Sinter: New user-mode security enforcement for macOS

Summary: Trail of Bits released Sinter, an open-source macOS endpoint protection agent written entirely in Swift that uses Apple's EndpointSecurity API to receive authorization callbacks from the kernel and allow or deny process execution events via rules. The release comes as Apple deprecates third-party kernel extensions and requires security vendors to migrate to user-mode APIs before macOS 11 Big Sur, and the EndpointSecurity entitlement required to use the API took Trail of Bits six calendar weeks to obtain from Apple.
Key Takeaway: Every macOS security product that authorizes events in real time must be rewritten for EndpointSecurity before Big Sur, and the API enforces a per-message deadline that terminates a client process if it blows the deadline. Sinter's own development locked up a machine on a burst of execution events involving large programs, and bundle-level code-signing checks on apps like Xcode.app, upwards of a gigabyte, cannot complete in real time.

Read the original at Trail of Bits Blog ↗