New privacy switches in macOS 15 are not managed by allowDiagnosticSubmission

[qupig]

Problem to solve

Two new data collection switches in macOS 15 (enabled by default):

• Analytics & Improvements -> Improve Assistive Voice Features
• Spotlight -> Improve Search

The restrictions key allowDiagnosticSubmission cannot cover the newly added switches, as shown in the screenshots:

Documentation

https://developer.apple.com/documentation/devicemanagement/restrictions

Links / references

https://support.apple.com/en-me/guide/mac-help/mchl54d95e8a/mac
https://www.apple.com/legal/privacy/data/en/improve-assistive-voice-features/

[vaughnhart]

This is a find! with a capital FIND! I wonder if these "features" bypass other restrictions with a nuisance. They're not exactly Siri, and Spotlight. I wonder what the underlying "linux" subsystem is?

[robertgendler]

I think we found those and added rules for them.
https://github.com/usnistgov/macos_security/blob/main/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml

https://github.com/usnistgov/macos_security/blob/main/rules/system_settings/system_settings_improve_search_disable.yaml

[robertgendler]

@vaughnhart there is no linux subsystem. It isn't linux. It isn't anywhere near linux. macOS is a unix and linux is not a unix.

[vaughnhart]

yeppers... private... I was more thinking about how spotlight was feeding from, if I remember correctly, lookup and another search database that could be controlled on the command line. I wondered if the same was for these two "options" as well.

[qupig]

Thanks, it's really disturbing to have these options hidden in different places and covered by subkeys in different corners.

There should be a clear primary key there that overrides any subsequently added sub-switches.

@robertgendler Anyway, thanks for your work and quick answer!

[qupig]

A little extra thought, maybe we should also record the corresponding UI settings description text there, so that it is easier for people to find and confirm.

For example when I search for, there is nothing there:

https://github.com/search?q=repo%3Ausnistgov%2Fmacos_security%20Improve%20Assistive%20Voice%20Features&type=code

Unless I simplify the search terms:
https://github.com/search?q=repo%3Ausnistgov%2Fmacos_security+Assistive+Voice&type=code

[robertgendler]

Good point! We'll try to remember to update the discussion and/or title a bit.

[JamminR]

I think we found those and added rules for them. https://github.com/usnistgov/macos_security/blob/main/rules/system_settings/system_settings_improve_assistive_voice_disable.yaml

https://github.com/usnistgov/macos_security/blob/main/rules/system_settings/system_settings_improve_search_disable.yaml

Though my org using this setting for "improve assistive voice" shows setting as disabled, the setting is not greyed out and the slider can be moved to 'on' position but immediately moves back to off.
Is this a concern, or with the setting method it was disabled, is that 'normal' and it will always remain disabled even though not greyed out.

[robertgendler]

@JamminR That's expected when it's not a setting that Apple officially supports as being manageable. Nobody has programmed it to "lock". But if you re open system settings it's off.

[JamminR]

Thank you for the response. I'll stop looking for a solution to a non-problem, and will go back to occasional Apple managed device github settings review in hopes they add ability to lock it as they have the other settings.