Child Item

Dropbox unnecessarily prompting users to allow system extension while whitelisted on Mac OS

Starting with macOS 10.13.2, Apple gave MDM administrators the ability to automatically whitelist any desired Kernel Extensions so that the user would not be prompted to allow the extension manually.

We do this to our machines in the field and, when enabling Smart Sync, Dropbox does not seem to notice that it's extension is already whitelisted. The user is still prompted to Manually Allow the Dropbox System Extension which they can't do because the extension has already been allowed (the option to manually allow doesn't show up in System Preferences). This puts them in a situation where they can only enable Smart Sync by canceling the Allow System Extension Prompt from Dropbox and clicking that they don't want to use Smart Sync, and then going into the Dropbox app settings and enabling Smart Sync in there.

Please fix this so that Dropbox can notice that it's system extension is already approved and not prompt to user to allow it.

Find more posts tagged with

Desktop

Security

Insightful

Disagree

Accepted answers

Walter

Thanks for the additional information @mlavine - I appreciate your elaborate explanation and clarifications on this.

I have passed all of your comments to the agent handling your case in order to get to the bottom of this in a timely fashion. Please get back to them with any information you think might help our investigation.

Thank you.

All comments

Lusil

Hi @mlavine!

In order to have a better understanding of the behavior that you’re experiencing and due to account-specific info that’s required so as to troubleshoot, I’ve gone ahead and sent you an email to the email address associated with your Forum profile. Please check your inbox for my latest message and we’ll take it from there.

Thanks in advance!

Walter

Hey there @mlavine - how are you today?

Are you by any chance using a graphics tablet or 3rd party mouse to perform these actions in the first place?

Here's some additional information I was able to find about this behavior - you can always have a look in the original thread for more context and also take a look at this thread from the Apple's support forum for more information about your Mac devices' kernel extensions.

Apple blocks certain GUI inputs from successfully clicking the approve button in System Preferences and there is no feedback to the user about why the approval fails. The two situations that this happens are:

1. If the end user clicking the approve button is using remote management software like VNC or TeamViewer to access the system and perform the approval operation.

2. If a third party pointing device driver -- like Logitech or Wacom -- is installed.

In order to resolve your issue now, all you need to do is to follow these steps:

1. Restart your computer, holding down command+R to enter Recovery Mode

2. Open your Terminal app (Located at /Applications/Utilities/Terminal)

3. Copy and paste the following line into the Terminal.

<SPAN class=" author-d-iz88z86z86za0dz67zz78zz78zz74zz68zjz80zz71z9iz90z9z84zl5yz80zz89znz68zoiz90zz77zl1z67zsgz79zz78z5lmz74zz71z3cz77zz73z7z122z">spctl kext-consent add G7HH3F8CAK</SPAN>

4. After this you can restart the machine, and let it load as normal. Once restarted, you can re-install Dropbox again. When Dropbox has finished installing, while it will not prompt you again to install Smart Sync, the required components will now be present on your machine.

I hope this helps everyone affected in the same way as you @mlavine and please let us know if this worked out for you. Cheers!

mlavine

Hi Walt3R,

Thanks for your reply. This issue is unrelated to using third-party drivers, although I am aware of the various security-based changes to macOS that would prompt you would to bring that up.

The issue is not that the user cannot approve the Dropbox Kernel Extension. The issue is that the extension is already approved via Configuration Profile and Dropbox does not notice. Because of this, Dropbox still prompts the user to manually allow the kernel extension by opening System Preferences and clicking "Allow" so that the extension so that Smart Sync can be used. This is something the user will never be able to do because the extension has already been allowed and therefore needs no approval to run, thus never shows up in System Preferences.

This causes a lot of confusion among users because Dropbox is prompting them to do something that cannot be done. The only way to get out of this impossible situation is to cancel out of setting up Smart Sync (thus enabling normal syncing and causing the app to start downloading everything) and then going into the Dropbox app settings and enabling Smart Sync there.

Walter

Thanks for the additional information @mlavine - I appreciate your elaborate explanation and clarifications on this.

Thank you.

Alec V.1

This is still an issue. In order to get past the dialog box to allow, I had to delete the Dropbox permissions in Accessibility.

amartin253

I'm glad I'm not the only one. I was wondering if this was the case. Any idea on this Dropbox support?

Walter

Sorry to hear you're having issues with this @amartin253.

Could you provide some additional information about your setup and if you've done any troubleshooting on your own already?

On a side note, would it be OK if I reached out via email to your Dropbox associated address so we can have a further look into this with all of our tools at my disposal?

Thanks!

amartin253

I was just replying with additional context as my previous post was a bit vague. I manage all the Macs in my company and have installed Dropbox via JAMF Self Service. All Macs affected are on macOS Mojave 10.14.6 Build 18G87. I've created a PPPC/TCC configuration profile for Dropbox that gets installed via JAMF on any Mac running Mojave that Dropbox is also detected to be installed on to allow Accessibility. I've also whitelisted the Dropbox KEXT via Approved Kernel Extensions configuration profile using the following KEXT ID: G7HH3F8CAK with com.getdropbox.dropbox.kext listed as the KEXT to approve.

When a user who is a Standard account and not an Administrator account logs in with SSO, they get the initial dialog stating "How should your files sync?" with "Let my admin manage this setting". Since we have Smart Sync enabled, the user clicks Continue and they are prompted with a request for admin credentials.

I've tried unchecking this box as well and intentionally NOT enabling Smart Sync and moving forward with only using Selective Sync and it seems the checking or unchecking of that box is ignored and Smart Sync is still active because after selecting 1 or 2 folders and clicking continue, the user is still prompted for admin credentials.

I have 35 new Dropbox for Business users who need their Dropbox configured ASAP and Smart Sync NEEDS to be enabled because they have Mac Pro towers with 256GB drives that are filling up fast without it enabled.

I'm happy to get on a remote video call today if you can help further. Thanks Walter.

- Adam Martin in Seattle

Walter

Thanks for the additional information Adam - it's most appreciated!

While I won't be able to have a video call with you (our current channels include phone, chat and email support while you can always post on our Social media too), I've just sent you a brief message to your Dropbox associated email address in order to have a better look into this.

Whenever you find some spare time, please take a look at your inbox and we'll take it from there.