8526008357

Committed 02 Apr 2024 04:11PM UTC coverage: 63.25% (-0.3%) from 63.593%

Build # 8526008357

Build Type

Pull #1296

github

Committed by

web-flow

Commit Message

Merge 2a1bb52b2 into 3b2d02f38

Pull Request Pull Request #1296: ProcessTree: add the first annotation, originator (4/4)

Run Details

4657 of 9618 branches covered (48.42%)

Branch coverage included in aggregate %.

63 of 68 new or added lines in 4 files covered. (92.65%)

343 existing lines in 5 files now uncovered.

16265 of 23460 relevant lines covered (69.33%)

14863.37 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santad/EventProviders/SNTEndpointSecurityTreeAwareClient.mm

/// Copyright 2024 Google LLC
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     https://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityTreeAwareClient.h"

#include <EndpointSecurity/EndpointSecurity.h>

#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"
#include "Source/santad/ProcessTree/SNTEndpointSecurityAdapter.h"
#include "Source/santad/ProcessTree/process_tree.h"
#include "Source/santad/ProcessTree/process_tree_macos.h"

using santa::santad::EventDisposition;
using santa::santad::Metrics;
using santa::santad::Processor;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Message;

@implementation SNTEndpointSecurityTreeAwareClient {
  std::vector<bool> _addedEvents;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<Metrics>)metrics
                    processor:(Processor)processor
                  processTree:
                    (std::shared_ptr<santa::santad::process_tree::ProcessTree>)processTree {
  self = [super initWithESAPI:std::move(esApi) metrics:std::move(metrics) processor:processor];
  if (self) {
    _processTree = std::move(processTree);
    _addedEvents.resize(ES_EVENT_TYPE_LAST, false);
  }
  return self;
}

// ES guarantees logical consistency within a client (e.g. forks always precede exits),
// however there are no guarantees about the ordering of when messages are delivered _across_
// clients, meaning any client might be the first one to receive process events, and therefore would
// need to be the one to inform the tree. However not all clients are interested in or subscribe to
// process events. This (and the below handleContextMessage) ensures that the ES subscription for
// all clients includes the minimal required set of events for process tree (NOTIFY_FORK, some EXEC
// variant, and NOTIFY_EXIT) but also filters out any events that were subscribed to solely for the
// purpose of updating the tree from being processed downstream, where they would be unexpected.
- (bool)subscribe:(const std::set<es_event_type_t> &)events {
  std::set<es_event_type_t> eventsWithLifecycle = events;
  if (events.find(ES_EVENT_TYPE_NOTIFY_FORK) == events.end()) {
    eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_FORK);
    _addedEvents[ES_EVENT_TYPE_NOTIFY_FORK] = true;
  }
  if (events.find(ES_EVENT_TYPE_NOTIFY_EXEC) == events.end() &&
      events.find(ES_EVENT_TYPE_AUTH_EXEC) == events.end()) {
    eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_EXEC);
    _addedEvents[ES_EVENT_TYPE_NOTIFY_EXEC] = true;
  }
  if (events.find(ES_EVENT_TYPE_NOTIFY_EXIT) == events.end()) {
    eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_EXIT);
    _addedEvents[ES_EVENT_TYPE_NOTIFY_EXIT] = true;
  }

  return [super subscribe:eventsWithLifecycle];
}

- (bool)handleContextMessage:(Message &)esMsg {
  if (!_processTree) {
    return false;
  }

  // Inform the tree
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_FORK:
    case ES_EVENT_TYPE_NOTIFY_EXEC:
    case ES_EVENT_TYPE_AUTH_EXEC:
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      santa::santad::process_tree::InformFromESEvent(*_processTree, esMsg);
      break;
    default: break;
  }

  // Now enumerate the processes that processing this event might require access to...
  std::vector<struct santa::santad::process_tree::Pid> pids;
  pids.emplace_back(santa::santad::process_tree::PidFromAuditToken(esMsg->process->audit_token));
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_AUTH_EXEC:
    case ES_EVENT_TYPE_NOTIFY_EXEC:
      pids.emplace_back(
        santa::santad::process_tree::PidFromAuditToken(esMsg->event.exec.target->audit_token));
      break;
    case ES_EVENT_TYPE_NOTIFY_FORK:
      pids.emplace_back(
        santa::santad::process_tree::PidFromAuditToken(esMsg->event.fork.child->audit_token));
      break;
    default: break;
  }

  // ...and create the token for those.
  esMsg.SetProcessToken(santa::santad::process_tree::ProcessToken(_processTree, std::move(pids)));

  return _addedEvents[esMsg->event_type];
}

@end

1	/// Copyright 2024 Google LLC
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// https://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityTreeAwareClient.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18
19	#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
20	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
21	#include "Source/santad/Metrics.h"
22	#include "Source/santad/ProcessTree/SNTEndpointSecurityAdapter.h"
23	#include "Source/santad/ProcessTree/process_tree.h"
24	#include "Source/santad/ProcessTree/process_tree_macos.h"
25
26	using santa::santad::EventDisposition;
27	using santa::santad::Metrics;
28	using santa::santad::Processor;
29	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
30	using santa::santad::event_providers::endpoint_security::Message;
31
32	@implementation SNTEndpointSecurityTreeAwareClient {
33	std::vector<bool> _addedEvents;
34	}
35
36	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
37	metrics:(std::shared_ptr<Metrics>)metrics
38	processor:(Processor)processor
39	processTree:
UNCOV 40	(std::shared_ptr<santa::santad::process_tree::ProcessTree>)processTree {	×
UNCOV 41	self = [super initWithESAPI:std::move(esApi) metrics:std::move(metrics) processor:processor];	×
UNCOV 42	if (self) {	×
UNCOV 43	_processTree = std::move(processTree);	×
UNCOV 44	_addedEvents.resize(ES_EVENT_TYPE_LAST, false);	×
UNCOV 45	}	×
UNCOV 46	return self;	×
UNCOV 47	}	×
48
49	// ES guarantees logical consistency within a client (e.g. forks always precede exits),
50	// however there are no guarantees about the ordering of when messages are delivered _across_
51	// clients, meaning any client might be the first one to receive process events, and therefore would
52	// need to be the one to inform the tree. However not all clients are interested in or subscribe to
53	// process events. This (and the below handleContextMessage) ensures that the ES subscription for
54	// all clients includes the minimal required set of events for process tree (NOTIFY_FORK, some EXEC
55	// variant, and NOTIFY_EXIT) but also filters out any events that were subscribed to solely for the
56	// purpose of updating the tree from being processed downstream, where they would be unexpected.
UNCOV 57	- (bool)subscribe:(const std::set<es_event_type_t> &)events {	×
UNCOV 58	std::set<es_event_type_t> eventsWithLifecycle = events;	×
UNCOV 59	if (events.find(ES_EVENT_TYPE_NOTIFY_FORK) == events.end()) {	×
60	eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_FORK);	×
61	_addedEvents[ES_EVENT_TYPE_NOTIFY_FORK] = true;	×
62	}	×
UNCOV 63	if (events.find(ES_EVENT_TYPE_NOTIFY_EXEC) == events.end() &&	×
64	events.find(ES_EVENT_TYPE_AUTH_EXEC) == events.end()) {	×
65	eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_EXEC);	×
66	_addedEvents[ES_EVENT_TYPE_NOTIFY_EXEC] = true;	×
67	}	×
UNCOV 68	if (events.find(ES_EVENT_TYPE_NOTIFY_EXIT) == events.end()) {	×
69	eventsWithLifecycle.insert(ES_EVENT_TYPE_NOTIFY_EXIT);	×
70	_addedEvents[ES_EVENT_TYPE_NOTIFY_EXIT] = true;	×
71	}	×
72
UNCOV 73	return [super subscribe:eventsWithLifecycle];	×
UNCOV 74	}	×
75
76	- (bool)handleContextMessage:(Message &)esMsg {	×
77	if (!_processTree) {	×
78	return false;	×
79	}	×
80
81	// Inform the tree
82	switch (esMsg->event_type) {	×
83	case ES_EVENT_TYPE_NOTIFY_FORK:	×
84	case ES_EVENT_TYPE_NOTIFY_EXEC:	×
85	case ES_EVENT_TYPE_AUTH_EXEC:	×
86	case ES_EVENT_TYPE_NOTIFY_EXIT:	×
87	santa::santad::process_tree::InformFromESEvent(*_processTree, esMsg);	×
88	break;	×
89	default: break;	×
90	}	×
91
92	// Now enumerate the processes that processing this event might require access to...
93	std::vector<struct santa::santad::process_tree::Pid> pids;	×
94	pids.emplace_back(santa::santad::process_tree::PidFromAuditToken(esMsg->process->audit_token));	×
95	switch (esMsg->event_type) {	×
96	case ES_EVENT_TYPE_AUTH_EXEC:	×
97	case ES_EVENT_TYPE_NOTIFY_EXEC:	×
98	pids.emplace_back(	×
99	santa::santad::process_tree::PidFromAuditToken(esMsg->event.exec.target->audit_token));	×
100	break;	×
101	case ES_EVENT_TYPE_NOTIFY_FORK:	×
102	pids.emplace_back(	×
103	santa::santad::process_tree::PidFromAuditToken(esMsg->event.fork.child->audit_token));	×
104	break;	×
105	default: break;	×
106	}	×
107
108	// ...and create the token for those.
109	esMsg.SetProcessToken(santa::santad::process_tree::ProcessToken(_processTree, std::move(pids)));	×
110
111	return _addedEvents[esMsg->event_type];	×
112	}	×
113
114	@end

google / santa / 8526008357

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous