(Sierra) AppTranslocation has side-effect of bypassing BlacklistRegex about santa HOT 3 CLOSED

BlacklistRegex was not an originally-planned feature but was added due to request in #23, it's not something I think will ever be hugely useful and will always have holes. There are other issues, like the fact that scripts in BlacklistRegex matched paths will also be blocked (where scripts would normally be ignored). I think it would be best to very clearly document that it's not a reliable way to block things.

from santa.

I was actually kindof into that side-effect (blocking scripts...), but I get it. It's just I'm in one of those wacky places where everyone still doesn't run as admins day-to-day, so it does provide a fair amount of value, especially without a server. I've added my impressions on that to the discussion on santa-dev I started, but docs to that effect would indeed help make things clearer. It sounds like the guidance is only monitor with a sprinkling of specific blacklists as needed, or lockdown.

from santa.

I'm going to let this one close as well, as it's not considered intended use. (Just for kicks, you can actually trace this back with security's translocate-original-path verbs, seems like they're giving GK teeth to stop being so naïve)

from santa.