7106389393

Committed 05 Dec 2023 08:48PM UTC coverage: 63.345% (-0.9%) from 64.293%

Build # 7106389393

Build Type

push

github

Committed by

web-flow

Commit Message

Revert "Project: Remove provisioning_profiles attributes from command-line tool rules (#1247)" (#1251)

This reverts commit 65c660298.

Run Details

4289 of 8818 branches covered (0.0%)

Branch coverage included in aggregate %.

14952 of 21557 relevant lines covered (69.36%)

14264.29 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santad/EventProviders/SNTEndpointSecurityRecorder.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityRecorder.h"

#include <EndpointSecurity/EndpointSecurity.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/String.h"
#include "Source/santad/EventProviders/AuthResultCache.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::common::PrefixTree;
using santa::common::Unit;
using santa::santad::EventDisposition;
using santa::santad::event_providers::AuthResultCache;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Enricher;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
  switch (msg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE: return msg->event.close.target;
    case ES_EVENT_TYPE_NOTIFY_LINK: return msg->event.link.source;
    case ES_EVENT_TYPE_NOTIFY_RENAME: return msg->event.rename.source;
    case ES_EVENT_TYPE_NOTIFY_UNLINK: return msg->event.unlink.target;
    default: return NULL;
  }
}

@interface SNTEndpointSecurityRecorder ()
@property SNTCompilerController *compilerController;
@property SNTConfigurator *configurator;
@end

@implementation SNTEndpointSecurityRecorder {
  std::shared_ptr<AuthResultCache> _authResultCache;
  std::shared_ptr<Enricher> _enricher;
  std::shared_ptr<Logger> _logger;
  std::shared_ptr<PrefixTree<Unit>> _prefixTree;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
                       logger:(std::shared_ptr<Logger>)logger
                     enricher:(std::shared_ptr<Enricher>)enricher
           compilerController:(SNTCompilerController *)compilerController
              authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache
                   prefixTree:(std::shared_ptr<PrefixTree<Unit>>)prefixTree {
  self = [super initWithESAPI:std::move(esApi)
                      metrics:std::move(metrics)
                    processor:santa::santad::Processor::kRecorder];
  if (self) {
    _enricher = enricher;
    _logger = logger;
    _compilerController = compilerController;
    _authResultCache = authResultCache;
    _prefixTree = prefixTree;
    _configurator = [SNTConfigurator configurator];

    [self establishClientOrDie];
  }
  return self;
}

- (NSString *)description {
  return @"Recorder";
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {
  // Pre-enrichment processing
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE: {
      BOOL shouldLogClose = esMsg->event.close.modified;

#if HAVE_MACOS_13
      if (@available(macOS 13.5, *)) {
        // As of macSO 13.0 we have a new field for if a file was mmaped with
        // write permissions on close events. However it did not work until
        // 13.5.
        //
        // If something was mmaped writable it was probably written to. Often
        // developer tools do this to avoid lots of write syscalls, e.g. go's
        // tool chain. We log this so the compiler controller can take that into
        // account.
        shouldLogClose |= esMsg->event.close.was_mapped_writable;
      }
#endif

      if (!shouldLogClose) {
        // Ignore unmodified files
        // Note: Do not record metrics in this case. These are not considered "drops"
        // because this is not a failure case. Ideally we would tell ES to not send
        // these events in the first place but no such mechanism currently exists.
        return;
      }

      self->_authResultCache->RemoveFromCache(esMsg->event.close.target);

      // Only log file changes that match the given regex
      NSString *targetPath = santa::common::StringToNSString(esMsg->event.close.target->path.data);
      if (![[self.configurator fileChangesRegex]
            numberOfMatchesInString:targetPath
                            options:0
                              range:NSMakeRange(0, targetPath.length)]) {
        // Note: Do not record metrics in this case. These are not considered "drops"
        // because this is not a failure case.
        // TODO(mlw): Consider changes to configuration that would allow muting paths
        // to filter on the kernel side rather than in user space.
        return;
      }

      break;
    }
    default: break;
  }

  [self.compilerController handleEvent:esMsg withLogger:self->_logger];

  // Filter file op events matching the prefix tree.
  es_file_t *targetFile = GetTargetFileForPrefixTree(&(*esMsg));
  if (targetFile != NULL && self->_prefixTree->HasPrefix(targetFile->path.data)) {
    recordEventMetrics(EventDisposition::kDropped);
    return;
  }

  // Enrich the message inline with the ES handler block to capture enrichment
  // data as close to the source event as possible.
  std::unique_ptr<EnrichedMessage> enrichedMessage = _enricher->Enrich(std::move(esMsg));

  // Asynchronously log the message
  [self processEnrichedMessage:std::move(enrichedMessage)
                       handler:^(std::unique_ptr<EnrichedMessage> msg) {
                         self->_logger->Log(std::move(msg));
                         recordEventMetrics(EventDisposition::kProcessed);
                       }];
}

- (void)enable {
  [super subscribe:{
                     ES_EVENT_TYPE_NOTIFY_CLOSE,
                     ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA,
                     ES_EVENT_TYPE_NOTIFY_EXEC,
                     ES_EVENT_TYPE_NOTIFY_EXIT,
                     ES_EVENT_TYPE_NOTIFY_FORK,
                     ES_EVENT_TYPE_NOTIFY_LINK,
                     ES_EVENT_TYPE_NOTIFY_RENAME,
                     ES_EVENT_TYPE_NOTIFY_UNLINK,
                   }];
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityRecorder.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18
19	#import "Source/common/SNTConfigurator.h"
20	#import "Source/common/SNTLogging.h"
21	#include "Source/common/String.h"
22	#include "Source/santad/EventProviders/AuthResultCache.h"
23	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
24	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
25	#include "Source/santad/Metrics.h"
26
27	using santa::common::PrefixTree;
28	using santa::common::Unit;
29	using santa::santad::EventDisposition;
30	using santa::santad::event_providers::AuthResultCache;
31	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
32	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
33	using santa::santad::event_providers::endpoint_security::Enricher;
34	using santa::santad::event_providers::endpoint_security::Message;
35	using santa::santad::logs::endpoint_security::Logger;
36
37	es_file_t GetTargetFileForPrefixTree(const es_message_t msg) {	×
38	switch (msg->event_type) {	×
39	case ES_EVENT_TYPE_NOTIFY_CLOSE: return msg->event.close.target;	×
40	case ES_EVENT_TYPE_NOTIFY_LINK: return msg->event.link.source;	×
41	case ES_EVENT_TYPE_NOTIFY_RENAME: return msg->event.rename.source;	×
42	case ES_EVENT_TYPE_NOTIFY_UNLINK: return msg->event.unlink.target;	×
43	default: return NULL;	×
44	}	×
45	}	×
46
47	@interface SNTEndpointSecurityRecorder ()
48	@property SNTCompilerController *compilerController;
49	@property SNTConfigurator *configurator;
50	@end
51
52	@implementation SNTEndpointSecurityRecorder {
53	std::shared_ptr<AuthResultCache> _authResultCache;
54	std::shared_ptr<Enricher> _enricher;
55	std::shared_ptr<Logger> _logger;
56	std::shared_ptr<PrefixTree<Unit>> _prefixTree;
57	}
58
59	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
60	metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
61	logger:(std::shared_ptr<Logger>)logger
62	enricher:(std::shared_ptr<Enricher>)enricher
63	compilerController:(SNTCompilerController *)compilerController
64	authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache
65	prefixTree:(std::shared_ptr<PrefixTree<Unit>>)prefixTree {	×
66	self = [super initWithESAPI:std::move(esApi)	×
67	metrics:std::move(metrics)	×
68	processor:santa::santad::Processor::kRecorder];	×
69	if (self) {	×
70	_enricher = enricher;	×
71	_logger = logger;	×
72	_compilerController = compilerController;	×
73	_authResultCache = authResultCache;	×
74	_prefixTree = prefixTree;	×
75	_configurator = [SNTConfigurator configurator];	×
76
77	[self establishClientOrDie];	×
78	}	×
79	return self;	×
80	}	×
81
82	- (NSString *)description {	×
83	return @"Recorder";	×
84	}	×
85
86	- (void)handleMessage:(Message &&)esMsg
87	recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {	×
88	// Pre-enrichment processing
89	switch (esMsg->event_type) {	×
90	case ES_EVENT_TYPE_NOTIFY_CLOSE: {	×
91	BOOL shouldLogClose = esMsg->event.close.modified;	×
92
93	#if HAVE_MACOS_13
94	if (@available(macOS 13.5, *)) {
95	// As of macSO 13.0 we have a new field for if a file was mmaped with
96	// write permissions on close events. However it did not work until
97	// 13.5.
98	//
99	// If something was mmaped writable it was probably written to. Often
100	// developer tools do this to avoid lots of write syscalls, e.g. go's
101	// tool chain. We log this so the compiler controller can take that into
102	// account.
103	shouldLogClose \|= esMsg->event.close.was_mapped_writable;
104	}
105	#endif
106
107	if (!shouldLogClose) {	×
108	// Ignore unmodified files
109	// Note: Do not record metrics in this case. These are not considered "drops"
110	// because this is not a failure case. Ideally we would tell ES to not send
111	// these events in the first place but no such mechanism currently exists.
112	return;	×
113	}	×
114
115	self->_authResultCache->RemoveFromCache(esMsg->event.close.target);	×
116
117	// Only log file changes that match the given regex
118	NSString *targetPath = santa::common::StringToNSString(esMsg->event.close.target->path.data);	×
119	if (![[self.configurator fileChangesRegex]	×
120	numberOfMatchesInString:targetPath	×
121	options:0	×
122	range:NSMakeRange(0, targetPath.length)]) {	×
123	// Note: Do not record metrics in this case. These are not considered "drops"
124	// because this is not a failure case.
125	// TODO(mlw): Consider changes to configuration that would allow muting paths
126	// to filter on the kernel side rather than in user space.
127	return;	×
128	}	×
129
130	break;	×
131	}	×
132	default: break;	×
133	}	×
134
135	[self.compilerController handleEvent:esMsg withLogger:self->_logger];	×
136
137	// Filter file op events matching the prefix tree.
138	es_file_t targetFile = GetTargetFileForPrefixTree(&(esMsg));	×
139	if (targetFile != NULL && self->_prefixTree->HasPrefix(targetFile->path.data)) {	×
140	recordEventMetrics(EventDisposition::kDropped);	×
141	return;	×
142	}	×
143
144	// Enrich the message inline with the ES handler block to capture enrichment
145	// data as close to the source event as possible.
146	std::unique_ptr<EnrichedMessage> enrichedMessage = _enricher->Enrich(std::move(esMsg));	×
147
148	// Asynchronously log the message
149	[self processEnrichedMessage:std::move(enrichedMessage)	×
150	handler:^(std::unique_ptr<EnrichedMessage> msg) {	×
151	self->_logger->Log(std::move(msg));	×
152	recordEventMetrics(EventDisposition::kProcessed);	×
153	}];	×
154	}	×
155
156	- (void)enable {	×
157	[super subscribe:{	×
158	ES_EVENT_TYPE_NOTIFY_CLOSE,	×
159	ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA,	×
160	ES_EVENT_TYPE_NOTIFY_EXEC,	×
161	ES_EVENT_TYPE_NOTIFY_EXIT,	×
162	ES_EVENT_TYPE_NOTIFY_FORK,	×
163	ES_EVENT_TYPE_NOTIFY_LINK,	×
164	ES_EVENT_TYPE_NOTIFY_RENAME,	×
165	ES_EVENT_TYPE_NOTIFY_UNLINK,	×
166	}];	×
167	}	×
168
169	@end

google / santa / 7106389393

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous