10728260647

Committed 05 Sep 2024 09:13PM UTC coverage: 63.166% (+0.1%) from 63.063%

Build # 10728260647

Build Type

Pull #1424

github

Committed by

web-flow

Commit Message

Merge 78ee41065 into ff0efe952

Pull Request Pull Request #1424: Use runtime platform binary check for exec evals

Run Details

5672 of 13474 branches covered (42.1%)

Branch coverage included in aggregate %.

7 of 20 new or added lines in 1 file covered. (35.0%)

1 existing line in 1 file now uncovered.

18835 of 25324 relevant lines covered (74.38%)

6575.96 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

67.31

/Source/santad/SNTPolicyProcessor.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santad/SNTPolicyProcessor.h"
#include <Foundation/Foundation.h>

#include <Kernel/kern/cs_blobs.h>
#import <MOLCodesignChecker/MOLCodesignChecker.h>
#import <Security/SecCode.h>
#import <Security/Security.h>

#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTDeepCopy.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTRule.h"
#import "Source/common/SigningIDHelpers.h"
#import "Source/santad/DataLayer/SNTRuleTable.h"
#include "absl/container/flat_hash_map.h"

enum class PlatformBinaryState {
  kRuntimeTrue = 0,
  kRuntimeFalse,
  kStaticCheck,
};

@interface SNTPolicyProcessor ()
@property SNTRuleTable *ruleTable;
@property SNTConfigurator *configurator;
@end

@implementation SNTPolicyProcessor

- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {
  self = [super init];
  if (self) {
    _ruleTable = ruleTable;
    _configurator = [SNTConfigurator configurator];
  }
  return self;
}

// This method applies the rules to the cached decision object.
//
// It returns YES if the decision was made, NO if the decision was not made.
- (BOOL)decision:(SNTCachedDecision *)cd
              forRule:(SNTRule *)rule
  withTransitiveRules:(BOOL)enableTransitiveRules {
  static const auto decisions =
    absl::flat_hash_map<std::pair<SNTRuleType, SNTRuleState>, SNTEventState>{
      {{SNTRuleTypeCDHash, SNTRuleStateAllow}, SNTEventStateAllowCDHash},
      {{SNTRuleTypeCDHash, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},
      {{SNTRuleTypeCDHash, SNTRuleStateBlock}, SNTEventStateBlockCDHash},
      {{SNTRuleTypeCDHash, SNTRuleStateSilentBlock}, SNTEventStateBlockCDHash},
      {{SNTRuleTypeBinary, SNTRuleStateAllow}, SNTEventStateAllowBinary},
      {{SNTRuleTypeBinary, SNTRuleStateAllowTransitive}, SNTEventStateAllowTransitive},
      {{SNTRuleTypeBinary, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},
      {{SNTRuleTypeBinary, SNTRuleStateSilentBlock}, SNTEventStateBlockBinary},
      {{SNTRuleTypeBinary, SNTRuleStateBlock}, SNTEventStateBlockBinary},
      {{SNTRuleTypeSigningID, SNTRuleStateAllow}, SNTEventStateAllowSigningID},
      {{SNTRuleTypeSigningID, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},
      {{SNTRuleTypeSigningID, SNTRuleStateSilentBlock}, SNTEventStateBlockSigningID},
      {{SNTRuleTypeSigningID, SNTRuleStateBlock}, SNTEventStateBlockSigningID},
      {{SNTRuleTypeCertificate, SNTRuleStateAllow}, SNTEventStateAllowCertificate},
      {{SNTRuleTypeCertificate, SNTRuleStateSilentBlock}, SNTEventStateBlockCertificate},
      {{SNTRuleTypeCertificate, SNTRuleStateBlock}, SNTEventStateBlockCertificate},
      {{SNTRuleTypeTeamID, SNTRuleStateAllow}, SNTEventStateAllowTeamID},
      {{SNTRuleTypeTeamID, SNTRuleStateSilentBlock}, SNTEventStateBlockTeamID},
      {{SNTRuleTypeTeamID, SNTRuleStateBlock}, SNTEventStateBlockTeamID},
    };

  auto iterator = decisions.find(std::pair<SNTRuleType, SNTRuleState>{rule.type, rule.state});
  if (iterator != decisions.end()) {
    cd.decision = iterator->second;
  } else {
    // If we have an invalid state combination then either we have stale data in
    // the database or a programming error. We treat this as if the
    // corresponding rule was not found.
    LOGE(@"Invalid rule type/state combination %ld/%ld", rule.type, rule.state);
    return NO;
  }

  switch (rule.state) {
    case SNTRuleStateSilentBlock: cd.silentBlock = YES; break;
    case SNTRuleStateAllowCompiler:
      if (!enableTransitiveRules) {
        switch (rule.type) {
          case SNTRuleTypeCDHash: cd.decision = SNTEventStateAllowCDHash; break;
          case SNTRuleTypeBinary: cd.decision = SNTEventStateAllowBinary; break;
          case SNTRuleTypeSigningID: cd.decision = SNTEventStateAllowSigningID; break;
          default:
            // Programming error. Something's marked as a compiler that shouldn't
            // be.
            LOGE(@"Invalid compiler rule type %ld", rule.type);
            [NSException
               raise:@"Invalid compiler rule type"
              format:@"decision:forRule:withTransitiveRules: Unexpected compiler rule type: %ld",
                     rule.type];
            break;
        }
      }
      break;
    case SNTRuleStateAllowTransitive:
      // If transitive rules are disabled, then we treat
      // SNTRuleStateAllowTransitive rules as if a matching rule was not found
      // and set the state to unknown. Otherwise the decision map will have already set
      // the EventState to SNTEventStateAllowTransitive.
      if (!enableTransitiveRules) {
        cd.decision = SNTEventStateUnknown;
        return NO;
      }
      break;
    default:
      // If its not one of the special cases above, we don't need to do anything.
      break;
  }

  // We know we have a match so apply the custom messages
  cd.customMsg = rule.customMsg;
  cd.customURL = rule.customURL;

  return YES;
}

static void UpdateCachedDecisionSigningInfo(
  SNTCachedDecision *cd, MOLCodesignChecker *csInfo,
  NSDictionary *_Nullable (^entitlementsFilterCallback)(NSDictionary *_Nullable entitlements),
  PlatformBinaryState platformBinaryState) {
  cd.certSHA256 = csInfo.leafCertificate.SHA256;
  cd.certCommonName = csInfo.leafCertificate.commonName;
  cd.certChain = csInfo.certificates;
  // Check if we need to get teamID from code signing.
  if (!cd.teamID) {
    cd.teamID = csInfo.teamID;
  }

  // Check if we need to get signing ID from code signing.
  if (!cd.signingID) {
    cd.signingID = FormatSigningID(csInfo);
  }

  // Ensure that if no teamID exists but a signingID does exist, that the binary
  // is a platform binary. If not, remove the signingID.
  if (!cd.teamID && cd.signingID) {
    switch (platformBinaryState) {
      case PlatformBinaryState::kRuntimeTrue: break;
      case PlatformBinaryState::kStaticCheck:
        if (!csInfo.platformBinary) {
          cd.signingID = nil;
        }
        break;
      case PlatformBinaryState::kRuntimeFalse: OS_FALLTHROUGH;
      default: cd.signingID = nil; break;
    }
  }

  if (!cd.teamID && cd.signingID) {
    if (!csInfo.platformBinary) {
      cd.signingID = nil;
    }
  }

  NSDictionary *entitlements = csInfo.entitlements;

  if (entitlementsFilterCallback) {
    cd.entitlements = entitlementsFilterCallback(entitlements);
    cd.entitlementsFiltered = (cd.entitlements.count != entitlements.count);
  } else {
    cd.entitlements = [entitlements sntDeepCopy];
    cd.entitlementsFiltered = NO;
  }
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                            cdhash:(nullable NSString *)cdhash
                                        fileSHA256:(nullable NSString *)fileSHA256
                                 certificateSHA256:(nullable NSString *)certificateSHA256
                                            teamID:(nullable NSString *)teamID
                                         signingID:(nullable NSString *)signingID
                              isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nullable)(
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback
                          preCodesignCheckCallback:(void (^_Nullable)(void))preCodesignCheckCallback
                               platformBinaryState:(PlatformBinaryState)platformBinaryState {
  // Check the hash before allocating a SNTCachedDecision.
  NSString *fileHash = fileSHA256 ?: fileInfo.SHA256;
  SNTClientMode mode = [self.configurator clientMode];

  // If the binary is a critical system binary, don't check its signature.
  // The binary was validated at startup when the rule table was initialized.
  SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[fileHash];
  if (systemCd) {
    systemCd.decisionClientMode = mode;
    return systemCd;
  }

  // Allocate a new cached decision for the execution.
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.cdhash = cdhash;
  cd.sha256 = fileHash;
  cd.teamID = teamID;
  cd.signingID = signingID;
  cd.decisionClientMode = mode;
  cd.quarantineURL = fileInfo.quarantineDataURL;

  NSError *csInfoError;
  if (certificateSHA256.length) {
    cd.certSHA256 = certificateSHA256;
  } else {
    if (preCodesignCheckCallback) {
      preCodesignCheckCallback();
    }

    // Grab the code signature, if there's an error don't try to capture
    // any of the signature details. Also clear out any rule lookup parameters
    // that would require being validly signed.
    MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];
    if (csInfoError) {
      csInfo = nil;
      cd.decisionExtra =
        [NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];
      cd.teamID = nil;
      cd.signingID = nil;
      cd.cdhash = nil;
    } else {
      UpdateCachedDecisionSigningInfo(cd, csInfo, entitlementsFilterCallback, platformBinaryState);
    }
  }

  // Do not evaluate TeamID/SigningID rules for dev-signed code based on the
  // assumption that orgs are generally more relaxed about dev signed cert
  // protections and users can more easily produce dev-signed code that
  // would otherwise be inadvertently allowed.
  // Note: Only perform the check if the SigningID is still set, otherwise
  // it is unsigned or had issues above that already cleared the values.
  if (cd.signingID && !isProdSignedCallback()) {
    LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",
         cd.signingID);
    cd.teamID = nil;
    cd.signingID = nil;
  }

  SNTRule *rule =
    [self.ruleTable ruleForIdentifiers:(struct RuleIdentifiers){.cdhash = cd.cdhash,
                                                                .binarySHA256 = cd.sha256,
                                                                .signingID = cd.signingID,
                                                                .certificateSHA256 = cd.certSHA256,
                                                                .teamID = cd.teamID}];
  if (rule) {
    // If we have a rule match we don't need to process any further.
    if ([self decision:cd
                      forRule:rule
          withTransitiveRules:self.configurator.enableTransitiveRules]) {
      return cd;
    }
  }

  if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&
      csInfoError.code != errSecCSUnsigned) {
    cd.decisionExtra =
      [NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];
    cd.decision = SNTEventStateBlockCertificate;
    return cd;
  }

  NSString *msg = [self fileIsScopeBlocked:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateBlockScope;
    return cd;
  }

  msg = [self fileIsScopeAllowed:fileInfo];
  if (msg) {
    cd.decisionExtra = msg;
    cd.decision = SNTEventStateAllowScope;
    return cd;
  }

  switch (mode) {
    case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;
    case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;
    default: cd.decision = SNTEventStateBlockUnknown; return cd;
  }
}

- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                     targetProcess:(nonnull const es_process_t *)targetProc
                          preCodesignCheckCallback:(void (^_Nullable)(void))preCodesignCheckCallback
                        entitlementsFilterCallback:
                          (NSDictionary *_Nullable (^_Nonnull)(
                            const char *_Nullable teamID,
                            NSDictionary *_Nullable entitlements))entitlementsFilterCallback {
  NSString *signingID;
  NSString *teamID;
  NSString *cdhash;

  const char *entitlementsFilterTeamID = NULL;

  if (targetProc->codesigning_flags & CS_SIGNED && targetProc->codesigning_flags & CS_VALID) {
    if (targetProc->signing_id.length > 0) {
      if (targetProc->team_id.length > 0) {
        entitlementsFilterTeamID = targetProc->team_id.data;
        teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
        signingID =
          [NSString stringWithFormat:@"%@:%@", teamID,
                                     [NSString stringWithUTF8String:targetProc->signing_id.data]];
      } else if (targetProc->is_platform_binary) {
        entitlementsFilterTeamID = "platform";
        signingID =
          [NSString stringWithFormat:@"platform:%@",
                                     [NSString stringWithUTF8String:targetProc->signing_id.data]];
      }
    }

    // Only consider the CDHash for processes that have CS_KILL or CS_HARD set.
    // This ensures that the OS will kill the process if the CDHash was tampered
    // with and code was loaded that didn't match a page hash.
    if (targetProc->codesigning_flags & CS_KILL || targetProc->codesigning_flags & CS_HARD) {
      static NSString *const kCDHashFormatString = @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
                                                    "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";

      const uint8_t *buf = targetProc->cdhash;
      cdhash = [[NSString alloc] initWithFormat:kCDHashFormatString, buf[0], buf[1], buf[2], buf[3],
                                                buf[4], buf[5], buf[6], buf[7], buf[8], buf[9],
                                                buf[10], buf[11], buf[12], buf[13], buf[14],
                                                buf[15], buf[16], buf[17], buf[18], buf[19]];
    }
  }

  return [self decisionForFileInfo:fileInfo
    cdhash:cdhash
    fileSHA256:nil
    certificateSHA256:nil
    teamID:teamID
    signingID:signingID
    isProdSignedCallback:^BOOL {
      return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);
    }
    entitlementsFilterCallback:^NSDictionary *(NSDictionary *entitlements) {
      return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);
    }
    preCodesignCheckCallback:preCodesignCheckCallback
    platformBinaryState:(targetProc->is_platform_binary ? PlatformBinaryState::kRuntimeTrue
                                                        : PlatformBinaryState::kRuntimeFalse)];
}

// Used by `$ santactl fileinfo`.
- (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                       identifiers:(nonnull SNTRuleIdentifiers *)identifiers {
  MOLCodesignChecker *csInfo;
  NSError *error;

  SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
  if (!fileInfo) {
    LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
  } else {
    csInfo = [fileInfo codesignCheckerWithError:&error];
    if (error) {
      LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);
    }
  }

  return [self decisionForFileInfo:fileInfo
                            cdhash:identifiers.cdhash
                        fileSHA256:identifiers.binarySHA256
                 certificateSHA256:identifiers.certificateSHA256
                            teamID:identifiers.teamID
                         signingID:identifiers.signingID
              isProdSignedCallback:^BOOL {
                if (csInfo) {
                  // Development OID values defined by Apple and used by the Security Framework
                  // https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
                  NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];
                  NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(
                    csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));
                  return vals.count == 0;
                } else {
                  return NO;
                }
              }
        entitlementsFilterCallback:nil
          preCodesignCheckCallback:nil
               platformBinaryState:PlatformBinaryState::kStaticCheck];
}

///
///  Checks whether the file at @c path is in-scope for checking with Santa.
///
///  Files that are out of scope:
///    + Non Mach-O files that are not part of an installer package.
///    + Files in allowed path.
///
///  @return @c YES if file is in scope, @c NO otherwise.
///
- (NSString *)fileIsScopeAllowed:(SNTFileInfo *)fi {
  if (!fi) return nil;

  // Determine if file is within an allowed path
  NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Allowed Path Regex";
  }

  // If file is not a Mach-O file, we're not interested.
  if (!fi.isMachO) {
    return @"Not a Mach-O";
  }

  return nil;
}

- (NSString *)fileIsScopeBlocked:(SNTFileInfo *)fi {
  if (!fi) return nil;

  NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];
  if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {
    return @"Blocked Path Regex";
  }

  if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {
    return @"Missing __PAGEZERO";
  }

  return nil;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santad/SNTPolicyProcessor.h"
16	#include <Foundation/Foundation.h>
17
18	#include <Kernel/kern/cs_blobs.h>
19	#import <MOLCodesignChecker/MOLCodesignChecker.h>
20	#import <Security/SecCode.h>
21	#import <Security/Security.h>
22
23	#import "Source/common/SNTCachedDecision.h"
24	#import "Source/common/SNTConfigurator.h"
25	#import "Source/common/SNTDeepCopy.h"
26	#import "Source/common/SNTFileInfo.h"
27	#import "Source/common/SNTLogging.h"
28	#import "Source/common/SNTRule.h"
29	#import "Source/common/SigningIDHelpers.h"
30	#import "Source/santad/DataLayer/SNTRuleTable.h"
31	#include "absl/container/flat_hash_map.h"
32
33	enum class PlatformBinaryState {
34	kRuntimeTrue = 0,
35	kRuntimeFalse,
36	kStaticCheck,
37	};
38
39	@interface SNTPolicyProcessor ()
40	@property SNTRuleTable *ruleTable;
41	@property SNTConfigurator *configurator;
42	@end
43
44	@implementation SNTPolicyProcessor
45
46	- (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable {	53✔
47	self = [super init];	53✔
48	if (self) {	53!
49	_ruleTable = ruleTable;	53✔
50	_configurator = [SNTConfigurator configurator];	53✔
51	}	53✔
52	return self;	53✔
53	}	53✔
54
55	// This method applies the rules to the cached decision object.
56	//
57	// It returns YES if the decision was made, NO if the decision was not made.
58	- (BOOL)decision:(SNTCachedDecision *)cd
59	forRule:(SNTRule *)rule
60	withTransitiveRules:(BOOL)enableTransitiveRules {	83✔
61	static const auto decisions =	83✔
62	absl::flat_hash_map<std::pair<SNTRuleType, SNTRuleState>, SNTEventState>{	83✔
63	{{SNTRuleTypeCDHash, SNTRuleStateAllow}, SNTEventStateAllowCDHash},	83✔
64	{{SNTRuleTypeCDHash, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},	83✔
65	{{SNTRuleTypeCDHash, SNTRuleStateBlock}, SNTEventStateBlockCDHash},	83✔
66	{{SNTRuleTypeCDHash, SNTRuleStateSilentBlock}, SNTEventStateBlockCDHash},	83✔
67	{{SNTRuleTypeBinary, SNTRuleStateAllow}, SNTEventStateAllowBinary},	83✔
68	{{SNTRuleTypeBinary, SNTRuleStateAllowTransitive}, SNTEventStateAllowTransitive},	83✔
69	{{SNTRuleTypeBinary, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},	83✔
70	{{SNTRuleTypeBinary, SNTRuleStateSilentBlock}, SNTEventStateBlockBinary},	83✔
71	{{SNTRuleTypeBinary, SNTRuleStateBlock}, SNTEventStateBlockBinary},	83✔
72	{{SNTRuleTypeSigningID, SNTRuleStateAllow}, SNTEventStateAllowSigningID},	83✔
73	{{SNTRuleTypeSigningID, SNTRuleStateAllowCompiler}, SNTEventStateAllowCompiler},	83✔
74	{{SNTRuleTypeSigningID, SNTRuleStateSilentBlock}, SNTEventStateBlockSigningID},	83✔
75	{{SNTRuleTypeSigningID, SNTRuleStateBlock}, SNTEventStateBlockSigningID},	83✔
76	{{SNTRuleTypeCertificate, SNTRuleStateAllow}, SNTEventStateAllowCertificate},	83✔
77	{{SNTRuleTypeCertificate, SNTRuleStateSilentBlock}, SNTEventStateBlockCertificate},	83✔
78	{{SNTRuleTypeCertificate, SNTRuleStateBlock}, SNTEventStateBlockCertificate},	83✔
79	{{SNTRuleTypeTeamID, SNTRuleStateAllow}, SNTEventStateAllowTeamID},	83✔
80	{{SNTRuleTypeTeamID, SNTRuleStateSilentBlock}, SNTEventStateBlockTeamID},	83✔
81	{{SNTRuleTypeTeamID, SNTRuleStateBlock}, SNTEventStateBlockTeamID},	83✔
82	};	83✔
83
84	auto iterator = decisions.find(std::pair<SNTRuleType, SNTRuleState>{rule.type, rule.state});	83✔
85	if (iterator != decisions.end()) {	83✔
86	cd.decision = iterator->second;	80✔
87	} else {	80✔
88	// If we have an invalid state combination then either we have stale data in
89	// the database or a programming error. We treat this as if the
90	// corresponding rule was not found.
91	LOGE(@"Invalid rule type/state combination %ld/%ld", rule.type, rule.state);	3✔
92	return NO;	3✔
93	}	3✔
94
95	switch (rule.state) {	80✔
96	case SNTRuleStateSilentBlock: cd.silentBlock = YES; break;	10✔
97	case SNTRuleStateAllowCompiler:	11✔
98	if (!enableTransitiveRules) {	11✔
99	switch (rule.type) {	5✔
100	case SNTRuleTypeCDHash: cd.decision = SNTEventStateAllowCDHash; break;	2✔
101	case SNTRuleTypeBinary: cd.decision = SNTEventStateAllowBinary; break;	2✔
102	case SNTRuleTypeSigningID: cd.decision = SNTEventStateAllowSigningID; break;	1✔
103	default:	×
104	// Programming error. Something's marked as a compiler that shouldn't
105	// be.
106	LOGE(@"Invalid compiler rule type %ld", rule.type);	×
107	[NSException	×
108	raise:@"Invalid compiler rule type"	×
109	format:@"decision:forRule:withTransitiveRules: Unexpected compiler rule type: %ld",	×
110	rule.type];	×
111	break;	×
112	}	5✔
113	}	5✔
114	break;	11✔
115	case SNTRuleStateAllowTransitive:	11✔
116	// If transitive rules are disabled, then we treat
117	// SNTRuleStateAllowTransitive rules as if a matching rule was not found
118	// and set the state to unknown. Otherwise the decision map will have already set
119	// the EventState to SNTEventStateAllowTransitive.
120	if (!enableTransitiveRules) {	4✔
121	cd.decision = SNTEventStateUnknown;	2✔
122	return NO;	2✔
123	}	2✔
124	break;	2✔
125	default:	55✔
126	// If its not one of the special cases above, we don't need to do anything.
127	break;	55✔
128	}	80✔
129
130	// We know we have a match so apply the custom messages
131	cd.customMsg = rule.customMsg;	78✔
132	cd.customURL = rule.customURL;	78✔
133
134	return YES;	78✔
135	}	80✔
136
137	static void UpdateCachedDecisionSigningInfo(
138	SNTCachedDecision cd, MOLCodesignChecker csInfo,
139	NSDictionary _Nullable (^entitlementsFilterCallback)(NSDictionary _Nullable entitlements),
140	PlatformBinaryState platformBinaryState) {	44✔
141	cd.certSHA256 = csInfo.leafCertificate.SHA256;	44✔
142	cd.certCommonName = csInfo.leafCertificate.commonName;	44✔
143	cd.certChain = csInfo.certificates;	44✔
144	// Check if we need to get teamID from code signing.
145	if (!cd.teamID) {	44✔
146	cd.teamID = csInfo.teamID;	31✔
147	}	31✔
148
149	// Check if we need to get signing ID from code signing.
150	if (!cd.signingID) {	44✔
151	cd.signingID = FormatSigningID(csInfo);	31✔
152	}	31✔
153
154	// Ensure that if no teamID exists but a signingID does exist, that the binary
155	// is a platform binary. If not, remove the signingID.
156	if (!cd.teamID && cd.signingID) {	44!
NEW 157	switch (platformBinaryState) {	×
NEW 158	case PlatformBinaryState::kRuntimeTrue: break;	×
NEW 159	case PlatformBinaryState::kStaticCheck:	×
NEW 160	if (!csInfo.platformBinary) {	×
NEW 161	cd.signingID = nil;	×
NEW 162	}	×
NEW 163	break;	×
NEW 164	case PlatformBinaryState::kRuntimeFalse: OS_FALLTHROUGH;	×
NEW 165	default: cd.signingID = nil; break;	×
NEW 166	}	×
NEW 167	}	×
168
169	if (!cd.teamID && cd.signingID) {	44!
170	if (!csInfo.platformBinary) {	×
171	cd.signingID = nil;	×
172	}	×
173	}	×
174
175	NSDictionary *entitlements = csInfo.entitlements;	44✔
176
177	if (entitlementsFilterCallback) {	44!
178	cd.entitlements = entitlementsFilterCallback(entitlements);	44✔
179	cd.entitlementsFiltered = (cd.entitlements.count != entitlements.count);	44✔
180	} else {	44✔
181	cd.entitlements = [entitlements sntDeepCopy];	×
182	cd.entitlementsFiltered = NO;	×
183	}	×
184	}	44✔
185
186	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
187	cdhash:(nullable NSString *)cdhash
188	fileSHA256:(nullable NSString *)fileSHA256
189	certificateSHA256:(nullable NSString *)certificateSHA256
190	teamID:(nullable NSString *)teamID
191	signingID:(nullable NSString *)signingID
192	isProdSignedCallback:(BOOL (^_Nonnull)())isProdSignedCallback
193	entitlementsFilterCallback:
194	(NSDictionary *_Nullable (^_Nullable)(
195	NSDictionary *_Nullable entitlements))entitlementsFilterCallback
196	preCodesignCheckCallback:(void (^_Nullable)(void))preCodesignCheckCallback
197	platformBinaryState:(PlatformBinaryState)platformBinaryState {	51✔
198	// Check the hash before allocating a SNTCachedDecision.
199	NSString *fileHash = fileSHA256 ?: fileInfo.SHA256;	51!
200	SNTClientMode mode = [self.configurator clientMode];	51✔
201
202	// If the binary is a critical system binary, don't check its signature.
203	// The binary was validated at startup when the rule table was initialized.
204	SNTCachedDecision *systemCd = self.ruleTable.criticalSystemBinaries[fileHash];	51✔
205	if (systemCd) {	51✔
206	systemCd.decisionClientMode = mode;	1✔
207	return systemCd;	1✔
208	}	1✔
209
210	// Allocate a new cached decision for the execution.
211	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	50✔
212	cd.cdhash = cdhash;	50✔
213	cd.sha256 = fileHash;	50✔
214	cd.teamID = teamID;	50✔
215	cd.signingID = signingID;	50✔
216	cd.decisionClientMode = mode;	50✔
217	cd.quarantineURL = fileInfo.quarantineDataURL;	50✔
218
219	NSError *csInfoError;	50✔
220	if (certificateSHA256.length) {	50!
221	cd.certSHA256 = certificateSHA256;	×
222	} else {	50✔
223	if (preCodesignCheckCallback) {	50!
224	preCodesignCheckCallback();	50✔
225	}	50✔
226
227	// Grab the code signature, if there's an error don't try to capture
228	// any of the signature details. Also clear out any rule lookup parameters
229	// that would require being validly signed.
230	MOLCodesignChecker *csInfo = [fileInfo codesignCheckerWithError:&csInfoError];	50✔
231	if (csInfoError) {	50✔
232	csInfo = nil;	6✔
233	cd.decisionExtra =	6✔
234	[NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];	6✔
235	cd.teamID = nil;	6✔
236	cd.signingID = nil;	6✔
237	cd.cdhash = nil;	6✔
238	} else {	44✔
239	UpdateCachedDecisionSigningInfo(cd, csInfo, entitlementsFilterCallback, platformBinaryState);	44✔
240	}	44✔
241	}	50✔
242
243	// Do not evaluate TeamID/SigningID rules for dev-signed code based on the
244	// assumption that orgs are generally more relaxed about dev signed cert
245	// protections and users can more easily produce dev-signed code that
246	// would otherwise be inadvertently allowed.
247	// Note: Only perform the check if the SigningID is still set, otherwise
248	// it is unsigned or had issues above that already cleared the values.
249	if (cd.signingID && !isProdSignedCallback()) {	50!
250	LOGD(@"Ignoring TeamID and SigningID rules for code not signed with production cert: %@",	×
251	cd.signingID);	×
252	cd.teamID = nil;	×
253	cd.signingID = nil;	×
254	}	×
255
256	SNTRule *rule =	50✔
257	[self.ruleTable ruleForIdentifiers:(struct RuleIdentifiers){.cdhash = cd.cdhash,	50✔
258	.binarySHA256 = cd.sha256,	50✔
259	.signingID = cd.signingID,	50✔
260	.certificateSHA256 = cd.certSHA256,	50✔
261	.teamID = cd.teamID}];	50✔
262	if (rule) {	50✔
263	// If we have a rule match we don't need to process any further.
264	if ([self decision:cd	42✔
265	forRule:rule	42✔
266	withTransitiveRules:self.configurator.enableTransitiveRules]) {	42✔
267	return cd;	40✔
268	}	40✔
269	}	42✔
270
271	if ([[SNTConfigurator configurator] enableBadSignatureProtection] && csInfoError &&	10!
272	csInfoError.code != errSecCSUnsigned) {	10!
273	cd.decisionExtra =	×
274	[NSString stringWithFormat:@"Blocked due to signature error: %ld", (long)csInfoError.code];	×
275	cd.decision = SNTEventStateBlockCertificate;	×
276	return cd;	×
277	}	×
278
279	NSString *msg = [self fileIsScopeBlocked:fileInfo];	10✔
280	if (msg) {	10!
281	cd.decisionExtra = msg;	×
282	cd.decision = SNTEventStateBlockScope;	×
283	return cd;	×
284	}	×
285
286	msg = [self fileIsScopeAllowed:fileInfo];	10✔
287	if (msg) {	10✔
288	cd.decisionExtra = msg;	2✔
289	cd.decision = SNTEventStateAllowScope;	2✔
290	return cd;	2✔
291	}	2✔
292
293	switch (mode) {	8✔
294	case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;	3✔
295	case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;	4✔
296	default: cd.decision = SNTEventStateBlockUnknown; return cd;	1✔
297	}	8✔
298	}	8✔
299
300	- (nonnull SNTCachedDecision )decisionForFileInfo:(nonnull SNTFileInfo )fileInfo
301	targetProcess:(nonnull const es_process_t *)targetProc
302	preCodesignCheckCallback:(void (^_Nullable)(void))preCodesignCheckCallback
303	entitlementsFilterCallback:
304	(NSDictionary *_Nullable (^_Nonnull)(
305	const char *_Nullable teamID,
306	NSDictionary *_Nullable entitlements))entitlementsFilterCallback {	51✔
307	NSString *signingID;	51✔
308	NSString *teamID;	51✔
309	NSString *cdhash;	51✔
310
311	const char *entitlementsFilterTeamID = NULL;	51✔
312
313	if (targetProc->codesigning_flags & CS_SIGNED && targetProc->codesigning_flags & CS_VALID) {	51!
314	if (targetProc->signing_id.length > 0) {	51✔
315	if (targetProc->team_id.length > 0) {	13!
316	entitlementsFilterTeamID = targetProc->team_id.data;	13✔
317	teamID = [NSString stringWithUTF8String:targetProc->team_id.data];	13✔
318	signingID =	13✔
319	[NSString stringWithFormat:@"%@:%@", teamID,	13✔
320	[NSString stringWithUTF8String:targetProc->signing_id.data]];	13✔
321	} else if (targetProc->is_platform_binary) {	13!
322	entitlementsFilterTeamID = "platform";	×
323	signingID =	×
324	[NSString stringWithFormat:@"platform:%@",	×
325	[NSString stringWithUTF8String:targetProc->signing_id.data]];	×
326	}	×
327	}	13✔
328
329	// Only consider the CDHash for processes that have CS_KILL or CS_HARD set.
330	// This ensures that the OS will kill the process if the CDHash was tampered
331	// with and code was loaded that didn't match a page hash.
332	if (targetProc->codesigning_flags & CS_KILL \|\| targetProc->codesigning_flags & CS_HARD) {	51!
333	static NSString *const kCDHashFormatString = @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"	28✔
334	"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";	28✔
335
336	const uint8_t *buf = targetProc->cdhash;	28✔
337	cdhash = [[NSString alloc] initWithFormat:kCDHashFormatString, buf[0], buf[1], buf[2], buf[3],	28✔
338	buf[4], buf[5], buf[6], buf[7], buf[8], buf[9],	28✔
339	buf[10], buf[11], buf[12], buf[13], buf[14],	28✔
340	buf[15], buf[16], buf[17], buf[18], buf[19]];	28✔
341	}	28✔
342	}	51✔
343
344	return [self decisionForFileInfo:fileInfo	51✔
345	cdhash:cdhash	51✔
346	fileSHA256:nil	51✔
347	certificateSHA256:nil	51✔
348	teamID:teamID	51✔
349	signingID:signingID	51✔
350	isProdSignedCallback:^BOOL {	51✔
351	return ((targetProc->codesigning_flags & CS_DEV_CODE) == 0);	13✔
352	}	13✔
353	entitlementsFilterCallback:^NSDictionary (NSDictionary entitlements) {	51✔
354	return entitlementsFilterCallback(entitlementsFilterTeamID, entitlements);	44✔
355	}	44✔
356	preCodesignCheckCallback:preCodesignCheckCallback	51✔
357	platformBinaryState:(targetProc->is_platform_binary ? PlatformBinaryState::kRuntimeTrue	51!
358	: PlatformBinaryState::kRuntimeFalse)];	51✔
359	}	51✔
360
361	// Used by `$ santactl fileinfo`.
362	- (nonnull SNTCachedDecision )decisionForFilePath:(nonnull NSString )filePath
363	identifiers:(nonnull SNTRuleIdentifiers *)identifiers {	×
364	MOLCodesignChecker *csInfo;	×
365	NSError *error;	×
366
367	SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];	×
368	if (!fileInfo) {	×
369	LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);	×
370	} else {	×
371	csInfo = [fileInfo codesignCheckerWithError:&error];	×
372	if (error) {	×
373	LOGW(@"Failed to get codesign ingo for file %@: %@", filePath, error.localizedDescription);	×
374	}	×
375	}	×
376
377	return [self decisionForFileInfo:fileInfo	×
378	cdhash:identifiers.cdhash	×
379	fileSHA256:identifiers.binarySHA256	×
380	certificateSHA256:identifiers.certificateSHA256	×
381	teamID:identifiers.teamID	×
382	signingID:identifiers.signingID	×
383	isProdSignedCallback:^BOOL {	×
384	if (csInfo) {	×
385	// Development OID values defined by Apple and used by the Security Framework
386	// https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.31.pdf
387	NSArray *keys = @[ @"1.2.840.113635.100.6.1.2", @"1.2.840.113635.100.6.1.12" ];	×
388	NSDictionary *vals = CFBridgingRelease(SecCertificateCopyValues(	×
389	csInfo.leafCertificate.certRef, (__bridge CFArrayRef)keys, NULL));	×
390	return vals.count == 0;	×
391	} else {	×
392	return NO;	×
393	}	×
394	}	×
395	entitlementsFilterCallback:nil	×
NEW 396	preCodesignCheckCallback:nil	×
NEW 397	platformBinaryState:PlatformBinaryState::kStaticCheck];	×
UNCOV 398	}	×
399
400	///
401	/// Checks whether the file at @c path is in-scope for checking with Santa.
402	///
403	/// Files that are out of scope:
404	/// + Non Mach-O files that are not part of an installer package.
405	/// + Files in allowed path.
406	///
407	/// @return @c YES if file is in scope, @c NO otherwise.
408	///
409	- (NSString )fileIsScopeAllowed:(SNTFileInfo )fi {	10✔
410	if (!fi) return nil;	10!
411
412	// Determine if file is within an allowed path
413	NSRegularExpression *re = [[SNTConfigurator configurator] allowedPathRegex];	10✔
414	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
415	return @"Allowed Path Regex";	×
416	}	×
417
418	// If file is not a Mach-O file, we're not interested.
419	if (!fi.isMachO) {	10✔
420	return @"Not a Mach-O";	2✔
421	}	2✔
422
423	return nil;	8✔
424	}	10✔
425
426	- (NSString )fileIsScopeBlocked:(SNTFileInfo )fi {	10✔
427	if (!fi) return nil;	10!
428
429	NSRegularExpression *re = [[SNTConfigurator configurator] blockedPathRegex];	10✔
430	if ([re numberOfMatchesInString:fi.path options:0 range:NSMakeRange(0, fi.path.length)]) {	10!
431	return @"Blocked Path Regex";	×
432	}	×
433
434	if ([[SNTConfigurator configurator] enablePageZeroProtection] && fi.isMissingPageZero) {	10!
435	return @"Missing __PAGEZERO";	×
436	}	×
437
438	return nil;	10✔
439	}	10✔
440
441	@end

google / santa / 10728260647

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous