8159770658

Committed 05 Mar 2024 04:35PM UTC coverage: 65.124% (+0.5%) from 64.591%

Build # 8159770658

Build Type

Pull #1301

github

Committed by

web-flow

Commit Message

Merge e47bfdc7f into 6a697e00e

Pull Request Pull Request #1301: Add support for CDHash rule types

Run Details

4608 of 9286 branches covered (49.62%)

Branch coverage included in aggregate %.

266 of 352 new or added lines in 19 files covered. (75.57%)

4 existing lines in 4 files now uncovered.

16179 of 22633 relevant lines covered (71.48%)

17274.21 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

68.42

/Source/santad/SNTPolicyProcessor.m

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTPolicyProcessor.h"
#include <Foundation/Foundation.h>

#include <Kernel/kern/cs_blobs.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <Security/SecCode.h>
#import <Security/Security.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeepCopy.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"

@interface SNTPolicyProcessor ()
@property SNTRuleTable *ruleTable;
@property SNTConfigurator *configurator;
@end

@implementation SNTPolicyProcessor

- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {
  self = [super init];
  if (self) {
    _ruleTable = ruleTable;
    _configurator = [SNTConfigurator configurator];
  }
  return self;
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                            cdhash:(nullable NSString *)cdhash
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID
                              isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nullable)(
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.cdhash = cdhash;
  cd.sha256 = fileSHA256 ?: fileInfo.SHA256;
  cd.teamID = teamID;
  cd.signingID = signingID;

  SNTClientMode mode = [self.configurator clientMode];
  cd.decisionClientMode = mode;

  // If the binary is a critical system binary, don't check its signature.
  // The binary was validated at startup when the rule table was initialized.
  SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];
  if (systemCd) {
    systemCd.decisionClientMode = mode;
    return systemCd;
  }

  NSError *csInfoError;
  if (certificateSHA256.length) {
    cd.certSHA256 = certificateSHA256;
  } else {
    // Grab the code signature, if there's an error don't try to capture
    // any of the signature details. Also clear out any rule lookup parameters
    // that would require being validly signed.
    MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];
    if (csInfoError) {
      csInfo = nil;
      cd.decisionExtra =
        [NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];
      cd.teamID = nil;
      cd.signingID = nil;
      cd.cdhash = nil;
    } else {
      cd.certSHA256 = csInfo.leafCertificate.SHA256;
      cd.certCommonName = csInfo.leafCertificate.commonName;
      cd.certChain = csInfo.certificates;
      cd.teamID = teamID
                    ?: [csInfo.signingInformation
                         objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];

      // Ensure that if no teamID exists that the signing info confirms it is a
      // platform binary. If not, remove the signingID.
      if (!cd.teamID && cd.signingID) {
        id platformID = [csInfo.signingInformation
          objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
        if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
          cd.signingID = nil;
        }
      }

      NSDictionary *entitlements =
        csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];

      if (entitlementsFilterCallback) {
        cd.entitlements = entitlementsFilterCallback(entitlements);
        cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);
      } else {
        cd.entitlements = [entitlements sntDeepCopy];
        cd.entitlementsFiltered = NO;
      }
    }
  }
  cd.quarantineURL = fileInfo.quarantineDataURL;

  // Do not evaluate TeamID/SigningID rules for dev-signed code based on the
  // assumption that orgs are generally more relaxed about dev signed cert
  // protections and users can more easily produce dev-signed code that
  // would otherwise be inadvertently allowed.
  // Note: Only perform the check if the SigningID is still set, otherwise
  // it is unsigned or had issues above that already cleared the values.
  if (cd.signingID && !isProdSignedCallback()) {
    LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",
         cd.signingID);
    cd.teamID = nil;
    cd.signingID = nil;
  }

  SNTRule *rule =
    [self.ruleTable ruleForIdentifiers:(struct RuleIdentifiers){.cdhash = cd.cdhash,
                                                                .binarySHA256 = cd.sha256,
                                                                .signingID = cd.signingID,
                                                                .certificateSHA256 = cd.certSHA256,
                                                                .teamID = cd.teamID}];
  if (rule) {
    switch (rule.type) {
      case SNTRuleTypeCDHash:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCDHash; return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllowCDHash.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowCDHash;
            }
            return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockCDHash;
            return cd;
          default: break;
        }
      case SNTRuleTypeBinary:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;
          case SNTRuleStateSilentBlock: cd.silentBlock = YES;
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockBinary;
            return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllow.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowBinary;
            }
            return cd;
          case SNTRuleStateAllowTransitive:
            // If transitive rules are enabled, then SNTRuleStateAllowTransitive
            // rules become SNTEventStateAllowTransitive decisions.  Otherwise, we treat the
            // rule as if it were SNTRuleStateUnknown.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowTransitive;
              return cd;
            } else {
              rule.state = SNTRuleStateUnknown;
            }
          default: break;
        }
        break;
      case SNTRuleTypeSigningID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;
          case SNTRuleStateAllowCompiler:
            // If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
            // become SNTEventStateAllowCompiler decisions.  Otherwise we treat the rule as if
            // it were SNTRuleStateAllowSigningID.
            if ([self.configurator enableTransitiveRules]) {
              cd.decision = SNTEventStateAllowCompiler;
            } else {
              cd.decision = SNTEventStateAllowSigningID;
            }
            return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockSigningID;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeCertificate:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockCertificate;
            return cd;
          default: break;
        }
        break;
      case SNTRuleTypeTeamID:
        switch (rule.state) {
          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;
          case SNTRuleStateSilentBlock:
            cd.silentBlock = YES;
            // intentional fallthrough
          case SNTRuleStateBlock:
            cd.customMsg = rule.customMsg;
            cd.customURL = rule.customURL;
            cd.decision = SNTEventStateBlockTeamID;
            return cd;
          default: break;
        }
        break;

      default: break;
    }
  }

  if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&
      csInfoError.code != errSecCSUnsigned) {
    cd.decisionExtra =
      [NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];
    cd.decision = SNTEventStateBlockCertificate;
    return cd;
  }

  NSString *msg = [self fileIsScopeBlocked:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateBlockScope;
    return cd;
  }

  msg = [self fileIsScopeAllowed:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateAllowScope;
    return cd;
  }

  switch (mode) {
    case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;
    case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;
    default: cd.decision = SNTEventStateBlockUnknown; return cd;
  }
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                     targetProcess:(nonnull const es_process_t *)targetProc
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nonnull)(
                            const char *_Nullable teamID,
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  NSString *signingID;
  NSString *teamID;
  NSString *cdhash;

  const char *entitlementsFilterTeamID = NULL;

  if (targetProc->codesigning_flags & CS_SIGNED && targetProc->codesigning_flags & CS_VALID) {
    if (targetProc->signing_id.length > 0) {
      if (targetProc->team_id.length > 0) {
        entitlementsFilterTeamID = targetProc->team_id.data;
        teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
        signingID =
          [NSString stringWithFormat:@"%@:%@", teamID,
                                     [NSString stringWithUTF8String:targetProc->signing_id.data]];
      } else if (targetProc->is_platform_binary) {
        entitlementsFilterTeamID = "platform";
        signingID =
          [NSString stringWithFormat:@"platform:%@",
                                     [NSString stringWithUTF8String:targetProc->signing_id.data]];
      }
    }

    // Only consider the CDHash for processes that have CS_KILL or CS_HARD set.
    // This ensures that the OS will kill the process if the CDHash was tampered
    // with and code was loaded that didn't match a page hash.
    if (targetProc->codesigning_flags & CS_KILL || targetProc->codesigning_flags & CS_HARD) {
      static NSString *const kCDHashFormatString = @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
                                                    "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";

      const uint8_t *buf = targetProc->cdhash;
      cdhash = [[NSString alloc] initWithFormat:kCDHashFormatString, buf[0], buf[1], buf[2], buf[3],
                                                buf[4], buf[5], buf[6], buf[7], buf[8], buf[9],
                                                buf[10], buf[11], buf[12], buf[13], buf[14],
                                                buf[15], buf[16], buf[17], buf[18], buf[19]];
    }
  }

  return [self decisionForFileInfo:fileInfo
    cdhash:cdhash
    fileSHA256:nil
    certificateSHA256:nil
    teamID:teamID
    signingID:signingID
    isProdSignedCallback:^BOOL {
      return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);
    }
    entitlementsFilterCallback:^NSDictionary *(NSDictionary *entitlements) {
      return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);
    }];
}

// Used by `$ santactl fileinfo`.
- (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                       identifiers:(nonnull SNTRuleIdentifiers *)identifiers {
  MOLCodesignChecker *csInfo;
  NSError *error;

  SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
  if (!fileInfo) {
    LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
  } else {
    csInfo = [fileInfo codesignCheckerWithError:&error];
    if (error) {
      LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);
    }
  }

  return [self decisionForFileInfo:fileInfo
                            cdhash:identifiers.cdhash
                        fileSHA256:identifiers.binarySHA256
                 certificateSHA256:identifiers.certificateSHA256
                            teamID:identifiers.teamID
                         signingID:identifiers.signingID
              isProdSignedCallback:^BOOL {
                if (csInfo) {
                  // Development OID values defined by Apple and used by the Security Framework
                  // https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
                  NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];
                  NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(
                    csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));
                  return vals.count == 0;
                } else {
                  return NO;
                }
              }
        entitlementsFilterCallback:nil];
}

///
///  Checks whether the file at @c path is in-scope for checking with Santa.
///
///  Files that are out of scope:
///    + Non Mach-O files that are not part of an installer package.
///    + Files in allowed path.
///
///  @return @c YES if file is in scope, @c NO otherwise.
///
- (NSString *)fileIsScopeAllowed:(SNTFileInfo *)fi {
  if (!fi) return nil;

  // Determine if file is within an allowed path
  NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Allowed Path Regex";
  }

  // If file is not a Mach-O file, we're not interested.
  if (!fi.isMachO) {
    return @"Not a Mach-O";
  }

  return nil;
}

- (NSString *)fileIsScopeBlocked:(SNTFileInfo *)fi {
  if (!fi) return nil;

  NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Blocked Path Regex";
  }

  if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {
    return @"Missing __PAGEZERO";
  }

  return nil;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTPolicyProcessor.h"
16	#include <Foundation/Foundation.h>
17
18	#include <Kernel/kern/cs_blobs.h>
19	#import <MOLCodesignChecker/MOLCodesignChecker.h>
20	#import <Security/SecCode.h>
21	#import <Security/Security.h>
22
23	#import "Source/common/SNTCachedDecision.h"
24	#import "Source/common/SNTConfigurator.h"
25	#import "Source/common/SNTDeepCopy.h"
26	#import "Source/common/SNTFileInfo.h"
27	#import "Source/common/SNTLogging.h"
28	#import "Source/common/SNTRule.h"
29	#import "Source/santad/DataLayer/SNTRuleTable.h"
30
31	@interface SNTPolicyProcessor ()
32	@property SNTRuleTable *ruleTable;
33	@property SNTConfigurator *configurator;
34	@end
35
36	@implementation SNTPolicyProcessor
37
38	- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {	53✔
39	self = [super init];	53✔
40	if (self) {	53!
41	_ruleTable = ruleTable;	53✔
42	_configurator = [SNTConfigurator configurator];	53✔
43	}	53✔
44	return self;	53✔
45	}	53✔
46
47	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
48	cdhash:(nullable NSString *)cdhash
49	fileSHA256:(nullable NSString *)fileSHA256
50	certificateSHA256:(nullable NSString *)certificateSHA256
51	teamID:(nullable NSString *)teamID
52	signingID:(nullable NSString *)signingID
53	isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
54	entitlementsFilterCallback:
55	(NSDictionary *_Nullable (^_Nullable)(
56	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	51✔
57	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	51✔
58	cd.cdhash = cdhash;	51✔
59	cd.sha256 = fileSHA256 ?: fileInfo.SHA256;	51✔
60	cd.teamID = teamID;	51✔
61	cd.signingID = signingID;	51✔
62
63	SNTClientMode mode = [self.configurator clientMode];	51✔
64	cd.decisionClientMode = mode;	51✔
65
66	// If the binary is a critical system binary, don't check its signature.
67	// The binary was validated at startup when the rule table was initialized.
68	SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[cd.sha256];	51✔
69	if (systemCd) {	51✔
70	systemCd.decisionClientMode = mode;	1✔
71	return systemCd;	1✔
72	}	1✔
73
74	NSError *csInfoError;	50✔
75	if (certificateSHA256.length) {	50!
76	cd.certSHA256 = certificateSHA256;	×
77	} else {	50✔
78	// Grab the code signature, if there's an error don't try to capture
79	// any of the signature details. Also clear out any rule lookup parameters
80	// that would require being validly signed.
81	MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];	50✔
82	if (csInfoError) {	50✔
83	csInfo = nil;	6✔
84	cd.decisionExtra =	6✔
85	[NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];	6✔
86	cd.teamID = nil;	6✔
87	cd.signingID = nil;	6✔
88	cd.cdhash = nil;	6✔
89	} else {	44✔
90	cd.certSHA256 = csInfo.leafCertificate.SHA256;	44✔
91	cd.certCommonName = csInfo.leafCertificate.commonName;	44✔
92	cd.certChain = csInfo.certificates;	44✔
93	cd.teamID = teamID	44✔
94	?: [csInfo.signingInformation	44✔
95	objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];	44✔
96
97	// Ensure that if no teamID exists that the signing info confirms it is a
98	// platform binary. If not, remove the signingID.
99	if (!cd.teamID && cd.signingID) {	44!
100	id platformID = [csInfo.signingInformation	×
101	objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];	×
102	if (![platformID isKindOfClass:[NSNumber class]] \|\| [platformID intValue] == 0) {	×
103	cd.signingID = nil;	×
104	}	×
105	}	×
106
107	NSDictionary *entitlements =	44✔
108	csInfo.signingInformation[(__bridge NSString *)kSecCodeInfoEntitlementsDict];	44✔
109
110	if (entitlementsFilterCallback) {	44!
111	cd.entitlements = entitlementsFilterCallback(entitlements);	44✔
112	cd.entitlementsFiltered = (cd.entitlements.count == entitlements.count);	44✔
113	} else {	×
114	cd.entitlements = [entitlements sntDeepCopy];	×
115	cd.entitlementsFiltered = NO;	×
116	}	×
117	}	44✔
118	}	50✔
119	cd.quarantineURL = fileInfo.quarantineDataURL;	50✔
120
121	// Do not evaluate TeamID/SigningID rules for dev-signed code based on the
122	// assumption that orgs are generally more relaxed about dev signed cert
123	// protections and users can more easily produce dev-signed code that
124	// would otherwise be inadvertently allowed.
125	// Note: Only perform the check if the SigningID is still set, otherwise
126	// it is unsigned or had issues above that already cleared the values.
127	if (cd.signingID && !isProdSignedCallback()) {	50!
128	LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",	×
129	cd.signingID);	×
130	cd.teamID = nil;	×
131	cd.signingID = nil;	×
132	}	×
133
134	SNTRule *rule =	50✔
135	[self.ruleTable ruleForIdentifiers:(struct RuleIdentifiers){.cdhash = cd.cdhash,	50✔
136	.binarySHA256 = cd.sha256,	50✔
137	.signingID = cd.signingID,	50✔
138	.certificateSHA256 = cd.certSHA256,	50✔
139	.teamID = cd.teamID}];	50✔
140	if (rule) {	50✔
141	switch (rule.type) {	42✔
142	case SNTRuleTypeCDHash:	9✔
143	switch (rule.state) {	9✔
144	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCDHash; return cd;	4✔
145	case SNTRuleStateAllowCompiler:	2✔
146	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
147	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
148	// it were SNTRuleStateAllowCDHash.
149	if ([self.configurator enableTransitiveRules]) {	2✔
150	cd.decision = SNTEventStateAllowCompiler;	1✔
151	} else {	1✔
152	cd.decision = SNTEventStateAllowCDHash;	1✔
153	}	1✔
154	return cd;	2✔
NEW 155	case SNTRuleStateSilentBlock:	×
NEW 156	cd.silentBlock = YES;	×
157	// intentional fallthrough
158	case SNTRuleStateBlock:	3✔
159	cd.customMsg = rule.customMsg;	3✔
160	cd.customURL = rule.customURL;	3✔
161	cd.decision = SNTEventStateBlockCDHash;	3✔
162	return cd;	3✔
NEW 163	default: break;	×
NEW 164	}	×
165	case SNTRuleTypeBinary:	13✔
166	switch (rule.state) {	13✔
167	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowBinary; return cd;	6✔
168	case SNTRuleStateSilentBlock: cd.silentBlock = YES;	×
169	case SNTRuleStateBlock:	3✔
170	cd.customMsg = rule.customMsg;	3✔
171	cd.customURL = rule.customURL;	3✔
172	cd.decision = SNTEventStateBlockBinary;	3✔
173	return cd;	3✔
174	case SNTRuleStateAllowCompiler:	2✔
175	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
176	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
177	// it were SNTRuleStateAllow.
178	if ([self.configurator enableTransitiveRules]) {	2✔
179	cd.decision = SNTEventStateAllowCompiler;	1✔
180	} else {	1✔
181	cd.decision = SNTEventStateAllowBinary;	1✔
182	}	1✔
183	return cd;	2✔
184	case SNTRuleStateAllowTransitive:	2✔
185	// If transitive rules are enabled, then SNTRuleStateAllowTransitive
186	// rules become SNTEventStateAllowTransitive decisions. Otherwise, we treat the
187	// rule as if it were SNTRuleStateUnknown.
188	if ([self.configurator enableTransitiveRules]) {	2✔
189	cd.decision = SNTEventStateAllowTransitive;	1✔
190	return cd;	1✔
191	} else {	1✔
192	rule.state = SNTRuleStateUnknown;	1✔
193	}	1✔
194	default: break;	1!
195	}	1✔
196	break;	1✔
197	case SNTRuleTypeSigningID:	8✔
198	switch (rule.state) {	8✔
199	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;	3✔
200	case SNTRuleStateAllowCompiler:	1✔
201	// If transitive rules are enabled, then SNTRuleStateAllowListCompiler rules
202	// become SNTEventStateAllowCompiler decisions. Otherwise we treat the rule as if
203	// it were SNTRuleStateAllowSigningID.
204	if ([self.configurator enableTransitiveRules]) {	1!
205	cd.decision = SNTEventStateAllowCompiler;	1✔
206	} else {	×
207	cd.decision = SNTEventStateAllowSigningID;	×
208	}	×
209	return cd;	1✔
210	case SNTRuleStateSilentBlock:	×
211	cd.silentBlock = YES;	×
212	// intentional fallthrough
213	case SNTRuleStateBlock:	3✔
214	cd.customMsg = rule.customMsg;	3✔
215	cd.customURL = rule.customURL;	3✔
216	cd.decision = SNTEventStateBlockSigningID;	3✔
217	return cd;	3✔
218	default: break;	1✔
219	}	1✔
220	break;	1✔
221	case SNTRuleTypeCertificate:	6✔
222	switch (rule.state) {	6✔
223	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;	3✔
224	case SNTRuleStateSilentBlock:	×
225	cd.silentBlock = YES;	×
226	// intentional fallthrough
227	case SNTRuleStateBlock:	3✔
228	cd.customMsg = rule.customMsg;	3✔
229	cd.customURL = rule.customURL;	3✔
230	cd.decision = SNTEventStateBlockCertificate;	3✔
231	return cd;	3✔
232	default: break;	×
233	}	×
234	break;	×
235	case SNTRuleTypeTeamID:	6✔
236	switch (rule.state) {	6✔
237	case SNTRuleStateAllow: cd.decision = SNTEventStateAllowTeamID; return cd;	3✔
238	case SNTRuleStateSilentBlock:	×
239	cd.silentBlock = YES;	×
240	// intentional fallthrough
241	case SNTRuleStateBlock:	3✔
242	cd.customMsg = rule.customMsg;	3✔
243	cd.customURL = rule.customURL;	3✔
244	cd.decision = SNTEventStateBlockTeamID;	3✔
245	return cd;	3✔
246	default: break;	×
247	}	×
248	break;	×
249
250	default: break;	×
251	}	10✔
252	}	10✔
253
254	if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&	10!
255	csInfoError.code != errSecCSUnsigned) {	×
256	cd.decisionExtra =	×
257	[NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];	×
258	cd.decision = SNTEventStateBlockCertificate;	×
259	return cd;	×
260	}	×
261
262	NSString *msg = [self fileIsScopeBlocked:fileInfo];	10✔
263	if (msg) {	10!
264	cd.decisionExtra = msg;	×
265	cd.decision = SNTEventStateBlockScope;	×
266	return cd;	×
267	}	×
268
269	msg = [self fileIsScopeAllowed:fileInfo];	10✔
270	if (msg) {	10✔
271	cd.decisionExtra = msg;	2✔
272	cd.decision = SNTEventStateAllowScope;	2✔
273	return cd;	2✔
274	}	2✔
275
276	switch (mode) {	8✔
277	case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;	3✔
278	case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;	4✔
279	default: cd.decision = SNTEventStateBlockUnknown; return cd;	1✔
280	}	8✔
281	}	8✔
282
283	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
284	targetProcess:(nonnull const es_process_t *)targetProc
285	entitlementsFilterCallback:
286	(NSDictionary *_Nullable (^_Nonnull)(
287	const char *_Nullable teamID,
288	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	51✔
289	NSString *signingID;	51✔
290	NSString *teamID;	51✔
291	NSString *cdhash;	51✔
292
293	const char *entitlementsFilterTeamID = NULL;	51✔
294
295	if (targetProc->codesigning_flags & CS_SIGNED && targetProc->codesigning_flags & CS_VALID) {	51!
296	if (targetProc->signing_id.length > 0) {	51✔
297	if (targetProc->team_id.length > 0) {	13!
298	entitlementsFilterTeamID = targetProc->team_id.data;	13✔
299	teamID = [NSString stringWithUTF8String:targetProc->team_id.data];	13✔
300	signingID =	13✔
301	[NSString stringWithFormat:@"%@:%@", teamID,	13✔
302	[NSString stringWithUTF8String:targetProc->signing_id.data]];	13✔
NEW 303	} else if (targetProc->is_platform_binary) {	×
NEW 304	entitlementsFilterTeamID = "platform";	×
NEW 305	signingID =	×
NEW 306	[NSString stringWithFormat:@"platform:%@",	×
NEW 307	[NSString stringWithUTF8String:targetProc->signing_id.data]];	×
NEW 308	}	×
309	}	13✔
310
311	// Only consider the CDHash for processes that have CS_KILL or CS_HARD set.
312	// This ensures that the OS will kill the process if the CDHash was tampered
313	// with and code was loaded that didn't match a page hash.
314	if (targetProc->codesigning_flags & CS_KILL \|\| targetProc->codesigning_flags & CS_HARD) {	51!
315	static NSString *const kCDHashFormatString = @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"	28✔
316	"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";	28✔
317
318	const uint8_t *buf = targetProc->cdhash;	28✔
319	cdhash = [[NSString alloc] initWithFormat:kCDHashFormatString, buf[0], buf[1], buf[2], buf[3],	28✔
320	buf[4], buf[5], buf[6], buf[7], buf[8], buf[9],	28✔
321	buf[10], buf[11], buf[12], buf[13], buf[14],	28✔
322	buf[15], buf[16], buf[17], buf[18], buf[19]];	28✔
323	}	28✔
324	}	51✔
325
326	return [self decisionForFileInfo:fileInfo	51✔
327	cdhash:cdhash	51✔
328	fileSHA256:nil	51✔
329	certificateSHA256:nil	51✔
330	teamID:teamID	51✔
331	signingID:signingID	51✔
332	isProdSignedCallback:^BOOL {	13✔
333	return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);	13✔
334	}	13✔
335	entitlementsFilterCallback:^NSDictionary (NSDictionary entitlements) {	44✔
336	return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);	44✔
337	}];	44✔
338	}	51✔
339
340	// Used by `$ santactl fileinfo`.
341	- (nonnull SNTCachedDecision )decisionForFilePath:(nonnull NSString )filePath
NEW 342	identifiers:(nonnull SNTRuleIdentifiers *)identifiers {	×
UNCOV 343	MOLCodesignChecker *csInfo;	×
344	NSError *error;	×
345
346	SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];	×
347	if (!fileInfo) {	×
348	LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);	×
349	} else {	×
350	csInfo = [fileInfo codesignCheckerWithError:&error];	×
351	if (error) {	×
352	LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);	×
353	}	×
354	}	×
355
356	return [self decisionForFileInfo:fileInfo	×
NEW 357	cdhash:identifiers.cdhash	×
NEW 358	fileSHA256:identifiers.binarySHA256	×
NEW 359	certificateSHA256:identifiers.certificateSHA256	×
NEW 360	teamID:identifiers.teamID	×
NEW 361	signingID:identifiers.signingID	×
362	isProdSignedCallback:^BOOL {	×
363	if (csInfo) {	×
364	// Development OID values defined by Apple and used by the Security Framework
365	// https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
366	NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];	×
367	NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(	×
368	csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));	×
369	return vals.count == 0;	×
370	} else {	×
371	return NO;	×
372	}	×
373	}	×
374	entitlementsFilterCallback:nil];	×
375	}	×
376
377	///
378	/// Checks whether the file at @c path is in-scope for checking with Santa.
379	///
380	/// Files that are out of scope:
381	/// + Non Mach-O files that are not part of an installer package.
382	/// + Files in allowed path.
383	///
384	/// @return @c YES if file is in scope, @c NO otherwise.
385	///
386	- (NSString )fileIsScopeAllowed:(SNTFileInfo )fi {	10✔
387	if (!fi) return nil;	10!
388
389	// Determine if file is within an allowed path
390	NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];	10✔
391	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
392	return @"Allowed Path Regex";	×
393	}	×
394
395	// If file is not a Mach-O file, we're not interested.
396	if (!fi.isMachO) {	10✔
397	return @"Not a Mach-O";	2✔
398	}	2✔
399
400	return nil;	8✔
401	}	8✔
402
403	- (NSString )fileIsScopeBlocked:(SNTFileInfo )fi {	10✔
404	if (!fi) return nil;	10!
405
406	NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];	10✔
407	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
408	return @"Blocked Path Regex";	×
409	}	×
410
411	if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {	10!
412	return @"Missing __PAGEZERO";	×
413	}	×
414
415	return nil;	10✔
416	}	10✔
417
418	@end

google / santa / 8159770658

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous