Russell Hancox
209eaff3c6
SNTFileInfo: Embed SHA hashing loop in an autoreleasepool to avoid temporary RAM spikes
2015-10-31 13:45:47 -04:00
Russell Hancox
c3f70703fd
santactl/status: Expose peak CPU/RAM use from santad.
2015-10-29 16:20:57 -04:00
Russell Hancox
77c46b5c43
SNTFileInfo: switch from NSData to NSFileHandle.
...
This seems to work much better than NSData with either mapped (SIGBUS when file is deleted) or uncached (ballooning memory use) reading.
2015-10-29 16:17:12 -04:00
Russell Hancox
33a7b38c6a
SNTFileInfo: check for NULL ptrs when parsing for embedded plist
2015-10-27 18:35:11 -04:00
Russell Hancox
2a7c0bd58c
SNTFileInfo: Go back to using mmap, uncached read balloons memory use
2015-10-27 18:08:16 -04:00
Russell Hancox
2a03341fb6
santad: Add configuration option for turning off PAGEZERO protection.
2015-10-15 18:10:00 -04:00
Russell Hancox
1a71cdff4a
santad/santactl: Report back if rule adding/removing failed rather than assuming success.
2015-10-15 12:15:38 -04:00
Russell Hancox
63f65c51c3
SNTFileInfo: Use NSURL method for getting quarantine data, don't try to use <10.10
2015-10-15 12:14:53 -04:00
Russell Hancox
7b8068139b
santad, santactl/sync: Collect and upload quarantine data with events.
2015-10-14 23:02:20 -04:00
Russell Hancox
bc51c9f25b
SNTFileInfo: Add com.apple.quarantine data accessors for downloaded files.
2015-10-14 20:11:32 -04:00
Russell Hancox
c412e8b9a7
SNTFileInfo: Fix embedded plist parsing, extract into separate method
2015-10-14 20:07:50 -04:00
Russell Hancox
4e0ff224b6
Project: Remove SNTCertificate/SNTCodesignChecker, use new CocoaPod versions
2015-10-12 17:23:42 -04:00
Russell Hancox
13aa889633
SNTFileInfo: Add fileSize method, use it in SNTEventLog
2015-10-08 17:57:02 -04:00
Russell Hancox
84f46de940
Driver/Daemon: Collect process name in-kernel for file events, parent name for exec requests. For file events log process name and path, if possible.
2015-10-05 17:09:33 -04:00
Russell Hancox
d9718faba4
SNTFileInfo: Return non-embedded dict if locating embedded fails
2015-10-05 14:13:40 -04:00
Russell Hancox
18a7992372
Config: Add more protected keys, only protect if a server is set
2015-10-02 16:35:30 -04:00
Russell Hancox
9f49e24dc5
santad: Update file changes logging to use a configurable regex
2015-10-01 17:57:07 -04:00
Russell Hancox
1c310486c7
santactl/status, santad: Show watchdog events in status output
2015-09-28 16:41:33 -04:00
Russell Hancox
5782378616
santactl/sync, santad: Add clean sync and last success options, use to initiate clean sync when database is re-created
2015-09-28 16:11:17 -04:00
Russell Hancox
5fd4d56b00
santactl/sync: Add ability to sync blacklist regex
2015-09-28 16:08:11 -04:00
Russell Hancox
cea698d720
SNTCertificate: Add serialNumber and isCa properties.
2015-09-21 17:48:47 -04:00
Russell Hancox
0050724e22
SNTXPCConnection: Use semaphore instead of variable & sleep.
2015-09-21 15:58:54 -04:00
Russell Hancox
718f37024a
SNTConfigurator: Use NSPropertyListImmutable instead of kCFPropertyListImmutable
2015-09-21 15:51:03 -04:00
Russell Hancox
2bc3df3255
santad: Stop using mmap while reading files, it can be forced to crash by truncating the file.
2015-09-16 15:52:49 -04:00
Russell Hancox
5b0e550c85
santad: Add BlacklistRegex option, log a useful explanation when decision is made by scope
2015-09-16 14:19:33 -04:00
Russell Hancox
8fe5e4e238
Logging: Update logMessage to use asl directly, adding a facility
2015-09-09 11:56:53 -04:00
Russell Hancox
02f23d0c62
santad: Add LogFileChanges option, remove LogAllEvents, fix key protection
2015-09-09 11:56:31 -04:00
Russell Hancox
ff6f4d4152
Common: Update SNTRule and SNTStoredEvent isEqual/hash/description methods.
2015-09-08 16:35:50 -04:00
Russell Hancox
98878f3e7c
Kernel/santad: Add file write logging and exec argv's.
...
This necessitated a large refactoring of a bunch of code, hence being a large commit. This moves all event logging into a separate class, moves logging of executions to be from FileOp events rather than Vnode events (so we can get the argv after the execve call has finished) and implements the logging of cached execs.
2015-09-08 16:33:59 -04:00
Russell Hancox
75158c11ea
santa-driver: Don't create santa_message_t structs on the stack.
...
Also rename userId field to uid and add gid field to match
2015-08-31 15:21:25 -04:00
Russell Hancox
a9ba99dc79
SNTFileInfo: Re-write mach header parsing
2015-08-27 15:25:12 -04:00
Russell Hancox
6385514257
santad: Block 32-bit binaries with missing/invalid page zero
2015-08-27 15:25:12 -04:00
Russell Hancox
bb43a04992
SNTFileInfo: Always try to get embedded info.plist before bundle plist
2015-08-05 12:01:05 -04:00
Russell Hancox
5f93dc7991
Project: Stop trying to be smart with logging destinations
2015-08-04 18:13:04 -04:00
Russell Hancox
9bc94ca658
GUI: Add defaultBlockMessage configuration
2015-08-04 13:52:44 -04:00
Russell Hancox
cfac7dbb37
Logging: Fix syslog logging and file rotation
2015-07-17 17:43:04 -04:00
Russell Hancox
e94d1175e7
santad: If file can't be hashed, log an error and allow execution.
2015-07-13 11:20:39 -04:00
Russell Hancox
1a31dc870f
Merge branch 'whitelistscope'
...
* whitelistscope:
Common: Rename kWhitelistDirsKey/WhitelistDirs to kWhitelistRegexKey/WhitelistRegex
santad: NSRegularExpression doesn't work with XPC.
santactl/sync: Sync whitelist regex
santad: In a rule vs scope, rule wins.
santad: Move whitelisted dirs feature to using regex instead of array. Faster and more flexible.
santactl: Update help/error wordings
santad: Add whitelisted directory support
2015-06-23 18:31:03 -04:00
Russell Hancox
a1712858c5
Common: Rename kWhitelistDirsKey/WhitelistDirs to kWhitelistRegexKey/WhitelistRegex
2015-06-23 18:30:42 -04:00
Russell Hancox
0059e768b9
Common: Add __NSString__ attribute to logMessage to catch format string bugs. Fix some warnings that found.
2015-06-23 18:10:46 -04:00
Russell Hancox
4fe1550bd2
santad: NSRegularExpression doesn't work with XPC.
2015-06-23 18:09:35 -04:00
Russell Hancox
bc13ac3a98
santad: Move whitelisted dirs feature to using regex instead of array. Faster and more flexible.
2015-06-23 17:22:18 -04:00
Russell Hancox
cbecfd444d
santad: Add whitelisted directory support
2015-06-23 17:21:17 -04:00
Russell Hancox
60594c9f03
santad/santactl-sync: Accept backoff interval from server, disable event uploads if back off is used, re-enable on next sync.
2015-06-23 15:54:30 -04:00
Russell Hancox
44b5bae8da
santad: Add sync execution timer to santad
2015-06-23 15:52:39 -04:00
Russell Hancox
9562ee86cd
Project: Add missing copy to a few properties previously missed
2015-06-19 17:32:45 -04:00
Russell Hancox
adfb4bc861
SNTFileInfo: Better caching of properties
2015-06-19 17:31:48 -04:00
Russell Hancox
f95245cedd
10.11 Prep: Move santad,santactl from /usr/libexec,/usr/sbin to within santa-driver.kext
2015-06-15 16:18:51 -04:00
Russell Hancox
e751a3d307
SNTFileWatcher: Only get the fileSystemRepresentation once, to avoid high memory use when file doesn't exist
2015-06-09 13:10:29 -04:00
Russell Hancox
78bb9a1bd6
common: Correct comment on default loglevels
2015-05-18 13:06:31 -04:00
