Rules handling and client_sync

[weiminm]

Hi.

When a rule is deleted from the toml, a Santa sync does not remove the rule from the Santa dB.

Thanks!

[kcgaisford]

I can verify that this is the case.

[dannykorpan]

Same problem.

[trusted-francisg]

Same issue here. Anyone have a workaround for this?

[radsec]

Confirmed as well on my end.

[kcgaisford]

As a work around you can "over-write" the rule. AKA if it was blacklisted move it to the whitelist. or if it was whitelisted move to the blacklist.

Has gotten me past some of the issues haven't fully tested it. but it might resolve the issue for a few people.

[bfreezy]

Very late but with https://github.com/groob/moroz/pull/32 added the REMOVE policy type. So, you can now change your rule policy to REMOVE and the santa client will do the right thing and remove it.

ex:

[[rules]]
rule_type = "BINARY"
policy = "REMOVE"
identifier = "50d79d1763fefb56716e4a36284300523eb4335c3726fb9070fa83074b02279e"
custom_msg = "remove allowlist of the go compiler component"