"VPN is trying to modify your system settings." on macOS Ventura

Question

Created Oct ’22

Replies 5

Boosts 0

Views 1.8k

Participants 3

Since upgraded to Ventura we've started seeing this popup occasionally while starting/stopping a VPN client provided by a 3rd party software. It seems like to be coming from the "System Settings" instead of from an individual software and doesn't seem to be really impacting anything - even if we just cancel the prompt the VPN can be started/stopped properly. However this is confusing nonetheless.

Screenshot 2022-10-31 at 9.52.41 AM.png

If we do cancel the prompt without providing the authentication it asks, we get an error message in the system logs saying "AuthenticatedOperation (Change Configuration Status) error ".

Is there an explanation to this prompt, or is it some kind of system bug? In the latter case we do have certain reproducing steps we'd be happy to share through a radar ticket.

Boost

Answer 1

OP

Apple

Oct ’22

Hi there,

You might have better luck asking this question over in Apple Support Communities run by Apple Support.

—Jason.

0

Answer 2

qb_s OP

Nov ’22

Thanks Jason, I posted a question there too. However, I wanted to say the reason I put it here (dev forum) was because our software has a VPN functionality and we are seeing this popup on Ventura and know it's gonna impact our customers' user experience. For a few reasons I also posted in the question on the Support website, I really suspect this is a Ventura bug.

The popup isn't from a 3rd party VPN software, it's from an Apple process called "VPN" (/System/Library/ExtensionKit/Extensions/VPN.appex).
The popup DOESN'T happen if I do not open System Settings > Network > VPN & Filters settings tab in the first place. For example, if I close the System Settings dialog, then no matter how I manipulate a VPN software, I won't see this prompt.
The popup DOESN'T change anything either - no matter if I accept it or just cancel it, 3rd party software can still manage its VPN profile just fine.
When we allowed the VPN software to create a VPN profile in the system in the first place, we already saw another system prompt asking for user consent to allow this app to monitor network traffic. Right now I'm very sure our software is not trying to do any modifications (not trying to create any new VPN profile), it's only trying to start or stop the VPN connection. It doesn't seem to be a very good user experience if I got a prompt out of blue every time when trying to connect or disconnect the VPN (even though the popup doesn't really block our functionality).

0

Answer 3

DTS Engineer OP

Apple

Nov ’22

because our software has a VPN functionality

Please expand on that. What VPN functionality does it provide? Or using which APIs?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 4

qb_s OP

Nov ’22

It's using the NEPacketTunnelProvider API, which creates a VPN profile in System Settings > Network.

The first time when our app creates that profile, we see a prompt saying "App XYZ would like to filter network content. Allow/Don't Allow", but that's not what we are talking about here. Instead let's assume we've already allowed the profile to be created, and then what happens is that (1) when our code is operating on that profile, e.g. starting/stopping the VPN connection, or (2) the user is manually operating on that profile, we have a chance to see this new popup in question. And also it only happens if we currently have the System Settings > Network > VPN & Filters tab opened (again this is Ventura only).

0

Answer 5

DTS Engineer OP

Apple

Nov ’22

It's using the NEPacketTunnelProvider API, which creates a VPN profile in System Settings > Network.

Ah, that explains things. When Jason and I read your initial post, we presumed that “3rd party software” meant you were using VPN software from another third-party developer.

let's assume we've already allowed the profile to be created, and then what happens is that (1) when our code is operating on that profile, e.g. starting/stopping the VPN connection, or (2) the user is manually operating on that profile, we have a chance to see this new popup in question. And also it only happens if we currently have the System Settings > Network > VPN & Filters tab opened

Well, that’s weird, and definitely bugworthy. Make sure to follow the VPN (Network Extension) for macOS instructions on our Bug Reporting > Profiles and Logs page.

Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0