How to obtain access policy criteria

This document provides information on how to obtain the necessary criteria to be used during the creation of an access policy.

Application Name

The application name is a value that can be located, and the name displayed through Finder may not be the original application name. Use one of the following options to locate the application name:

Option 1: Finder

1. Right-click on the application to display the context menu.
2. Click on the Get Info option.
3. In the Name & Extension field, copy the application name.

Option 2: Command line

1. Open the Terminal application.
2. Run the following command: defaults read /app_path/app.app/contents/info.plist CFBundleDisplayName.

Bundle identifier

1. Open the Terminal application.
2. Run the following command: mdls -name kMDItemCFBundleIdentifier /app_path/app.app.

Code signature

1. Open the Terminal application.
2. Run the following command: codesign -dv -r- /app_path/app.app 2>&1 | grep "designated =>".

Path

Option 1: Finder

1. Left-click on the application.
2. With the application selected, press the keys: Command + Option + C to copy the application path to the clipboard.

Option 2: Command line

1. Open the Terminal application.
2. Run the following command: realpath /app_path/app.app.

Developer identity

Developer identities are unique identifiers that relate to a development team. To obtain the developer identity, see the following step-by-step:

1. Open the Terminal application.
2. Run the following command: codesign -dv -r- /app_path/app.app 2>&1 | grep "TeamIdentifier".

Version

The installed application version can be found through the visual interface or command line. Use one of the following options to locate the application version:

Option 1: Finder

1. Right-click on the application to display the context menu.
2. Click on the Get Info option.
3. In the General field, copy the application version.

Option 2: Command line

1. Open the Terminal application.
2. Run the following command: mdls -name kMDItemVersion /app_path/app.app.

SHA256

1. Open the Terminal application.
2. Run the following command: shasum -a 256 /app_path/app.app/Contents/MacOS/ExecutableName.

SHA512

1. Open the Terminal application.
2. Run the following command: shasum -a 512 /app_path/app.app/Contents/MacOS/ExecutableName.

Executable name

The executable name can be found through the visual interface or command line. Use one of the following options to locate the executable name:

Option 1: Finder

1. Right-click on the application to display the context menu.
2. Click on the Show Package Contents option.
3. Access Contents > MacOS, locate the executable and copy its name.

Option 2: Command line

1. Open the Terminal application.
2. Run the following command: find /app_path/app.app/Contents/MacOS -perm +111 -type f.

Application Category

1. Open the Terminal application.
2. Run the following command: mdls -name kMDItemAppStoreCategoryType /app_path/app.app.

User

EPM macOS uses the POSIX username for access policy rules. There are several ways to obtain it, but the two most useful forms are with the whoami and dscl commands, where the first option provides only the current user and the second provides all system users. Use one of the following options to locate users:

Current user

1. Open the Terminal application.
2. Run the following command: whoami.

All system users

1. Open the Terminal application.
2. Run the following command: dscl . list /Users.

Arguments

Arguments are everything that comes after the program name. To know which arguments can be used for a command, consult the program manual through the man <program> command or through the help command <program> help.