Dictionaries or dictionaries of dictionaries… yay.
I looked to the answers in one of my past posts on macOS plists for guidance, but found little in there that helped this time. Anyone want to join me in this “fun”?
Again, I’m trying to “browse” my way though a macOS plist to both list out certain information and look for specific values. The plist in question is “/Library/Application Support/com.apple.TCC/MDMOverrides.plist”, a heavily trimmed example of which is below:
Dict {
com.crowdstrike.falcon.Agent = Dict {
kTCCServiceSystemPolicyAllFiles = Dict {
Allowed = 1
}
}
com.crowdstrike.falcon.App = Dict {
kTCCServiceSystemPolicyAllFiles = Dict {
Allowed = 1
}
}
com.apple.Terminal = Dict {
kTCCServiceAccessibility = Dict {
Allowed = 1
}
kTCCServiceSystemPolicyAllFiles = Dict {
Allowed = 1
}
kTCCServiceReminders = Dict {
Allowed = 1
}
kTCCServiceAddressBook = Dict {
Allowed = 1
}
}
}
Minimally, I need to be able to identify computers that have, for example, a value of 1
for Allowed
under kTCCServiceSystemPolicyAllFiles
for com.apple.Terminal
(or something similar to that).
Ideally, I’d ALSO like to list out this plist with those values and paths on one line:
MDM|allw|com.apple.Terminal|kTCCServiceAccessibility
MDM|allw|com.apple.Terminal|kTCCServiceAddressBook
MDM|allw|com.apple.Terminal|kTCCServiceReminders
MDM|allw|com.apple.Terminal|kTCCServiceSystemPolicyAllFiles
MDM|allw|com.crowdstrike.falcon.Agent|kTCCServiceSystemPolicyAllFiles
MDM|allw|com.crowdstrike.falcon.App|kTCCServiceSystemPolicyAllFiles
I’ve written a shell script (that I’m very proud of, using PlistBuddy and sqlite) that does this, but I’d much rather do this with inspectors than with eternal actions that rewrite a file once a day to be read by an analysis.
Frustratingly, I’ve only gotten as far as this:
Q: keys of entries of dictionaries of file "/Library/Application Support/com.apple.TCC/MDMOverrides.plist"
A: com.screenconnect.client.access
A: com.jamf.management.Jamf
A: com.crowdstrike.falcon.Agent
A: com.crowdstrike.falcon.App
A: /usr/bin/osascript
A: com.apple.Terminal
A: /usr/local/jamf/bin/jamf
T: 395
Any other combinations of keys and entries and dictionaries and values and strings (probed in a bazillion ways with exists
) has gotten me nothing but
E: The operator "everything-I've-tried" is not defined.
What am I missing that will get me into that next level of Dante’s dictionary inferno to pull out the bit of brimstone that I need?