trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

Include arguments in log #96

Open SixGenInc opened 4 years ago

SixGenInc commented 4 years ago

The Endpoint Security Framework includes process agruments as es_exec_arg which can be extracted as shown here (Objective-C). It would be very helpful to include these process arguments in the sinter log to start with, and potentially use them in decisions in the future (i.e. sudo processA is allowed but sudo processB is not). This would also help get sinter up par with Santa which logs process arguments.