EPM-Mac How to target user installed binary?

Question

Hi Everyone,

I have the following use case:
How can i target the git command in the terminal?
The Git binary was installed by the user via Homebrew.

I’ve tried matching File / Folder Name criteria with git, and also using the absolute path /usr/local/Cellar/git/2.51.1/bin/git in the Application Groups, but it still didn’t work.

I tried matching it with parent process and even using the hash (SHA-256).

I tested sample commands like ls -la, as shown in the documentation website, and the ls -la were successfully captured.

The git command filtering is only work when i use a sudo command application type. i.e. if i type sudo git pull...

But the case i want is not using sudo.
Does EPM-M only process binary that are signed by Apple?

Because the git from homebrew is not signed.

I’m using macOS 13 Ventura and PMC 25.6.580

Thanks

celliott · Accepted Answer

You would need to add a controlled path to the defendpoint.plist. Once that path is added, then BeyondTrust can manage those binaries. Then you can target the specific binary outside of sudo.

tclowater · Answer

Hi ​@raymondus,The best recommendation I can think of would be to target any binary with command line argument containing git. If you’re getting stuck, I would recommending checking with support if they are able to narrow down what is occurring with execution vs implementation.The terminal items, along with controlling homebrew, can be a bit more challenging if the developers are allowed to install from any source (e.g. internet) vs an internal repository where approved applications are housed.

EPM-Mac How to target user installed binary?

3 replies

Badge Earners

Badge Earners

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded