Detect and thwart file copy operation using securityExtension.

I guess it's composed out of multiple basic ops like file read and file write

That’s correct. If your goal is to block Finder copies specifically, it’s very hard for an ES client to infer that operation based on the low-level operations it sees. I talk about this in some detail in Inferring High-Level Semantics from Low-Level Operations.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks for your quick reply Quinn. I see that in your post you specifically refer to one of the use cases i'm trying to implement which is to catch file copying (either from finder or from terminal using cp) to remote fileStorage device. Perhaps you can give me some guidelines for how to approach this issue ? Does ES have high level interface for file copying ? Perhaps I should use DriverKit to catch the data being copied can block it until scan...

Perhaps you can give me some guidelines for how to approach this issue ?

No, sorry. The whole point of that post is to explain the limits of my help in scenarios like this. In the absence of ES supporting a high-level authorise-file-copy operation, you have to infer that from lower-level operations, and the heuristics you use for this inference are your concern.

Perhaps I should use DriverKit to catch the data being copied can block it

Going lower in the stack only makes these problems worse.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"