Skip to content

Safe Exam Browser 3.7.1 Beta 3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@danschlet danschlet released this 27 Aug 22:26
3.7.1b3
d21d375

Release notes for Safe Exam Browser version 3.7.1 for macOS:

SEB 3.7.1 adds the option to require specific SEB client versions in a configuration, allows fetching server certificates by URL in settings, and contains a security fix for certificate validation as well as several permission-handling and stability fixes.

New in SEB 3.7.1b3 (Build 159CD)

  • Fixed the Full Disk Access and Location Services permission dialogs being inaccessible when reconfiguring from one Classic kiosk mode session to another: the dialogs were shown while the previous session's kiosk mode still covered the screen, so System Settings stayed hidden behind SEB and SEB took input focus back when the user tried to interact with it, making it impossible to grant the permission. While such a permission dialog is displayed, SEB now temporarily downgrades the Classic kiosk mode to allow switching to System Settings, brings the relevant System Settings pane to the foreground, and restores the kiosk mode once the permission has been granted or the dialog is dismissed.

  • Fixed Location Services not being requested when reconfiguring into a Classic kiosk mode session, so the Wi-Fi control showed that access wasn't granted without ever prompting for it. SEB now requests Location Services (when needed to display Wi-Fi network names) on such a reconfiguration, as it already did on the initial launch and when starting the AAC Assessment Mode.

  • Fixed SEB still taking input focus back from the genuine Apple-signed macOS SecurityAgent dialog (for example the keychain prompt shown when connecting to a Wi-Fi network) in situations where the system reported the change without a workspace notification. SEB now leaves this system dialog in the foreground in these cases as well.

  • Fixed holding the Option key while starting SEB not opening the Settings window when SEB was launched with deployed client settings (a SEBClientSettings.seb in the /Library/Preferences/ folder). Holding the Option key at launch now opens Settings in this case too (if allowed in the client settings), instead of always starting a session.

  • Added explanation about the Detect Accessibility Apps feature and Full Disk Access. Updated localizations.

New in SEB 3.7.1b2 (Build 15999)

  • Detecting apps with Accessibility permissions (setting detectAccessibilityApps) requires Full Disk Access to read the system permission (TCC) database. On macOS 11 the system does not grant apps read access to this database even when Full Disk Access is enabled, so this detection is now only performed on macOS 12 and newer. On macOS 11 SEB no longer shows a Full Disk Access prompt that could never be satisfied and starts normally (the accessibility app detection is simply unavailable there). Accordingly, the default minimum required macOS version has been raised to macOS 12.

  • Fixed Full Disk Access detection so SEB reliably recognizes when Full Disk Access has been granted (on macOS 12 and newer).

  • Fixed several permission and information dialogs (Full Disk Access, Location Services and the "minimum macOS version required" alert) not being displayed — or SEB freezing or continuing without waiting for the user — when running under the AAC Assessment Mode on macOS 11. These alerts are now shown reliably and correctly block the session start.

  • Fixed the Location Services permission dialog not closing automatically on macOS 11 once access is granted in System Settings.

  • Fixed an unnecessary Location Services permission dialog briefly appearing on macOS 11 even when access was already granted.

New in SEB 3.7.1b1 (Build 1598E)

  • Added "Allowed SEB Versions": exam administrators can now require that a configuration may only be used (and an exam only attempted) with one or more specific SEB client version(s). If the SEB version running on the device doesn't match the requirement, SEB displays an alert stating which version(s) are required and offers to open the SEB download page ("Download SEB") or to quit; in both cases SEB is quit, so it can't be used for the exam with a disallowed version. The requirements are configured in Settings / Security (see the new setting sebAllowedVersions below).
    As this feature will only make sense when there will only be SEB macOS clients circulating which support the version check and because that is more secure, you should preferably use server-side SEB client version restrictions.

  • Added fetching server certificates by URL in Settings / Network / Certificates: certificates to embed can now be retrieved directly from a URL.

  • Fixed improper certificate validation (CWE-295): removed the "authorized hosts" substring fallback in the server-trust evaluation, which could accept a certificate for a host whose name merely contained an authorized host name as a substring. Server trust is now matched correctly.

  • Fixed a crash when opening the Advanced Certificates sheet in Settings / Network / Certificates.

  • Fixed Full Disk Access permission detection on macOS 12 and 11. System permission prompts are now requested while the AAC Assessment Mode is off, and Full Disk Access is checked before requesting download/log folder access, so the prompts are shown reliably and aren't hidden behind the locked-down UI. Also the authorization dialog is no longer displayed when starting SEB with pressed option key (which displays Settings instead of starting a session).

  • Location Services access is now only requested when actually needed (to display Wi-Fi network names), when displaying the Wi-Fi control isn’t disabled and while SEB isn't locked down, so users aren't prompted unnecessarily.

  • Replaced the preset permitted process for the Cisco Secure Client with AnyConnect, which works when it is connected before starting SEB.

New Settings

sebAllowedVersions — Array of strings, default empty (no restriction)
Settings window: Security → "Allowed SEB Versions"

Specifies one or more SEB client versions required in order to use a configuration. Enter one restriction per row. Each restriction has the format OS.Major.Minor.[Patch].[Build].[AE].[min], where the parts in square brackets are optional:

  • OS — the operating system: Win, Mac or iOS.
  • Major, Minor — the major and minor version (required).
  • [Patch], [Build] — optionally the patch and build version.
  • [AE] — optionally indicates the Alliance Edition.
  • [min] — optionally marks the value as the minimum required version (this version or any newer one); without it, the restriction is an exact match on the components you specified.

Examples: Win.3.9.min allows all SEB for Windows versions from 3.9 upwards; Mac.3.7.1 requires exactly SEB for macOS 3.7.1.

Only restrictions for the platform SEB is running on can allow the current build; a non-empty list that contains no satisfiable restriction for the running platform blocks it. When the running version isn't allowed, SEB shows an error message describing the requirement — phrased as a minimum ("… or higher") or as one or more specific versions, as configured — with a link to the SEB download page.

Assets 4
Loading