3063612453

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/9f094d811b7027560cd5e2c39f6d574c37df3704">9f094d811">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/9f094d811b7027560cd5e2c39f6d574c37df3704">9f094d811</a><a href="https://github.com/google/santa/commit/9f094d811b7027560cd5e2c39f6d574c37df3704">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/9f094d811b7027560cd5e2c39f6d574c37df3704&quot;&gt;9f094d811&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/9f094d811b7027560cd5e2c39f6d574c37df3704&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2456 of 5508 branches covered (44.59%)

Branch coverage included in aggregate %.

3926 of 3926 new or added lines in 64 files covered. (100.0%)

9560 of 14148 relevant lines covered (67.57%)

15194.69 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

84.35

/Source/santad/EventProviders/SNTEndpointSecurityDeviceManagerTest.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import <DiskArbitration/DiskArbitration.h>
#include <EndpointSecurity/EndpointSecurity.h>
#import <OCMock/OCMock.h>
#import <XCTest/XCTest.h>
#import <bsm/libbsm.h>
#import <dispatch/dispatch.h>
#include <gmock/gmock.h>
#include <gtest/gtest.h>
#include <sys/mount.h>
#include "gmock/gmock.h"

#include <memory>
#include <set>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeviceEvent.h"
#include "Source/common/TestUtils.h"
#import "Source/santad/EventProviders/DiskArbitrationTestUtil.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/EventProviders/EndpointSecurity/MockEndpointSecurityAPI.h"
#import "Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.h"

using santa::santad::event_providers::endpoint_security::Message;

@interface SNTEndpointSecurityDeviceManager (Testing)
- (void)logDiskAppeared:(NSDictionary *)props;
@end

@interface SNTEndpointSecurityDeviceManagerTest : XCTestCase
@property id mockConfigurator;
@property MockDiskArbitration *mockDA;
@end

@implementation SNTEndpointSecurityDeviceManagerTest

- (void)setUp {
  [super setUp];

  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
  OCMStub([self.mockConfigurator eventLogType]).andReturn(-1);

  self.mockDA = [MockDiskArbitration mockDiskArbitration];
  [self.mockDA reset];

  fclose(stdout);
}

- (void)triggerTestMountEvent:(es_event_type_t)eventType
            //  mockDA:(MockDiskArbitration *)mockDA
            diskInfoOverrides:(NSDictionary *)diskInfo
           expectedAuthResult:(es_auth_result_t)expectedAuthResult
           deviceManagerSetup:(void (^)(SNTEndpointSecurityDeviceManager *))setupDMCallback {
  struct statfs fs = {0};
  NSString *test_mntfromname = @"/dev/disk2s1";
  NSString *test_mntonname = @"/Volumes/KATE'S 4G";

  strncpy(fs.f_mntfromname, [test_mntfromname UTF8String], sizeof(fs.f_mntfromname));
  strncpy(fs.f_mntonname, [test_mntonname UTF8String], sizeof(fs.f_mntonname));

  MockDADisk *disk = [[MockDADisk alloc] init];
  disk.diskDescription = @{
    (__bridge NSString *)kDADiskDescriptionDeviceProtocolKey : @"USB",
    (__bridge NSString *)kDADiskDescriptionMediaRemovableKey : @YES,
    @"DAVolumeMountable" : @YES,
    @"DAVolumePath" : test_mntonname,
    @"DADeviceModel" : @"Some device model",
    @"DADevicePath" : test_mntonname,
    @"DADeviceVendor" : @"Some vendor",
    @"DAAppearanceTime" : @0,
    @"DAMediaBSDName" : test_mntfromname,
  };

  if (diskInfo != nil) {
    NSMutableDictionary *mergedDiskDescription = [disk.diskDescription mutableCopy];
    for (NSString *key in diskInfo) {
      mergedDiskDescription[key] = diskInfo[key];
    }
    disk.diskDescription = (NSDictionary *)mergedDiskDescription;
  }

  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
  mockESApi->SetExpectationsESNewClient();

  SNTEndpointSecurityDeviceManager *deviceManager =
    [[SNTEndpointSecurityDeviceManager alloc] initWithESAPI:mockESApi
                                                     logger:nullptr
                                            authResultCache:nullptr];

  setupDMCallback(deviceManager);

  // Stub the log method since a mock `Logger` object isn't used.
  id partialDeviceManager = OCMPartialMock(deviceManager);
  OCMStub([partialDeviceManager logDiskAppeared:OCMOCK_ANY]);

  [self.mockDA insert:disk bsdName:test_mntfromname];

  es_file_t file = MakeESFile("foo");
  es_process_t proc = MakeESProcess(&file);
  es_message_t esMsg = MakeESMessage(eventType, &proc, ActionType::Auth, 6000);
  // Need a pointer to esMsg to capture in blocks below.
  es_message_t *heapESMsg = &esMsg;

  __block int retainCount = 0;
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  EXPECT_CALL(*mockESApi, ReleaseMessage).WillRepeatedly(^{
    if (retainCount == 0) {
      XCTFail(@"Under retain!");
    }
    retainCount--;
    if (retainCount == 0) {
      dispatch_semaphore_signal(sema);
    }
  });
  EXPECT_CALL(*mockESApi, RetainMessage).WillRepeatedly(^{
    retainCount++;
    return heapESMsg;
  });

  if (eventType == ES_EVENT_TYPE_AUTH_MOUNT) {
    esMsg.event.mount.statfs = &fs;
  } else if (eventType == ES_EVENT_TYPE_AUTH_REMOUNT) {
    esMsg.event.remount.statfs = &fs;
  } else {
    // Programming error. Fail the test.
    XCTFail(@"Unhandled event type in test: %d", eventType);
  }

  XCTestExpectation *mountExpectation =
    [self expectationWithDescription:@"Wait for response from ES"];

  EXPECT_CALL(*mockESApi, RespondAuthResult(testing::_, testing::_, expectedAuthResult, false))
    .WillOnce(testing::InvokeWithoutArgs(^bool {
      [mountExpectation fulfill];
      return true;
    }));

  [deviceManager handleMessage:Message(mockESApi, &esMsg)];

  [self waitForExpectations:@[ mountExpectation ] timeout:60.0];

  XCTAssertEqual(0,
                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC)),
                 "Failed waiting for message to be processed...");

  [partialDeviceManager stopMocking];
  XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
}

- (void)testUSBBlockDisabled {
  [self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT
            diskInfoOverrides:nil
           expectedAuthResult:ES_AUTH_RESULT_ALLOW
           deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {
             dm.blockUSBMount = NO;
           }];
}

- (void)testRemount {
  NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];

  XCTestExpectation *expectation =
    [self expectationWithDescription:
            @"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];

  __block NSString *gotmntonname, *gotmntfromname;
  __block NSArray<NSString *> *gotRemountedArgs;

  [self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT
            diskInfoOverrides:nil
           expectedAuthResult:ES_AUTH_RESULT_DENY
           deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {
             dm.blockUSBMount = YES;
             dm.remountArgs = wantRemountArgs;

             dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {
               gotRemountedArgs = event.remountArgs;
               gotmntonname = event.mntonname;
               gotmntfromname = event.mntfromname;
               [expectation fulfill];
             };
           }];

  XCTAssertEqual(self.mockDA.wasRemounted, YES);

  [self waitForExpectations:@[ expectation ] timeout:60.0];

  XCTAssertEqualObjects(gotRemountedArgs, wantRemountArgs);
  XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");
  XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");
}

- (void)testBlockNoRemount {
  XCTestExpectation *expectation =
    [self expectationWithDescription:
            @"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];

  __block NSString *gotmntonname, *gotmntfromname;
  __block NSArray<NSString *> *gotRemountedArgs;

  [self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT
            diskInfoOverrides:nil
           expectedAuthResult:ES_AUTH_RESULT_DENY
           deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {
             dm.blockUSBMount = YES;

             dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {
               gotRemountedArgs = event.remountArgs;
               gotmntonname = event.mntonname;
               gotmntfromname = event.mntfromname;
               [expectation fulfill];
             };
           }];

  [self waitForExpectations:@[ expectation ] timeout:60.0];

  XCTAssertNil(gotRemountedArgs);
  XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");
  XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");
}

- (void)testEnsureRemountsCannotChangePerms {
  NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];

  XCTestExpectation *expectation =
    [self expectationWithDescription:
            @"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];

  __block NSString *gotmntonname, *gotmntfromname;
  __block NSArray<NSString *> *gotRemountedArgs;

  [self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT
            diskInfoOverrides:nil
           expectedAuthResult:ES_AUTH_RESULT_DENY
           deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {
             dm.blockUSBMount = YES;
             dm.remountArgs = wantRemountArgs;

             dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {
               gotRemountedArgs = event.remountArgs;
               gotmntonname = event.mntonname;
               gotmntfromname = event.mntfromname;
               [expectation fulfill];
             };
           }];

  XCTAssertEqual(self.mockDA.wasRemounted, YES);

  [self waitForExpectations:@[ expectation ] timeout:10.0];

  XCTAssertEqualObjects(gotRemountedArgs, wantRemountArgs);
  XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");
  XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");
}

- (void)testEnsureDMGsDoNotPrompt {
  NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];
  NSDictionary *diskInfo = @{
    (__bridge NSString *)kDADiskDescriptionDeviceProtocolKey : @"Virtual Interface",
    (__bridge NSString *)kDADiskDescriptionDeviceModelKey : @"Disk Image",
    (__bridge NSString *)kDADiskDescriptionMediaNameKey : @"disk image",
  };

  [self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT
            diskInfoOverrides:diskInfo
           expectedAuthResult:ES_AUTH_RESULT_ALLOW
           deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {
             dm.blockUSBMount = YES;
             dm.remountArgs = wantRemountArgs;

             dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {
               XCTFail(@"Should not be called");
             };
           }];

  XCTAssertEqual(self.mockDA.wasRemounted, NO);
}

- (void)testEnable {
  // Ensure the client subscribes to expected event types
  std::set<es_event_type_t> expectedEventSubs{
    ES_EVENT_TYPE_AUTH_MOUNT,
    ES_EVENT_TYPE_AUTH_REMOUNT,
    ES_EVENT_TYPE_NOTIFY_UNMOUNT,
  };
  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();

  id deviceClient = [[SNTEndpointSecurityDeviceManager alloc] initWithESAPI:mockESApi];

  EXPECT_CALL(*mockESApi, ClearCache(testing::_))
    .After(EXPECT_CALL(*mockESApi, Subscribe(testing::_, expectedEventSubs))
             .WillOnce(testing::Return(true)))
    .WillOnce(testing::Return(true));

  [deviceClient enable];

  XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import <DiskArbitration/DiskArbitration.h>
16	#include <EndpointSecurity/EndpointSecurity.h>
17	#import <OCMock/OCMock.h>
18	#import <XCTest/XCTest.h>
19	#import <bsm/libbsm.h>
20	#import <dispatch/dispatch.h>
21	#include <gmock/gmock.h>
22	#include <gtest/gtest.h>
23	#include <sys/mount.h>
24	#include "gmock/gmock.h"
25
26	#include <memory>
27	#include <set>
28
29	#import "Source/common/SNTConfigurator.h"
30	#import "Source/common/SNTDeviceEvent.h"
31	#include "Source/common/TestUtils.h"
32	#import "Source/santad/EventProviders/DiskArbitrationTestUtil.h"
33	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
34	#include "Source/santad/EventProviders/EndpointSecurity/MockEndpointSecurityAPI.h"
35	#import "Source/santad/EventProviders/SNTEndpointSecurityDeviceManager.h"
36
37	using santa::santad::event_providers::endpoint_security::Message;
38
39	@interface SNTEndpointSecurityDeviceManager (Testing)
40	- (void)logDiskAppeared:(NSDictionary *)props;
41	@end
42
43	@interface SNTEndpointSecurityDeviceManagerTest : XCTestCase
44	@property id mockConfigurator;
45	@property MockDiskArbitration *mockDA;
46	@end
47
48	@implementation SNTEndpointSecurityDeviceManagerTest
49
50	- (void)setUp {	6✔
51	[super setUp];	6✔
52
53	self.mockConfigurator = OCMClassMock([SNTConfigurator class]);	6✔
54	OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);	6!
55	OCMStub([self.mockConfigurator eventLogType]).andReturn(-1);	6!
56
57	self.mockDA = [MockDiskArbitration mockDiskArbitration];	6✔
58	[self.mockDA reset];	6✔
59
60	fclose(stdout);	6✔
61	}	6✔
62
63	- (void)triggerTestMountEvent:(es_event_type_t)eventType
64	// mockDA:(MockDiskArbitration *)mockDA
65	diskInfoOverrides:(NSDictionary *)diskInfo
66	expectedAuthResult:(es_auth_result_t)expectedAuthResult
67	deviceManagerSetup:(void (^)(SNTEndpointSecurityDeviceManager *))setupDMCallback {	5✔
68	struct statfs fs = {0};	5✔
69	NSString *test_mntfromname = @"/dev/disk2s1";	5✔
70	NSString *test_mntonname = @"/Volumes/KATE'S 4G";	5✔
71
72	strncpy(fs.f_mntfromname, [test_mntfromname UTF8String], sizeof(fs.f_mntfromname));	5✔
73	strncpy(fs.f_mntonname, [test_mntonname UTF8String], sizeof(fs.f_mntonname));	5✔
74
75	MockDADisk *disk = [[MockDADisk alloc] init];	5✔
76	disk.diskDescription = @{	5✔
77	(__bridge NSString *)kDADiskDescriptionDeviceProtocolKey : @"USB",	5✔
78	(__bridge NSString *)kDADiskDescriptionMediaRemovableKey : @YES,	5✔
79	@"DAVolumeMountable" : @YES,	5✔
80	@"DAVolumePath" : test_mntonname,	5✔
81	@"DADeviceModel" : @"Some device model",	5✔
82	@"DADevicePath" : test_mntonname,	5✔
83	@"DADeviceVendor" : @"Some vendor",	5✔
84	@"DAAppearanceTime" : @0,	5✔
85	@"DAMediaBSDName" : test_mntfromname,	5✔
86	};	5✔
87
88	if (diskInfo != nil) {	5✔
89	NSMutableDictionary *mergedDiskDescription = [disk.diskDescription mutableCopy];	1✔
90	for (NSString *key in diskInfo) {	3✔
91	mergedDiskDescription[key] = diskInfo[key];	3✔
92	}	3✔
93	disk.diskDescription = (NSDictionary *)mergedDiskDescription;	1✔
94	}	1✔
95
96	auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();	5✔
97	mockESApi->SetExpectationsESNewClient();	5✔
98
99	SNTEndpointSecurityDeviceManager *deviceManager =	5✔
100	[[SNTEndpointSecurityDeviceManager alloc] initWithESAPI:mockESApi	5✔
101	logger:nullptr	5✔
102	authResultCache:nullptr];	5✔
103
104	setupDMCallback(deviceManager);	5✔
105
106	// Stub the log method since a mock `Logger` object isn't used.
107	id partialDeviceManager = OCMPartialMock(deviceManager);	5✔
108	OCMStub([partialDeviceManager logDiskAppeared:OCMOCK_ANY]);	5✔
109
110	[self.mockDA insert:disk bsdName:test_mntfromname];	5✔
111
112	es_file_t file = MakeESFile("foo");	5✔
113	es_process_t proc = MakeESProcess(&file);	5✔
114	es_message_t esMsg = MakeESMessage(eventType, &proc, ActionType::Auth, 6000);	5✔
115	// Need a pointer to esMsg to capture in blocks below.
116	es_message_t *heapESMsg = &esMsg;	5✔
117
118	__block int retainCount = 0;	5✔
119	dispatch_semaphore_t sema = dispatch_semaphore_create(0);	5✔
120	EXPECT_CALL(*mockESApi, ReleaseMessage).WillRepeatedly(^{	13✔
121	if (retainCount == 0) {	13!
122	XCTFail(@"Under retain!");	×
123	}	×
124	retainCount--;	13✔
125	if (retainCount == 0) {	13✔
126	dispatch_semaphore_signal(sema);	5✔
127	}	5✔
128	});	13✔
129	EXPECT_CALL(*mockESApi, RetainMessage).WillRepeatedly(^{	13✔
130	retainCount++;	13✔
131	return heapESMsg;	13✔
132	});	13✔
133
134	if (eventType == ES_EVENT_TYPE_AUTH_MOUNT) {	5!
135	esMsg.event.mount.statfs = &fs;	5✔
136	} else if (eventType == ES_EVENT_TYPE_AUTH_REMOUNT) {	×
137	esMsg.event.remount.statfs = &fs;	×
138	} else {	×
139	// Programming error. Fail the test.
140	XCTFail(@"Unhandled event type in test: %d", eventType);	×
141	}	×
142
143	XCTestExpectation *mountExpectation =	5✔
144	[self expectationWithDescription:@"Wait for response from ES"];	5✔
145
146	EXPECT_CALL(*mockESApi, RespondAuthResult(testing::_, testing::_, expectedAuthResult, false))	5✔
147	.WillOnce(testing::InvokeWithoutArgs(^bool {	5✔
148	[mountExpectation fulfill];	5✔
149	return true;	5✔
150	}));	5✔
151
152	[deviceManager handleMessage:Message(mockESApi, &esMsg)];	5✔
153
154	[self waitForExpectations:@[ mountExpectation ] timeout:60.0];	5✔
155
156	XCTAssertEqual(0,	5!
157	dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC)),	5✔
158	"Failed waiting for message to be processed...");	5✔
159
160	[partialDeviceManager stopMocking];	5✔
161	XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());	5!
162	}	5✔
163
164	- (void)testUSBBlockDisabled {	1✔
165	[self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT	1✔
166	diskInfoOverrides:nil	1✔
167	expectedAuthResult:ES_AUTH_RESULT_ALLOW	1✔
168	deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {	1✔
169	dm.blockUSBMount = NO;	1✔
170	}];	1✔
171	}	1✔
172
173	- (void)testRemount {	1✔
174	NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];	1✔
175
176	XCTestExpectation *expectation =	1✔
177	[self expectationWithDescription:	1✔
178	@"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];	1✔
179
180	__block NSString gotmntonname, gotmntfromname;	1✔
181	__block NSArray<NSString > gotRemountedArgs;	1✔
182
183	[self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT	1✔
184	diskInfoOverrides:nil	1✔
185	expectedAuthResult:ES_AUTH_RESULT_DENY	1✔
186	deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {	1✔
187	dm.blockUSBMount = YES;	1✔
188	dm.remountArgs = wantRemountArgs;	1✔
189
190	dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {	1✔
191	gotRemountedArgs = event.remountArgs;	1✔
192	gotmntonname = event.mntonname;	1✔
193	gotmntfromname = event.mntfromname;	1✔
194	[expectation fulfill];	1✔
195	};	1✔
196	}];	1✔
197
198	XCTAssertEqual(self.mockDA.wasRemounted, YES);	1!
199
200	[self waitForExpectations:@[ expectation ] timeout:60.0];	1✔
201
202	XCTAssertEqualObjects(gotRemountedArgs, wantRemountArgs);	1!
203	XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");	1!
204	XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");	1!
205	}	1✔
206
207	- (void)testBlockNoRemount {	1✔
208	XCTestExpectation *expectation =	1✔
209	[self expectationWithDescription:	1✔
210	@"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];	1✔
211
212	__block NSString gotmntonname, gotmntfromname;	1✔
213	__block NSArray<NSString > gotRemountedArgs;	1✔
214
215	[self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT	1✔
216	diskInfoOverrides:nil	1✔
217	expectedAuthResult:ES_AUTH_RESULT_DENY	1✔
218	deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {	1✔
219	dm.blockUSBMount = YES;	1✔
220
221	dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {	1✔
222	gotRemountedArgs = event.remountArgs;	1✔
223	gotmntonname = event.mntonname;	1✔
224	gotmntfromname = event.mntfromname;	1✔
225	[expectation fulfill];	1✔
226	};	1✔
227	}];	1✔
228
229	[self waitForExpectations:@[ expectation ] timeout:60.0];	1✔
230
231	XCTAssertNil(gotRemountedArgs);	1!
232	XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");	1!
233	XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");	1!
234	}	1✔
235
236	- (void)testEnsureRemountsCannotChangePerms {	1✔
237	NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];	1✔
238
239	XCTestExpectation *expectation =	1✔
240	[self expectationWithDescription:	1✔
241	@"Wait for SNTEndpointSecurityDeviceManager's blockCallback to trigger"];	1✔
242
243	__block NSString gotmntonname, gotmntfromname;	1✔
244	__block NSArray<NSString > gotRemountedArgs;	1✔
245
246	[self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT	1✔
247	diskInfoOverrides:nil	1✔
248	expectedAuthResult:ES_AUTH_RESULT_DENY	1✔
249	deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {	1✔
250	dm.blockUSBMount = YES;	1✔
251	dm.remountArgs = wantRemountArgs;	1✔
252
253	dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {	1✔
254	gotRemountedArgs = event.remountArgs;	1✔
255	gotmntonname = event.mntonname;	1✔
256	gotmntfromname = event.mntfromname;	1✔
257	[expectation fulfill];	1✔
258	};	1✔
259	}];	1✔
260
261	XCTAssertEqual(self.mockDA.wasRemounted, YES);	1!
262
263	[self waitForExpectations:@[ expectation ] timeout:10.0];	1✔
264
265	XCTAssertEqualObjects(gotRemountedArgs, wantRemountArgs);	1!
266	XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");	1!
267	XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");	1!
268	}	1✔
269
270	- (void)testEnsureDMGsDoNotPrompt {	1✔
271	NSArray *wantRemountArgs = @[ @"noexec", @"rdonly" ];	1✔
272	NSDictionary *diskInfo = @{	1✔
273	(__bridge NSString *)kDADiskDescriptionDeviceProtocolKey : @"Virtual Interface",	1✔
274	(__bridge NSString *)kDADiskDescriptionDeviceModelKey : @"Disk Image",	1✔
275	(__bridge NSString *)kDADiskDescriptionMediaNameKey : @"disk image",	1✔
276	};	1✔
277
278	[self triggerTestMountEvent:ES_EVENT_TYPE_AUTH_MOUNT	1✔
279	diskInfoOverrides:diskInfo	1✔
280	expectedAuthResult:ES_AUTH_RESULT_ALLOW	1✔
281	deviceManagerSetup:^(SNTEndpointSecurityDeviceManager *dm) {	1✔
282	dm.blockUSBMount = YES;	1✔
283	dm.remountArgs = wantRemountArgs;	1✔
284
285	dm.deviceBlockCallback = ^(SNTDeviceEvent *event) {	×
286	XCTFail(@"Should not be called");	×
287	};	×
288	}];	1✔
289
290	XCTAssertEqual(self.mockDA.wasRemounted, NO);	1!
291	}	1✔
292
293	- (void)testEnable {	1✔
294	// Ensure the client subscribes to expected event types
295	std::set<es_event_type_t> expectedEventSubs{	1✔
296	ES_EVENT_TYPE_AUTH_MOUNT,	1✔
297	ES_EVENT_TYPE_AUTH_REMOUNT,	1✔
298	ES_EVENT_TYPE_NOTIFY_UNMOUNT,	1✔
299	};	1✔
300	auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();	1✔
301
302	id deviceClient = [[SNTEndpointSecurityDeviceManager alloc] initWithESAPI:mockESApi];	1✔
303
304	EXPECT_CALL(*mockESApi, ClearCache(testing::_))	1✔
305	.After(EXPECT_CALL(*mockESApi, Subscribe(testing::_, expectedEventSubs))	1✔
306	.WillOnce(testing::Return(true)))	1✔
307	.WillOnce(testing::Return(true));	1✔
308
309	[deviceClient enable];	1✔
310
311	XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());	1!
312	}	1✔
313
314	@end

google / santa / 3063612453

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous