Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Minor Grammar & Correctness issues within known-limitations file of docs. #1345

Merged
merged 7 commits into from
May 14, 2024
Merged

Update Minor Grammar & Correctness issues within known-limitations file of docs. #1345

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
94915fb
Do correctness and grammar updates
Mpro256 May 10, 2024
08fca89
final fixes
Mpro256 May 10, 2024
3be8119
Update docs/known-limitations.md
Mpro256 May 10, 2024
5e3045d
Merge branch 'google:main' into patch-4
Mpro256 May 10, 2024
9c58f80
Fix Issues
Mpro256 May 10, 2024
4513b52
Update docs/known-limitations.md
Mpro256 May 10, 2024
17ac0f2
Fix My Mistake
Mpro256 May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions docs/known-limitations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,10 @@ nav_order: 7

## Known limitations

- Santa only blocks execution (execve and variants), it doesn't protect against dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`.
- Santa only blocks execution (execve and variants); it doesn't protect against dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`.

- Scripts: Santa is currently written to ignore any execution that isn't a binary. After weighing the administration cost versus the benefit, we found it wasn't worthwhile to manage the execution of scripts. Additionally, a number of applications make use of temporary generated scripts and blocking these could cause problems. We're happy to revisit this (or at least make it an option) if it would be useful to others.
- Scripts: Santa is written to ignore any execution that isn't a binary. After weighing the administrative cost versus the benefit, we found it wasn't worthwhile to manage the execution of scripts. Additionally, several applications make use of temporary scripts, and blocking these could cause problems. We're happy to revisit this (or at least make it an option) if it would be useful to others.

- USB Mass Storage Blocking: Santa's USB Mass Storage blocking feature is only meant to stop incidental
- USB Mass Storage Blocking: Santa's USB Mass Storage blocking feature only stops incidental
data exfiltration. It is not meant as a hard control. It cannot block:
* Storage devices mounted during boot prior to Santa having an opportunity to begin authorizing mounts
* Directly writing to an unmounted, but attached device
Loading