Rules for Temp Files During Build about santa HOT 2 CLOSED

We have build processes written in Python that generates a lot of temp files that are blocked in lockdown mode. Since Python is not a compiled language, should we still add compiler rules for the Python binary to allow builds to run smoothly without blocking outputs. I am assuming we may need to do same for Java, Rust, C#, c++, etc?

Right now you have to add more compiler rules or use a scope to allow executables from a path see AllowedPathRegex.

What will be the best approach?

Hard to say without knowing your environment and security needs. Some folks use scopes to allow anything run under a given path. Others try to setup compiler rules.

Also when running 'brew install' in lockdown mode, it is not a pretty experience as a lot of things get blocked and have to add rules and start over. We are now thinking of implementing a snooze mode to temporary go into monitor mode while doing this kind of activities in lockdown but that defeats the purpose.

This is a known limitation and unfortunately there isn't much to say at this point. We're trying to find better ways to improve the experience overall while still maintaining security.

from santa.

Thank you!

from santa.