3008679391

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/7531148de32e7146751b34861456f0aeecc5f5d2">7531148de">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/7531148de32e7146751b34861456f0aeecc5f5d2">7531148de</a><a href="https://github.com/google/santa/commit/7531148de32e7146751b34861456f0aeecc5f5d2">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/7531148de32e7146751b34861456f0aeecc5f5d2&quot;&gt;7531148de&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/7531148de32e7146751b34861456f0aeecc5f5d2&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2238 of 5380 branches covered (41.6%)

Branch coverage included in aggregate %.

3532 of 3532 new or added lines in 60 files covered. (100.0%)

8532 of 13681 relevant lines covered (62.36%)

17949.34 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

57.87

/Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.
#import "Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.h"

#import <DiskArbitration/DiskArbitration.h>
#include <EndpointSecurity/EndpointSecurity.h>
#import <Foundation/Foundation.h>

#include <atomic>
#include <memory>

#include <bsm/libbsm.h>
#include <errno.h>
#include <libproc.h>
#include <sys/mount.h>

#import "Source/common/SNTDeviceEvent.h"
#import "Source/common/SNTLogging.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"

using santa::santad::event_providers::AuthResultCache;
using santa::santad::event_providers::FlushCacheMode;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

@interface SNTEndpointSecurityDeviceManager ()

- (void)logDiskAppeared:(NSDictionary *)props;
- (void)logDiskDisappeared:(NSDictionary *)props;

@property DASessionRef diskArbSession;
@property(nonatomic, readonly) dispatch_queue_t diskQueue;

@end

void diskMountedCallback(DADiskRef disk, DADissenterRef dissenter, void *context) {
  if (dissenter) {
    DAReturn status = DADissenterGetStatus(dissenter);

    NSString *statusString = (NSString *)DADissenterGetStatusString(dissenter);
    IOReturn systemCode = err_get_system(status);
    IOReturn subSystemCode = err_get_sub(status);
    IOReturn errorCode = err_get_code(status);

    LOGE(@"SNTEndpointSecurityDeviceManager: dissenter status codes: system: %d, subsystem: %d, "
         @"err: %d; status: %s",
         systemCode, subSystemCode, errorCode, [statusString UTF8String]);
  }
}

void diskAppearedCallback(DADiskRef disk, void *context) {
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
  if (![props[@"DAVolumeMountable"] boolValue]) return;
  SNTEndpointSecurityDeviceManager *dm = (__bridge SNTEndpointSecurityDeviceManager *)context;

  [dm logDiskAppeared:props];
}

void diskDescriptionChangedCallback(DADiskRef disk, CFArrayRef keys, void *context) {
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
  if (![props[@"DAVolumeMountable"] boolValue]) return;

  if (props[@"DAVolumePath"]) {
    SNTEndpointSecurityDeviceManager *dm = (__bridge SNTEndpointSecurityDeviceManager *)context;

    [dm logDiskAppeared:props];
  }
}

void diskDisappearedCallback(DADiskRef disk, void *context) {
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
  if (![props[@"DAVolumeMountable"] boolValue]) return;

  SNTEndpointSecurityDeviceManager *dm = (__bridge SNTEndpointSecurityDeviceManager *)context;

  [dm logDiskDisappeared:props];
}

NSArray<NSString *> *maskToMountArgs(long remountOpts) {
  NSMutableArray<NSString *> *args = [NSMutableArray array];
  if (remountOpts & MNT_RDONLY) [args addObject:@"rdonly"];
  if (remountOpts & MNT_NOEXEC) [args addObject:@"noexec"];
  if (remountOpts & MNT_NOSUID) [args addObject:@"nosuid"];
  if (remountOpts & MNT_DONTBROWSE) [args addObject:@"nobrowse"];
  if (remountOpts & MNT_UNKNOWNPERMISSIONS) [args addObject:@"noowners"];
  if (remountOpts & MNT_NODEV) [args addObject:@"nodev"];
  if (remountOpts & MNT_JOURNALED) [args addObject:@"-j"];
  if (remountOpts & MNT_ASYNC) [args addObject:@"async"];
  return args;
}

long mountArgsToMask(NSArray<NSString *> *args) {
  long flags = 0;
  for (NSString *i in args) {
    NSString *arg = [i lowercaseString];
    if ([arg isEqualToString:@"rdonly"])
      flags |= MNT_RDONLY;
    else if ([arg isEqualToString:@"noexec"])
      flags |= MNT_NOEXEC;
    else if ([arg isEqualToString:@"nosuid"])
      flags |= MNT_NOSUID;
    else if ([arg isEqualToString:@"nobrowse"])
      flags |= MNT_DONTBROWSE;
    else if ([arg isEqualToString:@"noowners"])
      flags |= MNT_UNKNOWNPERMISSIONS;
    else if ([arg isEqualToString:@"nodev"])
      flags |= MNT_NODEV;
    else if ([arg isEqualToString:@"-j"])
      flags |= MNT_JOURNALED;
    else if ([arg isEqualToString:@"async"])
      flags |= MNT_ASYNC;
    else
      LOGE(@"SNTEndpointSecurityDeviceManager: unexpected mount arg: %@", arg);
  }
  return flags;
}

NS_ASSUME_NONNULL_BEGIN

@implementation SNTEndpointSecurityDeviceManager {
  std::shared_ptr<AuthResultCache> _authResultCache;
  std::shared_ptr<Logger> _logger;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                       logger:(std::shared_ptr<Logger>)logger
              authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache {
  self = [super initWithESAPI:std::move(esApi)];
  if (self) {
    _logger = logger;
    _blockUSBMount = false;

    _diskQueue = dispatch_queue_create("com.google.santa.daemon.disk_queue", DISPATCH_QUEUE_SERIAL);

    _diskArbSession = DASessionCreate(NULL);
    DASessionSetDispatchQueue(_diskArbSession, _diskQueue);

    [self establishClientOrDie];
  }
  return self;
}

- (void)logDiskAppeared:(NSDictionary *)props {
  self->_logger->LogDiskAppeared(props);
}

- (void)logDiskDisappeared:(NSDictionary *)props {
  self->_logger->LogDiskDisappeared(props);
}

- (void)handleMessage:(Message &&)esMsg {
  if (!self.blockUSBMount) {
    // TODO: We should also unsubscribe from events when this isn't set, but
    // this is generally a low-volume event type.
    [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:false];
    return;
  }

  if (esMsg->event_type == ES_EVENT_TYPE_NOTIFY_UNMOUNT) {
    self->_authResultCache->FlushCache(FlushCacheMode::kNonRootOnly);
    return;
  }

  [self processMessage:std::move(esMsg)
               handler:^(const Message &msg) {
                 es_auth_result_t result = [self handleAuthMount:msg];
                 [self respondToMessage:msg withAuthResult:result cacheable:false];
               }];
}

- (void)enable {
  DARegisterDiskAppearedCallback(_diskArbSession, NULL, diskAppearedCallback,
                                 (__bridge void *)self);
  DARegisterDiskDescriptionChangedCallback(_diskArbSession, NULL, NULL,
                                           diskDescriptionChangedCallback, (__bridge void *)self);
  DARegisterDiskDisappearedCallback(_diskArbSession, NULL, diskDisappearedCallback,
                                    (__bridge void *)self);

  [super subscribeAndClearCache:{
                                  ES_EVENT_TYPE_AUTH_MOUNT,
                                  ES_EVENT_TYPE_AUTH_REMOUNT,
                                  ES_EVENT_TYPE_NOTIFY_UNMOUNT,
                                }];
}

- (es_auth_result_t)handleAuthMount:(const Message &)m {
  struct statfs *eventStatFS;

  switch (m->event_type) {
    case ES_EVENT_TYPE_AUTH_MOUNT: eventStatFS = m->event.mount.statfs; break;
    case ES_EVENT_TYPE_AUTH_REMOUNT: eventStatFS = m->event.remount.statfs; break;
    default:
      // This is a programming error
      LOGE(@"Unexpected Event Type passed to DeviceManager handleAuthMount: %d", m->event_type);
      exit(EXIT_FAILURE);
  }

  long mountMode = eventStatFS->f_flags;
  pid_t pid = audit_token_to_pid(m->process->audit_token);
  LOGD(
    @"SNTEndpointSecurityDeviceManager: mount syscall arriving from path: %s, pid: %d, fflags: %lu",
    m->process->executable->path.data, pid, mountMode);

  DADiskRef disk = DADiskCreateFromBSDName(NULL, self.diskArbSession, eventStatFS->f_mntfromname);
  CFAutorelease(disk);

  // TODO(tnek): Log all of the other attributes available in diskInfo into a structured log format.
  NSDictionary *diskInfo = CFBridgingRelease(DADiskCopyDescription(disk));
  BOOL isInternal = [diskInfo[(__bridge NSString *)kDADiskDescriptionDeviceInternalKey] boolValue];
  BOOL isRemovable = [diskInfo[(__bridge NSString *)kDADiskDescriptionMediaRemovableKey] boolValue];
  BOOL isEjectable = [diskInfo[(__bridge NSString *)kDADiskDescriptionMediaEjectableKey] boolValue];
  NSString *protocol = diskInfo[(__bridge NSString *)kDADiskDescriptionDeviceProtocolKey];
  BOOL isUSB = [protocol isEqualToString:@"USB"];
  BOOL isVirtual = [protocol isEqualToString:@"Virtual Interface"];

  NSString *kind = diskInfo[(__bridge NSString *)kDADiskDescriptionMediaKindKey];

  // TODO: check kind and protocol for banned things (e.g. MTP).
  LOGD(@"SNTEndpointSecurityDeviceManager: DiskInfo Protocol: %@ Kind: %@ isInternal: %d "
       @"isRemovable: %d "
       @"isEjectable: %d",
       protocol, kind, isInternal, isRemovable, isEjectable);

  // If the device is internal or virtual we are okay with the operation. We
  // also are okay with operations for devices that are non-removal as long as
  // they are NOT a USB device.
  if (isInternal || isVirtual || (!isRemovable && !isEjectable && !isUSB)) {
    return ES_AUTH_RESULT_ALLOW;
  }

  SNTDeviceEvent *event = [[SNTDeviceEvent alloc]
    initWithOnName:[NSString stringWithUTF8String:eventStatFS->f_mntonname]
          fromName:[NSString stringWithUTF8String:eventStatFS->f_mntfromname]];

  BOOL shouldRemount = self.remountArgs != nil && [self.remountArgs count] > 0;

  if (shouldRemount) {
    event.remountArgs = self.remountArgs;
    long remountOpts = mountArgsToMask(self.remountArgs);

    LOGD(@"SNTEndpointSecurityDeviceManager: mountMode: %@", maskToMountArgs(mountMode));
    LOGD(@"SNTEndpointSecurityDeviceManager: remountOpts: %@", maskToMountArgs(remountOpts));

    if ((mountMode & remountOpts) == remountOpts && m->event_type != ES_EVENT_TYPE_AUTH_REMOUNT) {
      LOGD(@"SNTEndpointSecurityDeviceManager: Allowing as mount as flags match remountOpts");
      return ES_AUTH_RESULT_ALLOW;
    }

    long newMode = mountMode | remountOpts;
    LOGI(@"SNTEndpointSecurityDeviceManager: remounting device '%s'->'%s', flags (%lu) -> (%lu)",
         eventStatFS->f_mntfromname, eventStatFS->f_mntonname, mountMode, newMode);
    [self remount:disk mountMode:newMode];
  }

  if (self.deviceBlockCallback) {
    self.deviceBlockCallback(event);
  }

  return ES_AUTH_RESULT_DENY;
}

- (void)remount:(DADiskRef)disk mountMode:(long)remountMask {
  NSArray<NSString *> *args = maskToMountArgs(remountMask);
  CFStringRef *argv = (CFStringRef *)calloc(args.count + 1, sizeof(CFStringRef));
  CFArrayGetValues((__bridge CFArrayRef)args, CFRangeMake(0, (CFIndex)args.count),
                   (const void **)argv);

  DADiskMountWithArguments(disk, NULL, kDADiskMountOptionDefault, diskMountedCallback,
                           (__bridge void *)self, (CFStringRef *)argv);

