Russell Hancox
8f05ee7d79
santa-driver: Rename some action types
2016-03-15 12:53:44 -04:00
Russell Hancox
e0a46be1b7
santactl/fileinfo: When resolving path, store bundle ref if possible.
2016-03-14 12:55:20 -04:00
Russell Hancox
fd82c67b56
santactl/fileinfo: Add disk image file type
2016-03-14 12:55:20 -04:00
Russell Hancox
f0a83b6f19
santactl/fileinfo: Add simultaneous hashing.
2016-03-14 12:52:25 -04:00
Russell Hancox
736b45bb46
SNTXPCConnection: Remove client validation of server
...
Now that santad<->SantaGUI work more like the client/server they are,
having an SNTXPCConnection 'client' validate its server is no longer necessary.
Having the validation in the 'server' only simplifies the code.
2016-03-11 17:06:43 -05:00
Russell Hancox
8eae9b7cb7
santad/SantaGUI: Refactor GUI<>santad connection logic and add queuing.
...
Instead of having santad create a listener for SantaGUI to connect to
and then reverse the client-server relationship, have SantaGUI create an
anonymous listener that it sends to santad using the control interface.
Also add a queue for notifications so that blocks that occur while
SantaGUI isn't running will show up once it starts.
2016-03-11 14:58:12 -05:00
Russell Hancox
0e00237e44
Project: Add clang-format file, apply most of the fixes it suggested
2016-03-10 15:53:06 -05:00
Russell Hancox
6834507f3a
XPC: Allow multiple XPC clients to a server
2016-03-10 12:21:49 -05:00
Russell Hancox
90e99255b1
santa-driver/santad: Split decision making and logging onto 2 data queues
...
This resolves an issue where the data queue can be overwhelmed by logging requests and fail to respond to decisions for an extended period of time.
2016-03-10 12:21:17 -05:00
Russell Hancox
b6487000a3
SNTFileInfo: Use NSBundle to find executable path in bundles.
...
Fixes #37
2016-03-10 12:19:52 -05:00
Russell Hancox
18ce2f72ed
Config: Fix config reloading
2016-03-10 12:18:05 -05:00
Russell Hancox
a210ffecec
Logging: Create one ASL client per-thread.
2016-03-07 17:31:31 -05:00
Russell Hancox
aff96e8144
Config: Warn if SyncBaseURL is an invalid URL
2016-03-07 12:36:00 -05:00
Russell Hancox
d507e79505
santad: Fix quarantine data collection.
...
This previously didn't work for root (santactl fileinfo was fine)
because quarantine data is per-user.
2016-03-07 12:30:36 -05:00
Russell Hancox
d8a8aba0ea
SNTFileInfo: Move machoType method to binaryinfo command, add XAR archive detection.
2015-12-14 17:25:32 -05:00
Russell Hancox
4150feece2
santactl/sync: When uploading events for bundles, look for other bundled executables.
...
Many application bundles have related helper tools, which will individually need to be whitelisted unless they're covered by a certificate. To help make user's lives easier, when an event is triggered for a binary inside a bundle look for other executables in the same bundle and upload an event for those too (with an obvious tag) so that the server can let the user vote to whitelist all the binaries together.
2015-12-10 17:01:49 -05:00
Russell Hancox
28ad00ffad
SantaGUI: Split block messages into unknown and banned.
...
This is so that a message can be configured for banned executables without having to provide a custom message for every single one.
2015-12-10 12:13:52 -05:00
Russell Hancox
36189e9122
santad: Update SNTFileInfo to always get strings from bundle Info.plist data.
...
Also perform a one-time update of any events created before this change.
2015-12-04 13:09:56 -05:00
Russell Hancox
209eaff3c6
SNTFileInfo: Embed SHA hashing loop in an autoreleasepool to avoid temporary RAM spikes
2015-10-31 13:45:47 -04:00
Russell Hancox
c3f70703fd
santactl/status: Expose peak CPU/RAM use from santad.
2015-10-29 16:20:57 -04:00
Russell Hancox
77c46b5c43
SNTFileInfo: switch from NSData to NSFileHandle.
...
This seems to work much better than NSData with either mapped (SIGBUS when file is deleted) or uncached (ballooning memory use) reading.
2015-10-29 16:17:12 -04:00
Russell Hancox
33a7b38c6a
SNTFileInfo: check for NULL ptrs when parsing for embedded plist
2015-10-27 18:35:11 -04:00
Russell Hancox
2a7c0bd58c
SNTFileInfo: Go back to using mmap, uncached read balloons memory use
2015-10-27 18:08:16 -04:00
Russell Hancox
2a03341fb6
santad: Add configuration option for turning off PAGEZERO protection.
2015-10-15 18:10:00 -04:00
Russell Hancox
1a71cdff4a
santad/santactl: Report back if rule adding/removing failed rather than assuming success.
2015-10-15 12:15:38 -04:00
Russell Hancox
63f65c51c3
SNTFileInfo: Use NSURL method for getting quarantine data, don't try to use <10.10
2015-10-15 12:14:53 -04:00
Russell Hancox
7b8068139b
santad, santactl/sync: Collect and upload quarantine data with events.
2015-10-14 23:02:20 -04:00
Russell Hancox
bc51c9f25b
SNTFileInfo: Add com.apple.quarantine data accessors for downloaded files.
2015-10-14 20:11:32 -04:00
Russell Hancox
c412e8b9a7
SNTFileInfo: Fix embedded plist parsing, extract into separate method
2015-10-14 20:07:50 -04:00
Russell Hancox
4e0ff224b6
Project: Remove SNTCertificate/SNTCodesignChecker, use new CocoaPod versions
2015-10-12 17:23:42 -04:00
Russell Hancox
13aa889633
SNTFileInfo: Add fileSize method, use it in SNTEventLog
2015-10-08 17:57:02 -04:00
Russell Hancox
84f46de940
Driver/Daemon: Collect process name in-kernel for file events, parent name for exec requests. For file events log process name and path, if possible.
2015-10-05 17:09:33 -04:00
Russell Hancox
d9718faba4
SNTFileInfo: Return non-embedded dict if locating embedded fails
2015-10-05 14:13:40 -04:00
Russell Hancox
18a7992372
Config: Add more protected keys, only protect if a server is set
2015-10-02 16:35:30 -04:00
Russell Hancox
9f49e24dc5
santad: Update file changes logging to use a configurable regex
2015-10-01 17:57:07 -04:00
Russell Hancox
1c310486c7
santactl/status, santad: Show watchdog events in status output
2015-09-28 16:41:33 -04:00
Russell Hancox
5782378616
santactl/sync, santad: Add clean sync and last success options, use to initiate clean sync when database is re-created
2015-09-28 16:11:17 -04:00
Russell Hancox
5fd4d56b00
santactl/sync: Add ability to sync blacklist regex
2015-09-28 16:08:11 -04:00
Russell Hancox
cea698d720
SNTCertificate: Add serialNumber and isCa properties.
2015-09-21 17:48:47 -04:00
Russell Hancox
0050724e22
SNTXPCConnection: Use semaphore instead of variable & sleep.
2015-09-21 15:58:54 -04:00
Russell Hancox
718f37024a
SNTConfigurator: Use NSPropertyListImmutable instead of kCFPropertyListImmutable
2015-09-21 15:51:03 -04:00
Russell Hancox
2bc3df3255
santad: Stop using mmap while reading files, it can be forced to crash by truncating the file.
2015-09-16 15:52:49 -04:00
Russell Hancox
5b0e550c85
santad: Add BlacklistRegex option, log a useful explanation when decision is made by scope
2015-09-16 14:19:33 -04:00
Russell Hancox
8fe5e4e238
Logging: Update logMessage to use asl directly, adding a facility
2015-09-09 11:56:53 -04:00
Russell Hancox
02f23d0c62
santad: Add LogFileChanges option, remove LogAllEvents, fix key protection
2015-09-09 11:56:31 -04:00
Russell Hancox
ff6f4d4152
Common: Update SNTRule and SNTStoredEvent isEqual/hash/description methods.
2015-09-08 16:35:50 -04:00
Russell Hancox
98878f3e7c
Kernel/santad: Add file write logging and exec argv's.
...
This necessitated a large refactoring of a bunch of code, hence being a large commit. This moves all event logging into a separate class, moves logging of executions to be from FileOp events rather than Vnode events (so we can get the argv after the execve call has finished) and implements the logging of cached execs.
2015-09-08 16:33:59 -04:00
Russell Hancox
75158c11ea
santa-driver: Don't create santa_message_t structs on the stack.
...
Also rename userId field to uid and add gid field to match
2015-08-31 15:21:25 -04:00
Russell Hancox
a9ba99dc79
SNTFileInfo: Re-write mach header parsing
2015-08-27 15:25:12 -04:00
Russell Hancox
6385514257
santad: Block 32-bit binaries with missing/invalid page zero
2015-08-27 15:25:12 -04:00
