Vegvísir

Management Lifeline

Problem

An allowlist that blocks everything else is the strongest control a network tool can have, and the easiest way to brick a fleet. If the allowlist forgets the one thing that delivers the next profile (the MDM client, the push service, certificate validation, name resolution), the Mac cannot be told to fix itself. Each admin rediscovers the list the hard way.

Context & forces

• Admins write their allowlists by hand and will forget something.
• The things needed to stay manageable are few, well known and Apple-signed.
• A fixed list that users could edit is no safety net; a list that nobody can switch off is a trap for the admin who knows better.
• Third-party management agents differ per organisation, so a tool cannot know them.
• The rest of the policy must stay strict: "allow everything Apple" would allow curl and ssh.

Solution

Build a small, non-editable allowance into the restriction itself: the lifeline. It names exactly the processes the management channel needs, identifies them by their Apple signature (not by name, which anyone can copy), and applies in the strict modes where a profile might forget them. An explicit rule from the admin still wins, and one documented switch turns the lifeline off for those who want only their own rules.

 strict policy ──▶ is it one of the lifeline processes? ──yes──▶ allow (unless the admin
                          │                                       explicitly denies it)
                          no
                          ▼
                    the admin's rules decide

For developers

• The lifeline is data in the core, small and tested: process identity (signing ID and Apple platform signature) rather than path or name.
• It sits in the decision order after explicit managed rules and before the fallback, so an explicit deny wins and a missing allow does not cut the Mac off.
• It applies in block mode, in ask mode without a question, and in a hidden-app lockdown.
• The reason is shown ("management lifeline"), so a connection that got through is explained.
• The admin guide lists what the lifeline cannot know (third-party agents) and tells admins to allow those themselves.
• Tests cover the lifeline in each mode, and that an explicit managed deny still wins.

Consequences

• A forgotten allow rule no longer strands a Mac.
• Admins still own the real policy: the lifeline is short and says so.
• It is a trust decision: five Apple processes are always reachable in strict modes. Switching it off is possible and documented, at the admin's own risk.
• It cannot save a Mac whose third-party agent is blocked, and it does not close the gap before the filter has started after a restart.

Known uses

• Gjallarhorn: five Apple-signed processes (the MDM client, the push service, trust evaluation, name resolution and the enrolment daemon) stay reachable in block mode, in ask mode without a prompt and in a hidden lockdown, unless a managed rule denies them or ManagementLifeline is false. The example allowlist deliberately does not allow "all Apple processes".

Name

The vegvísir is the Icelandic stave that keeps its bearer from losing the way in bad weather. The lifeline keeps a locked-down Mac able to find its way back to its MDM.