3046537650

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/0d4099a2adf1e23384f457ff1e9dcbf9ad9337d7">0d4099a2a">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/0d4099a2adf1e23384f457ff1e9dcbf9ad9337d7">0d4099a2a</a><a href="https://github.com/google/santa/commit/0d4099a2adf1e23384f457ff1e9dcbf9ad9337d7">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/0d4099a2adf1e23384f457ff1e9dcbf9ad9337d7&quot;&gt;0d4099a2a&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/0d4099a2adf1e23384f457ff1e9dcbf9ad9337d7&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2440 of 5502 branches covered (44.35%)

Branch coverage included in aggregate %.

3930 of 3930 new or added lines in 63 files covered. (100.0%)

9501 of 14156 relevant lines covered (67.12%)

16153.0 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

72.5

/Source/santad/SNTCompilerController.mm

/// Copyright 2017-2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTCompilerController.h"

#include <bsm/libbsm.h>
#include <mach/message.h>
#include <os/base.h>
#include <string.h>

#include <atomic>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTCommon.h"
#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#import "Source/santad/SNTDatabaseController.h"
#import "Source/santad/SNTDecisionCache.h"

using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

static const pid_t PID_MAX = 99999;
static constexpr std::string_view kIgnoredCompilerProcessPathPrefix = "/dev/";

@interface SNTCompilerController () {
  std::atomic<bool> _compilerPIDs[PID_MAX];
}
@end

@implementation SNTCompilerController

- (BOOL)isCompiler:(const audit_token_t &)tok {
  pid_t pid = audit_token_to_pid(tok);
  return pid >= 0 && pid < PID_MAX && self->_compilerPIDs[pid].load();
}

- (void)setProcess:(const audit_token_t &)tok isCompiler:(bool)isCompiler {
  pid_t pid = audit_token_to_pid(tok);
  if (pid < 1) {
    LOGE(@"Unable to watch compiler pid=%d", pid);
  } else if (pid >= PID_MAX) {
    LOGE(@"Unable to watch compiler pid=%d >= PID_MAX(%d)", pid, PID_MAX);
  } else {
    self->_compilerPIDs[pid].store(isCompiler);
    if (isCompiler) {
      LOGD(@"Watching compiler pid=%d", pid);
    }
  }
}

// Adds a fake cached decision to SNTDecisionCache for pending files. If the file
// is executed before we can create a transitive rule for it, then we can at
// least log the pending decision info.
- (void)saveFakeDecision:(const es_file_t *)esFile {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:esFile];
  cd.decision = SNTEventStateAllowPendingTransitive;
  cd.sha256 = @"pending";
  [[SNTDecisionCache sharedCache] cacheDecision:cd];
}

- (void)removeFakeDecision:(const es_file_t *)esFile {
  [[SNTDecisionCache sharedCache] forgetCachedDecisionForFile:esFile->stat];
}

- (BOOL)handleEvent:(const Message &)esMsg withLogger:(std::shared_ptr<Logger>)logger {
  const es_file_t *targetFile = NULL;

  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
      if (![self isCompiler:esMsg->process->audit_token]) {
        return NO;
      }

      if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.close.target->path.data,
                  kIgnoredCompilerProcessPathPrefix.length()) == 0) {
        return NO;
      }

      targetFile = esMsg->event.close.target;

      break;
    case ES_EVENT_TYPE_NOTIFY_RENAME:
      if (![self isCompiler:esMsg->process->audit_token]) {
        return NO;
      }

      // Note: For RENAME events, we process the `source`. This is the one
      // that we sould be creating transitive rules for, not the destination.
      if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.rename.source->path.data,
                  kIgnoredCompilerProcessPathPrefix.length()) == 0) {
        return NO;
      }

      targetFile = esMsg->event.rename.source;

      break;
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      [self setProcess:esMsg->process->audit_token isCompiler:false];
      return YES;
    default: return NO;
  }

  // If we get here, we need to update transitve rules
  if (targetFile) {
    [self createTransitiveRule:esMsg target:targetFile logger:logger];
    return YES;
  } else {
    return NO;
  }
}

// Assume that this method is called only when we already know that the writing process is a
// compiler.  It checks if the closed file is executable, and if so, transitively allowlists it.
// The passed in message contains the pid of the writing process and path of closed file.
- (void)createTransitiveRule:(const Message &)esMsg
                      target:(const es_file_t *)targetFile
                      logger:(std::shared_ptr<Logger>)logger {
  [self saveFakeDecision:targetFile];

  // Check if this file is an executable.
  SNTFileInfo *fi = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetFile error:nil];
  if (fi.isExecutable) {
    // Check if there is an existing (non-transitive) rule for this file.  We leave existing rules
    // alone, so that a allowlist or blocklist rule can't be overwritten by a transitive one.
    SNTRuleTable *ruleTable = [SNTDatabaseController ruleTable];
    SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256 certificateSHA256:nil teamID:nil];
    if (!prevRule || prevRule.state == SNTRuleStateAllowTransitive) {
      // Construct a new transitive allowlist rule for the executable.
      SNTRule *rule = [[SNTRule alloc] initWithIdentifier:fi.SHA256
                                                    state:SNTRuleStateAllowTransitive
                                                     type:SNTRuleTypeBinary
                                                customMsg:@""];

      // Add the new rule to the rules database.
      NSError *err;
      if (![ruleTable addRules:@[ rule ] cleanSlate:NO error:&err]) {
        LOGE(@"unable to add new transitive rule to database: %@", err.localizedDescription);
      } else {
        logger->LogAllowlist(esMsg, [fi.SHA256 UTF8String]);
      }
    }
  }

  [self removeFakeDecision:targetFile];
}

@end

1	/// Copyright 2017-2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTCompilerController.h"
16
17	#include <bsm/libbsm.h>
18	#include <mach/message.h>
19	#include <os/base.h>
20	#include <string.h>
21
22	#include <atomic>
23
24	#import "Source/common/SNTCachedDecision.h"
25	#import "Source/common/SNTCommon.h"
26	#import "Source/common/SNTCommonEnums.h"
27	#import "Source/common/SNTFileInfo.h"
28	#import "Source/common/SNTLogging.h"
29	#import "Source/common/SNTRule.h"
30	#import "Source/santad/DataLayer/SNTRuleTable.h"
31	#import "Source/santad/SNTDatabaseController.h"
32	#import "Source/santad/SNTDecisionCache.h"
33
34	using santa::santad::event_providers::endpoint_security::Message;
35	using santa::santad::logs::endpoint_security::Logger;
36
37	static const pid_t PID_MAX = 99999;
38	static constexpr std::string_view kIgnoredCompilerProcessPathPrefix = "/dev/";
39
40	@interface SNTCompilerController () {
41	std::atomic<bool> _compilerPIDs[PID_MAX];
42	}
43	@end
44
45	@implementation SNTCompilerController
46
47	- (BOOL)isCompiler:(const audit_token_t &)tok {	19✔
48	pid_t pid = audit_token_to_pid(tok);	19✔
49	return pid >= 0 && pid < PID_MAX && self->_compilerPIDs[pid].load();	19✔
50	}	19✔
51
52	- (void)setProcess:(const audit_token_t &)tok isCompiler:(bool)isCompiler {	8✔
53	pid_t pid = audit_token_to_pid(tok);	8✔
54	if (pid < 1) {	8✔
55	LOGE(@"Unable to watch compiler pid=%d", pid);	1✔
56	} else if (pid >= PID_MAX) {	7✔
57	LOGE(@"Unable to watch compiler pid=%d >= PID_MAX(%d)", pid, PID_MAX);	1✔
58	} else {	6✔
59	self->_compilerPIDs[pid].store(isCompiler);	6✔
60	if (isCompiler) {	6✔
61	LOGD(@"Watching compiler pid=%d", pid);	4✔
62	}	4✔
63	}	6✔
64	}	8✔
65
66	// Adds a fake cached decision to SNTDecisionCache for pending files. If the file
67	// is executed before we can create a transitive rule for it, then we can at
68	// least log the pending decision info.
69	- (void)saveFakeDecision:(const es_file_t *)esFile {	1✔
70	SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:esFile];	1✔
71	cd.decision = SNTEventStateAllowPendingTransitive;	1✔
72	cd.sha256 = @"pending";	1✔
73	[[SNTDecisionCache sharedCache] cacheDecision:cd];	1✔
74	}	1✔
75
76	- (void)removeFakeDecision:(const es_file_t *)esFile {	1✔
77	[[SNTDecisionCache sharedCache] forgetCachedDecisionForFile:esFile->stat];	1✔
78	}	1✔
79
80	- (BOOL)handleEvent:(const Message &)esMsg withLogger:(std::shared_ptr<Logger>)logger {	8✔
81	const es_file_t *targetFile = NULL;	8✔
82
83	switch (esMsg->event_type) {	8✔
84	case ES_EVENT_TYPE_NOTIFY_CLOSE:	3✔
85	if (![self isCompiler:esMsg->process->audit_token]) {	3✔
86	return NO;	1✔
87	}	1✔
88
89	if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.close.target->path.data,	2✔
90	kIgnoredCompilerProcessPathPrefix.length()) == 0) {	1✔
91	return NO;	1✔
92	}	1✔
93
94	targetFile = esMsg->event.close.target;	1✔
95
96	break;	1✔
97	case ES_EVENT_TYPE_NOTIFY_RENAME:	3✔
98	if (![self isCompiler:esMsg->process->audit_token]) {	3✔
99	return NO;	1✔
100	}	1✔
101
102	// Note: For RENAME events, we process the `source`. This is the one
103	// that we sould be creating transitive rules for, not the destination.
104	if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.rename.source->path.data,	2✔
105	kIgnoredCompilerProcessPathPrefix.length()) == 0) {	1✔
106	return NO;	1✔
107	}	1✔
108
109	targetFile = esMsg->event.rename.source;	1✔
110
111	break;	1✔
112	case ES_EVENT_TYPE_NOTIFY_EXIT:	1✔
113	[self setProcess:esMsg->process->audit_token isCompiler:false];	1✔
114	return YES;	1✔
115	default: return NO;	1✔
116	}	2✔
117
118	// If we get here, we need to update transitve rules
119	if (targetFile) {	2!
120	[self createTransitiveRule:esMsg target:targetFile logger:logger];	2✔
121	return YES;	2✔
122	} else {	×
123	return NO;	×
124	}	×
125	}	2✔
126
127	// Assume that this method is called only when we already know that the writing process is a
128	// compiler. It checks if the closed file is executable, and if so, transitively allowlists it.
129	// The passed in message contains the pid of the writing process and path of closed file.
130	- (void)createTransitiveRule:(const Message &)esMsg
131	target:(const es_file_t *)targetFile
132	logger:(std::shared_ptr<Logger>)logger {	×
133	[self saveFakeDecision:targetFile];	×
134
135	// Check if this file is an executable.
136	SNTFileInfo *fi = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetFile error:nil];	×
137	if (fi.isExecutable) {	×
138	// Check if there is an existing (non-transitive) rule for this file. We leave existing rules
139	// alone, so that a allowlist or blocklist rule can't be overwritten by a transitive one.
140	SNTRuleTable *ruleTable = [SNTDatabaseController ruleTable];	×
141	SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256 certificateSHA256:nil teamID:nil];	×
142	if (!prevRule \|\| prevRule.state == SNTRuleStateAllowTransitive) {	×
143	// Construct a new transitive allowlist rule for the executable.
144	SNTRule *rule = [[SNTRule alloc] initWithIdentifier:fi.SHA256	×
145	state:SNTRuleStateAllowTransitive	×
146	type:SNTRuleTypeBinary	×
147	customMsg:@""];	×
148
149	// Add the new rule to the rules database.
150	NSError *err;	×
151	if (![ruleTable addRules:@[ rule ] cleanSlate:NO error:&err]) {	×
152	LOGE(@"unable to add new transitive rule to database: %@", err.localizedDescription);	×
153	} else {	×
154	logger->LogAllowlist(esMsg, [fi.SHA256 UTF8String]);	×
155	}	×
156	}	×
157	}	×
158
159	[self removeFakeDecision:targetFile];	×
160	}	×
161
162	@end

google / santa / 3046537650

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous