3046575710

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/23a6972764bc7fd56211aa5669e9cd9534337294">23a697276">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/23a6972764bc7fd56211aa5669e9cd9534337294">23a697276</a><a href="https://github.com/google/santa/commit/23a6972764bc7fd56211aa5669e9cd9534337294">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/23a6972764bc7fd56211aa5669e9cd9534337294&quot;&gt;23a697276&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/23a6972764bc7fd56211aa5669e9cd9534337294&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2408 of 5130 branches covered (46.94%)

Branch coverage included in aggregate %.

3917 of 3917 new or added lines in 62 files covered. (100.0%)

9315 of 12981 relevant lines covered (71.76%)

17430.57 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

86.18

/Source/santad/EventProviders/EndpointSecurity/Enricher.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"

#include <EndpointSecurity/ESTypes.h>
#include <bsm/libbsm.h>
#include <grp.h>
#include <pwd.h>
#include <sys/types.h>
#include <uuid/uuid.h>

#include <memory>
#include <optional>

#include "Source/common/SNTLogging.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"

using LRUCache = tstarling::ThreadSafeLRUCache<uid_t, std::optional<std::shared_ptr<std::string>>>;

namespace santa::santad::event_providers::endpoint_security {

std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
  switch (es_msg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
      return std::make_shared<EnrichedMessage>(EnrichedClose(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.close.target)));
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
      return std::make_shared<EnrichedMessage>(EnrichedExchange(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exchangedata.file1),
        Enrich(*es_msg->event.exchangedata.file2)));
    case ES_EVENT_TYPE_NOTIFY_EXEC:
      return std::make_shared<EnrichedMessage>(EnrichedExec(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exec.target),
        (es_msg->version >= 2 && es_msg->event.exec.script)
          ? std::make_optional(Enrich(*es_msg->event.exec.script))
          : std::nullopt,
        (es_msg->version >= 3) ? std::make_optional(Enrich(*es_msg->event.exec.cwd))
                               : std::nullopt));
    case ES_EVENT_TYPE_NOTIFY_FORK:
      return std::make_shared<EnrichedMessage>(EnrichedFork(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.fork.child)));
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      return std::make_shared<EnrichedMessage>(
        EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_LINK:
      return std::make_shared<EnrichedMessage>(
        EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),
                     Enrich(*es_msg->event.link.source), Enrich(*es_msg->event.link.target_dir)));
    case ES_EVENT_TYPE_NOTIFY_RENAME: {
      if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {
        return std::make_shared<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));
      } else {
        return std::make_shared<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));
      }
    }
    case ES_EVENT_TYPE_NOTIFY_UNLINK:
      return std::make_shared<EnrichedMessage>(EnrichedUnlink(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.unlink.target)));
    default:
      // This is a programming error
      LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);
      exit(EXIT_FAILURE);
  }
}

EnrichedProcess Enricher::Enrich(const es_process_t &es_proc) {
  return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token)),
                         UsernameForGID(audit_token_to_egid(es_proc.audit_token)),
                         UsernameForUID(audit_token_to_ruid(es_proc.audit_token)),
                         UsernameForGID(audit_token_to_rgid(es_proc.audit_token)),
                         Enrich(*es_proc.executable));
}

EnrichedFile Enricher::Enrich(const es_file_t &es_file) {
  // TODO(mlw): Consider having the enricher perform file hashing. This will
  // make more sense if we start including hashes in more event types.
  return EnrichedFile(UsernameForUID(es_file.stat.st_uid), UsernameForGID(es_file.stat.st_gid),
                      std::nullopt);
}

std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid) {
  LRUCache::ConstAccessor val;
  if (username_cache_.find(val, uid)) {
    return *val;
  } else {
    std::optional<std::shared_ptr<std::string>> username;

    struct passwd *pw = getpwuid(uid);
    if (pw) {
      username = std::make_shared<std::string>(pw->pw_name);
    } else {
      username = std::nullopt;
    }

    username_cache_.insert(uid, username);

    return username;
  }
}
std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid) {
  LRUCache::ConstAccessor val;
  if (groupname_cache_.find(val, gid)) {
    return *val;
  } else {
    std::optional<std::shared_ptr<std::string>> groupname;

    struct group *gr = getgrgid(gid);
    if (gr) {
      groupname = std::make_shared<std::string>(gr->gr_name);
    } else {
      groupname = std::nullopt;
    }

    username_cache_.insert(gid, groupname);

