Missing synchronous events for close in Endpoint Security Framework

In KAuth, we were able to monitor file close event using KAUTHFILEOPCLOSE listeners in synchronous fashion

However, corresponding event in Endpoint Security (ESEVENTTYPENOTIFYCLOSE) is Async.

We don’t expect an AUTH event, however we expect it to be synchronous. It is okay even if we are not able to block/deny it.

I understand you have Auth and Notify model in new framework. Having synchronous but not Auth won't fit into your existing model.

May be if it can be exposed as Auth and you can ignore the result as the call being file close.

If you have any suggestion or workaround, let us know.
I think your analysis of the current situation is correct. My advice here is that you file an enhancement request with detailed info about what you’re doing on close that needs to be done synchronously.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
Missing synchronous events for close in Endpoint Security Framework
 
 
Q