diff --git a/Source/santa-driver/SantaDecisionManager.cc b/Source/santa-driver/SantaDecisionManager.cc index b75284eaf..4965635e5 100644 --- a/Source/santa-driver/SantaDecisionManager.cc +++ b/Source/santa-driver/SantaDecisionManager.cc @@ -589,7 +589,17 @@ int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred, void SantaDecisionManager::FileOpCallback( const kauth_action_t action, const vnode_t vp, const char *path, const char *new_path) { - if (!ClientConnected() || proc_selfpid() == client_pid_) return; + if (!ClientConnected()) return; + + // KAUTH_FILEOP_CLOSE implies KAUTH_FILEOP_CLOSE_MODIFIED, so remove it from the cache. + if (action == KAUTH_FILEOP_CLOSE) { + auto context = vfs_context_create(nullptr); + RemoveFromCache(GetVnodeIDForVnode(context, vp)); + vfs_context_rele(context); + } + + // Don't log santad fileops. + if (proc_selfpid() == client_pid_) return; if (vp && action == KAUTH_FILEOP_EXEC) { auto context = vfs_context_create(nullptr); diff --git a/Tests/KernelTests/main.mm b/Tests/KernelTests/main.mm index b439a29f4..1454f68bc 100644 --- a/Tests/KernelTests/main.mm +++ b/Tests/KernelTests/main.mm @@ -687,7 +687,7 @@ - (void)testNoTransitiveRules { [hello waitUntilExit]; TFAILINFO("Should not have been able to launch /private/tmp/hello"); } @catch (NSException *exception) { - TPASS(); + // All good } // Check that there wasn't a decision for /private/tmp/hello in the cache. if (helloCount != 1) {