macOS-enterprise-privileges VS rtrouton-recipes

Also, if you need them to have admin rights, you can use something like https://github.com/SAP/macOS-enterprise-privileges

> For technically-inclined users, I'm still largely unconvinced of the value of SIP.

Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week.

Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator.

https://github.com/SAP/macOS-enterprise-privileges

This helps* prevent drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

* Helps prevent, not prevents.

It doesn't look like the default recipe for Privileges has an install or post install script. Which do you use? https://github.com/autopkg/rtrouton-recipes/blob/master/Privileges/Privileges.munki.recipe

Package building. I don't have access to our AutoPkgr setup, so for now I am using Jamf Composer to build it with the same pre and post-install scripts as rtrouton's AutoPkgr recipe. When I build it this way by hand, the icon showing admin status never changes. If I run the postinstall script manually after installing, the icon changes just fine. Is this just a quirk of me attempting to hand build something designed to be automated?