Non-Notarized Process Whitelist

[rubnogueira]

I have a process that I know is safe, with a specific path + args.

Every time that I start that process from a new context, I get a new popup to allow/deny temporarily (the checkbox is disabled). I would like to add that combo of path + args as an exception.

Context example: a bash script that I have to check with node --version I have installed, and it's being prompted all the time.

Current settings:

[MaksimZinovev]

yes, 100% agree, this would be very helpful.

For me, number of safe scripts that are being flagged is too large which creates a lot of friction. I am afraid I will have to give up at some point and disable this tool if I cannot find a way to whitelist.

[sohate]

Please implement this! I have Non-Notarized Process too that I trust.

[objective-see]

Made some changes in the latest version (v2.4.4) to hopefully address this!

There are two notarization modes

1. Default is only for downloaded items.
   Now, when you allow such a non-notarized items, its quarantine attribute will be cleared so you won't be prompted again.

2. For "All mode" this doesn't apply to scripts (that can never be notarized). So for non-notarized programs that you allow, this will be cached until reboot. Yes, a more comprehensive solution would be to create/manage rules....

[sohate]

"Yes, a more comprehensive solution would be to create/manage rules...." Why there is no ability to create custom rules?

[objective-see]

BlockBlock was designed to monitor for persistence events ...and the current rules are based on this, that is to say, rules have for example reference to the item was persisted, it's startup file (e.g plist), the responsible process, etc. etc.

Rules for notarization would be fundamentally different, both in the UI but more relevant in code / rule logic (matching etc). So, BlockBlock would have to support a totally separate rule type. Doable sure, but not trivially...

Maybe one day when I have more time (or longer weekends 😅)

[sohate]

@objective-see Thank you for explaining. I think, you probably should add custom rules, because every time when I run a script - "BlockBlock" triggers, it's annoying.

[objective-see]

@sohate the latest version should address this: https://github.com/objective-see/BlockBlock/releases/tag/v2.4.4

Unless I'm missing something... 🤔

1. When Notarization mode is set, scripts are only checked if they have a quarantine flag set (meaning they are from the internet). The latest version now clears the quarantine flag once you approve the script. Ok, yes this means new (downloaded) scripts will trigger a new alert but that's by design. But re-running the same script should not alert again, as shown below from the logs:

BlockBlock: [com.objective-see.blockblock:daemon] checking if /Users/patrick/Downloads/download_test.sh is quarantined
BlockBlock: [com.objective-see.blockblock:daemon] quarantine flags: 0x83
BlockBlock: [com.objective-see.blockblock:daemon] /Users/patrick/Downloads/download_test.sh is a downloaded script, so *will not* ignore

....
//user approved alert:
BlockBlock: [com.objective-see.blockblock:daemon]  removed quarantine from /Users/patrick/Downloads/download_test.sh

Now, re-running, we can see the script is now ignored.

BlockBlock: [com.objective-see.blockblock:daemon] checking if /Users/patrick/Downloads/download_test.sh is quarantined
BlockBlock: [com.objective-see.blockblock:daemon] /Users/patrick/Downloads/download_test.sh is *not* quarantined (QTN_NOT_QUARANTINED)
BlockBlock: [com.objective-see.blockblock:daemon] /Users/patrick/Downloads/download_test.sh is not quarantined
BlockBlock: [com.objective-see.blockblock:daemon] bash is platform binary (with no/no downloaded script), so will ignore/allow.

2. If you select "All Programs" scripts are not checked (as all scripts are not notarized).

If something isn't working about you expect

1. Make sure you're running the latest version that you can manually download and install
2. From a terminal, run: log stream --level debug --predicate="subsystem='com.objective-see.blockblock'" then trigger the action that's not what you expect and post that.

Mahalo 🙏🏽

[sohate]

@objective-see I'm using 2.4.4 Notarization mode is now working fine with Non-Notarized Process I have (problem solved), but every time when I run a script from Alfred alert from BlockBlock appears - "All programs" do nothing.

[objective-see]

From a terminal, run: log stream --level debug --predicate="subsystem='com.objective-see.blockblock'" then trigger the action that's not what you expect and post that.

[sohate]

@objective-see Results:

Timestamp Thread Type Activity PID TTL
2026-04-13 15:35:42.658504+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:42.662264+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is quarantined
2026-04-13 15:35:42.668846+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is not quarantined (QTN_NOT_QUARANTINED)
2026-04-13 15:35:42.668956+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is not quarantined
2026-04-13 15:35:42.668993+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] zsh is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:42.670243+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12481,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B"],"ppid":769,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:42.688232+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:42.688301+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] shortcuts is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:42.688417+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12482,"name":"shortcuts","path":"/usr/bin/shortcuts","uid":501,"architecture":"Apple Silicon","arguments":["shortcuts","run","Script"],"ppid":12481,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.shortcuts.ShortcutsCommandLine","teamID":"","cdHash":"326F261FDD170DDC85E21A3AC50FCACA45895121"},"signing info (computed)":{"signatureID":"com.apple.shortcuts.ShortcutsCommandLine","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:43.149052+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:43.149115+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/654F5B3C-E4F3-4D77-8CED-B49B6DAEE276 is quarantined
2026-04-13 15:35:43.149270+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine flags: 0x82
2026-04-13 15:35:43.149310+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/654F5B3C-E4F3-4D77-8CED-B49B6DAEE276 is a downloaded script, so will not ignore
2026-04-13 15:35:43.302679+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user about: "process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:43.303864+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user w/: process="process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:43 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:43.304140+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] delivering alert to user: process="process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:43 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:43.304272+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] invoking user XPC method: 'alertShow'
2026-04-13 15:35:43.305073+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] process hierarchy: (
{
index = 0;
name = zsh;
pid = 12487;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
)
2026-04-13 15:35:43.305385+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] sending alert to user (client): {
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12487;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12487;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
timestamp = "2026-04-13 06:35:43 +0000";
uuid = "9CDFD072-FDC5-4C22-A1AC-BCAEF248A39D";
}
2026-04-13 15:35:43.306346+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] adding alert to 'shown': process="process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:43 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:43.306421+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alert delivered, waiting for response...
2026-04-13 15:35:43.308023+0900 0x31951 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] daemon invoked user XPC method, '-[XPCUser alertShow:]'
2026-04-13 15:35:43.363845+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] processing signing information
2026-04-13 15:35:43.378320+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:43.378437+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c055390>"
)
2026-04-13 15:35:43.378477+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:45.125954+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] user clicked: 1
2026-04-13 15:35:45.126398+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] responding to daemon, alert: {
action = 1;
actionScope = 0;
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12487;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12487;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
tempRule = 1;
timestamp = "2026-04-13 06:35:43 +0000";
user = 501;
uuid = "9CDFD072-FDC5-4C22-A1AC-BCAEF248A39D";
}
2026-04-13 15:35:45.131563+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] invoking daemon XPC method, '-[XPCDaemonClient alertReply:]'
2026-04-13 15:35:45.131754+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:45.131834+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c055390>"
)
2026-04-13 15:35:45.131862+0900 0x1c69 Debug 0x11e492 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:45.133251+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] XPC request: '-[XPCDaemon alertReply:]'
2026-04-13 15:35:45.134500+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removing alert from 'shown': process="process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:43 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:45.134814+0900 0x31e6c Default 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user says, 'allow', so allowing process="process":{"pid":12487,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//654F5B3C-E4F3-4D77-8CED-B49B6DAEE276"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:43 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:45.135083+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing: /bin/zsh
2026-04-13 15:35:45.135312+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowed: /bin/zsh
2026-04-13 15:35:45.135582+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine attribute not removed from /bin/zsh (errno: 1)
2026-04-13 15:35:45.135629+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] esf semaphore signaled, alert was handled
2026-04-13 15:35:45.135862+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removed quarantine from /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/654F5B3C-E4F3-4D77-8CED-B49B6DAEE276
2026-04-13 15:35:45.135917+0900 0x31e6c Debug 0x11e492 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user selected 'temporary' ...won't save rule
2026-04-13 15:35:45.146443+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:45.146592+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] networksetup is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:45.147143+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12490,"name":"networksetup","path":"/usr/sbin/networksetup","uid":501,"architecture":"Apple Silicon","arguments":["networksetup","-showpppoestatus","Script"],"ppid":12487,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.networksetup","teamID":"","cdHash":"BDB896853DCA7D195DC5BC8EFE53001167E8271A"},"signing info (computed)":{"signatureID":"com.apple.networksetup","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:45.326520+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:45.326587+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/2D746E91-6284-4F71-803C-0FAAE8704161 is quarantined
2026-04-13 15:35:45.326704+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine flags: 0x82
2026-04-13 15:35:45.326764+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/2D746E91-6284-4F71-803C-0FAAE8704161 is a downloaded script, so will not ignore
2026-04-13 15:35:45.480125+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user about: "process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:45.480886+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user w/: process="process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:45 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:45.481041+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] delivering alert to user: process="process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:45 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:45.481188+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] invoking user XPC method: 'alertShow'
2026-04-13 15:35:45.481471+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] process hierarchy: (
{
index = 0;
name = zsh;
pid = 12492;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
)
2026-04-13 15:35:45.481611+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] sending alert to user (client): {
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12492;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12492;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
timestamp = "2026-04-13 06:35:45 +0000";
uuid = "192F9339-44AF-45B1-8D34-9DAA4B723DCD";
}
2026-04-13 15:35:45.482005+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] adding alert to 'shown': process="process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:45 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:45.482026+0900 0x32f16 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] daemon invoked user XPC method, '-[XPCUser alertShow:]'
2026-04-13 15:35:45.482208+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alert delivered, waiting for response...
2026-04-13 15:35:45.510901+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] processing signing information
2026-04-13 15:35:45.520287+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:45.520357+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c044950>"
)
2026-04-13 15:35:45.520383+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:46.085764+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] user clicked: 1
2026-04-13 15:35:46.086078+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] responding to daemon, alert: {
action = 1;
actionScope = 0;
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12492;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12492;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
tempRule = 1;
timestamp = "2026-04-13 06:35:45 +0000";
user = 501;
uuid = "192F9339-44AF-45B1-8D34-9DAA4B723DCD";
}
2026-04-13 15:35:46.090373+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] invoking daemon XPC method, '-[XPCDaemonClient alertReply:]'
2026-04-13 15:35:46.090559+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:46.090633+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c044950>"
)
2026-04-13 15:35:46.090664+0900 0x1c69 Debug 0x11e49c 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:46.091526+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] XPC request: '-[XPCDaemon alertReply:]'
2026-04-13 15:35:46.091761+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removing alert from 'shown': process="process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:45 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:46.092084+0900 0x31dd1 Default 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user says, 'allow', so allowing process="process":{"pid":12492,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//2D746E91-6284-4F71-803C-0FAAE8704161"],"ppid":12484,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:45 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:46.092150+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing: /bin/zsh
2026-04-13 15:35:46.092702+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowed: /bin/zsh
2026-04-13 15:35:46.093276+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] esf semaphore signaled, alert was handled
2026-04-13 15:35:46.093308+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine attribute not removed from /bin/zsh (errno: 1)
2026-04-13 15:35:46.093566+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removed quarantine from /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/2D746E91-6284-4F71-803C-0FAAE8704161
2026-04-13 15:35:46.093888+0900 0x31dd1 Debug 0x11e49c 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user selected 'temporary' ...won't save rule
2026-04-13 15:35:46.103315+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:46.103410+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] networksetup is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:46.103669+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12493,"name":"networksetup","path":"/usr/sbin/networksetup","uid":501,"architecture":"Apple Silicon","arguments":["networksetup","-disconnectpppoeservice","Script"],"ppid":12492,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.networksetup","teamID":"","cdHash":"BDB896853DCA7D195DC5BC8EFE53001167E8271A"},"signing info (computed)":{"signatureID":"com.apple.networksetup","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:50.452185+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:50.452281+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is quarantined
2026-04-13 15:35:50.452936+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is not quarantined (QTN_NOT_QUARANTINED)
2026-04-13 15:35:50.452971+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B is not quarantined
2026-04-13 15:35:50.452992+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] zsh is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:50.453237+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12496,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/Users/user/Library/Caches/com.runningwithcrayons.Alfred/Workflow Scripts/F3B2BF0F-26AF-4D2E-9AA6-C6D8E449FF6B"],"ppid":769,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:50.458014+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:50.458631+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] shortcuts is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:50.458902+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12497,"name":"shortcuts","path":"/usr/bin/shortcuts","uid":501,"architecture":"Apple Silicon","arguments":["shortcuts","run","Scripts"],"ppid":12496,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.shortcuts.ShortcutsCommandLine","teamID":"","cdHash":"326F261FDD170DDC85E21A3AC50FCACA45895121"},"signing info (computed)":{"signatureID":"com.apple.shortcuts.ShortcutsCommandLine","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:50.712887+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:50.712959+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/DECF25F7-AA31-4726-97E2-E3321B4B3934 is quarantined
2026-04-13 15:35:50.713071+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine flags: 0x82
2026-04-13 15:35:50.713106+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/DECF25F7-AA31-4726-97E2-E3321B4B3934 is a downloaded script, so will not ignore
2026-04-13 15:35:50.865532+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user about: "process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:50.866639+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user w/: process="process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:50 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:50.866863+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] delivering alert to user: process="process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:50 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:50.866935+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] invoking user XPC method: 'alertShow'
2026-04-13 15:35:50.867156+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] process hierarchy: (
{
index = 0;
name = zsh;
pid = 12502;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
)
2026-04-13 15:35:50.867478+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] sending alert to user (client): {
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12502;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12502;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
timestamp = "2026-04-13 06:35:50 +0000";
uuid = "BE26A96C-AD16-4645-8419-F86CC3F0B7E8";
}
2026-04-13 15:35:50.868287+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] adding alert to 'shown': process="process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:50 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:50.868348+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alert delivered, waiting for response...
2026-04-13 15:35:50.868381+0900 0x33c26 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] daemon invoked user XPC method, '-[XPCUser alertShow:]'
2026-04-13 15:35:50.907630+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] processing signing information
2026-04-13 15:35:50.926554+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:50.926618+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c581da0>"
)
2026-04-13 15:35:50.926639+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:51.928301+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] user clicked: 1
2026-04-13 15:35:51.928640+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] responding to daemon, alert: {
action = 1;
actionScope = 0;
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12502;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12502;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
tempRule = 1;
timestamp = "2026-04-13 06:35:50 +0000";
user = 501;
uuid = "BE26A96C-AD16-4645-8419-F86CC3F0B7E8";
}
2026-04-13 15:35:51.933991+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] invoking daemon XPC method, '-[XPCDaemonClient alertReply:]'
2026-04-13 15:35:51.934196+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:51.934290+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c581da0>"
)
2026-04-13 15:35:51.934319+0900 0x1c69 Debug 0x11ede7 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:51.936252+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] XPC request: '-[XPCDaemon alertReply:]'
2026-04-13 15:35:51.936503+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removing alert from 'shown': process="process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:50 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:51.936648+0900 0x31e6c Default 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user says, 'allow', so allowing process="process":{"pid":12502,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//DECF25F7-AA31-4726-97E2-E3321B4B3934"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:50 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:51.936711+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing: /bin/zsh
2026-04-13 15:35:51.936769+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowed: /bin/zsh
2026-04-13 15:35:51.936938+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine attribute not removed from /bin/zsh (errno: 1)
2026-04-13 15:35:51.937187+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removed quarantine from /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/DECF25F7-AA31-4726-97E2-E3321B4B3934
2026-04-13 15:35:51.937222+0900 0x31e6c Debug 0x11ede7 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user selected 'temporary' ...won't save rule
2026-04-13 15:35:51.936881+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] esf semaphore signaled, alert was handled
2026-04-13 15:35:51.947123+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:51.947210+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] networksetup is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:51.947991+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12503,"name":"networksetup","path":"/usr/sbin/networksetup","uid":501,"architecture":"Apple Silicon","arguments":["networksetup","-showpppoestatus","Scripts"],"ppid":12502,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.networksetup","teamID":"","cdHash":"BDB896853DCA7D195DC5BC8EFE53001167E8271A"},"signing info (computed)":{"signatureID":"com.apple.networksetup","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:52.140740+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:52.140821+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] checking if /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/0F3CF6D3-2AB8-4D88-8330-64195EE13AF5 is quarantined
2026-04-13 15:35:52.140905+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine flags: 0x82
2026-04-13 15:35:52.140928+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/0F3CF6D3-2AB8-4D88-8330-64195EE13AF5 is a downloaded script, so will not ignore
