8368893102

Committed 21 Mar 2024 02:38AM UTC coverage: 62.777% (-0.7%) from 63.461%

Build # 8368893102

Build Type

Pull #1310

github

Committed by

web-flow

Commit Message

Merge e1d79671b into e31aa5cf3

Pull Request Pull Request #1310: Fix: Do not flush authcache when receiving duplicate block rules from the sync service

Run Details

4577 of 9526 branches covered (48.05%)

Branch coverage included in aggregate %.

93 of 93 new or added lines in 2 files covered. (100.0%)

342 existing lines in 4 files now uncovered.

15982 of 23223 relevant lines covered (68.82%)

11819.41 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santad/EventProviders/SNTEndpointSecurityRecorder.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityRecorder.h"
#include <os/base.h>

#include <EndpointSecurity/EndpointSecurity.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/String.h"
#include "Source/santad/EventProviders/AuthResultCache.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"
#include "Source/santad/ProcessTree/process_tree.h"

using santa::common::PrefixTree;
using santa::common::Unit;
using santa::santad::EventDisposition;
using santa::santad::event_providers::AuthResultCache;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Enricher;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;
using santa::santad::process_tree::ProcessTree;

es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
  switch (msg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE: return msg->event.close.target;
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: return msg->event.exchangedata.file1;
    case ES_EVENT_TYPE_NOTIFY_LINK: return msg->event.link.source;
    case ES_EVENT_TYPE_NOTIFY_RENAME: return msg->event.rename.source;
    case ES_EVENT_TYPE_NOTIFY_UNLINK: return msg->event.unlink.target;
    default: return NULL;
  }
}

@interface SNTEndpointSecurityRecorder ()
@property SNTCompilerController *compilerController;
@property SNTConfigurator *configurator;
@end

@implementation SNTEndpointSecurityRecorder {
  std::shared_ptr<AuthResultCache> _authResultCache;
  std::shared_ptr<Enricher> _enricher;
  std::shared_ptr<Logger> _logger;
  std::shared_ptr<PrefixTree<Unit>> _prefixTree;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
                       logger:(std::shared_ptr<Logger>)logger
                     enricher:(std::shared_ptr<Enricher>)enricher
           compilerController:(SNTCompilerController *)compilerController
              authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache
                   prefixTree:(std::shared_ptr<PrefixTree<Unit>>)prefixTree
                  processTree:(std::shared_ptr<ProcessTree>)processTree {
  self = [super initWithESAPI:std::move(esApi)
                      metrics:std::move(metrics)
                    processor:santa::santad::Processor::kRecorder
                  processTree:std::move(processTree)];
  if (self) {
    _enricher = enricher;
    _logger = logger;
    _compilerController = compilerController;
    _authResultCache = authResultCache;
    _prefixTree = prefixTree;
    _configurator = [SNTConfigurator configurator];

    [self establishClientOrDie];
  }
  return self;
}

- (NSString *)description {
  return @"Recorder";
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {
  // Pre-enrichment processing
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE: {
      BOOL shouldLogClose = esMsg->event.close.modified;

#if HAVE_MACOS_13
      if (esMsg->version >= 6) {
        // As of macSO 13.0 we have a new field for if a file was mmaped with
        // write permissions on close events. However due to a bug in ES, it
        // only worked for certain conditions until macOS 13.5 (FB12094635).
        //
        // If something was mmaped writable it was probably written to. Often
        // developer tools do this to avoid lots of write syscalls, e.g. go's
        // tool chain. We log this so the compiler controller can take that into
        // account.
        shouldLogClose |= esMsg->event.close.was_mapped_writable;
      }
#endif

      if (!shouldLogClose) {
        // Ignore unmodified files
        // Note: Do not record metrics in this case. These are not considered "drops"
        // because this is not a failure case. Ideally we would tell ES to not send
        // these events in the first place but no such mechanism currently exists.
        return;
      }

      self->_authResultCache->RemoveFromCache(esMsg->event.close.target);

      break;
    }

    default: break;
  }

  [self.compilerController handleEvent:esMsg withLogger:self->_logger];

  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE: OS_FALLTHROUGH;
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: OS_FALLTHROUGH;
    case ES_EVENT_TYPE_NOTIFY_LINK: OS_FALLTHROUGH;
    case ES_EVENT_TYPE_NOTIFY_RENAME: OS_FALLTHROUGH;
    case ES_EVENT_TYPE_NOTIFY_UNLINK: {
      es_file_t *targetFile = GetTargetFileForPrefixTree(&(*esMsg));

      if (!targetFile) {
        break;
      }

      // Only log file changes that match the given regex
      NSString *targetPath = santa::common::StringToNSString(targetFile->path.data);
      if (![[self.configurator fileChangesRegex]
            numberOfMatchesInString:targetPath
                            options:0
                              range:NSMakeRange(0, targetPath.length)]) {
        // Note: Do not record metrics in this case. These are not considered "drops"
        // because this is not a failure case.
        // TODO(mlw): Consider changes to configuration that would allow muting paths
        // to filter on the kernel side rather than in user space.
        return;
      }

      if (self->_prefixTree->HasPrefix(targetFile->path.data)) {
        recordEventMetrics(EventDisposition::kDropped);
        return;
      }

      break;
    }

    case ES_EVENT_TYPE_NOTIFY_FORK: OS_FALLTHROUGH;
    case ES_EVENT_TYPE_NOTIFY_EXIT: {
      if (self.configurator.enableForkAndExitLogging == NO) {
        recordEventMetrics(EventDisposition::kDropped);
        return;
      }
      break;
    }

    default: break;
  }

  // Enrich the message inline with the ES handler block to capture enrichment
  // data as close to the source event as possible.
  std::unique_ptr<EnrichedMessage> enrichedMessage = _enricher->Enrich(std::move(esMsg));

  // Asynchronously log the message
  [self processEnrichedMessage:std::move(enrichedMessage)
                       handler:^(std::unique_ptr<EnrichedMessage> msg) {
                         self->_logger->Log(std::move(msg));
                         recordEventMetrics(EventDisposition::kProcessed);
                       }];
}

- (void)enable {
  [super subscribe:{
                     ES_EVENT_TYPE_NOTIFY_CLOSE,
                     ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA,
                     ES_EVENT_TYPE_NOTIFY_EXEC,
                     ES_EVENT_TYPE_NOTIFY_EXIT,
                     ES_EVENT_TYPE_NOTIFY_FORK,
                     ES_EVENT_TYPE_NOTIFY_LINK,
                     ES_EVENT_TYPE_NOTIFY_RENAME,
                     ES_EVENT_TYPE_NOTIFY_UNLINK,
                   }];
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityRecorder.h"
16	#include <os/base.h>
17
18	#include <EndpointSecurity/EndpointSecurity.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTLogging.h"
22	#include "Source/common/String.h"
23	#include "Source/santad/EventProviders/AuthResultCache.h"
24	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
25	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
26	#include "Source/santad/Metrics.h"
27	#include "Source/santad/ProcessTree/process_tree.h"
28
29	using santa::common::PrefixTree;
30	using santa::common::Unit;
31	using santa::santad::EventDisposition;
32	using santa::santad::event_providers::AuthResultCache;
33	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
34	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
35	using santa::santad::event_providers::endpoint_security::Enricher;
36	using santa::santad::event_providers::endpoint_security::Message;
37	using santa::santad::logs::endpoint_security::Logger;
38	using santa::santad::process_tree::ProcessTree;
39
UNCOV 40	es_file_t GetTargetFileForPrefixTree(const es_message_t msg) {	×
UNCOV 41	switch (msg->event_type) {	×
UNCOV 42	case ES_EVENT_TYPE_NOTIFY_CLOSE: return msg->event.close.target;	×
UNCOV 43	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: return msg->event.exchangedata.file1;	×
UNCOV 44	case ES_EVENT_TYPE_NOTIFY_LINK: return msg->event.link.source;	×
UNCOV 45	case ES_EVENT_TYPE_NOTIFY_RENAME: return msg->event.rename.source;	×
UNCOV 46	case ES_EVENT_TYPE_NOTIFY_UNLINK: return msg->event.unlink.target;	×
UNCOV 47	default: return NULL;	×
UNCOV 48	}	×
UNCOV 49	}	×
50
51	@interface SNTEndpointSecurityRecorder ()
52	@property SNTCompilerController *compilerController;
53	@property SNTConfigurator *configurator;
54	@end
55
56	@implementation SNTEndpointSecurityRecorder {
57	std::shared_ptr<AuthResultCache> _authResultCache;
58	std::shared_ptr<Enricher> _enricher;
59	std::shared_ptr<Logger> _logger;
60	std::shared_ptr<PrefixTree<Unit>> _prefixTree;
61	}
62
63	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
64	metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
65	logger:(std::shared_ptr<Logger>)logger
66	enricher:(std::shared_ptr<Enricher>)enricher
67	compilerController:(SNTCompilerController *)compilerController
68	authResultCache:(std::shared_ptr<AuthResultCache>)authResultCache
69	prefixTree:(std::shared_ptr<PrefixTree<Unit>>)prefixTree
UNCOV 70	processTree:(std::shared_ptr<ProcessTree>)processTree {	×
UNCOV 71	self = [super initWithESAPI:std::move(esApi)	×
UNCOV 72	metrics:std::move(metrics)	×
UNCOV 73	processor:santa::santad::Processor::kRecorder	×
UNCOV 74	processTree:std::move(processTree)];	×
UNCOV 75	if (self) {	×
UNCOV 76	_enricher = enricher;	×
UNCOV 77	_logger = logger;	×
UNCOV 78	_compilerController = compilerController;	×
UNCOV 79	_authResultCache = authResultCache;	×
UNCOV 80	_prefixTree = prefixTree;	×
UNCOV 81	_configurator = [SNTConfigurator configurator];	×
82
UNCOV 83	[self establishClientOrDie];	×
UNCOV 84	}	×
UNCOV 85	return self;	×
UNCOV 86	}	×
87
UNCOV 88	- (NSString *)description {	×
UNCOV 89	return @"Recorder";	×
UNCOV 90	}	×
91
92	- (void)handleMessage:(Message &&)esMsg
UNCOV 93	recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {	×
94	// Pre-enrichment processing
UNCOV 95	switch (esMsg->event_type) {	×
UNCOV 96	case ES_EVENT_TYPE_NOTIFY_CLOSE: {	×
UNCOV 97	BOOL shouldLogClose = esMsg->event.close.modified;	×
98
99	#if HAVE_MACOS_13
100	if (esMsg->version >= 6) {
101	// As of macSO 13.0 we have a new field for if a file was mmaped with
102	// write permissions on close events. However due to a bug in ES, it
103	// only worked for certain conditions until macOS 13.5 (FB12094635).
104	//
105	// If something was mmaped writable it was probably written to. Often
106	// developer tools do this to avoid lots of write syscalls, e.g. go's
107	// tool chain. We log this so the compiler controller can take that into
108	// account.
109	shouldLogClose \|= esMsg->event.close.was_mapped_writable;
110	}
111	#endif
112
UNCOV 113	if (!shouldLogClose) {	×
114	// Ignore unmodified files
115	// Note: Do not record metrics in this case. These are not considered "drops"
116	// because this is not a failure case. Ideally we would tell ES to not send
117	// these events in the first place but no such mechanism currently exists.
UNCOV 118	return;	×
UNCOV 119	}	×
120
UNCOV 121	self->_authResultCache->RemoveFromCache(esMsg->event.close.target);	×
122
UNCOV 123	break;	×
UNCOV 124	}	×
125
UNCOV 126	default: break;	×
UNCOV 127	}	×
128
UNCOV 129	[self.compilerController handleEvent:esMsg withLogger:self->_logger];	×
130
UNCOV 131	switch (esMsg->event_type) {	×
UNCOV 132	case ES_EVENT_TYPE_NOTIFY_CLOSE: OS_FALLTHROUGH;	×
UNCOV 133	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA: OS_FALLTHROUGH;	×
UNCOV 134	case ES_EVENT_TYPE_NOTIFY_LINK: OS_FALLTHROUGH;	×
UNCOV 135	case ES_EVENT_TYPE_NOTIFY_RENAME: OS_FALLTHROUGH;	×
UNCOV 136	case ES_EVENT_TYPE_NOTIFY_UNLINK: {	×
UNCOV 137	es_file_t targetFile = GetTargetFileForPrefixTree(&(esMsg));	×
138
UNCOV 139	if (!targetFile) {	×
140	break;	×
141	}	×
142
143	// Only log file changes that match the given regex
UNCOV 144	NSString *targetPath = santa::common::StringToNSString(targetFile->path.data);	×
UNCOV 145	if (![[self.configurator fileChangesRegex]	×
UNCOV 146	numberOfMatchesInString:targetPath	×
UNCOV 147	options:0	×
UNCOV 148	range:NSMakeRange(0, targetPath.length)]) {	×
149	// Note: Do not record metrics in this case. These are not considered "drops"
150	// because this is not a failure case.
151	// TODO(mlw): Consider changes to configuration that would allow muting paths
152	// to filter on the kernel side rather than in user space.
UNCOV 153	return;	×
UNCOV 154	}	×
155
UNCOV 156	if (self->_prefixTree->HasPrefix(targetFile->path.data)) {	×
UNCOV 157	recordEventMetrics(EventDisposition::kDropped);	×
UNCOV 158	return;	×
UNCOV 159	}	×
160
UNCOV 161	break;	×
UNCOV 162	}	×
163
UNCOV 164	case ES_EVENT_TYPE_NOTIFY_FORK: OS_FALLTHROUGH;	×
UNCOV 165	case ES_EVENT_TYPE_NOTIFY_EXIT: {	×
UNCOV 166	if (self.configurator.enableForkAndExitLogging == NO) {	×
UNCOV 167	recordEventMetrics(EventDisposition::kDropped);	×
UNCOV 168	return;	×
UNCOV 169	}	×
UNCOV 170	break;	×
UNCOV 171	}	×
172
173	default: break;	×
UNCOV 174	}	×
175
176	// Enrich the message inline with the ES handler block to capture enrichment
177	// data as close to the source event as possible.
UNCOV 178	std::unique_ptr<EnrichedMessage> enrichedMessage = _enricher->Enrich(std::move(esMsg));	×
179
180	// Asynchronously log the message
UNCOV 181	[self processEnrichedMessage:std::move(enrichedMessage)	×
UNCOV 182	handler:^(std::unique_ptr<EnrichedMessage> msg) {	×
UNCOV 183	self->_logger->Log(std::move(msg));	×
UNCOV 184	recordEventMetrics(EventDisposition::kProcessed);	×
UNCOV 185	}];	×
UNCOV 186	}	×
187
UNCOV 188	- (void)enable {	×
UNCOV 189	[super subscribe:{	×
UNCOV 190	ES_EVENT_TYPE_NOTIFY_CLOSE,	×
UNCOV 191	ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA,	×
UNCOV 192	ES_EVENT_TYPE_NOTIFY_EXEC,	×
UNCOV 193	ES_EVENT_TYPE_NOTIFY_EXIT,	×
UNCOV 194	ES_EVENT_TYPE_NOTIFY_FORK,	×
UNCOV 195	ES_EVENT_TYPE_NOTIFY_LINK,	×
UNCOV 196	ES_EVENT_TYPE_NOTIFY_RENAME,	×
UNCOV 197	ES_EVENT_TYPE_NOTIFY_UNLINK,	×
UNCOV 198	}];	×
UNCOV 199	}	×
200
201	@end

google / santa / 8368893102

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous