How strong a policy is
Three rungs, what each one actually guarantees, and why MSL tells you which you are on.
On this page 4 sections
msl admin status prints a Strength line, and the panel shows the same. It is measured from the file, never inferred from where it sits.
| Rung | What it means | Someone can still |
|---|---|---|
| Advisory | A policy the person using the Mac can simply edit. | Change it to whatever they like. |
| Tamper-evident | Signed. It can be deleted, not forged. | Delete it, which is visible. |
| Enforceable | Signed and root-owned. | Nothing, unless they are an administrator of this Mac. |
Why it is measured#
A policy under /Library/Application Support/MSL is not automatically enforceable: that folder is group-writable by admin on some systems, and a policy placed there by an ordinary user would otherwise claim the top rung it has not earned. MSL checks the file's owner and permissions and reports what it finds.
Say it, do not imply it
Somebody deploys on the strength of that one line. It is the deployment MSL is least willing to be vague about.
Signing#
A signed policy is checked against the public keys this Mac has pinned. Three different failures, reported differently, because they mean completely different things:
| Reported | Means |
|---|---|
| not signed | Nobody vouched for it. |
| signed by a key this Mac has not pinned | Somebody vouched for it, but not somebody you said to trust. |
| the signature does not match | It has been edited since it was signed. |
When a policy is broken#
If the policy is present but will not verify, MSL falls back to the last policy that did verify rather than to no policy at all. Editing a policy to break it must not be a way to remove it.
It also does not refuse everything on a corrupt file. A machine that fails closed on an unreadable policy is a bricked machine, including the owner's ability to fix it — so MSL says so loudly, repeatedly, and keeps working on the last good rules.
Local admin mode#
If you set MSLAP up on your own Mac, the signing key is on that Mac. Anyone with administrator access could re-sign a policy. What it still buys is that casually editing it breaks it — which is the whole point for one person locking down their own machine. A fleet keeps its key somewhere else entirely; see Managing several Macs.