Hey there,
I edited a /bin/bash script that automatically checks the devices uptime and tells the user to restart his computer after 2weeks uptime (with the help of https://www.jamf.com/jamf-nation/discussions/17336/user-has-not-restarted-in-x-number-of-days)
The following part generates the ""jamf" wants access to control "system events"" message for end users:
#!/bin/bash
# Discover logged in user
user=`stat -f%Su /dev/console`
#Execute code as logged in user (instead of root)
sudo -u $user /usr/bin/osascript <<-EOF
tell application "System Events"
activate
set question to display dialog "The device has not been restared for [...]"
with title "RESTART YOUR COMPUTER" buttons {"Shut Down", "Restart", "Cancel"} ¬
cancel button "Cancel" with icon caution
set answer to button returned of question
if answer is equal to "Shut Down" then
tell application "System Events"
shut down
end tell
end if
if answer is equal to "Restart" then
tell application "System Events"
restart
end tell
end if
if answer is equal to "Cancel" then
return
end if
end tell
EOF
exit 0
fiI already read the thread (https://www.jamf.com/jamf-nation/discussions/30388/loginwindow-wants-access-to-control-system-events) but couldn't find the solution there.
The issue seems to be the tell / end tell statement but I can't find a way to change the script.
I tried several PPPCs and gave JAMF access to Accessibility, System Events and everything else that's required.
The script itself works fine.
Can someone help me out here?
Hey!
For testing purposes I tried the following:
I
I know that most permissions are unnecessary, just wanted to be sure nothings missing.
I just did the following:
and the issue still exists.
Thanks for the input anyway!
On my testing machine under "System Preferences" -> "Profiles" the following Profiles are shown:
JAMF:
JamfAgent:
osascript:
So this doesn't seem to be the issue.
I already tried to reset the permissions of my testing machine with:
tccutil reset AppleEvents; tccutil reset SystemPolicy AllFilesto make sure there were no changes specifically on my testing machine that cause the issue.
I still can't figure out why it doesn't work - especially now that I know it works on @mm2270 's machine.
Does your profile look anything different? Also, it works when I run it in terminal, just not when I run it remotely via jamf policy.
If you run the script locally/manually and leave the display box there, AppleScript will time out after 2 minutes.
That is what you are getting on the error message, end users not "actioning" the request, they may be away from the computer for example.
A possible solution is to add a "giving up" parameter, capture the output and do some logic with it.
Example from your script.
use AppleScript version "2.4" -- Yosemite (10.10) or later
use scripting additions
tell application "System Events"
activate
set question to display dialog "The device has not been restared for [...]" with title "RESTART YOUR COMPUTER" buttons {"Shut Down", "Restart", "Cancel"} ¬
cancel button "Cancel" with icon caution giving up after 5
if gave up of question is false then
set answer to button returned of question
if answer is equal to "Shut Down" then
tell application "System Events"
shut down
end tell
end if
if answer is equal to "Restart" then
tell application "System Events"
restart
end tell
end if
if answer is equal to "Cancel" then
return
end if
else
set isActioned to "Not there"
end if
end tellA note about the "Cancel" button, the way it is set it will stop and exit the script at that point, it will not run to the end.
I would recommend a small change to allow the script to run.
use AppleScript version "2.4" -- Yosemite (10.10) or later
use scripting additions
tell application "System Events"
activate
set question to display dialog "The device has not been restared for [...]" with title "RESTART YOUR COMPUTER" buttons {"Shut Down", "Restart", " Cancel"} ¬
with icon caution giving up after 10
if gave up of question is false then
set answer to button returned of question
if answer is equal to "Shut Down" then
tell application "System Events"
shut down
end tell
end if
if answer is equal to "Restart" then
tell application "System Events"
restart
end tell
end if
if answer is equal to " Cancel" then
return
end if
else
set isActioned to "Not there"
end if
end tellIf you must use Cancel add a space to it " Cancel" that bypass the internal Cancel function of the script and allow the flow to continue. Of course you could call it "Not Now".
Regards
Are you on 10.11? Small note from the bottom of the release notes
You'll want your PPPC profile to allow
/Library/Application Support/JAMF/Jamf.app
Hey @jbutler47 , I exactly followed your steps and uploaded the following profile:
The profile was rolled out on my testing machines and I double checked if the profile was there. Then I waited until the next recurring check-in (15min).
The issue still exists. I did not try it with Self Service as thats not the intended use in the end (it should run with a recurring check-in).
We have been seeing a similar issue. It appears that if, at some point, a/the user has selected "Don't Allow" when they see the "Jamf wants access" message then the script will never work regardless of what you do. If the user has denied the Jamf System Events that setting appears to be persistent and pushing a config profile after the fact does not resolve it the problem. I'm not yet certain if the denial is a per user issue or a system wide issue.
On a test machine I've been able to run tccutil reset AppleEvents then push out a PPPC allowance for Jamf.app - System Events. After that a script we have that runs osascript will work. Here's the settings I made in the PPPC utility for /Library/Application Support/JAMF/Jamf.app
It would be useful to know if clearing the System Events works for anyone else.
Having all 3 items including allowing all the Apple Events allowed me to bypass the osascript prompt @leonwun .
I think I have this figured out. I was running into this exact problem while attempting to use osascript to remove Bluetooth devices from our loaner computers. I fixed this using a PPPC, see below:
I wasn't able to navigate to these files inside of the PPPC Utility, instead I had to open up the files in Finder and drag them into the PPPC Utility window. Add these files:
-- /Library/Application Support/JAMF/Jamf.app/Contents/MacOS/Jamf
-- /Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService
-- (Right Click on Jamf.app and select "Show Package Contents" to get to these files)
Make sure to reference them inside of the Apple Events section as well.
Why not just add Jamf.app? I don't know. You would think that would work, but I could only get it to work by digging down to these specific files.
I hope this helps someone.
