Russell Hancox
7a851cb080
santad: Typo in comment
2015-10-08 19:54:23 -04:00
Russell Hancox
13aa889633
SNTFileInfo: Add fileSize method, use it in SNTEventLog
2015-10-08 17:57:02 -04:00
Russell Hancox
5c3fba5f41
santad: Prevent user/server from accidentally deleting rules that would kill the system.
2015-10-08 17:45:39 -04:00
Russell Hancox
84f46de940
Driver/Daemon: Collect process name in-kernel for file events, parent name for exec requests. For file events log process name and path, if possible.
2015-10-05 17:09:33 -04:00
Russell Hancox
420f1efa50
santad: For file write events, print process name as well as pid.
2015-10-03 18:16:06 -04:00
Russell Hancox
9f49e24dc5
santad: Update file changes logging to use a configurable regex
2015-10-01 17:57:07 -04:00
Russell Hancox
1c310486c7
santactl/status, santad: Show watchdog events in status output
2015-09-28 16:41:33 -04:00
Russell Hancox
5782378616
santactl/sync, santad: Add clean sync and last success options, use to initiate clean sync when database is re-created
2015-09-28 16:11:17 -04:00
Russell Hancox
64c97ebfba
santad: If database open fails, delete and re-create.
2015-09-28 16:09:05 -04:00
Russell Hancox
5fd4d56b00
santactl/sync: Add ability to sync blacklist regex
2015-09-28 16:08:11 -04:00
Russell Hancox
c07f41c312
santad: Stop closing stdout/stderr
2015-09-21 15:59:32 -04:00
Russell Hancox
5b0e550c85
santad: Add BlacklistRegex option, log a useful explanation when decision is made by scope
2015-09-16 14:19:33 -04:00
Russell Hancox
682f741ddc
santad: Separate uid/gid fields in log.
2015-09-11 11:35:14 -04:00
Russell Hancox
cc286dcf16
santad: Fix event storage
2015-09-09 17:13:21 -04:00
Russell Hancox
02f23d0c62
santad: Add LogFileChanges option, remove LogAllEvents, fix key protection
2015-09-09 11:56:31 -04:00
Russell Hancox
98878f3e7c
Kernel/santad: Add file write logging and exec argv's.
...
This necessitated a large refactoring of a bunch of code, hence being a large commit. This moves all event logging into a separate class, moves logging of executions to be from FileOp events rather than Vnode events (so we can get the argv after the execve call has finished) and implements the logging of cached execs.
2015-09-08 16:33:59 -04:00
Russell Hancox
761a852156
santad: Always request sizeof(santa_message_t) regardless of previous message size
2015-09-08 14:40:50 -04:00
Russell Hancox
f4ddb11c1f
santad: Force database permissions on startup
2015-09-08 14:33:25 -04:00
Russell Hancox
75158c11ea
santa-driver: Don't create santa_message_t structs on the stack.
...
Also rename userId field to uid and add gid field to match
2015-08-31 15:21:25 -04:00
Russell Hancox
b87482e824
santad: Move page zero check to after binary/cert rule checks so 'bad' binaries can be whitelisted and notifications will be generated when they're blocked
2015-08-27 15:25:13 -04:00
Russell Hancox
6385514257
santad: Block 32-bit binaries with missing/invalid page zero
2015-08-27 15:25:12 -04:00
Russell Hancox
5f93dc7991
Project: Stop trying to be smart with logging destinations
2015-08-04 18:13:04 -04:00
Russell Hancox
e3593c1b0c
santad: fclose stderr for santactl sync too
2015-07-22 16:35:25 -04:00
Russell Hancox
0898940d0b
santad: Pass santa_message_t straight to SNTExecutionController
2015-07-21 14:52:53 -04:00
Russell Hancox
38b65b0ca4
santad: Move uid->username lookup to where it's actually used
2015-07-21 14:52:53 -04:00
Russell Hancox
ff99ab9cfe
santad: loggedInUsers:sessions: style clean-up
2015-07-21 14:22:42 -04:00
Russell Hancox
64995367c3
santad: Simplify eventStateForDecision:type:
2015-07-21 14:22:42 -04:00
Russell Hancox
c67f0ffc11
santad: Don't initiate event upload if syncing isn't enabled
2015-07-21 14:22:42 -04:00
Russell Hancox
d21d64cbfe
santad: Don't print log format every startup
2015-07-21 14:22:42 -04:00
Russell Hancox
cfac7dbb37
Logging: Fix syslog logging and file rotation
2015-07-17 17:43:04 -04:00
Russell Hancox
3134448eac
santad: Close password database after getpwuid
2015-07-15 18:25:26 -04:00
Russell Hancox
e94d1175e7
santad: If file can't be hashed, log an error and allow execution.
2015-07-13 11:20:39 -04:00
Russell Hancox
90c64812d0
santad: close stdout before running santactl sync
2015-07-01 17:22:40 -04:00
Russell Hancox
08d368fc49
santad: Rename watchdog thread with reverse-dns name
2015-06-26 16:29:46 -04:00
Russell Hancox
39385f0bff
santad: Put an autoreleasepool inside the watchdog thread.
2015-06-26 13:12:46 -04:00
Russell Hancox
8bc3418ce1
santad: Watchdog: only log memory use if it increased since last check. Increase threshold to 250MB
2015-06-25 17:58:17 -04:00
Russell Hancox
8234706dd3
santad: Vacuum event database after removing multiple events.
2015-06-24 11:58:38 -04:00
Russell Hancox
4fe1550bd2
santad: NSRegularExpression doesn't work with XPC.
2015-06-23 18:09:35 -04:00
Russell Hancox
bcdf746def
santad: In a rule vs scope, rule wins.
2015-06-23 17:33:08 -04:00
Russell Hancox
bc13ac3a98
santad: Move whitelisted dirs feature to using regex instead of array. Faster and more flexible.
2015-06-23 17:22:18 -04:00
Russell Hancox
cbecfd444d
santad: Add whitelisted directory support
2015-06-23 17:21:17 -04:00
Russell Hancox
60594c9f03
santad/santactl-sync: Accept backoff interval from server, disable event uploads if back off is used, re-enable on next sync.
2015-06-23 15:54:30 -04:00
Russell Hancox
44b5bae8da
santad: Add sync execution timer to santad
2015-06-23 15:52:39 -04:00
Russell Hancox
2e856196c5
santad: Move SIGCHLD SIG_IGN setting to main(), it doesn't need to be set repeatedly.
2015-06-23 15:36:59 -04:00
Russell Hancox
f323f5e3de
santad: Up watchdog interval to 60s and CPU threshold to 20%.
...
Whilst during normal operation santad doesn't use more than 5% CPU, it does spike if lots
of processes start, such as during bootup. This change helps to reduce the noise.
2015-06-22 15:28:02 -04:00
Russell Hancox
44c9d9aead
santad: Add watchdog thread to print warnings if CPU/RAM usage seem high.
2015-06-15 16:31:55 -04:00
Russell Hancox
f95245cedd
10.11 Prep: Move santad,santactl from /usr/libexec,/usr/sbin to within santa-driver.kext
2015-06-15 16:18:51 -04:00
Russell Hancox
2a8bdfd714
santad: Use _exit instead of exit after fork. Oops.
2015-06-01 17:12:12 -04:00
Russell Hancox
567e0b6431
santad: If exiting because of a failed dequeue, log the return code at ERROR level.
2015-05-18 13:06:31 -04:00
Russell Hancox
3f5400b264
santa-driver: Split FetchDecision, notify daemon of missed executions, reorganize some methods.
2015-05-14 17:01:49 -04:00
