santabs: use the ancestor bundle when searching for binaries (#175)

* santabs: use the ancestor bundle when searching for binaries

* review updates

* bundle tests

.clang-format

@@ -0,0 +1,22 @@
+BasedOnStyle: Google
+Language: Cpp
+Standard: Cpp11
+
+# Disable ColumnLimit because it causes some very weird line breaks.
+# For ObjC the limit is 100
+# For Cpp  the limit is 80
+ColumnLimit: 0
+
+# Allow short case statements to be on a single line
+AllowShortCaseLabelsOnASingleLine: true
+
+# Ban short loops and functions on a single line
+AllowShortLoopsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: false
+
+# Allow spaces in NSArray/NSDictionary literals @[ and @{
+SpacesInContainerLiterals: true
+
+# For pointers, always put the * next to the variable name.
+DerivePointerAlignment: false
+PointerAlignment: Right

.gitignore

@@ -1,8 +1,9 @@
 .DS_Store
 Build
-Dist
+santa-*
 Pods
 Santa.xcodeproj/xcuserdata
 Santa.xcodeproj/project.xcworkspace
 Santa.xcworkspace/xcuserdata
 Santa.xcworkspace/xcshareddata
+Source/DevelopmentTeam.xcconfig

.travis.yml

@@ -0,0 +1,14 @@
+---
+language: objective-c
+cache:
+  - bundler
+  - cocoapods
+sudo: false
+osx_image: xcode7
+
+before_install:
+ - gem install cocoapods xcpretty
+ - pod setup >/dev/null
+
+script:
+ - xcodebuild -workspace Santa.xcworkspace -scheme All -derivedDataPath build build test CODE_SIGN_IDENTITY='' | xcpretty -sc && exit ${PIPESTATUS[0]}

CONTRIBUTING.md

@@ -25,6 +25,12 @@ tests beforehand, which you can do with the following commands:
 rake tests:logic
 rake tests:kernel  # only necessary if you're changing the kext code
 ```
+### Code Style
+
+All code submissions should try to match the surrounding code.  Wherever possible,
+code should adhere to either the
+[Google Objective-C Style Guide](https://google.github.io/styleguide/objcguide.xml)
+or the [Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html).
 
 ### The small print
 Contributions made by corporations are covered by a different agreement than

Conf/Package/Makefile

@@ -0,0 +1,85 @@
+#
+#  Package Makefile for Santa
+#  Requires TheLuggage (github.com/unixorn/luggage) to be installed
+#
+#  Will generate a package based on the latest release. You can replace
+#  the PACKAGE_VERSION variable with a specific variable instead if you wish.
+#
+
+LUGGAGE:=/usr/local/share/luggage/luggage.make
+include ${LUGGAGE}
+
+TITLE:=santa
+REVERSE_DOMAIN:=com.google
+
+# Get latest Release version using the GitHub API. Each release is bound to a
+# git tag, which should always be a semantic version number. The most recent
+# release is always first in the API result.
+PACKAGE_VERSION:=$(shell curl -fs https://api.github.com/repos/google/santa/releases |\
+	python -c 'import json, sys; print json.load(sys.stdin)[0]["tag_name"]' 2>/dev/null)
+
+# Get the download URL for the latest Release. Each release should have a
+# tarball named santa-$version.tar.bz2 containing all of the files associated
+# with that release. The tarball layout is:
+#
+#   santa-$version.tar.bz2
+#   +--santa-$version
+#         |-- binaries
+#         |    |-- santa-driver.kext
+#         |    |-- Santa.app
+#         |-- conf
+#         |    |-- install.sh
+#         |    |-- com.google.santad.plist
+#         |    |-- com.google.santagui.plist
+#         |    +-- com.google.santa.asl.conf
+#         +--dsym
+#              |-- santa-driver.kext.dSYM
+#              |-- Santa.app.dSYM
+#              |-- santad.dSYM
+#              +-- santactl.dSYM
+PACKAGE_DOWNLOAD_URL:="https://github.com/google/santa/releases/download/${PACKAGE_VERSION}/santa-${PACKAGE_VERSION}.tar.bz2"
+
+PAYLOAD:=pack-Library-Extensions-santa-driver.kext \
+	pack-applications-Santa.app \
+	pack-Library-LaunchDaemons-com.google.santad.plist \
+	pack-Library-LaunchAgents-com.google.santagui.plist \
+	pack-etc-asl-com.google.santa.asl.conf \
+	pack-script-preinstall \
+	pack-script-postinstall
+
+santa-driver.kext: download
+Santa.app: download
+com.google.santad.plist: download
+com.google.santagui.plist: download
+com.google.santa.asl.conf: download
+
+download:
+	$(if $(PACKAGE_VERSION),, $(error GitHub API returned unexpected result. Wait a while and try again))
+
+	@curl -fL ${PACKAGE_DOWNLOAD_URL} | tar xvj --strip=2
+	@rm -rf *.dSYM
+
+pack-etc-asl-com.google.santa.asl.conf: com.google.santa.asl.conf l_private_etc
+	@sudo mkdir -p ${WORK_D}/private/etc/asl
+	@sudo chown root:wheel ${WORK_D}/private/etc/asl
+	@sudo chmod 755 ${WORK_D}/private/etc/asl
+	@sudo install -m 644 -o root -g wheel com.google.santa.asl.conf ${WORK_D}/private/etc/asl
+
+pack-Library-Extensions-santa-driver.kext: santa-driver.kext l_Library
+	@sudo mkdir -p ${WORK_D}/Library/Extensions
+	@sudo ${DITTO} --noqtn santa-driver.kext ${WORK_D}/Library/Extensions/santa-driver.kext
+	@sudo chown -R root:wheel ${WORK_D}/Library/Extensions/santa-driver.kext
+	@sudo chmod -R 755 ${WORK_D}/Library/Extensions/santa-driver.kext
+
+clean: myclean
+
+myclean:
+	@rm -rf *.dSYM
+	@rm -rf Santa.app
+	@rm -rf santa-driver.kext
+	@rm -f config.plist
+	@rm -f com.google.santa.asl.conf
+	@rm -f com.google.santad.plist
+	@rm -f com.google.santagui.plist
+	@rm -f install.sh
+	@rm -f uninstall.sh

Conf/Package/postinstall

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Load the kernel extension, santad, sync client
+# If a user is logged in, also load the GUI agent.
+# If the target volume is not /, do nothing
+
+[[ $3 != "/" ]] && exit 0
+
+# Restart syslogd to pick up ASL configuration change
+/usr/bin/killall -HUP syslogd
+
+/sbin/kextload /Library/Extensions/santa-driver.kext
+
+sleep 1
+
+/bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
+
+sleep 1
+
+# Create hopefully useful symlink for santactl
+mkdir -p /usr/local/bin
+/bin/ln -sf /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin/santactl
+
+user=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -z "$user" ]] && exit 0
+/bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+
+exit 0

Conf/Package/preinstall

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Unload the kernel extension, santad, sync client
+# If a user is logged in, also unload the GUI agent.
+# If the target volume is not /, do nothing
+
+[[ $3 != "/" ]] && exit 0
+
+/bin/launchctl remove com.google.santad
+
+sleep 1
+
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+
+# Remove cruft from old Santa versions
+/bin/rm /usr/libexec/santad
+/bin/rm /usr/sbin/santactl
+/bin/launchctl remove com.google.santasync
+/bin/rm /Library/LaunchDaemons/com.google.santasync.plist
+
+sleep 1
+
+user=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+
+exit 0

Conf/com.google.santa.asl.conf

@@ -1,4 +1,6 @@
 # Copy this file to /etc/asl to log all messages from santa-driver to the log file
-? [S= Message santa-driver:] claim only
-? [S= Message santa-driver:] file /var/log/santa.log format="[$((Time)(utc.3))] $Message"
-> /var/log/santa.log mode=0644 rotate=seq compress file_max=5M all_max=100M
+> /var/db/santa/santa.log format="[$((Time)(ISO8601Z.3))] $Message" mode=0644 rotate=seq compress file_max=25M all_max=100M uid=0 gid=0
+? [= Sender kernel] [S= Message santa-driver:] claim
+? [= Sender kernel] [S= Message santa-driver:] file /var/db/santa/santa.log
+? [= Facility com.google.santa] claim
+? [= Facility com.google.santa] file /var/db/santa/santa.log

Conf/com.google.santad.plist

@@ -6,24 +6,21 @@
 				<string>com.google.santad</string>
 				<key>ProgramArguments</key>
 				<array>
-								<string>/usr/libexec/santad</string>
+					<string>/Library/Extensions/santa-driver.kext/Contents/MacOS/santad</string>
+					<string>--syslog</string>
 				</array>
 				<key>MachServices</key>
 				<dict>
-								<key>SantaXPCNotifications</key>
-								<true/>
-								<key>SantaXPCControl</key>
-								<true/>
+					<key>SantaXPCControl</key>
+					<true/>
 				</dict>
-				<key>StandardOutPath</key>
-				<string>/var/log/santa.log</string>
-				<key>StandardErrorPath</key>
-				<string>/var/log/santa.log</string>
 				<key>RunAtLoad</key>
 				<true/>
 				<key>KeepAlive</key>
 				<true />
 				<key>ProcessType</key>
 				<string>Interactive</string>
+				<key>ThrottleInterval</key>
+				<integer>1</integer>
 </dict>
 </plist>

Conf/com.google.santagui.plist

@@ -7,8 +7,11 @@
 				<key>ProgramArguments</key>
 				<array>
 					<string>/Applications/Santa.app/Contents/MacOS/Santa</string>
+					<string>--syslog</string>
 				</array>
 				<key>RunAtLoad</key>
 				<true/>
+				<key>KeepAlive</key>
+				<true/>
 </dict>
 </plist>

Conf/com.google.santasync.plist

@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-				<key>Label</key>
-				<string>com.google.santasync</string>
-				<key>ProgramArguments</key>
-				<array>
-								<string>/usr/sbin/santactl</string>
-								<string>sync</string>
-				</array>
-				<key>StandardErrorPath</key>
-				<string>/var/log/santa.log</string>
-				<key>ProcessType</key>
-				<string>Background</string>
-				<key>StartInterval</key>
-				<integer>600</integer>
-</dict>
-</plist>

Conf/install.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+if [[ $EUID -ne 0 ]]; then
+  echo "This script must be run as root" 1>&2
+  exit 1
+fi
+
+if [[ -d "binaries" ]]; then
+  SOURCE="."
+elif [[ -d "../binaries" ]]; then
+  SOURCE=".."
+else
+  echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
+  exit 1
+fi
+
+# Determine if anyone is logged into the GUI
+GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
+
+# Unload santad and scheduled sync job.
+/bin/launchctl remove com.google.santad >/dev/null 2>&1
+
+# Unload kext.
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+
+# Unload GUI agent if someone is logged in.
+[[ -n "$GUI_USER" ]] && \
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove /Library/LaunchAgents/com.google.santagui.plist
+
+# Cleanup cruft from old versions
+/bin/launchctl remove com.google.santasync >/dev/null 2>&1
+/bin/rm /Library/LaunchDaemons/com.google.santasync.plist >/dev/null 2>&1
+/bin/rm /usr/libexec/santad >/dev/null 2>&1
+/bin/rm /usr/sbin/santactl >/dev/null 2>&1
+
+# Copy new files.
+/bin/cp -r ${SOURCE}/binaries/santa-driver.kext /Library/Extensions
+/bin/cp -r ${SOURCE}/binaries/Santa.app /Applications
+mkdir -p /usr/local/bin
+/bin/ln -s /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin
+
+/bin/cp ${SOURCE}/conf/com.google.santad.plist /Library/LaunchDaemons
+/bin/cp ${SOURCE}/conf/com.google.santagui.plist /Library/LaunchAgents
+/bin/cp ${SOURCE}/conf/com.google.santa.asl.conf /etc/asl/
+
+# Reload syslogd to pick up ASL configuration change.
+/usr/bin/killall -HUP syslogd
+
+# Load kext.
+/sbin/kextload /Library/Extensions/santa-driver.kext
+
+# Load santad and scheduled sync jobs.
+/bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist
+
+# Load GUI agent if someone is logged in.
+[[ -n "$GUI_USER" ]] && \
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+
+exit 0

Conf/uninstall.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Uninstalls Santa from the boot volume, clearing up everything but logs/configs.
+# Unloads the kernel extension, services, and deletes component files.
+# If a user is logged in, also unloads the GUI agent.
+
+[ "$EUID" != 0 ] && printf "%s\n" "This requires running as root/sudo." && exit 1
+
+/bin/launchctl remove com.google.santad
+sleep 1
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+user=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+# and to clean out the log config, although it won't write after wiping the binary
+/usr/bin/killall -HUP syslogd
+# delete artifacts on-disk
+/bin/rm -rf /Applications/Santa.app
+/bin/rm -rf /Library/Extensions/santa-driver.kext
+/bin/rm -f /Library/LaunchAgents/com.google.santagui.plist
+/bin/rm -f /Library/LaunchDaemons/com.google.santad.plist
+/bin/rm -f /private/etc/asl/com.google.santa.asl.conf
+/bin/rm -f /usr/local/bin/santactl # just a symlink
+#uncomment to remove the config file and all databases, log files
+#/bin/rm -rf /var/db/santa
+#/bin/rm -f /var/log/santa*
+exit 0

Podfile

@@ -1,12 +1,54 @@
-platform :osx, "10.8"
+platform :osx, "10.9"
 
 inhibit_all_warnings!
 
+target :Santa do
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+end
+
 target :santad do
   pod 'FMDB'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+  target :santabs do
+    pod 'FMDB'
+    pod 'MOLCertificate'
+    pod 'MOLCodesignChecker'
+  end
+end
+
+target :santactl do
+  pod 'FMDB'
+  pod 'MOLAuthenticatingURLSession'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+  pod 'MOLFCMClient', '~> 1.3'
 end
 
 target :LogicTests do
-  pod 'OCMock'
   pod 'FMDB'
+  pod 'MOLAuthenticatingURLSession'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+  pod 'OCMock'
 end
+
+post_install do |installer|
+  installer.pods_project.targets.each do |target|
+    target.build_configurations.each do |config|
+      if config.name != 'Release' then
+        break
+      end
+
+      # This is necessary to get FMDB to not NSLog stuff.
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= ''
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] <<= "NDEBUG=1"
+
+      # Enable more compiler optimizations.
+      config.build_settings['GCC_OPTIMIZATION_LEVEL'] = 'fast'
+      config.build_settings['LLVM_LTO'] = 'YES'
+    end
+  end
+end
+

Podfile.lock

@@ -1,17 +1,32 @@
 PODS:
-  - FMDB (2.4):
-    - FMDB/standard (= 2.4)
-  - FMDB/common (2.4)
-  - FMDB/standard (2.4):
-    - FMDB/common
-  - OCMock (3.1.1)
+  - FMDB (2.6.2):
+    - FMDB/standard (= 2.6.2)
+  - FMDB/standard (2.6.2)
+  - MOLAuthenticatingURLSession (2.2):
+    - MOLCertificate (~> 1.5)
+  - MOLCertificate (1.5)
+  - MOLCodesignChecker (1.5):
+    - MOLCertificate (~> 1.3)
+  - MOLFCMClient (1.3):
+    - MOLAuthenticatingURLSession (~> 2.1)
+  - OCMock (3.4)
 
 DEPENDENCIES:
   - FMDB
+  - MOLAuthenticatingURLSession
+  - MOLCertificate
+  - MOLCodesignChecker
+  - MOLFCMClient (~> 1.3)
   - OCMock
 
 SPEC CHECKSUMS:
-  FMDB: 0b2fa25e5264ef177973c0cb8c02c711107979aa
-  OCMock: f6cb8c162ab9d5620dddf411282c7b2c0ee78854
+  FMDB: 854a0341b4726e53276f2a8996f06f1b80f9259a
+  MOLAuthenticatingURLSession: 5a5e31eb73248c3e92c79b9a285f031194e8404c
+  MOLCertificate: c39cae866d24d36fbc78032affff83d401b5384a
+  MOLCodesignChecker: fc9c64147811d7b0d0739127003e0630dff9213a
+  MOLFCMClient: 13d8b42db9d750e772f09cc38fc453922fece09f
+  OCMock: 35ae71d6a8fcc1b59434d561d1520b9dd4f15765
 
-COCOAPODS: 0.35.0
+PODFILE CHECKSUM: acd378b3727c923d912e09812da344f7375c14fe
+
+COCOAPODS: 1.2.1

README.md

@@ -1,7 +1,13 @@
-Santa
+Santa  [![Build Status](https://travis-ci.org/google/santa.png?branch=master)](https://travis-ci.org/google/santa)
 =====
 
-Santa is a binary whitelisting/blacklisting system for Mac OS X. It consists of
+<p align="center">
+<a href="#santa--">
+<img src="./Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
+</a>
+</p>
+
+Santa is a binary whitelisting/blacklisting system for macOS. It consists of
 a kernel extension that monitors for executions, a userland daemon that makes
 execution decisions based on the contents of a SQLite database, a GUI agent that
 notifies the user in case of a block decision and a command-line utility for
@@ -10,25 +16,53 @@ managing the system and synchronizing the database with a server.
 Santa is not yet a 1.0. We're writing more tests, fixing bugs, working on TODOs
 and finishing up a security audit.
 
-Santa is named because it keeps track of binaries that are naughty and nice.
+It is named Santa because it keeps track of binaries that are naughty or nice.
 
 Santa is a project of Google's Macintosh Operations Team.
 
-Features
+Admin-Related Features
 ========
 
-* Multiple modes: MONITOR and LOCKDOWN. In MONITOR mode all binaries except
-those marked as blacklisted will be allowed to run, whilst being logged and
-recorded in the database. In LOCKDOWN mode, only whitelisted binaries are
+* Multiple modes: In the default MONITOR mode, all binaries except
+those marked as blacklisted will be allowed to run, whilst being logged and recorded in the events database. In LOCKDOWN mode, only whitelisted binaries are
 allowed to run.
 
-* Codesign listing: Binaries can be whitelisted/blacklisted by their signing
-certificate, so you can trust/block all binaries by a given publisher. The
-binary will only be whitelisted by certificate if its signature validates
-correctly. However, a decision for a binary will override a decision for a
-certificate; i.e. you can whitelist a certificate while blacklisting a binary
-signed by that certificate or vice-versa.
+* Event logging: When the kext is loaded, all binary launches are logged.
+When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.
 
+* Certificate-based rules, with override levels: Instead of relying on a binaries hash (or 'fingerprint'), executables can be whitelisted/blacklisted by their signing
+certificate. You can therefore trust/block all binaries by a given publisher that were signed with that cert across version updates. A
+binary can only be whitelisted by its certificate if its signature validates
+correctly, but a rule for a binaries fingerprint will override a decision for a
+certificate; i.e. you can whitelist a certificate while blacklisting a binary
+signed with that certificate, or vice-versa.
+
+* Path-based rules (via NSRegularExpression/ICU): This allows a similar feature as Managed Client for OS X's (the precursor to configuration profiles, which used the same implementation mechanism) Application Launch Restrictions via the mcxalr binary. This implementation carries the added benefit of being configurable via regex, and doesn't rely on LaunchServices. As detailed in the wiki, when evaluating rules this holds the lowest precendence.
+
+* Failsafe cert rules: You cannot put in a deny rule that would block the certificate used to sign launchd, a.k.a. pid 1, and therefore all components used in macOS. The binaries in every OS update (and in some cases entire new versions) are therefore auto-whitelisted. This does not affect binaries from Apple's App Store, which use various certs that change regularly for common apps. Likewise, you cannot blacklist Santa itself, and Santa uses a distinct separate cert than other Google apps.
+
+Intentions and Expectations
+===========================
+No single system or process will stop *all* attacks, or provide 100% security.
+Santa is written with the intention of helping protect users from themselves.
+People often download malware and trust it, giving the malware credentials, or
+allowing unknown software to exfiltrate more data about your system. As a
+centrally managed component, Santa can help stop the spread of malware among a
+larger fleet of machines. Independently, Santa can aid in analyzing what is
+running on your computer.
+
+Santa is part of a defense-in-depth strategy, and you should continue to protect
+hosts in whatever other ways you see fit.
+
+Get Help
+========
+
+If you have questions or otherwise need help getting started, the
+[santa-dev](https://groups.google.com/forum/#!forum/santa-dev) group is a
+great place. Please consult the [wiki](https://github.com/google/santa/wiki) and [issues](https://github.com/google/santa/issues) as well.
+
+Security and Performance-Related Features
+============
 * In-kernel caching: whitelisted binaries are cached in the kernel so the
 processing required to make a request is only done if the binary
 isn't already cached.
@@ -38,37 +72,28 @@ daemon, the GUI agent and the command-line utility) communicate with each other
 using XPC and check that their signing certificates are identical before any
 communication is accepted.
 
-* Event logging: all executions processed by the userland agent are logged and
-all unknown or denied binaries are also stored in the database for upload to a
-server.
-
 * Kext uses only KPIs: the kernel extension only uses provided kernel
 programming interfaces to do its job. This means that the kext code should
 continue to work across OS versions.
 
 Known Issues
 ============
-
 Santa is not yet a 1.0 and we have some known issues to be aware of:
 
-* Potential race-condition: we currently have a single TODO in the kext code to
-investigate a potential race condition where a binary is executed and then very
-quickly modified between the kext getting the SHA-1 and the decision being made.
+* Santa only blocks execution (execve and variants), it doesn't protect against
+dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or
+libraries loaded using `DYLD_INSERT_LIBRARIES`. As of version 0.9.1 we *do* address [__PAGEZERO missing issues](b87482e) that were exploited in some versions of macOS. We are working on also protecting against similar avenues of attack.
 
 * Kext communication security: the kext will only accept a connection from a
 single client at a time and said client must be running as root. We haven't yet
-found a good way to ensure the kext only accepts connections from a valid client,
-short of hardcoding the SHA-1 in the kext. This shouldn't present a huge problem
-as the daemon is loaded on boot-up by launchd, so any later attempts to connect
-will be blocked.
+found a good way to ensure the kext only accepts connections from a valid client.
 
 * Database protection: the SQLite database is installed with permissions so that
 only the root user can read/write it. We're considering approaches to secure
 this further.
 
-* Sync client: the command-line client includes a command to synchronize with a
-management server, including the uploading of events that have occurred on the
-machine and to download new rules. We're still very heavily working on this
+* Sync client: The `santactl` command-line client includes a flag to synchronize with a management server, which uploads events that have occurred on the
+machine and downloads new rules. We're still very heavily working on this
 server (which is AppEngine-based and will be open-sourced in the future), so the
 sync client code is unfinished. It does show the 'API' that we're expecting to
 use so if you'd like to write your own management server, feel free to look at
@@ -81,12 +106,23 @@ of temporary generated scripts, which we can't possibly whitelist and not doing
 so would cause problems. We're happy to revisit this (or at least make it an
 option) if it would be useful to others.
 
-* Documentation: There currently isn't any.
+* Documentation: This is currently limited.
 
 * Tests: There aren't enough of them.
 
+Screenshots
+===========
+
+A tool like Santa doesn't really lend itself to screenshots, so here's a video instead.
+
+<p align="center">
+<img src="https://zippy.gfycat.com/MadFatalAmphiuma.gif" alt="Santa Block Video" />
+</p>
+
 Building
 ========
+Firstly, make sure you're using Xcode 7.3.1 as currently we do not support
+building with Xcode 8.
 
 ```sh
 git clone https://github.com/google/santa
@@ -105,12 +141,10 @@ and for security-reasons parts of Santa will not operate properly if not signed.
 
 Kext Signing
 ============
-
-10.9 requires a special Developer ID certificate to sign kernel extensions and
-if the kext is not signed with one of these special certificates a warning will
-be shown when loading the kext for the first time. In 10.10 this is a hard error
-and the kext will not load at all unless the machine is booted with a debug
-boot-arg.
+Kernel extensions on macOS 10.9 and later must be signed using an Apple-provided
+Developer ID certificate with a kernel extension flag. Without it, the only way
+to load an extension is to enable kext-dev-mode or disable SIP, depending on the
+OS version.
 
 There are two possible solutions for this, for distribution purposes:
 
@@ -125,17 +159,11 @@ and distribute a new version of the pre-signed kext.
 Apple will only grant this for broad distribution within an organization, they
 won't issue them just for testing purposes.
 
-If you just want to locally test changes to the kext code, you should enable
-kext-dev mode, instructions for which can be found on the Apple developer site.
-
-
 Contributing
 ============
-
 Patches to this project are very much welcome. Please see the [CONTRIBUTING](https://github.com/google/santa/blob/master/CONTRIBUTING.md)
 file.
 
 Disclaimer
 ==========
-
 This is **not** an official Google product.

Rakefile

@@ -1,68 +1,72 @@
-require 'timeout'
+require 'openssl'
 
-WORKSPACE       = 'Santa.xcworkspace'
-DEFAULT_SCHEME  = 'All'
-OUTPUT_PATH     = 'Build'
-DIST_PATH       = 'Dist'
-BINARIES        = ['Santa.app', 'santa-driver.kext', 'santad', 'santactl']
-PLISTS          = ['Source/SantaGUI/Resources/Santa-Info.plist',
-                   'Source/santad/Resources/santad-Info.plist',
-                   'Source/santa-driver/Resources/santa-driver-Info.plist',
-                   'Source/santactl/Resources/santactl-Info.plist']
-XCODE_DEFAULTS  = "-workspace #{WORKSPACE} -scheme #{DEFAULT_SCHEME} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"
+WORKSPACE           = 'Santa.xcworkspace'
+DEFAULT_SCHEME      = 'All'
+OUTPUT_PATH         = 'Build'
+BINARIES            = ['Santa.app', 'santa-driver.kext']
+DSYMS               = ['Santa.app.dSYM', 'santa-driver.kext.dSYM', 'santad.dSYM', 'santactl.dSYM']
+XCPRETTY_DEFAULTS   = '-sc'
+XCODEBUILD_DEFAULTS = "-workspace #{WORKSPACE} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"
+DEVTEAM_FILE        = 'Source/DevelopmentTeam.xcconfig'
+DEVTEAM_CERT_CN     = 'Mac Developer'
+$DISABLE_XCPRETTY   = false
 
 task :default do
   system("rake -sT")
 end
 
-def run_and_output_on_fail(cmd)
-  output=`#{cmd} 2>&1`
-  if not $?.success?
-    raise output
+def xcodebuild(opts)
+  command = "xcodebuild #{XCODEBUILD_DEFAULTS} #{opts}"
+  if not $DISABLE_XCPRETTY
+    command << " | xcpretty #{XCPRETTY_DEFAULTS} && exit ${PIPESTATUS[0]}"
+  end
+
+  if system command
+    puts "\e[32mPass\e[0m"
+  else
+    raise "\e[31mFail\e[0m"
   end
 end
 
-def run_and_output_with_color(cmd)
-  output=`#{cmd} 2>&1`
-
-  has_output = false
-  output.scan(/((Test Suite|Test Case|Executed).*)$/) do |match|
-    has_output = true
-    out = match[0]
-    if out.include?("passed")
-      puts "\e[32m#{out}\e[0m"
-    elsif out.include?("failed")
-      puts "\e[31m#{out}\e[0m"
-    else
-      puts out
+def xcodebuilddir
+  if not $xcode_build_dir
+    output = `xcodebuild #{XCODEBUILD_DEFAULTS} -scheme All -showBuildSettings`
+    if match = output.match(/BUILD_DIR = (.*)/)
+        $xcode_build_dir = match.captures.first
+        puts "Found Xcode build dir #{$xcode_build_dir}"
     end
   end
-
-  if not has_output
-    raise output
-  end
+  $xcode_build_dir
 end
 
 task :init do
   unless File.exists?(WORKSPACE) and File.exists?('Pods')
-    puts "Workspace is missing, running 'pod install'"
+    puts "Pods missing, running 'pod install'"
     system "pod install" or raise "CocoaPods is not installed. Install with 'sudo gem install cocoapods'"
   end
+  unless system 'xcpretty -v >/dev/null 2>&1'
+    puts "xcpretty is not installed. Install with 'sudo gem install xcpretty'"
+    $DISABLE_XCPRETTY = true
+  end
+  cert_pem = `security find-certificate -p -c '#{DEVTEAM_CERT_CN}'`
+  cert = OpenSSL::X509::Certificate.new cert_pem
+  team_id = cert.subject.to_a.find {|f| f[0] == "OU"}[1]
+  File.open(DEVTEAM_FILE, 'w') { |f|
+    f.puts("// This file is auto-generated. Do not edit manually")
+    f.puts("DEVELOPMENT_TEAM = #{team_id}")
+  }
 end
 
 task :remove_existing do
-  system 'sudo rm -rf /santa-driver.kext'
+  system 'sudo rm -rf /Library/Extensions/santa-driver.kext'
   system 'sudo rm -rf /Applications/Santa.app'
-  system 'sudo rm /usr/libexec/santad'
-  system 'sudo rm /usr/sbin/santactl'
 end
 
 desc "Clean"
 task :clean => :init do
   puts "Cleaning"
-  run_and_output_on_fail("xcodebuild #{XCODE_DEFAULTS} clean")
   FileUtils.rm_rf(OUTPUT_PATH)
-  FileUtils.rm_rf(DIST_PATH)
+  xcodebuild("-scheme All clean")
 end
 
 # Build
@@ -80,7 +84,7 @@ namespace :build do
   task :build, [:configuration] => :init do |t, args|
     config = args[:configuration]
     puts "Building with configuration: #{config}"
-    run_and_output_on_fail("xcodebuild #{XCODE_DEFAULTS} -configuration #{config} build")
+    xcodebuild("-scheme All -configuration #{config} build")
   end
 end
 
@@ -100,16 +104,14 @@ namespace :install do
   task :install, [:configuration] do |t, args|
     config = args[:configuration]
     system 'sudo cp conf/com.google.santad.plist /Library/LaunchDaemons'
-    system 'sudo cp conf/com.google.santasync.plist /Library/LaunchDaemons'
     system 'sudo cp conf/com.google.santagui.plist /Library/LaunchAgents'
     system 'sudo cp conf/com.google.santa.asl.conf /etc/asl'
+    system '/usr/bin/killall -HUP syslogd'
     Rake::Task['build:build'].invoke(config)
     puts "Installing with configuration: #{config}"
     Rake::Task['remove_existing'].invoke()
-    system "sudo cp -r #{OUTPUT_PATH}/Products/#{config}/santa-driver.kext /"
-    system "sudo cp -r #{OUTPUT_PATH}/Products/#{config}/Santa.app /Applications"
-    system "sudo cp #{OUTPUT_PATH}/Products/#{config}/santad /usr/libexec"
-    system "sudo cp #{OUTPUT_PATH}/Products/#{config}/santactl /usr/sbin"
+    system "sudo cp -r #{xcodebuilddir}/#{config}/santa-driver.kext /Library/Extensions"
+    system "sudo cp -r #{xcodebuilddir}/#{config}/Santa.app /Applications"
   end
 end
 
@@ -117,22 +119,29 @@ end
 task :dist do
   desc "Create distribution folder"
 
+  Rake::Task['clean'].invoke()
   Rake::Task['build:build'].invoke("Release")
 
-  FileUtils.rm_rf(DIST_PATH)
+  dist_path = "santa-#{`defaults read #{xcodebuilddir}/Release/santa-driver.kext/Contents/Info.plist CFBundleVersion`.strip}"
 
-  FileUtils.mkdir_p("#{DIST_PATH}/binaries")
-  FileUtils.mkdir_p("#{DIST_PATH}/conf")
-  FileUtils.mkdir_p("#{DIST_PATH}/dsym")
+  FileUtils.rm_rf(dist_path)
+
+  FileUtils.mkdir_p("#{dist_path}/binaries")
+  FileUtils.mkdir_p("#{dist_path}/conf")
+  FileUtils.mkdir_p("#{dist_path}/dsym")
 
   BINARIES.each do |x|
-    FileUtils.cp_r("#{OUTPUT_PATH}/Products/Release/#{x}", "#{DIST_PATH}/binaries")
-    FileUtils.cp_r("#{OUTPUT_PATH}/Products/Release/#{x}.dSYM", "#{DIST_PATH}/dsym")
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/binaries")
   end
 
-  Dir.glob("Conf/*") {|x| FileUtils.cp(x, "#{DIST_PATH}/conf")}
+  DSYMS.each do |x|
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/dsym")
+  end
 
-  puts "Distribution folder created"
+
+  Dir.glob("Conf/*") {|x| File.directory?(x) or FileUtils.cp(x, "#{dist_path}/conf")}
+
+  puts "Distribution folder #{dist_path} created"
 end
 
 # Tests
@@ -140,7 +149,7 @@ namespace :tests do
   desc "Tests: Logic"
   task :logic => [:init] do
     puts "Running logic tests"
-    run_and_output_with_color("xcodebuild #{XCODE_DEFAULTS} test")
+    xcodebuild("-scheme LogicTests test")
   end
 
   desc "Tests: Kernel"
@@ -148,16 +157,17 @@ namespace :tests do
     Rake::Task['unload'].invoke()
     Rake::Task['install:debug'].invoke()
     Rake::Task['load_kext'].invoke
-    timeout = 30
-    puts "Running kernel tests with a #{timeout} second timeout"
+    FileUtils.mkdir_p("/tmp/santa_kerneltests_tmp")
     begin
-      Timeout::timeout(timeout) {
-        system "sudo #{OUTPUT_PATH}/Products/Debug/KernelTests"
-      }
-    rescue Timeout::Error
-      puts "ERROR: tests ran for longer than #{timeout} seconds and were killed."
+      puts "\033[?25l\033[12h"  # hide cursor
+      puts "Running kernel tests"
+      system "cd /tmp/santa_kerneltests_tmp && sudo #{xcodebuilddir}/Debug/KernelTests"
+    rescue Exception
+    ensure
+      puts "\033[?25h\033[12l\n\n"  # unhide cursor
+      FileUtils.rm_rf("/tmp/santa_kerneltests_tmp")
+      Rake::Task['unload_kext'].execute
     end
-    Rake::Task['unload_kext'].execute
   end
 end
 
@@ -169,12 +179,12 @@ end
 
 task :unload_kext do
   puts "Unloading kernel extension"
-  system "sudo kextunload /santa-driver.kext 2>/dev/null"
+  system "sudo kextunload -b com.google.santa-driver 2>/dev/null"
 end
 
 task :unload_gui do
   puts "Unloading GUI agent"
-  system "sudo killall Santa 2>/dev/null"
+  system "launchctl unload /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
 end
 
 desc "Unload"
@@ -187,12 +197,12 @@ end
 
 task :load_kext do
   puts "Loading kernel extension"
-  system "sudo kextload /santa-driver.kext"
+  system "sudo kextload /Library/Extensions/santa-driver.kext"
 end
 
 task :load_gui do
   puts "Loading GUI agent"
-  system "open /Applications/Santa.app"
+  system "launchctl load /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
 end
 
 desc "Load"
@@ -213,23 +223,3 @@ namespace :reload do
     Rake::Task['load'].invoke()
   end
 end
-
-# Versioning
-desc "Update version, version should be of the form rake version[\\d{1,4}.\\d{1,2}(?:.\\d{1,2})?]"
-task :version, :version do |t, args|
-  response = args[:version]
-
-  unless response =~ /^\d{1,4}\.\d{1,2}(?:\.\d{1,2})?$/
-    raise "Version number must be of form: xxxx.xx[.xx]. E.g: rake version[1.0.2], rake version[1.7]"
-  end
-
-  system "sed -i -e 's/MODULE_VERSION = .*;/MODULE_VERSION = #{response};/g' Santa.xcodeproj/project.pbxproj"
-
-  PLISTS.each do |plist|
-    system "defaults write $PWD/#{plist} CFBundleVersion #{response}"
-    system "defaults write $PWD/#{plist} CFBundleShortVersionString #{response}"
-    system "plutil -convert xml1 $PWD/#{plist}"
-  end
-
-  puts "Updated version to #{response}"
-end

Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0510"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,10 +23,12 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      codeCoverageEnabled = "YES"
+      enableAddressSanitizer = "YES">
       <Testables>
          <TestableReference
             skipped = "NO">
@@ -39,24 +41,36 @@
             </BuildableReference>
          </TestableReference>
       </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D91BCDC174E8AE600131A7D"
+            BuildableName = "All"
+            BlueprintName = "All"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
       <AdditionalOptions>
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
    </ProfileAction>
    <AnalyzeAction

Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0600"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
       <Testables>
       </Testables>
       <MacroExpansion>
@@ -38,17 +38,21 @@
             ReferencedContainer = "container:Santa.xcodeproj">
          </BuildableReference>
       </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
@@ -61,12 +65,13 @@
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"

Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme

@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "NO"
+            buildForArchiving = "NO"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+               BuildableName = "LogicTests.xctest"
+               BlueprintName = "LogicTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+               BuildableName = "LogicTests.xctest"
+               BlueprintName = "LogicTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0510"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
       <Testables>
       </Testables>
       <MacroExpansion>
@@ -38,17 +38,21 @@
             ReferencedContainer = "container:Santa.xcodeproj">
          </BuildableReference>
       </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
@@ -61,12 +65,13 @@
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D385DB5180DE4A900418BC6"

Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0510"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,30 +23,42 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
       <Testables>
       </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D91BCB3174E8A7E00131A7D"
+            BuildableName = "santa-driver.kext"
+            BlueprintName = "santa-driver"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
       <AdditionalOptions>
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
    </ProfileAction>
    <AnalyzeAction

Santa.xcodeproj/xcshareddata/xcschemes/santabs.xcscheme

@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+               BuildableName = "santabs.xpc"
+               BlueprintName = "santabs"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+            BuildableName = "santabs.xpc"
+            BlueprintName = "santabs"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+            BuildableName = "santabs.xpc"
+            BlueprintName = "santabs"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0510"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
       <Testables>
       </Testables>
       <MacroExpansion>
@@ -38,17 +38,21 @@
             ReferencedContainer = "container:Santa.xcodeproj">
          </BuildableReference>
       </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
@@ -61,12 +65,13 @@
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"

Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0510"
+   LastUpgradeVersion = "0730"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
       </BuildActionEntries>
    </BuildAction>
    <TestAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
       <Testables>
       </Testables>
       <MacroExpansion>
@@ -38,17 +38,22 @@
             ReferencedContainer = "container:Santa.xcodeproj">
          </BuildableReference>
       </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
    </TestAction>
    <LaunchAction
+      buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      debugAsWhichUser = "root"
       launchStyle = "0"
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
       ignoresPersistentStateOnLaunch = "NO"
       debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
       allowLocationSimulation = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
@@ -61,12 +66,13 @@
       </AdditionalOptions>
    </LaunchAction>
    <ProfileAction
+      buildConfiguration = "Release"
       shouldUseLaunchSchemeArgsEnv = "YES"
       savedToolIdentifier = ""
       useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
       debugDocumentVersioning = "YES">
-      <BuildableProductRunnable>
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
          <BuildableReference
             BuildableIdentifier = "primary"
             BlueprintIdentifier = "0D9A7F3C1759330400035EB5"

Source/SantaGUI/Resources/AboutWindow.xib

@@ -1,21 +1,22 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="6250" systemVersion="13F34" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="16D32" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
     <dependencies>
         <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="6250"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="10117"/>
     </dependencies>
     <objects>
         <customObject id="-2" userLabel="File's Owner" customClass="SNTAboutWindowController">
             <connections>
+                <outlet property="moreInfoButton" destination="SRu-Kf-vu5" id="Vj2-9Q-05d"/>
                 <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
             </connections>
         </customObject>
         <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
         <customObject id="-3" userLabel="Application" customClass="NSObject"/>
         <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
-            <windowStyleMask key="styleMask" titled="YES"/>
+            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
             <rect key="contentRect" x="196" y="240" width="480" height="200"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1578"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
             <view key="contentView" id="se5-gp-TjO">
                 <rect key="frame" x="0.0" y="0.0" width="480" height="200"/>
                 <autoresizingMask key="autoresizingMask"/>
@@ -36,32 +37,51 @@
                         <rect key="frame" x="18" y="65" width="444" height="60"/>
                         <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="center" id="CcT-ul-1eA">
                             <font key="font" metaFont="system"/>
-                            <string key="title">Santa is a binary whitelisting system for Mac OS X.
+                            <string key="title">Santa is an application whitelisting system for macOS.
 
 There are no user-configurable settings.</string>
                             <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
                             <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
                         </textFieldCell>
                     </textField>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Udo-BY-n7e">
-                        <rect key="frame" x="196" y="21" width="88" height="32"/>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="SRu-Kf-vu5">
+                        <rect key="frame" x="130" y="21" width="111" height="32"/>
                         <constraints>
-                            <constraint firstAttribute="width" constant="76" id="2Xc-ax-2bV"/>
+                            <constraint firstAttribute="width" constant="99" id="JHv-2J-QSe"/>
                         </constraints>
-                        <buttonCell key="cell" type="push" title="OK" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="uSw-o1-lWW">
+                        <buttonCell key="cell" type="push" title="More Info..." bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="6fe-ju-aET">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                         </buttonCell>
+                        <connections>
+                            <action selector="openMoreInfoURL:" target="-2" id="dps-TN-rkS"/>
+                        </connections>
+                    </button>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Udo-BY-n7e">
+                        <rect key="frame" x="240" y="21" width="111" height="32"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="99" id="2Xc-ax-2bV"/>
+                        </constraints>
+                        <buttonCell key="cell" type="push" title="Dismiss" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="uSw-o1-lWW">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                        </buttonCell>
                         <connections>
                             <action selector="orderOut:" target="-1" id="6oW-zI-zn5"/>
                         </connections>
                     </button>
                 </subviews>
                 <constraints>
+                    <constraint firstItem="Udo-BY-n7e" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" priority="900" constant="191" id="1T4-DB-Dz8"/>
+                    <constraint firstItem="SRu-Kf-vu5" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="136" id="Ake-nU-qhW"/>
                     <constraint firstItem="BnL-ZS-kXw" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="20" symbolic="YES" id="Fj1-SG-mzF"/>
                     <constraint firstAttribute="bottom" secondItem="Udo-BY-n7e" secondAttribute="bottom" constant="28" id="bpF-hC-haN"/>
-                    <constraint firstItem="BnL-ZS-kXw" firstAttribute="centerX" secondItem="Udo-BY-n7e" secondAttribute="centerX" constant="0.5" id="csK-2p-W94"/>
+                    <constraint firstAttribute="bottom" secondItem="SRu-Kf-vu5" secondAttribute="bottom" constant="28" id="fCB-02-SEt"/>
                     <constraint firstItem="BnL-ZS-kXw" firstAttribute="centerX" secondItem="se5-gp-TjO" secondAttribute="centerX" id="kez-S0-6Gg"/>
+                    <constraint firstItem="Udo-BY-n7e" firstAttribute="leading" secondItem="SRu-Kf-vu5" secondAttribute="trailing" constant="11" id="sYO-yY-w9w"/>
                 </constraints>
             </view>
             <connections>

Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/Contents.json

@@ -31,25 +31,25 @@
       "scale" : "1x"
     },
     {
-      "idiom" : "mac",
       "size" : "128x128",
+      "idiom" : "mac",
+      "filename" : "santa-hat-icon-256.png",
       "scale" : "2x"
     },
     {
-      "idiom" : "mac",
       "size" : "256x256",
+      "idiom" : "mac",
+      "filename" : "santa-hat-icon-256.png",
       "scale" : "1x"
     },
     {
-      "size" : "256x256",
       "idiom" : "mac",
-      "filename" : "santa-hat-icon-512.png",
+      "size" : "256x256",
       "scale" : "2x"
     },
     {
-      "size" : "512x512",
       "idiom" : "mac",
-      "filename" : "santa-hat-icon-512.png",
+      "size" : "512x512",
       "scale" : "1x"
     },
     {
@@ -62,4 +62,4 @@
     "version" : 1,
     "author" : "xcode"
   }
-}
+}

Source/SantaGUI/Resources/Images.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  }
+}

Source/SantaGUI/Resources/MessageWindow.xib

@@ -1,141 +1,309 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="6250" systemVersion="14B25" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="16E195" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
     <dependencies>
         <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="6250"/>
+        <development version="6300" identifier="xcode"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="10117"/>
     </dependencies>
     <objects>
         <customObject id="-2" userLabel="File's Owner" customClass="SNTMessageWindowController">
             <connections>
+                <outlet property="applicationNameLabel" destination="qgf-Jf-cJr" id="1JX-X8-03v"/>
+                <outlet property="bundleHashLabel" destination="xP7-jE-NF8" id="i8B-Gs-2E3"/>
+                <outlet property="foundFileCountLabel" destination="LHV-gV-vyf" id="Sr0-T2-xGx"/>
+                <outlet property="hashingIndicator" destination="VyY-Yg-JOe" id="Yq4-tZ-9ep"/>
+                <outlet property="openEventButton" destination="7ua-5a-uSd" id="9s4-ZA-Vlo"/>
                 <outlet property="window" destination="9Bq-yh-54f" id="Uhs-WF-TV9"/>
             </connections>
         </customObject>
         <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
         <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
             <windowStyleMask key="styleMask" utility="YES"/>
-            <rect key="contentRect" x="167" y="107" width="550" height="275"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1577"/>
+            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
             <view key="contentView" id="Iwq-Lx-rLv">
-                <rect key="frame" x="0.0" y="0.0" width="550" height="275"/>
+                <rect key="frame" x="0.0" y="0.0" width="540" height="479"/>
                 <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                 <subviews>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
-                        <rect key="frame" x="234" y="210" width="83" height="40"/>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="40" id="KoG-v6-GfK"/>
-                            <constraint firstAttribute="width" constant="79" id="oS3-CE-1vv"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
-                            <font key="font" size="34" name="HelveticaNeue-UltraLight"/>
-                            <color key="textColor" red="0.18696189413265307" green="0.18696189413265307" blue="0.18696189413265307" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR">
-                        <rect key="frame" x="23" y="168" width="504" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="500" id="q9O-xW-hnS"/>
-                        </constraints>
-                        <textFieldCell key="cell" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="A message to the user goes here..." allowsEditingTextAttributes="YES" id="5tH-bG-UJA">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.attributedCustomMessage" id="NH1-gV-Cor">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">The following application has been blocked from executing because its trustworthiness cannot be determined.</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <imageView horizontalHuggingPriority="1000" verticalHuggingPriority="1000" horizontalCompressionResistancePriority="1000" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="GYD-v8-fqH">
-                        <rect key="frame" x="31" y="91" width="32" height="32"/>
-                        <imageCell key="cell" refusesFirstResponder="YES" alignment="left" imageScaling="proportionallyDown" image="NSBonjour" id="jKM-qY-7mp"/>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.bundleIcon" id="X4L-aD-P21">
-                                <dictionary key="options">
-                                    <bool key="NSConditionallySetsEnabled" value="NO"/>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </imageView>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H">
-                        <rect key="frame" x="111" y="126" width="34" height="17"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Path" id="KgY-X1-ESG">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <textField horizontalHuggingPriority="1000" verticalHuggingPriority="1000" horizontalCompressionResistancePriority="1000" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ">
-                        <rect key="frame" x="154" y="126" width="350" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="346" id="BYY-2q-Lmb"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="E7T-9h-ofr">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" white="0.0" alpha="0.5" colorSpace="deviceWhite"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.path" id="4Nh-Ue-aCb"/>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y">
-                        <rect key="frame" x="96" y="99" width="46" height="17"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="SHA-1" id="eKN-Ic-5zy">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
-                        <rect key="frame" x="155" y="99" width="88" height="17"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Binary SHA-1" id="X4W-9e-eIu">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" white="0.0" alpha="0.5" colorSpace="deviceWhite"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.SHA1" id="KuE-WW-9av"/>
-                        </connections>
-                    </textField>
-                    <textField verticalHuggingPriority="750" verticalCompressionResistancePriority="499" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5">
-                        <rect key="frame" x="78" y="72" width="66" height="17"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Publisher" id="yL9-yD-JXX">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS">
-                        <rect key="frame" x="322" y="75" width="10" height="10"/>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="10" id="c3b-iv-bWa"/>
-                            <constraint firstAttribute="width" constant="10" id="fXl-na-Lwx"/>
-                        </constraints>
-                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSFollowLinkFreestandingTemplate" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
+                    <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
+                        <rect key="frame" x="16" y="451" width="37" height="32"/>
+                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </buttonCell>
+                        <connections>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="vl5-A8-O0H"/>
+                        </connections>
+                    </button>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
+                        <rect key="frame" x="228" y="408" width="85" height="41"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
+                            <font key="font" metaFont="systemUltraLight" size="34"/>
+                            <color key="textColor" red="0.20000000000000001" green="0.20000000000000001" blue="0.20000000000000001" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="z5y-RR-IEH"/>
+                        </connections>
+                    </textField>
+                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="43" y="369" width="454" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" refusesFirstResponder="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="A message to the user goes here..." allowsEditingTextAttributes="YES" id="5tH-bG-UJA">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.attributedCustomMessage" id="376-sj-4Q1"/>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="VC7-bE-uHc"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="297" width="142" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="Kqd-nX-7df"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Filename" id="KgY-X1-ESG">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="272" width="142" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="3wU-P0-gAC"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Path" id="adC-be-Beh">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Binary Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="297" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="xVR-j3-dLw"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Name" id="E7T-9h-ofr">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.filePath.lastPathComponent" id="bOu-gv-1Vh"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5" userLabel="Label: Publisher">
+                        <rect key="frame" x="8" y="247" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Publisher" id="yL9-yD-JXX">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Publisher" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w" userLabel="Publisher" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="247" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="Dem-wH-KHm"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.publisherInfo" id="CEI-Cu-7pC">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Not code-signed</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
+                        <rect key="frame" x="62" y="248" width="15" height="15"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
+                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
+                        </constraints>
+                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSInfo" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
                         </buttonCell>
                         <connections>
                             <action selector="showCertInfo:" target="-2" id="dB0-a3-X31"/>
-                            <binding destination="-2" name="hidden" keyPath="self.binaryCert" id="xpJ-jl-aUN">
+                            <binding destination="-2" name="hidden" keyPath="self.publisherInfo" id="fFR-f3-Oiw">
                                 <dictionary key="options">
                                     <string key="NSValueTransformerName">NSIsNil</string>
                                 </dictionary>
                             </binding>
                         </connections>
                     </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL">
-                        <rect key="frame" x="220" y="23" width="110" height="25"/>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y" userLabel="Label: Identifier">
+                        <rect key="frame" x="8" y="222" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Identifier" id="eKN-Ic-5zy">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
+                        <rect key="frame" x="187" y="222" width="219" height="17"/>
                         <constraints>
-                            <constraint firstAttribute="width" constant="110" id="HdL-6x-X4f"/>
-                            <constraint firstAttribute="height" constant="22" id="YYm-GI-ojT"/>
+                            <constraint firstAttribute="width" constant="215" id="4hh-R2-86s"/>
                         </constraints>
-                        <buttonCell key="cell" type="roundTextured" title="OK" bezelStyle="texturedRounded" alignment="center" refusesFirstResponder="YES" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
+                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="SHA-256" id="X4W-9e-eIu">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.fileSHA256" id="9KB-0b-qLV"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="MhO-U0-MLR" userLabel="Label: Bundle Identifier">
+                        <rect key="frame" x="8" y="197" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Bundle Identifier" id="LEe-u0-52o">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="hidden" keyPath="self.event.needsBundleHash" id="2kb-3z-Kyn">
+                                <dictionary key="options">
+                                    <string key="NSValueTransformerName">NSNegateBoolean</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="eQb-0a-76J" userLabel="Label: Parent">
+                        <rect key="frame" x="8" y="157" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Parent" id="gze-4A-1w5">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Parent Process" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="f1p-GL-O3o" userLabel="Parent" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="157" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="h3Y-mO-38F"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Parent Name" id="ieo-WK-aDD">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="displayPatternValue1" keyPath="self.event.parentName" id="Lce-TO-q9V">
+                                <dictionary key="options">
+                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
+                                </dictionary>
+                            </binding>
+                            <binding destination="-2" name="displayPatternValue2" keyPath="self.event.ppid" previousBinding="Lce-TO-q9V" id="ofI-kH-F2d">
+                                <dictionary key="options">
+                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="oFj-ol-xpL" userLabel="Label: User">
+                        <rect key="frame" x="8" y="132" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="User" id="1ut-uT-hQD">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
+                        <rect key="frame" x="154" y="33" width="112" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
+                        </constraints>
+                        <buttonCell key="cell" type="roundTextured" title="Open Event..." bezelStyle="texturedRounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
+                        </buttonCell>
+                        <connections>
+                            <action selector="openEventDetails:" target="-2" id="VhL-ql-rCV"/>
+                            <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
+                        </connections>
+                    </button>
+                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="272" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="p1W-f9-KBX"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.filePath" id="Sry-KY-HDb"/>
+                        </connections>
+                    </textField>
+                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
+                        <rect key="frame" x="113" y="80" width="315" height="29"/>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                        </constraints>
+                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
+                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
+                            <font key="font" metaFont="smallSystem"/>
+                        </buttonCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
+                        </connections>
+                    </button>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
+                        <rect key="frame" x="278" y="33" width="110" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
+                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
+                        </constraints>
+                        <buttonCell key="cell" type="roundTextured" title="Ignore" bezelStyle="texturedRounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                             <string key="keyEquivalent" base64-UTF8="YES">
@@ -143,60 +311,189 @@ DQ
 </string>
                             <modifierMask key="keyEquivalentModifierMask" shift="YES"/>
                         </buttonCell>
+                        <accessibility description="Dismiss Dialog"/>
                         <connections>
                             <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="4KL-Z2-1op"/>
                         </connections>
                     </button>
-                    <textField horizontalHuggingPriority="750" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w">
-                        <rect key="frame" x="154" y="72" width="159" height="17"/>
+                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="132" width="294" height="17"/>
                         <constraints>
-                            <constraint firstAttribute="height" constant="17" id="re0-7U-qcL"/>
+                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
                         </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
                             <font key="font" metaFont="system"/>
-                            <color key="textColor" white="0.0" alpha="0.5" colorSpace="deviceWhite"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                         </textFieldCell>
                         <connections>
-                            <binding destination="-2" name="value" keyPath="self.binaryCert" id="eFt-oy-SXL">
+                            <binding destination="-2" name="value" keyPath="self.event.executingUser" id="IcM-Lt-xTT">
                                 <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Not code-signed</string>
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <progressIndicator wantsLayer="YES" canDrawConcurrently="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" maxValue="1" bezeled="NO" controlSize="small" style="bar" translatesAutoresizingMaskIntoConstraints="NO" id="VyY-Yg-JOe">
+                        <rect key="frame" x="187" y="199" width="217" height="12"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="217" id="M22-Dv-KIP"/>
+                        </constraints>
+                    </progressIndicator>
+                    <textField toolTip="Bundle SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="xP7-jE-NF8">
+                        <rect key="frame" x="187" y="197" width="219" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="215" id="s7W-o9-2nN"/>
+                        </constraints>
+                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="Calculating..." id="yJa-yL-X9a">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.fileBundleHash" id="CnT-q6-bot"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="LHV-gV-vyf">
+                        <rect key="frame" x="187" y="182" width="219" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="215" id="LUu-Vd-peN"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="1000 related binaries" id="AVM-vB-hB8">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                    </textField>
+                    <box horizontalHuggingPriority="750" title="Line" boxType="custom" borderType="line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
+                        <rect key="frame" x="168" y="132" width="1" height="207"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="1" id="0o1-Jh-epf"/>
+                        </constraints>
+                        <color key="borderColor" white="0.0" alpha="0.17999999999999999" colorSpace="calibratedWhite"/>
+                        <color key="fillColor" white="0.0" alpha="0.0" colorSpace="calibratedWhite"/>
+                        <font key="titleFont" metaFont="system"/>
+                    </box>
+                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="322" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="Pav-ZA-iAu"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.fileBundleName" id="enC-Cl-UWt">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="pDa-fA-vnC" userLabel="Label: Application">
+                        <rect key="frame" x="8" y="322" width="142" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="8mA-zi-Ev7"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Application" id="Hy7-WF-6xW">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="hidden" keyPath="self.event.fileBundleName" id="r2Q-hh-Uy5">
+                                <dictionary key="options">
+                                    <string key="NSValueTransformerName">NSIsNil</string>
                                 </dictionary>
                             </binding>
                         </connections>
                     </textField>
                 </subviews>
                 <constraints>
-                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="113" id="3oY-g4-wHW"/>
-                    <constraint firstItem="BbV-3h-mmL" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" priority="800" constant="52" id="42Z-62-hKo"/>
-                    <constraint firstItem="cD5-Su-lXR" firstAttribute="top" secondItem="t8c-Fx-e5h" secondAttribute="bottom" constant="25" id="4Hn-vu-fva"/>
-                    <constraint firstItem="C3G-wL-u7w" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="10" id="7Pr-bA-HgG"/>
-                    <constraint firstItem="PXc-xv-A28" firstAttribute="top" secondItem="pc8-G9-4pJ" secondAttribute="bottom" constant="10" id="8LX-e8-bKv"/>
-                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="d9e-Wv-Y5H" secondAttribute="top" id="94E-d6-Jrg"/>
-                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="leading" secondItem="d9e-Wv-Y5H" secondAttribute="trailing" constant="13" id="A6N-gA-dt5"/>
-                    <constraint firstItem="KEB-eH-x2Y" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="98" id="CYj-Gm-XZp"/>
-                    <constraint firstItem="PXc-xv-A28" firstAttribute="leading" secondItem="KEB-eH-x2Y" secondAttribute="trailing" constant="17" id="IGi-bx-nBP"/>
-                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="80" id="O3p-RO-0ZJ"/>
-                    <constraint firstItem="C3G-wL-u7w" firstAttribute="centerY" secondItem="cJf-k6-OxS" secondAttribute="centerY" constant="-1" id="R0U-iV-5Fx"/>
-                    <constraint firstAttribute="centerX" secondItem="t8c-Fx-e5h" secondAttribute="centerX" id="SHu-BF-01V"/>
-                    <constraint firstAttribute="centerX" secondItem="BbV-3h-mmL" secondAttribute="centerX" id="UAx-Xk-9DE"/>
-                    <constraint firstItem="KEB-eH-x2Y" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="top" id="YiW-o8-HZ2"/>
-                    <constraint firstItem="BbV-3h-mmL" firstAttribute="top" secondItem="C3G-wL-u7w" secondAttribute="bottom" constant="25" id="Zxm-Pa-Ryj"/>
-                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="top" secondItem="C3G-wL-u7w" secondAttribute="top" id="adm-oT-FAf"/>
-                    <constraint firstAttribute="bottom" secondItem="BbV-3h-mmL" secondAttribute="bottom" constant="25" id="awW-Dh-Xl4"/>
-                    <constraint firstItem="GYD-v8-fqH" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="31" id="btT-jY-NXw"/>
-                    <constraint firstItem="GYD-v8-fqH" firstAttribute="centerY" secondItem="KEB-eH-x2Y" secondAttribute="centerY" id="cOS-EE-Mw8"/>
-                    <constraint firstItem="C3G-wL-u7w" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="trailing" constant="14" id="ewf-Pg-nRK"/>
-                    <constraint firstAttribute="centerX" secondItem="cD5-Su-lXR" secondAttribute="centerX" id="goV-ub-zwi"/>
-                    <constraint firstItem="t8c-Fx-e5h" firstAttribute="top" secondItem="Iwq-Lx-rLv" secondAttribute="top" constant="25" id="mY6-FP-uEK"/>
-                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" constant="25" id="pfg-1u-Yfj"/>
-                    <constraint firstItem="cJf-k6-OxS" firstAttribute="leading" secondItem="C3G-wL-u7w" secondAttribute="trailing" constant="11" id="sMW-KK-A28"/>
+                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="0AD-PS-5V1"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="centerY" secondItem="eQb-0a-76J" secondAttribute="centerY" id="2Aq-1E-Ybz"/>
+                    <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" priority="500" constant="193" id="2uo-Cm-Tfp"/>
+                    <constraint firstItem="h6f-PY-cc0" firstAttribute="top" secondItem="f1p-GL-O3o" secondAttribute="bottom" constant="8" id="496-VQ-Fx5"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="5Mr-By-PAU"/>
+                    <constraint firstItem="pDa-fA-vnC" firstAttribute="centerY" secondItem="qgf-Jf-cJr" secondAttribute="centerY" id="AKX-pe-hEX"/>
+                    <constraint firstItem="C3G-wL-u7w" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="ALv-0v-szi"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="FPe-Rd-G4n"/>
+                    <constraint firstItem="cJf-k6-OxS" firstAttribute="centerY" secondItem="C3G-wL-u7w" secondAttribute="centerY" id="FdL-ZZ-Vbe"/>
+                    <constraint firstItem="t8c-Fx-e5h" firstAttribute="top" secondItem="Iwq-Lx-rLv" secondAttribute="top" constant="30" id="FuB-GX-0jg"/>
+                    <constraint firstItem="oFj-ol-xpL" firstAttribute="bottom" secondItem="4Li-ul-zIi" secondAttribute="bottom" id="G0I-O2-S91"/>
+                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="cJf-k6-OxS" secondAttribute="trailing" constant="-67" id="GD2-Ka-deo"/>
+                    <constraint firstItem="BbV-3h-mmL" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="GT2-tO-2td"/>
+                    <constraint firstItem="h6f-PY-cc0" firstAttribute="centerY" secondItem="oFj-ol-xpL" secondAttribute="centerY" id="GXI-pT-FM1"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="top" secondItem="pDa-fA-vnC" secondAttribute="top" id="Gd4-Nr-n5G"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="8" id="HUT-MI-jsR"/>
+                    <constraint firstItem="qgf-Jf-cJr" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="Ht4-Lg-U5N"/>
+                    <constraint firstItem="LHV-gV-vyf" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="IA0-dy-2be"/>
+                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="IwX-ja-ZIs"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="top" secondItem="4Li-ul-zIi" secondAttribute="top" priority="500" id="JY4-N1-j8e"/>
+                    <constraint firstItem="YNz-ka-cBi" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="KmX-kX-VCN"/>
+                    <constraint firstItem="5D8-GP-a4l" firstAttribute="centerX" secondItem="Iwq-Lx-rLv" secondAttribute="centerX" id="LkH-F4-Ncm"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="55" id="Nsl-zf-poH"/>
+                    <constraint firstItem="YNz-ka-cBi" firstAttribute="centerY" secondItem="bDE-Tl-UHg" secondAttribute="centerY" id="ObQ-RA-S5V"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="SCl-Ky-VmT"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="centerY" secondItem="pc8-G9-4pJ" secondAttribute="centerY" id="SLv-F7-w5k"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="KEB-eH-x2Y" secondAttribute="trailing" constant="20" id="Seb-c0-MUL"/>
+                    <constraint firstAttribute="centerX" secondItem="cD5-Su-lXR" secondAttribute="centerX" id="V0a-Py-iEc"/>
+                    <constraint firstItem="LHV-gV-vyf" firstAttribute="top" secondItem="VyY-Yg-JOe" secondAttribute="bottom" id="Vjr-NX-j8V"/>
+                    <constraint firstItem="MhO-U0-MLR" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="Vly-VE-BwU"/>
+                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="leading" priority="999" id="Z6G-l9-G4a"/>
+                    <constraint firstItem="C3G-wL-u7w" firstAttribute="top" secondItem="bDE-Tl-UHg" secondAttribute="bottom" constant="8" id="ZoS-xV-2WA"/>
+                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="aMJ-Wb-vRS"/>
+                    <constraint firstItem="KEB-eH-x2Y" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="aOk-S0-0n2"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="eQb-0a-76J" secondAttribute="trailing" constant="20" id="b0B-3w-grH"/>
+                    <constraint firstItem="KEB-eH-x2Y" firstAttribute="centerY" secondItem="PXc-xv-A28" secondAttribute="centerY" id="cHe-pZ-0Oq"/>
+                    <constraint firstItem="cD5-Su-lXR" firstAttribute="top" secondItem="t8c-Fx-e5h" secondAttribute="bottom" constant="22" id="dYg-zP-wh2"/>
+                    <constraint firstItem="h6f-PY-cc0" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="eSz-lz-Fdh"/>
+                    <constraint firstItem="qgf-Jf-cJr" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" constant="30" id="esg-lX-BAT"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="fGd-YS-phP"/>
+                    <constraint firstAttribute="centerX" secondItem="t8c-Fx-e5h" secondAttribute="centerX" id="h3d-Kc-q88"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="LHV-gV-vyf" secondAttribute="bottom" constant="8" id="h4h-K3-BTd"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" priority="700" constant="8" id="hXw-6Z-lb2"/>
+                    <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="7ua-5a-uSd" secondAttribute="trailing" constant="12" id="ioO-NJ-Jqo"/>
+                    <constraint firstItem="bDE-Tl-UHg" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="jdk-ak-soQ"/>
+                    <constraint firstItem="C3G-wL-u7w" firstAttribute="centerY" secondItem="lvJ-Rk-UT5" secondAttribute="centerY" id="jfs-YI-7Ae"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="oFj-ol-xpL" secondAttribute="trailing" constant="20" id="kOG-Cj-hFG"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="MhO-U0-MLR" secondAttribute="trailing" constant="20" id="ke9-wW-5fr"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="qgf-Jf-cJr" secondAttribute="bottom" constant="8" id="lWU-tC-vWg"/>
+                    <constraint firstItem="5D8-GP-a4l" firstAttribute="top" secondItem="h6f-PY-cc0" secondAttribute="bottom" constant="25" id="lYd-VZ-lBs"/>
+                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="18" id="lei-uP-T8m"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="xP7-jE-NF8" secondAttribute="bottom" priority="701" constant="8" id="oY4-e7-lsz"/>
+                    <constraint firstItem="7ua-5a-uSd" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="pCX-eX-erN"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="pdC-x8-Nao"/>
+                    <constraint firstAttribute="centerX" secondItem="7ua-5a-uSd" secondAttribute="centerX" constant="60" id="phL-j9-rPq"/>
+                    <constraint firstItem="bDE-Tl-UHg" firstAttribute="top" secondItem="pc8-G9-4pJ" secondAttribute="bottom" constant="8" id="pis-of-f93"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="trailing" constant="20" id="qKi-KT-jzJ"/>
+                    <constraint firstItem="C3G-wL-u7w" firstAttribute="bottom" secondItem="PXc-xv-A28" secondAttribute="top" constant="-8" id="snd-8T-LjC"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="d9e-Wv-Y5H" secondAttribute="trailing" constant="20" id="stz-Vm-Kxo"/>
+                    <constraint firstItem="PXc-xv-A28" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="tAa-1s-xVZ"/>
+                    <constraint firstItem="eQb-0a-76J" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="u1y-6V-moc"/>
+                    <constraint firstAttribute="bottom" secondItem="BbV-3h-mmL" secondAttribute="bottom" constant="35" id="ukF-FH-DE8"/>
+                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="vB8-c5-pfO"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="YNz-ka-cBi" secondAttribute="trailing" constant="20" id="vfq-83-tKI"/>
+                    <constraint firstItem="pDa-fA-vnC" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="z6s-ga-iAk"/>
                 </constraints>
             </view>
+            <connections>
+                <outlet property="initialFirstResponder" destination="kiB-jZ-69S" id="I96-dS-lq5"/>
+            </connections>
+            <point key="canvasLocation" x="274" y="326.5"/>
         </window>
+        <userDefaultsController representsSharedInstance="YES" id="iXx-cu-WYe"/>
     </objects>
     <resources>
-        <image name="NSBonjour" width="32" height="32"/>
-        <image name="NSFollowLinkFreestandingTemplate" width="14" height="14"/>
+        <image name="NSInfo" width="32" height="32"/>
     </resources>
 </document>

Source/SantaGUI/Resources/Santa-Prefix.pch

@@ -1,3 +0,0 @@
-#ifdef __OBJC__
-  #import <Cocoa/Cocoa.h>
-#endif

Source/SantaGUI/Resources/SantaGUI-Info.plist

@@ -2,30 +2,26 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>en</string>
-	<key>CFBundleExecutable</key>
-	<string>${EXECUTABLE_NAME}</string>
-	<key>CFBundleIconFile</key>
-	<string></string>
-	<key>CFBundleIdentifier</key>
-	<string>com.google.${PRODUCT_NAME:rfc1034identifier}GUI</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>${PRODUCT_NAME}</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
-	<key>CFBundleShortVersionString</key>
-	<string>0.7.1</string>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google, Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.google.${PRODUCT_NAME:rfc1034identifier}GUI</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
 	<key>CFBundleVersion</key>
-	<string>0.7.1</string>
+	<string>TO.BE.FILLED</string>
+	<key>CFBundleShortVersionString</key>
+	<string>TO.BE.FILLED</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
 	<key>LSUIElement</key>
 	<true/>
-	<key>NSHumanReadableCopyright</key>
-	<string>Google, Inc.</string>
 	<key>NSPrincipalClass</key>
 	<string>NSApplication</string>
 </dict>

Source/SantaGUI/SNTAboutWindowController.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,6 +12,12 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+@import Cocoa;
+
 @interface SNTAboutWindowController : NSWindowController
 
+@property IBOutlet NSButton *moreInfoButton;
+
+- (IBAction)openMoreInfoURL:(id)sender;
+
 @end

Source/SantaGUI/SNTAboutWindowController.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,10 +14,24 @@
 
 #import "SNTAboutWindowController.h"
 
+#import "SNTConfigurator.h"
+
 @implementation SNTAboutWindowController
 
 - (instancetype)init {
   return [super initWithWindowNibName:@"AboutWindow"];
 }
 
+- (void)loadWindow {
+  [super loadWindow];
+  if (![[SNTConfigurator configurator] moreInfoURL]) {
+    [self.moreInfoButton removeFromSuperview];
+  }
+}
+
+- (IBAction)openMoreInfoURL:(id)sender {
+  [[NSWorkspace sharedWorkspace] openURL:[[SNTConfigurator configurator] moreInfoURL]];
+  [self close];
+}
+
 @end

Source/SantaGUI/SNTAccessibleTextField.h

@@ -0,0 +1,23 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Cocoa;
+
+/**
+   An NSTextField subclass that provides an accessiblity label equal to:
+   (self.toolTip + self.stringValue) where available. It also sets the
+   accessibilityRoleDescription to "label".
+*/
+@interface SNTAccessibleTextField : NSTextField
+@end

Source/SantaGUI/SNTAccessibleTextField.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2016 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,21 +12,28 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-/// An instance of this class is passed to each stage of the sync process for storing data
-/// that might be needed in later stages.
-@interface SNTCommandSyncStatus : NSObject
+#import "SNTAccessibleTextField.h"
 
-/// The base API URL
-@property NSURL *syncBaseURL;
+@implementation SNTAccessibleTextField
 
-/// Machine identifier and owner
-@property NSString *machineID;
-@property NSString *machineOwner;
+- (BOOL)accessibilityIsIgnored {
+  return NO;
+}
 
-/// Batch size for uploading events, sent from server
-@property int32_t eventBatchSize;
+- (NSString *)accessibilityLabel {
+  if (self.toolTip && self.stringValue) {
+    return [NSString stringWithFormat:@"%@: %@", self.toolTip, self.stringValue];
+  } else if (self.stringValue) {
+    return self.stringValue;
+  } else if (self.toolTip) {
+    return self.toolTip;
+  } else {
+    return nil;
+  }
+}
 
-/// Log upload URL sent from server
-@property NSURL *uploadLogURL;
+- (NSString *)accessibilityRoleDescription {
+  return @"label";
+}
 
 @end

Source/SantaGUI/SNTAppDelegate.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,6 +12,10 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+@import Cocoa;
+
+///
 /// Initiates and manages the connection to santad
+///
 @interface SNTAppDelegate : NSObject<NSApplicationDelegate>
 @end

Source/SantaGUI/SNTAppDelegate.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -15,13 +15,19 @@
 #import "SNTAppDelegate.h"
 
 #import "SNTAboutWindowController.h"
+#import "SNTConfigurator.h"
+#import "SNTFileWatcher.h"
 #import "SNTNotificationManager.h"
+#import "SNTStrengthify.h"
 #import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
 
 @interface SNTAppDelegate ()
 @property SNTAboutWindowController *aboutWindowController;
+@property SNTFileWatcher *configFileWatcher;
 @property SNTNotificationManager *notificationManager;
-@property SNTXPCConnection *listener;
+@property SNTXPCConnection *daemonListener;
+@property SNTXPCConnection *bundleListener;
 @end
 
 @implementation SNTAppDelegate
@@ -30,40 +36,109 @@
 
 - (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
   [self setupMenu];
-  self.aboutWindowController = [[SNTAboutWindowController alloc] init];
+
+  self.configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
+                                                            handler:^(unsigned long data) {
+    if (! (data & DISPATCH_VNODE_ATTRIB)) [[SNTConfigurator configurator] reloadConfigData];
+  }];
+
   self.notificationManager = [[SNTNotificationManager alloc] init];
-  [self createConnection];
+
+  NSNotificationCenter *workspaceNotifications = [[NSWorkspace sharedWorkspace] notificationCenter];
+
+  [workspaceNotifications addObserverForName:NSWorkspaceSessionDidResignActiveNotification
+                                      object:nil
+                                       queue:[NSOperationQueue currentQueue]
+                                  usingBlock:^(NSNotification *note) {
+    self.daemonListener.invalidationHandler = nil;
+    [self.daemonListener invalidate];
+    self.daemonListener = nil;
+  }];
+  [workspaceNotifications addObserverForName:NSWorkspaceSessionDidBecomeActiveNotification
+                                      object:nil
+                                       queue:[NSOperationQueue currentQueue]
+                                  usingBlock:^(NSNotification *note) {
+    [self attemptDaemonReconnection];
+  }];
+
+  [self createDaemonConnection];
+  [self createBundleConnection];
 }
 
 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
+  self.aboutWindowController = [[SNTAboutWindowController alloc] init];
   [self.aboutWindowController showWindow:self];
   return NO;
 }
 
 #pragma mark Connection handling
 
-- (void)createConnection {
-  __weak __typeof(self) weakSelf = self;
+- (void)createDaemonConnection {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 
-  self.listener =
-      [[SNTXPCConnection alloc] initClientWithName:[SNTXPCNotifierInterface serviceId]
-                                           options:NSXPCConnectionPrivileged];
-  self.listener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
-  self.listener.exportedObject = self.notificationManager;
-  self.listener.rejectedHandler = ^{
-      [weakSelf performSelectorInBackground:@selector(attemptReconnection)
-                                 withObject:nil];
+  WEAKIFY(self);
+
+  // Create listener for return connection from daemon.
+  NSXPCListener *listener = [NSXPCListener anonymousListener];
+  self.daemonListener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.daemonListener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
+  self.daemonListener.exportedObject = self.notificationManager;
+  self.daemonListener.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
   };
-  self.listener.invalidationHandler = self.listener.rejectedHandler;
-  [self.listener resume];
+  self.daemonListener.invalidationHandler = ^{
+    STRONGIFY(self);
+    [self attemptDaemonReconnection];
+  };
+  [self.daemonListener resume];
+
+  // Tell daemon to connect back to the above listener.
+  SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+  [daemonConn resume];
+  [[daemonConn remoteObjectProxy] setNotificationListener:listener.endpoint];
+
+  // Now wait for the connection to come in.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    [self attemptDaemonReconnection];
+  }
 }
 
-- (void)attemptReconnection {
-  // TODO(rah): Make this smarter.
-  sleep(10);
-  [self performSelectorOnMainThread:@selector(createConnection)
-                         withObject:nil
-                      waitUntilDone:NO];
+- (void)attemptDaemonReconnection {
+  [self performSelectorInBackground:@selector(createDaemonConnection) withObject:nil];
+}
+
+- (void)createBundleConnection {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  WEAKIFY(self);
+
+  // Create listener for return connection from the bundle service.
+  NSXPCListener *listener = [NSXPCListener anonymousListener];
+  self.bundleListener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.bundleListener.exportedInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
+  self.bundleListener.exportedObject = self.notificationManager;
+  self.bundleListener.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+  self.bundleListener.invalidationHandler = ^{
+    STRONGIFY(self);
+    [self attemptBundleReconnection];
+  };
+  [self.bundleListener resume];
+
+  // Tell santabs to connect back to the above listener.
+  SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+  [daemonConn resume];
+  [[daemonConn remoteObjectProxy] setBundleNotificationListener:listener.endpoint];
+
+  // Now wait for the connection to come in.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    [self attemptBundleReconnection];
+  }
+}
+
+- (void)attemptBundleReconnection {
+  [self performSelectorInBackground:@selector(createBundleConnection) withObject:nil];
 }
 
 #pragma mark Menu Management

Source/SantaGUI/SNTMessageWindow.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,13 +12,21 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-/// An NSPanel that can become key/main and can fade in/out.
+@import Cocoa;
+
+///
+///  An NSPanel that can become key/main and can fade in/out.
+///
 @interface SNTMessageWindow : NSPanel
 
-/// Fade the window in
+///
+///  Fade the window in
+///
 - (IBAction)fadeIn:(id)sender;
 
-/// Fade the window out
+///
+///  Fade the window out
+///
 - (IBAction)fadeOut:(id)sender;
 
 @end

Source/SantaGUI/SNTMessageWindow.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -26,11 +26,12 @@
 
 - (IBAction)fadeIn:(id)sender {
   [self setAlphaValue:0.f];
+  [self center];
   [self makeKeyAndOrderFront:sender];
   [NSAnimationContext beginGrouping];
   [[NSAnimationContext currentContext] setDuration:0.15f];
   [[NSAnimationContext currentContext] setCompletionHandler:^{
-      [NSApp activateIgnoringOtherApps:YES];
+    [NSApp activateIgnoringOtherApps:YES];
   }];
   [[self animator] setAlphaValue:1.f];
   [NSAnimationContext endGrouping];
@@ -42,9 +43,9 @@
   [NSAnimationContext beginGrouping];
   [[NSAnimationContext currentContext] setDuration:0.15f];
   [[NSAnimationContext currentContext] setCompletionHandler:^{
-      [weakSelf.windowController windowWillClose:nil];
-      [weakSelf orderOut:nil];
-      [weakSelf setAlphaValue:1.f];
+    [weakSelf.windowController windowWillClose:sender];
+    [weakSelf orderOut:sender];
+    [weakSelf setAlphaValue:1.f];
   }];
   [[self animator] setAlphaValue:0.f];
   [NSAnimationContext endGrouping];

Source/SantaGUI/SNTMessageWindowController.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,34 +12,58 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTNotificationMessage;
+@import Cocoa;
+
+@class SNTStoredEvent;
 
 @protocol SNTMessageWindowControllerDelegate
-- (void)windowDidClose;
+- (void)windowDidCloseSilenceHash:(NSString *)hash;
 @end
 
-/// Controller for a single message window.
+///
+///  Controller for a single message window.
+///
 @interface SNTMessageWindowController : NSWindowController
 
-- (instancetype)initWithEvent:(SNTNotificationMessage *)event;
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message;
 
 - (IBAction)showWindow:(id)sender;
 - (IBAction)closeWindow:(id)sender;
 - (IBAction)showCertInfo:(id)sender;
 
-/// The execution event that this window is for
-@property SNTNotificationMessage *event;
+///  Reference to the "Bundle Hash" label in the XIB. Used to remove if application
+///  doesn't have a bundle hash.
+@property(weak) IBOutlet NSTextField *bundleHashLabel;
 
-/// The delegate to inform when the notification is dismissed
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSProgressIndicator *hashingIndicator;
+
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSTextField *foundFileCountLabel;
+
+///
+///  Reference to the "Open Event" button in the XIB. Used to either remove the button
+///  if it isn't needed or set its title if it is.
+///
+@property(weak) IBOutlet NSButton *openEventButton;
+
+///
+///  The execution event that this window is for
+///
+@property(readonly) SNTStoredEvent *event;
+
+///
+///  The root progress object. Child nodes are vended to santad to report on work being done.
+///
+@property NSProgress *progress;
+
+///
+///  The delegate to inform when the notification is dismissed
+///
 @property(weak) id<SNTMessageWindowControllerDelegate> delegate;
 
-/// A 'friendly' string representing the certificate information
-@property(readonly) IBOutlet NSString *binaryCert;
-
-/// An optional message to display with this block.
-@property(readonly) IBOutlet NSAttributedString *attributedCustomMessage;
-
-/// If the binary is part of a bundle, this is the icon for that bundle
-@property(readonly) IBOutlet NSImage *bundleIcon;
-
 @end

Source/SantaGUI/SNTMessageWindowController.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,42 +14,123 @@
 
 #import "SNTMessageWindowController.h"
 
-#import <SecurityInterface/SFCertificatePanel.h>
+@import SecurityInterface.SFCertificatePanel;
 
-#import "SNTBinaryInfo.h"
-#import "SNTCertificate.h"
+#import "MOLCertificate.h"
+#import "SNTBlockMessage.h"
+#import "SNTConfigurator.h"
+#import "SNTFileInfo.h"
 #import "SNTMessageWindow.h"
-#import "SNTNotificationMessage.h"
+#import "SNTStoredEvent.h"
+
+@interface SNTMessageWindowController ()
+///  The custom message to display for this event
+@property(copy) NSString *customMessage;
+
+///  A 'friendly' string representing the certificate information
+@property(readonly, nonatomic) NSString *publisherInfo;
+
+///  An optional message to display with this block.
+@property(readonly, nonatomic) NSAttributedString *attributedCustomMessage;
+
+///  Reference to the "Application Name" label in the XIB. Used to remove if application
+///  doesn't have a CFBundleName.
+@property(weak) IBOutlet NSTextField *applicationNameLabel;
+
+///  Linked to checkbox in UI to prevent future notifications for this binary.
+@property BOOL silenceFutureNotifications;
+@end
 
 @implementation SNTMessageWindowController
 
-- (instancetype)initWithEvent:(SNTNotificationMessage *)event {
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message {
   self = [super initWithWindowNibName:@"MessageWindow"];
   if (self) {
     _event = event;
-    [self.window setMovableByWindowBackground:NO];
-    [self.window setLevel:NSPopUpMenuWindowLevel];
-    [self.window center];
+    _customMessage = message;
+    _progress = [NSProgress discreteProgressWithTotalUnitCount:1];
+    [_progress addObserver:self
+                forKeyPath:@"fractionCompleted"
+                   options:NSKeyValueObservingOptionNew
+                   context:NULL];
   }
   return self;
 }
 
+- (void)dealloc {
+  [_progress removeObserver:self forKeyPath:@"fractionCompleted"];
+}
+
+- (void)observeValueForKeyPath:(NSString *)keyPath
+                      ofObject:(id)object
+                        change:(NSDictionary *)change
+                       context:(void *)context {
+  if ([keyPath isEqualToString:@"fractionCompleted"]) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      NSProgress *progress = object;
+      if (progress.fractionCompleted != 0.0) {
+        self.hashingIndicator.indeterminate = NO;
+        [self.foundFileCountLabel removeFromSuperview];
+      }
+      self.hashingIndicator.doubleValue = progress.fractionCompleted;
+    });
+  }
+}
+
+- (void)loadWindow {
+  [super loadWindow];
+  [self.window setLevel:NSPopUpMenuWindowLevel];
+  [self.window setMovableByWindowBackground:YES];
+
+  if (![[SNTConfigurator configurator] eventDetailURL]) {
+    [self.openEventButton removeFromSuperview];
+  } else {
+    NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
+    if (eventDetailText) {
+      [self.openEventButton setTitle:eventDetailText];
+    }
+  }
+
+  if (!self.event.needsBundleHash) {
+    [self.bundleHashLabel removeFromSuperview];
+    [self.hashingIndicator removeFromSuperview];
+    [self.foundFileCountLabel removeFromSuperview];
+  } else {
+    self.openEventButton.enabled = NO;
+    self.hashingIndicator.indeterminate = YES;
+    [self.hashingIndicator startAnimation:self];
+    self.bundleHashLabel.hidden = YES;
+    self.foundFileCountLabel.stringValue = @"";
+  }
+
+  if (!self.event.fileBundleName) {
+    [self.applicationNameLabel removeFromSuperview];
+  }
+}
+
 - (IBAction)showWindow:(id)sender {
   [(SNTMessageWindow *)self.window fadeIn:sender];
 }
 
 - (IBAction)closeWindow:(id)sender {
+  [self.progress cancel];
   [(SNTMessageWindow *)self.window fadeOut:sender];
 }
 
 - (void)windowWillClose:(NSNotification *)notification {
-  if (self.delegate) [self.delegate windowDidClose];
+  if (!self.delegate) return;
+
+  if (self.silenceFutureNotifications) {
+    [self.delegate windowDidCloseSilenceHash:self.event.fileSHA256];
+  } else {
+    [self.delegate windowDidCloseSilenceHash:nil];
+  }
 }
 
 - (IBAction)showCertInfo:(id)sender {
   // SFCertificatePanel expects an NSArray of SecCertificateRef's
-  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.certificates count]];
-  for (SNTCertificate *cert in self.event.certificates) {
+  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.signingChain count]];
+  for (MOLCertificate *cert in self.event.signingChain) {
     [certArray addObject:(id)cert.certRef];
   }
 
@@ -61,21 +142,27 @@
                                                showGroup:YES];
 }
 
+- (IBAction)openEventDetails:(id)sender {
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
+  [self closeWindow:sender];
+  [[NSWorkspace sharedWorkspace] openURL:url];
+}
+
 #pragma mark Generated properties
 
 + (NSSet *)keyPathsForValuesAffectingValueForKey:(NSString *)key {
-  if (! [key isEqualToString:@"event"]) {
+  if (![key isEqualToString:@"event"]) {
     return [NSSet setWithObject:@"event"];
   } else {
-    return nil;
+    return [NSSet set];
   }
 }
 
-- (NSString *)binaryCert {
-  SNTCertificate *leafCert = self.event.leafCertificate;
+- (NSString *)publisherInfo {
+  MOLCertificate *leafCert = [self.event.signingChain firstObject];
 
   if (leafCert.commonName && leafCert.orgName) {
-    return [NSString stringWithFormat:@"%@ - %@", leafCert.commonName, leafCert.orgName];
+    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
   } else if (leafCert.commonName) {
     return leafCert.commonName;
   } else if (leafCert.orgName) {
@@ -86,33 +173,8 @@
 }
 
 - (NSAttributedString *)attributedCustomMessage {
-  if (self.event.customMessage) {
-    NSString *htmlHeader = @"<html><head><style>"
-                           @"body {"
-                           @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
-                           @"  font-size: 13px;"
-                           @"  color: #666;"
-                           @"  text-align: center;"
-                           @"}"
-                           @"</style></head><body>";
-    NSString *htmlFooter = @"</body></html>";
-    NSString *fullHtml = [NSString stringWithFormat:@"%@%@%@", htmlHeader,
-                          self.event.customMessage, htmlFooter];
-    NSData *htmlData = [fullHtml dataUsingEncoding:NSUTF8StringEncoding];
-    NSAttributedString *returnStr = [[NSAttributedString alloc] initWithHTML:htmlData
-                                                          documentAttributes:NULL];
-    return returnStr;
-  } else {
-    return nil;
-  }
-}
-
-- (NSImage *)bundleIcon {
-  SNTBinaryInfo *bi = [[SNTBinaryInfo alloc] initWithPath:self.event.path];
-
-  if (!bi || !bi.bundle) return nil;
-
-  return [[NSWorkspace sharedWorkspace] iconForFile:bi.bundlePath];
+  return [SNTBlockMessage attributedBlockMessageForEvent:self.event
+                                           customMessage:self.customMessage];
 }
 
 @end

Source/SantaGUI/SNTNotificationManager.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,11 +12,15 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+@import Cocoa;
+
 #import "SNTMessageWindowController.h"
 #import "SNTXPCNotifierInterface.h"
 
-/// Keeps track of pending notifications and ensures only one is presented to the user at a time.
-@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate, SNTNotifierXPC>
-
+///
+///  Keeps track of pending notifications and ensures only one is presented to the user at a time.
+///
+@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate,
+                                             SNTNotifierXPC, SNTBundleNotifierXPC>
 
 @end

Source/SantaGUI/SNTNotificationManager.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,68 +14,245 @@
 
 #import "SNTNotificationManager.h"
 
-#import "SNTNotificationMessage.h"
+#import "SNTBlockMessage.h"
+#import "SNTConfigurator.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
+#import "SNTStrengthify.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
 
 @interface SNTNotificationManager ()
-/// The currently displayed notification
+
+///  The currently displayed notification
 @property SNTMessageWindowController *currentWindowController;
 
-/// The queue of pending notifications
+///  The queue of pending notifications
 @property(readonly) NSMutableArray *pendingNotifications;
+
+///  The connection to the bundle service
+@property SNTXPCConnection *bundleServiceConnection;
+
+///  A semaphore to block bundle hashing until a connection is established
+@property dispatch_semaphore_t bundleServiceSema;
+
+// A serial queue for holding hashBundleBinaries requests
+@property dispatch_queue_t hashBundleBinariesQueue;
+
 @end
 
 @implementation SNTNotificationManager
 
+static NSString * const silencedNotificationsKey = @"SilencedNotifications";
+
 - (instancetype)init {
   self = [super init];
   if (self) {
     _pendingNotifications = [[NSMutableArray alloc] init];
+    _bundleServiceSema = dispatch_semaphore_create(0);
+    _hashBundleBinariesQueue = dispatch_queue_create("com.google.santagui.hashbundlebinaries",
+                                                     DISPATCH_QUEUE_SERIAL);
   }
   return self;
 }
 
-- (void)windowDidClose {
+- (void)windowDidCloseSilenceHash:(NSString *)hash {
+  if (hash) [self updateSilenceDate:[NSDate date] forHash:hash];
+
   [self.pendingNotifications removeObject:self.currentWindowController];
   self.currentWindowController = nil;
 
   if ([self.pendingNotifications count]) {
     self.currentWindowController = [self.pendingNotifications firstObject];
     [self.currentWindowController showWindow:self];
+    if (self.currentWindowController.event.needsBundleHash) {
+      dispatch_async(self.hashBundleBinariesQueue, ^{
+        [self hashBundleBinariesForEvent:self.currentWindowController.event];
+      });
+    }
   } else {
+    // Tear down the bundle service
+    self.bundleServiceSema = dispatch_semaphore_create(0);
+    [self.bundleServiceConnection invalidate];
+    self.bundleServiceConnection = nil;
     [NSApp hide:self];
   }
 }
 
+- (void)updateSilenceDate:(NSDate *)date forHash:(NSString *)hash {
+  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+  NSMutableDictionary *d = [[ud objectForKey:silencedNotificationsKey] mutableCopy];
+  if (!d) d = [NSMutableDictionary dictionary];
+  if (date) {
+    d[hash] = date;
+  } else {
+    [d removeObjectForKey:hash];
+  }
+  [ud setObject:d forKey:silencedNotificationsKey];
+}
+
 #pragma mark SNTNotifierXPC protocol methods
 
-- (void)postBlockNotification:(SNTNotificationMessage *)event {
+- (void)postClientModeNotification:(SNTClientMode)clientmode {
+  NSUserNotification *un = [[NSUserNotification alloc] init];
+  un.title = @"Santa";
+  un.hasActionButton = NO;
+  NSString *customMsg;
+  switch (clientmode) {
+    case SNTClientModeMonitor:
+      un.informativeText = @"Switching into Monitor mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationMonitor];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    case SNTClientModeLockdown:
+      un.informativeText = @"Switching into Lockdown mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationLockdown];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    default:
+      return;
+  }
+  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
+}
+
+- (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
   // See if this binary is already in the list of pending notifications.
-  NSPredicate *predicate = [NSPredicate predicateWithFormat:@"event.SHA1==%@", event.SHA1];
+  NSPredicate *predicate =
+      [NSPredicate predicateWithFormat:@"event.fileSHA256==%@", event.fileSHA256];
   if ([[self.pendingNotifications filteredArrayUsingPredicate:predicate] count]) return;
 
+  // See if this binary is silenced.
+  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+  NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][event.fileSHA256];
+  if ([silenceDate isKindOfClass:[NSDate class]]) {
+    NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
+    if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
+      LOGI(@"Notification silence: date is in the future, ignoring");
+      [self updateSilenceDate:nil forHash:event.fileSHA256];
+    } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
+      LOGI(@"Notification silence: date is more than one day ago, ignoring");
+      [self updateSilenceDate:nil forHash:event.fileSHA256];
+    } else {
+      LOGI(@"Notification silence: dropping notification for %@", event.fileSHA256);
+      return;
+    }
+  }
+
+  if (!event) {
+    LOGI(@"Error: Missing event object in message received from daemon!");
+    return;
+  }
+
   // Notifications arrive on a background thread but UI updates must happen on the main thread.
   // This includes making windows.
-  [self performSelectorOnMainThread:@selector(postBlockNotificationMainThread:)
-                         withObject:event
-                      waitUntilDone:NO];
+  dispatch_async(dispatch_get_main_queue(), ^{
+    SNTMessageWindowController *pendingMsg =
+        [[SNTMessageWindowController alloc] initWithEvent:event andMessage:message];
+    pendingMsg.delegate = self;
+    [self.pendingNotifications addObject:pendingMsg];
+
+    // If a notification isn't currently being displayed, display the incoming one.
+    if (!self.currentWindowController) {
+      self.currentWindowController = pendingMsg;
+      [pendingMsg showWindow:nil];
+      if (self.currentWindowController.event.needsBundleHash) {
+        dispatch_async(self.hashBundleBinariesQueue, ^{
+          [self hashBundleBinariesForEvent:self.currentWindowController.event];
+        });
+      }
+    }
+  });
 }
 
-- (void)postBlockNotificationMainThread:(SNTNotificationMessage *)event {
-  // Create message window
-  SNTMessageWindowController *pendingMsg = [[SNTMessageWindowController alloc] initWithEvent:event];
-  pendingMsg.delegate = self;
-  [self.pendingNotifications addObject:pendingMsg];
+- (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message {
+  NSUserNotification *un = [[NSUserNotification alloc] init];
+  un.title = @"Santa";
+  un.hasActionButton = NO;
+  un.informativeText = message ?: @"Requested application can now be run";
+  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
+}
 
-  // If a notification isn't currently being displayed, display the incoming one.
-  if (!self.currentWindowController) {
-    self.currentWindowController = pendingMsg;
+#pragma mark SNTBundleNotifierXPC protocol methods
 
-    [NSApp activateIgnoringOtherApps:YES];
-
-    // It's quite likely that we're currently on a background thread, and GUI code should always be
-    // on main thread. Open the window on the main thread so any code it runs is also.
-    [pendingMsg showWindow:nil];
+- (void)updateCountsForEvent:(SNTStoredEvent *)event
+                 binaryCount:(uint64_t)binaryCount
+                   fileCount:(uint64_t)fileCount {
+  if ([self.currentWindowController.event.idx isEqual:event.idx]) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      self.currentWindowController.foundFileCountLabel.stringValue =
+          [NSString stringWithFormat:@"%llu binaries / %llu files", binaryCount, fileCount];
+    });
   }
 }
 
+- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener {
+  SNTXPCConnection *c = [[SNTXPCConnection alloc] initClientWithListener:listener];
+  c.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  [c resume];
+  self.bundleServiceConnection = c;
+  dispatch_semaphore_signal(self.bundleServiceSema);
+}
+
+#pragma mark SNTBundleNotifierXPC helper methods
+
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event {
+  // Wait a max of 6 secs for the bundle service. Should the bundle service fall over, it will
+  // reconnect within 5 secs. Otherwise abandon bundle hashing and display the blockable event.
+  if (dispatch_semaphore_wait(self.bundleServiceSema,
+                              dispatch_time(DISPATCH_TIME_NOW, 6 * NSEC_PER_SEC))) {
+    [self updateBlockNotification:event withBundleHash:nil];
+    return;
+  }
+
+  // Let all future requests flow, until the connection is terminated and we go back to waiting.
+  dispatch_semaphore_signal(self.bundleServiceSema);
+
+  // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
+  [self.currentWindowController.progress becomeCurrentWithPendingUnitCount:1];
+
+  // Start hashing. Progress is reported to the root NSProgress (currentWindowController.progress).
+  [[self.bundleServiceConnection remoteObjectProxy]
+      hashBundleBinariesForEvent:event
+                           reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
+    // Revert to displaying the blockable event if we fail to calculate the bundle hash
+    if (!bh) return [self updateBlockNotification:event withBundleHash:nil];
+
+    event.fileBundleHash = bh;
+    event.fileBundleBinaryCount = @(events.count);
+    event.fileBundleHashMilliseconds = ms;
+    for (SNTStoredEvent *se in events) {
+      se.fileBundleHash = bh;
+      se.fileBundleBinaryCount = @(events.count);
+      se.fileBundleHashMilliseconds = ms;
+    }
+
+    // Send the results to santad. It will decide if they need to be synced.
+    SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+    [daemonConn resume];
+    [[daemonConn remoteObjectProxy] syncBundleEvent:event relatedEvents:events];
+
+    // Update the UI with the bundle hash. Also make the openEventButton available.
+    [self updateBlockNotification:event withBundleHash:bh];
+  }];
+  [self.currentWindowController.progress resignCurrent];
+}
+
+- (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash {
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if ([self.currentWindowController.event.idx isEqual:event.idx]) {
+      if (bundleHash) {
+        [self.currentWindowController.bundleHashLabel setHidden:NO];
+      } else {
+        [self.currentWindowController.bundleHashLabel removeFromSuperview];
+      }
+      self.currentWindowController.event.fileBundleHash = bundleHash;
+      [self.currentWindowController.foundFileCountLabel removeFromSuperview];
+      [self.currentWindowController.hashingIndicator setHidden:YES];
+      [self.currentWindowController.openEventButton setEnabled:YES];
+    }
+  });
+}
+
 @end

Source/SantaGUI/main.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,6 +12,8 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+@import Cocoa;
+
 #import "SNTAppDelegate.h"
 
 int main(int argc, const char *argv[]) {

Source/common/SNTBinaryInfo.h

@@ -1,73 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-/// SNTBinaryInfo represents a binary on disk, providing access to details about that binary such as
-/// the SHA-1, the Info.plist and the Mach-O data.
-@interface SNTBinaryInfo : NSObject
-
-/// Designated initializer
-- (instancetype)initWithPath:(NSString *)path;
-
-/// Return SHA-1 hash of this binary
-- (NSString *)SHA1;
-
-/// Returns the type of Mach-O file:
-///  Dynamic Library, Kernel Extension, Fat Binary, Thin Binary
-- (NSString *)machoType;
-
-/// Returns the architectures included in this binary (e.g. x86_64, ppc)
-- (NSArray *)architectures;
-
-/// Returns YES if this file is a Mach-O file
-- (BOOL)isMachO;
-
-/// Returns YES if this file contains multiple architectures
-- (BOOL)isFat;
-
-/// Returns YES if this file is an executable Mach-O file
-- (BOOL)isExecutable;
-
-/// Returns YES if this file is a dynamic library
-- (BOOL)isDylib;
-
-/// Returns YES if this file is a kernel extension
-- (BOOL)isKext;
-
-/// Returns YES if this file is a script (e.g. it begins #!)
-- (BOOL)isScript;
-
-/// Returns an NSBundle if this file is part of a bundle.
-- (NSBundle *)bundle;
-
-/// Returns the path to the bundle this file is a part of, if any.
-- (NSString *)bundlePath;
-
-/// Returns either the Info.plist in the bundle this file is part of, or an embedded plist if there
-/// is one. In the odd case that a file has both an embedded Info.plist and is part of a bundle,
-/// the Info.plist from the bundle will be returned.
-- (NSDictionary *)infoPlist;
-
-/// Returns the CFBundleIdentifier from this file's Info.plist
-- (NSString *)bundleIdentifier;
-
-/// Returns the CFBundleName from this file's Info.plist
-- (NSString *)bundleName;
-
-/// Returns the CFBundleVersion from this file's Info.plist
-- (NSString *)bundleVersion;
-
-/// Returns the CFBundleShortVersionString from this file's Info.plist
-- (NSString *)bundleShortVersionString;
-
-@end

Source/common/SNTBinaryInfo.m

@@ -1,291 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTBinaryInfo.h"
-
-#import <CommonCrypto/CommonDigest.h>
-
-#include <mach-o/loader.h>
-#include <mach-o/swap.h>
-
-@interface SNTBinaryInfo ()
-@property NSString *path;
-@property NSData *fileData;
-@property NSBundle *bundleRef;
-@property NSDictionary *infoDict;
-@end
-
-@implementation SNTBinaryInfo
-
-- (instancetype)initWithPath:(NSString *)path {
-  self = [super init];
-
-  if (self) {
-    _path = path;
-
-    _fileData = [NSData dataWithContentsOfFile:path options:NSDataReadingMappedIfSafe error:nil];
-    if (!_fileData) return nil;
-  }
-
-  return self;
-}
-
-- (NSString *)SHA1 {
-  unsigned char sha1[CC_SHA1_DIGEST_LENGTH];
-  CC_SHA1([self.fileData bytes], (unsigned int)[self.fileData length], sha1);
-
-  // Convert the binary SHA into hex
-  NSMutableString *buf = [[NSMutableString alloc] initWithCapacity:CC_SHA1_DIGEST_LENGTH * 2];
-  for (int i = 0; i < CC_SHA1_DIGEST_LENGTH; i++) {
-    [buf appendFormat:@"%02x", (unsigned char)sha1[i]];
-  }
-
-  return buf;
-}
-
-- (NSString *)machoType {
-  if ([self isDylib])   { return @"Dynamic Library"; }
-  if ([self isKext])    { return @"Kernel Extension"; }
-  if ([self isFat])     { return @"Fat Binary"; }
-  if ([self isMachO])   { return @"Thin Binary"; }
-  if ([self isScript])  { return @"Script"; }
-  return @"Unknown (not executable?)";
-}
-
-- (NSArray *)architectures {
-  if (![self isMachO]) return nil;
-
-  if ([self isFat]) {
-    NSMutableArray *ret = [[NSMutableArray alloc] init];
-
-    // Retrieve just the fat_header, if possible.
-    NSData *head = [self safeSubdataWithRange:NSMakeRange(0, sizeof(struct fat_header))];
-    if (!head) return nil;
-    struct fat_header *fat_header = (struct fat_header *)[head bytes];
-
-    // Get number of architectures in the binary
-    uint32_t narch = NSSwapBigIntToHost(fat_header->nfat_arch);
-
-    // Retrieve just the fat_arch's, make a mutable copy and if necessary swap the bytes
-    NSData *archs = [self safeSubdataWithRange:NSMakeRange(sizeof(struct fat_header),
-                                                           sizeof(struct fat_arch) * narch)];
-    if (!archs) return nil;
-    struct fat_arch *fat_archs = (struct fat_arch *)[archs bytes];
-
-    // For each arch, get the name of it's architecture
-    for (int i = 0; i < narch; ++i) {
-      [ret addObject:[self nameForCPUType:NSSwapBigIntToHost(fat_archs[i].cputype)]];
-    }
-    return ret;
-  } else {
-    struct mach_header *hdr = [self firstMachHeader];
-    return @[ [self nameForCPUType:hdr->cputype] ];
-  }
-  return nil;
-}
-
-- (BOOL)isDylib {
-  struct mach_header *mach_header = [self firstMachHeader];
-  if (!mach_header) return NO;
-  if (mach_header->filetype == MH_DYLIB ||
-      mach_header->filetype == MH_FVMLIB) {
-    return YES;
-  }
-
-  return NO;
-}
-
-- (BOOL)isKext {
-  struct mach_header *mach_header = [self firstMachHeader];
-  if (!mach_header) return NO;
-  if (mach_header->filetype == MH_KEXT_BUNDLE) {
-    return YES;
-  }
-
-  return NO;
-}
-
-- (BOOL)isMachO {
-  return ([self.fileData length] >= 160 &&
-          ([self isMachHeader:(struct mach_header *)[self.fileData bytes]] || [self isFat]));
-}
-
-- (BOOL)isFat {
-  return ([self isFatHeader:(struct fat_header *)[self.fileData bytes]]);
-}
-
-- (BOOL)isScript {
-  if ([self.fileData length] < 1) return NO;
-
-  char magic[2];
-  [self.fileData getBytes:&magic length:2];
-
-  return (strncmp("#!", magic, 2) == 0);
-}
-
-- (BOOL)isExecutable {
-  struct mach_header *mach_header = [self firstMachHeader];
-  if (!mach_header) return NO;
-  if (mach_header->filetype == MH_OBJECT ||
-      mach_header->filetype == MH_EXECUTE ||
-      mach_header->filetype == MH_PRELOAD) {
-    return YES;
-  }
-
-  return NO;
-}
-
-# pragma mark Bundle Information
-
-/**
- *  Try and determine the bundle that the represented executable is contained within, if any.
- *
- *  Rationale: An NSBundle has a method executablePath for discovering the main binary within a
- *  bundle but provides no way to get an NSBundle object when only the executablePath is known. Also,
- *  a bundle can contain multiple binaries within the MacOS folder and we want any of these to count
- *  as being part of the bundle.
- *
- *  This method relies on executable bundles being laid out as follows:
- *
- *@code
- *  Bundle.app/
- *     Contents/
- *        MacOS/
- *          executable
- *@endcode
- *
- *  If @c self.path is the full path to @c executable above, this method would return an
- *  NSBundle reference for Bundle.app.
- */
-- (NSBundle *)bundle {
-  if (self.bundleRef) return self.bundleRef;
-
-  NSArray *pathComponents = [self.path pathComponents];
-
-  // Check that the full path is at least 4-levels deep:
-  // e.g: /Calendar.app/Contents/MacOS/Calendar
-  if ([pathComponents count] < 4) return nil;
-
-  pathComponents = [pathComponents subarrayWithRange:NSMakeRange(0, [pathComponents count] - 3)];
-  self.bundleRef = [NSBundle bundleWithPath:[NSString pathWithComponents:pathComponents]];
-
-  // Clear the bundle if it doesn't have a bundle ID
-  if (![self.bundleRef objectForInfoDictionaryKey:@"CFBundleIdentifier"]) self.bundleRef = nil;
-
-  return self.bundleRef;
-}
-
-- (NSString *)bundlePath {
-  return [self.bundle bundlePath];
-}
-
-- (NSDictionary *)infoPlist {
-  if (self.infoDict) return self.infoDict;
-
-  if ([self bundle]) {
-    self.infoDict = [[self bundle] infoDictionary];
-    return self.infoDict;
-  }
-
-  NSURL *url = [NSURL fileURLWithPath:self.path isDirectory:NO];
-  self.infoDict =
-      (__bridge_transfer NSDictionary*)CFBundleCopyInfoDictionaryForURL((__bridge CFURLRef) url);
-  return self.infoDict;
-}
-
-- (NSString *)bundleIdentifier {
-  return [[self infoPlist] objectForKey:@"CFBundleIdentifier"];
-}
-
-- (NSString *)bundleName {
-  return [[self infoPlist] objectForKey:@"CFBundleName"];
-}
-
-- (NSString *)bundleVersion {
-  return [[self infoPlist] objectForKey:@"CFBundleVersion"];
-}
-
-- (NSString *)bundleShortVersionString {
-  return [[self infoPlist] objectForKey:@"CFBundleShortVersionString"];
-}
-
-# pragma mark Internal Methods
-
-/// Look through the file for the first mach_header. If the file is thin, this will be the
-/// header at the beginning of the file. If the file is fat, it will be the first
-/// architecture-specific header.
-- (struct mach_header *)firstMachHeader {
-  if (![self isMachO]) return NULL;
-
-  struct mach_header *mach_header = (struct mach_header *)[self.fileData bytes];
-  struct fat_header *fat_header = (struct fat_header *)[self.fileData bytes];
-
-  if ([self isFatHeader:fat_header]) {
-    // Get the bytes for the fat_arch
-    NSData *archHdr = [self safeSubdataWithRange:NSMakeRange(sizeof(struct fat_header),
-                                                             sizeof(struct fat_arch))];
-    if (!archHdr) return nil;
-    struct fat_arch *fat_arch = (struct fat_arch *)[archHdr bytes];
-
-    // Get bytes for first mach_header
-    NSData *machHdr = [self safeSubdataWithRange:NSMakeRange(NSSwapBigIntToHost(fat_arch->offset),
-                                                             sizeof(struct mach_header))];
-    if (!machHdr) return nil;
-    mach_header = (struct mach_header *)[machHdr bytes];
-  }
-
-  if ([self isMachHeader:mach_header]) {
-    return mach_header;
-  }
-
-  return NULL;
-}
-
-- (BOOL)isMachHeader:(struct mach_header *)header {
-  return (header->magic == MH_MAGIC || header->magic == MH_MAGIC_64 ||
-          header->magic == MH_CIGAM || header->magic == MH_CIGAM_64);
-}
-
-- (BOOL)isFatHeader:(struct fat_header *)header {
-  return (header->magic == FAT_MAGIC || header->magic == FAT_CIGAM);
-}
-
-/// Wrap subdataWithRange: in a @try/@catch, returning nil on exception.
-/// Useful for when the range is beyond the end of the file.
-- (NSData *)safeSubdataWithRange:(NSRange)range {
-  @try {
-    return [self.fileData subdataWithRange:range];
-  }
-  @catch (NSException *exception) {
-    return nil;
-  }
-}
-
-- (NSString *)nameForCPUType:(cpu_type_t)cpuType {
-  switch (cpuType) {
-    case CPU_TYPE_X86:
-      return @"i386";
-    case CPU_TYPE_X86_64:
-      return @"x86-64";
-    case CPU_TYPE_POWERPC:
-      return @"ppc";
-    case CPU_TYPE_POWERPC64:
-      return @"ppc64";
-    default:
-      return @"unknown";
-  }
-  return nil;
-}
-
-@end

Source/common/SNTBlockMessage.h

@@ -0,0 +1,47 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifdef SANTAGUI
+@import Cocoa;
+#else
+@import Foundation;
+#endif
+
+@class SNTStoredEvent;
+
+@interface SNTBlockMessage : NSObject
+
+///
+///  Return a message suitable for presenting to the user.
+///  Uses either the configured message depending on the event type or a custom message
+///  if the rule that blocked this file included one.
+///
+///  In SantaGUI this will return an NSAttributedString with links and formatting included
+///  while for santad all HTML will be properly stripped.
+///
++ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
+                                         customMessage:(NSString *)customMessage;
+
+///
+///  Return a URL generated from the EventDetailURL configuration key
+///  after replacing templates in the URL with values from the event.
+///
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event;
+
+///
+///  Strip HTML from a string, replacing <br /> with newline.
+///
++ (NSString *)stringFromHTML:(NSString *)html;
+
+@end

Source/common/SNTBlockMessage.m

@@ -0,0 +1,128 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTBlockMessage.h"
+
+#import "SNTConfigurator.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
+
+@implementation SNTBlockMessage
+
++ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
+                                         customMessage:(NSString *)customMessage {
+  NSString *htmlHeader = @"<html><head><style>"
+      @"body {"
+      @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
+      @"  font-size: 13px;"
+      @"  color: #666;"
+      @"  text-align: center;"
+      @"}"
+      @"</style></head><body>";
+  NSString *htmlFooter = @"</body></html>";
+
+  NSString *message;
+  if (customMessage.length) {
+    message = customMessage;
+  } else if (event.decision == SNTEventStateBlockUnknown) {
+    message = [[SNTConfigurator configurator] unknownBlockMessage];
+    if (!message) {
+      message = @"The following application has been blocked from executing<br />"
+                @"because its trustworthiness cannot be determined.";
+    }
+  } else {
+    message = [[SNTConfigurator configurator] bannedBlockMessage];
+    if (!message) {
+      message = @"The following application has been blocked from executing<br />"
+                @"because it has been deemed malicious.";
+    }
+  }
+
+  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
+
+#ifdef NSAppKitVersionNumber10_0
+  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
+  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
+#else
+  NSString *strippedHTML = [self stringFromHTML:fullHTML];
+  if (!strippedHTML) {
+    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
+  }
+  return [[NSAttributedString alloc] initWithString:strippedHTML];
+#endif
+}
+
++ (NSString *)stringFromHTML:(NSString *)html {
+  NSError *error;
+  NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
+
+  if (!xml && error.code == NSXMLParserEmptyDocumentError) {
+    html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];
+    xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
+    if (!xml) return html;
+  }
+
+  // Strip any HTML tags out of the message. Also remove any content inside <style> tags and
+  // replace <br> elements with a newline.
+  NSString *stripXslt = @"<?xml version='1.0' encoding='utf-8'?>"
+      @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
+      @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
+      @"<xsl:output method='text'/>"
+      @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
+      @"<xsl:template match='style'/>"
+      @"</xsl:stylesheet>";
+  NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];
+  if (error || ![data isKindOfClass:[NSData class]]) {
+    return html;
+  }
+  return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
+}
+
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
+  SNTConfigurator *config = [SNTConfigurator configurator];
+
+  NSString *formatStr, *versionStr;
+  if (config.eventDetailBundleURL.length && event.fileBundleID) {
+    formatStr = config.eventDetailBundleURL;
+    versionStr = event.fileBundleVersion;
+    if (!versionStr) versionStr = event.fileBundleVersionString;
+
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_id%"
+                                                     withString:event.fileBundleID];
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_ver%"
+                                                     withString:versionStr];
+  } else {
+    formatStr = config.eventDetailURL;
+  }
+
+  if (!formatStr.length) return nil;
+
+  if (event.fileSHA256) {
+    formatStr =
+        [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
+                                             withString:event.fileBundleHash ?: event.fileSHA256];
+  }
+  if (event.executingUser) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
+                                                     withString:event.executingUser];
+  }
+  if (config.machineID) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
+                                                     withString:config.machineID];
+  }
+
+  return [NSURL URLWithString:formatStr];
+}
+
+@end

Source/common/SNTCertificate.h

@@ -1,67 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-/// SNTCertificate wraps a @c SecCertificateRef to provide Objective-C accessors to
-/// commonly used certificate data. Accessors cache data for repeated access.
-@interface SNTCertificate : NSObject<NSSecureCoding>
-
-/// Initialize a SNTCertificate object with a valid SecCertificateRef. Designated initializer.
-- (instancetype)initWithSecCertificateRef:(SecCertificateRef)certRef;
-
-/// Initialize a SNTCertificate object with certificate data in DER format.
-/// Returns nil if |certData| is invalid.
-- (instancetype)initWithCertificateDataDER:(NSData *)certData;
-
-/// Initialize a SNTCertificate object with certificate data in PEM format.
-/// If multiple PEM certificates exist within the string, the first is used.
-/// Returns nil if |certData| is invalid.
-- (instancetype)initWithCertificateDataPEM:(NSString *)certData;
-
-/// Returns an array of SNTCertificate's for all of the certificates in |pemData|.
-+ (NSArray *)certificatesFromPEM:(NSString *)pemData;
-
-/// Access the underlying certificate ref.
-@property(readonly) SecCertificateRef certRef;
-
-/// SHA-1 hash of the certificate data.
-@property(readonly) NSString *SHA1;
-
-/// Certificate data.
-@property(readonly) NSData *certData;
-
-/// Common Name e.g: "Software Signing"
-@property(readonly) NSString *commonName;
-
-/// Country Name e.g: "US"
-@property(readonly) NSString *countryName;
-
-/// Organizational Name e.g: "Apple Inc."
-@property(readonly) NSString *orgName;
-
-/// Organizational Unit Name e.g: "Apple Software"
-@property(readonly) NSString *orgUnit;
-
-/// Issuer details, same fields as above.
-@property(readonly) NSString *issuerCommonName;
-@property(readonly) NSString *issuerCountryName;
-@property(readonly) NSString *issuerOrgName;
-@property(readonly) NSString *issuerOrgUnit;
-
-/// Validity Not Before
-@property(readonly) NSDate *validFrom;
-
-/// Validity Not After
-@property(readonly) NSDate *validUntil;
-
-@end

Source/common/SNTCertificate.m

@@ -1,336 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTCertificate.h"
-
-#import <CommonCrypto/CommonDigest.h>
-#import <Security/Security.h>
-
-@interface SNTCertificate ()
-/// A container for cached property values
-@property NSMutableDictionary *memoizedData;
-@end
-
-@implementation SNTCertificate
-
-static NSString *const kCertDataKey = @"certData";
-
-#pragma mark Init/Dealloc
-
-- (instancetype)initWithSecCertificateRef:(SecCertificateRef)certRef {
-  self = [super init];
-  if (self) {
-    _certRef = certRef;
-    CFRetain(_certRef);
-  }
-  return self;
-}
-
-- (instancetype)initWithCertificateDataDER:(NSData *)certData {
-  SecCertificateRef cert = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certData);
-
-  if (cert) {
-    // Despite the header file claiming that SecCertificateCreateWithData will return NULL if
-    // |certData| doesn't contain a valid DER-encoded X509 cert, this isn't always true.
-    // radar://problem/16124651
-    // To workaround, check that the certificate serial number can be retrieved.
-    NSData *ser = CFBridgingRelease(SecCertificateCopySerialNumber(cert, NULL));
-    if (ser) {
-      self = [self initWithSecCertificateRef:cert];
-    } else {
-      self = nil;
-    }
-    CFRelease(cert);  // was retained in initWithSecCertificateRef
-  } else {
-    self = nil;
-  }
-
-  return self;
-}
-
-- (instancetype)initWithCertificateDataPEM:(NSString *)certData {
-  // Find the PEM and extract the base64-encoded DER data from within
-  NSScanner *scanner = [NSScanner scannerWithString:certData];
-  NSString *base64der;
-
-  // Locate and parse DER data into |base64der|
-  [scanner scanUpToString:@"-----BEGIN CERTIFICATE-----" intoString:NULL];
-  if (!([scanner scanString:@"-----BEGIN CERTIFICATE-----" intoString:NULL] &&
-        [scanner scanUpToString:@"-----END CERTIFICATE-----" intoString:&base64der] &&
-        [scanner scanString:@"-----END CERTIFICATE-----" intoString:NULL])) {
-    return nil;
-  }
-
-  // base64-decode the DER
-  SecTransformRef transform = SecDecodeTransformCreate(kSecBase64Encoding, NULL);
-  if (!transform) return nil;
-  NSData *input = [base64der dataUsingEncoding:NSUTF8StringEncoding];
-  NSData *output = nil;
-
-  if (SecTransformSetAttribute(transform,
-                             kSecTransformInputAttributeName,
-                             (__bridge CFDataRef)input,
-                             NULL)) {
-    output = CFBridgingRelease(SecTransformExecute(transform, NULL));
-  }
-  if (transform) CFRelease(transform);
-
-  return [self initWithCertificateDataDER:output];
-}
-
-+ (NSArray *)certificatesFromPEM:(NSString *)pemData {
-  NSScanner *scanner = [NSScanner scannerWithString:pemData];
-  NSMutableArray *certs = [[NSMutableArray alloc] init];
-
-  while (YES) {
-    NSString *curCert;
-
-    [scanner scanUpToString:@"-----BEGIN CERTIFICATE-----" intoString:NULL];
-    [scanner scanUpToString:@"-----END CERTIFICATE-----" intoString:&curCert];
-
-    // If there was no data, break.
-    if (!curCert) break;
-
-    curCert = [curCert stringByAppendingString:@"-----END CERTIFICATE-----"];
-    SNTCertificate *cert = [[SNTCertificate alloc] initWithCertificateDataPEM:curCert];
-
-    // If the data couldn't be turned into a valid SNTCertificate, continue.
-    if (!cert) continue;
-
-    [certs addObject:cert];
-  }
-
-  return certs;
-}
-
-- (instancetype)init {
-  [self doesNotRecognizeSelector:_cmd];
-  return nil;
-}
-
-- (void)dealloc {
-  if (_certRef) CFRelease(_certRef);
-}
-
-#pragma mark Equality & description
-
-- (BOOL)isEqual:(SNTCertificate *)other {
-  if (self == other) return YES;
-  if (![other isKindOfClass:[SNTCertificate class]]) return NO;
-
-  return [self.certData isEqual:other.certData];
-}
-
-- (NSUInteger)hash {
-  return [self.certData hash];
-}
-
-- (NSString *)description {
-  return [NSString stringWithFormat:@"/O=%@/OU=%@/CN=%@",
-          self.orgName,
-          self.orgUnit,
-          self.commonName];
-}
-
-#pragma mark NSSecureCoding
-
-+ (BOOL)supportsSecureCoding {
-  return YES;
-}
-
-- (void)encodeWithCoder:(NSCoder *)coder {
-  [coder encodeObject:self.certData forKey:kCertDataKey];
-}
-
-- (instancetype)initWithCoder:(NSCoder *)decoder {
-  NSData *certData = [decoder decodeObjectOfClass:[NSData class] forKey:kCertDataKey];
-  if ([certData length] == 0) return nil;
-  SecCertificateRef cert = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certData);
-  self = [self initWithSecCertificateRef:cert];
-  if (cert) CFRelease(cert);
-  return self;
-}
-
-#pragma mark Private Accessors
-
-/// For a given selector, caches the value that selector would return on subsequent invocations,
-/// using the provided block to get the value on the first invocation.
-/// Assumes the selector's value will never change.
-- (id)memoizedSelector:(SEL)selector forBlock:(id (^)(void))block {
-  NSString *selName = NSStringFromSelector(selector);
-
-  if (!self.memoizedData) {
-    self.memoizedData = [NSMutableDictionary dictionary];
-  }
-
-  if (!self.memoizedData[selName]) {
-    id val = block();
-    if (val) {
-      self.memoizedData[selName] = val;
-    } else {
-      self.memoizedData[selName] = [NSNull null];
-    }
-  }
-
-  // Return the value if there is one, or nil if the value is NSNull
-  return self.memoizedData[selName] != [NSNull null] ? self.memoizedData[selName] : nil;
-}
-
-- (NSDictionary *)allCertificateValues {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return CFBridgingRelease(SecCertificateCopyValues(self.certRef, NULL, NULL));
-  }];
-}
-
-- (NSDictionary *)x509SubjectName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self allCertificateValues][(__bridge NSString *)kSecOIDX509V1SubjectName];
-  }];
-}
-
-- (NSDictionary *)x509IssuerName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self allCertificateValues][(__bridge NSString *)kSecOIDX509V1IssuerName];
-  }];
-}
-
-/// Retrieve the value with the specified label from the X509 dictionary provided
-/// @param desiredLabel The label you want, e.g: kSecOIDOrganizationName.
-/// @param dict The dictionary to look in (Subject or Issuer)
-/// @returns An @c NSString, the value for the specified label.
-- (NSString *)x509ValueForLabel:(NSString *)desiredLabel fromDictionary:(NSDictionary *)dict {
-  @try {
-    NSArray *valArray = dict[(__bridge NSString *)kSecPropertyKeyValue];
-
-    for (NSDictionary *curCertVal in valArray) {
-      NSString *valueLabel = curCertVal[(__bridge NSString *)kSecPropertyKeyLabel];
-      if ([valueLabel isEqual:desiredLabel]) {
-        return curCertVal[(__bridge NSString *)kSecPropertyKeyValue];
-      }
-    }
-    return nil;
-  }
-  @catch (NSException *exception) {
-    return nil;
-  }
-}
-
-/// Retrieve the specified date from the certificate's values and convert from a reference date
-/// to an NSDate object.
-/// @param key The identifier for the date: @c kSecOIDX509V1ValiditityNot{Before,After}
-/// @return An @c NSDate representing the date and time the certificate is valid from or expires.
-- (NSDate *)dateForX509Key:(NSString *)key {
-  NSDictionary *curCertVal = [self allCertificateValues][key];
-  NSNumber *value = curCertVal[(__bridge NSString *)kSecPropertyKeyValue];
-
-  NSTimeInterval interval = [value doubleValue];
-  if (interval) {
-    return [NSDate dateWithTimeIntervalSinceReferenceDate:interval];
-  }
-
-  return nil;
-}
-
-#pragma mark Public Accessors
-
-- (NSString *)SHA1 {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      NSMutableData *SHA1Buffer = [[NSMutableData alloc] initWithCapacity:CC_SHA1_DIGEST_LENGTH];
-
-      CC_SHA1([self.certData bytes], (CC_LONG)[self.certData length], [SHA1Buffer mutableBytes]);
-
-      const unsigned char *bytes = (const unsigned char *)[SHA1Buffer bytes];
-      return [NSString stringWithFormat:
-          @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
-          bytes[0], bytes[1], bytes[2], bytes[3], bytes[4], bytes[5], bytes[6], bytes[7], bytes[8],
-          bytes[9], bytes[10], bytes[11], bytes[12], bytes[13], bytes[14], bytes[15], bytes[16],
-          bytes[17], bytes[18], bytes[19]];
-  }];
-}
-
-- (NSData *)certData {
-  return CFBridgingRelease(SecCertificateCopyData(self.certRef));
-}
-
-- (NSString *)commonName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      CFStringRef commonName = NULL;
-      SecCertificateCopyCommonName(self.certRef, &commonName);
-      return CFBridgingRelease(commonName);
-  }];
-}
-
-- (NSString *)countryName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDCountryName
-                      fromDictionary:[self x509SubjectName]];
-  }];
-}
-
-- (NSString *)orgName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDOrganizationName
-                      fromDictionary:[self x509SubjectName]];
-  }];
-}
-
-- (NSString *)orgUnit {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDOrganizationalUnitName
-                      fromDictionary:[self x509SubjectName]];
-  }];
-}
-
-- (NSDate *)validFrom {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self dateForX509Key:(__bridge NSString *)kSecOIDX509V1ValidityNotBefore];
-  }];
-}
-
-- (NSDate *)validUntil {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self dateForX509Key:(__bridge NSString *)kSecOIDX509V1ValidityNotAfter];
-  }];
-}
-
-- (NSString *)issuerCommonName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDCommonName
-                      fromDictionary:[self x509IssuerName]];
-  }];
-}
-
-- (NSString *)issuerCountryName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDCountryName
-                      fromDictionary:[self x509IssuerName]];
-  }];
-}
-
-- (NSString *)issuerOrgName {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDOrganizationName
-                      fromDictionary:[self x509IssuerName]];
-  }];
-}
-
-- (NSString *)issuerOrgUnit {
-  return [self memoizedSelector:_cmd forBlock:^id{
-      return [self x509ValueForLabel:(__bridge NSString *)kSecOIDOrganizationalUnitName
-                      fromDictionary:[self x509IssuerName]];
-  }];
-}
-
-
-@end

Source/common/SNTCodesignChecker.h

@@ -1,55 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-@class SNTCertificate;
-
-/// SNTCodesignChecker validates a binary (either on-disk or in memory) has been signed
-/// and if so allows for pulling out the certificates that were used to sign it.
-@interface SNTCodesignChecker : NSObject
-
-/// The SecStaticCodeRef that this SNTCodesignChecker is working around
-@property(readonly) SecStaticCodeRef codeRef;
-
-/// Returns a dictionary of raw signing information
-@property(readonly) NSDictionary *signingInformation;
-
-/// Returns an array of @c SNTCertificate objects representing the chain that signed this binary.
-@property(readonly) NSArray *certificates;
-
-/// Returns the leaf certificate that this binary was signed with
-@property(readonly) SNTCertificate *leafCertificate;
-
-/// Returns the on-disk path of this binary.
-@property(readonly) NSString *binaryPath;
-
-/// Initialize an @c SNTCodesignChecker with a SecStaticCodeRef
-/// Designated initializer.
-/// Takes ownership of @c codeRef.
-- (instancetype)initWithSecStaticCodeRef:(SecStaticCodeRef)codeRef;
-
-/// Initialize an @c SNTCodesignChecker with a binary on disk.
-/// Returns nil if @c binaryPath does not exist, is not a binary or is not codesigned.
-- (instancetype)initWithBinaryPath:(NSString *)binaryPath;
-
-/// Initialize an @c SNTCodesignChecker with the PID of a running process.
-- (instancetype)initWithPID:(pid_t)PID;
-
-/// Initialize an @c SNTCodesignChecker for the currently-running process.
-- (instancetype)initWithSelf;
-
-/// Returns true if the binary represented by @c otherChecker has signing information that matches
-/// this binary.
-- (BOOL)signingInformationMatches:(SNTCodesignChecker *)otherChecker;
-
-@end

Source/common/SNTCodesignChecker.m

@@ -1,190 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTCodesignChecker.h"
-
-#import <Security/Security.h>
-
-#import "SNTCertificate.h"
-
-
-// kStaticSigningFlags are the flags used when validating signatures on disk.
-//
-// Don't validate resources but do validate nested code. Ignoring resources _dramatically_ speeds
-// up validation (see below) but does mean images, plists, etc will not be checked and modifying
-// these will not be considered invalid. To ensure any code inside the binary is still checked,
-// we check nested code.
-//
-// Timings with different flags:
-//   Checking Xcode 5.1.1 bundle:
-//      kSecCSDefaultFlags:                                   3.895s
-//      kSecCSDoNotValidateResources:                         0.013s
-//      kSecCSDoNotValidateResources | kSecCSCheckNestedCode: 0.013s
-//
-//   Checking Google Chrome 36.0.1985.143 bundle:
-//      kSecCSDefaultFlags:                                   0.529s
-//      kSecCSDoNotValidateResources:                         0.032s
-//      kSecCSDoNotValidateResources | kSecCSCheckNestedCode: 0.033s
-//
-const SecCSFlags kStaticSigningFlags = kSecCSDoNotValidateResources | kSecCSCheckNestedCode;
-
-// kSigningFlags are the flags used when validating signatures for running binaries.
-//
-// No special flags needed currently.
-const SecCSFlags kSigningFlags = kSecCSDefaultFlags;
-
-
-@implementation SNTCodesignChecker {
-  /// Array of @c SNTCertificate's representing the chain of certs this executable was signed with.
-  NSMutableArray *_certificates;
-}
-
-#pragma mark Init/dealloc
-
-- (instancetype)initWithSecStaticCodeRef:(SecStaticCodeRef)codeRef {
-  self = [super init];
-
-  if (self) {
-    // First check the signing is valid
-    if (CFGetTypeID(codeRef) == SecStaticCodeGetTypeID()) {
-      if (SecStaticCodeCheckValidity(codeRef, kStaticSigningFlags, NULL) != errSecSuccess) {
-        return nil;
-      }
-    } else if (CFGetTypeID(codeRef) == SecCodeGetTypeID()) {
-      if (SecCodeCheckValidity((SecCodeRef)codeRef, kSigningFlags, NULL) != errSecSuccess) {
-        return nil;
-      }
-    } else {
-      return nil;
-    }
-
-    // Get CFDictionary of signing information for binary
-    OSStatus status = errSecSuccess;
-    CFDictionaryRef signingDict = NULL;
-    status = SecCodeCopySigningInformation(codeRef, kSecCSSigningInformation, &signingDict);
-    _signingInformation = CFBridgingRelease(signingDict);
-    if (status != errSecSuccess) return nil;
-
-    // Get array of certificates.
-    NSArray *certs = _signingInformation[(id)kSecCodeInfoCertificates];
-    if (!certs) return nil;
-
-    // Wrap SecCertificateRef objects in SNTCertificate and put in a new NSArray
-    _certificates = [[NSMutableArray alloc] initWithCapacity:certs.count];
-    for (int i = 0; i < certs.count; ++i) {
-      SecCertificateRef certRef = (__bridge SecCertificateRef)certs[i];
-      SNTCertificate *newCert = [[SNTCertificate alloc] initWithSecCertificateRef:certRef];
-      [_certificates addObject:newCert];
-    }
-
-    _codeRef = codeRef;
-    CFRetain(_codeRef);
-  }
-
-  return self;
-}
-
-- (instancetype)initWithBinaryPath:(NSString *)binaryPath {
-  SecStaticCodeRef codeRef = NULL;
-
-  // Get SecStaticCodeRef for binary
-  if (SecStaticCodeCreateWithPath((__bridge CFURLRef)[NSURL fileURLWithPath:binaryPath
-                                                                isDirectory:NO],
-                                  kSecCSDefaultFlags,
-                                  &codeRef) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeRef];
-  } else {
-    self = nil;
-  }
-
-  if (codeRef) CFRelease(codeRef);
-  return self;
-}
-
-- (instancetype)initWithPID:(pid_t)PID {
-  SecCodeRef codeRef = NULL;
-  NSDictionary *attributes = @{(__bridge NSString *)kSecGuestAttributePid: @(PID)};
-
-  if (SecCodeCopyGuestWithAttributes(NULL,
-                                     (__bridge CFDictionaryRef)attributes,
-                                     kSecCSDefaultFlags,
-                                     &codeRef) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeRef];
-  } else {
-    self = nil;
-  }
-
-  if (codeRef) CFRelease(codeRef);
-  return self;
-}
-
-- (instancetype)initWithSelf {
-  SecCodeRef codeSelf = NULL;
-  if (SecCodeCopySelf(kSecCSDefaultFlags, &codeSelf) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeSelf];
-  } else {
-    self = nil;
-  }
-
-  if (codeSelf) CFRelease(codeSelf);
-  return self;
-}
-
-- (instancetype)init {
-  [self doesNotRecognizeSelector:_cmd];
-  return nil;
-}
-
-- (void)dealloc {
-  if (_codeRef) {
-    CFRelease(_codeRef);
-    _codeRef = NULL;
-  }
-}
-
-#pragma mark Description
-
-- (NSString *)description {
-  NSString *binarySource;
-  if (CFGetTypeID(self.codeRef) == SecStaticCodeGetTypeID()) {
-    binarySource = @"On-disk";
-  } else {
-    binarySource = @"In-memory";
-  }
-
-  return [NSString stringWithFormat:@"%@ binary, signed by %@, located at: %@",
-             binarySource,
-             self.leafCertificate.orgName,
-             self.binaryPath];
-}
-
-#pragma mark Public accessors
-
-- (SNTCertificate *)leafCertificate {
-  return [self.certificates firstObject];
-}
-
-- (NSString *)binaryPath {
-  CFURLRef path;
-  OSStatus status = SecCodeCopyPath(_codeRef, kSecCSDefaultFlags, &path);
-  NSURL *pathURL = CFBridgingRelease(path);
-  if (status != errSecSuccess) return nil;
-  return [pathURL path];
-}
-
-- (BOOL)signingInformationMatches:(SNTCodesignChecker *)otherChecker {
-  return [self.certificates isEqual:otherChecker.certificates];
-}
-
-@end

Source/common/SNTCodesignChecker.m.old

@@ -1,213 +0,0 @@
-#import "SNTCodesignChecker.h"
-
-#import <Security/Security.h>
-
-#import "SNTCertificate.h"
-
-
-// kStaticSigningFlags are the flags used when validating signatures on disk.
-//
-// Don't validate resources but do validate nested code. Ignoring resources _dramatically_ speeds
-// up validation (see below) but does mean images, plists, etc will not be checked and modifying
-// these will not be considered invalid. To ensure any code inside the binary is still checked,
-// we check nested code.
-//
-// Timings with different flags:
-//   Checking Xcode 5.1.1 bundle:
-//      kSecCSDefaultFlags:                                   3.895s
-//      kSecCSDoNotValidateResources:                         0.013s
-//      kSecCSDoNotValidateResources | kSecCSCheckNestedCode: 0.013s
-//
-//   Checking Google Chrome 36.0.1985.143 bundle:
-//      kSecCSDefaultFlags:                                   0.529s
-//      kSecCSDoNotValidateResources:                         0.032s
-//      kSecCSDoNotValidateResources | kSecCSCheckNestedCode: 0.033s
-//
-const SecCSFlags kStaticSigningFlags = kSecCSDoNotValidateResources | kSecCSCheckNestedCode;
-
-// kSigningFlags are the flags used when validating signatures for running binaries.
-//
-// No special flags needed currently.
-const SecCSFlags kSigningFlags = kSecCSDefaultFlags;
-
-
-@implementation SNTCodesignChecker
-
-#pragma mark Init/dealloc
-
-- (instancetype)initWithSecStaticCodeRef:(SecStaticCodeRef)codeRef {
-  self = [super init];
-
-  if (self) {
-    _codeRef = codeRef;
-    CFRetain(_codeRef);
-  }
-
-  return self;
-}
-
-- (instancetype)initWithBinaryPath:(NSString *)binaryPath {
-  SecStaticCodeRef codeRef = NULL;
-
-  // Get SecStaticCodeRef for binary
-  if (SecStaticCodeCreateWithPath((__bridge CFURLRef)[NSURL fileURLWithPath:binaryPath
-                                                                isDirectory:NO],
-                                  kSecCSDefaultFlags,
-                                  &codeRef) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeRef];
-  } else {
-    self = nil;
-  }
-
-  if (codeRef) CFRelease(codeRef);
-  return self;
-}
-
-- (instancetype)initWithPID:(pid_t)PID {
-  SecCodeRef codeRef = NULL;
-  NSDictionary *attributes = @{(__bridge NSString *)kSecGuestAttributePid: @(PID)};
-
-  if (SecCodeCopyGuestWithAttributes(NULL,
-                                     (__bridge CFDictionaryRef)attributes,
-                                     kSecCSDefaultFlags,
-                                     &codeRef) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeRef];
-  } else {
-    self = nil;
-  }
-
-  if (codeRef) CFRelease(codeRef);
-  return self;
-}
-
-- (instancetype)initWithSelf {
-  SecCodeRef codeSelf = NULL;
-  if (SecCodeCopySelf(kSecCSDefaultFlags, &codeSelf) == errSecSuccess) {
-    self = [self initWithSecStaticCodeRef:codeSelf];
-  } else {
-    self = nil;
-  }
-
-  if (codeSelf) CFRelease(codeSelf);
-  return self;
-}
-
-- (instancetype)init {
-  [self doesNotRecognizeSelector:_cmd];
-  return nil;
-}
-
-- (void)dealloc {
-  if (_codeRef) CFRelease(_codeRef);
-}
-
-#pragma mark Validate
-
-- (OSStatus)validate {
-  return [self validateWithRequirement:NULL];
-}
-
-- (OSStatus)validateAppleAnchor {
-  SecRequirementRef req = NULL;
-  SecRequirementCreateWithString(CFSTR("anchor apple"), kSecCSDefaultFlags, &req);
-  return [self validateWithRequirement:req];
-}
-
-- (OSStatus)validateAppleAnchorGeneric {
-  SecRequirementRef req = NULL;
-  SecRequirementCreateWithString(CFSTR("anchor apple generic"), kSecCSDefaultFlags, &req);
-  return [self validateWithRequirement:req];
-}
-
-- (OSStatus)validateWithRequirement:(SecRequirementRef)requirement {
-  // Validate the binary and save the return code.
-  if (CFGetTypeID(self.codeRef) == SecStaticCodeGetTypeID()) {
-    return SecStaticCodeCheckValidity(self.codeRef, kStaticSigningFlags, requirement);
-  } else if (CFGetTypeID(self.codeRef) == SecCodeGetTypeID()) {
-    return SecCodeCheckValidity((SecCodeRef)self.codeRef, kSigningFlags, requirement);
-  } else {
-    return errSecCSSignatureNotVerifiable;
-  }
-}
-
-#pragma mark Description
-
-- (NSString *)description {
-  NSString *retStr;
-  if (CFGetTypeID(self.codeRef) == SecStaticCodeGetTypeID()) {
-    retStr = @"On-disk binary, ";
-  } else {
-    retStr = @"In-memory binary, ";
-  }
-
-  if ([self validate] == errSecSuccess) {
-    [retStr appendFormat:@"signed by %@, ", self.leafCertificate.orgName];
-  } else {
-    [retStr appendFormat:@"unsigned, "];
-  }
-
-  [retStr appendFormat:@"located at: %@", self.binaryPath];
-
-  return retStr;
-}
-
-#pragma mark Public accessors
-
-- (NSDictionary *)signingInformation {
-  static NSDictionary *signingInformation = nil;
-  static dispatch_once_t onceToken;
-  dispatch_once(&onceToken, ^{
-    // Get dictionary of signing information for binary
-    CFDictionaryRef signingDict = NULL;
-    SecCodeCopySigningInformation(self.codeRef, kSecCSSigningInformation, &signingDict);
-    signingInformation = CFBridgingRelease(signingDict);
-  });
-  return signingInformation;
-}
-
-- (NSArray *)certificates {
-  static NSArray *certificates = nil;
-  static dispatch_once_t onceToken;
-  dispatch_once(&onceToken, ^{
-    // Get array of certificates, wrap each one in a SNTCertificate and store in a new array.
-    NSArray *certs = self.signingInformation[(__bridge NSString *)kSecCodeInfoCertificates];
-
-    NSMutableArray *tempCerts = [[NSMutableArray alloc] initWithCapacity:certs.count];
-    for (id cert in certs) {
-      SNTCertificate *newCert =
-          [[SNTCertificate alloc] initWithSecCertificateRef:(SecCertificateRef)cert];
-      if (newCert) [tempCerts addObject:newCert];
-    }
-    certificates = [tempCerts copy];
-  });
-  return certificates;
-}
-
-- (SNTCertificate *)leafCertificate {
-  return [self.certificates firstObject];
-}
-
-- (NSString *)binaryPath {
-  CFURLRef path;
-  OSStatus status = SecCodeCopyPath(_codeRef, kSecCSDefaultFlags, &path);
-  NSURL *pathURL = CFBridgingRelease(path);
-  if (status != errSecSuccess) return nil;
-  return [pathURL path];
-}
-
-#pragma mark Comparisons
-
-- (BOOL)signingChainMatches:(SNTCodesignChecker *)otherChecker {
-  return [self.certificates isEqual:otherChecker.certificates];
-}
-
-- (BOOL)teamSigningMatches:(SNTCodesignChecker *)otherChecker {
-  SNTCertificate *myLeaf = [self.certificates firstObject];
-  SNTCertificate *otherLeaf = [otherChecker.certificates firstObject];
-
-  return ([myLeaf.orgUnit isEqual:otherLeaf.orgUnit] &&
-          [self validateAppleAnchorGeneric] &&
-          [otherChecker validateAppleAnchorGeneric]);
-}
-
-@end

Source/common/SNTCommonEnums.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,55 +12,66 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#ifndef SANTA__COMMON__COMMONENUMS_H
-#define SANTA__COMMON__COMMONENUMS_H
+@import Foundation;
 
-// These enums are used in various places throughout the Santa client code.
-// The integer values are also stored in the database and so shouldn't be changed.
+///
+///  These enums are used in various places throughout the Santa client code.
+///  The integer values are also stored in the database and so shouldn't be changed.
+///
 
-// Each enum contains an _UNKNOWN and a _MAX value, which the valid values must be between so that
-// the code can easily verify valid values.
+typedef NS_ENUM(NSInteger, SNTRuleType) {
+  SNTRuleTypeUnknown,
 
-typedef enum {
-  RULETYPE_UNKNOWN,
+  SNTRuleTypeBinary = 1,
+  SNTRuleTypeCertificate = 2,
+};
 
-  RULETYPE_BINARY   = 1,
-  RULETYPE_CERT     = 2,
+typedef NS_ENUM(NSInteger, SNTRuleState) {
+  SNTRuleStateUnknown,
 
-  RULETYPE_MAX
-} santa_ruletype_t;
+  SNTRuleStateWhitelist = 1,
+  SNTRuleStateBlacklist = 2,
+  SNTRuleStateSilentBlacklist = 3,
+  SNTRuleStateRemove = 4,
+};
 
-typedef enum {
-  RULESTATE_UNKNOWN,
+typedef NS_ENUM(NSInteger, SNTClientMode) {
+  SNTClientModeUnknown,
 
-  RULESTATE_WHITELIST        = 1,
-  RULESTATE_BLACKLIST        = 2,
-  RULESTATE_SILENT_BLACKLIST = 3,
-  RULESTATE_REMOVE           = 4,
+  SNTClientModeMonitor = 1,
+  SNTClientModeLockdown = 2,
+};
 
-  RULESTATE_MAX
-} santa_rulestate_t;
+typedef NS_ENUM(NSInteger, SNTEventState) {
+  // Bits 0-15 bits store non-decision types
+  SNTEventStateUnknown = 0,
+  SNTEventStateBundleBinary = 1,
 
-typedef enum {
-  CLIENTMODE_UNKNOWN,
+  // Bits 16-23 store deny decision types
+  SNTEventStateBlockUnknown = 1 << 16,
+  SNTEventStateBlockBinary = 1 << 17,
+  SNTEventStateBlockCertificate = 1 << 18,
+  SNTEventStateBlockScope = 1 << 19,
 
-  CLIENTMODE_MONITOR  = 1,
-  CLIENTMODE_LOCKDOWN = 2,
+  // Bits 24-31 store allow decision types
+  SNTEventStateAllowUnknown = 1 << 24,
+  SNTEventStateAllowBinary = 1 << 25,
+  SNTEventStateAllowCertificate = 1 << 26,
+  SNTEventStateAllowScope = 1 << 27,
 
-  CLIENTMODE_MAX
-} santa_clientmode_t;
+  // Block and Allow masks
+  SNTEventStateBlock = 0xFF << 16,
+  SNTEventStateAllow = 0xFF << 24
+};
 
-typedef enum {
-  EVENTSTATE_UNKNOWN,
+typedef NS_ENUM(NSInteger, SNTRuleTableError) {
+  SNTRuleTableErrorEmptyRuleArray,
+  SNTRuleTableErrorInsertOrReplaceFailed,
+  SNTRuleTableErrorInvalidRule,
+  SNTRuleTableErrorMissingRequiredRule,
+  SNTRuleTableErrorRemoveFailed
+};
 
-  EVENTSTATE_ALLOW_UNKNOWN     = 1,
-  EVENTSTATE_ALLOW_BINARY      = 2,
-  EVENTSTATE_ALLOW_CERTIFICATE = 3,
-  EVENTSTATE_BLOCK_UNKNOWN     = 4,
-  EVENTSTATE_BLOCK_BINARY      = 5,
-  EVENTSTATE_BLOCK_CERTIFICATE = 6,
-
-  EVENTSTATE_MAX
-} santa_eventstate_t;
-
-#endif  // SANTA__COMMON__COMMONENUMS_H
+static const char *kKextPath = "/Library/Extensions/santa-driver.kext";
+static const char *kSantaDPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santad";
+static const char *kSantaCtlPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santactl";

Source/common/SNTConfigurator.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,50 +12,210 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#include "SNTCommonEnums.h"
+@import Foundation;
 
-/// Singleton that provides an interface for managing configuration values on disk
-/// n.b: This class is designed as a singleton but is not enforced.
+#import "SNTCommonEnums.h"
+
+///
+///  Singleton that provides an interface for managing configuration values on disk
+///  @note This class is designed as a singleton but that is not strictly enforced.
+///
 @interface SNTConfigurator : NSObject
 
-/// The operating mode
-@property santa_clientmode_t clientMode;
+///  Default config file path
+extern NSString *const kDefaultConfigFilePath;
 
-/// If YES, debug logging is enabled
-@property(readonly) BOOL debugLogging;
+#pragma mark - Daemon Settings
 
-# pragma mark - Sync Settings
+///
+///  The operating mode.
+///
+@property(nonatomic) SNTClientMode clientMode;
 
-/// The base URL of the sync server
-@property(readonly) NSURL *syncBaseURL;
+///
+///  The regex of paths to log file changes for. Regexes are specified in ICU format.
+///
+///  The regex flags IXSM can be used, though the s (dotalL) and m (multiline) flags are
+///  pointless as a path only ever has a single line.
+///  If the regex doesn't begin with ^ to match from the beginning of the line, it will be added.
+///
+@property(nonatomic) NSRegularExpression *fileChangesRegex;
 
-/// The machine owner
-@property(readonly) NSString *machineOwner;
+///
+///  The regex of whitelisted paths. Regexes are specified in ICU format.
+///
+///  The regex flags IXSM can be used, though the s (dotall) and m (multiline) flags are
+///  pointless as a path only ever has a single line.
+///  If the regex doesn't begin with ^ to match from the beginning of the line, it will be added.
+///
+@property(nonatomic) NSRegularExpression *whitelistPathRegex;
 
-/// If set, this over-rides the default machine ID used for syncing
-@property(readonly) NSString *machineIDOverride;
+///
+///  The regex of blacklisted paths. Regexes are specified in ICU format.
+///
+///  The regex flags IXSM can be used, though the s (dotall) and m (multiline) flags are
+///  pointless as a path only ever has a single line.
+///  If the regex doesn't begin with ^ to match from the beginning of the line, it will be added.
+///
+@property(nonatomic) NSRegularExpression *blacklistPathRegex;
 
-# pragma mark Server Auth Settings
+///
+///  Enable __PAGEZERO protection, defaults to YES
+///  If this flag is set to NO, 32-bit binaries that are missing
+///  the __PAGEZERO segment will not be blocked.
+///
+@property(readonly, nonatomic) BOOL enablePageZeroProtection;
 
-/// If set, this is valid PEM containing one or more certificates to be used to evaluate the
-/// server's SSL chain, overriding the list of trusted CAs distributed with the OS.
-@property(readonly) NSData *syncServerAuthRootsData;
+#pragma mark - GUI Settings
 
-/// This property is the same as the above but is a file on disk containing the PEM data.
-@property(readonly) NSString *syncServerAuthRootsFile;
+///
+///  The URL to open when the user clicks "More Info..." when opening Santa.app.
+///  If unset, the button will not be displayed.
+///
+@property(readonly, nonatomic) NSURL *moreInfoURL;
 
-# pragma mark Client Auth Settings
+///
+///  When the user gets a block notification, a button can be displayed which will
+///  take them to a web page with more information about that event.
+///  There are two properties, one for individual binaries and one for binaries that are part
+///  of a bundle. If the latter is not set the former will be used.
+///
+///  This property contains a kind of format string to be turned into the URL to send them to.
+///  The following sequences will be replaced in the final URL:
+///
+///  %file_sha%    -- SHA-256 of the file that was blocked.
+///  %machine_id%  -- ID of the machine.
+///  %username%    -- executing user.
+///  %bundle_id%   -- bundle id of the binary, if applicable.
+///  %bundle_ver%  -- bundle version of the binary, if applicable.
+///
+///  @note: This is not an NSURL because the format-string parsing is done elsewhere.
+///
+///  If this item isn't set, the Open Event button will not be displayed.
+///
+@property(readonly, nonatomic) NSString *eventDetailURL;
+@property(readonly, nonatomic) NSString *eventDetailBundleURL;
 
-/// If set, this is the Common Name of a certificate in the System keychain to be used for
-/// sync authentication. The corresponding private key must also be in the keychain.
-@property(readonly) NSString *syncClientAuthCertificateCn;
+///
+///  Related to the above property, this string represents the text to show on the button.
+///
+@property(readonly, nonatomic) NSString *eventDetailText;
 
-/// If set, this is the Issuer Name of a certificate in the System keychain to be used for
-/// sync authentication. The corresponding private key must also be in the keychain.
-@property(readonly) NSString *syncClientAuthCertificateIssuer;
+///
+///  In lockdown mode this is the message shown to the user when an unknown binary
+///  is blocked. If this message is not configured, a reasonable default is provided.
+///
+@property(readonly, nonatomic) NSString *unknownBlockMessage;
 
+///
+///  This is the message shown to the user when a binary is blocked because of a rule,
+///  if that rule doesn't provide a custom message. If this is not configured, a reasonable
+///  default is provided.
+///
+@property(readonly, nonatomic) NSString *bannedBlockMessage;
 
-/// Retrieve the initialized singleton configurator object
+///
+///  The notification text to display when the client goes into MONITOR mode.
+///  Defaults to "Switching into Monitor mode"
+///
+@property(readonly, nonatomic) NSString *modeNotificationMonitor;
+
+///
+///  The notification text to display when the client goes into LOCKDOWN mode.
+///  Defaults to "Switching into Lockdown mode"
+///
+@property(readonly, nonatomic) NSString *modeNotificationLockdown;
+
+#pragma mark - Sync Settings
+
+///
+///  The base URL of the sync server.
+///
+@property(readonly, nonatomic) NSURL *syncBaseURL;
+
+///
+///  The machine owner.
+///
+@property(readonly, nonatomic) NSString *machineOwner;
+
+///
+///  The last date of a successful full sync.
+///
+@property(nonatomic) NSDate *fullSyncLastSuccess;
+
+///
+///  The last date of a successful rule sync.
+///
+@property(nonatomic) NSDate *ruleSyncLastSuccess;
+
+///
+///  If YES a clean sync is required.
+///
+@property(nonatomic) BOOL syncCleanRequired;
+
+///
+///  If set, this over-rides the default machine ID used for syncing.
+///
+@property(readonly, nonatomic) NSString *machineID;
+
+///
+///  If YES, enables bundle detection for blocked events. This property is not stored on disk.
+///  Its value is set by a sync server that supports bundles. Defaults to NO.
+///
+@property BOOL bundlesEnabled;
+
+#pragma mark Server Auth Settings
+
+///
+///  If set, this is valid PEM containing one or more certificates to be used to evaluate the
+///  server's SSL chain, overriding the list of trusted CAs distributed with the OS.
+///
+@property(readonly, nonatomic) NSData *syncServerAuthRootsData;
+
+///
+///  This property is the same as the above but is a file on disk containing the PEM data.
+///
+@property(readonly, nonatomic) NSString *syncServerAuthRootsFile;
+
+#pragma mark Client Auth Settings
+
+///
+///  If set, this contains the location of a PKCS#12 certificate to be used for sync authentication.
+///
+@property(readonly, nonatomic) NSString *syncClientAuthCertificateFile;
+
+///
+///  Contains the password for the pkcs#12 certificate.
+///
+@property(readonly, nonatomic) NSString *syncClientAuthCertificatePassword;
+
+///
+///  If set, this is the Common Name of a certificate in the System keychain to be used for
+///  sync authentication. The corresponding private key must also be in the keychain.
+///
+@property(readonly, nonatomic) NSString *syncClientAuthCertificateCn;
+
+///
+///  If set, this is the Issuer Name of a certificate in the System keychain to be used for
+///  sync authentication. The corresponding private key must also be in the keychain.
+///
+@property(readonly, nonatomic) NSString *syncClientAuthCertificateIssuer;
+
+///
+///  Retrieve an initialized singleton configurator object using the default file path.
+///
 + (instancetype)configurator;
 
+///
+///  Designated initializer.
+///
+///  @param filePath The path to the file to use as a backing store.
+///
+- (instancetype)initWithFilePath:(NSString *)filePath;
+
+///
+///  Re-read config data from disk.
+///
+- (void)reloadConfigData;
+
 @end

Source/common/SNTConfigurator.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -15,57 +15,233 @@
 #import "SNTConfigurator.h"
 
 #import "SNTLogging.h"
+#import "SNTSystemInfo.h"
 
 @interface SNTConfigurator ()
+@property NSString *configFilePath;
 @property NSMutableDictionary *configData;
+
+/// Creating NSRegularExpression objects is not fast, so cache them.
+@property NSRegularExpression *cachedFileChangesRegex;
+@property NSRegularExpression *cachedWhitelistDirRegex;
+@property NSRegularExpression *cachedBlacklistDirRegex;
+
+/// Array of keys that cannot be changed while santad is running if santad didn't make the change.
+@property(readonly) NSArray *protectedKeys;
 @end
 
 @implementation SNTConfigurator
 
 /// The hard-coded path to the config file
-static NSString * const kConfigFilePath = @"/var/db/santa/config.plist";
+NSString *const kDefaultConfigFilePath = @"/var/db/santa/config.plist";
 
 /// The keys in the config file
-static NSString * const kSyncBaseURLKey = @"SyncBaseURL";
-static NSString * const kClientAuthCertificateCNKey = @"ClientAuthCertificateCN";
-static NSString * const kClientAuthCertificateIssuerKey = @"ClientAuthCertificateIssuerCN";
-static NSString * const kServerAuthRootsDataKey = @"ServerAuthRootsData";
-static NSString * const kServerAuthRootsFileKey = @"ServerAuthRootsFile";
-static NSString * const kDebugLoggingKey = @"DebugLogging";
-static NSString * const kClientModeKey = @"ClientMode";
+static NSString *const kClientModeKey = @"ClientMode";
+static NSString *const kFileChangesRegexKey = @"FileChangesRegex";
+static NSString *const kWhitelistRegexKey = @"WhitelistRegex";
+static NSString *const kBlacklistRegexKey = @"BlacklistRegex";
+static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection";
 
-static NSString * const kMachineOwnerKey = @"MachineOwner";
-static NSString * const kMachineIDKey = @"MachineID";
+static NSString *const kMoreInfoURLKey = @"MoreInfoURL";
+static NSString *const kEventDetailURLKey = @"EventDetailURL";
+static NSString *const kEventDetailBundleURLKey = @"EventDetailBundleURL";
+static NSString *const kEventDetailTextKey = @"EventDetailText";
+static NSString *const kUnknownBlockMessage = @"UnknownBlockMessage";
+static NSString *const kBannedBlockMessage = @"BannedBlockMessage";
+static NSString *const kModeNotificationMonitor = @"ModeNotificationMonitor";
+static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";
 
-static NSString * const kMachineOwnerPlistFileKey = @"MachineOwnerPlist";
-static NSString * const kMachineOwnerPlistKeyKey = @"MachineOwnerKey";
+static NSString *const kSyncBaseURLKey = @"SyncBaseURL";
+static NSString *const kFullSyncLastSuccess = @"FullSyncLastSuccess";
+static NSString *const kRuleSyncLastSuccess = @"RuleSyncLastSuccess";
+static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
+static NSString *const kClientAuthCertificateFileKey = @"ClientAuthCertificateFile";
+static NSString *const kClientAuthCertificatePasswordKey = @"ClientAuthCertificatePassword";
+static NSString *const kClientAuthCertificateCNKey = @"ClientAuthCertificateCN";
+static NSString *const kClientAuthCertificateIssuerKey = @"ClientAuthCertificateIssuerCN";
+static NSString *const kServerAuthRootsDataKey = @"ServerAuthRootsData";
+static NSString *const kServerAuthRootsFileKey = @"ServerAuthRootsFile";
 
-static NSString * const kMachineIDPlistFileKey = @"MachineIDPlist";
-static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
+static NSString *const kMachineOwnerKey = @"MachineOwner";
+static NSString *const kMachineIDKey = @"MachineID";
 
-- (instancetype)init {
+static NSString *const kMachineOwnerPlistFileKey = @"MachineOwnerPlist";
+static NSString *const kMachineOwnerPlistKeyKey = @"MachineOwnerKey";
+
+static NSString *const kMachineIDPlistFileKey = @"MachineIDPlist";
+static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";
+
+- (instancetype)initWithFilePath:(NSString *)filePath {
   self = [super init];
   if (self) {
+    _configFilePath = filePath;
     [self reloadConfigData];
   }
   return self;
 }
 
-# pragma mark Singleton retriever
+#pragma mark Singleton retriever
 
 + (instancetype)configurator {
   static SNTConfigurator *sharedConfigurator = nil;
   static dispatch_once_t onceToken;
   dispatch_once(&onceToken, ^{
-    sharedConfigurator = [[SNTConfigurator alloc] init];
+    sharedConfigurator = [[SNTConfigurator alloc] initWithFilePath:kDefaultConfigFilePath];
   });
   return sharedConfigurator;
 }
 
-# pragma mark Public Interface
+#pragma mark Protected Keys
+
+- (NSArray *)protectedKeys {
+  return @[ kClientModeKey, kWhitelistRegexKey, kBlacklistRegexKey,
+            kFileChangesRegexKey, kSyncBaseURLKey ];
+}
+
+#pragma mark Public Interface
+
+- (SNTClientMode)clientMode {
+  NSInteger cm = SNTClientModeUnknown;
+
+  id mode = self.configData[kClientModeKey];
+  if ([mode respondsToSelector:@selector(longLongValue)]) {
+    cm = (NSInteger)[mode longLongValue];
+  }
+
+  if (cm == SNTClientModeMonitor || cm == SNTClientModeLockdown) {
+    return (SNTClientMode)cm;
+  } else {
+    LOGE(@"Client mode was set to bad value: %ld. Resetting to MONITOR.", cm);
+    self.clientMode = SNTClientModeMonitor;
+    return SNTClientModeMonitor;
+  }
+}
+
+- (void)setClientMode:(SNTClientMode)newMode {
+  if (newMode == SNTClientModeMonitor || newMode == SNTClientModeLockdown) {
+    self.configData[kClientModeKey] = @(newMode);
+    [self saveConfigToDisk];
+  } else {
+    LOGW(@"Ignoring request to change client mode to %ld", newMode);
+  }
+}
+
+- (NSRegularExpression *)whitelistPathRegex {
+  if (!self.cachedWhitelistDirRegex && self.configData[kWhitelistRegexKey]) {
+    NSString *re = self.configData[kWhitelistRegexKey];
+    if (![re hasPrefix:@"^"]) re = [@"^" stringByAppendingString:re];
+    self.cachedWhitelistDirRegex = [NSRegularExpression regularExpressionWithPattern:re
+                                                                             options:0
+                                                                               error:NULL];
+  }
+  return self.cachedWhitelistDirRegex;
+}
+
+- (void)setWhitelistPathRegex:(NSRegularExpression *)re {
+  if (!re) {
+    [self.configData removeObjectForKey:kWhitelistRegexKey];
+  } else {
+    self.configData[kWhitelistRegexKey] = [re pattern];
+  }
+  self.cachedWhitelistDirRegex = nil;
+  [self saveConfigToDisk];
+}
+
+- (NSRegularExpression *)blacklistPathRegex {
+  if (!self.cachedBlacklistDirRegex && self.configData[kBlacklistRegexKey]) {
+    NSString *re = self.configData[kBlacklistRegexKey];
+    if (![re hasPrefix:@"^"]) re = [@"^" stringByAppendingString:re];
+    self.cachedBlacklistDirRegex = [NSRegularExpression regularExpressionWithPattern:re
+                                                                             options:0
+                                                                               error:NULL];
+  }
+  return self.cachedBlacklistDirRegex;
+}
+
+- (void)setBlacklistPathRegex:(NSRegularExpression *)re {
+  if (!re) {
+    [self.configData removeObjectForKey:kBlacklistRegexKey];
+  } else {
+    self.configData[kBlacklistRegexKey] = [re pattern];
+  }
+  self.cachedBlacklistDirRegex = nil;
+  [self saveConfigToDisk];
+}
+
+- (NSRegularExpression *)fileChangesRegex {
+  if (!self.cachedFileChangesRegex && self.configData[kFileChangesRegexKey]) {
+    NSString *re = self.configData[kFileChangesRegexKey];
+    if (![re hasPrefix:@"^"]) re = [@"^" stringByAppendingString:re];
+    self.cachedFileChangesRegex = [NSRegularExpression regularExpressionWithPattern:re
+                                                                            options:0
+                                                                              error:NULL];
+  }
+  return self.cachedFileChangesRegex;
+}
+
+- (void)setFileChangesRegex:(NSRegularExpression *)re {
+  if (!re) {
+    [self.configData removeObjectForKey:kFileChangesRegexKey];
+  } else {
+    self.configData[kFileChangesRegexKey] = [re pattern];
+  }
+  self.cachedFileChangesRegex = nil;
+  [self saveConfigToDisk];
+}
+
+- (BOOL)enablePageZeroProtection {
+  NSNumber *keyValue = self.configData[kEnablePageZeroProtectionKey];
+  return keyValue ? [keyValue boolValue] : YES;
+}
+
+- (NSURL *)moreInfoURL {
+  return [NSURL URLWithString:self.configData[kMoreInfoURLKey]];
+}
+
+- (NSString *)eventDetailURL {
+  return self.configData[kEventDetailURLKey];
+}
+
+- (NSString *)eventDetailBundleURL {
+  return self.configData[kEventDetailBundleURLKey];
+}
+
+- (NSString *)eventDetailText {
+  return self.configData[kEventDetailTextKey];
+}
+
+- (NSString *)unknownBlockMessage {
+  return self.configData[kUnknownBlockMessage];
+}
+
+- (NSString *)bannedBlockMessage {
+  return self.configData[kBannedBlockMessage];
+}
+
+- (NSString *)modeNotificationMonitor {
+  return self.configData[kModeNotificationMonitor];
+}
+
+- (NSString *)modeNotificationLockdown {
+  return self.configData[kModeNotificationLockdown];
+}
 
 - (NSURL *)syncBaseURL {
-  return [NSURL URLWithString:self.configData[kSyncBaseURLKey]];
+  NSString *urlStr = self.configData[kSyncBaseURLKey];
+  if (urlStr) {
+    NSURL *url = [NSURL URLWithString:urlStr];
+    if (!url) LOGW(@"SyncBaseURL is not a valid URL!");
+    return url;
+  }
+  return nil;
+}
+
+- (NSString *)syncClientAuthCertificateFile {
+  return self.configData[kClientAuthCertificateFileKey];
+}
+
+- (NSString *)syncClientAuthCertificatePassword {
+  return self.configData[kClientAuthCertificatePasswordKey];
 }
 
 - (NSString *)syncClientAuthCertificateCn {
@@ -84,68 +260,137 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
   return self.configData[kServerAuthRootsFileKey];
 }
 
+- (NSDate *)fullSyncLastSuccess {
+  return self.configData[kFullSyncLastSuccess];
+}
+
+- (void)setFullSyncLastSuccess:(NSDate *)fullSyncLastSuccess {
+  self.configData[kFullSyncLastSuccess] = fullSyncLastSuccess;
+  [self saveConfigToDisk];
+  self.ruleSyncLastSuccess = fullSyncLastSuccess;
+}
+
+- (NSDate *)ruleSyncLastSuccess {
+  return self.configData[kRuleSyncLastSuccess];
+}
+
+- (void)setRuleSyncLastSuccess:(NSDate *)ruleSyncLastSuccess {
+  self.configData[kRuleSyncLastSuccess] = ruleSyncLastSuccess;
+  [self saveConfigToDisk];
+}
+
+- (BOOL)syncCleanRequired {
+  return [self.configData[kSyncCleanRequired] boolValue];
+}
+
+- (void)setSyncCleanRequired:(BOOL)syncCleanRequired {
+  self.configData[kSyncCleanRequired] = @(syncCleanRequired);
+  [self saveConfigToDisk];
+}
+
 - (NSString *)machineOwner {
+  NSString *machineOwner;
+
   if (self.configData[kMachineOwnerPlistFileKey] && self.configData[kMachineOwnerPlistKeyKey]) {
     NSDictionary *plist =
         [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineOwnerPlistFileKey]];
-    return plist[kMachineOwnerPlistKeyKey];
+    machineOwner = plist[self.configData[kMachineOwnerPlistKeyKey]];
   }
 
   if (self.configData[kMachineOwnerKey]) {
-    return self.configData[kMachineOwnerKey];
+    machineOwner = self.configData[kMachineOwnerKey];
   }
 
-  return @"";
+  if (!machineOwner) machineOwner = @"";
+
+  return machineOwner;
 }
 
-- (NSString *)machineIDOverride {
+- (NSString *)machineID {
+  NSString *machineId;
+
   if (self.configData[kMachineIDPlistFileKey] && self.configData[kMachineIDPlistKeyKey]) {
     NSDictionary *plist =
         [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineIDPlistFileKey]];
-    return plist[kMachineIDPlistKeyKey];
+    machineId = plist[self.configData[kMachineIDPlistKeyKey]];
   }
 
   if (self.configData[kMachineIDKey]) {
-    return self.configData[kMachineIDKey];
+    machineId = self.configData[kMachineIDKey];
   }
 
-  return @"";
-}
-
-- (BOOL)debugLogging {
-  return [self.configData[kDebugLoggingKey] boolValue];
-}
-
-- (santa_clientmode_t)clientMode {
-  int cm = [self.configData[kClientModeKey] intValue];
-  if (cm > CLIENTMODE_UNKNOWN && cm < CLIENTMODE_MAX) {
-    return cm;
-  } else {
-    self.configData[kClientModeKey] = @(CLIENTMODE_MONITOR);
-    return CLIENTMODE_MONITOR;
+  if ([machineId length] == 0) {
+    machineId = [SNTSystemInfo hardwareUUID];
   }
+
+  return machineId;
 }
 
-- (void)setClientMode:(santa_clientmode_t)newMode {
-  if (newMode > CLIENTMODE_UNKNOWN && newMode < CLIENTMODE_MAX) {
-    [self reloadConfigData];
-    self.configData[kClientModeKey] = @(newMode);
+- (void)reloadConfigData {
+  NSFileManager *fm = [NSFileManager defaultManager];
+  if (![fm fileExistsAtPath:self.configFilePath]) {
+    // As soon as saveConfigToDisk is called, reloadConfigData will be called again because
+    // of the SNTFileWatchers on the config path. No need to use dictionaryWithCapacity: here.
+    self.configData = [NSMutableDictionary dictionary];
+    self.configData[kClientModeKey] = @(SNTClientModeMonitor);
     [self saveConfigToDisk];
+    return;
+  };
+
+  NSError *error;
+  NSData *readData = [NSData dataWithContentsOfFile:self.configFilePath
+                                            options:NSDataReadingMappedIfSafe
+                                              error:&error];
+  if (error) {
+    LOGE(@"Could not read configuration file: %@, replacing.", [error localizedDescription]);
+    [self saveConfigToDisk];
+    return;
+  }
+
+  NSMutableDictionary *configData =
+      [NSPropertyListSerialization propertyListWithData:readData
+                                                options:NSPropertyListMutableContainers
+                                                 format:NULL
+                                                  error:&error];
+  if (error) {
+    LOGE(@"Could not parse configuration file: %@, replacing.", [error localizedDescription]);
+    [self saveConfigToDisk];
+    return;
+  }
+
+  if (self.syncBaseURL) {
+    // Ensure no-one is trying to change protected keys behind our back.
+    BOOL changed = NO;
+    if (geteuid() == 0) {
+      for (NSString *key in self.protectedKeys) {
+        if (((self.configData[key] && !configData[key]) ||
+             (!self.configData[key] && configData[key]) ||
+             (self.configData[key] && ![self.configData[key] isEqual:configData[key]]))) {
+          if (self.configData[key]) {
+            configData[key] = self.configData[key];
+          } else {
+            [configData removeObjectForKey:key];
+          }
+          changed = YES;
+          LOGI(@"Ignoring changed configuration key: %@", key);
+        }
+      }
+    }
+    self.configData = configData;
+    if (changed) [self saveConfigToDisk];
+  } else {
+    self.configData = configData;
   }
 }
 
 #pragma mark Private
 
+///
+///  Saves the current @c self.configData to disk.
+///
 - (void)saveConfigToDisk {
-  [self.configData writeToFile:kConfigFilePath atomically:YES];
-}
-
-- (void)reloadConfigData {
-  _configData = [[NSDictionary dictionaryWithContentsOfFile:kConfigFilePath] mutableCopy];
-
-  if (!_configData) {
-    _configData = [NSMutableDictionary dictionary];
-  }
+  if (geteuid() != 0) return;
+  [self.configData writeToFile:self.configFilePath atomically:YES];
 }
 
 @end

Source/common/SNTDropRootPrivs.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,6 +12,11 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-/// Simple function to check and drop root privileges.
-/// @return True if dropping was successful or unnecessary.
-BOOL DropRootPrivileges();
+@import Foundation;
+
+///
+///  Simple function to check and drop root privileges.
+///
+///  @return YES if dropping was successful or unnecessary.
+///
+BOOL DropRootPrivileges(void);

Source/common/SNTDropRootPrivs.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,8 +16,9 @@
 
 BOOL DropRootPrivileges() {
   if (getuid() == 0 || geteuid() == 0 || getgid() == 0 || getegid() == 0) {
-    if (setgid(-2) != 0 || setgroups(0, NULL) != 0 || setegid(-2) != 0 ||
-        setuid(-2) != 0 || seteuid(-2) != 0) {
+    uid_t nobody = (uid_t)-2;
+    if (setgid(nobody) != 0 || setgroups(0, NULL) != 0 || setegid(nobody) != 0 ||
+        setuid(nobody) != 0 || seteuid(nobody) != 0) {
       return false;
     }
 
@@ -27,4 +28,4 @@ BOOL DropRootPrivileges() {
   }
 
   return true;
-}
+}

Source/common/SNTFileInfo.h

@@ -0,0 +1,196 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+///
+///  Represents a binary on disk, providing access to details about that binary
+///  such as the SHA-1, SHA-256, Info.plist and the Mach-O data.
+///
+@interface SNTFileInfo : NSObject
+
+///
+///  Designated initializer.
+///
+///  @param path The path of the file this instance is to represent. The path will be
+///      converted to an absolute, standardized path if it isn't already.
+///  @param error If an error occurred and nil is returned, this will be a pointer to an NSError
+///      describing the problem.
+///
+- (instancetype)initWithPath:(NSString *)path error:(NSError **)error;
+
+///
+///  Convenience initializer.
+///
+///  @param path The path to the file this instance is to represent. The path will be
+///      converted to an absolute, standardized path if it isn't already.
+///
+- (instancetype)initWithPath:(NSString *)path;
+
+///
+///  @return Path of this file.
+///
+- (NSString *)path;
+
+///
+///  Hash this file with SHA-1 and SHA-256 simultaneously.
+///
+///  @param sha1 If not NULL, will be filled with the SHA-1 of the file.
+///  @param sha256 If not NULL, will be filled with the SHA-256 of the file.
+///
+- (void)hashSHA1:(NSString **)sha1 SHA256:(NSString **)sha256;
+
+///
+///  @return SHA-1 hash of this binary.
+///
+- (NSString *)SHA1;
+
+///
+///  @return SHA-256 hash of this binary.
+///
+- (NSString *)SHA256;
+
+///
+///  @return The architectures included in this binary (e.g. x86_64, ppc).
+///
+- (NSArray *)architectures;
+
+///
+///  @return YES if this file is a Mach-O file.
+///
+- (BOOL)isMachO;
+
+///
+///  @return YES if this file contains multiple architectures.
+///
+- (BOOL)isFat;
+
+///
+///  @return YES if this file is an executable Mach-O file.
+///
+- (BOOL)isExecutable;
+
+///
+///  @return YES if this file is a dynamic library.
+///
+- (BOOL)isDylib;
+
+///
+///  @return YES if this file is a bundle executable (QuickLook/Spotlight plugin, etc.)
+///
+- (BOOL)isBundle;
+
+///
+///  @return YES if this file is a kernel extension.
+///
+- (BOOL)isKext;
+
+///
+///  @return YES if this file is a script (e.g. it begins #!).
+///
+- (BOOL)isScript;
+
+///
+///  @return YES if this file is an XAR archive.
+///
+- (BOOL)isXARArchive;
+
+///
+///  @return YES if this file is a disk image.
+///
+- (BOOL)isDMG;
+
+///
+///  @return YES if this file has a bad/missing __PAGEZERO .
+///
+- (BOOL)isMissingPageZero;
+
+///
+///  If set to YES, the bundle* and infoPlist methods will search for and use the highest NSBundle
+///  found in the tree. Defaults to NO, which uses the first found bundle, if any.
+///
+///  @example:
+///      An SNTFileInfo object that represents
+///        /Applications/Photos.app/Contents/XPCServices/com.apple.Photos.librarychooserservice.xpc
+///      useAncestorBundle is set to YES
+///        /Applications/Photos.app will be used to get data backing all the bundle methods
+///
+///  @note: The NSBundle object backing the bundle* and infoPlist methods is cached once found.
+///         Setting the useAncestorBundle propery will clear this cache and force a re-search.
+///
+@property(nonatomic) BOOL useAncestorBundle;
+
+///
+///  @return An NSBundle if this file is part of a bundle.
+///
+- (NSBundle *)bundle;
+
+///
+///  @return The path to the bundle this file is a part of, if any.
+///
+- (NSString *)bundlePath;
+
+///
+///  @return Either the Info.plist in the bundle this file is part of, or an embedded plist if there
+///  is one. In the unlikely event that a file has both an embedded Info.plist and is part of a
+///  bundle, the embedded plist will be returned.
+///
+- (NSDictionary *)infoPlist;
+
+///
+///  @return the CFBundleIdentifier from this file's Info.plist.
+///
+- (NSString *)bundleIdentifier;
+
+///
+///  @return the CFBundleName from this file's Info.plist.
+///
+- (NSString *)bundleName;
+
+///
+///  @return the CFBundleVersion from this file's Info.plist.
+///
+- (NSString *)bundleVersion;
+
+///
+///  @return the CFBundleShortVersionString from this file's Info.plist.
+///
+- (NSString *)bundleShortVersionString;
+
+///
+///  @return LaunchServices quarantine data - download URL as an absolute string.
+///
+- (NSString *)quarantineDataURL;
+
+///
+///  @return LaunchServices quarantine data - referer URL as an absolute string.
+///
+- (NSString *)quarantineRefererURL;
+
+///
+///  @return LaunchServices quarantine data - agent bundle ID.
+///
+- (NSString *)quarantineAgentBundleID;
+
+///
+///  @return LaunchServices quarantine data - timestamp.
+///
+- (NSDate *)quarantineTimestamp;
+
+///
+///  @return The size of the file in bytes.
+///
+- (NSUInteger)fileSize;
+
+@end

Source/common/SNTFileInfo.m

@@ -0,0 +1,658 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTFileInfo.h"
+
+#import <CommonCrypto/CommonDigest.h>
+
+#include <mach-o/loader.h>
+#include <mach-o/swap.h>
+#include <pwd.h>
+#include <sys/stat.h>
+#include <sys/xattr.h>
+
+#import <FMDB/FMDB.h>
+
+// Simple class to hold the data of a mach_header and the offset within the file
+// in which that header was found.
+@interface MachHeaderWithOffset : NSObject
+@property NSData *data;
+@property uint32_t offset;
+- (instancetype)initWithData:(NSData *)data offset:(uint32_t)offset;
+@end
+@implementation MachHeaderWithOffset
+- (instancetype)initWithData:(NSData *)data offset:(uint32_t)offset {
+  self = [super init];
+  if (self) {
+    _data = data;
+    _offset = offset;
+  }
+  return self;
+}
+@end
+
+@interface SNTFileInfo ()
+@property NSString *path;
+@property NSFileHandle *fileHandle;
+@property NSUInteger fileSize;
+@property NSString *fileOwnerHomeDir;
+
+// Cached properties
+@property NSBundle *bundleRef;
+@property NSDictionary *infoDict;
+@property NSDictionary *quarantineDict;
+@property NSDictionary *cachedHeaders;
+@end
+
+@implementation SNTFileInfo
+
+extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
+
+- (instancetype)initWithPath:(NSString *)path error:(NSError **)error {
+  self = [super init];
+  if (self) {
+    NSBundle *bndl;
+    _path = [self resolvePath:path bundle:&bndl];
+    _bundleRef = bndl;
+    if (_path.length == 0) {
+      if (error) {
+        NSString *errStr = @"Unable to resolve empty path";
+        if (path) errStr = [@"Unable to resolve path: " stringByAppendingString:path];
+        *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
+                                     code:260
+                                 userInfo:@{NSLocalizedDescriptionKey : errStr}];
+      }
+      return nil;
+    }
+
+    int fd = open([_path UTF8String], O_RDONLY | O_CLOEXEC);
+    if (fd < 0) {
+      if (error) {
+        NSString *errStr = [NSString stringWithFormat:@"Unable to open file: %s", strerror(errno)];
+        *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
+                                     code:280
+                                 userInfo:@{NSLocalizedDescriptionKey : errStr}];
+      }
+      return nil;
+    }
+    _fileHandle = [[NSFileHandle alloc] initWithFileDescriptor:fd closeOnDealloc:YES];
+
+    struct stat fileStat;
+    fstat(_fileHandle.fileDescriptor, &fileStat);
+    _fileSize = fileStat.st_size;
+
+    if (_fileSize == 0) return nil;
+
+    if (fileStat.st_uid != 0) {
+      struct passwd *pwd = getpwuid(fileStat.st_uid);
+      if (pwd) {
+        _fileOwnerHomeDir = @(pwd->pw_dir);
+      }
+    }
+  }
+
+  return self;
+}
+
+- (instancetype)initWithPath:(NSString *)path {
+  return [self initWithPath:path error:NULL];
+}
+
+#pragma mark Hashing
+
+- (void)hashSHA1:(NSString **)sha1 SHA256:(NSString **)sha256 {
+  const int MAX_CHUNK_SIZE = 256 * 1024;  // 256 KB
+  const size_t chunkSize = _fileSize > MAX_CHUNK_SIZE ? MAX_CHUNK_SIZE : _fileSize;
+  char chunk[chunkSize];
+
+  CC_SHA1_CTX c1;
+  CC_SHA256_CTX c256;
+
+  if (sha1) CC_SHA1_Init(&c1);
+  if (sha256) CC_SHA256_Init(&c256);
+
+  int fd = self.fileHandle.fileDescriptor;
+
+  fcntl(fd, F_RDAHEAD, 1);
+  struct radvisory radv;
+  radv.ra_offset = 0;
+  const int MAX_ADVISORY_READ = 10 * 1024 * 1024;
+  radv.ra_count = (int)_fileSize < MAX_ADVISORY_READ ? (int)_fileSize : MAX_ADVISORY_READ;
+  fcntl(fd, F_RDADVISE, &radv);
+  ssize_t bytesRead;
+
+  for (uint64_t offset = 0; offset < _fileSize;) {
+    bytesRead = pread(fd, chunk, chunkSize, offset);
+    if (bytesRead > 0) {
+      if (sha1) CC_SHA1_Update(&c1, chunk, (CC_LONG)bytesRead);
+      if (sha256) CC_SHA256_Update(&c256, chunk, (CC_LONG)bytesRead);
+      offset += bytesRead;
+    } else if (bytesRead == -1 && errno == EINTR) {
+      continue;
+    } else {
+      return;
+    }
+  }
+
+  // We turn off Read Ahead that we turned on
+  fcntl(fd, F_RDAHEAD, 0);
+  if (sha1) {
+    unsigned char digest[CC_SHA1_DIGEST_LENGTH];
+    CC_SHA1_Final(digest, &c1);
+    NSString *const SHA1FormatString =
+        @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
+    *sha1 = [[NSString alloc]
+        initWithFormat:SHA1FormatString, digest[0], digest[1], digest[2],
+                       digest[3], digest[4], digest[5], digest[6], digest[7],
+                       digest[8], digest[9], digest[10], digest[11], digest[12],
+                       digest[13], digest[14], digest[15], digest[16],
+                       digest[17], digest[18], digest[19]];
+  }
+  if (sha256) {
+    unsigned char digest[CC_SHA256_DIGEST_LENGTH];
+    CC_SHA256_Final(digest, &c256);
+    NSString *const SHA256FormatString =
+        @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+         "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
+
+    *sha256 = [[NSString alloc]
+        initWithFormat:SHA256FormatString, digest[0], digest[1], digest[2],
+                       digest[3], digest[4], digest[5], digest[6], digest[7],
+                       digest[8], digest[9], digest[10], digest[11], digest[12],
+                       digest[13], digest[14], digest[15], digest[16],
+                       digest[17], digest[18], digest[19], digest[20],
+                       digest[21], digest[22], digest[23], digest[24],
+                       digest[25], digest[26], digest[27], digest[28],
+                       digest[29], digest[30], digest[31]];
+  }
+}
+
+- (NSString *)SHA1 {
+  NSString *sha1;
+  [self hashSHA1:&sha1 SHA256:NULL];
+  return sha1;
+}
+
+- (NSString *)SHA256 {
+  NSString *sha256;
+  [self hashSHA1:NULL SHA256:&sha256];
+  return sha256;
+}
+
+#pragma mark File Type Info
+
+- (NSArray *)architectures {
+  return [self.machHeaders allKeys];
+}
+
+- (uint32_t)machFileType {
+  struct mach_header *mach_header = [self firstMachHeader];
+  if (mach_header) return mach_header->filetype;
+  return -1;
+}
+
+- (BOOL)isExecutable {
+  return [self machFileType] == MH_EXECUTE;
+}
+
+- (BOOL)isDylib {
+  return [self machFileType] == MH_DYLIB;
+}
+
+- (BOOL)isBundle {
+  return [self machFileType] == MH_BUNDLE;
+}
+
+- (BOOL)isKext {
+  return [self machFileType] == MH_KEXT_BUNDLE;
+}
+
+- (BOOL)isMachO {
+  return (self.machHeaders.count > 0);
+}
+
+- (BOOL)isFat {
+  return (self.machHeaders.count > 1);
+}
+
+- (BOOL)isScript {
+  const char *magic = (const char *)[[self safeSubdataWithRange:NSMakeRange(0, 2)] bytes];
+  return (magic && memcmp("#!", magic, 2) == 0);
+}
+
+- (BOOL)isXARArchive {
+  const char *magic = (const char *)[[self safeSubdataWithRange:NSMakeRange(0, 4)] bytes];
+  return (magic && memcmp("xar!", magic, 4) == 0);
+}
+
+- (BOOL)isDMG {
+  NSUInteger last512 = self.fileSize - 512;
+  const char *magic = (const char *)[[self safeSubdataWithRange:NSMakeRange(last512, 4)] bytes];
+  return (magic && memcmp("koly", magic, 4) == 0);
+}
+
+#pragma mark Page Zero
+
+- (BOOL)isMissingPageZero {
+  // This method only checks i386 arch because the kernel enforces this for other archs
+  // See bsd/kern/mach_loader.c, search for enforce_hard_pagezero.
+  MachHeaderWithOffset *x86Header = self.machHeaders[[self nameForCPUType:CPU_TYPE_X86]];
+  if (!x86Header) return NO;
+
+  struct mach_header *mh = (struct mach_header *)[x86Header.data bytes];
+  if (mh->filetype != MH_EXECUTE) return NO;
+
+  NSRange range = NSMakeRange(x86Header.offset + sizeof(struct mach_header),
+                              sizeof(struct segment_command));
+  NSData *lcData = [self safeSubdataWithRange:range];
+  if (!lcData) return NO;
+
+  // This code assumes the __PAGEZERO is always the first load-command in the file.
+  // Given that the macOS ABI says "the static linker creates a __PAGEZERO segment
+  // as the first segment of an executable file." this should be OK.
+  struct load_command *lc = (struct load_command *)[lcData bytes];
+  if (lc->cmd == LC_SEGMENT) {
+    struct segment_command *segment = (struct segment_command *)lc;
+    if (segment->vmaddr == 0 && segment->vmsize != 0 &&
+        segment->initprot == 0 && segment->maxprot == 0 &&
+        strcmp("__PAGEZERO", segment->segname) == 0) {
+      return NO;
+    }
+  }
+  return YES;
+}
+
+#pragma mark Bundle Information
+
+///
+///  Try and determine the bundle that the represented executable is contained within, if any.
+///
+///  Rationale: An NSBundle has a method executablePath for discovering the main binary within a
+///  bundle but provides no way to get an NSBundle object when only the executablePath is known.
+///  Also a bundle can contain multiple binaries within its subdirectories and we want any of these
+///  to count as being part of the bundle.
+///
+///  This method walks up the path until a bundle is found, if any.
+///
+///  @param ancestor YES this will return the highest NSBundle found in the tree. No will return the
+///                  the lowest.
+///
+-(NSBundle *)findBundleWithAncestor:(BOOL)ancestor {
+  NSBundle *bundle;
+  NSMutableArray *pathComponents = [[self.path pathComponents] mutableCopy];
+
+  // Ignore the root path "/", for some reason this is considered a bundle.
+  while (pathComponents.count > 1) {
+    NSBundle *bndl = [NSBundle bundleWithPath:[NSString pathWithComponents:pathComponents]];
+    if (bndl && [bndl objectForInfoDictionaryKey:@"CFBundleIdentifier"]) {
+      bundle = bndl;
+      if (!ancestor) break;
+    }
+    [pathComponents removeLastObject];
+  }
+  return bundle;
+}
+
+- (NSBundle *)bundle {
+  if (!self.bundleRef) {
+    self.bundleRef =
+        [self findBundleWithAncestor:self.useAncestorBundle] ?: (NSBundle *)[NSNull null];
+  }
+  return self.bundleRef == (NSBundle *)[NSNull null] ? nil : self.bundleRef;
+}
+
+- (NSString *)bundlePath {
+  return [self.bundle bundlePath];
+}
+
+- (void)setUseAncestorBundle:(BOOL)useAncestorBundle {
+  if (self.useAncestorBundle != useAncestorBundle) {
+    self.bundleRef = nil;
+    self.infoDict = nil;
+  }
+  _useAncestorBundle = useAncestorBundle;
+}
+
+- (NSDictionary *)infoPlist {
+  if (!self.infoDict) {
+    NSDictionary *d = [self embeddedPlist];
+    if (d) {
+      self.infoDict = d;
+      return self.infoDict;
+    }
+
+    d = self.bundle.infoDictionary;
+    if (d) {
+      self.infoDict = d;
+      return self.infoDict;
+    }
+
+    self.infoDict = (NSDictionary *)[NSNull null];
+  }
+  return self.infoDict == (NSDictionary *)[NSNull null] ? nil : self.infoDict;
+}
+
+- (NSString *)bundleIdentifier {
+  return [[self.infoPlist objectForKey:@"CFBundleIdentifier"] description];
+}
+
+- (NSString *)bundleName {
+  return [[self.infoPlist objectForKey:@"CFBundleDisplayName"] description] ?:
+         [[self.infoPlist objectForKey:@"CFBundleName"] description];
+}
+
+- (NSString *)bundleVersion {
+  return [[self.infoPlist objectForKey:@"CFBundleVersion"] description];
+}
+
+- (NSString *)bundleShortVersionString {
+  return [[self.infoPlist objectForKey:@"CFBundleShortVersionString"] description];
+}
+
+#pragma mark Quarantine Data
+
+- (NSString *)quarantineDataURL {
+  NSURL *dataURL = [self quarantineData][@"LSQuarantineDataURL"];
+  if (dataURL == (NSURL *)[NSNull null]) dataURL = nil;
+  return [dataURL absoluteString];
+}
+
+- (NSString *)quarantineRefererURL {
+  NSURL *originURL = [self quarantineData][@"LSQuarantineOriginURL"];
+  if (originURL == (NSURL *)[NSNull null]) originURL = nil;
+  return [originURL absoluteString];
+}
+
+- (NSString *)quarantineAgentBundleID {
+  NSString *agentBundle = [self quarantineData][@"LSQuarantineAgentBundleIdentifier"];
+  if (agentBundle == (NSString *)[NSNull null]) agentBundle = nil;
+  return agentBundle;
+}
+
+- (NSDate *)quarantineTimestamp {
+  NSDate *timeStamp = [self quarantineData][@"LSQuarantineTimeStamp"];
+  return timeStamp;
+}
+
+#pragma mark Internal Methods
+
+- (NSDictionary *)machHeaders {
+  if (self.cachedHeaders) return self.cachedHeaders;
+
+  // Sanity check file length
+  if (self.fileSize < sizeof(struct mach_header)) {
+    self.cachedHeaders = [NSDictionary dictionary];
+    return self.cachedHeaders;
+  }
+
+  NSMutableDictionary *machHeaders = [NSMutableDictionary dictionary];
+
+  NSData *machHeader = [self parseSingleMachHeader:[self safeSubdataWithRange:NSMakeRange(0,
+                                                                                          4096)]];
+  if (machHeader) {
+    struct mach_header *mh = (struct mach_header *)[machHeader bytes];
+    MachHeaderWithOffset *mhwo = [[MachHeaderWithOffset alloc] initWithData:machHeader offset:0];
+    machHeaders[[self nameForCPUType:mh->cputype]] = mhwo;
+  } else {
+    NSRange range = NSMakeRange(0, sizeof(struct fat_header));
+    NSData *fatHeader = [self safeSubdataWithRange:range];
+    struct fat_header *fh = (struct fat_header *)[fatHeader bytes];
+
+    if (fatHeader && (fh->magic == FAT_CIGAM || fh->magic == FAT_MAGIC)) {
+      int nfat_arch = OSSwapBigToHostInt32(fh->nfat_arch);
+      range = NSMakeRange(sizeof(struct fat_header), sizeof(struct fat_arch) * nfat_arch);
+      NSMutableData *fatArchs = [[self safeSubdataWithRange:range] mutableCopy];
+      if (fatArchs) {
+        struct fat_arch *fat_arch = (struct fat_arch *)[fatArchs mutableBytes];
+        for (int i = 0; i < nfat_arch; ++i) {
+          int offset = OSSwapBigToHostInt32(fat_arch[i].offset);
+          int size = OSSwapBigToHostInt32(fat_arch[i].size);
+          int cputype = OSSwapBigToHostInt(fat_arch[i].cputype);
+
+          range = NSMakeRange(offset, size);
+          NSData *machHeader = [self parseSingleMachHeader:[self safeSubdataWithRange:range]];
+          if (machHeader) {
+            NSString *key = [self nameForCPUType:cputype];
+            MachHeaderWithOffset *mhwo = [[MachHeaderWithOffset alloc] initWithData:machHeader
+                                                                             offset:offset];
+            machHeaders[key] = mhwo;
+          }
+        }
+      }
+    }
+  }
+
+  self.cachedHeaders = [machHeaders copy];
+  return self.cachedHeaders;
+}
+
+- (NSData *)parseSingleMachHeader:(NSData *)inputData {
+  if (inputData.length < sizeof(struct mach_header)) return nil;
+  struct mach_header *mh = (struct mach_header *)[inputData bytes];
+
+  if (mh->magic == MH_CIGAM || mh->magic == MH_CIGAM_64) {
+    NSMutableData *mutableInput = [inputData mutableCopy];
+    mh = (struct mach_header *)[mutableInput mutableBytes];
+    swap_mach_header(mh, NXHostByteOrder());
+  }
+
+  if (mh->magic == MH_MAGIC || mh->magic == MH_MAGIC_64) {
+    return [NSData dataWithBytes:mh length:sizeof(struct mach_header)];
+  }
+
+  return nil;
+}
+
+///
+///  Locate an embedded plist in the file
+///
+- (NSDictionary *)embeddedPlist {
+  // Look for an embedded Info.plist if there is one.
+  // This could (and used to) use CFBundleCopyInfoDictionaryForURL but that uses mmap to read
+  // the file and so can cause SIGBUS if the file is deleted/truncated while it's working.
+  MachHeaderWithOffset *mhwo = [[self.machHeaders allValues] firstObject];
+  if (!mhwo) return nil;
+
+  struct mach_header *mh = (struct mach_header *)mhwo.data.bytes;
+  if (mh->filetype != MH_EXECUTE) return self.infoDict;
+  BOOL is64 = (mh->magic == MH_MAGIC_64 || mh->magic == MH_CIGAM_64);
+  uint32_t ncmds = mh->ncmds;
+  uint32_t nsects = 0;
+  uint64_t offset = mhwo.offset;
+
+  uint32_t sz_header = is64 ? sizeof(struct mach_header_64) : sizeof(struct mach_header);
+  uint32_t sz_segment = is64 ? sizeof(struct segment_command_64) : sizeof(struct segment_command);
+  uint32_t sz_section = is64 ? sizeof(struct section_64) : sizeof(struct section);
+
+  offset += sz_header;
+
+  // Loop through the load commands looking for the segment named __TEXT
+  for (uint32_t i = 0; i < ncmds; ++i) {
+    NSData *cmdData = [self safeSubdataWithRange:NSMakeRange(offset, sz_segment)];
+    if (!cmdData) return nil;
+    struct segment_command_64 *lc = (struct segment_command_64 *)[cmdData bytes];
+    if (lc->cmd == LC_SEGMENT || lc->cmd == LC_SEGMENT_64) {
+      if (memcmp(lc->segname, "__TEXT", 6) == 0) {
+        nsects = lc->nsects;
+        offset += sz_segment;
+        break;
+      }
+    }
+    offset += lc->cmdsize;
+  }
+
+  // Loop through the sections in the __TEXT segment looking for an __info_plist section.
+  for (uint32_t i = 0; i < nsects; ++i) {
+    NSData *sectData = [self safeSubdataWithRange:NSMakeRange(offset, sz_section)];
+    if (!sectData) return nil;
+    struct section_64 *sect = (struct section_64 *)[sectData bytes];
+    if (sect && memcmp(sect->sectname, "__info_plist", 12) == 0 && sect->size < 2000000) {
+      NSData *plistData = [self safeSubdataWithRange:NSMakeRange(sect->offset, sect->size)];
+      if (!plistData) return nil;
+      NSDictionary *plist;
+      plist = [NSPropertyListSerialization propertyListWithData:plistData
+                                                        options:NSPropertyListImmutable
+                                                         format:NULL
+                                                          error:NULL];
+      if (plist) return plist;
+    }
+    offset += sz_section;
+  }
+  return nil;
+}
+
+///
+///  Return the first mach_header in this file.
+///
+- (struct mach_header *)firstMachHeader {
+  return (struct mach_header *)([[[[self.machHeaders allValues] firstObject] data] bytes]);
+}
+
+///
+///  Extract a range of the file as an NSData, handling any exceptions.
+///  Returns nil if the requested range is outside of the range of the file.
+///
+- (NSData *)safeSubdataWithRange:(NSRange)range {
+  @try {
+    if ((range.location + range.length) > self.fileSize) return nil;
+    [self.fileHandle seekToFileOffset:range.location];
+    NSData *d = [self.fileHandle readDataOfLength:range.length];
+    if (d.length != range.length) return nil;
+    return d;
+  }
+  @catch (NSException *e) {
+    return nil;
+  }
+}
+
+///
+///  Retrieve quarantine data for a file and caches the dictionary
+///  This method attempts to handle fetching the quarantine data even if the running user
+///  is not the one who downloaded the file.
+///
+- (NSDictionary *)quarantineData {
+  if (!self.quarantineDict && self.fileOwnerHomeDir && NSURLQuarantinePropertiesKey) {
+    self.quarantineDict = (NSDictionary *)[NSNull null];
+
+    NSURL *url = [NSURL fileURLWithPath:self.path];
+    NSDictionary *d = [url resourceValuesForKeys:@[ NSURLQuarantinePropertiesKey ] error:NULL];
+
+    if (d[NSURLQuarantinePropertiesKey]) {
+      d = d[NSURLQuarantinePropertiesKey];
+
+      if (d[@"LSQuarantineIsOwnedByCurrentUser"]) {
+        self.quarantineDict = d;
+      } else if (d[@"LSQuarantineEventIdentifier"]) {
+        NSMutableDictionary *quarantineDict = [d mutableCopy];
+
+        // If self.path is on a quarantine disk image, LSQuarantineDiskImageURL will point to the
+        // disk image and self.fileOwnerHomeDir will be incorrect (probably root).
+        NSString *fileOwnerHomeDir = self.fileOwnerHomeDir;
+        if (d[@"LSQuarantineDiskImageURL"]) {
+          struct stat fileStat;
+          stat([d[@"LSQuarantineDiskImageURL"] fileSystemRepresentation], &fileStat);
+          if (fileStat.st_uid != 0) {
+            struct passwd *pwd = getpwuid(fileStat.st_uid);
+            if (pwd) {
+              fileOwnerHomeDir = @(pwd->pw_dir);
+            }
+          }
+        }
+
+        NSURL *dbPath = [NSURL fileURLWithPathComponents:@[
+          fileOwnerHomeDir,
+          @"Library",
+          @"Preferences",
+          @"com.apple.LaunchServices.QuarantineEventsV2"
+        ]];
+        FMDatabase *db = [FMDatabase databaseWithPath:[dbPath absoluteString]];
+        db.logsErrors = NO;
+        if ([db open]) {
+          FMResultSet *rs = [db executeQuery:@"SELECT * FROM LSQuarantineEvent "
+                                             @"WHERE LSQuarantineEventIdentifier=?",
+                                             d[@"LSQuarantineEventIdentifier"]];
+          if ([rs next]) {
+            NSString *agentBundleID = [rs stringForColumn:@"LSQuarantineAgentBundleIdentifier"];
+            NSString *dataURLString = [rs stringForColumn:@"LSQuarantineDataURLString"];
+            NSString *originURLString = [rs stringForColumn:@"LSQuarantineOriginURLString"];
+            double timeStamp = [rs doubleForColumn:@"LSQuarantineTimeStamp"];
+
+            quarantineDict[@"LSQuarantineAgentBundleIdentifier"] = agentBundleID;
+            quarantineDict[@"LSQuarantineDataURL"] = [NSURL URLWithString:dataURLString];
+            quarantineDict[@"LSQuarantineOriginURL"] = [NSURL URLWithString:originURLString];
+            quarantineDict[@"LSQuarantineTimestamp"] =
+                [NSDate dateWithTimeIntervalSinceReferenceDate:timeStamp];
+
+            self.quarantineDict = quarantineDict;
+          }
+          [rs close];
+          [db close];
+        }
+      }
+    }
+  }
+  return (self.quarantineDict == (NSDictionary *)[NSNull null]) ? nil : self.quarantineDict;
+}
+
+///
+///  Return a human-readable string for a cpu_type_t.
+///
+- (NSString *)nameForCPUType:(cpu_type_t)cpuType {
+  switch (cpuType) {
+    case CPU_TYPE_X86:
+      return @"i386";
+    case CPU_TYPE_X86_64:
+      return @"x86-64";
+    case CPU_TYPE_POWERPC:
+      return @"ppc";
+    case CPU_TYPE_POWERPC64:
+      return @"ppc64";
+    default:
+      return @"unknown";
+  }
+  return nil;
+}
+
+///
+///  Resolves a given path:
+///    + Follows symlinks
+///    + Converts relative paths to absolute
+///    + If path is a directory, checks to see if that directory is a bundle and if so
+///      returns the path to that bundles CFBundleExecutable and stores a reference to the
+///      bundle in the bundle out-param.
+///
+- (NSString *)resolvePath:(NSString *)path bundle:(NSBundle **)bundle {
+  // Convert to absolute, standardized path
+  path = [path stringByResolvingSymlinksInPath];
+  if (![path isAbsolutePath]) {
+    NSString *cwd = [[NSFileManager defaultManager] currentDirectoryPath];
+    path = [cwd stringByAppendingPathComponent:path];
+  }
+  path = [path stringByStandardizingPath];
+
+  // Determine if file exists.
+  // If path is actually a directory, check to see if it's a bundle and has a CFBundleExecutable.
+  BOOL directory;
+  if (![[NSFileManager defaultManager] fileExistsAtPath:path isDirectory:&directory]) {
+    return nil;
+  } else if (directory && ![path isEqualToString:@"/"]) {
+    NSBundle *bndl = [NSBundle bundleWithPath:path];
+    if (bundle) *bundle = bndl;
+    return [bndl executablePath];
+  } else {
+    return path;
+  }
+}
+
+@end

Source/common/SNTFileWatcher.h

@@ -0,0 +1,35 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+///
+///  Simple file watching class using dispatch sources. Will automatically
+///  reload the watch if the file is deleted and continue watching for
+///  events until deallocated.
+///
+@interface SNTFileWatcher : NSObject
+
+///
+///  Designated initializer
+///  Initializes the watcher and begins watching for modifications.
+///
+///  @param filePath the file to watch.
+///  @param handler the handler to call when changes happen. The argument to the block is the
+///      type of change that happened as a bitmask to be compared with DISPATCH_VNODE_* constants.
+///
+- (nonnull instancetype)initWithFilePath:(nonnull NSString *)filePath
+                                 handler:(nonnull void (^)(unsigned long))handler;
+
+@end

Source/common/SNTFileWatcher.m

@@ -0,0 +1,94 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTFileWatcher.h"
+
+#import "SNTStrengthify.h"
+
+@interface SNTFileWatcher ()
+@property NSString *filePath;
+@property(copy) void (^handler)(unsigned long);
+
+@property dispatch_source_t source;
+@end
+
+@implementation SNTFileWatcher
+
+- (instancetype)init {
+  [self doesNotRecognizeSelector:_cmd];
+  return nil;
+}
+
+- (instancetype)initWithFilePath:(nonnull NSString *)filePath
+                         handler:(nonnull void (^)(unsigned long))handler {
+  self = [super init];
+  if (self) {
+    _filePath = filePath;
+    _handler = handler;
+    [self startWatchingFile];
+  }
+  return self;
+}
+
+- (void)dealloc {
+  [self stopWatchingFile];
+}
+
+- (void)startWatchingFile {
+  dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0);
+  int mask = (DISPATCH_VNODE_DELETE | DISPATCH_VNODE_RENAME |
+              DISPATCH_VNODE_WRITE | DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_ATTRIB);
+
+  dispatch_async(queue, ^{
+    int fd = -1;
+    const char *filePath = [self.filePath fileSystemRepresentation];
+    while ((fd = open(filePath, O_EVTONLY | O_CLOEXEC)) < 0) {
+      usleep(200000);  // wait 200ms
+    }
+    self.source = dispatch_source_create(DISPATCH_SOURCE_TYPE_VNODE, fd, mask, queue);
+
+    WEAKIFY(self);
+
+    dispatch_source_set_event_handler(self.source, ^{
+      STRONGIFY(self);
+      unsigned long data = dispatch_source_get_data(self.source);
+      self.handler(data);
+      if (data & DISPATCH_VNODE_DELETE || data & DISPATCH_VNODE_RENAME) {
+        [self stopWatchingFile];
+        [self startWatchingFile];
+      }
+      sleep(2);
+    });
+
+    dispatch_source_set_registration_handler(self.source, ^{
+      STRONGIFY(self);
+      self.handler(0);
+    });
+
+    dispatch_source_set_cancel_handler(self.source, ^{
+      close(fd);
+    });
+
+    dispatch_resume(self.source);
+  });
+}
+
+- (void)stopWatchingFile {
+  if (!self.source) return;
+  dispatch_source_set_event_handler_f(self.source, NULL);
+  dispatch_source_cancel(self.source);
+  self.source = nil;
+}
+
+@end

Source/common/SNTKernelCommon.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,63 +12,88 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+///
 /// Common defines between kernel <-> userspace
+///
+
+#include <sys/param.h>
 
 #ifndef SANTA__COMMON__KERNELCOMMON_H
 #define SANTA__COMMON__KERNELCOMMON_H
 
-// Defines the lengths of paths and SHA-1's passed around.
-#define MAX_PATH_LEN 1024
-#define MAX_SHA1_LEN 20
-#define MAX_SHA1_STRING 41
-#define MAX_VNODE_ID_STR 21
+// Defines the lengths of paths and Vnode IDs passed around.
+#define MAX_VNODE_ID_STR 21  // digits in UINT64_MAX + 1 for NULL-terminator
 
 // Defines the name of the userclient class and the driver bundle ID.
 #define USERCLIENT_CLASS "com_google_SantaDriver"
 #define USERCLIENT_ID "com.google.santa-driver"
 
+// Branch prediction
+#define likely(x)   __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+
 // List of methods supported by the driver.
 enum SantaDriverMethods {
   kSantaUserClientOpen,
-  kSantaUserClientClose,
   kSantaUserClientAllowBinary,
   kSantaUserClientDenyBinary,
   kSantaUserClientClearCache,
   kSantaUserClientCacheCount,
+  kSantaUserClientCheckCache,
 
   // Any methods supported by the driver should be added above this line to
   // ensure this remains the count of methods.
   kSantaUserClientNMethods,
 };
 
+typedef enum {
+  QUEUETYPE_DECISION,
+  QUEUETYPE_LOG
+} santa_queuetype_t;
+
 // Enum defining actions that can be passed down the IODataQueue and in
 // response methods.
 typedef enum {
   ACTION_UNSET = 0,
 
-  // CHECKBW
-  ACTION_REQUEST_CHECKBW = 10,
-  ACTION_RESPOND_CHECKBW_ALLOW = 11,
-  ACTION_RESPOND_CHECKBW_DENY = 12,
+  // REQUESTS
+  ACTION_REQUEST_SHUTDOWN = 10,
+  ACTION_REQUEST_BINARY = 11,
 
-  // SHUTDOWN
-  ACTION_REQUEST_SHUTDOWN = 60,
+  // RESPONSES
+  ACTION_RESPOND_ALLOW = 20,
+  ACTION_RESPOND_DENY = 21,
+
+  // NOTIFY
+  ACTION_NOTIFY_EXEC = 30,
+  ACTION_NOTIFY_WRITE = 31,
+  ACTION_NOTIFY_RENAME = 32,
+  ACTION_NOTIFY_LINK = 33,
+  ACTION_NOTIFY_EXCHANGE = 34,
+  ACTION_NOTIFY_DELETE = 35,
 
   // ERROR
   ACTION_ERROR = 99,
 } santa_action_t;
 
-#define RESPONSE_VALID(x) (x == ACTION_RESPOND_CHECKBW_ALLOW || \
-  x == ACTION_RESPOND_CHECKBW_DENY)
+#define RESPONSE_VALID(x) \
+  (x == ACTION_RESPOND_ALLOW || x == ACTION_RESPOND_DENY)
 
 // Message struct that is sent down the IODataQueue.
 typedef struct {
   santa_action_t action;
-  uid_t userId;
-  pid_t pid;
-  char sha1[MAX_SHA1_STRING];
-  char path[MAX_PATH_LEN];
   uint64_t vnode_id;
+  uid_t uid;
+  gid_t gid;
+  pid_t pid;
+  pid_t ppid;
+  char path[MAXPATHLEN];
+  char newpath[MAXPATHLEN];
+  // For file events, this is the process name.
+  // For exec requests, this is the parent process name.
+  // While process names can technically be 4*MAXPATHLEN, that never
+  // actually happens, so only take MAXPATHLEN and throw away any excess.
+  char pname[MAXPATHLEN];
 } santa_message_t;
 
 #endif  // SANTA__COMMON__KERNELCOMMON_H

Source/common/SNTLogging.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,15 +12,19 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+///
 /// Logging definitions, for both kernel and user space.
+///
 
 #ifndef SANTA__COMMON__LOGGING_H
 #define SANTA__COMMON__LOGGING_H
 
 #ifdef KERNEL
 
+#include <IOKit/IOLib.h>
+
 #ifdef DEBUG
-#define LOGD(...) IOLog("D santa-driver: " __VA_ARGS__); IOLog("\n");
+#define LOGD(...) IOLog("D santa-driver: " __VA_ARGS__); IOLog("\n")
 #else  // DEBUG
 #define LOGD(...)
 #endif  // DEBUG
@@ -30,23 +34,31 @@
 
 #else  // KERNEL
 
-#define LOG_LEVEL_ERROR   1
-#define LOG_LEVEL_WARN    2
-#define LOG_LEVEL_INFO    3
-#define LOG_LEVEL_DEBUG   4
+@import Foundation;
 
-/// Logging function.
-/// level is one of the levels defined above
-/// error is the destination a FILE, generally should be stdout or stderr
-/// format is the printf style format string
-/// ... is the arguments to format.
-void logMessage(int level, FILE *destination, NSString *format, ...);
+typedef enum : NSUInteger {
+  LOG_LEVEL_ERROR,
+  LOG_LEVEL_WARN,
+  LOG_LEVEL_INFO,
+  LOG_LEVEL_DEBUG
+} LogLevel;
+
+///
+///  Logging function.
+///  @param level one of the levels defined above
+///  @param destination a FILE, generally stdout/stderr. If the file is closed, the log
+///      will instead be sent to syslog.
+///  @param format the printf style format string
+///  @param ... the arguments to format.
+///
+void logMessage(LogLevel level, FILE *destination, NSString *format, ...)
+    __attribute__((format(__NSString__, 3, 4)));
 
 /// Simple logging macros
-#define LOGD(logFormat, ...) logMessage(LOG_LEVEL_DEBUG, stdout, logFormat, ##__VA_ARGS__);
-#define LOGI(logFormat, ...) logMessage(LOG_LEVEL_INFO, stdout, logFormat, ##__VA_ARGS__);
-#define LOGW(logFormat, ...) logMessage(LOG_LEVEL_WARN, stderr, logFormat, ##__VA_ARGS__);
-#define LOGE(logFormat, ...) logMessage(LOG_LEVEL_ERROR, stderr, logFormat, ##__VA_ARGS__);
+#define LOGD(logFormat, ...) logMessage(LOG_LEVEL_DEBUG, stdout, logFormat, ##__VA_ARGS__)
+#define LOGI(logFormat, ...) logMessage(LOG_LEVEL_INFO, stdout, logFormat, ##__VA_ARGS__)
+#define LOGW(logFormat, ...) logMessage(LOG_LEVEL_WARN, stderr, logFormat, ##__VA_ARGS__)
+#define LOGE(logFormat, ...) logMessage(LOG_LEVEL_ERROR, stderr, logFormat, ##__VA_ARGS__)
 
 #endif  // KERNEL
 

Source/common/SNTLogging.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,52 +14,80 @@
 
 #import "SNTLogging.h"
 
-#import "SNTConfigurator.h"
+#import <asl.h>
+#import <pthread.h>
 
 #ifdef DEBUG
-static int logLevel = LOG_LEVEL_DEBUG;  // default to info
+static LogLevel logLevel = LOG_LEVEL_DEBUG;
 #else
-static int logLevel = LOG_LEVEL_INFO;
+static LogLevel logLevel = LOG_LEVEL_INFO;  // default to info
 #endif
 
-void logMessage(int level, FILE *destination, NSString *format, ...) {
-  static NSDateFormatter *dateFormatter;
-  static NSString *binaryName;
+void syslogClientDestructor(void *arg) {
+  asl_close((aslclient)arg);
+}
+
+void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
+  static BOOL useSyslog = NO;
+  static const char *binaryName;
   static dispatch_once_t pred;
+  static pthread_key_t syslogKey = 0;
 
   dispatch_once(&pred, ^{
-      dateFormatter = [[NSDateFormatter alloc] init];
-      [dateFormatter setTimeZone:[NSTimeZone timeZoneWithName:@"UTC"]];
-      [dateFormatter setDateFormat:@"YYYY-MM-dd HH:mm:ss.SSS'Z"];
+    binaryName = [[[NSProcessInfo processInfo] processName] UTF8String];
 
-      binaryName = [[NSProcessInfo processInfo] processName];
+    // If debug logging is enabled, the process must be restarted.
+    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--debug"]) {
+      logLevel = LOG_LEVEL_DEBUG;
+    }
 
-      // If debug logging is enabled, the process must be restarted.
-      if ([[SNTConfigurator configurator] debugLogging]) {
-        logLevel = LOG_LEVEL_DEBUG;
-      }
+    // If requested, redirect output to syslog.
+    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--syslog"]) {
+      useSyslog = YES;
+      pthread_key_create(&syslogKey, syslogClientDestructor);
+    }
   });
 
   if (logLevel < level) return;
 
   va_list args;
   va_start(args, format);
-  NSString *s = [[NSString alloc] initWithFormat:format arguments:args];
+  NSMutableString *s = [[NSMutableString alloc] initWithFormat:format arguments:args];
   va_end(args);
 
-  // Only prepend timestamp, severity and binary name if stdout is not a TTY
-  if (isatty(fileno(destination))) {
-    fprintf(destination, "%s\n", [s UTF8String]);
-  } else {
-    NSString *levelName;
-    switch (level) {
-      case LOG_LEVEL_ERROR: levelName = @"E"; break;
-      case LOG_LEVEL_WARN: levelName = @"W"; break;
-      case LOG_LEVEL_INFO: levelName = @"I"; break;
-      case LOG_LEVEL_DEBUG: levelName = @"D"; break;
+  if (useSyslog) {
+    aslclient client = (aslclient)pthread_getspecific(syslogKey);
+    if (client == NULL) {
+      client = asl_open(NULL, "com.google.santa", 0);
+      asl_set_filter(client, ASL_FILTER_MASK_UPTO(ASL_LEVEL_DEBUG));
+      pthread_setspecific(syslogKey, client);
     }
 
-    fprintf(destination, "%s\n", [[NSString stringWithFormat:@"[%@] %@ %@: %@",
-               [dateFormatter stringFromDate:[NSDate date]], levelName, binaryName, s] UTF8String]);
+    char *levelName;
+    int syslogLevel = ASL_LEVEL_DEBUG;
+    switch (level) {
+      case LOG_LEVEL_ERROR:
+        levelName = "E";
+        syslogLevel = ASL_LEVEL_ERR;
+        break;
+      case LOG_LEVEL_WARN:
+        levelName = "W";
+        syslogLevel = ASL_LEVEL_WARNING;
+        break;
+      case LOG_LEVEL_INFO:
+        levelName = "I";
+        syslogLevel = ASL_LEVEL_INFO;
+        break;
+      case LOG_LEVEL_DEBUG:
+        levelName = "D";
+        syslogLevel = ASL_LEVEL_DEBUG;
+        break;
+    }
+
+    asl_log(client, NULL, syslogLevel, "%s %s: %s", levelName, binaryName, [s UTF8String]);
+  } else {
+    [s appendString:@"\n"];
+    size_t len = [s lengthOfBytesUsingEncoding:NSUTF8StringEncoding];
+    fwrite([s UTF8String], len, 1, destination);
   }
-}
+}

Source/common/SNTNotificationMessage.h

@@ -1,37 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-@class SNTCertificate;
-
-/// An SNTEvent is created when Santa is making a decision about an execution request.
-/// All of the information required to make that decision, log it, notify the user etc. must be
-/// encapsulated within this class.
-@interface SNTNotificationMessage : NSObject<NSSecureCoding>
-
-/// The path of the binary that was blocked.
-@property(copy) NSString *path;
-
-/// The SHA-1 of the binary that was blocked.
-@property(copy) NSString *SHA1;
-
-/// An array of @c SNTCertificate objects representing the certificate chain the binary was signed with.
-@property(copy) NSArray *certificates;
-
-/// A custom message to display to the user when blocking this binary, if any.
-@property(copy) NSString *customMessage;
-
-// A convenience accessor to the first certificate in @c certificates.
-@property(readonly) SNTCertificate *leafCertificate;
-
-@end

Source/common/SNTNotificationMessage.m

@@ -1,55 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTNotificationMessage.h"
-
-#import "SNTCertificate.h"
-
-@implementation SNTNotificationMessage
-
-static NSString *const kPathKey = @"path";
-static NSString *const kSHA1Key = @"sha1";
-static NSString *const kCertificatesKey = @"certificates";
-static NSString *const kCustomMessageKey = @"custommessage";
-
-#pragma mark NSSecureCoding
-
-+ (BOOL)supportsSecureCoding {
-  return YES;
-}
-
-- (void)encodeWithCoder:(NSCoder *)coder {
-  [coder encodeObject:self.path forKey:kPathKey];
-  [coder encodeObject:self.SHA1 forKey:kSHA1Key];
-  [coder encodeObject:self.customMessage forKey:kCustomMessageKey];
-  [coder encodeObject:self.certificates forKey:kCertificatesKey];
-}
-
-- (instancetype)initWithCoder:(NSCoder *)decoder {
-  _path = [decoder decodeObjectOfClass:[NSString class] forKey:kPathKey];
-  _SHA1 = [decoder decodeObjectOfClass:[NSString class] forKey:kSHA1Key];
-  _customMessage = [decoder decodeObjectOfClass:[NSString class] forKey:kCustomMessageKey];
-
-  NSSet *certClasses = [NSSet setWithObjects:[NSArray class], [SNTCertificate class], nil];
-  _certificates = [decoder decodeObjectOfClasses:certClasses forKey:kCertificatesKey];
-  return self;
-}
-
-#pragma mark Calculated Properties
-
-- (SNTCertificate *)leafCertificate {
-  return [self.certificates firstObject];
-}
-
-@end

Source/common/SNTRule.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,27 +12,41 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#include "SNTCommonEnums.h"
+@import Foundation;
 
-/// Represents a Rule.
+#import "SNTCommonEnums.h"
+
+///
+///  Represents a Rule.
+///
 @interface SNTRule : NSObject<NSSecureCoding>
 
-/// The SHA-1 hash of the object this rule is for
-@property NSString *SHA1;
+///
+///  The hash of the object this rule is for
+///
+@property(copy) NSString *shasum;
 
-/// The state of this rule
-@property santa_rulestate_t state;
+///
+///  The state of this rule
+///
+@property SNTRuleState state;
 
-/// The type of object this rule is for (binary, certificate)
-@property santa_ruletype_t type;
+///
+///  The type of object this rule is for (binary, certificate)
+///
+@property SNTRuleType type;
 
-/// A custom message that will be displayed if this rule blocks a binary from executing
-@property NSString *customMsg;
+///
+///  A custom message that will be displayed if this rule blocks a binary from executing
+///
+@property(copy) NSString *customMsg;
 
-/// Designated initializer.
-- (instancetype)initWithSHA1:(NSString *)SHA1
-                       state:(santa_rulestate_t)state
-                        type:(santa_ruletype_t)type
-                   customMsg:(NSString *)customMsg;
+///
+///  Designated initializer.
+///
+- (instancetype)initWithShasum:(NSString *)shasum
+                         state:(SNTRuleState)state
+                          type:(SNTRuleType)type
+                     customMsg:(NSString *)customMsg;
 
-@end
+@end

Source/common/SNTRule.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,18 +16,13 @@
 
 @implementation SNTRule
 
-static NSString *const kSHA1Key = @"sha1";
-static NSString *const kStateKey = @"state";
-static NSString *const kTypeKey = @"type";
-static NSString *const kCustomMessageKey = @"custommsg";
-
-- (instancetype)initWithSHA1:(NSString *)SHA1
-                       state:(santa_rulestate_t)state
-                        type:(santa_ruletype_t)type
-                   customMsg:(NSString *)customMsg {
+- (instancetype)initWithShasum:(NSString *)shasum
+                         state:(SNTRuleState)state
+                          type:(SNTRuleType)type
+                     customMsg:(NSString *)customMsg {
   self = [super init];
   if (self) {
-    _SHA1  = SHA1;
+    _shasum = shasum;
     _state = state;
     _type = type;
     _customMsg = customMsg;
@@ -37,23 +32,53 @@ static NSString *const kCustomMessageKey = @"custommsg";
 
 #pragma mark NSSecureCoding
 
-+ (BOOL)supportsSecureCoding { return YES; }
+#define ENCODE(obj, key) if (obj) [coder encodeObject:obj forKey:key]
+#define DECODE(cls, key) [decoder decodeObjectOfClass:[cls class] forKey:key]
+
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
 
 - (void)encodeWithCoder:(NSCoder *)coder {
-  [coder encodeObject:self.SHA1 forKey:kSHA1Key];
-  [coder encodeInt:self.state forKey:kStateKey];
-  [coder encodeInt:self.type forKey:kTypeKey];
-  [coder encodeObject:self.customMsg forKey:kCustomMessageKey];
+  ENCODE(self.shasum, @"shasum");
+  ENCODE(@(self.state), @"state");
+  ENCODE(@(self.type), @"type");
+  ENCODE(self.customMsg, @"custommsg");
 }
 
 - (instancetype)initWithCoder:(NSCoder *)decoder {
-  NSSet *stringPlusNull = [NSSet setWithObjects:[NSString class], [NSNull class], nil];
-
-  _SHA1 = [decoder decodeObjectOfClass:[NSString class] forKey:kSHA1Key];
-  _state = [decoder decodeIntForKey:kStateKey];
-  _type = [decoder decodeIntForKey:kTypeKey];
-  _customMsg = [decoder decodeObjectOfClasses:stringPlusNull forKey:kCustomMessageKey];
+  self = [super init];
+  if (self) {
+    _shasum = DECODE(NSString, @"shasum");
+    _state = [DECODE(NSNumber, @"state") intValue];
+    _type = [DECODE(NSNumber, @"type") intValue];
+    _customMsg = DECODE(NSString, @"custommsg");
+  }
   return self;
 }
 
-@end
+#undef DECODE
+#undef ENCODE
+
+- (BOOL)isEqual:(id)other {
+  if (other == self) return YES;
+  if (![other isKindOfClass:[SNTRule class]]) return NO;
+  SNTRule *o = other;
+  return ([self.shasum isEqual:o.shasum] && self.state == o.state && self.type == o.type);
+}
+
+- (NSUInteger)hash {
+  NSUInteger prime = 31;
+  NSUInteger result = 1;
+  result = prime * result + [self.shasum hash];
+  result = prime * result + self.state;
+  result = prime * result + self.type;
+  return result;
+}
+
+- (NSString *)description {
+  return [NSString stringWithFormat:@"SNTRule: SHA-256: %@, State: %ld, Type: %ld",
+                                    self.shasum, self.state, self.type];
+}
+
+@end

Source/common/SNTStoredEvent.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,29 +12,130 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#include "SNTCommonEnums.h"
+@import Foundation;
 
-/// Represents an event stored in the database.
+#import "SNTCommonEnums.h"
+
+///
+///  Represents an event stored in the database.
+///
 @interface SNTStoredEvent : NSObject<NSSecureCoding>
 
+///
+///  An index for this event, randomly generated during initialization.
+///
 @property NSNumber *idx;
-@property NSString *fileSHA1;
+
+///
+///  The SHA-256 of the executed file.
+///
+@property NSString *fileSHA256;
+
+///
+///  The full path of the executed file.
+///
 @property NSString *filePath;
+
+///
+///  Set to YES if the event is a part of a bundle. When an event is passed to SantaGUI this propery
+///  will be used as an indicator to to kick off bundle hashing as necessary. Default value is NO.
+///
+@property BOOL needsBundleHash;
+
+///
+///  If the executed file was part of a bundle, this is the calculated hash of all the nested
+///  executables within the bundle.
+///
+@property NSString *fileBundleHash;
+
+///
+///  If the executed file was part of a bundle, this is the time in ms it took to hash the bundle.
+///
+@property NSNumber *fileBundleHashMilliseconds;
+
+///
+///  If the executed file was part of a bundle, this is the total count of related mach-o binaries.
+///
+@property NSNumber *fileBundleBinaryCount;
+
+///
+///  If the executed file was part of the bundle, this is the CFBundleDisplayName, if it exists
+///  or the CFBundleName if not.
+///
 @property NSString *fileBundleName;
+
+///
+///  If the executed file was part of the bundle, this is the path to the bundle.
+///
+@property NSString *fileBundlePath;
+
+///
+///  If the executed file was part of the bundle, this is the CFBundleID.
+///
 @property NSString *fileBundleID;
+
+///
+///  If the executed file was part of the bundle, this is the CFBundleVersion.
+///
 @property NSString *fileBundleVersion;
+
+///
+///  If the executed file was part of the bundle, this is the CFBundleShortVersionString.
+///
 @property NSString *fileBundleVersionString;
-@property NSString *certSHA1;
-@property NSString *certCN;
-@property NSString *certOrg;
-@property NSString *certOU;
-@property NSDate *certValidFromDate;
-@property NSDate *certValidUntilDate;
+
+///
+///  If the executed file was signed, this is an NSArray of MOLCertificate's
+///  representing the signing chain.
+///
+@property NSArray *signingChain;
+
+///
+///  The user who executed the binary.
+///
 @property NSString *executingUser;
+
+///
+///  The date and time the execution request was received by santad.
+///
 @property NSDate *occurrenceDate;
-@property santa_eventstate_t decision;
+
+///
+///  The decision santad returned.
+///
+@property SNTEventState decision;
+
+///
+///  NSArray of logged in users when the decision was made.
+///
 @property NSArray *loggedInUsers;
+
+///
+///  NSArray of sessions when the decision was made (e.g. nobody@console, nobody@ttys000).
+///
 @property NSArray *currentSessions;
+
+///
+///  The process ID of the binary being executed.
+///
 @property NSNumber *pid;
 
+///
+///  The parent process ID of the binary being executed.
+///
+@property NSNumber *ppid;
+
+///
+///  The name of the parent process.
+///
+@property NSString *parentName;
+
+///
+///  Quarantine data about the executed file, if any.
+///
+@property NSString *quarantineDataURL;
+@property NSString *quarantineRefererURL;
+@property NSDate *quarantineTimestamp;
+@property NSString *quarantineAgentBundleID;
+
 @end

Source/common/SNTStoredEvent.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,89 +14,117 @@
 
 #import "SNTStoredEvent.h"
 
+#import "MOLCertificate.h"
+
 @implementation SNTStoredEvent
 
-+ (BOOL)supportsSecureCoding {  return YES; }
+#define ENCODE(obj, key) if (obj) [coder encodeObject:obj forKey:key]
+#define DECODE(cls, key) [decoder decodeObjectOfClass:[cls class] forKey:key]
+#define DECODEARRAY(cls, key) \
+    [decoder decodeObjectOfClasses:[NSSet setWithObjects:[NSArray class], [cls class], nil] \
+                            forKey:key]
 
-- (void)encodeWithCoder:(NSCoder *)coder {
-  [coder encodeObject:self.idx forKey:@"idx"];
-  [coder encodeObject:self.fileSHA1 forKey:@"fileSHA1"];
-  [coder encodeObject:self.filePath forKey:@"filePath"];
-
-  if (self.fileBundleName) [coder encodeObject:self.fileBundleName forKey:@"fileBundleName"];
-  if (self.fileBundleID) [coder encodeObject:self.fileBundleID forKey:@"fileBundleID"];
-  if (self.fileBundleVersion) {
-    [coder encodeObject:self.fileBundleVersion forKey:@"fileBundleVersion"];
-  }
-  if (self.fileBundleVersionString) {
-    [coder encodeObject:self.fileBundleVersionString forKey:@"fileBundleVersionString"];
-  }
-
-  if (self.certSHA1) [coder encodeObject:self.certSHA1 forKey:@"certSHA1"];
-  if (self.certCN) [coder encodeObject:self.certCN forKey:@"certCN"];
-  if (self.certOrg) [coder encodeObject:self.certOrg forKey:@"certOrg"];
-  if (self.certOU) [coder encodeObject:self.certOU forKey:@"certOU"];
-  if (self.certValidFromDate) {
-    [coder encodeObject:self.certValidFromDate forKey:@"certValidFromDate"];
-  }
-  if (self.certValidUntilDate) {
-    [coder encodeObject:self.certValidUntilDate forKey:@"certValidUntilDate"];
-  }
-
-  [coder encodeObject:self.executingUser forKey:@"executingUser"];
-  [coder encodeObject:self.occurrenceDate forKey:@"occurrenceDate"];
-  [coder encodeInt:self.decision forKey:@"decision"];
-
-  if (self.loggedInUsers) [coder encodeObject:self.loggedInUsers forKey:@"loggedInUsers"];
-  if (self.currentSessions) [coder encodeObject:self.currentSessions forKey:@"currentSessions"];
++ (BOOL)supportsSecureCoding {
+  return YES;
 }
 
-- (instancetype)initWithCoder:(NSCoder *)decoder {
-  _idx = [decoder decodeObjectOfClass:[NSNumber class] forKey:@"idx"];
-  _fileSHA1 = [decoder decodeObjectOfClass:[NSString class] forKey:@"fileSHA1"];
-  _filePath = [decoder decodeObjectOfClass:[NSString class] forKey:@"filePath"];
-  _fileBundleName = [decoder decodeObjectOfClass:[NSString class] forKey:@"fileBundleName"];
+- (void)encodeWithCoder:(NSCoder *)coder {
+  ENCODE(self.idx, @"idx");
+  ENCODE(self.fileSHA256, @"fileSHA256");
+  ENCODE(self.filePath, @"filePath");
 
-  _fileBundleID = [decoder decodeObjectOfClass:[NSString class] forKey:@"fileBundleID"];
-  _fileBundleVersion = [decoder decodeObjectOfClass:[NSString class] forKey:@"fileBundleVersion"];
-  _fileBundleVersionString =
-      [decoder decodeObjectOfClass:[NSString class] forKey:@"fileBundleVersionString"];
-  _certSHA1 = [decoder decodeObjectOfClass:[NSString class] forKey:@"certSHA1"];
-  _certCN = [decoder decodeObjectOfClass:[NSString class] forKey:@"certCN"];
-  _certOrg = [decoder decodeObjectOfClass:[NSString class] forKey:@"certOrg"];
-  _certOU = [decoder decodeObjectOfClass:[NSString class] forKey:@"certOU"];
-  _certValidFromDate = [decoder decodeObjectOfClass:[NSDate class] forKey:@"certValidFromDate"];
-  _certValidUntilDate = [decoder decodeObjectOfClass:[NSDate class] forKey:@"certValidUntilDate"];
-  _executingUser = [decoder decodeObjectOfClass:[NSString class] forKey:@"executingUser"];
-  _occurrenceDate = [decoder decodeObjectOfClass:[NSDate class] forKey:@"occurrenceDate"];
-  _decision = [decoder decodeIntForKey:@"decision"];
+  ENCODE(@(self.needsBundleHash), @"needsBundleHash");
+  ENCODE(self.fileBundleHash, @"fileBundleHash");
+  ENCODE(self.fileBundleHashMilliseconds, @"fileBundleHashMilliseconds");
+  ENCODE(self.fileBundleBinaryCount, @"fileBundleBinaryCount");
+  ENCODE(self.fileBundleName, @"fileBundleName");
+  ENCODE(self.fileBundlePath, @"fileBundlePath");
+  ENCODE(self.fileBundleID, @"fileBundleID");
+  ENCODE(self.fileBundleVersion, @"fileBundleVersion");
+  ENCODE(self.fileBundleVersionString, @"fileBundleVersionString");
 
-  NSSet *stringAndArrayClasses = [NSSet setWithObjects:[NSArray class], [NSString class], nil];
-  _loggedInUsers = [decoder decodeObjectOfClasses:stringAndArrayClasses forKey:@"loggedInUsers"];
-  _currentSessions = [decoder decodeObjectOfClasses:stringAndArrayClasses
-                                             forKey:@"currentSessions"];
+  ENCODE(self.signingChain, @"signingChain");
 
+  ENCODE(self.executingUser, @"executingUser");
+  ENCODE(self.occurrenceDate, @"occurrenceDate");
+  ENCODE(@(self.decision), @"decision");
+  ENCODE(self.pid, @"pid");
+  ENCODE(self.ppid, @"ppid");
+  ENCODE(self.parentName, @"parentName");
+
+  ENCODE(self.loggedInUsers, @"loggedInUsers");
+  ENCODE(self.currentSessions, @"currentSessions");
+
+  ENCODE(self.quarantineDataURL, @"quarantineDataURL");
+  ENCODE(self.quarantineRefererURL, @"quarantineRefererURL");
+  ENCODE(self.quarantineTimestamp, @"quarantineTimestamp");
+  ENCODE(self.quarantineAgentBundleID, @"quarantineAgentBundleID");
+}
+
+- (instancetype)init {
+  self = [super init];
+  if (self) {
+    _idx = @(arc4random());
+  }
   return self;
 }
 
-- (BOOL)isEqual:(SNTStoredEvent *)other {
+- (instancetype)initWithCoder:(NSCoder *)decoder {
+  self = [super init];
+  if (self) {
+    _idx = DECODE(NSNumber, @"idx");
+    _fileSHA256 = DECODE(NSString, @"fileSHA256");
+    _filePath = DECODE(NSString, @"filePath");
+
+    _needsBundleHash = [DECODE(NSNumber, @"needsBundleHash") boolValue];
+    _fileBundleHash = DECODE(NSString, @"fileBundleHash");
+    _fileBundleHashMilliseconds = DECODE(NSNumber, @"fileBundleHashMilliseconds");
+    _fileBundleBinaryCount = DECODE(NSNumber, @"fileBundleBinaryCount");
+    _fileBundleName = DECODE(NSString, @"fileBundleName");
+    _fileBundlePath = DECODE(NSString, @"fileBundlePath");
+    _fileBundleID = DECODE(NSString, @"fileBundleID");
+    _fileBundleVersion = DECODE(NSString, @"fileBundleVersion");
+    _fileBundleVersionString = DECODE(NSString, @"fileBundleVersionString");
+
+    _signingChain = DECODEARRAY(MOLCertificate, @"signingChain");
+
+    _executingUser = DECODE(NSString, @"executingUser");
+    _occurrenceDate = DECODE(NSDate, @"occurrenceDate");
+    _decision = (SNTEventState)[DECODE(NSNumber, @"decision") intValue];
+    _pid = DECODE(NSNumber, @"pid");
+    _ppid = DECODE(NSNumber, @"ppid");
+    _parentName = DECODE(NSString, @"parentName");
+
+    _loggedInUsers = DECODEARRAY(NSString, @"loggedInUsers");
+    _currentSessions = DECODEARRAY(NSString, @"currentSessions");
+
+    _quarantineDataURL = DECODE(NSString, @"quarantineDataURL");
+    _quarantineRefererURL = DECODE(NSString, @"quarantineRefererURL");
+    _quarantineTimestamp = DECODE(NSDate, @"quarantineTimestamp");
+    _quarantineAgentBundleID = DECODE(NSString, @"quarantineAgentBundleID");
+  }
+  return self;
+}
+
+- (BOOL)isEqual:(id)other {
   if (other == self) return YES;
   if (![other isKindOfClass:[SNTStoredEvent class]]) return NO;
-  return ([self.fileSHA1 isEqual:other.fileSHA1] &&
-          [self.idx isEqual:other.idx]);
+  SNTStoredEvent *o = other;
+  return ([self.fileSHA256 isEqual:o.fileSHA256] && [self.idx isEqual:o.idx]);
 }
 
 - (NSUInteger)hash {
   NSUInteger prime = 31;
   NSUInteger result = 1;
   result = prime * result + [self.idx hash];
-  result = prime * result + [self.fileSHA1 hash];
-  result = prime * result + [self.filePath hash];
+  result = prime * result + [self.fileSHA256 hash];
+  result = prime * result + [self.occurrenceDate hash];
   return result;
 }
 
 - (NSString *)description {
-  return [NSString stringWithFormat:@"SNTStoredEvent[%@] with SHA-1: %@", self.idx, self.fileSHA1];
+  return
+      [NSString stringWithFormat:@"SNTStoredEvent[%@] with SHA-256: %@", self.idx, self.fileSHA256];
 }
 
 @end

Source/common/SNTStrengthify.h

@@ -0,0 +1,22 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#define STRONGIFY(var) \
+  _Pragma("clang diagnostic push") \
+  _Pragma("clang diagnostic ignored \"-Wshadow\"") \
+  __strong __typeof(var) var = (Weak_##var); \
+  _Pragma("clang diagnostic pop")
+
+#define WEAKIFY(var) \
+  __weak __typeof(var) Weak_##var = (var);

Source/common/SNTSystemInfo.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,17 +12,41 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-/// Simple class for fetching system information
+@import Foundation;
+
+///
+///  Simple class for fetching system information
+///
 @interface SNTSystemInfo : NSObject
 
+///
+///  @return System serial number
+///
 + (NSString *)serialNumber;
 
+///
+///  @return System hardware UUID
+///
 + (NSString *)hardwareUUID;
 
+///
+///  @return OS Version, e.g.: 10.10.2
+///
 + (NSString *)osVersion;
+
+///
+///  @return OS Build, e.g.: 14C109
+///
 + (NSString *)osBuild;
 
+///
+///  @return Short hostname
+///
 + (NSString *)shortHostname;
+
+///
+///  @return Long hostname
+///
 + (NSString *)longHostname;
 
 @end

Source/common/SNTSystemInfo.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -21,14 +21,11 @@
       kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"));
   if (!platformExpert) return nil;
 
-  NSString *serial = CFBridgingRelease(
-      IORegistryEntryCreateCFProperty(platformExpert,
-                                      CFSTR(kIOPlatformSerialNumberKey),
-                                      kCFAllocatorDefault,
-                                      0));
-  
+  NSString *serial = CFBridgingRelease(IORegistryEntryCreateCFProperty(
+      platformExpert, CFSTR(kIOPlatformSerialNumberKey), kCFAllocatorDefault, 0));
+
   IOObjectRelease(platformExpert);
-  
+
   return serial;
 }
 
@@ -37,10 +34,8 @@
       kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"));
   if (!platformExpert) return nil;
 
-  NSString *uuid = CFBridgingRelease(
-      IORegistryEntryCreateCFProperty(platformExpert,
-                                      CFSTR(kIOPlatformUUIDKey),
-                                      kCFAllocatorDefault, 0));
+  NSString *uuid = CFBridgingRelease(IORegistryEntryCreateCFProperty(
+      platformExpert, CFSTR(kIOPlatformUUIDKey), kCFAllocatorDefault, 0));
 
   IOObjectRelease(platformExpert);
 
@@ -60,14 +55,16 @@
 }
 
 + (NSString *)longHostname {
-  return [[NSHost currentHost] name];
+  char hostname[MAXHOSTNAMELEN];
+  gethostname(hostname, (int)sizeof(hostname));
+  return @(hostname);
 }
 
-# pragma mark - Internal
+#pragma mark - Internal
 
 + (NSDictionary *)_systemVersionDictionary {
-  return [NSDictionary dictionaryWithContentsOfFile:
-      @"/System/Library/CoreServices/SystemVersion.plist"];
+  return [NSDictionary
+      dictionaryWithContentsOfFile:@"/System/Library/CoreServices/SystemVersion.plist"];
 }
 
 @end

Source/common/SNTXPCBundleServiceInterface.h

@@ -0,0 +1,56 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+@class SNTStoredEvent;
+
+///  A block that takes the calculated bundle hash, associated events and hashing time in ms.
+typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNumber *);
+
+///  Protocol implemented by santabs and utilized by SantaGUI for bundle hashing
+@protocol SNTBundleServiceXPC
+
+///
+///  @param listener The listener to connect back to the SantaGUI.
+///
+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
+
+///
+///  Hash a bundle for an event. The SNTBundleHashBlock will be called with nil parameters if a
+///  failure or cancellation occurs.
+///
+///  @param event The event that includes the fileBundlePath to be hashed.
+///  @param reply A SNTBundleHashBlock to be executed upon completion or cancellation.
+///
+///  @note If there is a current NSProgress when called this method will report back its progress.
+///
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
+
+@end
+
+@interface SNTXPCBundleServiceInterface : NSObject
+
+///
+///  Returns an initialized NSXPCInterface for the SNTBundleServiceXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning.
+///
++ (NSXPCInterface *)bundleServiceInterface;
+
+///
+///  Returns the MachService ID for this service.
+///
++ (NSString *)serviceId;
+
+@end

Source/common/SNTXPCBundleServiceInterface.m

@@ -0,0 +1,36 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTXPCBundleServiceInterface.h"
+
+#import "SNTStoredEvent.h"
+
+@implementation SNTXPCBundleServiceInterface
+
++ (NSXPCInterface *)bundleServiceInterface {
+  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleServiceXPC)];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(hashBundleBinariesForEvent:reply:)
+      argumentIndex:1
+            ofReply:YES];
+
+  return r;
+}
+
++ (NSString *)serviceId {
+  return @"com.google.santabs";
+}
+
+@end

Source/common/SNTXPCConnection.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,76 +12,124 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+@import Foundation;
+
 /**
-*  A validating XPC connection/listener which uses codesigning to validate that both ends of the
-*  connection were signed by the same certificate chain.
-*
-*  Example server started by @c launchd where the @c launchd job has a @c MachServices key:
-*
-*@code
-*   SNTXPCConnection *conn = [[SNTXPCConnection alloc] initServerWithName:@"MyServer"];
-*   conn.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyServerProtocol)];
-*   conn.exportedObject = myObject;
-*   conn.remoteInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyClientProtocol)];
-*   [conn resume];
-*@endcode
-*
-*  Example client, connecting to above server:
-*
-*@code
-*   SNTXPCConnection *conn = [[SNTXPCConnection alloc] initClientWithName:"MyServer" withOptions:0];
-*   conn.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyClientProtocol)];
-*   conn.exportedObject = myObject;
-*   conn.remoteInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyServerProtocol)];
-*   conn.invalidationHandler = ^{ NSLog(@"Connection invalidated") };
-*   [conn resume];
-*@endcode
-*
-*  Either side can then send a message to the other with:
-*
-*@code
-*   [conn.remoteObjectProxy selectorInRemoteInterface];
-*@endcode
-*
-*  Note: messages are always delivered on a background thread!
-**/
+  A wrapper around NSXPCListener and NSXPCConnection to provide client multiplexing, signature
+  validation of connecting clients and forced connection establishment.
+
+  Example server started by @c launchd where the @c launchd job has a @c MachServices key:
+
+  @code
+   SNTXPCConnection *conn = [[SNTXPCConnection alloc] initServerWithName:@"MyServer"];
+   conn.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyServerProtocol)];
+   conn.exportedObject = myObject;
+   [conn resume];
+  @endcode
+
+  Example client, connecting to above server:
+
+  @code
+   SNTXPCConnection *conn = [[SNTXPCConnection alloc] initClientWithName:"MyServer"
+                                                             withOptions:0];
+   conn.remoteInterface = [NSXPCInterface interfaceWithProtocol:@protocol(MyServerProtocol)];
+   conn.invalidationHandler = ^{ NSLog(@"Connection invalidated") };
+   [conn resume];
+  @endcode
+
+  The client can send a message to the server with:
+
+  @code
+   [conn.remoteObjectProxy selectorInRemoteInterface];
+  @endcode
+
+  One advantage of the way that SNTXPCConnection works over using NSXPCConnection directly is that
+  from the client-side once the resume method has finished, the connection is either valid or the
+  invalidation handler will be called. Ordinarily, the connection doesn't actually get made until
+  the first message is sent across it.
+
+  @note messages are always delivered on a background thread!
+*/
 @interface SNTXPCConnection : NSObject<NSXPCListenerDelegate>
 
-typedef void (^SNTXPCInvalidationBlock)(void);
-typedef void (^SNTXPCAcceptedBlock)(void);
-typedef void (^SNTXPCRejectedBlock)(void);
+/**
+  Initialize a new server with a given listener, provided by `[NSXPCListener anonymousListener]`.
+*/
+- (nullable instancetype)initServerWithListener:(nonnull NSXPCListener *)listener;
 
-/// The interface the remote object should conform to.
-@property(retain) NSXPCInterface *remoteInterface;
+/**
+  Initializer for the 'server' side of the connection, started by launchd.
 
-/// A proxy to the object at the other end of the connection.
-/// *Warning*: Do not send a message to this object if you didn't set @c remoteInterface above
-/// before calling the @c resume method, doing so will throw an exception.
-@property(readonly) id remoteObjectProxy;
+  @param name MachService name, must match the MachServices key in the launchd.plist
+*/
+- (nullable instancetype)initServerWithName:(nonnull NSString *)name;
 
-/// The interface this object conforms to.
-@property(retain) NSXPCInterface *exportedInterface;
+/**
+  Initialize a new client to a service exported by a LaunchDaemon.
 
-/// The object that responds to messages from the other end.
-@property(retain) id exportedObject;
+  @param name MachService name
+  @param privileged Use YES if the server is running as root.
+*/
+- (nullable instancetype)initClientWithName:(nonnull NSString *)name privileged:(BOOL)privileged;
 
-/// A block to run when the connection is invalidated.
-@property(copy) SNTXPCInvalidationBlock invalidationHandler;
+/**
+  Initialize a new client to a service within a bundle.
 
-/// A block to run when the connection has been accepted.
-@property(copy) SNTXPCAcceptedBlock acceptedHandler;
+  @param name service name
+*/
+- (nullable instancetype)initClientWithServiceName:(nonnull NSString *)name;
 
-/// A block to run when the connection has been rejected.
-@property(copy) SNTXPCRejectedBlock rejectedHandler;
+/**
+  Initialize a new client with a listener endpoint sent from another process.
 
-/// Initializer for the 'server' side of the connection, the binary that was started by launchd.
-- (instancetype)initServerWithName:(NSString *)name;
+  @param listener An NSXPCListenerEndpoint to connect to.
+*/
+- (nullable instancetype)initClientWithListener:(nonnull NSXPCListenerEndpoint *)listener;
 
-/// Initializer for the 'client' side of the connection. If the 'server' was started as a
-/// LaunchDaemon (running as root), pass |NSXPCConnectionPrivileged| for |options|, otherwise use 0.
-- (instancetype)initClientWithName:(NSString *)name options:(NSXPCConnectionOptions)options;
+/**
+  Call when the properties of the object have been set-up and you're ready for connections.
 
-/// Call when the properties of the object have been set-up and you're ready for connections.
+  For clients, this call can take up to 2s to complete for connection to finish establishing though
+  in basically all cases it will actually complete in a few milliseconds.
+*/
 - (void)resume;
 
+/**
+  Invalidate the connection(s). This must be done before the object can be released.
+*/
+- (void)invalidate;
+
+/**
+  The interface the remote object should conform to. (client)
+*/
+@property(retain, nullable) NSXPCInterface *remoteInterface;
+
+/**
+  A proxy to the object at the other end of the connection. (client)
+
+  @note If the connection to the server failed, this will be nil, so you can safely send messages
+  and rely on the invalidationHandler for handling the failure.
+*/
+@property(readonly, nonatomic, nullable) id remoteObjectProxy;
+
+/**
+  The interface this object exports. (server)
+*/
+@property(retain, nullable) NSXPCInterface *exportedInterface;
+
+/**
+  The object that responds to messages from the other end. (server)
+*/
+@property(retain, nullable) id exportedObject;
+
+/**
+  A block to run when a/the connection is accepted and fully established.
+*/
+@property(copy, nullable) void (^acceptedHandler)(void);
+
+/**
+  A block to run when a/the connection is invalidated/interrupted/rejected.
+*/
+@property(copy, nullable) void (^invalidationHandler)(void);
+
 @end

Source/common/SNTXPCConnection.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -14,47 +14,94 @@
 
 #import "SNTXPCConnection.h"
 
-#import "SNTCodesignChecker.h"
+#import "MOLCodesignChecker.h"
 
-@protocol XPCConnectionValidityRequest
-- (void)isConnectionValidWithBlock:(void (^)(BOOL))block;
+#import "SNTStrengthify.h"
+
+/**
+  Protocol used during connection establishment, @see SNTXPCConnectionInterface
+*/
+@protocol SNTXPCConnectionProtocol
+- (void)connectWithReply:(void (^)())reply;
+@end
+
+/**
+  Recipient object used during connection establishment. Each incoming connection
+  has one of these objects created which accept the message in the protocol
+  and call the block provided during creation before replying.
+
+  This allows the server to reset the connection's exported interface and
+  object to the correct values after the client has sent the establishment message.
+*/
+@interface SNTXPCConnectionInterface : NSObject<SNTXPCConnectionProtocol>
+@property(strong) void (^block)(void);
+@end
+
+@implementation SNTXPCConnectionInterface
+- (void)connectWithReply:(void (^)())reply {
+  if (self.block) self.block();
+  reply();
+}
 @end
 
 @interface SNTXPCConnection ()
-/// The XPC listener (used on server-side only).
+@property NSXPCInterface *validationInterface;
+
+/// The XPC listener (server only).
 @property NSXPCListener *listenerObject;
 
-/// The current connection object.
+/// The current connection object (client only).
 @property NSXPCConnection *currentConnection;
-
-/// The remote interface to use while the connection hasn't been validated.
-@property NSXPCInterface *validatorInterface;
 @end
 
 @implementation SNTXPCConnection
 
 #pragma mark Initializers
-- (instancetype)initServerWithName:(NSString *)name {
+
+- (instancetype)initServerWithListener:(NSXPCListener *)listener {
   self = [super init];
   if (self) {
-    Protocol *validatorProtocol = @protocol(XPCConnectionValidityRequest);
-    _validatorInterface = [NSXPCInterface interfaceWithProtocol:validatorProtocol];
-    _listenerObject = [[NSXPCListener alloc] initWithMachServiceName:name];
-
-    if (!_validatorInterface || !_listenerObject) return nil;
+    _listenerObject = listener;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
   }
   return self;
 }
 
-- (instancetype)initClientWithName:(NSString *)name options:(NSXPCConnectionOptions)options {
+- (instancetype)initServerWithName:(NSString *)name {
+  return [self initServerWithListener:[[NSXPCListener alloc] initWithMachServiceName:name]];
+}
+
+- (instancetype)initClientWithListener:(NSXPCListenerEndpoint *)listener {
   self = [super init];
   if (self) {
-    Protocol *validatorProtocol = @protocol(XPCConnectionValidityRequest);
-    _validatorInterface = [NSXPCInterface interfaceWithProtocol:validatorProtocol];
-    _currentConnection = [[NSXPCConnection alloc] initWithMachServiceName:name
-                                                                  options:options];
+    _currentConnection = [[NSXPCConnection alloc] initWithListenerEndpoint:listener];
+    if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
+  }
+  return self;
+}
 
-    if (!_validatorInterface || !_currentConnection) return nil;
+- (instancetype)initClientWithName:(NSString *)name privileged:(BOOL)privileged {
+  self = [super init];
+  if (self) {
+    NSXPCConnectionOptions options = (privileged ? NSXPCConnectionPrivileged : 0);
+    _currentConnection = [[NSXPCConnection alloc] initWithMachServiceName:name options:options];
+    if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
+  }
+  return self;
+}
+
+- (instancetype)initClientWithServiceName:(NSString *)name {
+  self = [super init];
+  if (self) {
+    _currentConnection = [[NSXPCConnection alloc] initWithServiceName:name];
+    if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
   }
   return self;
 }
@@ -67,130 +114,90 @@
 #pragma mark Connection set-up
 
 - (void)resume {
-  if (_listenerObject) {
-    // A new listener doesn't do anything until a client connects.
+  if (self.listenerObject) {
     self.listenerObject.delegate = self;
     [self.listenerObject resume];
   } else {
-    // A new client begins the validation process.
-    NSXPCConnection *connection = _currentConnection;
+    WEAKIFY(self);
 
-    connection.remoteObjectInterface = _validatorInterface;
-
-    connection.invalidationHandler = ^{
-        [self invokeInvalidationHandler];
-        self.currentConnection = nil;
+    // Set-up the connection with the remote interface set to the validation interface,
+    // send a message to the listener to finish establishing the connection
+    dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+    self.currentConnection.remoteObjectInterface = self.validationInterface;
+    self.currentConnection.interruptionHandler = self.currentConnection.invalidationHandler = ^{
+      STRONGIFY(self);
+      if (self.invalidationHandler) self.invalidationHandler();
     };
-
-    connection.interruptionHandler = ^{
-        [self.currentConnection invalidate];
-    };
-
-    [connection resume];
-
-    [[connection remoteObjectProxy] isConnectionValidWithBlock:^void(BOOL response) {
-        pid_t pid = self.currentConnection.processIdentifier;
-
-        SNTCodesignChecker *selfCS = [[SNTCodesignChecker alloc] initWithSelf];
-        SNTCodesignChecker *otherCS = [[SNTCodesignChecker alloc] initWithPID:pid];
-
-        if (response && [otherCS signingInformationMatches:selfCS]) {
-          [self.currentConnection suspend];
-          self.currentConnection.remoteObjectInterface = self.remoteInterface;
-          self.currentConnection.exportedInterface = self.exportedInterface;
-          self.currentConnection.exportedObject = self.exportedObject;
-          [self invokeAcceptedHandler];
-          [self.currentConnection resume];
-        } else {
-          [self invokeRejectedHandler];
-          [self.currentConnection invalidate];
-          self.currentConnection = nil;
-        }
+    [self.currentConnection resume];
+    [[self.currentConnection remoteObjectProxy] connectWithReply:^{
+      STRONGIFY(self);
+      // The connection is now established
+      [self.currentConnection suspend];
+      self.currentConnection.remoteObjectInterface = self.remoteInterface;
+      [self.currentConnection resume];
+      dispatch_semaphore_signal(sema);
+      if (self.acceptedHandler) self.acceptedHandler();
     }];
+    if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC))) {
+      // Connection was not established in a reasonable time, invalidate.
+      self.currentConnection.remoteObjectInterface = nil;  // ensure clients don't try to use it.
+      [self.currentConnection invalidate];
+    }
   }
 }
 
 - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)connection {
-  // Reject connection if a connection already exists. As the invalidation/interruption handlers
-  // both cause the currentConnection to be nil'd out, this should be OK.
-  if (self.currentConnection) return NO;
+  pid_t pid = connection.processIdentifier;
+  MOLCodesignChecker *otherCS = [[MOLCodesignChecker alloc] initWithPID:pid];
+  if (![otherCS signingInformationMatches:[[MOLCodesignChecker alloc] initWithSelf]]) {
+    return NO;
+  }
 
-  connection.exportedObject = self;
-  connection.exportedInterface = _validatorInterface;
+  // The client passed the code signature check, now we need to resume the listener and
+  // return YES so that the client can send the connectWithReply message. Once the client does
+  // we reset the connection's exportedInterface and exportedObject.
+  SNTXPCConnectionInterface *ci = [[SNTXPCConnectionInterface alloc] init];
+  WEAKIFY(self);
+  WEAKIFY(connection);
+  ci.block = ^{
+    STRONGIFY(self)
+    STRONGIFY(connection);
+    [connection suspend];
+    connection.invalidationHandler = connection.interruptionHandler = ^{
+      if (self.invalidationHandler) self.invalidationHandler();
+    };
+    connection.exportedInterface = self.exportedInterface;
+    connection.exportedObject = self.exportedObject;
+    [connection resume];
 
-  connection.invalidationHandler = ^{
-      [self invokeInvalidationHandler];
-      self.currentConnection = nil;
+    // The connection is now established.
+    if (self.acceptedHandler) self.acceptedHandler();
   };
-
-  connection.interruptionHandler = ^{
-      // Invalidate the connection, causing the handler above to run
-      [self.currentConnection invalidate];
-  };
-
-  // At this point the client is connected and can send messages but the only message it can send
-  // is isConnectionValidWithBlock: and we won't send anything to it until it has.
-  self.currentConnection = connection;
-
+  connection.exportedInterface = self.validationInterface;
+  connection.exportedObject = ci;
   [connection resume];
 
   return YES;
 }
 
-- (void)isConnectionValidWithBlock:(void (^)(BOOL))block {
-  pid_t pid = self.currentConnection.processIdentifier;
-
-  SNTCodesignChecker *selfCS = [[SNTCodesignChecker alloc] initWithSelf];
-  SNTCodesignChecker *otherCS = [[SNTCodesignChecker alloc] initWithPID:pid];
-
-  if ([otherCS signingInformationMatches:selfCS]) {
-    [self.currentConnection suspend];
-    self.currentConnection.remoteObjectInterface = self.remoteInterface;
-    self.currentConnection.exportedInterface = self.exportedInterface;
-    self.currentConnection.exportedObject = self.exportedObject;
-    [self.currentConnection resume];
-
-    [self invokeAcceptedHandler];
-
-    // Let remote end know that we accepted. Note: in acception this must come last otherwise
-    // the remote end might start sending messages before the interface is fully set-up.
-    block(YES);
-  } else {
-    // Let remote end know that we rejected. Note: in rejection this must come first otherwise
-    // the connection is invalidated before the client ever realizes.
-    block(NO);
-
-    [self invokeRejectedHandler];
-
-    [self.currentConnection invalidate];
-    self.currentConnection = nil;
-  }
-}
-
 - (id)remoteObjectProxy {
-  if (self.currentConnection && self.currentConnection.remoteObjectInterface) {
+  if (self.currentConnection.remoteObjectInterface &&
+      self.currentConnection.remoteObjectInterface != self.validationInterface) {
     return [self.currentConnection remoteObjectProxyWithErrorHandler:^(NSError *error) {
-        [self.currentConnection invalidate];
+      [self.currentConnection invalidate];
     }];
   }
   return nil;
 }
 
-- (void)invokeAcceptedHandler {
-  if (self.acceptedHandler) {
-    self.acceptedHandler();
-  }
-}
+#pragma mark Connection tear-down
 
-- (void)invokeRejectedHandler {
-  if (self.rejectedHandler) {
-    self.rejectedHandler();
-  }
-}
-
-- (void)invokeInvalidationHandler {
-  if (self.invalidationHandler) {
-    self.invalidationHandler();
+- (void)invalidate {
+  if (self.currentConnection) {
+    [self.currentConnection invalidate];
+    self.currentConnection = nil;
+  } else if (self.listenerObject) {
+    [self.listenerObject invalidate];
   }
 }
 

Source/common/SNTXPCControlInterface.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,41 +12,115 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#include "SNTCommonEnums.h"
+@import Foundation;
+
+#import <MOLCertificate/MOLCertificate.h>
+
+#import "SNTCachedDecision.h"
+#import "SNTCommonEnums.h"
+#import "SNTKernelCommon.h"
+#import "SNTXPCBundleServiceInterface.h"
 
 @class SNTRule;
 @class SNTStoredEvent;
+@class SNTXPCConnection;
 
-/// Protocol implemented by santad and utilized by santactl
+///
+///  Protocol implemented by santad and utilized by santactl
+///
 @protocol SNTDaemonControlXPC
 
-/// Kernel ops
-- (void)cacheCount:(void (^)(uint64_t))reply;
+///
+///  Kernel ops
+///
+- (void)cacheCount:(void (^)(int64_t))reply;
 - (void)flushCache:(void (^)(BOOL))reply;
+- (void)checkCacheForVnodeID:(uint64_t)vnodeID withReply:(void (^)(santa_action_t))reply;
 
-/// Database ops
-- (void)databaseRuleCounts:(void (^)(uint64_t binary, uint64_t certificate))reply;
-- (void)databaseRuleAddRule:(SNTRule *)rule withReply:(void (^)())reply;
-- (void)databaseRuleAddRules:(NSArray *)rules withReply:(void (^)())reply;
-
-- (void)databaseEventCount:(void (^)(uint64_t count))reply;
-- (void)databaseEventForSHA1:(NSString *)sha1 withReply:(void (^)(SNTStoredEvent *))reply;
+///
+///  Database ops
+///
+- (void)databaseRuleCounts:(void (^)(int64_t binary, int64_t certificate))reply;
+- (void)databaseRuleAddRules:(NSArray *)rules
+                  cleanSlate:(BOOL)cleanSlate
+                       reply:(void (^)(NSError *error))reply;
+- (void)databaseEventCount:(void (^)(int64_t count))reply;
 - (void)databaseEventsPending:(void (^)(NSArray *events))reply;
 - (void)databaseRemoveEventsWithIDs:(NSArray *)ids;
+- (void)databaseRuleForBinarySHA256:(NSString *)binarySHA256
+                  certificateSHA256:(NSString *)certificateSHA256
+                              reply:(void (^)(SNTRule *))reply;
+///
+///  Decision ops
+///
 
-/// Misc ops
-- (void)clientMode:(void (^)(santa_clientmode_t))reply;
-- (void)setClientMode:(santa_clientmode_t)mode withReply:(void (^)())reply;
+///
+///  @param filePath A Path to the file, can be nil.
+///  @param fileSHA256 The pre-calculated SHA256 hash for the file, can be nil. If nil the hash will
+///                    be calculated by this method from the filePath.
+///  @param certificateSHA256 A SHA256 hash of the signing certificate, can be nil.
+///  @note If fileInfo and signingCertificate are both passed in, the most specific rule will be
+///        returned. Binary rules take precedence over cert rules.
+///
+- (void)decisionForFilePath:(NSString *)filePath
+                 fileSHA256:(NSString *)fileSHA256
+          certificateSHA256:(NSString *)certificateSHA256
+                      reply:(void (^)(SNTEventState))reply;
+
+///
+///  Config ops
+///
+- (void)watchdogInfo:(void (^)(uint64_t, uint64_t, double, double))reply;
+- (void)clientMode:(void (^)(SNTClientMode))reply;
+- (void)setClientMode:(SNTClientMode)mode reply:(void (^)())reply;
+- (void)xsrfToken:(void (^)(NSString *))reply;
+- (void)setXsrfToken:(NSString *)token reply:(void (^)())reply;
+- (void)setSyncLastSuccess:(NSDate *)date reply:(void (^)())reply;
+- (void)setRuleSyncLastSuccess:(NSDate *)date reply:(void (^)())reply;
+- (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)())reply;
+- (void)setWhitelistPathRegex:(NSString *)pattern reply:(void (^)())reply;
+- (void)setBlacklistPathRegex:(NSString *)pattern reply:(void (^)())reply;
+- (void)bundlesEnabled:(void (^)(BOOL))reply;
+- (void)setBundlesEnabled:(BOOL)bundlesEnabled reply:(void (^)())reply;
+
+///
+///  GUI Ops
+///
+- (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;
+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
+
+///
+///  Syncd Ops
+///
+- (void)setSyncdListener:(NSXPCListenerEndpoint *)listener;
+- (void)pushNotifications:(void (^)(BOOL))reply;
+- (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message reply:(void (^)())reply;
+
+///
+///  Bundle Ops
+///
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
+- (void)syncBundleEvent:(SNTStoredEvent *)event relatedEvents:(NSArray<SNTStoredEvent *> *)events;
 
 @end
 
 @interface SNTXPCControlInterface : NSObject
 
-/// Returns the MachService ID for this service.
+///
+///  Returns the MachService ID for this service.
+///
 + (NSString *)serviceId;
 
-/// Returns an initialized NSXPCInterface for the SNTDaemonControlXPC protocol.
-/// Ensures any methods that accept custom classes as arguments are set-up before returning
+///
+///  Returns an initialized NSXPCInterface for the SNTDaemonControlXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
 + (NSXPCInterface *)controlInterface;
 
+///
+///  Retrieve a pre-configured SNTXPCConnection for communicating with santad.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
++ (SNTXPCConnection *)configuredConnection;
+
 @end

Source/common/SNTXPCControlInterface.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 #import "SNTRule.h"
 #import "SNTStoredEvent.h"
+#import "SNTXPCConnection.h"
 
 @implementation SNTXPCControlInterface
 
@@ -32,11 +33,28 @@
             ofReply:YES];
 
   [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTRule class], nil]
-        forSelector:@selector(databaseRuleAddRules:withReply:)
+        forSelector:@selector(databaseRuleAddRules:cleanSlate:reply:)
       argumentIndex:0
             ofReply:NO];
 
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(hashBundleBinariesForEvent:reply:)
+      argumentIndex:1
+            ofReply:YES];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(syncBundleEvent:relatedEvents:)
+      argumentIndex:1
+            ofReply:NO];
+
   return r;
 }
 
++ (SNTXPCConnection *)configuredConnection {
+  SNTXPCConnection *c = [[SNTXPCConnection alloc] initClientWithName:[self serviceId]
+                                                          privileged:YES];
+  c.remoteInterface = [self controlInterface];
+  return c;
+}
+
 @end

Source/common/SNTXPCNotifierInterface.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,19 +12,40 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-/// Protocol implemented by SantaNotifier and utilized by santad
-@class SNTNotificationMessage;
+@import Foundation;
+
+#import "SNTCommonEnums.h"
+#import "SNTXPCBundleServiceInterface.h"
+
+@class SNTStoredEvent;
+
+/// Protocol implemented by SantaGUI and utilized by santad
 @protocol SNTNotifierXPC
-- (void)postBlockNotification:(SNTNotificationMessage *)event;
+- (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
+- (void)postClientModeNotification:(SNTClientMode)clientmode;
+- (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
+@end
+
+/// Protocol implemented by SantaGUI and utilized by santabs
+@protocol SNTBundleNotifierXPC
+- (void)updateCountsForEvent:(SNTStoredEvent *)event
+                 binaryCount:(uint64_t)binaryCount
+                   fileCount:(uint64_t)fileCount;
+- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener;
 @end
 
 @interface SNTXPCNotifierInterface : NSObject
 
-/// Returns the MachService ID for this service.
-+ (NSString *)serviceId;
-
-/// Returns an initialized NSXPCInterface for the SNTNotifierXPC protocol.
-/// Ensures any methods that accept custom classes as arguments are set-up before returning
+///
+///  @return an initialized NSXPCInterface for the SNTNotifierXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
 + (NSXPCInterface *)notifierInterface;
 
+///
+///  @return an initialized NSXPCInterface for the SNTBundleNotifierXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
++ (NSXPCInterface *)bundleNotifierInterface;
+
 @end

Source/common/SNTXPCNotifierInterface.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,13 +16,12 @@
 
 @implementation SNTXPCNotifierInterface
 
-+ (NSString *)serviceId {
-  return @"SantaXPCNotifications";
++ (NSXPCInterface *)notifierInterface {
+  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTNotifierXPC)];
 }
 
-+ (NSXPCInterface *)notifierInterface {
-  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTNotifierXPC)];
-  return r;
++ (NSXPCInterface *)bundleNotifierInterface {
+  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleNotifierXPC)];
 }
 
 @end

Source/common/SNTXPCSyncdInterface.h

@@ -0,0 +1,37 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+#import "SNTCommonEnums.h"
+
+@class SNTStoredEvent;
+
+/// Protocol implemented by santactl and utilized by santad
+@protocol SNTSyncdXPC
+- (void)postEventToSyncServer:(SNTStoredEvent *)event;
+- (void)postBundleEventToSyncServer:(SNTStoredEvent *)event reply:(void (^)(BOOL))reply;
+- (void)postBundleEventsToSyncServer:(NSArray<SNTStoredEvent *> *)events;
+- (void)isFCMListening:(void (^)(BOOL))reply;
+@end
+
+@interface SNTXPCSyncdInterface : NSObject
+
+///
+///  Returns an initialized NSXPCInterface for the SNTSyncdXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
++ (NSXPCInterface *)syncdInterface;
+
+@end

Source/common/SNTXPCSyncdInterface.m

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2016 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,14 +12,21 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTCommandSyncStatus;
-@class SNTXPCConnection;
+#import "SNTXPCSyncdInterface.h"
 
-@interface SNTCommandSyncRuleDownload : NSObject
+#import "SNTStoredEvent.h"
 
-+ (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
+@implementation SNTXPCSyncdInterface
+
++ (NSXPCInterface *)syncdInterface {
+  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTSyncdXPC)];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(postBundleEventsToSyncServer:)
+      argumentIndex:0
+            ofReply:NO];
+
+  return r;
+}
 
 @end

Source/santa-driver/Resources/santa-driver-Info.plist

@@ -2,26 +2,22 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>English</string>
-	<key>CFBundleExecutable</key>
-	<string>${EXECUTABLE_NAME}</string>
-	<key>CFBundleIconFile</key>
-	<string></string>
-	<key>CFBundleIdentifier</key>
-	<string>com.google.santa-driver</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>${PRODUCT_NAME}</string>
 	<key>CFBundlePackageType</key>
 	<string>KEXT</string>
-	<key>CFBundleShortVersionString</key>
-	<string>0.7.1</string>
-	<key>CFBundleSignature</key>
-	<string>????</string>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google, Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.google.${PRODUCT_NAME:rfc1034identifier}</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
 	<key>CFBundleVersion</key>
-	<string>0.7.1</string>
+	<string>TO.BE.FILLED</string>
+	<key>CFBundleShortVersionString</key>
+	<string>TO.BE.FILLED</string>
 	<key>IOKitPersonalities</key>
 	<dict>
 		<key>SantaDriver</key>

Source/santa-driver/SantaCache.h

@@ -0,0 +1,271 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTA_DRIVER__SANTACACHE_H
+#define SANTA__SANTA_DRIVER__SANTACACHE_H
+
+#include <libkern/OSAtomic.h>
+#include <libkern/OSTypes.h>
+#include <stdint.h>
+#include <sys/cdefs.h>
+
+#include "SNTKernelCommon.h"
+
+#ifdef KERNEL
+#include <IOKit/IOLib.h>
+#else // KERNEL
+// Support for unit testing.
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#define panic(args...) printf(args); printf("\n"); abort()
+#define IOMalloc malloc
+#define IOMallocAligned(sz, alignment) malloc(sz);
+#define IOFree(addr, sz) free(addr)
+#define IOFreeAligned(addr, sz) free(addr)
+#define OSTestAndSet OSAtomicTestAndSet
+#define OSTestAndClear(bit, addr) OSAtomicTestAndClear(bit, addr) == 0
+#define OSIncrementAtomic(addr) OSAtomicIncrement64((volatile int64_t *)addr)
+#define OSDecrementAtomic(addr) OSAtomicDecrement64((volatile int64_t *)addr)
+#endif // KERNEL
+
+/**
+  A somewhat simple, concurrent linked-list hash table intended for use in IOKit kernel extensions.
+  Maps 64-bit unsigned integer keys to values.
+
+  Enforces a maximum size by clearing all entries if a new value
+  is added that would go over the maximum size declared at creation.
+
+  The number of buckets is calculated as `maximum_size` / `per_bucket`
+  rounded up to the next power of 2. Locking is done per-bucket.
+*/
+template<class T> class SantaCache {
+ public:
+  /**
+    Initialize a newly created cache.
+
+    @param maximum_size The maximum number of entries in this cache. Once this
+        number is reached all the entries will be purged.
+    @param per_bucket The target number of entries in each bucket when cache is full.
+        A higher number will result in better performance but higher memory usage.
+        Cannot be higher than 64 to try and ensure buckets don't overflow.
+  */
+  SantaCache(uint64_t maximum_size = 10000, uint8_t per_bucket = 5) {
+    if (unlikely(per_bucket < 1)) per_bucket = 1;
+    if (unlikely(per_bucket > 64)) per_bucket = 64;
+    max_size_ = maximum_size;
+    bucket_count_ = 1 << (32 - __builtin_clz(
+        ((uint32_t)max_size_ / per_bucket) - 1));
+    buckets_ = (struct bucket *)IOMalloc(bucket_count_ * sizeof(struct bucket));
+    bzero(buckets_, bucket_count_ * sizeof(struct bucket));
+  }
+
+  /**
+    Clear and free memory
+  */
+  ~SantaCache() {
+    clear();
+    IOFree(buckets_, bucket_count_ * sizeof(struct bucket));
+  }
+
+  /**
+    Get an element from the cache. Returns zero_ if item doesn't exist.
+  */
+  T get(uint64_t key) {
+    struct bucket *bucket = &buckets_[hash(key)];
+    lock(bucket);
+    struct entry *entry = (struct entry *)((uintptr_t)bucket->head - 1);
+    while (entry != nullptr) {
+      if (entry->key == key) {
+        T val = entry->value;
+        unlock(bucket);
+        return val;
+      }
+      entry = entry->next;
+    }
+    unlock(bucket);
+    return zero_;
+  }
+
+  /**
+    Set an element in the cache.
+
+    @note If the cache is full when this is called, this will empty the cache before
+    inserting the new value.
+
+    @return if an existing value was replaced, the previous value, otherwise zero_
+  */
+  T set(uint64_t key, T value) {
+    struct bucket *bucket = &buckets_[hash(key)];
+    lock(bucket);
+    struct entry *entry = (struct entry *)((uintptr_t)bucket->head - 1);
+    struct entry *previous_entry = nullptr;
+    while (entry != nullptr) {
+      if (entry->key == key) {
+        T existing_value = entry->value;
+        entry->value = value;
+
+        if (value == zero_) {
+          if (previous_entry != nullptr) {
+            previous_entry->next = entry->next;
+          } else {
+            bucket->head = (struct entry *)((uintptr_t)entry->next + 1);
+          }
+          IOFreeAligned(entry, sizeof(struct entry));
+          OSDecrementAtomic(&count_);
+        }
+
+        unlock(bucket);
+        return existing_value;
+      }
+      previous_entry = entry;
+      entry = entry->next;
+    }
+
+    // If value is zero_, we're clearing but there's nothing to clear
+    // so we don't need to do anything else.
+    if (value == zero_) {
+      unlock(bucket);
+      return zero_;
+    }
+
+    // Check that adding this new item won't take the cache over its maximum size.
+    if (count_ + 1 > max_size_) {
+      unlock(bucket);
+      lock(&clear_bucket_);
+      // Check again in case clear has already run while waiting for lock
+      if (count_ + 1 > max_size_) {
+        clear();
+      }
+      lock(bucket);
+      unlock(&clear_bucket_);
+    }
+
+    // Allocate a new entry, set the key and value, then set the next pointer as the current
+    // first entry in the bucket then make this new entry the first in the bucket.
+    struct entry *new_entry = (struct entry *)IOMallocAligned(sizeof(struct entry), 2);
+    new_entry->key = key;
+    new_entry->value = value;
+    new_entry->next = (struct entry *)((uintptr_t)bucket->head - 1);
+    bucket->head = (struct entry *)((uintptr_t)new_entry + 1);
+    OSIncrementAtomic(&count_);
+
+    unlock(bucket);
+    return zero_;
+  }
+
+  /**
+    An alias for `set(key, zero_)`
+  */
+  inline void remove(uint64_t key) {
+    set(key, zero_);
+  }
+
+  /**
+    Remove all entries and free bucket memory.
+  */
+  void clear() {
+    for (uint32_t i = 0; i < bucket_count_; ++i) {
+      struct bucket *bucket = &buckets_[i];
+      // We grab the lock so nothing can use this bucket while we're erasing it
+      // and never release it. It'll be 'released' when the bzero call happens
+      // at the end of this function.
+      lock(bucket);
+
+      // Free the bucket's entries, if there are any.
+      struct entry *entry = (struct entry *)((uintptr_t)bucket->head - 1);
+      while (entry != nullptr) {
+        struct entry *next_entry = entry->next;
+        IOFreeAligned(entry, sizeof(struct entry));
+        entry = next_entry;
+      }
+    }
+
+    // Reset cache count, no atomicity needed as we hold all the bucket locks.
+    count_ = 0;
+
+    // This resets all of the bucket counts and locks. Releasing the locks for
+    // each bucket isn't really atomic here but each bucket will be zero'd
+    // before the lock is released as the lock is the last thing in a bucket.
+    bzero(buckets_, bucket_count_ * sizeof(struct bucket));
+  }
+
+  /**
+    Return number of entries currently in cache.
+  */
+  inline uint64_t count() const {
+    return count_;
+  }
+
+ private:
+  struct entry {
+    uint64_t key;
+    T value;
+    struct entry *next;
+  };
+
+  struct bucket {
+    // The least significant bit of this pointer is always 0 (due to alignment),
+    // so we utilize that bit as the lock for the bucket.
+    struct entry *head;
+  };
+
+  /**
+    Lock a bucket. Spins until the lock is acquired.
+  */
+  inline void lock(struct bucket *bucket) const {
+    while (OSTestAndSet(7, (volatile uint8_t *)&bucket->head));
+  }
+
+  /**
+    Unlock a bucket. Panics if the lock wasn't locked.
+  */
+  inline void unlock(struct bucket *bucket) const {
+    if (unlikely(OSTestAndClear(7, (volatile uint8_t *)&bucket->head))) {
+      panic("SantaCache::unlock(): Tried to unlock an unlocked lock");
+    }
+  }
+
+  uint64_t count_ = 0;
+
+  uint64_t max_size_;
+  uint32_t bucket_count_;
+
+  struct bucket *buckets_;
+
+  /**
+    Holder for a 'zero' entry for the current type
+  */
+  const T zero_ = T();
+
+  /**
+    Special bucket used when automatically clearing due to size
+    to prevent two threads trying to clear at the same time and
+    getting stuck.
+  */
+  struct bucket clear_bucket_ = {};
+
+  /**
+    Hash a key to determine which bucket it belongs in.
+
+    Multiplicative hash using a prime near to the golden ratio, per Knuth.
+    This seems to have good bucket distribution generally and for the range of
+    values we expect to see.
+  */
+  inline uint64_t hash(uint64_t input) const {
+    return (input * 11400714819323198549ul) % bucket_count_;
+  }
+};
+
+#endif // SANTA__SANTA_DRIVER__SANTACACHE_H

Source/santa-driver/SantaDecisionManager.cc

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -19,317 +19,359 @@ OSDefineMetaClassAndStructors(SantaDecisionManager, OSObject);
 
 #pragma mark Object Lifecycle
 
-SantaDecisionManager *SantaDecisionManager::WithQueueAndPID(
-    IOSharedDataQueue *queue, pid_t pid) {
-  SantaDecisionManager *me = new SantaDecisionManager;
-
-  if (me && !me->InitWithQueueAndPID(queue, pid)) {
-    me->free();
-    return NULL;
-  }
-
-  return me;
-}
-
-bool SantaDecisionManager::InitWithQueueAndPID(
-    IOSharedDataQueue *queue, pid_t pid) {
+bool SantaDecisionManager::init() {
   if (!super::init()) return false;
 
-  if (!pid) return false;
-  if (!queue) return false;
+  sdm_lock_grp_attr_ = lck_grp_attr_alloc_init();
+  sdm_lock_grp_ = lck_grp_alloc_init("santa-locks", sdm_lock_grp_attr_);
+  sdm_lock_attr_ = lck_attr_alloc_init();
 
-  listener_invocations_ = 0;
-  dataqueue_ = queue;
-  owning_pid_ = pid;
-  owning_proc_ = proc_find(pid);
+  decision_dataqueue_lock_ = lck_mtx_alloc_init(sdm_lock_grp_, sdm_lock_attr_);
+  log_dataqueue_lock_ = lck_mtx_alloc_init(sdm_lock_grp_, sdm_lock_attr_);
 
-  if (!(dataqueue_lock_ = IORWLockAlloc())) return FALSE;
-  if (!(cached_decisions_lock_ = IORWLockAlloc())) return FALSE;
-  if (!(cached_decisions_ = OSDictionary::withCapacity(1000))) return FALSE;
+  decision_cache_ = new SantaCache<uint64_t>(10000, 2);
+  vnode_pid_map_ = new SantaCache<uint64_t>(2000, 5);
 
-  return TRUE;
+  decision_dataqueue_ = IOSharedDataQueue::withEntries(
+      kMaxDecisionQueueEvents, sizeof(santa_message_t));
+  if (!decision_dataqueue_) return kIOReturnNoMemory;
+
+  log_dataqueue_ = IOSharedDataQueue::withEntries(
+      kMaxLogQueueEvents, sizeof(santa_message_t));
+  if (!log_dataqueue_) return kIOReturnNoMemory;
+
+  client_pid_ = 0;
+
+  ts_ = { .tv_sec = kRequestLoopSleepMilliseconds / 1000,
+          .tv_nsec = kRequestLoopSleepMilliseconds % 1000 * 1000000 };
+
+  return true;
 }
 
 void SantaDecisionManager::free() {
-  proc_rele(owning_proc_);
+  delete decision_cache_;
+  delete vnode_pid_map_;
 
-  if (cached_decisions_) {
-    cached_decisions_->release();
-    cached_decisions_ = NULL;
+  if (decision_dataqueue_lock_) {
+    lck_mtx_free(decision_dataqueue_lock_, sdm_lock_grp_);
+    decision_dataqueue_lock_ = nullptr;
   }
 
-  if (cached_decisions_lock_) {
-    IORWLockFree(cached_decisions_lock_);
-    cached_decisions_lock_ = NULL;
+  if (log_dataqueue_lock_) {
+    lck_mtx_free(log_dataqueue_lock_, sdm_lock_grp_);
+    log_dataqueue_lock_ = nullptr;
   }
 
-  if (dataqueue_lock_) {
-    IORWLockFree(dataqueue_lock_);
-    dataqueue_lock_ = NULL;
+  if (sdm_lock_attr_) {
+    lck_attr_free(sdm_lock_attr_);
+    sdm_lock_attr_ = nullptr;
   }
 
+  if (sdm_lock_grp_) {
+    lck_grp_free(sdm_lock_grp_);
+    sdm_lock_grp_ = nullptr;
+  }
+
+  if (sdm_lock_grp_attr_) {
+    lck_grp_attr_free(sdm_lock_grp_attr_);
+    sdm_lock_grp_attr_ = nullptr;
+  }
+
+  OSSafeReleaseNULL(decision_dataqueue_);
+  OSSafeReleaseNULL(log_dataqueue_);
+
   super::free();
 }
 
-# pragma mark Cache Management
+#pragma mark Client Management
+
+void SantaDecisionManager::ConnectClient(pid_t pid) {
+  if (!pid) return;
+
+  client_pid_ = pid;
+
+  // Any decisions made while the daemon wasn't
+  // connected should be cleared
+  ClearCache();
+
+  failed_decision_queue_requests_ = 0;
+  failed_log_queue_requests_ = 0;
+}
+
+void SantaDecisionManager::DisconnectClient(bool itDied) {
+  if (client_pid_ < 1) return;
+  client_pid_ = 0;
+
+  // Ask santad to shutdown, in case it's running.
+  if (!itDied) {
+    auto message = new santa_message_t;
+    message->action = ACTION_REQUEST_SHUTDOWN;
+    PostToDecisionQueue(message);
+    delete message;
+    decision_dataqueue_->setNotificationPort(nullptr);
+  } else {
+    // If the client died, reset the data queues so when it reconnects
+    // it doesn't get swamped straight away.
+    lck_mtx_lock(decision_dataqueue_lock_);
+    decision_dataqueue_->release();
+    decision_dataqueue_ = IOSharedDataQueue::withEntries(
+        kMaxDecisionQueueEvents, sizeof(santa_message_t));
+    lck_mtx_unlock(decision_dataqueue_lock_);
+
+    lck_mtx_lock(log_dataqueue_lock_);
+    log_dataqueue_->release();
+    log_dataqueue_ = IOSharedDataQueue::withEntries(
+        kMaxLogQueueEvents, sizeof(santa_message_t));
+    lck_mtx_unlock(log_dataqueue_lock_);
+  }
+}
+
+bool SantaDecisionManager::ClientConnected() const {
+  if (client_pid_ <= 0) return false;
+  auto p = proc_find(client_pid_);
+  auto is_exiting = false;
+  if (p) {
+    is_exiting = proc_exiting(p);
+    proc_rele(p);
+  }
+  return (client_pid_ > 0 && !is_exiting);
+}
+
+void SantaDecisionManager::SetDecisionPort(mach_port_t port) {
+  lck_mtx_lock(decision_dataqueue_lock_);
+  decision_dataqueue_->setNotificationPort(port);
+  lck_mtx_unlock(decision_dataqueue_lock_);
+}
+
+void SantaDecisionManager::SetLogPort(mach_port_t port) {
+  lck_mtx_lock(log_dataqueue_lock_);
+  log_dataqueue_->setNotificationPort(port);
+  lck_mtx_unlock(log_dataqueue_lock_);
+}
+
+IOMemoryDescriptor *SantaDecisionManager::GetDecisionMemoryDescriptor() const {
+  return decision_dataqueue_->getMemoryDescriptor();
+}
+
+IOMemoryDescriptor *SantaDecisionManager::GetLogMemoryDescriptor() const {
+  return log_dataqueue_->getMemoryDescriptor();
+}
+
+#pragma mark Listener Control
+
+kern_return_t SantaDecisionManager::StartListener() {
+  vnode_listener_ = kauth_listen_scope(
+      KAUTH_SCOPE_VNODE, vnode_scope_callback, reinterpret_cast<void *>(this));
+  if (!vnode_listener_) return kIOReturnInternalError;
+
+  fileop_listener_ = kauth_listen_scope(
+      KAUTH_SCOPE_FILEOP, fileop_scope_callback, reinterpret_cast<void *>(this));
+  if (!fileop_listener_) return kIOReturnInternalError;
+
+  LOGD("Listeners started.");
+
+  return kIOReturnSuccess;
+}
+
+kern_return_t SantaDecisionManager::StopListener() {
+  kauth_unlisten_scope(vnode_listener_);
+  vnode_listener_ = nullptr;
+
+  kauth_unlisten_scope(fileop_listener_);
+  fileop_listener_ = nullptr;
+
+  // Wait for any active invocations to finish before returning
+  do {
+    IOSleep(5);
+  } while (listener_invocations_);
+
+  // Delete any cached decisions
+  ClearCache();
+
+  LOGD("Listeners stopped.");
+
+  return kIOReturnSuccess;
+}
+
+#pragma mark Cache Management
 
 void SantaDecisionManager::AddToCache(
-    const char *identifier, santa_action_t decision, uint64_t microsecs) {
-  IORWLockWrite(cached_decisions_lock_);
+    uint64_t identifier, santa_action_t decision, uint64_t microsecs) {
+  // Decision is stored in upper 8 bits, timestamp in remaining 56.
+  uint64_t val = ((uint64_t)decision << 56) | (microsecs & 0xFFFFFFFFFFFFFF);
 
-  if (cached_decisions_->getCount() > kMaxCacheSize) {
-    // This could be made a _lot_ smarter, say only removing entries older
-    // than a certain time period. However, with a kMaxCacheSize set
-    // sufficiently large and a kMaxAllowCacheTimeMilliseconds set
-    // sufficiently low, this should only ever occur if someone is purposefully
-    // trying to make the cache grow.
-    LOGD("Cache too large, flushing.");
-    cached_decisions_->flushCollection();
+  // If a previous entry was not found and the new entry is not `REQUEST_BINARY`, remove the
+  // existing entry. This is to prevent adding an ALLOW to the cache after a write has occurred.
+  if (decision_cache_->set(identifier, val) == 0 && decision != ACTION_REQUEST_BINARY) {
+    decision_cache_->remove(identifier);
   }
 
-  if (decision == ACTION_REQUEST_CHECKBW) {
-    SantaMessage *pending = new SantaMessage();
-    pending->setAction(ACTION_REQUEST_CHECKBW, 0);
-    cached_decisions_->setObject(identifier, pending);
-    pending->release();  // it was retained when added to the dictionary
-  } else {
-    SantaMessage *pending = OSDynamicCast(
-        SantaMessage, cached_decisions_->getObject(identifier));
-    if (pending) {
-      pending->setAction(decision, microsecs);
-    }
-  }
-
-  IORWLockUnlock(cached_decisions_lock_);
+  if (unlikely(!identifier)) return;
+  wakeup((void *)identifier);
 }
 
-void SantaDecisionManager::CacheCheck(const char *identifier) {
-  IORWLockRead(cached_decisions_lock_);
-  bool shouldInvalidate = (cached_decisions_->getObject(identifier) != NULL);
-  IORWLockUnlock(cached_decisions_lock_);
-  if (shouldInvalidate) {
-    IORWLockWrite(cached_decisions_lock_);
-    cached_decisions_->removeObject(identifier);
-    IORWLockUnlock(cached_decisions_lock_);
-  }
+void SantaDecisionManager::RemoveFromCache(uint64_t identifier) {
+  decision_cache_->remove(identifier);
+  if (unlikely(!identifier)) return;
+  wakeup((void *)identifier);
 }
 
-uint64_t SantaDecisionManager::CacheCount() {
-  return cached_decisions_->getCount();
+uint64_t SantaDecisionManager::CacheCount() const {
+  return decision_cache_->count();
 }
 
 void SantaDecisionManager::ClearCache() {
-  IORWLockWrite(cached_decisions_lock_);
-  cached_decisions_->flushCollection();
-  IORWLockUnlock(cached_decisions_lock_);
+  decision_cache_->clear();
 }
 
-santa_action_t SantaDecisionManager::GetFromCache(const char *identifier) {
-  santa_action_t result = ACTION_UNSET;
+#pragma mark Decision Fetching
+
+santa_action_t SantaDecisionManager::GetFromCache(uint64_t identifier) {
+  auto result = ACTION_UNSET;
   uint64_t decision_time = 0;
 
-  IORWLockRead(cached_decisions_lock_);
-  SantaMessage *cached_decision = OSDynamicCast(
-      SantaMessage, cached_decisions_->getObject(identifier));
-  if (cached_decision) {
-    result = cached_decision->getAction();
-    decision_time = cached_decision->getMicrosecs();
-  }
-  IORWLockUnlock(cached_decisions_lock_);
+  uint64_t cache_val = decision_cache_->get(identifier);
+  if (cache_val == 0) return result;
+
+  // Decision is stored in upper 8 bits, timestamp in remaining 56.
+  result = (santa_action_t)(cache_val >> 56);
+  decision_time = (cache_val & ~(0xFF00000000000000));
 
   if (RESPONSE_VALID(result)) {
-    uint64_t diff_time = GetCurrentUptime();
-
-    if (result == ACTION_RESPOND_CHECKBW_ALLOW) {
-      if ((kMaxAllowCacheTimeMilliseconds * 1000) > diff_time) {
-        diff_time = 0;
-      } else {
-        diff_time -= (kMaxAllowCacheTimeMilliseconds * 1000);
+    if (result == ACTION_RESPOND_DENY) {
+      auto expiry_time = decision_time + (kMaxDenyCacheTimeMilliseconds * 1000);
+      if (expiry_time < GetCurrentUptime()) {
+        decision_cache_->remove(identifier);
+        return ACTION_UNSET;
       }
-    } else if (result == ACTION_RESPOND_CHECKBW_DENY) {
-      if ((kMaxDenyCacheTimeMilliseconds * 1000) > diff_time) {
-        diff_time = 0;
-      } else {
-        diff_time -= (kMaxDenyCacheTimeMilliseconds * 1000);
-      }
-    }
-
-    if (decision_time < diff_time) {
-      IORWLockWrite(cached_decisions_lock_);
-      cached_decisions_->removeObject(identifier);
-      IORWLockUnlock(cached_decisions_lock_);
-      return ACTION_UNSET;
     }
   }
 
   return result;
 }
 
-# pragma mark Queue Management
+santa_action_t SantaDecisionManager::GetFromDaemon(santa_message_t *message, uint64_t identifier) {
+  auto return_action = ACTION_UNSET;
 
-bool SantaDecisionManager::PostToQueue(santa_message_t message) {
-  IORWLockWrite(dataqueue_lock_);
-  bool kr = dataqueue_->enqueue(&message, sizeof(message));
-  IORWLockUnlock(dataqueue_lock_);
-  return kr;
-}
+#ifdef DEBUG
+  clock_sec_t secs = 0;
+  clock_usec_t microsecs = 0;
+  clock_get_system_microtime(&secs, &microsecs);
+  uint64_t uptime = (secs * 1000000) + microsecs;
+#endif
 
-santa_action_t SantaDecisionManager::FetchDecision(
-    const kauth_cred_t credential,
-    const vfs_context_t vfs_context,
-    const vnode_t vnode) {
-  santa_action_t return_action = ACTION_UNSET;
+  // Wait for the daemon to respond or die.
+  do {
+    // Add pending request to cache, to be replaced by daemon with actual response
+    AddToCache(identifier, ACTION_REQUEST_BINARY, 0);
 
-  // Fetch Vnode ID & string
-  uint64_t vnode_id = GetVnodeIDForVnode(vfs_context, vnode);
-  char vnode_id_str[MAX_VNODE_ID_STR];
-  snprintf(vnode_id_str, MAX_VNODE_ID_STR, "%llu", vnode_id);
-
-  // Check to see if item is in cache
-  return_action = GetFromCache(vnode_id_str);
-
-  // If item wasn't in cache, fetch decision from daemon.
-  if (!RESPONSE_VALID(return_action)) {
-    // Add pending request to cache
-    AddToCache(vnode_id_str, ACTION_REQUEST_CHECKBW, 0);
-
-    char sha[MAX_SHA1_STRING];
-    if (!CalculateSHA1ForVnode(credential, vfs_context, vnode, sha)) {
-      LOGD("Unable to get SHA-1 for file, denying execution");
-      CacheCheck(vnode_id_str);
-      return ACTION_RESPOND_CHECKBW_DENY;
-    }
-
-    // Get path
-    char path[MAX_PATH_LEN];
-    int name_len = MAX_PATH_LEN;
-    if (vn_getpath(vnode, path, &name_len) != 0) {
-      path[0] = '\0';
-    }
-
-    // Prepare to send message to daemon
-    santa_message_t message;
-    strncpy(message.sha1, sha, MAX_SHA1_STRING);
-    strncpy(message.path, path, MAX_PATH_LEN);
-    message.userId = kauth_cred_getuid(credential);
-    message.pid = proc_selfpid();
-    message.action = ACTION_REQUEST_CHECKBW;
-    message.vnode_id = vnode_id;
-
-    // Wait for the daemon to respond or die.
-    do {
-      // Send request to daemon...
-      if (!PostToQueue(message)) {
-        LOGE("Failed to queue request for %s.", path);
-        CacheCheck(vnode_id_str);
-        return ACTION_ERROR;
-      }
-
-      // ... and wait for it to respond. If after kRequestLoopSleepMilliseconds
-      // * kMaxRequestLoops it still hasn't responded, send request again.
-      for (int i = 0; i < kMaxRequestLoops; ++i) {
-        IOSleep(kRequestLoopSleepMilliseconds);
-        return_action = GetFromCache(vnode_id_str);
-        if (RESPONSE_VALID(return_action)) break;
-      }
-    } while (!RESPONSE_VALID(return_action) && proc_exiting(owning_proc_) == 0);
-
-    // If response is still not valid, the daemon exited
-    if (!RESPONSE_VALID(return_action)) {
-      LOGE("Daemon process did not respond correctly. Allowing executions "
-           "until it comes back.");
-      CacheCheck(vnode_id_str);
+    // Send request to daemon...
+    if (!PostToDecisionQueue(message)) {
+      LOGE("Failed to queue request for %s.", message->path);
+      RemoveFromCache(identifier);
       return ACTION_ERROR;
     }
+
+    do {
+      msleep((void *)message->vnode_id, NULL, 0, "", &ts_);
+      return_action = GetFromCache(identifier);
+    } while (return_action == ACTION_REQUEST_BINARY && ClientConnected());
+  } while (!RESPONSE_VALID(return_action) && ClientConnected());
+
+  // If response is still not valid, the daemon exited
+  if (!RESPONSE_VALID(return_action)) {
+    LOGE("Daemon process did not respond correctly. Allowing executions "
+         "until it comes back. Executable path: %s", message->path);
+    RemoveFromCache(identifier);
+    return ACTION_ERROR;
   }
 
+#ifdef DEBUG
+  clock_get_system_microtime(&secs, &microsecs);
+  LOGD("Decision time: %4lldms (%s)",
+       (((secs * 1000000) + microsecs) - uptime) / 1000, message->path);
+#endif
+
   return return_action;
 }
 
-# pragma mark Misc
+santa_action_t SantaDecisionManager::FetchDecision(
+    const kauth_cred_t cred,
+    const vnode_t vp,
+    const uint64_t vnode_id) {
+  while (true) {
+    if (!ClientConnected()) return ACTION_RESPOND_ALLOW;
 
-bool SantaDecisionManager::CalculateSHA1ForVnode(const kauth_cred_t credential,
-                                                 const vfs_context_t context,
-                                                 const vnode_t vp,
-                                                 char *out) {
-  out[0] = '\0';
+    // Check to see if item is in cache
+    auto return_action = GetFromCache(vnode_id);
 
-  // Get binary size
-  uint64_t binary_size;
-  struct vnode_attr vap;
-  VATTR_INIT(&vap);
-  VATTR_WANTED(&vap, va_data_size);
-  vnode_getattr(vp, &vap, context);
-  binary_size = vap.va_data_size;
-
-  // Initialize the SHA1 context
-  SHA1_CTX sha1_ctx;
-  SHA1Init(&sha1_ctx);
-
-  // |chunkSize| should equal one page so that where possible
-  // the kernel can offload the calculation to dedicated hardware.
-  int chunkSize = PAGE_SIZE_64;
-  void *readChunk = IOMalloc(chunkSize);
-
-  // Credentials needed for vn_rdwr
-  kauth_cred_t kerncred = vfs_context_ucred(context);
-  proc_t p = vfs_context_proc(context);
-
-  // Read the file in chunks, updating the SHA as we go
-  for (uint64_t offset = 0; offset < binary_size; offset += chunkSize) {
-    int readSize;
-    if (offset + chunkSize > binary_size) {
-      readSize = (int)(binary_size - offset);
+    // If item was in cache with a valid response, return it.
+    // If item is in cache but hasn't received a response yet, sleep for a bit.
+    // If item is not in cache, break out of loop to send request to daemon.
+    if (RESPONSE_VALID(return_action)) {
+      return return_action;
+    } else if (return_action == ACTION_REQUEST_BINARY) {
+      msleep((void *)vnode_id, NULL, 0, "", &ts_);
     } else {
-      readSize = chunkSize;
+      break;
     }
-
-    int resid;  // unused
-    if (vn_rdwr(UIO_READ, vp, (caddr_t)readChunk, readSize, offset,
-                UIO_SYSSPACE, IO_NOAUTH, kerncred, &resid, p) != 0) {
-      IOFree(readChunk, chunkSize);
-      return false;
-    }
-
-    SHA1Update(&sha1_ctx, readChunk, readSize);
   }
 
-  // Free |readChunk|
-  IOFree(readChunk, chunkSize);
-
-  // Finalize the SHA-1 into |buf|
-  char buf[MAX_SHA1_LEN];
-  SHA1Final(buf, &sha1_ctx);
-
-  // Convert the binary SHA into a hex digest string
-  for (int i = 0; i < MAX_SHA1_LEN; i++) {
-    snprintf(out + (2*i), 3, "%02x", (unsigned char)buf[i]);
+  // Get path
+  char path[MAXPATHLEN];
+  int name_len = MAXPATHLEN;
+  if (vn_getpath(vp, path, &name_len) != 0) {
+    path[0] = '\0';
   }
 
-  return true;
+  auto message = NewMessage(cred);
+  strlcpy(message->path, path, sizeof(message->path));
+  message->action = ACTION_REQUEST_BINARY;
+  message->vnode_id = vnode_id;
+  proc_name(message->ppid, message->pname, sizeof(message->pname));
+  auto return_action = GetFromDaemon(message, vnode_id);
+  delete message;
+  return return_action;
 }
 
-uint64_t SantaDecisionManager::GetVnodeIDForVnode(const vfs_context_t context,
-                                                  const vnode_t vp) {
-  struct vnode_attr vap;
-  VATTR_INIT(&vap);
-  VATTR_WANTED(&vap, va_fileid);
-  vnode_getattr(vp, &vap, context);
-  return vap.va_fileid;
+#pragma mark Misc
+
+bool SantaDecisionManager::PostToDecisionQueue(santa_message_t *message) {
+  lck_mtx_lock(decision_dataqueue_lock_);
+  auto kr = decision_dataqueue_->enqueue(message, sizeof(santa_message_t));
+  if (!kr) {
+    if (++failed_decision_queue_requests_ > kMaxDecisionQueueFailures) {
+      LOGE("Failed to queue more than %d decision requests, killing daemon",
+           kMaxDecisionQueueFailures);
+      proc_signal(client_pid_, SIGKILL);
+      client_pid_ = 0;
+    }
+  }
+  lck_mtx_unlock(decision_dataqueue_lock_);
+  return kr;
 }
 
-uint64_t SantaDecisionManager::GetCurrentUptime() {
-  clock_sec_t sec;
-  clock_usec_t usec;
-  clock_get_system_microtime(&sec, &usec);
-  return (uint64_t)((sec * 1000000) + usec);
+bool SantaDecisionManager::PostToLogQueue(santa_message_t *message) {
+  lck_mtx_lock(log_dataqueue_lock_);
+  auto kr = log_dataqueue_->enqueue(message, sizeof(santa_message_t));
+  if (!kr) {
+    if (failed_log_queue_requests_++ == 0) {
+      LOGW("Dropping log queue messages");
+    }
+    // If enqueue failed, pop an item off the queue and try again.
+    uint32_t dataSize = 0;
+    log_dataqueue_->dequeue(0, &dataSize);
+    kr = log_dataqueue_->enqueue(message, sizeof(santa_message_t));
+  } else {
+    if (failed_log_queue_requests_ > 0) {
+      failed_log_queue_requests_--;
+    }
+  }
+  lck_mtx_unlock(log_dataqueue_lock_);
+  return kr;
 }
 
-# pragma mark Invocation Tracking & PID comparison
-
-SInt32 SantaDecisionManager::GetListenerInvocations() {
-  return listener_invocations_;
-}
+#pragma mark Invocation Tracking & PID comparison
 
 void SantaDecisionManager::IncrementListenerInvocations() {
   OSIncrementAtomic(&listener_invocations_);
@@ -339,166 +381,185 @@ void SantaDecisionManager::DecrementListenerInvocations() {
   OSDecrementAtomic(&listener_invocations_);
 }
 
-bool SantaDecisionManager::MatchesOwningPID(const pid_t other_pid) {
-  return (owning_pid_ == other_pid);
+#pragma mark Callbacks
+
+int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
+                                        const vfs_context_t ctx,
+                                        const vnode_t vp,
+                                        int *errno) {
+  // Get ID for the vnode
+  auto vnode_id = GetVnodeIDForVnode(ctx, vp);
+
+  // Fetch decision
+  auto returnedAction = FetchDecision(cred, vp, vnode_id);
+
+  // If file has dirty blocks, remove from cache and deny. This would usually
+  // be the case if a file has been written to and flushed but not yet
+  // closed.
+  if (vnode_hasdirtyblks(vp)) {
+    RemoveFromCache(vnode_id);
+    returnedAction = ACTION_RESPOND_DENY;
+  }
+
+  switch (returnedAction) {
+    case ACTION_RESPOND_ALLOW: {
+      auto proc = vfs_context_proc(ctx);
+      if (proc) {
+        pid_t pid = proc_pid(proc);
+        pid_t ppid = proc_ppid(proc);
+        // pid_t is 32-bit; pid is in upper 32 bits, ppid in lower.
+        uint64_t val = ((uint64_t)pid << 32) | (ppid & 0xFFFFFFFF);
+        vnode_pid_map_->set(vnode_id, val);
+      }
+      return KAUTH_RESULT_ALLOW;
+    }
+    case ACTION_RESPOND_DENY:
+      *errno = EPERM;
+      return KAUTH_RESULT_DENY;
+    default:
+      // NOTE: Any unknown response or error condition causes us to fail open.
+      // Whilst from a security perspective this is bad, it's important that
+      // we don't break user's machines.
+      return KAUTH_RESULT_DEFER;
+  }
 }
 
-# pragma mark Listener Control
+void SantaDecisionManager::FileOpCallback(
+    const kauth_action_t action, const vnode_t vp,
+    const char *path, const char *new_path) {
+  if (!ClientConnected() || proc_selfpid() == client_pid_) return;
 
-kern_return_t SantaDecisionManager::StartListener() {
-  process_listener_ = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
-                                         process_scope_callback,
-                                         reinterpret_cast<void *>(this));
-  if (!process_listener_) return kIOReturnInternalError;
-  LOGD("Process listener started.");
+  if (vp) {
+    auto context = vfs_context_create(nullptr);
+    auto vnode_id = GetVnodeIDForVnode(context, vp);
+    vfs_context_rele(context);
 
-  vnode_listener_ = kauth_listen_scope(KAUTH_SCOPE_VNODE,
-                                       vnode_scope_callback,
-                                       reinterpret_cast<void *>(this));
-  if (!vnode_listener_) return kIOReturnInternalError;
+    if (action == KAUTH_FILEOP_CLOSE) {
+      RemoveFromCache(vnode_id);
+    } else if (action == KAUTH_FILEOP_EXEC) {
+      auto message = NewMessage(nullptr);
+      message->vnode_id = vnode_id;
+      message->action = ACTION_NOTIFY_EXEC;
+      strlcpy(message->path, path, sizeof(message->path));
+      uint64_t val = vnode_pid_map_->get(vnode_id);
+      if (val) {
+        // pid_t is 32-bit, so pid is in upper 32 bits, ppid in lower.
+        message->pid = (val >> 32);
+        message->ppid = (val & ~0xFFFFFFFF00000000);
+      }
+      PostToLogQueue(message);
+      delete message;
+      return;
+    }
+  }
 
-  LOGD("Vnode listener started.");
+  // Filter out modifications to locations that are definitely
+  // not useful or made by santad.
+  if (!strprefix(path, "/.") && !strprefix(path, "/dev")) {
+    auto message = NewMessage(nullptr);
+    strlcpy(message->path, path, sizeof(message->path));
+    if (new_path) strlcpy(message->newpath, new_path, sizeof(message->newpath));
+    proc_name(message->pid, message->pname, sizeof(message->pname));
 
-  return kIOReturnSuccess;
-}
+    switch (action) {
+      case KAUTH_FILEOP_CLOSE:
+        message->action = ACTION_NOTIFY_WRITE;
+        break;
+      case KAUTH_FILEOP_RENAME:
+        message->action = ACTION_NOTIFY_RENAME;
+        break;
+      case KAUTH_FILEOP_LINK:
+        message->action = ACTION_NOTIFY_LINK;
+        break;
+      case KAUTH_FILEOP_EXCHANGE:
+        message->action = ACTION_NOTIFY_EXCHANGE;
+        break;
+      case KAUTH_FILEOP_DELETE:
+        message->action = ACTION_NOTIFY_DELETE;
+        break;
+      default:
+        delete message;
+        return;
+    }
 
-kern_return_t SantaDecisionManager::StopListener() {
-  kauth_unlisten_scope(vnode_listener_);
-  vnode_listener_ = NULL;
-
-  kauth_unlisten_scope(process_listener_);
-  process_listener_ = NULL;
-
-  // Wait for any active invocations to finish before returning
-  do {
-    IOSleep(5);
-  } while (GetListenerInvocations());
-
-  // Delete any cached decisions
-  ClearCache();
-
-  LOGD("Vnode listener stopped.");
-
-  return kIOReturnSuccess;
+    PostToLogQueue(message);
+    delete message;
+  }
 }
 
 #undef super
 
-#pragma mark Kauth Callbacks
-
-extern int process_scope_callback(kauth_cred_t credential,
-                                  void *idata,
-                                  kauth_action_t action,
-                                  uintptr_t arg0,
-                                  uintptr_t arg1,
-                                  uintptr_t arg2,
-                                  uintptr_t arg3) {
-  if (idata == NULL) {
-    LOGE("Process callback established without valid decision manager.");
-    return KAUTH_RESULT_ALLOW;
-  }
-  SantaDecisionManager *sdm = OSDynamicCast(
+extern "C" int fileop_scope_callback(
+    kauth_cred_t credential, void *idata, kauth_action_t action,
+    uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3) {
+  auto sdm = OSDynamicCast(
       SantaDecisionManager, reinterpret_cast<OSObject *>(idata));
 
-  // Note: this prevents a debugger from attaching to an existing santad
-  // process but doesn't prevent starting santad under a debugger. This check
-  // is only here to try and prevent the user from deadlocking their machine
-  // by attaching a debugger, so if they work around it and end up deadlocking,
-  // that's their problem.
-  if (action == KAUTH_PROCESS_CANTRACE &&
-      sdm->MatchesOwningPID(proc_pid((proc_t)arg0))) {
-    *(reinterpret_cast<int *>(arg1)) = EPERM;
-    LOGD("Denied debugger access");
-    return KAUTH_RESULT_DENY;
+  if (unlikely(sdm == nullptr)) {
+    LOGE("fileop_scope_callback called with no decision manager");
+    return KAUTH_RESULT_DEFER;
   }
 
-  return KAUTH_RESULT_ALLOW;
+  vnode_t vp = nullptr;
+  char *path = nullptr;
+  char *new_path = nullptr;
+
+  switch (action) {
+    case KAUTH_FILEOP_DELETE:
+    case KAUTH_FILEOP_EXEC:
+      vp = reinterpret_cast<vnode_t>(arg0);
+      if (vp && vnode_vtype(vp) != VREG) return KAUTH_RESULT_DEFER;
+      path = reinterpret_cast<char *>(arg1);
+      break;
+    case KAUTH_FILEOP_RENAME:
+    case KAUTH_FILEOP_EXCHANGE:
+    case KAUTH_FILEOP_LINK:
+      path = reinterpret_cast<char *>(arg0);
+      new_path = reinterpret_cast<char *>(arg1);
+      break;
+    default:
+      return KAUTH_RESULT_DEFER;
+  }
+
+  sdm->IncrementListenerInvocations();
+  sdm->FileOpCallback(action, vp, path, new_path);
+  sdm->DecrementListenerInvocations();
+
+  return KAUTH_RESULT_DEFER;
 }
 
-
-extern int vnode_scope_callback(kauth_cred_t credential,
-                                void *idata,
-                                kauth_action_t action,
-                                uintptr_t arg0,
-                                uintptr_t arg1,
-                                uintptr_t arg2,
-                                uintptr_t arg3) {
-  // The default action is to defer
-  int returnResult = KAUTH_RESULT_DEFER;
-
-  // Cast arguments to correct types
-  if (idata == NULL) {
-    LOGE("Vnode callback established without valid decision manager.");
-    return returnResult;
-  }
-  SantaDecisionManager *sdm = OSDynamicCast(
+extern "C" int vnode_scope_callback(
+    kauth_cred_t credential, void *idata, kauth_action_t action,
+    uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3) {
+  auto sdm = OSDynamicCast(
       SantaDecisionManager, reinterpret_cast<OSObject *>(idata));
-  vfs_context_t vfs_context = reinterpret_cast<vfs_context_t>(arg0);
-  vnode_t vnode = reinterpret_cast<vnode_t>(arg1);
 
-  // Only operate on regular files (not directories, symlinks, etc.)
-  vtype vt = vnode_vtype(vnode);
-  if (vt != VREG) return returnResult;
-
-  // Don't operate on ACCESS events, as they're advisory
-  if (action & KAUTH_VNODE_ACCESS) return returnResult;
-
-  // Filter for only WRITE_DATA actions
-  if (action & KAUTH_VNODE_WRITE_DATA || action & KAUTH_VNODE_APPEND_DATA) {
-    char vnode_id_str[MAX_VNODE_ID_STR];
-    snprintf(vnode_id_str, MAX_VNODE_ID_STR, "%llu",
-             sdm->GetVnodeIDForVnode(vfs_context, vnode));
-
-    // If an execution request is pending, deny write
-    if (sdm->GetFromCache(vnode_id_str) == ACTION_REQUEST_CHECKBW) {
-      LOGD("Denying write due to pending execution: %s", vnode_id_str);
-      *(reinterpret_cast<int *>(arg3)) = EACCES;
-      return KAUTH_RESULT_DENY;
-    }
-
-    // Otherwise remove from cache
-    sdm->CacheCheck(vnode_id_str);
-
-    return returnResult;
+  if (unlikely(sdm == nullptr)) {
+    LOGE("vnode_scope_callback called with no decision manager");
+    return KAUTH_RESULT_DEFER;
   }
 
-  // Filter for only EXECUTE actions
-  if (action & KAUTH_VNODE_EXECUTE) {
+  vnode_t vp = reinterpret_cast<vnode_t>(arg1);
+
+  // We only care about regular files.
+  if (vnode_vtype(vp) != VREG) return KAUTH_RESULT_DEFER;
+
+  if ((action & KAUTH_VNODE_EXECUTE) && !(action & KAUTH_VNODE_ACCESS)) {
     sdm->IncrementListenerInvocations();
-
-    // Fetch decision
-    santa_action_t returnedAction = sdm->FetchDecision(
-        credential, vfs_context, vnode);
-
-    switch (returnedAction) {
-      case ACTION_RESPOND_CHECKBW_ALLOW:
-        returnResult = KAUTH_RESULT_ALLOW;
-        break;
-      case ACTION_RESPOND_CHECKBW_DENY:
-        *(reinterpret_cast<int *>(arg3)) = EACCES;
-        returnResult = KAUTH_RESULT_DENY;
-        break;
-      default:
-        // NOTE: Any unknown response or error condition causes us to fail open.
-        // Whilst from a security perspective this is bad, it's important that
-        // we don't break user's machines. Every fallen open response will come
-        // through this code path and cause this log entry to be created, so we
-        // can investigate each case and try to fix the root cause.
-        char path[MAX_PATH_LEN];
-        int name_len = MAX_PATH_LEN;
-        if (vn_getpath(vnode, path, &name_len) != 0) {
-          path[0] = '\0';
-        }
-        LOGW("Didn't receive a valid response for %s. Received: %d.",
-             path,
-             returnedAction);
-        break;
-    }
-
+    int result = sdm->VnodeCallback(credential,
+                                    reinterpret_cast<vfs_context_t>(arg0),
+                                    vp,
+                                    reinterpret_cast<int *>(arg3));
+    sdm->DecrementListenerInvocations();
+    return result;
+  } else if (action & KAUTH_VNODE_WRITE_DATA) {
+    sdm->IncrementListenerInvocations();
+    char path[MAXPATHLEN];
+    int pathlen = MAXPATHLEN;
+    vn_getpath(vp, path, &pathlen);
+    sdm->FileOpCallback(KAUTH_FILEOP_CLOSE, vp, path, nullptr);
     sdm->DecrementListenerInvocations();
-
-    return returnResult;
   }
 
-  return returnResult;
+  return KAUTH_RESULT_DEFER;
 }

Source/santa-driver/SantaDecisionManager.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -15,142 +15,298 @@
 #ifndef SANTA__SANTA_DRIVER__SANTADECISIONMANAGER_H
 #define SANTA__SANTA_DRIVER__SANTADECISIONMANAGER_H
 
+#include <IOKit/IODataQueueShared.h>
 #include <IOKit/IOLib.h>
+#include <IOKit/IOMemoryDescriptor.h>
 #include <IOKit/IOSharedDataQueue.h>
 #include <libkern/c++/OSDictionary.h>
-#include <libkern/crypto/sha1.h>
 #include <sys/kauth.h>
 #include <sys/proc.h>
 #include <sys/vnode.h>
 
-#include "SantaMessage.h"
+#include "SantaCache.h"
 #include "SNTKernelCommon.h"
 #include "SNTLogging.h"
 
-/// The maximum number of milliseconds a cached deny message should be
-/// considered valid.
-const uint64_t kMaxDenyCacheTimeMilliseconds = 500;
-
-/// The maximum number of milliseconds a cached allow message should be
-/// considered valid.
-const uint64_t kMaxAllowCacheTimeMilliseconds = 1000 * 60 * 60 * 24;
-
-/// While waiting for a response from the daemon, this is the number of
-/// milliseconds to sleep for before checking the cache for a response.
-const int kRequestLoopSleepMilliseconds = 10;
-
-/// While waiting for a response from the daemon, this is the maximum number
-/// of loops to wait before sending the request again.
-const int kMaxRequestLoops = 50;
-
-/// Maximum number of entries in the in-kernel cache.
-const int kMaxCacheSize = 10000;
-
-/// SantaDecisionManager is responsible for intercepting Vnode execute actions
-/// and responding to the request appropriately.
 ///
-/// Documentation on the Kauth parts can be found here:
-/// https://developer.apple.com/library/mac/technotes/tn2127/_index.html
+///  SantaDecisionManager is responsible for intercepting Vnode execute actions
+///  and responding to the request appropriately.
+///
+///  Documentation on the Kauth parts can be found here:
+///  https://developer.apple.com/library/mac/technotes/tn2127/_index.html
+///
 class SantaDecisionManager : public OSObject {
   OSDeclareDefaultStructors(SantaDecisionManager);
 
  public:
-  // Convenience constructor
-  // Queue remains owned by caller but must exist for lifetime of
-  // SantaDecisionManager instance.
-  static SantaDecisionManager *WithQueueAndPID(
-      IOSharedDataQueue *queue, pid_t pid);
+  /// Used for initialization after instantiation.
+  bool init() override;
 
-  bool InitWithQueueAndPID(IOSharedDataQueue *queue, pid_t pid);
-  void free();
+  /// Called automatically when retain count drops to 0.
+  void free() override;
 
-  // Decision Fetching / Daemon Communication
-  bool PostToQueue(santa_message_t);
-  santa_action_t FetchDecision(const kauth_cred_t credential,
-                               const vfs_context_t vfs_context,
-                               const vnode_t vnode);
+  /**
+    Called by SantaDriverClient during connection to provide the shared
+    dataqueue memory to the client for the decision queue.
+  */
+  IOMemoryDescriptor *GetDecisionMemoryDescriptor() const;
 
-  // Hash calculation
-  bool CalculateSHA1ForVnode(const kauth_cred_t credential,
-                             const vfs_context_t context,
-                             const vnode_t vnode,
-                             char *out);
+  /**
+    Called by SantaDriverClient during connection to provide the shared
+    dataqueue memory to the client for the logging queue.
+  */
+  IOMemoryDescriptor *GetLogMemoryDescriptor() const;
 
-  // Vnode ID string
-  uint64_t GetVnodeIDForVnode(const vfs_context_t context, const vnode_t vp);
+  /**
+    Called by SantaDriverClient when a client connects to the decision queue,
+    providing the pid of the client process.
+  */
+  void ConnectClient(pid_t pid);
 
-  // Cache management
-  void AddToCache(const char *identifier,
-                  const santa_action_t decision,
-                  const uint64_t microsecs);
-  void CacheCheck(const char *identifier);
-  uint64_t CacheCount();
-  void ClearCache();
-  santa_action_t GetFromCache(const char *identifier);
+  /// Called by SantaDriverClient when a client disconnects
+  void DisconnectClient(bool itDied = false);
 
-  // Listener invocation management
-  SInt32 GetListenerInvocations();
-  void IncrementListenerInvocations();
-  void DecrementListenerInvocations();
+  /// Returns whether a client is currently connected or not.
+  bool ClientConnected() const;
 
-  // Owning PID comparison
-  bool MatchesOwningPID(const pid_t other_pid);
+  /// Sets the Mach port for notifying the decision queue.
+  void SetDecisionPort(mach_port_t port);
 
-  // Returns the current system uptime in microseconds
-  uint64_t GetCurrentUptime();
+  /// Sets the Mach port for notifying the log queue.
+  void SetLogPort(mach_port_t port);
 
-  // Starting and stopping the listener
+  /// Starts the kauth listeners.
   kern_return_t StartListener();
+
+  /**
+    Stops the kauth listeners. After stopping new callback requests, waits until all
+    current invocations have finished before clearing the cache and returning.
+  */
   kern_return_t StopListener();
 
+  /// Adds a decision to the cache, with a timestamp.
+  void AddToCache(uint64_t identifier,
+                  const santa_action_t decision,
+                  const uint64_t microsecs = GetCurrentUptime());
+
+  ///  Fetches a response from the cache, first checking to see if the entry has expired.
+  santa_action_t GetFromCache(uint64_t identifier);
+
+  /// Checks to see if a given identifier is in the cache and removes it.
+  void RemoveFromCache(uint64_t identifier);
+
+  /// Returns the number of entries in the cache.
+  uint64_t CacheCount() const;
+
+  /// Clears the cache.
+  void ClearCache();
+
+  /// Increments the count of active callbacks pending.
+  void IncrementListenerInvocations();
+
+  /// Decrements the count of active callbacks pending.
+  void DecrementListenerInvocations();
+
+  /**
+    Vnode Callback
+
+    @param cred The kauth credential for this request.
+    @param ctx The VFS context for this request.
+    @param vp The Vnode for this request.
+    @param errno A pointer to return an errno style error.
+    @return int A valid KAUTH_RESULT_*.
+  */
+  int VnodeCallback(const kauth_cred_t cred, const vfs_context_t ctx,
+                    const vnode_t vp, int *errno);
+  /**
+    FileOp Callback
+
+    @param action The performed action
+    @param vp The Vnode for this request. May be nullptr.
+    @param path The path being operated on.
+    @param new_path The target path for moves and links.
+  */
+  void FileOpCallback(kauth_action_t action, const vnode_t vp,
+                      const char *path, const char *new_path);
+
+ protected:
+  /**
+    While waiting for a response from the daemon, this is the maximum number of
+    milliseconds to sleep for before checking the cache for a response.
+  */
+  static const uint32_t kRequestLoopSleepMilliseconds = 1000;
+
+  /// The maximum number of milliseconds a cached deny message should be considered valid.
+  static const uint64_t kMaxDenyCacheTimeMilliseconds = 500;
+
+  /// Maximum number of entries in the in-kernel cache.
+  static const uint32_t kMaxCacheSize = 10000;
+
+  /// Maximum number of PostToDecisionQueue failures to allow.
+  static const uint32_t kMaxDecisionQueueFailures = 10;
+
+  /// The maximum number of messages can be kept in the decision data queue at any time.
+  static const uint32_t kMaxDecisionQueueEvents = 512;
+
+  /// The maximum number of messages can be kept in the logging data queue at any time.
+  static const uint32_t kMaxLogQueueEvents = 2048;
+
+  /**
+    Fetches a response from the daemon. Handles both daemon death
+    and failure to post messages to the daemon.
+
+    @param message The message to send to the daemon
+    @param identifier The vnode ID string for this request
+    @return santa_action_t The response for this request
+  */
+  santa_action_t GetFromDaemon(santa_message_t *message, uint64_t identifier);
+
+  /**
+    Fetches an execution decision for a file, first using the cache and then
+    by sending a message to the daemon and waiting until a response arrives.
+    If a daemon isn't connected, will allow execution and cache, logging
+    the path to the executed file.
+
+    @param cred The credential for this request.
+    @param vp The Vnode for this request.
+    @param vnode_id The ID for this vnode.
+    @return santa_action_t The response for this request
+  */
+  santa_action_t FetchDecision(
+      const kauth_cred_t cred, const vnode_t vp, const uint64_t vnode_id);
+
+  /**
+    Posts the requested message to the decision data queue.
+
+    @param message The message to send
+    @return bool true if sending was successful.
+  */
+  bool PostToDecisionQueue(santa_message_t *message);
+
+  /**
+    Posts the requested message to the logging data queue.
+
+    @param message The message to send
+    @return bool true if sending was successful.
+  */
+  bool PostToLogQueue(santa_message_t *message);
+
+  /**
+    Fetches the vnode_id for a given vnode.
+
+    @param ctx The VFS context to use.
+    @param vp The Vnode to get the ID for
+    @return uint64_t The Vnode ID as a 64-bit unsigned int.
+  */
+  static inline uint64_t GetVnodeIDForVnode(const vfs_context_t ctx, const vnode_t vp) {
+    struct vnode_attr vap;
+    VATTR_INIT(&vap);
+    VATTR_WANTED(&vap, va_fsid);
+    VATTR_WANTED(&vap, va_fileid);
+    vnode_getattr(vp, &vap, ctx);
+    return (((uint64_t)vap.va_fsid << 32) | vap.va_fileid);
+  }
+
+  /**
+    Creates a new santa_message_t with some fields pre-filled.
+
+    @param credential The kauth_cred_t for this action, if available.
+           If nullptr, will get the credential for the current process.
+  */
+  static inline santa_message_t *NewMessage(kauth_cred_t credential) {
+    bool should_release = false;
+    if (credential == nullptr) {
+      credential = kauth_cred_get_with_ref();
+      should_release = true;
+    }
+
+    auto message = new santa_message_t;
+    message->uid = kauth_cred_getuid(credential);
+    message->gid = kauth_cred_getgid(credential);
+    message->pid = proc_selfpid();
+    message->ppid = proc_selfppid();
+
+    if (should_release) {
+      kauth_cred_unref(&credential);
+    }
+
+    return message;
+  }
+
+  /**
+    Returns the current system uptime in microseconds
+  */
+  static inline uint64_t GetCurrentUptime() {
+    clock_sec_t sec;
+    clock_usec_t usec;
+    clock_get_system_microtime(&sec, &usec);
+    return (uint64_t)((sec * 1000000) + usec);
+  }
+
  private:
-  OSDictionary *cached_decisions_;
-  IORWLock *cached_decisions_lock_;
+  SantaCache<uint64_t> *decision_cache_;
+  SantaCache<uint64_t> *vnode_pid_map_;
 
-  IOSharedDataQueue *dataqueue_;
-  IORWLock *dataqueue_lock_;
+  lck_grp_t *sdm_lock_grp_;
+  lck_grp_attr_t *sdm_lock_grp_attr_;
+  lck_attr_t *sdm_lock_attr_;
 
-  SInt32 listener_invocations_;
+  lck_mtx_t *decision_dataqueue_lock_;
+  lck_mtx_t *log_dataqueue_lock_;
 
-  pid_t owning_pid_;
-  proc_t owning_proc_;
+  IOSharedDataQueue *decision_dataqueue_;
+  IOSharedDataQueue *log_dataqueue_;
+  uint32_t failed_decision_queue_requests_;
+  uint32_t failed_log_queue_requests_;
+
+  int32_t listener_invocations_;
+
+  pid_t client_pid_;
 
   kauth_listener_t vnode_listener_;
-  kauth_listener_t process_listener_;
+  kauth_listener_t fileop_listener_;
+
+  struct timespec ts_;
 };
 
-extern "C" {
-  /// The callback function for the Vnode scope
-  /// @param actor's credentials
-  /// @param data that was passed when the listener was registered
-  /// @param action that was requested
-  /// @param VFS context
-  /// @param Vnode being operated on
-  /// @param Parent Vnode. May be NULL.
-  /// @param Pointer to an errno-style error.
-  extern int vnode_scope_callback(kauth_cred_t credential,
-                                  void *idata,
-                                  kauth_action_t action,
-                                  uintptr_t arg0,
-                                  uintptr_t arg1,
-                                  uintptr_t arg2,
-                                  uintptr_t arg3);
+/**
+  The kauth callback function for the Vnode scope
 
-  /// The callback function for the Process scope
-  /// @param actor's credentials
-  /// @param data that was passed when the listener was registered
-  /// @param action that was requested (KAUTH_PROCESS_{CANTRACE,CANSIGNAL})
-  /// @param target process
-  /// @param Pointer to an errno-style error.
-  /// @param unused
-  /// @param unused
-  extern int process_scope_callback(kauth_cred_t credential,
-                                    void *idata,
-                                    kauth_action_t action,
-                                    uintptr_t arg0,
-                                    uintptr_t arg1,
-                                    uintptr_t arg2,
-                                    uintptr_t arg3);
-}  // extern C
+  @param actor's credentials
+  @param data that was passed when the listener was registered
+  @param action that was requested
+  @param VFS context
+  @param Vnode being operated on
+  @param Parent Vnode. May be nullptr.
+  @param Pointer to an errno-style error.
+*/
+extern "C" int vnode_scope_callback(
+    kauth_cred_t credential,
+    void *idata,
+    kauth_action_t action,
+    uintptr_t arg0,
+    uintptr_t arg1,
+    uintptr_t arg2,
+    uintptr_t arg3);
+
+/**
+  The kauth callback function for the FileOp scope
+
+  @param actor's credentials
+  @param data that was passed when the listener was registered
+  @param action that was requested
+  @param depends on action, usually the vnode ref.
+  @param depends on action.
+  @param depends on action, usually 0.
+  @param depends on action, usually 0.
+*/
+extern "C" int fileop_scope_callback(
+    kauth_cred_t credential,
+    void *idata,
+    kauth_action_t action,
+    uintptr_t arg0,
+    uintptr_t arg1,
+    uintptr_t arg2,
+    uintptr_t arg3);
 
 #endif  // SANTA__SANTA_DRIVER__SANTADECISIONMANAGER_H

Source/santa-driver/SantaDriver.cc

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -23,6 +23,14 @@ OSDefineMetaClassAndStructors(com_google_SantaDriver, IOService);
 bool SantaDriver::start(IOService *provider) {
   if (!super::start(provider)) return false;
 
+  santaDecisionManager = new SantaDecisionManager;
+  if (!santaDecisionManager->init() ||
+      santaDecisionManager->StartListener() != kIOReturnSuccess) {
+    santaDecisionManager->release();
+    santaDecisionManager = nullptr;
+    return false;
+  }
+
   registerService();
 
   LOGI("Loaded, version %s.", OSKextGetCurrentVersionString());
@@ -31,7 +39,17 @@ bool SantaDriver::start(IOService *provider) {
 }
 
 void SantaDriver::stop(IOService *provider) {
+  santaDecisionManager->StopListener();
+  santaDecisionManager->release();
+  santaDecisionManager = nullptr;
+
   LOGI("Unloaded.");
+
+  super::stop(provider);
+}
+
+SantaDecisionManager *SantaDriver::GetDecisionManager() const {
+  return santaDecisionManager;
 }
 
 #undef super

Source/santa-driver/SantaDriver.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -18,16 +18,29 @@
 #include <IOKit/IOService.h>
 #include <libkern/OSKextLib.h>
 
-#include "SantaDecisionManager.h"
 #include "SNTLogging.h"
+#include "SantaDecisionManager.h"
 
-/// The driver class, which provides just the start/stop functions.
+///
+///  The driver class, which provides the start/stop functions and holds
+///  the SantaDecisionManager instance which the connected client
+///  communicates with.
+///
 class com_google_SantaDriver : public IOService {
   OSDeclareDefaultStructors(com_google_SantaDriver);
 
  public:
-  bool start(IOService *provider);
-  void stop(IOService *provider);
+  ///  Called by the kernel when the kext is loaded
+  bool start(IOService *provider) override;
+
+  ///  Called by the kernel when the kext is unloaded
+  void stop(IOService *provider) override;
+
+  ///  Returns a pointer to the SantaDecisionManager created in start().
+  SantaDecisionManager *GetDecisionManager() const;
+
+ private:
+  SantaDecisionManager *santaDecisionManager;
 };
 
 #endif  // SANTA__SANTA_DRIVER__SANTADRIVER_H

Source/santa-driver/SantaDriverClient.cc

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -20,12 +20,12 @@
 // The defines above can'be used in this function, must use the full names.
 OSDefineMetaClassAndStructors(com_google_SantaDriverClient, IOUserClient);
 
-# pragma mark Driver Management
+#pragma mark Driver Management
 
 bool SantaDriverClient::initWithTask(
     task_t owningTask, void *securityID, UInt32 type) {
   if (clientHasPrivilege(
-      owningTask, kIOClientPrivilegeAdministrator) != KERN_SUCCESS) {
+          owningTask, kIOClientPrivilegeAdministrator) != KERN_SUCCESS) {
     LOGW("Unprivileged client attempted to connect.");
     return false;
   }
@@ -36,201 +36,150 @@ bool SantaDriverClient::initWithTask(
 }
 
 bool SantaDriverClient::start(IOService *provider) {
-  fProvider = OSDynamicCast(com_google_SantaDriver, provider);
+  myProvider = OSDynamicCast(com_google_SantaDriver, provider);
 
-  if (!fProvider) return false;
+  if (!myProvider) return false;
   if (!super::start(provider)) return false;
 
-  fSDMLock = IOLockAlloc();
+  decisionManager = myProvider->GetDecisionManager();
+  if (!decisionManager) return false;
 
   return true;
 }
 
 void SantaDriverClient::stop(IOService *provider) {
   super::stop(provider);
+  myProvider = nullptr;
+  decisionManager = nullptr;
 }
 
 IOReturn SantaDriverClient::clientClose() {
-  close();
-  terminate(kIOServiceSynchronous);
-
-  fProvider = NULL;
-
-  return kIOReturnSuccess;
+  decisionManager->DisconnectClient(true);
+  return terminate(kIOServiceSynchronous) ? kIOReturnSuccess : kIOReturnError;
 }
 
 bool SantaDriverClient::terminate(IOOptionBits options) {
-  // We have to lock before this check in case the client exits and the kext
-  // is unloaded very shortly afterwards.
-  IOLockLock(fSDMLock);
-  if (fSDM) {
-    fSDM->StopListener();
+  decisionManager->DisconnectClient();
+  LOGI("Client disconnected.");
 
-    // Ask santad to shutdown
-    santa_message_t message;
-    message.action = ACTION_REQUEST_SHUTDOWN;
-    message.userId = 0;
-    message.pid = 0;
-    message.vnode_id = 0;
-    fSDM->PostToQueue(message);
-
-    LOGI("Client disconnected.");
-
-    fSDM->release();
-    fSDM = NULL;
-  }
-  IOLockUnlock(fSDMLock);
-
-  if (fProvider && fProvider->isOpen(this)) fProvider->close(this);
+  if (myProvider && myProvider->isOpen(this)) myProvider->close(this);
 
   return super::terminate(options);
 }
 
-IOReturn SantaDriverClient::registerNotificationPort(mach_port_t port,
-                                                     UInt32 type,
-                                                     UInt32 ref) {
-  if ((!fDataQueue) || (port == MACH_PORT_NULL)) return kIOReturnError;
+#pragma mark Fetching memory and data queue notifications
 
-  fDataQueue->setNotificationPort(port);
+IOReturn SantaDriverClient::registerNotificationPort(
+    mach_port_t port, UInt32 type, UInt32 ref) {
+  if (port == MACH_PORT_NULL) return kIOReturnError;
+
+  switch (type) {
+    case QUEUETYPE_DECISION:
+      decisionManager->SetDecisionPort(port);
+      break;
+    case QUEUETYPE_LOG:
+      decisionManager->SetLogPort(port);
+      break;
+    default:
+      return kIOReturnBadArgument;
+  }
 
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::clientMemoryForType(UInt32 type,
-                                                IOOptionBits *options,
-                                                IOMemoryDescriptor **memory) {
-  *memory = NULL;
-  *options = 0;
-
-  if (type == kIODefaultMemoryType) {
-    if (!fSharedMemory) return kIOReturnNoMemory;
-    fSharedMemory->retain();  // client will decrement this ref
-    *memory = fSharedMemory;
-
-    return fSDM->StartListener();
+IOReturn SantaDriverClient::clientMemoryForType(
+    UInt32 type, IOOptionBits *options, IOMemoryDescriptor **memory) {
+  switch (type) {
+    case QUEUETYPE_DECISION:
+      *options = 0;
+      *memory = decisionManager->GetDecisionMemoryDescriptor();
+      decisionManager->ConnectClient(proc_selfpid());
+      break;
+    case QUEUETYPE_LOG:
+      *options = 0;
+      *memory = decisionManager->GetLogMemoryDescriptor();
+      break;
+    default:
+      return kIOReturnBadArgument;
   }
 
-  return kIOReturnNoMemory;
+  (*memory)->retain();
+
+  return kIOReturnSuccess;
 }
 
 #pragma mark Callable Methods
 
-IOReturn SantaDriverClient::open() {
-  if (isInactive()) return kIOReturnNotAttached;
+IOReturn SantaDriverClient::open(
+    OSObject *target,
+    void *reference,
+    IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
 
-  if (!fProvider->open(this)) {
+  if (me->isInactive()) return kIOReturnNotAttached;
+  if (!me->myProvider->open(me)) {
     LOGW("A second client tried to connect.");
     return kIOReturnExclusiveAccess;
   }
 
-  fDataQueue = IOSharedDataQueue::withCapacity((sizeof(santa_message_t) +
-                                                DATA_QUEUE_ENTRY_HEADER_SIZE)
-                                                * kMaxQueueEvents);
-  if (!fDataQueue) return kIOReturnNoMemory;
-
-  fSharedMemory = fDataQueue->getMemoryDescriptor();
-  if (!fSharedMemory) {
-    fDataQueue->release();
-    fDataQueue = NULL;
-    return kIOReturnVMError;
-  }
-
-  IOLockLock(fSDMLock);
-  fSDM = SantaDecisionManager::WithQueueAndPID(fDataQueue, proc_selfpid());
-  IOLockUnlock(fSDMLock);
-
-  LOGI("Client connected, PID: %d.", proc_selfpid());
+  LOGI("Client connected.");
 
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_open(
-    SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->open();
-}
+IOReturn SantaDriverClient::allow_binary(
+    OSObject *target, void *reference, IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
 
-IOReturn SantaDriverClient::close() {
-  if (!fProvider) return kIOReturnNotAttached;
-  if (fProvider->isOpen(this)) fProvider->close(this);
+  const uint64_t vnode_id = static_cast<const uint64_t>(*arguments->scalarInput);
+  me->decisionManager->AddToCache(vnode_id, ACTION_RESPOND_ALLOW);
 
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_close(
-    SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->close();
-}
+IOReturn SantaDriverClient::deny_binary(
+    OSObject *target, void *reference, IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
 
-IOReturn SantaDriverClient::allow_binary(const uint64_t vnode_id) {
-  char vnode_id_str[21];
-  snprintf(vnode_id_str, sizeof(vnode_id_str), "%llu", vnode_id);
-  fSDM->AddToCache(vnode_id_str,
-                   ACTION_RESPOND_CHECKBW_ALLOW,
-                   fSDM->GetCurrentUptime());
+  const uint64_t vnode_id = static_cast<const uint64_t>(*arguments->scalarInput);
+  me->decisionManager->AddToCache(vnode_id, ACTION_RESPOND_DENY);
 
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_allow_binary(
-    SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->allow_binary(
-      *(static_cast<const uint64_t *>(arguments->scalarInput)));
-}
+IOReturn SantaDriverClient::clear_cache(
+    OSObject *target, void *reference, IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
 
-IOReturn SantaDriverClient::deny_binary(const uint64_t vnode_id) {
-  char vnode_id_str[21];
-  snprintf(vnode_id_str, sizeof(vnode_id_str), "%llu", vnode_id);
-  fSDM->AddToCache(vnode_id_str,
-                   ACTION_RESPOND_CHECKBW_DENY,
-                   fSDM->GetCurrentUptime());
+  me->decisionManager->ClearCache();
 
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_deny_binary(
-    com_google_SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->deny_binary(
-      *(static_cast<const uint64_t *>(arguments->scalarInput)));
-}
+IOReturn SantaDriverClient::cache_count(
+    OSObject *target, void *reference, IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
 
-IOReturn SantaDriverClient::clear_cache() {
-  fSDM->ClearCache();
+  arguments->scalarOutput[0] = me->decisionManager->CacheCount();
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_clear_cache(
-    com_google_SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->clear_cache();
-}
+IOReturn SantaDriverClient::check_cache(
+    OSObject *target, void *reference, IOExternalMethodArguments *arguments) {
+  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
+  if (!me) return kIOReturnBadArgument;
+
+  uint64_t input = *arguments->scalarInput;
+  arguments->scalarOutput[0] = me->decisionManager->GetFromCache(input);
 
-IOReturn SantaDriverClient::cache_count(uint64_t *output) {
-  *output = fSDM->CacheCount();
   return kIOReturnSuccess;
 }
 
-IOReturn SantaDriverClient::static_cache_count(
-    com_google_SantaDriverClient *target,
-    void *reference,
-    IOExternalMethodArguments *arguments) {
-  if (!target) return kIOReturnBadArgument;
-  return target->cache_count(&(arguments->scalarOutput[0]));
-}
-
 #pragma mark Method Resolution
 
 IOReturn SantaDriverClient::externalMethod(
@@ -239,70 +188,25 @@ IOReturn SantaDriverClient::externalMethod(
     IOExternalMethodDispatch *dispatch,
     OSObject *target,
     void *reference) {
-  // Array of methods callable by clients. The order of these must match the
-  // order of the items in |SantaDriverMethods| in SNTKernelCommon.h
-  IOExternalMethodDispatch sMethods[kSantaUserClientNMethods] = {
-    {
-      reinterpret_cast<IOExternalMethodAction>(&SantaDriverClient::static_open),
-      0,  // input scalar
-      0,  // input struct
-      0,  // output scalar
-      0   // output struct
-    },
-    {
-      reinterpret_cast<IOExternalMethodAction>(
-          &SantaDriverClient::static_close),
-      0,
-      0,
-      0,
-      0
-    },
-    {
-      reinterpret_cast<IOExternalMethodAction>(
-          &SantaDriverClient::static_allow_binary),
-      1,
-      0,
-      0,
-      0
-    },
-    {
-      reinterpret_cast<IOExternalMethodAction>(
-          &SantaDriverClient::static_deny_binary),
-      1,
-      0,
-      0,
-      0
-    },
-    {
-      reinterpret_cast<IOExternalMethodAction>(
-          &SantaDriverClient::static_clear_cache),
-      0,
-      0,
-      0,
-      0
-    },
-    {
-      reinterpret_cast<IOExternalMethodAction>(
-          &SantaDriverClient::static_cache_count),
-      0,
-      0,
-      1,
-      0
-    }
+  ///  Array of methods callable by clients. The order of these must match the
+  ///  order of the items in SantaDriverMethods in SNTKernelCommon.h
+  static IOExternalMethodDispatch sMethods[kSantaUserClientNMethods] = {
+    // Function ptr, input scalar count, input struct size, output scalar count, output struct size
+    { &SantaDriverClient::open, 0, 0, 0, 0 },
+    { &SantaDriverClient::allow_binary, 1, 0, 0, 0 },
+    { &SantaDriverClient::deny_binary, 1, 0, 0, 0 },
+    { &SantaDriverClient::clear_cache, 0, 0, 0, 0 },
+    { &SantaDriverClient::cache_count, 0, 0, 1, 0 },
+    { &SantaDriverClient::check_cache, 1, 0, 1, 0 }
   };
 
-  if (selector < static_cast<UInt32>(kSantaUserClientNMethods)) {
-    dispatch = &(sMethods[selector]);
-    if (!target) target = this;
-  } else {
+  if (selector > static_cast<UInt32>(kSantaUserClientNMethods)) {
     return kIOReturnBadArgument;
   }
 
-  return super::externalMethod(selector,
-                               arguments,
-                               dispatch,
-                               target,
-                               reference);
+  dispatch = &(sMethods[selector]);
+  if (!target) target = this;
+  return super::externalMethod(selector, arguments, dispatch, target, reference);
 }
 
 #undef super

Source/santa-driver/SantaDriverClient.h

@@ -1,4 +1,4 @@
-/// Copyright 2014 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,97 +16,93 @@
 #define SANTA__SANTA_DRIVER__SANTADRIVERUSERCLIENT_H
 
 #include <IOKit/IOUserClient.h>
-#include <IOKit/IOSharedDataQueue.h>
-#include <IOKit/IOLib.h>
-#include <IOKit/IODataQueueShared.h>
-#include <libkern/crypto/sha1.h>
 #include <sys/kauth.h>
-#include <sys/vnode.h>
 #include <sys/proc.h>
+#include <sys/vnode.h>
 
+#include "SNTKernelCommon.h"
 #include "SantaDecisionManager.h"
 #include "SantaDriver.h"
-#include "SantaMessage.h"
-#include "SNTKernelCommon.h"
 
-// The maximum number of messages can be kept in the IODataQueue at any time.
-const int kMaxQueueEvents = 64;
-
-/// This class is instantiated by IOKit when a new client process attempts to
-/// connect to the driver. Starting, stopping, handling connections, allocating
-/// shared memory and establishing a data queue is handled here.
 ///
-/// Documentation on how the IOUserClient parts of this code work can be found
-/// here:
-/// @link https://developer.apple.com/library/mac/samplecode/SimpleUserClient/Listings/User_Client_Info_txt.html
+///  This class is instantiated by IOKit when a new client process attempts to
+///  connect to the driver. Starting, stopping, handling connections, allocating
+///  shared memory and establishing a data queue is handled here.
+///
+///  Documentation on how the IOUserClient parts of this code work can be found
+///  here:
+///  https://developer.apple.com/library/mac/samplecode/SimpleUserClient/Listings/User_Client_Info_txt.html
+///  https://developer.apple.com/library/mac/documentation/DeviceDrivers/Conceptual/WritingDeviceDriver/WritingDeviceDriver.pdf
+///
 class com_google_SantaDriverClient : public IOUserClient {
   OSDeclareDefaultStructors(com_google_SantaDriverClient);
 
- private:
-  IOSharedDataQueue *fDataQueue;
-  IOMemoryDescriptor *fSharedMemory;
-  com_google_SantaDriver *fProvider;
-  SantaDecisionManager *fSDM;
-  IOLock *fSDMLock;
-
  public:
-  bool start(IOService *provider);
-  void stop(IOService *provider);
-  IOReturn clientClose();
-  bool terminate(IOOptionBits options);
-  bool initWithTask(task_t owningTask, void *securityID, UInt32 type);
+  ///  Called as part of IOServiceOpen in clients
+  bool initWithTask(task_t owningTask, void *securityID, UInt32 type) override;
 
+  ///  Called after initWithTask as part of IOServiceOpen
+  bool start(IOService *provider) override;
+
+  ///  Called when this class is stopping
+  void stop(IOService *provider) override;
+
+  ///  Called when a client disconnects
+  IOReturn clientClose() override;
+
+  ///  Called when the driver is shutting down
+  bool terminate(IOOptionBits options) override;
+
+  ///  Called in clients with IOConnectSetNotificationPort
   IOReturn registerNotificationPort(
-      mach_port_t port, UInt32 type, UInt32 refCon);
+      mach_port_t port, UInt32 type, UInt32 refCon) override;
 
+  ///  Called in clients with IOConnectMapMemory
   IOReturn clientMemoryForType(
-      UInt32 type, IOOptionBits *options, IOMemoryDescriptor **memory);
+      UInt32 type, IOOptionBits *options, IOMemoryDescriptor **memory) override;
 
+  ///  Called in clients with IOConnectCallScalarMethod etc. Dispatches
+  ///  to the requested selector using the SantaDriverMethods enum in
+  ///  SNTKernelCommon.
   IOReturn externalMethod(
       UInt32 selector,
       IOExternalMethodArguments *arguments,
       IOExternalMethodDispatch *dispatch,
-      OSObject *target, void *reference);
+      OSObject *target, void *reference) override;
 
-  IOReturn open();
-  static IOReturn static_open(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///
+  ///  The userpsace callable methods are below. Each method corresponds
+  ///  to an entry in SantaDriverMethods.
+  ///
 
-  IOReturn close();
-  static IOReturn static_close(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///  Called during client connection.
+  static IOReturn open(
+      OSObject *target, void *reference, IOExternalMethodArguments *arguments);
 
-  /// The daemon calls this to allow a binary.
-  IOReturn allow_binary(uint64_t vnode_id);
-  static IOReturn static_allow_binary(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///  The daemon calls this to allow a binary.
+  static IOReturn allow_binary(
+      OSObject *target, void *reference,IOExternalMethodArguments *arguments);
 
-  /// The daemon calls this to deny a binary.
-  IOReturn deny_binary(uint64_t vnode_id);
-  static IOReturn static_deny_binary(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///  The daemon calls this to deny a binary.
+  static IOReturn deny_binary(
+      OSObject *target, void *reference, IOExternalMethodArguments *arguments);
 
-  /// The daemon calls this to empty the cache.
-  IOReturn clear_cache();
-  static IOReturn static_clear_cache(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///  The daemon calls this to empty the cache.
+  static IOReturn clear_cache(
+      OSObject *target, void *reference, IOExternalMethodArguments *arguments);
 
-  /// The daemon calls this to find out how many items are in the cache
-  IOReturn cache_count(uint64_t *output);
-  static IOReturn static_cache_count(
-      com_google_SantaDriverClient *target,
-      void *reference,
-      IOExternalMethodArguments *arguments);
+  ///  The daemon calls this to find out how many items are in the cache
+  static IOReturn cache_count(
+      OSObject *target, void *reference, IOExternalMethodArguments *arguments);
+
+  ///  The daemon calls this to find out the status of a vnode_id in the cache.
+  ///  Output will be a santa_action_t.
+  static IOReturn check_cache(
+      OSObject *target, void *reference, IOExternalMethodArguments *arguments);
+
+ private:
+  com_google_SantaDriver *myProvider;
+  SantaDecisionManager *decisionManager;
 };
 
 #endif  // SANTA__SANTA_DRIVER__SANTADRIVERUSERCLIENT_H

Source/santa-driver/SantaMessage.h

@@ -1,42 +0,0 @@
-/// Copyright 2014 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#ifndef SANTA__SANTA_DRIVER__SANTAMESSAGE_H
-#define SANTA__SANTA_DRIVER__SANTAMESSAGE_H
-
-#include <libkern/c++/OSObject.h>
-
-#include "SNTKernelCommon.h"
-
-/// An OSObject wrapper around a @c santa_action_t and a time.
-/// Only OSObject subclasses can be inserted into an OSDictionary.
-class SantaMessage : public OSObject {
-  OSDeclareDefaultStructors(SantaMessage)
-
- private:
-  santa_action_t action_;
-  uint64_t microsecs_;
-
- public:
-  // Returns the time the action was last set.
-  uint64_t getMicrosecs() const;
-
-  // Returns the set action.
-  santa_action_t getAction() const;
-
-  // Sets the acion and receive time.
-  void setAction(const santa_action_t action, const uint64_t microsecs);
-};
-
-#endif  // SANTA__SANTA_DRIVER__SANTAMESSAGE_H