7265502009

Committed 19 Dec 2023 05:37PM UTC coverage: 64.096% (+0.2%) from 63.858%

Build # 7265502009

Build Type

Pull #1236

github

Committed by

web-flow

Commit Message

Merge 36ab25c8a into f8a20d35b

Pull Request Pull Request #1236: ProcessTree: add core process tree logic (1/4)

Run Details

4458 of 9088 branches covered (0.0%)

Branch coverage included in aggregate %.

267 of 348 new or added lines in 7 files covered. (76.72%)

171 existing lines in 7 files now uncovered.

15547 of 22123 relevant lines covered (70.28%)

17415.9 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

87.72

/Source/santad/ProcessTree/process_tree_test.mm

/// Copyright 2023 Google LLC
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     https://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
#import <Foundation/Foundation.h>
#import <XCTest/XCTest.h>

#include <bsm/libbsm.h>

#include <memory>
#include <string>

#include "Source/santad/ProcessTree/annotations/annotator.h"
#include "Source/santad/ProcessTree/process.h"
#include "Source/santad/ProcessTree/process_tree_test_helpers.h"
#include "absl/synchronization/mutex.h"

namespace ptpb = ::santa::pb::v1::process_tree;

namespace santa::santad::process_tree {

static constexpr std::string_view kAnnotatedExecutable = "/usr/bin/login";

class TestAnnotator : public Annotator {
 public:
  TestAnnotator() {}
  void AnnotateFork(ProcessTree &tree, const Process &parent, const Process &child) override;
  void AnnotateExec(ProcessTree &tree, const Process &orig_process,
                    const Process &new_process) override;
  std::optional<::ptpb::Annotations> Proto() const override;
};

void TestAnnotator::AnnotateFork(ProcessTree &tree, const Process &parent, const Process &child) {
  // "Base case". Propagate existing annotations down to descendants.
  if (auto annotation = tree.GetAnnotation<TestAnnotator>(parent)) {
    tree.AnnotateProcess(child, std::move(*annotation));
  }
}

void TestAnnotator::AnnotateExec(ProcessTree &tree, const Process &orig_process,
                                 const Process &new_process) {
  if (auto annotation = tree.GetAnnotation<TestAnnotator>(orig_process)) {
    tree.AnnotateProcess(new_process, std::move(*annotation));
    return;
  }

  if (new_process.program_->executable == kAnnotatedExecutable) {
    tree.AnnotateProcess(new_process, std::make_shared<TestAnnotator>());
  }
}

std::optional<::ptpb::Annotations> TestAnnotator::Proto() const {
  return std::nullopt;
}
}  // namespace santa::santad::process_tree

using namespace santa::santad::process_tree;

@interface ProcessTreeTest : XCTestCase
@property std::shared_ptr<ProcessTreeTestPeer> tree;
@property std::shared_ptr<const Process> init_proc;
@end

@implementation ProcessTreeTest

- (void)setUp {
  std::vector<std::unique_ptr<Annotator>> annotators{};
  self.tree = std::make_shared<ProcessTreeTestPeer>(std::move(annotators));
  self.init_proc = self.tree->InsertInit();
}

- (void)testSimpleOps {
  uint64_t event_id = 1;
  // PID 1.1: fork() -> PID 2.2
  const struct Pid child_pid = {.pid = 2, .pidversion = 2};
  self.tree->HandleFork(event_id++, *self.init_proc, child_pid);

  auto child_opt = self.tree->Get(child_pid);
  XCTAssertTrue(child_opt.has_value());
  std::shared_ptr<const Process> child = *child_opt;
  XCTAssertEqual(child->pid_, child_pid);
  XCTAssertEqual(child->program_, self.init_proc->program_);
  XCTAssertEqual(child->effective_cred_, self.init_proc->effective_cred_);
  XCTAssertEqual(self.tree->GetParent(*child), self.init_proc);

  // PID 2.2: exec("/bin/bash") -> PID 2.3
  const struct Pid child_exec_pid = {.pid = 2, .pidversion = 3};
  const struct Program child_exec_prog = {.executable = "/bin/bash",
                                          .arguments = {"/bin/bash", "-i"}};
  self.tree->HandleExec(event_id++, *child, child_exec_pid, child_exec_prog,
                        child->effective_cred_);

  child_opt = self.tree->Get(child_exec_pid);
  XCTAssertTrue(child_opt.has_value());
  child = *child_opt;
  XCTAssertEqual(child->pid_, child_exec_pid);
  XCTAssertEqual(*child->program_, child_exec_prog);
  XCTAssertEqual(child->effective_cred_, self.init_proc->effective_cred_);
}

- (void)testAnnotation {
  std::vector<std::unique_ptr<Annotator>> annotators{};
  annotators.emplace_back(std::make_unique<TestAnnotator>());
  self.tree = std::make_shared<ProcessTreeTestPeer>(std::move(annotators));
  self.init_proc = self.tree->InsertInit();

  uint64_t event_id = 1;
  const struct Cred cred = {.uid = 0, .gid = 0};

  // PID 1.1: fork() -> PID 2.2
  const struct Pid login_pid = {.pid = 2, .pidversion = 2};
  self.tree->HandleFork(event_id++, *self.init_proc, login_pid);

  // PID 2.2: exec("/usr/bin/login") -> PID 2.3
  const struct Pid login_exec_pid = {.pid = 2, .pidversion = 3};
  const struct Program login_prog = {.executable = std::string(kAnnotatedExecutable),
                                     .arguments = {}};
  auto login = *self.tree->Get(login_pid);
  self.tree->HandleExec(event_id++, *login, login_exec_pid, login_prog, cred);

  // Ensure we have an annotation on login itself...
  login = *self.tree->Get(login_exec_pid);
  auto annotation = self.tree->GetAnnotation<TestAnnotator>(*login);
  XCTAssertTrue(annotation.has_value());

  // PID 2.3: fork() -> PID 3.3
  const struct Pid shell_pid = {.pid = 3, .pidversion = 3};
  self.tree->HandleFork(event_id++, *login, shell_pid);
  // PID 3.3: exec("/bin/zsh") -> PID 3.4
  const struct Pid shell_exec_pid = {.pid = 3, .pidversion = 4};
  const struct Program shell_prog = {.executable = "/bin/zsh", .arguments = {}};
  auto shell = *self.tree->Get(shell_pid);
  self.tree->HandleExec(event_id++, *shell, shell_exec_pid, shell_prog, cred);

  // ... and also ensure we have an annotation on the descendant zsh.
  shell = *self.tree->Get(shell_exec_pid);
  annotation = self.tree->GetAnnotation<TestAnnotator>(*shell);
  XCTAssertTrue(annotation.has_value());
}

- (void)testCleanup {
  uint64_t event_id = 1;
  const struct Pid child_pid = {.pid = 2, .pidversion = 2};
  {
    self.tree->HandleFork(event_id++, *self.init_proc, child_pid);
    auto child = *self.tree->Get(child_pid);
    self.tree->HandleExit(event_id++, *child);
  }

  // We should still be able to get a handle to child...
  {
    auto child = self.tree->Get(child_pid);
    XCTAssertTrue(child.has_value());
  }

  // ... until we step far enough into the future (32 events).
  struct Pid churn_pid = {.pid = 3, .pidversion = 3};
  for (int i = 0; i < 32; i++) {
    self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);
    churn_pid.pid++;
  }

  // Now when we try processing the next event, it should have fallen out of the tree.
  self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);
  {
    auto child = self.tree->Get(child_pid);
    XCTAssertFalse(child.has_value());
  }
}

- (void)testRefcountCleanup {
  uint64_t event_id = 1;
  const struct Pid child_pid = {.pid = 2, .pidversion = 2};
  {
    self.tree->HandleFork(event_id++, *self.init_proc, child_pid);
    auto child = *self.tree->Get(child_pid);
    self.tree->HandleExit(event_id++, *child);
  }

  {
    auto child = self.tree->Get(child_pid);
    XCTAssertTrue(child.has_value());
    std::vector<struct Pid> pids = {(*child)->pid_};
    self.tree->RetainProcess(pids);
  }

  // Even if we step far into the future, we should still be able to lookup
  // the child.
  for (int i = 0; i < 1000; i++) {
    struct Pid churn_pid = {.pid = 100 + i, .pidversion = (uint64_t)(100 + i)};
    self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);
    auto child = self.tree->Get(child_pid);
    XCTAssertTrue(child.has_value());
  }

  // But when released...
  {
    auto child = self.tree->Get(child_pid);
    XCTAssertTrue(child.has_value());
    std::vector<struct Pid> pids = {(*child)->pid_};
    self.tree->ReleaseProcess(pids);
  }

  // ... it should immediately be removed.
  {
    auto child = self.tree->Get(child_pid);
    XCTAssertFalse(child.has_value());
  }
}

@end

1	/// Copyright 2023 Google LLC
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// https://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14	#import <Foundation/Foundation.h>
15	#import <XCTest/XCTest.h>
16
17	#include <bsm/libbsm.h>
18
19	#include <memory>
20	#include <string>
21
22	#include "Source/santad/ProcessTree/annotations/annotator.h"
23	#include "Source/santad/ProcessTree/process.h"
24	#include "Source/santad/ProcessTree/process_tree_test_helpers.h"
25	#include "absl/synchronization/mutex.h"
26
27	namespace ptpb = ::santa::pb::v1::process_tree;
28
29	namespace santa::santad::process_tree {
30
31	static constexpr std::string_view kAnnotatedExecutable = "/usr/bin/login";
32
33	class TestAnnotator : public Annotator {
34	public:
35	TestAnnotator() {}	2✔
36	void AnnotateFork(ProcessTree &tree, const Process &parent, const Process &child) override;
37	void AnnotateExec(ProcessTree &tree, const Process &orig_process,
38	const Process &new_process) override;
39	std::optional<::ptpb::Annotations> Proto() const override;
40	};
41
42	void TestAnnotator::AnnotateFork(ProcessTree &tree, const Process &parent, const Process &child) {	2✔
43	// "Base case". Propagate existing annotations down to descendants.
44	if (auto annotation = tree.GetAnnotation<TestAnnotator>(parent)) {	2✔
45	tree.AnnotateProcess(child, std::move(*annotation));	1✔
46	}	1✔
47	}	2✔
48
49	void TestAnnotator::AnnotateExec(ProcessTree &tree, const Process &orig_process,
50	const Process &new_process) {	2✔
51	if (auto annotation = tree.GetAnnotation<TestAnnotator>(orig_process)) {	2✔
52	tree.AnnotateProcess(new_process, std::move(*annotation));	1✔
53	return;	1✔
54	}	1✔
55
56	if (new_process.program_->executable == kAnnotatedExecutable) {	1!
57	tree.AnnotateProcess(new_process, std::make_shared<TestAnnotator>());	1✔
58	}	1✔
59	}	1✔
60
NEW 61	std::optional<::ptpb::Annotations> TestAnnotator::Proto() const {	×
NEW 62	return std::nullopt;	×
NEW 63	}	×
64	} // namespace santa::santad::process_tree
65
66	using namespace santa::santad::process_tree;
67
68	@interface ProcessTreeTest : XCTestCase
69	@property std::shared_ptr<ProcessTreeTestPeer> tree;
70	@property std::shared_ptr<const Process> init_proc;
71	@end
72
73	@implementation ProcessTreeTest
74
75	- (void)setUp {	4✔
76	std::vector<std::unique_ptr<Annotator>> annotators{};	4✔
77	self.tree = std::make_shared<ProcessTreeTestPeer>(std::move(annotators));	4✔
78	self.init_proc = self.tree->InsertInit();	4✔
79	}	4✔
80
81	- (void)testSimpleOps {	1✔
82	uint64_t event_id = 1;	1✔
83	// PID 1.1: fork() -> PID 2.2
84	const struct Pid child_pid = {.pid = 2, .pidversion = 2};	1✔
85	self.tree->HandleFork(event_id++, *self.init_proc, child_pid);	1✔
86
87	auto child_opt = self.tree->Get(child_pid);	1✔
88	XCTAssertTrue(child_opt.has_value());	1!
89	std::shared_ptr<const Process> child = *child_opt;	1✔
90	XCTAssertEqual(child->pid_, child_pid);	1!
91	XCTAssertEqual(child->program_, self.init_proc->program_);	1!
92	XCTAssertEqual(child->effective_cred_, self.init_proc->effective_cred_);	1!
93	XCTAssertEqual(self.tree->GetParent(*child), self.init_proc);	1!
94
95	// PID 2.2: exec("/bin/bash") -> PID 2.3
96	const struct Pid child_exec_pid = {.pid = 2, .pidversion = 3};	1✔
97	const struct Program child_exec_prog = {.executable = "/bin/bash",	1✔
98	.arguments = {"/bin/bash", "-i"}};	1✔
99	self.tree->HandleExec(event_id++, *child, child_exec_pid, child_exec_prog,	1✔
100	child->effective_cred_);	1✔
101
102	child_opt = self.tree->Get(child_exec_pid);	1✔
103	XCTAssertTrue(child_opt.has_value());	1!
104	child = *child_opt;	1✔
105	XCTAssertEqual(child->pid_, child_exec_pid);	1!
106	XCTAssertEqual(*child->program_, child_exec_prog);	1!
107	XCTAssertEqual(child->effective_cred_, self.init_proc->effective_cred_);	1!
108	}	1✔
109
110	- (void)testAnnotation {	1✔
111	std::vector<std::unique_ptr<Annotator>> annotators{};	1✔
112	annotators.emplace_back(std::make_unique<TestAnnotator>());	1✔
113	self.tree = std::make_shared<ProcessTreeTestPeer>(std::move(annotators));	1✔
114	self.init_proc = self.tree->InsertInit();	1✔
115
116	uint64_t event_id = 1;	1✔
117	const struct Cred cred = {.uid = 0, .gid = 0};	1✔
118
119	// PID 1.1: fork() -> PID 2.2
120	const struct Pid login_pid = {.pid = 2, .pidversion = 2};	1✔
121	self.tree->HandleFork(event_id++, *self.init_proc, login_pid);	1✔
122
123	// PID 2.2: exec("/usr/bin/login") -> PID 2.3
124	const struct Pid login_exec_pid = {.pid = 2, .pidversion = 3};	1✔
125	const struct Program login_prog = {.executable = std::string(kAnnotatedExecutable),	1✔
126	.arguments = {}};	1✔
127	auto login = *self.tree->Get(login_pid);	1✔
128	self.tree->HandleExec(event_id++, *login, login_exec_pid, login_prog, cred);	1✔
129
130	// Ensure we have an annotation on login itself...
131	login = *self.tree->Get(login_exec_pid);	1✔
132	auto annotation = self.tree->GetAnnotation<TestAnnotator>(*login);	1✔
133	XCTAssertTrue(annotation.has_value());	1!
134
135	// PID 2.3: fork() -> PID 3.3
136	const struct Pid shell_pid = {.pid = 3, .pidversion = 3};	1✔
137	self.tree->HandleFork(event_id++, *login, shell_pid);	1✔
138	// PID 3.3: exec("/bin/zsh") -> PID 3.4
139	const struct Pid shell_exec_pid = {.pid = 3, .pidversion = 4};	1✔
140	const struct Program shell_prog = {.executable = "/bin/zsh", .arguments = {}};	1✔
141	auto shell = *self.tree->Get(shell_pid);	1✔
142	self.tree->HandleExec(event_id++, *shell, shell_exec_pid, shell_prog, cred);	1✔
143
144	// ... and also ensure we have an annotation on the descendant zsh.
145	shell = *self.tree->Get(shell_exec_pid);	1✔
146	annotation = self.tree->GetAnnotation<TestAnnotator>(*shell);	1✔
147	XCTAssertTrue(annotation.has_value());	1!
148	}	1✔
149
150	- (void)testCleanup {	1✔
151	uint64_t event_id = 1;	1✔
152	const struct Pid child_pid = {.pid = 2, .pidversion = 2};	1✔
153	{	1✔
154	self.tree->HandleFork(event_id++, *self.init_proc, child_pid);	1✔
155	auto child = *self.tree->Get(child_pid);	1✔
156	self.tree->HandleExit(event_id++, *child);	1✔
157	}	1✔
158
159	// We should still be able to get a handle to child...
160	{	1✔
161	auto child = self.tree->Get(child_pid);	1✔
162	XCTAssertTrue(child.has_value());	1!
163	}	1✔
164
165	// ... until we step far enough into the future (32 events).
166	struct Pid churn_pid = {.pid = 3, .pidversion = 3};	1✔
167	for (int i = 0; i < 32; i++) {	33✔
168	self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);	32✔
169	churn_pid.pid++;	32✔
170	}	32✔
171
172	// Now when we try processing the next event, it should have fallen out of the tree.
173	self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);	1✔
174	{	1✔
175	auto child = self.tree->Get(child_pid);	1✔
176	XCTAssertFalse(child.has_value());	1!
177	}	1✔
178	}	1✔
179
180	- (void)testRefcountCleanup {	1✔
181	uint64_t event_id = 1;	1✔
182	const struct Pid child_pid = {.pid = 2, .pidversion = 2};	1✔
183	{	1✔
184	self.tree->HandleFork(event_id++, *self.init_proc, child_pid);	1✔
185	auto child = *self.tree->Get(child_pid);	1✔
186	self.tree->HandleExit(event_id++, *child);	1✔
187	}	1✔
188
189	{	1✔
190	auto child = self.tree->Get(child_pid);	1✔
191	XCTAssertTrue(child.has_value());	1!
192	std::vector<struct Pid> pids = {(*child)->pid_};	1✔
193	self.tree->RetainProcess(pids);	1✔
194	}	1✔
195
196	// Even if we step far into the future, we should still be able to lookup
197	// the child.
198	for (int i = 0; i < 1000; i++) {	1,001✔
199	struct Pid churn_pid = {.pid = 100 + i, .pidversion = (uint64_t)(100 + i)};	1,000✔
200	self.tree->HandleFork(event_id++, *self.init_proc, churn_pid);	1,000✔
201	auto child = self.tree->Get(child_pid);	1,000✔
202	XCTAssertTrue(child.has_value());	1,000!
203	}	1,000✔
204
205	// But when released...
206	{	1✔
207	auto child = self.tree->Get(child_pid);	1✔
208	XCTAssertTrue(child.has_value());	1!
209	std::vector<struct Pid> pids = {(*child)->pid_};	1✔
210	self.tree->ReleaseProcess(pids);	1✔
211	}	1✔
212
213	// ... it should immediately be removed.
214	{	1✔
215	auto child = self.tree->Get(child_pid);	1✔
216	XCTAssertFalse(child.has_value());	1!
217	}	1✔
218	}	1✔
219
220	@end

google / santa / 7265502009

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous