SafeExamBrowser / seb-mac

SEB 2.3.1 is a maintenance update, which disables Automatic Assessment Configuration (AAC) macOS Assessment Mode in default settings, as it has a major issue when used on macOS 11 Big Sur. We recommend to not use AAC until this issue will be fixed in an upcoming macOS Big Sur update.

When running on macOS 11 Big Sur, DNS lookup fails while AAC is enabled. This is why SEB fails to load URLs with a different domain than the Start URL the first time it tries to connect to that URL. Usually it would connect to the according domain after quitting and starting SEB again (as the DNS lookup result is cached). The domain of the Start URL should always be loadable, as SEB reaches out to the Start URL before activating AAC.

• Changed default setting for AAC to disabled, using a new settings key enableMacOSAAC.

• Block screen capture also when AAC is used (as AAC currently doesn't prevent screen capture reliably).

• Fixed URL String from pasteboard to copy to Preferences/General/Start URL is not saved when SEB is started in AAC.

• Clicking the close button of the running prohibited processes list window now quits SEB/the exam session.

• Fixed force "Quit All Processes" alert was sometimes displayed behind process list window.

• Fixed security issue with "Revert to Client Settings" and "Configure Client" in Preferences: Don't ask for client settings admin password if it is empty (not set).

SEB 2.3 for macOS is a major update, which improves security massively by supporting the Automatic Assessment Configuration (AAC) macOS Assessment Mode, available from macOS 10.15.4. SEB 2.3 also adds new capabilities, improves the user interface for students and exam administrators and fixes several issues.

• Support for Automatic Assessment Configuration (AAC) macOS Assessment Mode. AAC is used by default if running on macOS 10.15.4 or newer. Assessment Mode blocks various macOS features which shouldn't be accessible during exams. Also no other applications and processes running in the background can access the network while Assessment Mode is active.

• Optionally, the old SEB kiosk mode can be used also on latest macOS versions (see Preferences / Security / "Use Assessment Mode (AAC) if available", settings key enableAAC), as AAC doesn't support optionally enabling features like like screen capture/sharing, Siri and Dictation. Assessment Mode also cannot be used if you want to run a video conferencing solution in the background during an exam for proctoring.

• New options to enforce using the internal (built-in) display of a MacBook or iMac but optionally still allowing to use the external display on a Mac without built-in display (Mac Mini, Mac Pro).

• Fixed an issue when calculating the Config Key for configuration files containing prohibited processes entries for both macOS and Windows.

• New battery indicator in the SEB Dock, automatically displayed on devices with battery when the macOS menu bar with its battery indicator is disabled. This specifically applies when using Assessment Mode, as then the menu bar is always hidden.

• Full compatibility with macOS 11 Big Sur.

• Native support for Apple Silicon (universal binary).

• Preferences window can be opened by holding the option/alt key when starting SEB (also when dropping a SEB configuration file onto the SEB icon).

• Fixed drag-and-drop of configuration files onto the Preferences window. Note that files in iCloud drive need to be downloaded first (click the cloud icon in Finder's list view).

• Added SEB 3.x for Windows settings to the Preferences window.

• Improved starting SEB by opening settings, fixed some related issues.

• Improved workaround for SEB freezing when a webpage tries to download a font.

This version is a maintenance update containing improvements and bug fixes:

• Fixed that PDF documents were not displayed when Acrobat PDF viewer is installed.
• Prevent Preferences window to be opened in Moodle 3.9 when using automatically generated settings (option "Configure manually"). SEB now uses the default setting allowPreferencesWindow=false in exam configurations (client configs still have allowPreferencesWindow=true as default setting).
• Fixed: Cannot start SEB by opening .seb file on macOS <= 10.12.
• Fixed false positive detection of not allowed process because of partial match of process executable name.
• Now controlling resizing of Preferences panels: Don't allow to resize those without scroll view and allow to resize the ones with scroll view only to the maximum size of their content.
• Now scrolling oversized Preferences panels to the top when displaying them the first time.
• Fixed User Interface Preferences Panel didn't resize vertically.
• Fixed missing error message when identity certificate to decrypt SEB config cannot be accessed.
• Attempted to fix (not always reproducible) checking code signature of some visible apps delays or blocks starting SEB.
• Added Discord to preset prohibited processes.

SEB 2.2.1 for macOS is a major update, improving security by blocking prohibited processes, adding new capabilities and offering full compatibility to enhanced integrations with learning management systems, like the one available in Moodle 3.9.

• Prohibited Processes settings for blocking specific processes and applications from running together with SEB.
• Preset prohibited processes covering communication, screen sharing and recording apps. Let us know if you would like to suggest applications and tools to be added to those preset prohibited processes (we need information about the software and its name and Bundle Identifier (if applicable).
• Added settings to allow to reconfigure SEB, even it is already running in a secure exam session.
• Implemented setting keys to control clearing cookies when starting/ending an exam session (examSessionClearCookiesOnStart / examSessionClearCookiesOnEnd). This can be used to keep users logged in from the previous session after an exam session was started (and SEB reconfigured with new settings).
• Added setting to enable Web Inspector (web developer tools) in Preferences/Browser (same settings key allowDeveloperConsole as in SEB for Windows 3.0. If enabled and right click isn't disabled (see Preferences/Security/Hooked Keys/Enable Right Mouse), you can right click/ctrl-left click on a web page element and open Web Inspector with 'Inspect Element'.
• Added Mac-specific settings for blocking screen shots and screen recording. The separate settings allow to run SEB correctly in parallel with some remote proctoring tools.
• Added separate Mac setting for the Private Clipboard feature.
• Added Mac-specific setting for blocking screen sharing over the network (VNC): key screenSharingMacEnforceBlocked (default: false, then the value of the existing key allowScreenSharing is used).
• Added all SEB for iOS settings in Preferences window.
• Fixed that a wrong Config Key was calculated because of specific new default settings added in a new SEB version. This was the cause why SEB 2.1.4 did not work correctly with the new SEB integration in Moodle 3.9.
• Fixed: Overriding check for specific processes in lock screen didn't work.
• Fixed: Client config encrypted with password wasn't compatible between Win vs. Mac+iOS.
• Fixed: Loading config file with different SEB admin password in Preferences didn't work.
• Fixed that an SEB config without proper MIME type wasn't recognized: Added "text/xml" as alternative MIME type for SEB config files when a seb(s) link is opened.
• Removed ARDAgent from detecting Remote Management: ARDAgent is running always when Remote Management is enabled in System Preferences / Sharing, which made it necessary to always disable Remote Management. Now this is not necessary, as long as no VNC client tries to connect to the SEB client (in that case the according red lock screen is displayed and requires the quit/unlock password to be entered).
• Removed setting for disabling Local Storage (in Browser pane). Local Storage is now always enabled.
• Replaced key string mobileShowSettings with string showSettingsInApp in default settings.

Fixed SEB 2.2 issues in SEB 2.2.1:

• Cannot open Moodle Deeper Integration quiz by starting SEB with indirect sebs:// link.
• Browser Exam and Config Key are not displayed correctly first time opening Preferences/Exams.
• Allow to load configs from indirect sebs:// Links regardless of URL filter in client settings.
• Embedded SSL debug certificate doesn't work with wildcard domains.

IMPORTANT: SEB 2.2.1 for macOS uses a different policy to decide if it can be reconfigured when a seb(s) URL is opened and a .seb config file downloaded: When running in Secure Mode (a quit password is set in the currently active settings), SEB 2.2.1 cannot be reconfigured, even if it's using the persisted client settings. Earlier versions could always be reconfigured when using client settings. If you want to allow reconfiguring SEB by opening a seb(s) URL while running in Secure Mode, then you need to use the "Allow Reconfiguring" and "Reconfiguring Config URL" options in Preferences/Exam Session. For the same behavior as in previous versions, you can enable "Allow Reconfiguring" and set "Reconfiguring Config URL" to "*" (wildcard symbol, meaning any seb(s) URL or download URL of a .seb config file is allowed to reconfigure SEB) in your SEB client settings. This policy settings for reconfiguring are already used by SEB for iOS and will also be introduced in SEB 3.1 for Windows.

Other changes could also require you to change your SEB settings:

• Preset prohibited processes are required to be quit before starting an exam and are automatically added to any config you open with SEB 2.2.1. This doesn't alter the Config Key hash. The Browser Exam Key hash value is changed, but that key you anyways have to determine by loading the according SEB config file in SEB 2.2.1 and copy-paste the key from the Preferences/Exam pane. You cannot remove those preset prohibited processes, but you can deactivate them individually using their "Active" parameter. See the Preferences/Applications/Prohibited Processes pane. You can change other properties of the prohibited process, although not all of these parameters are used by SEB for macOS, currently only "Active", "Executable", "Identifier", "OS", "Force quit" and "Description" are used. You can't change "Executable" or "Identifier", if you do so, a new prohibited process entry is created internally (and visible next time you open those settings). There are two kinds of processes: Applications with a Bundle Identifier, which follows the reverse domain notation (for example org.safeexambrowser.Safe-Exam-Browser). SEB uses the Identifier parameter to detect those Application processes. BSD processes don't have a Bundle Identifier, they are only detected using the Executable property (process name). If you want to add prohibited processes to your settings, you can use the Activity Monitor macOS app: Select a process, press the info button (or cmd-I) and press the "Sample" button. In the sample output, you can identify the process name (SEB property "Executable", which can differ from the localized application name displayed by macOS in the Finder, Dock and Activity Monitor process name list. If the sample shows an "Identifier" in reverse domain notation (and not the identical string as the "Process" entry), then this process is an application with a Bundle Identifier and you should enter this bundle ID as "Identifier" in SEB's settings if you create a prohibited process. If "Identifier" from the sample output isn't in reverse domain notation, don't enter anything in the "Identifier" field in SEB's prohibited process settings, only enter the process name in "Executable".
  Only enable the "Force quit" parameter for prohibited processes in SEB if you are sure that student's won't loose unsaved documents if the process is terminated without a warning when starting SEB. Usually "Force quit" should not be used with applications: When "Force quit" is disabled, SEB will send a regular quit command to the application. Most applications will then either auto-save unsaved changes in open documents or ask the user if the document should be saved before quitting.
  By default, when the SEB setting "Attempt to quit prohibited applications" (Preferences/Applications) is enabled, then SEB tries to quit all running prohibited applications in this "nice" way, allowing them to save changes to open documents. If you disable this setting, then the user first has to confirm SEB trying to quit those running prohibited applications even in this "nice" way.
  BSD processes cannot be "nicely" quit, users either have to manually quit or disable them or use the "Force Quit" button displayed in the list of running prohibited processes displayed when SEB is starting. Please note that macOS restarts some background (daemon) processes automatically if they are force terminated. Those processes might have to be uninstalled (or temporarily deactivated using the command line in Terminal, as explained in this external article).

• New separate Mac setting for the Private Clipboard feature, Preferences/Security/"Enforce private clipboard on Mac" (settings key enablePrivateClipboardMacEnforce), by default enabled. If enabled, then the private clipboard is used, even if the old setting Preferences/Security/"Use private clipboard" is disabled. The reason for the separate Mac setting is, that enabling private clipboard in the Windows version sometimes causes web compatibility issues (which isn't the case in the Mac version). If you intentionally disabled "Use private clipboard" (key enablePrivateClipboard=false) for the Mac version, then you have to set enablePrivateClipboardMacEnforce=false in addition.

• New separate SEB for macOS settings for allowing screen capture/recording, window capture and to use the legacy method for blocking screen shots. SEB 2.2.1 for macOS is no longer using the old setting "Enable screen capture" which corresponded with the setting "Enable Print Screen" in Windows. Instead, these new settings allow to control access to the screen while SEB is running in a gradual way. The new setting "Allow screen capture/recording" (key allowScreenCapture) controls a system process, which since macOS 10.14 Mojave is used for the macOS screen recording feature (cmd+shift+5) and for screen shots. The new setting "Allow window capture (screen shots)" (key allowWindowCapture) controls if other processes are able to read the contents of the windows displayed by SEB. Depending which system APIs are used to read window or screen contents, those settings have a different effect: If allowScreenCapture=true and allowWindowCapture=false, then macOS screen shots using cmd-shift-3 and -4 can still be taken, but don't show SEB's windows (only the desktop background). On screen recording videos taken with cmd-shift-5, SEB's windows will still be visible, unless allowScreenCapture is set to false. When the new setting "Block screen shots (Legacy)" (key blockScreenShotsLegacy) is enabled, then SEB uses the method to redirect and delete screen shots which had to be used with macOS 10.9 and older. Those separate settings may allow to use SEB with specific remote proctoring solutions which need access to the screen and SEB's window contents.

