7133605819

Committed 07 Dec 2023 08:23PM UTC coverage: 64.026% (-0.3%) from 64.347%

Build # 7133605819

Build Type

push

github

Committed by

web-flow

Commit Message

Event drop metrics (#1253)

* Add dropped event detection and metrics

* Update metrics test for drop counts

* Comment new interface

Run Details

4394 of 8952 branches covered (0.0%)

Branch coverage included in aggregate %.

84 of 102 new or added lines in 3 files covered. (82.35%)

103 existing lines in 6 files now uncovered.

15274 of 21767 relevant lines covered (70.17%)

13522.6 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

49.81

/Source/santad/EventProviders/SNTEndpointSecurityClient.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"

#include <EndpointSecurity/EndpointSecurity.h>
#include <bsm/libbsm.h>
#include <dispatch/dispatch.h>
#include <mach/mach_time.h>
#include <stdlib.h>
#include <sys/qos.h>

#include <set>
#include <string>
#include <string_view>

#include "Source/common/BranchPrediction.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/SystemResources.h"
#include "Source/santad/DataLayer/WatchItemPolicy.h"
#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventDisposition;
using santa::santad::Metrics;
using santa::santad::Processor;
using santa::santad::data_layer::WatchItemPathType;
using santa::santad::event_providers::endpoint_security::Client;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Message;

constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
                                                "/private/var/db/santa/events.db"};

@interface SNTEndpointSecurityClient ()
@property int64_t deadlineMarginMS;
@property SNTConfigurator *configurator;
@end

@implementation SNTEndpointSecurityClient {
  std::shared_ptr<EndpointSecurityAPI> _esApi;
  std::shared_ptr<Metrics> _metrics;
  Client _esClient;
  dispatch_queue_t _authQueue;
  dispatch_queue_t _notifyQueue;
  Processor _processor;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<Metrics>)metrics
                    processor:(Processor)processor {
  self = [super init];
  if (self) {
    _esApi = std::move(esApi);
    _metrics = std::move(metrics);
    _deadlineMarginMS = 5000;
    _configurator = [SNTConfigurator configurator];
    _processor = processor;

    _authQueue = dispatch_queue_create(
      "com.google.santa.daemon.auth_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_USER_INTERACTIVE, 0));

    _notifyQueue = dispatch_queue_create(
      "com.google.santa.daemon.notify_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_BACKGROUND, 0));
  }
  return self;
}

- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {
  switch (result) {
    case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";
    case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";
    case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";
    case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";
    default: return @"Unknown error";
  }
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {
  // This method should only be used by classes derived
  // from SNTEndpointSecurityClient.
  [self doesNotRecognizeSelector:_cmd];
}

- (BOOL)shouldHandleMessage:(const Message &)esMsg {
  if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {
    if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {
      [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
    }
    return NO;
  }

  return YES;
}

- (void)establishClientOrDie {
  if (self->_esClient.IsConnected()) {
    // This is a programming error
    LOGE(@"Client already established. Aborting.");
    [NSException raise:@"Client already established" format:@"IsConnected already true"];
  }

  self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {
    int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);

    // Update event stats BEFORE calling into the processor class to ensure
    // sequence numbers are processed in order.
    self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());

    es_event_type_t eventType = esMsg->event_type;
    if ([self shouldHandleMessage:esMsg]) {
      [self handleMessage:std::move(esMsg)
        recordEventMetrics:^(EventDisposition disposition) {
          int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
          self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,
                                          processingEnd - processingStart);
        }];
    } else {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,
                                      processingEnd - processingStart);
    }
  });

  if (!self->_esClient.IsConnected()) {
    NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];
    LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);
    [NSException raise:@"Failed to create ES client" format:@"%@", errMsg];
  } else {
    LOGI(@"Connected to EndpointSecurity (%@)", self);
  }

  if (![self muteSelf]) {
    [NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];
  }
}

+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {
  mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;
  if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {
    LOGE(@"Failed to fetch this client's audit token.");
    return false;
  }

  return true;
}

- (bool)muteSelf {
  audit_token_t myAuditToken;
  if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {
    return false;
  }

  if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {
    LOGE(@"Failed to mute this client's process.");
    return false;
  }

  return true;
}

- (bool)clearCache {
  return _esApi->ClearCache(self->_esClient);
}

- (bool)subscribe:(const std::set<es_event_type_t> &)events {
  return _esApi->Subscribe(_esClient, events);
}

- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {
  return [self subscribe:events] && [self clearCache];
}

- (bool)unsubscribeAll {
  return _esApi->UnsubscribeAll(_esClient);
}

- (bool)unmuteAllTargetPaths {
  return _esApi->UnmuteAllTargetPaths(_esClient);
}

- (bool)enableTargetPathWatching {
  [self unmuteAllTargetPaths];
  return _esApi->InvertTargetPathMuting(_esClient);
}

- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)respondToMessage:(const Message &)msg
          withAuthResult:(es_auth_result_t)result
               cacheable:(bool)cacheable {
  if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {
    return _esApi->RespondFlagsResult(
      // For now, Santa is only concerned about alllowing all access or no
      // access, hence the flags being translated here to all or nothing based
      // on the auth result. In the future it might be beneficial to expand the
      // scope of Santa to enforce things like read-only access.
      _esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);
  } else {
    return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);
  }
}

- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
                       handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {
  __block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {
  __block Message msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {
  if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {
    // This is a programming error
    LOGE(@"Attempting to process non-AUTH message");
    [NSException raise:@"Attempt to process non-auth message"
                format:@"Unexpected event type received: %d", msg->event_type];
  }

  dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);
  // Add 1 to the processing semaphore. We're not creating it with a starting
  // value of 1 because that requires that the semaphore is not deallocated
  // until its value matches the starting value, which we don't need.
  dispatch_semaphore_signal(processingSema);
  dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);

  const uint64_t timeout = NSEC_PER_MSEC * (self.deadlineMarginMS);

  uint64_t deadlineNano = MachTimeToNanos(msg->deadline - mach_absolute_time());

  // TODO(mlw): How should we handle `deadlineNano <= timeout`. Will currently
  // result in the deadline block being dispatched immediately (and therefore
  // the event will be denied).

  // Workaround for compiler bug that doesn't properly close over variables
  __block Message processMsg = msg;
  __block Message deadlineMsg = msg;

  dispatch_after(
    dispatch_time(DISPATCH_TIME_NOW, deadlineNano - timeout), self->_authQueue, ^(void) {
      if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
        // Handler has already responded, nothing to do.
        return;
      }

      bool res = [self respondToMessage:deadlineMsg
                         withAuthResult:ES_AUTH_RESULT_DENY
                              cacheable:false];

      LOGE(@"SNTEndpointSecurityClient: deadline reached: deny pid=%d, event type: %d ret=%d",
           audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type, res);
      dispatch_semaphore_signal(deadlineExpiredSema);
    });

  dispatch_async(self->_authQueue, ^{
    messageHandler(processMsg);
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Deadline expired, wait for deadline block to finish.
      dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);
    }
  });
}

+ (std::set<std::string>)getProtectedPaths {
  std::set<std::string> protectedPathsCopy;

  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    protectedPathsCopy.insert(std::string(kProtectedFiles[i]));
  }

  return protectedPathsCopy;
}

+ (bool)isProtectedPath:(const std::string_view)path {
  // TODO(mlw): These values should come from `SNTDatabaseController`. But right
  // now they live as NSStrings. We should make them `std::string_view` types
  // in order to use them here efficiently, but will need to make the
  // `SNTDatabaseController` an ObjC++ file.
  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    if (path == kProtectedFiles[i]) {
      return true;
    }
  }

  return false;
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18	#include <bsm/libbsm.h>
19	#include <dispatch/dispatch.h>
20	#include <mach/mach_time.h>
21	#include <stdlib.h>
22	#include <sys/qos.h>
23
24	#include <set>
25	#include <string>
26	#include <string_view>
27
28	#include "Source/common/BranchPrediction.h"
29	#import "Source/common/SNTConfigurator.h"
30	#import "Source/common/SNTLogging.h"
31	#include "Source/common/SystemResources.h"
32	#include "Source/santad/DataLayer/WatchItemPolicy.h"
33	#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
34	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
35	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
36	#include "Source/santad/Metrics.h"
37
38	using santa::santad::EventDisposition;
39	using santa::santad::Metrics;
40	using santa::santad::Processor;
41	using santa::santad::data_layer::WatchItemPathType;
42	using santa::santad::event_providers::endpoint_security::Client;
43	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
44	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
45	using santa::santad::event_providers::endpoint_security::Message;
46
47	constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
48	"/private/var/db/santa/events.db"};
49
50	@interface SNTEndpointSecurityClient ()
51	@property int64_t deadlineMarginMS;
52	@property SNTConfigurator *configurator;
53	@end
54
55	@implementation SNTEndpointSecurityClient {
56	std::shared_ptr<EndpointSecurityAPI> _esApi;
57	std::shared_ptr<Metrics> _metrics;
58	Client _esClient;
59	dispatch_queue_t _authQueue;
60	dispatch_queue_t _notifyQueue;
61	Processor _processor;
62	}
63
64	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
65	metrics:(std::shared_ptr<Metrics>)metrics
66	processor:(Processor)processor {	39✔
67	self = [super init];	39✔
68	if (self) {	39!
69	_esApi = std::move(esApi);	39✔
70	_metrics = std::move(metrics);	39✔
71	_deadlineMarginMS = 5000;	39✔
72	_configurator = [SNTConfigurator configurator];	39✔
73	_processor = processor;	39✔
74
75	_authQueue = dispatch_queue_create(	39✔
76	"com.google.santa.daemon.auth_queue",	39✔
77	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	39✔
78	QOS_CLASS_USER_INTERACTIVE, 0));	39✔
79
80	_notifyQueue = dispatch_queue_create(	39✔
81	"com.google.santa.daemon.notify_queue",	39✔
82	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	39✔
83	QOS_CLASS_BACKGROUND, 0));	39✔
84	}	39✔
85	return self;	39✔
86	}	39✔
87
88	- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {	×
89	switch (result) {	×
90	case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;	×
91	case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";	×
92	case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";	×
93	case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";	×
94	case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";	×
95	case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";	×
96	case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";	×
97	default: return @"Unknown error";	×
98	}	×
99	}	×
100
101	- (void)handleMessage:(Message &&)esMsg
102	recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {	×
103	// This method should only be used by classes derived
104	// from SNTEndpointSecurityClient.
105	[self doesNotRecognizeSelector:_cmd];	×
106	}	×
107
108	- (BOOL)shouldHandleMessage:(const Message &)esMsg {	×
109	if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {	×
110	if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {	×
111	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	×
112	}	×
113	return NO;	×
114	}	×
115
116	return YES;	×
117	}	×
118
119	- (void)establishClientOrDie {	36✔
120	if (self->_esClient.IsConnected()) {	36!
121	// This is a programming error
122	LOGE(@"Client already established. Aborting.");	×
123	[NSException raise:@"Client already established" format:@"IsConnected already true"];	×
124	}	×
125
126	self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {	×
127	int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
128
129	// Update event stats BEFORE calling into the processor class to ensure
130	// sequence numbers are processed in order.
NEW 131	self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());	×
132
133	es_event_type_t eventType = esMsg->event_type;	×
134	if ([self shouldHandleMessage:esMsg]) {	×
135	[self handleMessage:std::move(esMsg)	×
136	recordEventMetrics:^(EventDisposition disposition) {	×
137	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
138	self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,	×
139	processingEnd - processingStart);	×
140	}];	×
141	} else {	×
142	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
143	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,	×
144	processingEnd - processingStart);	×
145	}	×
146	});	×
147
148	if (!self->_esClient.IsConnected()) {	36!
149	NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];	×
150	LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);	×
151	[NSException raise:@"Failed to create ES client" format:@"%@", errMsg];	×
152	} else {	36✔
153	LOGI(@"Connected to EndpointSecurity (%@)", self);	36✔
154	}	36✔
155
156	if (![self muteSelf]) {	36!
157	[NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];	×
158	}	×
159	}	36✔
160
161	+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {	36✔
162	mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;	36✔
163	if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {	36!
164	LOGE(@"Failed to fetch this client's audit token.");	×
165	return false;	×
166	}	×
167
168	return true;	36✔
169	}	36✔
170
171	- (bool)muteSelf {	36✔
172	audit_token_t myAuditToken;	36✔
173	if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {	36!
174	return false;	×
175	}	×
176
177	if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {	36!
178	LOGE(@"Failed to mute this client's process.");	×
179	return false;	×
180	}	×
181
182	return true;	36✔
183	}	36✔
184
185	- (bool)clearCache {	3✔
186	return _esApi->ClearCache(self->_esClient);	3✔
187	}	3✔
188
189	- (bool)subscribe:(const std::set<es_event_type_t> &)events {	4✔
190	return _esApi->Subscribe(_esClient, events);	4✔
191	}	4✔
192
193	- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {	2✔
194	return [self subscribe:events] && [self clearCache];	2!
195	}	2✔
196
197	- (bool)unsubscribeAll {	1✔
198	return _esApi->UnsubscribeAll(_esClient);	1✔
199	}	1✔
200
201	- (bool)unmuteAllTargetPaths {	7✔
202	return _esApi->UnmuteAllTargetPaths(_esClient);	7✔
203	}	7✔
204
205	- (bool)enableTargetPathWatching {	6✔
206	[self unmuteAllTargetPaths];	6✔
207	return _esApi->InvertTargetPathMuting(_esClient);	6✔
208	}	6✔
209
210	- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	1✔
211	bool result = true;	1✔
212	for (const auto &pathAndTypePair : paths) {	2✔
213	result =	2✔
214	_esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	2!
215	}	2✔
216	return result;	1✔
217	}	1✔
218
219	- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	×
220	bool result = true;	×
221	for (const auto &pathAndTypePair : paths) {	×
222	result =	×
223	_esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	×
224	}	×
225	return result;	×
226	}	×
227
228	- (bool)respondToMessage:(const Message &)msg
229	withAuthResult:(es_auth_result_t)result
230	cacheable:(bool)cacheable {	20✔
231	if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {	20!
232	return _esApi->RespondFlagsResult(	×
233	// For now, Santa is only concerned about alllowing all access or no
234	// access, hence the flags being translated here to all or nothing based
235	// on the auth result. In the future it might be beneficial to expand the
236	// scope of Santa to enforce things like read-only access.
237	_esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);	×
238	} else {	20✔
239	return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);	20✔
240	}	20✔
241	}	20✔
242
243	- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
244	handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {	1✔
245	__block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);	1✔
246	dispatch_async(_notifyQueue, ^{	1✔
247	messageHandler(std::move(msgTmp));	1✔
248	});	1✔
249	}	1✔
250
251	- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {	×
252	__block Message msgTmp = std::move(msg);	×
253	dispatch_async(_notifyQueue, ^{	×
254	messageHandler(std::move(msgTmp));	×
255	});	×
256	}	×
257
258	- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {	21✔
259	if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {	21!
260	// This is a programming error
261	LOGE(@"Attempting to process non-AUTH message");	×
262	[NSException raise:@"Attempt to process non-auth message"	×
263	format:@"Unexpected event type received: %d", msg->event_type];	×
264	}	×
265
266	dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);	21✔
267	// Add 1 to the processing semaphore. We're not creating it with a starting
268	// value of 1 because that requires that the semaphore is not deallocated
269	// until its value matches the starting value, which we don't need.
270	dispatch_semaphore_signal(processingSema);	21✔
271	dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);	21✔
272
273	const uint64_t timeout = NSEC_PER_MSEC * (self.deadlineMarginMS);	21✔
274
275	uint64_t deadlineNano = MachTimeToNanos(msg->deadline - mach_absolute_time());	21✔
276
277	// TODO(mlw): How should we handle `deadlineNano <= timeout`. Will currently
278	// result in the deadline block being dispatched immediately (and therefore
279	// the event will be denied).
280
281	// Workaround for compiler bug that doesn't properly close over variables
282	__block Message processMsg = msg;	21✔
283	__block Message deadlineMsg = msg;	21✔
284
285	dispatch_after(	21✔
286	dispatch_time(DISPATCH_TIME_NOW, deadlineNano - timeout), self->_authQueue, ^(void) {	20✔
287	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	20!
288	// Handler has already responded, nothing to do.
289	return;	20✔
290	}	20✔
291
292	bool res = [self respondToMessage:deadlineMsg	×
293	withAuthResult:ES_AUTH_RESULT_DENY	×
294	cacheable:false];	×
295
296	LOGE(@"SNTEndpointSecurityClient: deadline reached: deny pid=%d, event type: %d ret=%d",	×
297	audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type, res);	×
298	dispatch_semaphore_signal(deadlineExpiredSema);	×
299	});	×
300
301	dispatch_async(self->_authQueue, ^{	21✔
302	messageHandler(processMsg);	21✔
303	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	21!
304	// Deadline expired, wait for deadline block to finish.
305	dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);	×
306	}	×
307	});	21✔
308	}	21✔
309
310	+ (std::set<std::string>)getProtectedPaths {	1✔
311	std::set<std::string> protectedPathsCopy;	1✔
312
313	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	3✔
314	protectedPathsCopy.insert(std::string(kProtectedFiles[i]));	2✔
315	}	2✔
316
317	return protectedPathsCopy;	1✔
318	}	1✔
319
320	+ (bool)isProtectedPath:(const std::string_view)path {	12✔
321	// TODO(mlw): These values should come from `SNTDatabaseController`. But right
322	// now they live as NSStrings. We should make them `std::string_view` types
323	// in order to use them here efficiently, but will need to make the
324	// `SNTDatabaseController` an ObjC++ file.
325	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	27✔
326	if (path == kProtectedFiles[i]) {	21✔
327	return true;	6✔
328	}	6✔
329	}	21✔
330
331	return false;	6✔
332	}	12✔
333
334	@end

google / santa / 7133605819

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous