9276811368

Committed 28 May 2024 09:51PM UTC coverage: 62.725% (+0.08%) from 62.648%

Build # 9276811368

Build Type

Pull #1360

github

Committed by

web-flow

Commit Message

Merge b252bf135 into 7502bc247

Pull Request Pull Request #1360: santad: Add signal auth to tamper resistence.

Run Details

5337 of 12788 branches covered (41.73%)

Branch coverage included in aggregate %.

4 of 12 new or added lines in 2 files covered. (33.33%)

1 existing line in 1 file now uncovered.

17776 of 24060 relevant lines covered (73.88%)

6905.85 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

87.16

/Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.h"

#include <EndpointSecurity/ESTypes.h>
#include <string.h>

#import "Source/common/SNTLogging.h"
#include "Source/santad/DataLayer/WatchItemPolicy.h"
#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
#include "Source/santad/Metrics.h"

using santa::santad::EventDisposition;
using santa::santad::data_layer::WatchItemPathType;
using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
using santa::santad::event_providers::endpoint_security::Message;
using santa::santad::logs::endpoint_security::Logger;

static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-driver";

@implementation SNTEndpointSecurityTamperResistance {
  std::shared_ptr<Logger> _logger;
}

- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
                      metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
                       logger:(std::shared_ptr<Logger>)logger {
  self = [super initWithESAPI:std::move(esApi)
                      metrics:std::move(metrics)
                    processor:santa::santad::Processor::kTamperResistance];
  if (self) {
    _logger = logger;

    [self establishClientOrDie];
  }
  return self;
}

- (NSString *)description {
  return @"Tamper Resistance";
}

- (void)handleMessage:(Message &&)esMsg
   recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {
  es_auth_result_t result = ES_AUTH_RESULT_ALLOW;
  switch (esMsg->event_type) {
    case ES_EVENT_TYPE_AUTH_UNLINK: {
      if ([SNTEndpointSecurityTamperResistance
            isProtectedPath:esMsg->event.unlink.target->path.data]) {
        result = ES_AUTH_RESULT_DENY;
        LOGW(@"Preventing attempt to delete Santa databases!");
      }
      break;
    }

    case ES_EVENT_TYPE_AUTH_RENAME: {
      if ([SNTEndpointSecurityTamperResistance
            isProtectedPath:esMsg->event.rename.source->path.data]) {
        result = ES_AUTH_RESULT_DENY;
        LOGW(@"Preventing attempt to rename Santa databases!");
        break;
      }

      if (esMsg->event.rename.destination_type == ES_DESTINATION_TYPE_EXISTING_FILE) {
        if ([SNTEndpointSecurityTamperResistance
              isProtectedPath:esMsg->event.rename.destination.existing_file->path.data]) {
          result = ES_AUTH_RESULT_DENY;
          LOGW(@"Preventing attempt to overwrite Santa databases!");
          break;
        }
      }

      break;
    }

    case ES_EVENT_TYPE_AUTH_SIGNAL: {
      if (esMsg->event.signal.target->session_id != getpid()) {
        result = ES_AUTH_RESULT_ALLOW;
        break;
      }
      LOGW(@"Preventing attempt to kill Santa daemon");
      result = ES_AUTH_RESULT_DENY;
      break;
    }

    case ES_EVENT_TYPE_AUTH_KEXTLOAD: {
      // TODO(mlw): Since we don't package the kext anymore, we should consider removing this.
      // TODO(mlw): Consider logging when kext loads are attempted.
      if (strcmp(esMsg->event.kextload.identifier.data, kSantaKextIdentifier.data()) == 0) {
        result = ES_AUTH_RESULT_DENY;
        LOGW(@"Preventing attempt to load Santa kext!");
      }
      break;
    }

    default:
      // Unexpected event type, this is a programming error
      [NSException raise:@"Invalid event type"
                  format:@"Invalid tamper resistance event type: %d", esMsg->event_type];
  }

  // Do not cache denied operations so that each tamper attempt is logged
  [self respondToMessage:esMsg withAuthResult:result cacheable:result == ES_AUTH_RESULT_ALLOW];

  // For this client, a processed event is one that was found to be violating anti-tamper policy
  recordEventMetrics(result == ES_AUTH_RESULT_DENY ? EventDisposition::kProcessed
                                                   : EventDisposition::kDropped);
}

- (void)enable {
  [super enableTargetPathWatching];

  // Get the set of protected paths
  std::set<std::string> protectedPaths = [SNTEndpointSecurityTamperResistance getProtectedPaths];

  // Iterate the set, and create a vector of literals to mute
  std::vector<std::pair<std::string, WatchItemPathType>> watchPaths;
  for (const auto &path : protectedPaths) {
    watchPaths.push_back({path, WatchItemPathType::kLiteral});
  }
  watchPaths.push_back({"/Library/SystemExtensions", WatchItemPathType::kPrefix});

  // Begin watching the protected set
  [super muteTargetPaths:watchPaths];

  [super subscribeAndClearCache:{
                                  ES_EVENT_TYPE_AUTH_KEXTLOAD,
                                  ES_EVENT_TYPE_AUTH_SIGNAL,
                                  ES_EVENT_TYPE_AUTH_UNLINK,
                                  ES_EVENT_TYPE_AUTH_RENAME,
                                }];
}

@end

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <string.h>
19
20	#import "Source/common/SNTLogging.h"
21	#include "Source/santad/DataLayer/WatchItemPolicy.h"
22	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
23	#include "Source/santad/Metrics.h"
24
25	using santa::santad::EventDisposition;
26	using santa::santad::data_layer::WatchItemPathType;
27	using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
28	using santa::santad::event_providers::endpoint_security::Message;
29	using santa::santad::logs::endpoint_security::Logger;
30
31	static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-driver";
32
33	@implementation SNTEndpointSecurityTamperResistance {
34	std::shared_ptr<Logger> _logger;
35	}
36
37	- (instancetype)initWithESAPI:(std::shared_ptr<EndpointSecurityAPI>)esApi
38	metrics:(std::shared_ptr<santa::santad::Metrics>)metrics
39	logger:(std::shared_ptr<Logger>)logger {	2✔
40	self = [super initWithESAPI:std::move(esApi)	2✔
41	metrics:std::move(metrics)	2✔
42	processor:santa::santad::Processor::kTamperResistance];	2✔
43	if (self) {	2!
44	_logger = logger;	2✔
45
46	[self establishClientOrDie];	2✔
47	}	2✔
48	return self;	2✔
49	}	2✔
50
51	- (NSString *)description {	2✔
52	return @"Tamper Resistance";	2✔
53	}	2✔
54
55	- (void)handleMessage:(Message &&)esMsg
56	recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {	12✔
57	es_auth_result_t result = ES_AUTH_RESULT_ALLOW;	12✔
58	switch (esMsg->event_type) {	12✔
59	case ES_EVENT_TYPE_AUTH_UNLINK: {	3✔
60	if ([SNTEndpointSecurityTamperResistance	3✔
61	isProtectedPath:esMsg->event.unlink.target->path.data]) {	3✔
62	result = ES_AUTH_RESULT_DENY;	2✔
63	LOGW(@"Preventing attempt to delete Santa databases!");	2✔
64	}	2✔
65	break;	3✔
66	}	×
67
68	case ES_EVENT_TYPE_AUTH_RENAME: {	6✔
69	if ([SNTEndpointSecurityTamperResistance	6✔
70	isProtectedPath:esMsg->event.rename.source->path.data]) {	6✔
71	result = ES_AUTH_RESULT_DENY;	2✔
72	LOGW(@"Preventing attempt to rename Santa databases!");	2✔
73	break;	2✔
74	}	2✔
75
76	if (esMsg->event.rename.destination_type == ES_DESTINATION_TYPE_EXISTING_FILE) {	4✔
77	if ([SNTEndpointSecurityTamperResistance	3✔
78	isProtectedPath:esMsg->event.rename.destination.existing_file->path.data]) {	3✔
79	result = ES_AUTH_RESULT_DENY;	2✔
80	LOGW(@"Preventing attempt to overwrite Santa databases!");	2✔
81	break;	2✔
82	}	2✔
83	}	3✔
84
85	break;	2✔
86	}	4✔
87
88	case ES_EVENT_TYPE_AUTH_SIGNAL: {	2!
NEW 89	if (esMsg->event.signal.target->session_id != getpid()) {	×
NEW 90	result = ES_AUTH_RESULT_ALLOW;	×
NEW 91	break;	×
NEW 92	}	×
NEW 93	LOGW(@"Preventing attempt to kill Santa daemon");	×
NEW 94	result = ES_AUTH_RESULT_DENY;	×
NEW 95	break;	×
NEW 96	}	×
97
98	case ES_EVENT_TYPE_AUTH_KEXTLOAD: {	2✔
99	// TODO(mlw): Since we don't package the kext anymore, we should consider removing this.
100	// TODO(mlw): Consider logging when kext loads are attempted.
101	if (strcmp(esMsg->event.kextload.identifier.data, kSantaKextIdentifier.data()) == 0) {	2✔
102	result = ES_AUTH_RESULT_DENY;	1✔
103	LOGW(@"Preventing attempt to load Santa kext!");	1✔
104	}	1✔
105	break;	2✔
UNCOV 106	}	×
107
108	default:	1✔
109	// Unexpected event type, this is a programming error
110	[NSException raise:@"Invalid event type"	1✔
111	format:@"Invalid tamper resistance event type: %d", esMsg->event_type];	1✔
112	}	12✔
113
114	// Do not cache denied operations so that each tamper attempt is logged
115	[self respondToMessage:esMsg withAuthResult:result cacheable:result == ES_AUTH_RESULT_ALLOW];	11✔
116
117	// For this client, a processed event is one that was found to be violating anti-tamper policy
118	recordEventMetrics(result == ES_AUTH_RESULT_DENY ? EventDisposition::kProcessed	11✔
119	: EventDisposition::kDropped);	11✔
120	}	11✔
121
122	- (void)enable {	1✔
123	[super enableTargetPathWatching];	1✔
124
125	// Get the set of protected paths
126	std::set<std::string> protectedPaths = [SNTEndpointSecurityTamperResistance getProtectedPaths];	1✔
127
128	// Iterate the set, and create a vector of literals to mute
129	std::vector<std::pair<std::string, WatchItemPathType>> watchPaths;	1✔
130	for (const auto &path : protectedPaths) {	2✔
131	watchPaths.push_back({path, WatchItemPathType::kLiteral});	2✔
132	}	2✔
133	watchPaths.push_back({"/Library/SystemExtensions", WatchItemPathType::kPrefix});	1✔
134
135	// Begin watching the protected set
136	[super muteTargetPaths:watchPaths];	1✔
137
138	[super subscribeAndClearCache:{	1✔
139	ES_EVENT_TYPE_AUTH_KEXTLOAD,	1✔
140	ES_EVENT_TYPE_AUTH_SIGNAL,	1✔
141	ES_EVENT_TYPE_AUTH_UNLINK,	1✔
142	ES_EVENT_TYPE_AUTH_RENAME,	1✔
143	}];	1✔
144	}	1✔
145
146	@end

google / santa / 9276811368

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous