9700290138

Committed 27 Jun 2024 04:33PM UTC coverage: 62.047% (-0.5%) from 62.519%

Build # 9700290138

Build Type

Pull #1376

github

Committed by

web-flow

Commit Message

Merge ea117a548 into cedbc0da1

Pull Request Pull Request #1376: Proto tests min version support

Run Details

5330 of 12972 branches covered (41.09%)

Branch coverage included in aggregate %.

69 of 136 new or added lines in 4 files covered. (50.74%)

126 existing lines in 8 files now uncovered.

17811 of 24324 relevant lines covered (73.22%)

7474.09 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

59.35

/Source/common/TestUtils.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/common/TestUtils.h"

#include <EndpointSecurity/ESTypes.h>
#include <dispatch/dispatch.h>
#include <mach/mach_time.h>
#include <time.h>
#include <uuid/uuid.h>
#include "Source/common/SystemResources.h"

NSString *RepeatedString(NSString *str, NSUInteger len) {
  return [@"" stringByPaddingToLength:len withString:str startingAtIndex:0];
}

audit_token_t MakeAuditToken(pid_t pid, pid_t pidver) {
  return audit_token_t{
    .val =
      {
        0,
        NOBODY_UID,
        NOGROUP_GID,
        NOBODY_UID,
        NOGROUP_GID,
        (unsigned int)pid,
        0,
        (unsigned int)pidver,
      },
  };
}

struct stat MakeStat(int offset) {
  return (struct stat){
    .st_dev = 1 + offset,
    .st_mode = (mode_t)(2 + offset),
    .st_nlink = (nlink_t)(3 + offset),
    .st_ino = (uint64_t)(4 + offset),
    .st_uid = NOBODY_UID,
    .st_gid = NOGROUP_GID,
    .st_rdev = 5 + offset,
    .st_atimespec = {.tv_sec = 100 + offset, .tv_nsec = 200 + offset},
    .st_mtimespec = {.tv_sec = 101 + offset, .tv_nsec = 21 + offset},
    .st_ctimespec = {.tv_sec = 102 + offset, .tv_nsec = 202 + offset},
    .st_birthtimespec = {.tv_sec = 103 + offset, .tv_nsec = 203 + offset},
    .st_size = 6 + offset,
    .st_blocks = 7 + offset,
    .st_blksize = 8 + offset,
    .st_flags = (uint32_t)(9 + offset),
    .st_gen = (uint32_t)(10 + offset),
  };
}

es_string_token_t MakeESStringToken(const char *s) {
  return es_string_token_t{
    .length = strlen(s),
    .data = s,
  };
}

es_file_t MakeESFile(const char *path, struct stat sb) {
  return es_file_t{
    .path = MakeESStringToken(path),
    .path_truncated = false,
    .stat = sb,
  };
}

es_process_t MakeESProcess(es_file_t *file, audit_token_t tok, audit_token_t parent_tok) {
  return es_process_t{
    .audit_token = tok,
    .ppid = audit_token_to_pid(parent_tok),
    .original_ppid = audit_token_to_pid(parent_tok),
    .group_id = 111,
    .session_id = 222,
    .is_platform_binary = true,
    .is_es_client = true,
    .executable = file,
    .parent_audit_token = parent_tok,
  };
}

es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc, ActionType action_type,
                           uint64_t future_deadline_ms) {
  es_message_t es_msg = {
    .deadline = AddNanosecondsToMachTime(future_deadline_ms * NSEC_PER_MSEC, mach_absolute_time()),
    .process = proc,
    .action_type =
      (action_type == ActionType::Notify) ? ES_ACTION_TYPE_NOTIFY : ES_ACTION_TYPE_AUTH,
    .event_type = et,
  };

  es_msg.version = MaxSupportedESMessageVersionForCurrentOS();

  return es_msg;
}

void SleepMS(long ms) {
  struct timespec ts {
    .tv_sec = ms / 1000, .tv_nsec = (long)((ms % 1000) * NSEC_PER_MSEC),
  };

  while (nanosleep(&ts, &ts) != 0) {
    XCTAssertEqual(errno, EINTR);
  }
}

uint32_t MaxSupportedESMessageVersionForCurrentOS() {
  // Notes:
  //   1. ES message v3 was only in betas.
  //   2. Message v7 appeared in macOS 13.3, v8 in macOS 15, but features from
  //      those versions are not currently used. Leaving off support here so as
  //      to not require adding unnecessary test JSON files.
  if (@available(macOS 13.0, *)) {
    return 6;
  } else if (@available(macOS 12.3, *)) {
    return 5;
  } else if (@available(macOS 11.0, *)) {
    return 4;
  } else if (@available(macOS 10.15.4, *)) {
    return 2;
  } else {
    return 1;
  }
}

uint32_t MinSupportedESMessageVersion(es_event_type_t event_type) {
  switch (event_type) {
    // The following events are available beginning in macOS 10.15
    case ES_EVENT_TYPE_AUTH_EXEC:
    case ES_EVENT_TYPE_AUTH_OPEN:
    case ES_EVENT_TYPE_AUTH_KEXTLOAD:
    case ES_EVENT_TYPE_AUTH_MMAP:
    case ES_EVENT_TYPE_AUTH_MPROTECT:
    case ES_EVENT_TYPE_AUTH_MOUNT:
    case ES_EVENT_TYPE_AUTH_RENAME:
    case ES_EVENT_TYPE_AUTH_SIGNAL:
    case ES_EVENT_TYPE_AUTH_UNLINK:
    case ES_EVENT_TYPE_NOTIFY_EXEC:
    case ES_EVENT_TYPE_NOTIFY_OPEN:
    case ES_EVENT_TYPE_NOTIFY_FORK:
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
    case ES_EVENT_TYPE_NOTIFY_CREATE:
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
    case ES_EVENT_TYPE_NOTIFY_EXIT:
    case ES_EVENT_TYPE_NOTIFY_GET_TASK:
    case ES_EVENT_TYPE_NOTIFY_KEXTLOAD:
    case ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD:
    case ES_EVENT_TYPE_NOTIFY_LINK:
    case ES_EVENT_TYPE_NOTIFY_MMAP:
    case ES_EVENT_TYPE_NOTIFY_MPROTECT:
    case ES_EVENT_TYPE_NOTIFY_MOUNT:
    case ES_EVENT_TYPE_NOTIFY_UNMOUNT:
    case ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN:
    case ES_EVENT_TYPE_NOTIFY_RENAME:
    case ES_EVENT_TYPE_NOTIFY_SETATTRLIST:
    case ES_EVENT_TYPE_NOTIFY_SETEXTATTR:
    case ES_EVENT_TYPE_NOTIFY_SETFLAGS:
    case ES_EVENT_TYPE_NOTIFY_SETMODE:
    case ES_EVENT_TYPE_NOTIFY_SETOWNER:
    case ES_EVENT_TYPE_NOTIFY_SIGNAL:
    case ES_EVENT_TYPE_NOTIFY_UNLINK:
    case ES_EVENT_TYPE_NOTIFY_WRITE:
    case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE:
    case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE:
    case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE:
    case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE:
    case ES_EVENT_TYPE_AUTH_READLINK:
    case ES_EVENT_TYPE_NOTIFY_READLINK:
    case ES_EVENT_TYPE_AUTH_TRUNCATE:
    case ES_EVENT_TYPE_NOTIFY_TRUNCATE:
    case ES_EVENT_TYPE_AUTH_LINK:
    case ES_EVENT_TYPE_NOTIFY_LOOKUP:
    case ES_EVENT_TYPE_AUTH_CREATE:
    case ES_EVENT_TYPE_AUTH_SETATTRLIST:
    case ES_EVENT_TYPE_AUTH_SETEXTATTR:
    case ES_EVENT_TYPE_AUTH_SETFLAGS:
    case ES_EVENT_TYPE_AUTH_SETMODE:
    case ES_EVENT_TYPE_AUTH_SETOWNER: return 1;

    // The following events are available beginning in macOS 10.15.1
    case ES_EVENT_TYPE_AUTH_CHDIR:
    case ES_EVENT_TYPE_NOTIFY_CHDIR:
    case ES_EVENT_TYPE_AUTH_GETATTRLIST:
    case ES_EVENT_TYPE_NOTIFY_GETATTRLIST:
    case ES_EVENT_TYPE_NOTIFY_STAT:
    case ES_EVENT_TYPE_NOTIFY_ACCESS:
    case ES_EVENT_TYPE_AUTH_CHROOT:
    case ES_EVENT_TYPE_NOTIFY_CHROOT:
    case ES_EVENT_TYPE_AUTH_UTIMES:
    case ES_EVENT_TYPE_NOTIFY_UTIMES:
    case ES_EVENT_TYPE_AUTH_CLONE:
    case ES_EVENT_TYPE_NOTIFY_CLONE:
    case ES_EVENT_TYPE_NOTIFY_FCNTL:
    case ES_EVENT_TYPE_AUTH_GETEXTATTR:
    case ES_EVENT_TYPE_NOTIFY_GETEXTATTR:
    case ES_EVENT_TYPE_AUTH_LISTEXTATTR:
    case ES_EVENT_TYPE_NOTIFY_LISTEXTATTR:
    case ES_EVENT_TYPE_AUTH_READDIR:
    case ES_EVENT_TYPE_NOTIFY_READDIR:
    case ES_EVENT_TYPE_AUTH_DELETEEXTATTR:
    case ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR:
    case ES_EVENT_TYPE_AUTH_FSGETPATH:
    case ES_EVENT_TYPE_NOTIFY_FSGETPATH:
    case ES_EVENT_TYPE_NOTIFY_DUP:
    case ES_EVENT_TYPE_AUTH_SETTIME:
    case ES_EVENT_TYPE_NOTIFY_SETTIME:
    case ES_EVENT_TYPE_NOTIFY_UIPC_BIND:
    case ES_EVENT_TYPE_AUTH_UIPC_BIND:
    case ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT:
    case ES_EVENT_TYPE_AUTH_UIPC_CONNECT:
    case ES_EVENT_TYPE_AUTH_EXCHANGEDATA:
    case ES_EVENT_TYPE_AUTH_SETACL:
    case ES_EVENT_TYPE_NOTIFY_SETACL: return 1;

    // The following events are available beginning in macOS 10.15.4
    case ES_EVENT_TYPE_NOTIFY_PTY_GRANT:
    case ES_EVENT_TYPE_NOTIFY_PTY_CLOSE:
    case ES_EVENT_TYPE_AUTH_PROC_CHECK:
    case ES_EVENT_TYPE_NOTIFY_PROC_CHECK:
    case ES_EVENT_TYPE_AUTH_GET_TASK: return 2;

    // The following events are available beginning in macOS 11.0
    case ES_EVENT_TYPE_AUTH_SEARCHFS:
    case ES_EVENT_TYPE_NOTIFY_SEARCHFS:
    case ES_EVENT_TYPE_AUTH_FCNTL:
    case ES_EVENT_TYPE_AUTH_IOKIT_OPEN:
    case ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME:
    case ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME:
    case ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED:
    case ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME:
    case ES_EVENT_TYPE_NOTIFY_TRACE:
    case ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE:
    case ES_EVENT_TYPE_AUTH_REMOUNT:
    case ES_EVENT_TYPE_NOTIFY_REMOUNT: return 4;

    // The following events are available beginning in macOS 11.3
    case ES_EVENT_TYPE_AUTH_GET_TASK_READ:
    case ES_EVENT_TYPE_NOTIFY_GET_TASK_READ:
    case ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT: return 4;

#if HAVE_MACOS_12
    // The following events are available beginning in macOS 12.0
    case ES_EVENT_TYPE_NOTIFY_SETUID:
    case ES_EVENT_TYPE_NOTIFY_SETGID:
    case ES_EVENT_TYPE_NOTIFY_SETEUID:
    case ES_EVENT_TYPE_NOTIFY_SETEGID:
    case ES_EVENT_TYPE_NOTIFY_SETREUID:
    case ES_EVENT_TYPE_NOTIFY_SETREGID:
    case ES_EVENT_TYPE_AUTH_COPYFILE:
    case ES_EVENT_TYPE_NOTIFY_COPYFILE: return 4;
#endif

#if HAVE_MACOS_13
    // The following events are available beginning in macOS 13.0
    case ES_EVENT_TYPE_NOTIFY_AUTHENTICATION:
    case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED:
    case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED:
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN:
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT:
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK:
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK:
    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:
    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH:
    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN:
    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT:
    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN:
    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT:
    case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD:
    case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE: return 6;
#endif

#if HAVE_MACOS_14
    // The following events are available beginning in macOS 14.0
    case ES_EVENT_TYPE_NOTIFY_PROFILE_ADD:
    case ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE:
    case ES_EVENT_TYPE_NOTIFY_SU:
    case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION:
    case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT:
    case ES_EVENT_TYPE_NOTIFY_SUDO:
    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD:
    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE:
    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET:
    case ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD:
    case ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER:
    case ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER:
    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD:
    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE:
    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET:
    case ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER:
    case ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP:
    case ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER:
    case ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP:
    case ES_EVENT_TYPE_NOTIFY_XPC_CONNECT: return 7;
#endif

    default: return UINT32_MAX;
  }
}

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/common/TestUtils.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <dispatch/dispatch.h>
19	#include <mach/mach_time.h>
20	#include <time.h>
21	#include <uuid/uuid.h>
22	#include "Source/common/SystemResources.h"
23
24	NSString RepeatedString(NSString str, NSUInteger len) {	12✔
25	return [@"" stringByPaddingToLength:len withString:str startingAtIndex:0];	12✔
26	}	12✔
27
28	audit_token_t MakeAuditToken(pid_t pid, pid_t pidver) {	180✔
29	return audit_token_t{	180✔
30	.val =	180✔
31	{	180✔
32	0,	180✔
33	NOBODY_UID,	180✔
34	NOGROUP_GID,	180✔
35	NOBODY_UID,	180✔
36	NOGROUP_GID,	180✔
37	(unsigned int)pid,	180✔
38	0,	180✔
39	(unsigned int)pidver,	180✔
40	},	180✔
41	};	180✔
42	}	180✔
43
44	struct stat MakeStat(int offset) {	230✔
45	return (struct stat){	230✔
46	.st_dev = 1 + offset,	230✔
47	.st_mode = (mode_t)(2 + offset),	230✔
48	.st_nlink = (nlink_t)(3 + offset),	230✔
49	.st_ino = (uint64_t)(4 + offset),	230✔
50	.st_uid = NOBODY_UID,	230✔
51	.st_gid = NOGROUP_GID,	230✔
52	.st_rdev = 5 + offset,	230✔
53	.st_atimespec = {.tv_sec = 100 + offset, .tv_nsec = 200 + offset},	230✔
54	.st_mtimespec = {.tv_sec = 101 + offset, .tv_nsec = 21 + offset},	230✔
55	.st_ctimespec = {.tv_sec = 102 + offset, .tv_nsec = 202 + offset},	230✔
56	.st_birthtimespec = {.tv_sec = 103 + offset, .tv_nsec = 203 + offset},	230✔
57	.st_size = 6 + offset,	230✔
58	.st_blocks = 7 + offset,	230✔
59	.st_blksize = 8 + offset,	230✔
60	.st_flags = (uint32_t)(9 + offset),	230✔
61	.st_gen = (uint32_t)(10 + offset),	230✔
62	};	230✔
63	}	230✔
64
65	es_string_token_t MakeESStringToken(const char *s) {	374✔
66	return es_string_token_t{	374✔
67	.length = strlen(s),	374✔
68	.data = s,	374✔
69	};	374✔
70	}	374✔
71
72	es_file_t MakeESFile(const char *path, struct stat sb) {	282✔
73	return es_file_t{	282✔
74	.path = MakeESStringToken(path),	282✔
75	.path_truncated = false,	282✔
76	.stat = sb,	282✔
77	};	282✔
78	}	282✔
79
80	es_process_t MakeESProcess(es_file_t *file, audit_token_t tok, audit_token_t parent_tok) {	188✔
81	return es_process_t{	188✔
82	.audit_token = tok,	188✔
83	.ppid = audit_token_to_pid(parent_tok),	188✔
84	.original_ppid = audit_token_to_pid(parent_tok),	188✔
85	.group_id = 111,	188✔
86	.session_id = 222,	188✔
87	.is_platform_binary = true,	188✔
88	.is_es_client = true,	188✔
89	.executable = file,	188✔
90	.parent_audit_token = parent_tok,	188✔
91	};	188✔
92	}	188✔
93
94	es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc, ActionType action_type,
95	uint64_t future_deadline_ms) {	158✔
96	es_message_t es_msg = {	158✔
97	.deadline = AddNanosecondsToMachTime(future_deadline_ms * NSEC_PER_MSEC, mach_absolute_time()),	158✔
98	.process = proc,	158✔
99	.action_type =	158✔
100	(action_type == ActionType::Notify) ? ES_ACTION_TYPE_NOTIFY : ES_ACTION_TYPE_AUTH,	158✔
101	.event_type = et,	158✔
102	};	158✔
103
104	es_msg.version = MaxSupportedESMessageVersionForCurrentOS();	158✔
105
106	return es_msg;	158✔
107	}	158✔
108
109	void SleepMS(long ms) {	7✔
110	struct timespec ts {	7✔
111	.tv_sec = ms / 1000, .tv_nsec = (long)((ms % 1000) * NSEC_PER_MSEC),	7✔
112	};	7✔
113
114	while (nanosleep(&ts, &ts) != 0) {	7!
115	XCTAssertEqual(errno, EINTR);	×
116	}	×
117	}	7✔
118
119	uint32_t MaxSupportedESMessageVersionForCurrentOS() {	234✔
120	// Notes:
121	// 1. ES message v3 was only in betas.
122	// 2. Message v7 appeared in macOS 13.3, v8 in macOS 15, but features from
123	// those versions are not currently used. Leaving off support here so as
124	// to not require adding unnecessary test JSON files.
125	if (@available(macOS 13.0, *)) {	234!
126	return 6;	234✔
127	} else if (@available(macOS 12.3, *)) {	234!
NEW 128	return 5;	×
NEW 129	} else if (@available(macOS 11.0, *)) {	×
NEW 130	return 4;	×
NEW 131	} else if (@available(macOS 10.15.4, *)) {	×
NEW 132	return 2;	×
NEW 133	} else {	×
NEW 134	return 1;	×
NEW 135	}	×
136	}	234✔
137
138	uint32_t MinSupportedESMessageVersion(es_event_type_t event_type) {	10✔
139	switch (event_type) {	10✔
140	// The following events are available beginning in macOS 10.15
NEW 141	case ES_EVENT_TYPE_AUTH_EXEC:	×
NEW 142	case ES_EVENT_TYPE_AUTH_OPEN:	×
NEW 143	case ES_EVENT_TYPE_AUTH_KEXTLOAD:	×
NEW 144	case ES_EVENT_TYPE_AUTH_MMAP:	×
NEW 145	case ES_EVENT_TYPE_AUTH_MPROTECT:	×
NEW 146	case ES_EVENT_TYPE_AUTH_MOUNT:	×
NEW 147	case ES_EVENT_TYPE_AUTH_RENAME:	×
NEW 148	case ES_EVENT_TYPE_AUTH_SIGNAL:	×
NEW 149	case ES_EVENT_TYPE_AUTH_UNLINK:	×
150	case ES_EVENT_TYPE_NOTIFY_EXEC:	2✔
151	case ES_EVENT_TYPE_NOTIFY_OPEN:	2!
152	case ES_EVENT_TYPE_NOTIFY_FORK:	3✔
153	case ES_EVENT_TYPE_NOTIFY_CLOSE:	4✔
154	case ES_EVENT_TYPE_NOTIFY_CREATE:	4!
155	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:	5✔
156	case ES_EVENT_TYPE_NOTIFY_EXIT:	6✔
157	case ES_EVENT_TYPE_NOTIFY_GET_TASK:	6!
158	case ES_EVENT_TYPE_NOTIFY_KEXTLOAD:	6!
159	case ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD:	6!
160	case ES_EVENT_TYPE_NOTIFY_LINK:	7✔
161	case ES_EVENT_TYPE_NOTIFY_MMAP:	7!
162	case ES_EVENT_TYPE_NOTIFY_MPROTECT:	7!
163	case ES_EVENT_TYPE_NOTIFY_MOUNT:	7!
164	case ES_EVENT_TYPE_NOTIFY_UNMOUNT:	7!
165	case ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN:	7!
166	case ES_EVENT_TYPE_NOTIFY_RENAME:	8✔
167	case ES_EVENT_TYPE_NOTIFY_SETATTRLIST:	8!
168	case ES_EVENT_TYPE_NOTIFY_SETEXTATTR:	8!
169	case ES_EVENT_TYPE_NOTIFY_SETFLAGS:	8!
170	case ES_EVENT_TYPE_NOTIFY_SETMODE:	8!
171	case ES_EVENT_TYPE_NOTIFY_SETOWNER:	8!
172	case ES_EVENT_TYPE_NOTIFY_SIGNAL:	8!
173	case ES_EVENT_TYPE_NOTIFY_UNLINK:	9✔
174	case ES_EVENT_TYPE_NOTIFY_WRITE:	9!
175	case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE:	9!
176	case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE:	9!
177	case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE:	9!
178	case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE:	9!
179	case ES_EVENT_TYPE_AUTH_READLINK:	9!
180	case ES_EVENT_TYPE_NOTIFY_READLINK:	9!
181	case ES_EVENT_TYPE_AUTH_TRUNCATE:	9!
182	case ES_EVENT_TYPE_NOTIFY_TRUNCATE:	9!
183	case ES_EVENT_TYPE_AUTH_LINK:	9!
184	case ES_EVENT_TYPE_NOTIFY_LOOKUP:	9!
185	case ES_EVENT_TYPE_AUTH_CREATE:	9!
186	case ES_EVENT_TYPE_AUTH_SETATTRLIST:	9!
187	case ES_EVENT_TYPE_AUTH_SETEXTATTR:	9!
188	case ES_EVENT_TYPE_AUTH_SETFLAGS:	9!
189	case ES_EVENT_TYPE_AUTH_SETMODE:	9!
190	case ES_EVENT_TYPE_AUTH_SETOWNER: return 1;	9!
191
192	// The following events are available beginning in macOS 10.15.1
NEW 193	case ES_EVENT_TYPE_AUTH_CHDIR:	×
NEW 194	case ES_EVENT_TYPE_NOTIFY_CHDIR:	×
NEW 195	case ES_EVENT_TYPE_AUTH_GETATTRLIST:	×
NEW 196	case ES_EVENT_TYPE_NOTIFY_GETATTRLIST:	×
NEW 197	case ES_EVENT_TYPE_NOTIFY_STAT:	×
NEW 198	case ES_EVENT_TYPE_NOTIFY_ACCESS:	×
NEW 199	case ES_EVENT_TYPE_AUTH_CHROOT:	×
NEW 200	case ES_EVENT_TYPE_NOTIFY_CHROOT:	×
NEW 201	case ES_EVENT_TYPE_AUTH_UTIMES:	×
NEW 202	case ES_EVENT_TYPE_NOTIFY_UTIMES:	×
NEW 203	case ES_EVENT_TYPE_AUTH_CLONE:	×
NEW 204	case ES_EVENT_TYPE_NOTIFY_CLONE:	×
NEW 205	case ES_EVENT_TYPE_NOTIFY_FCNTL:	×
NEW 206	case ES_EVENT_TYPE_AUTH_GETEXTATTR:	×
NEW 207	case ES_EVENT_TYPE_NOTIFY_GETEXTATTR:	×
NEW 208	case ES_EVENT_TYPE_AUTH_LISTEXTATTR:	×
NEW 209	case ES_EVENT_TYPE_NOTIFY_LISTEXTATTR:	×
NEW 210	case ES_EVENT_TYPE_AUTH_READDIR:	×
NEW 211	case ES_EVENT_TYPE_NOTIFY_READDIR:	×
NEW 212	case ES_EVENT_TYPE_AUTH_DELETEEXTATTR:	×
NEW 213	case ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR:	×
NEW 214	case ES_EVENT_TYPE_AUTH_FSGETPATH:	×
NEW 215	case ES_EVENT_TYPE_NOTIFY_FSGETPATH:	×
NEW 216	case ES_EVENT_TYPE_NOTIFY_DUP:	×
NEW 217	case ES_EVENT_TYPE_AUTH_SETTIME:	×
NEW 218	case ES_EVENT_TYPE_NOTIFY_SETTIME:	×
NEW 219	case ES_EVENT_TYPE_NOTIFY_UIPC_BIND:	×
NEW 220	case ES_EVENT_TYPE_AUTH_UIPC_BIND:	×
NEW 221	case ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT:	×
NEW 222	case ES_EVENT_TYPE_AUTH_UIPC_CONNECT:	×
NEW 223	case ES_EVENT_TYPE_AUTH_EXCHANGEDATA:	×
NEW 224	case ES_EVENT_TYPE_AUTH_SETACL:	×
NEW 225	case ES_EVENT_TYPE_NOTIFY_SETACL: return 1;	×
226
227	// The following events are available beginning in macOS 10.15.4
NEW 228	case ES_EVENT_TYPE_NOTIFY_PTY_GRANT:	×
NEW 229	case ES_EVENT_TYPE_NOTIFY_PTY_CLOSE:	×
NEW 230	case ES_EVENT_TYPE_AUTH_PROC_CHECK:	×
NEW 231	case ES_EVENT_TYPE_NOTIFY_PROC_CHECK:	×
NEW 232	case ES_EVENT_TYPE_AUTH_GET_TASK: return 2;	×
233
234	// The following events are available beginning in macOS 11.0
NEW 235	case ES_EVENT_TYPE_AUTH_SEARCHFS:	×
NEW 236	case ES_EVENT_TYPE_NOTIFY_SEARCHFS:	×
NEW 237	case ES_EVENT_TYPE_AUTH_FCNTL:	×
NEW 238	case ES_EVENT_TYPE_AUTH_IOKIT_OPEN:	×
NEW 239	case ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME:	×
NEW 240	case ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME:	×
241	case ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED:	1✔
242	case ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME:	1!
243	case ES_EVENT_TYPE_NOTIFY_TRACE:	1!
244	case ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE:	1!
245	case ES_EVENT_TYPE_AUTH_REMOUNT:	1!
246	case ES_EVENT_TYPE_NOTIFY_REMOUNT: return 4;	1!
247
248	// The following events are available beginning in macOS 11.3
NEW 249	case ES_EVENT_TYPE_AUTH_GET_TASK_READ:	×
NEW 250	case ES_EVENT_TYPE_NOTIFY_GET_TASK_READ:	×
NEW 251	case ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT: return 4;	×
252
253	#if HAVE_MACOS_12
254	// The following events are available beginning in macOS 12.0
255	case ES_EVENT_TYPE_NOTIFY_SETUID:
256	case ES_EVENT_TYPE_NOTIFY_SETGID:
257	case ES_EVENT_TYPE_NOTIFY_SETEUID:
258	case ES_EVENT_TYPE_NOTIFY_SETEGID:
259	case ES_EVENT_TYPE_NOTIFY_SETREUID:
260	case ES_EVENT_TYPE_NOTIFY_SETREGID:
261	case ES_EVENT_TYPE_AUTH_COPYFILE:
262	case ES_EVENT_TYPE_NOTIFY_COPYFILE: return 4;
263	#endif
264
265	#if HAVE_MACOS_13
266	// The following events are available beginning in macOS 13.0
267	case ES_EVENT_TYPE_NOTIFY_AUTHENTICATION:
268	case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED:
269	case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED:
270	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN:
271	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT:
272	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK:
273	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK:
274	case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:
275	case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH:
276	case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN:
277	case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT:
278	case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN:
279	case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT:
280	case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD:
281	case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE: return 6;
282	#endif
283
284	#if HAVE_MACOS_14
285	// The following events are available beginning in macOS 14.0
286	case ES_EVENT_TYPE_NOTIFY_PROFILE_ADD:
287	case ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE:
288	case ES_EVENT_TYPE_NOTIFY_SU:
289	case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION:
290	case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT:
291	case ES_EVENT_TYPE_NOTIFY_SUDO:
292	case ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD:
293	case ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE:
294	case ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET:
295	case ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD:
296	case ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER:
297	case ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER:
298	case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD:
299	case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE:
300	case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET:
301	case ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER:
302	case ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP:
303	case ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER:
304	case ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP:
305	case ES_EVENT_TYPE_NOTIFY_XPC_CONNECT: return 7;
306	#endif
307
NEW 308	default: return UINT32_MAX;	×
309	}	10✔
310	}	10✔

google / santa / 9700290138

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous