trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

Sinter in monitor mode still blocks processes with missing/invalid signatures #56

Closed mike-myers-tob closed 4 years ago

mike-myers-tob commented 4 years ago

Example:


Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2/bin/git'. Execution has been denied
Severity: information Message: Requesting new rule database from the sync-server...
Severity: error Message: Failed to contact the Moroz server: Could not connect to the server.
[1]    28051 killed     sudo```
mike-myers-tob commented 4 years ago

In the current beta release of Sinter (0.1.1), after installing the latest Homebrew version of git:

In the Sinter log:

% codesign -dvvvv /usr/local/Cellar/git/2.26.2_1/bin/git
/usr/local/Cellar/git/2.26.2_1/bin/git: code object is not signed at all
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.
Severity: information Message: Invalid code signature for '/usr/local/Cellar/git/2.26.2_1/bin/git'.

Nothing blocks or locks, so there might be more at play here. Next step is to try to reproduce more closely, by testing zsh and git together, and/or adding additional logging to Sinter.

mike-myers-tob commented 4 years ago
➜  Desktop echo $SHELL
/bin/zsh
➜  Desktop which git
/usr/local/bin/git
➜  Desktop /usr/local/bin/git --version
git version 2.26.2
➜  Desktop /usr/local/Cellar/git/2.26.2_1/bin/git --version # the homebrew installed path
git version 2.26.2