MacOS – Pre-approve upgraded software/applications for users under parental control

applicationsmacosparental-controls

I am responsible for keeping the software on our Mac at home up to date, and some software is updated rather frequently. This includes Firefox.

FF is one of the applications our kids are allowed to use, but after each upgrade they are unable to use it before I approve/allow it again. I usually do the upgrades at night, and when I leave for work early in the morning this means the kids can't use FF before I get home to approve it the next evening.

Is there any way I can approve applications without logging in to each parental controlled account, starting the application and approve it with my own username/password?

I.e. I want to do it in one step (from my admin account) instead of in several (by logging into each restricted account). I also don't have the passwords for my kids accounts (I can get it if I want to by asking them), since I'm trying to teach them to keep their passwords safe and secret.

Best Answer

There is no need to log in to individual accounts, at least with more modern versions of OS X. You can set access privileges for managed accounts from within the Users & Groups pane of System Preferences without leaving your own account.

image of Users & Groups preferences pane

image of Parental Controls

By selecting the Other tab in the Parental Controls dialog you can even enable Remotely managing parental controls.

image of Parental Controls remote management checkbox

Upon further clarification by Cra, it seems that Apple's file quarantine system is causing the difficulty. Starting with Mac OS X 10.5, files downloaded from the internet are quarantined and checked for safety.

image of file quarantine dialog

Applications that are downloaded must be approved the first time that they are run, and only the owner of the account used to initially download the software can grant that approval.

image of Application quarantine dialog box

If you have multiple user accounts on your Mac, the user account that downloaded the file is the only user account that can remove the quarantine attribute to the file. All other user accounts can open the quarantine file, but they will be presented with the quarantine dialog box asking "Are you sure you want to open it?" every time they open the file.

ᔥ Apple Knowledgebase:About file quarantine in Mac OS X v10.5 and v10.6

Make sure that you download software updates using your administrator account and that you open and approve the software from your account before making any adjustments (which may not be necessary at this point) to the Parental Control settings. It may be necessary to disable automatic updates in Firefox.

image of Firefox preferences pane, Advanced tab

The quarantine system works by attaching an extended attribute to a downloaded file. If absolutely necessary, you can remove this attribute using the terminal

Enter the following command, replacing appropriately: 

xattr -d com.apple.quarantine /applicationPath/<applicationName>.app

See also: Stack Overflow: How do I remove the “extended attributes” on a file in mac

Related Question