9

I'm trying to kill a process by a user other than myself on macOS High Sierra, but still getting an error even with sudo:

$ sudo kill 108
kill: 108: Operation not permitted

The PID does exist:

$ ps ux -p 108
USER        PID  %CPU %MEM      VSZ    RSS   TT  STAT STARTED      TIME COMMAND
_sentinel   108   3.6  1.5  5364180 245992   ??  Rs   23May19 149:15.88 /Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld

How can I diagnose why sudo kill is failing? Is it because of System Integrity Protection? If so, how do I disable the relevant attributes on the process so that sudo kill succeeds?

I'm not looking to disable SIP globally, since the process in question belongs to SentinelOne (not a core macOS pre-installed application).

bmike
  • 235,889
mxxk
  • 275

1 Answers1

10

As far as I know this is not due to SIP as such, but rather to the fact that SentinelOne includes guards against this in particular. It works by adding a kernel extension to the system, which means it can change ordinary workings of signal delivery.

You could say that the best way to kill this process is simply never to run it at all - i.e. uninstall the program.

jksoegaard
  • 77,783
  • 2
    This is perhaps the clearest expansion of how much control is ceded by kernel extensions before they move to user space and start getting reined in with Catalina. – bmike Jun 11 '19 at 01:05
  • Is there a way to uninstall SentinelOne? – IgorGanapolsky May 12 '22 at 17:31
  • Yes, just run "sudo sentinelctl uninstall --local" from the Terminal. If you have anti-tampering on, you'll need to run "sudo sentinelctl unprotect" with the passphrase first. – jksoegaard May 12 '22 at 21:09