don't log TRUNCATE and don't log fileops from com.google.santa.daemon (#428 )

* don't log TRUNCATE and don't log fileops from com.google.santa.daemon * review updates
cleanup 10.14 -> 10.15 upgrade artifacts (#427 )
2026-01-15 01:08:12 -05:00 · 2019-12-20 14:00:16 -05:00 · 2019-12-19 15:56:59 -05:00 · 2019-12-16 13:03:20 -05:00 · 2019-12-13 15:24:21 -05:00 · 2019-12-12 14:02:23 -05:00
226 changed files with 6402 additions and 5646 deletions
--- a/.bazelrc
+++ b/.bazelrc
@@ -0,0 +1,2 @@
+build --apple_generate_dsym --define=apple.propagate_embedded_extra_outputs=yes
+build --host_force_python=PY2
--- a/.gitignore
+++ b/.gitignore
@@ -1,12 +1,9 @@
 .DS_Store
-Build
-santa-*
-!santa-driver
-!*.md
+default.profraw
+*.provisionprofile
+bazel-*
 Pods
 Santa.xcodeproj/xcuserdata
 Santa.xcodeproj/project.xcworkspace
 Santa.xcworkspace/xcuserdata
 Santa.xcworkspace/xcshareddata
-Source/DevelopmentTeam.xcconfig
-default.profraw
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,14 +1,14 @@
 ---
+os: osx
+osx_image: xcode11
 language: objective-c
-cache:
-  - bundler
-  - cocoapods
 sudo: false
-osx_image: xcode9.3

-before_install:
- - gem install cocoapods xcpretty
- - pod setup >/dev/null
+addons:
+  homebrew:
+    taps: bazelbuild/tap
+    packages: bazelbuild/tap/bazel

 script:
- - xcodebuild -workspace Santa.xcworkspace -scheme All -derivedDataPath build build test CODE_SIGN_IDENTITY='' | xcpretty -sc && exit ${PIPESTATUS[0]}
+ - bazel build :release --show_progress_rate_limit=30.0 -c opt --apple_generate_dsym --color=no --verbose_failures --sandbox_debug
+ - bazel test :unit_tests --show_progress_rate_limit=30.0 --test_output=errors --color=no --verbose_failures --sandbox_debug
--- a/167
+++ b/167
@@ -0,0 +1,167 @@
+load("@build_bazel_rules_apple//apple:versioning.bzl", "apple_bundle_version")
+load("//:helper.bzl", "run_command")
+load("//:version.bzl", "SANTA_VERSION")
+
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])
+
+exports_files(["LICENSE"])
+
+# The version label for mac_* rules.
+apple_bundle_version(
+    name = "version",
+    build_version = SANTA_VERSION,
+    short_version_string = SANTA_VERSION,
+)
+
+# Used to detect optimized builds
+config_setting(
+    name = "opt_build",
+    values = {"compilation_mode": "opt"},
+)
+
+################################################################################
+# Loading/Unloading/Reloading
+################################################################################
+run_command(
+    name = "unload",
+    cmd = """
+sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist 2>/dev/null
+sudo launchctl unload /Library/LaunchDaemons/com.google.santa.bundleservice.plist 2>/dev/null
+sudo kextunload -b com.google.santa-driver 2>/dev/null
+launchctl unload /Library/LaunchAgents/com.google.santa.plist 2>/dev/null
+""",
+)
+
+run_command(
+    name = "load",
+    cmd = """
+sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist
+sudo launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist
+launchctl load /Library/LaunchAgents/com.google.santa.plist
+""",
+)
+
+run_command(
+    name = "reload",
+    srcs = [
+        "//Source/santa:Santa",
+        "//Source/santa_driver",
+    ],
+    cmd = """
+set -e
+
+rm -rf /tmp/bazel_santa_reload
+unzip -d /tmp/bazel_santa_reload \
+    $${BUILD_WORKSPACE_DIRECTORY}/bazel-bin/Source/santa_driver/santa_driver.zip >/dev/null
+unzip -d /tmp/bazel_santa_reload \
+    $${BUILD_WORKSPACE_DIRECTORY}/bazel-bin/Source/santa/Santa.zip >/dev/null
+echo "You may be asked for your password for sudo"
+sudo BINARIES=/tmp/bazel_santa_reload CONF=$${BUILD_WORKSPACE_DIRECTORY}/Conf \
+    $${BUILD_WORKSPACE_DIRECTORY}/Conf/install.sh
+rm -rf /tmp/bazel_santa_reload
+echo "Time to stop being naughty"
+""",
+)
+
+################################################################################
+# Release rules - used to create a release tarball
+################################################################################
+genrule(
+    name = "release",
+    srcs = [
+        "//Source/santa:Santa",
+        "//Source/santa_driver",
+        "Conf/install.sh",
+        "Conf/uninstall.sh",
+        "Conf/com.google.santa.bundleservice.plist",
+        "Conf/com.google.santad.plist",
+        "Conf/com.google.santa.plist",
+        "Conf/com.google.santa.asl.conf",
+        "Conf/com.google.santa.newsyslog.conf",
+        "Conf/Package/Makefile",
+        "Conf/Package/postinstall",
+        "Conf/Package/preinstall",
+    ],
+    outs = ["santa-" + SANTA_VERSION + ".tar.gz"],
+    cmd = select({
+        "//conditions:default": """
+        echo "ERROR: Trying to create a release tarball without optimization."
+        echo "Please add '-c opt' flag to bazel invocation"
+        """,
+        ":opt_build": """
+      # Extract santa_driver.zip and Santa.zip
+      for SRC in $(SRCS); do
+        if [ "$$(basename $${SRC})" == "santa_driver.zip" -o "$$(basename $${SRC})" == "Santa.zip" ]; then
+          mkdir -p $(@D)/binaries
+          unzip -q $${SRC} -d $(@D)/binaries >/dev/null
+        fi
+      done
+
+      # Copy config files
+      for SRC in $(SRCS); do
+        if [[ "$$(dirname $${SRC})" == *"Conf" ]]; then
+          mkdir -p $(@D)/conf
+          cp $${SRC} $(@D)/conf/
+        fi
+      done
+
+      # Gather together the dSYMs. Throw an error if no dSYMs were found
+      for SRC in $(SRCS); do
+        case $${SRC} in
+          *santa-driver.kext.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santa-driver.kext.dSYM
+            ;;
+          *santad.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santad.dSYM
+            ;;
+          *santactl.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santactl.dSYM
+            ;;
+          *santabundleservice.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santabundleservice.dSYM
+            ;;
+          *Santa.app.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/Santa.app.dSYM
+            ;;
+        esac
+      done
+
+      # Cause a build failure if the dSYMs are missing.
+      if [[ ! -d "$(@D)/dsym" ]]; then
+        echo "dsym dir missing: Did you forget to use --apple_generate_dsym?"
+        echo "This flag is required for the 'release' target."
+        exit 1
+      fi
+
+      # Update all the timestamps to now. Bazel avoids timestamps to allow
+      # builds to be hermetic and cacheable but for releases we want the
+      # timestamps to be more-or-less correct.
+      find $(@D)/{binaries,conf,dsym} -exec touch {} \\;
+
+      # Create final output tar
+      tar -C $(@D) -czpf $(@) binaries dsym conf
+    """,
+    }),
+    heuristic_label_expansion = 0,
+)
+
+test_suite(
+    name = "unit_tests",
+    tests = [
+        "//Source/common:SNTFileInfoTest",
+        "//Source/common:SNTPrefixTreeTest",
+        "//Source/santa_driver:SantaCacheTest",
+        "//Source/santactl:SNTCommandFileInfoTest",
+        "//Source/santactl:SNTCommandSyncTest",
+        "//Source/santad:SNTEventTableTest",
+        "//Source/santad:SNTExecutionControllerTest",
+        "//Source/santad:SNTRuleTableTest",
+    ],
+)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,133 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-
-execute_process(
-  COMMAND git fetch --tags --all
-  COMMAND git describe --tags --always --abbrev=0
-  WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}"
-  OUTPUT_VARIABLE SANTA_VERSION
-  OUTPUT_STRIP_TRAILING_WHITESPACE
-)
-
-execute_process(
-  COMMAND xcode-select -p
-  OUTPUT_VARIABLE DEFAULT_XCODE_ROOT_FOLDER
-)
-
-string(STRIP "${DEFAULT_XCODE_ROOT_FOLDER}" DEFAULT_XCODE_ROOT_FOLDER)
-
-add_custom_target(tests)
-function(AddTestTarget target_name run_as_root)
-  if(run_as_root)
-    add_custom_target(
-      "${target_name}_runner"
-      COMMAND sudo $<TARGET_FILE:${target_name}>
-      COMMENT "Running ${target_name}_runner as root"
-    )
-
-  else()
-    add_custom_target(
-      "${target_name}_runner"
-      COMMAND $<TARGET_FILE:${target_name}>
-    )
-  endif()
-
-  add_dependencies(tests "${target_name}_runner")
-endfunction()
-
-add_custom_target(fuzz)
-function(AddFuzzTarget target_name max_len max_total_time run_as_root)
-  add_custom_command(TARGET "${target_name}" POST_BUILD
-    COMMAND codesign --force --verify --verbose --sign "${CODESIGN_IDENTITY}" $<TARGET_FILE:${target_name}>
-    COMMENT "Signing ${target_name} with the following identity: ${CODESIGN_IDENTITY}"
-  )
-
-  if(${run_as_root})
-    set(sudo_command "sudo")
-  else()
-    set(sudo_command "")
-  endif()
-
-  add_custom_target(
-    "${target_name}_runner"
-    COMMAND "${CMAKE_COMMAND}" -E make_directory "${CMAKE_CURRENT_BINARY_DIR}/${target_name}_corpus"
-    COMMAND ${sudo_command} $<TARGET_FILE:${target_name}> -max_len=${max_len} -max_total_time=${max_total_time} "${CMAKE_CURRENT_BINARY_DIR}/${target_name}_corpus" "${CMAKE_CURRENT_SOURCE_DIR}/${target_name}_seed_corpus"
-    COMMENT "Running fuzzer: ${target_name}"
-  )
-
-  add_dependencies("${target_name}_runner" "${target_name}")
-  add_dependencies(fuzz "${target_name}_runner")
-endfunction()
-
-function(main)
-  if("${CMAKE_BUILD_TYPE}" STREQUAL "")
-    set(CMAKE_BUILD_TYPE RelWithDebInfo)
-  endif()
-
-  if(NOT DEFINED CODESIGN_IDENTITY)
-    if ("$ENV{CODESIGN_IDENTITY}" STREQUAL "")
-      message(FATAL_ERROR "Please define CODESIGN_IDENTITY - You can either use an environment variable or pass it to CMake with -DCODESIGN_IDENTITY=identity. If you are using sudo, make sure to keep the variable defined")
-    endif()
-
-    set(CODESIGN_IDENTITY "$ENV{CODESIGN_IDENTITY}")
-  endif()
-
-  if(NOT MACOSX_VERSION_MIN)
-    set(MACOSX_VERSION_MIN 10.9)
-  endif()
-
-  if(NOT MACOSX_SDK_VERSION)
-    set(sdk_version_name "Latest")
-  else()
-    set(sdk_version_name "${MACOSX_SDK_VERSION}")
-  endif()
-
-  if(NOT XCODE_ROOT_FOLDER)
-    set(XCODE_ROOT_FOLDER "${DEFAULT_XCODE_ROOT_FOLDER}")
-  endif()
-
-  message(STATUS "MACOSX_VERSION_MIN: ${MACOSX_VERSION_MIN}")
-  message(STATUS "MACOSX_SDK_VERSION: ${sdk_version_name}")
-  message(STATUS "XCODE_ROOT_FOLDER: ${XCODE_ROOT_FOLDER}")
-  message(STATUS "CMAKE_BUILD_TYPE: ${CMAKE_BUILD_TYPE}")
-  message(STATUS "SANTA_VERSION: ${SANTA_VERSION}")
-
-  add_subdirectory(CocoaPods)
-  add_subdirectory(Source/santad)
-  add_subdirectory(Source/santactl)
-  add_subdirectory(Source/santabs)
-  add_subdirectory(Source/SantaGUI)
-  add_subdirectory(Source/santa-driver)
-
-  add_subdirectory(Fuzzing)
-  add_subdirectory(Tests)
-
-  set(redist_folder_path "${CMAKE_BINARY_DIR}/redist")
-  add_custom_command(
-    OUTPUT "${redist_folder_path}/conf/install.sh"
-
-    # Copy the binaries
-    COMMAND "${CMAKE_COMMAND}" -E copy_directory "${CMAKE_BINARY_DIR}/Source/SantaGUI/Santa.app" "${redist_folder_path}/binaries/Santa.app"
-    COMMAND "${CMAKE_COMMAND}" -E copy_directory "${CMAKE_BINARY_DIR}/Source/santa-driver/santa-driver.kext" "${redist_folder_path}/binaries/santa-driver.kext"
-
-    # Copy the configuration files
-    COMMAND "${CMAKE_COMMAND}" -E copy_directory "${CMAKE_SOURCE_DIR}/Conf" "${redist_folder_path}/conf"
-    COMMAND "${CMAKE_COMMAND}" -E remove_directory "${redist_folder_path}/conf/Package"
-    COMMAND "${CMAKE_COMMAND}" -E copy "${CMAKE_SOURCE_DIR}/Docs/deployment/com.google.santa.example.mobileconfig" "${redist_folder_path}/conf"
-
-    COMMENT "Generating redistributable package"
-  )
-
-  add_custom_target(redist DEPENDS "${redist_folder_path}/conf/install.sh")
-  add_dependencies(redist santad santa-driver santactl santabs Santa)
-
-  install(FILES Conf/com.google.santad.plist DESTINATION /Library/LaunchDaemons)
-  install(FILES Conf/com.google.santagui.plist DESTINATION /Library/LaunchAgents)
-
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E echo To finalize the installation, run the following commands)")
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E echo sudo /sbin/kextload /Library/Extensions/santa-driver.kext)")
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E echo sudo /bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist)")
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E echo sudo /bin/launchctl asuser `/usr/bin/stat -f '%u' /dev/console` /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist)")
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E echo Configuration guide available on ReadTheDocs - https://santa.readthedocs.io/en/latest/deployment/configuration/)")
-endfunction()
-
-main()
--- a/CocoaPods/CMakeLists.txt
+++ b/CocoaPods/CMakeLists.txt
@@ -1,195 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(CocoaPods)
-
-function(main)
-  add_custom_command(
-    OUTPUT "${CMAKE_SOURCE_DIR}/Pods/Manifest.lock"
-    COMMAND pod repo update && pod install
-    DEPENDS "${CMAKE_SOURCE_DIR}/Podfile"
-    WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}"
-    COMMENT "Fetching CocoaPods dependencies"
-    VERBATIM
-  )
-
-  add_custom_target("${PROJECT_NAME}"
-    DEPENDS "${CMAKE_SOURCE_DIR}/Pods/Manifest.lock"
-  )
-
-  ImportCocoaPodsLibrary(
-    FMDB
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb"
-
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabase.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMResultSet.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabasePool.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabaseQueue.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDB.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabaseAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabaseQueue.m"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabaseAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabase.m"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMDatabasePool.m"
-    "${CMAKE_SOURCE_DIR}/Pods/FMDB/src/fmdb/FMResultSet.m"
-  )
-
-  target_link_libraries(FMDB PUBLIC sqlite3 "-framework Cocoa")
-
-  ImportCocoaPodsLibrary(
-    MOLCertificate
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCertificate/Source/MOLCertificate"
-
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCertificate/Source/MOLCertificate/MOLCertificate.m"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCertificate/Source/MOLCertificate/MOLCertificate.h"
-  )
-
-  target_link_libraries(MOLCertificate PUBLIC "-framework Security" "-framework Cocoa")
-
-  ImportCocoaPodsLibrary(
-    MOLCodesignChecker
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCodesignChecker/Source/MOLCodesignChecker"
-
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCodesignChecker/Source/MOLCodesignChecker/MOLCodesignChecker.h"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLCodesignChecker/Source/MOLCodesignChecker/MOLCodesignChecker.m"
-  )
-
-  target_link_libraries(MOLCodesignChecker PUBLIC "-framework Security" "-framework Cocoa")
-
-  ImportCocoaPodsLibrary(
-    MOLAuthenticatingURLSession
-    "${CMAKE_SOURCE_DIR}/Pods/MOLAuthenticatingURLSession/Source/MOLAuthenticatingURLSession"
-
-    "${CMAKE_SOURCE_DIR}/Pods/MOLAuthenticatingURLSession/Source/MOLAuthenticatingURLSession/MOLAuthenticatingURLSession.m"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLAuthenticatingURLSession/Source/MOLAuthenticatingURLSession/MOLDERDecoder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLAuthenticatingURLSession/Source/MOLAuthenticatingURLSession/MOLDERDecoder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLAuthenticatingURLSession/Source/MOLAuthenticatingURLSession/MOLAuthenticatingURLSession.h"
-  )
-
-  target_link_libraries(MOLAuthenticatingURLSession PUBLIC "-framework Security" MOLCertificate "-framework Cocoa")
-
-  ImportCocoaPodsLibrary(
-    MOLFCMClient
-    "${CMAKE_SOURCE_DIR}/Pods/MOLFCMClient/MOLFCMClient"
-
-    "${CMAKE_SOURCE_DIR}/Pods/MOLFCMClient/Source/MOLFCMClient/MOLFCMClient.m"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLFCMClient/Source/MOLFCMClient/MOLFCMClient.h"
-  )
-
-  target_link_libraries(MOLFCMClient PUBLIC MOLCertificate MOLAuthenticatingURLSession "-framework Cocoa")
-  target_compile_options(MOLFCMClient PRIVATE -fobjc-weak)
-
-  ImportCocoaPodsLibrary(
-    MOLXPCConnection
-    "${CMAKE_SOURCE_DIR}/Pods/MOLXPCConnection/Source/MOLXPCConnection"
-
-    "${CMAKE_SOURCE_DIR}/Pods/MOLXPCConnection/Source/MOLXPCConnection/MOLXPCConnection.h"
-    "${CMAKE_SOURCE_DIR}/Pods/MOLXPCConnection/Source/MOLXPCConnection/MOLXPCConnection.m"
-  )
-
-  target_link_libraries(MOLXPCConnection PUBLIC "-framework Cocoa")
-
-  ImportCocoaPodsLibrary(
-    OCMock
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock"
-
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMExceptionReturnValueProvider.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBlockCaller.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMExpectationRecorder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMockObject.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMArgAction.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMMacroState.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMRealObjectForwarder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationStub.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCPartialMockObject.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMock.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMStubRecorder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMRecorder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationExpectation.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMFunctions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMIndirectReturnValueProvider.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCProtocolMockObject.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBlockArgCaller.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMReturnValueProvider.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBoxedReturnValueProvider.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCClassMockObject.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSObject+OCMAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationMatcher.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMPassByRefSetter.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMArg.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSNotificationCenter+OCMAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMObserverRecorder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMNotificationPoster.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMVerifier.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMConstraint.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMLocation.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSInvocation+OCMAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSValue+OCMAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCObserverMockObject.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSMethodSignature+OCMAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMRealObjectForwarder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMMacroState.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMArgAction.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMockObject.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMExpectationRecorder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBlockCaller.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMExceptionReturnValueProvider.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMIndirectReturnValueProvider.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMFunctions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMStubRecorder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMRecorder.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationExpectation.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCPartialMockObject.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationStub.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMPassByRefSetter.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMInvocationMatcher.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSObject+OCMAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCClassMockObject.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBoxedReturnValueProvider.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMBlockArgCaller.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMReturnValueProvider.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCProtocolMockObject.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSMethodSignature+OCMAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMFunctionsPrivate.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSInvocation+OCMAdditions.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCObserverMockObject.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSValue+OCMAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMLocation.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMConstraint.h"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMVerifier.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMNotificationPoster.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMObserverRecorder.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/NSNotificationCenter+OCMAdditions.m"
-    "${CMAKE_SOURCE_DIR}/Pods/OCMock/Source/OCMock/OCMArg.h"
-  )
-
-  target_link_libraries(OCMock PUBLIC "-framework Cocoa")
-  target_compile_options(OCMock PRIVATE -fno-objc-arc)
-endfunction()
-
-function(ImportCocoaPodsLibrary library_name source_directory)
-	set_source_files_properties(${ARGN} PROPERTIES GENERATED True)
-
-  add_library("${library_name}" STATIC ${ARGN})
-  add_dependencies("${library_name}" "${PROJECT_NAME}")
-
-  target_include_directories("${library_name}" PUBLIC
-    "${source_directory}"
-    "${CMAKE_SOURCE_DIR}/Pods/Headers/Public"
-  )
-
-  target_compile_options("${library_name}" PUBLIC
-    -Wno-deprecated -fmodules -fcxx-modules -fobjc-arc
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  if(CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo" OR CMAKE_BUILD_TYPE STREQUAL "Debug")
-    target_compile_options("${library_name}" PRIVATE -g3)
-  endif()
-
-  if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-    target_compile_options("${library_name}" PRIVATE -O0)
-  else()
-    target_compile_options("${library_name}" PRIVATE -O3)
-  endif()
-endfunction()
-
-main()
--- a/Conf/Package/postinstall
+++ b/Conf/Package/postinstall
@@ -9,20 +9,28 @@
 # Restart syslogd to pick up ASL configuration change
 /usr/bin/killall -HUP syslogd

-/sbin/kextload /Library/Extensions/santa-driver.kext
-
-sleep 1
-
-/bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
-
-sleep 1
-
 # Create hopefully useful symlink for santactl
 mkdir -p /usr/local/bin
-/bin/ln -sf /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin/santactl
+/bin/ln -sf /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin/santactl
+
+if [ $(uname -r | cut -d'.' -f1) -ge 19 ]; then
+  # Running on 10.15+
+  echo "Santa postinstall: running on 10.15+"
+  /bin/rm -rf /Library/Extensions/santa-driver.kext
+  /bin/rm -f /Library/LaunchDaemons/com.google.santad.plist
+else
+  # Running on <10.15
+  /bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
+fi
+
+# Load the bundle service
+/bin/launchctl load -w /Library/LaunchDaemons/com.google.santa.bundleservice.plist

 user=$(/usr/bin/stat -f '%u' /dev/console)
-[[ -z "$user" ]] && exit 0
-/bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+if [[ -z "$user" ]]; then
+  /Applications/Santa.app/Contents/MacOS/Santa --load-system-extension
+  exit 0
+fi
+/bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.santa.plist

 exit 0
--- a/Conf/Package/preinstall
+++ b/Conf/Package/preinstall
@@ -6,21 +6,24 @@

 [[ $3 != "/" ]] && exit 0

-/bin/launchctl remove com.google.santad
+/bin/launchctl remove com.google.santad || true
+/bin/launchctl remove com.google.santa.bundleservice || true

-sleep 1
+/bin/sleep 1

-/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1 || true

 # Remove cruft from old Santa versions
-/bin/rm /usr/libexec/santad
-/bin/rm /usr/sbin/santactl
+/bin/rm -f /usr/libexec/santad
+/bin/rm -f /usr/sbin/santactl
 /bin/launchctl remove com.google.santasync
-/bin/rm /Library/LaunchDaemons/com.google.santasync.plist
+/bin/rm -f /Library/LaunchDaemons/com.google.santasync.plist
+/bin/rm -rf /Applications/Santa.app

-sleep 1
+/bin/sleep 1

 user=$(/usr/bin/stat -f '%u' /dev/console)
 [[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santa

 exit 0
--- a/Conf/com.google.santa.bundleservice.plist
+++ b/Conf/com.google.santa.bundleservice.plist
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>com.google.santa.bundleservice</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/Santa.app/Contents/MacOS/santabundleservice</string>
+		<string>--syslog</string>
+	</array>
+	<key>MachServices</key>
+	<dict>
+		<key>com.google.santa.bundleservice</key>
+		<true/>
+	</dict>
+	<key>RunAtLoad</key>
+	<false/>
+	<key>KeepAlive</key>
+	<false/>
+	<key>ProcessType</key>
+	<string>Interactive</string>
+	<key>ThrottleInterval</key>
+	<integer>0</integer>
+</dict>
+</plist>
--- a/Conf/com.google.santagui.plist
+++ b/Conf/com.google.santagui.plist
@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 				<key>Label</key>
-				<string>com.google.santagui</string>
+				<string>com.google.santa</string>
 				<key>ProgramArguments</key>
 				<array>
 					<string>/Applications/Santa.app/Contents/MacOS/Santa</string>
--- a/Conf/com.google.santad.plist
+++ b/Conf/com.google.santad.plist
@@ -1,24 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-				<key>Label</key>
-				<string>com.google.santad</string>
-				<key>ProgramArguments</key>
-				<array>
-					<string>/Library/Extensions/santa-driver.kext/Contents/MacOS/santad</string>
-					<string>--syslog</string>
-				</array>
-				<key>MachServices</key>
-				<dict>
-					<key>SantaXPCControl</key>
-					<true/>
-				</dict>
-				<key>RunAtLoad</key>
-				<true/>
-				<key>KeepAlive</key>
-				<true />
-				<key>ProcessType</key>
-				<string>Interactive</string>
+	<key>Label</key>
+	<string>com.google.santad</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/Santa.app/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon</string>
+		<string>--syslog</string>
+	</array>
+	<key>MachServices</key>
+	<dict>
+		<key>com.google.santa.daemon</key>
+		<true/>
+	</dict>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>ProcessType</key>
+	<string>Interactive</string>
 </dict>
 </plist>
--- a/Conf/install.sh
+++ b/Conf/install.sh
@@ -5,62 +5,77 @@ if [[ $EUID -ne 0 ]]; then
  exit 1
 fi

-if [[ -d "binaries" ]]; then
-  SOURCE="."
-elif [[ -d "../binaries" ]]; then
-  SOURCE=".."
-else
-  echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
-  exit 1
+if [[ -z "${BINARIES}" || -z "${CONF}" ]]; then
+  if [[ -d "binaries" ]]; then
+    BINARIES="${PWD}/binaries"
+    CONF="${PWD}/conf"
+  elif [[ -d "../binaries" ]]; then
+    BINARIES="${PWD}/../binaries"
+    CONF="${PWD}/../conf"
+  else
+    echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
+    exit 1
+  fi
 fi

-# Determine if anyone is logged into the GUI
-GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
-
 # Unload santad and scheduled sync job.
 /bin/launchctl remove com.google.santad >/dev/null 2>&1

+# Unload bundle service
+/bin/launchctl remove com.google.santa.bundleservice >/dev/null 2>&1
+
 # Unload kext.
 /sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1

+# Determine if anyone is logged into the GUI
+GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
+
 # Unload GUI agent if someone is logged in.
 [[ -n "$GUI_USER" ]] && \
-  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove /Library/LaunchAgents/com.google.santagui.plist
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove com.google.santagui
+[[ -n "$GUI_USER" ]] && \
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove com.google.santa

 # Cleanup cruft from old versions
 /bin/launchctl remove com.google.santasync >/dev/null 2>&1
 /bin/rm /Library/LaunchDaemons/com.google.santasync.plist >/dev/null 2>&1
 /bin/rm /usr/libexec/santad >/dev/null 2>&1
 /bin/rm /usr/sbin/santactl >/dev/null 2>&1
+/bin/rm -rf /Applications/Santa.app 2>&1
+/bin/rm -rf /Library/Extensions/santa-driver.kext 2>&1

 # Copy new files.
-/bin/cp -r ${SOURCE}/binaries/santa-driver.kext /Library/Extensions
-/bin/cp -r ${SOURCE}/binaries/Santa.app /Applications
-mkdir -p /usr/local/bin
-/bin/ln -s /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin
+/bin/mkdir -p /var/db/santa

-if [ ! -d /var/db/santa ] ; then
-  mkdir /var/db/santa
-fi
+/bin/cp -r ${BINARIES}/Santa.app /Applications

-cp ${SOURCE}/conf/com.google.santa.example.mobileconfig /var/db/santa
+/bin/mkdir -p /usr/local/bin
+/bin/ln -s /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin 2>/dev/null

-/bin/cp ${SOURCE}/conf/com.google.santad.plist /Library/LaunchDaemons
-/bin/cp ${SOURCE}/conf/com.google.santagui.plist /Library/LaunchAgents
-/bin/cp ${SOURCE}/conf/com.google.santa.asl.conf /etc/asl/
-/bin/cp ${SOURCE}/conf/com.google.santa.newsyslog.conf /etc/newsyslog.d/
+/bin/cp ${CONF}/com.google.santa.plist /Library/LaunchAgents
+/bin/cp ${CONF}/com.google.santa.bundleservice.plist /Library/LaunchDaemons
+/bin/cp ${CONF}/com.google.santa.asl.conf /etc/asl/
+/bin/cp ${CONF}/com.google.santa.newsyslog.conf /etc/newsyslog.d/

 # Reload syslogd to pick up ASL configuration change.
 /usr/bin/killall -HUP syslogd

-# Load kext.
-/sbin/kextload /Library/Extensions/santa-driver.kext
+# Only copy the kext and load santad if running pre-10.15
+if [ $(uname -r | cut -d'.' -f1) -lt 19 ]; then
+  /bin/cp -r ${BINARIES}/santa-driver.kext /Library/Extensions
+  /bin/cp ${CONF}/com.google.santad.plist /Library/LaunchDaemons
+  /bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist
+else
+  /Applications/Santa.app/Contents/MacOS/Santa --load-system-extension
+fi

-# Load santad and scheduled sync jobs.
-/bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist
+# Load the bundle service
+/bin/launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist

 # Load GUI agent if someone is logged in.
-[[ -n "$GUI_USER" ]] && \
-  /bin/launchctl asuser ${GUI_USER} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+if [[ -n "$GUI_USER" ]]; then
+  /bin/launchctl asuser ${GUI_USER} \
+  /bin/launchctl load -w /Library/LaunchAgents/com.google.santa.plist
+fi

 exit 0
--- a/Conf/uninstall.sh
+++ b/Conf/uninstall.sh
@@ -6,27 +6,24 @@

 [ "$EUID" != 0 ] && printf "%s\n" "This requires running as root/sudo." && exit 1

-if [[ -d "binaries" ]]; then
-  SOURCE="."
-elif [[ -d "../binaries" ]]; then
-  SOURCE=".."
-else
-  echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
-  exit 1
-fi
+# For macOS 10.15+ this will block up to 60 seconds
+/Applications/Santa.app/Contents/MacOS/Santa --unload-system-extension

 /bin/launchctl remove com.google.santad
 sleep 1
 /sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
 user=$(/usr/bin/stat -f '%u' /dev/console)
 [[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santa
 # and to clean out the log config, although it won't write after wiping the binary
 /usr/bin/killall -HUP syslogd
 # delete artifacts on-disk
 /bin/rm -rf /Applications/Santa.app
 /bin/rm -rf /Library/Extensions/santa-driver.kext
 /bin/rm -f /Library/LaunchAgents/com.google.santagui.plist
+/bin/rm -f /Library/LaunchAgents/com.google.santa.plist
 /bin/rm -f /Library/LaunchDaemons/com.google.santad.plist
+/bin/rm -f /Library/LaunchDaemons/com.google.santa.bundleservice.plist
 /bin/rm -f /private/etc/asl/com.google.santa.asl.conf
 /bin/rm -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf
 /bin/rm -f /usr/local/bin/santactl # just a symlink
--- a/Docs/development/building.md
+++ b/Docs/development/building.md
@@ -1,108 +0,0 @@
-
-
-# Building
-
-Santa makes use of [rake](https://ruby.github.io/rake/) for building and testing Santa. All of the [releases](https://github.com/google/santa/releases) are made using this same process. Santa's releases are codesigned with Google's KEXT signing certificate. This allows Santa to be loaded with SIP fully enabled.
-
-#### Cloning
-
-Clone the source and change into the directory.
-
-```sh
-git clone https://github.com/google/santa
-cd santa
-```
-
-The above command will default to using the `master` branch. If you wanted to build, run or test a specific version of Santa use this command.
-
-```sh
-git checkout <version, i.e. 0.9.19>
-```
-
-#### Building
-
-Build a debug version of Santa. This keeps all the debug symbols, adds additional logs and does not optimize the compiled output. For speed sensitive tests make sure to benchmark a release version too.
-
-```sh
-rake build:debug
-```
-
-Build a release version of Santa.
-
-```sh
-rake build:release
-```
-
-Both of these just output the binaries that makeup Santa in the default Xcode build location. To actually run  what was built, see the next section.
-
-#### Running
-
-On macOS 10.11+ System Integrity Protection (SIP) prevents loading of kernel extensions that are not signed by an Apple KEXT signing certificate. To be able to load and test a non-release version of Santa, SIP will have to be configured to allow non-Apple KEXT signing certificates.
-
-__This is only to be done a machine that is actively developing, unloading and loading kernel extensions.__
-
-1. Boot into Recovery Mode: Reboot and hold down `command+r`
-2. From the utilities menu select `Terminal`
-3. Disable the KEXT feature of SIP: `csrutil enable --without kext`
-4. Reboot
-
-You should now be able to load and run a non-release version of Santa.
-
-Build and run a debug version of Santa.
-
-```sh
-rake reload:debug
-```
-
-Build and run a release version of Santa.
-
-```sh
-rake reload:release
-```
-
-#### Debugging
-
-Xcode and lldb can be used to debug Santa, just like any other project. Instead of clicking the play button to launch and attach to a process, you can attach to an already running, or soon to by running, component of Santa. To do this select the Debug menu and choose `Attach to Process by PID or Name… `. Below are the four components of Santa and who to debug the process as. 
-
-Note: santa-driver (the kernel extension) cannot be debugged by attaching with Xcode.
-
-Note: Xcode can attach to santad without interruption, however any breakpoints in the decision making codepath can deadlock the machine. Using lldb directly to attach to santad will deadlock the machine.
-
-| process  | user |
-| -------- | ---- |
-| santad   | root |
-| Santa*   | me   |
-| santactl | me   |
-| santabs  | root |
-
-Xcode will then wait for the process to start. Issue this command to restart all the Santa processes in debug mode.
-
-*The Santa (GUI) process is the only component of Santa that can be launched and debugged from Xcode directly. All the other components are launched with privileges and/or are scoped to an XPC service that launchd scopes to a hosting bundle. Thus the need for the `Attach to Process by PID or Name…` technique.  See the [ipc](../details/ipc.md) document for for details.
-
-```sh
-rake reload:debug
-```
-
-Now the process is attached in Xcode and you can debug your day away.
-
-#### Tests
-
-Run all the logic / unit tests
-
-```sh
-rake tests:logic
-```
-
-Run all of santa-driver kernel extension tests
-
-```sh
-rake tests:kernel
-```
-
-#### Releases
-
-Creates a release build of Santa with a version based of the newest tag. Also saves the dsym files for each component of Santa. This makes debugging and interpreting future crashes or kernel panics much easier.
-
-```sh
-rake dist
-```
--- a/Fuzzing/CMakeLists.txt
+++ b/Fuzzing/CMakeLists.txt
@@ -1,25 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-
-set(LIBFUZZER_PATH "${CMAKE_CURRENT_SOURCE_DIR}/libFuzzer/bin/libFuzzer.a")
-
-function(ImportLibFuzzer)
-  add_custom_command(
-    OUTPUT "${LIBFUZZER_PATH}"
-    COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/libFuzzer/build.sh"
-    DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/libFuzzer/build.sh"
-    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libFuzzer"
-    COMMENT "Building libFuzzer..."
-  )
-
-  add_custom_target(libfuzzer_builder DEPENDS "${LIBFUZZER_PATH}")
-endfunction()
-
-function(main)
-  ImportLibFuzzer()
-
-  add_subdirectory(santacache)
-  add_subdirectory(santad)
-  add_subdirectory(santactl)
-endfunction()
-
-main()
--- a/Fuzzing/santacache/CMakeLists.txt
+++ b/Fuzzing/santacache/CMakeLists.txt
@@ -1,35 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(santacache_fuzzer)
-
-set(CMAKE_CXX_STANDARD 11)
-
-function(main)
-  set(PROJECT_SOURCEFILES
-    src/main.cpp
-  )
-
-  add_executable("${PROJECT_NAME}" EXCLUDE_FROM_ALL ${PROJECT_SOURCEFILES})
-
-  add_dependencies("${PROJECT_NAME}" libfuzzer_builder)
-  target_link_libraries("${PROJECT_NAME}" PRIVATE "${LIBFUZZER_PATH}")
- 
-  target_include_directories("${PROJECT_NAME}" PRIVATE
-    "${CMAKE_SOURCE_DIR}/Source/common"
-    "${CMAKE_SOURCE_DIR}/Source/santa-driver"
-  )
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -g -O0 -Wno-deprecated-declarations
-    -fsanitize-coverage=trace-pc-guard
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  target_link_libraries("${PROJECT_NAME}" PRIVATE
-    -fsanitize=address -fno-omit-frame-pointer
-    -mno-omit-leaf-frame-pointer
-  )
-
-  AddFuzzTarget("${PROJECT_NAME}" 16 60 false)
-endfunction()
-
-main()
--- a/Fuzzing/santactl/CMakeLists.txt
+++ b/Fuzzing/santactl/CMakeLists.txt
@@ -1,61 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(santactl_fuzzer)
-
-set(CMAKE_CXX_STANDARD 11)
-
-function(main)
-  set(PROJECT_SOURCEFILES
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncConstants.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncStage.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncState.m"
-
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTRule.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTLogging.m"
-
-    src/main.mm
-  )
-
-  add_executable("${PROJECT_NAME}" EXCLUDE_FROM_ALL ${PROJECT_SOURCEFILES})
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -fobjc-arc -Wno-everything -fmodules -fcxx-modules
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  target_compile_definitions("${PROJECT_NAME}" PRIVATE
-    COCOAPODS=1
-  )
-
-  target_include_directories("${PROJECT_NAME}" PRIVATE
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync"
-    "${CMAKE_SOURCE_DIR}/Source/common"
-    "${CMAKE_SOURCE_DIR}/Source/santad"
-  )
-
-  target_link_libraries("${PROJECT_NAME}" PRIVATE
-    MOLCertificate MOLCodesignChecker
-    MOLAuthenticatingURLSession FMDB MOLFCMClient
-  )
-
-  #
-  # Add libfuzzer
-  #
-
-  add_dependencies("${PROJECT_NAME}" libfuzzer_builder)
-  target_link_libraries("${PROJECT_NAME}" PRIVATE "${LIBFUZZER_PATH}")
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -g -O0 -Wno-deprecated-declarations
-    -fsanitize-coverage=trace-pc-guard
-  )
-
-  target_link_libraries("${PROJECT_NAME}" PRIVATE
-    -fsanitize=address -fno-omit-frame-pointer
-    -mno-omit-leaf-frame-pointer
-  )
-
-  AddFuzzTarget("${PROJECT_NAME}" 428 60 false)
-endfunction()
-
-main()
--- a/Fuzzing/santad/CMakeLists.txt
+++ b/Fuzzing/santad/CMakeLists.txt
@@ -1,109 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(santad_fuzzer)
-
-set(CMAKE_CXX_STANDARD 11)
-
-function(main)
-  GenerateFuzzTarget(src/databaseRuleAddRules.mm 45 60 true)
-  GenerateFuzzTarget(src/checkCacheForVnodeID.mm 16 60 true)
-  GenerateFuzzTarget(src/databaseRemoveEventsWithIDs.mm 80 60 true)
-endfunction()
-
-function(GenerateFuzzTarget source_file data_size timeout run_as_root)
-  # Generate one new project for each source file in the 'src' folder. Copy
-  # the project source files and settings from santactl
-  set(PROJECT_SANTACTLSOURCEFILES
-    "${CMAKE_SOURCE_DIR}/Source/santactl/SNTCommand.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/SNTCommand.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/SNTCommandController.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/SNTCommandController.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Resources/santactl-Info.plist"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandBundleInfo.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandCheckCache.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandFileInfo.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandFlushCache.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandRule.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandStatus.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/SNTCommandVersion.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/NSData+Zlib.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/NSData+Zlib.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSync.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncConstants.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncConstants.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncEventUpload.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncEventUpload.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncLogUpload.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncLogUpload.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncManager.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncManager.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncPostflight.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncPostflight.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncPreflight.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncPreflight.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncStage.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncStage.m"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncState.h"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync/SNTCommandSyncState.m"
-
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTConfigurator.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTFileInfo.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTRule.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTStoredEvent.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTSystemInfo.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCControlInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCSyncdInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTLogging.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTDropRootPrivs.m"
-  )
-
-  get_filename_component(target_name "${source_file}" NAME_WE)
-  set(target_name "santad_${target_name}_fuzzer")
-
-  add_executable("${target_name}" EXCLUDE_FROM_ALL ${source_file} ${PROJECT_SANTACTLSOURCEFILES})
-
-  target_compile_options("${target_name}" PRIVATE
-    -fobjc-arc -Wno-everything -fmodules -fcxx-modules
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  target_compile_definitions("${target_name}" PRIVATE
-    COCOAPODS=1
-  )
-
-  target_include_directories("${target_name}" PRIVATE
-    "${CMAKE_SOURCE_DIR}/Source/santactl"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands"
-    "${CMAKE_SOURCE_DIR}/Source/santactl/Commands/sync"
-    "${CMAKE_SOURCE_DIR}/Source/santad"
-    "${CMAKE_SOURCE_DIR}/Source/common"
-  )
-
-  target_link_libraries("${target_name}" PRIVATE
-    MOLCertificate MOLCodesignChecker
-    MOLAuthenticatingURLSession FMDB MOLFCMClient
-    MOLXPCConnection
-  )
-
-  #
-  # Add libfuzzer
-  #
-
-  add_dependencies("${target_name}" libfuzzer_builder)
-  target_link_libraries("${target_name}" PRIVATE "${LIBFUZZER_PATH}")
-
-  target_compile_options("${target_name}" PRIVATE
-    -g -O0 -Wno-deprecated-declarations
-    -fsanitize-coverage=trace-pc-guard
-  )
-
-  target_link_libraries("${target_name}" PRIVATE
-    -fsanitize=address -fno-omit-frame-pointer
-    -mno-omit-leaf-frame-pointer
-  )
-
-  AddFuzzTarget("${target_name}" ${data_size} ${timeout} ${run_as_root})
-endfunction()
-
-main()
--- a/71
+++ b/71
@@ -1,59 +1,22 @@
-platform :osx, "10.9"

-inhibit_all_warnings!
-
-target :Santa do
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
-  pod 'MOLXPCConnection'
+def common_pods
+   pod 'MOLXPCConnection'
+   pod 'MOLCodesignChecker'
+   pod 'FMDB'
+   pod 'MOLCertificate'
+   pod 'OCMock'
+   pod 'MOLAuthenticatingURLSession'
+   pod 'MOLFCMClient'
 end

-target :santad do
-  pod 'FMDB'
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
-  pod 'MOLXPCConnection'
-  target :santabs do
-    pod 'FMDB'
-    pod 'MOLCertificate'
-    pod 'MOLCodesignChecker'
-    pod 'MOLXPCConnection'
+project './Santa.xcodeproj'
+
+project = Xcodeproj::Project.open "./Santa.xcodeproj"
+project.targets.each do |t|
+  if t.name == "santa-driver"
+      next
+  end
+  target t.name do
+      common_pods
  end
 end
-
-target :santactl do
-  pod 'FMDB'
-  pod 'MOLAuthenticatingURLSession'
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
-  pod 'MOLFCMClient', '~> 1.3'
-  pod 'MOLXPCConnection'
-end
-
-target :LogicTests do
-  pod 'FMDB'
-  pod 'MOLAuthenticatingURLSession'
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
-  pod 'MOLXPCConnection'
-  pod 'OCMock'
-end
-
-post_install do |installer|
-  installer.pods_project.targets.each do |target|
-    target.build_configurations.each do |config|
-      if config.name != 'Release' then
-        break
-      end
-
-      # This is necessary to get FMDB to not NSLog stuff.
-      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= ''
-      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] <<= "NDEBUG=1"
-
-      # Enable more compiler optimizations.
-      config.build_settings['GCC_OPTIMIZATION_LEVEL'] = 'fast'
-      config.build_settings['LLVM_LTO'] = 'YES'
-    end
-  end
-end
-
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -1,24 +1,24 @@
 PODS:
-  - FMDB (2.7.2):
-    - FMDB/standard (= 2.7.2)
-  - FMDB/standard (2.7.2)
+  - FMDB (2.7.5):
+    - FMDB/standard (= 2.7.5)
+  - FMDB/standard (2.7.5)
  - MOLAuthenticatingURLSession (2.4):
    - MOLCertificate (~> 1.8)
  - MOLCertificate (1.9)
  - MOLCodesignChecker (1.10):
    - MOLCertificate (~> 1.8)
-  - MOLFCMClient (1.7):
+  - MOLFCMClient (1.8):
    - MOLAuthenticatingURLSession (~> 2.4)
  - MOLXPCConnection (1.2):
    - MOLCodesignChecker (~> 1.9)
-  - OCMock (3.4.1)
+  - OCMock (3.4.3)

 DEPENDENCIES:
  - FMDB
  - MOLAuthenticatingURLSession
  - MOLCertificate
  - MOLCodesignChecker
-  - MOLFCMClient (~> 1.3)
+  - MOLFCMClient
  - MOLXPCConnection
  - OCMock

@@ -33,14 +33,14 @@ SPEC REPOS:
    - OCMock

 SPEC CHECKSUMS:
-  FMDB: 6198a90e7b6900cfc046e6bc0ef6ebb7be9236aa
+  FMDB: 2ce00b547f966261cd18927a3ddb07cb6f3db82a
  MOLAuthenticatingURLSession: c238aa1c9a7b1077eb39a6f40204bfe76a7d204e
  MOLCertificate: e9e88a396c57032cab847f51a46e20c730cd752a
  MOLCodesignChecker: b0d5db9d2f9bd94e0fd093891a5d40e5ad77cbc0
-  MOLFCMClient: ee45348909351f232e2759c580329072ae7e02d4
+  MOLFCMClient: 2bfbacd45cc11e1ca3c077e97b80401c4e4a54f1
  MOLXPCConnection: c27af5cb1c43b18319698b0e568a8ddc2fc1e306
-  OCMock: 2cd0716969bab32a2283ff3a46fd26a8c8b4c5e3
+  OCMock: 43565190abc78977ad44a61c0d20d7f0784d35ab

-PODFILE CHECKSUM: ddca043a7ace9ec600c108621c56d13a50d17236
+PODFILE CHECKSUM: d03767a9915896232523962c98d9ff7294aec2b7

-COCOAPODS: 1.5.3
+COCOAPODS: 1.7.5
--- a/README.md
+++ b/README.md
@@ -1,54 +1,82 @@
-Santa
-[![Build Status](https://travis-ci.org/google/santa.png?branch=master)](https://travis-ci.org/google/santa)
-[![Documentation Status](https://readthedocs.org/projects/santa/badge/?version=latest)](https://santa.readthedocs.io/en/latest/?badge=latest)
-=====
+# Santa [![Build Status][build-status-img]][build-status-link] [![Documentation Status][doc-status-img]][doc-status-link]
+
+[build-status-img]: https://travis-ci.org/google/santa.png?branch=master
+[build-status-link]: https://travis-ci.org/google/santa
+[doc-status-img]: https://readthedocs.org/projects/santa/badge/?version=latest
+[doc-status-link]: https://santa.readthedocs.io/en/latest/?badge=latest

 <p align="center">
-<a href="#santa--">
-<img src="./Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
-</a>
+    <img src="./Source/santa/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
 </p>

-Santa is a binary whitelisting/blacklisting system for macOS. It consists of
-a kernel extension that monitors for executions, a userland daemon that makes
-execution decisions based on the contents of a SQLite database, a GUI agent that
-notifies the user in case of a block decision and a command-line utility for
-managing the system and synchronizing the database with a server.
-
-Santa is not yet at 1.0. We're writing more tests, fixing bugs, working on TODOs
-and finishing up a security audit.
+Santa is a binary whitelisting/blacklisting system for macOS. It consists of a
+kernel extension that monitors for executions, a userland daemon that makes
+execution decisions based on the contents of a SQLite database, a GUI agent
+that notifies the user in case of a block decision and a command-line utility
+for managing the system and synchronizing the database with a server.

 It is named Santa because it keeps track of binaries that are naughty or nice.

 Santa is a project of Google's Macintosh Operations Team.

-Docs
-========
-The Santa docs are stored in the [Docs](https://github.com/google/santa/blob/master/Docs) directory. A Read the Docs instance is available here: https://santa.readthedocs.io.
+# Docs

-Admin-Related Features
-========
+The Santa docs are stored in the
+[Docs](https://github.com/google/santa/blob/master/docs) directory. A Read the
+Docs instance is available here: https://santa.readthedocs.io.

-* Multiple modes: In the default MONITOR mode, all binaries except 
-those marked as blacklisted will be allowed to run, whilst being logged and recorded in the events database. In LOCKDOWN mode, only whitelisted binaries are
-allowed to run.
+The docs include deployment options, details on how parts of Santa work and
+instructions for developing Santa itself.

-* Event logging: When the kext is loaded, all binary launches are logged.
-When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.
+# Get Help

-* Certificate-based rules, with override levels: Instead of relying on a binary's hash (or 'fingerprint'), executables can be whitelisted/blacklisted by their signing
-certificate. You can therefore trust/block all binaries by a given publisher that were signed with that cert across version updates. A
-binary can only be whitelisted by its certificate if its signature validates
-correctly, but a rule for a binary's fingerprint will override a decision for a
-certificate; i.e. you can whitelist a certificate while blacklisting a binary
-signed with that certificate, or vice-versa.
+If you have questions or otherwise need help getting started,
+the [santa-dev](https://groups.google.com/forum/#!forum/santa-dev) group is a
+great place.

-* Path-based rules (via NSRegularExpression/ICU): This allows a similar feature to that found in Managed Client (the precursor to configuration profiles, which used the same implementation mechanism), Application Launch Restrictions via the mcxalr binary. This implementation carries the added benefit of being configurable via regex, and not relying on LaunchServices. As detailed in the wiki, when evaluating rules this holds the lowest precedence.
+If you believe you have a bug, feel free to report [an
+issue](https://github.com/google/santa/isues) and we'll respond as soon as we
+can.

-* Failsafe cert rules: You cannot put in a deny rule that would block the certificate used to sign launchd, a.k.a. pid 1, and therefore all components used in macOS. The binaries in every OS update (and in some cases entire new versions) are therefore auto-whitelisted. This does not affect binaries from Apple's App Store, which use various certs that change regularly for common apps. Likewise, you cannot blacklist Santa itself, and Santa uses a distinct separate cert than other Google apps.

-Intentions and Expectations
-===========================
+# Admin-Related Features
+
+* Multiple modes: In the default MONITOR mode, all binaries except those marked
+  as blacklisted will be allowed to run, whilst being logged and recorded in
+  the events database. In LOCKDOWN mode, only whitelisted binaries are allowed
+  to run.
+
+* Event logging: When the kext is loaded, all binary launches are logged.  When
+  in either mode, all unknown or denied binaries are stored in the database to
+  enable later aggregation.
+
+* Certificate-based rules, with override levels: Instead of relying on a
+  binary's hash (or 'fingerprint'), executables can be whitelisted/blacklisted
+  by their signing certificate. You can therefore trust/block all binaries by a
+  given publisher that were signed with that cert across version updates. A
+  binary can only be whitelisted by its certificate if its signature validates
+  correctly, but a rule for a binary's fingerprint will override a decision for
+  a certificate; i.e. you can whitelist a certificate while blacklisting a
+  binary signed with that certificate, or vice-versa.
+
+* Path-based rules (via NSRegularExpression/ICU): This allows a similar feature
+  to that found in Managed Client (the precursor to configuration profiles,
+  which used the same implementation mechanism), Application Launch
+  Restrictions via the mcxalr binary. This implementation carries the added
+  benefit of being configurable via regex, and not relying on LaunchServices.
+  As detailed in the wiki, when evaluating rules this holds the lowest
+  precedence.
+
+* Failsafe cert rules: You cannot put in a deny rule that would block the
+  certificate used to sign launchd, a.k.a. pid 1, and therefore all components
+  used in macOS. The binaries in every OS update (and in some cases entire new
+  versions) are therefore auto-whitelisted. This does not affect binaries from
+  Apple's App Store, which use various certs that change regularly for common
+  apps. Likewise, you cannot blacklist Santa itself, and Santa uses a distinct
+  separate cert than other Google apps.
+
+# Intentions and Expectations
+
 No single system or process will stop *all* attacks, or provide 100% security.
 Santa is written with the intention of helping protect users from themselves.
 People often download malware and trust it, giving the malware credentials, or
@@ -57,139 +85,99 @@ centrally managed component, Santa can help stop the spread of malware among a
 large fleet of machines. Independently, Santa can aid in analyzing what is
 running on your computer.

-Santa is part of a defense-in-depth strategy, and you should continue to protect
-hosts in whatever other ways you see fit.
+Santa is part of a defense-in-depth strategy, and you should continue to
+protect hosts in whatever other ways you see fit.

-Get Help
-========
-If you have questions or otherwise need help getting started, the
-[santa-dev](https://groups.google.com/forum/#!forum/santa-dev) group is a
-great place. Please consult the [wiki](https://github.com/google/santa/wiki) and [issues](https://github.com/google/santa/issues) as well.
+# Security and Performance-Related Features

-Security and Performance-Related Features
-============
 * In-kernel caching: whitelisted binaries are cached in the kernel so the
-processing required to make a request is only done if the binary
-isn't already cached.
+  processing required to make a request is only done if the binary isn't
+  already cached.

 * Userland components validate each other: each of the userland components (the
-daemon, the GUI agent and the command-line utility) communicate with each other
-using XPC and check that their signing certificates are identical before any
-communication is accepted.
+  daemon, the GUI agent and the command-line utility) communicate with each
+  other using XPC and check that their signing certificates are identical
+  before any communication is accepted.

 * Kext uses only KPIs: the kernel extension only uses provided kernel
-programming interfaces to do its job. This means that the kext code should
-continue to work across OS versions.
+  programming interfaces to do its job. This means that the kext code should
+  continue to work across OS versions.

-Known Issues
-============
-Santa is not yet at 1.0 and we have some known issues to be aware of:
+# Known Issues

 * Santa only blocks execution (execve and variants), it doesn't protect against
-dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or
-libraries loaded using `DYLD_INSERT_LIBRARIES`. As of version 0.9.1 we *do* address [__PAGEZERO missing issues](b87482e) that were exploited in some versions of macOS. We are working on also protecting against similar avenues of attack.
+  dynamic libraries loaded with dlopen, libraries on disk that have been
+  replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`. As of version
+  0.9.1 we *do* address [__PAGEZERO missing issues](b87482e) that were
+  exploited in some versions of macOS. We are working on also protecting
+  against similar avenues of attack.

 * Kext communication security: the kext will only accept a connection from a
-single client at a time and said client must be running as root. We haven't yet
-found a good way to ensure the kext only accepts connections from a valid client.
+  single client at a time and said client must be running as root. We haven't
+  yet found a good way to ensure the kext only accepts connections from a valid
+  client.

-* Database protection: the SQLite database is installed with permissions so that
-only the root user can read/write it. We're considering approaches to secure
-this further.
-
-* Sync client: The `santactl` command-line client includes a flag to synchronize with a management server, which uploads events that have occurred on the
-machine and downloads new rules. There are several open-source servers you can sync with:
-
-    * [Upvote](https://github.com/google/upvote) - An AppEngine-based server that implements social voting to make managing a large fleet easier.
-    * [Moroz](https://github.com/groob/moroz) - A simple golang server that serves hardcoded rules from simple configuration files.
-    * [Zentral](https://github.com/zentralopensource/zentral/wiki) - A centralized service that pulls data from multiple sources and deploy configurations to multiple services.
+* Database protection: the SQLite database is installed with permissions so
+  that only the root user can read/write it. We're considering approaches to
+  secure this further.

 * Scripts: Santa is currently written to ignore any execution that isn't a
-binary. This is because after weighing the administration cost vs the benefit,
-we found it wasn't worthwhile. Additionally, a number of applications make use
-of temporary generated scripts, which we can't possibly whitelist and not doing
-so would cause problems. We're happy to revisit this (or at least make it an
-option) if it would be useful to others.
+  binary. This is because after weighing the administration cost vs the
+  benefit, we found it wasn't worthwhile. Additionally, a number of
+  applications make use of temporary generated scripts, which we can't possibly
+  whitelist and not doing so would cause problems. We're happy to revisit this
+  (or at least make it an option) if it would be useful to others.

-* Documentation: This is currently limited.
+# Sync Servers

-* Tests: There aren't enough of them.
+* The `santactl` command-line client includes a flag to synchronize with a
+  management server, which uploads events that have occurred on the machine and
+  downloads new rules. There are several open-source servers you can sync with:

-Screenshots
-===========
+    * [Upvote](https://github.com/google/upvote) - An AppEngine-based server
+      that implements social voting to make managing a large fleet easier.
+    * [Moroz](https://github.com/groob/moroz) - A simple golang server that
+      serves hardcoded rules from simple configuration files.
+    * [Zentral](https://github.com/zentralopensource/zentral/wiki) - A
+      centralized service that pulls data from multiple sources and deploy
+      configurations to multiple services.

-A tool like Santa doesn't really lend itself to screenshots, so here's a video instead.
+* Alternatively, `santactl` can configure rules locally (without a sync
+  server).

-<p align="center">
-<img src="https://zippy.gfycat.com/MadFatalAmphiuma.gif" alt="Santa Block Video" />
-</p>
+# Screenshots

-Building with Xcode
-========
+A tool like Santa doesn't really lend itself to screenshots, so here's a video
+instead.

-```sh
-git clone https://github.com/google/santa
-cd santa
+<p align="center"> <img src="https://zippy.gfycat.com/MadFatalAmphiuma.gif"
+alt="Santa Block Video" /> </p>

-# Build a debug build. This will install any necessary CocoaPods, create the
-# workspace and build, outputting the full log only if an error occurred.
-# If CocoaPods is not installed, you'll be prompted to install it.
-#
-# For other build/install/run options, run rake without any arguments
-rake build:debug
-```
-
-Note: the Xcode project is setup to use any installed "Mac Developer" certificate
-and for security-reasons parts of Santa will not operate properly if not signed.
-
-For more details on building see the [building.md](https://github.com/google/santa/blob/master/Docs/development/building.md) document.
-
-Building with CMake
-========
-### General steps
-1. Install Xcode and the command line tools
-2. Install CMake using homebrew
-3. Clone the santa source code repository
-4. Set the signing key
-5. Create a build folder and configure the project
-6. Run make
-
-Example
-git clone https://github.com/google/santa.git
-mkdir build
-cd build
-
-export CODESIGN_IDENTITY=XXX
-cmake ../santa
-
-make -j `sysctl -n hw.ncpu`
-The CODESIGN_IDENTITY parameter can also be passed directly to CMake: cmake -DCODESIGN_IDENTITY=XXX /path/to/source/code
-
-Kext Signing
-============
+# Kext Signing
 Kernel extensions on macOS 10.9 and later must be signed using an Apple-provided
 Developer ID certificate with a kernel extension flag. Without it, the only way
-to load an extension is to enable kext-dev-mode or disable SIP, depending on the
-OS version.
+to load an extension is to enable kext-dev-mode or disable SIP, depending on
+the OS version.

 There are two possible solutions for this, for distribution purposes:

-1) Use a [pre-built, pre-signed version](https://github.com/google/santa/releases)
-of the kext that we supply. Each time changes are made to the kext code we will
-update the pre-built version that you can make use of. This doesn't prevent you
-from making changes to the non-kext parts of Santa and distributing those.
-If you make changes to the kext and make a pull request, we can merge them in
-and distribute a new version of the pre-signed kext.
+1) Use a [pre-built, pre-signed
+version](https://github.com/google/santa/releases) of the kext that we supply.
+Each time changes are made to the kext code we will update the pre-built
+version that you can make use of. This doesn't prevent you from making changes
+to the non-kext parts of Santa and distributing those.  If you make changes to
+the kext and make a pull request, we can merge them in and distribute a new
+version of the pre-signed kext.

-2) Apply for your own [kext signing certificate](https://developer.apple.com/contact/kext/).
-Apple will only grant this for broad distribution within an organization, they
-won't issue them just for testing purposes.
+2) Apply for your own [kext signing
+certificate](https://developer.apple.com/contact/kext/).  Apple will only grant
+this for broad distribution within an organization, they won't issue them just
+for testing purposes.

-Contributing
-============
-Patches to this project are very much welcome. Please see the [CONTRIBUTING](https://github.com/google/santa/blob/master/CONTRIBUTING.md)
+# Contributing
+Patches to this project are very much welcome. Please see the
+[CONTRIBUTING](https://github.com/google/santa/blob/master/CONTRIBUTING.md)
 file.

-Disclaimer
-==========
+# Disclaimer
 This is **not** an official Google product.
--- a/214
+++ b/214
@@ -1,214 +0,0 @@
-require 'openssl'
-
-WORKSPACE           = 'Santa.xcworkspace'
-DEFAULT_SCHEME      = 'All'
-OUTPUT_PATH         = 'Build'
-BINARIES            = ['Santa.app', 'santa-driver.kext']
-DSYMS               = ['Santa.app.dSYM', 'santa-driver.kext.dSYM', 'santad.dSYM', 'santactl.dSYM']
-XCPRETTY_DEFAULTS   = '-sc'
-XCODEBUILD_DEFAULTS = "-workspace #{WORKSPACE} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"
-DEVTEAM_FILE        = 'Source/DevelopmentTeam.xcconfig'
-DEVTEAM_CERT_CN     = 'Mac Developer'
-$DISABLE_XCPRETTY   = false
-
-task :default do
-  system("rake -sT")
-end
-
-def xcodebuild(opts)
-  command = "xcodebuild #{XCODEBUILD_DEFAULTS} #{opts}"
-  if not $DISABLE_XCPRETTY
-    command << " | xcpretty #{XCPRETTY_DEFAULTS} && exit ${PIPESTATUS[0]}"
-  end
-
-  if system command
-    puts "\e[32mPass\e[0m"
-  else
-    raise "\e[31mFail\e[0m"
-  end
-end
-
-def xcodebuilddir
-  if not $xcode_build_dir
-    output = `xcodebuild #{XCODEBUILD_DEFAULTS} -scheme All -showBuildSettings`
-    if match = output.match(/BUILD_DIR = (.*)/)
-        $xcode_build_dir = match.captures.first
-        puts "Found Xcode build dir #{$xcode_build_dir}"
-    end
-  end
-  $xcode_build_dir
-end
-
-task :init do
-  unless File.exists?(WORKSPACE) and File.exists?('Pods')
-    puts "Pods missing, running 'pod install'"
-    system "pod install" or raise "CocoaPods is not installed. Install with 'sudo gem install cocoapods'"
-  end
-  unless system 'xcpretty -v >/dev/null 2>&1'
-    puts "xcpretty is not installed. Install with 'sudo gem install xcpretty'"
-    $DISABLE_XCPRETTY = true
-  end
-  cert_pem = `security find-certificate -p -c '#{DEVTEAM_CERT_CN}'`
-  cert = OpenSSL::X509::Certificate.new cert_pem
-  team_id = cert.subject.to_a.find {|f| f[0] == "OU"}[1]
-  File.open(DEVTEAM_FILE, 'w') { |f|
-    f.puts("// This file is auto-generated. Do not edit manually")
-    f.puts("DEVELOPMENT_TEAM = #{team_id}")
-  }
-end
-
-task :remove_existing do
-  system 'sudo rm -rf /Library/Extensions/santa-driver.kext'
-  system 'sudo rm -rf /Applications/Santa.app'
-end
-
-desc "Clean"
-task :clean => :init do
-  puts "Cleaning"
-  FileUtils.rm_rf(OUTPUT_PATH)
-  xcodebuild("-scheme All clean")
-end
-
-# Build
-namespace :build do
-  desc "Build: Debug"
-  task :debug do
-    Rake::Task['build:build'].invoke("Debug")
-  end
-
-  desc "Build: Release"
-  task :release do
-    Rake::Task['build:build'].invoke("Release")
-  end
-
-  task :build, [:configuration] => :init do |t, args|
-    config = args[:configuration]
-    puts "Building with configuration: #{config}"
-    xcodebuild("-scheme All -configuration #{config} build")
-  end
-end
-
-
-# Install
-namespace :install do
-  desc "Install: Debug"
-  task :debug do
-    Rake::Task['install:install'].invoke("Debug")
-  end
-
-  desc "Install: Release"
-  task :release do
-    Rake::Task['install:install'].invoke("Release")
-  end
-
-  task :install, [:configuration] do |t, args|
-    config = args[:configuration]
-    system 'sudo cp conf/com.google.santad.plist /Library/LaunchDaemons'
-    system 'sudo cp conf/com.google.santagui.plist /Library/LaunchAgents'
-    system 'sudo cp conf/com.google.santa.asl.conf /etc/asl'
-    system 'sudo cp conf/com.google.santa.newsyslog.conf /etc/newsyslog.d/'
-    system '/usr/bin/killall -HUP syslogd'
-    Rake::Task['build:build'].invoke(config)
-    puts "Installing with configuration: #{config}"
-    Rake::Task['remove_existing'].invoke()
-    system "sudo cp -r #{xcodebuilddir}/#{config}/santa-driver.kext /Library/Extensions"
-    system "sudo cp -r #{xcodebuilddir}/#{config}/Santa.app /Applications"
-  end
-end
-
-# Dist
-task :dist do
-  desc "Create distribution folder"
-
-  Rake::Task['clean'].invoke()
-  Rake::Task['build:build'].invoke("Release")
-
-  dist_path = "santa-#{`defaults read #{xcodebuilddir}/Release/santa-driver.kext/Contents/Info.plist CFBundleVersion`.strip}"
-
-  FileUtils.rm_rf(dist_path)
-
-  FileUtils.mkdir_p("#{dist_path}/binaries")
-  FileUtils.mkdir_p("#{dist_path}/conf")
-  FileUtils.mkdir_p("#{dist_path}/dsym")
-
-  BINARIES.each do |x|
-    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/binaries")
-  end
-
-  DSYMS.each do |x|
-    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/dsym")
-  end
-
-
-  Dir.glob("Conf/*") {|x| File.directory?(x) or FileUtils.cp(x, "#{dist_path}/conf")}
-
-  puts "Distribution folder #{dist_path} created"
-end
-
-# Tests
-namespace :tests do
-  desc "Tests: Logic"
-  task :logic => [:init] do
-    puts "Running logic tests"
-    xcodebuild("-scheme LogicTests test")
-  end
-
-  desc "Tests: Kernel"
-  task :kernel do
-    Rake::Task['build:debug'].invoke()
-    system "sudo #{xcodebuilddir}/Debug/KernelTests"
-  end
-end
-
-# Load/Unload
-task :unload_daemon do
-  puts "Unloading daemon"
-  system "sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist 2>/dev/null"
-end
-
-task :unload_kext do
-  puts "Unloading kernel extension"
-  system "sudo kextunload -b com.google.santa-driver 2>/dev/null"
-end
-
-task :unload_gui do
-  puts "Unloading GUI agent"
-  system "launchctl unload /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
-end
-
-desc "Unload"
-task :unload => [:unload_daemon, :unload_kext, :unload_gui]
-
-task :load_daemon do
-  puts "Loading daemon"
-  system "sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist"
-end
-
-task :load_kext do
-  puts "Loading kernel extension"
-  system "sudo kextload /Library/Extensions/santa-driver.kext"
-end
-
-task :load_gui do
-  puts "Loading GUI agent"
-  system "launchctl load /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
-end
-
-desc "Load"
-task :load => [:load_kext, :load_daemon, :load_gui]
-
-namespace :reload do
-  desc "Reload: Debug"
-  task :debug do
-    Rake::Task['unload'].invoke()
-    Rake::Task['install:debug'].invoke()
-    Rake::Task['load'].invoke()
-  end
-
-  desc "Reload: Release"
-  task :release do
-    Rake::Task['unload'].invoke()
-    Rake::Task['install:release'].invoke()
-    Rake::Task['load'].invoke()
-  end
-end
--- a/Santa.xcodeproj/project.pbxproj
+++ b/Santa.xcodeproj/project.pbxproj
--- a/Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme
@@ -1,84 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D91BCDC174E8AE600131A7D"
-               BuildableName = "All"
-               BlueprintName = "All"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      codeCoverageEnabled = "YES"
-      enableAddressSanitizer = "YES">
-      <Testables>
-         <TestableReference
-            skipped = "NO">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-               BuildableName = "LogicTests.xctest"
-               BlueprintName = "LogicTests"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D91BCDC174E8AE600131A7D"
-            BuildableName = "All"
-            BlueprintName = "All"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme
@@ -1,94 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
-               BuildableName = "KernelTests"
-               BlueprintName = "KernelTests"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-      </Testables>
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
-            BuildableName = "KernelTests"
-            BlueprintName = "KernelTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      debugAsWhichUser = "root"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
-            BuildableName = "KernelTests"
-            BlueprintName = "KernelTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
-            BuildableName = "KernelTests"
-            BlueprintName = "KernelTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme
@@ -1,101 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "NO"
-            buildForArchiving = "NO"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-               BuildableName = "LogicTests.xctest"
-               BlueprintName = "LogicTests"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-         <TestableReference
-            skipped = "NO">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-               BuildableName = "LogicTests.xctest"
-               BlueprintName = "LogicTests"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-      </Testables>
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-            BuildableName = "LogicTests.xctest"
-            BlueprintName = "LogicTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-            BuildableName = "LogicTests.xctest"
-            BlueprintName = "LogicTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
-            BuildableName = "LogicTests.xctest"
-            BlueprintName = "LogicTests"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0910"
+   LastUpgradeVersion = "1100"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -14,7 +14,7 @@
            buildForAnalyzing = "YES">
            <BuildableReference
               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+               BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
               BuildableName = "Santa.app"
               BlueprintName = "Santa"
               ReferencedContainer = "container:Santa.xcodeproj">
@@ -26,27 +26,14 @@
      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
-            BuildableName = "Santa.app"
-            BlueprintName = "Santa"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
   </TestAction>
   <LaunchAction
      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
      ignoresPersistentStateOnLaunch = "NO"
@@ -57,14 +44,12 @@
         runnableDebuggingMode = "0">
         <BuildableReference
            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+            BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
            BuildableName = "Santa.app"
            BlueprintName = "Santa"
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </BuildableProductRunnable>
-      <AdditionalOptions>
-      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
      buildConfiguration = "Release"
@@ -76,7 +61,7 @@
         runnableDebuggingMode = "0">
         <BuildableReference
            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+            BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
            BuildableName = "Santa.app"
            BlueprintName = "Santa"
            ReferencedContainer = "container:Santa.xcodeproj">
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme
@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D91BCB3174E8A7E00131A7D"
-               BuildableName = "santa-driver.kext"
-               BlueprintName = "santa-driver"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-      </Testables>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D91BCB3174E8A7E00131A7D"
-            BuildableName = "santa-driver.kext"
-            BlueprintName = "santa-driver"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santabs.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santabs.xcscheme
@@ -1,82 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
-               BuildableName = "santabs.xpc"
-               BlueprintName = "santabs"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-      </Testables>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
-            BuildableName = "santabs.xpc"
-            BlueprintName = "santabs"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "C78227531E1C3C58006EB2D6"
-            BuildableName = "santabs.xpc"
-            BlueprintName = "santabs"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme
@@ -1,93 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Scheme
-   LastUpgradeVersion = "0910"
-   version = "1.3">
-   <BuildAction
-      parallelizeBuildables = "YES"
-      buildImplicitDependencies = "YES">
-      <BuildActionEntries>
-         <BuildActionEntry
-            buildForTesting = "YES"
-            buildForRunning = "YES"
-            buildForProfiling = "YES"
-            buildForArchiving = "YES"
-            buildForAnalyzing = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
-               BuildableName = "santactl"
-               BlueprintName = "santactl"
-               ReferencedContainer = "container:Santa.xcodeproj">
-            </BuildableReference>
-         </BuildActionEntry>
-      </BuildActionEntries>
-   </BuildAction>
-   <TestAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      shouldUseLaunchSchemeArgsEnv = "YES">
-      <Testables>
-      </Testables>
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
-            BuildableName = "santactl"
-            BlueprintName = "santactl"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </TestAction>
-   <LaunchAction
-      buildConfiguration = "Debug"
-      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
-      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
-      launchStyle = "0"
-      useCustomWorkingDirectory = "NO"
-      ignoresPersistentStateOnLaunch = "NO"
-      debugDocumentVersioning = "YES"
-      debugServiceExtension = "internal"
-      allowLocationSimulation = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
-            BuildableName = "santactl"
-            BlueprintName = "santactl"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-      <AdditionalOptions>
-      </AdditionalOptions>
-   </LaunchAction>
-   <ProfileAction
-      buildConfiguration = "Release"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      savedToolIdentifier = ""
-      useCustomWorkingDirectory = "NO"
-      debugDocumentVersioning = "YES">
-      <BuildableProductRunnable
-         runnableDebuggingMode = "0">
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
-            BuildableName = "santactl"
-            BlueprintName = "santactl"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </BuildableProductRunnable>
-   </ProfileAction>
-   <AnalyzeAction
-      buildConfiguration = "Debug">
-   </AnalyzeAction>
-   <ArchiveAction
-      buildConfiguration = "Release"
-      revealArchiveInOrganizer = "YES">
-   </ArchiveAction>
-</Scheme>
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0910"
+   LastUpgradeVersion = "1100"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -14,9 +14,9 @@
            buildForAnalyzing = "YES">
            <BuildableReference
               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
-               BuildableName = "santad"
-               BlueprintName = "santad"
+               BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+               BuildableName = "com.google.santa.daemon"
+               BlueprintName = "com.google.santa.daemon"
               ReferencedContainer = "container:Santa.xcodeproj">
            </BuildableReference>
         </BuildActionEntry>
@@ -26,28 +26,15 @@
      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      language = ""
      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
-      <MacroExpansion>
-         <BuildableReference
-            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
-            BuildableName = "santad"
-            BlueprintName = "santad"
-            ReferencedContainer = "container:Santa.xcodeproj">
-         </BuildableReference>
-      </MacroExpansion>
-      <AdditionalOptions>
-      </AdditionalOptions>
   </TestAction>
   <LaunchAction
      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      debugAsWhichUser = "root"
-      language = ""
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
      ignoresPersistentStateOnLaunch = "NO"
@@ -58,14 +45,12 @@
         runnableDebuggingMode = "0">
         <BuildableReference
            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
-            BuildableName = "santad"
-            BlueprintName = "santad"
+            BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+            BuildableName = "com.google.santa.daemon"
+            BlueprintName = "com.google.santa.daemon"
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </BuildableProductRunnable>
-      <AdditionalOptions>
-      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
      buildConfiguration = "Release"
@@ -77,9 +62,9 @@
         runnableDebuggingMode = "0">
         <BuildableReference
            BuildableIdentifier = "primary"
-            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
-            BuildableName = "santad"
-            BlueprintName = "santad"
+            BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+            BuildableName = "com.google.santa.daemon"
+            BlueprintName = "com.google.santa.daemon"
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </BuildableProductRunnable>
--- a/Santa.xcworkspace/contents.xcworkspacedata
+++ b/Santa.xcworkspace/contents.xcworkspacedata
@@ -1 +1,10 @@
-<?xml version='1.0' encoding='UTF-8'?><Workspace version='1.0'><FileRef location='group:Santa.xcodeproj'/><FileRef location='group:Pods/Pods.xcodeproj'/></Workspace>
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "group:Santa.xcodeproj">
+   </FileRef>
+   <FileRef
+      location = "group:Pods/Pods.xcodeproj">
+   </FileRef>
+</Workspace>
--- a/Source/SantaGUI/CMakeLists.txt
+++ b/Source/SantaGUI/CMakeLists.txt
@@ -1,139 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(Santa)
-
-function(CompileXib output_file_path_variable input_file_path)
-  get_filename_component(input_file_name "${input_file_path}" NAME_WE)
-  set(output_file_path "${CMAKE_CURRENT_BINARY_DIR}/${input_file_name}.nib")
-
-  add_custom_command(
-    OUTPUT "${output_file_path}"
-    COMMAND ibtool --compile "${output_file_path}" "${input_file_path}"
-    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
-    COMMENT "Compiling: ${input_file_path}"
-  )
-
-  set("${output_file_path_variable}" "${output_file_path}" PARENT_SCOPE)
-endfunction()
-
-# It is important to only use absolute file paths with actool
-function(CompileAssets asset_file_list_variable)
-  set(asset_file_list
-    "${CMAKE_CURRENT_BINARY_DIR}/AppIcon.icns"
-    "${CMAKE_CURRENT_BINARY_DIR}/Assets.car"
-  )
-
-  add_custom_command(
-    OUTPUT ${asset_file_list}
-    COMMAND xcrun actool --output-format=human-readable-text --notices --warnings --errors --platform macosx --minimum-deployment-target ${MACOSX_VERSION_MIN} --target-device mac --app-icon AppIcon --output-partial-info-plist "${CMAKE_CURRENT_BINARY_DIR}/Assets.plist" --compile "${CMAKE_CURRENT_BINARY_DIR}" "${CMAKE_CURRENT_SOURCE_DIR}/Resources/Images.xcassets"
-    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
-    COMMENT "Packaging resources"
-  )
-
-  set("${asset_file_list_variable}" ${asset_file_list} PARENT_SCOPE)
-endfunction()
-
-function(main)
-  # Include all files to make IDEs happy
-  set(PROJECT_SOURCEFILES
-    SNTAboutWindowController.h
-    SNTAboutWindowController.m
-
-    SNTAccessibleTextField.h
-    SNTAccessibleTextField.m
-
-    SNTAppDelegate.h
-    SNTAppDelegate.m
-
-    SNTMessageWindow.h
-    SNTMessageWindow.m
-
-    SNTMessageWindowController.h
-    SNTMessageWindowController.m
-
-    SNTNotificationManager.h
-    SNTNotificationManager.m
-
-    main.m
-
-    # The "common" folder contains some of the files required to build this target
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTConfigurator.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCControlInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCUnprivilegedControlInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTBlockMessage.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTRule.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTStoredEvent.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTSystemInfo.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCBundleServiceInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTXPCNotifierInterface.m"
-    "${CMAKE_SOURCE_DIR}/Source/common/SNTLogging.m"
-  )
-
-  set(PROJECT_XIBFILES
-    "${CMAKE_CURRENT_SOURCE_DIR}/Resources/AboutWindow.xib"
-    "${CMAKE_CURRENT_SOURCE_DIR}/Resources/MessageWindow.xib"
-  )
-
-  foreach(xib_file ${PROJECT_XIBFILES})
-    CompileXib(output_nib_file_path "${xib_file}")
-
-    list(APPEND PROJECT_RESOURCES "${output_nib_file_path}")
-    list(APPEND PROJECT_SOURCEFILES "${output_nib_file_path}")
-  endforeach()
-
-  CompileAssets(asset_file_list)
-  foreach(asset_file ${asset_file_list})
-    list(APPEND PROJECT_RESOURCES "${asset_file}")
-    list(APPEND PROJECT_SOURCEFILES "${asset_file}")
-  endforeach()
-
-  add_executable("${PROJECT_NAME}" MACOSX_BUNDLE ${PROJECT_SOURCEFILES})
-  target_link_libraries("${PROJECT_NAME}" PRIVATE -ObjC)
-
-  set_target_properties("${PROJECT_NAME}" PROPERTIES
-    MACOSX_BUNDLE_GUI_IDENTIFIER "com.google.SantaGUI"
-    MACOSX_BUNDLE_INFO_PLIST "${CMAKE_CURRENT_SOURCE_DIR}/Resources/SantaGUI-Info.plist"
-    RESOURCE "${PROJECT_RESOURCES}"
-  )
-
-  target_link_libraries("${PROJECT_NAME}" PRIVATE
-    MOLCertificate MOLCodesignChecker MOLXPCConnection
-
-    "-framework Cocoa"
-  )
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -fobjc-arc -Wno-everything -fmodules
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  if(CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
-    target_compile_options("${PROJECT_NAME}" PRIVATE -g3)
-  endif()
-
-  target_compile_definitions("${PROJECT_NAME}" PRIVATE
-    COCOAPODS=1
-    SANTAGUI=1
-  )
-
-  if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-    target_compile_definitions("${PROJECT_NAME}" PRIVATE DEBUG=1)
-  else()
-    target_compile_definitions("${PROJECT_NAME}" PRIVATE NDEBUG=1)
-  endif()
-
-  target_include_directories("${PROJECT_NAME}" PRIVATE
-    "${CMAKE_SOURCE_DIR}/Source/SantaGUI"
-    "${CMAKE_SOURCE_DIR}/Source/common"
-    "${CMAKE_SOURCE_DIR}/Source/santad"
-  )
-
-  add_custom_command(TARGET "${PROJECT_NAME}" POST_BUILD
-    COMMAND codesign --force --verify --verbose --sign "${CODESIGN_IDENTITY}" "${CMAKE_BINARY_DIR}/Source/SantaGUI/Santa.app"
-    COMMENT "Signing ${PROJECT_NAME} with the following identity: ${CODESIGN_IDENTITY}"
-  )
-
-  # Ignore errors about the missing RESOURCE destination missing; this is a cmake bug
-  install(TARGETS "${PROJECT_NAME}" BUNDLE DESTINATION "/Applications")
-endfunction()
-
-main()
--- a/Source/SantaGUI/main.m
+++ b/Source/SantaGUI/main.m
@@ -1,27 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import <Cocoa/Cocoa.h>
-
-#import "SNTAppDelegate.h"
-
-int main(int argc, const char *argv[]) {
-  @autoreleasepool {
-    NSApplication *app = [NSApplication sharedApplication];
-    SNTAppDelegate *delegate = [[SNTAppDelegate alloc] init];
-    [app setDelegate:delegate];
-    [app finishLaunching];
-    [app run];
-  }
-}
--- a/Source/common/BUILD
+++ b/Source/common/BUILD
@@ -0,0 +1,211 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
+
+load("//:helper.bzl", "santa_unit_test")
+
+objc_library(
+    name = "SNTBlockMessage",
+    srcs = ["SNTBlockMessage.m"],
+    hdrs = ["SNTBlockMessage.h"],
+    deps = [
+        ":SNTConfigurator",
+        ":SNTStoredEvent",
+    ],
+)
+
+objc_library(
+    name = "SNTBlockMessage_SantaGUI",
+    srcs = ["SNTBlockMessage.m"],
+    hdrs = ["SNTBlockMessage.h"],
+    defines = ["SANTAGUI"],
+    deps = [
+        ":SNTConfigurator",
+        ":SNTStoredEvent",
+    ],
+)
+
+objc_library(
+    name = "SNTCachedDecision",
+    srcs = ["SNTCachedDecision.m"],
+    hdrs = ["SNTCachedDecision.h"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTKernelCommon",
+    ],
+)
+
+cc_library(
+    name = "SNTCommonEnums",
+    hdrs = ["SNTCommonEnums.h"],
+)
+
+objc_library(
+    name = "SNTConfigurator",
+    srcs = ["SNTConfigurator.m"],
+    hdrs = ["SNTConfigurator.h"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTLogging",
+        ":SNTStrengthify",
+        ":SNTSystemInfo",
+    ],
+)
+
+objc_library(
+    name = "SNTDropRootPrivs",
+    srcs = ["SNTDropRootPrivs.m"],
+    hdrs = ["SNTDropRootPrivs.h"],
+)
+
+objc_library(
+    name = "SNTFileInfo",
+    srcs = ["SNTFileInfo.m"],
+    hdrs = ["SNTFileInfo.h"],
+    deps = [
+        "@FMDB",
+        "@MOLCodesignChecker",
+    ],
+)
+
+cc_library(
+    name = "SNTKernelCommon",
+    hdrs = ["SNTKernelCommon.h"],
+)
+
+cc_library(
+    name = "SNTLoggingKernel",
+    hdrs = ["SNTLogging.h"],
+)
+
+objc_library(
+    name = "SNTLogging",
+    srcs = ["SNTLogging.m"],
+    hdrs = ["SNTLogging.h"],
+)
+
+cc_library(
+    name = "SNTPrefixTree",
+    srcs = ["SNTPrefixTree.cc"],
+    hdrs = ["SNTPrefixTree.h"],
+    copts = ["-std=c++11"],
+    deps = [":SNTLogging"],
+)
+
+cc_library(
+    name = "SNTPrefixTreeKernel",
+    srcs = ["SNTPrefixTree.cc"],
+    hdrs = ["SNTPrefixTree.h"],
+    copts = [
+        "-std=c++11",
+        "-mkernel",
+        "-I__BAZEL_XCODE_SDKROOT__/System/Library/Frameworks/Kernel.framework/Headers",
+    ],
+    defines = ["KERNEL"],
+    deps = [":SNTLoggingKernel"],
+)
+
+objc_library(
+    name = "SNTRule",
+    srcs = ["SNTRule.m"],
+    hdrs = ["SNTRule.h"],
+    deps = [":SNTCommonEnums"],
+)
+
+objc_library(
+    name = "SNTStoredEvent",
+    srcs = ["SNTStoredEvent.m"],
+    hdrs = ["SNTStoredEvent.h"],
+    deps = [
+        ":SNTCommonEnums",
+        "@MOLCertificate",
+    ],
+)
+
+cc_library(
+    name = "SNTStrengthify",
+    hdrs = ["SNTStrengthify.h"],
+)
+
+objc_library(
+    name = "SNTSystemInfo",
+    srcs = ["SNTSystemInfo.m"],
+    hdrs = ["SNTSystemInfo.h"],
+    sdk_frameworks = ["IOKit"],
+)
+
+objc_library(
+    name = "SNTXPCBundleServiceInterface",
+    srcs = ["SNTXPCBundleServiceInterface.m"],
+    hdrs = ["SNTXPCBundleServiceInterface.h"],
+    deps = [
+        ":SNTStoredEvent",
+        "@MOLXPCConnection",
+    ],
+)
+
+objc_library(
+    name = "SNTXPCControlInterface",
+    srcs = ["SNTXPCControlInterface.m"],
+    hdrs = ["SNTXPCControlInterface.h"],
+    deps = [
+        ":SNTStoredEvent",
+        ":SNTXPCUnprivilegedControlInterface",
+        "@MOLXPCConnection",
+    ],
+)
+
+objc_library(
+    name = "SNTXPCNotifierInterface",
+    srcs = ["SNTXPCNotifierInterface.m"],
+    hdrs = ["SNTXPCNotifierInterface.h"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTXPCBundleServiceInterface",
+    ],
+)
+
+objc_library(
+    name = "SNTXPCSyncdInterface",
+    srcs = ["SNTXPCSyncdInterface.m"],
+    hdrs = ["SNTXPCSyncdInterface.h"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTStoredEvent",
+    ],
+)
+
+objc_library(
+    name = "SNTXPCUnprivilegedControlInterface",
+    srcs = ["SNTXPCUnprivilegedControlInterface.m"],
+    hdrs = ["SNTXPCUnprivilegedControlInterface.h"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTKernelCommon",
+        ":SNTRule",
+        ":SNTStoredEvent",
+        ":SNTXPCBundleServiceInterface",
+        "@MOLCertificate",
+        "@MOLXPCConnection",
+    ],
+)
+
+santa_unit_test(
+    name = "SNTFileInfoTest",
+    srcs = ["SNTFileInfoTest.m"],
+    resources = [
+        "testdata/bad_pagezero",
+        "testdata/missing_pagezero",
+    ],
+    structured_resources = glob([
+        "testdata/BundleExample.app/**",
+        "testdata/DirectoryBundle/**",
+    ]),
+    deps = [":SNTFileInfo"],
+)
+
+santa_unit_test(
+    name = "SNTPrefixTreeTest",
+    srcs = ["SNTPrefixTreeTest.mm"],
+    deps = ["SNTPrefixTree"],
+)
--- a/Source/common/SNTBlockMessage.m
+++ b/Source/common/SNTBlockMessage.m
@@ -12,11 +12,11 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTBlockMessage.h"
+#import "Source/common/SNTBlockMessage.h"

-#import "SNTConfigurator.h"
-#import "SNTLogging.h"
-#import "SNTStoredEvent.h"
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTLogging.h"
+#import "Source/common/SNTStoredEvent.h"

@implementation SNTBlockMessage

@@ -26,10 +26,24 @@
      @"body {"
      @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
      @"  font-size: 13px;"
-      @"  color: #666;"
+      @"  color: %@;"
      @"  text-align: center;"
      @"}"
+
+      // Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
+      @"@media (prefers-color-scheme: dark) {"
+      @"  body {"
+      @"    color: #ddd;"
+      @"  }"
+      @"}"
      @"</style></head><body>";
+
+  // Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
+  // the OS switches modes.
+  NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];
+  BOOL dark =  [mode isEqualToString:@"Dark"];
+  htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];
+
  NSString *htmlFooter = @"</body></html>";

  NSString *message;
@@ -51,7 +65,7 @@

  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];

-#ifdef NSAppKitVersionNumber10_0
+#ifdef SANTAGUI
  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
 #else
--- a/Source/common/SNTCachedDecision.h
+++ b/Source/common/SNTCachedDecision.h
@@ -14,8 +14,8 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
-#import "SNTKernelCommon.h"
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTKernelCommon.h"

 ///
 ///  Store information about executions from decision making for later logging.
--- a/Source/common/SNTCachedDecision.m
+++ b/Source/common/SNTCachedDecision.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTCachedDecision.h"
+#import "Source/common/SNTCachedDecision.h"

@implementation SNTCachedDecision
@end
--- a/Source/common/SNTCommonEnums.h
+++ b/Source/common/SNTCommonEnums.h
@@ -33,6 +33,9 @@ typedef NS_ENUM(NSInteger, SNTRuleState) {
  SNTRuleStateBlacklist = 2,
  SNTRuleStateSilentBlacklist = 3,
  SNTRuleStateRemove = 4,
+
+  SNTRuleStateWhitelistCompiler = 5,
+  SNTRuleStateWhitelistTransitive = 6,
 };

 typedef NS_ENUM(NSInteger, SNTClientMode) {
@@ -58,6 +61,9 @@ typedef NS_ENUM(NSInteger, SNTEventState) {
  SNTEventStateAllowBinary = 1 << 25,
  SNTEventStateAllowCertificate = 1 << 26,
  SNTEventStateAllowScope = 1 << 27,
+  SNTEventStateAllowCompiler = 1 << 28,
+  SNTEventStateAllowTransitive = 1 << 29,
+  SNTEventStateAllowPendingTransitive = 1 << 30,

  // Block and Allow masks
  SNTEventStateBlock = 0xFF << 16,
@@ -68,7 +74,6 @@ typedef NS_ENUM(NSInteger, SNTRuleTableError) {
  SNTRuleTableErrorEmptyRuleArray,
  SNTRuleTableErrorInsertOrReplaceFailed,
  SNTRuleTableErrorInvalidRule,
-  SNTRuleTableErrorMissingRequiredRule,
  SNTRuleTableErrorRemoveFailed
 };

@@ -87,5 +92,6 @@ typedef NS_ENUM(NSInteger, SNTEventLogType) {
 };

 static const char *kKextPath = "/Library/Extensions/santa-driver.kext";
-static const char *kSantaDPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santad";
-static const char *kSantaCtlPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santactl";
+static const char *kSantaDPath = "/Applications/Santa.app/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon";
+static const char *kSantaCtlPath = "/Applications/Santa.app/Contents/MacOS/santactl";
+static const char *kSantaAppPath = "/Applications/Santa.app";
--- a/Source/common/SNTConfigurator.h
+++ b/Source/common/SNTConfigurator.h
@@ -14,7 +14,7 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
+#import "Source/common/SNTCommonEnums.h"

 ///
 ///  Singleton that provides an interface for managing configuration values on disk
@@ -72,6 +72,57 @@
 ///
@property(readonly, nonatomic) NSRegularExpression *fileChangesRegex;

+///
+///  A list of ignore prefixes which are checked in-kernel.
+///  This is more performant than FileChangesRegex when ignoring whole directory trees.
+///
+///  For example adding a prefix of "/private/tmp/" will turn off file change log generation
+///  in-kernel for that entire tree. Since they are ignored by the kernel, they never reach santad
+///  and are not seen by the fileChangesRegex. Note the trailing "/", without it any file or
+///  directory starting with "/private/tmp" would be ignored.
+///
+///  By default "/." and "/dev/" are added.
+///
+///  Memory in the kernel is precious. A total of MAXPATHLEN (1024) nodes are allowed.
+///  Using all 1024 nodes will result in santa-driver allocating ~2MB of wired memory.
+///  An ASCII character uses 1 node. An UTF-8 encoded Unicode character uses 1-4 nodes.
+///  Prefixes are added to the running config in-order, one by one. The prefix will be ignored if
+///  (the running config's current size) + (the prefix's size) totals up to more than 1024 nodes.
+///  The running config is stored in a prefix tree.
+///  Prefixes that share prefixes are effectively de-duped; their shared node sized components only
+///  take up 1 node. For example these 3 prefixes all have a common prefix of "/private/".
+///  They will only take up 21 nodes instead of 39.
+///
+///  "/private/tmp/"
+///  "/private/var/"
+///  "/private/new/"
+///
+///                                                              -> [t] -> [m] -> [p] -> [/]
+///
+///  [/] -> [p] -> [r] -> [i] -> [v] -> [a] -> [t] -> [e] -> [/] -> [v] -> [a] -> [r] -> [/]
+///
+///                                                              -> [n] -> [e] -> [w] -> [/]
+///
+///  Prefixes with Unicode characters work similarly. Assuming a UTF-8 encoding these two prefixes
+///  are actually the same for the first 3 nodes. They take up 7 nodes instead of 10.
+///
+///  "/🤘"
+///  "/🖖"
+///
+///                          -> [0xa4] -> [0x98]
+///
+///  [/] -> [0xf0] -> [0x9f]
+///
+///                          -> [0x96] -> [0x96]
+///
+///  To disable file change logging completely add "/".
+///  TODO(bur): Make this default if no FileChangesRegex is set.
+///
+///  Filters are only applied on santad startup.
+///  TODO(bur): Support add / remove of filters while santad is running.
+///
+@property(readonly, nonatomic) NSArray *fileChangesPrefixFilters;
+
 ///
 ///  Enable __PAGEZERO protection, defaults to YES
 ///  If this flag is set to NO, 32-bit binaries that are missing
@@ -196,7 +247,16 @@
 ///  If YES, enables bundle detection for blocked events. This property is not stored on disk.
 ///  Its value is set by a sync server that supports bundles. Defaults to NO.
 ///
-@property BOOL bundlesEnabled;
+@property BOOL enableBundles;
+
+#pragma mark Transitive Whitelisting Settings
+
+///
+///  If YES, binaries marked with SNTRuleStateWhitelistCompiler rules are allowed to transitively
+///  whitelist any executables that they produce.  If NO, SNTRuleStateWhitelistCompiler rules are
+///  interpreted as if they were simply SNTRuleStateWhitelist rules.  Defaults to NO.
+///
+@property BOOL enableTransitiveWhitelisting;

 #pragma mark Server Auth Settings

--- a/Source/common/SNTConfigurator.m
+++ b/Source/common/SNTConfigurator.m
@@ -12,13 +12,13 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTConfigurator.h"
+#import "Source/common/SNTConfigurator.h"

 #include <sys/stat.h>

-#import "SNTLogging.h"
-#import "SNTStrengthify.h"
-#import "SNTSystemInfo.h"
+#import "Source/common/SNTLogging.h"
+#import "Source/common/SNTStrengthify.h"
+#import "Source/common/SNTSystemInfo.h"

@interface SNTConfigurator ()
 /// A NSUserDefaults object set to use the com.google.santa suite.
@@ -68,6 +68,7 @@ static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";
 static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection";

 static NSString *const kFileChangesRegexKey = @"FileChangesRegex";
+static NSString *const kFileChangesPrefixFiltersKey = @"FileChangesPrefixFilters";

 static NSString *const kEventLogType = @"EventLogType";
 static NSString *const kEventLogPath = @"EventLogPath";
@@ -76,6 +77,7 @@ static NSString *const kEnableMachineIDDecoration = @"EnableMachineIDDecoration"

 // The keys managed by a sync server or mobileconfig.
 static NSString *const kClientModeKey = @"ClientMode";
+static NSString *const kEnableTransitiveWhitelistingKey = @"EnableTransitiveWhitelisting";
 static NSString *const kWhitelistRegexKey = @"WhitelistRegex";
 static NSString *const kBlacklistRegexKey = @"BlacklistRegex";

@@ -92,8 +94,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
    Class date = [NSDate class];
    Class string = [NSString class];
    Class data = [NSData class];
+    Class array = [NSArray class];
    _syncServerKeyTypes = @{
      kClientModeKey : number,
+      kEnableTransitiveWhitelistingKey : number,
      kWhitelistRegexKey : re,
      kBlacklistRegexKey : re,
      kFullSyncLastSuccess : date,
@@ -102,7 +106,9 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
    };
    _forcedConfigKeyTypes = @{
      kClientModeKey : number,
+      kEnableTransitiveWhitelistingKey : number,
      kFileChangesRegexKey : re,
+      kFileChangesPrefixFiltersKey : array,
      kWhitelistRegexKey : re,
      kBlacklistRegexKey : re,
      kEnablePageZeroProtectionKey : number,
@@ -195,6 +201,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  return [self configStateSet];
 }

+ (NSSet *)keyPathsForValuesAffectingFileChangesPrefixFiltersKey {
+  return [self configStateSet];
+}
+
 + (NSSet *)keyPathsForValuesAffectingSyncBaseURL {
  return [self configStateSet];
 }
@@ -287,6 +297,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  return [self configStateSet];
 }

+ (NSSet *)keyPathsForValuesAffectingEnableTransitiveWhitelisting {
+  return [self syncAndConfigStateSet];
+}
+
 #pragma mark Public Interface

 - (SNTClientMode)clientMode {
@@ -311,6 +325,18 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  }
 }

+- (BOOL)enableTransitiveWhitelisting {
+  NSNumber *n = self.syncState[kEnableTransitiveWhitelistingKey];
+  if (n) {
+    return [n boolValue];
+  }
+  return [self.configState[kEnableTransitiveWhitelistingKey] boolValue];
+}
+
+- (void)setEnableTransitiveWhitelisting:(BOOL)enabled {
+  [self updateSyncStateForKey:kEnableTransitiveWhitelistingKey value:@(enabled)];
+}
+
 - (NSRegularExpression *)whitelistPathRegex {
  return self.syncState[kWhitelistRegexKey] ?: self.configState[kWhitelistRegexKey];
 }
@@ -331,8 +357,20 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  return self.configState[kFileChangesRegexKey];
 }

+- (NSArray *)fileChangesPrefixFilters {
+  NSArray *filters = self.configState[kFileChangesPrefixFiltersKey];
+  for (id filter in filters) {
+    if (![filter isKindOfClass:[NSString class]]) {
+      LOGE(@"Ignoring FileChangesPrefixFilters: array contains a non-string %@", filter);
+      return nil;
+    }
+  }
+  return filters;
+}
+
 - (NSURL *)syncBaseURL {
  NSString *urlString = self.configState[kSyncBaseURLKey];
+  if (![urlString hasSuffix:@"/"]) urlString = [urlString stringByAppendingString:@"/"];
  NSURL *url = [NSURL URLWithString:urlString];
  if (urlString && !url) LOGW(@"SyncBaseURL is not a valid URL!");
  return url;
--- a/Source/common/SNTDropRootPrivs.m
+++ b/Source/common/SNTDropRootPrivs.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTDropRootPrivs.h"
+#import "Source/common/SNTDropRootPrivs.h"

 BOOL DropRootPrivileges() {
  if (getuid() == 0 || geteuid() == 0 || getgid() == 0 || getegid() == 0) {
--- a/Source/common/SNTFileInfo.m
+++ b/Source/common/SNTFileInfo.m
@@ -12,9 +12,10 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTFileInfo.h"
+#import "Source/common/SNTFileInfo.h"

 #import <CommonCrypto/CommonDigest.h>
+#import <fmdb/FMDB.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>

 #include <mach-o/arch.h>
@@ -24,7 +25,6 @@
 #include <sys/stat.h>
 #include <sys/xattr.h>

-#import <fmdb/FMDB.h>

 // Simple class to hold the data of a mach_header and the offset within the file
 // in which that header was found.
--- a/Tests/LogicTests/SNTFileInfoTest.m
+++ b/Tests/LogicTests/SNTFileInfoTest.m
@@ -14,13 +14,23 @@

 #import <XCTest/XCTest.h>

-#import "SNTFileInfo.h"
+#import "Source/common/SNTFileInfo.h"

@interface SNTFileInfoTest : XCTestCase
@end

@implementation SNTFileInfoTest

+- (NSString *)directoryBundle {
+  NSString *rp = [[NSBundle bundleForClass:[self class]] resourcePath];
+  return [rp stringByAppendingPathComponent:@"testdata/DirectoryBundle"];
+}
+
+- (NSString *)bundleExample {
+  NSString *rp = [[NSBundle bundleForClass:[self class]] resourcePath];
+  return [rp stringByAppendingPathComponent:@"testdata/BundleExample.app"];
+}
+
 - (void)testPathStandardizing {
  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:@"/Applications/Safari.app"];
  XCTAssertNotNil(sut);
@@ -29,9 +39,9 @@
  sut = [[SNTFileInfo alloc] initWithPath:@"../../../../../../../../../../../../../../../bin/ls"];
  XCTAssertEqualObjects(sut.path, @"/bin/ls");

-  sut = [[SNTFileInfo alloc] initWithPath:@"/usr/bin/qlmanage"];
-  XCTAssertEqualObjects(sut.path, @"/System/Library/Frameworks/QuickLook.framework/Versions/A/"
-                                  @"Resources/quicklookd.app/Contents/MacOS/qlmanage");
+  sut = [[SNTFileInfo alloc] initWithPath:@"/usr/sbin/AppleFileServer"];
+  XCTAssertEqualObjects(sut.path, @"/System/Library/CoreServices/AppleFileServer.app/"
+                                  @"Contents/MacOS/AppleFileServer");
 }

 - (void)testSHA1 {
@@ -120,8 +130,7 @@
 }

 - (void)testBundle {
-  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:@"BundleExample"
-                                                                    ofType:@"app"];
+  NSString *path = [self bundleExample];
  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:path];

  XCTAssertNotNil([sut bundle]);
@@ -134,19 +143,18 @@
 }

 - (void)testAncestorBundle {
-  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:@"BundleExample"
-                                                                    ofType:@"app"];
+  NSString *path = [self bundleExample];
  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:path];
  sut.useAncestorBundle = YES;

  XCTAssertNotNil([sut bundle]);

-  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.LogicTests");
+  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.santa.UnitTest.SNTFileInfoTest");
  XCTAssertNotNil([sut bundleVersion]);
  XCTAssertNotNil([sut bundleShortVersionString]);

  NSString *ancestorBundlePath = path;
-  for (int i = 0; i < 3; i++) {
+  for (int i = 0; i < 4; i++) {
    ancestorBundlePath = [ancestorBundlePath stringByDeletingLastPathComponent];
  }
  XCTAssertEqualObjects([sut bundlePath], ancestorBundlePath);
@@ -159,15 +167,14 @@

  XCTAssertNotNil([sut bundle]);

-  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.LogicTests");
+  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.santa.UnitTest.SNTFileInfoTest");
  XCTAssertNotNil([sut bundleVersion]);
  XCTAssertNotNil([sut bundleShortVersionString]);
  XCTAssertEqualObjects([sut bundlePath], path);
 }

 - (void)testDirectoryBundleIsNotAncestor {
-  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:@"DirectoryBundle"
-                                                                    ofType:@""];
+  NSString *path = [self directoryBundle];
  NSString *directoryBundle = @"/tmp/DirectoryBundle";
  NSFileManager *fm = [NSFileManager defaultManager];
  [fm removeItemAtPath:directoryBundle error:NULL];
@@ -186,8 +193,7 @@
 }

 - (void)testBundleCacheReset {
-  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:@"BundleExample"
-                                                                    ofType:@"app"];
+  NSString *path = [self bundleExample];
  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:path];

  XCTAssertNotNil([sut bundle]);
@@ -202,12 +208,12 @@

  XCTAssertNotNil([sut bundle]);

-  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.LogicTests");
+  XCTAssertEqualObjects([sut bundleIdentifier], @"com.google.santa.UnitTest.SNTFileInfoTest");
  XCTAssertNotNil([sut bundleVersion]);
  XCTAssertNotNil([sut bundleShortVersionString]);

  NSString *ancestorBundlePath = path;
-  for (int i = 0; i < 3; i++) {
+  for (int i = 0; i < 4; i++) {
    ancestorBundlePath = [ancestorBundlePath stringByDeletingLastPathComponent];
  }
  XCTAssertEqualObjects([sut bundlePath], ancestorBundlePath);
--- a/Source/common/SNTKernelCommon.h
+++ b/Source/common/SNTKernelCommon.h
@@ -33,12 +33,16 @@
 enum SantaDriverMethods {
  kSantaUserClientOpen,
  kSantaUserClientAllowBinary,
+  kSantaUserClientAllowCompiler,
  kSantaUserClientDenyBinary,
  kSantaUserClientAcknowledgeBinary,
  kSantaUserClientClearCache,
+  kSantaUserClientRemoveCacheEntry,
  kSantaUserClientCacheCount,
  kSantaUserClientCheckCache,
  kSantaUserClientCacheBucketCount,
+  kSantaUserClientFilemodPrefixFilterAdd,
+  kSantaUserClientFilemodPrefixFilterReset,

  // Any methods supported by the driver should be added above this line to
  // ensure this remains the count of methods.
@@ -47,7 +51,7 @@ enum SantaDriverMethods {

 typedef enum {
  QUEUETYPE_DECISION,
-  QUEUETYPE_LOG
+  QUEUETYPE_LOG,
 } santa_queuetype_t;

 // Enum defining actions that can be passed down the IODataQueue and in
@@ -64,6 +68,10 @@ typedef enum {
  ACTION_RESPOND_DENY = 21,
  ACTION_RESPOND_TOOLONG = 22,
  ACTION_RESPOND_ACK = 23,
+  ACTION_RESPOND_ALLOW_COMPILER = 24,
+  // The following response is stored only in the kernel decision cache.
+  // It is removed by SNTCompilerController
+  ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE = 25,

  // NOTIFY
  ACTION_NOTIFY_EXEC = 30,
@@ -72,13 +80,17 @@ typedef enum {
  ACTION_NOTIFY_LINK = 33,
  ACTION_NOTIFY_EXCHANGE = 34,
  ACTION_NOTIFY_DELETE = 35,
+  ACTION_NOTIFY_WHITELIST = 36,

  // ERROR
  ACTION_ERROR = 99,
 } santa_action_t;

 #define RESPONSE_VALID(x) \
-  (x == ACTION_RESPOND_ALLOW || x == ACTION_RESPOND_DENY)
+  (x == ACTION_RESPOND_ALLOW || \
+   x == ACTION_RESPOND_DENY || \
+   x == ACTION_RESPOND_ALLOW_COMPILER || \
+   x == ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE)

 // Struct to manage vnode IDs
 typedef struct santa_vnode_id_t {
@@ -112,6 +124,12 @@ typedef struct {
  // While process names can technically be 4*MAXPATHLEN, that never
  // actually happens, so only take MAXPATHLEN and throw away any excess.
  char pname[MAXPATHLEN];
+
+  // For messages that originate from EndpointSecurity, this points to a copy of the message.
+  void *es_message;
+
+  // For messages that originate from EndpointSecurity, this points to an NSArray of the arguments.
+  void *args_array;
 } santa_message_t;

 // Used for the kSantaUserClientCacheBucketCount request.
--- a/Source/common/SNTLogging.h
+++ b/Source/common/SNTLogging.h
@@ -34,6 +34,10 @@

 #else  // KERNEL

+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #import <Foundation/Foundation.h>

 typedef enum : NSUInteger {
@@ -60,6 +64,10 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...)
 #define LOGW(logFormat, ...) logMessage(LOG_LEVEL_WARN, stderr, logFormat, ##__VA_ARGS__)
 #define LOGE(logFormat, ...) logMessage(LOG_LEVEL_ERROR, stderr, logFormat, ##__VA_ARGS__)

+#ifdef __cplusplus
+} // extern C
+#endif
+
 #endif  // KERNEL

 #endif  // SANTA__COMMON__LOGGING_H
--- a/Source/common/SNTLogging.m
+++ b/Source/common/SNTLogging.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTLogging.h"
+#import "Source/common/SNTLogging.h"

 #import <asl.h>
 #import <pthread.h>
@@ -24,7 +24,10 @@ static LogLevel logLevel = LOG_LEVEL_INFO;  // default to info
 #endif

 void syslogClientDestructor(void *arg) {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
  asl_close((aslclient)arg);
+#pragma clang diagnostic pop
 }

 void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
@@ -36,6 +39,13 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
  dispatch_once(&pred, ^{
    binaryName = [[NSProcessInfo processInfo] processName];

+    if (@available(macOS 10.15, *)) {
+      if ([binaryName isEqualToString:@"com.google.santa.daemon"]) {
+        useSyslog = YES;
+        pthread_key_create(&syslogKey, syslogClientDestructor);
+      }
+    }
+
    // If debug logging is enabled, the process must be restarted.
    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--debug"]) {
      logLevel = LOG_LEVEL_DEBUG;
@@ -58,8 +68,11 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
  if (useSyslog) {
    aslclient client = (aslclient)pthread_getspecific(syslogKey);
    if (client == NULL) {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
      client = asl_open(NULL, "com.google.santa", 0);
      asl_set_filter(client, ASL_FILTER_MASK_UPTO(ASL_LEVEL_DEBUG));
+#pragma clang diagnostic pop
      pthread_setspecific(syslogKey, client);
    }

@@ -84,7 +97,10 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
        break;
    }

+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
    asl_log(client, NULL, syslogLevel, "%s %s: %s", levelName, binaryName.UTF8String, s.UTF8String);
+#pragma clang diagnostic pop
  } else {
    [s appendString:@"\n"];
    size_t len = [s lengthOfBytesUsingEncoding:NSUTF8StringEncoding];
--- a/Source/common/SNTPrefixTree.cc
+++ b/Source/common/SNTPrefixTree.cc
@@ -0,0 +1,259 @@
+/// Copyright 2018 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/common/SNTPrefixTree.h"
+
+#ifdef KERNEL
+#include <libkern/locks.h>
+#include "Source/common/SNTLogging.h"
+
+#else
+
+#include <mutex>
+#include <string.h>
+
+#define LOGD(format, ...) // NOP
+#define LOGE(format, ...) // NOP
+
+#define lck_rw_lock_shared(l) pthread_rwlock_rdlock(&l)
+#define lck_rw_unlock_shared(l) pthread_rwlock_unlock(&l)
+#define lck_rw_lock_exclusive(l) pthread_rwlock_wrlock(&l)
+#define lck_rw_unlock_exclusive(l) pthread_rwlock_unlock(&l)
+
+#define lck_rw_lock_shared_to_exclusive(l) ({ pthread_rwlock_unlock(&l); false; })
+#define lck_rw_lock_exclusive_to_shared(l) ({ pthread_rwlock_unlock(&l); pthread_rwlock_rdlock(&l); })
+
+#define lck_mtx_lock(l) l->lock()
+#define lck_mtx_unlock(l) l->unlock()
+#endif // KERNEL
+
+SNTPrefixTree::SNTPrefixTree(uint32_t max_nodes) {
+  root_ = new SantaPrefixNode();
+  node_count_ = 0;
+  max_nodes_ = max_nodes;
+
+#ifdef KERNEL
+  spt_lock_grp_attr_ = lck_grp_attr_alloc_init();
+  spt_lock_grp_ = lck_grp_alloc_init("santa-prefix-tree-lock", spt_lock_grp_attr_);
+  spt_lock_attr_ = lck_attr_alloc_init();
+
+  spt_lock_ = lck_rw_alloc_init(spt_lock_grp_, spt_lock_attr_);
+  spt_add_lock_ = lck_mtx_alloc_init(spt_lock_grp_, spt_lock_attr_);
+#else
+  pthread_rwlock_init(&spt_lock_, nullptr);
+  spt_add_lock_ = new std::mutex;
+#endif
+}
+
+IOReturn SNTPrefixTree::AddPrefix(const char *prefix, uint64_t *node_count) {
+  // Serialize requests to AddPrefix. Otherwise one AddPrefix thread could overwrite whole
+  // branches of another. HasPrefix is still free to read the tree, until AddPrefix needs to
+  // modify it.
+  lck_mtx_lock(spt_add_lock_);
+
+  // Don't allow an empty prefix.
+  if (prefix[0] == '\0') return kIOReturnBadArgument;
+
+  LOGD("Trying to add prefix: %s", prefix);
+
+  // Enforce max tree depth.
+  size_t len = strnlen(prefix, max_nodes_);
+
+  // Grab a shared lock until a new branch is required.
+  lck_rw_lock_shared(spt_lock_);
+
+  SantaPrefixNode *node = root_;
+  for (int i = 0; i < len; ++i) {
+    // If there is a node in the path that is considered a prefix, stop adding.
+    // For our purposes we only care about the shortest path that matches.
+    if (node->isPrefix) break;
+
+    // Only process a byte at a time.
+    uint8_t value = prefix[i];
+
+    // Create the child if it does not exist.
+    if (!node->children[value]) {
+      // Upgrade the shared lock.
+      // If the upgrade fails, the shared lock is released.
+      if (!lck_rw_lock_shared_to_exclusive(spt_lock_)) {
+        // Grab a new exclusive lock.
+        lck_rw_lock_exclusive(spt_lock_);
+      }
+
+      // Is there enough room for the rest of the prefix?
+      if ((node_count_ + (len - i)) > max_nodes_) {
+        LOGE("Prefix tree is full, can not add: %s", prefix);
+
+        if (node_count) *node_count = node_count_;
+        lck_rw_unlock_exclusive(spt_lock_);
+        lck_mtx_unlock(spt_add_lock_);
+        return kIOReturnNoResources;
+      }
+
+      // Create the rest of the prefix.
+      while (i < len) {
+        value = prefix[i++];
+
+        SantaPrefixNode *new_node = new SantaPrefixNode();
+        node->children[value] = new_node;
+        ++node_count_;
+
+        node = new_node;
+      }
+
+      // This is the end, mark the node as a prefix.
+      LOGD("Added prefix: %s", prefix);
+
+      node->isPrefix = true;
+
+      // Downgrade the exclusive lock
+      lck_rw_lock_exclusive_to_shared(spt_lock_);
+    } else if (i + 1 == len) {
+      // If the child does exist and it is the end...
+      // Set the new, higher prefix and prune the now dead nodes.
+
+      if (!lck_rw_lock_shared_to_exclusive(spt_lock_)) {
+        lck_rw_lock_exclusive(spt_lock_);
+      }
+
+      PruneNode(node->children[value]);
+
+      SantaPrefixNode *new_node = new SantaPrefixNode();
+      new_node->isPrefix = true;
+
+      node->children[value] = new_node;
+      ++node_count_;
+
+      LOGD("Added prefix: %s", prefix);
+
+      lck_rw_lock_exclusive_to_shared(spt_lock_);
+    }
+
+    // Get ready for the next iteration.
+    node = node->children[value];
+  }
+
+  if (node_count) *node_count = node_count_;
+
+  lck_rw_unlock_shared(spt_lock_);
+  lck_mtx_unlock(spt_add_lock_);
+
+  return kIOReturnSuccess;
+}
+
+bool SNTPrefixTree::HasPrefix(const char *string) {
+  lck_rw_lock_shared(spt_lock_);
+
+  auto found = false;
+
+  SantaPrefixNode *node = root_;
+
+  // A well formed tree will always break this loop. Even if string doesn't terminate.
+  const char *p = string;
+  while (*p) {
+    // Only process a byte at a time.
+    node = node->children[(uint8_t)*p++];
+
+    // If it doesn't exist in the tree, no match.
+    if (!node) break;
+
+    // If it does exist, is it a prefix?
+    if (node->isPrefix) {
+      found = true;
+      break;
+    }
+  }
+
+  lck_rw_unlock_shared(spt_lock_);
+
+  return found;
+}
+
+void SNTPrefixTree::Reset() {
+  lck_rw_lock_exclusive(spt_lock_);
+
+  PruneNode(root_);
+  root_ = new SantaPrefixNode();
+  node_count_ = 0;
+
+  lck_rw_unlock_exclusive(spt_lock_);
+}
+
+void SNTPrefixTree::PruneNode(SantaPrefixNode *target) {
+  if (!target) return;
+
+  // For deep trees, a recursive approach will generate too many stack frames. Make a "stack"
+  // and walk the tree.
+  auto stack = new SantaPrefixNode *[node_count_ + 1];
+  if (!stack) {
+    LOGE("Unable to prune tree!");
+
+    return;
+  }
+  auto count = 0;
+
+  // Seed the "stack" with a starting node.
+  stack[count++] = target;
+
+  // Start at the target node and walk the tree to find and delete all the sub-nodes.
+  while (count) {
+    auto node = stack[--count];
+
+    for (int i = 0; i < 256; ++i) {
+      if (!node->children[i]) continue;
+      stack[count++] = node->children[i];
+    }
+
+    delete node;
+    --node_count_;
+  }
+
+  delete[] stack;
+}
+
+SNTPrefixTree::~SNTPrefixTree() {
+  lck_rw_lock_exclusive(spt_lock_);
+  PruneNode(root_);
+  root_ = nullptr;
+  lck_rw_unlock_exclusive(spt_lock_);
+
+#ifdef KERNEL
+  if (spt_lock_) {
+    lck_rw_free(spt_lock_, spt_lock_grp_);
+    spt_lock_ = nullptr;
+  }
+
+  if (spt_add_lock_) {
+    lck_mtx_free(spt_add_lock_, spt_lock_grp_);
+    spt_add_lock_ = nullptr;
+  }
+
+  if (spt_lock_attr_) {
+    lck_attr_free(spt_lock_attr_);
+    spt_lock_attr_ = nullptr;
+  }
+
+  if (spt_lock_grp_) {
+    lck_grp_free(spt_lock_grp_);
+    spt_lock_grp_ = nullptr;
+  }
+
+  if (spt_lock_grp_attr_) {
+    lck_grp_attr_free(spt_lock_grp_attr_);
+    spt_lock_grp_attr_ = nullptr;
+  }
+#else
+  pthread_rwlock_destroy(&spt_lock_);
+#endif
+}
--- a/Source/common/SNTPrefixTree.h
+++ b/Source/common/SNTPrefixTree.h
@@ -0,0 +1,103 @@
+/// Copyright 2018 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H
+#define SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H
+
+#include <IOKit/IOReturn.h>
+#include <sys/param.h>
+
+#ifdef KERNEL
+#include <libkern/locks.h>
+#else
+// Support for unit testing.
+#include <mutex>
+#include <pthread.h>
+#include <stdint.h>
+#endif // KERNEL
+
+///
+///  SantaPrefixTree is a simple prefix tree implementation.
+///  Operations are thread safe.
+///
+class SNTPrefixTree {
+ public:
+  // Add a prefix to the tree.
+  // Optionally pass node_count to get the number of nodes after the add.
+  IOReturn AddPrefix(const char *, uint64_t *node_count = nullptr);
+
+  // Check if the tree has a prefix for string.
+  bool HasPrefix(const char *string);
+
+  // Reset the tree.
+  void Reset();
+
+  SNTPrefixTree(uint32_t max_nodes = kDefaultMaxNodes);
+  ~SNTPrefixTree();
+
+ private:
+  ///
+  ///  SantaPrefixNode is a wrapper class that represents one byte.
+  ///  1 node can represent a whole ASCII character.
+  ///  For example a pointer to the 'A' node will be stored at children[0x41].
+  ///  It takes 1-4 nodes to represent a UTF-8 encoded Unicode character.
+  ///
+  ///  The path for "/🤘" would look like this:
+  ///      children[0x2f] -> children[0xf0] -> children[0x9f] -> children[0xa4] -> children[0x98]
+  ///
+  ///  The path for "/dev" is:
+  ///      children[0x2f] -> children[0x64] -> children[0x65] -> children[0x76]
+  ///
+  ///  Lookups of children are O(1).
+  ///
+  ///  Having the nodes represented by a smaller width, such as a nibble (1/2 byte), would
+  ///  drastically decrease the memory footprint but would double required dereferences.
+  ///
+  ///  TODO(bur): Potentially convert this into a full on radix tree.
+  ///
+  class SantaPrefixNode {
+   public:
+    bool isPrefix;
+    SantaPrefixNode *children[256];
+  };
+
+  // PruneNode will remove the passed in node from the tree.
+  // The passed in node and all subnodes will be deleted.
+  // It is the caller's responsibility to reset the pointer to this node (held by the parent).
+  // If the tree is in use grab the exclusive lock.
+  void PruneNode(SantaPrefixNode *);
+
+  SantaPrefixNode *root_;
+
+  // Each node takes up ~2k, assuming MAXPATHLEN is 1024 max out at ~2MB.
+  static const uint32_t kDefaultMaxNodes = MAXPATHLEN;
+  uint32_t max_nodes_;
+  uint32_t node_count_;
+
+#ifdef KERNEL
+  lck_grp_t *spt_lock_grp_;
+  lck_grp_attr_t *spt_lock_grp_attr_;
+  lck_attr_t *spt_lock_attr_;
+  lck_rw_t *spt_lock_;
+  lck_mtx_t *spt_add_lock_;
+#else // KERNEL
+  void *spt_lock_grp_;
+  void *spt_lock_grp_attr_;
+  void *spt_lock_attr_;
+  pthread_rwlock_t spt_lock_;
+  std::mutex *spt_add_lock_;
+#endif // KERNEL
+};
+
+#endif /* SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H */
--- a/Source/common/SNTPrefixTreeTest.mm
+++ b/Source/common/SNTPrefixTreeTest.mm
@@ -0,0 +1,70 @@
+/// Copyright 2018 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#include "Source/common/SNTPrefixTree.h"
+
+@interface SNTPrefixTreeTest : XCTestCase
+@end
+
+@implementation SNTPrefixTreeTest
+
+- (void)testAddAndHas {
+  auto t = SNTPrefixTree();
+  XCTAssertFalse(t.HasPrefix("/private/var/tmp/file1"));
+  t.AddPrefix("/private/var/tmp/");
+  XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
+}
+
+- (void)testReset {
+  auto t = SNTPrefixTree();
+  t.AddPrefix("/private/var/tmp/");
+  XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
+  t.Reset();
+  XCTAssertFalse(t.HasPrefix("/private/var/tmp/file1"));
+}
+
+- (void)testThreading {
+  uint32_t count = 4096;
+  auto t = new SNTPrefixTree(count * (uint32_t)[NSUUID UUID].UUIDString.length);
+
+  NSMutableArray *UUIDs = [NSMutableArray arrayWithCapacity:count];
+  for (int i = 0; i < count; ++i) {
+    [UUIDs addObject:[NSUUID UUID].UUIDString];
+  }
+
+  // Create a bunch of background noise.
+  dispatch_async(dispatch_get_global_queue(0, 0), ^{
+    dispatch_apply(UINT64_MAX, dispatch_get_global_queue(0, 0), ^(size_t i) {
+      t->HasPrefix([UUIDs[i % count] UTF8String]);
+    });
+  });
+
+  // Fill up the tree.
+  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
+    if (t->AddPrefix([UUIDs[i] UTF8String]) != kIOReturnSuccess) {
+      XCTFail();
+    }
+  });
+
+  // Make sure every leaf byte is found.
+  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
+    if (!t->HasPrefix([UUIDs[i] UTF8String])) {
+      XCTFail();
+    }
+  });
+}
+
+@end
--- a/Source/common/SNTRule.h
+++ b/Source/common/SNTRule.h
@@ -14,7 +14,7 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
+#import "Source/common/SNTCommonEnums.h"

 ///
 ///  Represents a Rule.
@@ -41,12 +41,32 @@
 ///
@property(copy) NSString *customMsg;

+///
+///  The time when this rule was last retrieved from the rules database, if rule is transitive.
+///  Stored as number of seconds since 00:00:00 UTC on 1 January 2001.
+///
+@property(readonly) NSUInteger timestamp;
+
 ///
 ///  Designated initializer.
 ///
+- (instancetype)initWithShasum:(NSString *)shasum
+                         state:(SNTRuleState)state
+                          type:(SNTRuleType)type
+                     customMsg:(NSString *)customMsg
+                     timestamp:(NSUInteger)timestamp;
+
+///
+///  Initialize with a default timestamp: current time if rule state is transitive, 0 otherwise.
+///
 - (instancetype)initWithShasum:(NSString *)shasum
                         state:(SNTRuleState)state
                          type:(SNTRuleType)type
                     customMsg:(NSString *)customMsg;

+///
+///  Sets timestamp of rule to the current time.
+///
+- (void)resetTimestamp;
+
@end
--- a/Source/common/SNTRule.m
+++ b/Source/common/SNTRule.m
@@ -12,24 +12,47 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTRule.h"
+#import "Source/common/SNTRule.h"
+
+@interface SNTRule()
+@property(readwrite) NSUInteger timestamp;
+@end

@implementation SNTRule

 - (instancetype)initWithShasum:(NSString *)shasum
                         state:(SNTRuleState)state
                          type:(SNTRuleType)type
-                     customMsg:(NSString *)customMsg {
+                     customMsg:(NSString *)customMsg
+                     timestamp:(NSUInteger)timestamp {
  self = [super init];
  if (self) {
    _shasum = shasum;
    _state = state;
    _type = type;
    _customMsg = customMsg;
+    _timestamp = timestamp;
  }
  return self;
 }

+- (instancetype)initWithShasum:(NSString *)shasum
+                         state:(SNTRuleState)state
+                          type:(SNTRuleType)type
+                     customMsg:(NSString *)customMsg {
+  self = [self initWithShasum:shasum
+                        state:state
+                         type:type
+                    customMsg:customMsg
+                    timestamp:0];
+  // Initialize timestamp to current time if rule is transitive.
+  if (self && state == SNTRuleStateWhitelistTransitive) {
+    [self resetTimestamp];
+  }
+  return self;
+}
+
+
 #pragma mark NSSecureCoding

 #pragma clang diagnostic push
@@ -46,6 +69,7 @@
  ENCODE(@(self.state), @"state");
  ENCODE(@(self.type), @"type");
  ENCODE(self.customMsg, @"custommsg");
+  ENCODE(@(self.timestamp), @"timestamp");
 }

 - (instancetype)initWithCoder:(NSCoder *)decoder {
@@ -55,6 +79,7 @@
    _state = [DECODE(NSNumber, @"state") intValue];
    _type = [DECODE(NSNumber, @"type") intValue];
    _customMsg = DECODE(NSString, @"custommsg");
+    _timestamp = [DECODE(NSNumber, @"timestamp") unsignedIntegerValue];
  }
  return self;
 }
@@ -80,8 +105,14 @@
 }

 - (NSString *)description {
-  return [NSString stringWithFormat:@"SNTRule: SHA-256: %@, State: %ld, Type: %ld",
-                                    self.shasum, self.state, self.type];
+  return [NSString stringWithFormat:@"SNTRule: SHA-256: %@, State: %ld, Type: %ld, Timestamp: %lu",
+             self.shasum, self.state, self.type, (unsigned long)self.timestamp];
+}
+
+# pragma mark Last-access Timestamp
+
+- (void)resetTimestamp {
+  self.timestamp = (NSUInteger)[[NSDate date] timeIntervalSinceReferenceDate];
 }

@end
--- a/Source/common/SNTStoredEvent.h
+++ b/Source/common/SNTStoredEvent.h
@@ -14,7 +14,7 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
+#import "Source/common/SNTCommonEnums.h"

 ///
 ///  Represents an event stored in the database.
--- a/Source/common/SNTStoredEvent.m
+++ b/Source/common/SNTStoredEvent.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTStoredEvent.h"
+#import "Source/common/SNTStoredEvent.h"

 #import <MOLCertificate/MOLCertificate.h>

--- a/Source/common/SNTSystemInfo.m
+++ b/Source/common/SNTSystemInfo.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTSystemInfo.h"
+#import "Source/common/SNTSystemInfo.h"

@implementation SNTSystemInfo

--- a/Source/common/SNTXPCBundleServiceInterface.h
+++ b/Source/common/SNTXPCBundleServiceInterface.h
@@ -14,6 +14,8 @@

 #import <Foundation/Foundation.h>

+#import <MOLXPCConnection/MOLXPCConnection.h>
+
@class SNTStoredEvent;

 ///  A block that takes the calculated bundle hash, associated events and hashing time in ms.
@@ -25,7 +27,7 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 ///  @param listener The listener to connect back to the SantaGUI.
 ///
- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
+- (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;

 ///
 ///  Hash a bundle for an event. The SNTBundleHashBlock will be called with nil parameters if a
@@ -39,6 +41,11 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 - (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;

+///
+///  santabundleservice is launched on demand by launchd, call spindown to let santabundleservice know you are done with it.
+///
+- (void)spindown;
+
@end

@interface SNTXPCBundleServiceInterface : NSObject
@@ -52,6 +59,12 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 ///  Returns the MachService ID for this service.
 ///
-+ (NSString *)serviceId;
+ (NSString *)serviceID;
+
+///
+///  Retrieve a pre-configured MOLXPCConnection for communicating with santabundleservice.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
+ (MOLXPCConnection *)configuredConnection;

@end
--- a/Source/common/SNTXPCBundleServiceInterface.m
+++ b/Source/common/SNTXPCBundleServiceInterface.m
@@ -12,9 +12,9 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCBundleServiceInterface.h"
+#import "Source/common/SNTXPCBundleServiceInterface.h"

-#import "SNTStoredEvent.h"
+#import "Source/common/SNTStoredEvent.h"

@implementation SNTXPCBundleServiceInterface

@@ -29,8 +29,15 @@
  return r;
 }

-+ (NSString *)serviceId {
-  return @"com.google.santabs";
+ (NSString *)serviceID {
+  return @"com.google.santa.bundleservice";
+}
+
+ (MOLXPCConnection *)configuredConnection {
+  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceID]
+                                                          privileged:YES];
+  c.remoteInterface = [self bundleServiceInterface];
+  return c;
 }

@end
--- a/Source/common/SNTXPCControlInterface.h
+++ b/Source/common/SNTXPCControlInterface.h
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCUnprivilegedControlInterface.h"
+#import "Source/common/SNTXPCUnprivilegedControlInterface.h"

 ///
 ///  Protocol implemented by santad and utilized by santactl (privileged operations)
@@ -46,7 +46,8 @@
 - (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)(void))reply;
 - (void)setWhitelistPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
 - (void)setBlacklistPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
- (void)setBundlesEnabled:(BOOL)bundlesEnabled reply:(void (^)(void))reply;
+- (void)setEnableBundles:(BOOL)bundlesEnabled reply:(void (^)(void))reply;
+- (void)setEnableTransitiveWhitelisting:(BOOL)enabled reply:(void (^)(void))reply;

 ///
 ///  Syncd Ops
@@ -56,12 +57,28 @@

@end

-@interface SNTXPCControlInterface : SNTXPCUnprivilegedControlInterface
+@interface SNTXPCControlInterface : NSObject

 ///
-///  Internal method used to initialize the control interface
+///  Returns the MachService ID for this service.
 ///
+ (NSString *)serviceID;

-+ (void)initializeControlInterface:(NSXPCInterface *)r;
+///
+///  Returns the SystemExtension ID for this service.
+///
+ (NSString *)systemExtensionID;
+
+///
+///  Returns an initialized NSXPCInterface for the SNTUnprivilegedDaemonControlXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
+ (NSXPCInterface *)controlInterface;
+
+///
+///  Retrieve a pre-configured MOLXPCConnection for communicating with santad.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
+ (MOLXPCConnection *)configuredConnection;

@end
--- a/Source/common/SNTXPCControlInterface.m
+++ b/Source/common/SNTXPCControlInterface.m
@@ -12,22 +12,33 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCControlInterface.h"
+#import "Source/common/SNTXPCControlInterface.h"

+#import <MOLCodesignChecker/MOLCodesignChecker.h>
 #import <MOLXPCConnection/MOLXPCConnection.h>

-#import "SNTRule.h"
-#import "SNTStoredEvent.h"
+#import "Source/common/SNTRule.h"
+#import "Source/common/SNTStoredEvent.h"
+
+NSString *const kBundleID = @"com.google.santa.daemon";

@implementation SNTXPCControlInterface

-+ (NSString *)serviceId {
-  return @"SantaXPCControl";
+ (NSString *)serviceID {
+  if (@available(macOS 10.15, *)) {
+    MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithSelf];
+    // "teamid.com.google.santa.daemon.xpc"
+    NSString *t = cs.signingInformation[@"teamid"];
+    return [NSString stringWithFormat:@"%@.%@.xpc", t, kBundleID];
+  }
+  return kBundleID;
+}
+
+ (NSString *)systemExtensionID {
+  return kBundleID;
 }

 + (void)initializeControlInterface:(NSXPCInterface *)r {
-  [super initializeControlInterface:r];
-
  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
        forSelector:@selector(databaseEventsPending:)
      argumentIndex:0
@@ -47,7 +58,7 @@
 }

 + (MOLXPCConnection *)configuredConnection {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceId]
+  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceID]
                                                          privileged:YES];
  c.remoteInterface = [self controlInterface];
  return c;
--- a/Source/common/SNTXPCNotifierInterface.h
+++ b/Source/common/SNTXPCNotifierInterface.h
@@ -14,8 +14,8 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
-#import "SNTXPCBundleServiceInterface.h"
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTXPCBundleServiceInterface.h"

@class SNTStoredEvent;

@@ -24,16 +24,10 @@
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
 - (void)postClientModeNotification:(SNTClientMode)clientmode;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
-@end
-
-/// Protocol implemented by SantaGUI and utilized by santabs
-@protocol SNTBundleNotifierXPC
 - (void)updateCountsForEvent:(SNTStoredEvent *)event
                 binaryCount:(uint64_t)binaryCount
                   fileCount:(uint64_t)fileCount
                 hashedCount:(uint64_t)hashedCount;
-
- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener;
@end

@interface SNTXPCNotifierInterface : NSObject
@@ -44,10 +38,4 @@
 ///
 + (NSXPCInterface *)notifierInterface;

-///
-///  @return an initialized NSXPCInterface for the SNTBundleNotifierXPC protocol.
-///  Ensures any methods that accept custom classes as arguments are set-up before returning
-///
-+ (NSXPCInterface *)bundleNotifierInterface;
-
@end
--- a/Source/common/SNTXPCNotifierInterface.m
+++ b/Source/common/SNTXPCNotifierInterface.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCNotifierInterface.h"
+#import "Source/common/SNTXPCNotifierInterface.h"

@implementation SNTXPCNotifierInterface

@@ -20,8 +20,4 @@
  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTNotifierXPC)];
 }

-+ (NSXPCInterface *)bundleNotifierInterface {
-  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleNotifierXPC)];
-}
-
@end
--- a/Source/common/SNTXPCSyncdInterface.h
+++ b/Source/common/SNTXPCSyncdInterface.h
@@ -14,7 +14,7 @@

 #import <Foundation/Foundation.h>

-#import "SNTCommonEnums.h"
+#import "Source/common/SNTCommonEnums.h"

@class SNTStoredEvent;

--- a/Source/common/SNTXPCSyncdInterface.m
+++ b/Source/common/SNTXPCSyncdInterface.m
@@ -12,9 +12,9 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCSyncdInterface.h"
+#import "Source/common/SNTXPCSyncdInterface.h"

-#import "SNTStoredEvent.h"
+#import "Source/common/SNTStoredEvent.h"

@implementation SNTXPCSyncdInterface

--- a/Source/common/SNTXPCUnprivilegedControlInterface.h
+++ b/Source/common/SNTXPCUnprivilegedControlInterface.h
@@ -13,13 +13,10 @@
 ///    limitations under the License.

 #import <Foundation/Foundation.h>
-
 #import <MOLCertificate/MOLCertificate.h>

-#import "SNTCachedDecision.h"
-#import "SNTCommonEnums.h"
-#import "SNTKernelCommon.h"
-#import "SNTXPCBundleServiceInterface.h"
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTKernelCommon.h"

@class SNTRule;
@class SNTStoredEvent;
@@ -33,7 +30,7 @@
 ///
 ///  Kernel ops
 ///
- (void)cacheCounts:(void (^)(uint64_t count))reply;
+- (void)cacheCounts:(void (^)(uint64_t rootCache, uint64_t nonRootCache))reply;
 - (void)cacheBucketCount:(void (^)(NSArray *))reply;
 - (void)checkCacheForVnodeID:(santa_vnode_id_t)vnodeID withReply:(void (^)(santa_action_t))reply;
 - (void)driverConnectionEstablished:(void (^)(BOOL))reply;
@@ -41,7 +38,10 @@
 ///
 ///  Database ops
 ///
- (void)databaseRuleCounts:(void (^)(int64_t binary, int64_t certificate))reply;
+- (void)databaseRuleCounts:(void (^)(int64_t binary,
+                                     int64_t certificate,
+                                     int64_t compiler,
+                                     int64_t transitive))reply;
 - (void)databaseEventCount:(void (^)(int64_t count))reply;

 ///
@@ -70,13 +70,13 @@
 - (void)fullSyncLastSuccess:(void (^)(NSDate *))reply;
 - (void)ruleSyncLastSuccess:(void (^)(NSDate *))reply;
 - (void)syncCleanRequired:(void (^)(BOOL))reply;
- (void)bundlesEnabled:(void (^)(BOOL))reply;
+- (void)enableBundles:(void (^)(BOOL))reply;
+- (void)enableTransitiveWhitelisting:(void (^)(BOOL))reply;

 ///
 ///  GUI Ops
 ///
 - (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;
- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;

 ///
 ///  Syncd Ops
@@ -86,34 +86,21 @@
 ///
 ///  Bundle Ops
 ///
- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
 - (void)syncBundleEvent:(SNTStoredEvent *)event relatedEvents:(NSArray<SNTStoredEvent *> *)events;

@end

@interface SNTXPCUnprivilegedControlInterface : NSObject

-///
-///  Returns the MachService ID for this service.
-///
-+ (NSString *)serviceId;
-
 ///
 ///  Returns an initialized NSXPCInterface for the SNTUnprivilegedDaemonControlXPC protocol.
 ///  Ensures any methods that accept custom classes as arguments are set-up before returning
 ///
 + (NSXPCInterface *)controlInterface;

-///
-///  Retrieve a pre-configured MOLXPCConnection for communicating with santad.
-///  Connections just needs any handlers set and then can be resumed and used.
-///
-+ (MOLXPCConnection *)configuredConnection;
-
 ///
 ///  Internal method used to initialize the control interface
 ///
-
 + (void)initializeControlInterface:(NSXPCInterface *)r;

@end
--- a/Source/common/SNTXPCUnprivilegedControlInterface.m
+++ b/Source/common/SNTXPCUnprivilegedControlInterface.m
@@ -12,25 +12,16 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTXPCUnprivilegedControlInterface.h"
+#import "Source/common/SNTXPCUnprivilegedControlInterface.h"

 #import <MOLXPCConnection/MOLXPCConnection.h>

-#import "SNTRule.h"
-#import "SNTStoredEvent.h"
+#import "Source/common/SNTRule.h"
+#import "Source/common/SNTStoredEvent.h"

@implementation SNTXPCUnprivilegedControlInterface

-+ (NSString *)serviceId {
-  return @"SantaUnprivilegedXPCControl";
-}
-
 + (void)initializeControlInterface:(NSXPCInterface *)r {
-  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
-        forSelector:@selector(hashBundleBinariesForEvent:reply:)
-      argumentIndex:1
-            ofReply:YES];
-
  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
        forSelector:@selector(syncBundleEvent:relatedEvents:)
      argumentIndex:1
@@ -44,11 +35,4 @@
  return r;
 }

-+ (MOLXPCConnection *)configuredConnection {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceId]
-                                                          privileged:YES];
-  c.remoteInterface = [self controlInterface];
-  return c;
-}
-
@end
--- a/Tests/LogicTests/Resources/BundleExample.app/Contents/Info.plist
+++ b/Tests/LogicTests/Resources/BundleExample.app/Contents/Info.plist
--- a/Tests/LogicTests/Resources/BundleExample.app/Contents/MacOS/BundleExample
+++ b/Tests/LogicTests/Resources/BundleExample.app/Contents/MacOS/BundleExample
--- a/Tests/LogicTests/Resources/DirectoryBundle/Contents/Info.plist
+++ b/Tests/LogicTests/Resources/DirectoryBundle/Contents/Info.plist
--- a/Tests/LogicTests/Resources/DirectoryBundle/Contents/MacOS/DirectoryBundle
+++ b/Tests/LogicTests/Resources/DirectoryBundle/Contents/MacOS/DirectoryBundle
--- a/Tests/LogicTests/Resources/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/Info.plist
+++ b/Tests/LogicTests/Resources/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/Info.plist
--- a/Tests/LogicTests/Resources/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/MacOS/BundleExample
+++ b/Tests/LogicTests/Resources/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/MacOS/BundleExample
--- a/Tests/LogicTests/Resources/bad_pagezero
+++ b/Tests/LogicTests/Resources/bad_pagezero
--- a/Tests/LogicTests/Resources/missing_pagezero
+++ b/Tests/LogicTests/Resources/missing_pagezero
--- a/Source/santa-driver/CMakeLists.txt
+++ b/Source/santa-driver/CMakeLists.txt
@@ -1,112 +0,0 @@
-cmake_minimum_required(VERSION 3.10.0)
-project(santa-driver)
-
-set(CMAKE_CXX_STANDARD 11)
-
-function(main)
-  # Include all files to make IDEs happy
-  set(PROJECT_INFOPLIST "${CMAKE_CURRENT_SOURCE_DIR}/Resources/santa-driver-Info.plist")
-
-  set(PROJECT_SOURCEFILES
-    SantaCache.h
-
-    SantaDecisionManager.cc
-    SantaDecisionManager.h
-
-    SantaDriver.cc
-    SantaDriver.h
-
-    SantaDriverClient.cc
-    SantaDriverClient.h
-
-    main.c
-
-    "${PROJECT_INFOPLIST}"
-  )
-
-  add_library("${PROJECT_NAME}" MODULE ${PROJECT_SOURCEFILES})
-  set_target_properties("${PROJECT_NAME}" PROPERTIES
-    BUNDLE TRUE
-    BUNDLE_EXTENSION "kext"
-    MACOSX_BUNDLE_INFO_PLIST "${PROJECT_INFOPLIST}"
-  )
-
-  # As we have to include the executables in the same bundle, make sure
-  # we add them as dependencies
-  add_dependencies("${PROJECT_NAME}" santad santactl santabs)
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -fmessage-length=0 -fdiagnostics-show-note-include-stack -fmacro-backtrace-limit=0
-    -nostdinc -fmodules -gmodules -fno-builtin -Wno-trigraphs -msoft-float -O0 -fno-common
-    -fapple-kext -fasm-blocks -fstrict-aliasing -MMD -MT dependencies
-    -mmacosx-version-min=${MACOSX_VERSION_MIN}
-  )
-
-  if(CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
-    target_compile_options("${PROJECT_NAME}" PRIVATE -g3)
-  endif()
-
-  target_compile_options("${PROJECT_NAME}" PRIVATE
-    -Wnon-modular-include-in-framework-module -Werror=non-modular-include-in-framework-module
-    -Wno-missing-field-initializers -Wno-missing-prototypes -Werror=return-type -Wdocumentation
-    -Wunreachable-code -Werror=deprecated-objc-isa-usage -Werror=objc-root-class -Wno-missing-braces
-    -Wparentheses -Wswitch -Wunused-function -Wno-unused-label -Wno-unused-parameter
-    -Wunused-variable -Wunused-value -Wempty-body -Wuninitialized -Wconditional-uninitialized
-    -Wno-unknown-pragmas -Wno-shadow -Wno-four-char-constants -Wno-conversion -Wconstant-conversion
-    -Wint-conversion -Wbool-conversion -Wenum-conversion -Wno-float-conversion
-    -Wnon-literal-null-conversion -Wobjc-literal-conversion -Wshorten-64-to-32 -Wpointer-sign
-    -Wno-newline-eof -Wdeprecated-declarations -Wno-sign-conversion -Winfinite-recursion -Wcomma
-    -Wblock-capture-autoreleasing -Wstrict-prototypes -Wunguarded-availability
-  )
-
-  target_compile_definitions("${PROJECT_NAME}" PRIVATE
-    KERNEL
-    KERNEL_PRIVATE
-    DRIVER_PRIVATE
-    APPLE
-    NeXT
-    CMAKE
-    -DSANTA_VERSION="${SANTA_VERSION}"
-  )
-
-  if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-    target_compile_definitions("${PROJECT_NAME}" PRIVATE DEBUG)
-  else()
-    target_compile_definitions("${PROJECT_NAME}" PRIVATE NDEBUG)
-  endif()
-
-  target_include_directories("${PROJECT_NAME}" SYSTEM PRIVATE
-    "${XCODE_ROOT_FOLDER}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX${MACOSX_SDK_VERSION}.sdk/System/Library/Frameworks/Kernel.framework/PrivateHeaders"
-    "${XCODE_ROOT_FOLDER}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX${MACOSX_SDK_VERSION}.sdk/System/Library/Frameworks/Kernel.framework/Headers"
-  )
-
-  target_include_directories("${PROJECT_NAME}" PRIVATE
-    "${CMAKE_SOURCE_DIR}/Source/santa-driver"
-    "${CMAKE_SOURCE_DIR}/Source/common"
-  )
-
-  target_link_libraries("${PROJECT_NAME}" PRIVATE
-    -Xlinker -export_dynamic
-    -Xlinker -no_deduplicate
-    -Xlinker -kext
-    -nostdlib -lkmodc++ -lkmod -lcc_kext
-  )
-
-  add_custom_command(TARGET "${PROJECT_NAME}" POST_BUILD
-    # Copy santad and santactl
-    COMMAND "${CMAKE_COMMAND}" -E copy $<TARGET_FILE:santad> "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}.kext/Contents/MacOS"
-    COMMAND "${CMAKE_COMMAND}" -E copy $<TARGET_FILE:santactl> "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}.kext/Contents/MacOS"
-
-    # Copy the the santabs service
-    COMMAND "${CMAKE_COMMAND}" -E copy_directory "${CMAKE_BINARY_DIR}/Source/santabs/santabs.xpc" "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}.kext/Contents/XPCServices/santabs.xpc"
-
-    # Sign everything
-    COMMAND codesign --force --verify --verbose --sign "${CODESIGN_IDENTITY}" "${CMAKE_BINARY_DIR}/Source/santa-driver/santa-driver.kext"
-    COMMENT "Building and signing santa-driver.kext"
-  )
-
-  install(TARGETS "${PROJECT_NAME}" LIBRARY DESTINATION "/Library/Extensions")
-  install(CODE "execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin/santactl)")
-endfunction()
-
-main()
--- a/Source/santa-driver/main.c
+++ b/Source/santa-driver/main.c
@@ -1,11 +0,0 @@
-#include <mach/mach_types.h>
-
-extern kern_return_t _start(kmod_info_t *ki, void *data);
-extern kern_return_t _stop(kmod_info_t *ki, void *data);
-
-__attribute__((visibility("default"))) KMOD_EXPLICIT_DECL(com.google.santa-driver, SANTA_VERSION, _start, _stop)
-
-__private_extern__ kmod_start_func_t *_realmain = 0;
-__private_extern__ kmod_stop_func_t *_antimain = 0;
-
-__private_extern__ int _kext_apple_cc = __APPLE_CC__ ;
--- a/Source/santa/BUILD
+++ b/Source/santa/BUILD
@@ -0,0 +1,60 @@
+licenses(["notice"])  # Apache 2.0
+
+exports_files([
+    "Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-256.png",
+])
+
+load("@build_bazel_rules_apple//apple:macos.bzl", "macos_application")
+
+objc_library(
+    name = "SantaGUI_lib",
+    srcs = [
+        "SNTAboutWindowController.h",
+        "SNTAboutWindowController.m",
+        "SNTAccessibleTextField.h",
+        "SNTAccessibleTextField.m",
+        "SNTAppDelegate.h",
+        "SNTAppDelegate.m",
+        "SNTMessageWindow.h",
+        "SNTMessageWindow.m",
+        "SNTMessageWindowController.h",
+        "SNTMessageWindowController.m",
+        "SNTNotificationManager.h",
+        "SNTNotificationManager.m",
+        "main.m",
+    ],
+    data = [
+        "Resources/AboutWindow.xib",
+        "Resources/MessageWindow.xib",
+    ],
+    sdk_frameworks = [
+        "IOKit",
+        "SecurityInterface",
+        "SystemExtensions",
+    ],
+    deps = [
+        "//Source/common:SNTBlockMessage_SantaGUI",
+        "//Source/common:SNTConfigurator",
+        "//Source/common:SNTXPCControlInterface",
+        "//Source/common:SNTXPCNotifierInterface",
+        "@MOLCodesignChecker",
+        "@MOLXPCConnection",
+    ],
+)
+
+macos_application(
+    name = "Santa",
+    additional_contents = {
+        "//Source/santactl": "MacOS",
+        "//Source/santabundleservice": "MacOS",
+        "//Source/santad:com.google.santa.daemon": "Library/SystemExtensions",
+    },
+    app_icons = glob(["Resources/Images.xcassets/**"]),
+    bundle_id = "com.google.santa",
+    bundle_name = "Santa",
+    infoplists = ["Info.plist"],
+    minimum_os_version = "10.9",
+    version = "//:version",
+    visibility = ["//visibility:public"],
+    deps = [":SantaGUI_lib"],
+)
--- a/Source/SantaGUI/Resources/SantaGUI-Info.plist
+++ b/Source/SantaGUI/Resources/SantaGUI-Info.plist
@@ -2,31 +2,31 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>Google, Inc.</string>
-	<key>CFBundleIdentifier</key>
-	<string>com.google.SantaGUI</string>
-	<key>CFBundleName</key>
-	<string>Santa</string>
 	<key>CFBundleExecutable</key>
 	<string>Santa</string>
-	<key>CFBundleVersion</key>
-	<string>${SANTA_VERSION}</string>
-	<key>CFBundleShortVersionString</key>
-	<string>${SANTA_VERSION}</string>
-	<key>LSMinimumSystemVersion</key>
-	<string>${MACOSX_VERSION_MIN}</string>
-	<key>LSUIElement</key>
-	<true/>
-	<key>NSPrincipalClass</key>
-	<string>NSApplication</string>
 	<key>CFBundleIconFile</key>
 	<string>AppIcon</string>
 	<key>CFBundleIconName</key>
 	<string>AppIcon</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>Santa</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>${MACOSX_VERSION_MIN}</string>
+	<key>LSUIElement</key>
+	<true/>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google LLC.</string>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
 </dict>
 </plist>
--- a/Source/SantaGUI/Resources/AboutWindow.xib
+++ b/Source/SantaGUI/Resources/AboutWindow.xib
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="16D32" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14460.31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="10117"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14460.31"/>
+        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
    </dependencies>
    <objects>
        <customObject id="-2" userLabel="File's Owner" customClass="SNTAboutWindowController">
@@ -13,10 +13,10 @@
        </customObject>
        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
+        <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
            <rect key="contentRect" x="196" y="240" width="480" height="200"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="3840" height="1577"/>
            <view key="contentView" id="se5-gp-TjO">
                <rect key="frame" x="0.0" y="0.0" width="480" height="200"/>
                <autoresizingMask key="autoresizingMask"/>
@@ -29,12 +29,13 @@
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Santa" id="VVj-gU-bzy">
                            <font key="font" size="34" name="HelveticaNeue-UltraLight"/>
-                            <color key="textColor" red="0.1869618941" green="0.1869618941" blue="0.1869618941" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                    </textField>
                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" fixedFrame="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="uh6-q0-RzL">
                        <rect key="frame" x="18" y="65" width="444" height="60"/>
+                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
                        <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="center" id="CcT-ul-1eA">
                            <font key="font" metaFont="system"/>
                            <string key="title">Santa is an application whitelisting system for macOS.
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/Contents.json
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/Contents.json
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-16.png
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-16.png
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-256.png
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-256.png
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-32.png
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-32.png
--- a/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-64.png
+++ b/Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-64.png
--- a/Source/SantaGUI/Resources/Images.xcassets/Contents.json
+++ b/Source/SantaGUI/Resources/Images.xcassets/Contents.json
--- a/Source/SantaGUI/Resources/MessageWindow.xib
+++ b/Source/SantaGUI/Resources/MessageWindow.xib
@@ -1,10 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="13529" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14460.31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
-        <deployment identifier="macosx"/>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="13529"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14460.31"/>
        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
-        <capability name="system font weights other than Regular or Bold" minToolsVersion="7.0"/>
    </dependencies>
    <objects>
        <customObject id="-2" userLabel="File's Owner" customClass="SNTMessageWindowController">
@@ -20,10 +18,10 @@
        </customObject>
        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
            <windowStyleMask key="styleMask" utility="YES"/>
            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="3840" height="1578"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="3840" height="1577"/>
            <view key="contentView" id="Iwq-Lx-rLv">
                <rect key="frame" x="0.0" y="0.0" width="540" height="479"/>
                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
@@ -42,14 +40,14 @@
                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="vl5-A8-O0H"/>
                        </connections>
                    </button>
-                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
+                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" textCompletion="NO" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
                        <rect key="frame" x="43" y="369" width="454" height="17"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" refusesFirstResponder="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="A message to the user goes here..." allowsEditingTextAttributes="YES" id="5tH-bG-UJA">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -92,7 +90,7 @@
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Name" id="E7T-9h-ofr">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -117,7 +115,7 @@
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -168,7 +166,7 @@
                        </constraints>
                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="SHA-256" id="X4W-9e-eIu">
                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                            <userDefinedRuntimeAttributes>
                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
@@ -214,7 +212,7 @@
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Parent Name" id="ieo-WK-aDD">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -242,7 +240,7 @@
                        </textFieldCell>
                    </textField>
                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
-                        <rect key="frame" x="154" y="33" width="112" height="25"/>
+                        <rect key="frame" x="154" y="34" width="112" height="23"/>
                        <constraints>
                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
                        </constraints>
@@ -266,7 +264,7 @@ DQ
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -287,7 +285,7 @@ DQ
                        </connections>
                    </button>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
-                        <rect key="frame" x="278" y="33" width="110" height="25"/>
+                        <rect key="frame" x="278" y="34" width="110" height="23"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
@@ -313,7 +311,7 @@ DQ
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
                            <font key="font" metaFont="system"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -337,7 +335,7 @@ DQ
                        </constraints>
                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="Calculating..." id="yJa-yL-X9a">
                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                            <userDefinedRuntimeAttributes>
                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
@@ -354,7 +352,7 @@ DQ
                        </constraints>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="1000 related binaries" id="AVM-vB-hB8">
                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                    </textField>
@@ -374,7 +372,7 @@ DQ
                        </constraints>
                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                        </textFieldCell>
                        <connections>
@@ -410,8 +408,8 @@ DQ
                        <rect key="frame" x="229" y="408" width="82" height="41"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
                            <font key="font" metaFont="systemUltraLight" size="34"/>
-                            <color key="textColor" red="0.20000000000000001" green="0.20000000000000001" blue="0.20000000000000001" alpha="1" colorSpace="calibratedRGB"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                            <userDefinedRuntimeAttributes>
                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
                            </userDefinedRuntimeAttributes>
--- a/Source/SantaGUI/SNTAboutWindowController.h
+++ b/Source/SantaGUI/SNTAboutWindowController.h
--- a/Source/SantaGUI/SNTAboutWindowController.m
+++ b/Source/SantaGUI/SNTAboutWindowController.m
@@ -12,9 +12,9 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTAboutWindowController.h"
+#import "Source/santa/SNTAboutWindowController.h"

-#import "SNTConfigurator.h"
+#import "Source/common/SNTConfigurator.h"

@implementation SNTAboutWindowController

--- a/Source/SantaGUI/SNTAccessibleTextField.h
+++ b/Source/SantaGUI/SNTAccessibleTextField.h
--- a/Source/SantaGUI/SNTAccessibleTextField.m
+++ b/Source/SantaGUI/SNTAccessibleTextField.m
@@ -12,14 +12,10 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTAccessibleTextField.h"
+#import "Source/santa/SNTAccessibleTextField.h"

@implementation SNTAccessibleTextField

- (BOOL)accessibilityIsIgnored {
-  return NO;
-}
-
 - (NSString *)accessibilityLabel {
  if (self.toolTip && self.stringValue) {
    return [NSString stringWithFormat:@"%@: %@", self.toolTip, self.stringValue];
--- a/Source/SantaGUI/SNTAppDelegate.h
+++ b/Source/SantaGUI/SNTAppDelegate.h
--- a/Source/SantaGUI/SNTAppDelegate.m
+++ b/Source/SantaGUI/SNTAppDelegate.m
@@ -12,21 +12,23 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTAppDelegate.h"
+#import "Source/santa/SNTAppDelegate.h"

 #import <MOLXPCConnection/MOLXPCConnection.h>

-#import "SNTAboutWindowController.h"
-#import "SNTConfigurator.h"
-#import "SNTNotificationManager.h"
-#import "SNTStrengthify.h"
-#import "SNTXPCControlInterface.h"
+#import <SystemExtensions/SystemExtensions.h>

-@interface SNTAppDelegate ()
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTLogging.h"
+#import "Source/common/SNTStrengthify.h"
+#import "Source/common/SNTXPCControlInterface.h"
+#import "Source/santa/SNTAboutWindowController.h"
+#import "Source/santa/SNTNotificationManager.h"
+
+@interface SNTAppDelegate ()<OSSystemExtensionRequestDelegate>
@property SNTAboutWindowController *aboutWindowController;
@property SNTNotificationManager *notificationManager;
@property MOLXPCConnection *daemonListener;
-@property MOLXPCConnection *bundleListener;
@end

@implementation SNTAppDelegate
@@ -34,6 +36,16 @@
 #pragma mark App Delegate methods

 - (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
+  if (@available(macOS 10.15, *)) {
+    LOGI(@"Requesting SystemExtension activation");
+    NSString *e = [SNTXPCControlInterface systemExtensionID];
+    dispatch_queue_t q = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0);
+    OSSystemExtensionRequest *req = [OSSystemExtensionRequest activationRequestForExtension:e
+                                                                                      queue:q];
+    req.delegate = self;
+    [[OSSystemExtensionManager sharedManager] submitRequest:req];
+  }
+
  [self setupMenu];
  self.notificationManager = [[SNTNotificationManager alloc] init];

@@ -46,21 +58,15 @@
    self.daemonListener.invalidationHandler = nil;
    [self.daemonListener invalidate];
    self.daemonListener = nil;
-
-    self.bundleListener.invalidationHandler = nil;
-    [self.bundleListener invalidate];
-    self.bundleListener = nil;
  }];
  [workspaceNotifications addObserverForName:NSWorkspaceSessionDidBecomeActiveNotification
                                      object:nil
                                       queue:[NSOperationQueue currentQueue]
                                  usingBlock:^(NSNotification *note) {
    [self attemptDaemonReconnection];
-    [self attemptBundleReconnection];
  }];

  [self createDaemonConnection];
-  [self createBundleConnection];
 }

 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
@@ -90,6 +96,11 @@
  };
  [self.daemonListener resume];

+  // This listener will also handle bundle service requests to update the GUI.
+  // When initializing connections with santabundleservice, the notification manager
+  // will send along the endpoint so santabundleservice knows where to find us.
+  self.notificationManager.notificationListener = listener.endpoint;
+
  // Tell daemon to connect back to the above listener.
  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
  [daemonConn resume];
@@ -108,43 +119,6 @@
  [self performSelectorInBackground:@selector(createDaemonConnection) withObject:nil];
 }

- (void)createBundleConnection {
-  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
-
-  WEAKIFY(self);
-
-  // Create listener for return connection from the bundle service.
-  NSXPCListener *listener = [NSXPCListener anonymousListener];
-  self.bundleListener = [[MOLXPCConnection alloc] initServerWithListener:listener];
-  self.bundleListener.privilegedInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
-  self.bundleListener.exportedObject = self.notificationManager;
-  self.bundleListener.acceptedHandler = ^{
-    dispatch_semaphore_signal(sema);
-  };
-  self.bundleListener.invalidationHandler = ^{
-    STRONGIFY(self);
-    [self attemptBundleReconnection];
-  };
-  [self.bundleListener resume];
-
-  // Tell santabs to connect back to the above listener.
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
-  [daemonConn resume];
-  [[daemonConn remoteObjectProxy] setBundleNotificationListener:listener.endpoint];
-  [daemonConn invalidate];
-
-  // Now wait for the connection to come in.
-  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self attemptBundleReconnection];
-  }
-}
-
- (void)attemptBundleReconnection {
-  self.bundleListener.invalidationHandler = nil;
-  [self.bundleListener invalidate];
-  [self performSelectorInBackground:@selector(createBundleConnection) withObject:nil];
-}
-
 #pragma mark Menu Management

 - (void)setupMenu {
@@ -161,4 +135,33 @@
  [NSApp setMainMenu:mainMenu];
 }

+#pragma mark OSSystemExtensionRequestDelegate
+
+- (OSSystemExtensionReplacementAction)request:(OSSystemExtensionRequest *)request
+                  actionForReplacingExtension:(OSSystemExtensionProperties *)old
+                                withExtension:(OSSystemExtensionProperties *)new
+    API_AVAILABLE(macos(10.15)) {
+  LOGI(@"SystemExtension \"%@\" request for replacement", request.identifier);
+#ifdef DEBUG
+  return OSSystemExtensionReplacementActionReplace;
+#else
+  return [old.bundleVersion isEqualToString:new.bundleVersion]
+      ? OSSystemExtensionReplacementActionCancel : OSSystemExtensionReplacementActionReplace;
+#endif
+}
+
+- (void)requestNeedsUserApproval:(OSSystemExtensionRequest *)request API_AVAILABLE(macos(10.15)) {
+  LOGI(@"SystemExtension \"%@\" request needs user approval", request.identifier);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFailWithError:(NSError *)error API_AVAILABLE(macos(10.15)) {
+  LOGI(@"SystemExtension \"%@\" request did fail: %@", request.identifier, error);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFinishWithResult:(OSSystemExtensionRequestResult)result API_AVAILABLE(macos(10.15)) {
+  LOGI(@"SystemExtension \"%@\" request did finish: %ld", request.identifier, (long)result);
+}
+
@end
--- a/Source/SantaGUI/SNTMessageWindow.h
+++ b/Source/SantaGUI/SNTMessageWindow.h
--- a/Source/SantaGUI/SNTMessageWindow.m
+++ b/Source/SantaGUI/SNTMessageWindow.m
@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTMessageWindow.h"
+#import "Source/santa/SNTMessageWindow.h"

@implementation SNTMessageWindow

--- a/Source/SantaGUI/SNTMessageWindowController.h
+++ b/Source/SantaGUI/SNTMessageWindowController.h
--- a/Source/SantaGUI/SNTMessageWindowController.m
+++ b/Source/SantaGUI/SNTMessageWindowController.m
@@ -12,16 +12,15 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTMessageWindowController.h"
-
-#import <SecurityInterface/SFCertificatePanel.h>
+#import "Source/santa/SNTMessageWindowController.h"

 #import <MOLCertificate/MOLCertificate.h>
+#import <SecurityInterface/SFCertificatePanel.h>

-#import "SNTBlockMessage.h"
-#import "SNTConfigurator.h"
-#import "SNTMessageWindow.h"
-#import "SNTStoredEvent.h"
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTStoredEvent.h"
+#import "Source/santa/SNTMessageWindow.h"

@interface SNTMessageWindowController ()
 ///  The custom message to display for this event
--- a/Source/SantaGUI/SNTNotificationManager.h
+++ b/Source/SantaGUI/SNTNotificationManager.h
@@ -14,13 +14,14 @@

 #import <Cocoa/Cocoa.h>

-#import "SNTMessageWindowController.h"
-#import "SNTXPCNotifierInterface.h"
+#import "Source/common/SNTXPCNotifierInterface.h"
+#import "Source/santa/SNTMessageWindowController.h"

 ///
 ///  Keeps track of pending notifications and ensures only one is presented to the user at a time.
 ///
-@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate,
-                                             SNTNotifierXPC, SNTBundleNotifierXPC>
+@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate, SNTNotifierXPC>
+
+@property NSXPCListenerEndpoint *notificationListener;

@end
--- a/Source/SantaGUI/SNTNotificationManager.m
+++ b/Source/SantaGUI/SNTNotificationManager.m
@@ -12,16 +12,16 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#import "SNTNotificationManager.h"
+#import "Source/santa/SNTNotificationManager.h"

 #import <MOLXPCConnection/MOLXPCConnection.h>

-#import "SNTBlockMessage.h"
-#import "SNTConfigurator.h"
-#import "SNTLogging.h"
-#import "SNTStoredEvent.h"
-#import "SNTStrengthify.h"
-#import "SNTXPCControlInterface.h"
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTLogging.h"
+#import "Source/common/SNTStoredEvent.h"
+#import "Source/common/SNTStrengthify.h"
+#import "Source/common/SNTXPCControlInterface.h"

@interface SNTNotificationManager ()

@@ -31,12 +31,6 @@
 ///  The queue of pending notifications
@property(readonly) NSMutableArray *pendingNotifications;

-///  The connection to the bundle service
-@property MOLXPCConnection *bundleServiceConnection;
-
-///  A semaphore to block bundle hashing until a connection is established
-@property dispatch_semaphore_t bundleServiceSema;
-
 // A serial queue for holding hashBundleBinaries requests
@property dispatch_queue_t hashBundleBinariesQueue;

@@ -50,7 +44,6 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  self = [super init];
  if (self) {
    _pendingNotifications = [[NSMutableArray alloc] init];
-    _bundleServiceSema = dispatch_semaphore_create(0);
    _hashBundleBinariesQueue = dispatch_queue_create("com.google.santagui.hashbundlebinaries",
                                                     DISPATCH_QUEUE_SERIAL);
  }
@@ -72,10 +65,10 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
      });
    }
  } else {
-    // Tear down the bundle service
-    self.bundleServiceSema = dispatch_semaphore_create(0);
-    [self.bundleServiceConnection invalidate];
-    self.bundleServiceConnection = nil;
+    MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+    [bc resume];
+    [[bc remoteObjectProxy] spindown];
+    [bc invalidate];
    [NSApp hide:self];
  }
 }
@@ -192,48 +185,35 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
  }
 }

- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithListener:listener];
-  c.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
-  [c resume];
-  self.bundleServiceConnection = c;
-
-  WEAKIFY(self);
-  self.bundleServiceConnection.invalidationHandler = ^{
-    STRONGIFY(self);
-    if (self.currentWindowController) {
-      [self updateBlockNotification:self.currentWindowController.event withBundleHash:nil];
-    }
-    self.bundleServiceConnection.invalidationHandler = nil;
-    [self.bundleServiceConnection invalidate];
-  };
-
-  dispatch_semaphore_signal(self.bundleServiceSema);
-}
-
 #pragma mark SNTBundleNotifierXPC helper methods

 - (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event {
  self.currentWindowController.foundFileCountLabel.stringValue = @"Searching for files...";

-  // Wait a max of 6 secs for the bundle service. Should the bundle service fall over, it will
-  // reconnect within 5 secs. Otherwise abandon bundle hashing and display the blockable event.
-  if (dispatch_semaphore_wait(self.bundleServiceSema,
-                              dispatch_time(DISPATCH_TIME_NOW, 6 * NSEC_PER_SEC))) {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+  bc.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+  [bc resume];
+
+  // Wait a max of 5 secs for the bundle service
+  // Otherwise abandon bundle hashing and display the blockable event.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
    [self updateBlockNotification:event withBundleHash:nil];
    return;
  }

-  // Let all future requests flow, until the connection is terminated and we go back to waiting.
-  dispatch_semaphore_signal(self.bundleServiceSema);
+  [[bc remoteObjectProxy] setNotificationListener:self.notificationListener];

  // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
  [self.currentWindowController.progress becomeCurrentWithPendingUnitCount:100];

  // Start hashing. Progress is reported to the root NSProgress (currentWindowController.progress).
-  [[self.bundleServiceConnection remoteObjectProxy]
-      hashBundleBinariesForEvent:event
-                           reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
+  [[bc remoteObjectProxy] hashBundleBinariesForEvent:event
+                                               reply:^(NSString *bh,
+                                                       NSArray<SNTStoredEvent *> *events,
+                                                       NSNumber *ms) {
    // Revert to displaying the blockable event if we fail to calculate the bundle hash
    if (!bh) return [self updateBlockNotification:event withBundleHash:nil];

@@ -255,7 +235,10 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";

    // Update the UI with the bundle hash. Also make the openEventButton available.
    [self updateBlockNotification:event withBundleHash:bh];
+
+    [bc invalidate];
  }];
+
  [self.currentWindowController.progress resignCurrent];
 }

--- a/Source/santa/Santa.app.entitlements
+++ b/Source/santa/Santa.app.entitlements
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.developer.system-extension.install</key>
+	<true/>
+</dict>
+</plist>
--- a/Source/santa/main.m
+++ b/Source/santa/main.m
@@ -0,0 +1,95 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <Cocoa/Cocoa.h>
+#import <SystemExtensions/SystemExtensions.h>
+
+#import "Source/common/SNTXPCControlInterface.h"
+#import "Source/santa/SNTAppDelegate.h"
+
+@interface SNTSystemExtensionDelegate : NSObject<OSSystemExtensionRequestDelegate>
+@end
+
+@implementation SNTSystemExtensionDelegate
+
+#pragma mark OSSystemExtensionRequestDelegate
+
+- (OSSystemExtensionReplacementAction)request:(OSSystemExtensionRequest *)request
+                  actionForReplacingExtension:(OSSystemExtensionProperties *)old
+                                withExtension:(OSSystemExtensionProperties *)new
+    API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request for replacement", request.identifier);
+  return OSSystemExtensionReplacementActionReplace;
+}
+
+- (void)requestNeedsUserApproval:(OSSystemExtensionRequest *)request API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request needs user approval", request.identifier);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFailWithError:(NSError *)error API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request did fail: %@", request.identifier, error);
+  exit((int)error.code);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFinishWithResult:(OSSystemExtensionRequestResult)result API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request did finish: %ld", request.identifier, (long)result);
+  exit(0);
+}
+
+@end
+
+int main(int argc, const char *argv[]) {
+  @autoreleasepool {
+    NSNumber *sysxOperation;
+    NSArray *args = [NSProcessInfo processInfo].arguments;
+    if ([args containsObject:@"--load-system-extension"]) {
+      sysxOperation = @(1);
+    } else if ([args containsObject:@"--unload-system-extension"]) {
+      sysxOperation = @(2);
+    }
+    if (sysxOperation) {
+      if (@available(macOS 10.15, *)) {
+        NSString *e = [SNTXPCControlInterface systemExtensionID];
+        dispatch_queue_t q = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0);
+        OSSystemExtensionRequest *req;
+        if (sysxOperation.intValue == 1) {
+          NSLog(@"Requesting SystemExtension activation");
+          req = [OSSystemExtensionRequest activationRequestForExtension:e queue:q];
+        } else if (sysxOperation.intValue == 2) {
+          NSLog(@"Requesting SystemExtension deactivation");
+          req = [OSSystemExtensionRequest deactivationRequestForExtension:e queue:q];
+        }
+        if (req) {
+          SNTSystemExtensionDelegate *ed = [[SNTSystemExtensionDelegate alloc] init];
+          req.delegate = ed;
+          [[OSSystemExtensionManager sharedManager] submitRequest:req];
+          dispatch_after(dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 60), q, ^{
+            exit(1);
+          });
+          [[NSRunLoop mainRunLoop] run];
+        }
+      } else {
+        exit(1);
+      }
+    }
+
+    NSApplication *app = [NSApplication sharedApplication];
+    SNTAppDelegate *delegate = [[SNTAppDelegate alloc] init];
+    [app setDelegate:delegate];
+    [app finishLaunching];
+    [app run];
+  }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tom Burgin	d1d008af0a	don't log TRUNCATE and don't log fileops from com.google.santa.daemon (#428 ) * don't log TRUNCATE and don't log fileops from com.google.santa.daemon * review updates	2019-12-20 14:00:16 -05:00
Tom Burgin	5db56e01f5	cleanup 10.14 -> 10.15 upgrade artifacts (#427 ) * cleanup 10.14 -> 10.15 upgrade artifacts * exit exit * exit exit	2019-12-19 15:56:59 -05:00
Tom Burgin	726c49bec5	com.google.santa.daemon: handle es deadline (#426 ) * com.google.santa.daemon: deny execs that are about to exceed the es deadline * update comment * actually handle the deadline	2019-12-16 13:03:20 -05:00
Tom Burgin	ae5db5dde7	com.google.santa.daemon: lookup the tty for deny decisions before posting the decision (#425 )	2019-12-13 15:24:21 -05:00
Tom Burgin	2671807f0e	com.google.santa.daemon: don't reload if versions have not changed (#424 )	2019-12-12 14:02:23 -05:00
Tom Burgin	70c8626016	fix com.google.santa.daemon path for critical system binary checking (#423 )	2019-12-12 11:41:16 -05:00
Tom Burgin	436c472a49	es event provider: support transitive whitelisting (#422 ) * es event provider: support transitive whitelisting * remove vector * truncate check * consistent log style * review updates	2019-12-12 11:30:05 -05:00
Tom Burgin	ed5be6b062	com.google.santa.daemon: async es message handling (#421 ) * fix Santa.xcodeproj * com.google.santa.daemon: some es tweaks * review updates	2019-12-09 11:21:12 -05:00
Russell Hancox	a38f24728a	santactl/status: Remove kext section of status on 10.15+	2019-11-25 19:32:54 -05:00
Russell Hancox	4af026356f	santactl/version: print useful status for santa-driver on 10.15	2019-11-25 19:32:30 -05:00
Russell Hancox	c6e1bb5618	santad: Fix Apple-cert trust	2019-11-25 19:31:51 -05:00
Tom Burgin	e64d2e7ad4	Update README.md (#416 )	2019-11-10 12:18:33 -05:00
Russell Hancox	3d393e9aa4	santa-driver: Workaround 10.15 SDK Dispatch() issue	2019-11-09 08:18:51 -05:00
Russell Hancox	b8f3122ee9	santad: Don't need macos_command_line_application anymore	2019-11-08 22:22:09 -05:00
Russell Hancox	8acfa6591e	santa-driver: Fix compilation of SNTPrefixTree	2019-11-08 22:22:09 -05:00
Russell Hancox	25b75b0e1b	santad: Re-work targets to avoid unnecessary postprocessing	2019-11-08 22:22:09 -05:00
Russell Hancox	cb01b77f84	Project: no longer need to move the embedded provisionprofile	2019-11-08 22:22:09 -05:00
Russell Hancox	61582a0324	Project: standardize Info.plist and entitlement paths	2019-11-08 22:22:09 -05:00
Russell Hancox	a17b5d51a4	Project: more BUILD file cleanups, remove commented provisioning_profile attrs	2019-11-08 22:22:09 -05:00
Russell Hancox	447ea8674b	Project: run buildifier on all bazel files, fix typo (#405 )	2019-11-08 22:22:09 -05:00
Russell Hancox	c5eec850e1	Project: update santad path (#404 )	2019-11-08 22:22:09 -05:00
Russell Hancox	1870631150	Project: Update bazel rules for endpointsec (#403 )	2019-11-08 22:22:09 -05:00
Russell Hancox	20ed1659c1	santad: Don't store rules for santad/launchd, keep in-mem (#402 )	2019-11-08 22:22:09 -05:00
Tom Burgin	258de3efba	handle all ACTION_RESPOND_* (#401 )	2019-11-08 22:22:09 -05:00
Tom Burgin	394fd5fab9	add required santad entitlements (#400 )	2019-11-08 22:22:09 -05:00
Russell Hancox	53b7ef86ed	santad: Log file changes, use prefix trees (#398 )	2019-11-08 22:22:09 -05:00
Russell Hancox	423479771e	santad: Use args from endpointsecurity rather than using the sysctl (#396 ) This should be much more reliable and, in theory, faster.	2019-11-08 22:22:09 -05:00
Tom Burgin	933271826b	simplify santabundleservice xpc connection protocol (#397 ) * simplify santabundleservice xpc connection protocol * fix BUILD deps * fix BUILD deps * know	2019-11-08 22:22:09 -05:00
Tom Burgin	880170ea7d	make santabundleservice a command line app (#395 ) * make santabundleservice a command line app * bazel - don't build santabs.xpc	2019-11-08 22:22:09 -05:00
Russell Hancox	e58ec37881	santad: Fix BUILD after moving EventProviders (#394 )	2019-11-08 22:22:09 -05:00
Russell Hancox	dece50dd10	Logging: under 10.15, force santad into syslog mode (#393 )	2019-11-08 22:22:09 -05:00
Russell Hancox	9db9fc6009	santad: Move event providers into a new group, make ES connection logic smarter (#392 )	2019-11-08 22:22:09 -05:00
Russell Hancox	f38c030805	Add file IDs to messages (#391 )	2019-11-08 22:22:09 -05:00
Tom Burgin	d8060d3af9	update component paths (#390 )	2019-11-08 22:22:09 -05:00
Russell Hancox	34b4090b42	Project: fix some new Xcode11 warnings (#389 )	2019-11-08 22:22:09 -05:00
Tom Burgin	c6ca3d64b3	add SNTEventProvider interface (#388 ) * Add SNTEventProvider interface * execution controller test should use the event provider interface * * Xcode project: Use manual signing * SNTEndpointSecurityManager: Don't cache deny decisions * Review updates * review updates	2019-11-08 22:22:09 -05:00
Tom Burgin	4913426631	* Added Xcode project + pods (#387 ) * * Added Xcode project + pods * Cleaned up unused SNTXPCUnprivilegedControlInterface MachServices id. * Change santad's MachServices id to be compatible with the default SystemExtension namespace template. * pods * bazel * switch MachService name for 10.15+ * build with SystemExensions framework * build with Xcode 11 * launchd.plist fix * use @available * * Request SystemExtension activation on a background thread. * Create a constant for the "com.google.santa.daemon" SystemExtension id.	2019-11-08 22:22:09 -05:00
Russell Hancox	455a1c76c3	Docs: update building docs. Fixes #411 . Will need updating again when we merge endpointsec.	2019-11-08 22:11:35 -05:00
Russell Hancox	e5a5f6f9fb	Bump MOLAuthenticatingURLSession version (#384 )	2019-08-02 16:16:51 -04:00
ancdesign	7ef88d06a5	fix typo (inital -> intial) (#378 )	2019-07-29 08:29:04 -04:00
Russell Hancox	bc82d7988b	santad: Add /usr/lib/dyld to critical system binaries (#376 ) dyld is also authorized by santad and a bad cache eviction plus trustd/ocspd not running can result in deadlock. Fixes #375, probably.	2019-07-22 17:05:34 -04:00
Russell Hancox	545fa858e4	SantaGUI: ensure bundle listeners are invalidated (#373 ) When setting a new bundle service listener, it was possible for an existing listener to be replaced without invalidating it first. This can cause crashes if a process somehow tries to connect to that listener later on.	2019-07-17 11:27:50 -04:00
Russell Hancox	71c917649e	Set theme jekyll-theme-cayman	2019-07-12 13:56:04 -04:00
Tom Burgin	3781556cf5	Create CNAME	2019-07-12 13:52:59 -04:00
Tom Burgin	765d10a7c3	rename Docs -> docs (#372 )	2019-07-12 13:50:19 -04:00
Tom Burgin	3583113381	santactl: nil prefix value check - fixes #361 (#362 ) * santactl: nil prefix value check - fixes #361 * santactl: check all filters	2019-07-12 13:13:43 -04:00
Tom Burgin	46cd60e579	Use updated deps (#370 ) * Use updated deps * update travis build settings	2019-06-23 12:43:50 -04:00
Tom Burgin	8198e59736	tests: Create a SantaPrefixTree userland lib (#359 )	2019-03-04 14:22:19 -05:00
Russell Hancox	c5f0f5d177	Project: Use MOLCodesignChecker v2.1 (#356 )	2019-02-27 16:15:13 -05:00
Tom Burgin	ebc93954be	SantaGUI: Fix message text. Add support for Dark Mode. (#354 )	2019-02-21 16:53:20 -05:00
Russell Hancox	cb4d2984b3	SantaCache: Fix possible divide by zero in bucket count calculation (#353 )	2019-02-20 17:56:42 -05:00
Russell Hancox	4c2018ef67	SantaCache: Fix flaky test (#352 )	2019-02-20 13:18:40 -05:00
Russell Hancox	06d8295d0a	Project: Use apple_resource_group for test resources. Fix bazelrc (#351 )	2019-02-19 12:20:30 -05:00
Tom Burgin	ef8e9975e9	c++11 features (#350 )	2019-02-15 17:14:10 -05:00
Russell Hancox	31509f4b9c	Project: Minor tidy-ups (#349 )	2019-02-15 16:59:32 -05:00
Tom Burgin	497c1f393f	project format (#347 ) * starlark format * Source/santa-driver -> Source/santa_driver * buildifier * kernel_tests unloads the driver * review updates * review updates	2019-02-15 15:38:06 -05:00
Tom Burgin	8334a245c7	cleanup unused includes (#346 )	2019-02-15 11:12:38 -05:00
Tom Burgin	e8826a2941	add licenses and default_visibility to each BUILD file (#345 ) * add licenses and default_visibility to each BUILD file * remove default_visibility the bins are public * oops	2019-02-15 11:03:28 -05:00
Tom Burgin	ef040c1e7d	resurrect action=BUNDLE logs (#344 ) They were lost in the refactoring of the logging utility `4a2cf9d722`.	2019-02-11 13:46:37 -05:00
Russell Hancox	dc692c8256	Project: Move tests with the code they're testing (#343 ) Add helper to make declaring unit tests easier Add unit_tests test_suite containing all unit tests Fix reload rule Update to workspace-relative header locations that were missed before	2019-02-06 15:09:09 -05:00
Russell Hancox	e9c7bfc087	Project: Make all imports workspace-relative, remove include attributes from all rules. (#339 )	2019-01-22 14:24:11 -05:00
Russell Hancox	22c72625c8	Project: Split BUILD file into several. Part 1/3 (#338 ) * Project: Split BUILD file into several. Part 1/3 The tests fail in this PR because the rules need updating. I'll fix them in a follow-up PR.	2019-01-22 12:06:48 -05:00
Tom Burgin	65a2212890	BUILD: buildifier formatting (#336 )	2019-01-17 16:23:37 -05:00
Russell Hancox	0a7c08cafc	santactl/version: Make version command not crash with new Santa.app location (#335 )	2019-01-16 17:16:39 -05:00
Tom Burgin	831a32160b	BUILD: Some tweaks (#334 )	2019-01-16 16:49:54 -05:00
Russell Hancox	b186419e54	Sync: Remove LogUpload. (#333 ) Fixes #331	2019-01-07 14:27:44 -05:00
Russell Hancox	1dc579c00f	Project: Fix badges in README (#332 )	2019-01-07 12:28:57 -05:00
Russell Hancox	abdd6c319a	Project: Update docs for switch to bazel (#330 ) * Project: Update docs for switch to bazel I also made it so the santactl compilation won't include debug-only commands in release builds and the release rule will fail on a non-opt build.	2019-01-04 19:45:00 -05:00
Russell Hancox	5dd93fadfa	Project: Convert to bazel, part 2 (#329 ) Project: Convert to bazel, part 2 The main thing to call out in this PR is that Santa.app is now embedded inside santa-driver.kext along with everything else. The package will handle updating this automatically but it should be called out in release notes to make everyone aware. * Switch to using macos_kernel_extension and macos_xpc_service, stop using product_type. * Have Bazel embed all related binaries inside santa-driver.kext, including Santa.app. This simplifies the :release and :reload rules. * Add commands for unload, load and reload, removing any need to keep the Rakefile around 😃 * Make the :kernel_tests rule a command that replicates what the Rakefile did for this. * Added a project-wide .bazelrc that always generates dSYMs Documentation changes to follow, as all the building instructions are now out of date.	2019-01-04 16:23:35 -05:00
Russell Hancox	e6fcbf59df	Proj: Convert to Bazel build, remove other build systems. (#326 ) This necessitated fixing some warnings, updating the resource locations inside some tests and updating the Travis config. I'll send a follow-up PR shortly that adds the fuzzing targets and updates the Rakefile and documentation.	2018-12-14 11:57:32 -05:00
Tom Burgin	9fd04ed301	SantaPrefixTree: Fix a bug and add some more tests (#324 ) * SantaPrefixTree: Fix a threading bug. Tests: Add logic tests for SantaPrefixTree. * clean up * don't ifdef so much * more #define less #ifdef * less lambda more of rah's ideas	2018-12-03 17:08:16 -05:00
Tom Burgin	e4b5f595ce	* Add note about vnode map. (#323 ) * Fix logic tests under Xcode 10.1.	2018-11-19 12:44:28 -05:00
Tom Burgin	212b02589b	Update README.md (#319 )	2018-11-12 10:50:28 -05:00
Tom Burgin	42c3631995	Update uninstall.sh (#318 ) I think this was added by accident.	2018-11-09 16:13:38 -05:00
Tom Burgin	2695355dd2	add in-kernel filemod prefix filter (#313 ) * add in-kernel filemod prefix filter * byte lookup * added pruning and tests * clang-format * add TODO * don't need seen * review updates * reset filter on client connect * DisconnectClient: reset filter AddPrefix: when a branch is needed create the whole branch immediately * don't use strlen in HasPrefix use strnlen in AddPrefix up max nodes to 1024 * use new[] and delete[] for the prune "stack" revert clang-format changes to kernel tests remove reset node count * words * count not size	2018-11-08 15:37:30 -05:00
Darío Hereñú	db0cd861d6	README: Paragraph formatting L157 to L168 (proposal) (#317 )	2018-11-08 13:12:23 -05:00
Victor Vrantchan	57d6a962de	update deployment documentation (#312 ) - SyncBaseURL is not overridable by the server. - ATS requires a self signed certificate to exist in the system roots. Providing roots enables in the Santa configuration enables pinning. Closes #309	2018-11-05 13:06:49 -05:00
Russell Hancox	91608d7366	santad: Document implicit rule ordering (#315 ) Also add a test to ensure this doesn't change one day without us noticing	2018-11-02 12:12:19 -04:00
Russell Hancox	7d4f1ffc45	config: Ensure syncBaseURL ends with a / (#311 ) * config: Ensure syncBaseURL ends with a / Without the trailing / the last path component is removed by `URLWithString:relativeToURL:`	2018-10-09 18:27:04 -04:00
Victor Vrantchan	ba539bb555	docs: remove space before period. (#308 )	2018-10-07 15:09:17 -04:00
Victor Vrantchan	d9ecbf06c0	Document recent changes to sync server configuration (#307 ) - bundles_enabled became enable_bundles. - enabled_transitive_whitelisting was added. Both changes were implemented in #300	2018-10-07 15:09:04 -04:00
Tom Burgin	01df4623c7	santa-driver: add back the root and non-root caches (#302 ) * santa-driver: add back the root and non-root caches * cachehistogram: clarify buckets and entries * review changes	2018-09-26 12:41:04 -04:00
Tom Burgin	c9cb91a22e	ocspd also seems integral to cs validation (#301 )	2018-09-26 08:45:39 -04:00
Russell Hancox	1f9d60aecc	common: Allow transitive whitelisting to be controlled by sync servers. (#300 ) Also rename TransitiveWhitelistingEnabled -> EnableTransitiveWhitelisting and BundlesEnabled -> EnableBundles	2018-09-26 08:43:31 -04:00
nguyen-phillip	52c5b5aade	add newline to output of "santactl help sync" (#299 )	2018-09-25 13:55:52 -04:00
Tom Burgin	2d98173c51	fix cache invalidation on macOS Mojave (#298 )	2018-09-21 15:22:34 -04:00
Tom Burgin	5e3f13be70	intentional fall-through (#297 ) * intentional fall-through * russell's idea	2018-09-20 18:40:23 -04:00
Tom Burgin	90b894b88a	santad: add critical system binaries (#296 ) * santad: add critical system binaries * review updates * use a getter	2018-09-20 17:17:12 -04:00
nguyen-phillip	6dc7387881	Add transitive whitelisting to Santa (#224 ) Add transitive whitelisting. Binaries may be identified with WHITELIST_COMPILER rules. Any executable they output will then be marked locally with a transitive whitelist rule and allowed to run if the TransitiveWhitelistingEnabled config key is true.	2018-07-20 11:47:04 -04:00
Tom Burgin	b14b017d72	santa-driver: add IOMatchCategory (#292 )	2018-07-18 11:33:09 -04:00