7291210629

Committed 21 Dec 2023 05:15PM UTC coverage: 64.482% (+0.4%) from 64.055%

Build # 7291210629

Build Type

Pull #1259

github

Committed by

web-flow

Commit Message

Merge 26c135d78 into f8a20d35b

Pull Request Pull Request #1259: Added documentation to clarify clean sync with zero rule behavior

Run Details

4414 of 8964 branches covered (0.0%)

Branch coverage included in aggregate %.

0 of 1 new or added line in 1 file covered. (0.0%)

10 existing lines in 2 files now uncovered.

15407 of 21775 relevant lines covered (70.76%)

14488.89 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santactl/Commands/SNTCommandRule.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import <Foundation/Foundation.h>
#import <MOLCertificate/MOLCertificate.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDropRootPrivs.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santactl/SNTCommand.h"
#import "Source/santactl/SNTCommandController.h"

@interface SNTCommandRule : SNTCommand <SNTCommandProtocol>
@end

@implementation SNTCommandRule

REGISTER_COMMAND_NAME(@"rule")

+ (BOOL)requiresRoot {
  return YES;
}

+ (BOOL)requiresDaemonConn {
  return YES;
}

+ (NSString *)shortHelpText {
  return @"Manually add/remove/check rules.";
}

+ (NSString *)longHelpText {
  return (@"Usage: santactl rule [options]\n"
          @"  One of:\n"
          @"    --allow: add to allow\n"
          @"    --block: add to block\n"
          @"    --silent-block: add to silent block\n"
          @"    --compiler: allow and mark as a compiler\n"
          @"    --remove: remove existing rule\n"
          @"    --check: check for an existing rule\n"
          @"    --import {path}: import rules from a JSON file\n"
          @"    --export {path}: export rules to a JSON file\n"
          @"\n"
          @"  One of:\n"
          @"    --path {path}: path of binary/bundle ao add/remove.\n"
          @"                   Will add the hash of the file currently at that path.\n"
          @"                   Does not work with --check. Use the fileinfo verb to check.\n"
          @"                   the rule state of a file.\n"
          @"    --identifier {sha256|teamID|signingID}: identifier to add/remove/check\n"
          @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
          @"\n"
          @"  Optionally:\n"
          @"    --teamid: add or check a team ID rule instead of binary\n"
          @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
          @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
#ifdef DEBUG
          @"    --force: allow manual changes even when SyncBaseUrl is set\n"
#endif
          @"    --message {message}: custom message\n"
          @"\n"
          @"  Notes:\n"
          @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
          @"\n"
          @"      `TeamID:SigningID`\n"
          @"\n"
          @"    Because signing IDs are controlled by the binary author, this ensures\n"
          @"    that the signing ID is properly scoped to a developer. For the special\n"
          @"    case of platform binaries, `TeamID` should be replaced with the string\n"
          @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
          @"    targeting Apple-signed binaries that do not have a team ID.\n"
          @"\n"
          @"  Importing / Exporting Rules:\n"
          @"    If santa is not configured to use a sync server one can export\n"
          @"    & import its non-static rules to and from JSON files using the \n"
          @"    --export/--import flags. These files have the following form:\n"
          @"\n"
          @"    {\"rules\": [{rule-dictionaries}]}\n"
          @"    e.g. {\"rules\": [\n"
          @"                      {\"policy\": \"BLOCKLIST\",\n"
          @"                       \"identifier\": "
          @"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"
          @"                       \"custom_url\" : \"\",\n"
          @"                       \"custom_msg\": \"/bin/ls block for demo\"}\n"
          @"                      ]}\n");
}

- (void)runWithArguments:(NSArray *)arguments {
  SNTConfigurator *config = [SNTConfigurator configurator];
  if ((config.syncBaseURL || config.staticRules.count) &&
      ![arguments containsObject:@"--check"]
#ifdef DEBUG
      // DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
      && ![arguments containsObject:@"--force"]) {
#else
  ) {
#endif
    printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");
    exit(1);
  }

  SNTRule *newRule = [[SNTRule alloc] init];
  newRule.state = SNTRuleStateUnknown;
  newRule.type = SNTRuleTypeBinary;

  NSString *path;
  NSString *jsonFilePath;
  BOOL check = NO;
  BOOL importRules = NO;
  BOOL exportRules = NO;

  // Parse arguments
  for (NSUInteger i = 0; i < arguments.count; ++i) {
    NSString *arg = arguments[i];

    if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame ||
        [arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllow;
    } else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateBlock;
    } else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateSilentBlock;
    } else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllowCompiler;
    } else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {
      newRule.state = SNTRuleStateRemove;
    } else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {
      check = YES;
    } else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeCertificate;
    } else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeTeamID;
    } else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeSigningID;
    } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--path requires an argument"];
      }
      path = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--identifier requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--sha256 requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--message requires an argument"];
      }
      newRule.customMsg = arguments[i];
#ifdef DEBUG
    } else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {
      // Don't do anything special.
#endif
    } else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {
      if (exportRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      importRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--import requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {
      if (importRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      exportRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--export requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {
      printf("%s\n", self.class.longHelpText.UTF8String);
      exit(0);
    } else {
      [self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];
    }
  }

  if (jsonFilePath.length > 0) {
    if (importRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--import can only be used by itself"];
      }
      [self importJSONFile:jsonFilePath];
    } else if (exportRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--export can only be used by itself"];
      }
      [self exportJSONFile:jsonFilePath];
    }
    return;
  }

  if (path) {
    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
    if (!fi.path) {
      [self printErrorUsageAndExit:@"Provided path was not a plain file"];
    }

    if (newRule.type == SNTRuleTypeBinary) {
      newRule.identifier = fi.SHA256;
    } else if (newRule.type == SNTRuleTypeCertificate) {
      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
      newRule.identifier = cs.leafCertificate.SHA256;
    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
      // noop
    }
  }

  if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) {
    NSCharacterSet *nonHex =
      [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
    if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=
        64) {
      [self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];
    }
  }

  if (check) {
    if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];
    return [self printStateOfRule:newRule daemonConnection:self.daemonConn];
  }

  if (newRule.state == SNTRuleStateUnknown) {
    [self printErrorUsageAndExit:@"No state specified"];
  } else if (!newRule.identifier) {
    [self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:@[ newRule ]
              cleanSlate:NO
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     } else {
                       NSString *ruleType;
                       switch (newRule.type) {
                         case SNTRuleTypeCertificate:
                         case SNTRuleTypeBinary: {
                           ruleType = @"SHA-256";
                           break;
                         }
                         case SNTRuleTypeTeamID: {
                           ruleType = @"Team ID";
                           break;
                         }
                         default: ruleType = @"(Unknown type)";
                       }
                       if (newRule.state == SNTRuleStateRemove) {
                         printf("Removed rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       } else {
                         printf("Added rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       }
                       exit(0);
                     }
                   }];
}

- (void)printStateOfRule:(SNTRule *)rule daemonConnection:(MOLXPCConnection *)daemonConn {
  id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];
  NSString *fileSHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil;
  NSString *certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil;
  NSString *teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil;
  NSString *signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil;
  __block NSMutableString *output;
  [rop decisionForFilePath:nil
                fileSHA256:fileSHA256
         certificateSHA256:certificateSHA256
                    teamID:teamID
                 signingID:signingID
                     reply:^(SNTEventState s) {
                       output =
                         (SNTEventStateAllow & s) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;
                       switch (s) {
                         case SNTEventStateAllowUnknown:
                         case SNTEventStateBlockUnknown: [output appendString:@" (Unknown)"]; break;
                         case SNTEventStateAllowBinary:
                         case SNTEventStateBlockBinary: [output appendString:@" (Binary)"]; break;
                         case SNTEventStateAllowCertificate:
                         case SNTEventStateBlockCertificate:
                           [output appendString:@" (Certificate)"];
                           break;
                         case SNTEventStateAllowScope:
                         case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
                         case SNTEventStateAllowCompiler:
                           [output appendString:@" (Compiler)"];
                           break;
                         case SNTEventStateAllowTransitive:
                           [output appendString:@" (Transitive)"];
                           break;
                         case SNTEventStateAllowTeamID:
                         case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
                         case SNTEventStateAllowSigningID:
                         case SNTEventStateBlockSigningID:
                           [output appendString:@" (SigningID)"];
                           break;
                         default: output = @"None".mutableCopy; break;
                       }
                       if (isatty(STDOUT_FILENO)) {
                         if ((SNTEventStateAllow & s)) {
                           [output insertString:@"\033[32m" atIndex:0];
                           [output appendString:@"\033[0m"];
                         } else if ((SNTEventStateBlock & s)) {
                           [output insertString:@"\033[31m" atIndex:0];
                           [output appendString:@"\033[0m"];
                         } else {
                           [output insertString:@"\033[33m" atIndex:0];
                           [output appendString:@"\033[0m"];
                         }
                       }
                     }];

  [rop databaseRuleForBinarySHA256:fileSHA256
                 certificateSHA256:certificateSHA256
                            teamID:teamID
                         signingID:signingID
                             reply:^(SNTRule *r) {
                               if (r.state == SNTRuleStateAllowTransitive) {
                                 NSDate *date =
                                   [NSDate dateWithTimeIntervalSinceReferenceDate:r.timestamp];
                                 [output appendString:[NSString
                                                        stringWithFormat:@"\nlast access date: %@",
                                                                         [date description]]];
                               }
                             }];

  printf("%s\n", output.UTF8String);
  exit(0);
}

- (void)importJSONFile:(NSString *)jsonFilePath {
  // If the file exists parse it and then add the rules one at a time.
  NSError *error;
  NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  // We expect a JSON object with one key "rules". This is an array of rule
  // objects.
  // e.g.
  // {"rules": [{
  //  "policy" : "BLOCKLIST",
  //    "rule_type" : "BINARY",
  //    "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
  //    "custom_url" : "",
  //    "custom_msg" : "/bin/ls block for demo"
  //  }]}
  NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  NSMutableArray<SNTRule *> *parsedRules = [[NSMutableArray alloc] init];

  for (NSDictionary *jsonRule in rules[@"rules"]) {
    SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];
    if (!rule) {
      [self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];
    }
    [parsedRules addObject:rule];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:parsedRules
              cleanSlate:NO
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     }
                     exit(0);
                   }];
}

- (void)exportJSONFile:(NSString *)jsonFilePath {
  // Get the rules from the daemon and then write them to the file.
  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
  [rop retrieveAllRules:^(NSArray<SNTRule *> *rules, NSError *error) {
    if (error) {
      printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }

    if (rules.count == 0) {
      printf("No rules to export.\n");
      exit(1);
    }
    // Convert Rules to an NSDictionary.
    NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];

    for (SNTRule *rule in rules) {
      // Omit transitive and remove rules as they're not relevan.
      if (rule.state == SNTRuleStateAllowTransitive || rule.state == SNTRuleStateRemove) {
        continue;
      }

      [rulesAsDicts addObject:[rule dictionaryRepresentation]];
    }

    NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];
    [outputStream open];

    // Write the rules to the file.
    // File should look like the following JSON:
    // {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}
                                                       options:NSJSONWritingPrettyPrinted
                                                         error:&error];
    // Print error
    if (error) {
      printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }
    // Write jsonData to the file
    [outputStream write:jsonData.bytes maxLength:jsonData.length];
    [outputStream close];
    exit(0);
  }];
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import <Foundation/Foundation.h>
16	#import <MOLCertificate/MOLCertificate.h>
17	#import <MOLCodesignChecker/MOLCodesignChecker.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTDropRootPrivs.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTRule.h"
25	#import "Source/common/SNTXPCControlInterface.h"
26	#import "Source/santactl/SNTCommand.h"
27	#import "Source/santactl/SNTCommandController.h"
28
29	@interface SNTCommandRule : SNTCommand <SNTCommandProtocol>
30	@end
31
32	@implementation SNTCommandRule
33
34	REGISTER_COMMAND_NAME(@"rule")
35
36	+ (BOOL)requiresRoot {	×
37	return YES;	×
38	}	×
39
40	+ (BOOL)requiresDaemonConn {	×
41	return YES;	×
42	}	×
43
44	+ (NSString *)shortHelpText {	×
45	return @"Manually add/remove/check rules.";	×
46	}	×
47
48	+ (NSString *)longHelpText {	×
49	return (@"Usage: santactl rule [options]\n"	×
50	@" One of:\n"	×
51	@" --allow: add to allow\n"	×
52	@" --block: add to block\n"	×
53	@" --silent-block: add to silent block\n"	×
54	@" --compiler: allow and mark as a compiler\n"	×
55	@" --remove: remove existing rule\n"	×
56	@" --check: check for an existing rule\n"	×
57	@" --import {path}: import rules from a JSON file\n"	×
58	@" --export {path}: export rules to a JSON file\n"	×
59	@"\n"	×
60	@" One of:\n"	×
NEW 61	@" --path {path}: path of binary/bundle ao add/remove.\n"	×
62	@" Will add the hash of the file currently at that path.\n"	×
63	@" Does not work with --check. Use the fileinfo verb to check.\n"	×
64	@" the rule state of a file.\n"	×
65	@" --identifier {sha256\|teamID\|signingID}: identifier to add/remove/check\n"	×
66	@" --sha256 {sha256}: hash to add/remove/check [deprecated]\n"	×
67	@"\n"	×
68	@" Optionally:\n"	×
69	@" --teamid: add or check a team ID rule instead of binary\n"	×
70	@" --signingid: add or check a signing ID rule instead of binary (see notes)\n"	×
71	@" --certificate: add or check a certificate sha256 rule instead of binary\n"	×
72	#ifdef DEBUG	×
73	@" --force: allow manual changes even when SyncBaseUrl is set\n"	×
74	#endif	×
75	@" --message {message}: custom message\n"	×
76	@"\n"	×
77	@" Notes:\n"	×
78	@" The format of `identifier` when adding/checking a `signingid` rule is:\n"	×
79	@"\n"	×
80	@" `TeamID:SigningID`\n"	×
81	@"\n"	×
82	@" Because signing IDs are controlled by the binary author, this ensures\n"	×
83	@" that the signing ID is properly scoped to a developer. For the special\n"	×
84	@" case of platform binaries, `TeamID` should be replaced with the string\n"	×
85	@" \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"	×
86	@" targeting Apple-signed binaries that do not have a team ID.\n"	×
87	@"\n"	×
88	@" Importing / Exporting Rules:\n"	×
89	@" If santa is not configured to use a sync server one can export\n"	×
90	@" & import its non-static rules to and from JSON files using the \n"	×
91	@" --export/--import flags. These files have the following form:\n"	×
92	@"\n"	×
93	@" {\"rules\": [{rule-dictionaries}]}\n"	×
94	@" e.g. {\"rules\": [\n"	×
95	@" {\"policy\": \"BLOCKLIST\",\n"	×
96	@" \"identifier\": "	×
97	@"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"	×
98	@" \"custom_url\" : \"\",\n"	×
99	@" \"custom_msg\": \"/bin/ls block for demo\"}\n"	×
100	@" ]}\n");	×
101	}	×
102
103	- (void)runWithArguments:(NSArray *)arguments {	×
104	SNTConfigurator *config = [SNTConfigurator configurator];	×
105	if ((config.syncBaseURL \|\| config.staticRules.count) &&	×
106	![arguments containsObject:@"--check"]	×
107	#ifdef DEBUG	×
108	// DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
109	&& ![arguments containsObject:@"--force"]) {	×
110	#else
111	) {
112	#endif
113	printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");	×
114	exit(1);	×
115	}	×
116
117	SNTRule *newRule = [[SNTRule alloc] init];	×
118	newRule.state = SNTRuleStateUnknown;	×
119	newRule.type = SNTRuleTypeBinary;	×
120
121	NSString *path;	×
122	NSString *jsonFilePath;	×
123	BOOL check = NO;	×
124	BOOL importRules = NO;	×
125	BOOL exportRules = NO;	×
126
127	// Parse arguments
128	for (NSUInteger i = 0; i < arguments.count; ++i) {	×
129	NSString *arg = arguments[i];	×
130
131	if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame \|\|	×
132	[arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {	×
133	newRule.state = SNTRuleStateAllow;	×
134	} else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame \|\|	×
135	[arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {	×
136	newRule.state = SNTRuleStateBlock;	×
137	} else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame \|\|	×
138	[arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {	×
139	newRule.state = SNTRuleStateSilentBlock;	×
140	} else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {	×
141	newRule.state = SNTRuleStateAllowCompiler;	×
142	} else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {	×
143	newRule.state = SNTRuleStateRemove;	×
144	} else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {	×
145	check = YES;	×
146	} else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {	×
147	newRule.type = SNTRuleTypeCertificate;	×
148	} else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {	×
149	newRule.type = SNTRuleTypeTeamID;	×
150	} else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {	×
151	newRule.type = SNTRuleTypeSigningID;	×
152	} else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {	×
153	if (++i > arguments.count - 1) {	×
154	[self printErrorUsageAndExit:@"--path requires an argument"];	×
155	}	×
156	path = arguments[i];	×
157	} else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {	×
158	if (++i > arguments.count - 1) {	×
159	[self printErrorUsageAndExit:@"--identifier requires an argument"];	×
160	}	×
161	newRule.identifier = arguments[i];	×
162	} else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {	×
163	if (++i > arguments.count - 1) {	×
164	[self printErrorUsageAndExit:@"--sha256 requires an argument"];	×
165	}	×
166	newRule.identifier = arguments[i];	×
167	} else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {	×
168	if (++i > arguments.count - 1) {	×
169	[self printErrorUsageAndExit:@"--message requires an argument"];	×
170	}	×
171	newRule.customMsg = arguments[i];	×
172	#ifdef DEBUG	×
173	} else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {	×
174	// Don't do anything special.
175	#endif	×
176	} else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {	×
177	if (exportRules) {	×
178	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
179	}	×
180	importRules = YES;	×
181	if (++i > arguments.count - 1) {	×
182	[self printErrorUsageAndExit:@"--import requires an argument"];	×
183	}	×
184	jsonFilePath = arguments[i];	×
185	} else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {	×
186	if (importRules) {	×
187	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
188	}	×
189	exportRules = YES;	×
190	if (++i > arguments.count - 1) {	×
191	[self printErrorUsageAndExit:@"--export requires an argument"];	×
192	}	×
193	jsonFilePath = arguments[i];	×
194	} else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame \|\|	×
195	[arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {	×
196	printf("%s\n", self.class.longHelpText.UTF8String);	×
197	exit(0);	×
198	} else {	×
199	[self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];	×
200	}	×
201	}	×
202
203	if (jsonFilePath.length > 0) {	×
204	if (importRules) {	×
205	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
206	[self printErrorUsageAndExit:@"--import can only be used by itself"];	×
207	}	×
208	[self importJSONFile:jsonFilePath];	×
209	} else if (exportRules) {	×
210	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
211	[self printErrorUsageAndExit:@"--export can only be used by itself"];	×
212	}	×
213	[self exportJSONFile:jsonFilePath];	×
214	}	×
215	return;	×
216	}	×
217
218	if (path) {	×
219	SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];	×
220	if (!fi.path) {	×
221	[self printErrorUsageAndExit:@"Provided path was not a plain file"];	×
222	}	×
223
224	if (newRule.type == SNTRuleTypeBinary) {	×
225	newRule.identifier = fi.SHA256;	×
226	} else if (newRule.type == SNTRuleTypeCertificate) {	×
227	MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];	×
228	newRule.identifier = cs.leafCertificate.SHA256;	×
229	} else if (newRule.type == SNTRuleTypeTeamID \|\| newRule.type == SNTRuleTypeSigningID) {	×
230	// noop
231	}	×
232	}	×
233
234	if (newRule.type == SNTRuleTypeBinary \|\| newRule.type == SNTRuleTypeCertificate) {	×
235	NSCharacterSet *nonHex =	×
236	[[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];	×
237	if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=	×
238	64) {	×
239	[self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];	×
240	}	×
241	}	×
242
243	if (check) {	×
244	if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];	×
245	return [self printStateOfRule:newRule daemonConnection:self.daemonConn];	×
246	}	×
247
248	if (newRule.state == SNTRuleStateUnknown) {	×
249	[self printErrorUsageAndExit:@"No state specified"];	×
250	} else if (!newRule.identifier) {	×
251	[self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];	×
252	}	×
253
254	[[self.daemonConn remoteObjectProxy]	×
255	databaseRuleAddRules:@[ newRule ]	×
256	cleanSlate:NO	×
257	reply:^(NSError *error) {	×
258	if (error) {	×
259	printf("Failed to modify rules: %s",	×
260	[error.localizedDescription UTF8String]);	×
261	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
262	exit(1);	×
263	} else {	×
264	NSString *ruleType;	×
265	switch (newRule.type) {	×
266	case SNTRuleTypeCertificate:	×
267	case SNTRuleTypeBinary: {	×
268	ruleType = @"SHA-256";	×
269	break;	×
270	}	×
271	case SNTRuleTypeTeamID: {	×
272	ruleType = @"Team ID";	×
273	break;	×
274	}	×
275	default: ruleType = @"(Unknown type)";	×
276	}	×
277	if (newRule.state == SNTRuleStateRemove) {	×
278	printf("Removed rule for %s: %s.\n", [ruleType UTF8String],	×
279	[newRule.identifier UTF8String]);	×
280	} else {	×
281	printf("Added rule for %s: %s.\n", [ruleType UTF8String],	×
282	[newRule.identifier UTF8String]);	×
283	}	×
284	exit(0);	×
285	}	×
286	}];	×
287	}	×
288
289	- (void)printStateOfRule:(SNTRule )rule daemonConnection:(MOLXPCConnection )daemonConn {	×
290	id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];	×
291	NSString *fileSHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil;	×
292	NSString *certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil;	×
293	NSString *teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil;	×
294	NSString *signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil;	×
295	__block NSMutableString *output;	×
296	[rop decisionForFilePath:nil	×
297	fileSHA256:fileSHA256	×
298	certificateSHA256:certificateSHA256	×
299	teamID:teamID	×
300	signingID:signingID	×
301	reply:^(SNTEventState s) {	×
302	output =	×
303	(SNTEventStateAllow & s) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;	×
304	switch (s) {	×
305	case SNTEventStateAllowUnknown:	×
306	case SNTEventStateBlockUnknown: [output appendString:@" (Unknown)"]; break;	×
307	case SNTEventStateAllowBinary:	×
308	case SNTEventStateBlockBinary: [output appendString:@" (Binary)"]; break;	×
309	case SNTEventStateAllowCertificate:	×
310	case SNTEventStateBlockCertificate:	×
311	[output appendString:@" (Certificate)"];	×
312	break;	×
313	case SNTEventStateAllowScope:	×
314	case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;	×
315	case SNTEventStateAllowCompiler:	×
316	[output appendString:@" (Compiler)"];	×
317	break;	×
318	case SNTEventStateAllowTransitive:	×
319	[output appendString:@" (Transitive)"];	×
320	break;	×
321	case SNTEventStateAllowTeamID:	×
322	case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;	×
323	case SNTEventStateAllowSigningID:	×
324	case SNTEventStateBlockSigningID:	×
325	[output appendString:@" (SigningID)"];	×
326	break;	×
327	default: output = @"None".mutableCopy; break;	×
328	}	×
329	if (isatty(STDOUT_FILENO)) {	×
330	if ((SNTEventStateAllow & s)) {	×
331	[output insertString:@"\033[32m" atIndex:0];	×
332	[output appendString:@"\033[0m"];	×
333	} else if ((SNTEventStateBlock & s)) {	×
334	[output insertString:@"\033[31m" atIndex:0];	×
335	[output appendString:@"\033[0m"];	×
336	} else {	×
337	[output insertString:@"\033[33m" atIndex:0];	×
338	[output appendString:@"\033[0m"];	×
339	}	×
340	}	×
341	}];	×
342
343	[rop databaseRuleForBinarySHA256:fileSHA256	×
344	certificateSHA256:certificateSHA256	×
345	teamID:teamID	×
346	signingID:signingID	×
347	reply:^(SNTRule *r) {	×
348	if (r.state == SNTRuleStateAllowTransitive) {	×
349	NSDate *date =	×
350	[NSDate dateWithTimeIntervalSinceReferenceDate:r.timestamp];	×
351	[output appendString:[NSString	×
352	stringWithFormat:@"\nlast access date: %@",	×
353	[date description]]];	×
354	}	×
355	}];	×
356
357	printf("%s\n", output.UTF8String);	×
358	exit(0);	×
359	}	×
360
361	- (void)importJSONFile:(NSString *)jsonFilePath {	×
362	// If the file exists parse it and then add the rules one at a time.
363	NSError *error;	×
364	NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];	×
365	if (error) {	×
366	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,	×
367	error.localizedDescription]];	×
368	}	×
369
370	// We expect a JSON object with one key "rules". This is an array of rule
371	// objects.
372	// e.g.
373	// {"rules": [{
374	// "policy" : "BLOCKLIST",
375	// "rule_type" : "BINARY",
376	// "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
377	// "custom_url" : "",
378	// "custom_msg" : "/bin/ls block for demo"
379	// }]}
380	NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];	×
381	if (error) {	×
382	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,	×
383	error.localizedDescription]];	×
384	}	×
385
386	NSMutableArray<SNTRule > parsedRules = [[NSMutableArray alloc] init];	×
387
388	for (NSDictionary *jsonRule in rules[@"rules"]) {	×
389	SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];	×
390	if (!rule) {	×
391	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];	×
392	}	×
393	[parsedRules addObject:rule];	×
394	}	×
395
396	[[self.daemonConn remoteObjectProxy]	×
397	databaseRuleAddRules:parsedRules	×
398	cleanSlate:NO	×
399	reply:^(NSError *error) {	×
400	if (error) {	×
401	printf("Failed to modify rules: %s",	×
402	[error.localizedDescription UTF8String]);	×
403	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
404	exit(1);	×
405	}	×
406	exit(0);	×
407	}];	×
408	}	×
409
410	- (void)exportJSONFile:(NSString *)jsonFilePath {	×
411	// Get the rules from the daemon and then write them to the file.
412	id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];	×
413	[rop retrieveAllRules:^(NSArray<SNTRule > rules, NSError *error) {	×
414	if (error) {	×
415	printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);	×
416	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
417	exit(1);	×
418	}	×
419
420	if (rules.count == 0) {	×
421	printf("No rules to export.\n");	×
422	exit(1);	×
423	}	×
424	// Convert Rules to an NSDictionary.
425	NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];	×
426
427	for (SNTRule *rule in rules) {	×
428	// Omit transitive and remove rules as they're not relevan.
429	if (rule.state == SNTRuleStateAllowTransitive \|\| rule.state == SNTRuleStateRemove) {	×
430	continue;	×
431	}	×
432
433	[rulesAsDicts addObject:[rule dictionaryRepresentation]];	×
434	}	×
435
436	NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];	×
437	[outputStream open];	×
438
439	// Write the rules to the file.
440	// File should look like the following JSON:
441	// {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
442	NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}	×
443	options:NSJSONWritingPrettyPrinted	×
444	error:&error];	×
445	// Print error
446	if (error) {	×
447	printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);	×
448	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
449	exit(1);	×
450	}	×
451	// Write jsonData to the file
452	[outputStream write:jsonData.bytes maxLength:jsonData.length];	×
453	[outputStream close];	×
454	exit(0);	×
455	}];	×
456	}	×
457
458	@end

google / santa / 7291210629

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous