Managed Reports Runner App

Managed Reports Runner App

/Applications/Utilities/Managed Reports Runner.app is the GUI for the client. Its main executable is ReportMateApp (bundle id com.github.reportmate), and it does every privileged action through ReportMateHelper, a root LaunchDaemon the package installs. Standard users can open it, see the settings, start a collection and read the logs without an administrator password.

The window has three toolbar tabs: Prefs, Run and Logs.

Prefs

Prefs edits the settings in /Library/Preferences/com.github.reportmate.plist: ApiUrl, DeviceId, Passphrase, ValidateSSL, CollectionInterval, LogLevel, StorageMode, Timeout, OsqueryPath, OsqueryExtensionPath, ExtensionEnabled, UseAltSystemInfo and EnabledModules.

• Values are read straight from the plist file rather than through cfprefsd, so the window shows what the daemons see.
• Edits save automatically 0.75 s after the last change. Clearing a text field removes the key.
• A key a configuration profile forces shows the forced value with a lock and cannot be edited. A forced EnabledModules locks the module cards and shows Managed by MDM.

The other runner settings (ApiKey, CompressPayload, MaxRetryAttempts and the timeouts) are not in the window; set them with defaults, a profile or the environment. See Configuration.

Run

Run starts a collection of the selected modules and streams the runner's output into a console, coloured by level. The app always runs the CLI at -vvv, with --run-modules <selected> when any module is selected. A Debug checkbox hides or shows debug lines, Stop ends the run, and the run status turns red or orange when the run logged errors or warnings.

If the helper cannot be reached, the app falls back to launching the CLI itself and says so in the console. That direct run is not privileged, so it only succeeds when the app itself is running as root; otherwise the CLI stops with ERROR: You must run this as root!.

Logs

Logs lists every .log file in /Library/Managed Reports/logs in reverse name order and shows the selected file with each line coloured by level. When the folder holds no logs yet, it says so instead of showing an empty pane. See Logging for what each file is.

The privileged helper

Item	Value
Binary	.../Managed Reports Runner.app/Contents/MacOS/ReportMateHelper
LaunchDaemon	/Library/LaunchDaemons/com.github.reportmate.helper.plist
Mach service	com.github.reportmate.helper
Logs	Unified log, subsystem com.github.reportmate.helper

launchd starts the helper on demand when the app connects. It enforces four rules, defined in HelperPolicy and covered by unit tests:

1. Who may connect. Only the app with signing identifier com.github.reportmate, signed by the helper's own Team ID. The requirement is checked by the system on every message, so a recycled PID cannot impersonate the app. An unsigned or ad-hoc signed helper has no Team ID and rejects every connection, so the GUI needs a signed build.
2. What it runs. The CLI at /Applications/Utilities/Managed Reports Runner.app/Contents/MacOS/managedreportsrunner, only with -v, -vv, -vvv and --run-modules followed by a list of lowercase module names. It refuses to run the CLI unless the binary and every folder above it are real directories, owned by root and not writable by anyone else (group write is tolerated for wheel and admin).
3. What it writes. Only the thirteen keys Prefs edits, only in the com.github.reportmate domain, at system level.
4. What it leaves alone. A key a configuration profile manages is never written or removed. The helper checks both CFPreferencesAppValueIsForced and the file /Library/Managed Preferences/com.github.reportmate.plist directly, because a long-running helper keeps the managed layer it saw at launch and would otherwise miss a profile installed later.

To confirm the helper is loaded:

sudo launchctl print system/com.github.reportmate.helper