Blocking Roblox

[morcutt]

Work for a public school district, use MacBook Airs for students, and of course Jamf Pro to manage them. Students keep finding ways to play Roblox. We've restricted every variation of the word "Roblox" and all the installers in Restricted Software. Seems like all they need to do is rename the app (for instance, to "easy" or "easy.app" or even just a letter, "g" or "g.app") and it is able to open. Any ideas?

[sdagley]

@morcutt If you get the process name for the executable binary inside the Roblox app (right-click on the app, select Show Package Contents, look for the executable file inside the Contents/MacOS folder in the Roblox package) and block on that in your Restricted Software configuration instead of .app it'll block no matter what the app is named.

[morcutt]

Hey, thanks for the reply. Unfortunately, it seems they're going into the MacOS folder and changing the name of the executable file as well. We're going to block all domains associated with Roblox in our web filter, which wont stop the app from opening but will hopefully stop it from reaching the network/Roblox servers, but it would be nice to have a Jamf solution as well.

[sdagley]

@morcutt If the Roblox app is signed by Apple, and you have the requirement that apps must be signed, then it'd be impossible to bypass the process name block by changing the executable name.

[mm2270]

That doesn't seem possible. Are you sure they're renaming the executable? The way almost all macOS apps are built, you can't change the executable and still get the application to work. I think something else is going on here. Can you confirm that you've changed your Restricted Software item to block only the executable name (should NOT have a .app at the end of the string) and applied to a device and it's still opening the application?

[snowfox]

@morcutt sdagley is correct.  Block the actual process name Roblox and it wont matter what they rename files to.  The process running in memory will still be named Roblox and will be killed as soon as it tries to run.