8113089355

Committed 01 Mar 2024 02:59PM UTC coverage: 64.615% (-0.08%) from 64.697%

Build # 8113089355

Build Type

Pull #1300

github

Committed by

web-flow

Commit Message

Merge dbc514920 into 74d8fe30d

Pull Request Pull Request #1300: Added clean flag for JSON rule import

Run Details

4525 of 9148 branches covered (49.46%)

Branch coverage included in aggregate %.

0 of 71 new or added lines in 1 file covered. (0.0%)

9 existing lines in 2 files now uncovered.

15812 of 22326 relevant lines covered (70.82%)

12591.37 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

14.4

/Source/santactl/Commands/SNTCommandRule.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import <Foundation/Foundation.h>
#import <MOLCertificate/MOLCertificate.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDropRootPrivs.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SNTRuleIdentifiers.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santactl/Commands/SNTCommandRule.h"
#import "Source/santactl/SNTCommand.h"
#import "Source/santactl/SNTCommandController.h"

@implementation SNTCommandRule

REGISTER_COMMAND_NAME(@"rule")

+ (BOOL)requiresRoot {
  return YES;
}

+ (BOOL)requiresDaemonConn {
  return YES;
}

+ (NSString *)shortHelpText {
  return @"Manually add/remove/check rules.";
}

+ (NSString *)longHelpText {
  return (
    @"Usage: santactl rule [options]\n"
    @"  One of:\n"
    @"    --allow: add to allow\n"
    @"    --block: add to block\n"
    @"    --silent-block: add to silent block\n"
    @"    --compiler: allow and mark as a compiler\n"
    @"    --remove: remove existing rule\n"
    @"    --check: check for an existing rule\n"
    @"    --import {path}: import rules from a JSON file\n"
    @"    --export {path}: export rules to a JSON file\n"
    @"\n"
    @"  One of:\n"
    @"    --path {path}: path of binary/bundle to add/remove.\n"
    @"                   Will add the hash of the file currently at that path.\n"
    @"                   Does not work with --check. Use the fileinfo verb to check.\n"
    @"                   the rule state of a file.\n"
    @"    --identifier {sha256|teamID|signingID}: identifier to add/remove/check\n"
    @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
    @"\n"
    @"  Optionally:\n"
    @"    --teamid: add or check a team ID rule instead of binary\n"
    @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
    @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
#ifdef DEBUG
    @"    --force: allow manual changes even when SyncBaseUrl is set\n"
#endif
    @"    --message {message}: custom message\n"
    @"    --clean: when importing rules via JSON clear all non-transitive rules before importing\n"
    @"    --clean-all: when importing rules via JSON clear all rules before importing\n"
    @"\n"
    @"  Notes:\n"
    @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
    @"\n"
    @"      `TeamID:SigningID`\n"
    @"\n"
    @"    Because signing IDs are controlled by the binary author, this ensures\n"
    @"    that the signing ID is properly scoped to a developer. For the special\n"
    @"    case of platform binaries, `TeamID` should be replaced with the string\n"
    @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
    @"    targeting Apple-signed binaries that do not have a team ID.\n"
    @"\n"
    @"  Importing / Exporting Rules:\n"
    @"    If santa is not configured to use a sync server one can export\n"
    @"    & import its non-static rules to and from JSON files using the \n"
    @"    --export/--import flags. These files have the following form:\n"
    @"\n"
    @"    {\"rules\": [{rule-dictionaries}]}\n"
    @"    e.g. {\"rules\": [\n"
    @"                      {\"policy\": \"BLOCKLIST\",\n"
    @"                       \"identifier\": "
    @"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"
    @"                       \"custom_url\" : \"\",\n"
    @"                       \"custom_msg\": \"/bin/ls block for demo\"}\n"
    @"                      ]}\n"
    @"\n"
    @"    By default rules are not cleared when importing. To clear the\n"
    @"    database you must use either --clean or --clean-all\n"
    @"\n");
}

- (void)runWithArguments:(NSArray *)arguments {
  SNTConfigurator *config = [SNTConfigurator configurator];
  if ((config.syncBaseURL || config.staticRules.count) &&
      ![arguments containsObject:@"--check"]
#ifdef DEBUG
      // DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
      && ![arguments containsObject:@"--force"]) {
#else
  ) {
#endif
    printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");
    exit(1);
  }

  SNTRule *newRule = [[SNTRule alloc] init];
  newRule.state = SNTRuleStateUnknown;
  newRule.type = SNTRuleTypeBinary;

  NSString *path;
  NSString *jsonFilePath;
  BOOL check = NO;
  SNTRuleCleanup cleanupType;
  BOOL importRules = NO;
  BOOL exportRules = NO;

  // Parse arguments
  for (NSUInteger i = 0; i < arguments.count; ++i) {
    NSString *arg = arguments[i];

    if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame ||
        [arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllow;
    } else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateBlock;
    } else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateSilentBlock;
    } else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllowCompiler;
    } else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {
      newRule.state = SNTRuleStateRemove;
    } else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {
      check = YES;
    } else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeCertificate;
    } else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeTeamID;
    } else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeSigningID;
    } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--path requires an argument"];
      }
      path = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--identifier requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--sha256 requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--message requires an argument"];
      }
      newRule.customMsg = arguments[i];
#ifdef DEBUG
    } else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {
      // Don't do anything special.
#endif
    } else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {
      if (exportRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      importRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--import requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--clean"] == NSOrderedSame) {
      if (!importRules) {
        [self printErrorUsageAndExit:@"--clean requires --import"];
      }
      cleanupType = SNTRuleCleanupNonTransitive;
    } else if ([arg caseInsensitiveCompare:@"--clean-all"] == NSOrderedSame) {
      if (!importRules) {
        [self printErrorUsageAndExit:@"--clean-all requires --import"];
      }
      cleanupType = SNTRuleCleanupAll;
    } else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {
      if (importRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      exportRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--export requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {
      printf("%s\n", self.class.longHelpText.UTF8String);
      exit(0);
    } else {
      [self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];
    }
  }

  if (jsonFilePath.length > 0) {
    if (importRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--import can only be used by itself"];
      }
      [self importJSONFile:jsonFilePath with:cleanupType];
    } else if (exportRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--export can only be used by itself"];
      }
      [self exportJSONFile:jsonFilePath];
    }
    return;
  }

  if (path) {
    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
    if (!fi.path) {
      [self printErrorUsageAndExit:@"Provided path was not a plain file"];
    }

    if (newRule.type == SNTRuleTypeBinary) {
      newRule.identifier = fi.SHA256;
    } else if (newRule.type == SNTRuleTypeCertificate) {
      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
      newRule.identifier = cs.leafCertificate.SHA256;
    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
      // noop
    }
  }

  if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) {
    NSCharacterSet *nonHex =
      [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
    if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=
        64) {
      [self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];
    }
  }

  if (check) {
    if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];
    return [self printStateOfRule:newRule daemonConnection:self.daemonConn];
  }

  if (newRule.state == SNTRuleStateUnknown) {
    [self printErrorUsageAndExit:@"No state specified"];
  } else if (!newRule.identifier) {
    [self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:@[ newRule ]
             ruleCleanup:SNTRuleCleanupNone
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     } else {
                       NSString *ruleType;
                       switch (newRule.type) {
                         case SNTRuleTypeCertificate:
                         case SNTRuleTypeBinary: {
                           ruleType = @"SHA-256";
                           break;
                         }
                         case SNTRuleTypeTeamID: {
                           ruleType = @"Team ID";
                           break;
                         }
                         default: ruleType = @"(Unknown type)";
                       }
                       if (newRule.state == SNTRuleStateRemove) {
                         printf("Removed rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       } else {
                         printf("Added rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       }
                       exit(0);
                     }
                   }];
}

// IMPORTANT: This method makes no attempt to validate whether or not the data
// in a rule is valid. It merely constructs a string with the given data.
// E.g., TeamID compiler rules are not currently supproted, but if a test rule
// is provided with that state, an appropriate string will be returned.
+ (NSString *)stringifyRule:(SNTRule *)rule withColor:(BOOL)colorize {
  NSMutableString *output;
  // Rule state is saved as eventState for output colorization down below
  SNTEventState eventState = SNTEventStateUnknown;

  switch (rule.state) {
    case SNTRuleStateUnknown:
      output = [@"No rule exists with the given parameters" mutableCopy];
      break;
    case SNTRuleStateAllow: OS_FALLTHROUGH;
    case SNTRuleStateAllowCompiler: OS_FALLTHROUGH;
    case SNTRuleStateAllowTransitive:
      output = [@"Allowed" mutableCopy];
      eventState = SNTEventStateAllow;
      break;
    case SNTRuleStateBlock: OS_FALLTHROUGH;
    case SNTRuleStateSilentBlock:
      output = [@"Blocked" mutableCopy];
      eventState = SNTEventStateBlock;
      break;
    case SNTRuleStateRemove: OS_FALLTHROUGH;
    default:
      output = [NSMutableString stringWithFormat:@"Unexpected rule state: %ld", rule.state];
      break;
  }

  if (rule.state == SNTRuleStateUnknown) {
    // No more output to append
    return output;
  }

  [output appendString:@" ("];

  switch (rule.type) {
    case SNTRuleTypeUnknown: [output appendString:@"Unknown"]; break;
    case SNTRuleTypeBinary: [output appendString:@"Binary"]; break;
    case SNTRuleTypeSigningID: [output appendString:@"SigningID"]; break;
    case SNTRuleTypeCertificate: [output appendString:@"Certificate"]; break;
    case SNTRuleTypeTeamID: [output appendString:@"TeamID"]; break;
    default:
      output = [NSMutableString stringWithFormat:@"Unexpected rule type: %ld", rule.type];
      break;
  }

  // Add additional attributes
  switch (rule.state) {
    case SNTRuleStateAllowCompiler: [output appendString:@", Compiler"]; break;
    case SNTRuleStateAllowTransitive: [output appendString:@", Transitive"]; break;
    case SNTRuleStateSilentBlock: [output appendString:@", Silent"]; break;
    default: break;
  }

  [output appendString:@")"];

  // Colorize
  if (colorize) {
    if ((SNTEventStateAllow & eventState)) {
      [output insertString:@"\033[32m" atIndex:0];
      [output appendString:@"\033[0m"];
    } else if ((SNTEventStateBlock & eventState)) {
      [output insertString:@"\033[31m" atIndex:0];
      [output appendString:@"\033[0m"];
    } else {
      [output insertString:@"\033[33m" atIndex:0];
      [output appendString:@"\033[0m"];
    }
  }

  if (rule.state == SNTRuleStateAllowTransitive) {
    NSDate *date = [NSDate dateWithTimeIntervalSinceReferenceDate:rule.timestamp];
    [output appendString:[NSString stringWithFormat:@"\nlast access date: %@", [date description]]];
  }
  return output;
}

- (void)printStateOfRule:(SNTRule *)rule daemonConnection:(MOLXPCConnection *)daemonConn {
  id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];
  __block NSString *output;

  struct RuleIdentifiers identifiers = {
    .binarySHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil,
    .certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil,
    .teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil,
    .signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil,
  };

  [rop databaseRuleForIdentifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]
                            reply:^(SNTRule *r) {
                              output = [SNTCommandRule stringifyRule:r
                                                           withColor:(isatty(STDOUT_FILENO) == 1)];
                            }];

  printf("%s\n", output.UTF8String);
  exit(0);
}

- (void)importJSONFile:(NSString *)jsonFilePath with:(SNTRuleCleanup)cleanupType {
  // If the file exists parse it and then add the rules one at a time.
  NSError *error;
  NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  // We expect a JSON object with one key "rules". This is an array of rule
  // objects.
  // e.g.
  // {"rules": [{
  //  "policy" : "BLOCKLIST",
  //    "rule_type" : "BINARY",
  //    "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
  //    "custom_url" : "",
  //    "custom_msg" : "/bin/ls block for demo"
  //  }]}
  NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  NSMutableArray<SNTRule *> *parsedRules = [[NSMutableArray alloc] init];

  for (NSDictionary *jsonRule in rules[@"rules"]) {
    SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];
    if (!rule) {
      [self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];
    }
    [parsedRules addObject:rule];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:parsedRules
             ruleCleanup:cleanupType
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     }
                     exit(0);
                   }];
}

- (void)exportJSONFile:(NSString *)jsonFilePath {
  // Get the rules from the daemon and then write them to the file.
  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
  [rop retrieveAllRules:^(NSArray<SNTRule *> *rules, NSError *error) {
    if (error) {
      printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }

    if (rules.count == 0) {
      printf("No rules to export.\n");
      exit(1);
    }
    // Convert Rules to an NSDictionary.
    NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];

    for (SNTRule *rule in rules) {
      // Omit transitive and remove rules as they're not relevant.
      if (rule.state == SNTRuleStateAllowTransitive || rule.state == SNTRuleStateRemove) {
        continue;
      }

      [rulesAsDicts addObject:[rule dictionaryRepresentation]];
    }

    NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];
    [outputStream open];

    // Write the rules to the file.
    // File should look like the following JSON:
    // {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}
                                                       options:NSJSONWritingPrettyPrinted
                                                         error:&error];
    // Print error
    if (error) {
      printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }
    // Write jsonData to the file
    [outputStream write:jsonData.bytes maxLength:jsonData.length];
    [outputStream close];
    exit(0);
  }];
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import <Foundation/Foundation.h>
16	#import <MOLCertificate/MOLCertificate.h>
17	#import <MOLCodesignChecker/MOLCodesignChecker.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTDropRootPrivs.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTRule.h"
25	#import "Source/common/SNTRuleIdentifiers.h"
26	#import "Source/common/SNTXPCControlInterface.h"
27	#import "Source/santactl/Commands/SNTCommandRule.h"
28	#import "Source/santactl/SNTCommand.h"
29	#import "Source/santactl/SNTCommandController.h"
30
31	@implementation SNTCommandRule
32
33	REGISTER_COMMAND_NAME(@"rule")
34
35	+ (BOOL)requiresRoot {	×
36	return YES;	×
37	}	×
38
39	+ (BOOL)requiresDaemonConn {	×
40	return YES;	×
41	}	×
42
43	+ (NSString *)shortHelpText {	×
44	return @"Manually add/remove/check rules.";	×
45	}	×
46
47	+ (NSString *)longHelpText {	×
NEW 48	return (	×
NEW 49	@"Usage: santactl rule [options]\n"	×
NEW 50	@" One of:\n"	×
NEW 51	@" --allow: add to allow\n"	×
NEW 52	@" --block: add to block\n"	×
NEW 53	@" --silent-block: add to silent block\n"	×
NEW 54	@" --compiler: allow and mark as a compiler\n"	×
NEW 55	@" --remove: remove existing rule\n"	×
NEW 56	@" --check: check for an existing rule\n"	×
NEW 57	@" --import {path}: import rules from a JSON file\n"	×
NEW 58	@" --export {path}: export rules to a JSON file\n"	×
NEW 59	@"\n"	×
NEW 60	@" One of:\n"	×
NEW 61	@" --path {path}: path of binary/bundle to add/remove.\n"	×
NEW 62	@" Will add the hash of the file currently at that path.\n"	×
NEW 63	@" Does not work with --check. Use the fileinfo verb to check.\n"	×
NEW 64	@" the rule state of a file.\n"	×
NEW 65	@" --identifier {sha256\|teamID\|signingID}: identifier to add/remove/check\n"	×
NEW 66	@" --sha256 {sha256}: hash to add/remove/check [deprecated]\n"	×
NEW 67	@"\n"	×
NEW 68	@" Optionally:\n"	×
NEW 69	@" --teamid: add or check a team ID rule instead of binary\n"	×
NEW 70	@" --signingid: add or check a signing ID rule instead of binary (see notes)\n"	×
NEW 71	@" --certificate: add or check a certificate sha256 rule instead of binary\n"	×
72	#ifdef DEBUG	×
NEW 73	@" --force: allow manual changes even when SyncBaseUrl is set\n"	×
74	#endif	×
NEW 75	@" --message {message}: custom message\n"	×
NEW 76	@" --clean: when importing rules via JSON clear all non-transitive rules before importing\n"	×
NEW 77	@" --clean-all: when importing rules via JSON clear all rules before importing\n"	×
NEW 78	@"\n"	×
NEW 79	@" Notes:\n"	×
NEW 80	@" The format of `identifier` when adding/checking a `signingid` rule is:\n"	×
NEW 81	@"\n"	×
NEW 82	@" `TeamID:SigningID`\n"	×
NEW 83	@"\n"	×
NEW 84	@" Because signing IDs are controlled by the binary author, this ensures\n"	×
NEW 85	@" that the signing ID is properly scoped to a developer. For the special\n"	×
NEW 86	@" case of platform binaries, `TeamID` should be replaced with the string\n"	×
NEW 87	@" \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"	×
NEW 88	@" targeting Apple-signed binaries that do not have a team ID.\n"	×
NEW 89	@"\n"	×
NEW 90	@" Importing / Exporting Rules:\n"	×
NEW 91	@" If santa is not configured to use a sync server one can export\n"	×
NEW 92	@" & import its non-static rules to and from JSON files using the \n"	×
NEW 93	@" --export/--import flags. These files have the following form:\n"	×
NEW 94	@"\n"	×
NEW 95	@" {\"rules\": [{rule-dictionaries}]}\n"	×
NEW 96	@" e.g. {\"rules\": [\n"	×
NEW 97	@" {\"policy\": \"BLOCKLIST\",\n"	×
NEW 98	@" \"identifier\": "	×
NEW 99	@"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"	×
NEW 100	@" \"custom_url\" : \"\",\n"	×
NEW 101	@" \"custom_msg\": \"/bin/ls block for demo\"}\n"	×
NEW 102	@" ]}\n"	×
NEW 103	@"\n"	×
NEW 104	@" By default rules are not cleared when importing. To clear the\n"	×
NEW 105	@" database you must use either --clean or --clean-all\n"	×
NEW 106	@"\n");	×
UNCOV 107	}	×
108
109	- (void)runWithArguments:(NSArray *)arguments {	×
110	SNTConfigurator *config = [SNTConfigurator configurator];	×
111	if ((config.syncBaseURL \|\| config.staticRules.count) &&	×
112	![arguments containsObject:@"--check"]	×
113	#ifdef DEBUG	×
114	// DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
115	&& ![arguments containsObject:@"--force"]) {	×
116	#else
117	) {
118	#endif
119	printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");	×
120	exit(1);	×
121	}	×
122
123	SNTRule *newRule = [[SNTRule alloc] init];	×
124	newRule.state = SNTRuleStateUnknown;	×
125	newRule.type = SNTRuleTypeBinary;	×
126
127	NSString *path;	×
128	NSString *jsonFilePath;	×
129	BOOL check = NO;	×
NEW 130	SNTRuleCleanup cleanupType;	×
131	BOOL importRules = NO;	×
132	BOOL exportRules = NO;	×
133
134	// Parse arguments
135	for (NSUInteger i = 0; i < arguments.count; ++i) {	×
136	NSString *arg = arguments[i];	×
137
138	if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame \|\|	×
139	[arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {	×
140	newRule.state = SNTRuleStateAllow;	×
141	} else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame \|\|	×
142	[arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {	×
143	newRule.state = SNTRuleStateBlock;	×
144	} else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame \|\|	×
145	[arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {	×
146	newRule.state = SNTRuleStateSilentBlock;	×
147	} else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {	×
148	newRule.state = SNTRuleStateAllowCompiler;	×
149	} else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {	×
150	newRule.state = SNTRuleStateRemove;	×
151	} else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {	×
152	check = YES;	×
153	} else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {	×
154	newRule.type = SNTRuleTypeCertificate;	×
155	} else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {	×
156	newRule.type = SNTRuleTypeTeamID;	×
157	} else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {	×
158	newRule.type = SNTRuleTypeSigningID;	×
159	} else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {	×
160	if (++i > arguments.count - 1) {	×
161	[self printErrorUsageAndExit:@"--path requires an argument"];	×
162	}	×
163	path = arguments[i];	×
164	} else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {	×
165	if (++i > arguments.count - 1) {	×
166	[self printErrorUsageAndExit:@"--identifier requires an argument"];	×
167	}	×
168	newRule.identifier = arguments[i];	×
169	} else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {	×
170	if (++i > arguments.count - 1) {	×
171	[self printErrorUsageAndExit:@"--sha256 requires an argument"];	×
172	}	×
173	newRule.identifier = arguments[i];	×
174	} else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {	×
175	if (++i > arguments.count - 1) {	×
176	[self printErrorUsageAndExit:@"--message requires an argument"];	×
177	}	×
178	newRule.customMsg = arguments[i];	×
179	#ifdef DEBUG	×
180	} else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {	×
181	// Don't do anything special.
182	#endif	×
183	} else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {	×
184	if (exportRules) {	×
185	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
186	}	×
187	importRules = YES;	×
188	if (++i > arguments.count - 1) {	×
189	[self printErrorUsageAndExit:@"--import requires an argument"];	×
190	}	×
191	jsonFilePath = arguments[i];	×
NEW 192	} else if ([arg caseInsensitiveCompare:@"--clean"] == NSOrderedSame) {	×
NEW 193	if (!importRules) {	×
NEW 194	[self printErrorUsageAndExit:@"--clean requires --import"];	×
NEW 195	}	×
NEW 196	cleanupType = SNTRuleCleanupNonTransitive;	×
NEW 197	} else if ([arg caseInsensitiveCompare:@"--clean-all"] == NSOrderedSame) {	×
NEW 198	if (!importRules) {	×
NEW 199	[self printErrorUsageAndExit:@"--clean-all requires --import"];	×
NEW 200	}	×
NEW 201	cleanupType = SNTRuleCleanupAll;	×
202	} else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {	×
203	if (importRules) {	×
204	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
205	}	×
206	exportRules = YES;	×
207	if (++i > arguments.count - 1) {	×
208	[self printErrorUsageAndExit:@"--export requires an argument"];	×
209	}	×
210	jsonFilePath = arguments[i];	×
211	} else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame \|\|	×
212	[arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {	×
213	printf("%s\n", self.class.longHelpText.UTF8String);	×
214	exit(0);	×
215	} else {	×
216	[self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];	×
217	}	×
218	}	×
219
220	if (jsonFilePath.length > 0) {	×
221	if (importRules) {	×
222	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
223	[self printErrorUsageAndExit:@"--import can only be used by itself"];	×
224	}	×
NEW 225	[self importJSONFile:jsonFilePath with:cleanupType];	×
226	} else if (exportRules) {	×
227	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
228	[self printErrorUsageAndExit:@"--export can only be used by itself"];	×
229	}	×
230	[self exportJSONFile:jsonFilePath];	×
231	}	×
232	return;	×
233	}	×
234
235	if (path) {	×
236	SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];	×
237	if (!fi.path) {	×
238	[self printErrorUsageAndExit:@"Provided path was not a plain file"];	×
239	}	×
240
241	if (newRule.type == SNTRuleTypeBinary) {	×
242	newRule.identifier = fi.SHA256;	×
243	} else if (newRule.type == SNTRuleTypeCertificate) {	×
244	MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];	×
245	newRule.identifier = cs.leafCertificate.SHA256;	×
246	} else if (newRule.type == SNTRuleTypeTeamID \|\| newRule.type == SNTRuleTypeSigningID) {	×
247	// noop
248	}	×
249	}	×
250
251	if (newRule.type == SNTRuleTypeBinary \|\| newRule.type == SNTRuleTypeCertificate) {	×
252	NSCharacterSet *nonHex =	×
253	[[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];	×
254	if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=	×
255	64) {	×
256	[self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];	×
257	}	×
258	}	×
259
260	if (check) {	×
261	if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];	×
262	return [self printStateOfRule:newRule daemonConnection:self.daemonConn];	×
263	}	×
264
265	if (newRule.state == SNTRuleStateUnknown) {	×
266	[self printErrorUsageAndExit:@"No state specified"];	×
267	} else if (!newRule.identifier) {	×
268	[self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];	×
269	}	×
270
271	[[self.daemonConn remoteObjectProxy]	×
272	databaseRuleAddRules:@[ newRule ]	×
273	ruleCleanup:SNTRuleCleanupNone	×
274	reply:^(NSError *error) {	×
275	if (error) {	×
276	printf("Failed to modify rules: %s",	×
277	[error.localizedDescription UTF8String]);	×
278	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
279	exit(1);	×
280	} else {	×
281	NSString *ruleType;	×
282	switch (newRule.type) {	×
283	case SNTRuleTypeCertificate:	×
284	case SNTRuleTypeBinary: {	×
285	ruleType = @"SHA-256";	×
286	break;	×
287	}	×
288	case SNTRuleTypeTeamID: {	×
289	ruleType = @"Team ID";	×
290	break;	×
291	}	×
292	default: ruleType = @"(Unknown type)";	×
293	}	×
294	if (newRule.state == SNTRuleStateRemove) {	×
295	printf("Removed rule for %s: %s.\n", [ruleType UTF8String],	×
296	[newRule.identifier UTF8String]);	×
297	} else {	×
298	printf("Added rule for %s: %s.\n", [ruleType UTF8String],	×
299	[newRule.identifier UTF8String]);	×
300	}	×
301	exit(0);	×
302	}	×
303	}];	×
304	}	×
305
306	// IMPORTANT: This method makes no attempt to validate whether or not the data
307	// in a rule is valid. It merely constructs a string with the given data.
308	// E.g., TeamID compiler rules are not currently supproted, but if a test rule
309	// is provided with that state, an appropriate string will be returned.
310	+ (NSString )stringifyRule:(SNTRule )rule withColor:(BOOL)colorize {	35✔
311	NSMutableString *output;	35✔
312	// Rule state is saved as eventState for output colorization down below
313	SNTEventState eventState = SNTEventStateUnknown;	35✔
314
315	switch (rule.state) {	35✔
316	case SNTRuleStateUnknown:	5✔
317	output = [@"No rule exists with the given parameters" mutableCopy];	5✔
318	break;	5✔
319	case SNTRuleStateAllow: OS_FALLTHROUGH;	5✔
320	case SNTRuleStateAllowCompiler: OS_FALLTHROUGH;	10✔
321	case SNTRuleStateAllowTransitive:	15✔
322	output = [@"Allowed" mutableCopy];	15✔
323	eventState = SNTEventStateAllow;	15✔
324	break;	15✔
325	case SNTRuleStateBlock: OS_FALLTHROUGH;	5✔
326	case SNTRuleStateSilentBlock:	10✔
327	output = [@"Blocked" mutableCopy];	10✔
328	eventState = SNTEventStateBlock;	10✔
329	break;	10✔
330	case SNTRuleStateRemove: OS_FALLTHROUGH;	5✔
331	default:	5!
332	output = [NSMutableString stringWithFormat:@"Unexpected rule state: %ld", rule.state];	5✔
333	break;	5✔
334	}	35✔
335
336	if (rule.state == SNTRuleStateUnknown) {	35✔
337	// No more output to append
338	return output;	5✔
339	}	5✔
340
341	[output appendString:@" ("];	30✔
342
343	switch (rule.type) {	30✔
344	case SNTRuleTypeUnknown: [output appendString:@"Unknown"]; break;	6✔
345	case SNTRuleTypeBinary: [output appendString:@"Binary"]; break;	6✔
346	case SNTRuleTypeSigningID: [output appendString:@"SigningID"]; break;	6✔
347	case SNTRuleTypeCertificate: [output appendString:@"Certificate"]; break;	6✔
348	case SNTRuleTypeTeamID: [output appendString:@"TeamID"]; break;	6✔
349	default:	×
350	output = [NSMutableString stringWithFormat:@"Unexpected rule type: %ld", rule.type];	×
351	break;	×
352	}	30✔
353
354	// Add additional attributes
355	switch (rule.state) {	30✔
356	case SNTRuleStateAllowCompiler: [output appendString:@", Compiler"]; break;	5✔
357	case SNTRuleStateAllowTransitive: [output appendString:@", Transitive"]; break;	5✔
358	case SNTRuleStateSilentBlock: [output appendString:@", Silent"]; break;	5✔
359	default: break;	15✔
360	}	30✔
361
362	[output appendString:@")"];	30✔
363
364	// Colorize
365	if (colorize) {	30!
366	if ((SNTEventStateAllow & eventState)) {	×
367	[output insertString:@"\033[32m" atIndex:0];	×
368	[output appendString:@"\033[0m"];	×
369	} else if ((SNTEventStateBlock & eventState)) {	×
370	[output insertString:@"\033[31m" atIndex:0];	×
371	[output appendString:@"\033[0m"];	×
372	} else {	×
373	[output insertString:@"\033[33m" atIndex:0];	×
374	[output appendString:@"\033[0m"];	×
375	}	×
376	}	×
377
378	if (rule.state == SNTRuleStateAllowTransitive) {	30✔
379	NSDate *date = [NSDate dateWithTimeIntervalSinceReferenceDate:rule.timestamp];	5✔
380	[output appendString:[NSString stringWithFormat:@"\nlast access date: %@", [date description]]];	5✔
381	}	5✔
382	return output;	30✔
383	}	30✔
384
385	- (void)printStateOfRule:(SNTRule )rule daemonConnection:(MOLXPCConnection )daemonConn {	×
386	id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];	×
387	__block NSString *output;	×
388
389	struct RuleIdentifiers identifiers = {	×
390	.binarySHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil,	×
391	.certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil,	×
392	.teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil,	×
393	.signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil,	×
394	};	×
395
396	[rop databaseRuleForIdentifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]	×
397	reply:^(SNTRule *r) {	×
398	output = [SNTCommandRule stringifyRule:r	×
399	withColor:(isatty(STDOUT_FILENO) == 1)];	×
400	}];	×
401
402	printf("%s\n", output.UTF8String);	×
403	exit(0);	×
404	}	×
405
NEW 406	- (void)importJSONFile:(NSString *)jsonFilePath with:(SNTRuleCleanup)cleanupType {	×
407	// If the file exists parse it and then add the rules one at a time.
408	NSError *error;	×
409	NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];	×
410	if (error) {	×
411	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,	×
412	error.localizedDescription]];	×
413	}	×
414
415	// We expect a JSON object with one key "rules". This is an array of rule
416	// objects.
417	// e.g.
418	// {"rules": [{
419	// "policy" : "BLOCKLIST",
420	// "rule_type" : "BINARY",
421	// "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
422	// "custom_url" : "",
423	// "custom_msg" : "/bin/ls block for demo"
424	// }]}
425	NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];	×
426	if (error) {	×
427	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,	×
428	error.localizedDescription]];	×
429	}	×
430
431	NSMutableArray<SNTRule > parsedRules = [[NSMutableArray alloc] init];	×
432
433	for (NSDictionary *jsonRule in rules[@"rules"]) {	×
434	SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];	×
435	if (!rule) {	×
436	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];	×
437	}	×
438	[parsedRules addObject:rule];	×
439	}	×
440
441	[[self.daemonConn remoteObjectProxy]	×
442	databaseRuleAddRules:parsedRules	×
NEW 443	ruleCleanup:cleanupType	×
444	reply:^(NSError *error) {	×
445	if (error) {	×
446	printf("Failed to modify rules: %s",	×
447	[error.localizedDescription UTF8String]);	×
448	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
449	exit(1);	×
450	}	×
451	exit(0);	×
452	}];	×
453	}	×
454
455	- (void)exportJSONFile:(NSString *)jsonFilePath {	×
456	// Get the rules from the daemon and then write them to the file.
457	id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];	×
458	[rop retrieveAllRules:^(NSArray<SNTRule > rules, NSError *error) {	×
459	if (error) {	×
460	printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);	×
461	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
462	exit(1);	×
463	}	×
464
465	if (rules.count == 0) {	×
466	printf("No rules to export.\n");	×
467	exit(1);	×
468	}	×
469	// Convert Rules to an NSDictionary.
470	NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];	×
471
472	for (SNTRule *rule in rules) {	×
473	// Omit transitive and remove rules as they're not relevant.
474	if (rule.state == SNTRuleStateAllowTransitive \|\| rule.state == SNTRuleStateRemove) {	×
475	continue;	×
476	}	×
477
478	[rulesAsDicts addObject:[rule dictionaryRepresentation]];	×
479	}	×
480
481	NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];	×
482	[outputStream open];	×
483
484	// Write the rules to the file.
485	// File should look like the following JSON:
486	// {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
487	NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}	×
488	options:NSJSONWritingPrettyPrinted	×
489	error:&error];	×
490	// Print error
491	if (error) {	×
492	printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);	×
493	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
494	exit(1);	×
495	}	×
496	// Write jsonData to the file
497	[outputStream write:jsonData.bytes maxLength:jsonData.length];	×
498	[outputStream close];	×
499	exit(0);	×
500	}];	×
501	}	×
502
503	@end

google / santa / 8113089355

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous