Red screen is triggered in SEB MAC v 3.2.5 because of jamFHelper

[cbowdenrm]

Some of our users reported issue of red screen in SEB MAC v 3.2.5 because of jamFHelper

Steps to replicate
Download and install SEB MAC v 3.2.5
Launch SEB and log in as student
After sometime red screen appears as follows
Entering the exit code does not work and student is locked.
It happens in Ventura, Big Sur, Monterey and even Catalina OS.

[danschlet]

SEB for macOS only detects processes as "prohibited"

• if you explicitly added them to the prohibited process list in your SEB settings
• if it's a preset default prohibited process (which jamfhelper isn't)
• if the process attempts to display a window in the foreground. That's most likely what happens in this case (you can send me SEB log files to confirm that)

Obviously SEB cannot allow other processes running in the background to display anything while an exam is running, that could be used for cheating. As it seems JAMF can be configured to optionally display (custom) information in windows through jamfhelper. So you have to disable that while you're doing exams with SEB. Our jamf instance never displays anything, so it's definitely your own jamf setup which causes this.
Students couldn't quit SEB because they didn't enter the correct quit password. They always have to enter the SEB quit password of the session which is running at that moment (from currently loaded SEB settings).

[danschlet]

PS: Jamf Helper can still cause this lock screen (even in SEB 3.3.3), because it apparently sometimes displays custom notifications (not macOS standard notifications). As these are displayed in front of SEB's windows, SEB tries to terminate the process (which isn't possible if it runs with admin rights). Currently SEB for macOS doesn't support permitted processes, so you can't allow Jamf Helper to display those notifications while SEB is using its standard lockdown (kiosk) mode.

The workarounds currently are:

• Configure Jamf to NOT display any notifications, especially not for example for newly available versions or to warn users that a software will be updated. Are these notifications really necessary? Maybe you can create some exceptions, so such notifications are not displayed while exams or SEB is running?
• Use Assessment Mode (AAC) in your SEB configurations (see below).

[danschlet]

Btw., you should also be able to prevent jamfHelper to block SEB if you use the AAC lockdown mode in your SEB settings, see Preferences / Security / Prefer Assessment Mode (AAC) (and if you want to increase compatibility to some macOS 11 Big Sur releases, also check "Use AAC with DNS pre-pinning").
This macOS built-in lockdown mode uses other methods of blocking other apps/background processes to stop displaying windows. The problem though is that AAC was not working correctly on some macOS 11 Big Sur releases (sometimes some network connections were blocked) and was generally only available since macOS 10.15.4. But if you can require newer your students to use newer macOS versions, then AAC should be more safe than the original/default lockdown mode of SEB.

[cbowdenrm]

Thanks Daniel, we will implement these setting as and assess their effectiveness.
Appreciate the time taken to assist

[cbowdenrm]

Hi Daniel

Thank you for taking the time to reply.
My concern what does "Prefer Assessment Mode" alter how SEB works? would it fix one issue but possibly have any other behaviors/nuances we are not prepared for?

Also any change it might help with the other red screen we get at the same time (com.apple.webkit.networking)

[danschlet]

The AutomaticAssessmentConfiguration AAC lockdown mode is more secure, but there were issues with it on earlier macOS versions. Apple reported that it works without issues from macOS 12.1. I couldn't reproduce earlier issues on current updated versions of macOS 11 anymore (sometimes websites were not loading), but there's probably a risk that could happen (especially if your assessment system is assessing many different servers/domains.

How often the red screen for WebKit is being displayed? Only on specific machines or randomly on many different student Macs? Was really SEB 3.2.5 used or an earlier version? These prohibited process lock screens should only be displayed for processes without a valid Apple signature, so it shouldn't be displayed for WebKit.

I can't analyze such issues without SEB log files. Use the default log level debug and get the SEB log files from a machine where such an issue happened directly after the exam (or at least before SEB is used again).

[cbowdenrm]

How often the red screen for WebKit is being displayed?

One school with 60 learners, 20 of them experienced JAMFHELPER/webkit but I can't tell you the split.

Only on specific machines or randomly on many different student Macs?

Random because there is a BYOD policy although school has back up macs.
On confirmed instance was Os 10.

Was really SEB 3.2.5 used or an earlier version?

Only 3.2.5 - we control the access to seb via a portal to students to download SEB and CONGIF files.

These prohibited process lock screens should only be displayed for processes without a valid Apple signature, so it shouldn't be displayed for WebKit.

Attached a log file that was retrieved. Can provide more but will need time to Anonymize the files.

com.rm.seb 2023-09-13--23-40-58-380.log

[danschlet]

The log doesn't contain the "Prohibited processes detected: ..." or "openLockdownWindows" log events. I guess you chose a wrong log file, it's sometimes not so easy to figure out which one belongs to which SEB session.

Without being able to reproduce this, it won't be easy to figure out what's wrong. I will have a look at the process watching code if I find some hints. Maybe also changes in SEB 3.3 fix the issue, please report again if you observe it with SEB 3.3.

As mentioned, to prevent it generally I would try starting the AAC lockdown mode, as that is in general more secure also agains all possible kinds of background communication/internet connection based exploits.

If you don't want to switch to AAC, then as a workaround it might help to tell students to close Safari, Mail and other apps which might use WebKit. In the next major SEB release I'll probably add an option to close all other running applications before the exam starts (which might not be necessary to use with AAC, but with the standard SEB lockdown mode it will make a lot of sense).

[danschlet]

Note: If this issue still happens with SEB 3.2.5 or 3.3, then please search the according SEB log files for this line
Couldn't terminate app with localized name (error
and post the full line here (best also the according SEB log file). I need to know the error number which would be listed in the log if SEB cannot terminate that process.

[zgu]

Hi Daniel,

I was able to reproduce this with Mac version 3.3. but the error number shows -1:

Couldn't terminate app with localized name (error -1)

org.safeexambrowser.SafeExamBrowser 2023-10-31--14-02-44-594.log

thanks

Zhen

[danschlet]

Arghh, error reporting of the Unix kill(9) command is quite complicated to fully understand. I think I got now another case when the process was actually terminated by SEB, but error -1 and an additional C error variable errno produces the error 3 "No such process". This seems to be caused by specific timing issues and means the process was at that time already terminated.

Anyways, I added that case and better logging and will release that in the final version of SEB 3.3.1 (or I might number that version 3.3.2 to avoid confusion with the currently available 3.3.1 release candidate, which doesn't include that fix yet).

[danschlet]

Hi Zhen,

I hope that the problem of these false positive lock screens about SEB not being able to terminate prohibited processes was fixed with a change I made in SEB 3.3.2. In case those lock screens still happen, please send SEB log files from Macs where it happens. I also improved logging, so in future log files should help me to find new edge cases.

Thanks,
Daniel

[lmBored]

Hi Daniel,

This same issue really still persists in 3.3.2. I really hope there could be some fix for the Unix kill command in SEB 3.3.3.

org.safeexambrowser.SafeExamBrowser 2024-04-17--11-28-56-864.log

[danschlet]

See #294 (comment) for a workaround for the WebKit Networking issue still happening.

[danschlet]

This should be fixed in SEB 3.3.3 for macOS. Please test and report if it works for you.