• New SEB for macOS setting "Enforce blocking screen sharing on Mac" (key screenSharingMacEnforceBlocked, default value true/enabled), which overrides the original screen sharing setting "Allow (network) screen sharing" (key allowScreenSharing) on Mac clients. This allows for example SEB for Windows to be used in Windows remote sessions (RDP), while still blocking VNC-based macOS screen sharing and remote management on Mac SEB clients.

SEB 2.2 for macOS is a major update, improving security by blocking prohibited processes, adding new capabilities and offering full compatibility to enhanced integrations with learning management systems, like the one available in Moodle 3.9.

• Prohibited Processes settings for blocking specific processes and applications from running together with SEB.
• Preset prohibited processes covering communication, screen sharing and recording apps. Let us know if you would like to suggest applications and tools to be added to those preset prohibited processes (we need information about the software and its name and Bundle Identifier (if applicable).
• Added settings to allow to reconfigure SEB, even it is already running in a secure exam session.
• Implemented setting keys to control clearing cookies when starting/ending an exam session (examSessionClearCookiesOnStart / examSessionClearCookiesOnEnd). This can be used to keep users logged in from the previous session after an exam session was started (and SEB reconfigured with new settings).
• Added setting to enable Web Inspector (web developer tools) in Preferences/Browser (same settings key allowDeveloperConsole as in SEB for Windows 3.0. If enabled and right click isn't disabled (see Preferences/Security/Hooked Keys/Enable Right Mouse), you can right click/ctrl-left click on a web page element and open Web Inspector with 'Inspect Element'.
• Added Mac-specific settings for blocking screen shots and screen recording. The separate settings allow to run SEB correctly in parallel with some remote proctoring tools.
• Added separate Mac setting for the Private Clipboard feature.
• Added Mac-specific setting for blocking screen sharing over the network (VNC): key screenSharingMacEnforceBlocked (default: false, then the value of the existing key allowScreenSharing is used).
• Added all SEB for iOS settings in Preferences window.
• Fixed that a wrong Config Key was calculated because of specific new default settings added in a new SEB version. This was the cause why SEB 2.1.4 did not work correctly with the new SEB integration in Moodle 3.9.
• Fixed: Overriding check for specific processes in lock screen didn't work.
• Fixed: Client config encrypted with password wasn't compatible between Win vs. Mac+iOS.
• Fixed: Loading config file with different SEB admin password in Preferences didn't work.
• Fixed that an SEB config without proper MIME type wasn't recognized: Added "text/xml" as alternative MIME type for SEB config files when a seb(s) link is opened.
• Removed ARDAgent from detecting Remote Management: ARDAgent is running always when Remote Management is enabled in System Preferences / Sharing, which made it necessary to always disable Remote Management. Now this is not necessary, as long as no VNC client tries to connect to the SEB client (in that case the according red lock screen is displayed and requires the quit/unlock password to be entered).
• Removed setting for disabling Local Storage (in Browser pane). Local Storage is now always enabled.
• Replaced key string mobileShowSettings with string showSettingsInApp in default settings.

SEB 2.1.4 enhances exam security and improves usability. Please update soon, we don't support older versions anymore.

• SEB 2.1.4 is fully compatible with macOS 10.15 Catalina.

• The SEB application is now notarized and uses the Hardened Runtime security feature.

• Set default minimum required macOS version to 10.11 El Capitan. This means, if you want students to be able to use older macOS versions, you need to adjust that setting if you didn’t had it set in your config already (previous versions had macOS 10.7 as minimum default settings). SEB 2.1.4 still should run even on macOS 10.7, but we’re no longer testing it with such old versions. Also the WebKit browser engine depends on the macOS version. Many modern web applications won’t run correctly on old WebKit versions. Ideally don’t use macOS 10.10 or older. Consider recommending to or demanding from your students to use a macOS version which is still getting security updates from Apple. Until the release of 10.15 Catalina, this was macOS 10.12 Sierra, from now on the oldest version still getting updates is 10.13 High Sierra.

• SEB 2.1.4 uses the final implementation of the Config Key, to verify that an exam is using a correct, unmodified SEB configuration. The Config Key can be generated automatically by a compatible exam system together with the SEB config to be used for an exam. All SEB versions supporting the Config Key generate the same key, as long as the same SEB config file is used. Currently SEB for iOS supports the Config Key as well, the Windows version will follow later this year.

• Implemented key shortcuts for switching between open browser windows.
  Left Alt (Option) Key +Tab: Cycle forward through open browser windows
  Left Alt (Option) Key + Left Shift Key + Tab: Cycle backwards through open browser windows
  Right Alt (Option) Key (+ Right Shift) + Tab keeps the standard function (cycle through website elements).

• Custom App Controls and Quick Actions in Touch Bar, also with enabled Control Strip, are now disabled, even if BetterTouchTool is used. Added alert displayed while quitting SEB, for the case when App Control mode for Touch Bar can't be restored automatically. This dialog offers to open System Preferences / Keyboards, so users can change the setting back manually.

• Fixed Preferences / Exams in some cases displayed "Save settings to display its Browser Exam / Config Key" instead of the keys.

• Fixed: Media player app can block SEB with play button. The previous implementation didn't work properly on Mojave and newer.

• Selecting multiple files for upload is now possible, controlled by the HTML input element (multiple-attribute).

• Fixed downloads not working in macOS 10.14 Mojave or newer.

• Fixed downloading and opening of SEB config files defined inline on a webpage with "data:" didn't work.

• Fixed issue with the default ~/Downloads directory when running on Mojave or newer. If you created a SEB config file with a previous version of SEB, you might have to again select the Downloads directory in Preferences / Down/Uploads in case an error message is displayed when trying to download files is SEB.

• Implemented blocking macOS screen recording (cmd+shift+5) introduced in Mojave, controlled with setting Preferences / Security / Allow screen capture (key enablePrintScreen).

• Fixed: JavaScript confirm dialog doesn't return false when cancel (or any secondary) button is clicked.

• Don't display red lock screen for SEB process was stopped when Mac is set to sleep mode. Improved SIGSTOP detection in case system time is changed. Background of lock screen log view is again white also on Mojave.

• Removed global hotkeys for F3+F6 shortcut to open Preferences window (F3+F6 shortcut now only works if SEB is the active application). You can still also use the macOS standard shortcut for opening Preferences, which is cmd + , (comma key)

• Improved preventing a modal lock (SEB freezes) when a webpage tries to download a font (displaying a dialog hidden by SEB's kiosk mode). When SEB doesn't have the needed Accessibility permissions to close the dialog, it is now terminated after saving information on which webpage the font download was attempted (title and URL or placeholder). This is then displayed when SEB is started next time.

• When checking server trust with embedded certificates, resources in subdomains of already trusted domains are now trusted as well, according to behavior in other standard browsers.

• Fixed opening an seb(s) link which requires authentication from another browser while SEB is running subsequently can fail: When the temporary browser window for authentication was closed (windows close button), then SEB ignored further external (as from the other browser) calls to open an seb(s) URL.

• Fixed: Background of Dock buttons was highlighted when clicked and button was white instead of gray on Mojave or newer.

This version includes important security and stability improvements, updating soon is highly recommended.

• New "Config Key" feature allowing an exam system to verify that the correct settings are being used. The Config Key can be generated server-side and doesn't change if same settings are loaded in a new SEB version which adds new setting keys (the key is forward and backwards compatible).

• Added settings to disable Siri and dictation.

• Now blocking Touch Bar typing suggestions (predictive keyboard) during an exam.

• Now refusing to re-enter an exam which hasn't been submitted properly before, for example because the Mac was force-rebooted.

• URL filter now treats query strings consistently in SEB for macOS 2.1.3 and Windows 2.2.1.

• Implemented functionality for separate Allow Reload / Show Reload Warning / Allow Navigating setting for exam and new browser windows.

• Setting "enable right mouse button" now also works in SEB for macOS: Allows to use the right mouse button/context menu on special website elements.

• Now loading SEBClientSettings.seb also from the /Library/Preferences directory: This directory is valid for all users on a Mac and usually only writable with administrator rights. This improvement makes it easier to configure managed SEB clients which are used by multiple users.

• Fixed that SEB in some cases didn't switch off automatic spelling correction.

• The screen sharing detector now also works correctly when connecting to a Mac using Apple ID (Back to My Mac).

• Improved startup process: Now client settings saved persistently on the Mac are not considered at all when starting SEB by opening a config file or config link.

• Fixed that double clicking a .seb config file several times could lock SEB.

• The About SEB splash screen now cannot hide alerts and lock SEB if those were displayed modally.

• Fixed modal lock when webpage tries to download a font.

• In case SEB cannot terminate an implicitly prohibited process (trying to display an overlay/panel window), a lock screen is displayed requiring to enter the quit/unlock password.

Note: The final release build number is 29E7.