santa
santa copied to clipboard
Intellij IDE Debugging Blocked in Lockdown Mode
What will be the correct rule to allow debugging in IntelliJ IDEA a temp output is blocked? See the message from Santa below for a Golang app executed from within IntelliJ in the IDE terminal:
debugserver-@(#)PROGRAM:LLDB PROJECT:lldb-1403.0.17.67
for x86_64.
Got a connection, launched process /private/var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker (pid = 62618).
Santa
This application has been blocked
Path: /private/var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker
Identifier: 65f1fe5df81290c6cf12434e088576d9ae81a9de5f18fbc6c8bab0b4808f6b18
Parent: debugserver (62617)
santactl fileinfo /private/var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker
gave the following output:
Path : /var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker
SHA-256 : 65f1fe5df81290c6cf12434e088576d9ae81a9de5f18fbc6c8bab0b4808f6b18
SHA-1 : 593ea43e632474253441b40ac2796269cc9a4b30
Type : Executable (x86_64)
Code-signed : No
Rule : Blocked (Unknown)
Not sure if this is related to #561 as we have compiler rules already written for goland.
The Santa log entry is
[2023-09-13T12:43:21.565Z] I santad: action=EXEC|decision=DENY|reason=UNKNOWN|explain=Signature ignored due to error: -67062|sha256=65f1fe5df81290c6cf12434e088576d9ae81a9de5f18fbc6c8bab0b4808f6b18|pid=62618|pidversion=1883468|ppid=62617|uid=59003|user=user1|gid=20|group=staff|mode=L|path=/private/var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker|args=/private/var/folders/w5/pvflyg8942d4041xjq5vxdk4001slv/T/GoLand/___notify_docker