8157807405

Committed 05 Mar 2024 02:21PM UTC coverage: 65.123% (+0.5%) from 64.591%

Build # 8157807405

Build Type

Pull #1301

github

Committed by

web-flow

Commit Message

Merge 106c7881f into 6a697e00e

Pull Request Pull Request #1301: Add support for CDHash rule types

Run Details

4608 of 9286 branches covered (49.62%)

Branch coverage included in aggregate %.

265 of 351 new or added lines in 19 files covered. (75.5%)

4 existing lines in 4 files now uncovered.

16178 of 22632 relevant lines covered (71.48%)

13315.62 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

66.5

/Source/santad/SNTExecutionController.mm


/// Copyright 2015-2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTExecutionController.h"
#include <Foundation/Foundation.h>

#import <MOLCodesignChecker/MOLCodesignChecker.h>
#include <bsm/libbsm.h>
#include <copyfile.h>
#include <libproc.h>
#include <pwd.h>
#include <sys/param.h>
#include <utmpx.h>

#include <memory>
#include <set>
#include <string>

#include "Source/common/BranchPrediction.h"
#include "Source/common/PrefixTree.h"
#import "Source/common/SNTBlockMessage.h"
#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeepCopy.h"
#import "Source/common/SNTDropRootPrivs.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTMetricSet.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SNTStoredEvent.h"
#include "Source/common/SantaVnode.h"
#include "Source/common/String.h"
#include "Source/common/Unit.h"
#import "Source/santad/DataLayer/SNTEventTable.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#import "Source/santad/SNTDecisionCache.h"
#import "Source/santad/SNTNotificationQueue.h"
#import "Source/santad/SNTPolicyProcessor.h"
#import "Source/santad/SNTSyncdQueue.h"
#include "absl/synchronization/mutex.h"

using santa::common::PrefixTree;
using santa::common::Unit;
using santa::santad::TTYWriter;
using santa::santad::event_providers::endpoint_security::Message;

static const size_t kMaxAllowedPathLength = MAXPATHLEN - 1;  // -1 to account for null terminator

void UpdateTeamIDFilterLocked(std::set<std::string> &filterSet, NSArray<NSString *> *filter) {
  filterSet.clear();

  for (NSString *prefix in filter) {
    filterSet.insert(santa::common::NSStringToUTF8String(prefix));
  }
}

void UpdatePrefixFilterLocked(std::unique_ptr<PrefixTree<Unit>> &tree,
                              NSArray<NSString *> *filter) {
  tree->Reset();

  for (NSString *item in filter) {
    tree->InsertPrefix(item.UTF8String, Unit{});
  }
}

@interface SNTExecutionController ()
@property SNTEventTable *eventTable;
@property SNTNotificationQueue *notifierQueue;
@property SNTPolicyProcessor *policyProcessor;
@property SNTRuleTable *ruleTable;
@property SNTSyncdQueue *syncdQueue;
@property SNTMetricCounter *events;

@property dispatch_queue_t eventQueue;
@end

@implementation SNTExecutionController {
  std::shared_ptr<TTYWriter> _ttyWriter;
  absl::Mutex _entitlementFilterMutex;
  std::set<std::string> _entitlementsTeamIDFilter;
  std::unique_ptr<PrefixTree<Unit>> _entitlementsPrefixFilter;
}

static NSString *const kPrinterProxyPreMonterey =
  (@"/System/Library/Frameworks/Carbon.framework/Versions/Current/"
   @"Frameworks/Print.framework/Versions/Current/Plugins/PrinterProxy.app/"
   @"Contents/MacOS/PrinterProxy");
static NSString *const kPrinterProxyPostMonterey =
  (@"/System/Library/PrivateFrameworks/PrintingPrivate.framework/"
   @"Versions/Current/Plugins/PrinterProxy.app/Contents/MacOS/PrinterProxy");

#pragma mark Initializers

- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable
                       eventTable:(SNTEventTable *)eventTable
                    notifierQueue:(SNTNotificationQueue *)notifierQueue
                       syncdQueue:(SNTSyncdQueue *)syncdQueue
                        ttyWriter:(std::shared_ptr<TTYWriter>)ttyWriter
         entitlementsPrefixFilter:(NSArray<NSString *> *)entitlementsPrefixFilter
         entitlementsTeamIDFilter:(NSArray<NSString *> *)entitlementsTeamIDFilter {
  self = [super init];
  if (self) {
    _ruleTable = ruleTable;
    _eventTable = eventTable;
    _notifierQueue = notifierQueue;
    _syncdQueue = syncdQueue;
    _ttyWriter = std::move(ttyWriter);
    _policyProcessor = [[SNTPolicyProcessor alloc] initWithRuleTable:_ruleTable];

    _eventQueue =
      dispatch_queue_create("com.google.santa.daemon.event_upload", DISPATCH_QUEUE_SERIAL);

    // This establishes the XPC connection between libsecurity and syspolicyd.
    // Not doing this causes a deadlock as establishing this link goes through xpcproxy.
    (void)[[MOLCodesignChecker alloc] initWithSelf];

    SNTMetricSet *metricSet = [SNTMetricSet sharedInstance];
    _events = [metricSet counterWithName:@"/santa/events"
                              fieldNames:@[ @"action_response" ]
                                helpText:@"Events processed by Santa per response"];

    self->_entitlementsPrefixFilter = std::make_unique<PrefixTree<Unit>>();

    UpdatePrefixFilterLocked(self->_entitlementsPrefixFilter, entitlementsPrefixFilter);
    UpdateTeamIDFilterLocked(self->_entitlementsTeamIDFilter, entitlementsTeamIDFilter);
  }
  return self;
}

- (void)updateEntitlementsPrefixFilter:(NSArray<NSString *> *)filter {
  absl::MutexLock lock(&self->_entitlementFilterMutex);
  UpdatePrefixFilterLocked(self->_entitlementsPrefixFilter, filter);
}

- (void)updateEntitlementsTeamIDFilter:(NSArray<NSString *> *)filter {
  absl::MutexLock lock(&self->_entitlementFilterMutex);
  UpdateTeamIDFilterLocked(self->_entitlementsTeamIDFilter, filter);
}

- (void)incrementEventCounters:(SNTEventState)eventType {
  const NSString *eventTypeStr;

  switch (eventType) {
    case SNTEventStateBlockBinary: eventTypeStr = kBlockBinary; break;
    case SNTEventStateAllowBinary: eventTypeStr = kAllowBinary; break;
    case SNTEventStateBlockCertificate: eventTypeStr = kBlockCertificate; break;
    case SNTEventStateAllowCertificate: eventTypeStr = kAllowCertificate; break;
    case SNTEventStateBlockTeamID: eventTypeStr = kBlockTeamID; break;
    case SNTEventStateAllowTeamID: eventTypeStr = kAllowTeamID; break;
    case SNTEventStateBlockSigningID: eventTypeStr = kBlockSigningID; break;
    case SNTEventStateAllowSigningID: eventTypeStr = kAllowSigningID; break;
    case SNTEventStateBlockCDHash: eventTypeStr = kBlockCDHash; break;
    case SNTEventStateAllowCDHash: eventTypeStr = kAllowCDHash; break;
    case SNTEventStateBlockScope: eventTypeStr = kBlockScope; break;
    case SNTEventStateAllowScope: eventTypeStr = kAllowScope; break;
    case SNTEventStateBlockUnknown: eventTypeStr = kBlockUnknown; break;
    case SNTEventStateAllowUnknown: eventTypeStr = kAllowUnknown; break;
    case SNTEventStateAllowCompiler: eventTypeStr = kAllowCompiler; break;
    case SNTEventStateAllowTransitive: eventTypeStr = kAllowTransitive; break;
    case SNTEventStateBlockLongPath: eventTypeStr = kBlockLongPath; break;
    default: eventTypeStr = kUnknownEventState; break;
  }

  [_events incrementForFieldValues:@[ (NSString *)eventTypeStr ]];
}

#pragma mark Binary Validation

- (bool)synchronousShouldProcessExecEvent:(const Message &)esMsg {
  if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {
    // Programming error. Bail.
    LOGE(@"Attempt to validate non-EXEC event. Event type: %d", esMsg->event_type);
    [NSException
       raise:@"Invalid event type"
      format:@"synchronousShouldProcessExecEvent: Unexpected event type: %d", esMsg->event_type];
  }

  const es_process_t *targetProc = esMsg->event.exec.target;

  if (targetProc->executable->path.length > kMaxAllowedPathLength ||
      targetProc->executable->path_truncated) {
    // Store a SNTCachedDecision so that this event gets properly logged
    SNTCachedDecision *cd =
      [[SNTCachedDecision alloc] initWithEndpointSecurityFile:targetProc->executable];
    cd.decision = SNTEventStateBlockLongPath;
    cd.customMsg = [NSString stringWithFormat:@"Path exceeded max length for processing (%zu)",
                                              targetProc->executable->path.length];

    if (targetProc->team_id.data) {
      cd.teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
    }

    // TODO(mlw): We should be able to grab signing info to have more-enriched log messages in the
    // future. The code to do this should probably be abstracted from the SNTPolicyProcessor.

    [[SNTDecisionCache sharedCache] cacheDecision:cd];

    return NO;
  }

  // An SNTCachedDecision will be created later on during full processing
  return YES;
}

- (void)validateExecEvent:(const Message &)esMsg postAction:(bool (^)(SNTAction))postAction {
  if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {
    // Programming error. Bail.
    LOGE(@"Attempt to validate non-EXEC event. Event type: %d", esMsg->event_type);
    [NSException
       raise:@"Invalid event type"
      format:@"validateExecEvent:postAction: Unexpected event type: %d", esMsg->event_type];
  }

  // Get info about the file. If we can't get this info, respond appropriately and log an error.
  SNTConfigurator *config = [SNTConfigurator configurator];
  const es_process_t *targetProc = esMsg->event.exec.target;

  NSError *fileInfoError;
  SNTFileInfo *binInfo = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetProc->executable
                                                                     error:&fileInfoError];
  if (unlikely(!binInfo)) {
    if (config.failClosed) {
      LOGE(@"Failed to read file %@: %@ and denying action", @(targetProc->executable->path.data),
           fileInfoError.localizedDescription);
      postAction(SNTActionRespondDeny);
      [self.events incrementForFieldValues:@[ (NSString *)kDenyNoFileInfo ]];
    } else {
      LOGE(@"Failed to read file %@: %@ but allowing action", @(targetProc->executable->path.data),
           fileInfoError.localizedDescription);
      postAction(SNTActionRespondAllow);
      [self.events incrementForFieldValues:@[ (NSString *)kAllowNoFileInfo ]];
    }
    return;
  }

  // PrinterProxy workaround, see description above the method for more details.
  if ([self printerProxyWorkaround:binInfo]) {
    postAction(SNTActionRespondDeny);
    [self.events incrementForFieldValues:@[ (NSString *)kBlockPrinterWorkaround ]];
    return;
  }

  // TODO(markowsky): Maybe add a metric here for how many large executables we're seeing.
  // if (binInfo.fileSize > SomeUpperLimit) ...

  SNTCachedDecision *cd = [self.policyProcessor
           decisionForFileInfo:binInfo
                 targetProcess:targetProc
    entitlementsFilterCallback:^NSDictionary *(const char *teamID, NSDictionary *entitlements) {
      if (!entitlements) {
        return nil;
      }

      absl::ReaderMutexLock lock(&self->_entitlementFilterMutex);

      if (teamID && self->_entitlementsTeamIDFilter.count(std::string(teamID)) > 0) {
        // Dropping entitlement logging for configured TeamID
        return nil;
      }

      if (self->_entitlementsPrefixFilter->NodeCount() == 0) {
        // Copying full entitlements for TeamID
        return [entitlements sntDeepCopy];
      } else {
        // Filtering entitlements for TeamID
        NSMutableDictionary *filtered = [NSMutableDictionary dictionary];

        [entitlements enumerateKeysAndObjectsUsingBlock:^(NSString *key, id obj, BOOL *stop) {
          if (!self->_entitlementsPrefixFilter->HasPrefix(key.UTF8String)) {
            if ([obj isKindOfClass:[NSArray class]] || [obj isKindOfClass:[NSDictionary class]]) {
              [filtered setObject:[obj sntDeepCopy] forKey:key];
            } else {
              [filtered setObject:[obj copy] forKey:key];
            }
          }
        }];

        return filtered.count > 0 ? filtered : nil;
      }
    }];

  cd.vnodeId = SantaVnode::VnodeForFile(targetProc->executable);

  // Formulate an initial action from the decision.
  SNTAction action =
    (SNTEventStateAllow & cd.decision) ? SNTActionRespondAllow : SNTActionRespondDeny;

  // Save decision details for logging the execution later.  For transitive rules, we also use
  // the shasum stored in the decision details to update the rule's timestamp whenever an
  // ACTION_NOTIFY_EXEC message related to the transitive rule is received.
  [[SNTDecisionCache sharedCache] cacheDecision:cd];

  // Upgrade the action to SNTActionRespondAllowCompiler when appropriate, because we want the
  // kernel to track this information in its decision cache.
  if (cd.decision == SNTEventStateAllowCompiler) {
    action = SNTActionRespondAllowCompiler;
  }

  // Respond with the decision.
  postAction(action);

  // Increment metric counters
  [self incrementEventCounters:cd.decision];

  // Log to database if necessary.
  if (config.enableAllEventUpload ||
      (cd.decision == SNTEventStateAllowUnknown && !config.disableUnknownEventUpload) ||
      (cd.decision & SNTEventStateAllow) == 0) {
    SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
    se.occurrenceDate = [[NSDate alloc] init];
    se.fileSHA256 = cd.sha256;
    se.filePath = binInfo.path;
    se.decision = cd.decision;

    se.signingChain = cd.certChain;
    se.teamID = cd.teamID;
    se.signingID = cd.signingID;
    se.cdhash = cd.cdhash;
    se.pid = @(audit_token_to_pid(targetProc->audit_token));
    se.ppid = @(audit_token_to_pid(targetProc->parent_audit_token));
    se.parentName = @(esMsg.ParentProcessName().c_str());

    // Bundle data
    se.fileBundleID = [binInfo bundleIdentifier];
    se.fileBundleName = [binInfo bundleName];
    se.fileBundlePath = [binInfo bundlePath];
    if ([binInfo bundleShortVersionString]) {
      se.fileBundleVersionString = [binInfo bundleShortVersionString];
    }
    if ([binInfo bundleVersion]) {
      se.fileBundleVersion = [binInfo bundleVersion];
    }

    // User data
    struct passwd *user = getpwuid(audit_token_to_ruid(targetProc->audit_token));
    if (user) se.executingUser = @(user->pw_name);
    NSArray *loggedInUsers, *currentSessions;
    [self loggedInUsers:&loggedInUsers sessions:&currentSessions];
    se.currentSessions = currentSessions;
    se.loggedInUsers = loggedInUsers;

    // Quarantine data
    se.quarantineDataURL = binInfo.quarantineDataURL;
    se.quarantineRefererURL = binInfo.quarantineRefererURL;
    se.quarantineTimestamp = binInfo.quarantineTimestamp;
    se.quarantineAgentBundleID = binInfo.quarantineAgentBundleID;

    // Only store events if there is a sync server configured.
    if (config.syncBaseURL) {
      dispatch_async(_eventQueue, ^{
        [self.eventTable addStoredEvent:se];
      });
    }

    // If binary was blocked, do the needful
    if (action != SNTActionRespondAllow && action != SNTActionRespondAllowCompiler) {
      if (config.enableBundles && binInfo.bundle) {
        // If the binary is part of a bundle, find and hash all the related binaries in the bundle.
        // Let the GUI know hashing is needed. Once the hashing is complete the GUI will send a
        // message to santad to perform the upload logic for bundles.
        // See syncBundleEvent:relatedEvents: for more info.
        se.needsBundleHash = YES;
      } else if (config.syncBaseURL) {
        // So the server has something to show the user straight away, initiate an event
        // upload for the blocked binary rather than waiting for the next sync.
        dispatch_async(_eventQueue, ^{
          [self.syncdQueue addEvents:@[ se ] isFromBundle:NO];
        });
      }

      if (!cd.silentBlock) {
        if (!config.enableSilentTTYMode && self->_ttyWriter && TTYWriter::CanWrite(targetProc)) {
          // Let the user know what happened on the terminal
          NSAttributedString *s = [SNTBlockMessage attributedBlockMessageForEvent:se
                                                                    customMessage:cd.customMsg];

          NSMutableString *msg = [NSMutableString stringWithCapacity:1024];
          // Escape sequences `\033[1m` and `\033[0m` begin/end bold lettering
          [msg appendFormat:@"\n\033[1mSanta\033[0m\n\n%@\n\n", s.string];
          [msg appendFormat:@"\033[1mPath:      \033[0m %@\n"
                            @"\033[1mIdentifier:\033[0m %@\n"
                            @"\033[1mParent:    \033[0m %@ (%@)\n\n",
                            se.filePath, se.fileSHA256, se.parentName, se.ppid];
          NSURL *detailURL = [SNTBlockMessage eventDetailURLForEvent:se customURL:cd.customURL];
          if (detailURL) {
            [msg appendFormat:@"More info:\n%@\n\n", detailURL.absoluteString];
          }

          self->_ttyWriter->Write(targetProc, msg);
        }

        // Let the user know what happened in the GUI.
        [self.notifierQueue addEvent:se withCustomMessage:cd.customMsg andCustomURL:cd.customURL];
      }
    }
  }
}

/**
  Workaround for issue with PrinterProxy.app.

  Every time a new printer is added to the machine, a copy of the PrinterProxy.app is copied from
  the Print.framework to ~/Library/Printers with the name of the printer as the name of the app.
  The binary inside is changed slightly (in a way that is unique to the printer name) and then
  re-signed with an adhoc signature. I don't know why this is done but it seems that the binary
  itself doesn't need to be changed as copying the old one back in-place seems to work,
  so that's what we do.

  If this workaround is applied the decision request is not responded to as the existing request
  is invalidated when the file is closed which will trigger a brand new request coming from the
  kernel.

  @param fi SNTFileInfo object for the binary being executed.
  @return YES if the workaround was applied, NO otherwise.
*/
- (BOOL)printerProxyWorkaround:(SNTFileInfo *)fi {
  if ([fi.path hasSuffix:@"/Contents/MacOS/PrinterProxy"] &&
      [fi.path containsString:@"Library/Printers"]) {
    SNTFileInfo *proxyFi = [self printerProxyFileInfo];
    if ([proxyFi.SHA256 isEqual:fi.SHA256]) return NO;

    copyfile_flags_t copyflags = COPYFILE_ALL | COPYFILE_UNLINK;
    if (copyfile(proxyFi.path.UTF8String, fi.path.UTF8String, NULL, copyflags) != 0) {
      LOGE(@"Failed to apply PrinterProxy workaround for %@", fi.path);
    } else {
      LOGI(@"PrinterProxy workaround applied to: %@", fi.path);
    }

    return YES;
  }
  return NO;
}

/**
  Returns an SNTFileInfo for the system PrinterProxy path on this system.
*/
- (SNTFileInfo *)printerProxyFileInfo {
  SNTFileInfo *proxyInfo = [[SNTFileInfo alloc] initWithPath:kPrinterProxyPostMonterey];
  if (!proxyInfo) proxyInfo = [[SNTFileInfo alloc] initWithPath:kPrinterProxyPreMonterey];
  return proxyInfo;
}

- (void)loggedInUsers:(NSArray **)users sessions:(NSArray **)sessions {
  NSMutableSet *loggedInUsers = [NSMutableSet set];
  NSMutableArray *loggedInHosts = [NSMutableArray array];

  struct utmpx *nxt;
  while ((nxt = getutxent())) {
    if (nxt->ut_type != USER_PROCESS) continue;

    NSString *userName = @(nxt->ut_user);
    NSString *sessionName;
    if (strnlen(nxt->ut_host, 1) > 0) {
      sessionName = [NSString stringWithFormat:@"%@@%s", userName, nxt->ut_host];
    } else {
      sessionName = [NSString stringWithFormat:@"%@@%s", userName, nxt->ut_line];
    }

    if (userName.length) [loggedInUsers addObject:userName];
    if (sessionName.length) [loggedInHosts addObject:sessionName];
  }
  endutxent();

  *users = [loggedInUsers allObjects];
  *sessions = [loggedInHosts copy];
}

@end

1
2	/// Copyright 2015-2022 Google Inc. All rights reserved.
3	///
4	/// Licensed under the Apache License, Version 2.0 (the "License");
5	/// you may not use this file except in compliance with the License.
6	/// You may obtain a copy of the License at
7	///
8	/// http://www.apache.org/licenses/LICENSE-2.0
9	///
10	/// Unless required by applicable law or agreed to in writing, software
11	/// distributed under the License is distributed on an "AS IS" BASIS,
12	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	/// See the License for the specific language governing permissions and
14	/// limitations under the License.
15
16	#import "Source/santad/SNTExecutionController.h"
17	#include <Foundation/Foundation.h>
18
19	#import <MOLCodesignChecker/MOLCodesignChecker.h>
20	#include <bsm/libbsm.h>
21	#include <copyfile.h>
22	#include <libproc.h>
23	#include <pwd.h>
24	#include <sys/param.h>
25	#include <utmpx.h>
26
27	#include <memory>
28	#include <set>
29	#include <string>
30
31	#include "Source/common/BranchPrediction.h"
32	#include "Source/common/PrefixTree.h"
33	#import "Source/common/SNTBlockMessage.h"
34	#import "Source/common/SNTCachedDecision.h"
35	#import "Source/common/SNTCommonEnums.h"
36	#import "Source/common/SNTConfigurator.h"
37	#import "Source/common/SNTDeepCopy.h"
38	#import "Source/common/SNTDropRootPrivs.h"
39	#import "Source/common/SNTFileInfo.h"
40	#import "Source/common/SNTLogging.h"
41	#import "Source/common/SNTMetricSet.h"
42	#import "Source/common/SNTRule.h"
43	#import "Source/common/SNTStoredEvent.h"
44	#include "Source/common/SantaVnode.h"
45	#include "Source/common/String.h"
46	#include "Source/common/Unit.h"
47	#import "Source/santad/DataLayer/SNTEventTable.h"
48	#import "Source/santad/DataLayer/SNTRuleTable.h"
49	#import "Source/santad/SNTDecisionCache.h"
50	#import "Source/santad/SNTNotificationQueue.h"
51	#import "Source/santad/SNTPolicyProcessor.h"
52	#import "Source/santad/SNTSyncdQueue.h"
53	#include "absl/synchronization/mutex.h"
54
55	using santa::common::PrefixTree;
56	using santa::common::Unit;
57	using santa::santad::TTYWriter;
58	using santa::santad::event_providers::endpoint_security::Message;
59
60	static const size_t kMaxAllowedPathLength = MAXPATHLEN - 1; // -1 to account for null terminator
61
62	void UpdateTeamIDFilterLocked(std::set<std::string> &filterSet, NSArray<NSString > filter) {	53✔
63	filterSet.clear();	53✔
64
65	for (NSString *prefix in filter) {	×
66	filterSet.insert(santa::common::NSStringToUTF8String(prefix));	×
67	}	×
68	}	53✔
69
70	void UpdatePrefixFilterLocked(std::unique_ptr<PrefixTree<Unit>> &tree,
71	NSArray<NSString > filter) {	53✔
72	tree->Reset();	53✔
73
74	for (NSString *item in filter) {	×
75	tree->InsertPrefix(item.UTF8String, Unit{});	×
76	}	×
77	}	53✔
78
79	@interface SNTExecutionController ()
80	@property SNTEventTable *eventTable;
81	@property SNTNotificationQueue *notifierQueue;
82	@property SNTPolicyProcessor *policyProcessor;
83	@property SNTRuleTable *ruleTable;
84	@property SNTSyncdQueue *syncdQueue;
85	@property SNTMetricCounter *events;
86
87	@property dispatch_queue_t eventQueue;
88	@end
89
90	@implementation SNTExecutionController {
91	std::shared_ptr<TTYWriter> _ttyWriter;
92	absl::Mutex _entitlementFilterMutex;
93	std::set<std::string> _entitlementsTeamIDFilter;
94	std::unique_ptr<PrefixTree<Unit>> _entitlementsPrefixFilter;
95	}
96
97	static NSString *const kPrinterProxyPreMonterey =
98	(@"/System/Library/Frameworks/Carbon.framework/Versions/Current/"
99	@"Frameworks/Print.framework/Versions/Current/Plugins/PrinterProxy.app/"
100	@"Contents/MacOS/PrinterProxy");
101	static NSString *const kPrinterProxyPostMonterey =
102	(@"/System/Library/PrivateFrameworks/PrintingPrivate.framework/"
103	@"Versions/Current/Plugins/PrinterProxy.app/Contents/MacOS/PrinterProxy");
104
105	#pragma mark Initializers
106
107	- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable
108	eventTable:(SNTEventTable *)eventTable
109	notifierQueue:(SNTNotificationQueue *)notifierQueue
110	syncdQueue:(SNTSyncdQueue *)syncdQueue
111	ttyWriter:(std::shared_ptr<TTYWriter>)ttyWriter
112	entitlementsPrefixFilter:(NSArray<NSString > )entitlementsPrefixFilter
113	entitlementsTeamIDFilter:(NSArray<NSString > )entitlementsTeamIDFilter {	53✔
114	self = [super init];	53✔
115	if (self) {	53!
116	_ruleTable = ruleTable;	53✔
117	_eventTable = eventTable;	53✔
118	_notifierQueue = notifierQueue;	53✔
119	_syncdQueue = syncdQueue;	53✔
120	_ttyWriter = std::move(ttyWriter);	53✔
121	_policyProcessor = [[SNTPolicyProcessor alloc] initWithRuleTable:_ruleTable];	53✔
122
123	_eventQueue =	53✔
124	dispatch_queue_create("com.google.santa.daemon.event_upload", DISPATCH_QUEUE_SERIAL);	53✔
125
126	// This establishes the XPC connection between libsecurity and syspolicyd.
127	// Not doing this causes a deadlock as establishing this link goes through xpcproxy.
128	(void)[[MOLCodesignChecker alloc] initWithSelf];	53✔
129
130	SNTMetricSet *metricSet = [SNTMetricSet sharedInstance];	53✔
131	_events = [metricSet counterWithName:@"/santa/events"	53✔
132	fieldNames:@[ @"action_response" ]	53✔
133	helpText:@"Events processed by Santa per response"];	53✔
134
135	self->_entitlementsPrefixFilter = std::make_unique<PrefixTree<Unit>>();	53✔
136
137	UpdatePrefixFilterLocked(self->_entitlementsPrefixFilter, entitlementsPrefixFilter);	53✔
138	UpdateTeamIDFilterLocked(self->_entitlementsTeamIDFilter, entitlementsTeamIDFilter);	53✔
139	}	53✔
140	return self;	53✔
141	}	53✔
142
143	- (void)updateEntitlementsPrefixFilter:(NSArray<NSString > )filter {	×
144	absl::MutexLock lock(&self->_entitlementFilterMutex);	×
145	UpdatePrefixFilterLocked(self->_entitlementsPrefixFilter, filter);	×
146	}	×
147
148	- (void)updateEntitlementsTeamIDFilter:(NSArray<NSString > )filter {	×
149	absl::MutexLock lock(&self->_entitlementFilterMutex);	×
150	UpdateTeamIDFilterLocked(self->_entitlementsTeamIDFilter, filter);	×
151	}	×
152
153	- (void)incrementEventCounters:(SNTEventState)eventType {	51✔
154	const NSString *eventTypeStr;	51✔
155
156	switch (eventType) {	51✔
157	case SNTEventStateBlockBinary: eventTypeStr = kBlockBinary; break;	3✔
158	case SNTEventStateAllowBinary: eventTypeStr = kAllowBinary; break;	8✔
159	case SNTEventStateBlockCertificate: eventTypeStr = kBlockCertificate; break;	3✔
160	case SNTEventStateAllowCertificate: eventTypeStr = kAllowCertificate; break;	3✔
161	case SNTEventStateBlockTeamID: eventTypeStr = kBlockTeamID; break;	3✔
162	case SNTEventStateAllowTeamID: eventTypeStr = kAllowTeamID; break;	3✔
163	case SNTEventStateBlockSigningID: eventTypeStr = kBlockSigningID; break;	3✔
164	case SNTEventStateAllowSigningID: eventTypeStr = kAllowSigningID; break;	3✔
165	case SNTEventStateBlockCDHash: eventTypeStr = kBlockCDHash; break;	3✔
166	case SNTEventStateAllowCDHash: eventTypeStr = kAllowCDHash; break;	5✔
UNCOV 167	case SNTEventStateBlockScope: eventTypeStr = kBlockScope; break;	×
168	case SNTEventStateAllowScope: eventTypeStr = kAllowScope; break;	2✔
169	case SNTEventStateBlockUnknown: eventTypeStr = kBlockUnknown; break;	5✔
170	case SNTEventStateAllowUnknown: eventTypeStr = kAllowUnknown; break;	3✔
171	case SNTEventStateAllowCompiler: eventTypeStr = kAllowCompiler; break;	3✔
172	case SNTEventStateAllowTransitive: eventTypeStr = kAllowTransitive; break;	1✔
173	case SNTEventStateBlockLongPath: eventTypeStr = kBlockLongPath; break;	×
174	default: eventTypeStr = kUnknownEventState; break;	×
175	}	51✔
176
177	[_events incrementForFieldValues:@[ (NSString *)eventTypeStr ]];	51✔
178	}	51✔
179
180	#pragma mark Binary Validation
181
182	- (bool)synchronousShouldProcessExecEvent:(const Message &)esMsg {	28✔
183	if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {	28✔
184	// Programming error. Bail.
185	LOGE(@"Attempt to validate non-EXEC event. Event type: %d", esMsg->event_type);	1✔
186	[NSException	1✔
187	raise:@"Invalid event type"	1✔
188	format:@"synchronousShouldProcessExecEvent: Unexpected event type: %d", esMsg->event_type];	1✔
189	}	1✔
190
191	const es_process_t *targetProc = esMsg->event.exec.target;	28✔
192
193	if (targetProc->executable->path.length > kMaxAllowedPathLength \|\|	28✔
194	targetProc->executable->path_truncated) {	26✔
195	// Store a SNTCachedDecision so that this event gets properly logged
196	SNTCachedDecision *cd =	2✔
197	[[SNTCachedDecision alloc] initWithEndpointSecurityFile:targetProc->executable];	2✔
198	cd.decision = SNTEventStateBlockLongPath;	2✔
199	cd.customMsg = [NSString stringWithFormat:@"Path exceeded max length for processing (%zu)",	2✔
200	targetProc->executable->path.length];	2✔
201
202	if (targetProc->team_id.data) {	2!
203	cd.teamID = [NSString stringWithUTF8String:targetProc->team_id.data];	×
204	}	×
205
206	// TODO(mlw): We should be able to grab signing info to have more-enriched log messages in the
207	// future. The code to do this should probably be abstracted from the SNTPolicyProcessor.
208
209	[[SNTDecisionCache sharedCache] cacheDecision:cd];	2✔
210
211	return NO;	2✔
212	}	2✔
213
214	// An SNTCachedDecision will be created later on during full processing
215	return YES;	26✔
216	}	26✔
217
218	- (void)validateExecEvent:(const Message &)esMsg postAction:(bool (^)(SNTAction))postAction {	53✔
219	if (unlikely(esMsg->event_type != ES_EVENT_TYPE_AUTH_EXEC)) {	53!
220	// Programming error. Bail.
221	LOGE(@"Attempt to validate non-EXEC event. Event type: %d", esMsg->event_type);	×
222	[NSException	×
223	raise:@"Invalid event type"	×
224	format:@"validateExecEvent:postAction: Unexpected event type: %d", esMsg->event_type];	×
225	}	×
226
227	// Get info about the file. If we can't get this info, respond appropriately and log an error.
228	SNTConfigurator *config = [SNTConfigurator configurator];	53✔
229	const es_process_t *targetProc = esMsg->event.exec.target;	53✔
230
231	NSError *fileInfoError;	53✔
232	SNTFileInfo *binInfo = [[SNTFileInfo alloc] initWithEndpointSecurityFile:targetProc->executable	53✔
233	error:&fileInfoError];	53✔
234	if (unlikely(!binInfo)) {	53✔
235	if (config.failClosed) {	2✔
236	LOGE(@"Failed to read file %@: %@ and denying action", @(targetProc->executable->path.data),	1✔
237	fileInfoError.localizedDescription);	1✔
238	postAction(SNTActionRespondDeny);	1✔
239	[self.events incrementForFieldValues:@[ (NSString *)kDenyNoFileInfo ]];	1✔
240	} else {	1✔
241	LOGE(@"Failed to read file %@: %@ but allowing action", @(targetProc->executable->path.data),	1✔
242	fileInfoError.localizedDescription);	1✔
243	postAction(SNTActionRespondAllow);	1✔
244	[self.events incrementForFieldValues:@[ (NSString *)kAllowNoFileInfo ]];	1✔
245	}	1✔
246	return;	2✔
247	}	2✔
248
249	// PrinterProxy workaround, see description above the method for more details.
250	if ([self printerProxyWorkaround:binInfo]) {	51!
251	postAction(SNTActionRespondDeny);	×
252	[self.events incrementForFieldValues:@[ (NSString *)kBlockPrinterWorkaround ]];	×
253	return;	×
254	}	×
255
256	// TODO(markowsky): Maybe add a metric here for how many large executables we're seeing.
257	// if (binInfo.fileSize > SomeUpperLimit) ...
258
259	SNTCachedDecision *cd = [self.policyProcessor	51✔
260	decisionForFileInfo:binInfo	51✔
261	targetProcess:targetProc	51✔
262	entitlementsFilterCallback:^NSDictionary (const char teamID, NSDictionary *entitlements) {	44✔
263	if (!entitlements) {	44!
264	return nil;	44✔
265	}	44✔
266
267	absl::ReaderMutexLock lock(&self->_entitlementFilterMutex);	×
268
269	if (teamID && self->_entitlementsTeamIDFilter.count(std::string(teamID)) > 0) {	×
270	// Dropping entitlement logging for configured TeamID
271	return nil;	×
272	}	×
273
274	if (self->_entitlementsPrefixFilter->NodeCount() == 0) {	×
275	// Copying full entitlements for TeamID
276	return [entitlements sntDeepCopy];	×
277	} else {	×
278	// Filtering entitlements for TeamID
279	NSMutableDictionary *filtered = [NSMutableDictionary dictionary];	×
280
281	[entitlements enumerateKeysAndObjectsUsingBlock:^(NSString key, id obj, BOOL stop) {	×
282	if (!self->_entitlementsPrefixFilter->HasPrefix(key.UTF8String)) {	×
283	if ([obj isKindOfClass:[NSArray class]] \|\| [obj isKindOfClass:[NSDictionary class]]) {	×
284	[filtered setObject:[obj sntDeepCopy] forKey:key];	×
285	} else {	×
286	[filtered setObject:[obj copy] forKey:key];	×
287	}	×
288	}	×
289	}];	×
290
291	return filtered.count > 0 ? filtered : nil;	×
292	}	×
293	}];	×
294
295	cd.vnodeId = SantaVnode::VnodeForFile(targetProc->executable);	51✔
296
297	// Formulate an initial action from the decision.
298	SNTAction action =	51✔
299	(SNTEventStateAllow & cd.decision) ? SNTActionRespondAllow : SNTActionRespondDeny;	31✔
300
301	// Save decision details for logging the execution later. For transitive rules, we also use
302	// the shasum stored in the decision details to update the rule's timestamp whenever an
303	// ACTION_NOTIFY_EXEC message related to the transitive rule is received.
304	[[SNTDecisionCache sharedCache] cacheDecision:cd];	51✔
305
306	// Upgrade the action to SNTActionRespondAllowCompiler when appropriate, because we want the
307	// kernel to track this information in its decision cache.
308	if (cd.decision == SNTEventStateAllowCompiler) {	51✔
309	action = SNTActionRespondAllowCompiler;	3✔
310	}	3✔
311
312	// Respond with the decision.
313	postAction(action);	51✔
314
315	// Increment metric counters
316	[self incrementEventCounters:cd.decision];	51✔
317
318	// Log to database if necessary.
319	if (config.enableAllEventUpload \|\|	51✔
320	(cd.decision == SNTEventStateAllowUnknown && !config.disableUnknownEventUpload) \|\|	50✔
321	(cd.decision & SNTEventStateAllow) == 0) {	48✔
322	SNTStoredEvent *se = [[SNTStoredEvent alloc] init];	23✔
323	se.occurrenceDate = [[NSDate alloc] init];	23✔
324	se.fileSHA256 = cd.sha256;	23✔
325	se.filePath = binInfo.path;	23✔
326	se.decision = cd.decision;	23✔
327
328	se.signingChain = cd.certChain;	23✔
329	se.teamID = cd.teamID;	23✔
330	se.signingID = cd.signingID;	23✔
331	se.cdhash = cd.cdhash;	23✔
332	se.pid = @(audit_token_to_pid(targetProc->audit_token));	23✔
333	se.ppid = @(audit_token_to_pid(targetProc->parent_audit_token));	23✔
334	se.parentName = @(esMsg.ParentProcessName().c_str());	23✔
335
336	// Bundle data
337	se.fileBundleID = [binInfo bundleIdentifier];	23✔
338	se.fileBundleName = [binInfo bundleName];	23✔
339	se.fileBundlePath = [binInfo bundlePath];	23✔
340	if ([binInfo bundleShortVersionString]) {	23!
341	se.fileBundleVersionString = [binInfo bundleShortVersionString];	×
342	}	×
343	if ([binInfo bundleVersion]) {	23!
344	se.fileBundleVersion = [binInfo bundleVersion];	×
345	}	×
346
347	// User data
348	struct passwd *user = getpwuid(audit_token_to_ruid(targetProc->audit_token));	23✔
349	if (user) se.executingUser = @(user->pw_name);	23!
350	NSArray loggedInUsers, currentSessions;	23✔
351	[self loggedInUsers:&loggedInUsers sessions:&currentSessions];	23✔
352	se.currentSessions = currentSessions;	23✔
353	se.loggedInUsers = loggedInUsers;	23✔
354
355	// Quarantine data
356	se.quarantineDataURL = binInfo.quarantineDataURL;	23✔
357	se.quarantineRefererURL = binInfo.quarantineRefererURL;	23✔
358	se.quarantineTimestamp = binInfo.quarantineTimestamp;	23✔
359	se.quarantineAgentBundleID = binInfo.quarantineAgentBundleID;	23✔
360
361	// Only store events if there is a sync server configured.
362	if (config.syncBaseURL) {	23✔
363	dispatch_async(_eventQueue, ^{	11✔
364	[self.eventTable addStoredEvent:se];	11✔
365	});	11✔
366	}	11✔
367
368	// If binary was blocked, do the needful
369	if (action != SNTActionRespondAllow && action != SNTActionRespondAllowCompiler) {	23!
370	if (config.enableBundles && binInfo.bundle) {	20!
371	// If the binary is part of a bundle, find and hash all the related binaries in the bundle.
372	// Let the GUI know hashing is needed. Once the hashing is complete the GUI will send a
373	// message to santad to perform the upload logic for bundles.
374	// See syncBundleEvent:relatedEvents: for more info.
375	se.needsBundleHash = YES;	×
376	} else if (config.syncBaseURL) {	20✔
377	// So the server has something to show the user straight away, initiate an event
378	// upload for the blocked binary rather than waiting for the next sync.
379	dispatch_async(_eventQueue, ^{	9✔
380	[self.syncdQueue addEvents:@[ se ] isFromBundle:NO];	9✔
381	});	9✔
382	}	9✔
383
384	if (!cd.silentBlock) {	20!
385	if (!config.enableSilentTTYMode && self->_ttyWriter && TTYWriter::CanWrite(targetProc)) {	20!
386	// Let the user know what happened on the terminal
387	NSAttributedString *s = [SNTBlockMessage attributedBlockMessageForEvent:se	×
388	customMessage:cd.customMsg];	×
389
390	NSMutableString *msg = [NSMutableString stringWithCapacity:1024];	×
391	// Escape sequences `\033[1m` and `\033[0m` begin/end bold lettering
392	[msg appendFormat:@"\n\033[1mSanta\033[0m\n\n%@\n\n", s.string];	×
393	[msg appendFormat:@"\033[1mPath: \033[0m %@\n"	×
394	@"\033[1mIdentifier:\033[0m %@\n"	×
395	@"\033[1mParent: \033[0m %@ (%@)\n\n",	×
396	se.filePath, se.fileSHA256, se.parentName, se.ppid];	×
397	NSURL *detailURL = [SNTBlockMessage eventDetailURLForEvent:se customURL:cd.customURL];	×
398	if (detailURL) {	×
399	[msg appendFormat:@"More info:\n%@\n\n", detailURL.absoluteString];	×
400	}	×
401
402	self->_ttyWriter->Write(targetProc, msg);	×
403	}	×
404
405	// Let the user know what happened in the GUI.
406	[self.notifierQueue addEvent:se withCustomMessage:cd.customMsg andCustomURL:cd.customURL];	20✔
407	}	20✔
408	}	20✔
409	}	23✔
410	}	51✔
411
412	/**
413	Workaround for issue with PrinterProxy.app.
414
415	Every time a new printer is added to the machine, a copy of the PrinterProxy.app is copied from
416	the Print.framework to ~/Library/Printers with the name of the printer as the name of the app.
417	The binary inside is changed slightly (in a way that is unique to the printer name) and then
418	re-signed with an adhoc signature. I don't know why this is done but it seems that the binary
419	itself doesn't need to be changed as copying the old one back in-place seems to work,
420	so that's what we do.
421
422	If this workaround is applied the decision request is not responded to as the existing request
423	is invalidated when the file is closed which will trigger a brand new request coming from the
424	kernel.
425
426	@param fi SNTFileInfo object for the binary being executed.
427	@return YES if the workaround was applied, NO otherwise.
428	*/
429	- (BOOL)printerProxyWorkaround:(SNTFileInfo *)fi {	51✔
430	if ([fi.path hasSuffix:@"/Contents/MacOS/PrinterProxy"] &&	51!
431	[fi.path containsString:@"Library/Printers"]) {	×
432	SNTFileInfo *proxyFi = [self printerProxyFileInfo];	×
433	if ([proxyFi.SHA256 isEqual:fi.SHA256]) return NO;	×
434
435	copyfile_flags_t copyflags = COPYFILE_ALL \| COPYFILE_UNLINK;	×
436	if (copyfile(proxyFi.path.UTF8String, fi.path.UTF8String, NULL, copyflags) != 0) {	×
437	LOGE(@"Failed to apply PrinterProxy workaround for %@", fi.path);	×
438	} else {	×
439	LOGI(@"PrinterProxy workaround applied to: %@", fi.path);	×
440	}	×
441
442	return YES;	×
443	}	×
444	return NO;	51✔
445	}	51✔
446
447	/**
448	Returns an SNTFileInfo for the system PrinterProxy path on this system.
449	*/
450	- (SNTFileInfo *)printerProxyFileInfo {	×
451	SNTFileInfo *proxyInfo = [[SNTFileInfo alloc] initWithPath:kPrinterProxyPostMonterey];	×
452	if (!proxyInfo) proxyInfo = [[SNTFileInfo alloc] initWithPath:kPrinterProxyPreMonterey];	×
453	return proxyInfo;	×
454	}	×
455
456	- (void)loggedInUsers:(NSArray )users sessions:(NSArray )sessions {	23✔
457	NSMutableSet *loggedInUsers = [NSMutableSet set];	23✔
458	NSMutableArray *loggedInHosts = [NSMutableArray array];	23✔
459
460	struct utmpx *nxt;	23✔
461	while ((nxt = getutxent())) {	69✔
462	if (nxt->ut_type != USER_PROCESS) continue;	46✔
463
464	NSString *userName = @(nxt->ut_user);	23✔
465	NSString *sessionName;	23✔
466	if (strnlen(nxt->ut_host, 1) > 0) {	23!
467	sessionName = [NSString stringWithFormat:@"%@@%s", userName, nxt->ut_host];	×
468	} else {	23✔
469	sessionName = [NSString stringWithFormat:@"%@@%s", userName, nxt->ut_line];	23✔
470	}	23✔
471
472	if (userName.length) [loggedInUsers addObject:userName];	23!
473	if (sessionName.length) [loggedInHosts addObject:sessionName];	23!
474	}	23✔
475	endutxent();	23✔
476
477	*users = [loggedInUsers allObjects];	23✔
478	*sessions = [loggedInHosts copy];	23✔
479	}	23✔
480
481	@end

google / santa / 8157807405

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous