9715901161

Committed 28 Jun 2024 04:26PM UTC coverage: 62.432% (+0.2%) from 62.268%

Build # 9715901161

Build Type

Pull #1377

github

Committed by

web-flow

Commit Message

Merge b61e52b80 into ecf7040b8

Pull Request Pull Request #1377: Drop macos 11

Run Details

5349 of 12964 branches covered (41.26%)

Branch coverage included in aggregate %.

47 of 54 new or added lines in 10 files covered. (87.04%)

26 existing lines in 2 files now uncovered.

17895 of 24267 relevant lines covered (73.74%)

6722.64 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"

#include <set>
#include <vector>

#include "Source/common/Platform.h"

using santa::santad::data_layer::WatchItemPathType;

namespace santa::santad::event_providers::endpoint_security {

Client EndpointSecurityAPI::NewClient(void (^message_handler)(es_client_t *, Message)) {
  es_client_t *client = NULL;

  auto shared_esapi = shared_from_this();
  es_new_client_result_t res = es_new_client(&client, ^(es_client_t *c, const es_message_t *msg) {
    @autoreleasepool {
      message_handler(c, Message(shared_esapi, msg));
    }
  });

  return Client(client, res);
}

void EndpointSecurityAPI::RetainMessage(const es_message_t *msg) {
  es_retain_message(msg);
}

void EndpointSecurityAPI::ReleaseMessage(const es_message_t *msg) {
  es_release_message(msg);
}

bool EndpointSecurityAPI::Subscribe(const Client &client,
                                    const std::set<es_event_type_t> &event_types) {
  std::vector<es_event_type_t> subs(event_types.begin(), event_types.end());
  return es_subscribe(client.Get(), subs.data(), (uint32_t)subs.size()) == ES_RETURN_SUCCESS;
}

bool EndpointSecurityAPI::UnsubscribeAll(const Client &client) {
  return es_unsubscribe_all(client.Get()) == ES_RETURN_SUCCESS;
}

bool EndpointSecurityAPI::UnmuteAllPaths(const Client &client) {
  return es_unmute_all_paths(client.Get()) == ES_RETURN_SUCCESS;
}

bool EndpointSecurityAPI::UnmuteAllTargetPaths(const Client &client) {
#if HAVE_MACOS_13
  if (@available(macOS 13.0, *)) {
    return es_unmute_all_target_paths(client.Get()) == ES_RETURN_SUCCESS;
  }
#endif

  return true;
}

bool EndpointSecurityAPI::IsTargetPathMutingInverted(const Client &client) {
#if HAVE_MACOS_13
  if (@available(macOS 13.0, *)) {
    return es_muting_inverted(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) == ES_MUTE_INVERTED;
  }
#endif

  return false;
}

bool EndpointSecurityAPI::InvertTargetPathMuting(const Client &client) {
#if HAVE_MACOS_13
  if (@available(macOS 13.0, *)) {
    if (!IsTargetPathMutingInverted(client)) {
      return es_invert_muting(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) ==
             ES_RETURN_SUCCESS;
    } else {
      return true;
    }
  }
#endif

  return false;
}

bool EndpointSecurityAPI::MuteTargetPath(const Client &client, std::string_view path,
                                         WatchItemPathType path_type) {
#if HAVE_MACOS_13
  if (@available(macOS 13.0, *)) {
    return es_mute_path(client.Get(), path.data(),
                        path_type == WatchItemPathType::kPrefix
                          ? ES_MUTE_PATH_TYPE_TARGET_PREFIX
                          : ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;
  }
#endif

  return false;
}

bool EndpointSecurityAPI::UnmuteTargetPath(const Client &client, std::string_view path,
                                           WatchItemPathType path_type) {
#if HAVE_MACOS_13
  if (@available(macOS 13.0, *)) {
    return es_unmute_path(client.Get(), path.data(),
                          path_type == WatchItemPathType::kPrefix
                            ? ES_MUTE_PATH_TYPE_TARGET_PREFIX
                            : ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;
  }
#endif

