Monitoring - authorisation rules

Elevate24 has the capability to block processes or file actions while the user is elevated, or always regardless of elevation. When configuring this, it's important to test the configuration to ensure the desired outcome.

File operation rules

• Availability: Premium
• Type: Array

Rules to restrict file operations. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. File open operations can be restricted to read-only access where required.

<key>FileOperationRules</key>
	<array>
		<dict>
			<key>action</key>
			<string>allow</string>
			<key>alwaysActive</key>
			<true/>
			<key>fileOperation</key>
			<string>file:open</string>
			<key>fileTargetPath</key>
			<string>/path/to/file</string>
			<key>signingID</key>
			<string>com.example.app</string>
			<key>username</key>
			<string>username</string>
		</dict>
	</array>

Parameters

Key	Type	Required	Description
action	String	Yes	The action to apply. Accepted values: allow, block, readOnly
alwaysActive	Boolean	No	When true, the rule applies at all times regardless of elevation. When omitted or false, the rule only applies during an elevated session.
fileOperation	String	Yes	The file operation to match. Accepted values: file:open, file:unlink
fileTargetPath	String	No	Path to the target file or directory. Supports wildcards, e.g. /private/var/*
signingID	String	No	Signing ID of the process performing the file operation, e.g. com.apple.finder
username	String	No	Restricts the rule to a specific local username

NOTE

At least one of fileTargetPath, signingID, or username should be specified to avoid broadly matching all file operations.

---

Execute process rules

• Availability: Premium
• Type: Array

Rules to restrict execution of processes. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. Multiple arguments can be specified by separating them with a comma.

<key>ExecuteProcessRules</key>
	<array>
		<dict>
			<key>action</key>
			<string>block</string>
			<key>alwaysActive</key>
			<true/>
			<key>matchingArgumentsContaining</key>
			<string>Contains...</string>
			<key>processPath</key>
			<string>/Applications/Example.app/Contents/MacOS/Example</string>
			<key>signingID</key>
			<string>com.example.app</string>
			<key>sourceSigningID</key>
			<string>com.example.app</string>
			<key>username</key>
			<string>username</string>
			<key>silentBlock</key>
			<true/>
		</dict>
	</array>

Parameters

Key	Type	Required	Description
action	String	Yes	The action to apply. Accepted values: allow, block
alwaysActive	Boolean	No	When true, the rule applies at all times regardless of elevation. When omitted or false, the rule only applies during an elevated session.
matchingArgumentsContaining	String	No	Matches processes whose launch arguments contain this value. Separate multiple values with a comma, e.g. --admin,--elevated
processPath	String	No	Full path to the process executable, e.g. /usr/bin/curl
signingID	String	No	Signing ID of the process to match, e.g. com.apple.Terminal
sourceSigningID	String	No	Signing ID of the launching (parent) process. Used to permit or block a process from being launched from a nominated source
username	String	No	Limits application of the rule to a specific username. This key is only valid for Elevate24 2.5+
silentBlock	Boolean	No	When true, users will not be notified of the blocked process. When omitted or false, users will be notified if a process is blocked.

NOTE

At least one of processPath or signingID should be specified to avoid broadly matching all process executions.

IMPORTANT

Always test authorisation rules in a non-production environment before deploying. An overly broad block rule could prevent critical system processes from running.

Authorisation rule - notifications

• Availability: Premium
• Version: 2.5.0+

When an authorisation rule is triggered, the user is shown a notification.

Clicking on the notification will display more detailed information.

Authorisation rule - blocked events history

• Availability: Premium
• Version: 2.5.0+

Additional information and options are accessible via the settings panel.

From the settings panel, a 30-day history of blocked events is available.

This will show a history of triggered authorisation rules.

Each list item can be opened for additional details (displaying the same information shown when clicking the original notification).

Hide blocked events history

• Availability: Premium
• Version: 2.5.0+
• Default: false

When enabled, hides the blocked events history from the Elevate24 UI.

<key>HideBlockedEventHistory</key>
<true/>

NOTE

When enabled, users cannot view the blocked events history. Notifications are still shown when an authorisation rule is triggered.