2282860702

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/68cdcbdfdb2924564a6c9ea590551b0356a54d73">68cdcbdfd">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/68cdcbdfdb2924564a6c9ea590551b0356a54d73">68cdcbdfd</a><a href="https://github.com/google/santa/commit/68cdcbdfdb2924564a6c9ea590551b0356a54d73">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/68cdcbdfdb2924564a6c9ea590551b0356a54d73&quot;&gt;68cdcbdfd&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/68cdcbdfdb2924564a6c9ea590551b0356a54d73&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #799: santad: Add 'null' event logger. Fixes #754

Run Details

2037 of 4902 branches covered (41.55%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 3 files covered. (100.0%)

7702 of 12654 relevant lines covered (60.87%)

18907.2 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

39.29

/Source/santad/Logs/SNTEventLog.m

/// Copyright 2018 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.
#import "Source/santad/Logs/SNTEventLog.h"

#include <dlfcn.h>
#include <grp.h>
#include <pwd.h>
#include <sys/sysctl.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#import "Source/santad/SNTDatabaseController.h"

#import "Source/santad/Logs/SNTFileEventLog.h"
#import "Source/santad/Logs/SNTProtobufEventLog.h"
#import "Source/santad/Logs/SNTSyslogEventLog.h"

@interface SNTEventLog ()
@property NSMutableDictionary<NSNumber *, SNTCachedDecision *> *detailStore;
@property dispatch_queue_t detailStoreQueue;
// Cache for sha256 -> date of last timestamp reset.
@property NSCache<NSString *, NSDate *> *timestampResetMap;
@end

@implementation SNTEventLog

- (instancetype)init {
  self = [super init];
  if (self) {
    _detailStore = [NSMutableDictionary dictionaryWithCapacity:10000];
    _detailStoreQueue =
      dispatch_queue_create("com.google.santad.detail_store", DISPATCH_QUEUE_SERIAL);

    _userNameMap = [[NSCache alloc] init];
    _userNameMap.countLimit = 100;
    _groupNameMap = [[NSCache alloc] init];
    _groupNameMap.countLimit = 100;
    _timestampResetMap = [[NSCache alloc] init];
    _timestampResetMap.countLimit = 100;

    _dateFormatter = [[NSDateFormatter alloc] init];
    _dateFormatter.dateFormat = @"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";
    _dateFormatter.calendar = [NSCalendar calendarWithIdentifier:NSCalendarIdentifierISO8601];
    _dateFormatter.timeZone = [NSTimeZone timeZoneWithName:@"UTC"];

    // Grab the system UUID on init
    _machineID = [[SNTConfigurator configurator] machineID];
  }
  return self;
}

- (void)logDiskAppeared:(NSDictionary *)diskProperties {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logDiskDisappeared:(NSDictionary *)diskProperties {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logFileModification:(santa_message_t)message {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logDeniedExecution:(SNTCachedDecision *)cd withMessage:(santa_message_t)message {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logAllowedExecution:(santa_message_t)message {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logBundleHashingEvents:(NSArray<SNTStoredEvent *> *)events {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logFork:(santa_message_t)message {
  [self doesNotRecognizeSelector:_cmd];
}
- (void)logExit:(santa_message_t)message {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)logAllowlist:(SNTAllowlistInfo *)allowlistInfo {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)forceFlush {
  [self doesNotRecognizeSelector:_cmd];
}

- (void)cacheDecision:(SNTCachedDecision *)cd {
  dispatch_sync(self.detailStoreQueue, ^{
    self.detailStore[@(cd.vnodeId.fileid)] = cd;
  });
}

- (SNTCachedDecision *)cachedDecisionForMessage:(santa_message_t)message {
  __block SNTCachedDecision *cd;
  dispatch_sync(self.detailStoreQueue, ^{
    cd = self.detailStore[@(message.vnode_id.fileid)];
  });
  return cd;
}

- (void)forgetCachedDecisionForVnodeId:(santa_vnode_id_t)vnodeId {
  dispatch_sync(self.detailStoreQueue, ^{
    [self.detailStore removeObjectForKey:@(vnodeId.fileid)];
  });
}

