> It doesn’t pin to PID? What if I rename a program to something that has been whitelisted?
That's a valid question. It should allow/disallow executables by hashing the executable file (not even the device id + inode), not by comparing the paths. Also pinning the PID also isn't good, since pid is temporary.
> It doesn’t pin to PID? What if I rename a program to something that has been whitelisted?
That's a valid question. It should allow/disallow executables by hashing the executable file (not even the device id + inode), not by comparing the paths. Also pinning the PID also isn't good, since pid is temporary.