Comments (2)
russellhancox
commented on April 28, 2024
No, the header forward declares the class and it's imported in SNTExecutionController.m.
Blocking via MAC policy was considered and discarded: before 10.11 the MAC framework was not considered KPI and subject to change without notice (which it did, between 10.9 and 10.10). It is now considered a KPI in 10.11 but SIP blocks dylib injection via environment variable.
from santa.
x43x61x69
commented on April 28, 2024
Gotcha about the header one. :) Didn't noticed that as I was checking file by file on GitHub,
It's great to know that SIP blocks dylib injection via environment variable! I didn't noticed that either. Does it also prevent KEXTs from calling task_get_pid()? If not, rootkits could still inject the dylib directly into the process memory without using the environment variable. (Of course it needs root and SIP disabled first to load a KEXT. But user might have disabled SIP for certain reasons like using app such as XtraFinder, or when an unpatched exploit is found.) Would be nice if we could have an "in advance" protection regarding those issues just in case.
Anyways, thank you for the super quick reply!
Cai
from santa.
Related Issues (20)
- Use SecTaskGetCodeSignStatus for Platform Binaries HOT 4
- Can't install the sample profile- The profile must originate from a user approved MDM server. HOT 2
- Any way to avoid chunked encoding? HOT 8
- Certificate SHA256 hashes are case-sensitive HOT 5
- Present information in the Santa blocked pop-up so it is more readily copy/pasted to a new rule HOT 2
- Incorrect event decision code being synced to server (ALLOW_UNKNOWN instead of ALLOW_TEAMID) HOT 5
- Allow events not being sent to sync server in Lockdown mode HOT 5
- Blocked Execution system notification is not processed unless receiver is focussed HOT 5
- Config: Add ability to include custom headers in sync requests
- Simple developer bootstrap - still possible? HOT 2
- v2023.6 Does not Apply Path Scope Rules HOT 1
- How to build santa universal binary HOT 8
- Unable to enable lockdown mode HOT 5
- Enhancement idea: Wildcards in SigningID rules HOT 4
- Compiler rules not allowing specified compiler binary to run? HOT 7
- Unable to get transitive rules working with XCode HOT 13
- Intellij IDE Debugging Blocked in Lockdown Mode HOT 6
- Feature Request: System Notifications in Monitor Mode HOT 4
- Transitive Rules for Bazel Build Agent HOT 1
- Options for speeding up the sync of new rules HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from santa.