    return groupname;
  }
}

}  // namespace santa::santad::event_providers::endpoint_security

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <bsm/libbsm.h>
19	#include <grp.h>
20	#include <pwd.h>
21	#include <sys/types.h>
22	#include <uuid/uuid.h>
23
24	#include <memory>
25	#include <optional>
26
27	#include "Source/common/SNTLogging.h"
28	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
29
30	using LRUCache = tstarling::ThreadSafeLRUCache<uid_t, std::optional<std::shared_ptr<std::string>>>;
31
32	namespace santa::santad::event_providers::endpoint_security {
33
34	std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {	8✔
35	switch (es_msg->event_type) {	8✔
36	case ES_EVENT_TYPE_NOTIFY_CLOSE:	1✔
37	return std::make_shared<EnrichedMessage>(EnrichedClose(	1✔
38	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.close.target)));	1✔
39	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:	1✔
40	return std::make_shared<EnrichedMessage>(EnrichedExchange(	1✔
41	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exchangedata.file1),	1✔
42	Enrich(*es_msg->event.exchangedata.file2)));	1✔
43	case ES_EVENT_TYPE_NOTIFY_EXEC:	1✔
44	return std::make_shared<EnrichedMessage>(EnrichedExec(	1✔
45	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exec.target),	1✔
46	(es_msg->version >= 2 && es_msg->event.exec.script)	1!
47	? std::make_optional(Enrich(*es_msg->event.exec.script))	×
48	: std::nullopt,	1✔
49	(es_msg->version >= 3) ? std::make_optional(Enrich(*es_msg->event.exec.cwd))	×
50	: std::nullopt));	1✔
51	case ES_EVENT_TYPE_NOTIFY_FORK:	1✔
52	return std::make_shared<EnrichedMessage>(EnrichedFork(	1✔
53	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.fork.child)));	1✔
54	case ES_EVENT_TYPE_NOTIFY_EXIT:	1✔
55	return std::make_shared<EnrichedMessage>(	1✔
56	EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));	1✔
57	case ES_EVENT_TYPE_NOTIFY_LINK:	1✔
58	return std::make_shared<EnrichedMessage>(	1✔
59	EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),	1✔
60	Enrich(es_msg->event.link.source), Enrich(es_msg->event.link.target_dir)));	1✔
61	case ES_EVENT_TYPE_NOTIFY_RENAME: {	1✔
62	if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {	1!
63	return std::make_shared<EnrichedMessage>(EnrichedRename(	×
64	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	×
65	std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));	×
66	} else {	1✔
67	return std::make_shared<EnrichedMessage>(EnrichedRename(	1✔
68	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	1✔
69	Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));	1✔
70	}	1✔
71	}	×
72	case ES_EVENT_TYPE_NOTIFY_UNLINK:	1✔
73	return std::make_shared<EnrichedMessage>(EnrichedUnlink(	1✔
74	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.unlink.target)));	1✔
75	default:	×
76	// This is a programming error
77	LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);	×
78	exit(EXIT_FAILURE);	×
79	}	8✔
80	}	8✔
81
82	EnrichedProcess Enricher::Enrich(const es_process_t &es_proc) {	10✔
83	return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token)),	10✔
84	UsernameForGID(audit_token_to_egid(es_proc.audit_token)),	10✔
85	UsernameForUID(audit_token_to_ruid(es_proc.audit_token)),	10✔
86	UsernameForGID(audit_token_to_rgid(es_proc.audit_token)),	10✔
87	Enrich(*es_proc.executable));	10✔
88	}	10✔
89
90	EnrichedFile Enricher::Enrich(const es_file_t &es_file) {	18✔
91	// TODO(mlw): Consider having the enricher perform file hashing. This will
92	// make more sense if we start including hashes in more event types.
93	return EnrichedFile(UsernameForUID(es_file.stat.st_uid), UsernameForGID(es_file.stat.st_gid),	18✔
94	std::nullopt);	18✔
95	}	18✔
96
97	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid) {	40✔
98	LRUCache::ConstAccessor val;	40✔
99	if (username_cache_.find(val, uid)) {	40✔
100	return *val;	22✔
101	} else {	18✔
102	std::optional<std::shared_ptr<std::string>> username;	18✔
103
104	struct passwd *pw = getpwuid(uid);	18✔
105	if (pw) {	18✔
106	username = std::make_shared<std::string>(pw->pw_name);	17✔
107	} else {	1✔
108	username = std::nullopt;	1✔
109	}	1✔
110
111	username_cache_.insert(uid, username);	18✔
112
113	return username;	18✔
114	}	18✔
115	}	40✔
116	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid) {	40✔
117	LRUCache::ConstAccessor val;	40✔
118	if (groupname_cache_.find(val, gid)) {	40!
119	return *val;	×
120	} else {	40✔
121	std::optional<std::shared_ptr<std::string>> groupname;	40✔
122
123	struct group *gr = getgrgid(gid);	40✔
124	if (gr) {	40✔
125	groupname = std::make_shared<std::string>(gr->gr_name);	39✔
126	} else {	1✔
127	groupname = std::nullopt;	1✔
128	}	1✔
129
130	username_cache_.insert(gid, groupname);	40✔
131
132	return groupname;	40✔
133	}	40✔
134	}	40✔
135
136	} // namespace santa::santad::event_providers::endpoint_security

google / santa / 3046575710

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous