Velocity - Mac - Is Full Disk Access Required?

[angelanorwood]

Deployed Velociraptor via shell scripts with Intune, however, Security is asking that we grant full disk access. Before attempting this - can someone advise if this is required? (Would think that if this access was required, it would have been included in the deployment docs)
Thanks in advance,

[scudette]

Deploying any software on Macs is a pain and usually requires some MDM solution like Jamf. Velociraptor needs a lot of preparation like preparing TCT policies and signing etc.

The gory details are outlines in this presentation
https://docs.velociraptor.app/presentations/2022_velocon/#mac-response--the-good-the-bad-and-the-ugly

I will add a note to the docs site to help point people to the right place.

[angelanorwood]

I did watch the presentation and got some good info - but not the CLI version of FDA deployment. We are using Intune for the MDM and shell scripts to manage our Macs and have tried several methods to obtain FDA - including a configuration profile (includes name, ID type (you can choose path or bundle ID), identifier (path or bundle ID), code requirement - this is the identifier obtained after codesign command. Lastly, adding the "full disk access as allow". While this deploys successfully, it does not show in settings>privacy & security>full disk access. Have also tried deploying a Plist - (this was used for MS Defender successfully), however I believe the payload identifier is the issue - where velociraptor is a binary and doesn't have a bundle ID. We can apply the FDA via settings w/user intervention; however, this obviously isn't a preferred method.

[scudette]

The binary is signed with an identifier

$ codesign -dv ./velociraptor-v0.7.1-2-darwin-arm64
Executable=/Users/mic/Downloads/velociraptor-v0.7.1-2-darwin-arm64
Identifier=com.velocidex.velociraptor
Format=Mach-O thin (arm64)
CodeDirectory v=20500 size=474406 flags=0x10000(runtime) hashes=14819+2 location=embedded
Signature size=8970
Timestamp=15 Feb 2024 at 12:33:53 pm
Info.plist=not bound
TeamIdentifier=UL6CGN7MAL
Runtime Version=12.1.0
Sealed Resources=none
Internal requirements count=1 size=188

See this #3272 as well.