3737315758

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/google/santa/commit/<a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/<a class="double-link" href="https://git"><a class=hub.com/google/santa/commit/4bf654b103a1da70d82c4ef154132721b75b20e3">4bf654b10">&lt;a href=&quot;https://github.com/google/santa/commit/</a><a class="double-link" href="https://github.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/google/santa/commit/4bf654b103a1da70d82c4ef154132721b75b20e3">4bf654b10</a><a href="https://github.com/google/santa/commit/4bf654b103a1da70d82c4ef154132721b75b20e3">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/google/santa/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/google/santa/commit/4bf654b103a1da70d82c4ef154132721b75b20e3&quot;&gt;4bf654b10&lt;/a&gt;&lt;a href=&quot;https://github.com/google/santa/commit/4bf654b103a1da70d82c4ef154132721b75b20e3&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.c... (continued)

Pull Request Pull Request #975: Adopt new ES APIs to monitor target paths

Run Details

3443 of 7154 branches covered (48.13%)

Branch coverage included in aggregate %.

188 of 188 new or added lines in 7 files covered. (100.0%)

12633 of 17891 relevant lines covered (70.61%)

16264.52 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

42.41

/Source/santad/EventProviders/SNTEndpointSecurityClient.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"

#include <EndpointSecurity/EndpointSecurity.h>
#include <bsm/libbsm.h>
#include <dispatch/dispatch.h>
#include <mach/mach_time.h>
#include <stdlib.h>
#include <sys/qos.h>

#include "Source/common/BranchPrediction.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/SystemResources.h"
#include "Source/santad/DataLayer/WatchItemPolicy.h"
#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventDisposition;
using santa::santad::Metrics;
using santa::santad::Processor;
using santa::santad::data_layer::WatchItemPathType;
using santa::santad::event_providers::endpoint_security::Client;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Message;

@interface SNTEndpointSecurityClient ()
@property int64_t deadlineMarginMS;
@end

@implementation SNTEndpointSecurityClient {
  std::shared_ptr<EndpointSecurityAPI> _esApi;
  std::shared_ptr<Metrics> _metrics;
  Client _esClient;
  dispatch_queue_t _authQueue;
  dispatch_queue_t _notifyQueue;
  Processor _processor;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<Metrics>)metrics
                    processor:(Processor)processor {
  self = [super init];
  if (self) {
    _esApi = std::move(esApi);
    _metrics = std::move(metrics);
    _deadlineMarginMS = 5000;
    _processor = processor;

    _authQueue = dispatch_queue_create(
      "com.google.santa.daemon.auth_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_USER_INTERACTIVE, 0));

    _notifyQueue = dispatch_queue_create(
      "com.google.santa.daemon.notify_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_BACKGROUND, 0));
  }
  return self;
}

- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {
  switch (result) {
    case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";
    case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";
    case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";
    case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";
    default: return @"Unknown error";
  }
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {
  // This method should only be used by classes derived
  // from SNTEndpointSecurityClient.
  [self doesNotRecognizeSelector:_cmd];
}

- (BOOL)shouldHandleMessage:(const Message &)esMsg
     ignoringOtherESClients:(BOOL)ignoringOtherESClients {
  if (esMsg->process->is_es_client && ignoringOtherESClients) {
    if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {
      [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
    }
    return NO;
  }

  return YES;
}

- (void)establishClientOrDie {
  if (self->_esClient.IsConnected()) {
    // This is a programming error
    LOGE(@"Client already established. Aborting.");
    [NSException raise:@"Client already established" format:@"IsConnected already true"];
  }

  self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {
    int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);
    es_event_type_t eventType = esMsg->event_type;
    if ([self shouldHandleMessage:esMsg
           ignoringOtherESClients:[[SNTConfigurator configurator]
                                    ignoreOtherEndpointSecurityClients]]) {
      [self handleMessage:std::move(esMsg)
        recordEventMetrics:^(EventDisposition disposition) {
          int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
          self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,
                                          processingEnd - processingStart);
        }];
    } else {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,
                                      processingEnd - processingStart);
    }
  });

  if (!self->_esClient.IsConnected()) {
    NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];
    LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);
    [NSException raise:@"Failed to create ES client" format:@"%@", errMsg];
  } else {
    LOGI(@"Connected to EndpointSecurity (%@)", self);
  }

  if (![self muteSelf]) {
    [NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];
  }
}

+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {
  mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;
  if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {
    LOGE(@"Failed to fetch this client's audit token.");
    return false;
  }

  return true;
}

- (bool)muteSelf {
  audit_token_t myAuditToken;
  if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {
    return false;
  }

  if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {
    LOGE(@"Failed to mute this client's process.");
    return false;
  }

  return true;
}

- (bool)clearCache {
  return _esApi->ClearCache(self->_esClient);
}

- (bool)subscribe:(const std::set<es_event_type_t> &)events {
  return _esApi->Subscribe(_esClient, events);
}

- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {
  return [self subscribe:events] && [self clearCache];
}

- (bool)unsubscribeAll {
  return _esApi->UnsubscribeAll(_esClient);
}

- (bool)unmuteEverything {
  bool result = _esApi->UnmuteAllPaths(_esClient);
  result = _esApi->UnmuteAllTargetPaths(_esClient) && result;
  return result;
}

- (bool)enableTargetPathWatching {
  return _esApi->InvertTargetPathMuting(_esClient);
}

- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)respondToMessage:(const Message &)msg
          withAuthResult:(es_auth_result_t)result
               cacheable:(bool)cacheable {
  if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {
    return _esApi->RespondFlagsResult(
      // For now, Santa is only concerned about alllowing all access or no
      // access, hence the flags being translated here to all or nothing based
      // on the auth result. In the future it might be beneficial to expand the
      // scope of Santa to enforce things like read-only access.
      _esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);
  } else {
    return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);
  }
}

- (void)processEnrichedMessage:(std::shared_ptr<EnrichedMessage>)msg
                       handler:(void (^)(std::shared_ptr<EnrichedMessage>))messageHandler {
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msg));
  });
}

- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {
  __block Message msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {
  if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {
    // This is a programming error
    LOGE(@"Attempting to process non-AUTH message");
    [NSException raise:@"Attempt to process non-auth message"
                format:@"Unexpected event type received: %d", msg->event_type];
  }

  dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);
  // Add 1 to the processing semaphore. We're not creating it with a starting
  // value of 1 because that requires that the semaphore is not deallocated
  // until its value matches the starting value, which we don't need.
  dispatch_semaphore_signal(processingSema);
  dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);

  const uint64_t timeout = NSEC_PER_MSEC * (self.deadlineMarginMS);

  uint64_t deadlineNano = MachTimeToNanos(msg->deadline - mach_absolute_time());

  // TODO(mlw): How should we handle `deadlineNano <= timeout`. Will currently
  // result in the deadline block being dispatched immediately (and therefore
  // the event will be denied).

  // Workaround for compiler bug that doesn't properly close over variables
  __block Message processMsg = msg;
  __block Message deadlineMsg = msg;

  dispatch_after(
    dispatch_time(DISPATCH_TIME_NOW, deadlineNano - timeout), self->_authQueue, ^(void) {
      if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
        // Handler has already responded, nothing to do.
        return;
      }

      bool res = [self respondToMessage:deadlineMsg
                         withAuthResult:ES_AUTH_RESULT_DENY
                              cacheable:false];

      LOGE(@"SNTEndpointSecurityClient: deadline reached: deny pid=%d, event type: %d ret=%d",
           audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type, res);
      dispatch_semaphore_signal(deadlineExpiredSema);
    });

  dispatch_async(self->_authQueue, ^{
    messageHandler(processMsg);
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Deadline expired, wait for deadline block to finish.
      dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);
    }
  });
}

+ (bool)isDatabasePath:(const std::string_view)path {
  // TODO(mlw): These values should come from `SNTDatabaseController`. But right
  // now they live as NSStrings. We should make them `std::string_view` types
  // in order to use them here efficiently, but will need to make the
  // `SNTDatabaseController` an ObjC++ file.
  return (path == "/private/var/db/santa/rules.db" || path == "/private/var/db/santa/events.db");
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18	#include <bsm/libbsm.h>
19	#include <dispatch/dispatch.h>
20	#include <mach/mach_time.h>
21	#include <stdlib.h>
22	#include <sys/qos.h>
23
24	#include "Source/common/BranchPrediction.h"
25	#import "Source/common/SNTConfigurator.h"
26	#import "Source/common/SNTLogging.h"
27	#include "Source/common/SystemResources.h"
28	#include "Source/santad/DataLayer/WatchItemPolicy.h"
29	#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
30	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
31	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
32	#include "Source/santad/Metrics.h"
33
34	using santa::santad::EventDisposition;
35	using santa::santad::Metrics;
36	using santa::santad::Processor;
37	using santa::santad::data_layer::WatchItemPathType;
38	using santa::santad::event_providers::endpoint_security::Client;
39	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
40	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
41	using santa::santad::event_providers::endpoint_security::Message;
42
43	@interface SNTEndpointSecurityClient ()
44	@property int64_t deadlineMarginMS;
45	@end
46
47	@implementation SNTEndpointSecurityClient {
48	std::shared_ptr<EndpointSecurityAPI> _esApi;
49	std::shared_ptr<Metrics> _metrics;
50	Client _esClient;
51	dispatch_queue_t _authQueue;
52	dispatch_queue_t _notifyQueue;
53	Processor _processor;
54	}
55
56	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
57	metrics:(std::shared_ptr<Metrics>)metrics
58	processor:(Processor)processor {	34✔
59	self = [super init];	34✔
60	if (self) {	34!
61	_esApi = std::move(esApi);	34✔
62	_metrics = std::move(metrics);	34✔
63	_deadlineMarginMS = 5000;	34✔
64	_processor = processor;	34✔
65
66	_authQueue = dispatch_queue_create(	34✔
67	"com.google.santa.daemon.auth_queue",	34✔
68	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	34✔
69	QOS_CLASS_USER_INTERACTIVE, 0));	34✔
70
71	_notifyQueue = dispatch_queue_create(	34✔
72	"com.google.santa.daemon.notify_queue",	34✔
73	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	34✔
74	QOS_CLASS_BACKGROUND, 0));	34✔
75	}	34✔
76	return self;	34✔
77	}	34✔
78
79	- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {	×
80	switch (result) {	×
81	case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;	×
82	case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";	×
83	case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";	×
84	case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";	×
85	case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";	×
86	case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";	×
87	case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";	×
88	default: return @"Unknown error";	×
89	}	×
90	}	×
91
92	- (void)handleMessage:(Message &&)esMsg
93	recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {	×
94	// This method should only be used by classes derived
95	// from SNTEndpointSecurityClient.
96	[self doesNotRecognizeSelector:_cmd];	×
97	}	×
98
99	- (BOOL)shouldHandleMessage:(const Message &)esMsg
100	ignoringOtherESClients:(BOOL)ignoringOtherESClients {	×
101	if (esMsg->process->is_es_client && ignoringOtherESClients) {	×
102	if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {	×
103	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	×
104	}	×
105	return NO;	×
106	}	×
107
108	return YES;	×
109	}	×
110
111	- (void)establishClientOrDie {	30✔
112	if (self->_esClient.IsConnected()) {	30!
113	// This is a programming error
114	LOGE(@"Client already established. Aborting.");	×
115	[NSException raise:@"Client already established" format:@"IsConnected already true"];	×
116	}	×
117
118	self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {	×
119	int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
120	es_event_type_t eventType = esMsg->event_type;	×
121	if ([self shouldHandleMessage:esMsg	×
122	ignoringOtherESClients:[[SNTConfigurator configurator]	×
123	ignoreOtherEndpointSecurityClients]]) {	×
124	[self handleMessage:std::move(esMsg)	×
125	recordEventMetrics:^(EventDisposition disposition) {	×
126	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
127	self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,	×
128	processingEnd - processingStart);	×
129	}];	×
130	} else {	×
131	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
132	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,	×
133	processingEnd - processingStart);	×
134	}	×
135	});	×
136
137	if (!self->_esClient.IsConnected()) {	30!
138	NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];	×
139	LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);	×
140	[NSException raise:@"Failed to create ES client" format:@"%@", errMsg];	×
141	} else {	30✔
142	LOGI(@"Connected to EndpointSecurity (%@)", self);	30✔
143	}	30✔
144
145	if (![self muteSelf]) {	30!
146	[NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];	×
147	}	×
148	}	30✔
149
150	+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {	30✔
151	mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;	30✔
152	if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {	30!
153	LOGE(@"Failed to fetch this client's audit token.");	×
154	return false;	×
155	}	×
156
157	return true;	30✔
158	}	30✔
159
160	- (bool)muteSelf {	30✔
161	audit_token_t myAuditToken;	30✔
162	if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {	30!
163	return false;	×
164	}	×
165
166	if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {	30!
167	LOGE(@"Failed to mute this client's process.");	×
168	return false;	×
169	}	×
170
171	return true;	30✔
172	}	30✔
173
174	- (bool)clearCache {	4✔
175	return _esApi->ClearCache(self->_esClient);	4✔
176	}	4✔
177
178	- (bool)subscribe:(const std::set<es_event_type_t> &)events {	5✔
179	return _esApi->Subscribe(_esClient, events);	5✔
180	}	5✔
181
182	- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {	3✔
183	return [self subscribe:events] && [self clearCache];	3!
184	}	3✔
185
186	- (bool)unsubscribeAll {	1✔
187	return _esApi->UnsubscribeAll(_esClient);	1✔
188	}	1✔
189
190	- (bool)unmuteEverything {	5✔
191	bool result = _esApi->UnmuteAllPaths(_esClient);	5✔
192	result = _esApi->UnmuteAllTargetPaths(_esClient) && result;	5!
193	return result;	5✔
194	}	5✔
195
196	- (bool)enableTargetPathWatching {	4✔
197	return _esApi->InvertTargetPathMuting(_esClient);	4✔
198	}	4✔
199
200	- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	×
201	bool result = true;	×
202	for (const auto &pathAndTypePair : paths) {	×
203	result =	×
204	_esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	×
205	}	×
206	return result;	×
207	}	×
208
209	- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	×
210	bool result = true;	×
211	for (const auto &pathAndTypePair : paths) {	×
212	result =	×
213	_esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	×
214	}	×
215	return result;	×
216	}	×
217
218	- (bool)respondToMessage:(const Message &)msg
219	withAuthResult:(es_auth_result_t)result
220	cacheable:(bool)cacheable {	19✔
221	if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {	19!
222	return _esApi->RespondFlagsResult(	×
223	// For now, Santa is only concerned about alllowing all access or no
224	// access, hence the flags being translated here to all or nothing based
225	// on the auth result. In the future it might be beneficial to expand the
226	// scope of Santa to enforce things like read-only access.
227	_esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);	×
228	} else {	19✔
229	return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);	19✔
230	}	19✔
231	}	19✔
232
233	- (void)processEnrichedMessage:(std::shared_ptr<EnrichedMessage>)msg
234	handler:(void (^)(std::shared_ptr<EnrichedMessage>))messageHandler {	1✔
235	dispatch_async(_notifyQueue, ^{	1✔
236	messageHandler(std::move(msg));	1✔
237	});	1✔
238	}	1✔
239
240	- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {	×
241	__block Message msgTmp = std::move(msg);	×
242	dispatch_async(_notifyQueue, ^{	×
243	messageHandler(std::move(msgTmp));	×
244	});	×
245	}	×
246
247	- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {	19✔
248	if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {	19!
249	// This is a programming error
250	LOGE(@"Attempting to process non-AUTH message");	×
251	[NSException raise:@"Attempt to process non-auth message"	×
252	format:@"Unexpected event type received: %d", msg->event_type];	×
253	}	×
254
255	dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);	19✔
256	// Add 1 to the processing semaphore. We're not creating it with a starting
257	// value of 1 because that requires that the semaphore is not deallocated
258	// until its value matches the starting value, which we don't need.
259	dispatch_semaphore_signal(processingSema);	19✔
260	dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);	19✔
261
262	const uint64_t timeout = NSEC_PER_MSEC * (self.deadlineMarginMS);	19✔
263
264	uint64_t deadlineNano = MachTimeToNanos(msg->deadline - mach_absolute_time());	19✔
265
266	// TODO(mlw): How should we handle `deadlineNano <= timeout`. Will currently
267	// result in the deadline block being dispatched immediately (and therefore
268	// the event will be denied).
269
270	// Workaround for compiler bug that doesn't properly close over variables
271	__block Message processMsg = msg;	19✔
272	__block Message deadlineMsg = msg;	19✔
273
274	dispatch_after(	19✔
275	dispatch_time(DISPATCH_TIME_NOW, deadlineNano - timeout), self->_authQueue, ^(void) {	18✔
276	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	18!
277	// Handler has already responded, nothing to do.
278	return;	18✔
279	}	18✔
280
281	bool res = [self respondToMessage:deadlineMsg	×
282	withAuthResult:ES_AUTH_RESULT_DENY	×
283	cacheable:false];	×
284
285	LOGE(@"SNTEndpointSecurityClient: deadline reached: deny pid=%d, event type: %d ret=%d",	×
286	audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type, res);	×
287	dispatch_semaphore_signal(deadlineExpiredSema);	×
288	});	×
289
290	dispatch_async(self->_authQueue, ^{	19✔
291	messageHandler(processMsg);	19✔
292	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	19!
293	// Deadline expired, wait for deadline block to finish.
294	dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);	×
295	}	×
296	});	19✔
297	}	19✔
298
299	+ (bool)isDatabasePath:(const std::string_view)path {	12✔
300	// TODO(mlw): These values should come from `SNTDatabaseController`. But right
301	// now they live as NSStrings. We should make them `std::string_view` types
302	// in order to use them here efficiently, but will need to make the
303	// `SNTDatabaseController` an ObjC++ file.
304	return (path == "/private/var/db/santa/rules.db" \|\| path == "/private/var/db/santa/events.db");	12✔
305	}	12✔
306
307	@end

google / santa / 3737315758

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous