Skint 1.08
a system security utility
to check key settings daily

Skint is an app for macOS Monterey and later that checks whether:
	– SIP is enabled
	– SSV is enabled
	– Gatekeeper/XProtect checks are enabled
	– XProtect is up to date
	– XProtect Remediator is up to date
	– Skint itself is up to date
	– the installed macOS is up to date for its major version
	– XProtect Remediator scans are recorded in the log over the last 36 hours, and whether they reported anything abnormal.

It runs all those checks when you open the app, and reports any problems found, as well as showing a coloured traffic light in its window and changing its Dock icon. This is green when everything is fine, amber (orange) for issues that you should attend to, and red for serious problems that need to be addressed.

When you’ve fixed or updated a previously reported problem, you don’t need to quit and restart Skint: use the Run Checks command in the Window menu, shortcut ⌘1, and Skint will run its full set of checks again. You can also run checks from the Dock Menu. This doesn’t alter the time of its next automatic checks, which will proceed as normal.

If you want Skint to run from a menu bar item, then run SkintM instead of Skint: that doesn’t appear in the Dock, and reports through the items listed for its menu instead of a window.

Skint is only 2.6 MB on disk, takes less than 30 MB of memory, uses no CPU in between its checks, uses App Nap, and doesn’t prevent sleep. Its only network connection is its daily check of the property list containing current version numbers on my GitHub at skint1.plist

Use

Move the app to one of your Applications folders, and open it. Skint will then run its first set of checks, and set a timer to repeat those about 24 hours later. As long as you keep the app open, it will continue to run its checks every 24 hours, report each to its window and change its Dock icon to reflect the results. If you like, you can add Skint to your Mac’s Login Items, in System Settings > General > Login Items, or you can just run it when you want to.

Report and Actions

Skint doesn’t waste your time with long reports. If all its checks complete normally, all you’ll see is a green traffic light, five green checkmarks, and a brief report such as:

No updates needed.
XPR checks OK.
Completed at 2024-01-28T19_42_02Z

You can copy and paste that text if you wish to keep a record.

macOS

Skint checks that your Mac is running the current minor version and patch of the major version of macOS installed on it. If either is older than the current one, it will point that out to you, so you can update using Software Update. It also tolerates running beta-releases of the next macOS updates by noting that a pre-release version is running. When macOS is up to date, the macOS section will have a green checkmark ✅.

Note that Skint is as happy as you are if your Mac is still running Monterey, Ventura or Sonoma, but does encourage you to keep up to date with their security updates.

SIP

System Integrity Protection (SIP) provides additional protection for system and some other critical files, including many that aren't part of the SSV, and supports other features such as hardening, used by notarised apps. Sometimes it's necessary to disable it, and you may forget to enable it afterwards. It's also a common requirement to be able to use Open Core Legacy Patcher (OCLP) on older Macs, in which case you'll need to leave it turned off. This is included in the group of tests for Protection.

To enable SIP, start your Mac up in Recovery, enter Terminal there, and use the command
csrutil enable; reboot
When you press Return, your Mac will restart with SIP enabled. Apple silicon Macs will then normally need to be started again in Recovery, and Startup Security Utility used to return their Boot Security to full.

SSV

The Signed System Volume (SSV) was introduce in Big Sur, and has greatly improved security and reliability of macOS. In the great majority of Macs, Skint should be able to confirm that the SSV is enabled. It may be necessary on older models using OCLP to disable this, but Macs that run supported installations of macOS 11 or later should always have it enabled. In some cases, when there's more than one bootable system available to a Mac, Skint may be unable to assess SSV status:
	– if it’s an Intel Mac, there’s no alternative method available to check that, so it may simply report that it can’t check the status of the SSV;
	– if it’s an Apple silicon Mac, then Skint will try an alternative method, which works well when its primary language is any form of English; however, that doesn’t work when you run your Mac in another language, in which case Skint will simply report that it can’t check the status of the SSV.

This is included in the group of tests for Protection.

If the SSV isn't enabled, you'll need to change settings in Startup Security Utility (in Recovery), or install macOS again.

Gatekeeper/XProtect checks

When Gatekeeper and XProtect are enabled, security checks are made on all executable code and apps when they're run, to ensure they don't contain known malware. You shouldn't need to disable that, but if you do an forget to turn it back on, enter the command
sudo spctl --global-enable
which requires you to authenticate using your admin password. Be careful with that command: the hyphens before global-enable aren’t long dashes, but two separate hyphens. That doesn't need to be done in Recovery, and should have immediate effect.

This is included in the group of tests for Protection.

XProtect

XProtect is a bundle containing security data used by macOS during Gatekeeper checks. Apple updates that data relatively frequently, and Skint checks that the version installed is the latest. If it isn't, use SilentKnight to check for and install an update. This is included in the group of tests for Updates.

Note that XProtect has changed in Sequoia. Although checks performed by Skint should remain accurate, updating XProtect is now quite different, and the old bundle appears to be unused. See SilentKnight version 3 for further information.

XProtect Remediator

XProtect Remediator (XPR) is separate, and every day or so runs scans to detect known malware on your Mac, and remediate any found. Skint runs two checks, the first to ensure this is up to date. If it reports that XPR is out of date, use SilentKnight to check for and install an update. This is included in the group of tests for Updates.

When XPR runs its scans, it doesn't alert you if it detects or remediates any malware, but records that in the log. Skint checks your Mac's log for the last 36 hours for results of those scans. If it reports any irregularities, use XProCheck to obtain full details so you can decide what to do. Obtaining those log extracts requires that you run Skint from an admin account; if that's not possible, there is an option to skip checking XPR's scans, as explained later.

The most common reasons for not finding any XPR scan reports are that your Mac hasn't been awake but inactive at the right time for the scans to run, or that its log records don't go back far enough to find them. When this version of Skint can't find any scan records in the last 36 hours, it now reports how long the log records are. If they're less than 24 hours, then records may already have been removed from the log. You can then run XPR manually using XProCheck if you wish, or adjust the time that Skint checks your Mac.

XPR scans are normally run at about the same time each day, when your Mac is awake but is not being used. You can work out when they're being run by checking more often with XProCheck; when you've found them, quit Skint and open it an hour or two after the time that the next scans are run. Then in its daily check, Skint should still be able to read the reports from the last XPR scans. This is reported in the XPR Scans item, with a green checkmark ✅ if they’re OK.

Connection problems

Skint has to make a single connection to obtain version and other data from my GitHub server. Like all remote connections, that can fail sometimes, in which case it will be unable to obtain the data to perform useful checks. When that happens, you will be warned that Skint couldn’t get data for XProtect and/or XProtect Remediator, and the traffic light will be shown in red. You can then either quit Skint and run it again to see if it connects properly, or leave it until it makes its next routine check in 24 hours. Such connection problems should be very unusual.

Skint updates

Each time Skint runs its checks, it also looks to see whether a new version of Skint is available. If it is, it will offer to download that version from this blog using your default browser. This is reported in the Skint item, with a green checkmark ✅ if Skint is up to date.

Preferences

Skint's preference file ~/Library/Preferences/co.eclecticlight.Skint contains three settings you can change using a Property List editor. Avoid trying to change these using a text editor, as they are managed by cfprefsd and those are likely to fail.

To disable XPR log checks, set the key dontXPR to <true/> To help you do this, a copy of the property list is supplied with the app.

To change the frequency at which Skint's checks are run, set the key updateCheckInt to the number of seconds between checks. The default is 86400, which is 24 hours. Setting it to less than 1 will return it to the default.

To change the tolerance for when checks are run, set the key updateCheckTol to the number of seconds. The default is 300, which is 5 minutes. Setting it to less than 1 will return it to the default.

Each time that Skint runs a set of tests, those results are saved to its preference file. Further details of this are provided separately.

Links to Product Pages:
SilentKnight
XProCheck

To do:
	– support for RSRs. Currently Skint will merely state that an RSR has been released, and can’t check whether it has been installed
	– a widget.

Version history

1.08:
	– compatible with XProtect in Sequoia.

1.07:
	– fixes auto-update.

1.06:
	– adds a Dock menu command to run checks
	– designed to work with macOS 15.

1.05:
	– fixed an insidious bug getting local XProtect and XPR versions, that returned false reports after updating either
	– now changes its Dock icon according to its results
	– added Run Checks command.

1.04:
	– improved detection and reporting
	– added group reports to the window
	– added the saving of results to the app’s preference file.

1.03:
	– improved detection and reporting of data connection problems.

1.02:
	– added Help book
	– added support for those running beta-releases of macOS
	– added ability to disable XPR log checks, so it can be run in a standard user account
	– added log time check to XPR log checks
	– added auto-update support.

1.01:
	– fixed problems checking SSV on Macs with multiple boot volume groups
	– fblocked Easter Egg allowing the user to change Colour Well.

1.0:
	– first release.

7 August 2024		Howard Oakley, at the Eclectic Light Company