7007829399

Committed 27 Nov 2023 04:21PM UTC coverage: 63.838% (-0.03%) from 63.866%

Build # 7007829399

Build Type

push

github

Committed by

web-flow

Commit Message

Ignore TeamID and SigningID rules for dev signed code (#1241)

* Ignore TID/SID rules for dev signed code

* Handle code paths from santactl

* Don't bother evaluating isProdSignedCallback if not necessary

* PR feedback. Link to docs.

Run Details

4321 of 8822 branches covered (0.0%)

Branch coverage included in aggregate %.

11 of 36 new or added lines in 1 file covered. (30.56%)

67 existing lines in 1 file now uncovered.

15073 of 21558 relevant lines covered (69.92%)

14119.93 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

65.87

/Source/santad/SNTPolicyProcessor.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTPolicyProcessor.h"
#include <Foundation/Foundation.h>

#include <Kernel/kern/cs_blobs.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <Security/SecCode.h>
#import <Security/Security.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeepCopy.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"

@interface SNTPolicyProcessor ()
@property SNTRuleTable *ruleTable;
@property SNTConfigurator *configurator;
@end

@implementation SNTPolicyProcessor

- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {
  self = [super init];
  if (self) {
    _ruleTable = ruleTable;
    _configurator = [SNTConfigurator configurator];
  }
  return self;
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID
                              isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nullable)(
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.sha256 = fileSHA256 ?: fileInfo.SHA256;
  cd.teamID = teamID;
  cd.signingID = signingID;

  SNTClientMode mode = [self.configurator clientMode];
  cd.decisionClientMode = mode;

  // If the binary is a critical system binary, don't check its signature.
  // The binary was validated at startup when the rule table was initialized.
  SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];
  if (systemCd) {
    systemCd.decisionClientMode = mode;
    return systemCd;
  }

  NSError *csInfoError;
  if (certificateSHA256.length) {
    cd.certSHA256 = certificateSHA256;
  } else {
    // Grab the code signature, if there's an error don't try to capture
    // any of the signature details.
    MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];
    if (csInfoError) {
      csInfo = nil;
      cd.decisionExtra =
        [NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];
      cd.teamID = nil;
      cd.signingID = nil;
    } else {
      cd.certSHA256 = csInfo.leafCertificate.SHA256;
      cd.certCommonName = csInfo.leafCertificate.commonName;
      cd.certChain = csInfo.certificates;
      cd.teamID = teamID
                    ?: [csInfo.signingInformation
                         objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];

      // Ensure that if no teamID exists that the signing info confirms it is a
      // platform binary. If not, remove the signingID.
      if (!cd.teamID && cd.signingID) {
        id platformID = [csInfo.signingInformation
          objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
        if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
          cd.signingID = nil;
        }
      }

      NSDictionary *entitlements =
        csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];

      if (entitlementsFilterCallback) {
        cd.entitlements = entitlementsFilterCallback(entitlements);
        cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);
      } else {
        cd.entitlements = [entitlements sntDeepCopy];
        cd.entitlementsFiltered = NO;
      }
    }
  }
  cd.quarantineURL = fileInfo.quarantineDataURL;

  // Do not evaluate TeamID/SigningID rules for dev-signed code based on the
  // assumption that orgs are generally more relaxed about dev signed cert
  // protections and users can more easily produce dev-signed code that
  // would otherwise be inadvertently allowed.
  // Note: Only perform the check if the SigningID is still set, otherwise
  // it is unsigned or had issues above that already cleared the values.
  if (cd.signingID && !isProdSignedCallback()) {
    LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",
         cd.signingID);
    cd.teamID = nil;
    cd.signingID = nil;
  }

  SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256
                                            signingID:cd.signingID
                                    certificateSHA256:cd.certSHA256
                                               teamID:cd.teamID];
  if (rule) {
    switch (rule.type) {
      case SNTRuleTypeBinary:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;
          case SNTRuleStateSilentBlock: cd.silentBlock = YES;
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockBinary;
            return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllow.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowBinary;
            }
            return cd;
          case SNTRuleStateAllowTransitive:
            // If transitive rules are enabled, then SNTRuleStateAllowTransitive
            // rules become SNTEventStateAllowTransitive decisions.  Otherwise, we treat the
            // rule as if it were SNTRuleStateUnknown.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowTransitive;
              return cd;
            } else {
              rule.state = SNTRuleStateUnknown;
            }
          default: break;
        }
        break;
      case SNTRuleTypeSigningID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllowSigningID.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowSigningID;
            }
            return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockSigningID;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeCertificate:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockCertificate;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeTeamID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockTeamID;
            return cd;
          default: break;
        }
        break;

      default: break;
    }
  }

  if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&
      csInfoError.code != errSecCSUnsigned) {
    cd.decisionExtra =
      [NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];
    cd.decision = SNTEventStateBlockCertificate;
    return cd;
  }

  NSString *msg = [self fileIsScopeBlocked:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateBlockScope;
    return cd;
  }

  msg = [self fileIsScopeAllowed:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateAllowScope;
    return cd;
  }

  switch (mode) {
    case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;
    case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;
    default: cd.decision = SNTEventStateBlockUnknown; return cd;
  }
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                     targetProcess:(nonnull const es_process_t *)targetProc
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nonnull)(
                            const char *_Nullable teamID,
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  NSString *signingID;
  NSString *teamID;

  const char *entitlementsFilterTeamID = NULL;

  if (targetProc->signing_id.length > 0) {
    if (targetProc->team_id.length > 0) {
      entitlementsFilterTeamID = targetProc->team_id.data;
      teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
      signingID =
        [NSString stringWithFormat:@"%@:%@", teamID,
                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
    } else if (targetProc->is_platform_binary) {
      entitlementsFilterTeamID = "platform";
      signingID =
        [NSString stringWithFormat:@"platform:%@",
                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
    }
  }

  return [self decisionForFileInfo:fileInfo
    fileSHA256:nil
    certificateSHA256:nil
    teamID:teamID
    signingID:signingID
    isProdSignedCallback:^BOOL {
      return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);
    }
    entitlementsFilterCallback:^NSDictionary *(NSDictionary *entitlements) {
      return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);
    }];
}

// Used by `$ santactl fileinfo`.
- (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID {
  MOLCodesignChecker *csInfo;
  NSError *error;

  SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
  if (!fileInfo) {
    LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
  } else {
    csInfo = [fileInfo codesignCheckerWithError:&error];
    if (error) {
      LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);
    }
  }

  return [self decisionForFileInfo:fileInfo
                        fileSHA256:fileSHA256
                 certificateSHA256:certificateSHA256
                            teamID:teamID
                         signingID:signingID
              isProdSignedCallback:^BOOL {
                if (csInfo) {
                  // Development OID values defined by Apple and used by the Security Framework
                  // https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
                  NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];
                  NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(
                    csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));
                  return vals.count == 0;
                } else {
                  return NO;
                }
              }
        entitlementsFilterCallback:nil];
}

///
///  Checks whether the file at @c path is in-scope for checking with Santa.
///
///  Files that are out of scope:
///    + Non Mach-O files that are not part of an installer package.
///    + Files in allowed path.
///
///  @return @c YES if file is in scope, @c NO otherwise.
///
- (NSString *)fileIsScopeAllowed:(SNTFileInfo *)fi {
  if (!fi) return nil;

  // Determine if file is within an allowed path
  NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Allowed Path Regex";
  }

  // If file is not a Mach-O file, we're not interested.
  if (!fi.isMachO) {
    return @"Not a Mach-O";
  }

  return nil;
}

- (NSString *)fileIsScopeBlocked:(SNTFileInfo *)fi {
  if (!fi) return nil;

  NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Blocked Path Regex";
  }

  if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {
    return @"Missing __PAGEZERO";
  }

  return nil;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTPolicyProcessor.h"
16	#include <Foundation/Foundation.h>
17
18	#include <Kernel/kern/cs_blobs.h>
19	#import <MOLCodesignChecker/MOLCodesignChecker.h>
20	#import <Security/SecCode.h>
21	#import <Security/Security.h>
22
23	#import "Source/common/SNTCachedDecision.h"
24	#import "Source/common/SNTConfigurator.h"
25	#import "Source/common/SNTDeepCopy.h"
26	#import "Source/common/SNTFileInfo.h"
27	#import "Source/common/SNTLogging.h"
28	#import "Source/common/SNTRule.h"
29	#import "Source/santad/DataLayer/SNTRuleTable.h"
30
31	@interface SNTPolicyProcessor ()
32	@property SNTRuleTable *ruleTable;
33	@property SNTConfigurator *configurator;
34	@end
35
36	@implementation SNTPolicyProcessor
37
38	- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {	45✔
39	self = [super init];	45✔
40	if (self) {	45!
41	_ruleTable = ruleTable;	45✔
42	_configurator = [SNTConfigurator configurator];	45✔
43	}	45✔
44	return self;	45✔
45	}	45✔
46
47	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
48	fileSHA256:(nullable NSString *)fileSHA256
49	certificateSHA256:(nullable NSString *)certificateSHA256
50	teamID:(nullable NSString *)teamID
51	signingID:(nullable NSString *)signingID
52	isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
53	entitlementsFilterCallback:
54	(NSDictionary *_Nullable (^_Nullable)(
55	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	42✔
56	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	42✔
57	cd.sha256 = fileSHA256 ?: fileInfo.SHA256;	42✔
58	cd.teamID = teamID;	42✔
59	cd.signingID = signingID;	42✔
60
61	SNTClientMode mode = [self.configurator clientMode];	42✔
62	cd.decisionClientMode = mode;	42✔
63
64	// If the binary is a critical system binary, don't check its signature.
65	// The binary was validated at startup when the rule table was initialized.
66	SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];	42✔
67	if (systemCd) {	42✔
68	systemCd.decisionClientMode = mode;	1✔
69	return systemCd;	1✔
70	}	1✔
71
72	NSError *csInfoError;	41✔
73	if (certificateSHA256.length) {	41!
UNCOV 74	cd.certSHA256 = certificateSHA256;	×
75	} else {	41✔
76	// Grab the code signature, if there's an error don't try to capture
77	// any of the signature details.
78	MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];	41✔
79	if (csInfoError) {	41✔
80	csInfo = nil;	6✔
81	cd.decisionExtra =	6✔
82	[NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];	6✔
83	cd.teamID = nil;	6✔
84	cd.signingID = nil;	6✔
85	} else {	35✔
86	cd.certSHA256 = csInfo.leafCertificate.SHA256;	35✔
87	cd.certCommonName = csInfo.leafCertificate.commonName;	35✔
88	cd.certChain = csInfo.certificates;	35✔
89	cd.teamID = teamID	35✔
90	?: [csInfo.signingInformation	35✔
91	objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];	35✔
92
93	// Ensure that if no teamID exists that the signing info confirms it is a
94	// platform binary. If not, remove the signingID.
95	if (!cd.teamID && cd.signingID) {	35!
UNCOV 96	id platformID = [csInfo.signingInformation	×
UNCOV 97	objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];	×
UNCOV 98	if (![platformID isKindOfClass:[NSNumber class]] \|\| [platformID intValue] == 0) {	×
UNCOV 99	cd.signingID = nil;	×
UNCOV 100	}	×
UNCOV 101	}	×
102
103	NSDictionary *entitlements =	35✔
104	csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];	35✔
105
106	if (entitlementsFilterCallback) {	35!
107	cd.entitlements = entitlementsFilterCallback(entitlements);	35✔
108	cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);	35✔
UNCOV 109	} else {	×
UNCOV 110	cd.entitlements = [entitlements sntDeepCopy];	×
UNCOV 111	cd.entitlementsFiltered = NO;	×
112	}	×
113	}	35✔
114	}	41✔
115	cd.quarantineURL = fileInfo.quarantineDataURL;	41✔
116
117	// Do not evaluate TeamID/SigningID rules for dev-signed code based on the
118	// assumption that orgs are generally more relaxed about dev signed cert
119	// protections and users can more easily produce dev-signed code that
120	// would otherwise be inadvertently allowed.
121	// Note: Only perform the check if the SigningID is still set, otherwise
122	// it is unsigned or had issues above that already cleared the values.
123	if (cd.signingID && !isProdSignedCallback()) {	41!
NEW UNCOV 124	LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",	×
NEW 125	cd.signingID);	×
NEW 126	cd.teamID = nil;	×
NEW 127	cd.signingID = nil;	×
NEW 128	}	×
129
130	SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256	41✔
131	signingID:cd.signingID	41✔
132	certificateSHA256:cd.certSHA256	41✔
133	teamID:cd.teamID];	41✔
134	if (rule) {	41✔
135	switch (rule.type) {	32✔
136	case SNTRuleTypeBinary:	13✔
137	switch (rule.state) {	13✔
138	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;	6✔
UNCOV 139	case SNTRuleStateSilentBlock: cd.silentBlock = YES;	×
140	case SNTRuleStateBlock:	3✔
141	cd.customMsg = rule.customMsg;	3✔
142	cd.customURL = rule.customURL;	3✔
143	cd.decision = SNTEventStateBlockBinary;	3✔
144	return cd;	3✔
145	case SNTRuleStateAllowCompiler:	2✔
146	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
147	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
148	// it were SNTRuleStateAllow.
149	if ([self.configurator enableTransitiveRules]) {	2✔
150	cd.decision = SNTEventStateAllowCompiler;	1✔
151	} else {	1✔
152	cd.decision = SNTEventStateAllowBinary;	1✔
153	}	1✔
154	return cd;	2✔
155	case SNTRuleStateAllowTransitive:	2✔
156	// If transitive rules are enabled, then SNTRuleStateAllowTransitive
157	// rules become SNTEventStateAllowTransitive decisions. Otherwise, we treat the
158	// rule as if it were SNTRuleStateUnknown.
159	if ([self.configurator enableTransitiveRules]) {	2✔
160	cd.decision = SNTEventStateAllowTransitive;	1✔
161	return cd;	1✔
162	} else {	1✔
163	rule.state = SNTRuleStateUnknown;	1✔
164	}	1✔
165	default: break;	1!
166	}	1✔
167	break;	1✔
168	case SNTRuleTypeSigningID:	7✔
169	switch (rule.state) {	7✔
170	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;	3✔
171	case SNTRuleStateAllowCompiler:	1✔
172	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
173	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
174	// it were SNTRuleStateAllowSigningID.
175	if ([self.configurator enableTransitiveRules]) {	1!
176	cd.decision = SNTEventStateAllowCompiler;	1✔
UNCOV 177	} else {	×
UNCOV 178	cd.decision = SNTEventStateAllowSigningID;	×
UNCOV 179	}	×
180	return cd;	1✔
UNCOV 181	case SNTRuleStateSilentBlock:	×
UNCOV 182	cd.silentBlock = YES;	×
183	// intentional fallthrough
184	case SNTRuleStateBlock:	3✔
185	cd.customMsg = rule.customMsg;	3✔
186	cd.customURL = rule.customURL;	3✔
187	cd.decision = SNTEventStateBlockSigningID;	3✔
188	return cd;	3✔
189	default: break;	×
UNCOV 190	}	×
UNCOV 191	break;	×
192	case SNTRuleTypeCertificate:	6✔
193	switch (rule.state) {	6✔
194	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;	3✔
UNCOV 195	case SNTRuleStateSilentBlock:	×
UNCOV 196	cd.silentBlock = YES;	×
197	// intentional fallthrough
198	case SNTRuleStateBlock:	3✔
199	cd.customMsg = rule.customMsg;	3✔
200	cd.customURL = rule.customURL;	3✔
201	cd.decision = SNTEventStateBlockCertificate;	3✔
202	return cd;	3✔
UNCOV 203	default: break;	×
UNCOV 204	}	×
UNCOV 205	break;	×
206	case SNTRuleTypeTeamID:	6✔
207	switch (rule.state) {	6✔
208	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;	3✔
UNCOV 209	case SNTRuleStateSilentBlock:	×
UNCOV 210	cd.silentBlock = YES;	×
211	// intentional fallthrough
212	case SNTRuleStateBlock:	3✔
213	cd.customMsg = rule.customMsg;	3✔
214	cd.customURL = rule.customURL;	3✔
215	cd.decision = SNTEventStateBlockTeamID;	3✔
216	return cd;	3✔
UNCOV 217	default: break;	×
UNCOV 218	}	×
UNCOV 219	break;	×
220
UNCOV 221	default: break;	×
222	}	10✔
223	}	10✔
224
225	if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&	10!
UNCOV 226	csInfoError.code != errSecCSUnsigned) {	×
227	cd.decisionExtra =	×
228	[NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];	×
229	cd.decision = SNTEventStateBlockCertificate;	×
UNCOV 230	return cd;	×
231	}	×
232
233	NSString *msg = [self fileIsScopeBlocked:fileInfo];	10✔
234	if (msg) {	10!
UNCOV 235	cd.decisionExtra = msg;	×
UNCOV 236	cd.decision = SNTEventStateBlockScope;	×
UNCOV 237	return cd;	×
UNCOV 238	}	×
239
240	msg = [self fileIsScopeAllowed:fileInfo];	10✔
241	if (msg) {	10✔
242	cd.decisionExtra = msg;	2✔
243	cd.decision = SNTEventStateAllowScope;	2✔
244	return cd;	2✔
245	}	2✔
246
247	switch (mode) {	8✔
248	case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;	3✔
249	case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;	4✔
250	default: cd.decision = SNTEventStateBlockUnknown; return cd;	1✔
251	}	8✔
252	}	8✔
253
254	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
255	targetProcess:(nonnull const es_process_t *)targetProc
256	entitlementsFilterCallback:
257	(NSDictionary *_Nullable (^_Nonnull)(
258	const char *_Nullable teamID,
259	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	42✔
260	NSString *signingID;	42✔
261	NSString *teamID;	42✔
262
263	const char *entitlementsFilterTeamID = NULL;	42✔
264
265	if (targetProc->signing_id.length > 0) {	42✔
266	if (targetProc->team_id.length > 0) {	14✔
267	entitlementsFilterTeamID = targetProc->team_id.data;	13✔
268	teamID = [NSString stringWithUTF8String:targetProc->team_id.data];	13✔
269	signingID =	13✔
270	[NSString stringWithFormat:@"%@:%@", teamID,	13✔
271	[NSString stringWithUTF8String:targetProc->signing_id.data]];	13✔
272	} else if (targetProc->is_platform_binary) {	1!
UNCOV 273	entitlementsFilterTeamID = "platform";	×
UNCOV 274	signingID =	×
UNCOV 275	[NSString stringWithFormat:@"platform:%@",	×
276	[NSString stringWithUTF8String:targetProc->signing_id.data]];	×
277	}	×
278	}	14✔
279
280	return [self decisionForFileInfo:fileInfo	42✔
281	fileSHA256:nil	42✔
282	certificateSHA256:nil	42✔
283	teamID:teamID	42✔
284	signingID:signingID	42✔
285	isProdSignedCallback:^BOOL {	13✔
286	return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);	13✔
287	}	13✔
288	entitlementsFilterCallback:^NSDictionary (NSDictionary entitlements) {	35✔
289	return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);	35✔
290	}];	35✔
291	}	42✔
292
293	// Used by `$ santactl fileinfo`.
294	- (nonnull SNTCachedDecision )decisionForFilePath:(nonnull NSString )filePath
295	fileSHA256:(nullable NSString *)fileSHA256
296	certificateSHA256:(nullable NSString *)certificateSHA256
297	teamID:(nullable NSString *)teamID
UNCOV 298	signingID:(nullable NSString *)signingID {	×
NEW UNCOV 299	MOLCodesignChecker *csInfo;	×
UNCOV 300	NSError *error;	×
301
NEW UNCOV 302	SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];	×
NEW UNCOV 303	if (!fileInfo) {	×
NEW UNCOV 304	LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);	×
NEW UNCOV 305	} else {	×
NEW UNCOV 306	csInfo = [fileInfo codesignCheckerWithError:&error];	×
NEW UNCOV 307	if (error) {	×
NEW UNCOV 308	LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);	×
NEW UNCOV 309	}	×
NEW UNCOV 310	}	×
311
UNCOV 312	return [self decisionForFileInfo:fileInfo	×
UNCOV 313	fileSHA256:fileSHA256	×
UNCOV 314	certificateSHA256:certificateSHA256	×
UNCOV 315	teamID:teamID	×
UNCOV 316	signingID:signingID	×
NEW UNCOV 317	isProdSignedCallback:^BOOL {	×
NEW UNCOV 318	if (csInfo) {	×
319	// Development OID values defined by Apple and used by the Security Framework
320	// https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
NEW UNCOV 321	NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];	×
NEW UNCOV 322	NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(	×
NEW 323	csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));	×
NEW 324	return vals.count == 0;	×
NEW 325	} else {	×
NEW 326	return NO;	×
NEW 327	}	×
NEW UNCOV 328	}	×
UNCOV 329	entitlementsFilterCallback:nil];	×
UNCOV 330	}	×
331
332	///
333	/// Checks whether the file at @c path is in-scope for checking with Santa.
334	///
335	/// Files that are out of scope:
336	/// + Non Mach-O files that are not part of an installer package.
337	/// + Files in allowed path.
338	///
339	/// @return @c YES if file is in scope, @c NO otherwise.
340	///
341	- (NSString )fileIsScopeAllowed:(SNTFileInfo )fi {	10✔
342	if (!fi) return nil;	10!
343
344	// Determine if file is within an allowed path
345	NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];	10✔
346	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
347	return @"Allowed Path Regex";	×
348	}	×
349
350	// If file is not a Mach-O file, we're not interested.
351	if (!fi.isMachO) {	10✔
352	return @"Not a Mach-O";	2✔
353	}	2✔
354
355	return nil;	8✔
356	}	8✔
357
358	- (NSString )fileIsScopeBlocked:(SNTFileInfo )fi {	10✔
359	if (!fi) return nil;	10!
360
361	NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];	10✔
362	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
UNCOV 363	return @"Blocked Path Regex";	×
UNCOV 364	}	×
365
366	if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {	10!
UNCOV 367	return @"Missing __PAGEZERO";	×
UNCOV 368	}	×
369
370	return nil;	10✔
371	}	10✔
372
373	@end

google / santa / 7007829399

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous