Where are 'socketfilterfw' changes being stored in macOS 15?

Question

Created Jul ’24

Replies 2

Boosts 0

Participants 2

With the recent change to socketfilterfw in macOS 15 we can no longer check if the application firewall is enabled or not via a plist. This is significant in our app because we rely on the NSFilePresenter interface to monitor the plist to alert our app whenever a user changes their firewall settings. Removing the plist is a breaking change for us.

Can you please advise either some new location on disk for us to monitor, or if there is another way to observe this setting? We would ideally rather not have to poll 'socketfilterfw' on an interval. Thanks!

Answered by DTS Engineer in 796620022

First up, I want to be sure you’ve seen the discussion in macOS Sequoia 15 Beta 3 Release Notes.

Can you please advise either some new location on disk for us to monitor … ?

No. The location and format of these preferences is not considered API, and so posting details like that just encourages more folks to dig themselves into the same hole that you’ve dug for yourself )-:

or if there is another way to observe this setting?

AFAIK there is not.

I’d like to clarify why you need this. What firewall settings are you monitoring? And to what end?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’24

Recommended

First up, I want to be sure you’ve seen the discussion in macOS Sequoia 15 Beta 3 Release Notes.

Can you please advise either some new location on disk for us to monitor … ?

No. The location and format of these preferences is not considered API, and so posting details like that just encourages more folks to dig themselves into the same hole that you’ve dug for yourself )-:

or if there is another way to observe this setting?

AFAIK there is not.

I’d like to clarify why you need this. What firewall settings are you monitoring? And to what end?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

dsg404 OP

Jul ’24

Thanks for the reply. Yep, I did see those release notes! For what it's worth, we aren't relying on the format of the plist, just the fact that it was modified so we can observe it.

Can you clarify what you mean by "not an API"? I'm seeing contradictory information - the linked release notes encourages people to use socketfilterfw. But in another response (see https://developer.apple.com/forums/thread/757907?answerId=792590022#792590022) you say that socketfilterfw is also not an API. Would relying on this tool also be considered digging ourselves into a hole? If so, what is the proper way to check for firewall status if socketfilterfw is not an api? Even if what I'm asking for overall isn't possible, we'd like to use the proper method to check for firewall status that wouldn't be considered unsupported.

To answer your question, we have a feature in our app that monitors when a user turns on or off their application firewall as a whole, and we perform an action accordingly. We'd have to switch to polling for the state on a timer without this, and we don't love that idea either.

0