deadline exceeded in monitor mode still ends up denying execution

When deadlines are exceeded here:

https://github.com/google/santa/blob/e8db89c57c41dde73fa447bca206faf9075eb484/Source/santad/EventProviders/SNTEndpointSecurityClient.mm#L296-L299

The process is still denied execution even if Santa is in monitor mode.

Also: these denials are not logged in the normal ALLOW/DENY logging (that end up in `/var/db/santa/santa.log*` files.

	LOGE(@"SNTEndpointSecurityClient: deadline reached: deny pid=%d, event type: %d ret=%d",
	audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type, res);
	dispatch_semaphore_signal(deadlineExpiredSema);
	});

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deadline exceeded in monitor mode still ends up denying execution #1283

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

deadline exceeded in monitor mode still ends up denying execution #1283

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions