Hi,
According to wwdc20-10159 there are two approaches in utilizing the Endpoint Security framework in macOS application:
- Packaged as a system extension.
- Embedded inside a daemon that is packaged into an application bundle.
WWDC 2020 Session 10159 (wwdc20-10159) - Build an EndpointSecurity app - also mentions:
"While it's possible to distribute your ES application as a stand-alone product, we believe there are a lot of benefits to delivering your product as an EndpointSecurity based system extension".
"Also, there are some EndpointSecurity features that products can only use if they are a system extension"
After performing quite deep research including rereading the transcriptions of all EndpointSecurity related wwdc sessions - the following questions arise:
-
I couldn't find any source that will list all those features. Does such exist?
-
What are the limitations of the non system extension approach comparing to EndpointSecurity based system extension?