trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

When in MONITOR mode, do not block an exec when signature verification takes too long #60

Closed mike-myers-tob closed 4 years ago

mike-myers-tob commented 4 years ago

Example:

Severity: warning Message: '/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS.simruntime' has been denied execution because the authorization/code signing check process took too long

What's happening here is the API allows your application 30 seconds maximum to make a decision to allow or deny a process execution event. Verifying the code signature on especially large binaries may approach or exceed 30 seconds, so a safe default decision has to be made immediately and then once the signature verification is done and cached, a real decision can be made on a second execution attempt. This affects Xcode.app in particular.

But the desired functionality for MONITOR mode is to default allow even in this case. We will add the exception in MONITOR mode.