Do not include any non-Apple default suppressions

droe · Nov 5, 2018 · 0fb26c4 · 0fb26c4
1 parent f18f869
commit 0fb26c4
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/pkg/configuration.plist-default.in b/pkg/configuration.plist-default.in
@@ -364,12 +364,12 @@
        -->
   <key>suppress_image_exec_by_path</key>
   <array>
-  <!--
+    <!--
     <string>/usr/libexec/xpcproxy</string>
     <string>/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker</string>
     <string>/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker32</string>
-    -->
     <string>/Applications/Splunk/bin/splunk-optimize</string>
+    -->
   </array>
 
   <!-- Suppress exec image events by ancestor ident:
@@ -399,7 +399,9 @@
        -->
   <key>suppress_image_exec_by_ancestor_path</key>
   <array>
+    <!--
     <string>/opt/local/bin/port</string>
+    -->
   </array>
 
   <!-- Suppress process access events by subject ident:
@@ -473,6 +475,9 @@
     <string>com.apple.mDNSResponder</string>
     <string>com.apple.configd</string>
     <string>com.apple.symptomsd</string>
+    <!--
+    <string>com.docker@9BNSXJN65R</string>
+    -->
   </array>
 
   <!-- Suppress socket op events by subject path:
@@ -489,6 +494,7 @@
     <string>/usr/sbin/mDNSResponder</string>
     <string>/usr/libexec/configd</string>
     <string>/usr/libexec/symptomsd</string>
+    <string>/Applications/Docker.app/Contents/Resources/bin/com.docker.vpnkit</string>
     -->
   </array>