Hi Kevin, Thanks for your response. We understand that Endpoint Security authorization deadlines represent upper bounds and that ES clients are expected to respond as quickly as possible. We are not suggesting that Finder or DesktopServicesHelper bypasses kauth or Endpoint Security authorization. We attempt to perform file inspection as early as possible for files leaving the user’s machine; however, in real-world scenarios, inspection time can occasionally exceed a few seconds. Our concern is with the observed behavior where DesktopServicesHelper appears to proceed with unlinking the source file before the ES authorization event associated with the operation has received a response.
Topic:
App & System Services
SubTopic:
Core OS
Tags: