supervisor.exe blocked by Windows Defender

[sda030]

I realize this is my computer setup's fault, but being on university IT system I cannot exempt the programme from the Windows Defender, nor can my colleagues. This must have started recently (last few months) as it has worked well in the past. Is there a signature that should have been sent to Microsoft?...

C:/Users/User/AppData/Local/R/win-library/processx/bin/x64/supervisor.exe

bash: C:/Users/User/AppData/Local/R/win-library/processx/bin/x64/supervisor.exe: Permission denied

webshot::install_phantomjs()
#> Error in c("process_initialize(self, private, command, args, stdin, stdout, ", : ! Native call to `processx_exec` failed
#> Caused by error in `chain_call(c_processx_exec, command, c(command, args), pty, pty_options, …`:
#> ! create process 'C:/Users/py128/AppData/Local/R/win-library/processx/bin/x64/supervisor.exe' (system error 5, Ingen tilgang.
#> ) @win/processx.c:1040 (processx_exec)

^{Created on 2025-03-07 with reprex v2.1.1}

Session info

sessioninfo::session_info()
#> Warning in system2("quarto", "-V", stdout = TRUE, env = paste0("TMPDIR=", :
#> running command '"quarto"
#> TMPDIR=C:/Users/User/AppData/Local/Temp/Rtmpeebyp3/file6190798e68c9 -V' had
#> status 1
#> ─ Session info ───────────────────────────────────────────────────────────────
#>  setting  value
#>  version  R version 4.4.3 (2025-02-28 ucrt)
#>  os       Windows 11 x64 (build 22631)
#>  system   x86_64, mingw32
#>  ui       RTerm
#>  language (EN)
#>  collate  nb.utf8
#>  ctype    nb.utf8
#>  tz       Europe/Oslo
#>  date     2025-03-07
#>  pandoc   3.6.1 @ C:/PROGRA~1/Pandoc/ (via rmarkdown)
#>  quarto   NA @ C:\\PROGRA~1\\RStudio\\RESOUR~1\\app\\bin\\quarto\\bin\\quarto.exe
#> 
#> ─ Packages ───────────────────────────────────────────────────────────────────
#>  package     * version date (UTC) lib source
#>  callr         3.7.6   2024-03-25 [1] CRAN (R 4.4.1)
#>  cli           3.6.3   2024-06-21 [1] CRAN (R 4.4.1)
#>  digest        0.6.37  2024-08-19 [1] CRAN (R 4.4.1)
#>  evaluate      1.0.3   2025-01-10 [1] CRAN (R 4.4.2)
#>  fastmap       1.2.0   2024-05-15 [1] RSPM
#>  fs            1.6.5   2024-10-30 [1] RSPM (R 4.4.0)
#>  glue          1.8.0   2024-09-30 [1] RSPM (R 4.4.0)
#>  htmltools     0.5.8.1 2024-04-04 [1] RSPM
#>  knitr         1.49    2024-11-08 [1] RSPM (R 4.4.0)
#>  lifecycle     1.0.4   2023-11-07 [1] CRAN (R 4.4.1)
#>  magrittr      2.0.3   2022-03-30 [1] CRAN (R 4.4.1)
#>  processx      3.8.6   2025-02-21 [1] CRAN (R 4.4.2)
#>  ps            1.9.0   2025-02-18 [1] CRAN (R 4.4.2)
#>  R6            2.6.1   2025-02-15 [1] CRAN (R 4.4.2)
#>  reprex        2.1.1   2024-07-06 [1] RSPM
#>  rlang         1.1.5   2025-01-17 [1] CRAN (R 4.4.2)
#>  rmarkdown     2.29    2024-11-04 [1] RSPM (R 4.4.0)
#>  rstudioapi    0.17.1  2024-10-22 [1] RSPM (R 4.4.0)
#>  sessioninfo   1.2.3   2025-02-05 [1] CRAN (R 4.4.2)
#>  webshot       0.5.5   2023-06-26 [1] RSPM
#>  withr         3.0.2   2024-10-28 [1] CRAN (R 4.4.1)
#>  xfun          0.51    2025-02-19 [1] CRAN (R 4.4.2)
#>  yaml          2.3.10  2024-07-26 [1] CRAN (R 4.4.1)
#> 
#>  [1] C:/Users/User/AppData/Local/R/win-library
#>  [2] C:/Program Files/R/R-4.4.3/library
#> 
#> ──────────────────────────────────────────────────────────────────────────────

[gaborcsardi]

Is there a signature that should have been sent to Microsoft?...

I don't know what this means, sorry.

[sda030]

I'm not competent on these things, but could this be relevant?
https://www.microsoft.com/en-us/wdsi/filesubmission
My idea was basically that antivirus software reacts to executables interacting with processes, that also lack meta-data, publisher info, etc and/or that are not available through common channels (like winget, chocolatey, etc).

Btw, I've also tried exempting manually with this: https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps to no avail - though that is probably just our enterprise security setup.

[gaborcsardi]

I'm not competent on these things, but could this be relevant?
microsoft.com/en-us/wdsi/filesubmission

I believe this is only possible with the output from Windows Defender, which I don't have, but you do.

[sda030]

I'm not competent on these things, but could this be relevant?
microsoft.com/en-us/wdsi/filesubmission

I believe this is only possible with the output from Windows Defender, which I don't have, but you do.

Alas, I have no access to any of the tree options. Enterprise security settings disallow all three, and getting through to the IT department is a tedious process for each of my colleagues.
I could provide a screenshot of the Defender output, if that helps...?

Translation:
Action blocked by administrator.
App or process blocked: Rterm.exe
Blocked by: Reduction of the attack surface.
Rule: Block executable files from running unless they meet a prevalence, age, or trusted list criteria
Affected elements: C:\Users\py128\AppData\Local\R\win-library\processx\bin\x64\supervisor.exe

[gaborcsardi]

Uploading needs the name of the product (Microsoft Defender Antivirus (Windows 11)?), the "Detection name" (https://go.microsoft.com/fwlink/?linkid=849601#detection-history), and the "Definition version", whatever these mean.

Personally, I don't think the supervisor process is very important, and it would make sense to remove it. As a first step I could add an option that will just not run it.

Btw. the file (for R 4.4.x from current CRAN) seems pretty clean:
https://www.virustotal.com/gui/file/b689b07d3a386f58f4d2bdac35e4cac90400d40cd3219c86bba18a8acc3ff195/detection
(Not that I can do much about it if it is not, except for telling CRAN.)

[sda030]

"Accidentally" came across these seemingly closely related issue in RStudio and Rust (I was looking to learn more about signatures):
rstudio/rstudio#15647
rust-lang/rustup#1568

Perhaps not a solution to this, just posting in case you are interested in learning more.

[gaborcsardi]

An EV cert is about $4-500 per year, so unfortunately we cannot do that for processx.

[gaborcsardi]

I think this can only be solved by making the supervisor defunct. Which might be OK, really.