In macOS 11.0 RC2, there is an issue that the file lock is unlocked when the ES_EVENT_TYPE_AUTH_OPEN callback of EndpointSecurity is passed!

Honorable Quinn,
I have a problem with macOS 11.0 Big Sur RC2.

I did nothing for the file at the time of opening with EndpointSecurity and allowed all of them.
Of course I refer to the source code of the official EndpointSecurity example.

However, a problem arises in the process of using the file lock.
The file lock is unlocked even when the process is alive.

When I check, the problem is not reproduced unless I receive the ESEVENTTYPEAUTHOPEN callback.
If all events are allowed through the esrespondflagsresult() function in the ESEVENTTYPEAUTH_OPEN callback, the file lock may be released.

This issue has a high reproducibility.
Ask for confirmation and advice.
Thank you.

This issue has a high reproducibility.

This sounds like a bug to me. I recommend that you file a bug report that describes this reproducible case. Please post your bug number, just for the record.

Oh, in your bug report you should also mention whether this is newly introduced in 11.0.1rc2. Or whether this was present in earlier 11.0 beta releases. Or indeed whether it’s present in 10.15.x.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
I reported a bug to the Feedback Assistant.
The posting number is as follows.

FB8893122

Thank you.

I reported a bug to the Feedback Assistant …

FB8893122

Thanks. Unfortunately we’re not able to reproduce the problem based on the info in that bug report. If you can update your bug with more concrete steps to reproduce, that’d be grand.

Your best option here would be to attach a small test ES client and a test program that uses file locks in a way that’s ‘broken’ by that ES client.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
In macOS 11.0 RC2, there is an issue that the file lock is unlocked when the ES_EVENT_TYPE_AUTH_OPEN callback of EndpointSecurity is passed!
 
 
Q