7108075696

Committed 05 Dec 2023 11:50PM UTC coverage: 64.455% (+1.1%) from 63.345%

Build # 7108075696

Build Type

Pull #1250

github

Committed by

web-flow

Commit Message

Merge 3529f2c52 into 2cbf15566

Pull Request Pull Request #1250: Initial support for some scoped types

Run Details

4384 of 8910 branches covered (0.0%)

Branch coverage included in aggregate %.

142 of 144 new or added lines in 5 files covered. (98.61%)

2 existing lines in 1 file now uncovered.

15345 of 21699 relevant lines covered (70.72%)

13637.14 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

65.91

/Source/santad/SNTCompilerController.mm

/// Copyright 2017-2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTCompilerController.h"

#include <bsm/libbsm.h>
#include <mach/message.h>
#include <os/base.h>
#include <string.h>

#include <atomic>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#import "Source/santad/SNTDatabaseController.h"
#import "Source/santad/SNTDecisionCache.h"

using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

static const pid_t PID_MAX = 99999;
static constexpr std::string_view kIgnoredCompilerProcessPathPrefix = "/dev/";

@interface SNTCompilerController () {
  std::atomic<bool> _compilerPIDs[PID_MAX];
}
@end

@implementation SNTCompilerController

- (BOOL)isCompiler:(const audit_token_t &)tok {
  pid_t pid = audit_token_to_pid(tok);
  return pid >= 0 && pid < PID_MAX && self->_compilerPIDs[pid].load();
}

- (void)setProcess:(const audit_token_t &)tok isCompiler:(bool)isCompiler {
  pid_t pid = audit_token_to_pid(tok);
  if (pid < 1) {
    LOGE(@"Unable to watch compiler pid=%d", pid);
  } else if (pid >= PID_MAX) {
    LOGE(@"Unable to watch compiler pid=%d >= PID_MAX(%d)", pid, PID_MAX);
  } else {
    self->_compilerPIDs[pid].store(isCompiler);
    if (isCompiler) {
      LOGD(@"Watching compiler pid=%d", pid);
    }
  }
}

// Adds a fake cached decision to SNTDecisionCache for pending files. If the file
// is executed before we can create a transitive rule for it, then we can at
// least log the pending decision info.
- (void)saveFakeDecision:(const es_file_t *)esFile {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:esFile];
  cd.decision = SNTEventStateAllowPendingTransitive;
  cd.sha256 = @"pending";
  [[SNTDecisionCache sharedCache] cacheDecision:cd];
}

- (void)removeFakeDecision:(const es_file_t *)esFile {
  [[SNTDecisionCache sharedCache] forgetCachedDecisionForFile:esFile->stat];
}

- (BOOL)handleEvent:(const Message &)esMsg withLogger:(std::shared_ptr<Logger>)logger {
  const es_file_t *targetFile = NULL;

  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
      if (![self isCompiler:esMsg->process->audit_token]) {
        return NO;
      }

      if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.close.target->path.data,
                  kIgnoredCompilerProcessPathPrefix.length()) == 0) {
        return NO;
      }

      targetFile = esMsg->event.close.target;

      break;
    case ES_EVENT_TYPE_NOTIFY_RENAME:
      if (![self isCompiler:esMsg->process->audit_token]) {
        return NO;
      }

      // Note: For RENAME events, we process the `source`. This is the one
      // that we sould be creating transitive rules for, not the destination.
      if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.rename.source->path.data,
                  kIgnoredCompilerProcessPathPrefix.length()) == 0) {
        return NO;
      }

      targetFile = esMsg->event.rename.source;

      break;
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      [self setProcess:esMsg->process->audit_token isCompiler:false];
      return YES;
    default: return NO;
  }

  // If we get here, we need to update transitve rules
  if (targetFile) {
    [self createTransitiveRule:esMsg target:targetFile logger:logger];
    return YES;
  } else {
    return NO;
  }
}

// Assume that this method is called only when we already know that the writing process is a
// compiler.  It checks if the closed file is executable, and if so, transitively allowlists it.
// The passed in message contains the pid of the writing process and path of closed file.
- (void)createTransitiveRule:(const Message &)esMsg
                      target:(const es_file_t *)targetFile
                      logger:(std::shared_ptr<Logger>)logger {
  NSError *error = nil;
  SNTFileInfo *fi = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetFile error:&error];
  if (error) {
    LOGD(@"Unable to create SNTFileInfo while attempting to create transitive rule. Event: %d | "
         @"Path: %@ | Error: %@",
         (int)esMsg->event_type, @(targetFile->path.data), error);
    return;
  }

  [self saveFakeDecision:targetFile];

  // Check if this file is an executable.
  if (fi.isExecutable) {
    // Check if there is an existing (non-transitive) rule for this file.  We leave existing rules
    // alone, so that a allowlist or blocklist rule can't be overwritten by a transitive one.
    SNTRuleTable *ruleTable = [SNTDatabaseController ruleTable];
    SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256
                                             signingID:nil
                                     certificateSHA256:nil
                                                teamID:nil];
    if (!prevRule || prevRule.state == SNTRuleStateAllowTransitive) {
      // Construct a new transitive allowlist rule for the executable.
      SNTRule *rule = [[SNTRule alloc] initWithIdentifier:fi.SHA256
                                                    state:SNTRuleStateAllowTransitive
                                                     type:SNTRuleTypeBinary
                                                customMsg:@""];

      // Add the new rule to the rules database.
      NSError *err;
      if (![ruleTable addRules:@[ rule ] cleanSlate:NO error:&err]) {
        LOGE(@"unable to add new transitive rule to database: %@", err.localizedDescription);
      } else {
        logger->LogAllowlist(esMsg, [fi.SHA256 UTF8String]);
      }
    }
  }

  [self removeFakeDecision:targetFile];
}

@end

1	/// Copyright 2017-2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTCompilerController.h"
16
17	#include <bsm/libbsm.h>
18	#include <mach/message.h>
19	#include <os/base.h>
20	#include <string.h>
21
22	#include <atomic>
23
24	#import "Source/common/SNTCachedDecision.h"
25	#import "Source/common/SNTCommonEnums.h"
26	#import "Source/common/SNTFileInfo.h"
27	#import "Source/common/SNTLogging.h"
28	#import "Source/common/SNTRule.h"
29	#import "Source/santad/DataLayer/SNTRuleTable.h"
30	#import "Source/santad/SNTDatabaseController.h"
31	#import "Source/santad/SNTDecisionCache.h"
32
33	using santa::santad::event_providers::endpoint_security::Message;
34	using santa::santad::logs::endpoint_security::Logger;
35
36	static const pid_t PID_MAX = 99999;
37	static constexpr std::string_view kIgnoredCompilerProcessPathPrefix = "/dev/";
38
39	@interface SNTCompilerController () {
40	std::atomic<bool> _compilerPIDs[PID_MAX];
41	}
42	@end
43
44	@implementation SNTCompilerController
45
46	- (BOOL)isCompiler:(const audit_token_t &)tok {	19✔
47	pid_t pid = audit_token_to_pid(tok);	19✔
48	return pid >= 0 && pid < PID_MAX && self->_compilerPIDs[pid].load();	19✔
49	}	19✔
50
51	- (void)setProcess:(const audit_token_t &)tok isCompiler:(bool)isCompiler {	8✔
52	pid_t pid = audit_token_to_pid(tok);	8✔
53	if (pid < 1) {	8✔
54	LOGE(@"Unable to watch compiler pid=%d", pid);	1✔
55	} else if (pid >= PID_MAX) {	7✔
56	LOGE(@"Unable to watch compiler pid=%d >= PID_MAX(%d)", pid, PID_MAX);	1✔
57	} else {	6✔
58	self->_compilerPIDs[pid].store(isCompiler);	6✔
59	if (isCompiler) {	6✔
60	LOGD(@"Watching compiler pid=%d", pid);	4✔
61	}	4✔
62	}	6✔
63	}	8✔
64
65	// Adds a fake cached decision to SNTDecisionCache for pending files. If the file
66	// is executed before we can create a transitive rule for it, then we can at
67	// least log the pending decision info.
68	- (void)saveFakeDecision:(const es_file_t *)esFile {	1✔
69	SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:esFile];	1✔
70	cd.decision = SNTEventStateAllowPendingTransitive;	1✔
71	cd.sha256 = @"pending";	1✔
72	[[SNTDecisionCache sharedCache] cacheDecision:cd];	1✔
73	}	1✔
74
75	- (void)removeFakeDecision:(const es_file_t *)esFile {	1✔
76	[[SNTDecisionCache sharedCache] forgetCachedDecisionForFile:esFile->stat];	1✔
77	}	1✔
78
79	- (BOOL)handleEvent:(const Message &)esMsg withLogger:(std::shared_ptr<Logger>)logger {	8✔
80	const es_file_t *targetFile = NULL;	8✔
81
82	switch (esMsg->event_type) {	8✔
83	case ES_EVENT_TYPE_NOTIFY_CLOSE:	3✔
84	if (![self isCompiler:esMsg->process->audit_token]) {	3✔
85	return NO;	1✔
86	}	1✔
87
88	if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.close.target->path.data,	2✔
89	kIgnoredCompilerProcessPathPrefix.length()) == 0) {	1✔
90	return NO;	1✔
91	}	1✔
92
93	targetFile = esMsg->event.close.target;	1✔
94
95	break;	1✔
96	case ES_EVENT_TYPE_NOTIFY_RENAME:	3✔
97	if (![self isCompiler:esMsg->process->audit_token]) {	3✔
98	return NO;	1✔
99	}	1✔
100
101	// Note: For RENAME events, we process the `source`. This is the one
102	// that we sould be creating transitive rules for, not the destination.
103	if (strncmp(kIgnoredCompilerProcessPathPrefix.data(), esMsg->event.rename.source->path.data,	2✔
104	kIgnoredCompilerProcessPathPrefix.length()) == 0) {	1✔
105	return NO;	1✔
106	}	1✔
107
108	targetFile = esMsg->event.rename.source;	1✔
109
110	break;	1✔
111	case ES_EVENT_TYPE_NOTIFY_EXIT:	1✔
112	[self setProcess:esMsg->process->audit_token isCompiler:false];	1✔
113	return YES;	1✔
114	default: return NO;	1✔
115	}	2✔
116
117	// If we get here, we need to update transitve rules
118	if (targetFile) {	2!
119	[self createTransitiveRule:esMsg target:targetFile logger:logger];	2✔
120	return YES;	2✔
121	} else {	×
122	return NO;	×
123	}	×
124	}	2✔
125
126	// Assume that this method is called only when we already know that the writing process is a
127	// compiler. It checks if the closed file is executable, and if so, transitively allowlists it.
128	// The passed in message contains the pid of the writing process and path of closed file.
129	- (void)createTransitiveRule:(const Message &)esMsg
130	target:(const es_file_t *)targetFile
131	logger:(std::shared_ptr<Logger>)logger {	×
132	NSError *error = nil;	×
133	SNTFileInfo *fi = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetFile error:&error];	×
134	if (error) {	×
NEW 135	LOGD(@"Unable to create SNTFileInfo while attempting to create transitive rule. Event: %d \| "	×
NEW 136	@"Path: %@ \| Error: %@",	×
137	(int)esMsg->event_type, @(targetFile->path.data), error);	×
138	return;	×
139	}	×
140
141	[self saveFakeDecision:targetFile];	×
142
143	// Check if this file is an executable.
144	if (fi.isExecutable) {	×
145	// Check if there is an existing (non-transitive) rule for this file. We leave existing rules
146	// alone, so that a allowlist or blocklist rule can't be overwritten by a transitive one.
147	SNTRuleTable *ruleTable = [SNTDatabaseController ruleTable];	×
148	SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256	×
149	signingID:nil	×
150	certificateSHA256:nil	×
151	teamID:nil];	×
152	if (!prevRule \|\| prevRule.state == SNTRuleStateAllowTransitive) {	×
153	// Construct a new transitive allowlist rule for the executable.
154	SNTRule *rule = [[SNTRule alloc] initWithIdentifier:fi.SHA256	×
155	state:SNTRuleStateAllowTransitive	×
156	type:SNTRuleTypeBinary	×
157	customMsg:@""];	×
158
159	// Add the new rule to the rules database.
160	NSError *err;	×
161	if (![ruleTable addRules:@[ rule ] cleanSlate:NO error:&err]) {	×
162	LOGE(@"unable to add new transitive rule to database: %@", err.localizedDescription);	×
163	} else {	×
164	logger->LogAllowlist(esMsg, [fi.SHA256 UTF8String]);	×
165	}	×
166	}	×
167	}	×
168
169	[self removeFakeDecision:targetFile];	×
170	}	×
171
172	@end

google / santa / 7108075696

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous