Gatekeeper
Chris Johnson ©1988-1991

The original configure-and-forget, run-time virus protection, detection & analysis system.

CONTENTS

•  Sections
•  1 – General
•  2 – Help
•  3 – ON/OFF
•  4 – Settings
•  5 – Log
•  6 – Privileges
•  Copyright Notice
•  Bug Reports, Postcards, Etc.
•  …And Thanks for All the Fish

SECTIONS

Gatekeeper’s controls and displays are separated into six sections each of which is briefly described below. The list of available sections always appears at the top of Gatekeeper’s window, and it may be necessary to use the scroll bar to see all the items in the list.

Clicking once on a line in the list opens the appropriate section of Gatekeeper. If you prefer to use the keyboard, you can hit the tab key to move to the next item in the list and shift + tab to move to the previous item in the list.

1 – GENERAL

The General section is always the first section visible when Gatekeeper is opened. It will tell you the version number of Gatekeeper and may, in future versions, bring other information to your attention as necessary.

2 – HELP

This is Gatekeeper’s help section. It provides a quick description of the controls and displays in all of Gatekeeper’s sections. For an introduction to Gatekeeper refer to the Gatekeeper Introduction file which should have been included with this copy of Gatekeeper.

You can move up and down in the help text using the scroll bar or the page up and page down keys on some keyboards. The home and end keys on those keyboards can be used to move to the top and bottom of the help text, respectively.

Text from the help section may be selected using the mouse and copied to the Clipboard so that it can be pasted into other applications. This would allow you, for instance, to paste the text into a word processor and print it out.

3 – ON/OFF

The ON/OFF feature allows you to turn Gatekeeper off for up to thirty minutes. This is useful when you’re performing relatively brief tasks that Gatekeeper would otherwise interfere with. The most common examples of such tasks are running “installer” programs which load software of some kind onto your system. Common examples of software loaded using these programs include PageMaker, Excel and TOPS.

Remember that Gatekeeper will not provide any protection against viruses while it is off.

4 – SETTINGS

The Settings section allows you to define some of the basic ways in which Gatekeeper operates.

When a Privilege Violation Occurs

Two radio buttons in this area let you tell Gatekeeper what to do about suspicious operations it encounters. When the “Stop the Operation (Notify & Veto)” radio button is selected, Gatekeeper will stop any suspicious activities it observes. On the other hand, if the “Permit the Operation (Notify Only)” radio button is selected, Gatekeeper will not interfere at all with suspicious operations; it will merely tell you the operations have occurred. It’s then up to you what you do about them.

When an Important Event Occurs

Two check boxes in this area let you tell Gatekeeper what it should do when it needs to get your attention. Typically, Gatekeeper only needs to get your attention when it observes privilege violations or other similarly unusual events. The “Display an Alert” check box tells Gatekeeper, when it is used with System 6.0 or later, to display an alert describing the event that occurred. The “Record it in the Log File” check box tells Gatekeeper to record a short description of the event in the Gatekeeper Log file for later review. These two options may be used in any combination you find convenient; in practice, however, it’s best to keep both options checked.

During Startup

Two check boxes in this area let you tell Gatekeeper how to behave when your Mac starts-up. If the “Show the Gatekeeper Icon” check box is checked, Gatekeeper’s icon will be displayed somewhere along the bottom of your Mac’s display during startup. Showing the icon in this fashion is merely a convenient way of indicating that Gatekeeper is installed on your Macintosh. In addition, if Gatekeeper cannot install itself for some reason, the icon will be drawn with a large red X over it to warn you that something went wrong.

The other check box in this area, labeled “Display a Mode Warning Alert”, allows you to tell Gatekeeper whether or not it should display a “warning” alert after startup to remind you of the mode in which it is operating. Gatekeeper can operate in either Notify Only or Notify & Veto mode. (A quick explanation of these modes can be found at the beginning of the Settings section in this help display.) By default, Gatekeeper displays a warning alert after startup when it is in Notify Only mode (since it doesn’t protect against viruses in that mode), but does not display a warning alert when in Notify & Veto mode (since that is the mode in which Gatekeeper normally operates). The “Display a Mode Warning Alert” check box, however, allows you to change this behavior to suit your own needs.

5 – LOG

This section allows you to view the contents of Gatekeeper’s log file, if the  “Record it in the Log File” option is checked in the Settings section. The log file is a file in which Gatekeeper records all the important events it observes for your later review.

Selecting a line in the log file display and clicking on the Get Info button will bring up an alert which explains the event recorded on that line of the log file. Double-clicking on a line, or clicking on a line and hitting the return or enter keys has the same effect.

For the convenience of users with appropriately equipped keyboards, the following keyboard shortcuts are available. To select the next line above or below the currently selected line use the up-arrow and down-arrow cursor keys. To move up or down through the log quickly, use the page up and page down keys. To instantly move to the top or bottom of the log, use the home and end keys, respectively.

Normally, the log will contain only “Installation” and “Shutdown” messages, which tell you when your Macintosh has been started or shutdown in Gatekeeper’s presence. These messages are totally routine, and are recorded only to help you determine when your Mac has been used and whether it may have been used without Gatekeeper, thereby leaving it unprotected against possible virus attacks.

The really important entries in the log file are displayed in bold, red type to get your attention. These entries normally describe attempts by programs to exceed the privileges they have been granted. These entries may tell you one of two things: (1) some program needs additional privileges in order to operate correctly, or (2) a virus is attempting to spread on your Macintosh and is being stopped by Gatekeeper. If you’re not sure which is which, try running Disinfectant 2.5, or later, to check for the involvement of known viruses. For additional information and helpful advice, you may want to refer to the Log section of the Gatekeeper Introduction document.

However, if you are confident that an entry in the log file merely indicates that a program needs additional privileges in order to operate correctly, you can grant that privilege by selecting that entry and clicking on the Get Info button. This will bring up an alert describing the entry. That alert will include a large button labeled Grant Privilege; clicking on that button will give the guilty program the privilege described in that entry. After using the Grant Privilege button, you can, if you wish, switch to the Privileges section where you’ll find that the guilty program has been automatically selected in the privilege list, in case you need to make adjustments.

6 – PRIVILEGES

The list that appears in this area is the list of applications that have been granted privileges of some kind. To the right of the list are four buttons: “Add”, “New”, “Edit” and “Clear”.  “Add” permits you to add an item to the list using the normal “Open” dialog box. You can compel Gatekeeper to display files regardless of their types by holding down the option key when clicking on the “Add” button. “New” gives you the option of typing in the name of an item to be added to the list; this is a convenient alternative to the “Add” button, and just about the only way to give privileges to desk accessories.  “Edit” lets you change the name of the currently selected item in the list. “Clear” allows you to delete the currently selected item from the list.

For a sensible discussion of what the privilege check boxes for an item mean, see the “Gatekeeper in Principle” section of the Gatekeeper Introduction document.

For the convenience of users with appropriately equipped keyboards, the following keyboard shortcuts are available. To select the next item above or below the currently selected item use the up-arrow and down-arrow cursor keys. To move up or down through the list quickly, use the page up and page down keys. To instantly move to the top or bottom of the list, use the home and end keys, respectively.

To select an item by name, type in the first several letters of its name; the list will be scrolled to the item that comes closest to matching the letters you’ve typed.

To delete an item from the list use the backspace, delete or clear keys. To edit the currently selected item, double-click on it, or hit the return or enter keys.

COPYRIGHT NOTICE

Gatekeeper ©1988-1991
Gatekeeper Aid ©1990-1991
by Chris Johnson.

All Rights Reserved.

Gatekeeper and Gatekeeper Aid are free for noncommercial public distribution. This means that you can’t charge for them or bundle them with a product without my express written permission. Bulletin-board systems are the sole exceptions to this rule.

If you’d like to distribute Gatekeeper or Gatekeeper Aid and the above statement appears to prevent you, get in touch with me. I’m potentially amenable to other distribution methods, so we should be able to come to some arrangement easily.

BUG REPORTS, POSTCARDS, ETC.

I can be reached with questions, suggestions, bug reports (be sure to note the version number of Gatekeeper and/or Gatekeeper Aid that you were using), donations, etc. at…

US Mail:

Chris Johnson
3311 Red River #305
Austin, TX  78705

Internet:
chrisj@emx.utexas.edu

UUCP:
husc6|uunet!cs.utexas.edu!ut-emx!chrisj

BitNet:
chrisj@utxvm.bitnet

AppleLink:
chrisj@emx.utexas.edu@internet#

CompuServe:
>INTERNET:chrisj@emx.utexas.edu

MCI Mail:
Command: Create
To: Chris Johnson (EMS)
EMS: Internet
MBX: chrisj@emx.utexas.edu

Turnaround time on email messages is usually under 48 hours. Turnaround time on US Mail is approaching two years in a few cases. I’m trying to handle that mail more efficiently, but if you have the choice, please send email. If you must use US Mail, including a self addressed stamped envelope does help to speed up the process.

If you like this product, send me a picture postcard from your home town.

See the Gatekeeper Introduction document for additional details on all this stuff.

…AND THANKS FOR ALL THE FISH

Many thanks to all the Gatekeeper and Gatekeeper Aid testers – without their help and patience Gatekeeper 1.2.1 couldn’t have been made even remotely as reliable and trouble-free as it is.

J. D. Sterling Babcock
Paul R. Badowski
jAMES bLIEDEN
Jonathan Brecher
Richard C. Cardona
Andrew Dater
Brian Donnell
Ramsey Dow
Jon Duke
William R. Engels
Nort Fowler
Gregory E. Gilbert
David Grayson
John Holland
Kirk Holub
John Im
W. G. Innanen
Andy Johnson
Bill Justin
Mark Kowitz
Dick Kriss
Steve Langer
Stuart A. Malone
Andrew J. Mason
Jakob Nielsen
Masato Ogawa
Doc O’Leary
Dennis Perzanowski
Fabian Ramirez
Pete Roberts
Nick Rothwell
Robert Rubinoff
Ray Spalding
Calvin C. Teague
Johan van Zanten

I would also like to thank all the people around the world who have sent me problem reports at one time or another. Unfortunately, there’s just no testing ground quite like the real world. There are too many people to list (and, in fact, too many to keep track of), but they know who they are. Thanks to all.

Thanks to Paul Mercer, Ken McLeod and Patrick C. Beard for creating the various components of the ShowINIT implementation used in this version of Gatekeeper and Gatekeeper Aid.

Gatekeeper and Gatekeeper Aid were written in version 4.0.5 of THINK C.

DISCLAIMER: My employer is in no way responsible for or involved with this project.