9022150234

Committed 09 May 2024 06:59PM UTC coverage: 62.581% (-0.02%) from 62.602%

Build # 9022150234

Build Type

Pull #1342

github

Committed by

web-flow

Commit Message

Merge a58109b35 into 6cca5ab27

Pull Request Pull Request #1342: santad: Bump QoS of notify handling queue

Run Details

5276 of 12738 branches covered (41.42%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

18 existing lines in 1 file now uncovered.

17658 of 23909 relevant lines covered (73.86%)

5852.67 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

81.14

/Source/santad/EventProviders/SNTEndpointSecurityClient.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"

#include <EndpointSecurity/EndpointSecurity.h>
#include <bsm/libbsm.h>
#include <dispatch/dispatch.h>
#include <mach/mach_time.h>
#include <stdlib.h>
#include <sys/qos.h>

#include <algorithm>
#include <set>
#include <string>
#include <string_view>

#include "Source/common/BranchPrediction.h"
#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/SystemResources.h"
#include "Source/santad/DataLayer/WatchItemPolicy.h"
#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventDisposition;
using santa::santad::Metrics;
using santa::santad::Processor;
using santa::santad::data_layer::WatchItemPathType;
using santa::santad::event_providers::endpoint_security::Client;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Message;

constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
                                                "/private/var/db/santa/events.db"};

@interface SNTEndpointSecurityClient ()
@property(nonatomic) double defaultBudget;
@property(nonatomic) int64_t minAllowedHeadroom;
@property(nonatomic) int64_t maxAllowedHeadroom;
@property SNTConfigurator *configurator;
@end

@implementation SNTEndpointSecurityClient {
  std::shared_ptr<EndpointSecurityAPI> _esApi;
  std::shared_ptr<Metrics> _metrics;
  Client _esClient;
  dispatch_queue_t _authQueue;
  dispatch_queue_t _notifyQueue;
  Processor _processor;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<Metrics>)metrics
                    processor:(Processor)processor {
  self = [super init];
  if (self) {
    _esApi = std::move(esApi);
    _metrics = std::move(metrics);
    _configurator = [SNTConfigurator configurator];
    _processor = processor;

    // Default event processing budget is 80% of the deadline time
    _defaultBudget = 0.8;

    // For events with small deadlines, clamp processing budget to 1s headroom
    _minAllowedHeadroom = 1 * NSEC_PER_SEC;

    // For events with large deadlines, clamp processing budget to 5s headroom
    _maxAllowedHeadroom = 5 * NSEC_PER_SEC;

    _authQueue = dispatch_queue_create(
      "com.google.santa.daemon.auth_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_USER_INTERACTIVE, 0));

    _notifyQueue = dispatch_queue_create(
      "com.google.santa.daemon.notify_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_DEFAULT, 0));
  }
  return self;
}

- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {
  switch (result) {
    case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";
    case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";
    case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";
    case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";
    default: return @"Unknown error";
  }
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {
  // This method should only be used by classes derived
  // from SNTEndpointSecurityClient.
  [self doesNotRecognizeSelector:_cmd];
}

- (BOOL)shouldHandleMessage:(const Message &)esMsg {
  if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {
    if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {
      [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
    }
    return NO;
  }

  return YES;
}

- (bool)handleContextMessage:(Message &)esMsg {
  return false;
}

- (void)establishClientOrDie {
  if (self->_esClient.IsConnected()) {
    // This is a programming error
    LOGE(@"Client already established. Aborting.");
    [NSException raise:@"Client already established" format:@"IsConnected already true"];
  }

  self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {
    int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);

    // Update event stats BEFORE calling into the processor class to ensure
    // sequence numbers are processed in order.
    self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());

    es_event_type_t eventType = esMsg->event_type;

    if ([self handleContextMessage:esMsg]) {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kProcessed,
                                      processingEnd - processingStart);
      return;
    }

    if ([self shouldHandleMessage:esMsg]) {
      [self handleMessage:std::move(esMsg)
        recordEventMetrics:^(EventDisposition disposition) {
          int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
          self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,
                                          processingEnd - processingStart);
        }];
    } else {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,
                                      processingEnd - processingStart);
    }
  });

  if (!self->_esClient.IsConnected()) {
    NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];
    LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);
    [NSException raise:@"Failed to create ES client" format:@"%@", errMsg];
  } else {
    LOGI(@"Connected to EndpointSecurity (%@)", self);
  }

  if (![self muteSelf]) {
    [NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];
  }
}

+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {
  mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;
  if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {
    LOGE(@"Failed to fetch this client's audit token.");
    return false;
  }

  return true;
}

- (bool)muteSelf {
  audit_token_t myAuditToken;
  if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {
    return false;
  }

  if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {
    LOGE(@"Failed to mute this client's process.");
    return false;
  }

  return true;
}

- (bool)clearCache {
  return _esApi->ClearCache(self->_esClient);
}

- (bool)subscribe:(const std::set<es_event_type_t> &)events {
  return _esApi->Subscribe(_esClient, events);
}

- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {
  return [self subscribe:events] && [self clearCache];
}

- (bool)unsubscribeAll {
  return _esApi->UnsubscribeAll(_esClient);
}

- (bool)unmuteAllTargetPaths {
  return _esApi->UnmuteAllTargetPaths(_esClient);
}

- (bool)enableTargetPathWatching {
  [self unmuteAllTargetPaths];
  return _esApi->InvertTargetPathMuting(_esClient);
}

- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)respondToMessage:(const Message &)msg
          withAuthResult:(es_auth_result_t)result
               cacheable:(bool)cacheable {
  if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {
    return _esApi->RespondFlagsResult(
      // For now, Santa is only concerned about alllowing all access or no
      // access, hence the flags being translated here to all or nothing based
      // on the auth result. In the future it might be beneficial to expand the
      // scope of Santa to enforce things like read-only access.
      _esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);
  } else {
    return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);
  }
}

- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
                       handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {
  __block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {
  __block Message msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (int64_t)computeBudgetForDeadline:(uint64_t)deadline currentTime:(uint64_t)currentTime {
  // First get how much time we have left
  int64_t nanosUntilDeadline = (int64_t)MachTimeToNanos(deadline - currentTime);

  // Compute the desired budget
  int64_t budget = nanosUntilDeadline * self.defaultBudget;

  // See how much headroom is left
  int64_t headroom = nanosUntilDeadline - budget;

  // Clamp headroom to maximize budget but ensure it's not so large as to not leave
  // enough time to respond in an emergency.
  headroom = std::clamp(headroom, self.minAllowedHeadroom, self.maxAllowedHeadroom);

  // Return the processing budget given the allotted headroom
  return nanosUntilDeadline - headroom;
}

- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {
  if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {
    // This is a programming error
    LOGE(@"Attempting to process non-AUTH message");
    [NSException raise:@"Attempt to process non-auth message"
                format:@"Unexpected event type received: %d", msg->event_type];
  }

  dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);
  // Add 1 to the processing semaphore. We're not creating it with a starting
  // value of 1 because that requires that the semaphore is not deallocated
  // until its value matches the starting value, which we don't need.
  dispatch_semaphore_signal(processingSema);
  dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);

  int64_t processingBudget = [self computeBudgetForDeadline:msg->deadline
                                                currentTime:mach_absolute_time()];

  // Workaround for compiler bug that doesn't properly close over variables
  __block Message processMsg = msg;
  __block Message deadlineMsg = msg;

  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, processingBudget), self->_authQueue, ^(void) {
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Handler has already responded, nothing to do.
      return;
    }

    es_auth_result_t authResult;
    if (self.configurator.failClosed) {
      authResult = ES_AUTH_RESULT_DENY;
    } else {
      authResult = ES_AUTH_RESULT_ALLOW;
    }

    bool res = [self respondToMessage:deadlineMsg withAuthResult:authResult cacheable:false];

    LOGE(@"SNTEndpointSecurityClient: deadline reached: pid=%d, event type: %d, result: %@, ret=%d",
         audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type,
         (authResult == ES_AUTH_RESULT_DENY ? @"denied" : @"allowed"), res);
    dispatch_semaphore_signal(deadlineExpiredSema);
  });

  dispatch_async(self->_authQueue, ^{
    messageHandler(processMsg);
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Deadline expired, wait for deadline block to finish.
      dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);
    }
  });
}

+ (std::set<std::string>)getProtectedPaths {
  std::set<std::string> protectedPathsCopy;

  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    protectedPathsCopy.insert(std::string(kProtectedFiles[i]));
  }

  return protectedPathsCopy;
}

+ (bool)isProtectedPath:(const std::string_view)path {
  // TODO(mlw): These values should come from `SNTDatabaseController`. But right
  // now they live as NSStrings. We should make them `std::string_view` types
  // in order to use them here efficiently, but will need to make the
  // `SNTDatabaseController` an ObjC++ file.
  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    if (path == kProtectedFiles[i]) {
      return true;
    }
  }

  return false;
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18	#include <bsm/libbsm.h>
19	#include <dispatch/dispatch.h>
20	#include <mach/mach_time.h>
21	#include <stdlib.h>
22	#include <sys/qos.h>
23
24	#include <algorithm>
25	#include <set>
26	#include <string>
27	#include <string_view>
28
29	#include "Source/common/BranchPrediction.h"
30	#import "Source/common/SNTCommonEnums.h"
31	#import "Source/common/SNTConfigurator.h"
32	#import "Source/common/SNTLogging.h"
33	#include "Source/common/SystemResources.h"
34	#include "Source/santad/DataLayer/WatchItemPolicy.h"
35	#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
36	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
37	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
38	#include "Source/santad/Metrics.h"
39
40	using santa::santad::EventDisposition;
41	using santa::santad::Metrics;
42	using santa::santad::Processor;
43	using santa::santad::data_layer::WatchItemPathType;
44	using santa::santad::event_providers::endpoint_security::Client;
45	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
46	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
47	using santa::santad::event_providers::endpoint_security::Message;
48
49	constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
50	"/private/var/db/santa/events.db"};
51
52	@interface SNTEndpointSecurityClient ()
53	@property(nonatomic) double defaultBudget;
54	@property(nonatomic) int64_t minAllowedHeadroom;
55	@property(nonatomic) int64_t maxAllowedHeadroom;
56	@property SNTConfigurator *configurator;
57	@end
58
59	@implementation SNTEndpointSecurityClient {
60	std::shared_ptr<EndpointSecurityAPI> _esApi;
61	std::shared_ptr<Metrics> _metrics;
62	Client _esClient;
63	dispatch_queue_t _authQueue;
64	dispatch_queue_t _notifyQueue;
65	Processor _processor;
66	}
67
68	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
69	metrics:(std::shared_ptr<Metrics>)metrics
70	processor:(Processor)processor {	67✔
71	self = [super init];	67✔
72	if (self) {	67!
73	_esApi = std::move(esApi);	67✔
74	_metrics = std::move(metrics);	67✔
75	_configurator = [SNTConfigurator configurator];	67✔
76	_processor = processor;	67✔
77
78	// Default event processing budget is 80% of the deadline time
79	_defaultBudget = 0.8;	67✔
80
81	// For events with small deadlines, clamp processing budget to 1s headroom
82	_minAllowedHeadroom = 1 * NSEC_PER_SEC;	67✔
83
84	// For events with large deadlines, clamp processing budget to 5s headroom
85	_maxAllowedHeadroom = 5 * NSEC_PER_SEC;	67✔
86
87	_authQueue = dispatch_queue_create(	67✔
88	"com.google.santa.daemon.auth_queue",	67✔
89	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	67✔
90	QOS_CLASS_USER_INTERACTIVE, 0));	67✔
91
92	_notifyQueue = dispatch_queue_create(	67✔
93	"com.google.santa.daemon.notify_queue",	67✔
94	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	67✔
95	QOS_CLASS_DEFAULT, 0));	67✔
96	}	67✔
97	return self;	67✔
98	}	67✔
99
100	- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {	9✔
101	switch (result) {	9✔
102	case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;	1✔
103	case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";	1✔
104	case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";	1✔
105	case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";	1✔
106	case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";	1✔
107	case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";	2✔
108	case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";	1✔
109	default: return @"Unknown error";	1✔
110	}	9✔
111	}	9✔
112
113	- (void)handleMessage:(Message &&)esMsg
114	recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {	1✔
115	// This method should only be used by classes derived
116	// from SNTEndpointSecurityClient.
117	[self doesNotRecognizeSelector:_cmd];	1✔
118	}	1✔
119
120	- (BOOL)shouldHandleMessage:(const Message &)esMsg {	4✔
121	if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {	4✔
122	if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {	2✔
123	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	1✔
124	}	1✔
125	return NO;	2✔
126	}	2✔
127
128	return YES;	2✔
129	}	4✔
130
131	- (bool)handleContextMessage:(Message &)esMsg {	×
UNCOV 132	return false;	×
UNCOV 133	}	×
134
135	- (void)establishClientOrDie {	46✔
136	if (self->_esClient.IsConnected()) {	46!
137	// This is a programming error
138	LOGE(@"Client already established. Aborting.");	×
UNCOV 139	[NSException raise:@"Client already established" format:@"IsConnected already true"];	×
UNCOV 140	}	×
141
142	self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {	46✔
UNCOV 143	int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
144
145	// Update event stats BEFORE calling into the processor class to ensure
146	// sequence numbers are processed in order.
147	self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());	×
148
149	es_event_type_t eventType = esMsg->event_type;	×
150
151	if ([self handleContextMessage:esMsg]) {	×
152	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
153	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kProcessed,	×
154	processingEnd - processingStart);	×
UNCOV 155	return;	×
156	}	×
157
158	if ([self shouldHandleMessage:esMsg]) {	×
159	[self handleMessage:std::move(esMsg)	×
160	recordEventMetrics:^(EventDisposition disposition) {	×
161	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
162	self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,	×
163	processingEnd - processingStart);	×
164	}];	×
165	} else {	×
166	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
167	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,	×
168	processingEnd - processingStart);	×
UNCOV 169	}	×
UNCOV 170	});	×
171
172	if (!self->_esClient.IsConnected()) {	46✔
173	NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];	1✔
174	LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);	1✔
175	[NSException raise:@"Failed to create ES client" format:@"%@", errMsg];	1✔
176	} else {	45✔
177	LOGI(@"Connected to EndpointSecurity (%@)", self);	45✔
178	}	45✔
179
180	if (![self muteSelf]) {	46!
UNCOV 181	[NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];	×
UNCOV 182	}	×
183	}	46✔
184
185	+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {	48✔
186	mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;	48✔
187	if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {	48!
188	LOGE(@"Failed to fetch this client's audit token.");	×
UNCOV 189	return false;	×
UNCOV 190	}	×
191
192	return true;	48✔
193	}	48✔
194
195	- (bool)muteSelf {	47✔
196	audit_token_t myAuditToken;	47✔
197	if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {	47!
UNCOV 198	return false;	×
UNCOV 199	}	×
200
201	if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {	47✔
202	LOGE(@"Failed to mute this client's process.");	1✔
203	return false;	1✔
204	}	1✔
205
206	return true;	46✔
207	}	47✔
208
209	- (bool)clearCache {	6✔
210	return _esApi->ClearCache(self->_esClient);	6✔
211	}	6✔
212
213	- (bool)subscribe:(const std::set<es_event_type_t> &)events {	8✔
214	return _esApi->Subscribe(_esClient, events);	8✔
215	}	8✔
216
217	- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {	4✔
218	return [self subscribe:events] && [self clearCache];	4!
219	}	4✔
220
221	- (bool)unsubscribeAll {	3✔
222	return _esApi->UnsubscribeAll(_esClient);	3✔
223	}	3✔
224
225	- (bool)unmuteAllTargetPaths {	11✔
226	return _esApi->UnmuteAllTargetPaths(_esClient);	11✔
227	}	11✔
228
229	- (bool)enableTargetPathWatching {	8✔
230	[self unmuteAllTargetPaths];	8✔
231	return _esApi->InvertTargetPathMuting(_esClient);	8✔
232	}	8✔
233
234	- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	2✔
235	bool result = true;	2✔
236	for (const auto &pathAndTypePair : paths) {	5✔
237	result =	5✔
238	_esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	5✔
239	}	5✔
240	return result;	2✔
241	}	2✔
242
243	- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	1✔
244	bool result = true;	1✔
245	for (const auto &pathAndTypePair : paths) {	3✔
246	result =	3✔
247	_esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	3✔
248	}	3✔
249	return result;	1✔
250	}	1✔
251
252	- (bool)respondToMessage:(const Message &)msg
253	withAuthResult:(es_auth_result_t)result
254	cacheable:(bool)cacheable {	28✔
255	if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {	28!
UNCOV 256	return _esApi->RespondFlagsResult(	×
257	// For now, Santa is only concerned about alllowing all access or no
258	// access, hence the flags being translated here to all or nothing based
259	// on the auth result. In the future it might be beneficial to expand the
260	// scope of Santa to enforce things like read-only access.
UNCOV 261	_esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);	×
262	} else {	28✔
263	return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);	28✔
264	}	28✔
265	}	28✔
266
267	- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
268	handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {	3✔
269	__block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);	3✔
270	dispatch_async(_notifyQueue, ^{	3✔
271	messageHandler(std::move(msgTmp));	3✔
272	});	3✔
273	}	3✔
274
275	- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {	×
276	__block Message msgTmp = std::move(msg);	×
277	dispatch_async(_notifyQueue, ^{	×
278	messageHandler(std::move(msgTmp));	×
UNCOV 279	});	×
UNCOV 280	}	×
281
282	- (int64_t)computeBudgetForDeadline:(uint64_t)deadline currentTime:(uint64_t)currentTime {	31✔
283	// First get how much time we have left
284	int64_t nanosUntilDeadline = (int64_t)MachTimeToNanos(deadline - currentTime);	31✔
285
286	// Compute the desired budget
287	int64_t budget = nanosUntilDeadline * self.defaultBudget;	31✔
288
289	// See how much headroom is left
290	int64_t headroom = nanosUntilDeadline - budget;	31✔
291
292	// Clamp headroom to maximize budget but ensure it's not so large as to not leave
293	// enough time to respond in an emergency.
294	headroom = std::clamp(headroom, self.minAllowedHeadroom, self.maxAllowedHeadroom);	31✔
295
296	// Return the processing budget given the allotted headroom
297	return nanosUntilDeadline - headroom;	31✔
298	}	31✔
299
300	- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {	29✔
301	if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {	29✔
302	// This is a programming error
303	LOGE(@"Attempting to process non-AUTH message");	1✔
304	[NSException raise:@"Attempt to process non-auth message"	1✔
305	format:@"Unexpected event type received: %d", msg->event_type];	1✔
306	}	1✔
307
308	dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);	29✔
309	// Add 1 to the processing semaphore. We're not creating it with a starting
310	// value of 1 because that requires that the semaphore is not deallocated
311	// until its value matches the starting value, which we don't need.
312	dispatch_semaphore_signal(processingSema);	29✔
313	dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);	29✔
314
315	int64_t processingBudget = [self computeBudgetForDeadline:msg->deadline	29✔
316	currentTime:mach_absolute_time()];	29✔
317
318	// Workaround for compiler bug that doesn't properly close over variables
319	__block Message processMsg = msg;	29✔
320	__block Message deadlineMsg = msg;	29✔
321
322	dispatch_after(dispatch_time(DISPATCH_TIME_NOW, processingBudget), self->_authQueue, ^(void) {	29✔
323	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	26✔
324	// Handler has already responded, nothing to do.
325	return;	24✔
326	}	24✔
327
328	es_auth_result_t authResult;	2✔
329	if (self.configurator.failClosed) {	2✔
330	authResult = ES_AUTH_RESULT_DENY;	1✔
331	} else {	1✔
332	authResult = ES_AUTH_RESULT_ALLOW;	1✔
333	}	1✔
334
335	bool res = [self respondToMessage:deadlineMsg withAuthResult:authResult cacheable:false];	2✔
336
337	LOGE(@"SNTEndpointSecurityClient: deadline reached: pid=%d, event type: %d, result: %@, ret=%d",	2✔
338	audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type,	2✔
339	(authResult == ES_AUTH_RESULT_DENY ? @"denied" : @"allowed"), res);	2✔
340	dispatch_semaphore_signal(deadlineExpiredSema);	2✔
341	});	2✔
342
343	dispatch_async(self->_authQueue, ^{	29✔
344	messageHandler(processMsg);	28✔
345	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	28✔
346	// Deadline expired, wait for deadline block to finish.
347	dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);	2✔
348	}	2✔
349	});	28✔
350	}	29✔
351
352	+ (std::set<std::string>)getProtectedPaths {	1✔
353	std::set<std::string> protectedPathsCopy;	1✔
354
355	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	3✔
356	protectedPathsCopy.insert(std::string(kProtectedFiles[i]));	2✔
357	}	2✔
358
359	return protectedPathsCopy;	1✔
360	}	1✔
361
362	+ (bool)isProtectedPath:(const std::string_view)path {	15✔
363	// TODO(mlw): These values should come from `SNTDatabaseController`. But right
364	// now they live as NSStrings. We should make them `std::string_view` types
365	// in order to use them here efficiently, but will need to make the
366	// `SNTDatabaseController` an ObjC++ file.
367	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	33✔
368	if (path == kProtectedFiles[i]) {	26✔
369	return true;	8✔
370	}	8✔
371	}	26✔
372
373	return false;	7✔
374	}	15✔
375
376	@end

google / santa / 9022150234

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous