macOS Installation

Install the BlueSentinel DLP agent on macOS endpoints.

Prerequisites

  • macOS 12+ (Monterey or later)
  • Root/sudo access
  • Python 3.9+ (bundled with installer)
  • Network connectivity to the central server on port 5100

Installation

Using the Installer Script

bash
# Download or copy the installer to the target Mac
sudo bash installer/install_macos.sh

The installer will prompt for:

  • Server URL — The HTTPS URL of your central server (e.g., https://your-server:5100)
  • Enrollment Token — Generated from the admin dashboard under Enrollment

What the Installer Does

  1. Creates the application directory at /Library/Application Support/BlueSentinel/
  2. Copies the agent files and dependencies
  3. Creates subdirectories: logs/, certs/, queue/
  4. Writes the initial configuration with server URL and enrollment token
  5. Registers a LaunchDaemon for auto-start on boot
  6. Starts the agent immediately

Manual Installation

bash
# Clone the repository
git clone https://github.com/your-org/BlueSentinel.git
cd BlueSentinel

# Install the package
pip install -e .

# Run the agent (requires root)
sudo bluesentinel

Or run as a Python module:

bash
sudo python -m dlp_agent

File Locations

PathPurpose
`/Library/Application Support/BlueSentinel/`Main application directory
`/Library/Application Support/BlueSentinel/policy.json`Current policy (offline fallback)
`/Library/Application Support/BlueSentinel/bluesentinel.db`Local SQLite database
`/Library/Application Support/BlueSentinel/logs/`Log files
`/Library/Application Support/BlueSentinel/certs/`TLS certificates
`/Library/Application Support/BlueSentinel/queue/`Offline alert queue

LaunchDaemon

The agent is registered as a macOS LaunchDaemon, which means:

  • It starts automatically on system boot
  • It runs as root
  • It restarts automatically if the process dies
  • Users cannot stop it via Activity Monitor (anti-tamper protection)

Verify Installation

bash
# Check if the agent is running
ps aux | grep bluesentinel

# Check the logs
tail -f "/Library/Application Support/BlueSentinel/logs/bluesentinel.log"

# Check enrollment status
cat "/Library/Application Support/BlueSentinel/policy.json" | python3 -m json.tool

The device should appear in the admin dashboard within 60 seconds (one heartbeat cycle).

macOS Permissions

The agent may require the following macOS permissions:

  • Full Disk Access — For file watcher guard
  • Accessibility — For clipboard and screenshot monitoring
  • Input Monitoring — For keyboard/clipboard detection

These can be pre-configured via MDM profiles to avoid user prompts.

Uninstallation

Warning: Uninstallation requires disabling the anti-tamper protection first. Send a disable_guard command for anti-tamper from the admin dashboard before attempting removal.

bash
# Stop the LaunchDaemon
sudo launchctl unload /Library/LaunchDaemons/com.bluesentinel.agent.plist

# Remove files
sudo rm -rf "/Library/Application Support/BlueSentinel"
sudo rm /Library/LaunchDaemons/com.bluesentinel.agent.plist