9812129450

Committed 05 Jul 2024 06:13PM UTC coverage: 63.056% (-0.1%) from 63.179%

Build # 9812129450

Build Type

push

github

Committed by

web-flow

Commit Message

Convert santa::santad::event_providers::endpoint_security (#1386)

Run Details

5579 of 13372 branches covered (41.72%)

Branch coverage included in aggregate %.

19 of 21 new or added lines in 9 files covered. (90.48%)

7 existing lines in 1 file now uncovered.

18728 of 25176 relevant lines covered (74.39%)

6067.45 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.42

/Source/santad/EventProviders/EndpointSecurity/Enricher.mm

/// Copyright 2022 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"

#include <EndpointSecurity/ESTypes.h>
#include <bsm/libbsm.h>
#include <grp.h>
#include <pwd.h>
#include <sys/types.h>

#include <memory>
#include <optional>

#include "Source/common/Platform.h"
#include "Source/common/SNTLogging.h"
#include "Source/common/String.h"
#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
#include "Source/santad/ProcessTree/SNTEndpointSecurityAdapter.h"
#include "Source/santad/ProcessTree/process_tree.h"
#include "Source/santad/ProcessTree/process_tree_macos.h"

using santa::StringTokenToStringView;

namespace santa {

Enricher::Enricher(std::shared_ptr<::santa::santad::process_tree::ProcessTree> pt)
    : username_cache_(256), groupname_cache_(256), process_tree_(std::move(pt)) {}

std::unique_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
  // TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
  // (such as maybe the flyweight pattern)
  switch (es_msg->event_type) {
    case ES_EVENT_TYPE_NOTIFY_CLOSE:
      return std::make_unique<EnrichedMessage>(EnrichedClose(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.close.target)));
    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
      return std::make_unique<EnrichedMessage>(EnrichedExchange(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exchangedata.file1),
        Enrich(*es_msg->event.exchangedata.file2)));
    case ES_EVENT_TYPE_NOTIFY_EXEC:
      return std::make_unique<EnrichedMessage>(EnrichedExec(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exec.target),
        (es_msg->version >= 2 && es_msg->event.exec.script)
          ? std::make_optional(Enrich(*es_msg->event.exec.script))
          : std::nullopt,
        (es_msg->version >= 3 && es_msg->event.exec.cwd)
          ? std::make_optional(Enrich(*es_msg->event.exec.cwd))
          : std::nullopt));
    case ES_EVENT_TYPE_NOTIFY_FORK:
      return std::make_unique<EnrichedMessage>(EnrichedFork(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.fork.child)));
    case ES_EVENT_TYPE_NOTIFY_EXIT:
      return std::make_unique<EnrichedMessage>(
        EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_LINK:
      return std::make_unique<EnrichedMessage>(
        EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),
                     Enrich(*es_msg->event.link.source), Enrich(*es_msg->event.link.target_dir)));
    case ES_EVENT_TYPE_NOTIFY_RENAME: {
      if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {
        return std::make_unique<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));
      } else {
        return std::make_unique<EnrichedMessage>(EnrichedRename(
          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
          Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));
      }
    }
    case ES_EVENT_TYPE_NOTIFY_UNLINK:
      return std::make_unique<EnrichedMessage>(EnrichedUnlink(
        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.unlink.target)));
    case ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED:
      return std::make_unique<EnrichedMessage>(
        EnrichedCSInvalidated(std::move(es_msg), Enrich(*es_msg->process)));
#if HAVE_MACOS_13
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN:
      return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLogin(
        std::move(es_msg), Enrich(*es_msg->process),
        UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_login->username))));
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT:
      return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLogout(
        std::move(es_msg), Enrich(*es_msg->process),
        UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_logout->username))));
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK:
      return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLock(
        std::move(es_msg), Enrich(*es_msg->process),
        UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_lock->username))));
    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK:
      return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionUnlock(
        std::move(es_msg), Enrich(*es_msg->process),
        UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_unlock->username))));
    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:
      return std::make_unique<EnrichedMessage>(
        EnrichedScreenSharingAttach(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH:
      return std::make_unique<EnrichedMessage>(
        EnrichedScreenSharingDetach(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN:
      return std::make_unique<EnrichedMessage>(
        EnrichedOpenSSHLogin(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT:
      return std::make_unique<EnrichedMessage>(
        EnrichedOpenSSHLogout(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN:
      return std::make_unique<EnrichedMessage>(
        EnrichedLoginLogin(std::move(es_msg), Enrich(*es_msg->process)));
    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT:
      return std::make_unique<EnrichedMessage>(
        EnrichedLoginLogout(std::move(es_msg), Enrich(*es_msg->process)));
#endif
    default:
      // This is a programming error
      LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);
      exit(EXIT_FAILURE);
  }
}

EnrichedProcess Enricher::Enrich(const es_process_t &es_proc, EnrichOptions options) {
  return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token), options),
                         UsernameForGID(audit_token_to_egid(es_proc.audit_token), options),
                         UsernameForUID(audit_token_to_ruid(es_proc.audit_token), options),
                         UsernameForGID(audit_token_to_rgid(es_proc.audit_token), options),
                         Enrich(*es_proc.executable, options),
                         process_tree_
                           ? process_tree_->ExportAnnotations(
                               santa::santad::process_tree::PidFromAuditToken(es_proc.audit_token))
                           : std::nullopt);
}

EnrichedFile Enricher::Enrich(const es_file_t &es_file, EnrichOptions options) {
  // TODO(mlw): Consider having the enricher perform file hashing. This will
  // make more sense if we start including hashes in more event types.
  return EnrichedFile(UsernameForUID(es_file.stat.st_uid, options),
                      UsernameForGID(es_file.stat.st_gid, options), std::nullopt);
}

std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid,
                                                                     EnrichOptions options) {
  std::optional<std::shared_ptr<std::string>> username = username_cache_.get(uid);

  if (username.has_value()) {
    return username;
  } else if (options == EnrichOptions::kLocalOnly) {
    // If `kLocalOnly` option is set, do not attempt a lookup
    return std::nullopt;
  } else {
    struct passwd *pw = getpwuid(uid);
    if (pw) {
      username = std::make_shared<std::string>(pw->pw_name);
    } else {
      username = std::nullopt;
    }

    username_cache_.set(uid, username);

    return username;
  }
}

std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid,
                                                                     EnrichOptions options) {
  std::optional<std::shared_ptr<std::string>> groupname = groupname_cache_.get(gid);

  if (groupname.has_value()) {
    return groupname;
  } else if (options == EnrichOptions::kLocalOnly) {
    // If `kLocalOnly` option is set, do not attempt a lookup
    return std::nullopt;
  } else {
    struct group *gr = getgrgid(gid);
    if (gr) {
      groupname = std::make_shared<std::string>(gr->gr_name);
    } else {
      groupname = std::nullopt;
    }

    groupname_cache_.set(gid, groupname);

    return groupname;
  }
}

std::optional<uid_t> Enricher::UIDForUsername(std::string_view username, EnrichOptions options) {
  if (options == EnrichOptions::kLocalOnly) {
    // If `kLocalOnly` option is set, do not attempt a lookup
    return std::nullopt;
  }

  struct passwd *pw = getpwnam(username.data());
  return pw ? std::make_optional(pw->pw_uid) : std::nullopt;
}

}  // namespace santa

1	/// Copyright 2022 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
16
17	#include <EndpointSecurity/ESTypes.h>
18	#include <bsm/libbsm.h>
19	#include <grp.h>
20	#include <pwd.h>
21	#include <sys/types.h>
22
23	#include <memory>
24	#include <optional>
25
26	#include "Source/common/Platform.h"
27	#include "Source/common/SNTLogging.h"
28	#include "Source/common/String.h"
29	#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
30	#include "Source/santad/ProcessTree/SNTEndpointSecurityAdapter.h"
31	#include "Source/santad/ProcessTree/process_tree.h"
32	#include "Source/santad/ProcessTree/process_tree_macos.h"
33
34	using santa::StringTokenToStringView;
35
36	namespace santa {
37
38	Enricher::Enricher(std::shared_ptr<::santa::santad::process_tree::ProcessTree> pt)
39	: username_cache_(256), groupname_cache_(256), process_tree_(std::move(pt)) {}	119✔
40
41	std::unique_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {	82✔
42	// TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
43	// (such as maybe the flyweight pattern)
44	switch (es_msg->event_type) {	82✔
45	case ES_EVENT_TYPE_NOTIFY_CLOSE:	6✔
46	return std::make_unique<EnrichedMessage>(EnrichedClose(	6✔
47	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.close.target)));	6✔
48	case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:	6✔
49	return std::make_unique<EnrichedMessage>(EnrichedExchange(	6✔
50	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exchangedata.file1),	6✔
51	Enrich(*es_msg->event.exchangedata.file2)));	6✔
52	case ES_EVENT_TYPE_NOTIFY_EXEC:	11✔
53	return std::make_unique<EnrichedMessage>(EnrichedExec(	11✔
54	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.exec.target),	11✔
55	(es_msg->version >= 2 && es_msg->event.exec.script)	11✔
56	? std::make_optional(Enrich(*es_msg->event.exec.script))	11✔
57	: std::nullopt,	11✔
58	(es_msg->version >= 3 && es_msg->event.exec.cwd)	11✔
59	? std::make_optional(Enrich(*es_msg->event.exec.cwd))	11✔
60	: std::nullopt));	11✔
61	case ES_EVENT_TYPE_NOTIFY_FORK:	6✔
62	return std::make_unique<EnrichedMessage>(EnrichedFork(	6✔
63	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.fork.child)));	6✔
64	case ES_EVENT_TYPE_NOTIFY_EXIT:	6✔
65	return std::make_unique<EnrichedMessage>(	6✔
66	EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));	6✔
67	case ES_EVENT_TYPE_NOTIFY_LINK:	6✔
68	return std::make_unique<EnrichedMessage>(	6✔
69	EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),	6✔
70	Enrich(es_msg->event.link.source), Enrich(es_msg->event.link.target_dir)));	6✔
71	case ES_EVENT_TYPE_NOTIFY_RENAME: {	6✔
72	if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {	6✔
73	return std::make_unique<EnrichedMessage>(EnrichedRename(	4✔
74	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	4✔
75	std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));	4✔
76	} else {	5✔
77	return std::make_unique<EnrichedMessage>(EnrichedRename(	2✔
78	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.rename.source),	2✔
79	Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));	2✔
80	}	2✔
81	}	6✔
82	case ES_EVENT_TYPE_NOTIFY_UNLINK:	6✔
83	return std::make_unique<EnrichedMessage>(EnrichedUnlink(	6✔
84	std::move(es_msg), Enrich(es_msg->process), Enrich(es_msg->event.unlink.target)));	6✔
85	case ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED:	4✔
86	return std::make_unique<EnrichedMessage>(	4✔
87	EnrichedCSInvalidated(std::move(es_msg), Enrich(*es_msg->process)));	4✔
88	#if HAVE_MACOS_13	×
89	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN:	2✔
90	return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLogin(	2✔
91	std::move(es_msg), Enrich(*es_msg->process),	2✔
92	UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_login->username))));	2✔
93	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT:	2✔
94	return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLogout(	2✔
95	std::move(es_msg), Enrich(*es_msg->process),	2✔
96	UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_logout->username))));	2✔
97	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK:	2✔
98	return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionLock(	2✔
99	std::move(es_msg), Enrich(*es_msg->process),	2✔
100	UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_lock->username))));	2✔
101	case ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK:	2✔
102	return std::make_unique<EnrichedMessage>(EnrichedLoginWindowSessionUnlock(	2✔
103	std::move(es_msg), Enrich(*es_msg->process),	2✔
104	UIDForUsername(StringTokenToStringView(es_msg->event.lw_session_unlock->username))));	2✔
105	case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:	4✔
106	return std::make_unique<EnrichedMessage>(	4✔
107	EnrichedScreenSharingAttach(std::move(es_msg), Enrich(*es_msg->process)));	4✔
108	case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH:	2✔
109	return std::make_unique<EnrichedMessage>(	2✔
110	EnrichedScreenSharingDetach(std::move(es_msg), Enrich(*es_msg->process)));	2✔
111	case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN:	4✔
112	return std::make_unique<EnrichedMessage>(	4✔
113	EnrichedOpenSSHLogin(std::move(es_msg), Enrich(*es_msg->process)));	4✔
114	case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT:	2✔
115	return std::make_unique<EnrichedMessage>(	2✔
116	EnrichedOpenSSHLogout(std::move(es_msg), Enrich(*es_msg->process)));	2✔
117	case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN:	4✔
118	return std::make_unique<EnrichedMessage>(	4✔
119	EnrichedLoginLogin(std::move(es_msg), Enrich(*es_msg->process)));	4✔
120	case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT:	1✔
121	return std::make_unique<EnrichedMessage>(	1✔
122	EnrichedLoginLogout(std::move(es_msg), Enrich(*es_msg->process)));	1✔
123	#endif	×
124	default:	×
125	// This is a programming error
126	LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);	×
127	exit(EXIT_FAILURE);	×
128	}	82✔
129	}	82✔
130
131	EnrichedProcess Enricher::Enrich(const es_process_t &es_proc, EnrichOptions options) {	101✔
132	return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token), options),	101✔
133	UsernameForGID(audit_token_to_egid(es_proc.audit_token), options),	101✔
134	UsernameForUID(audit_token_to_ruid(es_proc.audit_token), options),	101✔
135	UsernameForGID(audit_token_to_rgid(es_proc.audit_token), options),	101✔
136	Enrich(*es_proc.executable, options),	101✔
137	process_tree_	101!
138	? process_tree_->ExportAnnotations(	101✔
NEW 139	santa::santad::process_tree::PidFromAuditToken(es_proc.audit_token))	×
140	: std::nullopt);	101✔
141	}	101✔
142
143	EnrichedFile Enricher::Enrich(const es_file_t &es_file, EnrichOptions options) {	163✔
144	// TODO(mlw): Consider having the enricher perform file hashing. This will
145	// make more sense if we start including hashes in more event types.
146	return EnrichedFile(UsernameForUID(es_file.stat.st_uid, options),	163✔
147	UsernameForGID(es_file.stat.st_gid, options), std::nullopt);	163✔
148	}	163✔
149
150	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid,
151	EnrichOptions options) {	367✔
152	std::optional<std::shared_ptr<std::string>> username = username_cache_.get(uid);	367✔
153
154	if (username.has_value()) {	367✔
155	return username;	281✔
156	} else if (options == EnrichOptions::kLocalOnly) {	283!
157	// If `kLocalOnly` option is set, do not attempt a lookup
158	return std::nullopt;	×
159	} else {	86✔
160	struct passwd *pw = getpwuid(uid);	86✔
161	if (pw) {	86✔
162	username = std::make_shared<std::string>(pw->pw_name);	85✔
163	} else {	85✔
164	username = std::nullopt;	1✔
165	}	1✔
166
167	username_cache_.set(uid, username);	86✔
168
169	return username;	86✔
170	}	86✔
171	}	367✔
172
173	std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid,
174	EnrichOptions options) {	367✔
175	std::optional<std::shared_ptr<std::string>> groupname = groupname_cache_.get(gid);	367✔
176
177	if (groupname.has_value()) {	367✔
178	return groupname;	281✔
179	} else if (options == EnrichOptions::kLocalOnly) {	283!
180	// If `kLocalOnly` option is set, do not attempt a lookup
181	return std::nullopt;	×
182	} else {	86✔
183	struct group *gr = getgrgid(gid);	86✔
184	if (gr) {	86✔
185	groupname = std::make_shared<std::string>(gr->gr_name);	85✔
186	} else {	85✔
187	groupname = std::nullopt;	1✔
188	}	1✔
189
190	groupname_cache_.set(gid, groupname);	86✔
191
192	return groupname;	86✔
193	}	86✔
194	}	367✔
195
196	std::optional<uid_t> Enricher::UIDForUsername(std::string_view username, EnrichOptions options) {	8✔
197	if (options == EnrichOptions::kLocalOnly) {	8!
198	// If `kLocalOnly` option is set, do not attempt a lookup
199	return std::nullopt;	×
200	}	×
201
202	struct passwd *pw = getpwnam(username.data());	8✔
203	return pw ? std::make_optional(pw->pw_uid) : std::nullopt;	8!
204	}	8✔
205
206	} // namespace santa

google / santa / 9812129450

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous