3049572161

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/1ce0526c46f1052ac8cb2bed2312d4ec87164c45">1ce0526c4">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/1ce0526c46f1052ac8cb2bed2312d4ec87164c45">1ce0526c4</a><a href="https://github.com/google/santa/commit/1ce0526c46f1052ac8cb2bed2312d4ec87164c45">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/1ce0526c46f1052ac8cb2bed2312d4ec87164c45&quot;&gt;1ce0526c4&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/1ce0526c46f1052ac8cb2bed2312d4ec87164c45&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2439 of 5498 branches covered (44.36%)

Branch coverage included in aggregate %.

3910 of 3910 new or added lines in 63 files covered. (100.0%)

9488 of 14135 relevant lines covered (67.12%)

16040.26 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

93.27

/Source/santad/EventProviders/SNTEndpointSecurityAuthorizer.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityAuthorizer.h"

#include <EndpointSecurity/ESTypes.h>
#include <os/base.h>
#include <stdlib.h>

#import "Source/common/SNTLogging.h"
#include "Source/santad/EventProviders/AuthResultCache.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"

using santa::santad::event_providers::AuthResultCache;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Message;

@interface SNTEndpointSecurityAuthorizer ()
@property SNTCompilerController *compilerController;
@property SNTExecutionController *execController;
@end

@implementation SNTEndpointSecurityAuthorizer {
  std::shared_ptr<AuthResultCache> _authResultCache;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
               execController:(SNTExecutionController *)execController
           compilerController:(SNTCompilerController *)compilerController
              authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache {
  self = [super initWithESAPI:std::move(esApi)];
  if (self) {
    _execController = execController;
    _compilerController = compilerController;
    _authResultCache = authResultCache;

    [self establishClientOrDie];
  }
  return self;
}

- (void)processMessage:(const Message &)msg {
  const es_file_t *targetFile = msg->event.exec.target->executable;

  while (true) {
    santa_action_t returnAction = self->_authResultCache->CheckCache(targetFile);
    if (RESPONSE_VALID(returnAction)) {
      es_auth_result_t authResult = ES_AUTH_RESULT_DENY;

      switch (returnAction) {
        case ACTION_RESPOND_ALLOW_COMPILER:
          [self.compilerController setProcess:msg->event.exec.target->audit_token isCompiler:true];
          OS_FALLTHROUGH;
        case ACTION_RESPOND_ALLOW: authResult = ES_AUTH_RESULT_ALLOW; break;
        default: break;
      }

      [self respondToMessage:msg
              withAuthResult:authResult
                   cacheable:(authResult == ES_AUTH_RESULT_ALLOW)];
      return;
    } else if (returnAction == ACTION_REQUEST_BINARY) {
      // TODO(mlw): Look into caching a `Deferred<value>` to better prevent
      // raciness of multiple threads checking the cache simultaneously.
      // Also mitigates need to poll.
      usleep(5000);
    } else {
      break;
    }
  }

  self->_authResultCache->AddToCache(targetFile, ACTION_REQUEST_BINARY);

  [self.execController validateExecEvent:msg
                              postAction:^bool(santa_action_t action) {
                                return [self postAction:action forMessage:msg];
                              }];
}

- (void)handleMessage:(Message &&)esMsg {
  if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {
    // This is a programming error
    LOGE(@"Atteempting to authorize a non-exec event");
    [NSException raise:@"Invalid event type"
                format:@"Authorizing unexpected event type: %d", esMsg->event_type];
  }

  if (![self.execController synchronousShouldProcessExecEvent:esMsg]) {
    [self postAction:ACTION_RESPOND_DENY forMessage:esMsg];
    return;
  }

  [self processMessage:std::move(esMsg)
               handler:^(const Message &msg) {
                 [self processMessage:msg];
               }];
}

- (bool)postAction:(santa_action_t)action forMessage:(const Message &)esMsg {
  es_auth_result_t authResult;

  switch (action) {
    case ACTION_RESPOND_ALLOW_COMPILER:
      [self.compilerController setProcess:esMsg->event.exec.target->audit_token isCompiler:true];
      OS_FALLTHROUGH;
    case ACTION_RESPOND_ALLOW: authResult = ES_AUTH_RESULT_ALLOW; break;
    case ACTION_RESPOND_DENY: authResult = ES_AUTH_RESULT_DENY; break;
    default:
      // This is a programming error. Bail.
      LOGE(@"Invalid action for postAction, exiting.");
      [NSException raise:@"Invalid post action" format:@"Invalid post action: %d", action];
  }

  self->_authResultCache->AddToCache(esMsg->event.exec.target->executable, action);

  // Don't let the ES framework cache DENY results. Santa only flushes ES cache
  // when a new DENY rule is received. If DENY results were cached and a rule
  // update made the executable allowable, ES would continue to apply the DENY
  // cached result. Note however that the local AuthResultCache will cache
  // DENY results.
  return [self respondToMessage:esMsg
                 withAuthResult:authResult
                      cacheable:(authResult == ES_AUTH_RESULT_ALLOW)];
}

- (void)enable {
  [super subscribeAndClearCache:{
                                  ES_EVENT_TYPE_AUTH_EXEC,
                                }];
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityAuthorizer.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <os/base.h>
19	#include <stdlib.h>
20
21	#import "Source/common/SNTLogging.h"
22	#include "Source/santad/EventProviders/AuthResultCache.h"
23	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
24	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
25
26	using santa::santad::event_providers::AuthResultCache;
27	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
28	using santa::santad::event_providers::endpoint_security::Message;
29
30	@interface SNTEndpointSecurityAuthorizer ()
31	@property SNTCompilerController *compilerController;
32	@property SNTExecutionController *execController;
33	@end
34
35	@implementation SNTEndpointSecurityAuthorizer {
36	std::shared_ptr<AuthResultCache> _authResultCache;
37	}
38
39	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
40	execController:(SNTExecutionController *)execController
41	compilerController:(SNTCompilerController *)compilerController
42	authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache {	17✔
43	self = [super initWithESAPI:std::move(esApi)];	17✔
44	if (self) {	17!
45	_execController = execController;	17✔
46	_compilerController = compilerController;	17✔
47	_authResultCache = authResultCache;	17✔
48
49	[self establishClientOrDie];	17✔
50	}	17✔
51	return self;	17✔
52	}	17✔
53
54	- (void)processMessage:(const Message &)msg {	16✔
55	const es_file_t *targetFile = msg->event.exec.target->executable;	16✔
56
57	while (true) {	18✔
58	santa_action_t returnAction = self->_authResultCache->CheckCache(targetFile);	18✔
59	if (RESPONSE_VALID(returnAction)) {	18!
60	es_auth_result_t authResult = ES_AUTH_RESULT_DENY;	1✔
61
62	switch (returnAction) {	1✔
63	case ACTION_RESPOND_ALLOW_COMPILER:	1!
64	[self.compilerController setProcess:msg->event.exec.target->audit_token isCompiler:true];	1✔
65	OS_FALLTHROUGH;	1✔
66	case ACTION_RESPOND_ALLOW: authResult = ES_AUTH_RESULT_ALLOW; break;	1!
67	default: break;	×
68	}	1✔
69
70	[self respondToMessage:msg	1✔
71	withAuthResult:authResult	1✔
72	cacheable:(authResult == ES_AUTH_RESULT_ALLOW)];	1✔
73	return;	1✔
74	} else if (returnAction == ACTION_REQUEST_BINARY) {	17✔
75	// TODO(mlw): Look into caching a `Deferred<value>` to better prevent
76	// raciness of multiple threads checking the cache simultaneously.
77	// Also mitigates need to poll.
78	usleep(5000);	2✔
79	} else {	15✔
80	break;	15✔
81	}	15✔
82	}	18✔
83
84	self->_authResultCache->AddToCache(targetFile, ACTION_REQUEST_BINARY);	15✔
85
86	[self.execController validateExecEvent:msg	15✔
87	postAction:^bool(santa_action_t action) {	14✔
88	return [self postAction:action forMessage:msg];	14✔
89	}];	14✔
90	}	15✔
91
92	- (void)handleMessage:(Message &&)esMsg {	17✔
93	if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {	17✔
94	// This is a programming error
95	LOGE(@"Atteempting to authorize a non-exec event");	1✔
96	[NSException raise:@"Invalid event type"	1✔
97	format:@"Authorizing unexpected event type: %d", esMsg->event_type];	1✔
98	}	1✔
99
100	if (![self.execController synchronousShouldProcessExecEvent:esMsg]) {	17✔
101	[self postAction:ACTION_RESPOND_DENY forMessage:esMsg];	1✔
102	return;	1✔
103	}	1✔
104
105	[self processMessage:std::move(esMsg)	16✔
106	handler:^(const Message &msg) {	14✔
107	[self processMessage:msg];	14✔
108	}];	14✔
109	}	16✔
110
111	- (bool)postAction:(santa_action_t)action forMessage:(const Message &)esMsg {	18✔
112	es_auth_result_t authResult;	18✔
113
114	switch (action) {	18✔
115	case ACTION_RESPOND_ALLOW_COMPILER:	1✔
116	[self.compilerController setProcess:esMsg->event.exec.target->audit_token isCompiler:true];	1✔
117	OS_FALLTHROUGH;	1✔
118	case ACTION_RESPOND_ALLOW: authResult = ES_AUTH_RESULT_ALLOW; break;	9✔
119	case ACTION_RESPOND_DENY: authResult = ES_AUTH_RESULT_DENY; break;	8✔
120	default:	1✔
121	// This is a programming error. Bail.
122	LOGE(@"Invalid action for postAction, exiting.");	1✔
123	[NSException raise:@"Invalid post action" format:@"Invalid post action: %d", action];	1✔
124	}	18✔
125
126	self->_authResultCache->AddToCache(esMsg->event.exec.target->executable, action);	17✔
127
128	// Don't let the ES framework cache DENY results. Santa only flushes ES cache
129	// when a new DENY rule is received. If DENY results were cached and a rule
130	// update made the executable allowable, ES would continue to apply the DENY
131	// cached result. Note however that the local AuthResultCache will cache
132	// DENY results.
133	return [self respondToMessage:esMsg	17✔
134	withAuthResult:authResult	17✔
135	cacheable:(authResult == ES_AUTH_RESULT_ALLOW)];	17✔
136	}	18✔
137
138	- (void)enable {	1✔
139	[super subscribeAndClearCache:{	1✔
140	ES_EVENT_TYPE_AUTH_EXEC,	1✔
141	}];	1✔
142	}	1✔
143
144	@end

google / santa / 3049572161

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous