No Endpoint Security events for read/write from/to shared memory

Question

Mos123 OP

Created Dec ’22

Replies 2

Boosts 0

Views 1.1k

Participants 2

Hi,

I see no endpoint security events when writing & reading to & from shared memory segments. I used the following for accessing the shared memory: fd = shm_open("/AAA", O_CREAT | O_RDWR, S_IRUSR | S_IWUSR); ftruncate(fd, 32) addr = mmap(NULL, 32, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

Is there a way to monitor shm access?

Thx, Moshe.

Boost

Answer 1

Mos123 OP

Jan ’23

Just for clarification, I see no endpoint security events that point to the shared memory operations.

0

Answer 2

DTS Engineer OP

Apple

Jan ’23

I see no endpoint security events that point to the shared memory operations.

Agreed.

If you’d like to see such support added in the future, I encourage you to file an enhancement request describing your requirements. Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0