6948117073

Committed 21 Nov 2023 06:32PM UTC coverage: 62.983% (-0.9%) from 63.858%

Build # 6948117073

Build Type

Pull #1236

github

Committed by

web-flow

Commit Message

Merge 7cb9b0b21 into f49965495

Pull Request Pull Request #1236: ProcessTree: add core process tree logic (1/4)

Run Details

4332 of 8950 branches covered (0.0%)

Branch coverage included in aggregate %.

267 of 359 new or added lines in 6 files covered. (74.37%)

301 existing lines in 5 files now uncovered.

15100 of 21903 relevant lines covered (68.94%)

14723.06 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

68.33

/Source/santad/SNTPolicyProcessor.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTPolicyProcessor.h"
#include <Foundation/Foundation.h>

#include <Availability.h>
#include <Kernel/kern/cs_blobs.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <Security/SecCode.h>
#import <Security/Security.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeepCopy.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTMetricSet.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"

NSArray<NSString *> *FieldValuesForProperties(BOOL csDevFlagSet, BOOL validationCategoryThree,
                                              BOOL oidsSet) {
#define SNT_BOOL_STR(b) (b) ? @"True" : @"False"
  return
    @[ SNT_BOOL_STR(csDevFlagSet), SNT_BOOL_STR(validationCategoryThree), SNT_BOOL_STR(oidsSet) ];
#undef SNT_BOOL_STR
}

@interface SNTPolicyProcessor ()
@property SNTRuleTable *ruleTable;
@property SNTConfigurator *configurator;
@property SNTMetricCounter *experimentalDevMetrics;
@end

@implementation SNTPolicyProcessor

- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {
  self = [super init];
  if (self) {
    _ruleTable = ruleTable;
    _configurator = [SNTConfigurator configurator];

    _experimentalDevMetrics = [[SNTMetricSet sharedInstance]
      counterWithName:@"/santa/tmp_signing_info_experiment"
           fieldNames:@[ @"CSDevFlagSet", @"ValidationCategory", @"DevOIDSet" ]
             helpText:@"Temporary experiment for dev signed code"];
  }
  return self;
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID
                                     targetProcess:(nullable const es_process_t *)targetProc
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nullable)(
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.sha256 = fileSHA256 ?: fileInfo.SHA256;
  cd.teamID = teamID;
  cd.signingID = signingID;

  SNTClientMode mode = [self.configurator clientMode];
  cd.decisionClientMode = mode;

  // If the binary is a critical system binary, don't check its signature.
  // The binary was validated at startup when the rule table was initialized.
  SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];
  if (systemCd) {
    systemCd.decisionClientMode = mode;
    return systemCd;
  }

  NSError *csInfoError;
  if (certificateSHA256.length) {
    cd.certSHA256 = certificateSHA256;
  } else {
    // Grab the code signature, if there's an error don't try to capture
    // any of the signature details.
    MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];
    if (csInfoError) {
      csInfo = nil;
      cd.decisionExtra =
        [NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];
      cd.teamID = nil;
      cd.signingID = nil;
    } else {
      cd.certSHA256 = csInfo.leafCertificate.SHA256;
      cd.certCommonName = csInfo.leafCertificate.commonName;
      cd.certChain = csInfo.certificates;
      cd.teamID = teamID
                    ?: [csInfo.signingInformation
                         objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];

      // Ensure that if no teamID exists that the signing info confirms it is a
      // platform binary. If not, remove the signingID.
      if (!cd.teamID && cd.signingID) {
        id platformID = [csInfo.signingInformation
          objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
        if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
          cd.signingID = nil;
        }
      }

      NSDictionary *entitlements =
        csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];

      if (entitlementsFilterCallback) {
        cd.entitlements = entitlementsFilterCallback(entitlements);
        cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);
      } else {
        cd.entitlements = [entitlements sntDeepCopy];
        cd.entitlementsFiltered = NO;
      }

#if defined(MAC_OS_VERSION_13_3) && MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_13_3
      if (@available(macOS 13.0, *)) {
        // Temporary experiment code...
        if (targetProc != NULL && fileInfo.path != nil) {
          // Doing a second SecStaticCodeCreate to not need to worry about modifying the
          // dependency...
          SecStaticCodeRef codeRef = NULL;
          OSStatus status = SecStaticCodeCreateWithPath(
            (__bridge CFURLRef)[NSURL fileURLWithPath:fileInfo.path], kSecCSDefaultFlags, &codeRef);
          if (status == errSecSuccess) {
            CFDictionaryRef cfSigningInfo = NULL;
            SecCodeCopySigningInformation(
              codeRef, kSecCSSigningInformation | kSecCSRequirementInformation, &cfSigningInfo);
            NSDictionary *signingInfo = CFBridgingRelease(cfSigningInfo);

            // Taken from Security framework: LWCRHelper.mm
            NSString *reqVaidationCategryKey = @"validation-category";
            // Taken from Security framework:
            NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];
            NSDictionary *lwCodeReq = signingInfo[(
              __bridge NSString *)kSecCodeInfoDefaultDesignatedLightweightCodeRequirement];

            NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(
              csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));

            BOOL validationCategoryThree = [lwCodeReq[reqVaidationCategryKey] intValue] == 3;
            BOOL csDevFlagSet = ((targetProc->codesigning_flags & CS_DEV_CODE) != 0);
            BOOL oidsSet = vals.count > 0;

            [self.experimentalDevMetrics
              incrementForFieldValues:FieldValuesForProperties(csDevFlagSet,
                                                               validationCategoryThree, oidsSet)];

            if (!(csDevFlagSet == validationCategoryThree && csDevFlagSet == oidsSet)) {
              NSDictionary *certVals = CFBridgingRelease(
                SecCertificateCopyValues(csInfo.leafCertificate.certRef, NULL, NULL));
              LOGI(@"EXPERIMENTAL Unexpected state difference: %@ | Flags(%d): 0x%08x, VC(%d): %d, "
                   @"oids(%d): %@",
                   fileInfo.path, csDevFlagSet, targetProc->codesigning_flags,
                   validationCategoryThree, [lwCodeReq[reqVaidationCategryKey] intValue], oidsSet,
                   [certVals allKeys]);
            }
          }
        }
      }
#endif
    }
  }
  cd.quarantineURL = fileInfo.quarantineDataURL;

  SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256
                                            signingID:cd.signingID
                                    certificateSHA256:cd.certSHA256
                                               teamID:cd.teamID];
  if (rule) {
    switch (rule.type) {
      case SNTRuleTypeBinary:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;
          case SNTRuleStateSilentBlock: cd.silentBlock = YES;
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockBinary;
            return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllow.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowBinary;
            }
            return cd;
          case SNTRuleStateAllowTransitive:
            // If transitive rules are enabled, then SNTRuleStateAllowTransitive
            // rules become SNTEventStateAllowTransitive decisions.  Otherwise, we treat the
            // rule as if it were SNTRuleStateUnknown.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowTransitive;
              return cd;
            } else {
              rule.state = SNTRuleStateUnknown;
            }
          default: break;
        }
        break;
      case SNTRuleTypeSigningID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllowSigningID.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowSigningID;
            }
            return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockSigningID;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeCertificate:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockCertificate;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeTeamID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockTeamID;
            return cd;
          default: break;
        }
        break;

      default: break;
    }
  }

  if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&
      csInfoError.code != errSecCSUnsigned) {
    cd.decisionExtra =
      [NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];
    cd.decision = SNTEventStateBlockCertificate;
    return cd;
  }

  NSString *msg = [self fileIsScopeBlocked:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateBlockScope;
    return cd;
  }

  msg = [self fileIsScopeAllowed:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateAllowScope;
    return cd;
  }

  switch (mode) {
    case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;
    case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;
    default: cd.decision = SNTEventStateBlockUnknown; return cd;
  }
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                     targetProcess:(nonnull const es_process_t *)targetProc
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nonnull)(
                            const char *_Nullable teamID,
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  NSString *signingID;
  NSString *teamID;

  const char *entitlementsFilterTeamID = NULL;

  if (targetProc->signing_id.length > 0) {
    if (targetProc->team_id.length > 0) {
      entitlementsFilterTeamID = targetProc->team_id.data;
      teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
      signingID =
        [NSString stringWithFormat:@"%@:%@", teamID,
                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
    } else if (targetProc->is_platform_binary) {
      entitlementsFilterTeamID = "platform";
      signingID =
        [NSString stringWithFormat:@"platform:%@",
                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
    }
  }

  return [self decisionForFileInfo:fileInfo
                        fileSHA256:nil
                 certificateSHA256:nil
                            teamID:teamID
                         signingID:signingID
                     targetProcess:targetProc
        entitlementsFilterCallback:^NSDictionary *(NSDictionary *entitlements) {
          return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);
        }];
}

// Used by `$ santactl fileinfo`.
- (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID {
  SNTFileInfo *fileInfo;
  NSError *error;
  fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
  if (!fileInfo) LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
  return [self decisionForFileInfo:fileInfo
                        fileSHA256:fileSHA256
                 certificateSHA256:certificateSHA256
                            teamID:teamID
                         signingID:signingID
                     targetProcess:NULL
        entitlementsFilterCallback:nil];
}

///
///  Checks whether the file at @c path is in-scope for checking with Santa.
///
///  Files that are out of scope:
///    + Non Mach-O files that are not part of an installer package.
///    + Files in allowed path.
///
///  @return @c YES if file is in scope, @c NO otherwise.
///
- (NSString *)fileIsScopeAllowed:(SNTFileInfo *)fi {
  if (!fi) return nil;

  // Determine if file is within an allowed path
  NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Allowed Path Regex";
  }

  // If file is not a Mach-O file, we're not interested.
  if (!fi.isMachO) {
    return @"Not a Mach-O";
  }

  return nil;
}

- (NSString *)fileIsScopeBlocked:(SNTFileInfo *)fi {
  if (!fi) return nil;

  NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Blocked Path Regex";
  }

  if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {
    return @"Missing __PAGEZERO";
  }

  return nil;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTPolicyProcessor.h"
16	#include <Foundation/Foundation.h>
17
18	#include <Availability.h>
19	#include <Kernel/kern/cs_blobs.h>
20	#import <MOLCodesignChecker/MOLCodesignChecker.h>
21	#import <Security/SecCode.h>
22	#import <Security/Security.h>
23
24	#import "Source/common/SNTCachedDecision.h"
25	#import "Source/common/SNTConfigurator.h"
26	#import "Source/common/SNTDeepCopy.h"
27	#import "Source/common/SNTFileInfo.h"
28	#import "Source/common/SNTLogging.h"
29	#import "Source/common/SNTMetricSet.h"
30	#import "Source/common/SNTRule.h"
31	#import "Source/santad/DataLayer/SNTRuleTable.h"
32
33	NSArray<NSString > FieldValuesForProperties(BOOL csDevFlagSet, BOOL validationCategoryThree,
UNCOV 34	BOOL oidsSet) {	×
UNCOV 35	#define SNT_BOOL_STR(b) (b) ? @"True" : @"False"	×
UNCOV 36	return	×
UNCOV 37	@[ SNT_BOOL_STR(csDevFlagSet), SNT_BOOL_STR(validationCategoryThree), SNT_BOOL_STR(oidsSet) ];	×
UNCOV 38	#undef SNT_BOOL_STR	×
UNCOV 39	}	×
40
41	@interface SNTPolicyProcessor ()
42	@property SNTRuleTable *ruleTable;
43	@property SNTConfigurator *configurator;
44	@property SNTMetricCounter *experimentalDevMetrics;
45	@end
46
47	@implementation SNTPolicyProcessor
48
49	- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {	45✔
50	self = [super init];	45✔
51	if (self) {	45!
52	_ruleTable = ruleTable;	45✔
53	_configurator = [SNTConfigurator configurator];	45✔
54
55	_experimentalDevMetrics = [[SNTMetricSet sharedInstance]	45✔
56	counterWithName:@"/santa/tmp_signing_info_experiment"	45✔
57	fieldNames:@[ @"CSDevFlagSet", @"ValidationCategory", @"DevOIDSet" ]	45✔
58	helpText:@"Temporary experiment for dev signed code"];	45✔
59	}	45✔
60	return self;	45✔
61	}	45✔
62
63	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
64	fileSHA256:(nullable NSString *)fileSHA256
65	certificateSHA256:(nullable NSString *)certificateSHA256
66	teamID:(nullable NSString *)teamID
67	signingID:(nullable NSString *)signingID
68	targetProcess:(nullable const es_process_t *)targetProc
69	entitlementsFilterCallback:
70	(NSDictionary *_Nullable (^_Nullable)(
71	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	42✔
72	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	42✔
73	cd.sha256 = fileSHA256 ?: fileInfo.SHA256;	42✔
74	cd.teamID = teamID;	42✔
75	cd.signingID = signingID;	42✔
76
77	SNTClientMode mode = [self.configurator clientMode];	42✔
78	cd.decisionClientMode = mode;	42✔
79
80	// If the binary is a critical system binary, don't check its signature.
81	// The binary was validated at startup when the rule table was initialized.
82	SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];	42✔
83	if (systemCd) {	42✔
84	systemCd.decisionClientMode = mode;	1✔
85	return systemCd;	1✔
86	}	1✔
87
88	NSError *csInfoError;	41✔
89	if (certificateSHA256.length) {	41!
UNCOV 90	cd.certSHA256 = certificateSHA256;	×
91	} else {	41✔
92	// Grab the code signature, if there's an error don't try to capture
93	// any of the signature details.
94	MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];	41✔
95	if (csInfoError) {	41✔
96	csInfo = nil;	6✔
97	cd.decisionExtra =	6✔
98	[NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];	6✔
99	cd.teamID = nil;	6✔
100	cd.signingID = nil;	6✔
101	} else {	35✔
102	cd.certSHA256 = csInfo.leafCertificate.SHA256;	35✔
103	cd.certCommonName = csInfo.leafCertificate.commonName;	35✔
104	cd.certChain = csInfo.certificates;	35✔
105	cd.teamID = teamID	35✔
106	?: [csInfo.signingInformation	35✔
107	objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];	35✔
108
109	// Ensure that if no teamID exists that the signing info confirms it is a
110	// platform binary. If not, remove the signingID.
111	if (!cd.teamID && cd.signingID) {	35!
UNCOV 112	id platformID = [csInfo.signingInformation	×
UNCOV 113	objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];	×
UNCOV 114	if (![platformID isKindOfClass:[NSNumber class]] \|\| [platformID intValue] == 0) {	×
UNCOV 115	cd.signingID = nil;	×
UNCOV 116	}	×
UNCOV 117	}	×
118
119	NSDictionary *entitlements =	35✔
120	csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];	35✔
121
122	if (entitlementsFilterCallback) {	35!
123	cd.entitlements = entitlementsFilterCallback(entitlements);	35✔
124	cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);	35✔
UNCOV 125	} else {	×
UNCOV 126	cd.entitlements = [entitlements sntDeepCopy];	×
UNCOV 127	cd.entitlementsFiltered = NO;	×
UNCOV 128	}	×
129
130	#if defined(MAC_OS_VERSION_13_3) && MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_13_3
131	if (@available(macOS 13.0, *)) {
132	// Temporary experiment code...
133	if (targetProc != NULL && fileInfo.path != nil) {
134	// Doing a second SecStaticCodeCreate to not need to worry about modifying the
135	// dependency...
136	SecStaticCodeRef codeRef = NULL;
137	OSStatus status = SecStaticCodeCreateWithPath(
138	(__bridge CFURLRef)[NSURL fileURLWithPath:fileInfo.path], kSecCSDefaultFlags, &codeRef);
139	if (status == errSecSuccess) {
140	CFDictionaryRef cfSigningInfo = NULL;
141	SecCodeCopySigningInformation(
142	codeRef, kSecCSSigningInformation \| kSecCSRequirementInformation, &cfSigningInfo);
143	NSDictionary *signingInfo = CFBridgingRelease(cfSigningInfo);
144
145	// Taken from Security framework: LWCRHelper.mm
146	NSString *reqVaidationCategryKey = @"validation-category";
147	// Taken from Security framework:
148	NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];
149	NSDictionary *lwCodeReq = signingInfo[(
150	__bridge NSString *)kSecCodeInfoDefaultDesignatedLightweightCodeRequirement];
151
152	NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(
153	csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));
154
155	BOOL validationCategoryThree = [lwCodeReq[reqVaidationCategryKey] intValue] == 3;
156	BOOL csDevFlagSet = ((targetProc->codesigning_flags & CS_DEV_CODE) != 0);
157	BOOL oidsSet = vals.count > 0;
158
159	[self.experimentalDevMetrics
160	incrementForFieldValues:FieldValuesForProperties(csDevFlagSet,
161	validationCategoryThree, oidsSet)];
162
163	if (!(csDevFlagSet == validationCategoryThree && csDevFlagSet == oidsSet)) {
164	NSDictionary *certVals = CFBridgingRelease(
165	SecCertificateCopyValues(csInfo.leafCertificate.certRef, NULL, NULL));
166	LOGI(@"EXPERIMENTAL Unexpected state difference: %@ \| Flags(%d): 0x%08x, VC(%d): %d, "
167	@"oids(%d): %@",
168	fileInfo.path, csDevFlagSet, targetProc->codesigning_flags,
169	validationCategoryThree, [lwCodeReq[reqVaidationCategryKey] intValue], oidsSet,
170	[certVals allKeys]);
171	}
172	}
173	}
174	}
175	#endif
176	}	35✔
177	}	41✔
178	cd.quarantineURL = fileInfo.quarantineDataURL;	41✔
179
180	SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256	41✔
181	signingID:cd.signingID	41✔
182	certificateSHA256:cd.certSHA256	41✔
183	teamID:cd.teamID];	41✔
184	if (rule) {	41✔
185	switch (rule.type) {	32✔
186	case SNTRuleTypeBinary:	13✔
187	switch (rule.state) {	13✔
188	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;	6✔
189	case SNTRuleStateSilentBlock: cd.silentBlock = YES;	×
190	case SNTRuleStateBlock:	3✔
191	cd.customMsg = rule.customMsg;	3✔
192	cd.customURL = rule.customURL;	3✔
193	cd.decision = SNTEventStateBlockBinary;	3✔
194	return cd;	3✔
195	case SNTRuleStateAllowCompiler:	2✔
196	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
197	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
198	// it were SNTRuleStateAllow.
199	if ([self.configurator enableTransitiveRules]) {	2✔
200	cd.decision = SNTEventStateAllowCompiler;	1✔
201	} else {	1✔
202	cd.decision = SNTEventStateAllowBinary;	1✔
203	}	1✔
204	return cd;	2✔
205	case SNTRuleStateAllowTransitive:	2✔
206	// If transitive rules are enabled, then SNTRuleStateAllowTransitive
207	// rules become SNTEventStateAllowTransitive decisions. Otherwise, we treat the
208	// rule as if it were SNTRuleStateUnknown.
209	if ([self.configurator enableTransitiveRules]) {	2✔
210	cd.decision = SNTEventStateAllowTransitive;	1✔
211	return cd;	1✔
212	} else {	1✔
213	rule.state = SNTRuleStateUnknown;	1✔
214	}	1✔
215	default: break;	1!
216	}	1✔
217	break;	1✔
218	case SNTRuleTypeSigningID:	7✔
219	switch (rule.state) {	7✔
220	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;	3✔
221	case SNTRuleStateAllowCompiler:	1✔
222	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
223	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
224	// it were SNTRuleStateAllowSigningID.
225	if ([self.configurator enableTransitiveRules]) {	1!
226	cd.decision = SNTEventStateAllowCompiler;	1✔
UNCOV 227	} else {	×
UNCOV 228	cd.decision = SNTEventStateAllowSigningID;	×
UNCOV 229	}	×
230	return cd;	1✔
UNCOV 231	case SNTRuleStateSilentBlock:	×
UNCOV 232	cd.silentBlock = YES;	×
233	// intentional fallthrough
234	case SNTRuleStateBlock:	3✔
235	cd.customMsg = rule.customMsg;	3✔
236	cd.customURL = rule.customURL;	3✔
237	cd.decision = SNTEventStateBlockSigningID;	3✔
238	return cd;	3✔
UNCOV 239	default: break;	×
UNCOV 240	}	×
UNCOV 241	break;	×
242	case SNTRuleTypeCertificate:	6✔
243	switch (rule.state) {	6✔
244	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;	3✔
UNCOV 245	case SNTRuleStateSilentBlock:	×
UNCOV 246	cd.silentBlock = YES;	×
247	// intentional fallthrough
248	case SNTRuleStateBlock:	3✔
249	cd.customMsg = rule.customMsg;	3✔
250	cd.customURL = rule.customURL;	3✔
251	cd.decision = SNTEventStateBlockCertificate;	3✔
252	return cd;	3✔
UNCOV 253	default: break;	×
UNCOV 254	}	×
UNCOV 255	break;	×
256	case SNTRuleTypeTeamID:	6✔
257	switch (rule.state) {	6✔
258	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;	3✔
259	case SNTRuleStateSilentBlock:	×
260	cd.silentBlock = YES;	×
261	// intentional fallthrough
262	case SNTRuleStateBlock:	3✔
263	cd.customMsg = rule.customMsg;	3✔
264	cd.customURL = rule.customURL;	3✔
265	cd.decision = SNTEventStateBlockTeamID;	3✔
266	return cd;	3✔
UNCOV 267	default: break;	×
UNCOV 268	}	×
UNCOV 269	break;	×
270
UNCOV 271	default: break;	×
272	}	10✔
273	}	10✔
274
275	if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&	10!
UNCOV 276	csInfoError.code != errSecCSUnsigned) {	×
UNCOV 277	cd.decisionExtra =	×
UNCOV 278	[NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];	×
UNCOV 279	cd.decision = SNTEventStateBlockCertificate;	×
280	return cd;	×
281	}	×
282
283	NSString *msg = [self fileIsScopeBlocked:fileInfo];	10✔
284	if (msg) {	10!
285	cd.decisionExtra = msg;	×
286	cd.decision = SNTEventStateBlockScope;	×
287	return cd;	×
288	}	×
289
290	msg = [self fileIsScopeAllowed:fileInfo];	10✔
291	if (msg) {	10✔
292	cd.decisionExtra = msg;	2✔
293	cd.decision = SNTEventStateAllowScope;	2✔
294	return cd;	2✔
295	}	2✔
296
297	switch (mode) {	8✔
298	case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;	3✔
299	case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;	4✔
300	default: cd.decision = SNTEventStateBlockUnknown; return cd;	1✔
301	}	8✔
302	}	8✔
303
304	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
305	targetProcess:(nonnull const es_process_t *)targetProc
306	entitlementsFilterCallback:
307	(NSDictionary *_Nullable (^_Nonnull)(
308	const char *_Nullable teamID,
309	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	42✔
310	NSString *signingID;	42✔
311	NSString *teamID;	42✔
312
313	const char *entitlementsFilterTeamID = NULL;	42✔
314
315	if (targetProc->signing_id.length > 0) {	42✔
316	if (targetProc->team_id.length > 0) {	14✔
317	entitlementsFilterTeamID = targetProc->team_id.data;	13✔
318	teamID = [NSString stringWithUTF8String:targetProc->team_id.data];	13✔
319	signingID =	13✔
320	[NSString stringWithFormat:@"%@:%@", teamID,	13✔
321	[NSString stringWithUTF8String:targetProc->signing_id.data]];	13✔
322	} else if (targetProc->is_platform_binary) {	1!
UNCOV 323	entitlementsFilterTeamID = "platform";	×
324	signingID =	×
325	[NSString stringWithFormat:@"platform:%@",	×
UNCOV 326	[NSString stringWithUTF8String:targetProc->signing_id.data]];	×
UNCOV 327	}	×
328	}	14✔
329
330	return [self decisionForFileInfo:fileInfo	42✔
331	fileSHA256:nil	42✔
332	certificateSHA256:nil	42✔
333	teamID:teamID	42✔
334	signingID:signingID	42✔
335	targetProcess:targetProc	42✔
336	entitlementsFilterCallback:^NSDictionary (NSDictionary entitlements) {	35✔
337	return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);	35✔
338	}];	35✔
339	}	42✔
340
341	// Used by `$ santactl fileinfo`.
342	- (nonnull SNTCachedDecision )decisionForFilePath:(nonnull NSString )filePath
343	fileSHA256:(nullable NSString *)fileSHA256
344	certificateSHA256:(nullable NSString *)certificateSHA256
345	teamID:(nullable NSString *)teamID
UNCOV 346	signingID:(nullable NSString *)signingID {	×
UNCOV 347	SNTFileInfo *fileInfo;	×
UNCOV 348	NSError *error;	×
UNCOV 349	fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];	×
UNCOV 350	if (!fileInfo) LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);	×
UNCOV 351	return [self decisionForFileInfo:fileInfo	×
UNCOV 352	fileSHA256:fileSHA256	×
UNCOV 353	certificateSHA256:certificateSHA256	×
UNCOV 354	teamID:teamID	×
UNCOV 355	signingID:signingID	×
UNCOV 356	targetProcess:NULL	×
UNCOV 357	entitlementsFilterCallback:nil];	×
UNCOV 358	}	×
359
360	///
361	/// Checks whether the file at @c path is in-scope for checking with Santa.
362	///
363	/// Files that are out of scope:
364	/// + Non Mach-O files that are not part of an installer package.
365	/// + Files in allowed path.
366	///
367	/// @return @c YES if file is in scope, @c NO otherwise.
368	///
369	- (NSString )fileIsScopeAllowed:(SNTFileInfo )fi {	10✔
370	if (!fi) return nil;	10!
371
372	// Determine if file is within an allowed path
373	NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];	10✔
374	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
UNCOV 375	return @"Allowed Path Regex";	×
UNCOV 376	}	×
377
378	// If file is not a Mach-O file, we're not interested.
379	if (!fi.isMachO) {	10✔
380	return @"Not a Mach-O";	2✔
381	}	2✔
382
383	return nil;	8✔
384	}	8✔
385
386	- (NSString )fileIsScopeBlocked:(SNTFileInfo )fi {	10✔
387	if (!fi) return nil;	10!
388
389	NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];	10✔
390	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
UNCOV 391	return @"Blocked Path Regex";	×
UNCOV 392	}	×
393
394	if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {	10!
UNCOV 395	return @"Missing __PAGEZERO";	×
UNCOV 396	}	×
397
398	return nil;	10✔
399	}	10✔
400
401	@end

google / santa / 6948117073

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous