gt 1 Whether the EndpointSecurit

Question

< groob> < alessandrogario> gt 1 Whether the EndpointSecurity Client must be a system extension gt My understanding is that EndpointSecurity require that clients run as root and have the entitlement meaning there s no specific requirement that the client be a system extension This is in contrast to other subsystems like system wide NetworkExtensions which must be packaged as system extensions

alessandrogario · Answer

I m running it the same way in another project here s the code <https github com zeek zeek agent blob master components zeekendpointsecurity src endpointsecurityconsumer cpp>

alessandrogario · Answer

Never experienced the issue mentioned in the tweet mostly because I always stick to RAII slightly smiling face

alessandrogario · Answer

I have to update the is platform binary handling there too neutral face really misleading from the framework to put such an unreliable field in there

sharvil · Answer

re platform binary you can just report on `es message gt process gt platform binary` instead of the `event exec gt target gt platform binary` that would solve it right

alessandrogario · Answer

i would have to be called parent is platform binary then

alessandrogario · Answer

I m not sure how useful it is though

alessandrogario · Answer

the hash field is also annoying

alessandrogario · Answer

I know that all these issues are just coming from kauth but I wish they would have put more care into it

alessandrogario · Answer

so you can get either a sha1 or a sha256 value

alessandrogario · Answer

but either way it s always truncated at the length of the sha1

alessandrogario · Answer

only way around that is to check on the file manually but that s of course a race condition neutral face

sharvil · Answer

yeah

sharvil · Answer

did you read the comments on `ESMessage h` header especially related to codesigning

sharvil · Answer

```If page content has been tampered with in the executable we won t know until that page is paged in At that time the process will have its CS VALID bit removed and if CS KILL is set the process will be killed preventing any tampered code to be executed CS KILL is generally set for platform binaries and for binaries having opted into the hardened runtime An ES client wishing to detect tampered code before it is paged in for example already at exec time can use the Security framework to do so but should be cautious of the potentially significant performance cost of doing so The EndpointSecurity subsystem itself has no role in verifying the validity of code signatures ```

alessandrogario · Answer

Yes I did it s pretty sad joy