  return true;
}

bool EndpointSecurityAPI::RespondAuthResult(const Client &client, const Message &msg,
                                            es_auth_result_t result, bool cache) {
  return es_respond_auth_result(client.Get(), &(*msg), result, cache) == ES_RESPOND_RESULT_SUCCESS;
}

bool EndpointSecurityAPI::RespondFlagsResult(const Client &client, const Message &msg,
                                             uint32_t allowed_flags, bool cache) {
  return es_respond_flags_result(client.Get(), &(*msg), allowed_flags, cache);
}

bool EndpointSecurityAPI::MuteProcess(const Client &client, const audit_token_t *tok) {
  return es_mute_process(client.Get(), tok) == ES_RETURN_SUCCESS;
}

bool EndpointSecurityAPI::ClearCache(const Client &client) {
  return es_clear_cache(client.Get()) == ES_CLEAR_CACHE_RESULT_SUCCESS;
}

uint32_t EndpointSecurityAPI::ExecArgCount(const es_event_exec_t *event) {
  return es_exec_arg_count(event);
}

es_string_token_t EndpointSecurityAPI::ExecArg(const es_event_exec_t *event, uint32_t index) {
  return es_exec_arg(event, index);
}

uint32_t EndpointSecurityAPI::ExecEnvCount(const es_event_exec_t *event) {
  return es_exec_env_count(event);
}

es_string_token_t EndpointSecurityAPI::ExecEnv(const es_event_exec_t *event, uint32_t index) {
  return es_exec_env(event, index);
}

uint32_t EndpointSecurityAPI::ExecFDCount(const es_event_exec_t *event) {
  return es_exec_fd_count(event);
}

const es_fd_t *EndpointSecurityAPI::ExecFD(const es_event_exec_t *event, uint32_t index) {
  return es_exec_fd(event, index);
}

}  // namespace santa::santad::event_providers::endpoint_security

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
16
17	#include <set>
18	#include <vector>
19
20	#include "Source/common/Platform.h"
21
22	using santa::santad::data_layer::WatchItemPathType;
23
24	namespace santa::santad::event_providers::endpoint_security {
25
26	Client EndpointSecurityAPI::NewClient(void (^message_handler)(es_client_t *, Message)) {	×
27	es_client_t *client = NULL;	×
28
29	auto shared_esapi = shared_from_this();	×
30	es_new_client_result_t res = es_new_client(&client, ^(es_client_t c, const es_message_t msg) {	×
31	@autoreleasepool {	×
32	message_handler(c, Message(shared_esapi, msg));	×
33	}	×
34	});	×
35
36	return Client(client, res);	×
37	}	×
38
39	void EndpointSecurityAPI::RetainMessage(const es_message_t *msg) {	×
40	es_retain_message(msg);	×
41	}	×
42
43	void EndpointSecurityAPI::ReleaseMessage(const es_message_t *msg) {	×
44	es_release_message(msg);	×
45	}	×
46
47	bool EndpointSecurityAPI::Subscribe(const Client &client,
48	const std::set<es_event_type_t> &event_types) {	×
49	std::vector<es_event_type_t> subs(event_types.begin(), event_types.end());	×
50	return es_subscribe(client.Get(), subs.data(), (uint32_t)subs.size()) == ES_RETURN_SUCCESS;	×
51	}	×
52
53	bool EndpointSecurityAPI::UnsubscribeAll(const Client &client) {	×
54	return es_unsubscribe_all(client.Get()) == ES_RETURN_SUCCESS;	×
55	}	×
56
57	bool EndpointSecurityAPI::UnmuteAllPaths(const Client &client) {	×
58	return es_unmute_all_paths(client.Get()) == ES_RETURN_SUCCESS;	×
59	}	×
60
61	bool EndpointSecurityAPI::UnmuteAllTargetPaths(const Client &client) {	×
62	#if HAVE_MACOS_13	×
63	if (@available(macOS 13.0, *)) {	×
64	return es_unmute_all_target_paths(client.Get()) == ES_RETURN_SUCCESS;	×
65	}	×
66	#endif	×
67
68	return true;	×
69	}	×
70
71	bool EndpointSecurityAPI::IsTargetPathMutingInverted(const Client &client) {	×
72	#if HAVE_MACOS_13	×
73	if (@available(macOS 13.0, *)) {	×
74	return es_muting_inverted(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) == ES_MUTE_INVERTED;	×
75	}	×
76	#endif	×
77
78	return false;	×
79	}	×
80
81	bool EndpointSecurityAPI::InvertTargetPathMuting(const Client &client) {	×
82	#if HAVE_MACOS_13	×
83	if (@available(macOS 13.0, *)) {	×
84	if (!IsTargetPathMutingInverted(client)) {	×
85	return es_invert_muting(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) ==	×
86	ES_RETURN_SUCCESS;	×
87	} else {	×
88	return true;	×
89	}	×
90	}	×
91	#endif	×
92
93	return false;	×
94	}	×
95
96	bool EndpointSecurityAPI::MuteTargetPath(const Client &client, std::string_view path,
97	WatchItemPathType path_type) {	×
98	#if HAVE_MACOS_13	×
99	if (@available(macOS 13.0, *)) {	×
100	return es_mute_path(client.Get(), path.data(),	×
101	path_type == WatchItemPathType::kPrefix	×
102	? ES_MUTE_PATH_TYPE_TARGET_PREFIX	×
103	: ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;	×
104	}	×
105	#endif	×
106
107	return false;	×
108	}	×
109
110	bool EndpointSecurityAPI::UnmuteTargetPath(const Client &client, std::string_view path,
111	WatchItemPathType path_type) {	×
112	#if HAVE_MACOS_13	×
113	if (@available(macOS 13.0, *)) {	×
114	return es_unmute_path(client.Get(), path.data(),	×
115	path_type == WatchItemPathType::kPrefix	×
116	? ES_MUTE_PATH_TYPE_TARGET_PREFIX	×
117	: ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;	×
118	}	×
119	#endif	×
120
121	return true;	×
122	}	×
123
124	bool EndpointSecurityAPI::RespondAuthResult(const Client &client, const Message &msg,
125	es_auth_result_t result, bool cache) {	×
126	return es_respond_auth_result(client.Get(), &(*msg), result, cache) == ES_RESPOND_RESULT_SUCCESS;	×
127	}	×
128
129	bool EndpointSecurityAPI::RespondFlagsResult(const Client &client, const Message &msg,
130	uint32_t allowed_flags, bool cache) {	×
131	return es_respond_flags_result(client.Get(), &(*msg), allowed_flags, cache);	×
132	}	×
133
134	bool EndpointSecurityAPI::MuteProcess(const Client &client, const audit_token_t *tok) {	×
135	return es_mute_process(client.Get(), tok) == ES_RETURN_SUCCESS;	×
136	}	×
137
138	bool EndpointSecurityAPI::ClearCache(const Client &client) {	×
139	return es_clear_cache(client.Get()) == ES_CLEAR_CACHE_RESULT_SUCCESS;	×
140	}	×
141
142	uint32_t EndpointSecurityAPI::ExecArgCount(const es_event_exec_t *event) {	×
143	return es_exec_arg_count(event);	×
144	}	×
145
146	es_string_token_t EndpointSecurityAPI::ExecArg(const es_event_exec_t *event, uint32_t index) {	×
147	return es_exec_arg(event, index);	×
148	}	×
149
150	uint32_t EndpointSecurityAPI::ExecEnvCount(const es_event_exec_t *event) {	×
151	return es_exec_env_count(event);	×
152	}	×
153
154	es_string_token_t EndpointSecurityAPI::ExecEnv(const es_event_exec_t *event, uint32_t index) {	×
155	return es_exec_env(event, index);	×
156	}	×
157
158	uint32_t EndpointSecurityAPI::ExecFDCount(const es_event_exec_t *event) {	×
NEW 159	return es_exec_fd_count(event);	×
160	}	×
161
162	const es_fd_t EndpointSecurityAPI::ExecFD(const es_event_exec_t event, uint32_t index) {	×
NEW 163	return es_exec_fd(event, index);	×
164	}	×
165
166	} // namespace santa::santad::event_providers::endpoint_security

google / santa / 9715901161

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous