Struct EventGatekeeperUserOverride 

pub struct EventGatekeeperUserOverride<'a> { /* private fields */ }

Available on macOS and crate feature macos_15_0_0 only.

Notification for a gatekeeper_user_override event.

This event type does not support caching (notify-only).

Hashes are calculated in usermode by Gatekeeper. There is no guarantee that any other program including the kernel will observe the same file at the reported path. Furthermore, there is no guarantee that the CDHash is valid or that it matches the containing binary.

Implementations

impl<'a> EventGatekeeperUserOverride<'a>

pub fn file(&self) -> Option<GatekeeperFile<'a>>

Describes the target file that is being overridden by the user.

If Endpoint security can’t lookup the file at event submission it will emit a path instead of a File.

pub fn sha256(&self) -> &[u8; 32]

SHA256 of the file.

Provided if the filesize is less than 100MB.

pub fn signing_info(&self) -> Option<SignedFileInfo<'_>>

Signing Information, available if the file has been signed.

Trait Implementations

impl<'a> Debug for EventGatekeeperUserOverride<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> Eq for EventGatekeeperUserOverride<'a>

impl<'a> Hash for EventGatekeeperUserOverride<'a>

fn hash<H: Hasher>(&self, state: &mut H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl<'a> PartialEq for EventGatekeeperUserOverride<'a>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Send for EventGatekeeperUserOverride<'_>

impl Sync for EventGatekeeperUserOverride<'_>