9118144678

Committed 16 May 2024 07:35PM UTC coverage: 62.602% (-0.1%) from 62.701%

Build # 9118144678

Build Type

Pull #1348

github

Committed by

web-flow

Commit Message

Merge 4f64f245c into 67883c520

Pull Request Pull Request #1348: Add metric for when the file on disk is not the file being evaluated

Run Details

5325 of 12824 branches covered (41.52%)

Branch coverage included in aggregate %.

113 of 131 new or added lines in 7 files covered. (86.26%)

19 existing lines in 2 files now uncovered.

17744 of 24026 relevant lines covered (73.85%)

7016.5 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

80.33

/Source/santad/EventProviders/SNTEndpointSecurityClient.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"

#include <EndpointSecurity/EndpointSecurity.h>
#include <bsm/libbsm.h>
#include <dispatch/dispatch.h>
#include <mach/mach_time.h>
#include <stdlib.h>
#include <sys/qos.h>

#include <algorithm>
#include <set>
#include <string>
#include <string_view>

#include "Source/common/BranchPrediction.h"
#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#include "Source/common/SystemResources.h"
#include "Source/santad/DataLayer/WatchItemPolicy.h"
#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventDisposition;
using santa::santad::Metrics;
using santa::santad::Processor;
using santa::santad::data_layer::WatchItemPathType;
using santa::santad::event_providers::endpoint_security::Client;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::EnrichedMessage;
using santa::santad::event_providers::endpoint_security::Message;

constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
                                                "/private/var/db/santa/events.db"};

@interface SNTEndpointSecurityClient ()
@property(nonatomic) double defaultBudget;
@property(nonatomic) int64_t minAllowedHeadroom;
@property(nonatomic) int64_t maxAllowedHeadroom;
@property SNTConfigurator *configurator;
@end

@implementation SNTEndpointSecurityClient {
  std::shared_ptr<EndpointSecurityAPI> _esApi;
  std::shared_ptr<Metrics> _metrics;
  Client _esClient;
  dispatch_queue_t _authQueue;
  dispatch_queue_t _notifyQueue;
  Processor _processor;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<Metrics>)metrics
                    processor:(Processor)processor {
  self = [super init];
  if (self) {
    _esApi = std::move(esApi);
    _metrics = std::move(metrics);
    _configurator = [SNTConfigurator configurator];
    _processor = processor;

    // Default event processing budget is 80% of the deadline time
    _defaultBudget = 0.8;

    // For events with small deadlines, clamp processing budget to 1s headroom
    _minAllowedHeadroom = 1 * NSEC_PER_SEC;

    // For events with large deadlines, clamp processing budget to 5s headroom
    _maxAllowedHeadroom = 5 * NSEC_PER_SEC;

    _authQueue = dispatch_queue_create(
      "com.google.santa.daemon.auth_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_USER_INTERACTIVE, 0));

    _notifyQueue = dispatch_queue_create(
      "com.google.santa.daemon.notify_queue",
      dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,
                                              QOS_CLASS_UTILITY, 0));
  }
  return self;
}

- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {
  switch (result) {
    case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";
    case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";
    case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";
    case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";
    case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";
    default: return @"Unknown error";
  }
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {
  // This method should only be used by classes derived
  // from SNTEndpointSecurityClient.
  [self doesNotRecognizeSelector:_cmd];
}

- (BOOL)shouldHandleMessage:(const Message &)esMsg {
  if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {
    if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {
      [self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];
    }
    return NO;
  }

  return YES;
}

- (bool)handleContextMessage:(Message &)esMsg {
  return false;
}

- (void)establishClientOrDie {
  if (self->_esClient.IsConnected()) {
    // This is a programming error
    LOGE(@"Client already established. Aborting.");
    [NSException raise:@"Client already established" format:@"IsConnected already true"];
  }

  self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {
    int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);

    // Update event stats BEFORE calling into the processor class to ensure
    // sequence numbers are processed in order.
    self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());

    es_event_type_t eventType = esMsg->event_type;

    if ([self handleContextMessage:esMsg]) {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kProcessed,
                                      processingEnd - processingStart, esMsg.StatChangeStep(),
                                      esMsg.StatError());
      return;
    }

    if ([self shouldHandleMessage:esMsg]) {
      [self handleMessage:std::move(esMsg)
        recordEventMetrics:^(EventDisposition disposition) {
          int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
          self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,
                                          processingEnd - processingStart, esMsg.StatChangeStep(),
                                          esMsg.StatError());
        }];
    } else {
      int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);
      self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,
                                      processingEnd - processingStart, esMsg.StatChangeStep(),
                                      esMsg.StatError());
    }
  });

  if (!self->_esClient.IsConnected()) {
    NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];
    LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);
    [NSException raise:@"Failed to create ES client" format:@"%@", errMsg];
  } else {
    LOGI(@"Connected to EndpointSecurity (%@)", self);
  }

  if (![self muteSelf]) {
    [NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];
  }
}

+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {
  mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;
  if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {
    LOGE(@"Failed to fetch this client's audit token.");
    return false;
  }

  return true;
}

- (bool)muteSelf {
  audit_token_t myAuditToken;
  if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {
    return false;
  }

  if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {
    LOGE(@"Failed to mute this client's process.");
    return false;
  }

  return true;
}

- (bool)clearCache {
  return _esApi->ClearCache(self->_esClient);
}

- (bool)subscribe:(const std::set<es_event_type_t> &)events {
  return _esApi->Subscribe(_esClient, events);
}

- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {
  return [self subscribe:events] && [self clearCache];
}

- (bool)unsubscribeAll {
  return _esApi->UnsubscribeAll(_esClient);
}

- (bool)unmuteAllTargetPaths {
  return _esApi->UnmuteAllTargetPaths(_esClient);
}

- (bool)enableTargetPathWatching {
  [self unmuteAllTargetPaths];
  return _esApi->InvertTargetPathMuting(_esClient);
}

- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {
  bool result = true;
  for (const auto &pathAndTypePair : paths) {
    result =
      _esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;
  }
  return result;
}

- (bool)respondToMessage:(const Message &)msg
          withAuthResult:(es_auth_result_t)result
               cacheable:(bool)cacheable {
  if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {
    return _esApi->RespondFlagsResult(
      // For now, Santa is only concerned about alllowing all access or no
      // access, hence the flags being translated here to all or nothing based
      // on the auth result. In the future it might be beneficial to expand the
      // scope of Santa to enforce things like read-only access.
      _esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);
  } else {
    return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);
  }
}

- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
                       handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {
  __block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {
  __block Message msgTmp = std::move(msg);
  dispatch_async(_notifyQueue, ^{
    messageHandler(std::move(msgTmp));
  });
}

- (int64_t)computeBudgetForDeadline:(uint64_t)deadline currentTime:(uint64_t)currentTime {
  // First get how much time we have left
  int64_t nanosUntilDeadline = (int64_t)MachTimeToNanos(deadline - currentTime);

  // Compute the desired budget
  int64_t budget = nanosUntilDeadline * self.defaultBudget;

  // See how much headroom is left
  int64_t headroom = nanosUntilDeadline - budget;

  // Clamp headroom to maximize budget but ensure it's not so large as to not leave
  // enough time to respond in an emergency.
  headroom = std::clamp(headroom, self.minAllowedHeadroom, self.maxAllowedHeadroom);

  // Return the processing budget given the allotted headroom
  return nanosUntilDeadline - headroom;
}

- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {
  if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {
    // This is a programming error
    LOGE(@"Attempting to process non-AUTH message");
    [NSException raise:@"Attempt to process non-auth message"
                format:@"Unexpected event type received: %d", msg->event_type];
  }

  dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);
  // Add 1 to the processing semaphore. We're not creating it with a starting
  // value of 1 because that requires that the semaphore is not deallocated
  // until its value matches the starting value, which we don't need.
  dispatch_semaphore_signal(processingSema);
  dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);

  int64_t processingBudget = [self computeBudgetForDeadline:msg->deadline
                                                currentTime:mach_absolute_time()];

  // Workaround for compiler bug that doesn't properly close over variables
  __block Message processMsg = msg;
  __block Message deadlineMsg = msg;

  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, processingBudget), self->_authQueue, ^(void) {
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Handler has already responded, nothing to do.
      return;
    }

    es_auth_result_t authResult;
    if (self.configurator.failClosed) {
      authResult = ES_AUTH_RESULT_DENY;
    } else {
      authResult = ES_AUTH_RESULT_ALLOW;
    }

    bool res = [self respondToMessage:deadlineMsg withAuthResult:authResult cacheable:false];

    LOGE(@"SNTEndpointSecurityClient: deadline reached: pid=%d, event type: %d, result: %@, ret=%d",
         audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type,
         (authResult == ES_AUTH_RESULT_DENY ? @"denied" : @"allowed"), res);
    dispatch_semaphore_signal(deadlineExpiredSema);
  });

  dispatch_async(self->_authQueue, ^{
    messageHandler(processMsg);
    if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {
      // Deadline expired, wait for deadline block to finish.
      dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);
    }
  });
}

+ (std::set<std::string>)getProtectedPaths {
  std::set<std::string> protectedPathsCopy;

  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    protectedPathsCopy.insert(std::string(kProtectedFiles[i]));
  }

  return protectedPathsCopy;
}

+ (bool)isProtectedPath:(const std::string_view)path {
  // TODO(mlw): These values should come from `SNTDatabaseController`. But right
  // now they live as NSStrings. We should make them `std::string_view` types
  // in order to use them here efficiently, but will need to make the
  // `SNTDatabaseController` an ObjC++ file.
  for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {
    if (path == kProtectedFiles[i]) {
      return true;
    }
  }

  return false;
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityClient.h"
16
17	#include <EndpointSecurity/EndpointSecurity.h>
18	#include <bsm/libbsm.h>
19	#include <dispatch/dispatch.h>
20	#include <mach/mach_time.h>
21	#include <stdlib.h>
22	#include <sys/qos.h>
23
24	#include <algorithm>
25	#include <set>
26	#include <string>
27	#include <string_view>
28
29	#include "Source/common/BranchPrediction.h"
30	#import "Source/common/SNTCommonEnums.h"
31	#import "Source/common/SNTConfigurator.h"
32	#import "Source/common/SNTLogging.h"
33	#include "Source/common/SystemResources.h"
34	#include "Source/santad/DataLayer/WatchItemPolicy.h"
35	#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
36	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
37	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
38	#include "Source/santad/Metrics.h"
39
40	using santa::santad::EventDisposition;
41	using santa::santad::Metrics;
42	using santa::santad::Processor;
43	using santa::santad::data_layer::WatchItemPathType;
44	using santa::santad::event_providers::endpoint_security::Client;
45	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
46	using santa::santad::event_providers::endpoint_security::EnrichedMessage;
47	using santa::santad::event_providers::endpoint_security::Message;
48
49	constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db",
50	"/private/var/db/santa/events.db"};
51
52	@interface SNTEndpointSecurityClient ()
53	@property(nonatomic) double defaultBudget;
54	@property(nonatomic) int64_t minAllowedHeadroom;
55	@property(nonatomic) int64_t maxAllowedHeadroom;
56	@property SNTConfigurator *configurator;
57	@end
58
59	@implementation SNTEndpointSecurityClient {
60	std::shared_ptr<EndpointSecurityAPI> _esApi;
61	std::shared_ptr<Metrics> _metrics;
62	Client _esClient;
63	dispatch_queue_t _authQueue;
64	dispatch_queue_t _notifyQueue;
65	Processor _processor;
66	}
67
68	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
69	metrics:(std::shared_ptr<Metrics>)metrics
70	processor:(Processor)processor {	67✔
71	self = [super init];	67✔
72	if (self) {	67!
73	_esApi = std::move(esApi);	67✔
74	_metrics = std::move(metrics);	67✔
75	_configurator = [SNTConfigurator configurator];	67✔
76	_processor = processor;	67✔
77
78	// Default event processing budget is 80% of the deadline time
79	_defaultBudget = 0.8;	67✔
80
81	// For events with small deadlines, clamp processing budget to 1s headroom
82	_minAllowedHeadroom = 1 * NSEC_PER_SEC;	67✔
83
84	// For events with large deadlines, clamp processing budget to 5s headroom
85	_maxAllowedHeadroom = 5 * NSEC_PER_SEC;	67✔
86
87	_authQueue = dispatch_queue_create(	67✔
88	"com.google.santa.daemon.auth_queue",	67✔
89	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	67✔
90	QOS_CLASS_USER_INTERACTIVE, 0));	67✔
91
92	_notifyQueue = dispatch_queue_create(	67✔
93	"com.google.santa.daemon.notify_queue",	67✔
94	dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_CONCURRENT_WITH_AUTORELEASE_POOL,	67✔
95	QOS_CLASS_UTILITY, 0));	67✔
96	}	67✔
97	return self;	67✔
98	}	67✔
99
100	- (NSString *)errorMessageForNewClientResult:(es_new_client_result_t)result {	9✔
101	switch (result) {	9✔
102	case ES_NEW_CLIENT_RESULT_SUCCESS: return nil;	1✔
103	case ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED: return @"Full-disk access not granted";	1✔
104	case ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED: return @"Not entitled";	1✔
105	case ES_NEW_CLIENT_RESULT_ERR_NOT_PRIVILEGED: return @"Not running as root";	1✔
106	case ES_NEW_CLIENT_RESULT_ERR_INVALID_ARGUMENT: return @"Invalid argument";	1✔
107	case ES_NEW_CLIENT_RESULT_ERR_INTERNAL: return @"Internal error";	2✔
108	case ES_NEW_CLIENT_RESULT_ERR_TOO_MANY_CLIENTS: return @"Too many simultaneous clients";	1✔
109	default: return @"Unknown error";	1✔
110	}	9✔
111	}	9✔
112
113	- (void)handleMessage:(Message &&)esMsg
114	recordEventMetrics:(void (^)(EventDisposition disposition))recordEventMetrics {	1✔
115	// This method should only be used by classes derived
116	// from SNTEndpointSecurityClient.
117	[self doesNotRecognizeSelector:_cmd];	1✔
118	}	1✔
119
120	- (BOOL)shouldHandleMessage:(const Message &)esMsg {	4✔
121	if (esMsg->process->is_es_client && [self.configurator ignoreOtherEndpointSecurityClients]) {	4✔
122	if (esMsg->action_type == ES_ACTION_TYPE_AUTH) {	2✔
123	[self respondToMessage:esMsg withAuthResult:ES_AUTH_RESULT_ALLOW cacheable:true];	1✔
124	}	1✔
125	return NO;	2✔
126	}	2✔
127
128	return YES;	2✔
129	}	4✔
130
131	- (bool)handleContextMessage:(Message &)esMsg {	×
132	return false;	×
133	}	×
134
135	- (void)establishClientOrDie {	46✔
136	if (self->_esClient.IsConnected()) {	46!
137	// This is a programming error
138	LOGE(@"Client already established. Aborting.");	×
139	[NSException raise:@"Client already established" format:@"IsConnected already true"];	×
140	}	×
141
142	self->_esClient = self->_esApi->NewClient(^(es_client_t *c, Message esMsg) {	46✔
143	int64_t processingStart = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
144
145	// Update event stats BEFORE calling into the processor class to ensure
146	// sequence numbers are processed in order.
147	self->_metrics->UpdateEventStats(self->_processor, esMsg.operator->());	×
148
149	es_event_type_t eventType = esMsg->event_type;	×
150
151	if ([self handleContextMessage:esMsg]) {	×
152	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
153	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kProcessed,	×
NEW 154	processingEnd - processingStart, esMsg.StatChangeStep(),	×
NEW 155	esMsg.StatError());	×
156	return;	×
157	}	×
158
159	if ([self shouldHandleMessage:esMsg]) {	×
160	[self handleMessage:std::move(esMsg)	×
161	recordEventMetrics:^(EventDisposition disposition) {	×
162	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
163	self->_metrics->SetEventMetrics(self->_processor, eventType, disposition,	×
NEW 164	processingEnd - processingStart, esMsg.StatChangeStep(),	×
NEW 165	esMsg.StatError());	×
166	}];	×
167	} else {	×
168	int64_t processingEnd = clock_gettime_nsec_np(CLOCK_MONOTONIC);	×
169	self->_metrics->SetEventMetrics(self->_processor, eventType, EventDisposition::kDropped,	×
NEW 170	processingEnd - processingStart, esMsg.StatChangeStep(),	×
NEW 171	esMsg.StatError());	×
172	}	×
173	});	×
174
175	if (!self->_esClient.IsConnected()) {	46✔
176	NSString *errMsg = [self errorMessageForNewClientResult:_esClient.NewClientResult()];	1✔
177	LOGE(@"Unable to create EndpointSecurity client: %@", errMsg);	1✔
178	[NSException raise:@"Failed to create ES client" format:@"%@", errMsg];	1✔
179	} else {	45✔
180	LOGI(@"Connected to EndpointSecurity (%@)", self);	45✔
181	}	45✔
182
183	if (![self muteSelf]) {	46!
184	[NSException raise:@"ES Mute Failure" format:@"Failed to mute self"];	×
185	}	×
186	}	46✔
187
188	+ (bool)populateAuditTokenSelf:(audit_token_t *)tok {	48✔
189	mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;	48✔
190	if (task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)tok, &count) != KERN_SUCCESS) {	48!
191	LOGE(@"Failed to fetch this client's audit token.");	×
192	return false;	×
193	}	×
194
195	return true;	48✔
196	}	48✔
197
198	- (bool)muteSelf {	47✔
199	audit_token_t myAuditToken;	47✔
200	if (![SNTEndpointSecurityClient populateAuditTokenSelf:&myAuditToken]) {	47!
201	return false;	×
202	}	×
203
204	if (!self->_esApi->MuteProcess(self->_esClient, &myAuditToken)) {	47✔
205	LOGE(@"Failed to mute this client's process.");	1✔
206	return false;	1✔
207	}	1✔
208
209	return true;	46✔
210	}	47✔
211
212	- (bool)clearCache {	6✔
213	return _esApi->ClearCache(self->_esClient);	6✔
214	}	6✔
215
216	- (bool)subscribe:(const std::set<es_event_type_t> &)events {	8✔
217	return _esApi->Subscribe(_esClient, events);	8✔
218	}	8✔
219
220	- (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events {	4✔
221	return [self subscribe:events] && [self clearCache];	4!
222	}	4✔
223
224	- (bool)unsubscribeAll {	3✔
225	return _esApi->UnsubscribeAll(_esClient);	3✔
226	}	3✔
227
228	- (bool)unmuteAllTargetPaths {	11✔
229	return _esApi->UnmuteAllTargetPaths(_esClient);	11✔
230	}	11✔
231
232	- (bool)enableTargetPathWatching {	8✔
233	[self unmuteAllTargetPaths];	8✔
234	return _esApi->InvertTargetPathMuting(_esClient);	8✔
235	}	8✔
236
237	- (bool)muteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	2✔
238	bool result = true;	2✔
239	for (const auto &pathAndTypePair : paths) {	5✔
240	result =	5✔
241	_esApi->MuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	5✔
242	}	5✔
243	return result;	2✔
244	}	2✔
245
246	- (bool)unmuteTargetPaths:(const std::vector<std::pair<std::string, WatchItemPathType>> &)paths {	1✔
247	bool result = true;	1✔
248	for (const auto &pathAndTypePair : paths) {	3✔
249	result =	3✔
250	_esApi->UnmuteTargetPath(_esClient, pathAndTypePair.first, pathAndTypePair.second) && result;	3✔
251	}	3✔
252	return result;	1✔
253	}	1✔
254
255	- (bool)respondToMessage:(const Message &)msg
256	withAuthResult:(es_auth_result_t)result
257	cacheable:(bool)cacheable {	28✔
258	if (msg->event_type == ES_EVENT_TYPE_AUTH_OPEN) {	28!
259	return _esApi->RespondFlagsResult(	×
260	// For now, Santa is only concerned about alllowing all access or no
261	// access, hence the flags being translated here to all or nothing based
262	// on the auth result. In the future it might be beneficial to expand the
263	// scope of Santa to enforce things like read-only access.
264	_esClient, msg, (result == ES_AUTH_RESULT_ALLOW) ? 0xffffffff : 0x0, cacheable);	×
265	} else {	28✔
266	return _esApi->RespondAuthResult(_esClient, msg, result, cacheable);	28✔
267	}	28✔
268	}	28✔
269
270	- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
271	handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {	3✔
272	__block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);	3✔
273	dispatch_async(_notifyQueue, ^{	3✔
274	messageHandler(std::move(msgTmp));	3✔
275	});	3✔
276	}	3✔
277
278	- (void)asynchronouslyProcess:(Message)msg handler:(void (^)(Message &&))messageHandler {	×
279	__block Message msgTmp = std::move(msg);	×
280	dispatch_async(_notifyQueue, ^{	×
281	messageHandler(std::move(msgTmp));	×
282	});	×
283	}	×
284
285	- (int64_t)computeBudgetForDeadline:(uint64_t)deadline currentTime:(uint64_t)currentTime {	31✔
286	// First get how much time we have left
287	int64_t nanosUntilDeadline = (int64_t)MachTimeToNanos(deadline - currentTime);	31✔
288
289	// Compute the desired budget
290	int64_t budget = nanosUntilDeadline * self.defaultBudget;	31✔
291
292	// See how much headroom is left
293	int64_t headroom = nanosUntilDeadline - budget;	31✔
294
295	// Clamp headroom to maximize budget but ensure it's not so large as to not leave
296	// enough time to respond in an emergency.
297	headroom = std::clamp(headroom, self.minAllowedHeadroom, self.maxAllowedHeadroom);	31✔
298
299	// Return the processing budget given the allotted headroom
300	return nanosUntilDeadline - headroom;	31✔
301	}	31✔
302
303	- (void)processMessage:(Message &&)msg handler:(void (^)(const Message &))messageHandler {	29✔
304	if (unlikely(msg->action_type != ES_ACTION_TYPE_AUTH)) {	29✔
305	// This is a programming error
306	LOGE(@"Attempting to process non-AUTH message");	1✔
307	[NSException raise:@"Attempt to process non-auth message"	1✔
308	format:@"Unexpected event type received: %d", msg->event_type];	1✔
309	}	1✔
310
311	dispatch_semaphore_t processingSema = dispatch_semaphore_create(0);	29✔
312	// Add 1 to the processing semaphore. We're not creating it with a starting
313	// value of 1 because that requires that the semaphore is not deallocated
314	// until its value matches the starting value, which we don't need.
315	dispatch_semaphore_signal(processingSema);	29✔
316	dispatch_semaphore_t deadlineExpiredSema = dispatch_semaphore_create(0);	29✔
317
318	int64_t processingBudget = [self computeBudgetForDeadline:msg->deadline	29✔
319	currentTime:mach_absolute_time()];	29✔
320
321	// Workaround for compiler bug that doesn't properly close over variables
322	__block Message processMsg = msg;	29✔
323	__block Message deadlineMsg = msg;	29✔
324
325	dispatch_after(dispatch_time(DISPATCH_TIME_NOW, processingBudget), self->_authQueue, ^(void) {	29✔
326	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	26✔
327	// Handler has already responded, nothing to do.
328	return;	24✔
329	}	24✔
330
331	es_auth_result_t authResult;	2✔
332	if (self.configurator.failClosed) {	2✔
333	authResult = ES_AUTH_RESULT_DENY;	1✔
334	} else {	1✔
335	authResult = ES_AUTH_RESULT_ALLOW;	1✔
336	}	1✔
337
338	bool res = [self respondToMessage:deadlineMsg withAuthResult:authResult cacheable:false];	2✔
339
340	LOGE(@"SNTEndpointSecurityClient: deadline reached: pid=%d, event type: %d, result: %@, ret=%d",	2✔
341	audit_token_to_pid(deadlineMsg->process->audit_token), deadlineMsg->event_type,	2✔
342	(authResult == ES_AUTH_RESULT_DENY ? @"denied" : @"allowed"), res);	2✔
343	dispatch_semaphore_signal(deadlineExpiredSema);	2✔
344	});	2✔
345
346	dispatch_async(self->_authQueue, ^{	29✔
347	messageHandler(processMsg);	28✔
348	if (dispatch_semaphore_wait(processingSema, DISPATCH_TIME_NOW) != 0) {	28✔
349	// Deadline expired, wait for deadline block to finish.
350	dispatch_semaphore_wait(deadlineExpiredSema, DISPATCH_TIME_FOREVER);	2✔
351	}	2✔
352	});	28✔
353	}	29✔
354
355	+ (std::set<std::string>)getProtectedPaths {	1✔
356	std::set<std::string> protectedPathsCopy;	1✔
357
358	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	3✔
359	protectedPathsCopy.insert(std::string(kProtectedFiles[i]));	2✔
360	}	2✔
361
362	return protectedPathsCopy;	1✔
363	}	1✔
364
365	+ (bool)isProtectedPath:(const std::string_view)path {	15✔
366	// TODO(mlw): These values should come from `SNTDatabaseController`. But right
367	// now they live as NSStrings. We should make them `std::string_view` types
368	// in order to use them here efficiently, but will need to make the
369	// `SNTDatabaseController` an ObjC++ file.
370	for (size_t i = 0; i < sizeof(kProtectedFiles) / sizeof(kProtectedFiles[0]); i++) {	33✔
371	if (path == kProtectedFiles[i]) {	26✔
372	return true;	8✔
373	}	8✔
374	}	26✔
375
376	return false;	7✔
377	}	15✔
378
379	@end

google / santa / 9118144678

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous