3094337212

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/8ca108e3b494a91811d7bbb889a62cd48cd9acf0">8ca108e3b">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/8ca108e3b494a91811d7bbb889a62cd48cd9acf0">8ca108e3b</a><a href="https://github.com/google/santa/commit/8ca108e3b494a91811d7bbb889a62cd48cd9acf0">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/8ca108e3b494a91811d7bbb889a62cd48cd9acf0&quot;&gt;8ca108e3b&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/8ca108e3b494a91811d7bbb889a62cd48cd9acf0&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2420 of 5508 branches covered (43.94%)

Branch coverage included in aggregate %.

3924 of 3924 new or added lines in 64 files covered. (100.0%)

9400 of 14146 relevant lines covered (66.45%)

17826.41 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

97.47

/Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.h"

#include <EndpointSecurity/ESTypes.h>
#include <string.h>

#import "Source/common/SNTLogging.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"

using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-driver";

@implementation SNTEndpointSecurityTamperResistance {
  std::shared_ptr<Logger> _logger;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                       logger:(std::shared_ptr<Logger>)logger {
  self = [super initWithESAPI:std::move(esApi)];
  if (self) {
    _logger = logger;

    [self establishClientOrDie];
  }
  return self;
}

- (void)handleMessage:(Message &&)esMsg {
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_AUTH_UNLINK: {
      if ([SNTEndpointSecurityTamperResistance
            isDatabasePath:esMsg->event.unlink.target->path.data]) {
        // Do not cache so that each attempt to remove santa is logged
        [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];
        LOGW(@"Preventing attempt to delete Santa databases!");
      } else {
        [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
      }

      return;
    }

    case ES_EVENT_TYPE_AUTH_RENAME: {
      if ([SNTEndpointSecurityTamperResistance
            isDatabasePath:esMsg->event.rename.source->path.data]) {
        // Do not cache so that each attempt to remove santa is logged
        [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];
        LOGW(@"Preventing attempt to rename Santa databases!");
        return;
      }

      if (esMsg->event.rename.destination_type == ES_DESTINATION_TYPE_EXISTING_FILE) {
        if ([SNTEndpointSecurityTamperResistance
              isDatabasePath:esMsg->event.rename.destination.existing_file->path.data]) {
          [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];
          LOGW(@"Preventing attempt to overwrite Santa databases!");
          return;
        }
      }

      // If we get to here, no more reasons to deny the event, so allow it
      [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
      return;
    }

    case ES_EVENT_TYPE_AUTH_KEXTLOAD: {
      es_auth_result_t res = ES_AUTH_RESULT_ALLOW;
      if (strcmp(esMsg->event.kextload.identifier.data, kSantaKextIdentifier.data()) == 0) {
        LOGW(@"Preventing attempt to load Santa kext!");
        res = ES_AUTH_RESULT_DENY;
      }
      [self respondToMessage:esMsg withAuthResult:res cacheable:true];
      return;
    }

    default:
      // Unexpected event type, this is a programming error
      [NSException raise:@"Invalid event type"
                  format:@"Invalid tamper resistance event type: %d", esMsg->event_type];
  }
}

- (void)enable {
  // TODO(mlw): For macOS 13, use new mute and invert APIs to limit the
  // messages sent for these events to the Santa-specific directories
  // checked in the `handleMessage:` method.

  [super subscribeAndClearCache:{
                                  ES_EVENT_TYPE_AUTH_KEXTLOAD,
                                  ES_EVENT_TYPE_AUTH_UNLINK,
                                  ES_EVENT_TYPE_AUTH_RENAME,
                                }];
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <string.h>
19
20	#import "Source/common/SNTLogging.h"
21	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
22
23	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
24	using santa::santad::event_providers::endpoint_security::Message;
25	using santa::santad::logs::endpoint_security::Logger;
26
27	static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-driver";
28
29	@implementation SNTEndpointSecurityTamperResistance {
30	std::shared_ptr<Logger> _logger;
31	}
32
33	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
34	logger:(std::shared_ptr<Logger>)logger {	2✔
35	self = [super initWithESAPI:std::move(esApi)];	2✔
36	if (self) {	2!
37	_logger = logger;	2✔
38
39	[self establishClientOrDie];	2✔
40	}	2✔
41	return self;	2✔
42	}	2✔
43
44	- (void)handleMessage:(Message &&)esMsg {	12✔
45	switch (esMsg->event_type) {	12✔
46	case ES_EVENT_TYPE_AUTH_UNLINK: {	3✔
47	if ([SNTEndpointSecurityTamperResistance	3✔
48	isDatabasePath:esMsg->event.unlink.target->path.data]) {	2✔
49	// Do not cache so that each attempt to remove santa is logged
50	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];	2✔
51	LOGW(@"Preventing attempt to delete Santa databases!");	2✔
52	} else {	1✔
53	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	1✔
54	}	1✔
55
56	return;	3✔
57	}	×
58
59	case ES_EVENT_TYPE_AUTH_RENAME: {	6✔
60	if ([SNTEndpointSecurityTamperResistance	6✔
61	isDatabasePath:esMsg->event.rename.source->path.data]) {	2✔
62	// Do not cache so that each attempt to remove santa is logged
63	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];	2✔
64	LOGW(@"Preventing attempt to rename Santa databases!");	2✔
65	return;	2✔
66	}	2✔
67
68	if (esMsg->event.rename.destination_type == ES_DESTINATION_TYPE_EXISTING_FILE) {	4✔
69	if ([SNTEndpointSecurityTamperResistance	3✔
70	isDatabasePath:esMsg->event.rename.destination.existing_file->path.data]) {	2✔
71	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_DENY cacheable:false];	2✔
72	LOGW(@"Preventing attempt to overwrite Santa databases!");	2✔
73	return;	2✔
74	}	2✔
75	}	2✔
76
77	// If we get to here, no more reasons to deny the event, so allow it
78	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	2✔
79	return;	2✔
80	}	2✔
81
82	case ES_EVENT_TYPE_AUTH_KEXTLOAD: {	2✔
83	es_auth_result_t res = ES_AUTH_RESULT_ALLOW;	2✔
84	if (strcmp(esMsg->event.kextload.identifier.data, kSantaKextIdentifier.data()) == 0) {	2✔
85	LOGW(@"Preventing attempt to load Santa kext!");	1✔
86	res = ES_AUTH_RESULT_DENY;	1✔
87	}	1✔
88	[self respondToMessage:esMsg withAuthResult:res cacheable:true];	2✔
89	return;	2✔
90	}	2✔
91
92	default:	1✔
93	// Unexpected event type, this is a programming error
94	[NSException raise:@"Invalid event type"	1✔
95	format:@"Invalid tamper resistance event type: %d", esMsg->event_type];	1✔
96	}	12✔
97	}	12✔
98
99	- (void)enable {	1✔
100	// TODO(mlw): For macOS 13, use new mute and invert APIs to limit the
101	// messages sent for these events to the Santa-specific directories
102	// checked in the `handleMessage:` method.
103
104	[super subscribeAndClearCache:{	1✔
105	ES_EVENT_TYPE_AUTH_KEXTLOAD,	1✔
106	ES_EVENT_TYPE_AUTH_UNLINK,	1✔
107	ES_EVENT_TYPE_AUTH_RENAME,	1✔
108	}];	1✔
109	}	1✔
110
111	@end

google / santa / 3094337212

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous