8127133904

Committed 03 Mar 2024 02:17AM UTC coverage: 65.049% (+0.4%) from 64.697%

Build # 8127133904

Build Type

Pull #1300

github

Committed by

web-flow

Commit Message

Merge 0d95255e3 into 74d8fe30d

Pull Request Pull Request #1300: Added clean flag for JSON rule import

Run Details

4539 of 9148 branches covered (49.62%)

Branch coverage included in aggregate %.

0 of 78 new or added lines in 1 file covered. (0.0%)

9 existing lines in 2 files now uncovered.

15939 of 22333 relevant lines covered (71.37%)

11946.74 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

14.1

/Source/santactl/Commands/SNTCommandRule.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import <Foundation/Foundation.h>
#import <MOLCertificate/MOLCertificate.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDropRootPrivs.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SNTRuleIdentifiers.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santactl/Commands/SNTCommandRule.h"
#import "Source/santactl/SNTCommand.h"
#import "Source/santactl/SNTCommandController.h"

@implementation SNTCommandRule

REGISTER_COMMAND_NAME(@"rule")

+ (BOOL)requiresRoot {
  return YES;
}

+ (BOOL)requiresDaemonConn {
  return YES;
}

+ (NSString *)shortHelpText {
  return @"Manually add/remove/check rules.";
}

+ (NSString *)longHelpText {
  return (
    @"Usage: santactl rule [options]\n"
    @"  One of:\n"
    @"    --allow: add to allow\n"
    @"    --block: add to block\n"
    @"    --silent-block: add to silent block\n"
    @"    --compiler: allow and mark as a compiler\n"
    @"    --remove: remove existing rule\n"
    @"    --check: check for an existing rule\n"
    @"    --import {path}: import rules from a JSON file\n"
    @"    --export {path}: export rules to a JSON file\n"
    @"\n"
    @"  One of:\n"
    @"    --path {path}: path of binary/bundle to add/remove.\n"
    @"                   Will add the hash of the file currently at that path.\n"
    @"                   Does not work with --check. Use the fileinfo verb to check.\n"
    @"                   the rule state of a file.\n"
    @"    --identifier {sha256|teamID|signingID}: identifier to add/remove/check\n"
    @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
    @"\n"
    @"  Optionally:\n"
    @"    --teamid: add or check a team ID rule instead of binary\n"
    @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
    @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
#ifdef DEBUG
    @"    --force: allow manual changes even when SyncBaseUrl is set\n"
#endif
    @"    --message {message}: custom message\n"
    @"    --clean: when importing rules via JSON clear all non-transitive rules before importing\n"
    @"    --clean-all: when importing rules via JSON clear all rules before importing\n"
    @"\n"
    @"  Notes:\n"
    @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
    @"\n"
    @"      `TeamID:SigningID`\n"
    @"\n"
    @"    Because signing IDs are controlled by the binary author, this ensures\n"
    @"    that the signing ID is properly scoped to a developer. For the special\n"
    @"    case of platform binaries, `TeamID` should be replaced with the string\n"
    @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
    @"    targeting Apple-signed binaries that do not have a team ID.\n"
    @"\n"
    @"  Importing / Exporting Rules:\n"
    @"    If santa is not configured to use a sync server one can export\n"
    @"    & import its non-static rules to and from JSON files using the \n"
    @"    --export/--import flags. These files have the following form:\n"
    @"\n"
    @"    {\"rules\": [{rule-dictionaries}]}\n"
    @"    e.g. {\"rules\": [\n"
    @"                      {\"policy\": \"BLOCKLIST\",\n"
    @"                       \"identifier\": "
    @"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"
    @"                       \"custom_url\" : \"\",\n"
    @"                       \"custom_msg\": \"/bin/ls block for demo\"}\n"
    @"                      ]}\n"
    @"\n"
    @"    By default rules are not cleared when importing. To clear the\n"
    @"    database you must use either --clean or --clean-all\n"
    @"\n");
}

- (void)runWithArguments:(NSArray *)arguments {
  SNTConfigurator *config = [SNTConfigurator configurator];
  if ((config.syncBaseURL || config.staticRules.count) &&
      ![arguments containsObject:@"--check"]
#ifdef DEBUG
      // DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
      && ![arguments containsObject:@"--force"]) {
#else
  ) {
#endif
    printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");
    exit(1);
  }

  SNTRule *newRule = [[SNTRule alloc] init];
  newRule.state = SNTRuleStateUnknown;
  newRule.type = SNTRuleTypeBinary;

  NSString *path;
  NSString *jsonFilePath;
  BOOL check = NO;
  SNTRuleCleanup cleanupType = SNTRuleCleanupNone;
  BOOL importRules = NO;
  BOOL exportRules = NO;

  // Parse arguments
  for (NSUInteger i = 0; i < arguments.count; ++i) {
    NSString *arg = arguments[i];

    if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame ||
        [arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllow;
    } else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateBlock;
    } else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {
      newRule.state = SNTRuleStateSilentBlock;
    } else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {
      newRule.state = SNTRuleStateAllowCompiler;
    } else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {
      newRule.state = SNTRuleStateRemove;
    } else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {
      check = YES;
    } else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeCertificate;
    } else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeTeamID;
    } else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeSigningID;
    } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--path requires an argument"];
      }
      path = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--identifier requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--sha256 requires an argument"];
      }
      newRule.identifier = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--message requires an argument"];
      }
      newRule.customMsg = arguments[i];
#ifdef DEBUG
    } else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {
      // Don't do anything special.
#endif
    } else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {
      if (exportRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      importRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--import requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--clean"] == NSOrderedSame) {
      cleanupType = SNTRuleCleanupNonTransitive;
    } else if ([arg caseInsensitiveCompare:@"--clean-all"] == NSOrderedSame) {
      cleanupType = SNTRuleCleanupAll;
    } else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {
      if (importRules) {
        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
      }
      exportRules = YES;
      if (++i > arguments.count - 1) {
        [self printErrorUsageAndExit:@"--export requires an argument"];
      }
      jsonFilePath = arguments[i];
    } else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame ||
               [arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {
      printf("%s\n", self.class.longHelpText.UTF8String);
      exit(0);
    } else {
      [self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];
    }
  }

  if (!importRules && cleanupType != SNTRuleCleanupNone) {
    switch (cleanupType) {
      case SNTRuleCleanupNonTransitive:
        [self printErrorUsageAndExit:@"--clean can only be used with --import"];
        break;
      case SNTRuleCleanupAll:
        [self printErrorUsageAndExit:@"--clean-all can only be used with --import"];
        break;
      default:
        // This is a programming error.
        LOGE(@"Unexpected SNTRuleCleanupType %ld", cleanupType);
        exit(EXIT_FAILURE);
    }
  }

  if (jsonFilePath.length > 0) {
    if (importRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--import can only be used by itself"];
      }
      [self importJSONFile:jsonFilePath with:cleanupType];
    } else if (exportRules) {
      if (newRule.identifier != nil || path != nil || check) {
        [self printErrorUsageAndExit:@"--export can only be used by itself"];
      }
      [self exportJSONFile:jsonFilePath];
    }
    return;
  }

  if (path) {
    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
    if (!fi.path) {
      [self printErrorUsageAndExit:@"Provided path was not a plain file"];
    }

    if (newRule.type == SNTRuleTypeBinary) {
      newRule.identifier = fi.SHA256;
    } else if (newRule.type == SNTRuleTypeCertificate) {
      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
      newRule.identifier = cs.leafCertificate.SHA256;
    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
      // noop
    }
  }

  if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) {
    NSCharacterSet *nonHex =
      [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
    if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=
        64) {
      [self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];
    }
  }

  if (check) {
    if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];
    return [self printStateOfRule:newRule daemonConnection:self.daemonConn];
  }

  if (newRule.state == SNTRuleStateUnknown) {
    [self printErrorUsageAndExit:@"No state specified"];
  } else if (!newRule.identifier) {
    [self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:@[ newRule ]
             ruleCleanup:SNTRuleCleanupNone
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     } else {
                       NSString *ruleType;
                       switch (newRule.type) {
                         case SNTRuleTypeCertificate:
                         case SNTRuleTypeBinary: {
                           ruleType = @"SHA-256";
                           break;
                         }
                         case SNTRuleTypeTeamID: {
                           ruleType = @"Team ID";
                           break;
                         }
                         default: ruleType = @"(Unknown type)";
                       }
                       if (newRule.state == SNTRuleStateRemove) {
                         printf("Removed rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       } else {
                         printf("Added rule for %s: %s.\n", [ruleType UTF8String],
                                [newRule.identifier UTF8String]);
                       }
                       exit(0);
                     }
                   }];
}

// IMPORTANT: This method makes no attempt to validate whether or not the data
// in a rule is valid. It merely constructs a string with the given data.
// E.g., TeamID compiler rules are not currently supproted, but if a test rule
// is provided with that state, an appropriate string will be returned.
+ (NSString *)stringifyRule:(SNTRule *)rule withColor:(BOOL)colorize {
  NSMutableString *output;
  // Rule state is saved as eventState for output colorization down below
  SNTEventState eventState = SNTEventStateUnknown;

  switch (rule.state) {
    case SNTRuleStateUnknown:
      output = [@"No rule exists with the given parameters" mutableCopy];
      break;
    case SNTRuleStateAllow: OS_FALLTHROUGH;
    case SNTRuleStateAllowCompiler: OS_FALLTHROUGH;
    case SNTRuleStateAllowTransitive:
      output = [@"Allowed" mutableCopy];
      eventState = SNTEventStateAllow;
      break;
    case SNTRuleStateBlock: OS_FALLTHROUGH;
    case SNTRuleStateSilentBlock:
      output = [@"Blocked" mutableCopy];
      eventState = SNTEventStateBlock;
      break;
    case SNTRuleStateRemove: OS_FALLTHROUGH;
    default:
      output = [NSMutableString stringWithFormat:@"Unexpected rule state: %ld", rule.state];
      break;
  }

  if (rule.state == SNTRuleStateUnknown) {
    // No more output to append
    return output;
  }

  [output appendString:@" ("];

  switch (rule.type) {
    case SNTRuleTypeUnknown: [output appendString:@"Unknown"]; break;
    case SNTRuleTypeBinary: [output appendString:@"Binary"]; break;
    case SNTRuleTypeSigningID: [output appendString:@"SigningID"]; break;
    case SNTRuleTypeCertificate: [output appendString:@"Certificate"]; break;
    case SNTRuleTypeTeamID: [output appendString:@"TeamID"]; break;
    default:
      output = [NSMutableString stringWithFormat:@"Unexpected rule type: %ld", rule.type];
      break;
  }

  // Add additional attributes
  switch (rule.state) {
    case SNTRuleStateAllowCompiler: [output appendString:@", Compiler"]; break;
    case SNTRuleStateAllowTransitive: [output appendString:@", Transitive"]; break;
    case SNTRuleStateSilentBlock: [output appendString:@", Silent"]; break;
    default: break;
  }

  [output appendString:@")"];

  // Colorize
  if (colorize) {
    if ((SNTEventStateAllow & eventState)) {
      [output insertString:@"\033[32m" atIndex:0];
      [output appendString:@"\033[0m"];
    } else if ((SNTEventStateBlock & eventState)) {
      [output insertString:@"\033[31m" atIndex:0];
      [output appendString:@"\033[0m"];
    } else {
      [output insertString:@"\033[33m" atIndex:0];
      [output appendString:@"\033[0m"];
    }
  }

  if (rule.state == SNTRuleStateAllowTransitive) {
    NSDate *date = [NSDate dateWithTimeIntervalSinceReferenceDate:rule.timestamp];
    [output appendString:[NSString stringWithFormat:@"\nlast access date: %@", [date description]]];
  }
  return output;
}

- (void)printStateOfRule:(SNTRule *)rule daemonConnection:(MOLXPCConnection *)daemonConn {
  id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];
  __block NSString *output;

  struct RuleIdentifiers identifiers = {
    .binarySHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil,
    .certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil,
    .teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil,
    .signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil,
  };

  [rop databaseRuleForIdentifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]
                            reply:^(SNTRule *r) {
                              output = [SNTCommandRule stringifyRule:r
                                                           withColor:(isatty(STDOUT_FILENO) == 1)];
                            }];

  printf("%s\n", output.UTF8String);
  exit(0);
}

- (void)importJSONFile:(NSString *)jsonFilePath with:(SNTRuleCleanup)cleanupType {
  // If the file exists parse it and then add the rules one at a time.
  NSError *error;
  NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  // We expect a JSON object with one key "rules". This is an array of rule
  // objects.
  // e.g.
  // {"rules": [{
  //  "policy" : "BLOCKLIST",
  //    "rule_type" : "BINARY",
  //    "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
  //    "custom_url" : "",
  //    "custom_msg" : "/bin/ls block for demo"
  //  }]}
  NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];
  if (error) {
    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,
                                                            error.localizedDescription]];
  }

  NSMutableArray<SNTRule *> *parsedRules = [[NSMutableArray alloc] init];

  for (NSDictionary *jsonRule in rules[@"rules"]) {
    SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];
    if (!rule) {
      [self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];
    }
    [parsedRules addObject:rule];
  }

  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:parsedRules
             ruleCleanup:cleanupType
                   reply:^(NSError *error) {
                     if (error) {
                       printf("Failed to modify rules: %s",
                              [error.localizedDescription UTF8String]);
                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
                       exit(1);
                     }
                     exit(0);
                   }];
}

- (void)exportJSONFile:(NSString *)jsonFilePath {
  // Get the rules from the daemon and then write them to the file.
  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
  [rop retrieveAllRules:^(NSArray<SNTRule *> *rules, NSError *error) {
    if (error) {
      printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }

    if (rules.count == 0) {
      printf("No rules to export.\n");
      exit(1);
    }
    // Convert Rules to an NSDictionary.
    NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];

    for (SNTRule *rule in rules) {
      // Omit transitive and remove rules as they're not relevant.
      if (rule.state == SNTRuleStateAllowTransitive || rule.state == SNTRuleStateRemove) {
        continue;
      }

      [rulesAsDicts addObject:[rule dictionaryRepresentation]];
    }

    NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];
    [outputStream open];

    // Write the rules to the file.
    // File should look like the following JSON:
    // {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}
                                                       options:NSJSONWritingPrettyPrinted
                                                         error:&error];
    // Print error
    if (error) {
      printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
      exit(1);
    }
    // Write jsonData to the file
    [outputStream write:jsonData.bytes maxLength:jsonData.length];
    [outputStream close];
    exit(0);
  }];
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import <Foundation/Foundation.h>
16	#import <MOLCertificate/MOLCertificate.h>
17	#import <MOLCodesignChecker/MOLCodesignChecker.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTDropRootPrivs.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTRule.h"
25	#import "Source/common/SNTRuleIdentifiers.h"
26	#import "Source/common/SNTXPCControlInterface.h"
27	#import "Source/santactl/Commands/SNTCommandRule.h"
28	#import "Source/santactl/SNTCommand.h"
29	#import "Source/santactl/SNTCommandController.h"
30
31	@implementation SNTCommandRule
32
33	REGISTER_COMMAND_NAME(@"rule")
34
35	+ (BOOL)requiresRoot {	×
36	return YES;	×
37	}	×
38
39	+ (BOOL)requiresDaemonConn {	×
40	return YES;	×
41	}	×
42
43	+ (NSString *)shortHelpText {	×
44	return @"Manually add/remove/check rules.";	×
45	}	×
46
47	+ (NSString *)longHelpText {	×
NEW 48	return (	×
NEW 49	@"Usage: santactl rule [options]\n"	×
NEW 50	@" One of:\n"	×
NEW 51	@" --allow: add to allow\n"	×
NEW 52	@" --block: add to block\n"	×
NEW 53	@" --silent-block: add to silent block\n"	×
NEW 54	@" --compiler: allow and mark as a compiler\n"	×
NEW 55	@" --remove: remove existing rule\n"	×
NEW 56	@" --check: check for an existing rule\n"	×
NEW 57	@" --import {path}: import rules from a JSON file\n"	×
NEW 58	@" --export {path}: export rules to a JSON file\n"	×
NEW 59	@"\n"	×
NEW 60	@" One of:\n"	×
NEW 61	@" --path {path}: path of binary/bundle to add/remove.\n"	×
NEW 62	@" Will add the hash of the file currently at that path.\n"	×
NEW 63	@" Does not work with --check. Use the fileinfo verb to check.\n"	×
NEW 64	@" the rule state of a file.\n"	×
NEW 65	@" --identifier {sha256\|teamID\|signingID}: identifier to add/remove/check\n"	×
NEW 66	@" --sha256 {sha256}: hash to add/remove/check [deprecated]\n"	×
NEW 67	@"\n"	×
NEW 68	@" Optionally:\n"	×
NEW 69	@" --teamid: add or check a team ID rule instead of binary\n"	×
NEW 70	@" --signingid: add or check a signing ID rule instead of binary (see notes)\n"	×
NEW 71	@" --certificate: add or check a certificate sha256 rule instead of binary\n"	×
72	#ifdef DEBUG	×
NEW 73	@" --force: allow manual changes even when SyncBaseUrl is set\n"	×
74	#endif	×
NEW 75	@" --message {message}: custom message\n"	×
NEW 76	@" --clean: when importing rules via JSON clear all non-transitive rules before importing\n"	×
NEW 77	@" --clean-all: when importing rules via JSON clear all rules before importing\n"	×
NEW 78	@"\n"	×
NEW 79	@" Notes:\n"	×
NEW 80	@" The format of `identifier` when adding/checking a `signingid` rule is:\n"	×
NEW 81	@"\n"	×
NEW 82	@" `TeamID:SigningID`\n"	×
NEW 83	@"\n"	×
NEW 84	@" Because signing IDs are controlled by the binary author, this ensures\n"	×
NEW 85	@" that the signing ID is properly scoped to a developer. For the special\n"	×
NEW 86	@" case of platform binaries, `TeamID` should be replaced with the string\n"	×
NEW 87	@" \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"	×
NEW 88	@" targeting Apple-signed binaries that do not have a team ID.\n"	×
NEW 89	@"\n"	×
NEW 90	@" Importing / Exporting Rules:\n"	×
NEW 91	@" If santa is not configured to use a sync server one can export\n"	×
NEW 92	@" & import its non-static rules to and from JSON files using the \n"	×
NEW 93	@" --export/--import flags. These files have the following form:\n"	×
NEW 94	@"\n"	×
NEW 95	@" {\"rules\": [{rule-dictionaries}]}\n"	×
NEW 96	@" e.g. {\"rules\": [\n"	×
NEW 97	@" {\"policy\": \"BLOCKLIST\",\n"	×
NEW 98	@" \"identifier\": "	×
NEW 99	@"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"	×
NEW 100	@" \"custom_url\" : \"\",\n"	×
NEW 101	@" \"custom_msg\": \"/bin/ls block for demo\"}\n"	×
NEW 102	@" ]}\n"	×
NEW 103	@"\n"	×
NEW 104	@" By default rules are not cleared when importing. To clear the\n"	×
NEW 105	@" database you must use either --clean or --clean-all\n"	×
NEW 106	@"\n");	×
UNCOV 107	}	×
108
109	- (void)runWithArguments:(NSArray *)arguments {	×
110	SNTConfigurator *config = [SNTConfigurator configurator];	×
111	if ((config.syncBaseURL \|\| config.staticRules.count) &&	×
112	![arguments containsObject:@"--check"]	×
113	#ifdef DEBUG	×
114	// DEBUG builds add a --force flag to allow manually adding/removing rules during testing.
115	&& ![arguments containsObject:@"--force"]) {	×
116	#else
117	) {
118	#endif
119	printf("(SyncBaseURL/StaticRules is set, rules are managed centrally.)");	×
120	exit(1);	×
121	}	×
122
123	SNTRule *newRule = [[SNTRule alloc] init];	×
124	newRule.state = SNTRuleStateUnknown;	×
125	newRule.type = SNTRuleTypeBinary;	×
126
127	NSString *path;	×
128	NSString *jsonFilePath;	×
129	BOOL check = NO;	×
NEW 130	SNTRuleCleanup cleanupType = SNTRuleCleanupNone;	×
131	BOOL importRules = NO;	×
132	BOOL exportRules = NO;	×
133
134	// Parse arguments
135	for (NSUInteger i = 0; i < arguments.count; ++i) {	×
136	NSString *arg = arguments[i];	×
137
138	if ([arg caseInsensitiveCompare:@"--allow"] == NSOrderedSame \|\|	×
139	[arg caseInsensitiveCompare:@"--whitelist"] == NSOrderedSame) {	×
140	newRule.state = SNTRuleStateAllow;	×
141	} else if ([arg caseInsensitiveCompare:@"--block"] == NSOrderedSame \|\|	×
142	[arg caseInsensitiveCompare:@"--blacklist"] == NSOrderedSame) {	×
143	newRule.state = SNTRuleStateBlock;	×
144	} else if ([arg caseInsensitiveCompare:@"--silent-block"] == NSOrderedSame \|\|	×
145	[arg caseInsensitiveCompare:@"--silent-blacklist"] == NSOrderedSame) {	×
146	newRule.state = SNTRuleStateSilentBlock;	×
147	} else if ([arg caseInsensitiveCompare:@"--compiler"] == NSOrderedSame) {	×
148	newRule.state = SNTRuleStateAllowCompiler;	×
149	} else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {	×
150	newRule.state = SNTRuleStateRemove;	×
151	} else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {	×
152	check = YES;	×
153	} else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {	×
154	newRule.type = SNTRuleTypeCertificate;	×
155	} else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {	×
156	newRule.type = SNTRuleTypeTeamID;	×
157	} else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {	×
158	newRule.type = SNTRuleTypeSigningID;	×
159	} else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {	×
160	if (++i > arguments.count - 1) {	×
161	[self printErrorUsageAndExit:@"--path requires an argument"];	×
162	}	×
163	path = arguments[i];	×
164	} else if ([arg caseInsensitiveCompare:@"--identifier"] == NSOrderedSame) {	×
165	if (++i > arguments.count - 1) {	×
166	[self printErrorUsageAndExit:@"--identifier requires an argument"];	×
167	}	×
168	newRule.identifier = arguments[i];	×
169	} else if ([arg caseInsensitiveCompare:@"--sha256"] == NSOrderedSame) {	×
170	if (++i > arguments.count - 1) {	×
171	[self printErrorUsageAndExit:@"--sha256 requires an argument"];	×
172	}	×
173	newRule.identifier = arguments[i];	×
174	} else if ([arg caseInsensitiveCompare:@"--message"] == NSOrderedSame) {	×
175	if (++i > arguments.count - 1) {	×
176	[self printErrorUsageAndExit:@"--message requires an argument"];	×
177	}	×
178	newRule.customMsg = arguments[i];	×
179	#ifdef DEBUG	×
180	} else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {	×
181	// Don't do anything special.
182	#endif	×
183	} else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {	×
184	if (exportRules) {	×
185	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
186	}	×
187	importRules = YES;	×
188	if (++i > arguments.count - 1) {	×
189	[self printErrorUsageAndExit:@"--import requires an argument"];	×
190	}	×
191	jsonFilePath = arguments[i];	×
NEW 192	} else if ([arg caseInsensitiveCompare:@"--clean"] == NSOrderedSame) {	×
NEW 193	cleanupType = SNTRuleCleanupNonTransitive;	×
NEW 194	} else if ([arg caseInsensitiveCompare:@"--clean-all"] == NSOrderedSame) {	×
NEW 195	cleanupType = SNTRuleCleanupAll;	×
196	} else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {	×
197	if (importRules) {	×
198	[self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];	×
199	}	×
200	exportRules = YES;	×
201	if (++i > arguments.count - 1) {	×
202	[self printErrorUsageAndExit:@"--export requires an argument"];	×
203	}	×
204	jsonFilePath = arguments[i];	×
205	} else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame \|\|	×
206	[arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {	×
207	printf("%s\n", self.class.longHelpText.UTF8String);	×
208	exit(0);	×
209	} else {	×
210	[self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];	×
211	}	×
212	}	×
213
NEW 214	if (!importRules && cleanupType != SNTRuleCleanupNone) {	×
NEW 215	switch (cleanupType) {	×
NEW 216	case SNTRuleCleanupNonTransitive:	×
NEW 217	[self printErrorUsageAndExit:@"--clean can only be used with --import"];	×
NEW 218	break;	×
NEW 219	case SNTRuleCleanupAll:	×
NEW 220	[self printErrorUsageAndExit:@"--clean-all can only be used with --import"];	×
NEW 221	break;	×
NEW 222	default:	×
223	// This is a programming error.
NEW 224	LOGE(@"Unexpected SNTRuleCleanupType %ld", cleanupType);	×
NEW 225	exit(EXIT_FAILURE);	×
NEW 226	}	×
NEW 227	}	×
228
229	if (jsonFilePath.length > 0) {	×
230	if (importRules) {	×
231	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
232	[self printErrorUsageAndExit:@"--import can only be used by itself"];	×
233	}	×
NEW 234	[self importJSONFile:jsonFilePath with:cleanupType];	×
235	} else if (exportRules) {	×
236	if (newRule.identifier != nil \|\| path != nil \|\| check) {	×
237	[self printErrorUsageAndExit:@"--export can only be used by itself"];	×
238	}	×
239	[self exportJSONFile:jsonFilePath];	×
240	}	×
241	return;	×
242	}	×
243
244	if (path) {	×
245	SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];	×
246	if (!fi.path) {	×
247	[self printErrorUsageAndExit:@"Provided path was not a plain file"];	×
248	}	×
249
250	if (newRule.type == SNTRuleTypeBinary) {	×
251	newRule.identifier = fi.SHA256;	×
252	} else if (newRule.type == SNTRuleTypeCertificate) {	×
253	MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];	×
254	newRule.identifier = cs.leafCertificate.SHA256;	×
255	} else if (newRule.type == SNTRuleTypeTeamID \|\| newRule.type == SNTRuleTypeSigningID) {	×
256	// noop
257	}	×
258	}	×
259
260	if (newRule.type == SNTRuleTypeBinary \|\| newRule.type == SNTRuleTypeCertificate) {	×
261	NSCharacterSet *nonHex =	×
262	[[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];	×
263	if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=	×
264	64) {	×
265	[self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];	×
266	}	×
267	}	×
268
269	if (check) {	×
270	if (!newRule.identifier) return [self printErrorUsageAndExit:@"--check requires --identifier"];	×
271	return [self printStateOfRule:newRule daemonConnection:self.daemonConn];	×
272	}	×
273
274	if (newRule.state == SNTRuleStateUnknown) {	×
275	[self printErrorUsageAndExit:@"No state specified"];	×
276	} else if (!newRule.identifier) {	×
277	[self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];	×
278	}	×
279
280	[[self.daemonConn remoteObjectProxy]	×
281	databaseRuleAddRules:@[ newRule ]	×
282	ruleCleanup:SNTRuleCleanupNone	×
283	reply:^(NSError *error) {	×
284	if (error) {	×
285	printf("Failed to modify rules: %s",	×
286	[error.localizedDescription UTF8String]);	×
287	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
288	exit(1);	×
289	} else {	×
290	NSString *ruleType;	×
291	switch (newRule.type) {	×
292	case SNTRuleTypeCertificate:	×
293	case SNTRuleTypeBinary: {	×
294	ruleType = @"SHA-256";	×
295	break;	×
296	}	×
297	case SNTRuleTypeTeamID: {	×
298	ruleType = @"Team ID";	×
299	break;	×
300	}	×
301	default: ruleType = @"(Unknown type)";	×
302	}	×
303	if (newRule.state == SNTRuleStateRemove) {	×
304	printf("Removed rule for %s: %s.\n", [ruleType UTF8String],	×
305	[newRule.identifier UTF8String]);	×
306	} else {	×
307	printf("Added rule for %s: %s.\n", [ruleType UTF8String],	×
308	[newRule.identifier UTF8String]);	×
309	}	×
310	exit(0);	×
311	}	×
312	}];	×
313	}	×
314
315	// IMPORTANT: This method makes no attempt to validate whether or not the data
316	// in a rule is valid. It merely constructs a string with the given data.
317	// E.g., TeamID compiler rules are not currently supproted, but if a test rule
318	// is provided with that state, an appropriate string will be returned.
319	+ (NSString )stringifyRule:(SNTRule )rule withColor:(BOOL)colorize {	35✔
320	NSMutableString *output;	35✔
321	// Rule state is saved as eventState for output colorization down below
322	SNTEventState eventState = SNTEventStateUnknown;	35✔
323
324	switch (rule.state) {	35✔
325	case SNTRuleStateUnknown:	5✔
326	output = [@"No rule exists with the given parameters" mutableCopy];	5✔
327	break;	5✔
328	case SNTRuleStateAllow: OS_FALLTHROUGH;	5✔
329	case SNTRuleStateAllowCompiler: OS_FALLTHROUGH;	10✔
330	case SNTRuleStateAllowTransitive:	15✔
331	output = [@"Allowed" mutableCopy];	15✔
332	eventState = SNTEventStateAllow;	15✔
333	break;	15✔
334	case SNTRuleStateBlock: OS_FALLTHROUGH;	5✔
335	case SNTRuleStateSilentBlock:	10✔
336	output = [@"Blocked" mutableCopy];	10✔
337	eventState = SNTEventStateBlock;	10✔
338	break;	10✔
339	case SNTRuleStateRemove: OS_FALLTHROUGH;	5✔
340	default:	5!
341	output = [NSMutableString stringWithFormat:@"Unexpected rule state: %ld", rule.state];	5✔
342	break;	5✔
343	}	35✔
344
345	if (rule.state == SNTRuleStateUnknown) {	35✔
346	// No more output to append
347	return output;	5✔
348	}	5✔
349
350	[output appendString:@" ("];	30✔
351
352	switch (rule.type) {	30✔
353	case SNTRuleTypeUnknown: [output appendString:@"Unknown"]; break;	6✔
354	case SNTRuleTypeBinary: [output appendString:@"Binary"]; break;	6✔
355	case SNTRuleTypeSigningID: [output appendString:@"SigningID"]; break;	6✔
356	case SNTRuleTypeCertificate: [output appendString:@"Certificate"]; break;	6✔
357	case SNTRuleTypeTeamID: [output appendString:@"TeamID"]; break;	6✔
358	default:	×
359	output = [NSMutableString stringWithFormat:@"Unexpected rule type: %ld", rule.type];	×
360	break;	×
361	}	30✔
362
363	// Add additional attributes
364	switch (rule.state) {	30✔
365	case SNTRuleStateAllowCompiler: [output appendString:@", Compiler"]; break;	5✔
366	case SNTRuleStateAllowTransitive: [output appendString:@", Transitive"]; break;	5✔
367	case SNTRuleStateSilentBlock: [output appendString:@", Silent"]; break;	5✔
368	default: break;	15✔
369	}	30✔
370
371	[output appendString:@")"];	30✔
372
373	// Colorize
374	if (colorize) {	30!
375	if ((SNTEventStateAllow & eventState)) {	×
376	[output insertString:@"\033[32m" atIndex:0];	×
377	[output appendString:@"\033[0m"];	×
378	} else if ((SNTEventStateBlock & eventState)) {	×
379	[output insertString:@"\033[31m" atIndex:0];	×
380	[output appendString:@"\033[0m"];	×
381	} else {	×
382	[output insertString:@"\033[33m" atIndex:0];	×
383	[output appendString:@"\033[0m"];	×
384	}	×
385	}	×
386
387	if (rule.state == SNTRuleStateAllowTransitive) {	30✔
388	NSDate *date = [NSDate dateWithTimeIntervalSinceReferenceDate:rule.timestamp];	5✔
389	[output appendString:[NSString stringWithFormat:@"\nlast access date: %@", [date description]]];	5✔
390	}	5✔
391	return output;	30✔
392	}	30✔
393
394	- (void)printStateOfRule:(SNTRule )rule daemonConnection:(MOLXPCConnection )daemonConn {	×
395	id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];	×
396	__block NSString *output;	×
397
398	struct RuleIdentifiers identifiers = {	×
399	.binarySHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil,	×
400	.certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil,	×
401	.teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil,	×
402	.signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil,	×
403	};	×
404
405	[rop databaseRuleForIdentifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]	×
406	reply:^(SNTRule *r) {	×
407	output = [SNTCommandRule stringifyRule:r	×
408	withColor:(isatty(STDOUT_FILENO) == 1)];	×
409	}];	×
410
411	printf("%s\n", output.UTF8String);	×
412	exit(0);	×
413	}	×
414
NEW 415	- (void)importJSONFile:(NSString *)jsonFilePath with:(SNTRuleCleanup)cleanupType {	×
416	// If the file exists parse it and then add the rules one at a time.
417	NSError *error;	×
418	NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];	×
419	if (error) {	×
420	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,	×
421	error.localizedDescription]];	×
422	}	×
423
424	// We expect a JSON object with one key "rules". This is an array of rule
425	// objects.
426	// e.g.
427	// {"rules": [{
428	// "policy" : "BLOCKLIST",
429	// "rule_type" : "BINARY",
430	// "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
431	// "custom_url" : "",
432	// "custom_msg" : "/bin/ls block for demo"
433	// }]}
434	NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];	×
435	if (error) {	×
436	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,	×
437	error.localizedDescription]];	×
438	}	×
439
440	NSMutableArray<SNTRule > parsedRules = [[NSMutableArray alloc] init];	×
441
442	for (NSDictionary *jsonRule in rules[@"rules"]) {	×
443	SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];	×
444	if (!rule) {	×
445	[self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];	×
446	}	×
447	[parsedRules addObject:rule];	×
448	}	×
449
450	[[self.daemonConn remoteObjectProxy]	×
451	databaseRuleAddRules:parsedRules	×
NEW 452	ruleCleanup:cleanupType	×
453	reply:^(NSError *error) {	×
454	if (error) {	×
455	printf("Failed to modify rules: %s",	×
456	[error.localizedDescription UTF8String]);	×
457	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
458	exit(1);	×
459	}	×
460	exit(0);	×
461	}];	×
462	}	×
463
464	- (void)exportJSONFile:(NSString *)jsonFilePath {	×
465	// Get the rules from the daemon and then write them to the file.
466	id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];	×
467	[rop retrieveAllRules:^(NSArray<SNTRule > rules, NSError *error) {	×
468	if (error) {	×
469	printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);	×
470	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
471	exit(1);	×
472	}	×
473
474	if (rules.count == 0) {	×
475	printf("No rules to export.\n");	×
476	exit(1);	×
477	}	×
478	// Convert Rules to an NSDictionary.
479	NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];	×
480
481	for (SNTRule *rule in rules) {	×
482	// Omit transitive and remove rules as they're not relevant.
483	if (rule.state == SNTRuleStateAllowTransitive \|\| rule.state == SNTRuleStateRemove) {	×
484	continue;	×
485	}	×
486
487	[rulesAsDicts addObject:[rule dictionaryRepresentation]];	×
488	}	×
489
490	NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];	×
491	[outputStream open];	×
492
493	// Write the rules to the file.
494	// File should look like the following JSON:
495	// {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
496	NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}	×
497	options:NSJSONWritingPrettyPrinted	×
498	error:&error];	×
499	// Print error
500	if (error) {	×
501	printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);	×
502	LOGD(@"Failure reason: %@", error.localizedFailureReason);	×
503	exit(1);	×
504	}	×
505	// Write jsonData to the file
506	[outputStream write:jsonData.bytes maxLength:jsonData.length];	×
507	[outputStream close];	×
508	exit(0);	×
509	}];	×
510	}	×
511
512	@end

google / santa / 8127133904

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous