!

Not surprising that a tool like BigFix would have trouble when the OS permissions are changed like this. According to the article, there may be a way to revert the Root access. Has anyone tried that?

Hey Tim,

Check out these resources about SIP. Deals with configuration and management of SIP.

https://developer.apple.com/library/prerelease/ios/documentation/Security/Conceptual/System_Integrity_Protection_Guide/System_Integrity_Protection_Guide.pdf

https://developer.apple.com/library/prerelease/mac/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html

Hope this answers your question.

SIP basically locks down unix-y locations and forces user/third-party installs to /usr/local or /opt. You can’t shove stuff in to /bin or /usr/bin any more. However, BigFix is in /opt and /Library/Application support, so I don’t see that being a problem.

@AlanM, what’s y’all’s take on SIP?

SIP is definitely annoying and we are working on getting around it.

I opened a PMR with IBM support for El Capitan compatibility a couple of weeks ago. They replied that they’re expecting BF v9.2.6 to be released by the end of November, which will be El Capitan compatible, although all is subject to change. Maybe we’ll hear more at the BF user group meeting this week though.

2 Likes

That is probably the case, though it would be @AlanM we’d hear from about it at the BigFix User Group Meeting.

@AlanM It would be interesting if you have some thoughts on El Cap compatibility challenges for the user group meeting, as well as BigFix Mac support in general.

Hopefully I passed on enough of my distaste for SIP

That being we are working around it.

@AlanM, it was extraordinarily valuable to get your perspective.

Thanks again for attending, and sharing.

Hopefully BigFix can work within the confines of a SIP enabled system. In our environment we can’t really mandate or recommend that users should disable a security feature in order to run management tools. For all the Mac systems that we directly control we plan on leaving SIP fully enabled and excluding any software that doesn’t support that configuration.

1 Like

I agree with @hansen_m , this is also our intention to keep SIP on.

Concur. We have no intention of disabling SIP.

We will work around it, the full method of working around it may take some time, though an upcoming patch will return almost all of the functionality with more coming as we re-work the internal code to handle the new environment

1 Like

Should the latest patch 9.2.7.53 allow the TriggerClientUI to run in El Capitan?

I apologize, I realize this is an old thread, but it looked most appropriate for my question.

Not yet. SIP is still getting in the way of that. If you need an end user to be able to launch it you can mark it as always tray

Thank you for the info Alan, is Always tray a mac setting or IEM? Could you give a little more detail, I’m just helping out this isn’t my normal gig.

Its a client setting I am talking about

  _BESClient_ActionManager_TrayMode 
 Type:  String 
 Version:  7.0 
 Platform:  Windows 
 Default:  OffersTray 
 Requires Client Restart:  NO 
 Description:  "Specifies level of tray functionality - one of  "NoTray", "ActionsTray", "OffersTray", "AlwaysTray".
 Defaults to "OffersTray".

Hello, do you know which version will officially fix the problem?