Binary Blocked But FileInfo Says Allowed about santa HOT 8 CLOSED

This is my Preflight Response from the sync server. Should that toggle Clean Sync Required to NO?

{
    "clean_sync": false,
    "full_sync_interval": 600,
    "client_mode": "MONITOR",
    "batch_size": 100,
    "enable_bundles": true,
    "enable_transitive_rules": true
}

Also docs says full_sync_interval is REQUIRED but seems to work without it

from santa.

I'd like to first confirm a few things.

1. Could you please provide the santactl version output
2. The preflight response data indicates that the client mode should be in MONITOR, but the exec log string and status output both indicate the system is in Lockdown mode. Is the preflight response block you provided correct? (If so, I assume this is then a separate issue?)
3. Is it the case that the exec is always denied? After a sync, does it begin being allowed (i'm curious if this is "startup" issue where the system is executing the file in lockdown mode before the first sync that flips it to monitor mode and downloads rules...)

from santa.

1. santactl version

$ santactl version
santad          | 2023.8 (build 569285362)
santactl        | 2023.8 (build 569285362)
SantaGUI        | 2023.8 (build 569285362)

2. The Json I provided above is a different case; I was just confirming what needs to be sent down for Clean Sync to Toggle to NO. So, that is a different issue

3. It is allowed but I keep getting the Santa Blocked Notification. Everything seem to be working fine but the Blocked Notification keep coming up.

from santa.

It is also happening on Santa 2023.6. Some installations do not have the issue and we just confirmed that all the binaries are actually allowed to run; we are just getting the block notification as a NsNotification Observer

from santa.

We are also observing that the blocking is actually happening but intermittent. So it blocks and allows intermittently.

@russellhancox Not sure if this is related but the behavior started after we added StaticRules in addition to using SyncServer as we discussed couple days ago

from santa.

We seem to be narrowing this down to be happening only on machines that the installation of Santa is managed by MDM and we think it might be due to reinstallation of Santa periodically even though it is already installed.

from santa.

We can confirm that this was a tooling issue where Santa was getting reinstalled hourly due to config issues on our deployment pipeline.

from santa.

Was your deployment pipeline also resetting Santa somehow? A simple reinstall of the package should not generally trigger a clean sync or changes to existing rules.

from santa.