// Whenever a cached decision resulting from a transitive allowlist rule is used to allow the
// execution of a binary, we update the timestamp on the transitive rule in the rules database.
// To prevent writing to the database too often, we space out consecutive writes by 3600 seconds.
- (void)resetTimestampForCachedDecision:(SNTCachedDecision *)cd {
  if (cd.decision != SNTEventStateAllowTransitive) return;
  NSDate *lastUpdate = [self.timestampResetMap objectForKey:cd.sha256];
  if (!lastUpdate || -[lastUpdate timeIntervalSinceNow] > 3600) {
    SNTRule *rule = [[SNTRule alloc] initWithIdentifier:cd.sha256
                                                  state:SNTRuleStateAllowTransitive
                                                   type:SNTRuleTypeBinary
                                              customMsg:nil];
    [[SNTDatabaseController ruleTable] resetTimestampForRule:rule];
    [self.timestampResetMap setObject:[NSDate date] forKey:cd.sha256];
  }
}

/**
  Sanitizes a given string if necessary, otherwise returns the original.
*/
- (NSString *)sanitizeString:(NSString *)inStr {
  NSUInteger length = [inStr lengthOfBytesUsingEncoding:NSUTF8StringEncoding];
  if (length < 1) return inStr;

  NSString *ret = [self sanitizeCString:inStr.UTF8String ofLength:length];
  if (ret) {
    return ret;
  }
  return inStr;
}

/**
  Sanitize the given C-string, replacing |, \n and \r characters.

  @return a new NSString with the replaced contents, if necessary, otherwise nil.
*/
- (NSString *)sanitizeCString:(const char *)str ofLength:(NSUInteger)length {
  NSUInteger bufOffset = 0, strOffset = 0;
  char c = 0;
  char *buf = NULL;
  BOOL shouldFree = NO;

  if (length < 1) return @"";

  // Loop through the string one character at a time, looking for the characters
  // we want to remove.
  for (const char *p = str; (c = *p) != 0; ++p) {
    if (c == '|' || c == '\n' || c == '\r') {
      if (!buf) {
        // If string size * 6 is more than 64KiB use malloc, otherwise use stack space.
        if (length * 6 > 64 * 1024) {
          buf = malloc(length * 6);
          shouldFree = YES;
        } else {
          buf = alloca(length * 6);
        }
      }

      // Copy from the last offset up to the character we just found into the buffer
      ptrdiff_t diff = p - str;
      memcpy(buf + bufOffset, str + strOffset, diff - strOffset);

      // Update the buffer and string offsets
      bufOffset += diff - strOffset;
      strOffset = diff + 1;

      // Replace the found character and advance the buffer offset
      switch (c) {
        case '|':
          memcpy(buf + bufOffset, "<pipe>", 6);
          bufOffset += 6;
          break;
        case '\n':
          memcpy(buf + bufOffset, "\\n", 2);
          bufOffset += 2;
          break;
        case '\r':
          memcpy(buf + bufOffset, "\\r", 2);
          bufOffset += 2;
          break;
      }
    }
  }

  if (strOffset > 0 && strOffset < length) {
    // Copy any characters from the last match to the end of the string into the buffer.
    memcpy(buf + bufOffset, str + strOffset, length - strOffset);
    bufOffset += length - strOffset;
  }

  if (buf) {
    // Only return a new string if there were matches
    NSString *ret = [[NSString alloc] initWithBytes:buf
                                             length:bufOffset
                                           encoding:NSUTF8StringEncoding];
    if (shouldFree) {
      free(buf);
    }

    return ret;
  }
  return nil;
}

/**
  Use sysctl to get the arguments for a PID, appended to the given string.
*/
- (void)addArgsForPid:(pid_t)pid toString:(NSMutableString *)str {
  size_t argsSizeEstimate = 0, argsSize = 0, index = 0;

  // Use stack space up to 128KiB.
  const size_t MAX_STACK_ALLOC = 128 * 1024;
  char *bytes = alloca(MAX_STACK_ALLOC);
  BOOL shouldFree = NO;

  int mib[] = {CTL_KERN, KERN_PROCARGS2, pid};

  // Get estimated length of arg array
  if (sysctl(mib, 3, NULL, &argsSizeEstimate, NULL, 0) < 0) return;
  argsSize = argsSizeEstimate + 512;

  // If this is larger than our allocated stack space, alloc from heap.
  if (argsSize > MAX_STACK_ALLOC) {
    bytes = malloc(argsSize);
    shouldFree = YES;
  }

  // Get the args. If this fails, free if necessary and return.
  if (sysctl(mib, 3, bytes, &argsSize, NULL, 0) != 0 || argsSize >= argsSizeEstimate + 512) {
    if (shouldFree) {
      free(bytes);
    }
    return;
  }

  // Get argc, set index to the end of argc
  int argc = 0;
  memcpy(&argc, &bytes[0], sizeof(argc));
  index = sizeof(argc);

  // Skip past end of executable path and trailing NULLs
  for (; index < argsSize; ++index) {
    if (bytes[index] == '\0') {
      ++index;
      break;
    }
  }
  for (; index < argsSize; ++index) {
    if (bytes[index] != '\0') break;
  }

  // Save the beginning of the arguments
  size_t stringStart = index;

  // Replace all NULLs with spaces up until the first environment variable
  int replacedNulls = 0;
  for (; index < argsSize; ++index) {
    if (bytes[index] == '\0') {
      ++replacedNulls;
      if (replacedNulls == argc) break;
      bytes[index] = ' ';
    }
  }

  // Potentially sanitize the args string.
  NSString *sanitized = [self sanitizeCString:&bytes[stringStart] ofLength:index - stringStart];
  if (sanitized) {
    [str appendFormat:@"|args=%@", sanitized];
  } else {
    [str appendFormat:@"|args=%@", @(&bytes[stringStart])];
  }

  if (shouldFree) {
    free(bytes);
  }
}

- (NSString *)nameForUID:(uid_t)uid {
  NSNumber *uidNumber = @(uid);

  NSString *name = [self.userNameMap objectForKey:uidNumber];
  if (name) return name;

  struct passwd *pw = getpwuid(uid);
  if (pw) {
    name = @(pw->pw_name);
    [self.userNameMap setObject:name forKey:uidNumber];
  }
  return name;
}

- (NSString *)nameForGID:(gid_t)gid {
  NSNumber *gidNumber = @(gid);

  NSString *name = [self.groupNameMap objectForKey:gidNumber];
  if (name) return name;

  struct group *gr = getgrgid(gid);
  if (gr) {
    name = @(gr->gr_name);
    [self.groupNameMap setObject:name forKey:gidNumber];
  }
  return name;
}

/**
  Given an IOKit device path (like those provided by DiskArbitration), find the disk
  image path by looking up the device in the IOKit registry and getting its properties.

  This is largely the same as the way hdiutil gathers info for the "info" command.
*/
- (NSString *)diskImageForDevice:(NSString *)devPath {
  devPath = [devPath stringByDeletingLastPathComponent];
  if (!devPath.length) return nil;
  io_registry_entry_t device = IORegistryEntryFromPath(kIOMasterPortDefault, devPath.UTF8String);
  CFMutableDictionaryRef deviceProperties = NULL;
  IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);
  NSDictionary *properties = CFBridgingRelease(deviceProperties);
  IOObjectRelease(device);

  NSData *pathData = properties[@"image-path"];
  NSString *result = [[NSString alloc] initWithData:pathData encoding:NSUTF8StringEncoding];

  return result;
}

/**
 Given an IOKit device path (like those provided by DiskArbitration), find the device serial number,
 if there is one. This has only really been tested with USB and internal devices.
*/
- (NSString *)serialForDevice:(NSString *)devPath {
  if (!devPath.length) return nil;
  NSString *serial;
  io_registry_entry_t device = IORegistryEntryFromPath(kIOMasterPortDefault, devPath.UTF8String);
  while (!serial && device) {
    CFMutableDictionaryRef deviceProperties = NULL;
    IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);
    NSDictionary *properties = CFBridgingRelease(deviceProperties);
    if (properties[@"Serial Number"]) {
      serial = properties[@"Serial Number"];
    } else if (properties[@"kUSBSerialNumberString"]) {
      serial = properties[@"kUSBSerialNumberString"];
    }

    if (serial) {
      IOObjectRelease(device);
      break;
    }

    io_registry_entry_t parent;
    IORegistryEntryGetParentEntry(device, kIOServicePlane, &parent);
    IOObjectRelease(device);
    device = parent;
  }

  return serial;
}

/**
 Uses the executable path, uid, and gid from a given santa_message_t to determine if the path
 has been translocated by GateKeeper and if so, returns the original path of the executable.  This
 requires macOS 10.12 or higher.  We use dlopen to access the functions we need in
 Security.framework so that we can still build against the 10.11 SDK.  If the path has not been
 translocated or if running on macOS prior to 10.12, this method returns nil.
 */
- (NSString *)originalPathForTranslocation:(const santa_message_t *)message {
  if (!message) {
    return nil;
  }

  // The first time this function is called, we attempt to find the addresses of
  // SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL inside of the
  // Security.framework library.  If we were successful, handle will be non-NULL and is never
  // closed.
  static Boolean (*IsTranslocatedURL)(CFURLRef, bool *, CFErrorRef *) = NULL;
  static CFURLRef __nullable (*CreateOriginalPathForURL)(CFURLRef, CFErrorRef *) = NULL;
  static dispatch_once_t token;
  dispatch_once(&token, ^{
    void *handle = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_LAZY);
    if (handle) {
      IsTranslocatedURL = dlsym(handle, "SecTranslocateIsTranslocatedURL");
      CreateOriginalPathForURL = dlsym(handle, "SecTranslocateCreateOriginalPathForURL");
      if (!IsTranslocatedURL || !CreateOriginalPathForURL) {
        IsTranslocatedURL = NULL;
        CreateOriginalPathForURL = NULL;
        dlclose(handle);
      }
    }
  });

  // If we couldn't open the library or find the functions we need, don't do anything.
  if (!IsTranslocatedURL || !CreateOriginalPathForURL) return nil;

  // Determine if the executable URL has been translocated or not.
  CFURLRef cfExecURL = (__bridge CFURLRef)[NSURL fileURLWithPath:@(message->path)];
  bool isTranslocated = false;
  if (!IsTranslocatedURL(cfExecURL, &isTranslocated, NULL) || !isTranslocated) return nil;

    // SecTranslocateCreateOriginalPathForURL requires that our uid be the same as the user who
    // launched the executable.  So we temporarily drop from root down to this uid, then reset.
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wdeprecated"
  pthread_setugid_np(message->uid, message->gid);
  NSURL *origURL = CFBridgingRelease(CreateOriginalPathForURL(cfExecURL, NULL));
  pthread_setugid_np(KAUTH_UID_NONE, KAUTH_GID_NONE);
#pragma clang diagnostic pop

  return [origURL path];  // this will be nil if there was an error
}

+ (instancetype)logger {
  static SNTEventLog *logger = nil;
  static dispatch_once_t onceToken;
  dispatch_once(&onceToken, ^{
    switch ([[SNTConfigurator configurator] eventLogType]) {
      case SNTEventLogTypeSyslog: {
        logger = [[SNTSyslogEventLog alloc] init];
        break;
      }
      case SNTEventLogTypeFilelog: {
        logger = [[SNTFileEventLog alloc] init];
        break;
      }
      case SNTEventLogTypeProtobuf: {
        logger = [[SNTProtobufEventLog alloc] init];
        break;
      }
      case SNTEventLogTypeNull: {
        // Messages sent to nil objects do nothing, which is perfect for a null logger.
        logger = nil;
        break;
      }
    }
  });
  return logger;
}
@end

1	/// Copyright 2018 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14	#import "Source/santad/Logs/SNTEventLog.h"
15
16	#include <dlfcn.h>
17	#include <grp.h>
18	#include <pwd.h>
19	#include <sys/sysctl.h>
20
21	#import "Source/common/SNTCachedDecision.h"
22	#import "Source/common/SNTConfigurator.h"
23	#import "Source/common/SNTRule.h"
24	#import "Source/santad/DataLayer/SNTRuleTable.h"
25	#import "Source/santad/SNTDatabaseController.h"
26
27	#import "Source/santad/Logs/SNTFileEventLog.h"
28	#import "Source/santad/Logs/SNTProtobufEventLog.h"
29	#import "Source/santad/Logs/SNTSyslogEventLog.h"
30
31	@interface SNTEventLog ()
32	@property NSMutableDictionary<NSNumber , SNTCachedDecision > *detailStore;
33	@property dispatch_queue_t detailStoreQueue;
34	// Cache for sha256 -> date of last timestamp reset.
35	@property NSCache<NSString , NSDate > *timestampResetMap;
36	@end
37
38	@implementation SNTEventLog
39
40	- (instancetype)init {	10✔
41	self = [super init];	10✔
42	if (self) {	10!
43	_detailStore = [NSMutableDictionary dictionaryWithCapacity:10000];	10✔
44	_detailStoreQueue =	10✔
45	dispatch_queue_create("com.google.santad.detail_store", DISPATCH_QUEUE_SERIAL);	10✔
46
47	_userNameMap = [[NSCache alloc] init];	10✔
48	_userNameMap.countLimit = 100;	10✔
49	_groupNameMap = [[NSCache alloc] init];	10✔
50	_groupNameMap.countLimit = 100;	10✔
51	_timestampResetMap = [[NSCache alloc] init];	10✔
52	_timestampResetMap.countLimit = 100;	10✔
53
54	_dateFormatter = [[NSDateFormatter alloc] init];	10✔
55	_dateFormatter.dateFormat = @"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";	10✔
56	_dateFormatter.calendar = [NSCalendar calendarWithIdentifier:NSCalendarIdentifierISO8601];	10✔
57	_dateFormatter.timeZone = [NSTimeZone timeZoneWithName:@"UTC"];	10✔
58
59	// Grab the system UUID on init
60	_machineID = [[SNTConfigurator configurator] machineID];	10✔
61	}	10✔
62	return self;	10✔
63	}	10✔
64
65	- (void)logDiskAppeared:(NSDictionary *)diskProperties {	×
66	[self doesNotRecognizeSelector:_cmd];	×
67	}	×
68
69	- (void)logDiskDisappeared:(NSDictionary *)diskProperties {	×
70	[self doesNotRecognizeSelector:_cmd];	×
71	}	×
72
73	- (void)logFileModification:(santa_message_t)message {	×
74	[self doesNotRecognizeSelector:_cmd];	×
75	}	×
76
77	- (void)logDeniedExecution:(SNTCachedDecision *)cd withMessage:(santa_message_t)message {	×
78	[self doesNotRecognizeSelector:_cmd];	×
79	}	×
80
81	- (void)logAllowedExecution:(santa_message_t)message {	×
82	[self doesNotRecognizeSelector:_cmd];	×
83	}	×
84
85	- (void)logBundleHashingEvents:(NSArray<SNTStoredEvent > )events {	×
86	[self doesNotRecognizeSelector:_cmd];	×
87	}	×
88
89	- (void)logFork:(santa_message_t)message {	×
90	[self doesNotRecognizeSelector:_cmd];	×
91	}	×
92	- (void)logExit:(santa_message_t)message {	×
93	[self doesNotRecognizeSelector:_cmd];	×
94	}	×
95
96	- (void)logAllowlist:(SNTAllowlistInfo *)allowlistInfo {	×
97	[self doesNotRecognizeSelector:_cmd];	×
98	}	×
99
100	- (void)forceFlush {	×
101	[self doesNotRecognizeSelector:_cmd];	×
102	}	×
103
104	- (void)cacheDecision:(SNTCachedDecision *)cd {	11✔
105	dispatch_sync(self.detailStoreQueue, ^{	11✔
106	self.detailStore[@(cd.vnodeId.fileid)] = cd;	11✔
107	});	11✔
108	}	11✔
109
110	- (SNTCachedDecision *)cachedDecisionForMessage:(santa_message_t)message {	×
111	__block SNTCachedDecision *cd;	×
112	dispatch_sync(self.detailStoreQueue, ^{	×
113	cd = self.detailStore[@(message.vnode_id.fileid)];	×
114	});	×
115	return cd;	×
116	}	×
117
118	- (void)forgetCachedDecisionForVnodeId:(santa_vnode_id_t)vnodeId {	×
119	dispatch_sync(self.detailStoreQueue, ^{	×
120	[self.detailStore removeObjectForKey:@(vnodeId.fileid)];	×
121	});	×
122	}	×
123
124	// Whenever a cached decision resulting from a transitive allowlist rule is used to allow the
125	// execution of a binary, we update the timestamp on the transitive rule in the rules database.
126	// To prevent writing to the database too often, we space out consecutive writes by 3600 seconds.
127	- (void)resetTimestampForCachedDecision:(SNTCachedDecision *)cd {	×
128	if (cd.decision != SNTEventStateAllowTransitive) return;	×
129	NSDate *lastUpdate = [self.timestampResetMap objectForKey:cd.sha256];	×
130	if (!lastUpdate \|\| -[lastUpdate timeIntervalSinceNow] > 3600) {	×
131	SNTRule *rule = [[SNTRule alloc] initWithIdentifier:cd.sha256	×
132	state:SNTRuleStateAllowTransitive	×
133	type:SNTRuleTypeBinary	×
134	customMsg:nil];	×
135	[[SNTDatabaseController ruleTable] resetTimestampForRule:rule];	×
136	[self.timestampResetMap setObject:[NSDate date] forKey:cd.sha256];	×
137	}	×
138	}	×
139
140	/**
141	Sanitizes a given string if necessary, otherwise returns the original.
142	*/
143	- (NSString )sanitizeString:(NSString )inStr {	11✔
144	NSUInteger length = [inStr lengthOfBytesUsingEncoding:NSUTF8StringEncoding];	11✔
145	if (length < 1) return inStr;	11✔
146
147	NSString *ret = [self sanitizeCString:inStr.UTF8String ofLength:length];	10✔
148	if (ret) {	10!
149	return ret;	×
150	}	×
151	return inStr;	10✔
152	}	10✔
153
154	/**
155	Sanitize the given C-string, replacing \|, \n and \r characters.
156
157	@return a new NSString with the replaced contents, if necessary, otherwise nil.
158	*/
159	- (NSString )sanitizeCString:(const char )str ofLength:(NSUInteger)length {	10✔
160	NSUInteger bufOffset = 0, strOffset = 0;	10✔
161	char c = 0;	10✔
162	char *buf = NULL;	10✔
163	BOOL shouldFree = NO;	10✔
164
165	if (length < 1) return @"";	10!
166
167	// Loop through the string one character at a time, looking for the characters
168	// we want to remove.
169	for (const char p = str; (c = p) != 0; ++p) {	710✔
170	if (c == '\|' \|\| c == '\n' \|\| c == '\r') {	700!
171	if (!buf) {	×
172	// If string size * 6 is more than 64KiB use malloc, otherwise use stack space.
173	if (length * 6 > 64 * 1024) {	×
174	buf = malloc(length * 6);	×
175	shouldFree = YES;	×
176	} else {	×
177	buf = alloca(length * 6);	×
178	}	×
179	}	×
180
181	// Copy from the last offset up to the character we just found into the buffer
182	ptrdiff_t diff = p - str;	×
183	memcpy(buf + bufOffset, str + strOffset, diff - strOffset);	×
184
185	// Update the buffer and string offsets
186	bufOffset += diff - strOffset;	×
187	strOffset = diff + 1;	×
188
189	// Replace the found character and advance the buffer offset
190	switch (c) {	×
191	case '\|':	×
192	memcpy(buf + bufOffset, "<pipe>", 6);	×
193	bufOffset += 6;	×
194	break;	×
195	case '\n':	×
196	memcpy(buf + bufOffset, "\\n", 2);	×
197	bufOffset += 2;	×
198	break;	×
199	case '\r':	×
200	memcpy(buf + bufOffset, "\\r", 2);	×
201	bufOffset += 2;	×
202	break;	×
203	}	×
204	}	×
205	}	700✔
206
207	if (strOffset > 0 && strOffset < length) {	10!
208	// Copy any characters from the last match to the end of the string into the buffer.
209	memcpy(buf + bufOffset, str + strOffset, length - strOffset);	×
210	bufOffset += length - strOffset;	×
211	}	×
212
213	if (buf) {	10!
214	// Only return a new string if there were matches
215	NSString *ret = [[NSString alloc] initWithBytes:buf	×
216	length:bufOffset	×
217	encoding:NSUTF8StringEncoding];	×
218	if (shouldFree) {	×
219	free(buf);	×
220	}	×
221
222	return ret;	×
223	}	×
224	return nil;	10✔
225	}	10✔
226
227	/**
228	Use sysctl to get the arguments for a PID, appended to the given string.
229	*/
230	- (void)addArgsForPid:(pid_t)pid toString:(NSMutableString *)str {	×
231	size_t argsSizeEstimate = 0, argsSize = 0, index = 0;	×
232
233	// Use stack space up to 128KiB.
234	const size_t MAX_STACK_ALLOC = 128 * 1024;	×
235	char *bytes = alloca(MAX_STACK_ALLOC);	×
236	BOOL shouldFree = NO;	×
237
238	int mib[] = {CTL_KERN, KERN_PROCARGS2, pid};	×
239
240	// Get estimated length of arg array
241	if (sysctl(mib, 3, NULL, &argsSizeEstimate, NULL, 0) < 0) return;	×
242	argsSize = argsSizeEstimate + 512;	×
243
244	// If this is larger than our allocated stack space, alloc from heap.
245	if (argsSize > MAX_STACK_ALLOC) {	×
246	bytes = malloc(argsSize);	×
247	shouldFree = YES;	×
248	}	×
249
250	// Get the args. If this fails, free if necessary and return.
251	if (sysctl(mib, 3, bytes, &argsSize, NULL, 0) != 0 \|\| argsSize >= argsSizeEstimate + 512) {	×
252	if (shouldFree) {	×
253	free(bytes);	×
254	}	×
255	return;	×
256	}	×
257
258	// Get argc, set index to the end of argc
259	int argc = 0;	×
260	memcpy(&argc, &bytes[0], sizeof(argc));	×
261	index = sizeof(argc);	×
262
263	// Skip past end of executable path and trailing NULLs
264	for (; index < argsSize; ++index) {	×
265	if (bytes[index] == '\0') {	×
266	++index;	×
267	break;	×
268	}	×
269	}	×
270	for (; index < argsSize; ++index) {	×
271	if (bytes[index] != '\0') break;	×
272	}	×
273
274	// Save the beginning of the arguments
275	size_t stringStart = index;	×
276
277	// Replace all NULLs with spaces up until the first environment variable
278	int replacedNulls = 0;	×
279	for (; index < argsSize; ++index) {	×
280	if (bytes[index] == '\0') {	×
281	++replacedNulls;	×
282	if (replacedNulls == argc) break;	×
283	bytes[index] = ' ';	×
284	}	×
285	}	×
286
287	// Potentially sanitize the args string.
288	NSString *sanitized = [self sanitizeCString:&bytes[stringStart] ofLength:index - stringStart];	×
289	if (sanitized) {	×
290	[str appendFormat:@"\|args=%@", sanitized];	×
291	} else {	×
292	[str appendFormat:@"\|args=%@", @(&bytes[stringStart])];	×
293	}	×
294
295	if (shouldFree) {	×
296	free(bytes);	×
297	}	×
298	}	×
299
300	- (NSString *)nameForUID:(uid_t)uid {	12✔
301	NSNumber *uidNumber = @(uid);	12✔
302
303	NSString *name = [self.userNameMap objectForKey:uidNumber];	12✔
304	if (name) return name;	12✔
305
306	struct passwd *pw = getpwuid(uid);	6✔
307	if (pw) {	6!
308	name = @(pw->pw_name);	6✔
309	[self.userNameMap setObject:name forKey:uidNumber];	6✔
310	}	6✔
311	return name;	6✔
312	}	6✔
313
314	- (NSString *)nameForGID:(gid_t)gid {	12✔
315	NSNumber *gidNumber = @(gid);	12✔
316
317	NSString *name = [self.groupNameMap objectForKey:gidNumber];	12✔
318	if (name) return name;	12✔
319
320	struct group *gr = getgrgid(gid);	6✔
321	if (gr) {	6!
322	name = @(gr->gr_name);	6✔
323	[self.groupNameMap setObject:name forKey:gidNumber];	6✔
324	}	6✔
325	return name;	6✔
326	}	6✔
327
328	/**
329	Given an IOKit device path (like those provided by DiskArbitration), find the disk
330	image path by looking up the device in the IOKit registry and getting its properties.
331
332	This is largely the same as the way hdiutil gathers info for the "info" command.
333	*/
334	- (NSString )diskImageForDevice:(NSString )devPath {	×
335	devPath = [devPath stringByDeletingLastPathComponent];	×
336	if (!devPath.length) return nil;	×
337	io_registry_entry_t device = IORegistryEntryFromPath(kIOMasterPortDefault, devPath.UTF8String);	×
338	CFMutableDictionaryRef deviceProperties = NULL;	×
339	IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);	×
340	NSDictionary *properties = CFBridgingRelease(deviceProperties);	×
341	IOObjectRelease(device);	×
342
343	NSData *pathData = properties[@"image-path"];	×
344	NSString *result = [[NSString alloc] initWithData:pathData encoding:NSUTF8StringEncoding];	×
345
346	return result;	×
347	}	×
348
349	/**
350	Given an IOKit device path (like those provided by DiskArbitration), find the device serial number,
351	if there is one. This has only really been tested with USB and internal devices.
352	*/
353	- (NSString )serialForDevice:(NSString )devPath {	70✔
354	if (!devPath.length) return nil;	70✔
355	NSString *serial;	56✔
356	io_registry_entry_t device = IORegistryEntryFromPath(kIOMasterPortDefault, devPath.UTF8String);	56✔
357	while (!serial && device) {	112!
358	CFMutableDictionaryRef deviceProperties = NULL;	112✔
359	IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);	112✔
360	NSDictionary *properties = CFBridgingRelease(deviceProperties);	112✔
361	if (properties[@"Serial Number"]) {	112✔
362	serial = properties[@"Serial Number"];	56✔
363	} else if (properties[@"kUSBSerialNumberString"]) {	56!
364	serial = properties[@"kUSBSerialNumberString"];	×
365	}	×
366
367	if (serial) {	112✔
368	IOObjectRelease(device);	56✔
369	break;	56✔
370	}	56✔
371
372	io_registry_entry_t parent;	56✔
373	IORegistryEntryGetParentEntry(device, kIOServicePlane, &parent);	56✔
374	IOObjectRelease(device);	56✔
375	device = parent;	56✔
376	}	56✔
377
378	return serial;	56✔
379	}	56✔
380
381	/**
382	Uses the executable path, uid, and gid from a given santa_message_t to determine if the path
383	has been translocated by GateKeeper and if so, returns the original path of the executable. This
384	requires macOS 10.12 or higher. We use dlopen to access the functions we need in
385	Security.framework so that we can still build against the 10.11 SDK. If the path has not been
386	translocated or if running on macOS prior to 10.12, this method returns nil.
387	*/
388	- (NSString )originalPathForTranslocation:(const santa_message_t )message {	9✔
389	if (!message) {	9!
390	return nil;	×
391	}	×
392
393	// The first time this function is called, we attempt to find the addresses of
394	// SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL inside of the
395	// Security.framework library. If we were successful, handle will be non-NULL and is never
396	// closed.
397	static Boolean (IsTranslocatedURL)(CFURLRef, bool , CFErrorRef *) = NULL;	9✔
398	static CFURLRef __nullable (CreateOriginalPathForURL)(CFURLRef, CFErrorRef ) = NULL;	9✔
399	static dispatch_once_t token;	9✔
400	dispatch_once(&token, ^{	3✔
401	void *handle = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_LAZY);	3✔
402	if (handle) {	3!
403	IsTranslocatedURL = dlsym(handle, "SecTranslocateIsTranslocatedURL");	3✔
404	CreateOriginalPathForURL = dlsym(handle, "SecTranslocateCreateOriginalPathForURL");	3✔
405	if (!IsTranslocatedURL \|\| !CreateOriginalPathForURL) {	3!
406	IsTranslocatedURL = NULL;	×
407	CreateOriginalPathForURL = NULL;	×
408	dlclose(handle);	×
409	}	×
410	}	3✔
411	});	3✔
412
413	// If we couldn't open the library or find the functions we need, don't do anything.
414	if (!IsTranslocatedURL \|\| !CreateOriginalPathForURL) return nil;	9!
415
416	// Determine if the executable URL has been translocated or not.
417	CFURLRef cfExecURL = (__bridge CFURLRef)[NSURL fileURLWithPath:@(message->path)];	9✔
418	bool isTranslocated = false;	9✔
419	if (!IsTranslocatedURL(cfExecURL, &isTranslocated, NULL) \|\| !isTranslocated) return nil;	9!
420
421	// SecTranslocateCreateOriginalPathForURL requires that our uid be the same as the user who
422	// launched the executable. So we temporarily drop from root down to this uid, then reset.
423	#pragma clang diagnostic push	×
424	#pragma clang diagnostic ignored "-Wdeprecated"	×
425	pthread_setugid_np(message->uid, message->gid);	×
426	NSURL *origURL = CFBridgingRelease(CreateOriginalPathForURL(cfExecURL, NULL));	×
427	pthread_setugid_np(KAUTH_UID_NONE, KAUTH_GID_NONE);	×
428	#pragma clang diagnostic pop	×
429
430	return [origURL path]; // this will be nil if there was an error	×
431	}	×
432
433	+ (instancetype)logger {	92✔
434	static SNTEventLog *logger = nil;	92✔
435	static dispatch_once_t onceToken;	92✔
436	dispatch_once(&onceToken, ^{	3✔
437	switch ([[SNTConfigurator configurator] eventLogType]) {	3✔
438	case SNTEventLogTypeSyslog: {	1✔
439	logger = [[SNTSyslogEventLog alloc] init];	1✔
440	break;	1✔
441	}	×
442	case SNTEventLogTypeFilelog: {	1✔
443	logger = [[SNTFileEventLog alloc] init];	1✔
444	break;	1✔
445	}	×
446	case SNTEventLogTypeProtobuf: {	×
447	logger = [[SNTProtobufEventLog alloc] init];	×
448	break;	×
449	}	×
450	case SNTEventLogTypeNull: {	×
451	// Messages sent to nil objects do nothing, which is perfect for a null logger.
452	logger = nil;	×
453	break;	×
454	}	×
455	}	3✔
456	});	3✔
457	return logger;	92✔
458	}	92✔
459	@end

google / santa / 2282860702

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous