DLP Endpoint - Mac EDPA agents crash within a minute of starting.

Products

• Data Loss Prevention Enterprise Suite
• Data Loss Prevention

Issue/Introduction

The Mac EDPA service crashes within a minute of starting.
Verified that the EDPA and SEHA have full access.

The FINEST aggregator logs shows that the Policy Matrix is being sent to the agent, and the FINEST agent logs show that the matrix is received without issue.
The agent is stopping gracefully, without any errors.
The agent appears to be stopping when loading the policies on the disk.
The ps.ead-journal file is being created and the agent stops right after that.

Environment

Release: 15.8.x, 16.0

MacOS : All

Cause

Mac EDPA is unable to process Response Rules, which contain Smiley or Surrogate Characters.
When presented with such Response Rules, EDPA throws an Exception and Terminates with a EXC_CRASH (SIGABRT) Signal.

Steps to Reproduce/Observe issue:
              1). Package and Install MacOS DLP Agent with any Agent version prior to 16.0 RU1.
              2). On Enforce, create any policy, example Keyword matching policy.
              3). Set a Response rule for above policy to Block, and Customize the Response Rule Block Text to contain a Smiley (or any emoji) character.
              4). Make sure that the Agent receives the policy changes.
              5). Observe that EDPA crashes and restarts, with its PID changing every few seconds, when it is trying to process the response rule.
              6). Remove the Smiley from the Response Rule on Enforce.
              7). Observe that EDPA starts correctly now and does not crash.

Resolution

Non-BMP chars are not allowed for conditions and rules. 
16.0 RU1 adds checks to make sure that these invalid chars are not entered into the policies conditions and rules.