Security model
Understand tracce's privilege boundary, sensitive-file detection, and limitations.
tracce asks for sudo because macOS Endpoint Security events require privilege. The
boundary is deliberately narrow and auditable.
What runs as root
Only Apple's signed /usr/bin/eslogger binary runs as root, with this fixed argument list:
sudo /usr/bin/eslogger exec fork exit open close create write unlink rename- tracce itself continues running as your user
- no user input is interpolated into the privileged invocation
- no daemon, setuid binary, or sudoers change is installed
- the child process ends when the trace ends
- declining the prompt enables poll-only mode
Poll-only fallback
When eslogger cannot start, tracce still reports the process tree, network polling,
and supported agent tool calls. File-level kernel events are unavailable in this mode.
Sensitive files and commands
Built-in detection flags paths such as .env, ~/.ssh, ~/.aws, and private-key files.
Add your own glob patterns in ~/.tracce/flags.json:
{
"critical": ["*rm -rf*", "*curl*|*sh*", "*sudo*", "*chmod 777*"],
"warning": ["*.env*", "*git push --force*", "*npm publish*"]
}Patterns match the whole argument or path string. Use leading and trailing * for a
contains match. Changes are loaded when you next open or switch sessions.
Not a sandbox
tracce observes activity. It cannot block a process, prevent a file write, or stop a network connection.
Current limitations
- macOS only
- network byte counts are approximate and poll-based
- connections shorter than 500 ms may be missed
- attaching cannot reconstruct events from before the attach moment