Endpoint security - Stop user from opening file in write mode.

I tried Sample app given in WWDC. Using "ES_EVENT_TYPE_AUTH_OPEN" I could stop writing to file using echo. But if I use vim or text edit and edit the file it saves the changes.

I tried "ES_EVENT_TYPE_AUTHSIGNAL", "ES_EVENT_TYPE_AUTH_UNLINK", "ES_EVENT_TYPE_AUTH_TRUNCATE", but no luck.

Accepted Reply

The most common cause of this problem is that the app is doing a safe save. This involves writing the content to a temporary file and then atomically replacing the original file with rename. My advice is that you use fs_usage to uncover the exact file system APIs being used by the app and then update your ES client accordingly.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies

The most common cause of this problem is that the app is doing a safe save. This involves writing the content to a temporary file and then atomically replacing the original file with rename. My advice is that you use fs_usage to uncover the exact file system APIs being used by the app and then update your ES client accordingly.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"