Endpoint Standard: XCode 12 Slow build times with sensor installed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Slow build times
• Slow system performance

Environment

• Carbon Black Cloud Web Console: All Versions
• Carbon Black Cloud macOS Sensor: 3.3.4.6 and higher
• Apple macOS: 10.14 and higher

Cause

• A kernel feature that allows the sensor to safely unload KEXT without requiring a macOS reboot, introduces a performance issue when synchronizing low level operations in Apple XNU code
• Although this feature has been present since macOS 10.6, our investigation shows that more recent macOS internals changes exacerbated this interaction in macOS 10.14 and higher

Resolution

If experiencing the issues above, the following bypass rules are recommended:

/Users/*/Library/Developer/Xcode/DerivedData/**
/Applications/Xcode.app/**