In macOS 10.15, double-click to start an app. ES_EVENT_TYPE_AUTH_EXEC event location where the app is located.

App & System Services Core OS
c4m3l OP
Created Jun ’23
Replies 1
Boosts 0
Views 832
Participants 2

I encountered such a problem, when I am in macOS 10.15 this part, through monitoring ES_EVENT_TYPE_AUTH_EXEC ESF framework, if I double click on the start/Users/test/Downloads/test. The app, The path of test.app corresponding to message->event.exec.target-> Path. data in the ES_EVENT_TYPE_AUTH_EXEC event is under /private/var/folders. This prevents me from blocking the test.app startup in the /Users/test/Downloads/ directory through string matching.

Replies  1
Boosts  0
Views  832
Participants  2
DTS Engineer OP
Apple
Jun ’23

The path of … is under /private/var/folders

Does that path suggest that app translocation is involved? See App Translocation Notes for more background on that.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0
In macOS 10.15, double-click to start an app. ES_EVENT_TYPE_AUTH_EXEC event location where the app is located.
First post date Last post date
 
 
Q