9811772991

Committed 05 Jul 2024 05:33PM UTC coverage: 63.15% (-0.03%) from 63.179%

Build # 9811772991

Build Type

Pull #1386

github

Committed by

web-flow

Commit Message

Merge 4ddc0f99c into 466546f54

Pull Request Pull Request #1386: Namespace simplification pt3

Run Details

5591 of 13334 branches covered (41.93%)

Branch coverage included in aggregate %.

19 of 21 new or added lines in 9 files covered. (90.48%)

7 existing lines in 1 file now uncovered.

18728 of 25176 relevant lines covered (74.39%)

6748.58 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.41

/Source/santad/EventProviders/EndpointSecurity/Message.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/EventProviders/EndpointSecurity/Message.h"

#include <bsm/libbsm.h>
#include <libproc.h>
#include <sys/stat.h>

#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"

namespace santa {

Message::Message(std::shared_ptr<EndpointSecurityAPI> esapi, const es_message_t *es_msg)
    : esapi_(std::move(esapi)), es_msg_(es_msg), process_token_(std::nullopt) {
  esapi_->RetainMessage(es_msg);
  UpdateStatState(StatChangeStep::kMessageCreate);
}

Message::~Message() {
  if (es_msg_) {
    esapi_->ReleaseMessage(es_msg_);
  }
}

Message::Message(Message &&other) {
  esapi_ = std::move(other.esapi_);
  es_msg_ = other.es_msg_;
  other.es_msg_ = nullptr;
  process_token_ = std::move(other.process_token_);
  other.process_token_ = std::nullopt;
  stat_change_step_ = other.stat_change_step_;
  stat_result_ = other.stat_result_;
}

Message::Message(const Message &other) {
  esapi_ = other.esapi_;
  es_msg_ = other.es_msg_;
  esapi_->RetainMessage(es_msg_);
  process_token_ = other.process_token_;
  stat_change_step_ = other.stat_change_step_;
  stat_result_ = other.stat_result_;
}

void Message::UpdateStatState(enum StatChangeStep step) const {
  // Only update state for AUTH EXEC events and if no previous change was detected
  if (es_msg_->event_type == ES_EVENT_TYPE_AUTH_EXEC &&
      stat_change_step_ == StatChangeStep::kNoChange &&
      // Note: The following checks are required due to tests that only
      // partially construct an es_message_t.
      es_msg_->event.exec.target && es_msg_->event.exec.target->executable) {
    struct stat &es_sb = es_msg_->event.exec.target->executable->stat;
    struct stat sb;
    int ret = stat(es_msg_->event.exec.target->executable->path.data, &sb);
    // If stat failed, or if devno/inode changed, update state.
    if (ret != 0 || es_sb.st_ino != sb.st_ino || es_sb.st_dev != sb.st_dev) {
      stat_change_step_ = step;
      // Determine the specific condition that failed for tracking purposes
      stat_result_ = (ret != 0) ? StatResult::kStatError : StatResult::kDevnoInodeMismatch;
    }
  }
}

void Message::SetProcessToken(santa::santad::process_tree::ProcessToken tok) {
  process_token_ = std::move(tok);
}

std::string Message::ParentProcessName() const {
  return GetProcessName(es_msg_->process->ppid);
}

std::string Message::GetProcessName(pid_t pid) const {
  // Note: proc_name() accesses the `pbi_name` field of `struct proc_bsdinfo`. The size of `pname`
  // here is meant to match the size of `pbi_name`, and one extra byte ensure zero-terminated.
  char pname[MAXCOMLEN * 2 + 1] = {};
  if (proc_name(pid, pname, sizeof(pname)) > 0) {
    return std::string(pname);
  } else {
    return std::string("");
  }
}

}  // namespace santa

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
16
17	#include <bsm/libbsm.h>
18	#include <libproc.h>
19	#include <sys/stat.h>
20
21	#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
22
23	namespace santa {
24
25	Message::Message(std::shared_ptr<EndpointSecurityAPI> esapi, const es_message_t *es_msg)
26	: esapi_(std::move(esapi)), es_msg_(es_msg), process_token_(std::nullopt) {	243✔
27	esapi_->RetainMessage(es_msg);	243✔
28	UpdateStatState(StatChangeStep::kMessageCreate);	243✔
29	}	243✔
30
31	Message::~Message() {	606✔
32	if (es_msg_) {	606✔
33	esapi_->ReleaseMessage(es_msg_);	298✔
34	}	298✔
35	}	606✔
36
37	Message::Message(Message &&other) {	308✔
38	esapi_ = std::move(other.esapi_);	308✔
39	es_msg_ = other.es_msg_;	308✔
40	other.es_msg_ = nullptr;	308✔
41	process_token_ = std::move(other.process_token_);	308✔
42	other.process_token_ = std::nullopt;	308✔
43	stat_change_step_ = other.stat_change_step_;	308✔
44	stat_result_ = other.stat_result_;	308✔
45	}	308✔
46
47	Message::Message(const Message &other) {	57✔
48	esapi_ = other.esapi_;	57✔
49	es_msg_ = other.es_msg_;	57✔
50	esapi_->RetainMessage(es_msg_);	57✔
51	process_token_ = other.process_token_;	57✔
52	stat_change_step_ = other.stat_change_step_;	57✔
53	stat_result_ = other.stat_result_;	57✔
54	}	57✔
55
56	void Message::UpdateStatState(enum StatChangeStep step) const {	293✔
57	// Only update state for AUTH EXEC events and if no previous change was detected
58	if (es_msg_->event_type == ES_EVENT_TYPE_AUTH_EXEC &&	293✔
59	stat_change_step_ == StatChangeStep::kNoChange &&	293✔
60	// Note: The following checks are required due to tests that only
61	// partially construct an es_message_t.
62	es_msg_->event.exec.target && es_msg_->event.exec.target->executable) {	293!
63	struct stat &es_sb = es_msg_->event.exec.target->executable->stat;	82✔
64	struct stat sb;	82✔
65	int ret = stat(es_msg_->event.exec.target->executable->path.data, &sb);	82✔
66	// If stat failed, or if devno/inode changed, update state.
67	if (ret != 0 \|\| es_sb.st_ino != sb.st_ino \|\| es_sb.st_dev != sb.st_dev) {	82!
68	stat_change_step_ = step;	34✔
69	// Determine the specific condition that failed for tracking purposes
70	stat_result_ = (ret != 0) ? StatResult::kStatError : StatResult::kDevnoInodeMismatch;	34!
71	}	34✔
72	}	82✔
73	}	293✔
74
NEW 75	void Message::SetProcessToken(santa::santad::process_tree::ProcessToken tok) {	×
76	process_token_ = std::move(tok);	×
77	}	×
78
79	std::string Message::ParentProcessName() const {	25✔
80	return GetProcessName(es_msg_->process->ppid);	25✔
81	}	25✔
82
83	std::string Message::GetProcessName(pid_t pid) const {	25✔
84	// Note: proc_name() accesses the `pbi_name` field of `struct proc_bsdinfo`. The size of `pname`
85	// here is meant to match the size of `pbi_name`, and one extra byte ensure zero-terminated.
86	char pname[MAXCOMLEN * 2 + 1] = {};	25✔
87	if (proc_name(pid, pname, sizeof(pname)) > 0) {	25✔
88	return std::string(pname);	1✔
89	} else {	24✔
90	return std::string("");	24✔
91	}	24✔
92	}	25✔
93
94	} // namespace santa

google / santa / 9811772991

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous