Confusing process information on brew install

[torarnv]

When doing e.g. brew install llvm, LuLu catches brew reaching out to its package repo. But the resulting dialogs are a bit confusing in what caused this:

Why is /usr/bin/cp and /usr/local/blame/rm blamed for the network connection?

[torarnv]

Even more confusingly:

[ghost]

Could it be the infamous notarization checks when binaries are run?

https://lapcatsoftware.com/articles/catalina-executables.html

IIRC there is a basic command to be able to turn that off in macOS, floating around on the Internet. Can't find it now but IIRC I've implemented it in my system...

[torarnv]

If that was the case, wouldn't it reach out to Apple servers, not GitHub? I'm assuming this is actually LuLu catching Homebrew talking to GitHub to get the latest list of packages e.g.

[ghost]

Oh my bad I didn't check the IP. Sorry for potentially useless comment.

[objective-see]

Thanks for the feedback!
I've updated the code that maps a network flow to a process.

Before I was using the reported process id (pid), which could be problematic if the process forked/exec'd, or exited and the pid was re-used (LuLu would then report the wrong path 😅).

Good news, I refactored the code to now use the process's audit token (which should never be re-used). This should fix this issue!
...LuLu should now always report the correct path, etc. for the process responsible for generating the network flow.

Could you test the latest beta to confirm the fix?
https://bitbucket.org/objective-see/deploy/downloads/LuLu_2.0.0_BETA.zip

Mahalo again!

[torarnv]

Much appreciated!!! This bug was making me a bit unweary about my system being compromised in some way, especially when I saw the network connections being reported for my own software 😄 Thanks for looking into it!!

Will test the beta and report back ASAP!

[torarnv]

Looking good now! 😊

I guess there's nothing to do about brew exec'ing, hiding the "initiator" of the network connection.

So unless I specify a remote endpoint rule scope, /usr/bin/curlwill be allowed to reach out to any network address regardless of which script (hostile or not) is initiating it, do I understand that correctly? Is there any way to mitigate that?

Thanks!

[torarnv]

(Not saying LuLu isn't excellent, just trying to understand the considerations and possible threat models) 😊

[objective-see]

Correct, hence the addition of endpoint rules :)
...or perhaps you could go w/ 'temporary' so just that instance of curl would be allowed.

[torarnv]

Thanks! Love your tools, will bump my patreon tier! ❤️