Casper and El Capitain

mattstocum
New Contributor III

Not that I expected it to work, but I did just confirm that Casper does not work with El Capitain beta 1. With the new security settings on OS X, /usr/sbin (along with a number of other system directories) are now read-only, even for root. I haven't tested installing with the new security restrictions disabled yet, right now I'm just trying to figure out what isn't working.

At least I'm completely confident JAMF will have an update out for us when El Capitain ships this Fall, unlike some other vendors I have to deal with...

18 REPLIES 18

Aziz
Valued Contributor

mattstocum
New Contributor III

I figured they would be as soon as WWDC was over. There's a couple really nice features for MDM in 10.11 and iOS 9 (assigning apps to devices not users, skip account creation during setup, etc.)

For now for anyone who is testing, disabling Rootless with "sudo nvram boot-args=rootless=0" does seem to fix things. At least it's working in the VM I'm using to test El Cap, since I'm nowhere near crazy enough to put it on real hardware yet. Sophos AV/SafeGuard and VMware Tools also are getting bit by Rootless.

scottb
Honored Contributor

I tried to enroll an El Cap Mac but it failed (9.72). That's as far as I went - it was more a curiosity. I didn't upgrade a current Mac to see what would happen and I likely won't until the next build or two.

jjones
Contributor II

I just updated a currently enrolled mac to El Cap, it is still enrolled and can do recon reports, however it does error at the end:

2015-06-11 09:49:33.318 jamf[2197:37610] -[NSError init] called; this results in an invalid NSError instance. It will raise an exception in a future release. Please call errorWithDomain:code:userInfo: or initWithDomain:code:userInfo:. This message shown only once.

It was able to send the report to the jss, and the jss is reporting the mac as 10.11.0 I was able to remove/add configuration profiles without issue, self service is functioning properly. I don't see anything at issue besides the recon error so far (knock on wood)

dgreening
Valued Contributor II

Can someone check to confirm whether the Restrictions Config Profile bug which causes Safari Autofill to be mandated when "Allow Safari Autofill" is checked is resolved in 10.11.0. The user should be able to select their Autofill settings when this is enabled. It looks that way on my test box...

mm2270
Legendary Contributor III

Yes, I had the same results. I upgraded an existing enrolled Mac and it can submit inventory and check ins just fine, but does note the same error at the end that @jjones posted.
So far I also see everything working fairly well despite this being essentially beta 1. I haven't tried to enroll a newly set up 10.11 Mac, but sounds from above like that won't work right now.

My guess is JAMF probably won't need to do a major amount of work to get the JSS to at least work correctly with 10.11.
Supporting new features will be a different story of course.

Edit: OK, spoke a little too soon. We're on JSS 9.65 and looks like Self Service isn't really working. I can run policies from it, but every one of them fails immediately with an error. We'll be updating our JSS to 9.72 in a couple of weeks, so we'll see if its just the 9.65 version or something else.

davidhiggs
Contributor III

@mm2270 i'm seeing the same results as you on 9.72

jjones
Contributor II

@davidhiggs @mm2270 forgot to mention we are running 9.72, so it is an issue that Jamf will have to fix before anyone really continues.

mm2270
Legendary Contributor III

@jjones Yeah, I've basically stopped testing anything Casper related against 10.11. Lots of stuff not working right that I didn't initially see, so no point in doing any more with it until some updates come out.

ZachB
New Contributor

Has anyone tried using a quick add package in 10.11?

chriscollins
Valued Contributor

@ZachB Tried it but yeah it won't work. /usr/sbin/ is where the jamf binary gets installed to normally. That is one of the directories that the new protection system doesn't let 3rd parties write into so it will just immediately fails to install. JAMF will have to move that binary to another location on the system like /usr/local/bin/

scottb
Honored Contributor

@ZachB I did as well (see above) in 9.72. No luck. The new security settings that @chriscollins mentioned are most likely why. We'll see what happens to change this or get around it. Likely a lot more to come in regards to this as there are some big changes it looks like...

bentoms
Release Candidate Programs Tester

I sent the link that @Abdiaziz poated to my AM to register interest in the Beta program.

We should all do this, there are a number of under the hood changes to 10.11 that are going to take some time to workaround.

peterlbk
Contributor

Just moved both binaries on my El Cap to /usr/local/bin and rebooted. All works fine, except recon. That one is still giving the same problems:

[NSError init] called; this results in an invalid NSError instance....

I did have to install and enroll manually though. No quick add package support

jwojda
Valued Contributor II

@peterloobuyck you got C.Admin working on 10.11? Mine errors out with your above message which makes testing 10.11 more difficult (the best way I know to test an OS is to use it for my day-to-day activities).

peterlbk
Contributor

i still get the recon errors. But when i do a recon, manually the inventory is update on the jss. I tested this by removing an app. Then re-ran recon and the app was gone in the inventory.

Also check out this post https://jamfnation.jamfsoftware.com/discussion.html?id=15299 from @bradtchapman

jacbgla
New Contributor II

Hi, Just started testing 10.11, however when i launch the Casper Admin, i get the following error message - any ideas what is causing this? 10.10 is working fine for us.

70a046d03d834271b37c5ae91da98cd5

pdye
New Contributor II

I'm getting the same thing on my system.

It worked fine when it was on Yosemite. I did do just the "upgrade" to El Capitan, but I get the same error.