Interpret test results

LockRattler runs a total of fourteen tests, each of which is reported in a separate section in its window. There is little point in running them more than once on any given day, as they are extremely unlikely to change in that period unless you change your security configuration or force your Mac to update. Results which have changed since you last ran or refreshed LockRattler are shown with red text.

When running El Capitan, the Gatekeeper  Disk version  is omitted, as that was not introduced until Sierra, and  Log private data  is omitted, as that only works for the unified log introduced in Sierra.

When running El Capitan, Sierra, or High Sierra, the  TCC version  is omitted, as this is only (very) important for Mojave and later.

To check  SIP , it runs the shell command

csrutil status

This should always return a statement that SIP is enabled, as shown above. If SIP is disabled, you will need to enable it; details are provided in the Eclectic Light Company blog, or you can call Apple Support. In fact, if it is a new Mac, you should call Apple Support so that they know that Macs are shipping without SIP.

On Macs which are running Big Sur and later, this also reports whether the current System volume is sealed. If it isn’t, and you haven’t deliberately unsealed it, you should reinstall Big Sur to enable it again. SSV is checked using the shell command

csrutil authenticated-root status


To check  XProtect blacklist  protection, it runs the shell command

spctl --status

This should always return that assessments are enabled. If they are not, contact Apple Support soonest.

To check whether  FileVault  (disk encryption) is turned on, it runs the shell command

fdesetup status

This is an option which you control in the Security & Privacy pane of System Preferences.

To check whether  Software Update  is set to Automatic, it runs the shell command

sudo softwareupdate --schedule

with root privileges, which is why you are prompted to enter your admin password.

This is an option which you control in the  App Store  pane of System Preferences, where the boxes labelled  Install system data files and security updates  and  Automatically check for updates  should be checked (enabled).

To check whether  Log private data  are being saved in your log, it runs the shell command

sudo log config —status

with root privileges, which is why you are prompted to enter your admin password.

This is an option which is controlled from the command line, and in some tools such as Cirrus.

To check whether the  firmware password  is enabled, it runs the shell command

sudo firmwarepasswd -check

with root privileges, which is why you are prompted to enter your admin password. Firmware passwords are not available in Apple Silicon Macs, where this box is used to report  Platform Security  instead. A summary is shown here, with itemised settings in the lower scrolling text view. These are obtained using the shell command

system_profiler SPiBridgeDataType

The firmware password is an option on Intel Macs which is normally managed in the  Firmware Password Utility  in Recovery mode, but can also be managed in Terminal’s command line.

To check the  Firmware , it runs two different shell commands

system_profiler SPHardwareDataType

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check

The first, which should work on all Macs, returns the same version number shown in  System Information . The second, which is only available on Intel Macs running High Sierra and later which  don’t  have a T2 chip, uses the new system tool instead. The results are then displayed in the pair of boxes below the  Firmware  text, in that order. Firmware is only updated by Apple’s macOS installers and updaters, and isn’t available separately. If your Mac has a T2 chip, the upper box should show the new version, and the lower box should report the iBridge version as well. If yours is an Apple Silicon Mac, the firmware version is that for iBoot.

The other six checks are of the current versions of the data files used by macOS security protection systems. Apple pushes out silent updates to these, but if you have recently applied a Combo update or your Mac has been away from an Internet connection for some time, your data files may not be up to date.

Note that  Gatekeeper  data use was discontinued in 2019. Macs which weren’t up to date with those updates normally show a much earlier version such as 94, which is now perfectly normal for all newer Macs including M1 models.

The files in question are:

for  XProtect  version, /System/Library/CoreServices/XProtect.bundle (in 10.15 /Library/Apple/System/Library/CoreServices/XProtect.bundle)

for  Gatekeeper  version, /private/var/db/gkopaque.bundle

for  Gatekeeper disk  version ( GKE  in Catalina), /private/var/db/gke.bundle (Sierra and later)

for  KEXT block  version, /System/Library/Extensions/AppleKextExcludeList.kext (in 10.15 /Library/Apple/System/Library/Extensions/AppleKextExcludeList.kext)

for  MRT  version, /System/Library/CoreServices/MRT.app (in 10.15 /Library/Apple/System/Library/CoreServices/MRT.app)

for  TCC  version, /System/Library/Sandbox/TCC_Compatibility.bundle (in 10.15 /Library/Apple/Library/Bundles/TCC_Compatibility.bundle).

The results given for tests are exactly those supplied by macOS, and are not interpreted or altered in any way.

➜  How to interpret information about updates

➜  Welcome


The Eclectic Light Company – https://eclecticlight.co