Compatibility with Privacy Policy Preference Control

Technical Articles ID: KB91109
Last Modified: 2024-03-18 08:10:53 Etc/GMT

Environment

Data Loss Prevention Endpoint (DLP Endpoint) for Mac 11.x
Endpoint Security for Mac (ENSM) 10.x
File and Removable Media Protection (FRP) for Mac 5.4.x and later

Apple macOS Mojave 10.14.x and later

Summary

Recent updates to this article

Date	Update
March 18, 2024	Added EDR 4.2.0 and later in the "Solution" section. Added new attachment "PPPC_Trellix_v5.0.mobileconfig.zip".
February 19, 2024	Added process path and other details for DLP Endpoint for Mac in the "Solution" section.
January 22, 2024	Updated "Attachments" section.

To improve security on Mac systems, macOS Mojave 10.14 introduced the Privacy Policy Preference Control (PPPC) feature. This feature requires user consent to allow any installed third-party applications to have access to protected system locations such as Mail, Calendar, and Photos. In macOS Catalina 10.15, Apple expanded this protection to encompass removable storage devices, network shares, and user folders. For example: Desktop, Documents, and Downloads.

Problem

Because of PPPC, our software isn't allowed to access protected system locations without user consent. The operating system might prompt users to allow consent for our product processes.

Example:

In ENSM, fmpd or VShieldScanner
In DLP Endpoint for Mac, datalossd or datalosste

NOTE: For proper operation, DLP Endpoint must have access to mounted network shares, removable storage devices, and user-specific folders.

Solution 1

Apple enables you to manage PPPC settings through a user-approved Mobile Device Management (MDM) profile.

With the settings in the following table, create a PPPC settings payload to manage our product processes. See the specific MDM vendor instructions for payload creation details. Or, you can download and import the profile configuration file. The file is included in the correlating product .zip file in the "Attachment" section of this article. The profile configuration file can only be deployed through an MDM solution and can't be used on unmanaged devices.

Product	Process Path	PPPC Profile Key	Identifier Type to be used in the Payload
ENSM
Required for all ENSM versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
Required for all ENSM versions	/usr/local/McAfee/AntiMalware/VShieldScanner	SystemPolicyAllFiles	Path
Also required only for ENSM 10.6.5 to 10.6.7	/usr/local/McAfee/AntiMalware/VShieldService	SystemPolicyAllFiles	Path
Also required only for ENSM 10.6.5 to 10.6.7	/usr/local/McAfee/AntiMalware/VShieldTaskManager	SystemPolicyAllFiles	Path
Also required only for ENSM 10.7.0 to 10.7.1	/usr/local/McAfee/AntiMalware/VShieldScanManager	SystemPolicyAllFiles	Path
Also required only for ENSM 10.7.5 and later	ID: com.mcafee.tp.endpointsecurity	SystemPolicyAllFiles	Bundle ID
DLP Endpoint for Mac
Required for all DLP versions	ID: com.mcafee.console	SystemPolicyAllFiles	Bundle ID
Required for all DLP versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
FRP for Mac
	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
EDR for Mac
Required for all EDR versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path

Solution 2

For April 2023 Mac product releases

NOTE:

Having both McAfee PPPC and Trellix PPPC loaded onto a client can lead to conflicts during the upgrade.
Make sure that you use the respective profiles with the appropriate Mac products to avoid any issues.
Upgrading ENSM to ENSM 10.7.9 on an MDM-Managed BigSur host might require a reboot after making the above profile changes, to obtain the required Full-Disk access.

Product	Process Path	PPPC Profile Key	Identifier Type to be used in the Payload
ENSM
ENSM 10.7.9 and later	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
	/usr/local/McAfee/AntiMalware/VShieldScanner	SystemPolicyAllFiles	Path
	ID: com.trellix.tp.endpointsecurity	SystemPolicyAllFiles	Bundle ID
DLP Endpoint for Mac
Required for all DLP versions	ID: com.mcafee.console	SystemPolicyAllFiles	Bundle ID
Required for all DLP versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
DLP 11.10.100 and later	/usr/local/McAfee/fmp/bin64/fmpd	Accessibility	Path
FRP for Mac
	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
EDR for Mac
Required for all EDR versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path
EDR 4.2.0 and later	com.trellix.CMF.endpointsecurity	SystemPolicyAllFiles	Bundle ID
SCP for Mac
Required for all SCP versions	/usr/local/McAfee/fmp/bin64/fmpd	SystemPolicyAllFiles	Path

For a sample profile for the PPPC payload, see PPPC_Trellix_v5.0.mobileconfig.zip in the "Attachment" section of this article.

Related Information

Also see the following related articles:

Attachment 1

PPPC_McAfee_v3.0.mobileconfig.zip
1K • < 1 minute @ broadband

Attachment 2

PPPC_Trellix_v5.0.mobileconfig.zip
1K • < 1 minute @ broadband

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Compatibility with Privacy Policy Preference Control

Environment

Summary

Problem

Solution 1

Solution 2

Related Information

Attachment 1

Attachment 2

Affected Products

Languages:

Title

Title

Knowledge Center

Compatibility with Privacy Policy Preference Control

Environment

Summary

Problem

Solution 1

Solution 2

Related Information

Attachment 1

Attachment 2

Affected Products

Languages:

Choose your region

Title

Title