Post not yet marked as solved
We are seeing the same problem, only 1 of our 2 launch daemons is being started. One item is missing from the Background Application list in system settings and for the rest it's saying: It's from an unknown developer even with our correct production signing.
Post not yet marked as solved
Hello, we also used the kTCCServiceSystemPolicyAllFiles key in the TCC.db "access" table to verify if the user has been granted full disk access privileges for our extension using ES client. Now in beta 10 or extension is listed under key kTCCServiceEndpointSecurityClient. Does this also now signal that Full Disk Access has been granted?
Frank Fenn
Sophos Inc.
Not solved, accidentally clicked..
Hello, here's a brief outline of the architecture in use.
[daemon app] running as root with Full Disk Access enabled.
> is linked against PyHelper.framework located in /Library/Frameworks
> calls PythonHelper() (passes python byte code)
[PythonHelper() function]
> loads PyExec.framework via dlopen() also located in /Library/Frameworks
PyExec.framework has a customized version of Python located in Version/Current/Frameworks/Python.framework> gets PythonExec() function via dlsym() which finally causes the embedded Python framework to execute the byte code
> file deletions at this level fails!
No new process is created! Frameworks and calling daemon app have the same code signing and team ID. This architecture works on 10.15 but breaks on Big Sur. I've tried even with SIP disabled which does not result in a different outcome.
Post not yet marked as solved
Hello,a) I was just wondering why this function exists. es_clear_cache() seems to remove items the client did not store. So for example: I block the execution for a specific exectable during handling an AUTH_EXEC event. I want to make sure that none of the clients decision to allow or deny execution or a file open (in case of AUTH_OPEN) will be cached, so I will receive repetitive events for the same item and can make decisions again.b) if something is cached for the es client, will that reflect on the memory usage of the cleint process?Sincerely,Frank FennSophos Inc.
Post not yet marked as solved
I am definitely interested in the outcome of the discussion (use case 2)Frank FennSophos Inc.
Post not yet marked as solved
it looks like beta 10 has fixed the issueFrank FennSophos Inc.
Post not yet marked as solved
Feedback Ticket # : FB7321319
