google / santa / 9354806448

63%

push

github

santad: Add signal auth to tamper resistence. (#1360)

Prior to this change, root users could kill the com.google.santa.daemon process. 
It would be immediately restarted by sysextd but this opens a very brief
window where protection is lost. Hooking AUTH_SIGNAL and blocking all
signals to the santad process except those sent by launchd lets us block
this without breaking upgrades, reboots, etc.

This leaves `launchctl kill` and friends as an avenue, so we're also
hooking for exec and blocking executions of launchctl that reference
com.google.santa.daemon except in known safe cases.

5311 of 12912 branches covered (41.13%)

Branch coverage included in aggregate %.

42 of 70 new or added lines in 2 files covered. (60.0%)

17853 of 24184 relevant lines covered (73.82%)

6663.06 hits per line