Making the Mac and Linux first-class platforms in RFF

RFF had a Mac agent for a while before it had real Mac support. The agent enrolled, reported inventory and ran scripts, which is enough to put “macOS: supported” on a feature list. A lot of the product still assumed every device was a Windows PC, and the Linux agent was heading the same way.

In my previous role, I ran a desktop engineering team responsible for about 30,000 Windows endpoints and around 300 Macs. Every tool we bought was Windows-first, and Macs were usually treated as second-class citizens. We were lucky if the product even had a Mac agent. Honestly, Netwrix’s Endpoint Protector did Macs well. Check Point, on the other hand, was terrible. I didn’t want RFF to be like that either, and it was drifting that way.

Finding the gaps

I had an AI agent go through all 41 pages in the sidebar as a tech with a Mac fleet would, without reading the code first. It clicked what a tech would click and wrote down what was broken, missing, or Windows-only. A second one ran the whole product against two lab VMs, Ubuntu 26.04 and Rocky Linux 9.8, the way a Linux admin would. It installed the agent, ran jobs, pushed packages and rebooted things.

On the Mac

The Software list for one Mac had 313 entries, mostly macOS’s own bundles like “Script Editor templates.” After the fix it lists 28 real apps, and Apple’s own apps say “Part of macOS” instead of offering an Uninstall button.
App Vulnerabilities flagged a Mac for Jamf Pro Server CVEs. The Mac had the Jamf CLIENT, which has a similar name, and the CVE matcher wasn’t checking the product edition. That’s fixed for every OS.
Health checks for Secure Boot, SMART, sleep settings, screen lock and reboot pending read “Unknown” on Macs because they were written for Windows. They read real values on a Mac now, using bputil, diskutil and pmset.
Job notices were ignored. “Tell the user before this runs” and “ask before rebooting, allow postponing” did nothing on a Mac. The signed-in user gets the dialog now, and a postponed reboot reschedules the same way it does on Windows.
Cancel didn’t stop a running job on a Mac. The agent runs one job at a time and wasn’t checking for a cancel mid-job, so a cancelled 30-minute wait kept running and blocked every job behind it. The heartbeat now carries the cancel, and the job stops within seconds.
The fleet Software page had no Uninstall for Mac apps. It does now, by app name across every Mac that has the app.

On Linux

“Run as the logged-on user” ran as root. The Linux agent runs every job as root, so a Run or Install step meant for the user’s session ran as root instead, in root’s home with root’s settings, and still reported Success. RFF now refuses that step when you create the job, with the reason.
RFF offered to uninstall itself. The agent’s own rff-agent package showed up in the software list with an Uninstall button. The console doesn’t offer it anymore, and the agent refuses it if a job asks anyway.
Scheduled reboots died with the agent. A reboot with a delay was a background sleep followed by shutdown. When a service restarts, systemd stops everything in that service’s cgroup, so an agent update during the delay cancelled the reboot without a word. The reboot is a systemd timer now (systemd-run --on-active), which runs outside the agent, and a multi-step job picks up after the reboot by checking the boot ID.
Kill by name missed long names. Linux keeps only the first 15 characters of a process name in /proc/<pid>/comm, so pgrep -x can’t match a 16-character name, and the job reported “Killed 0”. It matches on the full command name now. A name typed with .exe out of Windows habit works too, because when nothing matches, it tries again without the .exe.
Jobs had no HOME. A systemd service running as root gets no HOME, USER or LOGNAME, so a script that used ~, or called a tool that wants a home directory, failed. The agent sets them for every job.
Scripts saved on Windows failed on line one. A .sh with CRLF line endings makes bash look for an interpreter called /bin/bash^M, and you get “bad interpreter”. The agent converts CRLF and strips a BOM on downloaded scripts, and leaves binaries and anything over 1 MB alone.
The last admin could be disabled. Disabling an account, or taking it out of sudo, could leave a machine with no admin at all. RFF now refuses unless another account could still sign in and use sudo, and it counts an Ubuntu cloud image’s default admin, which has a locked password, signs in with an SSH key and uses passwordless sudo.
Some services came right back. CUPS is socket-activated on Ubuntu, so systemctl stop only lasts until the next print job starts it again. The Stop job now warns you it’ll come back.
The install line assumed sudo. It ended in | sudo bash, which fails on a root shell with no sudo installed. It runs plain bash when you’re already root.

Three smaller Linux fixes went in with these. A bare timer name like logrotate.timer works in task control, Uninstall on the device page tells the agent which package manager owns the app (dpkg://, snap://), and the RDP check names the ports it found listening.

What works now

On a Mac

Remote Desktop, including a locked Mac when unattended access is on. You can see the lock screen and unlock it from the browser. A Mac at the login window is view only for now, and the deep dive explains why.
macOS Profiles. You can build or import configuration profiles, deploy them, and see per Mac whether it has the current version, an older one, or none. Templates include a CIS Level 1 starter baseline, Microsoft 365, shared or kiosk Macs, and encrypted DNS.
Self Service. A branded “Self Service” app on the Mac lists the apps you’ve approved for Macs. When a user picks one, IT sees it as a normal job.
Patching. Pending macOS updates show on the device page and the compliance report, and Patch Tuesday can include your Macs and Linux devices in the same monthly cycle.
OS Vulnerabilities. The Mac’s macOS version is matched against the NVD’s macOS ranges, next to the Windows results.
Maintenance windows hold Mac jobs, printer mappings create real CUPS queues, AI Visibility finds local models like Ollama, Disk Encryption shows FileVault status, and What’s New lists Mac and Linux agent releases along with Windows.

On Linux

Install. One line from the Install Agent dialog (curl or wget), or a .deb or .rpm for your own tooling. Debian, Ubuntu and RHEL-family distros like Rocky and Alma, on x64 or Arm, anywhere systemd runs. It’s signed with the same code-signing certificate as the Windows agent, and the installer checks the signature before it writes anything.
Inventory. dpkg, rpm, snap and flatpak packages, systemd services and timers, cron, the sudo admins, and posture from the OS itself: the firewall (ufw, firewalld or nftables), AppArmor or SELinux, LUKS, automatic updates, pending security updates, and whether a reboot is waiting.
Jobs. bash, sh or python3 scripts with the full output, .deb and .rpm installs or straight from the repositories (apt://, dnf://, snap://), checked in the package database before the job says Success. OS updates through apt or dnf, on their own or in the same Patch Tuesday cycle as your Windows machines.
Checks and alerts. Service running, process running, script exit code, a journal match, EDR healthy, firewall on and LUKS, with the same alerts, auto-remediation and workflows as Windows.
Live tools. A console as root, as the signed-in user, or as another account with its password, plus Files, Endpoint Explorer, and a dconf editor on GNOME desktops.
Remote desktop. GNOME, KDE Plasma, and X11 desktops like Xfce, MATE and Cinnamon, with a monitor picker and clipboard. The signed-in user is always asked first.
The rest. Time-boxed sudo for one program, IPP printers with no driver to pick, trusting a CA through a job, PerfCheck and performance history, Wake-on-LAN from a Linux machine, agent installs over SSH, and self-updates that roll back if the new build doesn’t check in.

Pages that only apply to one platform now carry a label at the top. Imaging is marked “Windows only”, macOS Profiles is “Mac only”, and OS Vulnerabilities is “Windows and Mac.”

Where they work differently

Some things work differently because Apple and the Linux desktops designed them that way.

macOS

Only a person or an MDM can install a configuration profile on macOS 11 and later. RFF puts the profile in front of the user and confirms when it’s installed. If you have an MDM, download the profile from RFF and push it from there.
The login window is view only for now. macOS ignores synthetic keyboard and mouse input there from every public API we tried. The fix is a virtual keyboard driver, and we’ve asked Apple for the entitlement.
Screen Recording and Accessibility need one approval per Mac, which is Apple’s rule for every remote tool. An MDM can pre-approve Accessibility, but Screen Recording needs one click from a person at the Mac.
FileVault recovery keys should be escrowed by your MDM. RFF shows whether FileVault is on.

Linux

Jobs run as root. There’s no run-as-the-signed-in-user on Linux, so RFF refuses those steps up front.
Remote desktop needs someone signed in. GNOME and KDE refuse remote sessions at the login screen, and GNOME at a locked screen too, whatever the caller’s privileges. Servers without a desktop get the console.
H.264 needs an encoder. A stock Ubuntu desktop doesn’t have one, so RFF installs gstreamer1.0-plugins-ugly the first time you ask for H.264 (that first session runs MJPEG). Rocky’s repositories don’t carry one, so Rocky stays on MJPEG.
No OS vulnerability scan on Linux yet. Distro packages carry backported fixes under old version numbers, so matching them against the NVD would flag machines that are already patched. dpkg and rpm packages are left out of NVD matching for that reason.

How we tested it

My bar was that a tech can do their job in RFF without landing on a page that ignores their device. Every page loads with no errors with Macs in the fleet. On a real Mac, from the browser, we ran a Self Service install, a profile deploy, a remote unlock and a cancelled job end to end.

Every Linux fix ran on both lab VMs through staging before it shipped. That included a multi-step job that reboots, with the agent restarted during the delay, picking up afterwards; the last-admin refusal; a dpkg uninstall from the device page; CRLF and BOM scripts; a kill by a 16-character name; the CUPS warning; an OS update whose reboot waited for the maintenance window; and the agent uninstalling itself from the published .rpm. The Linux binary that passed is the one on production, checked by its SHA-256.

RFF is free for your first 100 endpoints, Macs and Linux included. Start free.