google / grr

GRR Rapid Response: remote live forensics for incident response

Home Page:https://grr-doc.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Catalina (macos 10.15.5) - Operation not permitted

siftuser opened this issue · comments

Anybody noticed Operation not permitted error on filesystem operations such as listing or collecting files from agents running catalina ? If so, any workaround ? Thank you

Hello @siftuser - is your GRR agent signed/notarised? Catalina now enforces integrity checks via GateKeeper by default. See https://support.apple.com/en-us/HT202491 .

If you are a member of the grr-users Google Group you might find this discussion helpful: https://groups.google.com/forum/#!topic/grr-users/a4xWecZm_AA

Thanks @mari0d for sharing both useful links. The code signing steps described in google groups seems bit tricky ... appreciate if anybody has working guide or procedure. Thanks

There was a similar request concerning the Windows binary signing documentation. Our GRR client signing instructions are out of date. Unfortunately, I didn't have free cycles to update them yet - will do that on Monday of the coming week.

Thank you @mbushkov. Greatly appreciated

@siftuser - I did an iteration on our GRR client signing docs. The PR is here (will submit it soon):
https://github.com/google/grr-doc/pull/121/files

Hope this helps.

Thank you @mbushkov