ClearanceKit is a macOS security product that intercepts file-system access events and enforces per-process access policies via the opfilter Endpoint Security system extension. Prior to version 5.0.6, this extension can be suspended using signals such as SIGSTOP or killed with SIGKILL/SIGTERM by any root process. While suspended, all authorization events time out and default to allow, disabling ClearanceKit's enforcement silently. This constitutes a protection mechanism failure (CWE-693). The vulnerability is addressed in ClearanceKit 5.0.6.

An attacker or administrator with root privileges can disable ClearanceKit's file-access policy enforcement by suspending or killing the opfilter system extension. During this suspension, all authorization events time out and default to allow, potentially permitting unauthorized file access without detection. This undermines the security controls provided by ClearanceKit until the extension is resumed or restarted.

This vulnerability is fixed in ClearanceKit version 5.0.6. Users should upgrade to version 5.0.6 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until patched, restricting root access and monitoring for suspicious use of signals to the opfilter extension may help reduce risk.