Disable Terminal in macOS

[bogdanw]

I have the same issue/request.

Have you tried Santa?

Santa can block Terminal.
View attachment 2006577
As Santa is managed through Terminal with santactl, the only way to reenable Terminal is to delete Santa (requires admin password) and reboot.
https://github.com/google/santa
https://santa.dev/details/rules.html

 

[LuluMom]

Have you tried Santa?

I'd like to try Santa but, full disclosure, I think configuring is beyond my technical abilities!

 

[bogdanw]

I'd like to try Santa but, full disclosure, I think configuring is beyond my technical abilities!

I’ve just tested on Monterey 12.5.1 (21G83):
1. Download the latest Santa release from https://github.com/google/santa/releases
At the moment santa-2022.8.dmg https://github.com/google/santa/releases/download/2022.8/santa-2022.8.dmg
(you can scan the dmg on https://www.virustotal.com)
2. Open the dmg and install santa-2022.8.pkg
3. Grant permission in System Preferences – Security and Privacy for the Santa extension (See https://support.apple.com/en-us/HT210999 for more details)
4. Open Terminal, check if santactl is running with

santactl status

If it returns an error, try restarting your Mac.

Create a new rule to block Terminal

sudo santactl rule --block --path /System/Applications/Utilities/Terminal.app

Check the rule for Terminal

santactl fileinfo /System/Applications/Utilities/Terminal.app

Close Terminal and any user that tries to start it will be displayed this message.


An admin user can remove the rule and re-enable Terminal by running from Script Editor (Applications/Utilities/Script Editor.app)

do shell script "/usr/local/bin/santactl rule --remove --path /System/Applications/Utilities/Terminal.app" with administrator privileges

 

[LuluMom]

@bogdanw These are fantastic directions. Thank you! Unfortunately, I cannot get beyond the error message (have restarted multiple times). This is the message I am getting:

An error occurred communicating with the daemon, is it running?

 

[bogdanw]

This is the message I am getting:An error occurred communicating with the daemon, is it running?

Try to disable SIP.
From Apple:
“To disable SIP, do the following:
Restart your computer in Recovery mode.
Launch Terminal from the Utilities menu.
Run the command csrutil disable.
Restart your computer.”
https://developer.apple.com/documen...ling_and_enabling_system_integrity_protection

You can re-enable SIP after setting the rule for Terminal.

 

[tabulrasa]

Try to disable SIP.
From Apple:
“To disable SIP, do the following:
Restart your computer in Recovery mode.
Launch Terminal from the Utilities menu.
Run the command csrutil disable.
Restart your computer.”
https://developer.apple.com/documen...ling_and_enabling_system_integrity_protection

You can re-enable SIP after setting the rule for Terminal.

thanks for the write up

But reenabling SIP resets everything and santa no longer blocks terminal because of apples crappy insistence on snapshots.

Any alternative ways to block it?

 

[bogdanw]

Giving com.google.santa.daemon Full Disk Access in System Settings – Privacy & Security - Full Disk Access should now take care of the message “An error occurred communicating with the daemon, is it running?”

Tested in Ventura 13.5 (22G74) with SIP enabled, Santa version v2023.6

 

[tabulrasa]

Giving com.google.santa.daemon Full Disk Access in System Settings – Privacy & Security - Full Disk Access should now take care of the message “An error occurred communicating with the daemon, is it running?”

Tested in Ventura 13.5 (22G74) with SIP enabled, Santa version v2023.6
View attachment 2240053

Wizard! It works, thank you @bogdanw

 

[tabulrasa]

Giving com.google.santa.daemon Full Disk Access in System Settings – Privacy & Security - Full Disk Access should now take care of the message “An error occurred communicating with the daemon, is it running?”

Tested in Ventura 13.5 (22G74) with SIP enabled, Santa version v2023.6

Is there a way to block scripteditor too? I get errors about some sort of certificates

 

[bogdanw]

Is there a way to block scripteditor too? I get errors about some sort of certificates

Sure, block Script Editor first, then Terminal.

sudo santactl rule --block --path /System/Applications/Utilities/Script\ Editor.app

A new version of Santa has been released v2023.7 https://github.com/google/santa/releases