Russell Hancox
cf1d1e3557
santa-driver: Better handle secondary volumes
2016-03-15 15:10:41 -04:00
Russell Hancox
8f05ee7d79
santa-driver: Rename some action types
2016-03-15 12:53:44 -04:00
Russell Hancox
641bd07c0b
Project: New icon
2016-03-14 16:38:07 -04:00
Russell Hancox
e0a46be1b7
santactl/fileinfo: When resolving path, store bundle ref if possible.
2016-03-14 12:55:20 -04:00
Russell Hancox
fd82c67b56
santactl/fileinfo: Add disk image file type
2016-03-14 12:55:20 -04:00
Russell Hancox
f0a83b6f19
santactl/fileinfo: Add simultaneous hashing.
2016-03-14 12:52:25 -04:00
Russell Hancox
736b45bb46
SNTXPCConnection: Remove client validation of server
...
Now that santad<->SantaGUI work more like the client/server they are,
having an SNTXPCConnection 'client' validate its server is no longer necessary.
Having the validation in the 'server' only simplifies the code.
2016-03-11 17:06:43 -05:00
Russell Hancox
8eae9b7cb7
santad/SantaGUI: Refactor GUI<>santad connection logic and add queuing.
...
Instead of having santad create a listener for SantaGUI to connect to
and then reverse the client-server relationship, have SantaGUI create an
anonymous listener that it sends to santad using the control interface.
Also add a queue for notifications so that blocks that occur while
SantaGUI isn't running will show up once it starts.
2016-03-11 14:58:12 -05:00
Russell Hancox
0aa2d2c613
santactl/fileinfo: Print useful info when codesign validation fails
2016-03-10 18:23:21 -05:00
Russell Hancox
606f507422
Project: Update CocoaPods
2016-03-10 16:34:08 -05:00
Russell Hancox
0e00237e44
Project: Add clang-format file, apply most of the fixes it suggested
2016-03-10 15:53:06 -05:00
Russell Hancox
e9ec9a7d7f
santad: Log quarantine URL if one exists.
...
Fixes #34
2016-03-10 13:24:31 -05:00
Russell Hancox
6834507f3a
XPC: Allow multiple XPC clients to a server
2016-03-10 12:21:49 -05:00
Russell Hancox
90e99255b1
santa-driver/santad: Split decision making and logging onto 2 data queues
...
This resolves an issue where the data queue can be overwhelmed by logging requests and fail to respond to decisions for an extended period of time.
2016-03-10 12:21:17 -05:00
Russell Hancox
b6487000a3
SNTFileInfo: Use NSBundle to find executable path in bundles.
...
Fixes #37
2016-03-10 12:19:52 -05:00
Russell Hancox
18ce2f72ed
Config: Fix config reloading
2016-03-10 12:18:05 -05:00
Russell Hancox
8a2d04bf69
santactl/rule: Fix print error
2016-03-09 15:41:27 -05:00
Russell Hancox
a210ffecec
Logging: Create one ASL client per-thread.
2016-03-07 17:31:31 -05:00
Russell Hancox
aff96e8144
Config: Warn if SyncBaseURL is an invalid URL
2016-03-07 12:36:00 -05:00
Russell Hancox
3d4c639bb4
santactl/sync: Fix logic when auto-detecting certificates.
...
Now, instead of assuming an identity can be found that the server asked
for, look for a chain of certs resulting in an identity that matches the
server's request.
2016-03-07 12:32:32 -05:00
Russell Hancox
d507e79505
santad: Fix quarantine data collection.
...
This previously didn't work for root (santactl fileinfo was fine)
because quarantine data is per-user.
2016-03-07 12:30:36 -05:00
Russell Hancox
df7616403d
SantaGUI: Show entire SHA-256 in fixed-width font
2016-01-14 16:51:29 -05:00
Russell Hancox
962b15517a
SantaGUI: Add a transparent button to be the first responder, so tabbing the dialog works.
2015-12-28 17:24:29 -05:00
Russell Hancox
d295f2391f
santactl/sync: In --debug log the full NSError for failed requests
2015-12-15 12:36:07 -05:00
Russell Hancox
c042222eea
santad: Add user/group info to file changelogs also
2015-12-14 22:32:59 -05:00
Russell Hancox
63f6596bc2
santactl: Rename binaryinfo -> fileinfo.
2015-12-14 18:09:40 -05:00
Russell Hancox
d8a8aba0ea
SNTFileInfo: Move machoType method to binaryinfo command, add XAR archive detection.
2015-12-14 17:25:32 -05:00
Russell Hancox
d9d9682029
santactl/sync: Let related-binary search take up to 5s
2015-12-14 16:37:19 -05:00
Russell Hancox
375bfd3862
santa-driver: Put locks around vnode_pid_map, use an OSObject subclass to store PID/PPID.
...
Put a R/W lock around vnode_pid_map_ to prevent use-after-free.
Create SantaPIDAndPPID to use instead of creating and then scanning strings.
Also rename SantaMessage -> SantaCachedDecision, as that's what it is.
2015-12-14 16:34:38 -05:00
Russell Hancox
9430c41b8a
santad: Include user and group names in execution logs
2015-12-11 12:58:09 -05:00
Russell Hancox
9b342e146a
santactl/sync: Include code sign info with related executables and encode to dict.
2015-12-10 17:37:22 -05:00
Russell Hancox
e5685f2959
santad: Don't try to add empty argument to array when processing execution arguments
2015-12-10 17:02:11 -05:00
Russell Hancox
4150feece2
santactl/sync: When uploading events for bundles, look for other bundled executables.
...
Many application bundles have related helper tools, which will individually need to be whitelisted unless they're covered by a certificate. To help make user's lives easier, when an event is triggered for a binary inside a bundle look for other executables in the same bundle and upload an event for those too (with an obvious tag) so that the server can let the user vote to whitelist all the binaries together.
2015-12-10 17:01:49 -05:00
Russell Hancox
6879ec5deb
santa-driver: in DecisionManager free locks before anything else
2015-12-10 16:56:13 -05:00
Russell Hancox
28ad00ffad
SantaGUI: Split block messages into unknown and banned.
...
This is so that a message can be configured for banned executables without having to provide a custom message for every single one.
2015-12-10 12:13:52 -05:00
Russell Hancox
bf51049fbf
santa-driver: Save pid/ppid from VFS context when decision making for use when logging
...
Previously the execution logging from fileop didn't work when using posix_spawn as proc_selfpid/proc_selfppid still refer to the process calling posix_spawn. We can get the correct pid/ppid from the vfs_context in the vnode scope but we can't log executions from there as the arguments end up being wrong. Instead, save the vnode_id->pid/ppid mapping in the vnode scope and use that in the fileop scope for logging.
2015-12-10 12:12:38 -05:00
Russell Hancox
36189e9122
santad: Update SNTFileInfo to always get strings from bundle Info.plist data.
...
Also perform a one-time update of any events created before this change.
2015-12-04 13:09:56 -05:00
Russell Hancox
4c747463ac
santad: Separate execution requests and logging into separate queues with appropriate priorities.
2015-12-04 12:39:26 -05:00
Russell Hancox
b4b1fbb9e6
santad: Run watchdog thread loop once before sleeping
2015-10-31 14:01:44 -04:00
Russell Hancox
209eaff3c6
SNTFileInfo: Embed SHA hashing loop in an autoreleasepool to avoid temporary RAM spikes
2015-10-31 13:45:47 -04:00
Russell Hancox
c3f70703fd
santactl/status: Expose peak CPU/RAM use from santad.
2015-10-29 16:20:57 -04:00
Russell Hancox
f2967e7b94
santad: Switch watchdog CPU counter from rusage to task_info, capture peak CPU/RAM use.
2015-10-29 16:20:25 -04:00
Russell Hancox
77c46b5c43
SNTFileInfo: switch from NSData to NSFileHandle.
...
This seems to work much better than NSData with either mapped (SIGBUS when file is deleted) or uncached (ballooning memory use) reading.
2015-10-29 16:17:12 -04:00
Russell Hancox
5fda5bc081
santactl/binaryinfo: Only print bundle lines if bundle info is present
2015-10-29 12:35:27 -04:00
Russell Hancox
33a7b38c6a
SNTFileInfo: check for NULL ptrs when parsing for embedded plist
2015-10-27 18:35:11 -04:00
Russell Hancox
2a7c0bd58c
SNTFileInfo: Go back to using mmap, uncached read balloons memory use
2015-10-27 18:08:16 -04:00
Russell Hancox
86e4d0db0f
santactl: Use yyyy instead of YYYY in NSDateFormatter
2015-10-27 17:58:23 -04:00
Russell Hancox
1310fea64d
santa-driver: Only try to use/release proc_t if proc_find found it.
2015-10-22 11:29:49 -04:00
Stephane Moore
ff3303e312
Fix application deadlock.
...
Fix application deadlock by asynchronously dispatching to the main queue in -[SNTAppDelegate createConnection].
2015-10-21 17:45:59 -07:00
Russell Hancox
6ce0ef62e9
SantaGUI: Ensure connection is only made on main thread
2015-10-15 18:31:07 -04:00
