Description:
Gatekeeper is a macOS security feature that validates applications before they are allowed to run. It verifies that applications are from identified developers, checks Apple notarization status, and scans against a malware database before execution. Gatekeeper prevents unsigned, unnotarized, or known malicious applications from being launched, protecting the system from potentially harmful software.
Rationale:
Without Gatekeeper enabled, any application regardless of its origin or safety can be launched on the Mac. Gatekeeper is the primary defense against malicious applications being executed. It enforces code signing requirements and checks Apple notarization, ensuring only verified and safe software can run. Disabling Gatekeeper significantly increases the risk of malware infection.
Impact:
Prevents unsigned and unverified applications from executing on the Mac.
Checks Apple notarization to ensure apps have been scanned for malware.
Blocks known malicious applications from launching.
Users attempting to run unsigned apps will receive a security warning.
Legitimate apps from identified developers work without any issue.
Default Value:
By default, Gatekeeper is enabled on macOS and set to allow applications from the App Store and identified developers. It may be disabled by users or by IT scripts that require running unsigned software.
Pre-Requisite:
macOS 11 Big Sur or later.
Administrator privileges on the device.
Remediation:
Test Plan:
Pre-Implementation Check (run before making any changes)
Open Terminal (Applications > Utilities > Terminal) and check Gatekeeper status:
Expected on a non-compliant Mac: assessments disabled. If it shows assessments enabled, Gatekeeper is already on and no changes are needed.
Post-Implementation Check (run after completing the Implementation Steps)
Run the same command again:
Expected output: assessments enabled
Also check System Settings > Privacy & Security > Security: “Allow applications from” should be set to “App Store and identified developers” (shown as “App Store & Known Developers” on macOS 15 Sequoia and later).
Implementation Steps:
Step 1: Open Terminal
Open Terminal from Applications > Utilities > Terminal.
Step 2: Enable Gatekeeper
Run the following command and enter your administrator password when prompted:
The command shows no output when it succeeds.
Step 3: Check the allowed app sources in System Settings
Go to System Settings > Privacy & Security and scroll down to the Security section. Make sure “Allow applications from” (“Allow applications downloaded from” on older versions) is set to “App Store and identified developers” (shown as “App Store & Known Developers” on macOS 15 Sequoia and later).
Backout Plan:
Step 1: Open Terminal
Open Terminal from Applications > Utilities > Terminal.
Step 2: Disable Gatekeeper
Run the following command and enter your administrator password when prompted:
On macOS 15 Sequoia and later, this command only makes the “Anywhere” option available. To finish, go to System Settings > Privacy & Security, scroll to Security, and select Anywhere under “Allow applications from”.
Note: Disabling Gatekeeper leaves the system vulnerable to malicious applications. To run a single blocked app, use Open Anyway instead (see the Note section). Re-enable Gatekeeper as soon as the need is resolved.
Note:
Gatekeeper should always remain enabled on production devices.
If a legitimate app is blocked, allow just that app instead of disabling Gatekeeper: try to open the app once, then go to System Settings > Privacy & Security and click Open Anyway. (On macOS 14 Sonoma and earlier, you can also Control-click the app and choose Open.)
Gatekeeper works together with XProtect and Notarization for layered malware protection.