google / santa / 5859796732

63%

push

github

Add support for was_mmaped_writeable to file write monitoring when using macOS 13+ (#1148)

Add support for was_mmaped_writeable to file write monitoring when using macOS 13

In macOS 13 close events now have a new field was_mapped_writable that lets us
track if the file was mmaped writable.  Often developer tools use mmap to
avoid large numbers of write syscalls (e.g. the go toolchain) and this improves
transitive allow listing with those tools.

4156 of 8406 branches covered (49.44%)

Branch coverage included in aggregate %.

74 of 74 new or added lines in 2 files covered. (100.0%)

14744 of 20653 relevant lines covered (71.39%)

15415.39 hits per line