Conf: Undo adding Username/Groupname to santasync launchd, it doesn't work properly

Project: Stop using xctool, use xcpretty to make xcodebuild output nice instead.
Conf: Run scheduled santactl/sync runs as nobody
2026-01-15 01:08:12 -05:00 · 2015-04-13 16:41:47 -04:00 · 2015-04-10 16:37:24 -04:00 · 2015-04-10 16:06:56 -04:00 · 2015-04-10 12:39:22 -04:00 · 2015-04-10 10:07:53 -04:00
46 changed files with 917 additions and 440 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,9 +2,7 @@
 language: objective-c

 before_install:
- - gem install cocoapods
- - brew update
- - brew upgrade xctool
+ - gem install cocoapods xcpretty

 script:
- - xctool -workspace Santa.xcworkspace -scheme All build test CODE_SIGN_IDENTITY=''
+ - xcodebuild -workspace Santa.xcworkspace -scheme All build test CODE_SIGN_IDENTITY='' | xcpretty -sc && exit ${PIPESTATUS[0]}
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -11,7 +11,7 @@ DEPENDENCIES:
  - OCMock

 SPEC CHECKSUMS:
-  FMDB: 0efa188cf0dd1ce82c27a478cd5f5fa245308677
-  OCMock: ecdd510b73ef397f2f97274785c1e87fd147c49f
+  FMDB: 96e8f1bcc1329e269330f99770ad4285d9003e52
+  OCMock: a10ea9f0a6e921651f96f78b6faee95ebc813b92

-COCOAPODS: 0.35.0
+COCOAPODS: 0.36.1
--- a/67
+++ b/67
@@ -1,46 +1,24 @@
 require 'timeout'

-WORKSPACE       = 'Santa.xcworkspace'
-DEFAULT_SCHEME  = 'All'
-OUTPUT_PATH     = 'Build'
-DIST_PATH       = 'Dist'
-BINARIES        = ['Santa.app', 'santa-driver.kext', 'santad', 'santactl']
-XCTOOL_DEFAULTS = "-workspace #{WORKSPACE}"
-XCODE_DEFAULTS  = "-workspace #{WORKSPACE} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"
+WORKSPACE           = 'Santa.xcworkspace'
+DEFAULT_SCHEME      = 'All'
+OUTPUT_PATH         = 'Build'
+DIST_PATH           = 'Dist'
+BINARIES            = ['Santa.app', 'santa-driver.kext', 'santad', 'santactl']
+XCPRETTY_DEFAULTS   = '-sc'
+XCODEBUILD_DEFAULTS = "-workspace #{WORKSPACE} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"

 task :default do
  system("rake -sT")
 end

-def xctool_available
-  return system 'xctool --version >/dev/null 2>&1'
-end
-
-def run_and_output_on_fail(cmd)
-  output=`#{cmd} 2>&1`
-  if not $?.success?
-    raise output
-  end
-end
-
-def run_and_output_with_color(cmd)
-  output=`#{cmd} 2>&1`
-
-  has_output = false
-  output.scan(/((Test Suite|Test Case|Executed).*)$/) do |match|
-    has_output = true
-    out = match[0]
-    if out.include?("passed")
-      puts "\e[32m#{out}\e[0m"
-    elsif out.include?("failed")
-      puts "\e[31m#{out}\e[0m"
-    else
-      puts out
-    end
-  end
-
-  if not has_output
-    raise output
+def xcodebuild(opts)
+  if system "xcodebuild #{XCODEBUILD_DEFAULTS} #{opts} | " \
+      "xcpretty #{XCPRETTY_DEFAULTS} && " \
+      "exit ${PIPESTATUS[0]}"
+    puts "\e[32mPass\e[0m"
+  else
+    raise "\e[31mFail\e[0m"
  end
 end

@@ -49,6 +27,9 @@ task :init do
    puts "Pods missing, running 'pod install'"
    system "pod install" or raise "CocoaPods is not installed. Install with 'sudo gem install cocoapods'"
  end
+  unless system 'xcpretty -v >/dev/null 2>&1'
+    puts "xcpretty is not installed. Install with 'sudo gem install xcpretty'"
+  end
 end

 task :remove_existing do
@@ -61,7 +42,7 @@ end
 desc "Clean"
 task :clean => :init do
  puts "Cleaning"
-  system "xcodebuild #{XCODE_DEFAULTS} -scheme All clean"
+  xcodebuild("-scheme All clean")
  FileUtils.rm_rf(OUTPUT_PATH)
  FileUtils.rm_rf(DIST_PATH)
 end
@@ -81,11 +62,7 @@ namespace :build do
  task :build, [:configuration] => :init do |t, args|
    config = args[:configuration]
    puts "Building with configuration: #{config}"
-    if xctool_available
-      system "xctool #{XCTOOL_DEFAULTS} -scheme All -configuration #{config} build"
-    else
-      system "xcodebuild #{XCODE_DEFAULTS} -scheme All -configuration #{config} build"
-    end
+    xcodebuild("-scheme All -configuration #{config} build")
  end
 end

@@ -145,11 +122,7 @@ namespace :tests do
  desc "Tests: Logic"
  task :logic => [:init] do
    puts "Running logic tests"
-    if xctool_available
-      system "xctool #{XCTOOL_DEFAULTS} -scheme LogicTests test"
-    else
-      system "xcodebuild #{XCODE_DEFAULTS} -scheme LogicTests test"
-    end
+    xcodebuild("-scheme LogicTests test")
  end

  desc "Tests: Kernel"
--- a/Santa.xcodeproj/project.pbxproj
+++ b/Santa.xcodeproj/project.pbxproj
@@ -69,7 +69,7 @@
 		0D3AFBF018FB4C6C0087BCEE /* SNTDriverManager.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7D01861774F93A005DBAB4 /* SNTDriverManager.m */; };
 		0D3AFBF618FB4C7E0087BCEE /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D385DB7180DE4A900418BC6 /* Cocoa.framework */; };
 		0D3AFBF818FB4C870087BCEE /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D3AFBF718FB4C870087BCEE /* IOKit.framework */; };
-		0D416401191974F1006A356A /* SNTCommandSyncStatus.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D416400191974F1006A356A /* SNTCommandSyncStatus.m */; };
+		0D416401191974F1006A356A /* SNTCommandSyncState.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D416400191974F1006A356A /* SNTCommandSyncState.m */; };
 		0D41640519197AD7006A356A /* SNTCommandSyncEventUpload.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D41640419197AD7006A356A /* SNTCommandSyncEventUpload.m */; };
 		0D41DAD41A7C28C800A890FE /* SNTEventTableTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D41DAD31A7C28C800A890FE /* SNTEventTableTest.m */; };
 		0D42D2B519D1D98A00955F08 /* SNTSystemInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D42D2B419D1D98A00955F08 /* SNTSystemInfo.m */; };
@@ -147,6 +147,11 @@
 		0DE50F6C19130358007B2B0C /* SNTStoredEvent.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD604A19105433006B445C /* SNTStoredEvent.m */; };
 		0DE50F6E191304E0007B2B0C /* SNTRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE50F671912716A007B2B0C /* SNTRule.m */; };
 		0DE6788D1784A8C2007A9E52 /* SNTExecutionController.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE6788C1784A8C2007A9E52 /* SNTExecutionController.m */; };
+		0DEFB7C01ACB28B000B92AAE /* SNTCommandSyncConstants.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */; };
+		0DEFB7C41ACDD80100B92AAE /* SNTFileWatcher.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */; };
+		0DEFB7C51ACDD80100B92AAE /* SNTFileWatcher.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */; };
+		0DEFB7C61ACDE5F600B92AAE /* SNTFileWatcher.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */; };
+		0DEFB7C81ACF0BFE00B92AAE /* SNTFileWatcherTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C71ACF0BFE00B92AAE /* SNTFileWatcherTest.m */; };
 		0DF395641AB76A7900CBC520 /* NSData+Zlib.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DF395631AB76A7900CBC520 /* NSData+Zlib.m */; };
 		0DF395661AB76ABC00CBC520 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 0DF395651AB76ABC00CBC520 /* libz.dylib */; };
 		4092327A1A51B66400A04527 /* SNTCommandRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 409232791A51B65D00A04527 /* SNTCommandRule.m */; };
@@ -248,8 +253,8 @@
 		0D385DEF180DE51600418BC6 /* SNTNotificationManager.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTNotificationManager.m; sourceTree = "<group>"; };
 		0D3AFBE618FB32CB0087BCEE /* SNTXPCConnectionTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTXPCConnectionTest.m; sourceTree = "<group>"; };
 		0D3AFBF718FB4C870087BCEE /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = IOKit.framework; path = System/Library/Frameworks/IOKit.framework; sourceTree = SDKROOT; };
-		0D4163FF191974F1006A356A /* SNTCommandSyncStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncStatus.h; sourceTree = "<group>"; };
-		0D416400191974F1006A356A /* SNTCommandSyncStatus.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncStatus.m; sourceTree = "<group>"; };
+		0D4163FF191974F1006A356A /* SNTCommandSyncState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncState.h; sourceTree = "<group>"; };
+		0D416400191974F1006A356A /* SNTCommandSyncState.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncState.m; sourceTree = "<group>"; };
 		0D41640319197AD7006A356A /* SNTCommandSyncEventUpload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncEventUpload.h; sourceTree = "<group>"; };
 		0D41640419197AD7006A356A /* SNTCommandSyncEventUpload.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncEventUpload.m; sourceTree = "<group>"; };
 		0D41DAD31A7C28C800A890FE /* SNTEventTableTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTEventTableTest.m; sourceTree = "<group>"; };
@@ -325,6 +330,11 @@
 		0DE50F671912716A007B2B0C /* SNTRule.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTRule.m; sourceTree = "<group>"; };
 		0DE6788B1784A8C2007A9E52 /* SNTExecutionController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTExecutionController.h; sourceTree = "<group>"; };
 		0DE6788C1784A8C2007A9E52 /* SNTExecutionController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; lineEnding = 0; path = SNTExecutionController.m; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objc; };
+		0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncConstants.m; sourceTree = "<group>"; };
+		0DEFB7C11ACB28BC00B92AAE /* SNTCommandSyncConstants.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncConstants.h; sourceTree = "<group>"; };
+		0DEFB7C21ACDD80100B92AAE /* SNTFileWatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTFileWatcher.h; sourceTree = "<group>"; };
+		0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTFileWatcher.m; sourceTree = "<group>"; };
+		0DEFB7C71ACF0BFE00B92AAE /* SNTFileWatcherTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTFileWatcherTest.m; sourceTree = "<group>"; };
 		0DF395621AB76A7900CBC520 /* NSData+Zlib.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "NSData+Zlib.h"; sourceTree = "<group>"; };
 		0DF395631AB76A7900CBC520 /* NSData+Zlib.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = "NSData+Zlib.m"; sourceTree = "<group>"; };
 		0DF395651AB76ABC00CBC520 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = usr/lib/libz.dylib; sourceTree = SDKROOT; };
@@ -410,6 +420,7 @@
 				0D41DAD31A7C28C800A890FE /* SNTEventTableTest.m */,
 				0DD0D490194F9947005F27EB /* SNTExecutionControllerTest.m */,
 				0DD0D48E194F78F8005F27EB /* SNTFileInfoTest.m */,
+				0DEFB7C71ACF0BFE00B92AAE /* SNTFileWatcherTest.m */,
 				0D3AFBE618FB32CB0087BCEE /* SNTXPCConnectionTest.m */,
 			);
 			path = LogicTests;
@@ -464,6 +475,8 @@
 				0DCD6060191188B1006B445C /* SNTAuthenticatingURLSession.h */,
 				0DCD6061191188B1006B445C /* SNTAuthenticatingURLSession.m */,
 				0D35BDB418FD84F600921A21 /* SNTCommandSync.m */,
+				0DEFB7C11ACB28BC00B92AAE /* SNTCommandSyncConstants.h */,
+				0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */,
 				0D41640319197AD7006A356A /* SNTCommandSyncEventUpload.h */,
 				0D41640419197AD7006A356A /* SNTCommandSyncEventUpload.m */,
 				0DC5D86F192160180078A5C0 /* SNTCommandSyncLogUpload.h */,
@@ -474,8 +487,8 @@
 				0DCD605B19117A90006B445C /* SNTCommandSyncPreflight.m */,
 				0D0A1EC1191998C900B8450F /* SNTCommandSyncRuleDownload.h */,
 				0D0A1EC2191998C900B8450F /* SNTCommandSyncRuleDownload.m */,
-				0D4163FF191974F1006A356A /* SNTCommandSyncStatus.h */,
-				0D416400191974F1006A356A /* SNTCommandSyncStatus.m */,
+				0D4163FF191974F1006A356A /* SNTCommandSyncState.h */,
+				0D416400191974F1006A356A /* SNTCommandSyncState.m */,
 				0D7FFD491A017D4B00F34435 /* SNTDERDecoder.h */,
 				0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */,
 			);
@@ -616,6 +629,8 @@
 				0D10BE851A0AABD600C0C944 /* SNTDropRootPrivs.m */,
 				0DCD6040190ACCB8006B445C /* SNTFileInfo.h */,
 				0DCD6041190ACCB8006B445C /* SNTFileInfo.m */,
+				0DEFB7C21ACDD80100B92AAE /* SNTFileWatcher.h */,
+				0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */,
 				0D28E5E31926AFE400280F87 /* SNTKernelCommon.h */,
 				0D28E5E119269B3600280F87 /* SNTLogging.h */,
 				0DA73C9E1934F8100056D7C4 /* SNTLogging.m */,
@@ -1089,7 +1104,9 @@
 				0DCD604D19105433006B445C /* SNTStoredEvent.m in Sources */,
 				0DCD605819115E57006B445C /* SNTXPCControlInterface.m in Sources */,
 				0D10BE891A0AAF6700C0C944 /* SNTDropRootPrivs.m in Sources */,
+				0DEFB7C61ACDE5F600B92AAE /* SNTFileWatcher.m in Sources */,
 				0D10BE8B1A0AB23300C0C944 /* SNTDERDecoderTest.m in Sources */,
+				0DEFB7C81ACF0BFE00B92AAE /* SNTFileWatcherTest.m in Sources */,
 				0DD0D48B194F6193005F27EB /* SNTCertificateTest.m in Sources */,
 				0D28D53819D9F5910015C5EB /* SNTConfigurator.m in Sources */,
 				0D3AFBE718FB32CB0087BCEE /* SNTXPCConnectionTest.m in Sources */,
@@ -1116,6 +1133,7 @@
 				0D35BDC218FDA5D100921A21 /* SNTCodesignChecker.m in Sources */,
 				0D35BDB518FD84F600921A21 /* SNTCommandSync.m in Sources */,
 				0DCD5FBF1909D64A006B445C /* SNTCommandBinaryInfo.m in Sources */,
+				0DEFB7C01ACB28B000B92AAE /* SNTCommandSyncConstants.m in Sources */,
 				0DCD6062191188B1006B445C /* SNTAuthenticatingURLSession.m in Sources */,
 				0DCD605619115D17006B445C /* SNTXPCControlInterface.m in Sources */,
 				0DE50F6C19130358007B2B0C /* SNTStoredEvent.m in Sources */,
@@ -1127,7 +1145,7 @@
 				0D10BE871A0AABD600C0C944 /* SNTDropRootPrivs.m in Sources */,
 				0DE4C8A618FF3B1700466D04 /* SNTCommandFlushCache.m in Sources */,
 				4092327A1A51B66400A04527 /* SNTCommandRule.m in Sources */,
-				0D416401191974F1006A356A /* SNTCommandSyncStatus.m in Sources */,
+				0D416401191974F1006A356A /* SNTCommandSyncState.m in Sources */,
 				0DC5D871192160180078A5C0 /* SNTCommandSyncLogUpload.m in Sources */,
 				0D35BDA218FD71CE00921A21 /* main.m in Sources */,
 				0DCD6043190ACCB8006B445C /* SNTFileInfo.m in Sources */,
@@ -1161,6 +1179,7 @@
 				0D1B477019A53419008CADD3 /* SNTAboutWindowController.m in Sources */,
 				0D668E8118D1121700E29A8B /* SNTMessageWindow.m in Sources */,
 				0DA73CA11934F8100056D7C4 /* SNTLogging.m in Sources */,
+				0DEFB7C51ACDD80100B92AAE /* SNTFileWatcher.m in Sources */,
 				0D20710E1A7C4A86008B0A9A /* SNTStoredEvent.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -1190,6 +1209,7 @@
 				0D1AF477187C7A2C00D3298D /* SNTCertificate.m in Sources */,
 				0DA73C9F1934F8100056D7C4 /* SNTLogging.m in Sources */,
 				0DCD6042190ACCB8006B445C /* SNTFileInfo.m in Sources */,
+				0DEFB7C41ACDD80100B92AAE /* SNTFileWatcher.m in Sources */,
 				0DC5D86D191AED220078A5C0 /* SNTRuleTable.m in Sources */,
 				0D7D01871774F93A005DBAB4 /* SNTDriverManager.m in Sources */,
 				0D8E18CD19107B56000F89B8 /* SNTDaemonControlController.m in Sources */,
--- a/Source/SantaGUI/SNTAppDelegate.m
+++ b/Source/SantaGUI/SNTAppDelegate.m
@@ -16,11 +16,13 @@

 #import "SNTAboutWindowController.h"
 #import "SNTConfigurator.h"
+#import "SNTFileWatcher.h"
 #import "SNTNotificationManager.h"
 #import "SNTXPCConnection.h"

@interface SNTAppDelegate ()
@property SNTAboutWindowController *aboutWindowController;
+@property SNTFileWatcher *configFileWatcher;
@property SNTNotificationManager *notificationManager;
@property SNTXPCConnection *listener;
@end
@@ -31,6 +33,12 @@

 - (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
  [self setupMenu];
+
+  self.configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
+                                                            handler:^{
+      [[SNTConfigurator configurator] reloadConfigData];
+  }];
+
  self.aboutWindowController = [[SNTAboutWindowController alloc] init];
  self.notificationManager = [[SNTNotificationManager alloc] init];

@@ -45,9 +53,6 @@
                               object:nil];

  [self createConnection];
-
-  // Load configuration from disk ready for first message.
-  (void)[SNTConfigurator configurator];
 }

 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
@@ -60,9 +65,8 @@
 - (void)createConnection {
  __weak __typeof(self) weakSelf = self;

-  self.listener =
-      [[SNTXPCConnection alloc] initClientWithName:[SNTXPCNotifierInterface serviceId]
-                                           options:NSXPCConnectionPrivileged];
+  self.listener = [[SNTXPCConnection alloc] initClientWithName:[SNTXPCNotifierInterface serviceId]
+                                                       options:NSXPCConnectionPrivileged];
  self.listener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
  self.listener.exportedObject = self.notificationManager;
  self.listener.rejectedHandler = ^{
--- a/Source/SantaGUI/SNTMessageWindow.m
+++ b/Source/SantaGUI/SNTMessageWindow.m
@@ -26,6 +26,7 @@

 - (IBAction)fadeIn:(id)sender {
  [self setAlphaValue:0.f];
+  [self center];
  [self makeKeyAndOrderFront:sender];
  [NSAnimationContext beginGrouping];
  [[NSAnimationContext currentContext] setDuration:0.15f];
--- a/Source/SantaGUI/SNTMessageWindowController.m
+++ b/Source/SantaGUI/SNTMessageWindowController.m
@@ -36,7 +36,7 @@
 - (void)loadWindow {
  [super loadWindow];
  [self.window setLevel:NSPopUpMenuWindowLevel];
-  [self.window center];
+  [self.window setMovableByWindowBackground:YES];

  if (![[SNTConfigurator configurator] eventDetailURL]) {
    [self.openEventButton removeFromSuperview];
@@ -76,15 +76,15 @@
 }

 - (IBAction)openEventDetails:(id)sender {
-  NSString *formatStr = [[SNTConfigurator configurator] eventDetailURL];
+  SNTConfigurator *config = [SNTConfigurator configurator];

+  NSString *formatStr = config.eventDetailURL;
  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
                                                   withString:self.event.fileSHA256];
  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
                                                   withString:self.event.executingUser];
-  formatStr =
-      [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
-                                           withString:[[SNTConfigurator configurator] machineID]];
+  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
+                                                   withString:config.machineID];

  [self closeWindow:sender];
  [[NSWorkspace sharedWorkspace] openURL:[NSURL URLWithString:formatStr]];
@@ -126,7 +126,7 @@
  NSString *htmlFooter = @"</body></html>";

  NSString *message;
-  if (self.customMessage && ![self.customMessage isEqual:@""]) {
+  if ([self.customMessage length] > 0) {
    message = self.customMessage;
  } else {
    message = @"The following application has been blocked from executing<br />"
--- a/Source/common/SNTConfigurator.h
+++ b/Source/common/SNTConfigurator.h
@@ -16,14 +16,17 @@

 ///
 ///  Singleton that provides an interface for managing configuration values on disk
-///  @note This class is designed as a singleton but that is not enforced.
+///  @note This class is designed as a singleton but that is not strictly enforced.
 ///
@interface SNTConfigurator : NSObject

+///  Default config file path
+extern NSString * const kDefaultConfigFilePath;
+
 #pragma mark - Daemon Settings

 ///
-///  The operating mode
+///  The operating mode.
 ///
@property santa_clientmode_t clientMode;

@@ -64,17 +67,17 @@
 # pragma mark - Sync Settings

 ///
-///  The base URL of the sync server
+///  The base URL of the sync server.
 ///
@property(readonly) NSURL *syncBaseURL;

 ///
-///  The machine owner
+///  The machine owner.
 ///
@property(readonly) NSString *machineOwner;

 ///
-///  If set, this over-rides the default machine ID used for syncing
+///  If set, this over-rides the default machine ID used for syncing.
 ///
@property(readonly) NSString *machineID;

@@ -116,15 +119,20 @@
@property(readonly) NSString *syncClientAuthCertificateIssuer;

 ///
-///  Retrieve an initialized singleton configurator object using the default file path
+///  Retrieve an initialized singleton configurator object using the default file path.
 ///
 + (instancetype)configurator;

 ///
-///  Designated initializer
+///  Designated initializer.
 ///
 ///  @param filePath The path to the file to use as a backing store.
 ///
 - (instancetype)initWithFilePath:(NSString *)filePath;

+///
+///  Re-read config data from disk.
+///
+- (void)reloadConfigData;
+
@end
--- a/Source/common/SNTConfigurator.m
+++ b/Source/common/SNTConfigurator.m
@@ -20,17 +20,12 @@
@interface SNTConfigurator ()
@property NSString *configFilePath;
@property NSMutableDictionary *configData;
-
-@property dispatch_source_t fileMonitoringSource;
-@property(strong) void (^fileEventHandler)(void);
-@property(strong) void (^fileCancelHandler)(void);
-
@end

@implementation SNTConfigurator

 /// The hard-coded path to the config file
-static NSString * const kConfigFilePath = @"/var/db/santa/config.plist";
+NSString * const kDefaultConfigFilePath = @"/var/db/santa/config.plist";

 /// The keys in the config file
 static NSString * const kClientModeKey = @"ClientMode";
@@ -62,7 +57,7 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
  self = [super init];
  if (self) {
    _configFilePath = filePath;
-    [self beginWatchingConfigFile];
+    [self reloadConfigData];
  }
  return self;
 }
@@ -73,75 +68,13 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
  static SNTConfigurator *sharedConfigurator = nil;
  static dispatch_once_t onceToken;
  dispatch_once(&onceToken, ^{
-    sharedConfigurator = [[SNTConfigurator alloc] initWithFilePath:kConfigFilePath];
+      sharedConfigurator = [[SNTConfigurator alloc] initWithFilePath:kDefaultConfigFilePath];
  });
  return sharedConfigurator;
 }

 # pragma mark Public Interface

- (NSURL *)syncBaseURL {
-  return [NSURL URLWithString:self.configData[kSyncBaseURLKey]];
-}
-
- (NSString *)syncClientAuthCertificateFile {
-  return self.configData[kClientAuthCertificateFileKey];
-}
-
- (NSString *)syncClientAuthCertificatePassword {
-  return self.configData[kClientAuthCertificatePasswordKey];
-}
-
- (NSString *)syncClientAuthCertificateCn {
-  return self.configData[kClientAuthCertificateCNKey];
-}
-
- (NSString *)syncClientAuthCertificateIssuer {
-  return self.configData[kClientAuthCertificateIssuerKey];
-}
-
- (NSData *)syncServerAuthRootsData {
-  return self.configData[kServerAuthRootsDataKey];
-}
-
- (NSString *)syncServerAuthRootsFile {
-  return self.configData[kServerAuthRootsFileKey];
-}
-
- (NSString *)machineOwner {
-  if (self.configData[kMachineOwnerPlistFileKey] && self.configData[kMachineOwnerPlistKeyKey]) {
-    NSDictionary *plist =
-        [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineOwnerPlistFileKey]];
-    return plist[self.configData[kMachineOwnerPlistKeyKey]];
-  }
-
-  if (self.configData[kMachineOwnerKey]) {
-    return self.configData[kMachineOwnerKey];
-  }
-
-  return @"";
-}
-
- (NSString *)machineID {
-  NSString *machineId;
-
-  if (self.configData[kMachineIDPlistFileKey] && self.configData[kMachineIDPlistKeyKey]) {
-    NSDictionary *plist =
-        [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineIDPlistFileKey]];
-    machineId = plist[kMachineIDPlistKeyKey];
-  }
-
-  if (self.configData[kMachineIDKey]) {
-    machineId = self.configData[kMachineIDKey];
-  }
-
-  if (!machineId || [machineId isEqual:@""]) {
-    machineId = [SNTSystemInfo hardwareUUID];
-  }
-
-  return machineId;
-}
-
 - (santa_clientmode_t)clientMode {
  int cm = [self.configData[kClientModeKey] intValue];
  if (cm > CLIENTMODE_UNKNOWN && cm < CLIENTMODE_MAX) {
@@ -180,36 +113,78 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
  return self.configData[kEventDetailTextKey];
 }

-#pragma mark Private
-
-///
-///  Saves the current @c _configData to disk.
-///
- (void)saveConfigToDisk {
-  [self.configData writeToFile:kConfigFilePath atomically:YES];
+- (NSURL *)syncBaseURL {
+  return [NSURL URLWithString:self.configData[kSyncBaseURLKey]];
+}
+
+- (NSString *)syncClientAuthCertificateFile {
+  return self.configData[kClientAuthCertificateFileKey];
+}
+
+- (NSString *)syncClientAuthCertificatePassword {
+  return self.configData[kClientAuthCertificatePasswordKey];
+}
+
+- (NSString *)syncClientAuthCertificateCn {
+  return self.configData[kClientAuthCertificateCNKey];
+}
+
+- (NSString *)syncClientAuthCertificateIssuer {
+  return self.configData[kClientAuthCertificateIssuerKey];
+}
+
+- (NSData *)syncServerAuthRootsData {
+  return self.configData[kServerAuthRootsDataKey];
+}
+
+- (NSString *)syncServerAuthRootsFile {
+  return self.configData[kServerAuthRootsFileKey];
+}
+
+- (NSString *)machineOwner {
+  NSString *machineOwner;
+
+  if (self.configData[kMachineOwnerPlistFileKey] && self.configData[kMachineOwnerPlistKeyKey]) {
+    NSDictionary *plist =
+        [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineOwnerPlistFileKey]];
+    machineOwner = plist[self.configData[kMachineOwnerPlistKeyKey]];
+  }
+
+  if (self.configData[kMachineOwnerKey]) {
+    machineOwner = self.configData[kMachineOwnerKey];
+  }
+
+  if (!machineOwner) machineOwner = @"";
+
+  return machineOwner;
+}
+
+- (NSString *)machineID {
+  NSString *machineId;
+
+  if (self.configData[kMachineIDPlistFileKey] && self.configData[kMachineIDPlistKeyKey]) {
+    NSDictionary *plist =
+        [NSDictionary dictionaryWithContentsOfFile:self.configData[kMachineIDPlistFileKey]];
+    machineId = plist[self.configData[kMachineIDPlistKeyKey]];
+  }
+
+  if (self.configData[kMachineIDKey]) {
+    machineId = self.configData[kMachineIDKey];
+  }
+
+  if ([machineId length] == 0) {
+    machineId = [SNTSystemInfo hardwareUUID];
+  }
+
+  return machineId;
 }

-///
-///  Populate @c self.configData, using the config file on disk if possible,
-///  otherwise an empty mutable dictionary.
-///
-///  If the config file's permissions are not @c 0644, will attempt to set them
-///  but will fail silently if this cannot be done.
-///
 - (void)reloadConfigData {
  if (!self.configData) self.configData = [NSMutableDictionary dictionary];

  NSFileManager *fm = [NSFileManager defaultManager];
  if (![fm fileExistsAtPath:self.configFilePath]) return;

-  // Ensure the config file permissions are 0644. Fail silently if they can't be changed.
-  NSDictionary *fileAttrs = [fm attributesOfItemAtPath:self.configFilePath error:nil];
-  if ([fileAttrs filePosixPermissions] != 0644) {
-    [fm setAttributes:@{ NSFilePosixPermissions: @(0644) }
-         ofItemAtPath:self.configFilePath
-                error:nil];
-  }
-
  NSError *error;
  NSData *readData = [NSData dataWithContentsOfFile:self.configFilePath
                                            options:NSDataReadingMappedIfSafe
@@ -229,10 +204,10 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
    return;
  }

-  // Ensure user isn't trying to change the client mode while running, only santactl can do that.
+  // Ensure no-one is trying to change the client mode behind Santa's back.
  if (self.configData[kClientModeKey] && configData[kClientModeKey] &&
-      ![self.configData[kClientModeKey] isEqual:configData[kClientModeKey]]) {
-    LOGW(@"Client mode in config file was changed behind our back, resetting.");
+      ![self.configData[kClientModeKey] isEqual:configData[kClientModeKey]] &&
+      geteuid() == 0) {
    NSMutableDictionary *configDataMutable = [configData mutableCopy];
    configDataMutable[kClientModeKey] = self.configData[kClientModeKey];
    self.configData = configDataMutable;
@@ -242,45 +217,13 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
  }
 }

- (void)beginWatchingConfigFile {
-  if (self.fileMonitoringSource) return;
+#pragma mark Private

-  dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0);
-  if (!queue) return;
-
-  __weak typeof(self) weakSelf = self;
-  int mask = (DISPATCH_VNODE_DELETE | DISPATCH_VNODE_WRITE |
-              DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_RENAME);
-
-  self.fileEventHandler = ^{
-    unsigned long l = dispatch_source_get_data(weakSelf.fileMonitoringSource);
-    if (l & DISPATCH_VNODE_DELETE || l & DISPATCH_VNODE_RENAME) {
-      dispatch_source_cancel(weakSelf.fileMonitoringSource);
-    } else {
-      [weakSelf reloadConfigData];
-    }
-  };
-
-  self.fileCancelHandler = ^{
-    int fd;
-    if (weakSelf.fileMonitoringSource) {
-      fd = (int)dispatch_source_get_handle(weakSelf.fileMonitoringSource);
-      close(fd);
-    }
-
-    while ((fd = open([weakSelf.configFilePath fileSystemRepresentation], O_EVTONLY)) < 0) {
-      sleep(1);
-    }
-
-    weakSelf.fileMonitoringSource = dispatch_source_create(
-        DISPATCH_SOURCE_TYPE_VNODE, fd, mask, queue);
-    dispatch_source_set_event_handler(weakSelf.fileMonitoringSource, weakSelf.fileEventHandler);
-    dispatch_source_set_cancel_handler(weakSelf.fileMonitoringSource, weakSelf.fileCancelHandler);
-    dispatch_resume(weakSelf.fileMonitoringSource);
-    [weakSelf reloadConfigData];
-  };
-
-  dispatch_async(queue, self.fileCancelHandler);
+///
+///  Saves the current @c self.configData to disk.
+///
+- (void)saveConfigToDisk {
+  [self.configData writeToFile:self.configFilePath atomically:YES];
 }

@end
--- a/Source/common/SNTFileWatcher.h
+++ b/Source/common/SNTFileWatcher.h
@@ -0,0 +1,34 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+///
+///  Simple file watching class using dispatch sources. Will automatically
+///  reload the watch if the file is deleted. Will continue watching for
+///  events until deallocated.
+///
+@interface SNTFileWatcher : NSObject
+
+///
+///  Designated initializer
+///  Initializes the watcher and begins watching for modifications.
+///
+///  @param filePath the file to watch.
+///  @param handler the handler to call when changes happen.
+///
+///  @note Shortly after the file has been opened and monitoring has begun, the provided handler
+///  will be called.
+///
+- (instancetype)initWithFilePath:(NSString *)filePath handler:(void (^)(void))handler;
+
+@end
--- a/Source/common/SNTFileWatcher.m
+++ b/Source/common/SNTFileWatcher.m
@@ -0,0 +1,102 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTFileWatcher.h"
+
+@interface SNTFileWatcher ()
+@property NSString *filePath;
+@property dispatch_source_t monitoringSource;
+
+@property(strong) void (^eventHandler)(void);
+@property(strong) void (^internalEventHandler)(void);
+@property(strong) void (^internalCancelHandler)(void);
+@end
+
+@implementation SNTFileWatcher
+
+- (instancetype)init {
+  [self doesNotRecognizeSelector:_cmd];
+  return nil;
+}
+
+- (instancetype)initWithFilePath:(NSString *)filePath handler:(void (^)(void))handler {
+  self = [super init];
+  if (self) {
+    _filePath = filePath;
+    _eventHandler = handler;
+
+    if (!_filePath || !_eventHandler) return nil;
+
+    [self beginWatchingFile];
+  }
+  return self;
+}
+
+- (void)dealloc {
+  [self stopWatchingFile];
+}
+
+- (void)beginWatchingFile {
+  __weak typeof(self) weakSelf = self;
+  int mask = (DISPATCH_VNODE_DELETE | DISPATCH_VNODE_WRITE |
+              DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_RENAME);
+  dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0);
+
+  self.internalEventHandler = ^{
+      unsigned long l = dispatch_source_get_data(weakSelf.monitoringSource);
+      if (l & DISPATCH_VNODE_DELETE || l & DISPATCH_VNODE_RENAME) {
+        if (weakSelf.monitoringSource) dispatch_source_cancel(weakSelf.monitoringSource);
+      } else {
+        weakSelf.eventHandler();
+      }
+  };
+
+  self.internalCancelHandler = ^{
+      int fd;
+
+      if (weakSelf.monitoringSource) {
+        fd = (int)dispatch_source_get_handle(weakSelf.monitoringSource);
+        close(fd);
+      }
+
+      while ((fd = open([weakSelf.filePath fileSystemRepresentation], O_EVTONLY)) < 0) {
+        usleep(1000);
+      }
+
+      weakSelf.monitoringSource = dispatch_source_create(
+          DISPATCH_SOURCE_TYPE_VNODE, fd, mask, queue);
+      dispatch_source_set_event_handler(weakSelf.monitoringSource, weakSelf.internalEventHandler);
+      dispatch_source_set_cancel_handler(weakSelf.monitoringSource, weakSelf.internalCancelHandler);
+      dispatch_resume(weakSelf.monitoringSource);
+
+      weakSelf.eventHandler();
+  };
+
+  dispatch_async(queue, self.internalCancelHandler);
+}
+
+- (void)stopWatchingFile {
+  if (!self.monitoringSource) return;
+
+  int fd = (int)dispatch_source_get_handle(self.monitoringSource);
+  dispatch_source_set_event_handler_f(self.monitoringSource, NULL);
+  dispatch_source_set_cancel_handler(self.monitoringSource, ^{
+      close(fd);
+  });
+
+  dispatch_source_cancel(self.monitoringSource);
+  self.monitoringSource = nil;
+}
+
+@end
--- a/Source/common/SNTLogging.m
+++ b/Source/common/SNTLogging.m
@@ -58,6 +58,6 @@ void logMessage(int level, FILE *destination, NSString *format, ...) {
    }

    fprintf(destination, "%s\n", [[NSString stringWithFormat:@"[%@] %@ %@: %@",
-               [dateFormatter stringFromDate:[NSDate date]], levelName, binaryName, s] UTF8String]);
+            [dateFormatter stringFromDate:[NSDate date]], levelName, binaryName, s] UTF8String]);
  }
 }
--- a/Source/common/SNTXPCControlInterface.h
+++ b/Source/common/SNTXPCControlInterface.h
@@ -32,11 +32,11 @@
 ///  Database ops
 ///
 - (void)databaseRuleCounts:(void (^)(uint64_t binary, uint64_t certificate))reply;
- (void)databaseRuleAddRule:(SNTRule *)rule withReply:(void (^)())reply;
- (void)databaseRuleAddRules:(NSArray *)rules withReply:(void (^)())reply;
+- (void)databaseRuleAddRule:(SNTRule *)rule cleanSlate:(BOOL)cleanSlate reply:(void (^)())reply;
+- (void)databaseRuleAddRules:(NSArray *)rules cleanSlate:(BOOL)cleanSlate reply:(void (^)())reply;

 - (void)databaseEventCount:(void (^)(uint64_t count))reply;
- (void)databaseEventForSHA256:(NSString *)sha256 withReply:(void (^)(SNTStoredEvent *))reply;
+- (void)databaseEventForSHA256:(NSString *)sha256 reply:(void (^)(SNTStoredEvent *))reply;
 - (void)databaseEventsPending:(void (^)(NSArray *events))reply;
 - (void)databaseRemoveEventsWithIDs:(NSArray *)ids;

@@ -44,7 +44,7 @@
 ///  Misc ops
 ///
 - (void)clientMode:(void (^)(santa_clientmode_t))reply;
- (void)setClientMode:(santa_clientmode_t)mode withReply:(void (^)())reply;
+- (void)setClientMode:(santa_clientmode_t)mode reply:(void (^)())reply;

@end

--- a/Source/common/SNTXPCControlInterface.m
+++ b/Source/common/SNTXPCControlInterface.m
@@ -32,7 +32,7 @@
            ofReply:YES];

  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTRule class], nil]
-        forSelector:@selector(databaseRuleAddRules:withReply:)
+        forSelector:@selector(databaseRuleAddRules:cleanSlate:reply:)
      argumentIndex:0
            ofReply:NO];

--- a/Source/santa-driver/SantaDecisionManager.cc
+++ b/Source/santa-driver/SantaDecisionManager.cc
@@ -26,6 +26,8 @@ bool SantaDecisionManager::init() {

  cached_decisions_ = OSDictionary::withCapacity(1000);

+  owning_pid_ = 0;
+
  return kIOReturnSuccess;
 }

@@ -70,6 +72,7 @@ void SantaDecisionManager::ConnectClient(IOSharedDataQueue *queue, pid_t pid) {

  owning_pid_ = pid;
  owning_proc_ = proc_find(pid);
+  failed_queue_requests_ = 0;
 }

 void SantaDecisionManager::DisconnectClient() {
@@ -283,6 +286,11 @@ santa_action_t SantaDecisionManager::FetchDecision(
    do {
      // Send request to daemon...
      if (!PostToQueue(message)) {
+        OSIncrementAtomic(&failed_queue_requests_);
+        if (failed_queue_requests_ > kMaxQueueFailures) {
+          LOGE("Failed to queue more than %d requests, killing daemon", kMaxQueueFailures);
+          proc_signal(owning_pid_, SIGKILL);
+        }
        LOGE("Failed to queue request for %s.", path);
        CacheCheck(vnode_id_str);
        return ACTION_ERROR;
--- a/Source/santa-driver/SantaDecisionManager.h
+++ b/Source/santa-driver/SantaDecisionManager.h
@@ -55,6 +55,11 @@ const int kMaxRequestLoops = 50;
 ///
 const int kMaxCacheSize = 10000;

+///
+///  Maximum number of PostToQueue failures to allow.
+///
+const int kMaxQueueFailures = 10;
+
 ///
 ///  SantaDecisionManager is responsible for intercepting Vnode execute actions
 ///  and responding to the request appropriately.
@@ -142,6 +147,7 @@ class SantaDecisionManager : public OSObject {
  OSDictionary *cached_decisions_;

  IOSharedDataQueue *dataqueue_;
+  SInt32 failed_queue_requests_;

  SInt32 listener_invocations_;

--- a/Source/santa-driver/SantaDriverClient.cc
+++ b/Source/santa-driver/SantaDriverClient.cc
@@ -43,13 +43,13 @@ bool SantaDriverClient::start(IOService *provider) {

  fSDM = fProvider->GetDecisionManager();

+  if (!fSDM) return false;
+
  return true;
 }

 void SantaDriverClient::stop(IOService *provider) {
  super::stop(provider);
-
-  fSDM = NULL;
  fProvider = NULL;
 }

@@ -62,11 +62,15 @@ bool SantaDriverClient::terminate(IOOptionBits options) {
  fSDM->DisconnectClient();
  LOGI("Client disconnected.");

-  fSharedMemory->release();
-  fSharedMemory = NULL;
+  if (fSharedMemory) {
+    fSharedMemory->release();
+    fSharedMemory = NULL;
+  }

-  fDataQueue->release();
-  fDataQueue = NULL;
+  if (fDataQueue) {
+    fDataQueue->release();
+    fDataQueue = NULL;
+  }

  if (fProvider && fProvider->isOpen(this)) fProvider->close(this);

--- a/Source/santa-driver/SantaDriverClient.h
+++ b/Source/santa-driver/SantaDriverClient.h
@@ -43,12 +43,6 @@ const int kMaxQueueEvents = 256;
 class com_google_SantaDriverClient : public IOUserClient {
  OSDeclareDefaultStructors(com_google_SantaDriverClient);

- private:
-  IOSharedDataQueue *fDataQueue;
-  IOMemoryDescriptor *fSharedMemory;
-  com_google_SantaDriver *fProvider;
-  SantaDecisionManager *fSDM;
-
 public:
  ///  Called as part of IOServiceOpen in clients
  bool initWithTask(task_t owningTask, void *securityID, UInt32 type);
@@ -122,6 +116,12 @@ class com_google_SantaDriverClient : public IOUserClient {
      com_google_SantaDriverClient *target,
      void *reference,
      IOExternalMethodArguments *arguments);
+
+ private:
+  IOSharedDataQueue *fDataQueue;
+  IOMemoryDescriptor *fSharedMemory;
+  com_google_SantaDriver *fProvider;
+  SantaDecisionManager *fSDM;
 };

 #endif  // SANTA__SANTA_DRIVER__SANTADRIVERUSERCLIENT_H
--- a/Source/santa-driver/SantaMessage.h
+++ b/Source/santa-driver/SantaMessage.h
@@ -26,10 +26,6 @@
 class SantaMessage : public OSObject {
  OSDeclareDefaultStructors(SantaMessage)

- private:
-  santa_action_t action_;
-  uint64_t microsecs_;
-
 public:
  // Returns the time the action was last set.
  uint64_t getMicrosecs() const;
@@ -39,6 +35,10 @@ class SantaMessage : public OSObject {

  // Sets the acion and receive time.
  void setAction(const santa_action_t action, const uint64_t microsecs);
+
+ private:
+  santa_action_t action_;
+  uint64_t microsecs_;
 };

 #endif  // SANTA__SANTA_DRIVER__SANTAMESSAGE_H
--- a/Source/santactl/rule/SNTCommandRule.m
+++ b/Source/santactl/rule/SNTCommandRule.m
@@ -151,13 +151,13 @@ REGISTER_COMMAND_NAME(@"rule");
  newRule.type = RULETYPE_BINARY;
  newRule.customMsg = customMsg;
  
-  [[daemonConn remoteObjectProxy] databaseRuleAddRule:newRule withReply:^{
-    if (state == RULESTATE_REMOVE) {
-      printf("Removed rule for SHA-256: %s.\n", [newRule.shasum UTF8String]);
-    } else {
-      printf("Added rule for SHA-256: %s.\n", [newRule.shasum UTF8String]);
-    }
-    exit(0);
+  [[daemonConn remoteObjectProxy] databaseRuleAddRule:newRule cleanSlate:NO reply:^{
+      if (state == RULESTATE_REMOVE) {
+        printf("Removed rule for SHA-256: %s.\n", [newRule.shasum UTF8String]);
+      } else {
+        printf("Added rule for SHA-256: %s.\n", [newRule.shasum UTF8String]);
+      }
+      exit(0);
  }];

 }
--- a/Source/santactl/status/SNTCommandStatus.m
+++ b/Source/santactl/status/SNTCommandStatus.m
@@ -41,6 +41,22 @@ REGISTER_COMMAND_NAME(@"status");
 }

 + (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+  // Daemon status
+  __block NSString *clientMode;
+  [[daemonConn remoteObjectProxy] clientMode:^(santa_clientmode_t cm) {
+      switch (cm) {
+        case CLIENTMODE_MONITOR:
+          clientMode = @"Monitor"; break;
+        case CLIENTMODE_LOCKDOWN:
+          clientMode = @"Lockdown"; break;
+        default:
+          clientMode = [NSString stringWithFormat:@"Unknown (%d)", cm]; break;
+      }
+  }];
+  do { usleep(5000); } while (!clientMode);
+  printf(">>> Daemon Info\n");
+  printf("  %-25s | %s\n", "Mode", [clientMode UTF8String]);
+
  // Kext status
  __block uint64_t cacheCount = -1;
  [[daemonConn remoteObjectProxy] cacheCount:^(uint64_t count) {
--- a/Source/santactl/sync/SNTAuthenticatingURLSession.m
+++ b/Source/santactl/sync/SNTAuthenticatingURLSession.m
@@ -68,13 +68,13 @@
  }

  if (![protectionSpace.protocol isEqual:NSURLProtectionSpaceHTTPS]) {
-    LOGD(@"Protection Space: %@ is not a secure protocol", protectionSpace.protocol);
+    LOGE(@"%@ is not a secure protocol", protectionSpace.protocol);
    completionHandler(NSURLSessionAuthChallengeRejectProtectionSpace, nil);
    return;
  }

  if (!protectionSpace.receivesCredentialSecurely) {
-    LOGD(@"Protection Space: secure authentication or protocol cannot be established.");
+    LOGE(@"Secure authentication or protocol cannot be established.");
    completionHandler(NSURLSessionAuthChallengeRejectProtectionSpace, nil);
    return;
  }
@@ -97,7 +97,7 @@
      completionHandler(NSURLSessionAuthChallengeUseCredential, cred);
      return;
    } else {
-      LOGE(@"Server asked for client authentication but no usable client certificate found.");
+      LOGE(@"Unable to verify server identity.");
      completionHandler(NSURLSessionAuthChallengeRejectProtectionSpace, nil);
      return;
    }
@@ -111,11 +111,11 @@
    willPerformHTTPRedirection:(NSHTTPURLResponse *)response
                    newRequest:(NSURLRequest *)request
             completionHandler:(void (^)(NSURLRequest *))completionHandler {
-  if (self.refusesRedirects) {
-    completionHandler(NULL);
-  } else {
-    completionHandler(request);
-  }
+    if (self.refusesRedirects) {
+      completionHandler(NULL);
+    } else {
+      completionHandler(request);
+    }
 }

 #pragma mark Private Helpers for URLSession:didReceiveChallenge:completionHandler:
@@ -142,7 +142,7 @@
    NSError *error;
    NSData *data = [NSData dataWithContentsOfFile:self.clientCertFile options:0 error:&error];
    if (error) {
-      LOGE(@"Client Trust: Couldn't open client certificate %@: %@",
+      LOGD(@"Client Trust: Couldn't open client certificate %@: %@",
           self.clientCertFile,
           [error localizedDescription]);
      return nil;
@@ -158,7 +158,7 @@
    NSArray *identities = CFBridgingRelease(cfIdentities);

    if (err != errSecSuccess) {
-      LOGE(@"Client Trust: Couldn't load client certificate %@: %d", self.clientCertFile, err);
+      LOGD(@"Client Trust: Couldn't load client certificate %@: %d", self.clientCertFile, err);
      return nil;
    }

@@ -181,56 +181,59 @@

    // Manually iterate through available identities to find one with an allowed issuer.
    [identities enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
-      SecIdentityRef identityRef = (__bridge SecIdentityRef)obj;
+        SecIdentityRef identityRef = (__bridge SecIdentityRef)obj;

-      SecCertificateRef certificate = NULL;
-      err = SecIdentityCopyCertificate(identityRef, &certificate);
-      if (err != errSecSuccess) {
-        LOGD(@"Client Trust: Failed to read certificate data: %d. Skipping identity.", (int)err);
-        return;
-      }
-
-      SNTCertificate *clientCert = [[SNTCertificate alloc] initWithSecCertificateRef:certificate];
-      CFRelease(certificate);
-
-      // Switch identity finding method depending on config
-      if (self.clientCertCommonName && clientCert.commonName) {
-        if ([clientCert.commonName compare:self.clientCertCommonName
-                                   options:NSCaseInsensitiveSearch] == NSOrderedSame) {
-          foundIdentity = identityRef;
-          CFRetain(foundIdentity);
-          *stop = YES;
-          return;  // return from enumeration block
+        SecCertificateRef certificate = NULL;
+        err = SecIdentityCopyCertificate(identityRef, &certificate);
+        if (err != errSecSuccess) {
+          LOGD(@"Client Trust: Failed to read certificate data: %d. Skipping identity.", (int)err);
+          return;
        }
-      } else if (self.clientCertIssuerCn && clientCert.issuerCommonName) {
-        if ([clientCert.issuerCommonName compare:self.clientCertIssuerCn
-                                         options:NSCaseInsensitiveSearch] == NSOrderedSame) {
-          foundIdentity = identityRef;
-          CFRetain(foundIdentity);
-          *stop = YES;
-          return;  // return from enumeration block
-        }
-      } else {
-        for (NSData *allowedIssuer in protectionSpace.distinguishedNames) {
-          SNTDERDecoder *decoder = [[SNTDERDecoder alloc] initWithData:allowedIssuer];
-          if (!decoder) continue;
-          if ([clientCert.issuerCommonName isEqual:decoder.commonName] &&
-              [clientCert.issuerCountryName isEqual:decoder.countryName] &&
-              [clientCert.issuerOrgName isEqual:decoder.organizationName] &&
-              [clientCert.issuerOrgUnit isEqual:decoder.organizationalUnit]) {

+        SNTCertificate *clientCert = [[SNTCertificate alloc] initWithSecCertificateRef:certificate];
+        CFRelease(certificate);
+
+        // Switch identity finding method depending on config
+        if (self.clientCertCommonName && clientCert.commonName) {
+          if ([clientCert.commonName compare:self.clientCertCommonName
+                                     options:NSCaseInsensitiveSearch] == NSOrderedSame) {
            foundIdentity = identityRef;
            CFRetain(foundIdentity);
            *stop = YES;
            return;  // return from enumeration block
          }
+        } else if (self.clientCertIssuerCn && clientCert.issuerCommonName) {
+          if ([clientCert.issuerCommonName compare:self.clientCertIssuerCn
+                                           options:NSCaseInsensitiveSearch] == NSOrderedSame) {
+            foundIdentity = identityRef;
+            CFRetain(foundIdentity);
+            *stop = YES;
+            return;  // return from enumeration block
+          }
+        } else {
+          for (NSData *allowedIssuer in protectionSpace.distinguishedNames) {
+            SNTDERDecoder *decoder = [[SNTDERDecoder alloc] initWithData:allowedIssuer];
+            if (!decoder) continue;
+            if ([clientCert.issuerCommonName isEqual:decoder.commonName] &&
+                [clientCert.issuerCountryName isEqual:decoder.countryName] &&
+                [clientCert.issuerOrgName isEqual:decoder.organizationName] &&
+                [clientCert.issuerOrgUnit isEqual:decoder.organizationalUnit]) {
+
+              foundIdentity = identityRef;
+              CFRetain(foundIdentity);
+              *stop = YES;
+              return;  // return from enumeration block
+            }
+          }
        }
-      }
    }];
  }

  if (foundIdentity) {
-    LOGD(@"Client Trust: Valid client identity %@.", foundIdentity);
+    SecCertificateRef certificate = NULL;
+    err = SecIdentityCopyCertificate(foundIdentity, &certificate);
+    SNTCertificate *clientCert = [[SNTCertificate alloc] initWithSecCertificateRef:certificate];
+    LOGD(@"Client Trust: Valid client identity %@.", clientCert);
    NSURLCredential *cred =
        [NSURLCredential credentialWithIdentity:foundIdentity
                                   certificates:nil
@@ -278,7 +281,7 @@
    // Set this array of certs as the anchors to trust.
    err = SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)certRefs);
    if (err != errSecSuccess) {
-      LOGE(@"Server Trust: Could not set anchor certificates: %d", err);
+      LOGD(@"Server Trust: Could not set anchor certificates: %d", err);
      return nil;
    }
  }
@@ -287,7 +290,7 @@
  SecTrustResultType result = kSecTrustResultInvalid;
  err = SecTrustEvaluate(serverTrust, &result);
  if (err != errSecSuccess) {
-    LOGE(@"Server Trust: Unable to evaluate certificate chain for server: %d", err);
+    LOGD(@"Server Trust: Unable to evaluate certificate chain for server: %d", err);
    return nil;
  }

@@ -301,7 +304,7 @@
  // Having a trust level "unspecified" by the user is the usual result, described at
  // https://developer.apple.com/library/mac/qa/qa1360
  if (result != kSecTrustResultProceed && result != kSecTrustResultUnspecified) {
-    LOGE(@"Server Trust: Server isn't trusted. SecTrustResultType: %d", result);
+    LOGD(@"Server Trust: Server isn't trusted. SecTrustResultType: %d", result);
    return nil;
  }

--- a/Source/santactl/sync/SNTCommandSync.m
+++ b/Source/santactl/sync/SNTCommandSync.m
@@ -20,7 +20,7 @@
 #import "SNTCommandSyncPostflight.h"
 #import "SNTCommandSyncPreflight.h"
 #import "SNTCommandSyncRuleDownload.h"
-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncState.h"
 #import "SNTConfigurator.h"
 #import "SNTDropRootPrivs.h"
 #import "SNTLogging.h"
@@ -30,7 +30,7 @@
@interface SNTCommandSync : NSObject<SNTCommand>
@property NSURLSession *session;
@property SNTXPCConnection *daemonConn;
-@property SNTCommandSyncStatus *progress;
+@property SNTCommandSyncState *syncState;
@end

@implementation SNTCommandSync
@@ -112,24 +112,26 @@ REGISTER_COMMAND_NAME(@"sync");
  s.daemonConn = daemonConn;

  // Gather some data needed during some sync stages
-  s.progress = [[SNTCommandSyncStatus alloc] init];
+  s.syncState = [[SNTCommandSyncState alloc] init];

-  s.progress.syncBaseURL = config.syncBaseURL;
-  if (!s.progress.syncBaseURL) {
+  s.syncState.syncBaseURL = config.syncBaseURL;
+  if (!s.syncState.syncBaseURL) {
    LOGE(@"Missing SyncBaseURL. Can't sync without it.");
    exit(1);
+  } else if (![s.syncState.syncBaseURL.scheme isEqual:@"https"]) {
+    LOGW(@"SyncBaseURL is not over HTTPS!");
  }
-  authURLSession.serverHostname = s.progress.syncBaseURL.host;
+  authURLSession.serverHostname = s.syncState.syncBaseURL.host;

-  s.progress.machineID = config.machineID;
-  if (!s.progress.machineID || [s.progress.machineID isEqual:@""]) {
+  s.syncState.machineID = config.machineID;
+  if ([s.syncState.machineID length] == 0) {
    LOGE(@"Missing Machine ID. Can't sync without it.");
    exit(1);
  }

-  s.progress.machineOwner = config.machineOwner;
-  if (!s.progress.machineOwner) {
-    s.progress.machineOwner = @"";
+  s.syncState.machineOwner = config.machineOwner;
+  if ([s.syncState.machineOwner length] == 0) {
+    s.syncState.machineOwner = @"";
    LOGW(@"Missing Machine Owner.");  
  }

@@ -142,12 +144,12 @@ REGISTER_COMMAND_NAME(@"sync");

 - (void)preflight {
  [SNTCommandSyncPreflight performSyncInSession:self.session
-                                       progress:self.progress
+                                      syncState:self.syncState
                                     daemonConn:self.daemonConn
                              completionHandler:^(BOOL success) {
      if (success) {
        LOGI(@"Preflight complete");
-        if (self.progress.uploadLogURL) {
+        if (self.syncState.uploadLogURL) {
          [self logUpload];
        } else {
          [self eventUpload];
@@ -161,7 +163,7 @@ REGISTER_COMMAND_NAME(@"sync");

 - (void)logUpload {
  [SNTCommandSyncLogUpload performSyncInSession:self.session
-                                       progress:self.progress
+                                      syncState:self.syncState
                                     daemonConn:self.daemonConn
                              completionHandler:^(BOOL success) {
      if (success) {
@@ -176,7 +178,7 @@ REGISTER_COMMAND_NAME(@"sync");

 - (void)eventUpload {
  [SNTCommandSyncEventUpload performSyncInSession:self.session
-                                         progress:self.progress
+                                        syncState:self.syncState
                                       daemonConn:self.daemonConn
                                completionHandler:^(BOOL success) {
      if (success) {
@@ -192,7 +194,7 @@ REGISTER_COMMAND_NAME(@"sync");
 - (void)eventUploadSingleEvent:(NSString *)sha256 {
  [SNTCommandSyncEventUpload uploadSingleEventWithSHA256:sha256
                                                 session:self.session
-                                                progress:self.progress
+                                               syncState:self.syncState
                                              daemonConn:self.daemonConn
                                       completionHandler:^(BOOL success) {
      if (success) {
@@ -207,7 +209,7 @@ REGISTER_COMMAND_NAME(@"sync");

 - (void)ruleDownload {
  [SNTCommandSyncRuleDownload performSyncInSession:self.session
-                                          progress:self.progress
+                                         syncState:self.syncState
                                        daemonConn:self.daemonConn
                                 completionHandler:^(BOOL success) {
      if (success) {
@@ -222,7 +224,7 @@ REGISTER_COMMAND_NAME(@"sync");

 - (void)postflight {
  [SNTCommandSyncPostflight performSyncInSession:self.session
-                                        progress:self.progress
+                                       syncState:self.syncState
                                      daemonConn:self.daemonConn
                               completionHandler:^(BOOL success) {
      if (success) {
--- a/Source/santactl/sync/SNTCommandSyncConstants.h
+++ b/Source/santactl/sync/SNTCommandSyncConstants.h
@@ -0,0 +1,79 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+extern NSString * const kURLPreflight;
+extern NSString * const kURLEventUpload;
+extern NSString * const kURLRuleDownload;
+extern NSString * const kURLPostflight;
+
+extern NSString * const kSerialNumber;
+extern NSString * const kHostname;
+extern NSString * const kSantaVer;
+extern NSString * const kOSVer;
+extern NSString * const kOSBuild;
+extern NSString * const kPrimaryUser;
+extern NSString * const kRequestCleanSync;
+extern NSString * const kBatchSize;
+extern NSString * const kUploadLogsURL;
+extern NSString * const kClientMode;
+extern NSString * const kClientModeMonitor;
+extern NSString * const kClientModeLockdown;
+extern NSString * const kCleanSync;
+
+extern NSString * const kEvents;
+extern NSString * const kFileSHA256;
+extern NSString * const kFilePath;
+extern NSString * const kFileName;
+extern NSString * const kExecutingUser;
+extern NSString * const kExecutionTime;
+extern NSString * const kDecision;
+extern NSString * const kDecisionAllowUnknown;
+extern NSString * const kDecisionAllowBinary;
+extern NSString * const kDecisionAllowCertificate;
+extern NSString * const kDecisionAllowScope;
+extern NSString * const kDecisionBlockUnknown;
+extern NSString * const kDecisionBlockBinary;
+extern NSString * const kDecisionBlockCertificate;
+extern NSString * const kDecisionBlockScope;
+extern NSString * const kDecisionUnknown;
+extern NSString * const kLoggedInUsers;
+extern NSString * const kCurrentSessions;
+extern NSString * const kFileBundleID;
+extern NSString * const kFileBundleName;
+extern NSString * const kFileBundleVersion;
+extern NSString * const kFileBundleShortVersionString;
+extern NSString * const kPID;
+extern NSString * const kPPID;
+extern NSString * const kSigningChain;
+extern NSString * const kCertSHA256;
+extern NSString * const kCertCN;
+extern NSString * const kCertOrg;
+extern NSString * const kCertOU;
+extern NSString * const kCertValidFrom;
+extern NSString * const kCertValidUntil;
+
+extern NSString * const kLogUploadField;
+
+extern NSString * const kRules;
+extern NSString * const kRuleSHA256;
+extern NSString * const kRulePolicy;
+extern NSString * const kRulePolicyWhitelist;
+extern NSString * const kRulePolicyBlacklist;
+extern NSString * const kRulePolicySilentBlacklist;
+extern NSString * const kRulePolicyRemove;
+extern NSString * const kRuleType;
+extern NSString * const kRuleTypeBinary;
+extern NSString * const kRuleTypeCertificate;
+extern NSString * const kRuleCustomMsg;
+extern NSString * const kCursor;
--- a/Source/santactl/sync/SNTCommandSyncConstants.m
+++ b/Source/santactl/sync/SNTCommandSyncConstants.m
@@ -0,0 +1,81 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncConstants.h"
+
+NSString * const kURLPreflight = @"preflight/";
+NSString * const kURLEventUpload = @"eventupload/";
+NSString * const kURLRuleDownload = @"ruledownload/";
+NSString * const kURLPostflight = @"postflight/";
+
+NSString * const kSerialNumber = @"serial_num";
+NSString * const kHostname = @"hostname";
+NSString * const kSantaVer = @"santa_version";
+NSString * const kOSVer = @"os_version";
+NSString * const kOSBuild = @"os_build";
+NSString * const kPrimaryUser = @"primary_user";
+NSString * const kRequestCleanSync = @"request_clean_sync";
+NSString * const kBatchSize = @"batch_size";
+NSString * const kUploadLogsURL = @"upload_logs_url";
+NSString * const kClientMode = @"client_mode";
+NSString * const kClientModeMonitor = @"MONITOR";
+NSString * const kClientModeLockdown = @"LOCKDOWN";
+NSString * const kCleanSync = @"clean_sync";
+
+NSString * const kEvents = @"events";
+NSString * const kFileSHA256 = @"file_sha256";
+NSString * const kFilePath = @"file_path";
+NSString * const kFileName = @"file_name";
+NSString * const kExecutingUser = @"executing_user";
+NSString * const kExecutionTime = @"execution_time";
+NSString * const kDecision = @"decision";
+NSString * const kDecisionAllowUnknown = @"ALLOW_UNKNOWN";
+NSString * const kDecisionAllowBinary = @"ALLOW_BINARY";
+NSString * const kDecisionAllowCertificate = @"ALLOW_CERTIFICATE";
+NSString * const kDecisionAllowScope = @"ALLOW_SCOPE";
+NSString * const kDecisionBlockUnknown = @"BLOCK_UNKNOWN";
+NSString * const kDecisionBlockBinary = @"BLOCK_BINARY";
+NSString * const kDecisionBlockCertificate = @"BLOCK_CERTIFICATE";
+NSString * const kDecisionBlockScope = @"BLOCK_SCOPE";
+NSString * const kDecisionUnknown = @"UNKNOWN";
+NSString * const kLoggedInUsers = @"logged_in_users";
+NSString * const kCurrentSessions = @"current_sessions";
+NSString * const kFileBundleID = @"file_bundle_id";
+NSString * const kFileBundleName = @"file_bundle_name";
+NSString * const kFileBundleVersion = @"file_bundle_version";
+NSString * const kFileBundleShortVersionString = @"file_bundle_version_string";
+NSString * const kPID = @"pid";
+NSString * const kPPID = @"ppid";
+NSString * const kSigningChain = @"signing_chain";
+NSString * const kCertSHA256 = @"sha256";
+NSString * const kCertCN = @"cn";
+NSString * const kCertOrg = @"org";
+NSString * const kCertOU = @"ou";
+NSString * const kCertValidFrom = @"valid_from";
+NSString * const kCertValidUntil = @"valid_until";
+
+NSString * const kLogUploadField = @"files";
+
+NSString * const kRules = @"rules";
+NSString * const kRuleSHA256 = @"sha256";
+NSString * const kRulePolicy = @"policy";
+NSString * const kRulePolicyWhitelist = @"WHITELIST";
+NSString * const kRulePolicyBlacklist = @"BLACKLIST";
+NSString * const kRulePolicySilentBlacklist = @"SILENT_BLACKLIST";
+NSString * const kRulePolicyRemove = @"REMOVE";
+NSString * const kRuleType = @"rule_type";
+NSString * const kRuleTypeBinary = @"BINARY";
+NSString * const kRuleTypeCertificate = @"CERTIFICATE";
+NSString * const kRuleCustomMsg = @"custom_msg";
+NSString * const kCursor = @"cursor";
--- a/Source/santactl/sync/SNTCommandSyncEventUpload.h
+++ b/Source/santactl/sync/SNTCommandSyncEventUpload.h
@@ -12,19 +12,19 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-@class SNTCommandSyncStatus;
+@class SNTCommandSyncState;
@class SNTXPCConnection;

@interface SNTCommandSyncEventUpload : NSObject

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler;

 + (void)uploadSingleEventWithSHA256:(NSString *)SHA256
                            session:(NSURLSession *)session
-                           progress:(SNTCommandSyncStatus *)progress
+                          syncState:(SNTCommandSyncState *)syncState
                         daemonConn:(SNTXPCConnection *)daemonConn
                  completionHandler:(void (^)(BOOL success))handler;

--- a/Source/santactl/sync/SNTCommandSyncEventUpload.m
+++ b/Source/santactl/sync/SNTCommandSyncEventUpload.m
@@ -17,7 +17,8 @@
 #include "SNTLogging.h"

 #import "SNTCertificate.h"
-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
 #import "SNTStoredEvent.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
@@ -25,11 +26,11 @@
@implementation SNTCommandSyncEventUpload

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[@"eventupload/" stringByAppendingString:progress.machineID]
-                      relativeToURL:progress.syncBaseURL];
+  NSURL *url = [NSURL URLWithString:[kURLEventUpload stringByAppendingString:syncState.machineID]
+                      relativeToURL:syncState.syncBaseURL];

  [[daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
      if ([events count] == 0) {
@@ -38,7 +39,7 @@
        [self uploadEventsFromArray:events
                              toURL:url
                          inSession:session
-                          batchSize:progress.eventBatchSize
+                          batchSize:syncState.eventBatchSize
                         daemonConn:daemonConn
                  completionHandler:handler];
      }
@@ -47,12 +48,12 @@

 + (void)uploadSingleEventWithSHA256:(NSString *)SHA256
                            session:(NSURLSession *)session
-                           progress:(SNTCommandSyncStatus *)progress
+                          syncState:(SNTCommandSyncState *)syncState
                         daemonConn:(SNTXPCConnection *)daemonConn
                  completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[@"eventupload/" stringByAppendingString:progress.machineID]
-                      relativeToURL:progress.syncBaseURL];
-  [[daemonConn remoteObjectProxy] databaseEventForSHA256:SHA256 withReply:^(SNTStoredEvent *event) {
+  NSURL *url = [NSURL URLWithString:[kURLEventUpload stringByAppendingString:syncState.machineID]
+                      relativeToURL:syncState.syncBaseURL];
+  [[daemonConn remoteObjectProxy] databaseEventForSHA256:SHA256 reply:^(SNTStoredEvent *event) {
      if (!event) {
        handler(YES);
        return;
@@ -83,7 +84,7 @@
    if (eventIds.count >= batchSize) break;
  }

-  NSDictionary *uploadReq = @{ @"events": uploadEvents };
+  NSDictionary *uploadReq = @{ kEvents: uploadEvents };

  NSData *requestBody;
  @try {
@@ -101,8 +102,11 @@
  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
                                                        NSURLResponse *response,
                                                        NSError *error) {
-      if ([(NSHTTPURLResponse *)response statusCode] != 200) {
-        LOGD(@"HTTP Response Code: %d", [(NSHTTPURLResponse *)response statusCode]);
+      long statusCode = [(NSHTTPURLResponse *)response statusCode];
+      if (statusCode != 200) {
+          LOGE(@"HTTP Response: %d %@",
+               statusCode,
+               [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
        handler(NO);
      } else {
        LOGI(@"Uploaded %d events", eventIds.count);
@@ -129,38 +133,53 @@
 #define ADDKEY(dict, key, value) if (value) dict[key] = value
  NSMutableDictionary *newEvent = [NSMutableDictionary dictionary];

-  ADDKEY(newEvent, @"file_sha256", event.fileSHA256);
-  ADDKEY(newEvent, @"file_path", [event.filePath stringByDeletingLastPathComponent]);
-  ADDKEY(newEvent, @"file_name", [event.filePath lastPathComponent]);
-  ADDKEY(newEvent, @"executing_user", event.executingUser);
-  ADDKEY(newEvent, @"execution_time", @([event.occurrenceDate timeIntervalSince1970]));
-  ADDKEY(newEvent, @"decision", @(event.decision));
-  ADDKEY(newEvent, @"logged_in_users", event.loggedInUsers);
-  ADDKEY(newEvent, @"current_sessions", event.currentSessions);
+  ADDKEY(newEvent, kFileSHA256, event.fileSHA256);
+  ADDKEY(newEvent, kFilePath, [event.filePath stringByDeletingLastPathComponent]);
+  ADDKEY(newEvent, kFileName, [event.filePath lastPathComponent]);
+  ADDKEY(newEvent, kExecutingUser, event.executingUser);
+  ADDKEY(newEvent, kExecutionTime, @([event.occurrenceDate timeIntervalSince1970]));
+  ADDKEY(newEvent, kLoggedInUsers, event.loggedInUsers);
+  ADDKEY(newEvent, kCurrentSessions, event.currentSessions);

-  ADDKEY(newEvent, @"file_bundle_id", event.fileBundleID);
-  ADDKEY(newEvent, @"file_bundle_name", event.fileBundleName);
-  ADDKEY(newEvent, @"file_bundle_version", event.fileBundleVersion);
-  ADDKEY(newEvent, @"file_bundle_version_string", event.fileBundleVersionString);
+  switch (event.decision) {
+    case EVENTSTATE_ALLOW_UNKNOWN: ADDKEY(newEvent, kDecision, kDecisionAllowUnknown); break;
+    case EVENTSTATE_ALLOW_BINARY: ADDKEY(newEvent, kDecision, kDecisionAllowBinary); break;
+    case EVENTSTATE_ALLOW_CERTIFICATE:
+      ADDKEY(newEvent, kDecision, kDecisionAllowCertificate);
+      break;
+    case EVENTSTATE_ALLOW_SCOPE: ADDKEY(newEvent, kDecision, kDecisionAllowScope); break;
+    case EVENTSTATE_BLOCK_UNKNOWN: ADDKEY(newEvent, kDecision, kDecisionBlockUnknown); break;
+    case EVENTSTATE_BLOCK_BINARY: ADDKEY(newEvent, kDecision, kDecisionBlockBinary); break;
+    case EVENTSTATE_BLOCK_CERTIFICATE:
+      ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);
+      break;
+    case EVENTSTATE_BLOCK_SCOPE: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
+    default: ADDKEY(newEvent, kDecision, kDecisionUnknown);
+  }

-  ADDKEY(newEvent, @"pid", event.pid);
-  ADDKEY(newEvent, @"ppid", event.ppid);
+  ADDKEY(newEvent, kFileBundleID, event.fileBundleID);
+  ADDKEY(newEvent, kFileBundleName, event.fileBundleName);
+  ADDKEY(newEvent, kFileBundleVersion, event.fileBundleVersion);
+  ADDKEY(newEvent, kFileBundleShortVersionString, event.fileBundleVersionString);
+
+  ADDKEY(newEvent, kPID, event.pid);
+  ADDKEY(newEvent, kPPID, event.ppid);

  NSMutableArray *signingChain = [NSMutableArray arrayWithCapacity:event.signingChain.count];
  for (int i = 0; i < event.signingChain.count; i++) {
    SNTCertificate *cert = [event.signingChain objectAtIndex:i];

    NSMutableDictionary *certDict = [NSMutableDictionary dictionary];
-    ADDKEY(certDict, @"sha256", cert.SHA256);
-    ADDKEY(certDict, @"cn", cert.commonName);
-    ADDKEY(certDict, @"org", cert.orgName);
-    ADDKEY(certDict, @"ou", cert.orgUnit);
-    ADDKEY(certDict, @"valid_from", @([cert.validFrom timeIntervalSince1970]));
-    ADDKEY(certDict, @"valid_until", @([cert.validUntil timeIntervalSince1970]));
+    ADDKEY(certDict, kCertSHA256, cert.SHA256);
+    ADDKEY(certDict, kCertCN, cert.commonName);
+    ADDKEY(certDict, kCertOrg, cert.orgName);
+    ADDKEY(certDict, kCertOU, cert.orgUnit);
+    ADDKEY(certDict, kCertValidFrom, @([cert.validFrom timeIntervalSince1970]));
+    ADDKEY(certDict, kCertValidUntil, @([cert.validUntil timeIntervalSince1970]));

    [signingChain addObject:certDict];
  }
-  newEvent[@"signing_chain"] = signingChain;
+  newEvent[kSigningChain] = signingChain;

  return newEvent;
 #undef ADDKEY
--- a/Source/santactl/sync/SNTCommandSyncLogUpload.h
+++ b/Source/santactl/sync/SNTCommandSyncLogUpload.h
@@ -12,13 +12,13 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-@class SNTCommandSyncStatus;
+@class SNTCommandSyncState;
@class SNTXPCConnection;

@interface SNTCommandSyncLogUpload : NSObject

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler;

--- a/Source/santactl/sync/SNTCommandSyncLogUpload.m
+++ b/Source/santactl/sync/SNTCommandSyncLogUpload.m
@@ -19,15 +19,16 @@
 #include "SNTCommonEnums.h"
 #include "SNTLogging.h"

-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"

@implementation SNTCommandSyncLogUpload

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = progress.uploadLogURL;
+  NSURL *url = syncState.uploadLogURL;
  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
  [req setHTTPMethod:@"POST"];
  NSString *boundary = @"----santa-sync-upload-boundary";
@@ -45,8 +46,8 @@
        [[NSString stringWithFormat:@"--%@\r\n", boundary] dataUsingEncoding:NSUTF8StringEncoding]];
    [reqBody appendData:
        [[NSString stringWithFormat:@"Content-Disposition: form-data; "
-            @"name=\"files\"; "
-            @"filename=\"%@.gz\"\r\n", [log lastPathComponent]]
+            @"name=\"%@\"; "
+            @"filename=\"%@.gz\"\r\n", kLogUploadField, [log lastPathComponent]]
         dataUsingEncoding:NSUTF8StringEncoding]];
    [reqBody appendData:
        [@"Content-Type: application/x-gzip\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]];
@@ -60,8 +61,11 @@
  [[session uploadTaskWithRequest:req
                         fromData:reqBody
                completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
-      if ([(NSHTTPURLResponse *)response statusCode] != 200) {
-        LOGD(@"HTTP Response Code: %d", [(NSHTTPURLResponse *)response statusCode]);
+      long statusCode = [(NSHTTPURLResponse *)response statusCode];
+      if (statusCode != 200) {
+        LOGE(@"HTTP Response: %d %@",
+             statusCode,
+             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
        handler(NO);
      } else {
        LOGI(@"Uploaded %d logs", [logsToUpload count]);
--- a/Source/santactl/sync/SNTCommandSyncPostflight.h
+++ b/Source/santactl/sync/SNTCommandSyncPostflight.h
@@ -12,13 +12,13 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-@class SNTCommandSyncStatus;
+@class SNTCommandSyncState;
@class SNTXPCConnection;

@interface SNTCommandSyncPostflight : NSObject

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler;

--- a/Source/santactl/sync/SNTCommandSyncPostflight.m
+++ b/Source/santactl/sync/SNTCommandSyncPostflight.m
@@ -16,28 +16,32 @@

 #include "SNTLogging.h"

-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"

@implementation SNTCommandSyncPostflight

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[@"postflight/" stringByAppendingString:progress.machineID]
-                      relativeToURL:progress.syncBaseURL];
+  NSURL *url = [NSURL URLWithString:[kURLPostflight stringByAppendingString:syncState.machineID]
+                      relativeToURL:syncState.syncBaseURL];
  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
  [req setHTTPMethod:@"POST"];

  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
                                                        NSURLResponse *response,
                                                        NSError *error) {
-    if ([(NSHTTPURLResponse *)response statusCode] != 200) {
-      LOGD(@"HTTP Response Code: %d", [(NSHTTPURLResponse *)response statusCode]);
-      handler(NO);
-    } else {
-      handler(YES);
-    }
+      long statusCode = [(NSHTTPURLResponse *)response statusCode];
+      if (statusCode != 200) {
+        LOGE(@"HTTP Response: %d %@",
+             statusCode,
+             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+        handler(NO);
+      } else {
+        handler(YES);
+      }
  }] resume];
 }

--- a/Source/santactl/sync/SNTCommandSyncPreflight.h
+++ b/Source/santactl/sync/SNTCommandSyncPreflight.h
@@ -12,13 +12,13 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-@class SNTCommandSyncStatus;
+@class SNTCommandSyncState;
@class SNTXPCConnection;

@interface SNTCommandSyncPreflight : NSObject

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler;

--- a/Source/santactl/sync/SNTCommandSyncPreflight.m
+++ b/Source/santactl/sync/SNTCommandSyncPreflight.m
@@ -17,7 +17,8 @@
 #include "SNTKernelCommon.h"
 #include "SNTLogging.h"

-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
 #import "SNTSystemInfo.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
@@ -25,20 +26,23 @@
@implementation SNTCommandSyncPreflight

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[@"preflight/" stringByAppendingString:progress.machineID]
-                      relativeToURL:progress.syncBaseURL];
+  NSURL *url = [NSURL URLWithString:[kURLPreflight stringByAppendingString:syncState.machineID]
+                      relativeToURL:syncState.syncBaseURL];

  NSMutableDictionary *requestDict = [NSMutableDictionary dictionary];
-  requestDict[@"serial_no"] = [SNTSystemInfo serialNumber];
-  requestDict[@"hostname"] = [SNTSystemInfo shortHostname];
-  requestDict[@"santa_version"] =
-      [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
-  requestDict[@"os_version"] = [SNTSystemInfo osVersion];
-  requestDict[@"os_build"] = [SNTSystemInfo osBuild];
-  requestDict[@"primary_user"] = progress.machineOwner;
+  requestDict[kSerialNumber] = [SNTSystemInfo serialNumber];
+  requestDict[kHostname] = [SNTSystemInfo shortHostname];
+  requestDict[kSantaVer] = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
+  requestDict[kOSVer] = [SNTSystemInfo osVersion];
+  requestDict[kOSBuild] = [SNTSystemInfo osBuild];
+  requestDict[kPrimaryUser] = syncState.machineOwner;
+
+  if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--clean"]) {
+    requestDict[kRequestCleanSync] = @YES;
+  }

  NSData *requestBody = [NSJSONSerialization dataWithJSONObject:requestDict
                                                        options:0
@@ -53,17 +57,25 @@
                                                        NSError *error) {
      long statusCode = [(NSHTTPURLResponse *)response statusCode];
      if (statusCode != 200) {
-        LOGD(@"HTTP Response: %@",
+        LOGE(@"HTTP Response: %d %@",
+             statusCode,
             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
        handler(NO);
      } else {
        NSDictionary *r = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];

-        progress.eventBatchSize = [r[@"batch_size"] intValue];
-        progress.uploadLogURL = [NSURL URLWithString:r[@"upload_logs_url"]];
+        syncState.eventBatchSize = [r[kBatchSize] intValue];
+        syncState.uploadLogURL = [NSURL URLWithString:r[kUploadLogsURL]];

-        if (r[@"client_mode"]) {
-          [[daemonConn remoteObjectProxy] setClientMode:[r[@"client_mode"] intValue] withReply:^{}];
+        if ([r[kClientMode] isEqual:kClientModeMonitor]) {
+            [[daemonConn remoteObjectProxy] setClientMode:CLIENTMODE_MONITOR reply:^{}];
+        } else if ([r[kClientMode] isEqual:kClientModeLockdown]) {
+            [[daemonConn remoteObjectProxy] setClientMode:CLIENTMODE_LOCKDOWN reply:^{}];
+        }
+
+        if ([r[kCleanSync] boolValue]) {
+          syncState.cleanSync = YES;
+          LOGD(@"Clean sync requested by server");
        }

        handler(YES);
--- a/Source/santactl/sync/SNTCommandSyncRuleDownload.h
+++ b/Source/santactl/sync/SNTCommandSyncRuleDownload.h
@@ -12,13 +12,13 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-@class SNTCommandSyncStatus;
+@class SNTCommandSyncState;
@class SNTXPCConnection;

@interface SNTCommandSyncRuleDownload : NSObject

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler;

--- a/Source/santactl/sync/SNTCommandSyncRuleDownload.m
+++ b/Source/santactl/sync/SNTCommandSyncRuleDownload.m
@@ -14,7 +14,8 @@

 #import "SNTCommandSyncRuleDownload.h"

-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
 #import "SNTRule.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
@@ -24,15 +25,15 @@
@implementation SNTCommandSyncRuleDownload

 + (void)performSyncInSession:(NSURLSession *)session
-                    progress:(SNTCommandSyncStatus *)progress
+                   syncState:(SNTCommandSyncState *)syncState
                  daemonConn:(SNTXPCConnection *)daemonConn
           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[@"ruledownload/" stringByAppendingString:progress.machineID]
-                      relativeToURL:progress.syncBaseURL];
+  NSURL *url = [NSURL URLWithString:[kURLRuleDownload stringByAppendingString:syncState.machineID]
+                      relativeToURL:syncState.syncBaseURL];
  [self ruleDownloadWithCursor:nil
                           url:url
                       session:session
-                      progress:progress
+                     syncState:syncState
                    daemonConn:daemonConn
             completionHandler:handler];
 }
@@ -40,14 +41,14 @@
 + (void)ruleDownloadWithCursor:(NSString *)cursor
                           url:(NSURL *)url
                       session:(NSURLSession *)session
-                      progress:(SNTCommandSyncStatus *)progress
+                     syncState:(SNTCommandSyncState *)syncState
                    daemonConn:(SNTXPCConnection *)daemonConn
             completionHandler:(void (^)(BOOL success))handler {

-  NSDictionary *requestDict = (cursor ? @{ @"cursor": cursor } : @{});
+  NSDictionary *requestDict = (cursor ? @{ kCursor: cursor } : @{});

-  if (!progress.downloadedRules) {
-    progress.downloadedRules = [NSMutableArray array];
+  if (!syncState.downloadedRules) {
+    syncState.downloadedRules = [NSMutableArray array];
  }

  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
@@ -69,52 +70,54 @@
          handler(NO);
        }

-        NSArray *receivedRules = resp[@"rules"];
+        NSArray *receivedRules = resp[kRules];
        for (NSDictionary *rule in receivedRules) {
          if (![rule isKindOfClass:[NSDictionary class]]) continue;

          SNTRule *newRule = [[SNTRule alloc] init];
-          newRule.shasum = rule[@"sha256"];
+          newRule.shasum = rule[kRuleSHA256];

-          if ([rule[@"policy"] isEqual:@"WHITELIST"]) {
+          if ([rule[kRulePolicy] isEqual:kRulePolicyWhitelist]) {
            newRule.state = RULESTATE_WHITELIST;
-          } else if ([rule[@"policy"] isEqual:@"BLACKLIST"]) {
+          } else if ([rule[kRulePolicy] isEqual:kRulePolicyBlacklist]) {
            newRule.state = RULESTATE_BLACKLIST;
-          } else if ([rule[@"policy"] isEqual:@"SILENT_BLACKLIST"]) {
+          } else if ([rule[kRulePolicy] isEqual:kRulePolicySilentBlacklist]) {
            newRule.state = RULESTATE_SILENT_BLACKLIST;
-          } else if ([rule[@"policy"] isEqual:@"REMOVE"]) {
+          } else if ([rule[kRulePolicy] isEqual:kRulePolicyRemove]) {
            newRule.state = RULESTATE_REMOVE;
          } else {
            continue;
          }

-          if ([rule[@"rule_type"] isEqual:@"BINARY"]) {
+          if ([rule[kRuleType] isEqual:kRuleTypeBinary]) {
            newRule.type = RULETYPE_BINARY;
-          } else if ([rule[@"rule_type"] isEqual:@"CERTIFICATE"]) {
+          } else if ([rule[kRuleType] isEqual:kRuleTypeCertificate]) {
            newRule.type = RULETYPE_CERT;
          } else {
            continue;
          }

-          NSString *customMsg = rule[@"custom_msg"];
+          NSString *customMsg = rule[kRuleCustomMsg];
          if (customMsg) {
            newRule.customMsg = customMsg;
          }

-          [progress.downloadedRules addObject:newRule];
+          [syncState.downloadedRules addObject:newRule];
        }

-        if (resp[@"cursor"]) {
-          [self ruleDownloadWithCursor:resp[@"cursor"]
+        if (resp[kCursor]) {
+          [self ruleDownloadWithCursor:resp[kCursor]
                                   url:url
                               session:session
-                              progress:progress
+                             syncState:syncState
                            daemonConn:daemonConn
                     completionHandler:handler];
        } else {
-          [[daemonConn remoteObjectProxy] databaseRuleAddRules:progress.downloadedRules withReply:^{
-              if (progress.downloadedRules.count) {
-                LOGI(@"Added %d rule(s)", progress.downloadedRules.count);
+          [[daemonConn remoteObjectProxy] databaseRuleAddRules:syncState.downloadedRules
+                                                    cleanSlate:syncState.cleanSync
+                                                         reply:^{
+              if (syncState.downloadedRules.count) {
+                LOGI(@"Added %d rule(s)", syncState.downloadedRules.count);
              }
              handler(YES);
          }];
--- a/Source/santactl/sync/SNTCommandSyncStatus.h
+++ b/Source/santactl/sync/SNTCommandSyncStatus.h
@@ -14,7 +14,7 @@

 /// An instance of this class is passed to each stage of the sync process for storing data
 /// that might be needed in later stages.
-@interface SNTCommandSyncStatus : NSObject
+@interface SNTCommandSyncState : NSObject

 /// The base API URL
@property NSURL *syncBaseURL;
@@ -23,6 +23,10 @@
@property NSString *machineID;
@property NSString *machineOwner;

+/// Clean sync flag, sent from server. If True, all existing rules
+/// should be deleted before inserting any new rules.
+@property BOOL cleanSync;
+
 /// Batch size for uploading events, sent from server
@property int32_t eventBatchSize;

--- a/Source/santactl/sync/SNTCommandSyncStatus.m
+++ b/Source/santactl/sync/SNTCommandSyncStatus.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTCommandSyncStatus.h"
+#import "SNTCommandSyncState.h"

-@implementation SNTCommandSyncStatus
+@implementation SNTCommandSyncState
@end
--- a/Source/santad/SNTApplication.m
+++ b/Source/santad/SNTApplication.m
@@ -13,6 +13,7 @@
 ///    limitations under the License.

 #include <pwd.h>
+#include <sys/stat.h>
 #include <sys/types.h>

 #import "SNTApplication.h"
@@ -26,6 +27,7 @@
 #import "SNTDriverManager.h"
 #import "SNTEventTable.h"
 #import "SNTExecutionController.h"
+#import "SNTFileWatcher.h"
 #import "SNTRuleTable.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
@@ -35,6 +37,7 @@
@property SNTDriverManager *driverManager;
@property SNTEventTable *eventTable;
@property SNTExecutionController *execController;
+@property SNTFileWatcher *configFileWatcher;
@property SNTRuleTable *ruleTable;
@property SNTXPCConnection *controlConnection;
@property SNTXPCConnection *notifierConnection;
@@ -82,6 +85,15 @@
        [[SNTDaemonControlController alloc] initWithDriverManager:_driverManager];
    [_controlConnection resume];

+    _configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
+                                                          handler:^{
+        [[SNTConfigurator configurator] reloadConfigData];
+
+        // Ensure config file remains root:wheel 0644
+        chown([kDefaultConfigFilePath fileSystemRepresentation], 0, 0);
+        chmod([kDefaultConfigFilePath fileSystemRepresentation], 0644);
+    }];
+
    // Initialize the binary checker object
    _execController = [[SNTExecutionController alloc] initWithDriverManager:_driverManager
                                                                  ruleTable:_ruleTable
--- a/Source/santad/SNTDaemonControlController.m
+++ b/Source/santad/SNTDaemonControlController.m
@@ -50,16 +50,16 @@
  reply([rdb binaryRuleCount], [rdb certificateRuleCount]);
 }

- (void)databaseRuleAddRule:(SNTRule *)rule withReply:(void (^)())reply {
-  [self databaseRuleAddRules:@[ rule ] withReply:reply];
+- (void)databaseRuleAddRule:(SNTRule *)rule cleanSlate:(BOOL)cleanSlate reply:(void (^)())reply {
+  [self databaseRuleAddRules:@[ rule ] cleanSlate:cleanSlate reply:reply];
 }

- (void)databaseRuleAddRules:(NSArray *)rules withReply:(void (^)())reply {
-  [[SNTDatabaseController ruleTable] addRules:rules];
+- (void)databaseRuleAddRules:(NSArray *)rules cleanSlate:(BOOL)cleanSlate reply:(void (^)())reply {
+  [[SNTDatabaseController ruleTable] addRules:rules cleanSlate:cleanSlate];

  // If any rules were added that were not whitelist, flush cache.
  NSPredicate *p = [NSPredicate predicateWithFormat:@"SELF.state != %d", RULESTATE_WHITELIST];
-  if ([rules filteredArrayUsingPredicate:p].count) {
+  if ([rules filteredArrayUsingPredicate:p].count || cleanSlate) {
    LOGI(@"Received non-whitelist rule, flushing cache");
    [self.driverManager flushCache];
  }
@@ -71,7 +71,7 @@
  reply([[SNTDatabaseController eventTable] pendingEventsCount]);
 }

- (void)databaseEventForSHA256:(NSString *)sha256 withReply:(void (^)(SNTStoredEvent *))reply {
+- (void)databaseEventForSHA256:(NSString *)sha256 reply:(void (^)(SNTStoredEvent *))reply {
  reply([[SNTDatabaseController eventTable] pendingEventForSHA256:sha256]);
 }

@@ -89,7 +89,7 @@
  reply([[SNTConfigurator configurator] clientMode]);
 }

- (void)setClientMode:(santa_clientmode_t)mode withReply:(void (^)())reply {
+- (void)setClientMode:(santa_clientmode_t)mode reply:(void (^)())reply {
  [[SNTConfigurator configurator] setClientMode:mode];
  reply();
 }
--- a/Source/santad/SNTDatabaseController.m
+++ b/Source/santad/SNTDatabaseController.m
@@ -28,13 +28,13 @@ static NSString * const kEventsDatabaseName = @"events.db";
  static FMDatabaseQueue *eventDatabaseQueue = nil;
  static dispatch_once_t eventDatabaseToken;
  dispatch_once(&eventDatabaseToken, ^{
-    [self createDatabasePath];
-    NSString *fullPath = [kDatabasePath stringByAppendingPathComponent:kEventsDatabaseName];
-    eventDatabaseQueue = [[FMDatabaseQueue alloc] initWithPath:fullPath];
+      [self createDatabasePath];
+      NSString *fullPath = [kDatabasePath stringByAppendingPathComponent:kEventsDatabaseName];
+      eventDatabaseQueue = [[FMDatabaseQueue alloc] initWithPath:fullPath];

-#ifndef DEBUG
-    [eventDatabaseQueue inDatabase:^(FMDatabase *db) {
-      db.logsErrors = NO;
+  #ifndef DEBUG
+      [eventDatabaseQueue inDatabase:^(FMDatabase *db) {
+          db.logsErrors = NO;
    }];
 #endif
  });
@@ -46,13 +46,13 @@ static NSString * const kEventsDatabaseName = @"events.db";
  static FMDatabaseQueue *ruleDatabaseQueue = nil;
  static dispatch_once_t ruleDatabaseToken;
  dispatch_once(&ruleDatabaseToken, ^{
-    [self createDatabasePath];
-    NSString *fullPath = [kDatabasePath stringByAppendingPathComponent:kRulesDatabaseName];
-    ruleDatabaseQueue = [[FMDatabaseQueue alloc] initWithPath:fullPath];
+      [self createDatabasePath];
+      NSString *fullPath = [kDatabasePath stringByAppendingPathComponent:kRulesDatabaseName];
+      ruleDatabaseQueue = [[FMDatabaseQueue alloc] initWithPath:fullPath];

-#ifndef DEBUG
-    [ruleDatabaseQueue inDatabase:^(FMDatabase *db) {
-      db.logsErrors = NO;
+  #ifndef DEBUG
+      [ruleDatabaseQueue inDatabase:^(FMDatabase *db) {
+          db.logsErrors = NO;
    }];
 #endif
  });
--- a/Source/santad/SNTDatabaseTable.m
+++ b/Source/santad/SNTDatabaseTable.m
@@ -47,7 +47,6 @@
 /// database exists and uses the latest schema.
 - (void)updateTableSchema {
  [self inTransaction:^(FMDatabase *db, BOOL *rollback) {
-
      int currentVersion = [db userVersion];
      int newVersion = [self initializeDatabase:db fromVersion:currentVersion];
      if (newVersion < 1) return;
--- a/Source/santad/SNTExecutionController.m
+++ b/Source/santad/SNTExecutionController.m
@@ -308,12 +308,12 @@
      sessionName = [NSString stringWithFormat:@"%s@%s", nxt->ut_user, nxt->ut_line];
    }

-    if (userName && ![userName isEqual:@""]) {
-      loggedInUsers[userName] = @"";
+    if ([userName length] > 0) {
+      loggedInUsers[userName] = [NSNull null];
    }

-    if (sessionName && ![sessionName isEqual:@":"]) {
-      loggedInHosts[sessionName] = @"";
+    if ([sessionName length] > 1) {
+      loggedInHosts[sessionName] = [NSNull null];
    }
  }

--- a/Source/santad/SNTRuleTable.h
+++ b/Source/santad/SNTRuleTable.h
@@ -54,8 +54,9 @@
 ///  transaction will abort if any rule fails to add.
 ///
 ///  @param rules Array of SNTRule's to add.
+///  @param cleanslate If true, remove all rules before adding the new rules.
 ///  @return YES if all rules were added successfully.
 ///
- (BOOL)addRules:(NSArray *)rules;
+- (BOOL)addRules:(NSArray *)rules cleanSlate:(BOOL)cleanSlate;

@end
--- a/Source/santad/SNTRuleTable.m
+++ b/Source/santad/SNTRuleTable.m
@@ -119,10 +119,14 @@

 #pragma mark Adding

- (BOOL)addRules:(NSArray *)rules {
+- (BOOL)addRules:(NSArray *)rules cleanSlate:(BOOL)cleanSlate {
  __block BOOL failed = NO;

  [self inTransaction:^(FMDatabase *db, BOOL *rollback) {
+      if (cleanSlate) {
+        [db executeUpdate:@"DELETE FROM rules"];
+      }
+
      for (SNTRule *rule in rules) {
        if (![rule isKindOfClass:[SNTRule class]] ||
            !rule.shasum || rule.shasum.length == 0 ||
--- a/Tests/LogicTests/SNTExecutionControllerTest.m
+++ b/Tests/LogicTests/SNTExecutionControllerTest.m
@@ -55,6 +55,7 @@

  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
+  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);

  self.mockDriverManager = OCMClassMock([SNTDriverManager class]);

--- a/Tests/LogicTests/SNTFileWatcherTest.m
+++ b/Tests/LogicTests/SNTFileWatcherTest.m
@@ -0,0 +1,132 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#import "SNTFileWatcher.h"
+
+@interface SNTFileWatcherTest : XCTestCase
+@property NSFileManager *fm;
+@property NSString *file;
+@end
+
+@implementation SNTFileWatcherTest
+
+- (void)setUp {
+  [super setUp];
+
+  self.fm = [NSFileManager defaultManager];
+  self.file = @"/tmp/SNTFileWatcherTest_File";
+  [self createFile];
+  usleep(10000);
+}
+
+- (void)tearDown {
+  [self deleteFile];
+  usleep(10000);
+
+  [super tearDown];
+}
+
+- (void)createFile {
+  [self.fm createFileAtPath:self.file contents:nil attributes:nil];
+}
+
+- (void)deleteFile {
+  [self.fm removeItemAtPath:self.file error:NULL];
+}
+
+- (void)testPlainInit {
+  XCTAssertThrows([[SNTFileWatcher alloc] init]);
+}
+
+- (void)testInitFileExists {
+  __weak XCTestExpectation *exp = [self expectationWithDescription:@"Init: callback called"];
+  __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
+                                                                  handler:^{
+      [exp fulfill];
+  }];
+  [self waitForExpectationsWithTimeout:5.0 handler:nil];
+}
+
+- (void)testInitNewFile {
+  [self deleteFile];
+
+  __weak XCTestExpectation *exp = [self expectationWithDescription:@"Init: callback called"];
+  __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
+                                                                  handler:^{
+      [exp fulfill];
+  }];
+
+  [self createFile];
+  [self waitForExpectationsWithTimeout:5.0 handler:nil];
+}
+
+- (void)testFileChanged {
+  __weak XCTestExpectation *exp = [self expectationWithDescription:@"Changed: callback called"];
+  __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
+                                                                  handler:^{
+      NSString *d = [NSString stringWithContentsOfFile:self.file
+                                              encoding:NSUTF8StringEncoding
+                                                 error:nil];
+      if ([d isEqual:@"0x8BADF00D"]) {
+        [exp fulfill];
+      }
+  }];
+
+  [[@"0x8BADF00D" dataUsingEncoding:NSUTF8StringEncoding] writeToFile:self.file atomically:NO];
+  [self waitForExpectationsWithTimeout:5.0 handler:nil];
+}
+
+- (void)testFileReplaced {
+  __weak XCTestExpectation *exp = [self expectationWithDescription:@"Replaced: callback called"];
+  __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
+                                                                  handler:^{
+      NSString *d = [NSString stringWithContentsOfFile:self.file
+                                              encoding:NSUTF8StringEncoding
+                                                 error:nil];
+      if ([d isEqual:@"0xFACEFEED"]) {
+        [exp fulfill];
+      }
+  }];
+
+  [[@"0xFACEFEED" dataUsingEncoding:NSUTF8StringEncoding] writeToFile:self.file atomically:YES];
+
+  [self waitForExpectationsWithTimeout:5.0 handler:nil];
+}
+
+- (void)testFileExtended {
+  int fd = open(self.file.fileSystemRepresentation, O_WRONLY);
+  write(fd, "0xDEAD", 6);
+
+  __weak XCTestExpectation *exp = [self expectationWithDescription:@"Extended: callback called"];
+  __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
+                                                                  handler:^{
+      int file = open(self.file.fileSystemRepresentation, O_RDONLY);
+      char fileData[10];
+      read(file, fileData, 10);
+
+      if (strncmp(fileData, "0xDEADBEEF", 10) == 0) {
+        [exp fulfill];
+      }
+  }];
+
+  write(fd, "BEEF", 4);
+  close(fd);
+
+  [self waitForExpectationsWithTimeout:5.0 handler:nil];
+}
+
+@end
+
Author	SHA1	Message	Date
Russell Hancox	437764e6fc	Conf: Undo adding Username/Groupname to santasync launchd, it doesn't work properly	2015-04-13 16:41:47 -04:00
Russell Hancox	460dd6aa8b	Project: Stop using xctool, use xcpretty to make xcodebuild output nice instead.	2015-04-10 16:37:24 -04:00
Russell Hancox	0a511468e3	Conf: Run scheduled santactl/sync runs as nobody	2015-04-10 16:06:56 -04:00
Russell Hancox	96517573e7	santactl/sync: rename SyncStatus->SyncState, add cleanSync option that can be requested by client or server.	2015-04-10 12:39:22 -04:00
Russell Hancox	c996921c22	GUI: Move window centering to the fadeIn method so it's only called when the window is displayed	2015-04-10 10:07:53 -04:00
Russell Hancox	8365e00a50	Sync: Decision should be uploaded as a string, not an int. Rename serial_no to serial_num	2015-04-09 10:02:21 -04:00
Russell Hancox	a629e6cff1	Clean-up: NSString length is quicker than isEqual	2015-04-09 10:01:44 -04:00
Russell Hancox	cbb786c6d1	Kext: Check fSharedMemory and fDataQueue before trying to release them in terminate()	2015-04-09 10:01:04 -04:00
Russell Hancox	49b169ec36	SNTFileWatcher: unset source event handler correctly	2015-04-08 14:22:24 -04:00
Russell Hancox	41d1d7e3de	SNTFileWatcher: fix some dispatch bugs, move eventHandler property to class extension, add tests.	2015-04-08 12:29:41 -04:00
Russell Hancox	323a38dc21	Project: Clean-up block style, order of public/private in C++ headers	2015-04-08 12:29:22 -04:00
Russell Hancox	c37f1eb006	SNTConfigurator: remove auto-reloading code, move to file watching class.	2015-04-08 12:28:58 -04:00
Russell Hancox	b7b2b5b630	santactl/status: Add daemon status, currently just the mode.	2015-04-01 16:15:35 -04:00
Russell Hancox	2486cfdcff	santactl/sync: Update logging	2015-04-01 16:15:14 -04:00
Russell Hancox	4231781178	Project: Update CocoaPods	2015-03-31 18:13:37 -04:00
Russell Hancox	7ba886ed18	SNTConfigurator: Fix broken MachineOwner parsing, part 2	2015-03-31 17:29:11 -04:00
Russell Hancox	8096701fbd	SNTConfigurator: Fix broken MachineID/MachineOwner parsing	2015-03-31 17:26:02 -04:00
Russell Hancox	16531d18c8	santa-driver: Kill daemon if PostToQueue is failing too much.	2015-03-31 16:14:32 -04:00
Russell Hancox	ef0cc2fffd	santactl/sync: Put constant API strings in a separate file	2015-03-31 15:56:47 -04:00
Russell Hancox	f2dc7fb4b0	SNTConfigurator: Only reject and re-save client mode in santad.	2015-03-31 15:49:49 -04:00
Russell Hancox	707e9a11d4	SantaGUI: Let background move window, part 2.	2015-03-31 12:20:43 -04:00