Setting it up
An administrator password and a signing key, and what each one is actually for.
On this page 4 sections
Open Window ▸ MSL Admin Portal on a Mac with no policy and the window says This Mac is not managed, with a Set Up… button.
The three things, and why they are three#
Setup asks for a password and makes a key. They do different jobs, and blurring them is how somebody ends up believing a password protects a file that anyone can edit.
| What it does | What it does not do | |
|---|---|---|
| Administrator password | Unlocks the editing view in this window. | Protect the policy file. Anyone who can read the disk can read the file. |
| Signing key | Makes the policy tamper-evident: edit it and it stops verifying. | Stop it being deleted. |
| Where the file lives | A root-owned location cannot be changed by a non-administrator. | Stop an administrator of the Mac. |
Only all three together make a policy enforceable. How strong a policy is explains which rung a given setup is on, and MSL always tells you rather than letting you infer it.
Setting a policy#
Unlock with the password and the window lists all the capabilities with a switch each. Turn off what this Mac may not do, write a reason — it is shown on every refusal — and apply. MSL signs it and installs it for your user.
That is the tamper-evident rung. To go further:
msl admin enrol ~/Library/Application\ Support/MSL/policy.jsonwhich copies it to /Library/Application Support/MSL/ as root, where somebody who is not an administrator of this Mac cannot change or remove it.
Checking it#
msl admin status
msl admin status <instance>The first shows the whole policy and its strength; the second resolves it for one instance, which is what actually applies when that instance does something.
Undoing it#
msl admin unenrolRemoves the policy. If it is in the root-owned location this asks for your Mac password, because that is the point of it being there.