Russell Hancox
4150feece2
santactl/sync: When uploading events for bundles, look for other bundled executables.
...
Many application bundles have related helper tools, which will individually need to be whitelisted unless they're covered by a certificate. To help make user's lives easier, when an event is triggered for a binary inside a bundle look for other executables in the same bundle and upload an event for those too (with an obvious tag) so that the server can let the user vote to whitelist all the binaries together.
2015-12-10 17:01:49 -05:00
Russell Hancox
6879ec5deb
santa-driver: in DecisionManager free locks before anything else
2015-12-10 16:56:13 -05:00
Russell Hancox
28ad00ffad
SantaGUI: Split block messages into unknown and banned.
...
This is so that a message can be configured for banned executables without having to provide a custom message for every single one.
2015-12-10 12:13:52 -05:00
Russell Hancox
bf51049fbf
santa-driver: Save pid/ppid from VFS context when decision making for use when logging
...
Previously the execution logging from fileop didn't work when using posix_spawn as proc_selfpid/proc_selfppid still refer to the process calling posix_spawn. We can get the correct pid/ppid from the vfs_context in the vnode scope but we can't log executions from there as the arguments end up being wrong. Instead, save the vnode_id->pid/ppid mapping in the vnode scope and use that in the fileop scope for logging.
2015-12-10 12:12:38 -05:00
Russell Hancox
36189e9122
santad: Update SNTFileInfo to always get strings from bundle Info.plist data.
...
Also perform a one-time update of any events created before this change.
2015-12-04 13:09:56 -05:00
Russell Hancox
4c747463ac
santad: Separate execution requests and logging into separate queues with appropriate priorities.
2015-12-04 12:39:26 -05:00
Russell Hancox
b4b1fbb9e6
santad: Run watchdog thread loop once before sleeping
2015-10-31 14:01:44 -04:00
Russell Hancox
209eaff3c6
SNTFileInfo: Embed SHA hashing loop in an autoreleasepool to avoid temporary RAM spikes
2015-10-31 13:45:47 -04:00
Russell Hancox
c3f70703fd
santactl/status: Expose peak CPU/RAM use from santad.
2015-10-29 16:20:57 -04:00
Russell Hancox
f2967e7b94
santad: Switch watchdog CPU counter from rusage to task_info, capture peak CPU/RAM use.
2015-10-29 16:20:25 -04:00
Russell Hancox
77c46b5c43
SNTFileInfo: switch from NSData to NSFileHandle.
...
This seems to work much better than NSData with either mapped (SIGBUS when file is deleted) or uncached (ballooning memory use) reading.
2015-10-29 16:17:12 -04:00
Russell Hancox
5fda5bc081
santactl/binaryinfo: Only print bundle lines if bundle info is present
2015-10-29 12:35:27 -04:00
Russell Hancox
33a7b38c6a
SNTFileInfo: check for NULL ptrs when parsing for embedded plist
2015-10-27 18:35:11 -04:00
Russell Hancox
2a7c0bd58c
SNTFileInfo: Go back to using mmap, uncached read balloons memory use
2015-10-27 18:08:16 -04:00
Russell Hancox
86e4d0db0f
santactl: Use yyyy instead of YYYY in NSDateFormatter
2015-10-27 17:58:23 -04:00
Russell Hancox
1310fea64d
santa-driver: Only try to use/release proc_t if proc_find found it.
2015-10-22 11:29:49 -04:00
Stephane Moore
ff3303e312
Fix application deadlock.
...
Fix application deadlock by asynchronously dispatching to the main queue in -[SNTAppDelegate createConnection].
2015-10-21 17:45:59 -07:00
Russell Hancox
6ce0ef62e9
SantaGUI: Ensure connection is only made on main thread
2015-10-15 18:31:07 -04:00
Russell Hancox
2a03341fb6
santad: Add configuration option for turning off PAGEZERO protection.
2015-10-15 18:10:00 -04:00
Russell Hancox
77a55dde56
santad: Catch errors archiving/unarchiving SNTStoredEvent, delete events that fail
2015-10-15 18:09:46 -04:00
Russell Hancox
1a71cdff4a
santad/santactl: Report back if rule adding/removing failed rather than assuming success.
2015-10-15 12:15:38 -04:00
Russell Hancox
63f65c51c3
SNTFileInfo: Use NSURL method for getting quarantine data, don't try to use <10.10
2015-10-15 12:14:53 -04:00
Russell Hancox
75de2526c1
santactl/binaryinfo: Only print quarantine fields if they're not empty
2015-10-14 23:37:16 -04:00
Russell Hancox
6fc4b7b120
santactl/binaryinfo: Increase key padding +1
2015-10-14 23:31:50 -04:00
Russell Hancox
7b8068139b
santad, santactl/sync: Collect and upload quarantine data with events.
2015-10-14 23:02:20 -04:00
Russell Hancox
ced7de884f
santactl/binaryinfo: Add quarantine data to output, add print method to simplify changes.
2015-10-14 20:12:04 -04:00
Russell Hancox
bc51c9f25b
SNTFileInfo: Add com.apple.quarantine data accessors for downloaded files.
2015-10-14 20:11:32 -04:00
Russell Hancox
c412e8b9a7
SNTFileInfo: Fix embedded plist parsing, extract into separate method
2015-10-14 20:07:50 -04:00
Russell Hancox
4e0ff224b6
Project: Remove SNTCertificate/SNTCodesignChecker, use new CocoaPod versions
2015-10-12 17:23:42 -04:00
Russell Hancox
2ed384f677
santactl/sync: Only update client mode at end of sync
2015-10-09 13:12:25 -04:00
Russell Hancox
7a851cb080
santad: Typo in comment
2015-10-08 19:54:23 -04:00
Russell Hancox
13aa889633
SNTFileInfo: Add fileSize method, use it in SNTEventLog
2015-10-08 17:57:02 -04:00
Russell Hancox
5c3fba5f41
santad: Prevent user/server from accidentally deleting rules that would kill the system.
2015-10-08 17:45:39 -04:00
Russell Hancox
84f46de940
Driver/Daemon: Collect process name in-kernel for file events, parent name for exec requests. For file events log process name and path, if possible.
2015-10-05 17:09:33 -04:00
Russell Hancox
cb9a5b6fbe
santactl: Add --json option to both status and version commands.
2015-10-05 14:15:10 -04:00
Russell Hancox
d9718faba4
SNTFileInfo: Return non-embedded dict if locating embedded fails
2015-10-05 14:13:40 -04:00
Russell Hancox
5472ff41f0
santactl/status: Show timezone as UTF offset rather than name
2015-10-05 13:00:55 -04:00
Russell Hancox
4f94c3b310
santactl/status: Use fixed format for sync date output but still include TZ.
2015-10-03 19:57:19 -04:00
Russell Hancox
420f1efa50
santad: For file write events, print process name as well as pid.
2015-10-03 18:16:06 -04:00
Russell Hancox
5d2ce17817
santactl/status: When printing last sync date, use local timezone and locale settings
2015-10-03 18:15:41 -04:00
Russell Hancox
053cb823a1
santa-driver: Change C++ std to C++11
...
This is mostly just to quiet the warning about override not being set on getMetaClass, which is part of the OSDeclareDefaultStructors macro.
2015-10-03 18:15:11 -04:00
Russell Hancox
18a7992372
Config: Add more protected keys, only protect if a server is set
2015-10-02 16:35:30 -04:00
Russell Hancox
9e935f5bfb
GUI: Include CFBundleName as first item in UI, if available.
2015-10-01 18:53:58 -04:00
Russell Hancox
9f49e24dc5
santad: Update file changes logging to use a configurable regex
2015-10-01 17:57:07 -04:00
Russell Hancox
dbf60f16bc
santactl/sync: Fix typo causing clean sync on every run
2015-09-30 16:00:39 -04:00
Russell Hancox
0f3a228788
santactl/rule: Make help text a little clearer
2015-09-28 17:46:30 -04:00
Russell Hancox
d905f5b095
santactl/rule: Add ability to add certificate rules. Re-write argument parsing.
2015-09-28 17:20:34 -04:00
Russell Hancox
1c310486c7
santactl/status, santad: Show watchdog events in status output
2015-09-28 16:41:33 -04:00
Russell Hancox
4b01c6da91
santactl/status: Report some sync statuses.
2015-09-28 16:14:45 -04:00
Russell Hancox
5782378616
santactl/sync, santad: Add clean sync and last success options, use to initiate clean sync when database is re-created
2015-09-28 16:11:17 -04:00
