* Some minor changes for some easy perf wins based on trace info
* Manually track buffer offsets in File writer
* Add metrics tests
* Call members from appropriate shared object
* Add method to get WatchItems state
* Update santactl status with watch items state
* Update status label
* PR feedback - add missing dispatch_group_leave
* WIP parsing new watch item config format
* Change WatchItemPolicy param order. Define policy default constants.
* rename write_only policy member to allow_read_access
* WIP parsing new config format, WatchItemsTest all pass
* Restructured process config parsing. Added tons of tests.
* Abstract NSError creation to a function
* Better errors. Bubble up NSErrors to reduce duplicate messages. More Tests.
* Validate min string lengths. Add a bunch more tests.
* Adopt new policy process logic and add tests
* Address PR feedback
* Support more file access protection event types
* Update tests for new events and method signatures
* lint
* Add metrics for new event types
* Add support for LINK event
* Fix spacing
* WIP begin adopting new ES APIs inverting target mute paths
* Track subscription status so as not to unnecessarily enable/disable
* Properly chain call to invert target mute paths. Fix using wrong Message obj.
* Add base client tests
* Support compiling on older platforms
* More changes to support compiling on older platforms
* Only enable watch items periodic task on macOS 13
* Add more asserts to test
* Disable ES caching for now
* lint
* Change FindPolicyForPath to operate on vector of inputs
* Adopt new interface to find all policies simultaneously
* Fix tests to use new FindPoliciesForPath signature
* WIP refactor file access class to setup logging
* Combined GetPathTarget1 and 2, added some tests.
* Change method name to not be abbrv.
* Remove unnecessary includes
* PR feedback: fix missing path sep, add comments
* Fix test issue
* WIP Dynamic watch item config loading. Dynamic event handler protocol.
* Clients can now register with WatchItems to be enabled/disabled
* Handle dynamic fs monitor config add/modify/delete, dynamic enable/disable clients
* Update WatchItemsTest to use new constructor
* Better check handling value changes
* Add missing mock config value to fix integration test
* Add policy version to config. Return policy decision as enum.
* Check EnableBadSignatureProtection config when evaluating instigating procs
* Draft proto update for file access
* Revert "Draft proto update for file access"
This reverts commit 5d7e9a9e03.
* Change return type to work around OCMock partial mocking issues
* lint
* WIP Initial work for new fs watcher client
* WIP basic working mechanics of applying policy to OPEN events
* WIP now support allowing access based on cdhash
* WIP lint fix
* WIP check instigator cdhash and cert hash against policy
* WIP Fix test issue in base ES client class
* WIP Fix test issue in water items test
* Added secondary lookup cache for cert hashes and fallback lookups
* Adopt new SantaVnode name
* Adopt min macOS 11. Adopt new SantaCacheHasher for SantaVnode.
* Rename the es client to FileAccessAuthorizer
* Added some more tests
* Added MockLogger and a lot more tests.
* Removed currently unused subscriptions. Don't enable FS client by default
* lint
* lint after rebase
* Use strtoul for hex string conversion. Update comments.
* PR feedback
* WIP started work on parsing config
* WIP Basics of parsing config and generating new policy
* WIP Reapplying config updates functionally complete. Needs a lot more tests.
* Test cleanup, added using decl for watch items tree type
* More WatchItems tests and test polishing.
* Remove test print function. Formatting.
* Commented use of __BLOCKS__ undef
* Return a shared_ptr from factory
* Change WatchItemsPolicy to store sets instead of vectors
* Remove unnecessary WatchItem, replace with string
* Typo
* Update error messages to not make it sound like parse errors are recoverable
* Move santa_action_t to SNTCommonEnums and rename to SNTAction
* Move likely and unlikely macros to a new BranchPrediction header
* Remove SNTCommon.h. Move SantaVnode to its own header.
* Add SantaVnodeHash
* Fix build deps
* Swtich from task_info to libproc for system resource info
* Fix return value
* Convert nanos to seconds
* Make GetTimebase static. Expose NanosToMachTime.
* Abstract return or GetTaskInfo to new type.
* WIP Rename SNTPrefixTree to PrefixTree
* WIP Implement the new PrefixTree and tests
* Add Unit type. Fix build and tests.
* lint
* Make NodeCount accessor for tests
* Updated comments
