Skip to content

Commit

Permalink
Docs: Minor grammar & correctness fixes in known-limitations.md. (#1345)
Browse files Browse the repository at this point in the history
  • Loading branch information
Mpro256 authored May 14, 2024
1 parent 978b33e commit 7f06b8c
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions docs/known-limitations.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,10 @@ nav_order: 7

## Known limitations

- Santa only blocks execution (execve and variants), it doesn't protect against dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`.
- Santa only blocks execution (execve and variants); it doesn't protect against dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`.

- Scripts: Santa is currently written to ignore any execution that isn't a binary. After weighing the administration cost versus the benefit, we found it wasn't worthwhile to manage the execution of scripts. Additionally, a number of applications make use of temporary generated scripts and blocking these could cause problems. We're happy to revisit this (or at least make it an option) if it would be useful to others.
- Scripts: Santa is written to ignore any execution that isn't a binary. After weighing the administrative cost versus the benefit, we found it wasn't worthwhile to manage the execution of scripts. Additionally, several applications make use of temporary scripts, and blocking these could cause problems. We're happy to revisit this (or at least make it an option) if it would be useful to others.

- USB Mass Storage Blocking: Santa's USB Mass Storage blocking feature is only meant to stop incidental
- USB Mass Storage Blocking: Santa's USB Mass Storage blocking feature only stops incidental
data exfiltration. It is not meant as a hard control. It cannot block:
* Storage devices mounted during boot prior to Santa having an opportunity to begin authorizing mounts
* Directly writing to an unmounted, but attached device

0 comments on commit 7f06b8c

Please sign in to comment.