Binary Blocked But FileInfo Says Allowed

[eopeter]

We are experiencing an issue where Santa blocks a binary but when we look at the fileinfo, it is shown should be allowed.

Santa Log with Block

[2023-10-26T13:20:59.332Z] I santad: action=EXEC|decision=DENY|reason=UNKNOWN|explain=Signature ignored due to error: -67062|sha256=a84a83816a74fcc58fa9d1a57f12aef3f15f98290d1efc3427782468f3a0ff50|pid=60189|pidversion=121865|ppid=60188|uid=0|user=root|gid=0|group=wheel|mode=L|path=/usr/local/Homebrew/Caskroom/kd-cleanpython310/1.1.12/3.10.2/bin/python3.10|args=/export/apps/python/3.10/bin/python3.10 -sSE /usr/local/bin/rdev --version

FileInfo

$ santactl fileinfo /usr/local/Homebrew/Caskroom/kd-cleanpython310/1.1.12/3.10.2/bin/python3.10
Path                   : /usr/local/Homebrew/Caskroom/kd-cleanpython310/1.1.12/3.10.2/bin/python3.10
SHA-256                : a84a83816a74fcc58fa9d1a57f12aef3f15f98290d1efc3427782468f3a0ff50
SHA-1                  : bae4b00b55003378d51c617d8d3ae9f95aba69ad
Type                   : Executable (x86_64)
Code-signed            : No
Rule                   : Allowed (Binary)

Also, Clean Sync is always YES even though a full sync completed

$ sudo santactl sync
SyncBaseURL is not over HTTPS!
Preflight starting
Clean sync requested by user
Performing request, attempt 1 (of 5 maximum)...
Preflight complete
Event upload starting
Event upload complete
Rule download starting
Performing request, attempt 1 (of 5 maximum)...
Received 1561 rules
Processed 1561 rules
Rule download complete
Postflight starting
Performing request, attempt 1 (of 5 maximum)...
Postflight complete
Sync completed successfully
----
$ santactl status
>>> Daemon Info
  Mode                      | Lockdown
  Log Type                  | file
  File Logging              | Yes
  USB Blocking              | No
  Watchdog CPU Events       | 0  (Peak: 9.01%)
  Watchdog RAM Events       | 0  (Peak: 42.05MB)
>>> Cache Info
  Root cache count          | 8
  Non-root cache count      | 0
>>> Database Info
  Binary Rules              | 1345
  Certificate Rules         | 17
  TeamID Rules              | 199
  SigningID Rules           | 0
  Compiler Rules            | 1
  Transitive Rules          | 0
  Events Pending Upload     | 0
>>> Static Rules
  Rules                     | 4
>>> Watch Items
  Enabled                   | No
>>> Sync Info
  Sync Server               | http://localhost:76333/v1/santa/
  Clean Sync Required       | Yes
  Last Successful Full Sync | 2023/10/26 09:34:18 -0400
  Last Successful Rule Sync | 2023/10/26 09:34:18 -0400
  Push Notifications        | Disconnected
  Bundle Scanning           | Yes
  Transitive Rules          | Yes
>>> Metrics Info
  Metrics Server            | https://localhost:69844/metrics/santa
  Export Interval (seconds) | 30

[eopeter]

This is my Preflight Response from the sync server. Should that toggle Clean Sync Required to NO?

{
    "clean_sync": false,
    "full_sync_interval": 600,
    "client_mode": "MONITOR",
    "batch_size": 100,
    "enable_bundles": true,
    "enable_transitive_rules": true
}

Also docs says full_sync_interval is REQUIRED but seems to work without it

[mlw]

I'd like to first confirm a few things.

1. Could you please provide the santactl version output
2. The preflight response data indicates that the client mode should be in MONITOR, but the exec log string and status output both indicate the system is in Lockdown mode. Is the preflight response block you provided correct? (If so, I assume this is then a separate issue?)
3. Is it the case that the exec is always denied? After a sync, does it begin being allowed (i'm curious if this is "startup" issue where the system is executing the file in lockdown mode before the first sync that flips it to monitor mode and downloads rules...)

[eopeter]

1. santactl version

$ santactl version
santad          | 2023.8 (build 569285362)
santactl        | 2023.8 (build 569285362)
SantaGUI        | 2023.8 (build 569285362)

2. The Json I provided above is a different case; I was just confirming what needs to be sent down for Clean Sync to Toggle to NO. So, that is a different issue

3. It is allowed but I keep getting the Santa Blocked Notification. Everything seem to be working fine but the Blocked Notification keep coming up.

[eopeter]

It is also happening on Santa 2023.6. Some installations do not have the issue and we just confirmed that all the binaries are actually allowed to run; we are just getting the block notification as a NsNotification Observer

[eopeter]

We are also observing that the blocking is actually happening but intermittent. So it blocks and allows intermittently.

@russellhancox Not sure if this is related but the behavior started after we added StaticRules in addition to using SyncServer as we discussed couple days ago

[eopeter]

We seem to be narrowing this down to be happening only on machines that the installation of Santa is managed by MDM and we think it might be due to reinstallation of Santa periodically even though it is already installed.

[eopeter]

We can confirm that this was a tooling issue where Santa was getting reinstalled hourly due to config issues on our deployment pipeline.

[russellhancox]

Was your deployment pipeline also resetting Santa somehow? A simple reinstall of the package should not generally trigger a clean sync or changes to existing rules.