8526031294

Committed 02 Apr 2024 04:13PM UTC coverage: 64.923% (+1.3%) from 63.593%

Build # 8526031294

Build Type

Pull #1296

github

Committed by

web-flow

Commit Message

Merge eb5802088 into 3b2d02f38

Pull Request Pull Request #1296: ProcessTree: add the first annotation, originator (4/4)

Run Details

4753 of 9624 branches covered (49.39%)

Branch coverage included in aggregate %.

63 of 68 new or added lines in 4 files covered. (92.65%)

1 existing line in 1 file now uncovered.

16726 of 23460 relevant lines covered (71.3%)

13953.12 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

48.4

/Source/santad/SantadDeps.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/SantadDeps.h"

#include <cstdlib>
#include <memory>

#import "Source/common/SNTLogging.h"
#import "Source/common/SNTMetricSet.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/santad/DataLayer/SNTEventTable.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#include "Source/santad/DataLayer/WatchItems.h"
#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
#include "Source/santad/ProcessTree/annotations/originator.h"
#include "Source/santad/ProcessTree/process_tree.h"
#import "Source/santad/SNTDatabaseController.h"
#include "Source/santad/SNTDecisionCache.h"
#include "Source/santad/TTYWriter.h"

using santa::common::PrefixTree;
using santa::common::Unit;
using santa::santad::Metrics;
using santa::santad::TTYWriter;
using santa::santad::data_layer::WatchItems;
using santa::santad::event_providers::AuthResultCache;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Enricher;
using santa::santad::logs::endpoint_security::Logger;

namespace santa::santad {

std::unique_ptr<SantadDeps> SantadDeps::Create(SNTConfigurator *configurator,
                                               SNTMetricSet *metric_set) {
  // TODO(mlw): The XPC interfaces should be injectable. Could either make a new
  // protocol defining appropriate methods or accept values as params.
  MOLXPCConnection *control_connection =
    [[MOLXPCConnection alloc] initServerWithName:[SNTXPCControlInterface serviceID]];
  if (!control_connection) {
    LOGE(@"Failed to initialize control connection.");
    exit(EXIT_FAILURE);
  }

  control_connection.privilegedInterface = [SNTXPCControlInterface controlInterface];
  control_connection.unprivilegedInterface = [SNTXPCUnprivilegedControlInterface controlInterface];

  SNTRuleTable *rule_table = [SNTDatabaseController ruleTable];
  if (!rule_table) {
    LOGE(@"Failed to initialize rule table.");
    exit(EXIT_FAILURE);
  }

  SNTEventTable *event_table = [SNTDatabaseController eventTable];
  if (!event_table) {
    LOGE(@"Failed to initialize event table.");
    exit(EXIT_FAILURE);
  }

  SNTCompilerController *compiler_controller = [[SNTCompilerController alloc] init];
  if (!compiler_controller) {
    LOGE(@"Failed to initialize compiler controller.");
    exit(EXIT_FAILURE);
  }

  SNTNotificationQueue *notifier_queue = [[SNTNotificationQueue alloc] init];
  if (!notifier_queue) {
    LOGE(@"Failed to initialize notification queue.");
    exit(EXIT_FAILURE);
  }

  SNTSyncdQueue *syncd_queue = [[SNTSyncdQueue alloc] init];
  if (!syncd_queue) {
    LOGE(@"Failed to initialize syncd queue.");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<::TTYWriter> tty_writer = TTYWriter::Create();
  if (!tty_writer) {
    LOGW(@"Unable to initialize TTY writer");
  }

  SNTExecutionController *exec_controller =
    [[SNTExecutionController alloc] initWithRuleTable:rule_table
                                           eventTable:event_table
                                        notifierQueue:notifier_queue
                                           syncdQueue:syncd_queue
                                            ttyWriter:tty_writer
                             entitlementsPrefixFilter:[configurator entitlementsPrefixFilter]
                             entitlementsTeamIDFilter:[configurator entitlementsTeamIDFilter]];
  if (!exec_controller) {
    LOGE(@"Failed to initialize exec controller.");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<::PrefixTree<Unit>> prefix_tree = std::make_shared<::PrefixTree<Unit>>();

  // TODO(bur): Add KVO handling for fileChangesPrefixFilters.
  NSArray<NSString *> *prefix_filters =
    [@[ @"/.", @"/dev/" ] arrayByAddingObjectsFromArray:[configurator fileChangesPrefixFilters]];
  for (NSString *filter in prefix_filters) {
    prefix_tree->InsertPrefix([filter fileSystemRepresentation], Unit {});
  }

  std::shared_ptr<EndpointSecurityAPI> esapi = std::make_shared<EndpointSecurityAPI>();
  if (!esapi) {
    LOGE(@"Failed to create ES API wrapper.");
    exit(EXIT_FAILURE);
  }

  size_t spool_file_threshold_bytes = [configurator spoolDirectoryFileSizeThresholdKB] * 1024;
  size_t spool_dir_threshold_bytes = [configurator spoolDirectorySizeThresholdMB] * 1024 * 1024;
  uint64_t spool_flush_timeout_ms = [configurator spoolDirectoryEventMaxFlushTimeSec] * 1000;

  std::unique_ptr<::Logger> logger =
    Logger::Create(esapi, [configurator eventLogType], [SNTDecisionCache sharedCache],
                   [configurator eventLogPath], [configurator spoolDirectory],
                   spool_dir_threshold_bytes, spool_file_threshold_bytes, spool_flush_timeout_ms);
  if (!logger) {
    LOGE(@"Failed to create logger.");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<::WatchItems> watch_items =
    [configurator fileAccessPolicy]
      ? WatchItems::Create([configurator fileAccessPolicy],
                           [configurator fileAccessPolicyUpdateIntervalSec])
      : WatchItems::Create([configurator fileAccessPolicyPlist],
                           [configurator fileAccessPolicyUpdateIntervalSec]);
  if (!watch_items) {
    LOGE(@"Failed to create watch items");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<::Metrics> metrics =
    Metrics::Create(metric_set, [configurator metricExportInterval]);
  if (!metrics) {
    LOGE(@"Failed to create metrics");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<::AuthResultCache> auth_result_cache = AuthResultCache::Create(esapi, metric_set);
  if (!auth_result_cache) {
    LOGE(@"Failed to create auth result cache");
    exit(EXIT_FAILURE);
  }

  std::shared_ptr<process_tree::ProcessTree> process_tree;
  std::vector<std::unique_ptr<process_tree::Annotator>> annotators;

  for (NSString *annotation in [configurator enabledProcessAnnotations]) {
    if ([[annotation lowercaseString] isEqualToString:@"originator"]) {
      annotators.emplace_back(std::make_unique<process_tree::OriginatorAnnotator>());
    } else {
      LOGW(@"Unrecognized process annotation %@", annotation);
    }
  }

  auto tree_status = process_tree::CreateTree(std::move(annotators));
  if (!tree_status.ok()) {
    LOGE(@"Failed to create process tree: %@", @(tree_status.status().ToString().c_str()));
    exit(EXIT_FAILURE);
  }
  process_tree = *tree_status;

  return std::make_unique<SantadDeps>(
    esapi, std::move(logger), std::move(metrics), std::move(watch_items),
    std::move(auth_result_cache), control_connection, compiler_controller, notifier_queue,
    syncd_queue, exec_controller, prefix_tree, std::move(tty_writer), std::move(process_tree));
}

SantadDeps::SantadDeps(
  std::shared_ptr<EndpointSecurityAPI> esapi, std::unique_ptr<::Logger> logger,
  std::shared_ptr<::Metrics> metrics, std::shared_ptr<::WatchItems> watch_items,
  std::shared_ptr<santa::santad::event_providers::AuthResultCache> auth_result_cache,
  MOLXPCConnection *control_connection, SNTCompilerController *compiler_controller,
  SNTNotificationQueue *notifier_queue, SNTSyncdQueue *syncd_queue,
  SNTExecutionController *exec_controller, std::shared_ptr<::PrefixTree<Unit>> prefix_tree,
  std::shared_ptr<::TTYWriter> tty_writer, std::shared_ptr<process_tree::ProcessTree> process_tree)
    : esapi_(std::move(esapi)),
      logger_(std::move(logger)),
      metrics_(std::move(metrics)),
      watch_items_(std::move(watch_items)),
      enricher_(std::make_shared<::Enricher>(process_tree)),
      auth_result_cache_(std::move(auth_result_cache)),
      control_connection_(control_connection),
      compiler_controller_(compiler_controller),
      notifier_queue_(notifier_queue),
      syncd_queue_(syncd_queue),
      exec_controller_(exec_controller),
      prefix_tree_(prefix_tree),
      tty_writer_(std::move(tty_writer)),
      process_tree_(std::move(process_tree)) {}

std::shared_ptr<::AuthResultCache> SantadDeps::AuthResultCache() {
  return auth_result_cache_;
}

std::shared_ptr<Enricher> SantadDeps::Enricher() {
  return enricher_;
}
std::shared_ptr<EndpointSecurityAPI> SantadDeps::ESAPI() {
  return esapi_;
}

std::shared_ptr<Logger> SantadDeps::Logger() {
  return logger_;
}

std::shared_ptr<::Metrics> SantadDeps::Metrics() {
  return metrics_;
}

std::shared_ptr<::WatchItems> SantadDeps::WatchItems() {
  return watch_items_;
}

MOLXPCConnection *SantadDeps::ControlConnection() {
  return control_connection_;
}

SNTCompilerController *SantadDeps::CompilerController() {
  return compiler_controller_;
}

SNTNotificationQueue *SantadDeps::NotifierQueue() {
  return notifier_queue_;
}

SNTSyncdQueue *SantadDeps::SyncdQueue() {
  return syncd_queue_;
}

SNTExecutionController *SantadDeps::ExecController() {
  return exec_controller_;
}

std::shared_ptr<PrefixTree<Unit>> SantadDeps::PrefixTree() {
  return prefix_tree_;
}

std::shared_ptr<::TTYWriter> SantadDeps::TTYWriter() {
  return tty_writer_;
}

std::shared_ptr<process_tree::ProcessTree> SantadDeps::ProcessTree() {
  return process_tree_;
}

}  // namespace santa::santad

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/SantadDeps.h"
16
17	#include <cstdlib>
18	#include <memory>
19
20	#import "Source/common/SNTLogging.h"
21	#import "Source/common/SNTMetricSet.h"
22	#import "Source/common/SNTXPCControlInterface.h"
23	#import "Source/santad/DataLayer/SNTEventTable.h"
24	#import "Source/santad/DataLayer/SNTRuleTable.h"
25	#include "Source/santad/DataLayer/WatchItems.h"
26	#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
27	#include "Source/santad/ProcessTree/annotations/originator.h"
28	#include "Source/santad/ProcessTree/process_tree.h"
29	#import "Source/santad/SNTDatabaseController.h"
30	#include "Source/santad/SNTDecisionCache.h"
31	#include "Source/santad/TTYWriter.h"
32
33	using santa::common::PrefixTree;
34	using santa::common::Unit;
35	using santa::santad::Metrics;
36	using santa::santad::TTYWriter;
37	using santa::santad::data_layer::WatchItems;
38	using santa::santad::event_providers::AuthResultCache;
39	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
40	using santa::santad::event_providers::endpoint_security::Enricher;
41	using santa::santad::logs::endpoint_security::Logger;
42
43	namespace santa::santad {
44
45	std::unique_ptr<SantadDeps> SantadDeps::Create(SNTConfigurator *configurator,
46	SNTMetricSet *metric_set) {	24✔
47	// TODO(mlw): The XPC interfaces should be injectable. Could either make a new
48	// protocol defining appropriate methods or accept values as params.
49	MOLXPCConnection *control_connection =	24✔
50	[[MOLXPCConnection alloc] initServerWithName:[SNTXPCControlInterface serviceID]];	24✔
51	if (!control_connection) {	24!
52	LOGE(@"Failed to initialize control connection.");	×
53	exit(EXIT_FAILURE);	×
54	}	×
55
56	control_connection.privilegedInterface = [SNTXPCControlInterface controlInterface];	24✔
57	control_connection.unprivilegedInterface = [SNTXPCUnprivilegedControlInterface controlInterface];	24✔
58
59	SNTRuleTable *rule_table = [SNTDatabaseController ruleTable];	24✔
60	if (!rule_table) {	24!
61	LOGE(@"Failed to initialize rule table.");	×
62	exit(EXIT_FAILURE);	×
63	}	×
64
65	SNTEventTable *event_table = [SNTDatabaseController eventTable];	24✔
66	if (!event_table) {	24!
67	LOGE(@"Failed to initialize event table.");	×
68	exit(EXIT_FAILURE);	×
69	}	×
70
71	SNTCompilerController *compiler_controller = [[SNTCompilerController alloc] init];	24✔
72	if (!compiler_controller) {	24!
73	LOGE(@"Failed to initialize compiler controller.");	×
74	exit(EXIT_FAILURE);	×
75	}	×
76
77	SNTNotificationQueue *notifier_queue = [[SNTNotificationQueue alloc] init];	24✔
78	if (!notifier_queue) {	24!
79	LOGE(@"Failed to initialize notification queue.");	×
80	exit(EXIT_FAILURE);	×
81	}	×
82
83	SNTSyncdQueue *syncd_queue = [[SNTSyncdQueue alloc] init];	24✔
84	if (!syncd_queue) {	24!
85	LOGE(@"Failed to initialize syncd queue.");	×
86	exit(EXIT_FAILURE);	×
87	}	×
88
89	std::shared_ptr<::TTYWriter> tty_writer = TTYWriter::Create();	24✔
90	if (!tty_writer) {	24!
91	LOGW(@"Unable to initialize TTY writer");	×
92	}	×
93
94	SNTExecutionController *exec_controller =	24✔
95	[[SNTExecutionController alloc] initWithRuleTable:rule_table	24✔
96	eventTable:event_table	24✔
97	notifierQueue:notifier_queue	24✔
98	syncdQueue:syncd_queue	24✔
99	ttyWriter:tty_writer	24✔
100	entitlementsPrefixFilter:[configurator entitlementsPrefixFilter]	24✔
101	entitlementsTeamIDFilter:[configurator entitlementsTeamIDFilter]];	24✔
102	if (!exec_controller) {	24!
103	LOGE(@"Failed to initialize exec controller.");	×
104	exit(EXIT_FAILURE);	×
105	}	×
106
107	std::shared_ptr<::PrefixTree<Unit>> prefix_tree = std::make_shared<::PrefixTree<Unit>>();	24✔
108
109	// TODO(bur): Add KVO handling for fileChangesPrefixFilters.
110	NSArray<NSString > prefix_filters =	24✔
111	[@[ @"/.", @"/dev/" ] arrayByAddingObjectsFromArray:[configurator fileChangesPrefixFilters]];	24✔
112	for (NSString *filter in prefix_filters) {	48✔
113	prefix_tree->InsertPrefix([filter fileSystemRepresentation], Unit {});	48✔
114	}	48✔
115
116	std::shared_ptr<EndpointSecurityAPI> esapi = std::make_shared<EndpointSecurityAPI>();	24✔
117	if (!esapi) {	24!
118	LOGE(@"Failed to create ES API wrapper.");	×
119	exit(EXIT_FAILURE);	×
120	}	×
121
122	size_t spool_file_threshold_bytes = [configurator spoolDirectoryFileSizeThresholdKB] * 1024;	24✔
123	size_t spool_dir_threshold_bytes = [configurator spoolDirectorySizeThresholdMB] * 1024 * 1024;	24✔
124	uint64_t spool_flush_timeout_ms = [configurator spoolDirectoryEventMaxFlushTimeSec] * 1000;	24✔
125
126	std::unique_ptr<::Logger> logger =	24✔
127	Logger::Create(esapi, [configurator eventLogType], [SNTDecisionCache sharedCache],	24✔
128	[configurator eventLogPath], [configurator spoolDirectory],	24✔
129	spool_dir_threshold_bytes, spool_file_threshold_bytes, spool_flush_timeout_ms);	24✔
130	if (!logger) {	24!
131	LOGE(@"Failed to create logger.");	×
132	exit(EXIT_FAILURE);	×
133	}	×
134
135	std::shared_ptr<::WatchItems> watch_items =	24✔
136	[configurator fileAccessPolicy]	24!
137	? WatchItems::Create([configurator fileAccessPolicy],	×
138	[configurator fileAccessPolicyUpdateIntervalSec])	×
139	: WatchItems::Create([configurator fileAccessPolicyPlist],	24✔
140	[configurator fileAccessPolicyUpdateIntervalSec]);	24✔
141	if (!watch_items) {	24!
142	LOGE(@"Failed to create watch items");	×
143	exit(EXIT_FAILURE);	×
144	}	×
145
146	std::shared_ptr<::Metrics> metrics =	24✔
147	Metrics::Create(metric_set, [configurator metricExportInterval]);	24✔
148	if (!metrics) {	24!
149	LOGE(@"Failed to create metrics");	×
150	exit(EXIT_FAILURE);	×
151	}	×
152
153	std::shared_ptr<::AuthResultCache> auth_result_cache = AuthResultCache::Create(esapi, metric_set);	24✔
154	if (!auth_result_cache) {	24!
155	LOGE(@"Failed to create auth result cache");	×
156	exit(EXIT_FAILURE);	×
157	}	×
158
159	std::shared_ptr<process_tree::ProcessTree> process_tree;	24✔
160	std::vector<std::unique_ptr<process_tree::Annotator>> annotators;	24✔
161
162	for (NSString *annotation in [configurator enabledProcessAnnotations]) {	×
NEW 163	if ([[annotation lowercaseString] isEqualToString:@"originator"]) {	×
NEW 164	annotators.emplace_back(std::make_unique<process_tree::OriginatorAnnotator>());	×
NEW 165	} else {	×
NEW 166	LOGW(@"Unrecognized process annotation %@", annotation);	×
NEW 167	}	×
UNCOV 168	}	×
169
170	auto tree_status = process_tree::CreateTree(std::move(annotators));	24✔
171	if (!tree_status.ok()) {	24!
172	LOGE(@"Failed to create process tree: %@", @(tree_status.status().ToString().c_str()));	×
173	exit(EXIT_FAILURE);	×
174	}	×
175	process_tree = *tree_status;	24✔
176
177	return std::make_unique<SantadDeps>(	24✔
178	esapi, std::move(logger), std::move(metrics), std::move(watch_items),	24✔
179	std::move(auth_result_cache), control_connection, compiler_controller, notifier_queue,	24✔
180	syncd_queue, exec_controller, prefix_tree, std::move(tty_writer), std::move(process_tree));	24✔
181	}	24✔
182
183	SantadDeps::SantadDeps(
184	std::shared_ptr<EndpointSecurityAPI> esapi, std::unique_ptr<::Logger> logger,
185	std::shared_ptr<::Metrics> metrics, std::shared_ptr<::WatchItems> watch_items,
186	std::shared_ptr<santa::santad::event_providers::AuthResultCache> auth_result_cache,
187	MOLXPCConnection control_connection, SNTCompilerController compiler_controller,
188	SNTNotificationQueue notifier_queue, SNTSyncdQueue syncd_queue,
189	SNTExecutionController *exec_controller, std::shared_ptr<::PrefixTree<Unit>> prefix_tree,
190	std::shared_ptr<::TTYWriter> tty_writer, std::shared_ptr<process_tree::ProcessTree> process_tree)
191	: esapi_(std::move(esapi)),
192	logger_(std::move(logger)),
193	metrics_(std::move(metrics)),
194	watch_items_(std::move(watch_items)),
195	enricher_(std::make_shared<::Enricher>(process_tree)),
196	auth_result_cache_(std::move(auth_result_cache)),
197	control_connection_(control_connection),
198	compiler_controller_(compiler_controller),
199	notifier_queue_(notifier_queue),
200	syncd_queue_(syncd_queue),
201	exec_controller_(exec_controller),
202	prefix_tree_(prefix_tree),
203	tty_writer_(std::move(tty_writer)),
204	process_tree_(std::move(process_tree)) {}	24✔
205
206	std::shared_ptr<::AuthResultCache> SantadDeps::AuthResultCache() {	24✔
207	return auth_result_cache_;	24✔
208	}	24✔
209
210	std::shared_ptr<Enricher> SantadDeps::Enricher() {	×
211	return enricher_;	×
212	}	×
213	std::shared_ptr<EndpointSecurityAPI> SantadDeps::ESAPI() {	×
214	return esapi_;	×
215	}	×
216
217	std::shared_ptr<Logger> SantadDeps::Logger() {	×
218	return logger_;	×
219	}	×
220
221	std::shared_ptr<::Metrics> SantadDeps::Metrics() {	24✔
222	return metrics_;	24✔
223	}	24✔
224
225	std::shared_ptr<::WatchItems> SantadDeps::WatchItems() {	×
226	return watch_items_;	×
227	}	×
228
229	MOLXPCConnection *SantadDeps::ControlConnection() {	×
230	return control_connection_;	×
231	}	×
232
233	SNTCompilerController *SantadDeps::CompilerController() {	24✔
234	return compiler_controller_;	24✔
235	}	24✔
236
237	SNTNotificationQueue *SantadDeps::NotifierQueue() {	×
238	return notifier_queue_;	×
239	}	×
240
241	SNTSyncdQueue *SantadDeps::SyncdQueue() {	×
242	return syncd_queue_;	×
243	}	×
244
245	SNTExecutionController *SantadDeps::ExecController() {	24✔
246	return exec_controller_;	24✔
247	}	24✔
248
249	std::shared_ptr<PrefixTree<Unit>> SantadDeps::PrefixTree() {	×
250	return prefix_tree_;	×
251	}	×
252
253	std::shared_ptr<::TTYWriter> SantadDeps::TTYWriter() {	×
254	return tty_writer_;	×
255	}	×
256
257	std::shared_ptr<process_tree::ProcessTree> SantadDeps::ProcessTree() {	×
258	return process_tree_;	×
259	}	×
260
261	} // namespace santa::santad

google / santa / 8526031294

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous