Russell Hancox
492e523884
Project: Move enums in SNTCommonEnums to NS_ENUM, part 2
2016-04-08 15:41:26 -04:00
Russell Hancox
3d1fdb7a2b
Project: Move enums in SNTCommonEnums to NS_ENUM, part 1
2016-04-08 15:17:32 -04:00
Russell Hancox
95a4bf0ec7
santad: Ensure launchd/santad rules are whitelisted on every startup
...
If they weren't already and the database is not new, log an error.
2016-04-08 15:16:12 -04:00
Russell Hancox
0d4f261e14
santad: Have SNTRuleTable return NSError when failing to add rules so user can see why
2016-04-08 15:07:43 -04:00
Russell Hancox
e96288b41b
santad: Exclusive-lock rules.db when opening
2016-04-08 12:11:08 -04:00
Russell Hancox
916c3c7a2a
SNTXPCConnection: Re-add forced establishment of clients, better tests.
...
Previously SNTXPCConnection had two-way validation which, due to the method of
implementation, forced a client to connect to a server straight away. Once that
was removed, it meant invalidationHandlers aren't called if either end dies
before the connection is established.
This also puts back the acceptedHandler, which can be used to know when the
connection has finished being established (particularly useful on the server
side), updates the __weak stuff to use WEAKIFY/STRONGIFY macros (and now
actually switch them back to strong within each block) and make the
tests a lot better by using in-process anonymousListener's rather than
lots of mocking.
2016-04-06 23:25:55 -04:00
Russell Hancox
5f1b3a2284
santad: Initialize ppath to (null) before calling proc_pidpath
2016-03-30 16:12:52 -04:00
Russell Hancox
a2311e5128
santad: Attempt to load santa-driver before connecting to it
2016-03-29 14:08:29 -04:00
Russell Hancox
cb7f782893
santad: Fix typo in cert protection error
2016-03-23 17:45:08 -04:00
Russell Hancox
cbb60b3a05
SantaGUI: Have daemon reply when setting notification listener so GUI can ensure it connected
2016-03-17 17:55:31 -04:00
Russell Hancox
8f05ee7d79
santa-driver: Rename some action types
2016-03-15 12:53:44 -04:00
Russell Hancox
8eae9b7cb7
santad/SantaGUI: Refactor GUI<>santad connection logic and add queuing.
...
Instead of having santad create a listener for SantaGUI to connect to
and then reverse the client-server relationship, have SantaGUI create an
anonymous listener that it sends to santad using the control interface.
Also add a queue for notifications so that blocks that occur while
SantaGUI isn't running will show up once it starts.
2016-03-11 14:58:12 -05:00
Russell Hancox
0e00237e44
Project: Add clang-format file, apply most of the fixes it suggested
2016-03-10 15:53:06 -05:00
Russell Hancox
e9ec9a7d7f
santad: Log quarantine URL if one exists.
...
Fixes #34
2016-03-10 13:24:31 -05:00
Russell Hancox
90e99255b1
santa-driver/santad: Split decision making and logging onto 2 data queues
...
This resolves an issue where the data queue can be overwhelmed by logging requests and fail to respond to decisions for an extended period of time.
2016-03-10 12:21:17 -05:00
Russell Hancox
c042222eea
santad: Add user/group info to file changelogs also
2015-12-14 22:32:59 -05:00
Russell Hancox
9430c41b8a
santad: Include user and group names in execution logs
2015-12-11 12:58:09 -05:00
Russell Hancox
e5685f2959
santad: Don't try to add empty argument to array when processing execution arguments
2015-12-10 17:02:11 -05:00
Russell Hancox
36189e9122
santad: Update SNTFileInfo to always get strings from bundle Info.plist data.
...
Also perform a one-time update of any events created before this change.
2015-12-04 13:09:56 -05:00
Russell Hancox
4c747463ac
santad: Separate execution requests and logging into separate queues with appropriate priorities.
2015-12-04 12:39:26 -05:00
Russell Hancox
b4b1fbb9e6
santad: Run watchdog thread loop once before sleeping
2015-10-31 14:01:44 -04:00
Russell Hancox
c3f70703fd
santactl/status: Expose peak CPU/RAM use from santad.
2015-10-29 16:20:57 -04:00
Russell Hancox
f2967e7b94
santad: Switch watchdog CPU counter from rusage to task_info, capture peak CPU/RAM use.
2015-10-29 16:20:25 -04:00
Russell Hancox
2a03341fb6
santad: Add configuration option for turning off PAGEZERO protection.
2015-10-15 18:10:00 -04:00
Russell Hancox
77a55dde56
santad: Catch errors archiving/unarchiving SNTStoredEvent, delete events that fail
2015-10-15 18:09:46 -04:00
Russell Hancox
1a71cdff4a
santad/santactl: Report back if rule adding/removing failed rather than assuming success.
2015-10-15 12:15:38 -04:00
Russell Hancox
7b8068139b
santad, santactl/sync: Collect and upload quarantine data with events.
2015-10-14 23:02:20 -04:00
Russell Hancox
4e0ff224b6
Project: Remove SNTCertificate/SNTCodesignChecker, use new CocoaPod versions
2015-10-12 17:23:42 -04:00
Russell Hancox
7a851cb080
santad: Typo in comment
2015-10-08 19:54:23 -04:00
Russell Hancox
13aa889633
SNTFileInfo: Add fileSize method, use it in SNTEventLog
2015-10-08 17:57:02 -04:00
Russell Hancox
5c3fba5f41
santad: Prevent user/server from accidentally deleting rules that would kill the system.
2015-10-08 17:45:39 -04:00
Russell Hancox
84f46de940
Driver/Daemon: Collect process name in-kernel for file events, parent name for exec requests. For file events log process name and path, if possible.
2015-10-05 17:09:33 -04:00
Russell Hancox
420f1efa50
santad: For file write events, print process name as well as pid.
2015-10-03 18:16:06 -04:00
Russell Hancox
9f49e24dc5
santad: Update file changes logging to use a configurable regex
2015-10-01 17:57:07 -04:00
Russell Hancox
1c310486c7
santactl/status, santad: Show watchdog events in status output
2015-09-28 16:41:33 -04:00
Russell Hancox
5782378616
santactl/sync, santad: Add clean sync and last success options, use to initiate clean sync when database is re-created
2015-09-28 16:11:17 -04:00
Russell Hancox
64c97ebfba
santad: If database open fails, delete and re-create.
2015-09-28 16:09:05 -04:00
Russell Hancox
5fd4d56b00
santactl/sync: Add ability to sync blacklist regex
2015-09-28 16:08:11 -04:00
Russell Hancox
c07f41c312
santad: Stop closing stdout/stderr
2015-09-21 15:59:32 -04:00
Russell Hancox
5b0e550c85
santad: Add BlacklistRegex option, log a useful explanation when decision is made by scope
2015-09-16 14:19:33 -04:00
Russell Hancox
682f741ddc
santad: Separate uid/gid fields in log.
2015-09-11 11:35:14 -04:00
Russell Hancox
cc286dcf16
santad: Fix event storage
2015-09-09 17:13:21 -04:00
Russell Hancox
02f23d0c62
santad: Add LogFileChanges option, remove LogAllEvents, fix key protection
2015-09-09 11:56:31 -04:00
Russell Hancox
98878f3e7c
Kernel/santad: Add file write logging and exec argv's.
...
This necessitated a large refactoring of a bunch of code, hence being a large commit. This moves all event logging into a separate class, moves logging of executions to be from FileOp events rather than Vnode events (so we can get the argv after the execve call has finished) and implements the logging of cached execs.
2015-09-08 16:33:59 -04:00
Russell Hancox
761a852156
santad: Always request sizeof(santa_message_t) regardless of previous message size
2015-09-08 14:40:50 -04:00
Russell Hancox
f4ddb11c1f
santad: Force database permissions on startup
2015-09-08 14:33:25 -04:00
Russell Hancox
75158c11ea
santa-driver: Don't create santa_message_t structs on the stack.
...
Also rename userId field to uid and add gid field to match
2015-08-31 15:21:25 -04:00
Russell Hancox
b87482e824
santad: Move page zero check to after binary/cert rule checks so 'bad' binaries can be whitelisted and notifications will be generated when they're blocked
2015-08-27 15:25:13 -04:00
Russell Hancox
6385514257
santad: Block 32-bit binaries with missing/invalid page zero
2015-08-27 15:25:12 -04:00
Russell Hancox
5f93dc7991
Project: Stop trying to be smart with logging destinations
2015-08-04 18:13:04 -04:00