2026-04-13 15:35:52.293770+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user about: "process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}
2026-04-13 15:35:52.294614+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alerting user w/: process="process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:52 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:52.294769+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] delivering alert to user: process="process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:52 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:52.294811+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] invoking user XPC method: 'alertShow'
2026-04-13 15:35:52.294970+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] process hierarchy: (
{
index = 0;
name = zsh;
pid = 12505;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
)
2026-04-13 15:35:52.295182+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] sending alert to user (client): {
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12505;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12505;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
timestamp = "2026-04-13 06:35:52 +0000";
uuid = "5487A3DA-004B-4EBC-AB75-319B52CEEC92";
}
2026-04-13 15:35:52.295607+0900 0x33c26 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] daemon invoked user XPC method, '-[XPCUser alertShow:]'
2026-04-13 15:35:52.295603+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] adding alert to 'shown': process="process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:52 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:52.295660+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] alert delivered, waiting for response...
2026-04-13 15:35:52.325052+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] processing signing information
2026-04-13 15:35:52.334432+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:52.334502+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c056dc0>"
)
2026-04-13 15:35:52.334526+0900 0x1c69 Debug 0x0 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:52.768811+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] user clicked: 1
2026-04-13 15:35:52.769163+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] responding to daemon, alert: {
action = 1;
actionScope = 0;
alertType = 2;
args = (
"/bin/zsh",
"/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"
);
isRestricted = 0;
itemFile = unknown;
itemName = zsh;
itemObject = "/bin/zsh";
message = "is attempting to run a non-notarized script";
path = "/bin/zsh";
pid = 12505;
processAncestors = (
{
index = 0;
name = zsh;
pid = 12505;
},
{
index = 1;
name = "/sbin/launchd";
pid = 1;
}
);
processName = zsh;
signingInfo = {
csFlags = 637602561;
platformBinary = 1;
signingID = "com.apple.zsh";
};
tempRule = 1;
timestamp = "2026-04-13 06:35:52 +0000";
user = 501;
uuid = "5487A3DA-004B-4EBC-AB75-319B52CEEC92";
}
2026-04-13 15:35:52.774212+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] invoking daemon XPC method, '-[XPCDaemonClient alertReply:]'
2026-04-13 15:35:52.774394+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] setting app's activation policy
2026-04-13 15:35:52.774480+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] windows: (
"<TUINSWindow: 0x13c006180>",
"<NSWindow: 0x13af4f7e0>",
"<NSPanel: 0x13ae63ef0>",
"<NSWindow: 0x13c53ec60>",
"<NSWindow: 0x13c056dc0>"
)
2026-04-13 15:35:52.774513+0900 0x1c69 Debug 0x11efc1 770 0 BlockBlock Helper: [com.objective-see.blockblock:app (helper)] window(s) visible, setting policy: NSApplicationActivationPolicyRegular
2026-04-13 15:35:52.775430+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] XPC request: '-[XPCDaemon alertReply:]'
2026-04-13 15:35:52.775960+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removing alert from 'shown': process="process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:52 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:52.776158+0900 0x31e6c Default 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user says, 'allow', so allowing process="process":{"pid":12505,"name":"zsh","path":"/bin/zsh","uid":501,"architecture":"Apple Silicon","arguments":["/bin/zsh","/var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner//0F3CF6D3-2AB8-4D88-8330-64195EE13AF5"],"ppid":12499,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637602561,"platformBinary":1,"signingID":"com.apple.zsh","teamID":"","cdHash":"BE48892813F4DFD7D8DE0ED0CEA9F1A3917D11F6"},"signing info (computed)":{"signatureID":"com.apple.zsh","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}, item file path=(null), timestamp=2026-04-13 06:35:52 +0000, item binary=name=zsh, object=/bin/zsh
2026-04-13 15:35:52.776256+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing: /bin/zsh
2026-04-13 15:35:52.777074+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowed: /bin/zsh
2026-04-13 15:35:52.777192+0900 0x31dd1 Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] esf semaphore signaled, alert was handled
2026-04-13 15:35:52.777360+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] quarantine attribute not removed from /bin/zsh (errno: 1)
2026-04-13 15:35:52.777625+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] removed quarantine from /var/folders/2k/lj0thl1s3dl8q7gwnbgmmxn40000gn/T/com.apple.WorkflowKit.BackgroundShortcutRunner/0F3CF6D3-2AB8-4D88-8330-64195EE13AF5
2026-04-13 15:35:52.777674+0900 0x31e6c Debug 0x11efc1 337 0 BlockBlock: [com.objective-see.blockblock:daemon] user selected 'temporary' ...won't save rule
2026-04-13 15:35:52.786365+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] '-[Processes shouldIgnore:message:]' invoked
2026-04-13 15:35:52.786456+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] networksetup is platform binary (with no/no downloaded script), so will ignore
2026-04-13 15:35:52.786714+0900 0x31e6c Debug 0x0 337 0 BlockBlock: [com.objective-see.blockblock:daemon] allowing (and caching) "process":{"pid":12506,"name":"networksetup","path":"/usr/sbin/networksetup","uid":501,"architecture":"Apple Silicon","arguments":["networksetup","-connectpppoeservice","Script"],"ppid":12505,"rpid":769,"ancestors":[769,1],"signing info (reported)":{"csFlags":637623057,"platformBinary":1,"signingID":"com.apple.networksetup","teamID":"","cdHash":"BDB896853DCA7D195DC5BC8EFE53001167E8271A"},"signing info (computed)":{"signatureID":"com.apple.networksetup","notarized":0,"signatureStatus":0,"signatureSigner":"Apple","signatureAuthorities":["Software Signing","Apple Code Signing Certification Authority","Apple Root CA"]}}

[sohate]

I think it's because path is always changing.