I think there is a problem changing the application rules using 'socketfilterfw'.

My Situation:

I use the process 'socketfilterfw' related to the firewall. However, in macOS 15, the result message was different from previous versions. Some messages have only a few changes. However, the option '--listapps' has many changes. In previous version, the option showed results, including the path of each application. However, this is not the case with macOS 15. It only shows the name and status of the application.

The list only shows the name and current status of the application. The results of this list alone cannot change the policy. I think this is a bug. I think we should let them know the absolute path of the application in the list, or we should be able to change the policy just with the name of the application.

My Question: I wonder if these changes are intentional, and I want to get an absolute path for each application additionally, so I wonder what method to take.

Terminal input : $ /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

Previous macOS result —————————————————————————————— ALF: total number of apps = 5 1 : /Applications/Google Chrome.app ( Block incoming connections )

2 : /usr/sbin/smbd ( Block incoming connections )

3 : /Applications/FaceTime.app ( Block incoming connections )

4 : /Applications/Safari.app ( Allow incoming connections )

5 : /usr/sbin/cupsd ( Allow incoming connections )

——————————————————————————————

In macOS 15, result —————————————————————————————— 2024-06-24 16:21:15.599 socketfilterfw[2988:52866] ApplicationFirewall::AFGetAllApplications() processing response dictionary Total number of apps = 5 Google Chrome.app (state: 4) smbd (state: 4) FaceTime.app (state: 4) Safari.app (state: 1) cupsd (state: 1) ——————————————————————————————

On macOS 15 —————————————————————————————— Terminal input: % /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp FaceTime.app —————————————————————————————— 2024-06-24 16:51:59.091 socketfilterfw[3185:69041] ApplicationFirewall::AFSetAppStateByPath() result: 1 response: { Result = 1; } ——————————————————————————————

Terminal input: % /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /System/Applications/FaceTime.app —————————————————————————————— 2024-06-24 16:52:34.093 socketfilterfw[3186:69310] ApplicationFirewall::AFSetAppStateByPath() result: 1 response: { ErrorMessage = "vendor config update success"; Result = 1; } ——————————————————————————————

Answered by DTS Engineer in 792590022

socketfilterfw isn’t an API, and thus not something we can really help you with here on DevForums. If the change in behaviour you’re seeing on macOS 15 beta is causing you grief, I encourage you to file a bug about that.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

socketfilterfw isn’t an API, and thus not something we can really help you with here on DevForums. If the change in behaviour you’re seeing on macOS 15 beta is causing you grief, I encourage you to file a bug about that.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

While it’s not directly applicable to this discussion, I wanted to note that there’s some info about ALF changes in the macOS Sequoia 15 Beta 2 Release Notes.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I think there is a problem changing the application rules using 'socketfilterfw'.
 
 
Q