  free(argv);
}

@end

NS_ASSUME_NONNULL_END

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14	#import "Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.h"
15
16	#import <DiskArbitration/DiskArbitration.h>
17	#include <EndpointSecurity/EndpointSecurity.h>
18	#import <Foundation/Foundation.h>
19
20	#include <atomic>
21	#include <memory>
22
23	#include <bsm/libbsm.h>
24	#include <errno.h>
25	#include <libproc.h>
26	#include <sys/mount.h>
27
28	#import "Source/common/SNTDeviceEvent.h"
29	#import "Source/common/SNTLogging.h"
30	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
31
32	using santa::santad::event_providers::AuthResultCache;
33	using santa::santad::event_providers::FlushCacheMode;
34	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
35	using santa::santad::event_providers::endpoint_security::Message;
36	using santa::santad::logs::endpoint_security::Logger;
37
38	@interface SNTEndpointSecurityDeviceManager ()
39
40	- (void)logDiskAppeared:(NSDictionary *)props;
41	- (void)logDiskDisappeared:(NSDictionary *)props;
42
43	@property DASessionRef diskArbSession;
44	@property(nonatomic, readonly) dispatch_queue_t diskQueue;
45
46	@end
47
48	void diskMountedCallback(DADiskRef disk, DADissenterRef dissenter, void *context) {	×
49	if (dissenter) {	×
50	DAReturn status = DADissenterGetStatus(dissenter);	×
51
52	NSString statusString = (NSString )DADissenterGetStatusString(dissenter);	×
53	IOReturn systemCode = err_get_system(status);	×
54	IOReturn subSystemCode = err_get_sub(status);	×
55	IOReturn errorCode = err_get_code(status);	×
56
57	LOGE(@"SNTEndpointSecurityDeviceManager: dissenter status codes: system: %d, subsystem: %d, "	×
58	@"err: %d; status: %s",	×
59	systemCode, subSystemCode, errorCode, [statusString UTF8String]);	×
60	}	×
61	}	×
62
63	void diskAppearedCallback(DADiskRef disk, void *context) {	×
64	NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));	×
65	if (![props[@"DAVolumeMountable"] boolValue]) return;	×
66	SNTEndpointSecurityDeviceManager dm = (__bridge SNTEndpointSecurityDeviceManager )context;	×
67
68	[dm logDiskAppeared:props];	×
69	}	×
70
71	void diskDescriptionChangedCallback(DADiskRef disk, CFArrayRef keys, void *context) {	×
72	NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));	×
73	if (![props[@"DAVolumeMountable"] boolValue]) return;	×
74
75	if (props[@"DAVolumePath"]) {	×
76	SNTEndpointSecurityDeviceManager dm = (__bridge SNTEndpointSecurityDeviceManager )context;	×
77
78	[dm logDiskAppeared:props];	×
79	}	×
80	}	×
81
82	void diskDisappearedCallback(DADiskRef disk, void *context) {	×
83	NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));	×
84	if (![props[@"DAVolumeMountable"] boolValue]) return;	×
85
86	SNTEndpointSecurityDeviceManager dm = (__bridge SNTEndpointSecurityDeviceManager )context;	×
87
88	[dm logDiskDisappeared:props];	×
89	}	×
90
91	NSArray<NSString > maskToMountArgs(long remountOpts) {	6✔
92	NSMutableArray<NSString > args = [NSMutableArray array];	6✔
93	if (remountOpts & MNT_RDONLY) [args addObject:@"rdonly"];	6✔
94	if (remountOpts & MNT_NOEXEC) [args addObject:@"noexec"];	6✔
95	if (remountOpts & MNT_NOSUID) [args addObject:@"nosuid"];	6!
96	if (remountOpts & MNT_DONTBROWSE) [args addObject:@"nobrowse"];	6!
97	if (remountOpts & MNT_UNKNOWNPERMISSIONS) [args addObject:@"noowners"];	6!
98	if (remountOpts & MNT_NODEV) [args addObject:@"nodev"];	6!
99	if (remountOpts & MNT_JOURNALED) [args addObject:@"-j"];	6!
100	if (remountOpts & MNT_ASYNC) [args addObject:@"async"];	6!
101	return args;	6✔
102	}	6✔
103
104	long mountArgsToMask(NSArray<NSString > args) {	2✔
105	long flags = 0;	2✔
106	for (NSString *i in args) {	4✔
107	NSString *arg = [i lowercaseString];	4✔
108	if ([arg isEqualToString:@"rdonly"])	4✔
109	flags \|= MNT_RDONLY;	2✔
110	else if ([arg isEqualToString:@"noexec"])	2!
111	flags \|= MNT_NOEXEC;	2✔
112	else if ([arg isEqualToString:@"nosuid"])	×
113	flags \|= MNT_NOSUID;	×
114	else if ([arg isEqualToString:@"nobrowse"])	×
115	flags \|= MNT_DONTBROWSE;	×
116	else if ([arg isEqualToString:@"noowners"])	×
117	flags \|= MNT_UNKNOWNPERMISSIONS;	×
118	else if ([arg isEqualToString:@"nodev"])	×
119	flags \|= MNT_NODEV;	×
120	else if ([arg isEqualToString:@"-j"])	×
121	flags \|= MNT_JOURNALED;	×
122	else if ([arg isEqualToString:@"async"])	×
123	flags \|= MNT_ASYNC;	×
124	else	×
125	LOGE(@"SNTEndpointSecurityDeviceManager: unexpected mount arg: %@", arg);	×
126	}	4✔
127	return flags;	2✔
128	}	2✔
129
130	NS_ASSUME_NONNULL_BEGIN
131
132	@implementation SNTEndpointSecurityDeviceManager {
133	std::shared_ptr<AuthResultCache> _authResultCache;
134	std::shared_ptr<Logger> _logger;
135	}
136
137	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
138	logger:(std::shared_ptr<Logger>)logger
139	authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache {	5✔
140	self = [super initWithESAPI:std::move(esApi)];	5✔
141	if (self) {	5!
142	_logger = logger;	5✔
143	_blockUSBMount = false;	5✔
144
145	_diskQueue = dispatch_queue_create("com.google.santa.daemon.disk_queue", DISPATCH_QUEUE_SERIAL);	5✔
146
147	_diskArbSession = DASessionCreate(NULL);	5✔
148	DASessionSetDispatchQueue(_diskArbSession, _diskQueue);	5✔
149
150	[self establishClientOrDie];	5✔
151	}	5✔
152	return self;	5✔
153	}	5✔
154
155	- (void)logDiskAppeared:(NSDictionary *)props {	×
156	self->_logger->LogDiskAppeared(props);	×
157	}	×
158
159	- (void)logDiskDisappeared:(NSDictionary *)props {	×
160	self->_logger->LogDiskDisappeared(props);	×
161	}	×
162
163	- (void)handleMessage:(Message &&)esMsg {	5✔
164	if (!self.blockUSBMount) {	5✔
165	// TODO: We should also unsubscribe from events when this isn't set, but
166	// this is generally a low-volume event type.
167	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:false];	1✔
168	return;	1✔
169	}	1✔
170
171	if (esMsg->event_type == ES_EVENT_TYPE_NOTIFY_UNMOUNT) {	4!
172	self->_authResultCache->FlushCache(FlushCacheMode::kNonRootOnly);	×
173	return;	×
174	}	×
175
176	[self processMessage:std::move(esMsg)	4✔
177	handler:^(const Message &msg) {	4✔
178	es_auth_result_t result = [self handleAuthMount:msg];	4✔
179	[self respondToMessage:msg withAuthResult:result cacheable:false];	4✔
180	}];	4✔
181	}	4✔
182
183	- (void)enable {	1✔
184	DARegisterDiskAppearedCallback(_diskArbSession, NULL, diskAppearedCallback,	1✔
185	(__bridge void *)self);	1✔
186	DARegisterDiskDescriptionChangedCallback(_diskArbSession, NULL, NULL,	1✔
187	diskDescriptionChangedCallback, (__bridge void *)self);	1✔
188	DARegisterDiskDisappearedCallback(_diskArbSession, NULL, diskDisappearedCallback,	1✔
189	(__bridge void *)self);	1✔
190
191	[super subscribeAndClearCache:{	1✔
192	ES_EVENT_TYPE_AUTH_MOUNT,	1✔
193	ES_EVENT_TYPE_AUTH_REMOUNT,	1✔
194	ES_EVENT_TYPE_NOTIFY_UNMOUNT,	1✔
195	}];	1✔
196	}	1✔
197
198	- (es_auth_result_t)handleAuthMount:(const Message &)m {	4✔
199	struct statfs *eventStatFS;	4✔
200
201	switch (m->event_type) {	4✔
202	case ES_EVENT_TYPE_AUTH_MOUNT: eventStatFS = m->event.mount.statfs; break;	4!
203	case ES_EVENT_TYPE_AUTH_REMOUNT: eventStatFS = m->event.remount.statfs; break;	×
204	default:	×
205	// This is a programming error
206	LOGE(@"Unexpected Event Type passed to DeviceManager handleAuthMount: %d", m->event_type);	×
207	exit(EXIT_FAILURE);	×
208	}	4✔
209
210	long mountMode = eventStatFS->f_flags;	4✔
211	pid_t pid = audit_token_to_pid(m->process->audit_token);	4✔
212	LOGD(	4✔
213	@"SNTEndpointSecurityDeviceManager: mount syscall arriving from path: %s, pid: %d, fflags: %lu",	4✔
214	m->process->executable->path.data, pid, mountMode);	4✔
215
216	DADiskRef disk = DADiskCreateFromBSDName(NULL, self.diskArbSession, eventStatFS->f_mntfromname);	4✔
217	CFAutorelease(disk);	4✔
218
219	// TODO(tnek): Log all of the other attributes available in diskInfo into a structured log format.
220	NSDictionary *diskInfo = CFBridgingRelease(DADiskCopyDescription(disk));	4✔
221	BOOL isInternal = [diskInfo[(__bridge NSString *)kDADiskDescriptionDeviceInternalKey] boolValue];	4✔
222	BOOL isRemovable = [diskInfo[(__bridge NSString *)kDADiskDescriptionMediaRemovableKey] boolValue];	4✔
223	BOOL isEjectable = [diskInfo[(__bridge NSString *)kDADiskDescriptionMediaEjectableKey] boolValue];	4✔
224	NSString protocol = diskInfo[(__bridge NSString )kDADiskDescriptionDeviceProtocolKey];	4✔
225	BOOL isUSB = [protocol isEqualToString:@"USB"];	4✔
226	BOOL isVirtual = [protocol isEqualToString:@"Virtual Interface"];	4✔
227
228	NSString kind = diskInfo[(__bridge NSString )kDADiskDescriptionMediaKindKey];	4✔
229
230	// TODO: check kind and protocol for banned things (e.g. MTP).
231	LOGD(@"SNTEndpointSecurityDeviceManager: DiskInfo Protocol: %@ Kind: %@ isInternal: %d "	4✔
232	@"isRemovable: %d "	4✔
233	@"isEjectable: %d",	4✔
234	protocol, kind, isInternal, isRemovable, isEjectable);	4✔
235
236	// If the device is internal or virtual we are okay with the operation. We
237	// also are okay with operations for devices that are non-removal as long as
238	// they are NOT a USB device.
239	if (isInternal \|\| isVirtual \|\| (!isRemovable && !isEjectable && !isUSB)) {	4!
240	return ES_AUTH_RESULT_ALLOW;	1✔
241	}	1✔
242
243	SNTDeviceEvent *event = [[SNTDeviceEvent alloc]	3✔
244	initWithOnName:[NSString stringWithUTF8String:eventStatFS->f_mntonname]	3✔
245	fromName:[NSString stringWithUTF8String:eventStatFS->f_mntfromname]];	3✔
246
247	BOOL shouldRemount = self.remountArgs != nil && [self.remountArgs count] > 0;	3!
248
249	if (shouldRemount) {	3✔
250	event.remountArgs = self.remountArgs;	2✔
251	long remountOpts = mountArgsToMask(self.remountArgs);	2✔
252
253	LOGD(@"SNTEndpointSecurityDeviceManager: mountMode: %@", maskToMountArgs(mountMode));	2✔
254	LOGD(@"SNTEndpointSecurityDeviceManager: remountOpts: %@", maskToMountArgs(remountOpts));	2✔
255
256	if ((mountMode & remountOpts) == remountOpts && m->event_type != ES_EVENT_TYPE_AUTH_REMOUNT) {	2!
257	LOGD(@"SNTEndpointSecurityDeviceManager: Allowing as mount as flags match remountOpts");	×
258	return ES_AUTH_RESULT_ALLOW;	×
259	}	×
260
261	long newMode = mountMode \| remountOpts;	2✔
262	LOGI(@"SNTEndpointSecurityDeviceManager: remounting device '%s'->'%s', flags (%lu) -> (%lu)",	2✔
263	eventStatFS->f_mntfromname, eventStatFS->f_mntonname, mountMode, newMode);	2✔
264	[self remount:disk mountMode:newMode];	2✔
265	}	2✔
266
267	if (self.deviceBlockCallback) {	3!
268	self.deviceBlockCallback(event);	3✔
269	}	3✔
270
271	return ES_AUTH_RESULT_DENY;	3✔
272	}	3✔
273
274	- (void)remount:(DADiskRef)disk mountMode:(long)remountMask {	2✔
275	NSArray<NSString > args = maskToMountArgs(remountMask);	2✔
276	CFStringRef argv = (CFStringRef )calloc(args.count + 1, sizeof(CFStringRef));	2✔
277	CFArrayGetValues((__bridge CFArrayRef)args, CFRangeMake(0, (CFIndex)args.count),	2✔
278	(const void **)argv);	2✔
279
280	DADiskMountWithArguments(disk, NULL, kDADiskMountOptionDefault, diskMountedCallback,	2✔
281	(__bridge void )self, (CFStringRef )argv);	2✔
282
283	free(argv);	2✔
284	}	2✔
285
286	@end
287
288	NS_ASSUME_NONNULL_END

google / santa / 3008679391

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous