3094771332

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/1dfa74bd489b59200862e01159c322b50371c5ab">1dfa74bd4">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/1dfa74bd489b59200862e01159c322b50371c5ab">1dfa74bd4</a><a href="https://github.com/google/santa/commit/1dfa74bd489b59200862e01159c322b50371c5ab">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/1dfa74bd489b59200862e01159c322b50371c5ab&quot;&gt;1dfa74bd4&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/1dfa74bd489b59200862e01159c322b50371c5ab&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/google/santa/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/google/santa/commit/&amp;amp;lt;a class=&amp;amp;quot;double-link&amp;amp;quot; href=&amp;amp;quot;https://git&amp;quot... (continued)

Pull Request Pull Request #888: ES and Logging Interfaces Redesign

Run Details

2443 of 5510 branches covered (44.34%)

Branch coverage included in aggregate %.

3932 of 3932 new or added lines in 64 files covered. (100.0%)

9486 of 14153 relevant lines covered (67.02%)

16191.88 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

87.7

/Source/santad/EventProviders/EndpointSecurity/Enricher.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"

#include <EndpointSecurity/ESTypes.h>
#include <bsm/libbsm.h>
#include <grp.h>
#include <pwd.h>
#include <sys/types.h>
#include <uuid/uuid.h>

#include <memory>
#include <optional>

#include "Source/common/SNTLogging.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"

namespace santa::santad::event_providers::endpoint_security {

Enricher::Enricher() : username_cache_(256), groupname_cache_(256) {}

std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
  // TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
  // (such as maybe the flyweight pattern)
  switch (es_msg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
      return std::make_shared<EnrichedMessage>(EnrichedClose(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.close.target)));
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
      return std::make_shared<EnrichedMessage>(EnrichedExchange(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exchangedata.file1),
        Enrich(*es_msg->event.exchangedata.file2)));
    case ES_EVENT_TYPE_NOTIFY_EXEC:
      return std::make_shared<EnrichedMessage>(EnrichedExec(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exec.target),
        (es_msg->version >= 2 && es_msg->event.exec.script)
          ? std::make_optional(Enrich(*es_msg->event.exec.script))
          : std::nullopt,
        (es_msg->version >= 3) ? std::make_optional(Enrich(*es_msg->event.exec.cwd))
                               : std::nullopt));
    case ES_EVENT_TYPE_NOTIFY_FORK:
      return std::make_shared<EnrichedMessage>(EnrichedFork(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.fork.child)));
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      return std::make_shared<EnrichedMessage>(
        EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_LINK:
      return std::make_shared<EnrichedMessage>(
        EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),
                     Enrich(*es_msg->event.link.source), Enrich(*es_msg->event.link.target_dir)));
    case ES_EVENT_TYPE_NOTIFY_RENAME: {
      if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {
        return std::make_shared<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));
      } else {
        return std::make_shared<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));
      }
    }
    case ES_EVENT_TYPE_NOTIFY_UNLINK:
      return std::make_shared<EnrichedMessage>(EnrichedUnlink(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.unlink.target)));
    default:
      // This is a programming error
      LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);
      exit(EXIT_FAILURE);
  }
}

EnrichedProcess Enricher::Enrich(const es_process_t &es_proc) {
  return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token)),
                         UsernameForGID(audit_token_to_egid(es_proc.audit_token)),
                         UsernameForUID(audit_token_to_ruid(es_proc.audit_token)),
                         UsernameForGID(audit_token_to_rgid(es_proc.audit_token)),
                         Enrich(*es_proc.executable));
}

EnrichedFile Enricher::Enrich(const es_file_t &es_file) {
  // TODO(mlw): Consider having the enricher perform file hashing. This will
  // make more sense if we start including hashes in more event types.
  return EnrichedFile(UsernameForUID(es_file.stat.st_uid), UsernameForGID(es_file.stat.st_gid),
                      std::nullopt);
}

std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid) {
  std::optional<std::shared_ptr<std::string>> username = username_cache_.get(uid);

  if (username.has_value()) {
    return username;
  } else {
    struct passwd *pw = getpwuid(uid);
    if (pw) {
      username = std::make_shared<std::string>(pw->pw_name);
    } else {
      username = std::nullopt;
    }

    username_cache_.set(uid, username);

    return username;
  }
}

std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid) {
  std::optional<std::shared_ptr<std::string>> groupname = groupname_cache_.get(gid);

  if (groupname.has_value()) {
    return groupname;
  } else {
    struct group *gr = getgrgid(gid);
    if (gr) {
      groupname = std::make_shared<std::string>(gr->gr_name);
    } else {
      groupname = std::nullopt;
    }

    groupname_cache_.set(gid, groupname);

    return groupname;
  }
}

}  // namespace santa::santad::event_providers::endpoint_security

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <bsm/libbsm.h>
19	#include <grp.h>
20	#include <pwd.h>
21	#include <sys/types.h>
22	#include <uuid/uuid.h>
23
24	#include <memory>
25	#include <optional>
26
27	#include "Source/common/SNTLogging.h"
28	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
29
30	namespace santa::santad::event_providers::endpoint_security {
31
32	Enricher::Enricher() : username_cache_(256), groupname_cache_(256) {}	24✔
33
34	std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {	8✔
35	// TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
36	// (such as maybe the flyweight pattern)
37	switch (es_msg->event_type) {	8✔
38	case ES_EVENT_TYPE_NOTIFY_CLOSE:	1✔
39	return std::make_shared<EnrichedMessage>(EnrichedClose(	1✔
40	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.close.target)));	1✔
41	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:	1✔
42	return std::make_shared<EnrichedMessage>(EnrichedExchange(	1✔
43	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exchangedata.file1),	1✔
44	Enrich(*es_msg->event.exchangedata.file2)));	1✔
45	case ES_EVENT_TYPE_NOTIFY_EXEC:	1✔
46	return std::make_shared<EnrichedMessage>(EnrichedExec(	1✔
47	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exec.target),	1✔
48	(es_msg->version >= 2 && es_msg->event.exec.script)	1!
49	? std::make_optional(Enrich(*es_msg->event.exec.script))	×
50	: std::nullopt,	1✔
51	(es_msg->version >= 3) ? std::make_optional(Enrich(*es_msg->event.exec.cwd))	×
52	: std::nullopt));	1✔
53	case ES_EVENT_TYPE_NOTIFY_FORK:	1✔
54	return std::make_shared<EnrichedMessage>(EnrichedFork(	1✔
55	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.fork.child)));	1✔
56	case ES_EVENT_TYPE_NOTIFY_EXIT:	1✔
57	return std::make_shared<EnrichedMessage>(	1✔
58	EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));	1✔
59	case ES_EVENT_TYPE_NOTIFY_LINK:	1✔
60	return std::make_shared<EnrichedMessage>(	1✔
61	EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),	1✔
62	Enrich(es_msg->event.link.source), Enrich(es_msg->event.link.target_dir)));	1✔
63	case ES_EVENT_TYPE_NOTIFY_RENAME: {	1✔
64	if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {	1!
65	return std::make_shared<EnrichedMessage>(EnrichedRename(	×
66	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	×
67	std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));	×
68	} else {	1✔
69	return std::make_shared<EnrichedMessage>(EnrichedRename(	1✔
70	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	1✔
71	Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));	1✔
72	}	1✔
73	}	×
74	case ES_EVENT_TYPE_NOTIFY_UNLINK:	1✔
75	return std::make_shared<EnrichedMessage>(EnrichedUnlink(	1✔
76	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.unlink.target)));	1✔
77	default:	×
78	// This is a programming error
79	LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);	×
80	exit(EXIT_FAILURE);	×
81	}	8✔
82	}	8✔
83
84	EnrichedProcess Enricher::Enrich(const es_process_t &es_proc) {	10✔
85	return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token)),	10✔
86	UsernameForGID(audit_token_to_egid(es_proc.audit_token)),	10✔
87	UsernameForUID(audit_token_to_ruid(es_proc.audit_token)),	10✔
88	UsernameForGID(audit_token_to_rgid(es_proc.audit_token)),	10✔
89	Enrich(*es_proc.executable));	10✔
90	}	10✔
91
92	EnrichedFile Enricher::Enrich(const es_file_t &es_file) {	18✔
93	// TODO(mlw): Consider having the enricher perform file hashing. This will
94	// make more sense if we start including hashes in more event types.
95	return EnrichedFile(UsernameForUID(es_file.stat.st_uid), UsernameForGID(es_file.stat.st_gid),	18✔
96	std::nullopt);	18✔
97	}	18✔
98
99	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid) {	40✔
100	std::optional<std::shared_ptr<std::string>> username = username_cache_.get(uid);	40✔
101
102	if (username.has_value()) {	40✔
103	return username;	22✔
104	} else {	18✔
105	struct passwd *pw = getpwuid(uid);	18✔
106	if (pw) {	18✔
107	username = std::make_shared<std::string>(pw->pw_name);	17✔
108	} else {	1✔
109	username = std::nullopt;	1✔
110	}	1✔
111
112	username_cache_.set(uid, username);	18✔
113
114	return username;	18✔
115	}	18✔
116	}	40✔
117
118	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid) {	40✔
119	std::optional<std::shared_ptr<std::string>> groupname = groupname_cache_.get(gid);	40✔
120
121	if (groupname.has_value()) {	40✔
122	return groupname;	22✔
123	} else {	18✔
124	struct group *gr = getgrgid(gid);	18✔
125	if (gr) {	18✔
126	groupname = std::make_shared<std::string>(gr->gr_name);	17✔
127	} else {	1✔
128	groupname = std::nullopt;	1✔
129	}	1✔
130
131	groupname_cache_.set(gid, groupname);	18✔
132
133	return groupname;	18✔
134	}	18✔
135	}	40✔
136
137	} // namespace santa::santad::event_providers::endpoint_security

google / santa / 3094771332

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous