santad: Stop ignoring CSInfoPlistFailed (#204 )

It is too broad a check for the few false positive events we have seen.
sync: start reachability handler to retry to upload blocked event when initial upload fails (#202 )
2026-01-15 01:08:12 -05:00 · 2017-09-14 12:45:07 -04:00 · 2017-09-14 12:44:32 -04:00 · 2017-09-14 11:21:08 -04:00 · 2017-09-08 09:18:13 -04:00 · 2017-09-05 15:35:35 -04:00
104 changed files with 4917 additions and 1232 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 .DS_Store
 Build
 santa-*
+!*.md
 Pods
 Santa.xcodeproj/xcuserdata
 Santa.xcodeproj/project.xcworkspace
--- a/Conf/com.google.santa.asl.conf
+++ b/Conf/com.google.santa.asl.conf
@@ -1,6 +1,6 @@
 # Copy this file to /etc/asl to log all messages from santa-driver to the log file
-> /var/log/santa.log format="[$((Time)(ISO8601Z.3))] $Message" mode=0644 rotate=seq compress file_max=25M all_max=100M uid=0 gid=0
+> /var/db/santa/santa.log format="[$((Time)(ISO8601Z.3))] $Message" mode=0644 rotate=seq compress file_max=25M all_max=100M uid=0 gid=0
 ? [= Sender kernel] [S= Message santa-driver:] claim
-? [= Sender kernel] [S= Message santa-driver:] file /var/log/santa.log
+? [= Sender kernel] [S= Message santa-driver:] file /var/db/santa/santa.log
 ? [= Facility com.google.santa] claim
-? [= Facility com.google.santa] file /var/log/santa.log
+? [= Facility com.google.santa] file /var/db/santa/santa.log
--- a/Docs/deployment/configuration.md
+++ b/Docs/deployment/configuration.md
@@ -0,0 +1,113 @@
+# Configuration
+
+Two configuration methods can be used to control Santa: local configuration and a sync server controlled configuration. There are certain options that can only be controlled with a local configuration and others that can only be controlled with a sync server controlled configuration. Additionally, there are options that can be controlled by both.
+
+## Local Configuration
+
+| Key                           | Value Type | Description                              |
+| ----------------------------- | ---------- | ---------------------------------------- |
+| ClientMode*                   | Integer    | 1 = MONITOR, 2 = LOCKDOWN, defaults to MONITOR |
+| FileChangesRegex*             | String     | The regex of paths to log file changes. Regexes are specified in ICU format. |
+| WhitelistRegex*               | String     | A regex to whitelist if the binary or certificate scopes did not allow execution.  Regexes are specified in ICU format. |
+| BlacklistRegex*               | String     | A regex to blacklist if the binary or certificate scopes did not block an execution.  Regexes are specified in ICU format. |
+| EnablePageZeroProtection      | Bool       | Enable `__PAGEZERO` protection, defaults to YES. If this flag is set to YES, 32-bit binaries that are missing the `__PAGEZERO` segment will be blocked even in MONITOR mode, **unless** the binary is whitelisted by an explicit rule. |
+| MoreInfoURL                   | String     | The URL to open when the user clicks "More Info..." when opening Santa.app.  If unset, the button will not be displayed. |
+| EventDetailURL                | String     | See the [EventDetailURL](#eventdetailurl) section below. |
+| EventDetailText               | String     | Related to the above property, this string represents the text to show on the button. |
+| UnknownBlockMessage           | String     | In Lockdown mode this is the message shown to the user when an unknown binary is blocked. If this message is not configured a reasonable default is provided. |
+| BannedBlockMessage            | String     | This is the message shown to the user when a binary is blocked because of a rule if that rule doesn't provide a custom message. If this is not configured a reasonable  default is provided. |
+| ModeNotificationMonitor       | String     | The notification text to display when the client goes into Monitor mode. Defaults to "Switching into Monitor mode". |
+| ModeNotificationLockdown      | String     | The notification text to display when the client goes into Lockdown mode. Defaults to "Switching into Lockdown mode". |
+| SyncBaseURL*                  | String     | The base URL of the sync server.         |
+| ClientAuthCertificateFile     | String     | If set, this contains the location of a PKCS#12 certificate to be used for sync authentication. |
+| ClientAuthCertificatePassword | String     | Contains the password for the PKCS#12 certificate. |
+| ClientAuthCertificateCN       | String     | If set, this is the Common Name of a certificate in the System keychain to be used for sync authentication. The corresponding private key must also be in the keychain. |
+| ClientAuthCertificateIssuerCN | String     | If set, this is the Issuer Name of a certificate in the System keychain to be used for sync authentication. The corresponding private key must also be in the keychain. |
+| ServerAuthRootsData           | Data       | If set, this is valid PEM containing one or more certificates to be used to evaluate the server's SSL chain, overriding the list of trusted CAs distributed with the OS. |
+| ServerAuthRootsFile           | String     | The same as the above but is a path to a file on disk containing the PEM data. |
+| MachineOwner                  | String     | The machine owner.                       |
+| MachineID                     | String     | The machine ID.                          |
+| MachineOwnerPlist             | String     | The path to a plist that contains the MachineOwnerKey / value pair. |
+| MachineOwnerKey               | String     | The key to use on MachineOwnerPlist.     |
+| MachineIDPlist                | String     | The path to a plist that contains the MachineOwnerKey / value pair. |
+| MachineIDKey                  | String     | The key to use on MachineIDPlist.        |
+
+*protected keys: If a sync server is configured, this setting cannot be changed while santad is running as it is assumed the setting will be provided by the sync server.
+
+##### EventDetailURL
+
+When the user gets a block notification, a button can be displayed which will take them to a web page with more information about that event.
+
+This property contains a kind of format string to be turned into the URL to send them to. The following sequences will be replaced in the final URL:
+
+| Key          | Description                              |
+| ------------ | ---------------------------------------- |
+| %file_sha%   | SHA-256 of the file that was blocked     |
+| %machine_id% | ID of the machine                        |
+| %username%   | The executing user                       |
+| %bundle_id%  | Bundle ID of the binary, if applicable   |
+| %bundle_ver% | Bundle version of the binary, if applicable |
+
+For example: `https://sync-server-hostname/%machine_id%/%file_sha%`
+
+##### Example Config
+
+Here is an example of a configuration that could be set.
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>BannedBlockMessage</key>
+	<string>This application has been banned</string>
+	<key>ClientMode</key>
+	<integer>1</integer>
+	<key>EnablePageZeroProtection</key>
+	<false/>
+	<key>EventDetailText</key>
+	<string>Open sync server</string>
+	<key>EventDetailURL</key>
+	<string>https://sync-server-hostname/blockables/%file_sha%</string>
+	<key>FileChangesRegex</key>
+	<string>^/(?!(?:private/tmp|Library/(?:Caches|Managed Installs/Logs|(?:Managed )?Preferences))/)</string>
+	<key>MachineIDKey</key>
+	<string>MachineUUID</string>
+	<key>MachineIDPlist</key>
+	<string>/Library/Preferences/com.company.machine-mapping.plist</string>
+	<key>MachineOwnerKey</key>
+	<string>Owner</string>
+	<key>MachineOwnerPlist</key>
+	<string>/Library/Preferences/com.company.machine-mapping.plist</string>
+	<key>ModeNotificationLockdown</key>
+	<string>Entering Lockdown mode</string>
+	<key>ModeNotificationMonitor</key>
+	<string>Entering Monitor mode&lt;br/&gt;Please be careful!</string>
+	<key>MoreInfoURL</key>
+	<string>https://sync-server-hostname/moreinfo</string>
+	<key>SyncBaseURL</key>
+	<string>https://sync-server-hostname/api/santa/</string>
+	<key>UnknownBlockMessage</key>
+	<string>This application has been blocked from executing.</string>
+</dict>
+</plist>
+```
+
+## Sync server Provided Configuration
+
+| Key                            | Value Type | Description                              |
+| ------------------------------ | ---------- | ---------------------------------------- |
+| client_mode                    | String     | MONITOR or LOCKDOWN, defaults to MONITOR. |
+| clean_sync**                   | Bool       | If set to `True` Santa will clear all local rules and download a fresh copy from the sync-server. Defaults to `False`. |
+| batch_size                     | Integer    | The number of rules to download or events to upload per request. Multiple requests will be made if there is more work than can fit in single request. Defaults to 50. |
+| upload_logs_url**              | String     | If set, the endpoint to send Santa's current logs. No default. |
+| whitelist_regex                | String     | Same as the "Local Configuration" WhitelistRegex. No default. |
+| blacklist_regex                | String     | Same as the "Local Configuration" BlacklistRegex. No default. |
+| fcm_token*                     | String     | The FCM token used by Santa to listen for FCM messages. Unique for every machine. No default. |
+| fcm_full_sync_interval*        | Integer    | The full sync interval if a fcm_token is set. Defaults to  14400 secs (4 hours). |
+| fcm_global_rule_sync_deadline* | Integer    | The max time to wait before performing a rule sync when a global rule sync FCM message is received. This allows syncing to be staggered for global events to avoid spikes in server load. Defaults to 600 secs (10 min). |
+| bundles_enabled*               | Bool       | If set to `True` the bundle scanning feature is enabled. Defaults to `False`. |
+
+*Held only in memory. Not persistent upon process restart.
+
+**Performed once per preflight run (if set).
--- a/Docs/details/block.png
+++ b/Docs/details/block.png
--- a/Docs/details/events.md
+++ b/Docs/details/events.md
@@ -0,0 +1,141 @@
+# Events
+
+Events are a defined set of data, core to how Santa interacts with a sync server. Events are generated when there is a blocked `execve()` while in Lockdown or Monitor mode. Events are also generated in Monitor mode for an `execve()` that was allowed to run, but would have been blocked in Lockdown mode. This allows an admin to roll out Santa to their macOS fleet in Monitor mode but still collect meaningful data. The events collected while in Monitor mode can be used to build a reasonably comprehensive whitelist of signing certificates and binaries before switching the fleet to Lockdown mode.
+
+##### Event Data
+
+Events begin their life as an [SNTStoredEvent](https://github.com/google/santa/blob/master/Source/common/SNTStoredEvent.h) object. The SNTStoredEvent class is just a simple storage class that has properties for all the relevant bits of information. More importantly the class implements the [NSSecureCoding](https://developer.apple.com/documentation/foundation/nssecurecoding?language=objc) protocol. This allows the objects to be encoded and decoded for storage in the events sqlite3 database on disk and sent over XPC to another process.
+
+Events are temporarily stored in a database until they are uploaded. The format is subject the change; accessing the events database directly will most likely break in future releases. If direct access to the events database is required, raise a [issue on the Santa GitHub](https://github.com/google/santa/issues).
+
+###### JSON
+
+Before an event is uploaded to a sync server, the event data is copied into a JSON blob. Here is an example of Firefox being blocked and sent for upload:
+
+```json
+{
+  "events": [
+    {
+      "file_path": "/var/folders/l5/pd9rhsp54s79_9_qcy746_tw00b_4p/T/AppTranslocation/254C1357-7461-457B-B734-A0FDAF0F26D9/d/Firefox.app/Contents/MacOS",
+      "file_bundle_version": "5417.6.28",
+      "parent_name": "launchd",
+      "logged_in_users": [
+        "bur"
+      ],
+      "quarantine_timestamp": 0,
+      "signing_chain": [
+        {
+          "cn": "Developer ID Application: Mozilla Corporation (43AQ936H96)",
+          "valid_until": 1652123338,
+          "org": "Mozilla Corporation",
+          "valid_from": 1494270538,
+          "ou": "43AQ936H96",
+          "sha256": "96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b"
+        },
+        {
+          "cn": "Developer ID Certification Authority",
+          "valid_until": 1801519935,
+          "org": "Apple Inc.",
+          "valid_from": 1328134335,
+          "ou": "Apple Certification Authority",
+          "sha256": "7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f"
+        },
+        {
+          "cn": "Apple Root CA",
+          "valid_until": 2054670036,
+          "org": "Apple Inc.",
+          "valid_from": 1146001236,
+          "ou": "Apple Certification Authority",
+          "sha256": "b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024"
+        }
+      ],
+      "file_bundle_name": "Firefox",
+      "executing_user": "bur",
+      "ppid": 1,
+      "file_bundle_path": "/var/folders/l5/pd9rhsp54s79_9_qcy746_tw00b_4p/T/AppTranslocation/254C1357-7461-457B-B734-A0FDAF0F26D9/d/Firefox.app",
+      "file_name": "firefox",
+      "execution_time": 1501691337.059514,
+      "file_sha256": "dd78f456a0929faf5dcbb6d952992d900bfdf025e1e77af60f0b029f0b85bf09",
+      "decision": "BLOCK_BINARY",
+      "file_bundle_id": "org.mozilla.firefox",
+      "file_bundle_version_string": "54.0.1",
+      "pid": 49368,
+      "current_sessions": [
+        "bur@console",
+        "bur@ttys000",
+        "bur@ttys001",
+        "bur@ttys002",
+        "bur@ttys003",
+        "bur@ttys004"
+      ]
+    }
+  ]
+}
+```
+
+
+
+##### Event Lifecycle
+
+1. santad generates a new event
+2. santad compares, or adds if not present, the event's SHA-256 file hash to an in-memory cache with a timeout of 10 min. If an event with an matching hash is present in cache, the event is dropped.
+3. santad saves the event to `/var/db/santa/events.db` with a unique ID assigned as the key.
+4. santad sends an XPC message to the santactl daemon. The message contains the event with instructions to upload the event immediately. This is non-blocking and is performed on a background thread.
+
+##### Bundle Events
+
+Bundle events are a special type of event that are generated when a sync server supports receiving the associated bundle events, instead of just the original event. For example: `/Applications/Keynote.app/Contents/MacOS/Keynote` is blocked and an event representing the binary is uploaded. A whitelist rule is created for that one binary. Great, you can now run `/Applications/Keynote.app/Contents/MacOS/Keynote`, but what about all the other supporting binaries contained in the bundle? You would have to wait until they are executed until an event would be generated. It is very common for a bundle to contain multiple binaries, as shown here with Keynote.app. Waiting to get a block is not a very good user experience.
+
+```sh
+⇒  santactl bundleinfo /Applications/Keynote.app
+Hashing time: 1047 ms
+9 events found
+BundleHash: b475667ab1ab6eddea48bfc2bed76fcef89b8f85ed456c8068351292f7cb4806
+BundleID: com.apple.iWork.Keynote
+	SHA-256: be3aa404ee79c2af863132b93b0eedfdbc34c6e35d4fda2ade6dd637692ead84
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.MovieCompatibilityConverter.xpc/Contents/MacOS/com.apple.iWork.MovieCompatibilityConverter
+BundleID: com.apple.iWork.Keynote
+	SHA-256: 3b2582fd5e7652b653276b3980c248dc973e8082e9d0678c96a08d7d1a8366ba
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.PICTConverter.xpc/Contents/MacOS/com.apple.iWork.PICTConverter
+BundleID: com.apple.iWork.Keynote
+	SHA-256: f1bf3be05d511d7c7f651cf7b130d4977f8d28d0bfcd7c5de4144b95eaab7ad7
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.xpc/Contents/MacOS/com.apple.iWork.TCMovieExtractor
+BundleID: com.apple.iWork.Keynote
+	SHA-256: b59bc8548c91088a40d9023abb5d22fa8731b4aa17693fcb5b98c795607d219a
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.BitmapTracer.xpc/Contents/MacOS/com.apple.iWork.BitmapTracer
+BundleID: com.apple.iWork.Keynote
+	SHA-256: 08cb407f541d867f1a63dc3ae44eeedd5181ca06c61df6ef62b5dc7192951a4b
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.TCUtilities32.xpc/Contents/MacOS/com.apple.iWork.TCUtilities32
+BundleID: com.apple.iWork.Keynote
+	SHA-256: b965ae7be992d1ce818262752d0cf44297a88324a593c67278d78ca4d16fcc39
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.TCUtilities32.xpc/Contents/MacOS/com.apple.iWork.TCMovieExtractor.TCUtilities32
+BundleID: com.apple.iWork.Keynote
+	SHA-256: 59668dc27314f0f6f5daa5f02b564c176f64836c88e2dfe166e90548f47336f1
+	Path: /Applications/Keynote.app/Contents/MacOS/Keynote
+BundleID: com.apple.iWork.Keynote
+	SHA-256: 7ce324f919b14e14d327004b09f83ca81345fd4438c87ead4b699f89e9485595
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.ExternalResourceValidator.xpc/Contents/MacOS/com.apple.iWork.ExternalResourceValidator
+BundleID: com.apple.iWork.Keynote
+	SHA-256: 6b47f551565d886388eeec5e876b6de9cdd71ef36d43b0762e6ebf02bdd8515d
+	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/MacOS/com.apple.iWork.ExternalResourceAccessor
+```
+
+Bundle events provide a mechanism to generate and upload events for all the executable Mach-O binaries within a bundle. To enable bundle event generation a configuration must be set in the preflight sync stage on the sync server. Once set the sync server can use bundle events to drive a better user experience.
+
+Bundle events can be differentiated by the existence of these fields:
+
+| Field                    | Value                                    |
+| ------------------------ | ---------------------------------------- |
+| decision                 | BUNDLE_BINARY                            |
+| file_bundle_hash         | Super Hash of all binary hashes          |
+| file_bundle_hash_millis  | The time in milliseconds it took to find all of the binaries, hash and produce a super hash |
+| file_bundle_binary_count | Number of binaries within the bundle     |
+
+To avoid redundant uploads of a bundle event Santa will wait for the sync server to ask for them. The server will respond to event uploads with a request like this:
+
+| Field                        | Value                                    |
+| ---------------------------- | ---------------------------------------- |
+| event_upload_bundle_binaries | An array of bundle hashes that the sync server needs to be uploaded |
+
+When santactl receives this type of request, it sends an XPC reply to santad to save all the bundle events to the events.db. It then attempts to upload all the bundle events, purging the successes from the events.db. Any failures will be uploaded during the next full sync.
+
--- a/Docs/details/ipc.md
+++ b/Docs/details/ipc.md
@@ -0,0 +1,43 @@
+# Interprocess Communication (IPC)
+
+Most IPC within Santa is done by way of Apple's [XPC](https://developer.apple.com/documentation/xpc?language=objc). Santa wraps [NSXPCConnection](https://developer.apple.com/documentation/foundation/nsxpcconnection?language=objc) to provide client multiplexing, signature validation of connecting clients and forced connection establishment. This is called SNTXPCConnection.
+
+Communication between santad and santa-driver (KEXT) is done with a [IOUserClient](https://developer.apple.com/documentation/kernel/iouserclient?language=objc) subclass and IOKit/IOKitLib.h functions.
+
+##### Who starts who?
+
+The santad and Santa (GUI) processes are both started and kept alive by launchd as a LaunchDaemon and a LaunchAgent, respectively. This means santad runs as root and Santa (GUI) runs as the console user. 
+
+There can be multiple Santa (GUI) processes running, one per user logged into the GUI (assuming fast-user switching is enabled). While multiple processes might be running, only the one for the user currently logged-in will be connected to santad and receiving notifications.
+
+When using a sync server, the santactl process is started by santad. Before the new process starts, all privileges are dropped. santactl runs as _nobody_.
+
+The santabs process is started by launchd via an XPC service connection from santad. XPC services inherit their initiator's privileges meaning santabs runs as root, which is necessary to ensure it has permission to read all files.
+
+| Process  | Parent Process | Running User |
+| -------- | -------------- | ------------ |
+| santad   | launchd        | root         |
+| Santa    | launchd        | user         |
+| santactl | santad         | nobody       |
+| santabs  | launchd        | root         |
+
+
+
+##### Who communicates with who?
+
+In short, santad has two-way communication with every other process. In addition, Santa and santabs have two-way communication between each other. For other combinations, there is no direct communication.
+
+![Santa IPC](santa_ipc.png)
+
+##### SNTXPCConnection and two way communication
+
+`SNTXPCConnection` enforces a server / client model for XPC connections. This allows for strong signature validation and forced connection establishment. The only problem with this model is the lack of two-way communication. For example, process A can call methods on process B and retrieve a response, but process B cannot call methods on process A.
+
+To accomplish two-way communication, the following approach can be used:
+
+1. Process A creates a server with an anonymous `NSXPCListener`.
+2. Process A sends the anonymous `NSXPCListenerEndpoint` to process B over an already established `SNTXPCConnection`.
+3. Process B can now communicate directly with process A.
+
+This is a powerful notion. It enables forced connection establishment between both processes, which is critical when reliability is a concern.
+
--- a/Docs/details/logs.md
+++ b/Docs/details/logs.md
@@ -0,0 +1,30 @@
+# Logs
+
+Santa currently logs to `/var/db/santa/santa.log` by default. All executions and disk mounts are logged here. File operations can also be configured to be logged. See the `FileChangesRegex` key in the [configuration.md](../deployment/configuration.md) document.
+
+To view the logs:
+
+```sh
+tail -F /var/db/santa/santa.log
+```
+
+The `-F` will continue watching the path even when the current file fills up and rolls over.
+
+##### macOS Unified Logging System (ULS)
+
+Currently all of the most recent releases of Santa are built with the macOS 10.11 SDK. This allows Santa to continue to log to Apple System Logger (ASL) instead of ULS. However, on macOS 10.12+ all of the Kernel logs are sent to ULS. See the KEXT Logging section below for more details.
+
+If you are building Santa yourself and using the macOS 10.12+ SDKs, Santa's logs will be sent to ULS.
+
+Work is currently underway to bypass ASL and ULS altogether, allowing Santa to continue logging to `/var/db/santa/santa.log`. This change will also allow us to add alternative logging formats, like Protocol Buffer or JSON.
+
+##### KEXT Logging
+
+Streaming logs from the santa-driver KEXT does not work properly. Logs are generated but they will likely be garbled or show inaccurate data.
+
+Instead, `show` can be used to view the santa-driver KEXT logs:
+
+```sh
+/usr/bin/log show --info --debug --predicate 'senderImagePath == "/Library/Extensions/santa-driver.kext/Contents/MacOS/santa-driver"'
+```
+
--- a/Docs/details/mode.md
+++ b/Docs/details/mode.md
@@ -0,0 +1,62 @@
+# Mode
+
+Santa can run in one of two modes, Lockdown or Monitor. To check the current status run the following command:
+
+```sh
+⇒  santactl status
+>>> Daemon Info
+  Mode                      | Monitor
+  File Logging              | Yes
+  Watchdog CPU Events       | 0  (Peak: 13.59%)
+  Watchdog RAM Events       | 0  (Peak: 31.49MB)
+>>> Kernel Info
+  Root cache count          | 107
+  Non-root cache count      | 0
+>>> Database Info
+  Binary Rules              | 5
+  Certificate Rules         | 2
+  Events Pending Upload     | 0
+>>> Sync Info
+  Sync Server               | https://sync-server-hostname.com
+  Clean Sync Required       | No
+  Last Successful Full Sync | 2017/08/02 21:44:17 -0400
+  Last Successful Rule Sync | 2017/08/02 21:44:17 -0400
+  Push Notifications        | Connected
+  Bundle Scanning           | Yes
+```
+
+##### Monitor mode
+
+The default mode. Running Santa in Monitor Mode will stop any binaries matching blacklist rules, but will not stop unknown binaries from running. This is a flexible state, allowing virtually zero user interruption but still gives protection against known blacklisted binaries. In addition execution events that would have been blocked in Lockdown mode are generated and can be collected and analyzed by a sync server.
+
+##### Lockdown mode
+
+Running Santa in Lockdown Mode will stop all blacklisted binaries and additionally will prevent all unknown binaries from running. This means that if the binary has no rules or scopes that apply, then it will be blocked.
+
+##### Changing Modes
+
+There are two ways to change the running mode: changing the config.plist and with a sync server configuration.
+
+###### Change modes with the config.plist
+
+The `ClientMode` config key is protected while santad is running and will revert any attempt to change it.
+
+Change to Monitor mode:
+
+```sh
+sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist
+sudo defaults write /var/db/santa/config.plist ClientMode -int 1
+sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist
+```
+
+Change to Lockdown mode:
+
+```sh
+sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist
+sudo defaults write /var/db/santa/config.plist ClientMode -int 2
+sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist
+```
+
+######Change modes with a sync server
+
+The mode is set in the preflight sync stage. Use the key `client_mode` and a value of `MONITOR` or `LOCKDOWN`.
--- a/Docs/details/push.png
+++ b/Docs/details/push.png
--- a/Docs/details/rules.md
+++ b/Docs/details/rules.md
@@ -0,0 +1,104 @@
+# Rules
+
+Rules provide the primary evaluation mechanism for whitelisting and blacklisting binaries with Santa on macOS. There are two types of rules: binary and certificate.
+
+##### Binary Rules
+
+Binary rules use the SHA-256 hash of the entire binary as an identifier. This is the most specific rule in Santa. Even a small change in the binary will alter the SHA-256 hash, invalidating the rule.
+
+##### Certificate Rules
+
+Certificate rules are formed from the SHA-256 fingerprint of an X.509 leaf signing certificate. This is a powerful rule type that has a much broader reach than an individual binary rule . A signing certificate can sign any number of binaries. Whitelisting or blacklisting just a few key signing certificates can cover the bulk of an average user's binaries. The leaf signing certificate is the only part of the chain that is evaluated. Though the whole chain is available for viewing.
+
+```sh
+⇒  santactl fileinfo /Applications/Dropbox.app --key "Signing Chain"
+Signing Chain:
+     1. SHA-256             : 2a0417257348a20f96c9de0486b44fcc7eaeaeb7625b207591b8109698c02dd2
+        SHA-1               : 86ec91f726ba9caa09665b2109c49117f0b93134
+        Common Name         : Developer ID Application: Dropbox, Inc.
+        Organization        : Dropbox, Inc.
+        Organizational Unit : G7HH3F8CAK
+        Valid From          : 2012/06/19 16:10:30 -0400
+        Valid Until         : 2017/06/20 16:10:30 -0400
+
+     2. SHA-256             : 7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f
+        SHA-1               : 3b166c3b7dc4b751c9fe2afab9135641e388e186
+        Common Name         : Developer ID Certification Authority
+        Organization        : Apple Inc.
+        Organizational Unit : Apple Certification Authority
+        Valid From          : 2012/02/01 17:12:15 -0500
+        Valid Until         : 2027/02/01 17:12:15 -0500
+
+     3. SHA-256             : b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024
+        SHA-1               : 611e5b662c593a08ff58d14ae22452d198df6c60
+        Common Name         : Apple Root CA
+        Organization        : Apple Inc.
+        Organizational Unit : Apple Certification Authority
+        Valid From          : 2006/04/25 17:40:36 -0400
+        Valid Until         : 2035/02/09 16:40:36 -0500
+```
+
+If you wanted to whitelist or blacklist all software signed with this perticular Dropbox signing certificate you would use the leaf SHA-256 fingerprint.
+
+`2a0417257348a20f96c9de0486b44fcc7eaeaeb7625b207591b8109698c02dd2`
+
+Santa does not evaluate the `Valid From` or `Valid Until` fields, nor does it check the Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP) for revoked certificates. Adding rules for the certificate chain's intermediates or roots has no effect on binaries signing by a leaf. Santa ignores the chain and is only concerned with the leaf certificate's SHA-256 hash.
+
+##### Rule Evaluation
+
+When a process is trying to `execve()` santad retrieves information on the binary,  including a hash of the entire file and the signing chain (if any). The hash and signing leaf certificate are then passed through the [SNTPolicyProcessor](https://github.com/google/santa/blob/master/Source/santad/SNTPolicyProcessor.h). Rules are evaluated from most specific to least specific. First binary (either whitelist or blacklist), then certificate (either whitelist or blacklist). If no rules are found that apply, scopes are then searched. See the [scopes.md](scopes.md) document for more information on scopes.
+
+You can use the `santactl fileinfo` command to check the status of any given binary on the filesystem.
+
+###### Whitelisted with a Binary Rule 
+
+```sh
+⇒  santactl fileinfo /Applications/Hex\ Fiend.app --key Rule
+Whitelisted (Binary)
+```
+
+###### Whitelisted with a Certificate Rule
+
+```sh
+⇒  santactl fileinfo /Applications/Safari.app --key Rule
+Whitelisted (Certificate)
+```
+
+###### Blacklisted with a Binary Rule
+
+```sh
+⇒  santactl fileinfo /usr/bin/yes --key Rule
+Blacklisted (Binary)
+```
+
+###### Blacklisted with a Certificate Rule
+
+```sh
+⇒  santactl fileinfo /Applications/Malware.app --key Rule
+Blacklisted (Certificate)
+```
+
+You can also check arbitrary SHA-256 binary and certificate hashes for rules. The rule verb needs to be run with root privileges.
+
+For checking the SHA-256 hash of `/usr/bin/yes`:
+
+```sh
+sudo santactl rule --check --sha256 $(santactl fileinfo --key SHA-256 /usr/bin/yes)
+Blacklisted (Binary)
+```
+
+For checking the SHA-256 hash of `/usr/bin/yes ` signing certificate:
+
+```sh
+⇒  sudo santactl rule --check --certificate --sha256 $(santactl fileinfo --cert-index 1 --key SHA-256 /usr/bin/yes)
+Whitelisted (Certificate)
+```
+
+##### Built-in rules
+
+To avoid blocking any Apple system binaries or Santa binaries, santad will create 2 immutable certificate rules at startup:
+
+* The signing certificate santad is signed with
+* The signing certificate launchd is signed with
+
+By creating these two rules at startup, Santa should never block critical Apple system binaries or other Santa components.
--- a/Docs/details/santa-driver.md
+++ b/Docs/details/santa-driver.md
@@ -0,0 +1,94 @@
+# santa-driver
+
+santa-driver is a macOS [kernel extension](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KEXTConcept/KEXTConceptIntro/introduction.html) (KEXT) that makes use of the [Kernel Authorization](https://developer.apple.com/library/content/technotes/tn2127/_index.html) (Kauth) KPI. This allows santa-driver to listen for events and either deny or defer the decision of those events. The santa-driver acts as an intermediary layer between Kauth and santad, with some caching to lower the overhead of decision making.
+
+##### Kauth
+
+santa-driver utilizes two Kauth scopes `KAUTH_SCOPE_VNODE` and `KAUTH_SCOPE_FILEOP `. It registers itself with the Kauth API by calling `kauth_listen_scope()` for each scope. This function takes three arguments:
+
+* `const char *scope`
+* `kauth_scope_callback_t _callback`_
+* `void *contex`
+
+It returns a `kauth_listener_t` that is stored for later use, in Santa's case to stop listening.
+
+###### KAUTH_SCOPE_VNODE
+
+Here is how santa-driver starts listening for `KAUTH_SCOPE_VNODE` events.
+
+```c++
+vnode_listener_ = kauth_listen_scope(
+    KAUTH_SCOPE_VNODE, vnode_scope_callback, reinterpret_cast<void *>(this));
+```
+
+The function `vnode_scope_callback` is called for every vnode event. There are many types of vnode events, they complete list can be viewed in the kauth.h. There are many types of vnode events, the complete list can be viewed in kauth.h. Santa is only concerned with regular files generating `KAUTH_VNODE_EXECUTE` [1] and `KAUTH_VNODE_WRITE_DATA` events. All non-regular files and unnecessary vnode events are filtered out.
+
+Here is how santa-driver stops listening for `KAUTH_SCOPE_VNODE` events:
+
+```c++
+kauth_unlisten_scope(vnode_listener_);
+```
+
+[1] `KAUTH_VNODE_EXECUTE` events that do not have the `KAUTH_VNODE_ACCESS` advisory bit set.
+
+###### KAUTH_SCOPE_FILEOP
+
+Santa also listens for file operations, this is mainly used for logging [1] and cache invalidation. 
+
+* `KAUTH_FILEOP_DELETE`, `KAUTH_FILEOP_RENAME`, `KAUTH_FILEOP_EXCHANGE` and `KAUTH_FILEOP_LINK` are logged
+* `KAUTH_FILEOP_EXEC` is used to log `execve()`s. Since the `KAUTH_VNODE_EXECUTE` is used to allow or deny an `execve()` the process arguments have not been setup yet. Since `KAUTH_FILEOP_EXEC` is triggered after an `execve()` it is used to log the `execve()`.
+
+[1] `KAUTH_FILEOP_CLOSE` is used to invalidate that file's representation in the cache. If a file has changed it needs to be re-evalauted. This is particularly necessary for files that were added to the cache with an action of allow.
+
+##### Driver Interface
+
+santa-driver implements an [IOUserClient](https://developer.apple.com/documentation/kernel/iouserclient?language=objc) subclass and santad interacts with it through IOKit/IOKitLib.h functions.
+
+[//]: # "TODO(bur, rah) Flesh out the details"
+
+##### Cache
+
+To aid in performance, santa-driver utilizes a caching system to hold the state of all observed `execve()` events.
+
+###### Key
+
+The key is a `uint64_t`. The top 32 bits hold the filesystem ID, while the bottom 32 bits hold the file unique ID. Together we call this the vnode_id.
+
+```c++
+uint64_t vnode_id = (((uint64_t)fsid << 32) | fileid);
+```
+
+###### Value
+
+The value is a `uint64_t` containing the action necessary, along with the decision timestamp. The action is stored in the top 8 bits. The decision timestamp is stored in the remaining 56 bits.
+
+```c++
+santa_action_t action = (santa_action_t)(cache_val >> 56);
+uint64_t decision_time = (cache_val & ~(0xFF00000000000000));
+```
+
+The possible actions are:
+
+| Actions                 | Expiry Time      | Description                              |
+| ----------------------- | ---------------- | ---------------------------------------- |
+| `ACTION_REQUEST_BINARY` | None             | Awaiting an allow or deny decision from santad. |
+| `ACTION_RESPOND_ALLOW`  | None             | Allow the `execve()`                     |
+| `ACTION_RESPOND_DENY`   | 500 milliseconds | Deny the `execve()`, but re-evalaute after 500 milliseconds. If someone is trying to run a banned binary continually every millisecond for example, only 2 evaluation requests to santad for would occur per second. This mitigates a denial of service type attack on santad. |
+
+###### Invalidation
+
+Besides the expiry time for individual entries, the entire cache will be cleared if any of the following events takes place:
+
+* Addition of a blacklist rule
+* Addition of a blacklist regex scope
+* Cache fills up. This defaults to `5000` entries for the root volume and `500` for all other mounted volumes.
+
+To view the current kernel cache count see the "Kernel info" section of `santactl status`:
+
+```sh
+⇒  santactl status
+>>> Kernel Info
+    Root cache count          | 107
+    Non-root cache count      | 0
+```
+
--- a/Docs/details/santa-gui.md
+++ b/Docs/details/santa-gui.md
@@ -0,0 +1,11 @@
+# Santa GUI
+
+The Santa GUI process is pretty simple. It's only job is the display user GUI notifications. There are two types of notifications it can display:
+
+A notification when an `execve()` is blocked.
+
+![Block](block.png)
+
+Notifications when specific rules arrive (when using FCM for push notifications).
+
+![Notification](push.png)
--- a/Docs/details/santa_ipc.png
+++ b/Docs/details/santa_ipc.png
--- a/Docs/details/santabs.md
+++ b/Docs/details/santabs.md
@@ -0,0 +1,44 @@
+# santabs
+
+The santabs process is an XPC service for the santa-driver.kext bundle, meaning only binaries within that bundle can launch santabs. It will be launched with the same privileges as its calling process. Currently, santad is the only caller of santabs, so santabs runs as root.
+
+##### Events
+
+The santabs process is quite simple and only does one thing: it generates non-execution events for the contents of a bundle.
+
+When there is an `execve()` that is blocked within a bundle, a few actions take place:
+
+1. The highest ancestor bundle in the tree is found
+
+   * So `/Applications/DVD Player.app/Contents/MacOS/DVD Player` would be `/Applications/DVD Player.app`
+   * Or `/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension` would be `/Applications/Safari.app`
+
+2. The ancestor bundle is then searched for Mach-O executables
+
+   * For Safari that would currently be 4 binaries
+
+   * ```sh
+     Hashing time: 53 ms
+     4 events found
+     BundleHash: 718773556ca5ea798f984fde2fe1a5994f175900b26d2964c9358a0f469a4ac6
+     BundleID: com.apple.Safari
+     	SHA-256: ea872e83a518ce442ed050c4408a448d915e2bae90ef8455ce7805448d864a3e
+     	Path: /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
+     BundleID: com.apple.Safari
+     	SHA-256: 1a43283857b1822164f82af274c476204748c0a2894dbcaa11ed17f78e0273cc
+     	Path: /Applications/Safari.app/Contents/MacOS/Safari
+     BundleID: com.apple.Safari
+     	SHA-256: ab0ac54dd90144931b681d1e84e198c6510be44ac5339437bc004e60777af7ba
+     	Path: /Applications/Safari.app/Contents/Resources/appdiagnose
+     BundleID: com.apple.Safari
+     	SHA-256: f49c5aa3a7373127d0b4945782b1fa375dd3707d66808fd66b7c0756430defa8
+     	Path: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService
+     ```
+
+3. Events are created for each binary and the bundle hash is calculated
+
+4. These events are sent to the sync server for processing
+
+##### Bundle Hash
+
+The found events are sorted by their file SHA-256 hash. The hashes are concatenated and then SHA-256 hashed. This is now a strong indicator on what Mach-O executables were within the bundle at the time of scan. This can then be verified by the sync server when deciding to generate rules.
--- a/Docs/details/santactl.md
+++ b/Docs/details/santactl.md
@@ -0,0 +1,425 @@
+# santactl
+
+This may be the most complex part of Santa. It does two types of work:
+
+1. It contains all of the code and functionality for syncing with a sync-server.
+2. It can be used to view the state and configuration of Santa as a whole. It can also inspect individual files. When running without a sync server it also a supported method of managing the rules database.
+
+The details of santactl's syncing functionality are covered in the syncing.md document. This document will cover the status work that santactl performs.
+
+##### status
+
+To view the status of Santa run `santactl status`
+
+```sh
+⇒  santactl status
+>>> Daemon Info
+  Mode                      | Monitor
+  File Logging              | Yes
+  Watchdog CPU Events       | 0  (Peak: 2.19%)
+  Watchdog RAM Events       | 0  (Peak: 29.45MB)
+>>> Kernel Info
+  Kernel cache count        | 123
+>>> Database Info
+  Binary Rules              | 321
+  Certificate Rules         | 123
+  Events Pending Upload     | 0
+>>> Sync Info
+  Sync Server               | https://sync-server.com/santa/
+  Clean Sync Required       | No
+  Last Successful Full Sync | 2017/08/10 15:05:32 -0400
+  Last Successful Rule Sync | 2017/08/10 15:29:21 -0400
+  Push Notifications        | Connected
+  Bundle Scanning           | Yes
+```
+
+The status command also has the ability to print JSON output `santactl status --json`
+
+```sh
+⇒  santactl status --json
+{
+  "kernel" : {
+    "cache_count" : 123
+  },
+  "daemon" : {
+    "watchdog_ram_events" : 0,
+    "watchdog_ram_peak" : 29.44921875,
+    "watchdog_cpu_events" : 0,
+    "file_logging" : true,
+    "mode" : "Monitor",
+    "watchdog_cpu_peak" : 2.188006666666666
+  },
+  "database" : {
+    "events_pending_upload" : 0,
+    "certificate_rules" : 123,
+    "binary_rules" : 321
+  },
+  "sync" : {
+    "last_successful_rule" : "2017\/08\/10 15:29:21 -0400",
+    "push_notifications" : "Connected",
+    "bundle_scanning" : true,
+    "clean_required" : false,
+    "server" : "https:\/\//sync-server.com\/santa\/",
+    "last_successful_full" : "2017\/08\/10 15:05:32 -0400"
+  }
+}
+```
+
+##### version
+
+To view all of the component versions `santactl version`
+
+```sh
+⇒  santactl version
+santa-driver    | 0.9.19
+santad          | 0.9.19
+santactl        | 0.9.19
+SantaGUI        | 0.9.19
+```
+
+Again, a JSON version is available `santactl version --json`
+
+```sh
+⇒  santactl version --json
+{
+  "santa-driver" : "0.9.19",
+  "santad" : "0.9.19",
+  "SantaGUI" : "0.9.19",
+  "santactl" : "0.9.19"
+}
+```
+
+##### fileinfo
+
+The fileinfo verb is very powerful and can be used to tease out just about anything you wish to know about a file, with respect to the domain of Santa.
+
+Here is an example of using `santactl fileinfo ` to inspect the main executable within `/Applications/Hex Fiend.app`. 
+
+```sh
+⇒  santactl fileinfo /Applications/Hex\ Fiend.app
+Path                 : /Applications/Hex Fiend.app/Contents/MacOS/Hex Fiend
+SHA-256              : efaf88db065beae61615f6f176c11c751555d2bad3c5da6cdad71635896014f1
+SHA-1                : 5585e6fb94eace1bd37da9a0a2f928e992d7c60c
+Bundle Name          : Hex Fiend
+Bundle Version       : 170205
+Bundle Version Str   : 2.5
+Download Referrer URL: http://ridiculousfish.com/hexfiend/
+Download URL         : http://ridiculousfish.com/hexfiend/files/Hex_Fiend_2.5.dmg
+Download Timestamp   : 2017/06/29 12:52:16 -0400
+Download Agent       : com.google.Chrome
+Type                 : Executable (x86-64)
+Code-signed          : Yes
+Rule                 : Whitelisted (Unknown)
+Signing Chain:
+     1. SHA-256             : ba1be5d2d60a43658a0c6ebf61b577e428439b53ef2e0b96ba90285e2c82a1b2
+        SHA-1               : 8fdbf6d6c22a97c472fb4961b7733ab0d8830ff7
+        Common Name         : Developer ID Application: Kevin Wojniak
+        Organization        : Kevin Wojniak
+        Organizational Unit : QK92QP33YN
+        Valid From          : 2012/10/30 01:07:40 -0400
+        Valid Until         : 2017/10/31 01:07:40 -0400
+
+     2. SHA-256             : 7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f
+        SHA-1               : 3b166c3b7dc4b751c9fe2afab9135641e388e186
+        Common Name         : Developer ID Certification Authority
+        Organization        : Apple Inc.
+        Organizational Unit : Apple Certification Authority
+        Valid From          : 2012/02/01 17:12:15 -0500
+        Valid Until         : 2027/02/01 17:12:15 -0500
+
+     3. SHA-256             : b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024
+        SHA-1               : 611e5b662c593a08ff58d14ae22452d198df6c60
+        Common Name         : Apple Root CA
+        Organization        : Apple Inc.
+        Organizational Unit : Apple Certification Authority
+        Valid From          : 2006/04/25 17:40:36 -0400
+        Valid Until         : 2035/02/09 16:40:36 -0500
+```
+
+Any of the desired information can be targeted with the `--key` flag
+
+```sh
+⇒  santactl fileinfo /Applications/Hex\ Fiend.app --key SHA-256
+efaf88db065beae61615f6f176c11c751555d2bad3c5da6cdad71635896014f1
+```
+
+Multiple `--key` flags are allowed
+
+```sh
+⇒  santactl fileinfo /Applications/Hex\ Fiend.app --key SHA-256 --key Rule
+efaf88db065beae61615f6f176c11c751555d2bad3c5da6cdad71635896014f1
+Whitelisted (Unknown)
+```
+
+The `--json` flag can also be used at any point
+
+```sh
+⇒  santactl fileinfo /Applications/Hex\ Fiend.app --key SHA-256 --key Rule --json
+{
+  "SHA-256" : "efaf88db065beae61615f6f176c11c751555d2bad3c5da6cdad71635896014f1",
+  "Rule" : "Whitelisted (Unknown)"
+}
+```
+
+Multiple files are also supported as input
+
+```sh
+⇒  santactl fileinfo /bin/* --key SHA-256 --key Rule --json
+[
+{
+  "SHA-256" : "5d8e161c21fc1a43374c4cf21be05360dbe2ecea0165fd4725ae7a958f2a0b02",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "295fbc2356e8605e804f95cb6d6f992335e247dbf11767fe8781e2a7f889978a",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "9f9b36ec79b9fcaf649e17f2f94c544dd408c2ab630e73d7c62a7a43f1bc7b1d",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "08a09d2d9bade16872acdf5da1c4e9d29582ed985480a9e73fd389e98293c40d",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "48e4b938b363201ec11d06a13d8080c1bd77187d286780259b9304c96edc5324",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "7dff6291a29fdaf97dad64c0671dc5d1ecc42189bc5daf8ca08e2a3ae06aff95",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "7cbba457df4c02d6a7fb93046fea0e869732c65a2225bee6f2e8ec290d38c57b",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "39e894d1705656451f592884a56bcc76e7ffbb9ed2a8b81d5f2878e1c0e68dbe",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "8555ed4622410aa7b4379041acabf80fe452a90efe3be2697406935ff0d6822e",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "cee3e29089f8919ee904328904a7492995cfa398b027857fbf8b3e601397b308",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "da2cfa9fc2cabd41907f9d0931cea79000a19520fe0b3d73fc40537408730e40",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "73aee02c4761e5501b1fdfa51ccd316bf735017a5cc0a09d5bcc46f4e7112be9",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "3a1c4ca5a038b42b1fbfca6f9bec25d307a8af40afbe9c48b307372fe8167a2f",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "9dc8e1c5b6ec49602dd968eb88286e330220233f7cfa6e73fd37fc983a365084",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "78fd9b8749c2a216ca76ff4541754d4cf5a5e2e8c00710a85c3fdab171486f92",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "c4daaf12bd42adee60549872126e15186c75d89e760f078bfa6a45a861f6400f",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "9dba1cbb01bce47a9610a40cbcbc27704a754e31a889503eb0670c3a25f7ad72",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "a5ae86cd413589d9661fc604349fb153c0d6f5dfa3d9e95e01b8bc5e09bc1da1",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "a5ae86cd413589d9661fc604349fb153c0d6f5dfa3d9e95e01b8bc5e09bc1da1",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "c4c5517ff40a33006028853a19734d8cda8e2942cb9ba27b8310e07f18677487",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "a944b104742db59204b45f1dae657bd6a845ff2374e1ade3cf9f09cc428154cf",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "09e143cf3b6c4dcc98676cc45543613b83b6527b502d4dacb42b3f6c7036ef5a",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "47cea771e93aff464f1060a6a1a2c3855401e6cd22c3971b2b76fae92e8c33b4",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "5682f15628ae15e5c29aa37f19ec421bbe4aca47734864b6363b73a16f891888",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "83c29a2445d84daf51eebd51668753fb39600a136efc20aba7298a812b44974c",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "83929910d3cd2c401636337fadc747a9a8ea6c174bfd80f1e96b99d877ddfa6e",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "cccd818698aa802b116586a773643d0b951067dea8284304acaae62ac97b362b",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "2bf2d10a7529a88d340ce0255da52dbef9873ccb44e46d23af03abf70b8e54ca",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "956f2dc7ba31663dd3a9b70e84e6a2491980165426b90cacd10db4bd010c3353",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "da1a3ae959751b211928f175f6c8987408a976be44690022c92d45ef5a8cb6e5",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "1e51209ae4549a72432ad504341c0731a282b33ba99c5f7f4e2abc9993e09b0a",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "7dff6291a29fdaf97dad64c0671dc5d1ecc42189bc5daf8ca08e2a3ae06aff95",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "5d8e161c21fc1a43374c4cf21be05360dbe2ecea0165fd4725ae7a958f2a0b02",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "83929910d3cd2c401636337fadc747a9a8ea6c174bfd80f1e96b99d877ddfa6e",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "17372eafbe9e920d5715a9cffa59f881ef4ed949785c1e2adf9c067d550dbde6",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "b1834d55b76c65d57cef1219a30331452301e84b6e315f2a17e5b5b295ce1648",
+  "Rule" : "Whitelisted (Certificate)"
+}
+]
+```
+
+Recursive lookups of an application or directory is a soon to be added feature
+
+```sh
+⇒  santactl fileinfo --recursive /Applications/Santa.app --key SHA-256 --key Rule --key Type --json
+[
+{
+  "SHA-256" : "c149c10c83abaf6b602401106f098b68d47a1a433ab02455cef2ca8057cf4a82",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+},
+{
+  "SHA-256" : "c339c3e5e04c732ae493dbc4a26d18fccc8bb48cea0cc0762ccd8754ef318a0b",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+},
+{
+  "SHA-256" : "6ee757ab65d7c93e8b6a467b44cd2f0d10b6db7da8b6200e778c3ca279ea5619",
+  "Type" : "Executable (x86-64)",
+  "Rule" : "Whitelisted (Certificate)"
+},
+{
+  "SHA-256" : "82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+},
+{
+  "SHA-256" : "9814019f865a540d3635012a75db932eaefc9a62468750f2294350690430aadf",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+},
+{
+  "SHA-256" : "05a9c9dbbf0a7a30f083e3dccd8db3d96845e0644930977b4e284c65083b89ac",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+},
+{
+  "SHA-256" : "e1db8fdffc5017684f962c51fad059dcaa06ab5d551186aa85711f80b727d23d",
+  "Type" : "Unknown",
+  "Rule" : "Whitelisted (Scope)"
+}
+]
+```
+
+##### rule
+
+The rule command is covered in the [rules.md](rules.md) document.
+
+##### sync
+
+The sync command is covered in the [syncing.md](syncing.md) document.
+
+##### Debug Commands
+
+There are a few commands that are not included in the release versions of Santa. They are mainly used during development and only accessible with a debug build of Santa.
+
+##### bundleinfo
+
+This prints info about all of the executable Mach-O files within a bundle. It also prints the calculated bundle hash for that particular bundle. A bundle hash is a notion used by Santa to represent a set of binaries.
+
+```sh
+⇒  santactl bundleinfo /Applications/Hex\ Fiend.app
+Hashing time: 12 ms
+4 events found
+BundleHash: 33da3e2d5e2ccbdb9d34fb9753c2c18805e6325853d2fb4eb947915c90113efc
+BundleID: com.ridiculousfish.HexFiend
+	SHA-256: e592a7c65f803675c0b7d55ab7d2a1a2696c9f097a99dc28a4083d7387e53d95
+	Path: /Applications/Hex Fiend.app/Contents/Library/LaunchServices/com.ridiculousfish.HexFiend.PrivilegedHelper
+BundleID: com.ridiculousfish.HexFiend
+	SHA-256: ce23d39a1a8ff2b42baad5a0204b24b57590bb7ff74c9552b3ba10d9c1517279
+	Path: /Applications/Hex Fiend.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate
+BundleID: com.ridiculousfish.HexFiend
+	SHA-256: efaf88db065beae61615f6f176c11c751555d2bad3c5da6cdad71635896014f1
+	Path: /Applications/Hex Fiend.app/Contents/MacOS/Hex Fiend
+BundleID: com.ridiculousfish.HexFiend
+	SHA-256: 148d6ae55176b619e5eb9f5000922b3ca4c126206fc5782f925d112027f9db3c
+	Path: /Applications/Hex Fiend.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop
+```
+
+See the [santabs.md](santabs.md) document for more information on bundles and bundle hashes.
+
+##### checkcache
+
+This is used to check if a particular file is apart of santa-driver's kernel cache. Mainly for debugging purposes.
+
+```sh
+⇒  santactl checkcache /usr/bin/yes
+File does not exist in cache
+⇒  /usr/bin/yes
+y
+y
+y
+y
+y
+^C
+⇒  santactl checkcache /usr/bin/yes
+File exists in [whitelist] kernel cache
+```
+
+##### flushcache
+
+This can be used to flush santa-driver's kernel cache, as shown here.
+
+```sh
+⇒  santactl checkcache /usr/bin/yes
+File exists in [whitelist] kernel cache
+⇒  sudo santactl flushcache
+Cache flush requested
+⇒  santactl checkcache /usr/bin/yes
+File does not exist in cache
+```
--- a/Docs/details/santad.md
+++ b/Docs/details/santad.md
@@ -0,0 +1,23 @@
+# santad
+
+The santad process does the heavy lifting when it comes to making decisions about binary executions. It also handles brokering all of the XPC connections between the various components of Santa. It does all of this with performance being at the forefront. 
+
+##### A note on performance
+
+On an idling machine, santad and the other components of Santa consume virtually no CPU and a minimal amount of memory (5-50MB). When lots of processes `execve()` at the same time, the CPU and memory usage can spike. All of the `execve()` decisions are made on high priority threads to ensure decisions are posted back to the kernel as soon as possible. A watchdog thread will log warnings when sustained high CPU (>20%) and memory (>250MB) usage by santad is detected.
+
+##### On Launch
+
+The very first thing santad does once it has been launched is to load and connect to santa-driver. Only one connection may be active at any given time.
+
+At this point, santa-driver is loaded and running in the kernel, but is allowing all executions and not sending any messages to santad. Before santad tells santa-driver it is ready to receive messages, it needs to setup a few more things:
+
+* The rule and event databases are initialized
+* Connections to Santa (GUI) and santactl sync daemon are established. 
+* The config file is processed.
+
+santad is now ready to start processing decision and logging messages from santa-driver. The listeners are started and santad sits in a run loop awaiting messages from santa-driver. 
+
+##### Running
+
+Messages are read from a shared memory queue (`IODataQueueMemory` ) on a single thread. A callback is invoked for each message. The callback then dispatches all the work of processing a decision message to a concurrent high priority queue. The log messages are dispatched to a low priority queue for processing.
--- a/Docs/details/scopes.md
+++ b/Docs/details/scopes.md
@@ -0,0 +1,27 @@
+# Scopes
+
+In addition to rules, Santa can whitelist or blacklist based on scopes. Currently, only a few scopes are implemented. They fall into one of two categories: a whitelist scope or blacklist scope. Scopes are evaluated after rules, with blacklist evaluation preceding whitelist.
+
+Scopes are a broader way of whitelisting or blacklisting `execve()`s.
+
+For configuration of scopes see [configuration.md](../deployment/configuration.md).
+
+##### Blacklist Scopes
+
+| Scope                | Configurable |
+| -------------------- | ------------ |
+| Blacklist Path Regex | Yes          |
+| Missing __PAGEZERO   | Yes          |
+
+##### Whitelist Scopes
+
+| Scope                | Configurable |
+| -------------------- | ------------ |
+| Whitelist Path Regex | Yes          |
+| Not a Mach-O         | No           |
+
+As seen above, Santa will whitelist any non Mach-O binary under a whitelist scope. However, a blacklist regex or binary SHA-256 rule can be used to block non Mach-O `execve()`s since they are evaluated before the whitelist scopes.
+
+##### Regex Caveats
+
+The paths covered by the whitelist and blacklist regex patterns are not tracked. If an `execve()` is allowed initially, then moved into a blacklist directory, Santa has no knowledge of that move. Since santa-driver caches decisions, the recently moved file will continue to be allowed to `execve()` even though it is now within a blacklisted regex path. The cache holds "allow" decisions until invalidated and "deny" decisions for 500 milliseconds. Going from a blacklist path to a whitelist path is not largely affected.
--- a/Docs/development/building.md
+++ b/Docs/development/building.md
@@ -0,0 +1,108 @@
+
+
+# Building
+
+Santa makes use of [rake](https://ruby.github.io/rake/) for building and testing Santa. All of the [releases](https://github.com/google/santa/releases) are made using this same process. Santa's releases are codesigned with Google's KEXT signing certificate. This allows Santa to be loaded with SIP fully enabled.
+
+#### Cloning
+
+Clone the source and change into the directory.
+
+```sh
+git clone https://github.com/google/santa
+cd santa
+```
+
+The above command will default to using the `master` branch. If you wanted to build, run or test a specific version of Santa use this command.
+
+```sh
+git checkout <version, i.e. 0.9.19>
+```
+
+#### Building
+
+Build a debug version of Santa. This keeps all the debug symbols, adds additional logs and does not optimize the compiled output. For speed sensitive tests make sure to benchmark a release version too.
+
+```sh
+rake build:debug
+```
+
+Build a release version of Santa.
+
+```sh
+rake build:release
+```
+
+Both of these just output the binaries that makeup Santa in the default Xcode build location. To actually run  what was built, see the next section.
+
+#### Running
+
+On macOS 10.11+ System Integrity Protection (SIP) prevents loading of kernel extensions that are not signed by an Apple KEXT signing certificate. To be able to load and test a non-release version of Santa, SIP will have to be configured to allow non-Apple KEXT signing certificates.
+
+__This is only to be done a machine that is actively developing, unloading and loading kernel extensions.__
+
+1. Boot into Recovery Mode: Reboot and hold down `command+r`
+2. From the utilities menu select `Terminal`
+3. Disable the KEXT feature of SIP: `csrutil enable --without kext`
+4. Reboot
+
+You should now be able to load and run a non-release version of Santa.
+
+Build and run a debug version of Santa.
+
+```sh
+rake reload:debug
+```
+
+Build and run a release version of Santa.
+
+```sh
+rake reload:release
+```
+
+#### Debugging
+
+Xcode and lldb can be used to debug Santa, just like any other project. Instead of clicking the play button to launch and attach to a process, you can attach to an already running, or soon to by running, component of Santa. To do this select the Debug menu and choose `Attach to Process by PID or Name… `. Below are the four components of Santa and who to debug the process as. 
+
+Note: santa-driver (the kernel extension) cannot be debugged by attaching with Xcode.
+
+Note: Xcode can attach to santad without interruption, however any breakpoints in the decision making codepath can deadlock the machine. Using lldb directly to attach to santad will deadlock the machine.
+
+| process  | user |
+| -------- | ---- |
+| santad   | root |
+| Santa*   | me   |
+| santactl | me   |
+| santabs  | root |
+
+Xcode will then wait for the process to start. Issue this command to restart all the Santa processes in debug mode.
+
+*The Santa (GUI) process is the only component of Santa that can be launched and debugged from Xcode directly. All the other components are launched with privileges and/or are scoped to an XPC service that launchd scopes to a hosting bundle. Thus the need for the `Attach to Process by PID or Name…` technique.  See the [ipc](../details/ipc.md) document for for details.
+
+```sh
+rake reload:debug
+```
+
+Now the process is attached in Xcode and you can debug your day away.
+
+#### Tests
+
+Run all the logic / unit tests
+
+```sh
+rake tests:logic
+```
+
+Run all of santa-driver kernel extension tests
+
+```sh
+rake tests:kernel
+```
+
+#### Releases
+
+Creates a release build of Santa with a version based of the newest tag. Also saves the dsym files for each component of Santa. This makes debugging and interpreting future crashes or kernel panics much easier.
+
+```sh
+rake dist
+```
--- a/Docs/index.md
+++ b/Docs/index.md
@@ -0,0 +1,46 @@
+# Welcome to the Santa Docs
+
+Santa is a binary whitelisting / blacklisting system for macOS. Here you will find the documentation for understanding how Santa works, how to deploy it and how to contribute.
+
+#### Introduction
+
+The following documents give an overview of how Santa accomplishes binary whitelisting / blacklisting at the enterprise scale.
+
+- [Binary Whitelisting](introduction/binary-whitelisting-overview.md): How Santa makes allow or deny decisions for any `execve()` taking place.
+- [Syncing](introduction/syncing-overview.md): How configuration and whitelist / blacklist rules are applied from a sync server.
+
+#### Deployment
+
+* [Configuration](deployment/configuration.md): The local and sync server configuration options.
+
+#### Development
+
+* [Building Santa](development/building.md): How to build and load Santa for testing on a development machine.
+* [Contributing](../CONTRIBUTING.md): How to contribute a bug fix or new feature to Santa.
+
+#### Details
+
+For those who want even more details on how Santa works under the hood, this section is for you.
+
+###### Binaries
+
+There are five main components that make up Santa whose core functionality is described in snippets below. For additional detail on each component, visit their respective pages. These quick descriptions do not encompass all the jobs performed by each component, but do provide a quick look at the basic functionality utilized to achieve the goal of binary whitelisting / blacklisting.
+
+* [santa-driver](details/santa-driver.md): A macOS kernel extension that participates in `execve()` decisions.
+* [santad](details/santad.md): A user-land root daemon that makes decisions on behalf of santa-driver requests.
+* [santactl](details/santactl.md): A user-land anonymous daemon that communicates with a sync server for configurations and policies. santactl can also be used by a user to manually configure Santa when using the local configuration.
+* [santa-gui](details/santa-gui.md): A user-land GUI daemon that displays notifications when an `execve()` is blocked.
+* [santabs](details/santabs.md): A user-land root daemon that finds Mach-O binaries within a bundle and creates events for them. 
+
+###### Concepts
+
+Additional documentation on the concepts that support the operation of the main components:
+
+* [mode](details/mode.md): An operating mode, either Monitor or Lockdown.
+* [events](details/events.md): Represents an `execve()` that was blocked, or would have been blocked, depending on the mode.
+* [rules](details/rules.md): Represents allow or deny decisions for a given `execve()`. Can either be a binary's SHA-256 hash or a leaf code-signing certificate's SHA-256 hash.
+* [scopes](details/scopes.md): The level at which an `execve()` was allowed or denied from taking place.
+* [syncing](introduction/syncing-overview.md): How Santa communicates with a TLS server for configuration, rules and event uploading.
+* [ipc](details/ipc.md): How all the components of Santa communicate.
+  duction/syncing-overview.
+* [logs](details/logs.md): What and where Santa logs.
--- a/Docs/introduction/binary-whitelisting-overview.md
+++ b/Docs/introduction/binary-whitelisting-overview.md
@@ -0,0 +1,31 @@
+# Binary Whitelisting Overview
+
+#### Background
+
+The decision flow starts in the kernel. The macOS kernel is extensible by way of a kernel extension (KEXT). macOS makes available kernel programming interfaces (KPIs) to be used by a KEXT. Santa utilizes the Kernel Authorization (Kauth) KPI. This is a very powerful and verbose interface that gives Santa the ability to listen in on most vnode and file systems operations and to take actions, directly or indirectly, on the operations being performed. Still, there are some limitations to Kauth which are pointed out in the santa-driver document. For more information on the santa-driver KEXT see the [santa-driver.md](../details/santa-driver.md) document.
+
+#### Flow of an execve()
+
+This is a high level overview of the binary whitelisting / blacklisting decision process. For a more detailed account of each part, see the respective documentation. This flow does not cover the logging component of Santa, see the [logs.md](../details/logs.md) documentation for more info.
+
+###### Kernel Space
+
+0. santa-driver registers itself as a `KAUTH_SCOPE_VNODE` listener. This flow follows how santa-driver handles `KAUTH_VNODE_EXECUTE` events.
+1. A santa-driver Kauth callback function is executed by the kernel when a process is trying to `execve()`. In most cases, the `execve()` takes place right after a process calls `fork()` to start a new process. This function is running on a kernel thread representing the new process. Information on where to find the executable is provided. This information is known as the `vnode_id`.
+2. santa-driver then checks if its cache has an allow or deny entry for the `vnode_id`. If so it returns that decision to the Kauth KPI. 
+   * If Kauth receives a deny, it will stop the `execve()` from taking place. 
+   * If Kauth receives an allow, it will defer the decision. If there are other Kauth listeners, they also have a chance deny or defer.
+3. If there is no entry for the `vnode_id` in the cache a few actions occur:
+   * santa-driver hands off the decision making to santad.
+   * A new entry is created in the cache for the `vnode_id` with a special value of `ACTION_REQUEST_BINARY`.  This is used as a placeholder until the decision from santad comes back. If another process tries to `execve()` the same `vnode_id`, santa-driver will have that thread wait for the in-flight decision from santad. All subsequent `execve()`s for the same `vnode_id` will use the decision in the cache as explained in #2, until the cache is invalidated. See the [santa-driver.md](../details/santa-driver.md) document for more details on the cache invalidation.
+   * If the executing file is written to while any of the threads are waiting for a response the `ACTION_REQUEST_BINARY` entry is removed, forcing the decision-making process to be restarted.
+
+###### User Space
+
+1. santad is listening for decision requests from santa-driver.
+   * More information is collected about the executable that lives at the `vnode_id`. Since this codepath has a sleeping kernel thread waiting for a decision, extra care is taken to be as performant as possible.
+2. santad uses the information it has gathered to make a decision to allow or deny the `execve()`. There are more details on how these decisions are made in the [rules.md](../details/rules.md) and [scopes.md](../details/scopes.md) documents.
+3. The decision is posted back to santa-driver.
+4. If there was a deny decision, a message is sent to Santa GUI to display a user popup notification.
+
+
--- a/Docs/introduction/syncing-overview.md
+++ b/Docs/introduction/syncing-overview.md
@@ -0,0 +1,27 @@
+# Syncing Overview
+
+#### Background
+
+Santa can be run and configured without a sync server. Doing so will enable an admin to configure rules with the `santactl rule` command. Using a sync server will enable an admin to configures rules and multiple other settings from the sync server itself. Santa was designed from the start with a sync server in mind. This allows an admin to easily configure and sync rules across a fleet of macOS systems. This document explains the syncing process.
+
+#### Flow of a full sync
+
+This is a high level overview of the syncing process. For a more a more detailed account of each part, see the respective documentation. The santaclt binary can be run in one of two modes, daemon and non-daemon. The non-daemon mode does one full sync and exits. This is the typical way a user will interact with Santa, mainly to force a full sync. The daemon mode is used by santad to schedule full syncs, listen for push notifications and upload events.
+
+0. When the santad process starts up, it looks for a `SyncBaseURL` key/value in the config. If one exists it will `fork()` and `execve()` `santactl sync —-daemon`. Before the new process calls `execve()`, all privileges are dropped. All privileged actions are then restricted to the XPC interface made available to santactl by santad. Since this santactl process is running as a daemon it too exports an XPC interface so santad can interact with the process efficiently and securely. To ensure syncing reliability santad will restart the santactl daemon if it is killed or crashes.
+1. The santactl daemon process now schedules a full sync for 15 sec in the future. The 15 sec is used to let santad settle before santactl starts sending rules from the sync server to process.
+2. The full sync starts. There are a number of stages to a full sync:
+   1. preflight: The sync server can set various settings for Santa.
+   2. logupload (optional): The sync server can request that the Santa logs be uploaded to an endpoint.
+   3. eventupload (optional): If Santa has generated events, it will upload them to the sync-server.
+   4. ruledownload: Download rules from the sync server.
+   5. postflight: Updates timestamps for successful syncs.
+3. After the full sync completes a new full sync will be scheduled, by default this will be 10min. However there are a few ways to manipulate this:
+   1. The sync server can send down a configuration in the preflight to override the 10min interval. It can be anything greater than 10min.
+   2. Firebase Cloud Messaging (FCM) can be used. The sync server can send down a configuration in the preflight to have the santactl daemon to start listening for FCM messages. If a connection to FCM is made, the full sync interval drops to a default of 4 hours. This can be further configured by a preflight configuration. The FCM connection allows the sync-sever to talk directly with Santa. This way we can reduce polling the sync server dramatically.
+4. Full syncs will continue to take place at their configured interval. If configured FCM messages will continue to be digested and acted upon.
+
+#### santactl XPC interface
+
+When running as a daemon, the santactl process makes available an XPC interface for use by santad. This allows santad to send blocked binary or bundle events directly to santactl for immediate upload to the sync-server, enabling a smoother user experience. The binary that was blocked on macOS is immediately available for viewing or handling on the sync-server.
+
--- a/Docs/theme/Santa.css
+++ b/Docs/theme/Santa.css
@@ -0,0 +1,3 @@
+.wy-side-nav-search {
+  background-color: rgb(253, 67, 69);
+}
--- a/5
+++ b/5
@@ -11,6 +11,11 @@ target :santad do
  pod 'FMDB'
  pod 'MOLCertificate'
  pod 'MOLCodesignChecker'
+  target :santabs do
+    pod 'FMDB'
+    pod 'MOLCertificate'
+    pod 'MOLCodesignChecker'
+  end
 end

 target :santactl do
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -27,6 +27,6 @@ SPEC CHECKSUMS:
  MOLFCMClient: 13d8b42db9d750e772f09cc38fc453922fece09f
  OCMock: 35ae71d6a8fcc1b59434d561d1520b9dd4f15765

-PODFILE CHECKSUM: 1728b86e95e7cdb481dd91ab9c38af38e060a023
+PODFILE CHECKSUM: acd378b3727c923d912e09812da344f7375c14fe

-COCOAPODS: 1.2.0
+COCOAPODS: 1.2.1
--- a/README.md
+++ b/README.md
@@ -1,4 +1,6 @@
-Santa  [![Build Status](https://travis-ci.org/google/santa.png?branch=master)](https://travis-ci.org/google/santa)
+Santa
+[![Build Status](https://travis-ci.org/google/santa.png?branch=master)](https://travis-ci.org/google/santa)
+[![Documentation Status](https://readthedocs.org/projects/santa/badge/?version=latest)](https://santa.readthedocs.io/en/latest/?badge=latest)
 =====

 <p align="center">
@@ -20,6 +22,10 @@ It is named Santa because it keeps track of binaries that are naughty or nice.

 Santa is a project of Google's Macintosh Operations Team.

+Docs
+========
+The Santa docs are stored in the [Docs](https://github.com/google/santa/blob/master/Docs) directory. A Read the Docs instance is available here: https://santa.readthedocs.io.
+
 Admin-Related Features
 ========

@@ -139,6 +145,8 @@ rake build:debug
 Note: the Xcode project is setup to use any installed "Mac Developer" certificate
 and for security-reasons parts of Santa will not operate properly if not signed.

+For more details on building see the [building.md](https://github.com/google/santa/blob/master/Docs/development/building.md) document.
+
 Kext Signing
 ============
 Kernel extensions on macOS 10.9 and later must be signed using an Apple-provided
--- a/1
+++ b/1
@@ -106,6 +106,7 @@ namespace :install do
    system 'sudo cp conf/com.google.santad.plist /Library/LaunchDaemons'
    system 'sudo cp conf/com.google.santagui.plist /Library/LaunchAgents'
    system 'sudo cp conf/com.google.santa.asl.conf /etc/asl'
+    system '/usr/bin/killall -HUP syslogd'
    Rake::Task['build:build'].invoke(config)
    puts "Installing with configuration: #{config}"
    Rake::Task['remove_existing'].invoke()
--- a/Santa.xcodeproj/project.pbxproj
+++ b/Santa.xcodeproj/project.pbxproj
@@ -154,23 +154,42 @@
 		0DEFB7C81ACF0BFE00B92AAE /* SNTFileWatcherTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C71ACF0BFE00B92AAE /* SNTFileWatcherTest.m */; };
 		0DF395641AB76A7900CBC520 /* NSData+Zlib.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DF395631AB76A7900CBC520 /* NSData+Zlib.m */; };
 		0DF395661AB76ABC00CBC520 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 0DF395651AB76ABC00CBC520 /* libz.dylib */; };
+		168A4E09A2A5E0B7DF8A2F1A /* libPods-santad.a in Frameworks */ = {isa = PBXBuildFile; fileRef = C11A10A5D6E112788769CF70 /* libPods-santad.a */; };
 		4092327A1A51B66400A04527 /* SNTCommandRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 409232791A51B65D00A04527 /* SNTCommandRule.m */; };
-		42805FED981952EC9F0E4272 /* libPods-santactl.a in Frameworks */ = {isa = PBXBuildFile; fileRef = DC914D8DD0F5C0E21DA45150 /* libPods-santactl.a */; };
-		7E396F5897B914399A568D27 /* libPods-Santa.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 8FE66FA803110026A2A57C59 /* libPods-Santa.a */; };
-		8E6BE2EABCDF090F0FCEA980 /* libPods-santad.a in Frameworks */ = {isa = PBXBuildFile; fileRef = E57A355BC439804E082B9C0A /* libPods-santad.a */; };
-		C4F8326EEB58061C1A579F0D /* libPods-LogicTests.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 3EAD1E725C5F299F58F754D7 /* libPods-LogicTests.a */; };
+		59D56CF2D9C5BD9B7E3CC56D /* libPods-santad-santabs.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 14B98F4051188ECB7D024331 /* libPods-santad-santabs.a */; };
+		81133DB01F3A76F700917FF9 /* SNTCommand.m in Sources */ = {isa = PBXBuildFile; fileRef = 81133DAF1F3A75CE00917FF9 /* SNTCommand.m */; };
+		81133DB11F3A77C600917FF9 /* SNTCommand.m in Sources */ = {isa = PBXBuildFile; fileRef = 81133DAF1F3A75CE00917FF9 /* SNTCommand.m */; };
+		B352A545B76783D568A6D0C5 /* libPods-Santa.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 90E9D568200AB9B642E06272 /* libPods-Santa.a */; };
 		C714F8B11D8044D400700EDF /* SNTCommandFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */; };
 		C714F8B21D8044FE00700EDF /* SNTCommandController.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D35BDAB18FD7CFD00921A21 /* SNTCommandController.m */; };
 		C72E8D941D7F399900C86DD3 /* SNTCommandFileInfoTest.m in Sources */ = {isa = PBXBuildFile; fileRef = C72E8D931D7F399900C86DD3 /* SNTCommandFileInfoTest.m */; };
 		C73A4B9A1DC10753007B6789 /* SNTSyncdQueue.m in Sources */ = {isa = PBXBuildFile; fileRef = C7FB56FF1DBFC213004E14EF /* SNTSyncdQueue.m */; };
 		C73A4B9B1DC10758007B6789 /* SNTXPCSyncdInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7FB56F51DBFB480004E14EF /* SNTXPCSyncdInterface.m */; };
+		C7479F051E53704E0054C1CF /* SNTXPCBundleServiceInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */; };
+		C7479F071E5374BF0054C1CF /* SNTXPCControlInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD605419115D17006B445C /* SNTXPCControlInterface.m */; };
+		C7479F091E5374E50054C1CF /* SNTRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE50F671912716A007B2B0C /* SNTRule.m */; };
+		C74D6CC61EEB3B9B00BB5A33 /* BundleExample.app in Resources */ = {isa = PBXBuildFile; fileRef = C74D6CC51EEB3B9B00BB5A33 /* BundleExample.app */; };
 		C76614EC1D142D3C00D150C1 /* SNTCommandCheckCache.m in Sources */ = {isa = PBXBuildFile; fileRef = C76614EB1D142D3C00D150C1 /* SNTCommandCheckCache.m */; };
 		C776A1071DEE160500A56616 /* SNTCommandSyncManager.m in Sources */ = {isa = PBXBuildFile; fileRef = C776A1061DEE160500A56616 /* SNTCommandSyncManager.m */; };
+		C78227631E1C3C7D006EB2D6 /* santabs.xpc in CopyFiles */ = {isa = PBXBuildFile; fileRef = C78227541E1C3C58006EB2D6 /* santabs.xpc */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		C795ED901D80A5BE007CFF42 /* SNTPolicyProcessor.m in Sources */ = {isa = PBXBuildFile; fileRef = C795ED8F1D80A5BE007CFF42 /* SNTPolicyProcessor.m */; };
 		C795ED911D80B66B007CFF42 /* SNTPolicyProcessor.m in Sources */ = {isa = PBXBuildFile; fileRef = C795ED8F1D80A5BE007CFF42 /* SNTPolicyProcessor.m */; };
+		C79A23581E23F7E80037AFA8 /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = C79A23561E23F7E80037AFA8 /* main.m */; };
+		C7BBA67E1E54C7E200F1E6A8 /* SNTXPCNotifierInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD604E19115A06006B445C /* SNTXPCNotifierInterface.m */; };
+		C7C721AE1E23FCB50051FAA6 /* SNTBundleService.m in Sources */ = {isa = PBXBuildFile; fileRef = C7C721AD1E23FCB50051FAA6 /* SNTBundleService.m */; };
+		C7C721B11E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */; };
+		C7C721B21E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */; };
+		C7C721B31E2400310051FAA6 /* SNTXPCConnection.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D6FDC9518C93A020044685C /* SNTXPCConnection.m */; };
+		C7C721B41E24042B0051FAA6 /* SNTStoredEvent.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD604A19105433006B445C /* SNTStoredEvent.m */; };
+		C7C721B51E2408BE0051FAA6 /* SNTFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD6041190ACCB8006B445C /* SNTFileInfo.m */; };
+		C7C721B61E2408C30051FAA6 /* SNTLogging.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DA73C9E1934F8100056D7C4 /* SNTLogging.m */; };
+		C7DA62F71E241938009BDF2C /* SNTXPCBundleServiceInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */; };
+		C7DA62F91E241A02009BDF2C /* SNTCommandBundleInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = C7DA62F81E241A02009BDF2C /* SNTCommandBundleInfo.m */; };
 		C7FB56F61DBFB480004E14EF /* SNTXPCSyncdInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7FB56F51DBFB480004E14EF /* SNTXPCSyncdInterface.m */; };
 		C7FB56F71DBFB480004E14EF /* SNTXPCSyncdInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = C7FB56F51DBFB480004E14EF /* SNTXPCSyncdInterface.m */; };
 		C7FB57001DBFC213004E14EF /* SNTSyncdQueue.m in Sources */ = {isa = PBXBuildFile; fileRef = C7FB56FF1DBFC213004E14EF /* SNTSyncdQueue.m */; };
+		D1761D2DAE8C790F29AFE6C9 /* libPods-LogicTests.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 7D949AA996AEAC326A4F6596 /* libPods-LogicTests.a */; };
+		D6D356C5BC8709C2E355C113 /* libPods-santactl.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 4E3B4B2438711ACD7D560014 /* libPods-santactl.a */; };
 /* End PBXBuildFile section */

 /* Begin PBXContainerItemProxy section */
@@ -230,6 +249,13 @@
 			remoteGlobalIDString = 0D35BD9D18FD71CE00921A21;
 			remoteInfo = santactl;
 		};
+		C7089E801EA1404900D0E1DC /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0D91BCA8174E8A6500131A7D /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = C78227531E1C3C58006EB2D6;
+			remoteInfo = santabs;
+		};
 /* End PBXContainerItemProxy section */

 /* Begin PBXCopyFilesBuildPhase section */
@@ -244,10 +270,19 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		C78227621E1C3C70006EB2D6 /* CopyFiles */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "$(CONTENTS_FOLDER_PATH)/XPCServices";
+			dstSubfolderSpec = 16;
+			files = (
+				C78227631E1C3C7D006EB2D6 /* santabs.xpc in CopyFiles */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXCopyFilesBuildPhase section */

 /* Begin PBXFileReference section */
-		07B44952FAAF4CA056FC4A62 /* Pods-santad.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.debug.xcconfig"; sourceTree = "<group>"; };
 		0D0016A2192BCD3C005E7FCD /* KernelTests */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = KernelTests; sourceTree = BUILT_PRODUCTS_DIR; };
 		0D0016A5192BCD3C005E7FCD /* main.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
 		0D0A1EC1191998C900B8450F /* SNTCommandSyncRuleDownload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncRuleDownload.h; sourceTree = "<group>"; };
@@ -386,28 +421,43 @@
 		0DF395621AB76A7900CBC520 /* NSData+Zlib.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "NSData+Zlib.h"; sourceTree = "<group>"; };
 		0DF395631AB76A7900CBC520 /* NSData+Zlib.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = "NSData+Zlib.m"; sourceTree = "<group>"; };
 		0DF395651AB76ABC00CBC520 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = usr/lib/libz.dylib; sourceTree = SDKROOT; };
-		3EAD1E725C5F299F58F754D7 /* libPods-LogicTests.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-LogicTests.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		14B98F4051188ECB7D024331 /* libPods-santad-santabs.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santad-santabs.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		29DEB147E07B3D5E61674D49 /* Pods-santad.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.release.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.release.xcconfig"; sourceTree = "<group>"; };
+		351CEE7AC20DDB0345A706BE /* Pods-LogicTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.release.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.release.xcconfig"; sourceTree = "<group>"; };
 		409232791A51B65D00A04527 /* SNTCommandRule.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandRule.m; sourceTree = "<group>"; };
-		5123AB484639A3640D62CB67 /* Pods-santactl.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.release.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.release.xcconfig"; sourceTree = "<group>"; };
-		5B0D17672432F610DE7F14EA /* Pods-LogicTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.debug.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.debug.xcconfig"; sourceTree = "<group>"; };
-		6519E416CC4D06EE85DDB34B /* Pods-Santa.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.release.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.release.xcconfig"; sourceTree = "<group>"; };
-		6A947802FC1698EC37A47F5C /* Pods-santactl.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.debug.xcconfig"; sourceTree = "<group>"; };
-		8FE66FA803110026A2A57C59 /* libPods-Santa.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-Santa.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		A5C68436912C0F98A7DE3BFA /* Pods-LogicTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.release.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.release.xcconfig"; sourceTree = "<group>"; };
+		4E3B4B2438711ACD7D560014 /* libPods-santactl.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santactl.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		670AD2EB5E3572321B058D02 /* Pods-Santa.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.debug.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.debug.xcconfig"; sourceTree = "<group>"; };
+		6C489E087A247B24480DB954 /* Pods-LogicTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.debug.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.debug.xcconfig"; sourceTree = "<group>"; };
+		7D949AA996AEAC326A4F6596 /* libPods-LogicTests.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-LogicTests.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		81133DAE1F3A75CE00917FF9 /* SNTCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommand.h; sourceTree = "<group>"; };
+		81133DAF1F3A75CE00917FF9 /* SNTCommand.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommand.m; sourceTree = "<group>"; };
+		8EF10E4B8C86CED022C72F1B /* Pods-santactl.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.debug.xcconfig"; sourceTree = "<group>"; };
+		90E9D568200AB9B642E06272 /* libPods-Santa.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-Santa.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		A6A91785C40257CC156B4F05 /* Pods-Santa.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.release.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.release.xcconfig"; sourceTree = "<group>"; };
+		C11A10A5D6E112788769CF70 /* libPods-santad.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santad.a"; sourceTree = BUILT_PRODUCTS_DIR; };
 		C72E8D931D7F399900C86DD3 /* SNTCommandFileInfoTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandFileInfoTest.m; sourceTree = "<group>"; };
+		C74D6CC51EEB3B9B00BB5A33 /* BundleExample.app */ = {isa = PBXFileReference; lastKnownFileType = wrapper.application; path = BundleExample.app; sourceTree = "<group>"; };
 		C76614EB1D142D3C00D150C1 /* SNTCommandCheckCache.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandCheckCache.m; sourceTree = "<group>"; };
 		C776A1051DEE160500A56616 /* SNTCommandSyncManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncManager.h; sourceTree = "<group>"; };
 		C776A1061DEE160500A56616 /* SNTCommandSyncManager.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncManager.m; sourceTree = "<group>"; };
+		C78227541E1C3C58006EB2D6 /* santabs.xpc */ = {isa = PBXFileReference; explicitFileType = "wrapper.xpc-service"; includeInIndex = 0; path = santabs.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
 		C795ED8E1D80A5BE007CFF42 /* SNTPolicyProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTPolicyProcessor.h; sourceTree = "<group>"; };
 		C795ED8F1D80A5BE007CFF42 /* SNTPolicyProcessor.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTPolicyProcessor.m; sourceTree = "<group>"; };
+		C79A23561E23F7E80037AFA8 /* main.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = "<group>"; };
+		C79A235A1E23F8820037AFA8 /* santabs-Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = "santabs-Info.plist"; sourceTree = "<group>"; };
+		C7C721AC1E23FCB50051FAA6 /* SNTBundleService.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTBundleService.h; sourceTree = "<group>"; };
+		C7C721AD1E23FCB50051FAA6 /* SNTBundleService.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTBundleService.m; sourceTree = "<group>"; };
+		C7C721AF1E23FF300051FAA6 /* SNTXPCBundleServiceInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTXPCBundleServiceInterface.h; sourceTree = "<group>"; };
+		C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTXPCBundleServiceInterface.m; sourceTree = "<group>"; };
+		C7DA62F81E241A02009BDF2C /* SNTCommandBundleInfo.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandBundleInfo.m; sourceTree = "<group>"; };
 		C7FB56F41DBFB480004E14EF /* SNTXPCSyncdInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTXPCSyncdInterface.h; sourceTree = "<group>"; };
 		C7FB56F51DBFB480004E14EF /* SNTXPCSyncdInterface.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTXPCSyncdInterface.m; sourceTree = "<group>"; };
 		C7FB56FE1DBFC213004E14EF /* SNTSyncdQueue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTSyncdQueue.h; sourceTree = "<group>"; };
 		C7FB56FF1DBFC213004E14EF /* SNTSyncdQueue.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTSyncdQueue.m; sourceTree = "<group>"; };
-		DC914D8DD0F5C0E21DA45150 /* libPods-santactl.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santactl.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		E57A355BC439804E082B9C0A /* libPods-santad.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santad.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		F1E491F3C201A2362E04FF81 /* Pods-santad.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.release.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.release.xcconfig"; sourceTree = "<group>"; };
-		F25BED2D82EB26743AD59464 /* Pods-Santa.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.debug.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.debug.xcconfig"; sourceTree = "<group>"; };
+		D7DEE68F05C49966396A2F10 /* Pods-santad-santabs.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad-santabs.release.xcconfig"; path = "Pods/Target Support Files/Pods-santad-santabs/Pods-santad-santabs.release.xcconfig"; sourceTree = "<group>"; };
+		D9B2D7095028D87E12E63EF7 /* Pods-santad-santabs.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad-santabs.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santad-santabs/Pods-santad-santabs.debug.xcconfig"; sourceTree = "<group>"; };
+		DF5FE88E12AB307864A53CE7 /* Pods-santactl.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.release.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.release.xcconfig"; sourceTree = "<group>"; };
+		E9FBFC5E3E1B268E4B453C9D /* Pods-santad.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.debug.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */

 /* Begin PBXFrameworksBuildPhase section */
@@ -423,7 +473,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				0D202D1E1CDD479400A88F16 /* libz.tbd in Frameworks */,
-				C4F8326EEB58061C1A579F0D /* libPods-LogicTests.a in Frameworks */,
+				D1761D2DAE8C790F29AFE6C9 /* libPods-LogicTests.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -432,7 +482,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				0DF395661AB76ABC00CBC520 /* libz.dylib in Frameworks */,
-				42805FED981952EC9F0E4272 /* libPods-santactl.a in Frameworks */,
+				D6D356C5BC8709C2E355C113 /* libPods-santactl.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -440,7 +490,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				7E396F5897B914399A568D27 /* libPods-Santa.a in Frameworks */,
+				B352A545B76783D568A6D0C5 /* libPods-Santa.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -448,7 +498,7 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				8E6BE2EABCDF090F0FCEA980 /* libPods-santad.a in Frameworks */,
+				168A4E09A2A5E0B7DF8A2F1A /* libPods-santad.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -459,6 +509,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		C78227511E1C3C58006EB2D6 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				59D56CF2D9C5BD9B7E3CC56D /* libPods-santad-santabs.a in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXFrameworksBuildPhase section */

 /* Begin PBXGroup section */
@@ -491,6 +549,7 @@
 		0D260DB018B68E12002A0B55 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
+				C74D6CC51EEB3B9B00BB5A33 /* BundleExample.app */,
 				0D536ED51B8E7A2E0039A26D /* bad_pagezero */,
 				0D2CD4601A81C7B100C9C910 /* dn.plist */,
 				0D536ED61B8E7A2E0039A26D /* missing_pagezero */,
@@ -508,6 +567,8 @@
 		0D35BDA018FD71CE00921A21 /* santactl */ = {
 			isa = PBXGroup;
 			children = (
+				81133DAE1F3A75CE00917FF9 /* SNTCommand.h */,
+				81133DAF1F3A75CE00917FF9 /* SNTCommand.m */,
 				0D35BDAA18FD7CFD00921A21 /* SNTCommandController.h */,
 				0D35BDAB18FD7CFD00921A21 /* SNTCommandController.m */,
 				0D35BDA118FD71CE00921A21 /* main.m */,
@@ -608,8 +669,8 @@
 				0DB77FDC1CD262F5004DF060 /* Source */,
 				0D789F9F1940F26D0036F7C4 /* Tests */,
 				0D91BCB5174E8A7E00131A7D /* Products */,
-				32B59E26727EF7DC0FC6A1C2 /* Pods */,
-				8ADEC8FA6FDD43E921A3E0D6 /* Frameworks */,
+				F6A64BBF2D62B24B58B2051B /* Pods */,
+				65ABB276038B07159901CE5B /* Frameworks */,
 			);
 			sourceTree = "<group>";
 		};
@@ -622,6 +683,7 @@
 				0D260DAC18B68E12002A0B55 /* LogicTests.xctest */,
 				0D35BD9E18FD71CE00921A21 /* santactl */,
 				0D0016A2192BCD3C005E7FCD /* KernelTests */,
+				C78227541E1C3C58006EB2D6 /* santabs.xpc */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -682,6 +744,8 @@
 				0D5058CF1CB70123008784BA /* SNTStrengthify.h */,
 				0D42D2B319D1D98A00955F08 /* SNTSystemInfo.h */,
 				0D42D2B419D1D98A00955F08 /* SNTSystemInfo.m */,
+				C7C721AF1E23FF300051FAA6 /* SNTXPCBundleServiceInterface.h */,
+				C7C721B01E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m */,
 				0D6FDC9418C93A020044685C /* SNTXPCConnection.h */,
 				0D6FDC9518C93A020044685C /* SNTXPCConnection.m */,
 				0DCD605319115D17006B445C /* SNTXPCControlInterface.h */,
@@ -748,6 +812,7 @@
 		0DAF01141C1B794B00F5B6C3 /* Commands */ = {
 			isa = PBXGroup;
 			children = (
+				C7DA62F81E241A02009BDF2C /* SNTCommandBundleInfo.m */,
 				C76614EB1D142D3C00D150C1 /* SNTCommandCheckCache.m */,
 				0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */,
 				0DE4C8A518FF3B1700466D04 /* SNTCommandFlushCache.m */,
@@ -765,6 +830,7 @@
 				0D91BCD5174E8AAB00131A7D /* common */,
 				0D91BCB9174E8A7E00131A7D /* santa-driver */,
 				0D9A7F401759330500035EB5 /* santad */,
+				C79A23541E23F7E80037AFA8 /* santabs */,
 				0D35BDA018FD71CE00921A21 /* santactl */,
 				0D385DBD180DE4A900418BC6 /* SantaGUI */,
 				0D2429471E787655005C6FC9 /* DevelopmentTeam.xcconfig */,
@@ -772,32 +838,54 @@
 			path = Source;
 			sourceTree = "<group>";
 		};
-		32B59E26727EF7DC0FC6A1C2 /* Pods */ = {
+		65ABB276038B07159901CE5B /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
-				5B0D17672432F610DE7F14EA /* Pods-LogicTests.debug.xcconfig */,
-				A5C68436912C0F98A7DE3BFA /* Pods-LogicTests.release.xcconfig */,
-				F25BED2D82EB26743AD59464 /* Pods-Santa.debug.xcconfig */,
-				6519E416CC4D06EE85DDB34B /* Pods-Santa.release.xcconfig */,
-				6A947802FC1698EC37A47F5C /* Pods-santactl.debug.xcconfig */,
-				5123AB484639A3640D62CB67 /* Pods-santactl.release.xcconfig */,
-				07B44952FAAF4CA056FC4A62 /* Pods-santad.debug.xcconfig */,
-				F1E491F3C201A2362E04FF81 /* Pods-santad.release.xcconfig */,
-			);
-			name = Pods;
-			sourceTree = "<group>";
-		};
-		8ADEC8FA6FDD43E921A3E0D6 /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				3EAD1E725C5F299F58F754D7 /* libPods-LogicTests.a */,
-				8FE66FA803110026A2A57C59 /* libPods-Santa.a */,
-				DC914D8DD0F5C0E21DA45150 /* libPods-santactl.a */,
-				E57A355BC439804E082B9C0A /* libPods-santad.a */,
+				7D949AA996AEAC326A4F6596 /* libPods-LogicTests.a */,
+				90E9D568200AB9B642E06272 /* libPods-Santa.a */,
+				4E3B4B2438711ACD7D560014 /* libPods-santactl.a */,
+				C11A10A5D6E112788769CF70 /* libPods-santad.a */,
+				14B98F4051188ECB7D024331 /* libPods-santad-santabs.a */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
 		};
+		C79A23541E23F7E80037AFA8 /* santabs */ = {
+			isa = PBXGroup;
+			children = (
+				C79A23561E23F7E80037AFA8 /* main.m */,
+				C7C721AC1E23FCB50051FAA6 /* SNTBundleService.h */,
+				C7C721AD1E23FCB50051FAA6 /* SNTBundleService.m */,
+				C79A23591E23F8820037AFA8 /* Resources */,
+			);
+			path = santabs;
+			sourceTree = "<group>";
+		};
+		C79A23591E23F8820037AFA8 /* Resources */ = {
+			isa = PBXGroup;
+			children = (
+				C79A235A1E23F8820037AFA8 /* santabs-Info.plist */,
+			);
+			path = Resources;
+			sourceTree = "<group>";
+		};
+		F6A64BBF2D62B24B58B2051B /* Pods */ = {
+			isa = PBXGroup;
+			children = (
+				6C489E087A247B24480DB954 /* Pods-LogicTests.debug.xcconfig */,
+				351CEE7AC20DDB0345A706BE /* Pods-LogicTests.release.xcconfig */,
+				670AD2EB5E3572321B058D02 /* Pods-Santa.debug.xcconfig */,
+				A6A91785C40257CC156B4F05 /* Pods-Santa.release.xcconfig */,
+				8EF10E4B8C86CED022C72F1B /* Pods-santactl.debug.xcconfig */,
+				DF5FE88E12AB307864A53CE7 /* Pods-santactl.release.xcconfig */,
+				E9FBFC5E3E1B268E4B453C9D /* Pods-santad.debug.xcconfig */,
+				29DEB147E07B3D5E61674D49 /* Pods-santad.release.xcconfig */,
+				D9B2D7095028D87E12E63EF7 /* Pods-santad-santabs.debug.xcconfig */,
+				D7DEE68F05C49966396A2F10 /* Pods-santad-santabs.release.xcconfig */,
+			);
+			name = Pods;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */

 /* Begin PBXHeadersBuildPhase section */
@@ -835,13 +923,13 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D260DBC18B68E12002A0B55 /* Build configuration list for PBXNativeTarget "LogicTests" */;
 			buildPhases = (
-				C22A218D691E062A00781563 /* [CP] Check Pods Manifest.lock */,
+				9BF8830B1029605A497F13D5 /* [CP] Check Pods Manifest.lock */,
 				0D673DAD18FC9017009C5B06 /* Delete existing coverage files */,
 				0D260DA818B68E12002A0B55 /* Sources */,
 				0D260DA918B68E12002A0B55 /* Frameworks */,
 				0D260DAA18B68E12002A0B55 /* Resources */,
-				9F946EAD2A73FDCBE3FA3454 /* [CP] Embed Pods Frameworks */,
-				43EC969A89E13A43B4161035 /* [CP] Copy Pods Resources */,
+				D49A3AB950AFD99741E9AF89 /* [CP] Embed Pods Frameworks */,
+				23869BA352E2C86DEFE62819 /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -856,11 +944,11 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D35BDA918FD71CE00921A21 /* Build configuration list for PBXNativeTarget "santactl" */;
 			buildPhases = (
-				8EF1E72D9F742F663ABE8DCD /* [CP] Check Pods Manifest.lock */,
+				C936E88DFEEB9D1ED552BA97 /* [CP] Check Pods Manifest.lock */,
 				0DD98E671A5DD02000A754C6 /* Update Version Info */,
 				0D35BD9A18FD71CE00921A21 /* Sources */,
 				0D35BD9B18FD71CE00921A21 /* Frameworks */,
-				3AA84DD536CCE6A50E24E85E /* [CP] Copy Pods Resources */,
+				2737FE8516A33567D3449943 /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -875,13 +963,13 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D385DE3180DE4A900418BC6 /* Build configuration list for PBXNativeTarget "Santa" */;
 			buildPhases = (
-				D5EF20F46A8F8B36E63D1709 /* [CP] Check Pods Manifest.lock */,
+				B193461D3612BCB47C16E407 /* [CP] Check Pods Manifest.lock */,
 				0DD98E681A5DD03E00A754C6 /* Update Version Info */,
 				0D385DB2180DE4A900418BC6 /* Sources */,
 				0D385DB3180DE4A900418BC6 /* Frameworks */,
 				0D385DB4180DE4A900418BC6 /* Resources */,
-				50E59E61A01D3126C43D49BB /* [CP] Embed Pods Frameworks */,
-				F1D2415B87633FA13FC7AA29 /* [CP] Copy Pods Resources */,
+				BA20035148DDEF5808B2C7EF /* [CP] Embed Pods Frameworks */,
+				DDE76075391100F3BCE3634E /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -901,6 +989,7 @@
 				0D91BCAE174E8A7E00131A7D /* Sources */,
 				0D91BCB0174E8A7E00131A7D /* Headers */,
 				0DC765E91B28D9CB00BAE651 /* CopyFiles */,
+				C78227621E1C3C70006EB2D6 /* CopyFiles */,
 				73FE93AEAAFA579D63B26D43 /* Frameworks */,
 			);
 			buildRules = (
@@ -918,21 +1007,42 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D9A7F471759330500035EB5 /* Build configuration list for PBXNativeTarget "santad" */;
 			buildPhases = (
-				828CFA7B34B9061FAFA68503 /* [CP] Check Pods Manifest.lock */,
+				2146C1274A8C11B3755A8A67 /* [CP] Check Pods Manifest.lock */,
 				0DD98E661A5DCED300A754C6 /* Update Version Info */,
 				0D9A7F391759330400035EB5 /* Sources */,
 				0D9A7F3A1759330400035EB5 /* Frameworks */,
-				999D3C0A9B06CC3DFFB45CEA /* [CP] Copy Pods Resources */,
+				531BBB5BA4BF953D628D29AB /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
 			dependencies = (
+				C7089E811EA1404900D0E1DC /* PBXTargetDependency */,
 			);
 			name = santad;
 			productName = santad;
 			productReference = 0D9A7F3D1759330500035EB5 /* santad */;
 			productType = "com.apple.product-type.tool";
 		};
+		C78227531E1C3C58006EB2D6 /* santabs */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C782275F1E1C3C58006EB2D6 /* Build configuration list for PBXNativeTarget "santabs" */;
+			buildPhases = (
+				1F3C2264A3EADEFC0DBE283E /* [CP] Check Pods Manifest.lock */,
+				C7F95F971E23F9E7007A6BF5 /* Update bundle version */,
+				C78227501E1C3C58006EB2D6 /* Sources */,
+				C78227511E1C3C58006EB2D6 /* Frameworks */,
+				C78227521E1C3C58006EB2D6 /* Resources */,
+				FCF4BDAA180BD63C32AC85DE /* [CP] Copy Pods Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = santabs;
+			productName = santabs;
+			productReference = C78227541E1C3C58006EB2D6 /* santabs.xpc */;
+			productType = "com.apple.product-type.xpc-service";
+		};
 /* End PBXNativeTarget section */

 /* Begin PBXProject section */
@@ -944,6 +1054,9 @@
 					0D260DAB18B68E12002A0B55 = {
 						TestTargetID = 0D385DB5180DE4A900418BC6;
 					};
+					C78227531E1C3C58006EB2D6 = {
+						CreatedOnToolsVersion = 7.3.1;
+					};
 				};
 			};
 			buildConfigurationList = 0D91BCAB174E8A6500131A7D /* Build configuration list for PBXProject "Santa" */;
@@ -963,6 +1076,7 @@
 				0D91BCB3174E8A7E00131A7D /* santa-driver */,
 				0D9A7F3C1759330400035EB5 /* santad */,
 				0D35BD9D18FD71CE00921A21 /* santactl */,
+				C78227531E1C3C58006EB2D6 /* santabs */,
 				0D385DB5180DE4A900418BC6 /* Santa */,
 				0D260DAB18B68E12002A0B55 /* LogicTests */,
 				0D0016A1192BCD3C005E7FCD /* KernelTests */,
@@ -977,6 +1091,7 @@
 			files = (
 				0DEA5F761CF6482E00704398 /* sync_eventupload_input_basic.plist in Resources */,
 				0D536ED71B8E7A2E0039A26D /* bad_pagezero in Resources */,
+				C74D6CC61EEB3B9B00BB5A33 /* BundleExample.app in Resources */,
 				0DEA5F7A1CF64C9200704398 /* sync_ruledownload_batch1.json in Resources */,
 				0DEA5F741CF63B9600704398 /* sync_eventupload_input_quarantine.plist in Resources */,
 				0D2CD4611A81C7B100C9C910 /* dn.plist in Resources */,
@@ -997,6 +1112,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		C78227521E1C3C58006EB2D6 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXResourcesBuildPhase section */

 /* Begin PBXShellScriptBuildPhase section */
@@ -1093,22 +1215,37 @@
 			shellPath = /bin/sh;
 			shellScript = "GIT_TAG=$(git describe --abbrev=0 --tags)\nsed -i '' \"s/TO.BE.FILLED/${GIT_TAG}/\" ${DERIVED_FILE_DIR}/santa-driver_info.c";
 		};
-		3AA84DD536CCE6A50E24E85E /* [CP] Copy Pods Resources */ = {
+		1F3C2264A3EADEFC0DBE283E /* [CP] Check Pods Manifest.lock */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "[CP] Copy Pods Resources";
+			name = "[CP] Check Pods Manifest.lock";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santactl/Pods-santactl-resources.sh\"\n";
+			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
 			showEnvVarsInLog = 0;
 		};
-		43EC969A89E13A43B4161035 /* [CP] Copy Pods Resources */ = {
+		2146C1274A8C11B3755A8A67 /* [CP] Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		23869BA352E2C86DEFE62819 /* [CP] Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -1123,52 +1260,22 @@
 			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests-resources.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		50E59E61A01D3126C43D49BB /* [CP] Embed Pods Frameworks */ = {
+		2737FE8516A33567D3449943 /* [CP] Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "[CP] Embed Pods Frameworks";
+			name = "[CP] Copy Pods Resources";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-frameworks.sh\"\n";
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santactl/Pods-santactl-resources.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		828CFA7B34B9061FAFA68503 /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		8EF1E72D9F742F663ABE8DCD /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		999D3C0A9B06CC3DFFB45CEA /* [CP] Copy Pods Resources */ = {
+		531BBB5BA4BF953D628D29AB /* [CP] Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -1183,7 +1290,84 @@
 			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santad/Pods-santad-resources.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		9F946EAD2A73FDCBE3FA3454 /* [CP] Embed Pods Frameworks */ = {
+		9BF8830B1029605A497F13D5 /* [CP] Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		B193461D3612BCB47C16E407 /* [CP] Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		BA20035148DDEF5808B2C7EF /* [CP] Embed Pods Frameworks */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Embed Pods Frameworks";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-frameworks.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		C7F95F971E23F9E7007A6BF5 /* Update bundle version */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/Source/santabs/Resources/santabs-Info.plist",
+			);
+			name = "Update bundle version";
+			outputPaths = (
+				"$(DERIVED_FILE_DIR)/santabs-Info.plist",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "GIT_TAG=$(git describe --abbrev=0 --tags)\nGIT_COMMIT=$(git rev-parse --short HEAD)\n\ncp ${SCRIPT_INPUT_FILE_0} ${SCRIPT_OUTPUT_FILE_0}\n\nif [ $CONFIGURATION = \"Debug\" ]; then\nnewVersion=\"${GIT_TAG}d ${GIT_COMMIT}\"\nelse\nnewVersion=\"${GIT_TAG}\"\nfi\n\n/usr/libexec/PlistBuddy -c \"Set :CFBundleVersion ${GIT_TAG}\" ${SCRIPT_OUTPUT_FILE_0}\n/usr/libexec/PlistBuddy -c \"Set :CFBundleShortVersionString ${newVersion}\" ${SCRIPT_OUTPUT_FILE_0}";
+			showEnvVarsInLog = 0;
+		};
+		C936E88DFEEB9D1ED552BA97 /* [CP] Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		D49A3AB950AFD99741E9AF89 /* [CP] Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -1198,37 +1382,7 @@
 			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests-frameworks.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		C22A218D691E062A00781563 /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		D5EF20F46A8F8B36E63D1709 /* [CP] Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "[CP] Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n    # print error to STDERR\n    echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		F1D2415B87633FA13FC7AA29 /* [CP] Copy Pods Resources */ = {
+		DDE76075391100F3BCE3634E /* [CP] Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -1243,6 +1397,21 @@
 			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-resources.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
+		FCF4BDAA180BD63C32AC85DE /* [CP] Copy Pods Resources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "[CP] Copy Pods Resources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santad-santabs/Pods-santad-santabs-resources.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
 /* End PBXShellScriptBuildPhase section */

 /* Begin PBXSourcesBuildPhase section */
@@ -1258,7 +1427,9 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				81133DB01F3A76F700917FF9 /* SNTCommand.m in Sources */,
 				C714F8B21D8044FE00700EDF /* SNTCommandController.m in Sources */,
+				C7DA62F71E241938009BDF2C /* SNTXPCBundleServiceInterface.m in Sources */,
 				C714F8B11D8044D400700EDF /* SNTCommandFileInfo.m in Sources */,
 				0D88680C1AC48A1400B86659 /* SNTSystemInfo.m in Sources */,
 				0D536EDC1B94E9230039A26D /* SNTEventLog.m in Sources */,
@@ -1308,6 +1479,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				81133DB11F3A77C600917FF9 /* SNTCommand.m in Sources */,
 				0DA73CA21934F88D0056D7C4 /* SNTLogging.m in Sources */,
 				0D35BDB518FD84F600921A21 /* SNTCommandSync.m in Sources */,
 				0DCD5FBF1909D64A006B445C /* SNTCommandFileInfo.m in Sources */,
@@ -1335,6 +1507,7 @@
 				0D0A1EC3191998C900B8450F /* SNTCommandSyncRuleDownload.m in Sources */,
 				0DB390991AB1E11400614002 /* SNTCommandVersion.m in Sources */,
 				0D42D2B519D1D98A00955F08 /* SNTSystemInfo.m in Sources */,
+				C7DA62F91E241A02009BDF2C /* SNTCommandBundleInfo.m in Sources */,
 				0D827E6719DF3C74006EC811 /* SNTCommandStatus.m in Sources */,
 				0D0A1EC6191AB9B000B8450F /* SNTCommandSyncPostflight.m in Sources */,
 				0D35BDAC18FD7CFD00921A21 /* SNTCommandController.m in Sources */,
@@ -1360,6 +1533,7 @@
 				0D668E8118D1121700E29A8B /* SNTMessageWindow.m in Sources */,
 				0DA73CA11934F8100056D7C4 /* SNTLogging.m in Sources */,
 				0DEFB7C51ACDD80100B92AAE /* SNTFileWatcher.m in Sources */,
+				C7479F051E53704E0054C1CF /* SNTXPCBundleServiceInterface.m in Sources */,
 				0D20710E1A7C4A86008B0A9A /* SNTStoredEvent.m in Sources */,
 				0DE2CE561CA05561002B649A /* SNTAccessibleTextField.m in Sources */,
 			);
@@ -1388,6 +1562,7 @@
 				0DB8ACC1185662DC00FEF9C7 /* SNTApplication.m in Sources */,
 				0D9A7F421759330500035EB5 /* main.m in Sources */,
 				0DA73C9F1934F8100056D7C4 /* SNTLogging.m in Sources */,
+				C7C721B11E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m in Sources */,
 				0DE71A751B95F7F900518526 /* SNTCachedDecision.m in Sources */,
 				C7FB56F61DBFB480004E14EF /* SNTXPCSyncdInterface.m in Sources */,
 				0DCD6042190ACCB8006B445C /* SNTFileInfo.m in Sources */,
@@ -1409,6 +1584,23 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		C78227501E1C3C58006EB2D6 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				C7C721B21E23FF300051FAA6 /* SNTXPCBundleServiceInterface.m in Sources */,
+				C7C721B31E2400310051FAA6 /* SNTXPCConnection.m in Sources */,
+				C7C721B61E2408C30051FAA6 /* SNTLogging.m in Sources */,
+				C7C721B41E24042B0051FAA6 /* SNTStoredEvent.m in Sources */,
+				C7C721B51E2408BE0051FAA6 /* SNTFileInfo.m in Sources */,
+				C7BBA67E1E54C7E200F1E6A8 /* SNTXPCNotifierInterface.m in Sources */,
+				C7479F071E5374BF0054C1CF /* SNTXPCControlInterface.m in Sources */,
+				C7479F091E5374E50054C1CF /* SNTRule.m in Sources */,
+				C79A23581E23F7E80037AFA8 /* main.m in Sources */,
+				C7C721AE1E23FCB50051FAA6 /* SNTBundleService.m in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXSourcesBuildPhase section */

 /* Begin PBXTargetDependency section */
@@ -1452,6 +1644,11 @@
 			target = 0D35BD9D18FD71CE00921A21 /* santactl */;
 			targetProxy = 0DC765E71B28D9C600BAE651 /* PBXContainerItemProxy */;
 		};
+		C7089E811EA1404900D0E1DC /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = C78227531E1C3C58006EB2D6 /* santabs */;
+			targetProxy = C7089E801EA1404900D0E1DC /* PBXContainerItemProxy */;
+		};
 /* End PBXTargetDependency section */

 /* Begin XCBuildConfiguration section */
@@ -1530,7 +1727,7 @@
 		};
 		0D260DBA18B68E12002A0B55 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5B0D17672432F610DE7F14EA /* Pods-LogicTests.debug.xcconfig */;
+			baseConfigurationReference = 6C489E087A247B24480DB954 /* Pods-LogicTests.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1578,7 +1775,7 @@
 		};
 		0D260DBB18B68E12002A0B55 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = A5C68436912C0F98A7DE3BFA /* Pods-LogicTests.release.xcconfig */;
+			baseConfigurationReference = 351CEE7AC20DDB0345A706BE /* Pods-LogicTests.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1621,7 +1818,7 @@
 		};
 		0D35BDA718FD71CE00921A21 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 6A947802FC1698EC37A47F5C /* Pods-santactl.debug.xcconfig */;
+			baseConfigurationReference = 8EF10E4B8C86CED022C72F1B /* Pods-santactl.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1659,7 +1856,7 @@
 		};
 		0D35BDA818FD71CE00921A21 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 5123AB484639A3640D62CB67 /* Pods-santactl.release.xcconfig */;
+			baseConfigurationReference = DF5FE88E12AB307864A53CE7 /* Pods-santactl.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1692,7 +1889,7 @@
 		};
 		0D385DE4180DE4A900418BC6 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = F25BED2D82EB26743AD59464 /* Pods-Santa.debug.xcconfig */;
+			baseConfigurationReference = 670AD2EB5E3572321B058D02 /* Pods-Santa.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
@@ -1712,6 +1909,7 @@
 				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 				GCC_PRECOMPILE_PREFIX_HEADER = YES;
 				GCC_PREPROCESSOR_DEFINITIONS = (
+					"SANTAGUI=1",
 					"DEBUG=1",
 					"$(inherited)",
 				);
@@ -1731,7 +1929,7 @@
 		};
 		0D385DE5180DE4A900418BC6 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 6519E416CC4D06EE85DDB34B /* Pods-Santa.release.xcconfig */;
+			baseConfigurationReference = A6A91785C40257CC156B4F05 /* Pods-Santa.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
@@ -1750,6 +1948,11 @@
 				ENABLE_NS_ASSERTIONS = NO;
 				GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 				GCC_PRECOMPILE_PREFIX_HEADER = YES;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"SANTAGUI=1",
+					"$(inherited)",
+					"COCOAPODS=1",
+				);
 				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
 				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
 				GCC_WARN_UNDECLARED_SELECTOR = YES;
@@ -1907,7 +2110,7 @@
 		};
 		0D9A7F481759330500035EB5 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 07B44952FAAF4CA056FC4A62 /* Pods-santad.debug.xcconfig */;
+			baseConfigurationReference = E9FBFC5E3E1B268E4B453C9D /* Pods-santad.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1941,7 +2144,7 @@
 		};
 		0D9A7F491759330500035EB5 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = F1E491F3C201A2362E04FF81 /* Pods-santad.release.xcconfig */;
+			baseConfigurationReference = 29DEB147E07B3D5E61674D49 /* Pods-santad.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1967,6 +2170,89 @@
 			};
 			name = Release;
 		};
+		C782275D1E1C3C58006EB2D6 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = D9B2D7095028D87E12E63EF7 /* Pods-santad-santabs.debug.xcconfig */;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COMBINE_HIDPI_IMAGES = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu99;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				INFOPLIST_FILE = "${DERIVED_FILE_DIR}/santabs-Info.plist";
+				MTL_ENABLE_DEBUG_INFO = YES;
+				PRODUCT_BUNDLE_IDENTIFIER = com.google.santabs;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SKIP_INSTALL = YES;
+			};
+			name = Debug;
+		};
+		C782275E1E1C3C58006EB2D6 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = D7DEE68F05C49966396A2F10 /* Pods-santad-santabs.release.xcconfig */;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COMBINE_HIDPI_IMAGES = YES;
+				COPY_PHASE_STRIP = NO;
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu99;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				INFOPLIST_FILE = "${DERIVED_FILE_DIR}/santabs-Info.plist";
+				MTL_ENABLE_DEBUG_INFO = NO;
+				PRODUCT_BUNDLE_IDENTIFIER = com.google.santabs;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SKIP_INSTALL = YES;
+			};
+			name = Release;
+		};
 /* End XCBuildConfiguration section */

 /* Begin XCConfigurationList section */
@@ -2042,6 +2328,15 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		C782275F1E1C3C58006EB2D6 /* Build configuration list for PBXNativeTarget "santabs" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C782275D1E1C3C58006EB2D6 /* Debug */,
+				C782275E1E1C3C58006EB2D6 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 /* End XCConfigurationList section */
 	};
 	rootObject = 0D91BCA8174E8A6500131A7D /* Project object */;
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santabs.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santabs.xcscheme
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+               BuildableName = "santabs.xpc"
+               BlueprintName = "santabs"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+            BuildableName = "santabs.xpc"
+            BlueprintName = "santabs"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
+            BuildableName = "santabs.xpc"
+            BlueprintName = "santabs"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>
--- a/Source/SantaGUI/Resources/AboutWindow.xib
+++ b/Source/SantaGUI/Resources/AboutWindow.xib
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="6254" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="16D32" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="6254"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="10117"/>
    </dependencies>
    <objects>
        <customObject id="-2" userLabel="File's Owner" customClass="SNTAboutWindowController">
@@ -16,7 +16,7 @@
        <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
            <rect key="contentRect" x="196" y="240" width="480" height="200"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1577"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
            <view key="contentView" id="se5-gp-TjO">
                <rect key="frame" x="0.0" y="0.0" width="480" height="200"/>
                <autoresizingMask key="autoresizingMask"/>
--- a/Source/SantaGUI/Resources/MessageWindow.xib
+++ b/Source/SantaGUI/Resources/MessageWindow.xib
@@ -1,5 +1,5 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="15G31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="16F73" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
        <deployment identifier="macosx"/>
        <development version="6300" identifier="xcode"/>
@@ -9,6 +9,10 @@
        <customObject id="-2" userLabel="File's Owner" customClass="SNTMessageWindowController">
            <connections>
                <outlet property="applicationNameLabel" destination="qgf-Jf-cJr" id="1JX-X8-03v"/>
+                <outlet property="bundleHashLabel" destination="xP7-jE-NF8" id="i8B-Gs-2E3"/>
+                <outlet property="bundleHashTitle" destination="MhO-U0-MLR" id="KT0-bK-fpV"/>
+                <outlet property="foundFileCountLabel" destination="LHV-gV-vyf" id="Sr0-T2-xGx"/>
+                <outlet property="hashingIndicator" destination="VyY-Yg-JOe" id="Yq4-tZ-9ep"/>
                <outlet property="openEventButton" destination="7ua-5a-uSd" id="9s4-ZA-Vlo"/>
                <outlet property="window" destination="9Bq-yh-54f" id="Uhs-WF-TV9"/>
            </connections>
@@ -17,14 +21,14 @@
        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
            <windowStyleMask key="styleMask" utility="YES"/>
-            <rect key="contentRect" x="167" y="107" width="497" height="439"/>
+            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
            <view key="contentView" id="Iwq-Lx-rLv">
-                <rect key="frame" x="0.0" y="0.0" width="497" height="439"/>
+                <rect key="frame" x="0.0" y="0.0" width="540" height="479"/>
                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                <subviews>
                    <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
-                        <rect key="frame" x="-6" y="411" width="37" height="32"/>
+                        <rect key="frame" x="16" y="451" width="37" height="32"/>
                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                            <font key="font" metaFont="system"/>
@@ -37,7 +41,7 @@
                        </connections>
                    </button>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
-                        <rect key="frame" x="206" y="368" width="85" height="41"/>
+                        <rect key="frame" x="228" y="408" width="85" height="41"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
                            <font key="font" metaFont="systemUltraLight" size="34"/>
                            <color key="textColor" red="0.20000000000000001" green="0.20000000000000001" blue="0.20000000000000001" alpha="1" colorSpace="calibratedRGB"/>
@@ -51,7 +55,7 @@
                        </connections>
                    </textField>
                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="22" y="329" width="454" height="17"/>
+                        <rect key="frame" x="43" y="369" width="454" height="17"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
                        </constraints>
@@ -65,58 +69,10 @@
                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="VC7-bE-uHc"/>
                        </connections>
                    </textField>
-                    <box horizontalHuggingPriority="750" title="Line" boxType="custom" borderType="line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
-                        <rect key="frame" x="146" y="132" width="1" height="167"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="1" id="0o1-Jh-epf"/>
-                        </constraints>
-                        <color key="borderColor" white="0.0" alpha="0.17999999999999999" colorSpace="calibratedWhite"/>
-                        <color key="fillColor" white="0.0" alpha="0.0" colorSpace="calibratedWhite"/>
-                        <font key="titleFont" metaFont="system"/>
-                    </box>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="pDa-fA-vnC" userLabel="Label: Application">
-                        <rect key="frame" x="8" y="282" width="120" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="116" id="8mA-zi-Ev7"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Application" id="Hy7-WF-6xW">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="hidden" keyPath="self.event.fileBundleName" id="r2Q-hh-Uy5">
-                                <dictionary key="options">
-                                    <string key="NSValueTransformerName">NSIsNil</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="282" width="294" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="Pav-ZA-iAu"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.fileBundleName" id="enC-Cl-UWt">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Unknown</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="257" width="120" height="17"/>
+                        <rect key="frame" x="8" y="297" width="142" height="17"/>
                        <constraints>
-                            <constraint firstAttribute="width" constant="116" id="Kqd-nX-7df"/>
+                            <constraint firstAttribute="width" constant="138" id="Kqd-nX-7df"/>
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Filename" id="KgY-X1-ESG">
                            <font key="font" metaFont="systemBold"/>
@@ -128,9 +84,9 @@
                        </textFieldCell>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="232" width="120" height="17"/>
+                        <rect key="frame" x="8" y="272" width="142" height="17"/>
                        <constraints>
-                            <constraint firstAttribute="width" constant="116" id="3wU-P0-gAC"/>
+                            <constraint firstAttribute="width" constant="138" id="3wU-P0-gAC"/>
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Path" id="adC-be-Beh">
                            <font key="font" metaFont="systemBold"/>
@@ -141,10 +97,10 @@
                            </userDefinedRuntimeAttributes>
                        </textFieldCell>
                    </textField>
-                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="257" width="294" height="17"/>
+                    <textField toolTip="Binary Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="297" width="315" height="17"/>
                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="xVR-j3-dLw"/>
+                            <constraint firstAttribute="width" constant="311" id="xVR-j3-dLw"/>
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Name" id="E7T-9h-ofr">
                            <font key="font" metaFont="system"/>
@@ -156,7 +112,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5" userLabel="Label: Publisher">
-                        <rect key="frame" x="8" y="207" width="120" height="17"/>
+                        <rect key="frame" x="8" y="247" width="142" height="17"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Publisher" id="yL9-yD-JXX">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -167,9 +123,9 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="Publisher" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w" userLabel="Publisher" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="207" width="294" height="17"/>
+                        <rect key="frame" x="187" y="247" width="315" height="17"/>
                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="Dem-wH-KHm"/>
+                            <constraint firstAttribute="width" constant="311" id="Dem-wH-KHm"/>
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
                            <font key="font" metaFont="system"/>
@@ -185,7 +141,7 @@
                        </connections>
                    </textField>
                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
-                        <rect key="frame" x="40" y="208" width="15" height="15"/>
+                        <rect key="frame" x="62" y="248" width="15" height="15"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
@@ -207,7 +163,7 @@
                        </connections>
                    </button>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y" userLabel="Label: Identifier">
-                        <rect key="frame" x="8" y="182" width="120" height="17"/>
+                        <rect key="frame" x="8" y="222" width="142" height="17"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Identifier" id="eKN-Ic-5zy">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -217,8 +173,8 @@
                            </userDefinedRuntimeAttributes>
                        </textFieldCell>
                    </textField>
-                    <textField verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
-                        <rect key="frame" x="165" y="182" width="219" height="17"/>
+                    <textField toolTip="SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
+                        <rect key="frame" x="187" y="222" width="219" height="17"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="215" id="4hh-R2-86s"/>
                        </constraints>
@@ -234,8 +190,26 @@
                            <binding destination="-2" name="value" keyPath="self.event.fileSHA256" id="9KB-0b-qLV"/>
                        </connections>
                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="MhO-U0-MLR" userLabel="Label: Bundle Identifier">
+                        <rect key="frame" x="8" y="197" width="142" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Bundle Identifier" id="LEe-u0-52o">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="hidden" keyPath="self.event.needsBundleHash" id="2kb-3z-Kyn">
+                                <dictionary key="options">
+                                    <string key="NSValueTransformerName">NSNegateBoolean</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="eQb-0a-76J" userLabel="Label: Parent">
-                        <rect key="frame" x="8" y="157" width="120" height="17"/>
+                        <rect key="frame" x="8" y="157" width="142" height="17"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Parent" id="gze-4A-1w5">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -246,7 +220,7 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="Parent Process" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="f1p-GL-O3o" userLabel="Parent" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="157" width="294" height="17"/>
+                        <rect key="frame" x="187" y="157" width="294" height="17"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="290" id="h3Y-mO-38F"/>
                        </constraints>
@@ -269,7 +243,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="oFj-ol-xpL" userLabel="Label: User">
-                        <rect key="frame" x="8" y="132" width="120" height="17"/>
+                        <rect key="frame" x="8" y="132" width="142" height="17"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="User" id="1ut-uT-hQD">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -279,26 +253,8 @@
                            </userDefinedRuntimeAttributes>
                        </textFieldCell>
                    </textField>
-                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="132" width="294" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.executingUser" id="IcM-Lt-xTT">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Unknown</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
-                        <rect key="frame" x="132" y="33" width="112" height="25"/>
+                        <rect key="frame" x="154" y="33" width="112" height="25"/>
                        <constraints>
                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
                        </constraints>
@@ -315,8 +271,35 @@ DQ
                            <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
                        </connections>
                    </button>
+                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="272" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="p1W-f9-KBX"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.filePath" id="Sry-KY-HDb"/>
+                        </connections>
+                    </textField>
+                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
+                        <rect key="frame" x="113" y="80" width="315" height="29"/>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                        </constraints>
+                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
+                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
+                            <font key="font" metaFont="smallSystem"/>
+                        </buttonCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
+                        </connections>
+                    </button>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
-                        <rect key="frame" x="256" y="33" width="110" height="25"/>
+                        <rect key="frame" x="278" y="33" width="110" height="25"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
@@ -335,61 +318,138 @@ DQ
                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="4KL-Z2-1op"/>
                        </connections>
                    </button>
-                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="165" y="232" width="294" height="17"/>
+                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="132" width="294" height="17"/>
                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="p1W-f9-KBX"/>
+                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
                            <font key="font" metaFont="system"/>
                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.filePath" id="Sry-KY-HDb"/>
+                            <binding destination="-2" name="value" keyPath="self.event.executingUser" id="IcM-Lt-xTT">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
                        </connections>
                    </textField>
-                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
-                        <rect key="frame" x="91" y="80" width="315" height="29"/>
+                    <progressIndicator wantsLayer="YES" canDrawConcurrently="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" maxValue="1" bezeled="NO" controlSize="small" style="bar" translatesAutoresizingMaskIntoConstraints="NO" id="VyY-Yg-JOe">
+                        <rect key="frame" x="187" y="199" width="217" height="12"/>
                        <constraints>
-                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                            <constraint firstAttribute="width" constant="217" id="M22-Dv-KIP"/>
                        </constraints>
-                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
-                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                            <font key="font" metaFont="smallSystem"/>
-                        </buttonCell>
+                    </progressIndicator>
+                    <textField toolTip="Bundle SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="xP7-jE-NF8">
+                        <rect key="frame" x="187" y="197" width="219" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="215" id="s7W-o9-2nN"/>
+                        </constraints>
+                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="Calculating..." id="yJa-yL-X9a">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
+                            <binding destination="-2" name="value" keyPath="self.event.fileBundleHash" id="CnT-q6-bot"/>
                        </connections>
-                    </button>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="LHV-gV-vyf">
+                        <rect key="frame" x="187" y="182" width="219" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="215" id="LUu-Vd-peN"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="1000 related binaries" id="AVM-vB-hB8">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                    </textField>
+                    <box horizontalHuggingPriority="750" title="Line" boxType="custom" borderType="line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
+                        <rect key="frame" x="168" y="132" width="1" height="207"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="1" id="0o1-Jh-epf"/>
+                        </constraints>
+                        <color key="borderColor" white="0.0" alpha="0.17999999999999999" colorSpace="calibratedWhite"/>
+                        <color key="fillColor" white="0.0" alpha="0.0" colorSpace="calibratedWhite"/>
+                        <font key="titleFont" metaFont="system"/>
+                    </box>
+                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="322" width="315" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="Pav-ZA-iAu"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.fileBundleName" id="enC-Cl-UWt">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="pDa-fA-vnC" userLabel="Label: Application">
+                        <rect key="frame" x="8" y="322" width="142" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="8mA-zi-Ev7"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Application" id="Hy7-WF-6xW">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="hidden" keyPath="self.event.fileBundleName" id="r2Q-hh-Uy5">
+                                <dictionary key="options">
+                                    <string key="NSValueTransformerName">NSIsNil</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
                </subviews>
                <constraints>
                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="0AD-PS-5V1"/>
                    <constraint firstItem="f1p-GL-O3o" firstAttribute="centerY" secondItem="eQb-0a-76J" secondAttribute="centerY" id="2Aq-1E-Ybz"/>
                    <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" priority="500" constant="193" id="2uo-Cm-Tfp"/>
                    <constraint firstItem="h6f-PY-cc0" firstAttribute="top" secondItem="f1p-GL-O3o" secondAttribute="bottom" constant="8" id="496-VQ-Fx5"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="5Mr-By-PAU"/>
                    <constraint firstItem="pDa-fA-vnC" firstAttribute="centerY" secondItem="qgf-Jf-cJr" secondAttribute="centerY" id="AKX-pe-hEX"/>
                    <constraint firstItem="C3G-wL-u7w" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="ALv-0v-szi"/>
-                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="8" id="E6D-7P-17g"/>
                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="FPe-Rd-G4n"/>
                    <constraint firstItem="cJf-k6-OxS" firstAttribute="centerY" secondItem="C3G-wL-u7w" secondAttribute="centerY" id="FdL-ZZ-Vbe"/>
                    <constraint firstItem="t8c-Fx-e5h" firstAttribute="top" secondItem="Iwq-Lx-rLv" secondAttribute="top" constant="30" id="FuB-GX-0jg"/>
                    <constraint firstItem="oFj-ol-xpL" firstAttribute="bottom" secondItem="4Li-ul-zIi" secondAttribute="bottom" id="G0I-O2-S91"/>
-                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="cJf-k6-OxS" secondAttribute="trailing" constant="-45" id="GD2-Ka-deo"/>
+                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="cJf-k6-OxS" secondAttribute="trailing" constant="-67" id="GD2-Ka-deo"/>
                    <constraint firstItem="BbV-3h-mmL" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="GT2-tO-2td"/>
                    <constraint firstItem="h6f-PY-cc0" firstAttribute="centerY" secondItem="oFj-ol-xpL" secondAttribute="centerY" id="GXI-pT-FM1"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="top" secondItem="pDa-fA-vnC" secondAttribute="top" id="Gd4-Nr-n5G"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="8" id="HUT-MI-jsR"/>
                    <constraint firstItem="qgf-Jf-cJr" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="Ht4-Lg-U5N"/>
+                    <constraint firstItem="LHV-gV-vyf" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="IA0-dy-2be"/>
                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="IwX-ja-ZIs"/>
                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="top" secondItem="4Li-ul-zIi" secondAttribute="top" priority="500" id="JY4-N1-j8e"/>
                    <constraint firstItem="YNz-ka-cBi" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="KmX-kX-VCN"/>
                    <constraint firstItem="5D8-GP-a4l" firstAttribute="centerX" secondItem="Iwq-Lx-rLv" secondAttribute="centerX" id="LkH-F4-Ncm"/>
-                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="30" id="Nsl-zf-poH"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="55" id="Nsl-zf-poH"/>
                    <constraint firstItem="YNz-ka-cBi" firstAttribute="centerY" secondItem="bDE-Tl-UHg" secondAttribute="centerY" id="ObQ-RA-S5V"/>
                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="SCl-Ky-VmT"/>
                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="centerY" secondItem="pc8-G9-4pJ" secondAttribute="centerY" id="SLv-F7-w5k"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="KEB-eH-x2Y" secondAttribute="trailing" constant="20" id="Seb-c0-MUL"/>
                    <constraint firstAttribute="centerX" secondItem="cD5-Su-lXR" secondAttribute="centerX" id="V0a-Py-iEc"/>
+                    <constraint firstItem="LHV-gV-vyf" firstAttribute="top" secondItem="VyY-Yg-JOe" secondAttribute="bottom" id="Vjr-NX-j8V"/>
+                    <constraint firstItem="MhO-U0-MLR" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="Vly-VE-BwU"/>
                    <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="leading" priority="999" id="Z6G-l9-G4a"/>
                    <constraint firstItem="C3G-wL-u7w" firstAttribute="top" secondItem="bDE-Tl-UHg" secondAttribute="bottom" constant="8" id="ZoS-xV-2WA"/>
                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="aMJ-Wb-vRS"/>
@@ -401,22 +461,28 @@ DQ
                    <constraint firstItem="qgf-Jf-cJr" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" constant="30" id="esg-lX-BAT"/>
                    <constraint firstItem="f1p-GL-O3o" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="fGd-YS-phP"/>
                    <constraint firstAttribute="centerX" secondItem="t8c-Fx-e5h" secondAttribute="centerX" id="h3d-Kc-q88"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="LHV-gV-vyf" secondAttribute="bottom" constant="8" id="h4h-K3-BTd"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" priority="700" constant="8" id="hXw-6Z-lb2"/>
                    <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="7ua-5a-uSd" secondAttribute="trailing" constant="12" id="ioO-NJ-Jqo"/>
                    <constraint firstItem="bDE-Tl-UHg" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="jdk-ak-soQ"/>
                    <constraint firstItem="C3G-wL-u7w" firstAttribute="centerY" secondItem="lvJ-Rk-UT5" secondAttribute="centerY" id="jfs-YI-7Ae"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="oFj-ol-xpL" secondAttribute="trailing" constant="20" id="kOG-Cj-hFG"/>
+                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="MhO-U0-MLR" secondAttribute="trailing" constant="20" id="ke9-wW-5fr"/>
                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="qgf-Jf-cJr" secondAttribute="bottom" constant="8" id="lWU-tC-vWg"/>
                    <constraint firstItem="5D8-GP-a4l" firstAttribute="top" secondItem="h6f-PY-cc0" secondAttribute="bottom" constant="25" id="lYd-VZ-lBs"/>
+                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="18" id="lei-uP-T8m"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="xP7-jE-NF8" secondAttribute="bottom" priority="701" constant="8" id="oY4-e7-lsz"/>
                    <constraint firstItem="7ua-5a-uSd" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="pCX-eX-erN"/>
-                    <constraint firstAttribute="centerX" secondItem="7ua-5a-uSd" secondAttribute="centerX" constant="61" id="phL-j9-rPq"/>
+                    <constraint firstItem="xP7-jE-NF8" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="pdC-x8-Nao"/>
+                    <constraint firstAttribute="centerX" secondItem="7ua-5a-uSd" secondAttribute="centerX" constant="60" id="phL-j9-rPq"/>
                    <constraint firstItem="bDE-Tl-UHg" firstAttribute="top" secondItem="pc8-G9-4pJ" secondAttribute="bottom" constant="8" id="pis-of-f93"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="trailing" constant="20" id="qKi-KT-jzJ"/>
                    <constraint firstItem="C3G-wL-u7w" firstAttribute="bottom" secondItem="PXc-xv-A28" secondAttribute="top" constant="-8" id="snd-8T-LjC"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="d9e-Wv-Y5H" secondAttribute="trailing" constant="20" id="stz-Vm-Kxo"/>
                    <constraint firstItem="PXc-xv-A28" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="tAa-1s-xVZ"/>
                    <constraint firstItem="eQb-0a-76J" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="u1y-6V-moc"/>
-                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="width" secondItem="eQb-0a-76J" secondAttribute="width" id="u4p-1B-x5B"/>
                    <constraint firstAttribute="bottom" secondItem="BbV-3h-mmL" secondAttribute="bottom" constant="35" id="ukF-FH-DE8"/>
+                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="vB8-c5-pfO"/>
                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="YNz-ka-cBi" secondAttribute="trailing" constant="20" id="vfq-83-tKI"/>
                    <constraint firstItem="pDa-fA-vnC" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="z6s-ga-iAk"/>
                </constraints>
@@ -424,8 +490,9 @@ DQ
            <connections>
                <outlet property="initialFirstResponder" destination="kiB-jZ-69S" id="I96-dS-lq5"/>
            </connections>
-            <point key="canvasLocation" x="302.5" y="304.5"/>
+            <point key="canvasLocation" x="274" y="326.5"/>
        </window>
+        <userDefaultsController representsSharedInstance="YES" id="iXx-cu-WYe"/>
    </objects>
    <resources>
        <image name="NSInfo" width="32" height="32"/>
--- a/Source/SantaGUI/SNTAppDelegate.m
+++ b/Source/SantaGUI/SNTAppDelegate.m
@@ -26,7 +26,8 @@
@property SNTAboutWindowController *aboutWindowController;
@property SNTFileWatcher *configFileWatcher;
@property SNTNotificationManager *notificationManager;
-@property SNTXPCConnection *listener;
+@property SNTXPCConnection *daemonListener;
+@property SNTXPCConnection *bundleListener;
@end

@implementation SNTAppDelegate
@@ -49,18 +50,19 @@
                                      object:nil
                                       queue:[NSOperationQueue currentQueue]
                                  usingBlock:^(NSNotification *note) {
-    self.listener.invalidationHandler = nil;
-    [self.listener invalidate];
-    self.listener = nil;
+    self.daemonListener.invalidationHandler = nil;
+    [self.daemonListener invalidate];
+    self.daemonListener = nil;
  }];
  [workspaceNotifications addObserverForName:NSWorkspaceSessionDidBecomeActiveNotification
                                      object:nil
                                       queue:[NSOperationQueue currentQueue]
                                  usingBlock:^(NSNotification *note) {
-    [self attemptReconnection];
+    [self attemptDaemonReconnection];
  }];

-  [self createConnection];
+  [self createDaemonConnection];
+  [self createBundleConnection];
 }

 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
@@ -71,24 +73,24 @@

 #pragma mark Connection handling

- (void)createConnection {
+- (void)createDaemonConnection {
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);

  WEAKIFY(self);

  // Create listener for return connection from daemon.
  NSXPCListener *listener = [NSXPCListener anonymousListener];
-  self.listener = [[SNTXPCConnection alloc] initServerWithListener:listener];
-  self.listener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
-  self.listener.exportedObject = self.notificationManager;
-  self.listener.acceptedHandler = ^{
+  self.daemonListener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.daemonListener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
+  self.daemonListener.exportedObject = self.notificationManager;
+  self.daemonListener.acceptedHandler = ^{
    dispatch_semaphore_signal(sema);
  };
-  self.listener.invalidationHandler = ^{
+  self.daemonListener.invalidationHandler = ^{
    STRONGIFY(self);
-    [self attemptReconnection];
+    [self attemptDaemonReconnection];
  };
-  [self.listener resume];
+  [self.daemonListener resume];

  // Tell daemon to connect back to the above listener.
  SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
@@ -97,12 +99,46 @@

  // Now wait for the connection to come in.
  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self attemptReconnection];
+    [self attemptDaemonReconnection];
  }
 }

- (void)attemptReconnection {
-  [self performSelectorInBackground:@selector(createConnection) withObject:nil];
+- (void)attemptDaemonReconnection {
+  [self performSelectorInBackground:@selector(createDaemonConnection) withObject:nil];
+}
+
+- (void)createBundleConnection {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  WEAKIFY(self);
+
+  // Create listener for return connection from the bundle service.
+  NSXPCListener *listener = [NSXPCListener anonymousListener];
+  self.bundleListener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.bundleListener.exportedInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
+  self.bundleListener.exportedObject = self.notificationManager;
+  self.bundleListener.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+  self.bundleListener.invalidationHandler = ^{
+    STRONGIFY(self);
+    [self attemptBundleReconnection];
+  };
+  [self.bundleListener resume];
+
+  // Tell santabs to connect back to the above listener.
+  SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+  [daemonConn resume];
+  [[daemonConn remoteObjectProxy] setBundleNotificationListener:listener.endpoint];
+
+  // Now wait for the connection to come in.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    [self attemptBundleReconnection];
+  }
+}
+
+- (void)attemptBundleReconnection {
+  [self performSelectorInBackground:@selector(createBundleConnection) withObject:nil];
 }

 #pragma mark Menu Management
--- a/Source/SantaGUI/SNTMessageWindowController.h
+++ b/Source/SantaGUI/SNTMessageWindowController.h
@@ -31,6 +31,40 @@
 - (IBAction)closeWindow:(id)sender;
 - (IBAction)showCertInfo:(id)sender;

+///  Reference to the "Bundle Hash" label in the XIB. Used to remove if application
+///  doesn't have a bundle hash.
+@property(weak) IBOutlet NSTextField *bundleHashLabel;
+
+///  Reference to the "Bundle Identifier" label in the XIB. Used to remove if application
+///  doesn't have a bundle hash.
+@property(weak) IBOutlet NSTextField *bundleHashTitle;
+
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSProgressIndicator *hashingIndicator;
+
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSTextField *foundFileCountLabel;
+
+///
+///  Reference to the "Open Event" button in the XIB. Used to either remove the button
+///  if it isn't needed or set its title if it is.
+///
+@property(weak) IBOutlet NSButton *openEventButton;
+
+///
+///  The execution event that this window is for
+///
+@property(readonly) SNTStoredEvent *event;
+
+///
+///  The root progress object. Child nodes are vended to santad to report on work being done.
+///
+@property NSProgress *progress;
+
 ///
 ///  The delegate to inform when the notification is dismissed
 ///
--- a/Source/SantaGUI/SNTMessageWindowController.m
+++ b/Source/SantaGUI/SNTMessageWindowController.m
@@ -24,9 +24,6 @@
 #import "SNTStoredEvent.h"

@interface SNTMessageWindowController ()
-///  The execution event that this window is for
-@property SNTStoredEvent *event;
-
 ///  The custom message to display for this event
@property(copy) NSString *customMessage;

@@ -36,13 +33,9 @@
 ///  An optional message to display with this block.
@property(readonly, nonatomic) NSAttributedString *attributedCustomMessage;

-///  Reference to the "Open Event" button in the XIB. Used to either remove the button
-///  if it isn't needed or set its title if it is.
-@property IBOutlet NSButton *openEventButton;
-
 ///  Reference to the "Application Name" label in the XIB. Used to remove if application
 ///  doesn't have a CFBundleName.
-@property IBOutlet NSTextField *applicationNameLabel;
+@property(weak) IBOutlet NSTextField *applicationNameLabel;

 ///  Linked to checkbox in UI to prevent future notifications for this binary.
@property BOOL silenceFutureNotifications;
@@ -55,10 +48,34 @@
  if (self) {
    _event = event;
    _customMessage = message;
+    _progress = [NSProgress discreteProgressWithTotalUnitCount:1];
+    [_progress addObserver:self
+                forKeyPath:@"fractionCompleted"
+                   options:NSKeyValueObservingOptionNew
+                   context:NULL];
  }
  return self;
 }

+- (void)dealloc {
+  [_progress removeObserver:self forKeyPath:@"fractionCompleted"];
+}
+
+- (void)observeValueForKeyPath:(NSString *)keyPath
+                      ofObject:(id)object
+                        change:(NSDictionary *)change
+                       context:(void *)context {
+  if ([keyPath isEqualToString:@"fractionCompleted"]) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      NSProgress *progress = object;
+      if (progress.fractionCompleted != 0.0) {
+        self.hashingIndicator.indeterminate = NO;
+      }
+      self.hashingIndicator.doubleValue = progress.fractionCompleted;
+    });
+  }
+}
+
 - (void)loadWindow {
  [super loadWindow];
  [self.window setLevel:NSPopUpMenuWindowLevel];
@@ -73,6 +90,18 @@
    }
  }

+  if (!self.event.needsBundleHash) {
+    [self.bundleHashLabel removeFromSuperview];
+    [self.hashingIndicator removeFromSuperview];
+    [self.foundFileCountLabel removeFromSuperview];
+  } else {
+    self.openEventButton.enabled = NO;
+    self.hashingIndicator.indeterminate = YES;
+    [self.hashingIndicator startAnimation:self];
+    self.bundleHashLabel.hidden = YES;
+    self.foundFileCountLabel.stringValue = @"";
+  }
+
  if (!self.event.fileBundleName) {
    [self.applicationNameLabel removeFromSuperview];
  }
@@ -83,6 +112,7 @@
 }

 - (IBAction)closeWindow:(id)sender {
+  [self.progress cancel];
  [(SNTMessageWindow *)self.window fadeOut:sender];
 }

--- a/Source/SantaGUI/SNTNotificationManager.h
+++ b/Source/SantaGUI/SNTNotificationManager.h
@@ -20,6 +20,7 @@
 ///
 ///  Keeps track of pending notifications and ensures only one is presented to the user at a time.
 ///
-@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate, SNTNotifierXPC>
+@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate,
+                                             SNTNotifierXPC, SNTBundleNotifierXPC>

@end
--- a/Source/SantaGUI/SNTNotificationManager.m
+++ b/Source/SantaGUI/SNTNotificationManager.m
@@ -18,13 +18,27 @@
 #import "SNTConfigurator.h"
 #import "SNTLogging.h"
 #import "SNTStoredEvent.h"
+#import "SNTStrengthify.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"

@interface SNTNotificationManager ()
+
 ///  The currently displayed notification
@property SNTMessageWindowController *currentWindowController;

 ///  The queue of pending notifications
@property(readonly) NSMutableArray *pendingNotifications;
+
+///  The connection to the bundle service
+@property SNTXPCConnection *bundleServiceConnection;
+
+///  A semaphore to block bundle hashing until a connection is established
+@property dispatch_semaphore_t bundleServiceSema;
+
+// A serial queue for holding hashBundleBinaries requests
+@property dispatch_queue_t hashBundleBinariesQueue;
+
@end

@implementation SNTNotificationManager
@@ -35,6 +49,9 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  self = [super init];
  if (self) {
    _pendingNotifications = [[NSMutableArray alloc] init];
+    _bundleServiceSema = dispatch_semaphore_create(0);
+    _hashBundleBinariesQueue = dispatch_queue_create("com.google.santagui.hashbundlebinaries",
+                                                     DISPATCH_QUEUE_SERIAL);
  }
  return self;
 }
@@ -48,7 +65,16 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  if ([self.pendingNotifications count]) {
    self.currentWindowController = [self.pendingNotifications firstObject];
    [self.currentWindowController showWindow:self];
+    if (self.currentWindowController.event.needsBundleHash) {
+      dispatch_async(self.hashBundleBinariesQueue, ^{
+        [self hashBundleBinariesForEvent:self.currentWindowController.event];
+      });
+    }
  } else {
+    // Tear down the bundle service
+    self.bundleServiceSema = dispatch_semaphore_create(0);
+    [self.bundleServiceConnection invalidate];
+    self.bundleServiceConnection = nil;
    [NSApp hide:self];
  }
 }
@@ -65,7 +91,7 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  [ud setObject:d forKey:silencedNotificationsKey];
 }

-#pragma mark SNTNotifierXPC protocol method
+#pragma mark SNTNotifierXPC protocol methods

 - (void)postClientModeNotification:(SNTClientMode)clientmode {
  NSUserNotification *un = [[NSUserNotification alloc] init];
@@ -131,6 +157,11 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
    if (!self.currentWindowController) {
      self.currentWindowController = pendingMsg;
      [pendingMsg showWindow:nil];
+      if (self.currentWindowController.event.needsBundleHash) {
+        dispatch_async(self.hashBundleBinariesQueue, ^{
+          [self hashBundleBinariesForEvent:self.currentWindowController.event];
+        });
+      }
    }
  });
 }
@@ -143,4 +174,100 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
 }

+#pragma mark SNTBundleNotifierXPC protocol methods
+
+- (void)updateCountsForEvent:(SNTStoredEvent *)event
+                 binaryCount:(uint64_t)binaryCount
+                   fileCount:(uint64_t)fileCount
+                 hashedCount:(uint64_t)hashedCount {
+  if ([self.currentWindowController.event.idx isEqual:event.idx]) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      self.currentWindowController.foundFileCountLabel.stringValue =
+          [NSString stringWithFormat:@"%llu binaries / %llu %@",
+               binaryCount, hashedCount ?: fileCount, hashedCount ? @"hashed" : @"files"];
+    });
+  }
+}
+
+- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener {
+  SNTXPCConnection *c = [[SNTXPCConnection alloc] initClientWithListener:listener];
+  c.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  [c resume];
+  self.bundleServiceConnection = c;
+
+  WEAKIFY(self);
+  self.bundleServiceConnection.invalidationHandler = ^{
+    STRONGIFY(self);
+    if (self.currentWindowController) {
+      [self updateBlockNotification:self.currentWindowController.event withBundleHash:nil];
+    }
+  };
+
+  dispatch_semaphore_signal(self.bundleServiceSema);
+}
+
+#pragma mark SNTBundleNotifierXPC helper methods
+
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event {
+  self.currentWindowController.foundFileCountLabel.stringValue = @"Searching for files...";
+
+  // Wait a max of 6 secs for the bundle service. Should the bundle service fall over, it will
+  // reconnect within 5 secs. Otherwise abandon bundle hashing and display the blockable event.
+  if (dispatch_semaphore_wait(self.bundleServiceSema,
+                              dispatch_time(DISPATCH_TIME_NOW, 6 * NSEC_PER_SEC))) {
+    [self updateBlockNotification:event withBundleHash:nil];
+    return;
+  }
+
+  // Let all future requests flow, until the connection is terminated and we go back to waiting.
+  dispatch_semaphore_signal(self.bundleServiceSema);
+
+  // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
+  [self.currentWindowController.progress becomeCurrentWithPendingUnitCount:100];
+
+  // Start hashing. Progress is reported to the root NSProgress (currentWindowController.progress).
+  [[self.bundleServiceConnection remoteObjectProxy]
+      hashBundleBinariesForEvent:event
+                           reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
+    // Revert to displaying the blockable event if we fail to calculate the bundle hash
+    if (!bh) return [self updateBlockNotification:event withBundleHash:nil];
+
+    event.fileBundleHash = bh;
+    event.fileBundleBinaryCount = @(events.count);
+    event.fileBundleHashMilliseconds = ms;
+    event.fileBundleExecutableRelPath = [events.firstObject fileBundleExecutableRelPath];
+    for (SNTStoredEvent *se in events) {
+      se.fileBundleHash = bh;
+      se.fileBundleBinaryCount = @(events.count);
+      se.fileBundleHashMilliseconds = ms;
+    }
+
+    // Send the results to santad. It will decide if they need to be synced.
+    SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+    [daemonConn resume];
+    [[daemonConn remoteObjectProxy] syncBundleEvent:event relatedEvents:events];
+
+    // Update the UI with the bundle hash. Also make the openEventButton available.
+    [self updateBlockNotification:event withBundleHash:bh];
+  }];
+  [self.currentWindowController.progress resignCurrent];
+}
+
+- (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash {
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if ([self.currentWindowController.event.idx isEqual:event.idx]) {
+      if (bundleHash) {
+        [self.currentWindowController.bundleHashLabel setHidden:NO];
+      } else {
+        [self.currentWindowController.bundleHashLabel removeFromSuperview];
+        [self.currentWindowController.bundleHashTitle removeFromSuperview];
+      }
+      self.currentWindowController.event.fileBundleHash = bundleHash;
+      [self.currentWindowController.foundFileCountLabel removeFromSuperview];
+      [self.currentWindowController.hashingIndicator setHidden:YES];
+      [self.currentWindowController.openEventButton setEnabled:YES];
+    }
+  });
+}
+
@end
--- a/Source/common/SNTBlockMessage.h
+++ b/Source/common/SNTBlockMessage.h
@@ -12,7 +12,11 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

+#ifdef SANTAGUI
+@import Cocoa;
+#else
@import Foundation;
+#endif

@class SNTStoredEvent;

--- a/Source/common/SNTBlockMessage.m
+++ b/Source/common/SNTBlockMessage.m
@@ -92,25 +92,13 @@
 + (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
  SNTConfigurator *config = [SNTConfigurator configurator];

-  NSString *formatStr, *versionStr;
-  if (config.eventDetailBundleURL.length && event.fileBundleID) {
-    formatStr = config.eventDetailBundleURL;
-    versionStr = event.fileBundleVersion;
-    if (!versionStr) versionStr = event.fileBundleVersionString;
-
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_id%"
-                                                     withString:event.fileBundleID];
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_ver%"
-                                                     withString:versionStr];
-  } else {
-    formatStr = config.eventDetailURL;
-  }
-
+  NSString *formatStr = config.eventDetailURL;
  if (!formatStr.length) return nil;

  if (event.fileSHA256) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
-                                                     withString:event.fileSHA256];
+    formatStr =
+        [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
+                                             withString:event.fileBundleHash ?: event.fileSHA256];
  }
  if (event.executingUser) {
    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
--- a/Source/common/SNTCommonEnums.h
+++ b/Source/common/SNTCommonEnums.h
@@ -72,6 +72,14 @@ typedef NS_ENUM(NSInteger, SNTRuleTableError) {
  SNTRuleTableErrorRemoveFailed
 };

+// This enum type is used to indicate what should be done with the related bundle events that are
+// generated when an initiating blocked bundle event occurs.
+typedef NS_ENUM(NSInteger, SNTBundleEventAction) {
+  SNTBundleEventActionDropEvents,
+  SNTBundleEventActionStoreEvents,
+  SNTBundleEventActionSendEvents,
+};
+
 static const char *kKextPath = "/Library/Extensions/santa-driver.kext";
 static const char *kSantaDPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santad";
 static const char *kSantaCtlPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santactl";
--- a/Source/common/SNTConfigurator.h
+++ b/Source/common/SNTConfigurator.h
@@ -77,8 +77,6 @@ extern NSString *const kDefaultConfigFilePath;
 ///
 ///  When the user gets a block notification, a button can be displayed which will
 ///  take them to a web page with more information about that event.
-///  There are two properties, one for individual binaries and one for binaries that are part
-///  of a bundle. If the latter is not set the former will be used.
 ///
 ///  This property contains a kind of format string to be turned into the URL to send them to.
 ///  The following sequences will be replaced in the final URL:
@@ -86,15 +84,12 @@ extern NSString *const kDefaultConfigFilePath;
 ///  %file_sha%    -- SHA-256 of the file that was blocked.
 ///  %machine_id%  -- ID of the machine.
 ///  %username%    -- executing user.
-///  %bundle_id%   -- bundle id of the binary, if applicable.
-///  %bundle_ver%  -- bundle version of the binary, if applicable.
 ///
 ///  @note: This is not an NSURL because the format-string parsing is done elsewhere.
 ///
 ///  If this item isn't set, the Open Event button will not be displayed.
 ///
@property(readonly, nonatomic) NSString *eventDetailURL;
-@property(readonly, nonatomic) NSString *eventDetailBundleURL;

 ///
 ///  Related to the above property, this string represents the text to show on the button.
@@ -133,12 +128,6 @@ extern NSString *const kDefaultConfigFilePath;
 ///
@property(readonly, nonatomic) NSURL *syncBaseURL;

-///
-///  If YES, mid-execution event uploads are skipped.
-///  This property is never stored on disk.
-///
-@property BOOL syncBackOff;
-
 ///
 ///  The machine owner.
 ///
@@ -165,22 +154,10 @@ extern NSString *const kDefaultConfigFilePath;
@property(readonly, nonatomic) NSString *machineID;

 ///
-///  The number of seconds in-between full syncs while connected to FCM
+///  If YES, enables bundle detection for blocked events. This property is not stored on disk.
+///  Its value is set by a sync server that supports bundles. Defaults to NO.
 ///
-///  @note The default value is 14400.
-///  @note The minimum value is 600.
-///
-@property(readonly, nonatomic) NSInteger FCMFullSyncInterval;
-
-///
-///  The maximum number of seconds to wait before a rule sync when
-///  receiving a global rule sync message. Each client will choose a random
-///  number of seconds between 0 and FCMGlobalRuleLeeway.
-///
-///  @note The default value is 600.
-///  @note The minimum value is 60.
-///
-@property(readonly, nonatomic) NSInteger FCMGlobalRuleLeeway;
+@property BOOL bundlesEnabled;

 #pragma mark Server Auth Settings

--- a/Source/common/SNTConfigurator.m
+++ b/Source/common/SNTConfigurator.m
@@ -44,7 +44,6 @@ static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection

 static NSString *const kMoreInfoURLKey = @"MoreInfoURL";
 static NSString *const kEventDetailURLKey = @"EventDetailURL";
-static NSString *const kEventDetailBundleURLKey = @"EventDetailBundleURL";
 static NSString *const kEventDetailTextKey = @"EventDetailText";
 static NSString *const kUnknownBlockMessage = @"UnknownBlockMessage";
 static NSString *const kBannedBlockMessage = @"BannedBlockMessage";
@@ -71,9 +70,6 @@ static NSString *const kMachineOwnerPlistKeyKey = @"MachineOwnerKey";
 static NSString *const kMachineIDPlistFileKey = @"MachineIDPlist";
 static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";

-static NSString *const kFCMFullSyncInterval = @"FCMFullSyncInterval";
-static NSString *const kFCMGlobalRuleLeeway = @"FCMGlobalRuleLeeway";
-
 - (instancetype)initWithFilePath:(NSString *)filePath {
  self = [super init];
  if (self) {
@@ -205,10 +201,6 @@ static NSString *const kFCMGlobalRuleLeeway = @"FCMGlobalRuleLeeway";
  return self.configData[kEventDetailURLKey];
 }

- (NSString *)eventDetailBundleURL {
-  return self.configData[kEventDetailBundleURLKey];
-}
-
 - (NSString *)eventDetailText {
  return self.configData[kEventDetailTextKey];
 }
@@ -329,16 +321,6 @@ static NSString *const kFCMGlobalRuleLeeway = @"FCMGlobalRuleLeeway";
  return machineId;
 }

- (NSInteger)FCMFullSyncInterval {
-  NSInteger interval = [self.configData[kFCMFullSyncInterval] integerValue];
-  return (interval < 600) ? 1440 : interval;
-}
-
- (NSInteger)FCMGlobalRuleLeeway {
-  NSInteger leeway = [self.configData[kFCMGlobalRuleLeeway] integerValue];
-  return (leeway < 60) ? 600 : leeway;
-}
-
 - (void)reloadConfigData {
  NSFileManager *fm = [NSFileManager defaultManager];
  if (![fm fileExistsAtPath:self.configFilePath]) {
--- a/Source/common/SNTFileInfo.h
+++ b/Source/common/SNTFileInfo.h
@@ -14,6 +14,8 @@

@import Foundation;

+@class MOLCodesignChecker;
+
 ///
 ///  Represents a binary on disk, providing access to details about that binary
 ///  such as the SHA-1, SHA-256, Info.plist and the Mach-O data.
@@ -38,6 +40,18 @@
 ///
 - (instancetype)initWithPath:(NSString *)path;

+
+///
+///  Initializer for already resolved paths.
+///
+///  @param path The path of the file this instance is to represent. The path will
+///      not be converted and will be used as is. If the path is not a regular file this method will
+///      return nil and fill in an error.
+///  @param error If an error occurred and nil is returned, this will be a pointer to an NSError
+///      describing the problem.
+///
+- (instancetype)initWithResolvedPath:(NSString *)path error:(NSError **)error;
+
 ///
 ///  @return Path of this file.
 ///
@@ -111,11 +125,31 @@
 ///
 - (BOOL)isDMG;

+///
+///  @return NSString describing the kind of file (executable, bundle, script, etc.)
+///
+- (NSString *)humanReadableFileType;
+
 ///
 ///  @return YES if this file has a bad/missing __PAGEZERO .
 ///
 - (BOOL)isMissingPageZero;

+///
+///  If set to YES, the bundle* and infoPlist methods will search for and use the highest NSBundle
+///  found in the tree. Defaults to NO, which uses the first found bundle, if any.
+///
+///  @example:
+///      An SNTFileInfo object that represents
+///        /Applications/Photos.app/Contents/XPCServices/com.apple.Photos.librarychooserservice.xpc
+///      useAncestorBundle is set to YES
+///        /Applications/Photos.app will be used to get data backing all the bundle methods
+///
+///  @note: The NSBundle object backing the bundle* and infoPlist methods is cached once found.
+///         Setting the useAncestorBundle propery will clear this cache and force a re-search.
+///
+@property(nonatomic) BOOL useAncestorBundle;
+
 ///
 ///  @return An NSBundle if this file is part of a bundle.
 ///
@@ -178,4 +212,11 @@
 ///
 - (NSUInteger)fileSize;

+///
+///  @return Returns an instance of MOLCodeSignChecker initialized with the file's binary path.
+///  Both the MOLCodesignChecker and any resulting NSError are cached and returned on subsequent
+///  calls.  You may pass in NULL for the error if you don't care to receive it.
+///
+- (MOLCodesignChecker *)codesignCheckerWithError:(NSError **)error;
+
@end
--- a/Source/common/SNTFileInfo.m
+++ b/Source/common/SNTFileInfo.m
@@ -15,6 +15,7 @@
 #import "SNTFileInfo.h"

 #import <CommonCrypto/CommonDigest.h>
+#import <MOLCodesignChecker/MOLCodesignChecker.h>

 #include <mach-o/loader.h>
 #include <mach-o/swap.h>
@@ -53,29 +54,51 @@
@property NSDictionary *infoDict;
@property NSDictionary *quarantineDict;
@property NSDictionary *cachedHeaders;
+@property MOLCodesignChecker *cachedCodesignChecker;
+@property(nonatomic) NSError *codesignCheckerError;
@end

@implementation SNTFileInfo

 extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;

- (instancetype)initWithPath:(NSString *)path error:(NSError **)error {
+- (instancetype)initWithResolvedPath:(NSString *)path error:(NSError **)error {
  self = [super init];
  if (self) {
-    NSBundle *bndl;
-    _path = [self resolvePath:path bundle:&bndl];
-    _bundleRef = bndl;
-    if (_path.length == 0) {
+    _path = path;
+    if (!_path.length) {
      if (error) {
-        NSString *errStr = @"Unable to resolve empty path";
-        if (path) errStr = [@"Unable to resolve path: " stringByAppendingString:path];
+        NSString *errStr = @"Unable to use empty path";
        *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
-                                     code:260
+                                     code:270
                                 userInfo:@{NSLocalizedDescriptionKey : errStr}];
      }
      return nil;
    }

+    struct stat fileStat;
+    lstat(_path.UTF8String, &fileStat);
+    if (!((S_IFMT & fileStat.st_mode) == S_IFREG)) {
+      if (error) {
+        NSString *errStr = [NSString stringWithFormat:@"Non regular file: %s", strerror(errno)];
+        *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
+                                     code:290
+                                 userInfo:@{NSLocalizedDescriptionKey : errStr}];
+      }
+      return nil;
+    }
+
+    _fileSize = fileStat.st_size;
+
+    if (_fileSize == 0) return nil;
+
+    if (fileStat.st_uid != 0) {
+      struct passwd *pwd = getpwuid(fileStat.st_uid);
+      if (pwd) {
+        _fileOwnerHomeDir = @(pwd->pw_dir);
+      }
+    }
+
    int fd = open([_path UTF8String], O_RDONLY | O_CLOEXEC);
    if (fd < 0) {
      if (error) {
@@ -87,24 +110,29 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
      return nil;
    }
    _fileHandle = [[NSFileHandle alloc] initWithFileDescriptor:fd closeOnDealloc:YES];
-
-    struct stat fileStat;
-    fstat(_fileHandle.fileDescriptor, &fileStat);
-    _fileSize = fileStat.st_size;
-
-    if (_fileSize == 0) return nil;
-
-    if (fileStat.st_uid != 0) {
-      struct passwd *pwd = getpwuid(fileStat.st_uid);
-      if (pwd) {
-        _fileOwnerHomeDir = @(pwd->pw_dir);
-      }
-    }
  }

  return self;
 }

+- (instancetype)initWithPath:(NSString *)path error:(NSError **)error {
+  NSBundle *bndl;
+  NSString *resolvedPath = [self resolvePath:path bundle:&bndl];
+  if (!resolvedPath.length) {
+    if (error) {
+      NSString *errStr = @"Unable to resolve empty path";
+      if (path) errStr = [@"Unable to resolve path: " stringByAppendingString:path];
+      *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
+                                   code:260
+                               userInfo:@{NSLocalizedDescriptionKey : errStr}];
+    }
+    return nil;
+  }
+  self = [self initWithResolvedPath:resolvedPath error:error];
+  if (self && bndl) _bundleRef = bndl;
+  return self;
+}
+
 - (instancetype)initWithPath:(NSString *)path {
  return [self initWithPath:path error:NULL];
 }
@@ -237,11 +265,23 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 }

 - (BOOL)isDMG {
+  if (self.fileSize < 512) return NO;
  NSUInteger last512 = self.fileSize - 512;
  const char *magic = (const char *)[[self safeSubdataWithRange:NSMakeRange(last512, 4)] bytes];
  return (magic && memcmp("koly", magic, 4) == 0);
 }

+- (NSString *)humanReadableFileType {
+  if ([self isExecutable]) return @"Executable";
+  if ([self isDylib]) return @"Dynamic Library";
+  if ([self isBundle]) return @"Bundle/Plugin";
+  if ([self isKext]) return @"Kernel Extension";
+  if ([self isScript]) return @"Script";
+  if ([self isXARArchive]) return @"XAR Archive";
+  if ([self isDMG]) return @"Disk Image";
+  return @"Unknown";
+}
+
 #pragma mark Page Zero

 - (BOOL)isMissingPageZero {
@@ -280,34 +320,34 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 ///
 ///  Rationale: An NSBundle has a method executablePath for discovering the main binary within a
 ///  bundle but provides no way to get an NSBundle object when only the executablePath is known.
-///  Also a bundle can contain multiple binaries within the MacOS folder and we want any of these
+///  Also a bundle can contain multiple binaries within its subdirectories and we want any of these
 ///  to count as being part of the bundle.
 ///
-///  This method relies on executable bundles being laid out as follows:
+///  This method walks up the path until a bundle is found, if any.
 ///
-/// @code
-/// Bundle.app/
-///    Contents/
-///       MacOS/
-///         executable
-/// @endcode
-///
-///  If @c self.path is the full path to @c executable above, this method would return an
-///  NSBundle reference for Bundle.app.
+///  @param ancestor YES this will return the highest NSBundle found in the tree. No will return the
+///                  the lowest.
 ///
+-(NSBundle *)findBundleWithAncestor:(BOOL)ancestor {
+  NSBundle *bundle;
+  NSMutableArray *pathComponents = [[self.path pathComponents] mutableCopy];
+
+  // Ignore the root path "/", for some reason this is considered a bundle.
+  while (pathComponents.count > 1) {
+    NSBundle *bndl = [NSBundle bundleWithPath:[NSString pathWithComponents:pathComponents]];
+    if (bndl && [bndl objectForInfoDictionaryKey:@"CFBundleIdentifier"]) {
+      bundle = bndl;
+      if (!ancestor) break;
+    }
+    [pathComponents removeLastObject];
+  }
+  return bundle;
+}
+
 - (NSBundle *)bundle {
  if (!self.bundleRef) {
-    self.bundleRef = (NSBundle *)[NSNull null];
-
-    // Check that the full path is at least 4-levels deep:
-    // e.g: /Calendar.app/Contents/MacOS/Calendar
-    NSArray *pathComponents = [self.path pathComponents];
-    NSUInteger pathComponentsCount = pathComponents.count;
-    if (pathComponentsCount < 4) return nil;
-
-    pathComponents = [pathComponents subarrayWithRange:NSMakeRange(0, pathComponentsCount - 3)];
-    NSBundle *bndl = [NSBundle bundleWithPath:[NSString pathWithComponents:pathComponents]];
-    if (bndl && [bndl objectForInfoDictionaryKey:@"CFBundleIdentifier"]) self.bundleRef = bndl;
+    self.bundleRef =
+        [self findBundleWithAncestor:self.useAncestorBundle] ?: (NSBundle *)[NSNull null];
  }
  return self.bundleRef == (NSBundle *)[NSNull null] ? nil : self.bundleRef;
 }
@@ -316,6 +356,14 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  return [self.bundle bundlePath];
 }

+- (void)setUseAncestorBundle:(BOOL)useAncestorBundle {
+  if (self.useAncestorBundle != useAncestorBundle) {
+    self.bundleRef = nil;
+    self.infoDict = nil;
+  }
+  _useAncestorBundle = useAncestorBundle;
+}
+
 - (NSDictionary *)infoPlist {
  if (!self.infoDict) {
    NSDictionary *d = [self embeddedPlist];
@@ -522,8 +570,7 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
    NSData *d = [self.fileHandle readDataOfLength:range.length];
    if (d.length != range.length) return nil;
    return d;
-  }
-  @catch (NSException *e) {
+  } @catch (NSException *e) {
    return nil;
  }
 }
@@ -638,7 +685,7 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  BOOL directory;
  if (![[NSFileManager defaultManager] fileExistsAtPath:path isDirectory:&directory]) {
    return nil;
-  } else if (directory) {
+  } else if (directory && ![path isEqualToString:@"/"]) {
    NSBundle *bndl = [NSBundle bundleWithPath:path];
    if (bundle) *bundle = bndl;
    return [bndl executablePath];
@@ -647,4 +694,18 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  }
 }

+///
+///  Cache and return a MOLCodeSignChecker for the given file.  If there was an error creating the
+///  code sign checker it will be returned in the passed-in error parameter.
+///
+- (MOLCodesignChecker *)codesignCheckerWithError:(NSError **)error {
+  if (!self.cachedCodesignChecker && !self.codesignCheckerError) {
+    NSError *e;
+    self.cachedCodesignChecker = [[MOLCodesignChecker alloc] initWithBinaryPath:self.path error:&e];
+    self.codesignCheckerError = e;
+  }
+  if (error) *error = self.codesignCheckerError;
+  return self.cachedCodesignChecker;
+}
+
@end
--- a/Source/common/SNTLogging.h
+++ b/Source/common/SNTLogging.h
@@ -24,13 +24,13 @@
 #include <IOKit/IOLib.h>

 #ifdef DEBUG
-#define LOGD(...) IOLog("D santa-driver: " __VA_ARGS__); IOLog("\n")
+#define LOGD(format, ...) IOLog("D santa-driver: " format "\n", ##__VA_ARGS__);
 #else  // DEBUG
-#define LOGD(...)
+#define LOGD(format, ...)
 #endif  // DEBUG
-#define LOGI(...) IOLog("I santa-driver: " __VA_ARGS__); IOLog("\n")
-#define LOGW(...) IOLog("W santa-driver: " __VA_ARGS__); IOLog("\n")
-#define LOGE(...) IOLog("E santa-driver: " __VA_ARGS__); IOLog("\n")
+#define LOGI(format, ...) IOLog("I santa-driver: " format "\n", ##__VA_ARGS__);
+#define LOGW(format, ...) IOLog("W santa-driver: " format "\n", ##__VA_ARGS__);
+#define LOGE(format, ...) IOLog("E santa-driver: " format "\n", ##__VA_ARGS__);

 #else  // KERNEL

--- a/Source/common/SNTStoredEvent.h
+++ b/Source/common/SNTStoredEvent.h
@@ -36,6 +36,28 @@
 ///
@property NSString *filePath;

+///
+///  Set to YES if the event is a part of a bundle. When an event is passed to SantaGUI this propery
+///  will be used as an indicator to to kick off bundle hashing as necessary. Default value is NO.
+///
+@property BOOL needsBundleHash;
+
+///
+///  If the executed file was part of a bundle, this is the calculated hash of all the nested
+///  executables within the bundle.
+///
+@property NSString *fileBundleHash;
+
+///
+///  If the executed file was part of a bundle, this is the time in ms it took to hash the bundle.
+///
+@property NSNumber *fileBundleHashMilliseconds;
+
+///
+///  If the executed file was part of a bundle, this is the total count of related mach-o binaries.
+///
+@property NSNumber *fileBundleBinaryCount;
+
 ///
 ///  If the executed file was part of the bundle, this is the CFBundleDisplayName, if it exists
 ///  or the CFBundleName if not.
@@ -47,6 +69,11 @@
 ///
@property NSString *fileBundlePath;

+///
+///  The relative path to the bundle's main executable.
+///
+@property NSString *fileBundleExecutableRelPath;
+
 ///
 ///  If the executed file was part of the bundle, this is the CFBundleID.
 ///
--- a/Source/common/SNTStoredEvent.m
+++ b/Source/common/SNTStoredEvent.m
@@ -33,8 +33,13 @@
  ENCODE(self.fileSHA256, @"fileSHA256");
  ENCODE(self.filePath, @"filePath");

+  ENCODE(@(self.needsBundleHash), @"needsBundleHash");
+  ENCODE(self.fileBundleHash, @"fileBundleHash");
+  ENCODE(self.fileBundleHashMilliseconds, @"fileBundleHashMilliseconds");
+  ENCODE(self.fileBundleBinaryCount, @"fileBundleBinaryCount");
  ENCODE(self.fileBundleName, @"fileBundleName");
  ENCODE(self.fileBundlePath, @"fileBundlePath");
+  ENCODE(self.fileBundleExecutableRelPath, @"fileBundleExecutableRelPath");
  ENCODE(self.fileBundleID, @"fileBundleID");
  ENCODE(self.fileBundleVersion, @"fileBundleVersion");
  ENCODE(self.fileBundleVersionString, @"fileBundleVersionString");
@@ -72,8 +77,13 @@
    _fileSHA256 = DECODE(NSString, @"fileSHA256");
    _filePath = DECODE(NSString, @"filePath");

+    _needsBundleHash = [DECODE(NSNumber, @"needsBundleHash") boolValue];
+    _fileBundleHash = DECODE(NSString, @"fileBundleHash");
+    _fileBundleHashMilliseconds = DECODE(NSNumber, @"fileBundleHashMilliseconds");
+    _fileBundleBinaryCount = DECODE(NSNumber, @"fileBundleBinaryCount");
    _fileBundleName = DECODE(NSString, @"fileBundleName");
    _fileBundlePath = DECODE(NSString, @"fileBundlePath");
+    _fileBundleExecutableRelPath = DECODE(NSString, @"fileBundleExecutableRelPath");
    _fileBundleID = DECODE(NSString, @"fileBundleID");
    _fileBundleVersion = DECODE(NSString, @"fileBundleVersion");
    _fileBundleVersionString = DECODE(NSString, @"fileBundleVersionString");
--- a/Source/common/SNTXPCBundleServiceInterface.h
+++ b/Source/common/SNTXPCBundleServiceInterface.h
@@ -0,0 +1,57 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+@class SNTStoredEvent;
+
+///  A block that takes the calculated bundle hash, associated events and hashing time in ms.
+typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNumber *);
+
+///  Protocol implemented by santabs and utilized by SantaGUI for bundle hashing
+@protocol SNTBundleServiceXPC
+
+///
+///  @param listener The listener to connect back to the SantaGUI.
+///
+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
+
+///
+///  Hash a bundle for an event. The SNTBundleHashBlock will be called with nil parameters if a
+///  failure or cancellation occurs.
+///
+///  @param event The event that includes the fileBundlePath to be hashed. This method will
+///      attempt to to find and use the ancestor bundle as a starting point.
+///  @param reply A SNTBundleHashBlock to be executed upon completion or cancellation.
+///
+///  @note If there is a current NSProgress when called this method will report back its progress.
+///
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
+
+@end
+
+@interface SNTXPCBundleServiceInterface : NSObject
+
+///
+///  Returns an initialized NSXPCInterface for the SNTBundleServiceXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning.
+///
+ (NSXPCInterface *)bundleServiceInterface;
+
+///
+///  Returns the MachService ID for this service.
+///
+ (NSString *)serviceId;
+
+@end
--- a/Source/common/SNTXPCBundleServiceInterface.m
+++ b/Source/common/SNTXPCBundleServiceInterface.m
@@ -0,0 +1,36 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTXPCBundleServiceInterface.h"
+
+#import "SNTStoredEvent.h"
+
+@implementation SNTXPCBundleServiceInterface
+
+ (NSXPCInterface *)bundleServiceInterface {
+  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleServiceXPC)];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(hashBundleBinariesForEvent:reply:)
+      argumentIndex:1
+            ofReply:YES];
+
+  return r;
+}
+
+ (NSString *)serviceId {
+  return @"com.google.santabs";
+}
+
+@end
--- a/Source/common/SNTXPCConnection.h
+++ b/Source/common/SNTXPCConnection.h
@@ -65,13 +65,20 @@
 - (nullable instancetype)initServerWithName:(nonnull NSString *)name;

 /**
-  Initializer a new client to a service exported by a LaunchDaemon.
+  Initialize a new client to a service exported by a LaunchDaemon.

  @param name MachService name
  @param privileged Use YES if the server is running as root.
 */
 - (nullable instancetype)initClientWithName:(nonnull NSString *)name privileged:(BOOL)privileged;

+/**
+  Initialize a new client to a service within a bundle.
+
+  @param name service name
+*/
+- (nullable instancetype)initClientWithServiceName:(nonnull NSString *)name;
+
 /**
  Initialize a new client with a listener endpoint sent from another process.

--- a/Source/common/SNTXPCConnection.m
+++ b/Source/common/SNTXPCConnection.m
@@ -95,6 +95,17 @@
  return self;
 }

+- (instancetype)initClientWithServiceName:(NSString *)name {
+  self = [super init];
+  if (self) {
+    _currentConnection = [[NSXPCConnection alloc] initWithServiceName:name];
+    if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
+  }
+  return self;
+}
+
 - (instancetype)init {
  [self doesNotRecognizeSelector:_cmd];
  return nil;
@@ -128,6 +139,12 @@
      if (self.acceptedHandler) self.acceptedHandler();
    }];
    if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC))) {
+      // This is unusual - as we're not inside a block - but necessary in case the caller sets an
+      // invalidation handler that causes this instance to be released (which is a reasonable
+      // approach). If establishing a connection fails, the invalidation handler will be called
+      // and then shortly after this bit of code will run causing a crash.
+      STRONGIFY(self);
+
      // Connection was not established in a reasonable time, invalidate.
      self.currentConnection.remoteObjectInterface = nil;  // ensure clients don't try to use it.
      [self.currentConnection invalidate];
--- a/Source/common/SNTXPCControlInterface.h
+++ b/Source/common/SNTXPCControlInterface.h
@@ -19,6 +19,7 @@
 #import "SNTCachedDecision.h"
 #import "SNTCommonEnums.h"
 #import "SNTKernelCommon.h"
+#import "SNTXPCBundleServiceInterface.h"

@class SNTRule;
@class SNTStoredEvent;
@@ -32,7 +33,7 @@
 ///
 ///  Kernel ops
 ///
- (void)cacheCount:(void (^)(int64_t))reply;
+- (void)cacheCounts:(void (^)(uint64_t rootCache, uint64_t nonRootCache))reply;
 - (void)flushCache:(void (^)(BOOL))reply;
 - (void)checkCacheForVnodeID:(uint64_t)vnodeID withReply:(void (^)(santa_action_t))reply;

@@ -57,13 +58,13 @@
 ///  @param filePath A Path to the file, can be nil.
 ///  @param fileSHA256 The pre-calculated SHA256 hash for the file, can be nil. If nil the hash will
 ///                    be calculated by this method from the filePath.
-///  @param signingCertificate A MOLCertificate object, can be nil.
+///  @param certificateSHA256 A SHA256 hash of the signing certificate, can be nil.
 ///  @note If fileInfo and signingCertificate are both passed in, the most specific rule will be
 ///        returned. Binary rules take precedence over cert rules.
 ///
 - (void)decisionForFilePath:(NSString *)filePath
                 fileSHA256:(NSString *)fileSHA256
-         signingCertificate:(MOLCertificate *)signingCertificate
+          certificateSHA256:(NSString *)certificateSHA256
                      reply:(void (^)(SNTEventState))reply;

 ///
@@ -79,20 +80,28 @@
 - (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)())reply;
 - (void)setWhitelistPathRegex:(NSString *)pattern reply:(void (^)())reply;
 - (void)setBlacklistPathRegex:(NSString *)pattern reply:(void (^)())reply;
+- (void)bundlesEnabled:(void (^)(BOOL))reply;
+- (void)setBundlesEnabled:(BOOL)bundlesEnabled reply:(void (^)())reply;

 ///
 ///  GUI Ops
 ///
 - (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;
+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;

 ///
 ///  Syncd Ops
 ///
 - (void)setSyncdListener:(NSXPCListenerEndpoint *)listener;
- (void)setNextSyncInterval:(uint64_t)seconds reply:(void (^)())reply;
 - (void)pushNotifications:(void (^)(BOOL))reply;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message reply:(void (^)())reply;

+///
+///  Bundle Ops
+///
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
+- (void)syncBundleEvent:(SNTStoredEvent *)event relatedEvents:(NSArray<SNTStoredEvent *> *)events;
+
@end

@interface SNTXPCControlInterface : NSObject
--- a/Source/common/SNTXPCControlInterface.m
+++ b/Source/common/SNTXPCControlInterface.m
@@ -37,6 +37,16 @@
      argumentIndex:0
            ofReply:NO];

+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(hashBundleBinariesForEvent:reply:)
+      argumentIndex:1
+            ofReply:YES];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(syncBundleEvent:relatedEvents:)
+      argumentIndex:1
+            ofReply:NO];
+
  return r;
 }

--- a/Source/common/SNTXPCNotifierInterface.h
+++ b/Source/common/SNTXPCNotifierInterface.h
@@ -15,6 +15,7 @@
@import Foundation;

 #import "SNTCommonEnums.h"
+#import "SNTXPCBundleServiceInterface.h"

@class SNTStoredEvent;

@@ -25,6 +26,16 @@
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
@end

+/// Protocol implemented by SantaGUI and utilized by santabs
+@protocol SNTBundleNotifierXPC
+- (void)updateCountsForEvent:(SNTStoredEvent *)event
+                 binaryCount:(uint64_t)binaryCount
+                   fileCount:(uint64_t)fileCount
+                 hashedCount:(uint64_t)hashedCount;
+
+- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener;
+@end
+
@interface SNTXPCNotifierInterface : NSObject

 ///
@@ -33,4 +44,10 @@
 ///
 + (NSXPCInterface *)notifierInterface;

+///
+///  @return an initialized NSXPCInterface for the SNTBundleNotifierXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
+ (NSXPCInterface *)bundleNotifierInterface;
+
@end
--- a/Source/common/SNTXPCNotifierInterface.m
+++ b/Source/common/SNTXPCNotifierInterface.m
@@ -20,4 +20,8 @@
  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTNotifierXPC)];
 }

+ (NSXPCInterface *)bundleNotifierInterface {
+  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleNotifierXPC)];
+}
+
@end
--- a/Source/common/SNTXPCSyncdInterface.h
+++ b/Source/common/SNTXPCSyncdInterface.h
@@ -20,8 +20,9 @@

 /// Protocol implemented by santactl and utilized by santad
@protocol SNTSyncdXPC
- (void)postEventToSyncServer:(SNTStoredEvent *)event;
- (void)rescheduleSyncSecondsFromNow:(uint64_t)seconds;
+- (void)postEventsToSyncServer:(NSArray<SNTStoredEvent *> *)events isFromBundle:(BOOL)isFromBundle;
+- (void)postBundleEventToSyncServer:(SNTStoredEvent *)event
+                              reply:(void (^)(SNTBundleEventAction))reply;
 - (void)isFCMListening:(void (^)(BOOL))reply;
@end

--- a/Source/common/SNTXPCSyncdInterface.m
+++ b/Source/common/SNTXPCSyncdInterface.m
@@ -14,10 +14,19 @@

 #import "SNTXPCSyncdInterface.h"

+#import "SNTStoredEvent.h"
+
@implementation SNTXPCSyncdInterface

 + (NSXPCInterface *)syncdInterface {
-  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTSyncdXPC)];
+  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTSyncdXPC)];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(postEventsToSyncServer:isFromBundle:)
+      argumentIndex:0
+            ofReply:NO];
+
+  return r;
 }

@end
--- a/Source/santa-driver/SantaCache.h
+++ b/Source/santa-driver/SantaCache.h
@@ -101,12 +101,19 @@ template<class T> class SantaCache {
  /**
    Set an element in the cache.

-    @note If the cache is full when this is called, this will empty the cache before
-    inserting the new value.
+    @note If the cache is full when this is called, this will
+          empty the cache before inserting the new value.

-    @return if an existing value was replaced, the previous value, otherwise zero_
+    @param key, The key
+    @param value, The value with parameterized type
+    @param previous_value, If the has_prev_value parameter is true the new
+        value will only be set if this parameter is equal to the provided value.
+        This allows set to become a CAS operation.
+    @param has_prev_value, Pass true if previous_value should be used.
+
+    @return the previous value (which may be zero_)
  */
-  T set(uint64_t key, T value) {
+  T set(uint64_t key, T value, T previous_value, bool has_prev_value) {
    struct bucket *bucket = &buckets_[hash(key)];
    lock(bucket);
    struct entry *entry = (struct entry *)((uintptr_t)bucket->head - 1);
@@ -114,6 +121,12 @@ template<class T> class SantaCache {
    while (entry != nullptr) {
      if (entry->key == key) {
        T existing_value = entry->value;
+
+        if (has_prev_value && previous_value != existing_value) {
+          unlock(bucket);
+          return existing_value;
+        }
+
        entry->value = value;

        if (value == zero_) {
@@ -134,13 +147,15 @@ template<class T> class SantaCache {
    }

    // If value is zero_, we're clearing but there's nothing to clear
-    // so we don't need to do anything else.
-    if (value == zero_) {
+    // so we don't need to do anything else. Alternatively, if has_prev_value
+    // is true and is not zero_ we don't want to set a value.
+    if (value == zero_ || (has_prev_value && previous_value != zero_)) {
      unlock(bucket);
      return zero_;
    }

-    // Check that adding this new item won't take the cache over its maximum size.
+    // Check that adding this new item won't take the cache
+    // over its maximum size.
    if (count_ + 1 > max_size_) {
      unlock(bucket);
      lock(&clear_bucket_);
@@ -152,9 +167,10 @@ template<class T> class SantaCache {
      unlock(&clear_bucket_);
    }

-    // Allocate a new entry, set the key and value, then set the next pointer as the current
-    // first entry in the bucket then make this new entry the first in the bucket.
-    struct entry *new_entry = (struct entry *)IOMallocAligned(sizeof(struct entry), 2);
+    // Allocate a new entry, set the key and value, then put this new entry at
+    // the head of this bucket's linked list.
+    struct entry *new_entry = (struct entry *)IOMallocAligned(
+        sizeof(struct entry), 2);
    new_entry->key = key;
    new_entry->value = value;
    new_entry->next = (struct entry *)((uintptr_t)bucket->head - 1);
@@ -165,6 +181,20 @@ template<class T> class SantaCache {
    return zero_;
  }

+  /**
+    Overload to allow setting without providing a previous value
+  */
+  T set(uint64_t key, T value) {
+    return set(key, value, {}, false);
+  }
+
+  /**
+    Overload to allow setting while providing a previous value
+  */
+  T set(uint64_t key, T value, T previous_value) {
+    return set(key, value, previous_value, true);
+  }
+
  /**
    An alias for `set(key, zero_)`
  */
@@ -247,7 +277,7 @@ template<class T> class SantaCache {
  /**
    Holder for a 'zero' entry for the current type
  */
-  const T zero_ = T(0);
+  const T zero_ = {};

  /**
    Special bucket used when automatically clearing due to size
--- a/Source/santa-driver/SantaDecisionManager.cc
+++ b/Source/santa-driver/SantaDecisionManager.cc
@@ -29,7 +29,8 @@ bool SantaDecisionManager::init() {
  decision_dataqueue_lock_ = lck_mtx_alloc_init(sdm_lock_grp_, sdm_lock_attr_);
  log_dataqueue_lock_ = lck_mtx_alloc_init(sdm_lock_grp_, sdm_lock_attr_);

-  decision_cache_ = new SantaCache<uint64_t>(10000, 2);
+  root_decision_cache_ = new SantaCache<uint64_t>(5000, 2);
+  non_root_decision_cache_ = new SantaCache<uint64_t>(500, 2);
  vnode_pid_map_ = new SantaCache<uint64_t>(2000, 5);

  decision_dataqueue_ = IOSharedDataQueue::withEntries(
@@ -41,6 +42,7 @@ bool SantaDecisionManager::init() {
  if (!log_dataqueue_) return kIOReturnNoMemory;

  client_pid_ = 0;
+  root_fsid_ = 0;

  ts_ = { .tv_sec = kRequestLoopSleepMilliseconds / 1000,
          .tv_nsec = kRequestLoopSleepMilliseconds % 1000 * 1000000 };
@@ -49,7 +51,8 @@ bool SantaDecisionManager::init() {
 }

 void SantaDecisionManager::free() {
-  delete decision_cache_;
+  delete root_decision_cache_;
+  delete non_root_decision_cache_;
  delete vnode_pid_map_;

  if (decision_dataqueue_lock_) {
@@ -90,6 +93,17 @@ void SantaDecisionManager::ConnectClient(pid_t pid) {

  client_pid_ = pid;

+  // Determine root fsid
+  vfs_context_t ctx = vfs_context_create(NULL);
+  if (ctx) {
+    vnode_t root = vfs_rootvnode();
+    if (root) {
+      root_fsid_ = GetVnodeIDForVnode(ctx, root) >> 32;
+      vnode_put(root);
+    }
+    vfs_context_rele(ctx);
+  }
+
  // Any decisions made while the daemon wasn't
  // connected should be cleared
  ClearCache();
@@ -165,7 +179,8 @@ kern_return_t SantaDecisionManager::StartListener() {
  if (!vnode_listener_) return kIOReturnInternalError;

  fileop_listener_ = kauth_listen_scope(
-      KAUTH_SCOPE_FILEOP, fileop_scope_callback, reinterpret_cast<void *>(this));
+      KAUTH_SCOPE_FILEOP, fileop_scope_callback,
+      reinterpret_cast<void *>(this));
  if (!fileop_listener_) return kIOReturnInternalError;

  LOGD("Listeners started.");
@@ -195,31 +210,58 @@ kern_return_t SantaDecisionManager::StopListener() {

 #pragma mark Cache Management

+/**
+  Return the correct cache for a given identifier.
+
+  @param identifier The identifier
+  @return SantaCache* The cache to use
+*/
+SantaCache<uint64_t>* SantaDecisionManager::CacheForIdentifier(
+    const uint64_t identifier) {
+  return (identifier >> 32 == root_fsid_) ?
+    root_decision_cache_ : non_root_decision_cache_;
+}
+
 void SantaDecisionManager::AddToCache(
    uint64_t identifier, santa_action_t decision, uint64_t microsecs) {
  // Decision is stored in upper 8 bits, timestamp in remaining 56.
  uint64_t val = ((uint64_t)decision << 56) | (microsecs & 0xFFFFFFFFFFFFFF);

-  // If a previous entry was not found and the new entry is not `REQUEST_BINARY`, remove the
-  // existing entry. This is to prevent adding an ALLOW to the cache after a write has occurred.
-  if (decision_cache_->set(identifier, val) == 0 && decision != ACTION_REQUEST_BINARY) {
-    decision_cache_->remove(identifier);
+  auto decision_cache = CacheForIdentifier(identifier);
+
+  switch (decision) {
+    case ACTION_REQUEST_BINARY:
+      decision_cache->set(identifier, val, 0);
+      break;
+    case ACTION_RESPOND_ALLOW:
+    case ACTION_RESPOND_DENY:
+      decision_cache->set(
+          identifier, val, ((uint64_t)ACTION_REQUEST_BINARY << 56));
+      break;
+    default:
+      break;
  }

  wakeup((void *)identifier);
 }

 void SantaDecisionManager::RemoveFromCache(uint64_t identifier) {
-  decision_cache_->remove(identifier);
+  CacheForIdentifier(identifier)->remove(identifier);
+  if (unlikely(!identifier)) return;
  wakeup((void *)identifier);
 }

-uint64_t SantaDecisionManager::CacheCount() const {
-  return decision_cache_->count();
+uint64_t SantaDecisionManager::RootCacheCount() const {
+  return root_decision_cache_->count();
 }

-void SantaDecisionManager::ClearCache() {
-  decision_cache_->clear();
+uint64_t SantaDecisionManager::NonRootCacheCount() const {
+  return non_root_decision_cache_->count();
+}
+
+void SantaDecisionManager::ClearCache(bool non_root_only) {
+  if (!non_root_only) root_decision_cache_->clear();
+  non_root_decision_cache_->clear();
 }

 #pragma mark Decision Fetching
@@ -228,7 +270,9 @@ santa_action_t SantaDecisionManager::GetFromCache(uint64_t identifier) {
  auto result = ACTION_UNSET;
  uint64_t decision_time = 0;

-  uint64_t cache_val = decision_cache_->get(identifier);
+  auto decision_cache = CacheForIdentifier(identifier);
+
+  uint64_t cache_val = decision_cache->get(identifier);
  if (cache_val == 0) return result;

  // Decision is stored in upper 8 bits, timestamp in remaining 56.
@@ -237,14 +281,9 @@ santa_action_t SantaDecisionManager::GetFromCache(uint64_t identifier) {

  if (RESPONSE_VALID(result)) {
    if (result == ACTION_RESPOND_DENY) {
-      auto diff_time = GetCurrentUptime();
-      if ((kMaxDenyCacheTimeMilliseconds * 1000) > diff_time) {
-        diff_time = 0;
-      } else {
-        diff_time -= (kMaxDenyCacheTimeMilliseconds * 1000);
-      }
-      if (decision_time < diff_time) {
-        decision_cache_->remove(identifier);
+      auto expiry_time = decision_time + (kMaxDenyCacheTimeMilliseconds * 1000);
+      if (expiry_time < GetCurrentUptime()) {
+        decision_cache->remove(identifier);
        return ACTION_UNSET;
      }
    }
@@ -253,7 +292,8 @@ santa_action_t SantaDecisionManager::GetFromCache(uint64_t identifier) {
  return result;
 }

-santa_action_t SantaDecisionManager::GetFromDaemon(santa_message_t *message, uint64_t identifier) {
+santa_action_t SantaDecisionManager::GetFromDaemon(
+    santa_message_t *message, uint64_t identifier) {
  auto return_action = ACTION_UNSET;

 #ifdef DEBUG
@@ -265,10 +305,11 @@ santa_action_t SantaDecisionManager::GetFromDaemon(santa_message_t *message, uin

  // Wait for the daemon to respond or die.
  do {
-    // Add pending request to cache, to be replaced by daemon with actual response
+    // Add pending request to cache, to be replaced
+    // by daemon with actual response.
    AddToCache(identifier, ACTION_REQUEST_BINARY, 0);

-    // Send request to daemon...
+    // Send request to daemon.
    if (!PostToDecisionQueue(message)) {
      LOGE("Failed to queue request for %s.", message->path);
      RemoveFromCache(identifier);
@@ -314,6 +355,8 @@ santa_action_t SantaDecisionManager::FetchDecision(
    if (RESPONSE_VALID(return_action)) {
      return return_action;
    } else if (return_action == ACTION_REQUEST_BINARY) {
+      // This thread will now sleep for kRequestLoopSleepMilliseconds (1s) or
+      // until AddToCache is called, indicating a response has arrived.
      msleep((void *)vnode_id, NULL, 0, "", &ts_);
    } else {
      break;
@@ -392,6 +435,7 @@ int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
                                        int *errno) {
  // Get ID for the vnode
  auto vnode_id = GetVnodeIDForVnode(ctx, vp);
+  if (!vnode_id) return KAUTH_RESULT_DEFER;

  // Fetch decision
  auto returnedAction = FetchDecision(cred, vp, vnode_id);
--- a/Source/santa-driver/SantaDecisionManager.h
+++ b/Source/santa-driver/SantaDecisionManager.h
@@ -96,10 +96,11 @@ class SantaDecisionManager : public OSObject {
  void RemoveFromCache(uint64_t identifier);

  /// Returns the number of entries in the cache.
-  uint64_t CacheCount() const;
+  uint64_t RootCacheCount() const;
+  uint64_t NonRootCacheCount() const;

-  /// Clears the cache.
-  void ClearCache();
+  /// Clears the cache(s). If non_root_only is true, only the non-root cache is cleared.
+  void ClearCache(bool non_root_only = false);

  /// Increments the count of active callbacks pending.
  void IncrementListenerInvocations();
@@ -129,7 +130,7 @@ class SantaDecisionManager : public OSObject {
  void FileOpCallback(kauth_action_t action, const vnode_t vp,
                      const char *path, const char *new_path);

- protected:
+ private:
  /**
    While waiting for a response from the daemon, this is the maximum number of
    milliseconds to sleep for before checking the cache for a response.
@@ -243,10 +244,22 @@ class SantaDecisionManager : public OSObject {
    return (uint64_t)((sec * 1000000) + usec);
  }

- private:
-  SantaCache<uint64_t> *decision_cache_;
+  SantaCache<uint64_t> *root_decision_cache_;
+  SantaCache<uint64_t> *non_root_decision_cache_;
  SantaCache<uint64_t> *vnode_pid_map_;

+  /**
+    Return the correct cache for a given identifier.
+
+    @param identifier The identifier
+    @return SantaCache* The cache to use
+  */
+  SantaCache<uint64_t>* CacheForIdentifier(const uint64_t identifier);
+
+  // This is the file system ID of the root filesystem,
+  // used to determine which cache to use for requests
+  uint32_t root_fsid_;
+
  lck_grp_t *sdm_lock_grp_;
  lck_grp_attr_t *sdm_lock_grp_attr_;
  lck_attr_t *sdm_lock_attr_;
--- a/Source/santa-driver/SantaDriverClient.cc
+++ b/Source/santa-driver/SantaDriverClient.cc
@@ -133,7 +133,8 @@ IOReturn SantaDriverClient::allow_binary(
  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
  if (!me) return kIOReturnBadArgument;

-  const uint64_t vnode_id = static_cast<const uint64_t>(*arguments->scalarInput);
+  const uint64_t vnode_id = static_cast<const uint64_t>(arguments->scalarInput[0]);
+  if (!vnode_id) return kIOReturnInvalid;
  me->decisionManager->AddToCache(vnode_id, ACTION_RESPOND_ALLOW);

  return kIOReturnSuccess;
@@ -144,7 +145,8 @@ IOReturn SantaDriverClient::deny_binary(
  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
  if (!me) return kIOReturnBadArgument;

-  const uint64_t vnode_id = static_cast<const uint64_t>(*arguments->scalarInput);
+  const uint64_t vnode_id = static_cast<const uint64_t>(arguments->scalarInput[0]);
+  if (!vnode_id) return kIOReturnInvalid;
  me->decisionManager->AddToCache(vnode_id, ACTION_RESPOND_DENY);

  return kIOReturnSuccess;
@@ -155,7 +157,8 @@ IOReturn SantaDriverClient::clear_cache(
  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
  if (!me) return kIOReturnBadArgument;

-  me->decisionManager->ClearCache();
+  const bool non_root_only = static_cast<const bool>(arguments->scalarInput[0]);
+  me->decisionManager->ClearCache(non_root_only);

  return kIOReturnSuccess;
 }
@@ -165,7 +168,8 @@ IOReturn SantaDriverClient::cache_count(
  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
  if (!me) return kIOReturnBadArgument;

-  arguments->scalarOutput[0] = me->decisionManager->CacheCount();
+  arguments->scalarOutput[0] = me->decisionManager->RootCacheCount();
+  arguments->scalarOutput[1] = me->decisionManager->NonRootCacheCount();
  return kIOReturnSuccess;
 }

@@ -174,7 +178,7 @@ IOReturn SantaDriverClient::check_cache(
  SantaDriverClient *me = OSDynamicCast(SantaDriverClient, target);
  if (!me) return kIOReturnBadArgument;

-  uint64_t input = *arguments->scalarInput;
+  const uint64_t input = static_cast<const uint64_t>(arguments->scalarInput[0]);
  arguments->scalarOutput[0] = me->decisionManager->GetFromCache(input);

  return kIOReturnSuccess;
@@ -195,8 +199,8 @@ IOReturn SantaDriverClient::externalMethod(
    { &SantaDriverClient::open, 0, 0, 0, 0 },
    { &SantaDriverClient::allow_binary, 1, 0, 0, 0 },
    { &SantaDriverClient::deny_binary, 1, 0, 0, 0 },
-    { &SantaDriverClient::clear_cache, 0, 0, 0, 0 },
-    { &SantaDriverClient::cache_count, 0, 0, 1, 0 },
+    { &SantaDriverClient::clear_cache, 1, 0, 0, 0 },
+    { &SantaDriverClient::cache_count, 0, 0, 2, 0 },
    { &SantaDriverClient::check_cache, 1, 0, 1, 0 }
  };

--- a/Source/santabs/Resources/santabs-Info.plist
+++ b/Source/santabs/Resources/santabs-Info.plist
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>en</string>
+	<key>CFBundleDisplayName</key>
+	<string>santabs</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>XPC!</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>XPCService</key>
+	<dict>
+		<key>ServiceType</key>
+		<string>Application</string>
+	</dict>
+</dict>
+</plist>
--- a/Source/santabs/SNTBundleService.h
+++ b/Source/santabs/SNTBundleService.h
@@ -0,0 +1,20 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+#import "SNTXPCBundleServiceInterface.h"
+
+@interface SNTBundleService : NSObject<SNTBundleServiceXPC>
+@end
--- a/Source/santabs/SNTBundleService.m
+++ b/Source/santabs/SNTBundleService.m
@@ -0,0 +1,303 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTBundleService.h"
+
+#import <CommonCrypto/CommonDigest.h>
+#import <pthread/pthread.h>
+
+#import "MOLCertificate.h"
+#import "MOLCodesignChecker.h"
+#import "SNTFileInfo.h"
+#import "SNTStoredEvent.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCNotifierInterface.h"
+
+@interface SNTBundleService ()
+@property SNTXPCConnection *notifierConnection;
+@property SNTXPCConnection *listener;
+@property(nonatomic) dispatch_queue_t queue;
+@end
+
+@implementation SNTBundleService
+
+- (instancetype)init {
+  self = [super init];
+  if (self) {
+    _queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0);
+  }
+  return self;
+}
+
+#pragma mark Connection handling
+
+// Create a listener for SantaGUI to connect
+- (void)createConnection {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  // Create listener for return connection from SantaGUI.
+  NSXPCListener *listener = [NSXPCListener anonymousListener];
+  self.listener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.listener.exportedInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  self.listener.exportedObject = self;
+  self.listener.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+
+  // Exit when SantaGUI is done with us.
+  self.listener.invalidationHandler = ^{
+    exit(0);
+  };
+
+  [self.listener resume];
+
+  // Tell SantaGUI to connect back to the above listener.
+  [[self.notifierConnection remoteObjectProxy] setBundleServiceListener:listener.endpoint];
+
+  // Now wait for the connection to come in.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    [self attemptReconnection];
+  }
+}
+
+- (void)attemptReconnection {
+  [self performSelectorInBackground:@selector(createConnection) withObject:nil];
+}
+
+#pragma mark SNTBundleServiceXPC Methods
+
+// Connect to the SantaGUI
+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener {
+  SNTXPCConnection *c = [[SNTXPCConnection alloc] initClientWithListener:listener];
+  c.remoteInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
+  [c resume];
+  self.notifierConnection = c;
+  dispatch_async(self.queue, ^{
+    [self createConnection];
+  });
+}
+
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event
+                             reply:(SNTBundleHashBlock)reply {
+  NSProgress *progress =
+      [NSProgress currentProgress] ? [NSProgress progressWithTotalUnitCount:100] : nil;
+
+  NSDate *startTime = [NSDate date];
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  dispatch_async(self.queue, ^{
+    // Use the highest bundle we can find. Save and reuse the bundle infomation when creating
+    // the related binary events.
+    SNTFileInfo *b = [[SNTFileInfo alloc] initWithPath:event.fileBundlePath];
+    b.useAncestorBundle = YES;
+    event.fileBundlePath = b.bundlePath;
+    event.fileBundleID = b.bundleIdentifier;
+    event.fileBundleName = b.bundleName;
+    event.fileBundleVersion = b.bundleVersion;
+    event.fileBundleVersionString = b.bundleShortVersionString;
+
+    // For most apps this should be "Contents/MacOS/AppName"
+    if (b.bundle.executablePath.length > b.bundlePath.length) {
+      event.fileBundleExecutableRelPath =
+          [b.bundle.executablePath substringFromIndex:b.bundlePath.length + 1];
+    }
+
+    NSDictionary *relatedEvents = [self findRelatedBinaries:event progress:progress];
+    NSString *bundleHash = [self calculateBundleHashFromSHA256Hashes:relatedEvents.allKeys
+                                                            progress:progress];
+
+    NSNumber *ms = [NSNumber numberWithDouble:[startTime timeIntervalSinceNow] * -1000.0];
+
+    reply(bundleHash, relatedEvents.allValues, ms);
+    dispatch_semaphore_signal(sema);
+  });
+
+  // Master timeout of 10 min. Don't block the calling thread. NSProgress updates will be coming
+  // in over this thread.
+  dispatch_async(self.queue, ^{
+    if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 600 * NSEC_PER_SEC))) {
+      [progress cancel];
+    }
+  });
+}
+
+#pragma mark Internal Methods
+
+/**
+  Find binaries within a bundle given the bundle's event. It will run until a timeout occurs,
+  or until the NSProgress is cancelled. Search is done within the bundle concurrently.
+
+  @param event The SNTStoredEvent to begin searching.
+  @return An NSDictionary object with keys of fileSHA256 and values of SNTStoredEvent objects.
+*/
+- (NSDictionary *)findRelatedBinaries:(SNTStoredEvent *)event progress:(NSProgress *)progress {
+  // Find all files and folders within the fileBundlePath
+  NSFileManager *fm = [NSFileManager defaultManager];
+  NSArray *subpaths = [fm subpathsOfDirectoryAtPath:event.fileBundlePath error:NULL];
+
+  // This array is used to store pointers to executable SNTFileInfo objects. There will be one block
+  // dispatched per file in dirEnum. These blocks will write pointers to this array concurrently.
+  // No locks are used since every file has a slot.
+  //
+  // Xcode.app has roughly 500k files, 8bytes per pointer is ~4MB for this array. This size to space
+  // ratio seems appropriate as Xcode.app is in the upper bounds of bundle size.
+  __block void **fis = calloc(subpaths.count, sizeof(void *));
+
+  // Counts used as additional progress information in SantaGUI
+  __block volatile int64_t binaryCount = 0;
+  __block volatile int64_t sentBinaryCount = 0;
+
+  // Account for 80% of the work
+  NSProgress *p;
+  if (progress) {
+    [progress becomeCurrentWithPendingUnitCount:80];
+    p = [NSProgress progressWithTotalUnitCount:subpaths.count * 100];
+  }
+
+  // Dispatch a block for every file in dirEnum.
+  dispatch_apply(subpaths.count, self.queue, ^(size_t i) {
+    @autoreleasepool {
+      if (progress.isCancelled) return;
+
+      dispatch_sync(dispatch_get_main_queue(), ^{
+        p.completedUnitCount++;
+        if (progress && ((i % 500) == 0 || binaryCount > sentBinaryCount)) {
+          sentBinaryCount = binaryCount;
+          [[self.notifierConnection remoteObjectProxy] updateCountsForEvent:event
+                                                                binaryCount:binaryCount
+                                                                  fileCount:i
+                                                                hashedCount:0];
+        }
+      });
+
+      NSString *subpath = subpaths[i];
+
+      NSString *file =
+          [event.fileBundlePath stringByAppendingPathComponent:subpath].stringByStandardizingPath;
+      SNTFileInfo *fi = [[SNTFileInfo alloc] initWithResolvedPath:file error:NULL];
+      if (!fi.isExecutable) return;
+
+      fis[i] = (__bridge_retained void *)fi;
+      OSAtomicIncrement64Barrier(&binaryCount);
+    }
+  });
+
+  [progress resignCurrent];
+
+  NSMutableArray *fileInfos = [NSMutableArray arrayWithCapacity:binaryCount];
+  for (NSUInteger i = 0; i < subpaths.count; i++) {
+    if (fis[i]) [fileInfos addObject:(__bridge_transfer SNTFileInfo *)fis[i]];
+  }
+
+  free(fis);
+
+  return [self generateEventsFromBinaries:fileInfos blockingEvent:event progress:progress];
+}
+
+- (NSDictionary *)generateEventsFromBinaries:(NSArray *)fis
+                               blockingEvent:(SNTStoredEvent *)event
+                                    progress:(NSProgress *)progress {
+  if (progress.isCancelled) return nil;
+
+  NSMutableDictionary *relatedEvents = [NSMutableDictionary dictionaryWithCapacity:fis.count];
+
+  // Account for 15% of the work
+  NSProgress *p;
+  if (progress) {
+    [progress becomeCurrentWithPendingUnitCount:15];
+    p = [NSProgress progressWithTotalUnitCount:fis.count * 100];
+  }
+
+  dispatch_apply(fis.count, self.queue, ^(size_t i) {
+    @autoreleasepool {
+      if (progress.isCancelled) return;
+
+      SNTFileInfo *fi = fis[i];
+
+      SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+      se.filePath = fi.path;
+      se.fileSHA256 = fi.SHA256;
+      se.occurrenceDate = [NSDate distantFuture];
+      se.decision = SNTEventStateBundleBinary;
+
+      se.fileBundlePath = event.fileBundlePath;
+      se.fileBundleExecutableRelPath = event.fileBundleExecutableRelPath;
+      se.fileBundleID = event.fileBundleID;
+      se.fileBundleName = event.fileBundleName;
+      se.fileBundleVersion = event.fileBundleVersion;
+      se.fileBundleVersionString = event.fileBundleVersionString;
+
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
+      se.signingChain = cs.certificates;
+
+      dispatch_sync(dispatch_get_main_queue(), ^{
+        relatedEvents[se.fileSHA256] = se;
+        p.completedUnitCount++;
+        if (progress) {
+          [[self.notifierConnection remoteObjectProxy] updateCountsForEvent:event
+                                                                binaryCount:fis.count
+                                                                  fileCount:0
+                                                                hashedCount:i];
+        }
+      });
+    }
+  });
+
+  [progress resignCurrent];
+
+  return relatedEvents;
+}
+
+- (NSString *)calculateBundleHashFromSHA256Hashes:(NSArray *)hashes
+                                         progress:(NSProgress *)progress {
+  if (!hashes.count) return nil;
+
+  // Account for 5% of the work
+  NSProgress *p;
+  if (progress) {
+    [progress becomeCurrentWithPendingUnitCount:5];
+    p = [NSProgress progressWithTotalUnitCount:5 * 100];
+  }
+
+  NSMutableArray *sortedHashes = [hashes mutableCopy];
+  [sortedHashes sortUsingSelector:@selector(localizedCaseInsensitiveCompare:)];
+  NSString *sha256Hashes = [sortedHashes componentsJoinedByString:@""];
+
+  CC_SHA256_CTX c256;
+  CC_SHA256_Init(&c256);
+  CC_SHA256_Update(&c256, (const void *)sha256Hashes.UTF8String, (CC_LONG)sha256Hashes.length);
+  unsigned char digest[CC_SHA256_DIGEST_LENGTH];
+  CC_SHA256_Final(digest, &c256);
+
+  NSString *const SHA256FormatString =
+    @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+    "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
+
+  NSString *sha256 = [[NSString alloc] initWithFormat:SHA256FormatString,
+      digest[0], digest[1], digest[2], digest[3],
+      digest[4], digest[5], digest[6], digest[7],
+      digest[8], digest[9], digest[10], digest[11],
+      digest[12], digest[13], digest[14], digest[15],
+      digest[16], digest[17], digest[18], digest[19],
+      digest[20], digest[21], digest[22], digest[23],
+      digest[24], digest[25], digest[26], digest[27],
+      digest[28], digest[29], digest[30], digest[31]];
+
+  p.completedUnitCount++;
+  [progress resignCurrent];
+  return sha256;
+}
+
+@end
--- a/Source/santabs/main.m
+++ b/Source/santabs/main.m
@@ -0,0 +1,27 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+#import "SNTBundleService.h"
+#import "SNTXPCBundleServiceInterface.h"
+#import "SNTXPCConnection.h"
+
+int main(int argc, const char *argv[]) {
+  SNTXPCConnection *c =
+      [[SNTXPCConnection alloc] initServerWithListener:[NSXPCListener serviceListener]];
+  c.exportedInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  c.exportedObject = [[SNTBundleService alloc] init];
+  [c resume];
+}
--- a/Source/santactl/Commands/SNTCommandBundleInfo.m
+++ b/Source/santactl/Commands/SNTCommandBundleInfo.m
@@ -0,0 +1,79 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommand.h"
+#import "SNTCommandController.h"
+
+#import "SNTFileInfo.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
+
+@interface SNTCommandBundleInfo : SNTCommand<SNTCommandProtocol>
+@end
+
+@implementation SNTCommandBundleInfo
+
+#ifdef DEBUG
+REGISTER_COMMAND_NAME(@"bundleinfo")
+#endif
+
+ (BOOL)requiresRoot {
+  return NO;
+}
+
+ (BOOL)requiresDaemonConn {
+  return YES;
+}
+
+ (NSString *)shortHelpText {
+  return @"Searches a bundle for binaries";
+}
+
+ (NSString *)longHelpText {
+  return @"Searches a bundle for binaries";
+}
+
+- (void)runWithArguments:(NSArray *)arguments {
+  NSError *error;
+  SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:arguments.firstObject error:&error];
+  if (!fi) {
+    printf("%s\n", error.description.UTF8String);
+    exit(1);
+  } else if (!fi.bundle) {
+    printf("Not a bundle\n");
+    exit(2);
+  }
+
+  SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+  se.fileBundlePath = fi.bundlePath;
+
+  [[self.daemonConn remoteObjectProxy]
+      hashBundleBinariesForEvent:se
+                           reply:^(NSString *hash, NSArray<SNTStoredEvent *> *events,
+                                   NSNumber *time) {
+    printf("Hashing time: %llu ms\n", time.unsignedLongLongValue);
+    printf("%lu events found\n", events.count);
+    printf("BundleHash: %s\n", hash.UTF8String);
+
+    for (SNTStoredEvent *event in events) {
+      printf("BundleID: %s \n\tSHA-256: %s \n\tPath: %s\n",
+             event.fileBundleID.UTF8String, event.fileSHA256.UTF8String, event.filePath.UTF8String);
+    }
+    exit(0);
+  }];
+}
+
+@end
--- a/Source/santactl/Commands/SNTCommandCheckCache.m
+++ b/Source/santactl/Commands/SNTCommandCheckCache.m
@@ -14,6 +14,7 @@

@import Foundation;

+#import "SNTCommand.h"
 #import "SNTCommandController.h"

 #import "SNTLogging.h"
@@ -22,7 +23,7 @@

 #include <sys/stat.h>

-@interface SNTCommandCheckCache : NSObject<SNTCommand>
+@interface SNTCommandCheckCache : SNTCommand<SNTCommandProtocol>
@end

@implementation SNTCommandCheckCache
@@ -48,9 +49,10 @@ REGISTER_COMMAND_NAME(@"checkcache")
          @"Returns 0 if successful, 1 otherwise");
 }

-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+- (void)runWithArguments:(NSArray *)arguments {
  uint64_t vnodeID = [self vnodeIDForFile:arguments.firstObject];
-  [[daemonConn remoteObjectProxy] checkCacheForVnodeID:vnodeID withReply:^(santa_action_t action) {
+  [[self.daemonConn remoteObjectProxy] checkCacheForVnodeID:vnodeID
+                                                  withReply:^(santa_action_t action) {
    if (action == ACTION_RESPOND_ALLOW) {
      LOGI(@"File exists in [whitelist] kernel cache");
      exit(0);
@@ -64,7 +66,7 @@ REGISTER_COMMAND_NAME(@"checkcache")
  }];
 }

-+ (uint64_t)vnodeIDForFile:(NSString *)path {
+- (uint64_t)vnodeIDForFile:(NSString *)path {
  struct stat fstat = {};
  stat(path.fileSystemRepresentation, &fstat);
  return (((uint64_t)fstat.st_dev << 32) | fstat.st_ino);
--- a/Source/santactl/Commands/SNTCommandFileInfo.m
+++ b/Source/santactl/Commands/SNTCommandFileInfo.m
--- a/Source/santactl/Commands/SNTCommandFlushCache.m
+++ b/Source/santactl/Commands/SNTCommandFlushCache.m
@@ -14,13 +14,14 @@

@import Foundation;

+#import "SNTCommand.h"
 #import "SNTCommandController.h"

 #import "SNTLogging.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"

-@interface SNTCommandFlushCache : NSObject<SNTCommand>
+@interface SNTCommandFlushCache : SNTCommand<SNTCommandProtocol>
@end

@implementation SNTCommandFlushCache
@@ -46,8 +47,8 @@ REGISTER_COMMAND_NAME(@"flushcache")
          @"Returns 0 if successful, 1 otherwise");
 }

-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
-  [[daemonConn remoteObjectProxy] flushCache:^(BOOL success) {
+- (void)runWithArguments:(NSArray *)arguments {
+  [[self.daemonConn remoteObjectProxy] flushCache:^(BOOL success) {
    if (success) {
      LOGI(@"Cache flush requested");
      exit(0);
--- a/Source/santactl/Commands/SNTCommandRule.m
+++ b/Source/santactl/Commands/SNTCommandRule.m
@@ -14,21 +14,20 @@

@import Foundation;

+#import "SNTCommand.h"
 #import "SNTCommandController.h"

-#include "SNTLogging.h"
-
 #import "MOLCertificate.h"
 #import "MOLCodesignChecker.h"
 #import "SNTConfigurator.h"
 #import "SNTDropRootPrivs.h"
 #import "SNTFileInfo.h"
+#include "SNTLogging.h"
 #import "SNTRule.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"

-@interface SNTCommandRule : NSObject<SNTCommand>
-@property SNTXPCConnection *daemonConn;
+@interface SNTCommandRule : SNTCommand<SNTCommandProtocol>
@end

@implementation SNTCommandRule
@@ -44,7 +43,7 @@ REGISTER_COMMAND_NAME(@"rule")
 }

 + (NSString *)shortHelpText {
-  return @"Manually add/remove rules.";
+  return @"Manually add/remove/check rules.";
 }

 + (NSString *)longHelpText {
@@ -54,26 +53,23 @@ REGISTER_COMMAND_NAME(@"rule")
          @"    --blacklist: add to blacklist\n"
          @"    --silent-blacklist: add to silent blacklist\n"
          @"    --remove: remove existing rule\n"
+          @"    --check: check for an existing rule\n"
          @"\n"
          @"  One of:\n"
          @"    --path {path}: path of binary/bundle to add/remove.\n"
          @"                   Will add the hash of the file currently at that path.\n"
-          @"    --sha256 {sha256}: hash to add/remove\n"
+          @"                   Does not work with --check. Use the fileinfo verb to check.\n"
+          @"                   the rule state of a file.\n"
+          @"    --sha256 {sha256}: hash to add/remove/check\n"
          @"\n"
          @"  Optionally:\n"
-          @"    --certificate: add certificate rule instead of binary\n"
+          @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
          @"    --message {message}: custom message\n");
 }

-+ (void)printErrorUsageAndExit:(NSString *)error {
-  printf("%s\n\n", [error UTF8String]);
-  printf("%s\n", [[self longHelpText] UTF8String]);
-  exit(1);
-}
-
-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+- (void)runWithArguments:(NSArray *)arguments {
  SNTConfigurator *config = [SNTConfigurator configurator];
-  if ([config syncBaseURL] != nil) {
+  if ([config syncBaseURL] && ![arguments containsObject:@"--check"]) {
    printf("SyncBaseURL is set, rules are managed centrally.\n");
    exit(1);
  }
@@ -83,6 +79,7 @@ REGISTER_COMMAND_NAME(@"rule")
  newRule.type = SNTRuleTypeBinary;

  NSString *path;
+  BOOL check = NO;

  // Parse arguments
  for (NSUInteger i = 0; i < arguments.count; ++i) {
@@ -96,6 +93,8 @@ REGISTER_COMMAND_NAME(@"rule")
      newRule.state = SNTRuleStateSilentBlacklist;
    } else if ([arg caseInsensitiveCompare:@"--remove"] == NSOrderedSame) {
      newRule.state = SNTRuleStateRemove;
+    } else if ([arg caseInsensitiveCompare:@"--check"] == NSOrderedSame) {
+      check = YES;
    } else if ([arg caseInsensitiveCompare:@"--certificate"] == NSOrderedSame) {
      newRule.type = SNTRuleTypeCertificate;
    } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
@@ -121,6 +120,11 @@ REGISTER_COMMAND_NAME(@"rule")
    }
  }

+  if (check) {
+    if (!newRule.shasum) return [self printErrorUsageAndExit:@"--check requires --sha256"];
+    return [self printStateOfRule:newRule daemonConnection:self.daemonConn];
+  }
+
  if (path) {
    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
    if (!fi.path) {
@@ -130,7 +134,7 @@ REGISTER_COMMAND_NAME(@"rule")
    if (newRule.type == SNTRuleTypeBinary) {
      newRule.shasum = fi.SHA256;
    } else if (newRule.type == SNTRuleTypeCertificate) {
-      MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithBinaryPath:fi.path];
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
      newRule.shasum = cs.leafCertificate.SHA256;
    }
  }
@@ -141,9 +145,9 @@ REGISTER_COMMAND_NAME(@"rule")
    [self printErrorUsageAndExit:@"Either SHA-256 or path to file must be specified"];
  }

-  [[daemonConn remoteObjectProxy] databaseRuleAddRules:@[newRule]
-                                            cleanSlate:NO
-                                                 reply:^(NSError *error) {
+  [[self.daemonConn remoteObjectProxy] databaseRuleAddRules:@[newRule]
+                                                 cleanSlate:NO
+                                                      reply:^(NSError *error) {
    if (error) {
      printf("Failed to modify rules: %s", [error.localizedDescription UTF8String]);
      LOGD(@"Failure reason: %@", error.localizedFailureReason);
@@ -159,4 +163,58 @@ REGISTER_COMMAND_NAME(@"rule")
  }];
 }

+- (void)printStateOfRule:(SNTRule *)rule daemonConnection:(SNTXPCConnection *)daemonConn {
+  NSString *fileSHA256 = (rule.type == SNTRuleTypeBinary) ? rule.shasum : nil;
+  NSString *certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.shasum : nil;
+  dispatch_group_t group = dispatch_group_create();
+  dispatch_group_enter(group);
+  __block NSMutableString *output;
+  [[daemonConn remoteObjectProxy] decisionForFilePath:nil
+                                           fileSHA256:fileSHA256
+                                    certificateSHA256:certificateSHA256
+                                                reply:^(SNTEventState s) {
+    output = (SNTEventStateAllow & s) ? @"Whitelisted".mutableCopy : @"Blacklisted".mutableCopy;
+    switch (s) {
+      case SNTEventStateAllowUnknown:
+      case SNTEventStateBlockUnknown:
+        [output appendString:@" (Unknown)"];
+        break;
+      case SNTEventStateAllowBinary:
+      case SNTEventStateBlockBinary:
+        [output appendString:@" (Binary)"];
+        break;
+      case SNTEventStateAllowCertificate:
+      case SNTEventStateBlockCertificate:
+        [output appendString:@" (Certificate)"];
+        break;
+      case SNTEventStateAllowScope:
+      case SNTEventStateBlockScope:
+        [output appendString:@" (Scope)"];
+        break;
+      default:
+        output = @"None".mutableCopy;
+        break;
+    }
+    if (isatty(STDOUT_FILENO)) {
+      if ((SNTEventStateAllow & s)) {
+        [output insertString:@"\033[32m" atIndex:0];
+        [output appendString:@"\033[0m"];
+      } else if ((SNTEventStateBlock & s)) {
+        [output insertString:@"\033[31m" atIndex:0];
+        [output appendString:@"\033[0m"];
+      } else {
+        [output insertString:@"\033[33m" atIndex:0];
+        [output appendString:@"\033[0m"];
+      }
+    }
+    dispatch_group_leave(group);
+  }];
+  if (dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    printf("Cannot communicate with daemon");
+    exit(1);
+  }
+  printf("%s\n", output.UTF8String);
+  exit(0);
+}
+
@end
--- a/Source/santactl/Commands/SNTCommandStatus.m
+++ b/Source/santactl/Commands/SNTCommandStatus.m
@@ -14,13 +14,14 @@

@import Foundation;

+#import "SNTCommand.h"
 #import "SNTCommandController.h"

 #import "SNTConfigurator.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"

-@interface SNTCommandStatus : NSObject<SNTCommand>
+@interface SNTCommandStatus : SNTCommand<SNTCommandProtocol>
@end

@implementation SNTCommandStatus
@@ -44,7 +45,7 @@ REGISTER_COMMAND_NAME(@"status")
          @"  Use --json to output in JSON format");
 }

-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+- (void)runWithArguments:(NSArray *)arguments {
  dispatch_group_t group = dispatch_group_create();

  // Daemon status
@@ -52,7 +53,7 @@ REGISTER_COMMAND_NAME(@"status")
  __block uint64_t cpuEvents, ramEvents;
  __block double cpuPeak, ramPeak;
  dispatch_group_enter(group);
-  [[daemonConn remoteObjectProxy] clientMode:^(SNTClientMode cm) {
+  [[self.daemonConn remoteObjectProxy] clientMode:^(SNTClientMode cm) {
    switch (cm) {
      case SNTClientModeMonitor:
        clientMode = @"Monitor";
@@ -67,8 +68,8 @@ REGISTER_COMMAND_NAME(@"status")
    dispatch_group_leave(group);
  }];
  dispatch_group_enter(group);
-  [[daemonConn remoteObjectProxy] watchdogInfo:^(uint64_t wd_cpuEvents, uint64_t wd_ramEvents,
-                                                 double wd_cpuPeak, double wd_ramPeak) {
+  [[self.daemonConn remoteObjectProxy] watchdogInfo:^(uint64_t wd_cpuEvents, uint64_t wd_ramEvents,
+                                                      double wd_cpuPeak, double wd_ramPeak) {
    cpuEvents = wd_cpuEvents;
    cpuPeak = wd_cpuPeak;
    ramEvents = wd_ramEvents;
@@ -79,23 +80,24 @@ REGISTER_COMMAND_NAME(@"status")
  BOOL fileLogging = ([[SNTConfigurator configurator] fileChangesRegex] != nil);

  // Kext status
-  __block int64_t cacheCount = -1;
+  __block uint64_t rootCacheCount = -1, nonRootCacheCount = -1;
  dispatch_group_enter(group);
-  [[daemonConn remoteObjectProxy] cacheCount:^(int64_t count) {
-    cacheCount = count;
+  [[self.daemonConn remoteObjectProxy] cacheCounts:^(uint64_t rootCache, uint64_t nonRootCache) {
+    rootCacheCount = rootCache;
+    nonRootCacheCount = nonRootCache;
    dispatch_group_leave(group);
  }];

  // Database counts
  __block int64_t eventCount = -1, binaryRuleCount = -1, certRuleCount = -1;
  dispatch_group_enter(group);
-  [[daemonConn remoteObjectProxy] databaseRuleCounts:^(int64_t binary, int64_t certificate) {
+  [[self.daemonConn remoteObjectProxy] databaseRuleCounts:^(int64_t binary, int64_t certificate) {
    binaryRuleCount = binary;
    certRuleCount = certificate;
    dispatch_group_leave(group);
  }];
  dispatch_group_enter(group);
-  [[daemonConn remoteObjectProxy] databaseEventCount:^(int64_t count) {
+  [[self.daemonConn remoteObjectProxy] databaseEventCount:^(int64_t count) {
    eventCount = count;
    dispatch_group_leave(group);
  }];
@@ -114,12 +116,21 @@ REGISTER_COMMAND_NAME(@"status")
  __block BOOL pushNotifications = NO;
  if ([[SNTConfigurator configurator] syncBaseURL]) {
    dispatch_group_enter(group);
-    [[daemonConn remoteObjectProxy] pushNotifications:^(BOOL response) {
+    [[self.daemonConn remoteObjectProxy] pushNotifications:^(BOOL response) {
      pushNotifications = response;
      dispatch_group_leave(group);
    }];
  }

+  __block BOOL bundlesEnabled = NO;
+  if ([[SNTConfigurator configurator] syncBaseURL]) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] bundlesEnabled:^(BOOL response) {
+      bundlesEnabled = response;
+      dispatch_group_leave(group);
+    }];
+  }
+
  // Wait a maximum of 5s for stats collected from daemon to arrive.
  if (dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 5))) {
    fprintf(stderr, "Failed to retrieve some stats from daemon\n\n");
@@ -136,7 +147,8 @@ REGISTER_COMMAND_NAME(@"status")
        @"watchdog_ram_peak" : @(ramPeak),
      },
      @"kernel" : @{
-        @"cache_count" : @(cacheCount),
+        @"root_cache_count" : @(rootCacheCount),
+        @"non_root_cache_count": @(nonRootCacheCount),
      },
      @"database" : @{
        @"binary_rules" : @(binaryRuleCount),
@@ -148,7 +160,8 @@ REGISTER_COMMAND_NAME(@"status")
        @"clean_required" : @(syncCleanReqd),
        @"last_successful_full" : lastSyncSuccessStr ?: @"null",
        @"last_successful_rule" : lastRuleSyncSuccessStr ?: @"null",
-        @"push_notifications" : pushNotifications ? @"Connected" : @"Disconnected"
+        @"push_notifications" : pushNotifications ? @"Connected" : @"Disconnected",
+        @"bundle_scanning" : @(bundlesEnabled)
      },
    };
    NSData *statsData = [NSJSONSerialization dataWithJSONObject:stats
@@ -163,7 +176,8 @@ REGISTER_COMMAND_NAME(@"status")
    printf("  %-25s | %lld  (Peak: %.2f%%)\n", "Watchdog CPU Events", cpuEvents, cpuPeak);
    printf("  %-25s | %lld  (Peak: %.2fMB)\n", "Watchdog RAM Events", ramEvents, ramPeak);
    printf(">>> Kernel Info\n");
-    printf("  %-25s | %lld\n", "Kernel cache count", cacheCount);
+    printf("  %-25s | %lld\n", "Root cache count", rootCacheCount);
+    printf("  %-25s | %lld\n", "Non-root cache count", nonRootCacheCount);
    printf(">>> Database Info\n");
    printf("  %-25s | %lld\n", "Binary Rules", binaryRuleCount);
    printf("  %-25s | %lld\n", "Certificate Rules", certRuleCount);
@@ -177,6 +191,7 @@ REGISTER_COMMAND_NAME(@"status")
      printf("  %-25s | %s\n", "Last Successful Rule Sync", [lastRuleSyncSuccessStr UTF8String]);
      printf("  %-25s | %s\n", "Push Notifications",
             (pushNotifications ? "Connected" : "Disconnected"));
+      printf("  %-25s | %s\n", "Bundle Scanning", (bundlesEnabled ? "Yes" : "No"));
    }
  }

--- a/Source/santactl/Commands/SNTCommandVersion.m
+++ b/Source/santactl/Commands/SNTCommandVersion.m
@@ -13,17 +13,17 @@
 ///    limitations under the License.

@import Foundation;
-
-#import "SNTCommandController.h"
-
@import IOKit.kext;

+#import "SNTCommand.h"
+#import "SNTCommandController.h"
+
 #import "SNTCommonEnums.h"
 #import "SNTFileInfo.h"
 #import "SNTKernelCommon.h"
 #import "SNTXPCConnection.h"

-@interface SNTCommandVersion : NSObject<SNTCommand>
+@interface SNTCommandVersion : SNTCommand<SNTCommandProtocol>
@end

@implementation SNTCommandVersion
@@ -47,7 +47,7 @@ REGISTER_COMMAND_NAME(@"version")
          @"  Use --json to output in JSON format.");
 }

-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+- (void)runWithArguments:(NSArray *)arguments {
  if ([arguments containsObject:@"--json"]) {
    NSDictionary *versions = @{
      @"santa-driver" : [self santaKextVersion],
@@ -70,7 +70,7 @@ REGISTER_COMMAND_NAME(@"version")
  exit(0);
 }

-+ (NSString *)santaKextVersion {
+- (NSString *)santaKextVersion {
  NSDictionary *loadedKexts = CFBridgingRelease(
      KextManagerCopyLoadedKextInfo((__bridge CFArrayRef) @[ @(USERCLIENT_ID) ],
                                    (__bridge CFArrayRef) @[ @"CFBundleVersion" ]));
@@ -87,18 +87,18 @@ REGISTER_COMMAND_NAME(@"version")
  return @"not found";
 }

-+ (NSString *)santadVersion {
+- (NSString *)santadVersion {
  SNTFileInfo *daemonInfo = [[SNTFileInfo alloc] initWithPath:@(kSantaDPath)];
  return daemonInfo.bundleVersion;
 }

-+ (NSString *)santaAppVersion {
+- (NSString *)santaAppVersion {
  SNTFileInfo *guiInfo =
      [[SNTFileInfo alloc] initWithPath:@"/Applications/Santa.app/Contents/MacOS/Santa"];
  return guiInfo.bundleVersion;
 }

-+ (NSString *)santactlVersion {
+- (NSString *)santactlVersion {
  return [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
 }

--- a/Source/santactl/Commands/sync/SNTCommandSync.m
+++ b/Source/santactl/Commands/sync/SNTCommandSync.m
@@ -14,6 +14,7 @@

@import Foundation;

+#import "SNTCommand.h"
 #import "SNTCommandController.h"

 #import "SNTCommandSyncManager.h"
@@ -23,7 +24,7 @@
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"

-@interface SNTCommandSync : NSObject<SNTCommand>
+@interface SNTCommandSync : SNTCommand<SNTCommandProtocol>
@property SNTXPCConnection *listener;
@property SNTCommandSyncManager *syncManager;
@end
@@ -54,18 +55,22 @@ REGISTER_COMMAND_NAME(@"sync")
          @"           clean sync from the server.");
 }

-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+- (void)runWithArguments:(NSArray *)arguments {
  // Ensure we have no privileges
  if (!DropRootPrivileges()) {
    LOGE(@"Failed to drop root privileges. Exiting.");
    exit(1);
  }

-  SNTCommandSync *s = [[self alloc] init];
-  [daemonConn resume];
+  if (![[SNTConfigurator configurator] syncBaseURL]) {
+    LOGE(@"Missing SyncBaseURL. Exiting.");
+    exit(1);
+  }
+
+  [self.daemonConn resume];
  BOOL daemon = [arguments containsObject:@"--daemon"];
-  s.syncManager = [[SNTCommandSyncManager alloc] initWithDaemonConnection:daemonConn
-                                                                 isDaemon:daemon];
+  self.syncManager = [[SNTCommandSyncManager alloc] initWithDaemonConnection:self.daemonConn
+                                                                    isDaemon:daemon];

  // Dropping root privileges to the 'nobody' user causes the default NSURLCache to throw
  // sandbox errors, which are benign but annoying. This line disables the cache entirely.
@@ -73,8 +78,8 @@ REGISTER_COMMAND_NAME(@"sync")
                                                              diskCapacity:0
                                                                  diskPath:nil]];

-  if (!s.syncManager.daemon) return [s.syncManager fullSync];
-  [s syncdWithDaemonConnection:daemonConn];
+  if (!self.syncManager.daemon) return [self.syncManager fullSync];
+  [self syncdWithDaemonConnection:self.daemonConn];
 }

 #pragma mark daemon methods
--- a/Source/santactl/Commands/sync/SNTCommandSyncConstants.h
+++ b/Source/santactl/Commands/sync/SNTCommandSyncConstants.h
@@ -34,6 +34,9 @@ extern NSString *const kBlacklistRegex;
 extern NSString *const kBinaryRuleCount;
 extern NSString *const kCertificateRuleCount;
 extern NSString *const kFCMToken;
+extern NSString *const kFCMFullSyncInterval;
+extern NSString *const kFCMGlobalRuleSyncDeadline;
+extern NSString *const kBundlesEnabled;

 extern NSString *const kEvents;
 extern NSString *const kFileSHA256;
@@ -56,9 +59,13 @@ extern NSString *const kLoggedInUsers;
 extern NSString *const kCurrentSessions;
 extern NSString *const kFileBundleID;
 extern NSString *const kFileBundlePath;
+extern NSString *const kFileBundleExecutableRelPath;
 extern NSString *const kFileBundleName;
 extern NSString *const kFileBundleVersion;
 extern NSString *const kFileBundleShortVersionString;
+extern NSString *const kFileBundleHash;
+extern NSString *const kFileBundleHashMilliseconds;
+extern NSString *const kFileBundleBinaryCount;
 extern NSString *const kPID;
 extern NSString *const kPPID;
 extern NSString *const kParentName;
@@ -96,3 +103,17 @@ extern NSString *const kFullSync;
 extern NSString *const kRuleSync;
 extern NSString *const kConfigSync;
 extern NSString *const kLogSync;
+
+extern const NSUInteger kDefaultEventBatchSize;
+
+///
+///  kDefaultFullSyncInterval
+///  kDefaultFCMFullSyncInterval
+///  kDefaultFCMGlobalRuleSyncDeadline
+///
+///  Are represented in seconds
+///
+extern const NSUInteger kDefaultFullSyncInterval;
+extern const NSUInteger kDefaultFCMFullSyncInterval;
+extern const NSUInteger kDefaultFCMGlobalRuleSyncDeadline;
+
--- a/Source/santactl/Commands/sync/SNTCommandSyncConstants.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncConstants.m
@@ -34,6 +34,9 @@ NSString *const kBlacklistRegex = @"blacklist_regex";
 NSString *const kBinaryRuleCount = @"binary_rule_count";
 NSString *const kCertificateRuleCount = @"certificate_rule_count";
 NSString *const kFCMToken = @"fcm_token";
+NSString *const kFCMFullSyncInterval = @"fcm_full_sync_interval";
+NSString *const kFCMGlobalRuleSyncDeadline = @"fcm_global_rule_sync_deadline";
+NSString *const kBundlesEnabled = @"bundles_enabled";

 NSString *const kEvents = @"events";
 NSString *const kFileSHA256 = @"file_sha256";
@@ -56,9 +59,13 @@ NSString *const kLoggedInUsers = @"logged_in_users";
 NSString *const kCurrentSessions = @"current_sessions";
 NSString *const kFileBundleID = @"file_bundle_id";
 NSString *const kFileBundlePath = @"file_bundle_path";
+NSString *const kFileBundleExecutableRelPath = @"file_bundle_executable_rel_path";
 NSString *const kFileBundleName = @"file_bundle_name";
 NSString *const kFileBundleVersion = @"file_bundle_version";
 NSString *const kFileBundleShortVersionString = @"file_bundle_version_string";
+NSString *const kFileBundleHash = @"file_bundle_hash";
+NSString *const kFileBundleHashMilliseconds = @"file_bundle_hash_millis";
+NSString *const kFileBundleBinaryCount = @"file_bundle_binary_count";
 NSString *const kPID = @"pid";
 NSString *const kPPID = @"ppid";
 NSString *const kParentName = @"parent_name";
@@ -96,3 +103,8 @@ NSString *const kFullSync = @"full_sync";
 NSString *const kRuleSync = @"rule_sync";
 NSString *const kConfigSync = @"config_sync";
 NSString *const kLogSync = @"log_sync";
+
+const NSUInteger kDefaultEventBatchSize = 50;
+const NSUInteger kDefaultFullSyncInterval = 600;
+const NSUInteger kDefaultFCMFullSyncInterval = 14400;
+const NSUInteger kDefaultFCMGlobalRuleSyncDeadline = 600;
--- a/Source/santactl/Commands/sync/SNTCommandSyncEventUpload.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncEventUpload.m
@@ -57,6 +57,9 @@
  NSDictionary *r = [self performRequest:[self requestWithDictionary:@{ kEvents: uploadEvents }]];
  if (!r) return NO;

+  // A list of bundle hashes that require their related binary events to be uploaded.		
+  self.syncState.bundleBinaryRequests = r[kEventUploadBundleBinaries];
+
  LOGI(@"Uploaded %lu events", uploadEvents.count);

  // Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
@@ -97,15 +100,22 @@
      ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);
      break;
    case SNTEventStateBlockScope: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
-    case SNTEventStateBundleBinary: ADDKEY(newEvent, kDecision, kDecisionBundleBinary); break;
+    case SNTEventStateBundleBinary:
+      ADDKEY(newEvent, kDecision, kDecisionBundleBinary);
+      [newEvent removeObjectForKey:kExecutionTime];
+      break;
    default: ADDKEY(newEvent, kDecision, kDecisionUnknown);
  }

  ADDKEY(newEvent, kFileBundleID, event.fileBundleID);
  ADDKEY(newEvent, kFileBundlePath, event.fileBundlePath);
+  ADDKEY(newEvent, kFileBundleExecutableRelPath, event.fileBundleExecutableRelPath);
  ADDKEY(newEvent, kFileBundleName, event.fileBundleName);
  ADDKEY(newEvent, kFileBundleVersion, event.fileBundleVersion);
  ADDKEY(newEvent, kFileBundleShortVersionString, event.fileBundleVersionString);
+  ADDKEY(newEvent, kFileBundleHash, event.fileBundleHash);
+  ADDKEY(newEvent, kFileBundleHashMilliseconds, event.fileBundleHashMilliseconds);
+  ADDKEY(newEvent, kFileBundleBinaryCount, event.fileBundleBinaryCount);

  ADDKEY(newEvent, kPID, event.pid);
  ADDKEY(newEvent, kPPID, event.ppid);
--- a/Source/santactl/Commands/sync/SNTCommandSyncManager.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncManager.m
@@ -27,32 +27,54 @@
 #import "SNTCommandSyncPreflight.h"
 #import "SNTCommandSyncRuleDownload.h"
 #import "SNTCommandSyncState.h"
+#import "SNTCommonEnums.h"
 #import "SNTLogging.h"
+#import "SNTStoredEvent.h"
 #import "SNTStrengthify.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
 #import "SNTXPCSyncdInterface.h"

-// Syncing time constant
-const uint64_t kFullSyncInterval = 600;
+static NSString *const kFCMActionKey = @"action";
+static NSString *const kFCMFileHashKey = @"file_hash";
+static NSString *const kFCMFileNameKey = @"file_name";
+static NSString *const kFCMTargetHostIDKey = @"target_host_id";

@interface SNTCommandSyncManager () {
  SCNetworkReachabilityRef _reachability;
 }
+
@property(nonatomic) dispatch_source_t fullSyncTimer;
@property(nonatomic) dispatch_source_t ruleSyncTimer;
+
@property(nonatomic) NSCache *dispatchLock;
-@property(nonatomic) NSCache *ruleSyncCache;
+
+// whitelistNotifications dictionary stores info from FCM messages.  The binary/bundle hash is used
+// as a key mapping to values that are themselves dictionaries.  These dictionary values contain the
+// name of the binary/bundle and a count of associated binary rules.
+@property(nonatomic) NSMutableDictionary *whitelistNotifications;
+
+// whitelistNotificationQueue is used to serialize access to the whitelistNotifications dictionary.
+@property(nonatomic) NSOperationQueue *whitelistNotificationQueue;
+
+@property NSUInteger FCMFullSyncInterval;
+@property NSUInteger FCMGlobalRuleSyncDeadline;
+@property NSUInteger eventBatchSize;
+
@property MOLFCMClient *FCMClient;
+
@property(nonatomic) SNTXPCConnection *daemonConn;
+
@property BOOL targetedRuleSync;
+
@property(nonatomic) BOOL reachable;
+
@end

 // Called when the network state changes
 static void reachabilityHandler(
    SCNetworkReachabilityRef target, SCNetworkReachabilityFlags flags, void *info) {
-  // Ensure state changes are processed in order.
+  // Put this check and set on the main thread to ensure serial access.
  dispatch_async(dispatch_get_main_queue(), ^{
    SNTCommandSyncManager *commandSyncManager = (__bridge SNTCommandSyncManager *)info;
    // Only call the setter when there is a change. This will filter out the redundant calls to this
@@ -73,8 +95,7 @@ static void reachabilityHandler(
    _daemonConn = daemonConn;
    _daemon = daemon;
    _fullSyncTimer = [self createSyncTimerWithBlock:^{
-      [self rescheduleTimerQueue:self.fullSyncTimer
-                  secondsFromNow:[SNTConfigurator configurator].FCMFullSyncInterval];
+      [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:self.FCMFullSyncInterval];
      if (![[SNTConfigurator configurator] syncBaseURL]) return;
      [self lockAction:kFullSync];
      [self preflight];
@@ -87,7 +108,8 @@ static void reachabilityHandler(
      [self lockAction:kRuleSync];
      SNTCommandSyncState *syncState = [self createSyncState];
      syncState.targetedRuleSync = self.targetedRuleSync;
-      syncState.ruleSyncCache = self.ruleSyncCache;
+      syncState.whitelistNotifications = self.whitelistNotifications;
+      syncState.whitelistNotificationQueue = self.whitelistNotificationQueue;
      SNTCommandSyncRuleDownload *p = [[SNTCommandSyncRuleDownload alloc] initWithState:syncState];
      if ([p sync]) {
        LOGD(@"Rule download complete");
@@ -98,25 +120,56 @@ static void reachabilityHandler(
      [self unlockAction:kRuleSync];
    }];
    _dispatchLock = [[NSCache alloc] init];
-    _ruleSyncCache = [[NSCache alloc] init];
+    _whitelistNotifications = [NSMutableDictionary dictionary];
+    _whitelistNotificationQueue = [[NSOperationQueue alloc] init];
+    _whitelistNotificationQueue.maxConcurrentOperationCount = 1;  // make this a serial queue
+
+    _eventBatchSize = kDefaultEventBatchSize;
+    _FCMFullSyncInterval = kDefaultFCMFullSyncInterval;
+    _FCMGlobalRuleSyncDeadline = kDefaultFCMGlobalRuleSyncDeadline;
  }
  return self;
 }

 #pragma mark SNTSyncdXPC protocol methods

- (void)postEventToSyncServer:(SNTStoredEvent *)event {
-  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc]
-                                     initWithState:[self createSyncState]];
-  if (event && [p uploadEvents:@[event]]) {
-    LOGD(@"Event upload complete");
+- (void)postEventsToSyncServer:(NSArray<SNTStoredEvent *> *)events isFromBundle:(BOOL)isFromBundle {
+  SNTCommandSyncState *syncState = [self createSyncState];
+  if (isFromBundle) syncState.eventBatchSize = self.eventBatchSize;
+  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc] initWithState:syncState];
+  if (events && [p uploadEvents:events]) {
+    LOGD(@"Events upload complete");
  } else {
-    LOGE(@"Event upload failed");
+    LOGE(@"Events upload failed.  Will retry again once %@ is reachable",
+        [[SNTConfigurator configurator] syncBaseURL].absoluteString);
+    [self startReachability];
  }
 }

- (void)rescheduleSyncSecondsFromNow:(uint64_t)seconds {
-  [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:seconds];
+- (void)postBundleEventToSyncServer:(SNTStoredEvent *)event
+                              reply:(void (^)(SNTBundleEventAction))reply {
+  if (!event) {
+    reply(SNTBundleEventActionDropEvents);
+    return;
+  }
+  SNTCommandSyncState *syncState = [self createSyncState];
+  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc] initWithState:syncState];
+  if ([p uploadEvents:@[event]]) {
+    if ([syncState.bundleBinaryRequests containsObject:event.fileBundleHash]) {
+      reply(SNTBundleEventActionSendEvents);
+      LOGD(@"Needs related events");
+    } else {
+      reply(SNTBundleEventActionDropEvents);
+      LOGD(@"Bundle event upload complete");
+    }
+  } else {
+    // Related bundle events will be stored and eventually synced, whether the server actually
+    // wanted them or not.  If they weren't needed the server will simply ignore them.
+    reply(SNTBundleEventActionStoreEvents);
+    LOGE(@"Bundle event upload failed.  Will retry again once %@ is reachable",
+        [[SNTConfigurator configurator] syncBaseURL].absoluteString);
+    [self startReachability];
+  }
 }

 - (void)isFCMListening:(void (^)(BOOL))reply {
@@ -152,60 +205,58 @@ static void reachabilityHandler(
    LOGE(@"FCM connection error: %@", error);
    [self.FCMClient disconnect];
    self.FCMClient = nil;
-    [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:kFullSyncInterval];
+    [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:kDefaultFullSyncInterval];
  };
-  
+
  self.FCMClient.loggingBlock = ^(NSString *log) {
    LOGD(@"%@", log);
  };
-  
+
  [self.FCMClient connect];
 }

 - (void)processFCMMessage:(NSDictionary *)FCMmessage withMachineID:(NSString *)machineID {
-  NSData *messageData = [self extractMessageDataFrom:FCMmessage];
+  NSDictionary *message = [self messageFromMessageData:[self messageDataFromFCMmessage:FCMmessage]];

-  if (!messageData) {
+  if (!message) {
    LOGD(@"Push notification message is not in the expected format...dropping message");
    return;
  }

-  NSError *error;
-  NSDictionary *actionMessage = [NSJSONSerialization JSONObjectWithData:messageData
-                                                                options:0
-                                                                  error:&error];
-  if (!actionMessage) {
-    LOGD(@"Unable to parse push notification message value: %@", error);
+  NSString *action = message[kFCMActionKey];
+  if (!action) {
+    LOGD(@"Push notification message contains no action");
    return;
  }

-  // Store the file name and hash in a cache. When the rule is actually added, use the cache
-  // to build a user notification.
-  NSString *fileHash = actionMessage[@"file_hash"];
-  NSString *fileName = actionMessage[@"file_name"];
+  // We assume that the incoming FCM message contains name of binary/bundle and a hash.  Rule count
+  // info for bundles will be sent out later with the rules themselves.  If the message is related
+  // to a bundle, the hash is a bundle hash, otherwise it is just a hash for a single binary.
+  // For later use, we store a mapping of bundle/binary hash to a dictionary containing the
+  // binary/bundle name so we can send out relevant notifications once the rules are actually
+  // downloaded & added to local database.  We use a dictionary value so that we can later add a
+  // count field when we start downloading the rules and receive the count information.
+  NSString *fileHash = message[kFCMFileHashKey];
+  NSString *fileName = message[kFCMFileNameKey];
  if (fileName && fileHash) {
-    [self.ruleSyncCache setObject:fileName forKey:fileHash];
+    [self.whitelistNotificationQueue addOperationWithBlock:^{
+      self.whitelistNotifications[fileHash] = @{ kFileName : fileName }.mutableCopy;
+    }];
  }

-  NSString *action = actionMessage[@"action"];
-  if (action) {
-    LOGD(@"Push notification action: %@ received", action);
-  } else {
-    LOGD(@"Push notification message contains no action");
-  }
+  LOGD(@"Push notification action: %@ received", action);

  if ([action isEqualToString:kFullSync]) {
    [self fullSync];
  } else if ([action isEqualToString:kRuleSync]) {
-    NSString *targetMachineID = actionMessage[@"target_host_id"];
-    if (![targetMachineID isKindOfClass:[NSNull class]] &&
-        [targetMachineID.lowercaseString isEqualToString:machineID.lowercaseString]) {
+    NSString *targetHostID = message[kFCMTargetHostIDKey];
+    if (targetHostID && [targetHostID caseInsensitiveCompare:machineID] == NSOrderedSame) {
+      LOGD(@"Targeted rule_sync for host_id: %@", targetHostID);
      self.targetedRuleSync = YES;
      [self ruleSync];
    } else {
-      uint32_t delaySeconds =
-          arc4random_uniform((u_int32_t)[SNTConfigurator configurator].FCMGlobalRuleLeeway);
-      LOGD(@"Staggering rule download, %u second delay for this machine", delaySeconds);
+      uint32_t delaySeconds = arc4random_uniform((uint32_t)self.FCMGlobalRuleSyncDeadline);
+      LOGD(@"Global rule_sync, staggering: %u second delay", delaySeconds);
      [self ruleSyncSecondsFromNow:delaySeconds];
    }
  } else if ([action isEqualToString:kConfigSync]) {
@@ -217,12 +268,33 @@ static void reachabilityHandler(
  }
 }

- (NSData *)extractMessageDataFrom:(NSDictionary *)FCMmessage {
+- (NSData *)messageDataFromFCMmessage:(NSDictionary *)FCMmessage {
  if (![FCMmessage[@"data"] isKindOfClass:[NSDictionary class]]) return nil;
  if (![FCMmessage[@"data"][@"blob"] isKindOfClass:[NSString class]]) return nil;
  return [FCMmessage[@"data"][@"blob"] dataUsingEncoding:NSUTF8StringEncoding];
 }

+- (NSDictionary *)messageFromMessageData:(NSData *)messageData {
+  NSError *error;
+  NSDictionary *rawMessage = [NSJSONSerialization JSONObjectWithData:messageData
+                                                             options:0
+                                                               error:&error];
+  if (!rawMessage) {
+    LOGD(@"Unable to parse push notification message data: %@", error);
+    return nil;
+  }
+
+  // Create a new message dropping unexpected values
+  NSArray *allowedKeys = @[ kFCMActionKey, kFCMFileHashKey, kFCMFileNameKey, kFCMTargetHostIDKey ];
+  NSMutableDictionary *message = [NSMutableDictionary dictionaryWithCapacity:allowedKeys.count];
+  for (NSString *key in allowedKeys) {
+    if ([rawMessage[key] isKindOfClass:[NSString class]] && [rawMessage[key] length]) {
+      message[key] = rawMessage[key];
+    }
+  }
+  return message.count ? [message copy] : nil;
+}
+
 #pragma mark sync timer control

 - (void)fullSync {
@@ -266,15 +338,18 @@ static void reachabilityHandler(
    // Clean up reachability if it was started for a non-network error
    [self stopReachability];

-    // Start listening for push notifications with a full sync every kFullSyncFCMInterval or
-    // revert to full syncing every kFullSyncInterval.
+    self.eventBatchSize = syncState.eventBatchSize;
+
+    // Start listening for push notifications with a full sync every FCMFullSyncInterval
    if (syncState.daemon && syncState.FCMToken) {
+      self.FCMFullSyncInterval = syncState.FCMFullSyncInterval;
+      self.FCMGlobalRuleSyncDeadline = syncState.FCMGlobalRuleSyncDeadline;
      [self listenForPushNotificationsWithSyncState:syncState];
    } else if (syncState.daemon) {
-      LOGD(@"FCMToken not provided. Sync every %llu min.", kFullSyncInterval / 60);
+      LOGD(@"FCMToken not provided. Sync every %lu min.", kDefaultFullSyncInterval / 60);
      [self.FCMClient disconnect];
      self.FCMClient = nil;
-      [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:kFullSyncInterval];
+      [self rescheduleTimerQueue:self.fullSyncTimer secondsFromNow:kDefaultFullSyncInterval];
    }

    if (syncState.uploadLogURL) {
@@ -373,8 +448,11 @@ static void reachabilityHandler(
    LOGW(@"Missing Machine Owner.");
  }

+  dispatch_group_t group = dispatch_group_create();
+  dispatch_group_enter(group);
  [[self.daemonConn remoteObjectProxy] xsrfToken:^(NSString *token) {
    syncState.xsrfToken = token;
+    dispatch_group_leave(group);
  }];

  MOLAuthenticatingURLSession *authURLSession = [[MOLAuthenticatingURLSession alloc] init];
@@ -405,11 +483,12 @@ static void reachabilityHandler(
  } else if ([config syncClientAuthCertificateIssuer]) {
    authURLSession.clientCertIssuerCn = [config syncClientAuthCertificateIssuer];
  }
-  
+
  syncState.session = [authURLSession session];
  syncState.daemonConn = self.daemonConn;
  syncState.daemon = self.daemon;
-  
+
+  dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC));
  return syncState;
 }

@@ -437,27 +516,31 @@ static void reachabilityHandler(

 // Start listening for network state changes on a background thread
 - (void)startReachability {
-  if (_reachability) return;
-  const char *nodename = [[SNTConfigurator configurator] syncBaseURL].host.UTF8String;
-  _reachability = SCNetworkReachabilityCreateWithName(kCFAllocatorDefault, nodename);
-  SCNetworkReachabilityContext context = {
-    .info = (__bridge void *)self
-  };
-  if (SCNetworkReachabilitySetCallback(_reachability, reachabilityHandler, &context)) {
-    SCNetworkReachabilitySetDispatchQueue(
-        _reachability, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0));
-  } else {
-    [self stopReachability];
-  }
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (_reachability) return;
+    const char *nodename = [[SNTConfigurator configurator] syncBaseURL].host.UTF8String;
+    _reachability = SCNetworkReachabilityCreateWithName(kCFAllocatorDefault, nodename);
+    SCNetworkReachabilityContext context = {
+      .info = (__bridge void *)self
+    };
+    if (SCNetworkReachabilitySetCallback(_reachability, reachabilityHandler, &context)) {
+      SCNetworkReachabilitySetDispatchQueue(_reachability,
+          dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0));
+    } else {
+      [self stopReachability];
+    }
+  });
 }

 // Stop listening for network state changes
 - (void)stopReachability {
-  if (_reachability) {
-    SCNetworkReachabilitySetDispatchQueue(_reachability, NULL);
-    if (_reachability) CFRelease(_reachability);
-    _reachability = NULL;
-  }
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if (_reachability) {
+      SCNetworkReachabilitySetDispatchQueue(_reachability, NULL);
+      if (_reachability) CFRelease(_reachability);
+      _reachability = NULL;
+    }
+  });
 }

@end
--- a/Source/santactl/Commands/sync/SNTCommandSyncPostflight.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncPostflight.m
@@ -29,7 +29,7 @@
 }

 - (BOOL)sync {
-  NSDictionary *r = [self performRequest:[self requestWithDictionary:nil]];
+  [self performRequest:[self requestWithDictionary:nil]];

  dispatch_group_t group = dispatch_group_create();
  void (^replyBlock)() = ^{
@@ -43,14 +43,6 @@
                                                 reply:replyBlock];
  }

-  // Update backoff interval
-  NSString *backoffInterval = r[kBackoffInterval];
-  if (backoffInterval) {
-    dispatch_group_enter(group);
-    [[self.daemonConn remoteObjectProxy] setNextSyncInterval:[backoffInterval intValue]
-                                                       reply:replyBlock];
-  }
-
  // Remove clean sync flag if we did a clean sync
  if (self.syncState.cleanSync) {
    dispatch_group_enter(group);
--- a/Source/santactl/Commands/sync/SNTCommandSyncPreflight.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncPreflight.m
@@ -74,9 +74,21 @@

  if (!resp) return NO;

+  dispatch_group_enter(group);
+  [[self.daemonConn remoteObjectProxy] setBundlesEnabled:[resp[kBundlesEnabled] boolValue] reply:^{
+    dispatch_group_leave(group);
+  }];
+
+  self.syncState.eventBatchSize = [resp[kBatchSize] unsignedIntegerValue] ?: kDefaultEventBatchSize;
  self.syncState.FCMToken = resp[kFCMToken];

-  self.syncState.eventBatchSize = [resp[kBatchSize] intValue] ?: 50;
+  // Don't let these go too low
+  NSUInteger value = [resp[kFCMFullSyncInterval] unsignedIntegerValue];
+  self.syncState.FCMFullSyncInterval =
+      (value < kDefaultFullSyncInterval) ? kDefaultFCMFullSyncInterval : value;
+  value = [resp[kFCMGlobalRuleSyncDeadline] unsignedIntegerValue];
+  self.syncState.FCMGlobalRuleSyncDeadline =
+      (value < 60) ?  kDefaultFCMGlobalRuleSyncDeadline : value;

  self.syncState.uploadLogURL = [NSURL URLWithString:resp[kUploadLogsURL]];

@@ -99,6 +111,7 @@
    self.syncState.cleanSync = YES;
  }

+  dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC));
  return YES;
 }

--- a/Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.m
@@ -30,30 +30,16 @@
 }

 - (BOOL)sync {
-  self.syncState.downloadedRules = [NSMutableArray array];
-  return [self ruleDownloadWithCursor:nil];
-}
-
- (BOOL)ruleDownloadWithCursor:(NSString *)cursor {
-  NSDictionary *requestDict = (cursor ? @{kCursor : cursor} : @{});
-
-  NSDictionary *resp = [self performRequest:[self requestWithDictionary:requestDict]];
-  if (!resp) return NO;
-
-  for (NSDictionary *rule in resp[kRules]) {
-    SNTRule *r = [self ruleFromDictionary:rule];
-    if (r) [self.syncState.downloadedRules addObject:r];
-  }
-
-  if (resp[kCursor]) {
-    return [self ruleDownloadWithCursor:resp[kCursor]];
-  }
-
-  if (!self.syncState.downloadedRules.count) return YES;
+  // Grab the new rules from server
+  NSArray<SNTRule *> *newRules = [self downloadNewRulesFromServer];
+  if (!newRules) return NO;         // encountered a problem with the download
+  if (!newRules.count) return YES;  // successfully completed request, but no new rules

+  // Tell santad to add the new rules to the database.
+  // Wait until finished or until 5 minutes pass.
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  __block NSError *error;
-  [[self.daemonConn remoteObjectProxy] databaseRuleAddRules:self.syncState.downloadedRules
+  [[self.daemonConn remoteObjectProxy] databaseRuleAddRules:newRules
                                                 cleanSlate:self.syncState.cleanSync
                                                      reply:^(NSError *e) {
    error = e;
@@ -67,29 +53,74 @@
    return NO;
  }

+  // Tell santad to record a successful rules sync and wait for it to finish.
  sema = dispatch_semaphore_create(0);
  [[self.daemonConn remoteObjectProxy] setRuleSyncLastSuccess:[NSDate date] reply:^{
    dispatch_semaphore_signal(sema);
  }];
  dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC));

-  LOGI(@"Added %lu rules", self.syncState.downloadedRules.count);
+  LOGI(@"Added %lu rules", newRules.count);

-  if (self.syncState.targetedRuleSync) {
-    for (SNTRule *r in self.syncState.downloadedRules) {
-      NSString *fileName = [[self.syncState.ruleSyncCache objectForKey:r.shasum] copy];
-      [self.syncState.ruleSyncCache removeObjectForKey:r.shasum];
-      if (fileName) {
-        NSString *message = [NSString stringWithFormat:@"%@ can now be run", fileName];
-        [[self.daemonConn remoteObjectProxy]
-            postRuleSyncNotificationWithCustomMessage:message reply:^{}];
-      }
-    }
-  }
+  // Send out push notifications about any newly whitelisted binaries
+  // that had been previously blocked by santad.
+  [self.syncState.whitelistNotificationQueue addOperationWithBlock:^{
+    [self announceUnblockingRules:newRules];
+  }];

  return YES;
 }

+// Downloads new rules from server and converts them into SNTRule.
+// Returns an array of all converted rules, or nil if there was a server problem.
+// Note that rules from the server are filtered.  We only keep those whose rule_type
+// is either BINARY or CERTIFICATE.  PACKAGE rules are dropped.
+- (NSArray<SNTRule *> *)downloadNewRulesFromServer {
+  NSMutableArray<SNTRule *> *newRules = [NSMutableArray array];
+  NSString *cursor = nil;
+  do {
+    NSDictionary *requestDict = cursor ? @{kCursor : cursor} : @{};
+    NSDictionary *response = [self performRequest:[self requestWithDictionary:requestDict]];
+    if (!response) return nil;
+    for (NSDictionary *ruleDict in response[kRules]) {
+      SNTRule *rule = [self ruleFromDictionary:ruleDict];
+      if (rule) [newRules addObject:rule];
+    }
+    cursor = response[kCursor];
+  } while (cursor);
+  return newRules;
+}
+
+// Send out push notifications for whitelisted bundles/binaries whose rule download was preceded by
+// an associated announcing FCM message.
+- (void)announceUnblockingRules:(NSArray<SNTRule *> *)newRules {
+  if (!self.syncState.targetedRuleSync) return;
+
+  NSMutableArray *processed = [NSMutableArray array];
+
+  for (NSString *key in self.syncState.whitelistNotifications) {
+    // Each notifier object is a dictionary with name and count keys. If the count has been
+    // decremented to zero, then this means that we have downloaded all of the rules associated with
+    // this SHA256 hash (which might be a bundle hash or a binary hash), in which case we are OK to
+    // show a notification that the named bundle/binary can be run.
+    NSDictionary *notifier = self.syncState.whitelistNotifications[key];
+    NSNumber *remaining = notifier[kFileBundleBinaryCount];
+    if (remaining && [remaining intValue] == 0) {
+      [processed addObject:key];
+      NSString *message = [NSString stringWithFormat:@"%@ can now be run", notifier[kFileName]];
+      [[self.daemonConn remoteObjectProxy]
+          postRuleSyncNotificationWithCustomMessage:message reply:^{}];
+    }
+  }
+
+  // Remove all entries from whitelistNotifications dictionary that had zero count.
+  [self.syncState.whitelistNotifications removeObjectsForKeys:processed];
+}
+
+
+// Converts rule information downloaded from the server into a SNTRule.  Because any information
+// not recorded by SNTRule is thrown away here, this method is also responsible for dealing with
+// the extra bundle rule information (bundle_hash & rule_count).
 - (SNTRule *)ruleFromDictionary:(NSDictionary *)dict {
  if (![dict isKindOfClass:[NSDictionary class]]) return nil;

@@ -124,6 +155,41 @@
    newRule.customMsg = customMsg;
  }

+  // Check rule for extra notification related info.
+  if (newRule.state == SNTRuleStateWhitelist) {
+    // primaryHash is the bundle hash if there was a bundle hash included in the rule, otherwise
+    // it is simply the binary hash.
+    NSString *primaryHash = dict[kFileBundleHash];
+    if (primaryHash.length != 64) {
+      primaryHash = newRule.shasum;
+    }
+
+    // As we read in rules, we update the "remaining count" information stored in
+    // whitelistNotifications. This count represents the number of rules associated with the primary
+    // hash that still need to be downloaded and added.
+    [self.syncState.whitelistNotificationQueue addOperationWithBlock:^{
+      NSMutableDictionary *notifier = self.syncState.whitelistNotifications[primaryHash];
+      if (notifier) {
+        NSNumber *ruleCount = dict[kFileBundleBinaryCount];
+        NSNumber *remaining = notifier[kFileBundleBinaryCount];
+        if (remaining) {  // bundle rule with existing count
+          // If the primary hash already has an associated count field, just decrement it.
+          notifier[kFileBundleBinaryCount] = @([remaining intValue] - 1);
+        } else if (ruleCount) {  // bundle rule seen for first time
+          // Downloaded rules including count information are associated with bundles.
+          // The first time we see a rule for a given bundle hash, add a count field with an
+          // initial value equal to the number of associated rules, then decrement this value by 1
+          // to account for the rule that we've just downloaded.
+          notifier[kFileBundleBinaryCount] = @([ruleCount intValue] - 1);
+        } else {  // non-bundle binary rule
+          // Downloaded rule had no count information, meaning it is a singleton non-bundle rule.
+          // Therefore there are no more rules associated with this hash to download.
+          notifier[kFileBundleBinaryCount] = @0;
+        }
+      }
+    }];
+  }
+
  return newRule;
 }

--- a/Source/santactl/Commands/sync/SNTCommandSyncStage.m
+++ b/Source/santactl/Commands/sync/SNTCommandSyncStage.m
@@ -77,6 +77,8 @@
  return req;
 }

+// Returns nil when there is a server connection issue.  For other errors, such as
+// an empty response or an unparseable response, an empty dictionary is returned.
 - (NSDictionary *)performRequest:(NSURLRequest *)request timeout:(NSTimeInterval)timeout {
  NSHTTPURLResponse *response;
  NSError *error;
--- a/Source/santactl/Commands/sync/SNTCommandSyncState.h
+++ b/Source/santactl/Commands/sync/SNTCommandSyncState.h
@@ -16,6 +16,7 @@

 #import "SNTCommonEnums.h"

+@class SNTCommandSyncManager;
@class SNTXPCConnection;

 /// An instance of this class is passed to each stage of the sync process for storing data
@@ -34,9 +35,15 @@
 /// An XSRF token to send in the headers with each request.
@property NSString *xsrfToken;

-/// A FCM token to subscribe to push notifications.
+/// An FCM token to subscribe to push notifications.
@property(copy) NSString *FCMToken;

+/// Full sync interval in seconds while listening for FCM messages.
+@property NSUInteger FCMFullSyncInterval;
+
+/// Leeway time in seconds when receiving a global rule sync message.
+@property NSUInteger FCMGlobalRuleSyncDeadline;
+
 /// Machine identifier and owner.
@property(copy) NSString *machineID;
@property(copy) NSString *machineOwner;
@@ -55,12 +62,9 @@
 /// Log upload URL sent from server. If set, LogUpload phase needs to happen.
@property NSURL *uploadLogURL;

-/// Array of bundle paths to find binaries for.
+/// Array of bundle IDs to find binaries for.
@property NSArray *bundleBinaryRequests;

-/// Rules downloaded from server.
-@property NSMutableArray *downloadedRules;
-
 /// Returns YES if the santactl session is running as a daemon, returns NO otherwise.
@property BOOL daemon;

@@ -68,6 +72,9 @@
@property BOOL targetedRuleSync;

 /// Reference to the sync manager's ruleSyncCache. Used to lookup binary names for notifications.
-@property(weak) NSCache *ruleSyncCache;
+@property(weak) NSMutableDictionary *whitelistNotifications;
+
+/// Reference to the serial operation queue used for accessing whitelistNotifications.
+@property(weak) NSOperationQueue *whitelistNotificationQueue;

@end
--- a/Source/santactl/SNTCommand.h
+++ b/Source/santactl/SNTCommand.h
@@ -0,0 +1,68 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Foundation;
+
+@class SNTXPCConnection;
+
+@protocol SNTCommandProtocol
+
+///
+///  @return YES if command requires root.
+///
+ (BOOL)requiresRoot;
+
+///
+///  @return YES if command requires connection to santad.
+///
+ (BOOL)requiresDaemonConn;
+
+///
+///  A small summary of the command, to be printed with the list of available commands
+///
+ (NSString *)shortHelpText;
+
+///
+///  A longer description of the command when the user runs <tt>santactl help x</tt>
+///
+ (NSString *)longHelpText;
+
+@end
+
+@protocol SNTCommandRunProtocol
+
+///
+///  Called when the user is running the command
+///  @param arguments an array of arguments passed in
+///  @param daemonConn connection to santad. Will be nil if connection failed or
+///      if @c requiresDaemonConn is @c NO
+///
+///  @note This method (or one of the methods it calls) is responsible for calling exit().
+///
+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn;
+
+@end
+
+@interface SNTCommand : NSObject<SNTCommandRunProtocol>
+
+@property(nonatomic,readonly) SNTXPCConnection *daemonConn;
+
+///  Designated initializer
+- (instancetype)initWithDaemonConnection:(SNTXPCConnection *)daemonConn;
+
+- (void)runWithArguments:(NSArray *)arguments;
+
+- (void)printErrorUsageAndExit:(NSString *)error;
+@end
+
--- a/Source/santactl/SNTCommand.m
+++ b/Source/santactl/SNTCommand.m
@@ -0,0 +1,43 @@
+/// Copyright 2017 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommand.h"
+
+@implementation SNTCommand
+
+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
+  id cmd = [[self alloc] initWithDaemonConnection:daemonConn];
+  [cmd runWithArguments:arguments];
+}
+
+- (instancetype)initWithDaemonConnection:(SNTXPCConnection *)daemonConn {
+  self = [super init];
+  if (self) {
+    _daemonConn = daemonConn;
+  }
+  return self;
+}
+
+- (void)runWithArguments:(NSArray *)arguments {
+  // This method must be overridden.
+  [self doesNotRecognizeSelector:_cmd];
+}
+
+- (void)printErrorUsageAndExit:(NSString *)error {
+  fprintf(stderr, "%s\n\n", [error UTF8String]);
+  fprintf(stderr, "%s\n", [[[self class] longHelpText] UTF8String]);
+  exit(1);
+}
+
+@end
--- a/Source/santactl/SNTCommandController.h
+++ b/Source/santactl/SNTCommandController.h
@@ -14,44 +14,10 @@

@import Foundation;

+#import "SNTCommand.h"
+
@class SNTXPCConnection;

-///
-///  Protocol that each command must adhere to.
-///
-@protocol SNTCommand<NSObject>
-
-///
-///  @return YES if command requires root.
-///
-+ (BOOL)requiresRoot;
-
-///
-///  @return YES if command requires connection to santad.
-///
-+ (BOOL)requiresDaemonConn;
-
-///
-///  A small summary of the command, to be printed with the list of available commands
-///
-+ (NSString *)shortHelpText;
-
-///
-///  A longer description of the command when the user runs <tt>santactl help x</tt>
-///
-+ (NSString *)longHelpText;
-
-///
-///  Called when the user is running the command
-///  @param arguments an array of arguments passed in
-///  @param daemonConn connection to santad. Will be nil if connection failed or
-///      if @c requiresDaemonConn is @c NO
-///
-///  @note This method (or one of the methods it calls) is responsible for calling exit().
-///
-+ (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn;
-@end
-
 ///
 ///  Responsible for maintaining the list of available commands by name, printing their help text
 ///  when requested and launching them when requested. All of the methods in this class are
@@ -64,7 +30,7 @@
 ///  Register a new command with the specified name. Do not use this directly, use the
 ///  @c REGISTER_COMMAND_NAME macro instead.
 ///
-+ (void)registerCommand:(Class<SNTCommand>)command named:(NSString *)name;
+ (void)registerCommand:(Class<SNTCommandProtocol>)command named:(NSString *)name;

 ///
 ///  @return a usage string listing all of the available commands
--- a/Source/santactl/SNTCommandController.m
+++ b/Source/santactl/SNTCommandController.m
@@ -24,7 +24,8 @@
 /// Value is the Class
 static NSMutableDictionary *registeredCommands;

-+ (void)registerCommand:(Class<SNTCommand>)command named:(NSString *)name {
+ (void)registerCommand:(Class<SNTCommandProtocol, SNTCommandRunProtocol>)command
+                  named:(NSString *)name {
  if (!registeredCommands) {
    registeredCommands = [NSMutableDictionary dictionary];
  }
@@ -43,9 +44,9 @@ static NSMutableDictionary *registeredCommands;

  for (NSString *cmdName in
       [[registeredCommands allKeys] sortedArrayUsingSelector:@selector(caseInsensitiveCompare:)]) {
-    Class<SNTCommand> cmd = registeredCommands[cmdName];
+    Class<SNTCommandProtocol> command = registeredCommands[cmdName];
    [helpText appendFormat:@"\t%*s - %@\n", longestCommandName,
-                           [cmdName UTF8String], [cmd shortHelpText]];
+                           [cmdName UTF8String], [command shortHelpText]];
  }

  [helpText appendFormat:@"\nSee 'santactl help <command>' to read about a specific subcommand."];
@@ -53,7 +54,7 @@ static NSMutableDictionary *registeredCommands;
 }

 + (NSString *)helpForCommandWithName:(NSString *)commandName {
-  Class<SNTCommand> command = registeredCommands[commandName];
+  Class<SNTCommandProtocol> command = registeredCommands[commandName];
  if (command) {
    NSString *shortHelp = [command shortHelpText];
    NSString *longHelp = [command longHelpText];
@@ -86,7 +87,7 @@ static NSMutableDictionary *registeredCommands;
 }

 + (void)runCommandWithName:(NSString *)commandName arguments:(NSArray *)arguments {
-  Class<SNTCommand> command = registeredCommands[commandName];
+  Class<SNTCommandProtocol, SNTCommandRunProtocol> command = registeredCommands[commandName];

  if ([command requiresRoot] && getuid() != 0) {
    printf("The command '%s' requires root privileges.\n", [commandName UTF8String]);
--- a/Source/santad/DataLayer/SNTEventTable.h
+++ b/Source/santad/DataLayer/SNTEventTable.h
@@ -32,6 +32,14 @@
 ///
 - (BOOL)addStoredEvent:(SNTStoredEvent *)event;

+///
+///  Add events to the database.
+///
+///  @param events the events to store.
+///  @return YES if events were successfully stored.
+///
+- (BOOL)addStoredEvents:(NSArray<SNTStoredEvent *> *)events;
+
 ///
 ///  Retrieves all events in the database
 ///
--- a/Source/santad/DataLayer/SNTEventTable.m
+++ b/Source/santad/DataLayer/SNTEventTable.m
@@ -83,24 +83,37 @@
 #pragma mark Loading / Storing

 - (BOOL)addStoredEvent:(SNTStoredEvent *)event {
-  if (!event.idx ||
-      !event.fileSHA256 ||
-      !event.filePath ||
-      !event.occurrenceDate ||
-      !event.decision) return NO;
+  return [self addStoredEvents:@[event]];
+}

-  NSData *eventData;
-  @try {
-    eventData = [NSKeyedArchiver archivedDataWithRootObject:event];
-  } @catch (NSException *exception) {
-    return NO;
+- (BOOL)addStoredEvents:(NSArray<SNTStoredEvent *> *)events {
+  NSMutableDictionary *eventsData = [NSMutableDictionary dictionaryWithCapacity:events.count];
+  for (SNTStoredEvent *event in events) {
+    if (!event.idx ||
+        !event.fileSHA256 ||
+        !event.filePath ||
+        !event.occurrenceDate ||
+        !event.decision) continue;
+
+    NSData *eventData;
+    @try {
+      eventData = [NSKeyedArchiver archivedDataWithRootObject:event];
+    } @catch (NSException *exception) {
+      continue;
+    }
+    eventsData[eventData] = event;
  }

  __block BOOL success = NO;
  [self inTransaction:^(FMDatabase *db, BOOL *rollback) {
-    success = [db executeUpdate:@"INSERT INTO 'events' (idx, filesha256, eventdata)"
-                                @"VALUES (?, ?, ?)",
-                                event.idx, event.fileSHA256, eventData];
+    [eventsData enumerateKeysAndObjectsUsingBlock:^(NSData * eventData,
+                                                    SNTStoredEvent * event,
+                                                    BOOL *stop) {
+      success = [db executeUpdate:@"INSERT INTO 'events' (idx, filesha256, eventdata)"
+                    @"VALUES (?, ?, ?)",
+                    event.idx, event.fileSHA256, eventData];
+      if (!success) *stop = YES;
+    }];
  }];

  return success;
--- a/Source/santad/SNTApplication.m
+++ b/Source/santad/SNTApplication.m
@@ -115,7 +115,7 @@
          origMode = newMode;
          if (newMode == SNTClientModeLockdown) {
            LOGI(@"Changed client mode, flushing cache.");
-            [self.driverManager flushCache];
+            [self.driverManager flushCacheNonRootOnly:NO];
          }
        }

@@ -253,20 +253,26 @@
 void diskAppearedCallback(DADiskRef disk, void *context) {
  SNTApplication *app = (__bridge SNTApplication *)context;
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  if (![props[@"DAVolumeMountable"] boolValue]) return;
+
  [app.eventLog logDiskAppeared:props];
 }

 void diskDescriptionChangedCallback(DADiskRef disk, CFArrayRef keys, void *context) {
  SNTApplication *app = (__bridge SNTApplication *)context;
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  if (![props[@"DAVolumeMountable"] boolValue]) return;
+
  if (props[@"DAVolumePath"]) [app.eventLog logDiskAppeared:props];
 }

 void diskDisappearedCallback(DADiskRef disk, void *context) {
  SNTApplication *app = (__bridge SNTApplication *)context;
  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  if (![props[@"DAVolumeMountable"] boolValue]) return;
+
  [app.eventLog logDiskDisappeared:props];
+  [app.driverManager flushCacheNonRootOnly:YES];
 }

-
@end
--- a/Source/santad/SNTDaemonControlController.m
+++ b/Source/santad/SNTDaemonControlController.m
@@ -15,6 +15,7 @@
 #import "SNTDaemonControlController.h"

 #import "SNTCachedDecision.h"
+#import "SNTCommonEnums.h"
 #import "SNTConfigurator.h"
 #import "SNTDatabaseController.h"
 #import "SNTDriverManager.h"
@@ -24,7 +25,10 @@
 #import "SNTPolicyProcessor.h"
 #import "SNTRule.h"
 #import "SNTRuleTable.h"
+#import "SNTStoredEvent.h"
+#import "SNTStrengthify.h"
 #import "SNTSyncdQueue.h"
+#import "SNTXPCBundleServiceInterface.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCNotifierInterface.h"
 #import "SNTXPCSyncdInterface.h"
@@ -53,13 +57,13 @@ double watchdogRAMPeak = 0;

 #pragma mark Kernel ops

- (void)cacheCount:(void (^)(int64_t))reply {
-  int64_t count = [self.driverManager cacheCount];
-  reply(count);
+- (void)cacheCounts:(void (^)(uint64_t, uint64_t))reply {
+  NSArray<NSNumber *> *counts = [self.driverManager cacheCounts];
+  reply([counts[0] unsignedLongLongValue], [counts[1] unsignedLongLongValue]);
 }

 - (void)flushCache:(void (^)(BOOL))reply {
-  reply([self.driverManager flushCache]);
+  reply([self.driverManager flushCacheNonRootOnly:NO]);
 }

 - (void)checkCacheForVnodeID:(uint64_t)vnodeID withReply:(void (^)(santa_action_t))reply {
@@ -83,7 +87,7 @@ double watchdogRAMPeak = 0;
  NSPredicate *p = [NSPredicate predicateWithFormat:@"SELF.state != %d", SNTRuleStateWhitelist];
  if ([rules filteredArrayUsingPredicate:p].count || cleanSlate) {
    LOGI(@"Received non-whitelist rule, flushing cache");
-    [self.driverManager flushCache];
+    [self.driverManager flushCacheNonRootOnly:NO];
  }

  reply(error);
@@ -112,15 +116,19 @@ double watchdogRAMPeak = 0;

 - (void)decisionForFilePath:(NSString *)filePath
                 fileSHA256:(NSString *)fileSHA256
-         signingCertificate:(MOLCertificate *)signingCertificate
+          certificateSHA256:(NSString *)certificateSHA256
                      reply:(void (^)(SNTEventState))reply {
  reply([self.policyProcessor decisionForFilePath:filePath
                                       fileSHA256:fileSHA256
-                               signingCertificate:signingCertificate].decision);
+                                certificateSHA256:certificateSHA256].decision);
 }

 #pragma mark Config Ops

+- (void)watchdogInfo:(void (^)(uint64_t, uint64_t, double, double))reply {
+  reply(watchdogCPUEvents, watchdogRAMEvents, watchdogCPUPeak, watchdogRAMPeak);
+}
+
 - (void)clientMode:(void (^)(SNTClientMode))reply {
  reply([[SNTConfigurator configurator] clientMode]);
 }
@@ -163,7 +171,7 @@ double watchdogRAMPeak = 0;
                                                                        error:NULL];
  [[SNTConfigurator configurator] setWhitelistPathRegex:re];
  LOGI(@"Received new whitelist regex, flushing cache");
-  [self.driverManager flushCache];
+  [self.driverManager flushCacheNonRootOnly:NO];
  reply();
 }

@@ -173,12 +181,17 @@ double watchdogRAMPeak = 0;
                                                                        error:NULL];
  [[SNTConfigurator configurator] setBlacklistPathRegex:re];
  LOGI(@"Received new blacklist regex, flushing cache");
-  [self.driverManager flushCache];  
+  [self.driverManager flushCacheNonRootOnly:NO];
  reply();
 }

- (void)watchdogInfo:(void (^)(uint64_t, uint64_t, double, double))reply {
-  reply(watchdogCPUEvents, watchdogRAMEvents, watchdogCPUPeak, watchdogRAMPeak);
+- (void)bundlesEnabled:(void (^)(BOOL))reply {
+  reply([SNTConfigurator configurator].bundlesEnabled);
+}
+
+- (void)setBundlesEnabled:(BOOL)bundlesEnabled reply:(void (^)())reply {
+  [[SNTConfigurator configurator] setBundlesEnabled:bundlesEnabled];
+  reply();
 }

 #pragma mark GUI Ops
@@ -190,6 +203,13 @@ double watchdogRAMPeak = 0;
  self.notQueue.notifierConnection = c;
 }

+- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener {
+  SNTXPCConnection *bs = [[SNTXPCConnection alloc] initClientWithServiceName:@"com.google.santabs"];
+  bs.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  [bs resume];
+  [[bs remoteObjectProxy] setBundleNotificationListener:listener];
+}
+
 #pragma mark syncd Ops

 - (void)setSyncdListener:(NSXPCListenerEndpoint *)listener {
@@ -209,12 +229,6 @@ double watchdogRAMPeak = 0;
  self.syncdQueue.syncdConnection = c;
 }

- (void)setNextSyncInterval:(uint64_t)seconds reply:(void (^)())reply {
-  [[self.syncdQueue.syncdConnection remoteObjectProxy] rescheduleSyncSecondsFromNow:seconds];
-  [[SNTConfigurator configurator] setSyncBackOff:YES];
-  reply();
-}
-
 - (void)pushNotifications:(void (^)(BOOL))reply {
  [self.syncdQueue.syncdConnection.remoteObjectProxy isFCMListening:^(BOOL response) {
    reply(response);
@@ -227,4 +241,64 @@ double watchdogRAMPeak = 0;
  reply();
 }

+#pragma mark Bundle ops
+
+///
+///  This method is only used for santactl's bundleinfo command. For blocked executions, SantaGUI
+///  calls on santabs directly.
+///
+///  Hash a bundle for an event. The SNTBundleHashBlock will be called with nil parameters if a
+///  failure or cancellation occurs.
+///
+///  @param event The event that includes the fileBundlePath to be hashed.
+///  @param reply A SNTBundleHashBlock to be executed upon completion or cancellation.
+///
+///  @note If there is a current NSProgress when called this method will report back it's progress.
+///
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event
+                             reply:(SNTBundleHashBlock)reply {
+  SNTXPCConnection *bs =
+      [[SNTXPCConnection alloc] initClientWithServiceName:[SNTXPCBundleServiceInterface serviceId]];
+  bs.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
+  [bs resume];
+  [[bs remoteObjectProxy] hashBundleBinariesForEvent:event reply:reply];
+}
+
+///
+///  Used by SantaGUI sync the offending event and potentially all the related events,
+///  if the sync server has not seen them before.
+///
+///  @param event The offending event, fileBundleHash & fileBundleBinaryCount need to be populated.
+///  @param relatedEvents Nexted bundle events.
+///
+- (void)syncBundleEvent:(SNTStoredEvent *)event
+          relatedEvents:(NSArray<SNTStoredEvent *> *)events {
+  SNTEventTable *eventTable = [SNTDatabaseController eventTable];
+
+  // Delete the event cached by the execution controller.
+  [eventTable deleteEventWithId:event.idx];
+
+  // Add the updated event.
+  [eventTable addStoredEvent:event];
+
+  WEAKIFY(self);
+
+  // Sync the updated event. If the sync server needs the related events, add them to the eventTable
+  // and upload them too.
+  [self.syncdQueue addBundleEvent:event reply:^(SNTBundleEventAction action) {
+    STRONGIFY(self);
+    switch(action) {
+      case SNTBundleEventActionDropEvents:
+        break;
+      case SNTBundleEventActionStoreEvents:
+        [eventTable addStoredEvents:events];
+        break;
+      case SNTBundleEventActionSendEvents:
+        [eventTable addStoredEvents:events];
+        [self.syncdQueue addEvents:events isFromBundle:YES];
+        break;
+    }
+  }];
+}
+
@end
--- a/Source/santad/SNTDriverManager.h
+++ b/Source/santad/SNTDriverManager.h
@@ -48,18 +48,18 @@
 - (kern_return_t)postToKernelAction:(santa_action_t)action forVnodeID:(uint64_t)vnodeId;

 ///
-///  Get the number of binaries in the kernel's cache.
+///  Get the number of binaries in the kernel's caches.
 ///
- (uint64_t)cacheCount;
+- (NSArray<NSNumber *> *)cacheCounts;

 ///
 ///  Flush the kernel's binary cache.
 ///
- (BOOL)flushCache;
+- (BOOL)flushCacheNonRootOnly:(BOOL)nonRootOnly;

 ///
 ///  Check the kernel cache for a VnodeID
 ///
-(santa_action_t)checkCache:(uint64_t)vnodeID;
+- (santa_action_t)checkCache:(uint64_t)vnodeID;

@end
--- a/Source/santad/SNTDriverManager.m
+++ b/Source/santad/SNTDriverManager.m
@@ -167,22 +167,28 @@ static const int MAX_DELAY = 15;
  }
 }

- (uint64_t)cacheCount {
-  uint32_t input_count = 1;
-  uint64_t cache_count = 0;
+- (NSArray<NSNumber *> *)cacheCounts {
+  uint32_t input_count = 2;
+  uint64_t cache_counts[2] = {0, 0};

  IOConnectCallScalarMethod(_connection,
                            kSantaUserClientCacheCount,
                            0,
                            0,
-                            &cache_count,
+                            cache_counts,
                            &input_count);
-  return cache_count;
+
+  return @[ @(cache_counts[0]), @(cache_counts[1]) ];
 }

- (BOOL)flushCache {
+- (BOOL)flushCacheNonRootOnly:(BOOL)nonRootOnly {
+  const uint64_t nonRoot = nonRootOnly;
  return IOConnectCallScalarMethod(_connection,
-                                   kSantaUserClientClearCache, 0, 0, 0, 0) == KERN_SUCCESS;
+                                   kSantaUserClientClearCache,
+                                   &nonRoot,
+                                   1,
+                                   0,
+                                   0) == KERN_SUCCESS;
 }

 - (santa_action_t)checkCache:(uint64_t)vnodeID {
--- a/Source/santad/SNTEventLog.m
+++ b/Source/santad/SNTEventLog.m
@@ -14,6 +14,7 @@

 #import "SNTEventLog.h"

+#include <dlfcn.h>
 #include <grp.h>
 #include <libproc.h>
 #include <pwd.h>
@@ -34,6 +35,8 @@
 // Caches for uid->username and gid->groupname lookups.
@property NSCache<NSNumber *, NSString *> *userNameMap;
@property NSCache<NSNumber *, NSString *> *groupNameMap;
+
+@property NSDateFormatter *dateFormatter;
@end

@implementation SNTEventLog
@@ -49,6 +52,10 @@
    _userNameMap.countLimit = 100;
    _groupNameMap = [[NSCache alloc] init];
    _groupNameMap.countLimit = 100;
+
+    _dateFormatter = [[NSDateFormatter alloc] init];
+    _dateFormatter.dateFormat = @"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";
+    _dateFormatter.timeZone = [NSTimeZone timeZoneWithName:@"UTC"];
  }
  return self;
 }
@@ -175,11 +182,7 @@
    [outLog appendFormat:@"|explain=%@", cd.decisionExtra];
  }

-  [outLog appendFormat:@"|sha256=%@|path=%@", cd.sha256, [self sanitizeString:@(message.path)]];
-
-  if (logArgs) {
-    [self addArgsForPid:message.pid toString:outLog];
-  }
+  [outLog appendFormat:@"|sha256=%@", cd.sha256];

  if (cd.certSHA256) {
    [outLog appendFormat:@"|cert_sha256=%@|cert_cn=%@", cd.certSHA256,
@@ -200,18 +203,26 @@
      mode = @"U"; break;
  }

-  [outLog appendFormat:@"|pid=%d|ppid=%d|uid=%d|user=%@|gid=%d|group=%@|mode=%@",
+  [outLog appendFormat:@"|pid=%d|ppid=%d|uid=%d|user=%@|gid=%d|group=%@|mode=%@|path=%@",
                       message.pid, message.ppid,
                       message.uid, [self nameForUID:message.uid],
                       message.gid, [self nameForGID:message.gid],
-                       mode];
+                       mode, [self sanitizeString:@(message.path)]];
+
+  // Check for app translocation by GateKeeper, and log original path if the case.
+  NSString *originalPath = [self originalPathForTranslocation:message];
+  if (originalPath) {
+    [outLog appendFormat:@"|origpath=%@", [self sanitizeString:originalPath]];
+  }
+
+  if (logArgs) {
+    [self addArgsForPid:message.pid toString:outLog];
+  }

  LOGI(@"%@", outLog);
 }

 - (void)logDiskAppeared:(NSDictionary *)diskProperties {
-  if (![diskProperties[@"DAVolumeMountable"] boolValue]) return;
-
  NSString *dmgPath = @"";
  NSString *serial = @"";
  if ([diskProperties[@"DADeviceModel"] isEqual:@"Disk Image"]) {
@@ -226,7 +237,14 @@
                        diskProperties[@"DADeviceModel"] ?: @""];
  model = [model stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];

-  LOGI(@"action=DISKAPPEAR|mount=%@|volume=%@|bsdname=%@|fs=%@|model=%@|serial=%@|bus=%@|dmgpath=%@",
+  double appearance = [diskProperties[@"DAAppearanceTime"] doubleValue];
+  NSString *appearanceDateString =
+      [_dateFormatter stringFromDate:[NSDate dateWithTimeIntervalSinceReferenceDate:appearance]];
+
+  NSString *log =
+      @"action=DISKAPPEAR|mount=%@|volume=%@|bsdname=%@|fs=%@|"
+      @"model=%@|serial=%@|bus=%@|dmgpath=%@|appearance=%@";
+  LOGI(log,
       [diskProperties[@"DAVolumePath"] path] ?: @"",
       diskProperties[@"DAVolumeName"] ?: @"",
       diskProperties[@"DAMediaBSDName"] ?: @"",
@@ -234,12 +252,11 @@
       model ?: @"",
       serial,
       diskProperties[@"DADeviceProtocol"] ?: @"",
-       dmgPath);
+       dmgPath,
+       appearanceDateString);
 }

 - (void)logDiskDisappeared:(NSDictionary *)diskProperties {
-  if (![diskProperties[@"DAVolumeMountable"] boolValue]) return;
-
  LOGI(@"action=DISKDISAPPEAR|mount=%@|volume=%@|bsdname=%@",
       [diskProperties[@"DAVolumePath"] path] ?: @"",
       diskProperties[@"DAVolumeName"] ?: @"",
@@ -487,4 +504,49 @@
  return serial;
 }

+/**
+ Uses the executable path, uid, and gid from a given santa_message_t to determine if the path
+ has been translocated by GateKeeper and if so, returns the original path of the executable.  This
+ requires macOS 10.12 or higher.  We use dlopen to access the functions we need in
+ Security.framework so that we can still build against the 10.11 SDK.  If the path has not been
+ translocated or if running on macOS prior to 10.12, this method returns nil.
+ */
+- (NSString *)originalPathForTranslocation:(santa_message_t)message {
+  // The first time this function is called, we attempt to find the addresses of
+  // SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL inside of the
+  // Security.framework library.  If we were successful, handle will be non-NULL and is never
+  // closed.
+  static Boolean (*IsTranslocatedURL)(CFURLRef, bool *, CFErrorRef *) = NULL;
+  static CFURLRef __nullable (*CreateOriginalPathForURL)(CFURLRef, CFErrorRef *) = NULL;
+  static dispatch_once_t token;
+  dispatch_once(&token, ^{
+    void *handle = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_LAZY);
+    if (handle) {
+      IsTranslocatedURL = dlsym(handle, "SecTranslocateIsTranslocatedURL");
+      CreateOriginalPathForURL = dlsym(handle, "SecTranslocateCreateOriginalPathForURL");
+      if (!IsTranslocatedURL || !CreateOriginalPathForURL) {
+        IsTranslocatedURL = NULL;
+        CreateOriginalPathForURL = NULL;
+        dlclose(handle);
+      }
+    }
+  });
+
+  // If we couldn't open the library or find the functions we need, don't do anything.
+  if (!IsTranslocatedURL || !CreateOriginalPathForURL) return nil;
+
+  // Determine if the executable URL has been translocated or not.
+  CFURLRef cfExecURL = (__bridge CFURLRef)[NSURL fileURLWithPath:@(message.path)];
+  bool isTranslocated = false;
+  if (!IsTranslocatedURL(cfExecURL, &isTranslocated, NULL) || !isTranslocated) return nil;
+
+  // SecTranslocateCreateOriginalPathForURL requires that our uid be the same as the user who
+  // launched the executable.  So we temporarily drop from root down to this uid, then reset.
+  pthread_setugid_np(message.uid, message.gid);
+  NSURL *origURL = CFBridgingRelease(CreateOriginalPathForURL(cfExecURL, NULL));
+  pthread_setugid_np(KAUTH_UID_NONE, KAUTH_GID_NONE);
+
+  return [origURL path];  // this will be nil if there was an error
+}
+
@end
--- a/Source/santad/SNTExecutionController.m
+++ b/Source/santad/SNTExecutionController.m
@@ -106,16 +106,14 @@
  NSError *csError;
  MOLCodesignChecker *csInfo = [[MOLCodesignChecker alloc] initWithBinaryPath:binInfo.path
                                                                        error:&csError];
-  // We specifically ignore CSInfoPlistFailed (-67030) as it sometimes appears spuriously
-  // when trying to validate a binary separately from its bundle.
-  if (csError && csError.code != errSecCSInfoPlistFailed) {
-    csInfo = nil;
-  }
+  // Ignore codesigning if there are any errors with the signature. 
+  if (csError) csInfo = nil;

  // Actually make the decision.
  SNTCachedDecision *cd = [self.policyProcessor decisionForFileInfo:binInfo
                                                         fileSHA256:nil
-                                                 signingCertificate:csInfo.leafCertificate];
+                                                  certificateSHA256:csInfo.leafCertificate.SHA256];
+  cd.certCommonName = csInfo.leafCertificate.commonName;
  cd.vnodeId = message.vnode_id;

  // Formulate an action from the decision
@@ -176,11 +174,19 @@
    if (action != ACTION_RESPOND_ALLOW) {
      [_eventLog logDeniedExecution:cd withMessage:message];

-      // So the server has something to show the user straight away, initiate an event
-      // upload for the blocked binary rather than waiting for the next sync.
-      dispatch_async(_eventQueue, ^{
-        [self initiateEventUploadForEvent:se];
-      });
+      if ([[SNTConfigurator configurator] bundlesEnabled] && binInfo.bundle) {
+        // If the binary is part of a bundle, find and hash all the related binaries in the bundle.
+        // Let the GUI know hashing is needed. Once the hashing is complete the GUI will send a
+        // message to santad to perform the upload logic for bundles.
+        // See syncBundleEvent:relatedEvents: for more info.
+        se.needsBundleHash = YES;
+      } else if ([[SNTConfigurator configurator] syncBaseURL]) {
+        // So the server has something to show the user straight away, initiate an event
+        // upload for the blocked binary rather than waiting for the next sync.
+        dispatch_async(_eventQueue, ^{
+          [_syncdQueue addEvents:@[se] isFromBundle:NO];
+        });
+      }

      if (!cd.silentBlock) {
        // Let the user know what happened, both on the terminal and in the GUI.
@@ -245,24 +251,6 @@
  return NO;
 }

-/**
-  This sends the event that was just saved to santactl for immediate upload, so that the user
-  has something to vote in straight away.
-
-  This method is always called on a serial queue to keep this low-priority method 
-  away from the high-priority decision making threads.
-*/
- (void)initiateEventUploadForEvent:(SNTStoredEvent *)event {
-  // The event upload is skipped if the full path is equal to that of santactl so that
-  // on the off chance that santactl is not whitelisted, we don't get into an infinite loop.
-  // It's also skipped if there isn't a server configured or the last sync caused a backoff.
-  if ([event.filePath isEqual:@(kSantaCtlPath)] ||
-      ![[SNTConfigurator configurator] syncBaseURL] ||
-      [[SNTConfigurator configurator] syncBackOff]) return;
-
-  [self.syncdQueue addEvent:event];
-}
-
 - (void)printMessage:(NSString *)msg toTTYForPID:(pid_t)pid {
  if (pid < 2) return;  // don't bother even looking for launchd.

--- a/Source/santad/SNTPolicyProcessor.h
+++ b/Source/santad/SNTPolicyProcessor.h
@@ -39,22 +39,24 @@
 ///  @param fileInfo A SNTFileInfo object.
 ///  @param fileSHA256 The pre-calculated SHA256 hash for the file, can be nil. If nil the hash will
 ///                    be calculated by this method from the filePath.
-///  @param signingCertificate A MOLCertificate object, can be nil.
-///  @note If fileInfo and signingCertificate are both passed in, the most specific rule will be
+///  @param certificateSHA256 A SHA256 hash of the signing certificate, can be nil.
+///  @note If fileSHA256 and certificateSHA256 are both passed in, the most specific rule will be
 ///        returned. Binary rules take precedence over cert rules.
+///  @note This method can also be used to generate a SNTCachedDecision object without any
+///        artifacts on disk. Simply pass nil to fileInfo and pass in the desired SHA256s.
 ///
- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
+- (nonnull SNTCachedDecision *)decisionForFileInfo:(nullable SNTFileInfo *)fileInfo
                                        fileSHA256:(nullable NSString *)fileSHA256
-                                signingCertificate:(nullable MOLCertificate *)signingCertificate;
+                                 certificateSHA256:(nullable NSString *)certificateSHA256;

 ///
-///  A wrapper for decisionForFileInfo:fileSHA256:signingCertificate:. This method is slower as it
+///  A wrapper for decisionForFileInfo:fileSHA256:certificateSHA256:. This method is slower as it
 ///  has to create the SNTFileInfo object. This is mainly used by the santactl binary because
 ///  SNTFileInfo is not SecureCoding compliant. If the SHA256 hash of the file has already been
 ///  calculated, use the fileSHA256 parameter to save a second calculation of the hash.
 ///
- (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
+- (nonnull SNTCachedDecision *)decisionForFilePath:(nullable NSString *)filePath
                                        fileSHA256:(nullable NSString *)fileSHA256
-                                signingCertificate:(nullable MOLCertificate *)signingCertificate;
+                                 certificateSHA256:(nullable NSString *)certificateSHA256;

@end
--- a/Source/santad/SNTPolicyProcessor.m
+++ b/Source/santad/SNTPolicyProcessor.m
@@ -38,14 +38,11 @@

 - (SNTCachedDecision *)decisionForFileInfo:(SNTFileInfo *)fileInfo
                                fileSHA256:(NSString *)fileSHA256
-                        signingCertificate:(MOLCertificate *)signingCertificate {
+                         certificateSHA256:(NSString *)certificateSHA256 {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.sha256 = fileSHA256 ?: fileInfo.SHA256;
+  cd.certSHA256 = certificateSHA256;
  cd.quarantineURL = fileInfo.quarantineDataURL;
-  if (signingCertificate) {
-    cd.certCommonName = signingCertificate.commonName;
-    cd.certSHA256 = signingCertificate.SHA256;
-  }

  SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256
                                    certificateSHA256:cd.certSHA256];
@@ -113,13 +110,16 @@

 - (SNTCachedDecision *)decisionForFilePath:(NSString *)filePath
                                fileSHA256:(NSString *)fileSHA256
-                        signingCertificate:(MOLCertificate *)signingCertificate {
-  NSError *error;
-  SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
-  if (!fileInfo) LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
+                         certificateSHA256:(NSString *)certificateSHA256 {
+  SNTFileInfo *fileInfo;
+  if (filePath) {
+    NSError *error;
+    fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
+    if (!fileInfo) LOGW(@"Failed to read file %@: %@", filePath, error.localizedDescription);
+  }
  return [self decisionForFileInfo:fileInfo
                        fileSHA256:fileSHA256
-                signingCertificate:signingCertificate];
+                 certificateSHA256:certificateSHA256];
 }

 ///
@@ -138,10 +138,8 @@
    return @"Whitelist Regex";
  }

-  // If file is not a Mach-O file, we're not interested unless it's part of an install package.
-  // TODO(rah): Consider adding an option to check all scripts.
-  // TODO(rah): Consider adding an option to disable package script checks.
-  if (!fi.isMachO && ![fi.path hasPrefix:@"/private/tmp/PKInstallSandbox."]) {
+  // If file is not a Mach-O file, we're not interested.
+  if (!fi.isMachO) {
    return @"Not a Mach-O";
  }

--- a/Source/santad/SNTSyncdQueue.h
+++ b/Source/santad/SNTSyncdQueue.h
@@ -14,6 +14,8 @@

@import Foundation;

+#import "SNTCommonEnums.h"
+
@class SNTStoredEvent;
@class SNTXPCConnection;

@@ -23,7 +25,8 @@
@property(copy) void (^invalidationHandler)();
@property(copy) void (^acceptedHandler)();

- (void)addEvent:(SNTStoredEvent *)event;
+- (void)addEvents:(NSArray<SNTStoredEvent *> *)events isFromBundle:(BOOL)isFromBundle;
+- (void)addBundleEvent:(SNTStoredEvent *)event reply:(void (^)(SNTBundleEventAction))reply;
 - (void)startSyncingEvents;
 - (void)stopSyncingEvents;

--- a/Source/santad/SNTSyncdQueue.m
+++ b/Source/santad/SNTSyncdQueue.m
@@ -38,27 +38,30 @@
  return self;
 }

- (void)addEvent:(SNTStoredEvent *)event {
-  // The event upload is skipped if an event upload has been initiated for it in the
-  // last 10 minutes.
-  NSDate *backoff = [self.uploadBackoff objectForKey:event.fileSHA256];
-  NSDate *now = [NSDate date];
-  if (([now timeIntervalSince1970] - [backoff timeIntervalSince1970]) < 600) return;
-  [self.uploadBackoff setObject:now forKey:event.fileSHA256];
-  
-  // Hold events for a few seconds to allow santad and santactl to establish connections.
-  // If the connections are not established in time drop the event from the queue.
-  // They will be uploaded during a full sync.
-  dispatch_async(self.syncdQueue, ^{
-    if (!dispatch_semaphore_wait(self.sema, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC))) {
-      [self.syncdConnection.remoteObjectProxy postEventToSyncServer:event];
-      
-      // Let em flow
-      dispatch_semaphore_signal(self.sema);
-    } else {
-      LOGI(@"Dropping event %@ from com.google.syncd_queue", event.fileSHA256);
-    }
-  });
+- (void)addEvents:(NSArray<SNTStoredEvent *> *)events isFromBundle:(BOOL)isFromBundle {
+  if (!events.count) return;
+  SNTStoredEvent *first = events.firstObject;
+  NSString *hash = isFromBundle ? first.fileBundleHash : first.fileSHA256;
+  if (![self backoffForPrimaryHash:hash]) return;
+  [self dispatchBlockOnSyncdQueue:^{
+    [self.syncdConnection.remoteObjectProxy postEventsToSyncServer:events
+                                                      isFromBundle:isFromBundle];
+  }];
+}
+
+- (void)addBundleEvent:(SNTStoredEvent *)event reply:(void (^)(SNTBundleEventAction))reply {
+  if (![self backoffForPrimaryHash:event.fileBundleHash]) return;
+  [self dispatchBlockOnSyncdQueue:^{
+    [self.syncdConnection.remoteObjectProxy
+        postBundleEventToSyncServer:event reply:^(SNTBundleEventAction action) {
+      // Remove the backoff entry for the inital block event. The same event will be included in
+      // the related events synced using addEvents:isFromBundle:.
+      if (action == SNTBundleEventActionSendEvents) {
+        [self.uploadBackoff removeObjectForKey:event.fileBundleHash];
+      }
+      reply(action);
+    }];
+  }];
 }

 - (void)startSyncingEvents {
@@ -69,4 +72,28 @@
  self.sema = dispatch_semaphore_create(0);
 }

+// Hold events for a few seconds to allow santad and santactl to establish connections.
+// If the connections are not established in time drop the event from the queue.
+// They will be uploaded during a full sync.
+- (void)dispatchBlockOnSyncdQueue:(void (^)())block {
+  dispatch_async(self.syncdQueue, ^{
+    if (!dispatch_semaphore_wait(self.sema, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC))) {
+      if (block) block();
+      dispatch_semaphore_signal(self.sema);
+    } else {
+      LOGD(@"Dropping block %@ from com.google.syncd_queue", block);
+    }
+  });
+}
+
+// The event upload is skipped if an event has been initiated for it in the last 10 minutes.
+// The passed-in hash is fileBundleHash for a bundle event, or fileSHA256 for a normal event.
+- (BOOL)backoffForPrimaryHash:(NSString *)hash {
+  NSDate *backoff = [self.uploadBackoff objectForKey:hash];
+  NSDate *now = [NSDate date];
+  if (([now timeIntervalSince1970] - [backoff timeIntervalSince1970]) < 600) return NO;
+  [self.uploadBackoff setObject:now forKey:hash];
+  return YES;
+}
+
@end
--- a/Tests/KernelTests/main.mm
+++ b/Tests/KernelTests/main.mm
@@ -104,7 +104,8 @@

 /// Call in-kernel function: |kSantaUserClientClearCache|
 - (void)flushCache {
-  IOConnectCallScalarMethod(self.connection, kSantaUserClientClearCache, 0, 0, 0, 0);
+  uint64_t nonRootOnly = 0;
+  IOConnectCallScalarMethod(self.connection, kSantaUserClientClearCache, &nonRootOnly, 1, 0, 0);
 }

 #pragma mark - Connection Tests
@@ -512,17 +513,20 @@
  TSTART("Test cache performance");

  // Execute echo 100 times, saving the time taken for each run
-  std::vector<std::clock_t> times;
+  std::vector<double> times;
  for (int i = 0; i < 100; ++i) {
    printf("\033[s");  // save cursor position
    printf("%d/%d", i + 1, 100);
-    auto start = std::clock();
    NSTask *t = [[NSTask alloc] init];
    t.launchPath = @"/bin/echo";
    t.standardOutput = [NSPipe pipe];
+    auto start = std::chrono::steady_clock::now();
    [t launch];
    [t waitUntilExit];
-    if (i > 5) times.push_back(std::clock() - start);
+    auto end = std::chrono::steady_clock::now();
+    auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(end - start).count();
+
+    if (i > 5) times.push_back(duration);
    printf("\033[u");  // restore cursor position
  }

@@ -541,12 +545,12 @@
  std::for_each(times.begin(), times.end(), [&](const double d) {
    accum += (d - mean) * (d - mean);
  });
-  double stdev = sqrt(accum / (times.size()-1));
+  double stdev = sqrt(accum / (times.size() - 1));

-  if (mean > 1000 || stdev > 150) {
-    TFAILINFO("μ: %-3.2f σ: %-3.2f", mean, stdev);
+  if (mean > 80 || stdev > 10) {
+    TFAILINFO("ms: %-3.2f σ: %-3.2f", mean, stdev);
  } else {
-    TPASSINFO("μ: %-3.2f σ: %-3.2f", mean, stdev);
+    TPASSINFO("ms: %-3.2f σ: %-3.2f", mean, stdev);
  }
 }

--- a/Tests/LogicTests/Resources/BundleExample.app/Contents/Info.plist
+++ b/Tests/LogicTests/Resources/BundleExample.app/Contents/Info.plist
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>BuildMachineOSBuild</key>
+	<string>16F73</string>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>en</string>
+	<key>CFBundleExecutable</key>
+	<string>BundleExample</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.google.santa.BundleExample</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>BundleExample</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleSupportedPlatforms</key>
+	<array>
+		<string>MacOSX</string>
+	</array>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>DTCompiler</key>
+	<string>com.apple.compilers.llvm.clang.1_0</string>
+	<key>DTPlatformBuild</key>
+	<string>7D1014</string>
+	<key>DTPlatformVersion</key>
+	<string>GM</string>
+	<key>DTSDKBuild</key>
+	<string>15E60</string>
+	<key>DTSDKName</key>
+	<string>macosx10.11</string>
+	<key>DTXcode</key>
+	<string>0731</string>
+	<key>DTXcodeBuild</key>
+	<string>7D1014</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>10.12</string>
+	<key>NSHumanReadableCopyright</key>
+	<string>Copyright © 2017 Google. All rights reserved.</string>
+	<key>NSMainNibFile</key>
+	<string>MainMenu</string>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
+</dict>
+</plist>
--- a/Tests/LogicTests/Resources/BundleExample.app/Contents/MacOS/BundleExample
+++ b/Tests/LogicTests/Resources/BundleExample.app/Contents/MacOS/BundleExample
--- a/Tests/LogicTests/SNTCommandFileInfoTest.m
+++ b/Tests/LogicTests/SNTCommandFileInfoTest.m
@@ -17,28 +17,29 @@
 #import <OCMock/OCMock.h>

 #import "MOLCodesignChecker.h"
+#import "SNTFileInfo.h"
 #import "SNTXPCConnection.h"

@interface SNTCommandFileInfo : NSObject

-typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
-@property(nonatomic) NSMutableDictionary *propertyMap;
+typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);
+@property(nonatomic) BOOL recursive;
+@property(nonatomic) BOOL jsonOutput;
+@property(nonatomic) NSNumber *certIndex;
+@property(nonatomic, copy) NSArray<NSString *> *outputKeyList;
+@property(nonatomic) NSDictionary<NSString *, SNTAttributeBlock> *propertyMap;
 + (NSArray *)fileInfoKeys;
 + (NSArray *)signingChainKeys;
 - (SNTAttributeBlock)codeSigned;
- (instancetype)initWithFilePath:(NSString *)filePath
-                daemonConnection:(SNTXPCConnection *)daemonConn;
-+ (void)parseArguments:(NSArray *)args
-                forKey:(NSString **)key
-             certIndex:(NSNumber **)certIndex
-            jsonOutput:(BOOL *)jsonOutput
-             filePaths:(NSArray **)filePaths;
+- (instancetype)initWithDaemonConnection:(SNTXPCConnection *)daemonConn;
+- (NSArray *)parseArguments:(NSArray *)arguments;

@end

@interface SNTCommandFileInfoTest : XCTestCase

@property SNTCommandFileInfo *cfi;
+@property SNTFileInfo *fileInfo;
@property id cscMock;

@end
@@ -48,13 +49,15 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
 - (void)setUp {
  [super setUp];

-  self.cfi = [[SNTCommandFileInfo alloc] initWithFilePath:nil daemonConnection:nil];
+  self.cfi = [[SNTCommandFileInfo alloc] initWithDaemonConnection:nil];
+  self.fileInfo = [[SNTFileInfo alloc] initWithResolvedPath:@"/usr/bin/yes" error:nil];
  self.cscMock = OCMClassMock([MOLCodesignChecker class]);
  OCMStub([self.cscMock alloc]).andReturn(self.cscMock);
 }

 - (void)tearDown {
  self.cfi = nil;
+  self.fileInfo = nil;
  [self.cscMock stopMocking];
  self.cscMock = nil;

@@ -62,55 +65,39 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
 }

 - (void)testParseArgumentsKey {
-  NSString *key;
-  NSNumber *certIndex;
-  BOOL jsonOutput = NO;
-  NSArray *filePaths;
-  [SNTCommandFileInfo parseArguments:@[ @"--key", @"SHA-256", @"/usr/bin/yes" ]
-                              forKey:&key
-                           certIndex:&certIndex
-                          jsonOutput:&jsonOutput
-                           filePaths:&filePaths];
-  XCTAssertEqualObjects(key, @"SHA-256");
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"--key", @"SHA-256", @"/usr/bin/yes" ]];
+  XCTAssertTrue([self.cfi.outputKeyList containsObject:@"SHA-256"]);
+  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
 }

 - (void)testParseArgumentsCertIndex {
-  NSString *key;
-  NSNumber *certIndex;
-  BOOL jsonOutput = NO;
-  NSArray *filePaths;
-  [SNTCommandFileInfo parseArguments:@[ @"--cert-index", @"1", @"/usr/bin/yes" ]
-                              forKey:&key
-                           certIndex:&certIndex
-                          jsonOutput:&jsonOutput
-                           filePaths:&filePaths];
-  XCTAssertEqualObjects(certIndex, @(1));
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"--cert-index", @"1", @"/usr/bin/yes" ]];
+  XCTAssertEqualObjects(self.cfi.certIndex, @(1));
+  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
 }
- (void)testParseArgumentsJSON {
-  NSString *key;
-  NSNumber *certIndex;
-  BOOL jsonOutput = NO;
-  NSArray *filePaths;
-  [SNTCommandFileInfo parseArguments:@[ @"--json", @"/usr/bin/yes" ]
-                              forKey:&key
-                           certIndex:&certIndex
-                          jsonOutput:&jsonOutput
-                           filePaths:&filePaths];
-  XCTAssertTrue(jsonOutput);
+
+- (void)testParseArgumentsJSONFalse {
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"/usr/bin/yes" ]];
+  XCTAssertFalse(self.cfi.jsonOutput);
+  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
+}
+
+- (void)testParseArgumentsJSONFalseWithPath {
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"/usr/bin/yes", @"json" ]];
+  XCTAssertFalse(self.cfi.jsonOutput);
+  XCTAssertTrue([filePaths containsObject:@"json"]);
+}
+
+- (void)testParseArgumentsJSONTrue {
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"--json", @"/usr/bin/yes" ]];
+  XCTAssertTrue(self.cfi.jsonOutput);
+  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
 }

 - (void)testParseArgumentsFilePaths {
-  NSString *key;
-  NSNumber *certIndex;
-  BOOL jsonOutput = NO;
-  NSArray *filePaths;
  NSArray *args = @[ @"/usr/bin/yes", @"/bin/mv", @"--key", @"SHA-256", @"/bin/ls", @"--json",
-                     @"/bin/rm", @"--cert-index", @"1", @"/bin/cp"];
-  [SNTCommandFileInfo parseArguments:args
-                              forKey:&key
-                           certIndex:&certIndex
-                          jsonOutput:&jsonOutput
-                           filePaths:&filePaths];
+                     @"/bin/rm", @"--cert-index", @"1", @"/bin/cp" ];
+  NSArray *filePaths = [self.cfi parseArguments:args];
  XCTAssertEqual(filePaths.count, 5);
  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
  XCTAssertTrue([filePaths containsObject:@"/bin/mv"]);
@@ -119,22 +106,25 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  XCTAssertTrue([filePaths containsObject:@"/bin/cp"]);
 }

+- (void)testParseArgumentsFilePathSameAsKey {
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"--key", @"Rule", @"Rule"]];
+  XCTAssertTrue([self.cfi.outputKeyList containsObject:@"Rule"]);
+  XCTAssertEqual(filePaths.count, 1);
+  XCTAssertTrue([filePaths containsObject:@"Rule"]);
+}
+
 - (void)testKeysAlignWithPropertyMap {
  NSArray *mapKeys = self.cfi.propertyMap.allKeys;
-  NSArray *keys = [SNTCommandFileInfo fileInfoKeys];
-  [keys enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
-    XCTAssertTrue([mapKeys containsObject:obj]);
-  }];
-  [mapKeys enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
-    XCTAssertTrue([keys containsObject:obj]);
-  }];
+  NSArray *fileInfokeys = [SNTCommandFileInfo fileInfoKeys];
+  for (NSString *key in fileInfokeys) XCTAssertTrue([mapKeys containsObject:key]);
+  for (NSString *key in mapKeys) XCTAssertTrue([fileInfokeys containsObject:key]);
 }

 - (void)testCodeSignedNo {
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSUnsigned userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), @"No");
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), @"No");
 }

 - (void)testCodeSignedSignatureFailed {
@@ -142,7 +132,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSSignatureFailed userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedStaticCodeChanged {
@@ -150,7 +140,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSStaticCodeChanged userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedSignatureNotVerifiable {
@@ -158,7 +148,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSSignatureNotVerifiable userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedSignatureUnsupported {
@@ -166,7 +156,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSSignatureUnsupported userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourceDirectoryFailed {
@@ -174,7 +164,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourceDirectoryFailed userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourceNotSupported {
@@ -182,7 +172,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourceNotSupported userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourceRulesInvalid {
@@ -190,7 +180,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourceRulesInvalid userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourcesInvalid {
@@ -198,7 +188,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourcesInvalid userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourcesNotFound {
@@ -206,7 +196,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourcesNotFound userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedResourcesNotSealed {
@@ -214,7 +204,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSResourcesNotSealed userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedReqFailed {
@@ -222,7 +212,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSReqFailed userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedReqInvalid {
@@ -230,7 +220,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSReqInvalid userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedReqUnsupported {
@@ -238,7 +228,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSReqUnsupported userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedInfoPlistFailed {
@@ -246,7 +236,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:errSecCSInfoPlistFailed userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

 - (void)testCodeSignedDefault {
@@ -254,7 +244,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *);
  NSError *err = [NSError errorWithDomain:@"" code:999 userInfo:nil];
  OCMStub([self.cscMock initWithBinaryPath:OCMOCK_ANY
                                     error:[OCMArg setTo:err]]).andReturn(self.cscMock);
-  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi), expected);
+  XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }

@end
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tom Burgin	1c95e8e25c	santad: Stop ignoring CSInfoPlistFailed (#204 ) It is too broad a check for the few false positive events we have seen.	2017-09-14 12:45:07 -04:00
nguyen-phillip	ff5a92772b	sync: start reachability handler to retry to upload blocked event when initial upload fails (#202 ) * sync: start reachability handler to retry to upload blocked event when initial upload fails * fix indentation * store related bundle events when server connection fails * revert SNTBundleEventAction to BOOL * go back to using SNTBundleEventAction in reply; make sure to send reply to avoid leaks * fix indentation * fix indentation	2017-09-14 12:44:32 -04:00
nguyen-phillip	bc2a17f70f	santactl: added filtering to fileinfo command via --filter flag (#201 ) * implemented simple filtering with fileinfo command * Use regex filters instead of substring matching * remove unnecessary match variable * Update SNTCommandFileInfo.m	2017-09-14 11:21:08 -04:00
nguyen-phillip	f2e909e578	Minor refactor to merge similar methods into one: (#200 ) * Merged similar methods into one: * SNTSyncdQueue addBundleEvents: and addEvent: became addEvents:isFromBundle: * SNTSyncdQueue backoffForBundleHash: and backoffForEvent: became backoffForPrimaryHash: * SNTCommandSyncManager postBundleEventsToSyncServer: and postEventToSyncServer: became postEventsToSyncServer:isFromBundle: * fix style issue * simplify condition	2017-09-08 09:18:13 -04:00
nguyen-phillip	c3385a808c	Bundle Notifications (#197 ) * stub code for bundle notifications with new rules info * get bundle rule count info from each rule, rather than initial FCM message * Replace string literals with constants * only update pendingNotifications for whitelist rules * use pre-existing string constants as dictionary keys * Remove processed entries from the notifications dictionary after we're done with them. * fix indentation * replace kRuleBundleHash with kFileBundleHash * enforce serial access to the whitelistNotifications dictionary * clarify comment * fix queue spelling and better comments	2017-09-05 15:35:35 -04:00
Tom Burgin	8d480331ff	Add Read the Docs to README (#196 ) * Update README.md * Update README.md	2017-08-18 13:29:43 -04:00
nguyen-phillip	5216f0989c	santactl: Recursive fileinfo command (#191 ) * temporarily gutted SNTCommandFileInfo. Added SNTCommand base class for all of the SNTCommand* classes to inherit from. Changed commands so that they are consistently instantiated before being run, with a common init method. * Put most of SNTCommandFileInfo functionality back in * follow symlinks * added -r and --recursive flags and updated help text * moved humanReadableFileType to SNTFileInfo * added back JSON output * Fixed bundle info. Grab directory color from ENV variable. * fixed indentation, moved stuff around * Added SNTCommandFileInfo * back as parameter to property getters so that rule getter doesn't have to be a special case any more. * fixed code review issues * added SNTCommand.h and SNTCommand.m to project * added SNTCommand.m to build phases * removed trailing spaces * fixed tests for SNTCommandFileInfo and added a few more * fix end-of-line comment spacing to conform to style guide * Use NSBundle instead of NSWorkspace to determine if path is a bundle. * added autorelease pool inside recursive search loop to fix bug where file listing would abruptly stop after so many files with mach header related keys. * removed directory headers. don't separate entries with newline when printing single key. format output based on max key length. * an attempt at speeding things up. also halfway fixed broken cert-index key. * speedups via caching MOLCodeSignChecker & not using NSMutableString append* * fix json ouput with cert-index, single key output, & cache SHA values * reverted back to NSMutableString for building up output, since it seems slightly better or at least no worse than using an NSMutableArray * Don't print empty JSON objects * fixed non-thread-safe JSON commas * made the print dispatch group a property so it doesn't have to be passed around * Fixed certIndex indexing bug & better error checking when parsing --cert-index argument * prevent unsigned int overflow * fixed logic tests broken by objc_setAssociatedObject with nil SNTFileInfo argument * send error output to the serial print queue * NSBundle bundleWithPath: returns an object even for non-bundle directories, so need to also check that there's a valid bundle identifier. * Added TODO comment and fixed formatting issues * added cached codeSignChecker property to SNTFileInfo * rewrote SNTFileInfo's codesignChecker method to include an error reference parameter & removed @synchronized * Removed caching of SHA values from SNTFileInfo * use property getter/setter to access codesignCheckerError * Change nil NSError ** arguments to NULL * Don't try to create a new codesignChecker if there was previously an error * Fix NSDirectoryEnumerator memory usage & don't retain self in rule getter. The NSStrings grabbed from the directory enumerator needed a chance to be freed. * fixed colon alignment	2017-08-18 09:56:37 -04:00
Tom Burgin	4238553a2e	Docs: Start of Santa Docs (#192 ) * Docs: Start of Santa Docs * Docs: /exec()/execve()/ * Docs: /sync-server/sync server/ * Docs: review updates	2017-08-17 16:01:59 -04:00
nguyen-phillip	79662d0dcf	santad/SNTEventLog: log original path of translocated apps (#194 ) * log original path of translocated apps * made handle a local variable & fixed capitalization * Removed superfluous CFError	2017-08-17 11:09:46 -04:00
Russell Hancox	ff095bc53d	KernelTests: Fix cache performance test It was previously calculating CPU use rather than walltime which isn't really what we want to measure.	2017-08-16 16:13:45 -04:00
Russell Hancox	eefd70b2de	santa-driver: Fix race condition by adding CAS op to SantaCache Change the signature of the set method in SantaCache so that it takes an optional previous-value parameter (and a bool indicating that this value has been provided). If previous-value is provided, set becomes a compare-and-swap. Also provide 2 overloads for a cleaner interface, one with and without the previous-value parameter.	2017-08-16 16:13:45 -04:00
Russell Hancox	9b3eab67a2	santa-driver: Determine root FSID more safely Only calculate root FSID during daemon connection. If daemon is running there must be a root filesystem. Also check return values just in case. Check vnode_id has been determined in VnodeCallback and SantaDriverClient methods so that it doesn't need to be checked anywhere else.	2017-08-16 12:07:44 -04:00
Russell Hancox	54def2deb7	santa-driver: Reverse ClearCache() non_root_only default parameter	2017-08-16 12:07:44 -04:00
Russell Hancox	cd12744726	santad/santactl/santa-driver: Make status command return size of both caches	2017-08-16 12:07:44 -04:00
Russell Hancox	616fd9570f	santa-driver: Split cache for root/non-root volume Split the kernel-land cache into 2 separate caches, one for the root volume and one for secondary volumes. When an unmount happens, clear the non-root cache to ensure no overlap with filesystem IDs.	2017-08-16 12:07:44 -04:00
Russell Hancox	0544011ee0	[santad] Remove broken check and obsolete TODOs (#190 )	2017-08-03 15:14:02 -04:00
nguyen-phillip	51920c7045	santad: modified execution log format to show path & args at end (#189 ) Fixed problem where extremely long path/args obscured other log info.	2017-08-02 14:27:39 -04:00
Russell Hancox	6f417a1775	common: Remove EventDetailBundleURL key (#187 ) The changes to bundle scanning mean this key isn't really necessary anymore - if a server supports bundles it tells the client during preflight, this in turn causes bundle hashes to be generated and these are used in place of the file hash when generating a detail URL. Keying bundles off the ID and version was never really a good idea anyway.	2017-08-01 12:16:37 -04:00
Russell Hancox	51034a24c6	SNTXPCConnection: Prevent crash if caller releases instance during resume (#183 )	2017-07-18 16:50:32 -04:00
Tom Burgin	f631f219b0	santactl/sync: fixed exception when file_name is None / NSNull (#180 ) * santactl/sync: fixed exception when file_name is None / NSNull * review updates	2017-07-06 11:52:49 -04:00
Tom Burgin	aacae020b8	logs: add DAAppearanceTime to the DISKAPPEAR logs (#179 ) * logs: add DAAppearanceTime to the DISKAPPEAR logs * review updates * discussion updates	2017-07-02 16:27:40 -04:00
Tom Burgin	7c426e0eec	santactl/sync: upload file bundle executable relative path for bundle events (#178 )	2017-06-28 11:55:21 -04:00
Tom Burgin	363826502f	santabs: de-dupe generated events before upload (#177 ) * santabs: de-dupe generated events before upload and remove locks * review updates * error updates	2017-06-22 17:46:04 -04:00
Russell Hancox	1cfadae068	SantaGUI: Don't show pop-up notifications for empty filenames (#176 )	2017-06-12 11:28:32 -07:00
Tom Burgin	d3b3d722b4	santabs: use the ancestor bundle when searching for binaries (#175 ) * santabs: use the ancestor bundle when searching for binaries * review updates * bundle tests	2017-06-09 17:04:23 -04:00
Tom Burgin	a82428958b	santactl/rule: Add the ability to check the status of arbitrary sha256 hashes without on-disk artifacts. (#172 )	2017-05-30 13:07:47 -04:00
Tom Burgin	b185632bda	santad/SantaGUI: Add needsBundleHash property to SNTStoredEvent && (#170 ) santactl/sync:sync server enables/disables client bundle support	2017-05-30 13:04:08 -04:00
Tom Burgin	e7a0c3d25b	santactl/sync: Sync Server to set FCM interval and deadline (#168 ) * santactl/sync: Sync Server to set FCM interval and deadline * rename default constants * review updates	2017-05-22 11:50:37 -04:00
Tom Burgin	ab33de2c15	project/config: Move /var/log/santa.log to /var/db/santa/santa.log (#173 )	2017-05-22 11:10:10 -04:00
Tom Burgin	a1031cdc27	protect wakeup() from being called with 0 (#167 ) * don't call wakeup on 0 * project: "share" the santabs target * Project: Update CocoaPods to 1.2.1 * Project: pod deintegrate - pod install	2017-04-14 16:13:45 -04:00
Tom Burgin	e3ab3ca506	Update SNTCommandSyncEventUpload.m (#162 )	2017-04-13 16:58:25 -04:00
Matthew Suozzo	b4cd1ccbee	santa-driver: Fix a typo	2017-04-13 14:27:05 -04:00
Matthew Suozzo	14573a5714	santa-driver: Refactor cache expiration calculation	2017-04-12 22:35:08 -04:00
Tom Burgin	96150a9668	Bundle Events (#145 ) * santabs: Create Santa Bundle Service * common: SNTXPCConnection add initClientWithServiceName: * santad: add logic for blocked bundles * SantaGUI: add ui elements and xpc connections to / from santabs * santactl/sync: add api features for syncing bundle events * santactl/bundleinfo: add bundleinfo command for debug builds * common: prefer bundle hash over file hash for event urls * common: remove syncBackoff property - this is now handled in santactl sync * common: add properties to support the bundle event api * common: find a bundle from a nested binary * review updates * sane bundle hash time outs * post rebase updates * post review updates	2017-04-07 15:31:56 -04:00
Russell Hancox	c10c1303ed	SantaGUI: Add preprocessor flag to import Cocoa for SNTBlockMessage	2017-04-05 14:19:50 -04:00
Tom Burgin	7852e69685	SantaCache fix 0 init (#158 )	2017-03-22 09:38:27 -04:00