santad: Fix transitive rules when using the sysx cache feature (#540)

This fixes transitive allowlisting when `EnableSysxCache` is turned on, reduces the deadline timer to fire 5s before the ES deadline, remaps our DEBUG logs to NOTICE so they can be more easily seen in Console and prevents transitive rules being created for paths under /dev/.

.bazelrc

@@ -1 +1,2 @@
 build --apple_generate_dsym --define=apple.propagate_embedded_extra_outputs=yes
+build --host_force_python=PY2

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+on:
+  push:
+    paths-ignore:
+      - 'docs/**'
+    branches:
+      - '*'
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Build Userspace
+      run: bazel build --apple_generate_dsym -c opt :release
+    - name: Build Driver
+      run: bazel build --apple_generate_dsym -c opt :release_driver
+    - name: Test
+      run: bazel test :unit_tests

.gitignore

@@ -1,3 +1,9 @@
 .DS_Store
 default.profraw
+*.provisionprofile
 bazel-*
+Pods
+Santa.xcodeproj/xcuserdata
+Santa.xcodeproj/project.xcworkspace
+Santa.xcworkspace/xcuserdata
+Santa.xcworkspace/xcshareddata

.travis.yml

@@ -1,12 +0,0 @@
----
-language: objective-c
-sudo: false
-
-addons:
-  homebrew:
-    taps: bazelbuild/tap
-    packages: bazelbuild/tap/bazel
-
-script:
- - bazel build :release --show_progress_rate_limit=30.0 -c opt --apple_generate_dsym --color=no --verbose_failures --sandbox_debug
- - bazel test :unit_tests --show_progress_rate_limit=30.0 --test_output=errors --color=no --verbose_failures --sandbox_debug

BUILD

@@ -1,13 +1,13 @@
-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])  # Apache 2.0
-
-exports_files(["LICENSE"])
-
 load("@build_bazel_rules_apple//apple:versioning.bzl", "apple_bundle_version")
 load("//:helper.bzl", "run_command")
 load("//:version.bzl", "SANTA_VERSION")
 
+package(default_visibility = ["//:santa_package_group"])
+
+licenses(["notice"])
+
+exports_files(["LICENSE"])
+
 # The version label for mac_* rules.
 apple_bundle_version(
     name = "version",
@@ -21,6 +21,12 @@ config_setting(
     values = {"compilation_mode": "opt"},
 )
 
+package_group(
+    name = "santa_package_group",
+    packages = ["//..."],
+)
+
+
 ################################################################################
 # Loading/Unloading/Reloading
 ################################################################################
@@ -28,8 +34,9 @@ run_command(
     name = "unload",
     cmd = """
 sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist 2>/dev/null
+sudo launchctl unload /Library/LaunchDaemons/com.google.santa.bundleservice.plist 2>/dev/null
 sudo kextunload -b com.google.santa-driver 2>/dev/null
-launchctl unload /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null
+launchctl unload /Library/LaunchAgents/com.google.santa.plist 2>/dev/null
 """,
 )
 
@@ -37,19 +44,25 @@ run_command(
     name = "load",
     cmd = """
 sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist
-launchctl load /Library/LaunchAgents/com.google.santagui.plist
+sudo launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist
+launchctl load /Library/LaunchAgents/com.google.santa.plist
 """,
 )
 
 run_command(
     name = "reload",
-    srcs = ["//Source/santa_driver"],
+    srcs = [
+        "//Source/santa:Santa",
+        "//Source/santa_driver",
+    ],
     cmd = """
 set -e
 
 rm -rf /tmp/bazel_santa_reload
 unzip -d /tmp/bazel_santa_reload \
-    $${BUILD_WORKSPACE_DIRECTORY}/bazel-bin/Source/santa_driver/santa_driver.zip >/dev/null
+    $${BUILD_WORKSPACE_DIRECTORY}/bazel-out/*/bin/Source/santa_driver/santa_driver.zip >/dev/null
+unzip -d /tmp/bazel_santa_reload \
+    $${BUILD_WORKSPACE_DIRECTORY}/bazel-out/*/bin/Source/santa/Santa.zip >/dev/null
 echo "You may be asked for your password for sudo"
 sudo BINARIES=/tmp/bazel_santa_reload CONF=$${BUILD_WORKSPACE_DIRECTORY}/Conf \
     $${BUILD_WORKSPACE_DIRECTORY}/Conf/install.sh
@@ -64,11 +77,12 @@ echo "Time to stop being naughty"
 genrule(
     name = "release",
     srcs = [
-        "//Source/santa_driver",
+        "//Source/santa:Santa",
         "Conf/install.sh",
         "Conf/uninstall.sh",
+        "Conf/com.google.santa.bundleservice.plist",
         "Conf/com.google.santad.plist",
-        "Conf/com.google.santagui.plist",
+        "Conf/com.google.santa.plist",
         "Conf/com.google.santa.asl.conf",
         "Conf/com.google.santa.newsyslog.conf",
         "Conf/Package/Makefile",
@@ -82,9 +96,9 @@ genrule(
         echo "Please add '-c opt' flag to bazel invocation"
         """,
         ":opt_build": """
-      # Extract santa_driver.zip
+      # Extract Santa.zip
       for SRC in $(SRCS); do
-        if [[ $$(basename $${SRC}) == "santa_driver.zip" ]]; then
+        if [ "$$(basename $${SRC})" == "Santa.zip" ]; then
           mkdir -p $(@D)/binaries
           unzip -q $${SRC} -d $(@D)/binaries >/dev/null
         fi
@@ -101,10 +115,6 @@ genrule(
       # Gather together the dSYMs. Throw an error if no dSYMs were found
       for SRC in $(SRCS); do
         case $${SRC} in
-          *santa-driver.kext.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santa-driver.kext.dSYM
-            ;;
           *santad.dSYM*Info.plist)
             mkdir -p $(@D)/dsym
             cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santad.dSYM
@@ -113,14 +123,18 @@ genrule(
             mkdir -p $(@D)/dsym
             cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santactl.dSYM
             ;;
-          *santabs.xpc.dSYM*Info.plist)
+          *santabundleservice.dSYM*Info.plist)
             mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santabs.xpc.dSYM
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santabundleservice.dSYM
             ;;
           *Santa.app.dSYM*Info.plist)
             mkdir -p $(@D)/dsym
             cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/Santa.app.dSYM
             ;;
+          *com.google.santa.daemon.systemextension.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/com.google.santa.daemon.systemextension.dSYM
+            ;;
         esac
       done
 
@@ -134,7 +148,7 @@ genrule(
       # Update all the timestamps to now. Bazel avoids timestamps to allow
       # builds to be hermetic and cacheable but for releases we want the
       # timestamps to be more-or-less correct.
-      find $(@D)/{binaries,conf,dsym} -exec touch {} \;
+      find $(@D)/{binaries,conf,dsym} -exec touch {} \\;
 
       # Create final output tar
       tar -C $(@D) -czpf $(@) binaries dsym conf
@@ -143,12 +157,61 @@ genrule(
     heuristic_label_expansion = 0,
 )
 
+genrule(
+    name = "release_driver",
+    srcs = [
+        "//Source/santa_driver",
+    ],
+    outs = ["santa-driver-" + SANTA_VERSION + ".tar.gz"],
+    cmd = select({
+        "//conditions:default": """
+        echo "ERROR: Trying to create a release tarball without optimization."
+        echo "Please add '-c opt' flag to bazel invocation"
+        """,
+        ":opt_build": """
+      # Extract santa_driver.zip
+      for SRC in $(SRCS); do
+        if [ "$$(basename $${SRC})" == "santa_driver.zip" ]; then
+          mkdir -p $(@D)/binaries
+          unzip -q $${SRC} -d $(@D)/binaries >/dev/null
+        fi
+      done
+
+      # Gather together the dSYMs. Throw an error if no dSYMs were found
+      for SRC in $(SRCS); do
+        case $${SRC} in
+          *santa-driver.kext.dSYM*Info.plist)
+            mkdir -p $(@D)/dsym
+            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santa-driver.kext.dSYM
+            ;;
+        esac
+      done
+
+      # Cause a build failure if the dSYMs are missing.
+      if [[ ! -d "$(@D)/dsym" ]]; then
+        echo "dsym dir missing: Did you forget to use --apple_generate_dsym?"
+        echo "This flag is required for the 'release' target."
+        exit 1
+      fi
+
+      # Update all the timestamps to now. Bazel avoids timestamps to allow
+      # builds to be hermetic and cacheable but for releases we want the
+      # timestamps to be more-or-less correct.
+      find $(@D)/{binaries,dsym} -exec touch {} \\;
+
+      # Create final output tar
+      tar -C $(@D) -czpf $(@) binaries dsym
+    """,
+    }),
+    heuristic_label_expansion = 0,
+)
+
 test_suite(
     name = "unit_tests",
     tests = [
+        "//Source/common:SantaCacheTest",
         "//Source/common:SNTFileInfoTest",
-        "//Source/santa_driver:SantaCacheTest",
-        "//Source/santa_driver:SantaPrefixTreeTest",
+        "//Source/common:SNTPrefixTreeTest",
         "//Source/santactl:SNTCommandFileInfoTest",
         "//Source/santactl:SNTCommandSyncTest",
         "//Source/santad:SNTEventTableTest",

CONTRIBUTING.md

@@ -1,37 +0,0 @@
-Want to contribute? Great! First, read this page (including the small print at the end).
-
-### Before you contribute
-Before we can use your code, you must sign the
-[Google Individual Contributor License Agreement](https://developers.google.com/open-source/cla/individual)
-(CLA), which you can do online. The CLA is necessary mainly because you own the
-copyright to your changes, even after your contribution becomes part of our
-codebase, so we need your permission to use and distribute your code. We also
-need to be sure of various other things—for instance that you'll tell us if you
-know that your code infringes on other people's patents. You don't have to sign
-the CLA until after you've submitted your code for review and a member has
-approved it, but you must do it before we can put your code into our codebase.
-
-Before you start working on a larger contribution, you should get in touch with
-us first through the [issue tracker](https://github.com/google/santa/issues)
-with your idea so that we can help out and possibly guide you. Coordinating up 
-front makes it much easier to avoid frustration later on.
-
-### Code reviews
-All submissions, including submissions by project members, require review. We
-use GitHub pull requests for this purpose. It's also a good idea to run the
-tests beforehand, which you can do with the following commands:
-
-```sh
-rake tests:logic
-rake tests:kernel  # only necessary if you're changing the kext code
-```
-### Code Style
-
-All code submissions should try to match the surrounding code.  Wherever possible,
-code should adhere to either the
-[Google Objective-C Style Guide](https://google.github.io/styleguide/objcguide.xml)
-or the [Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html).
-
-### The small print
-Contributions made by corporations are covered by a different agreement than
-the one above, the [Software Grant and Corporate Contributor License Agreement](https://developers.google.com/open-source/cla/corporate).

CONTRIBUTING.md

@@ -0,0 +1 @@
+docs/development/contributing.md

Conf/Package/postinstall

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Load the kernel extension, santad, sync client
+# Load com.google.santa.daemon and com.google.santa.bundleservice
 # If a user is logged in, also load the GUI agent.
 # If the target volume is not /, do nothing
 
@@ -9,20 +9,23 @@
 # Restart syslogd to pick up ASL configuration change
 /usr/bin/killall -HUP syslogd
 
-/sbin/kextload /Library/Extensions/santa-driver.kext
-
-sleep 1
-
-/bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
-
-sleep 1
-
 # Create hopefully useful symlink for santactl
 mkdir -p /usr/local/bin
-/bin/ln -sf /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin/santactl
+/bin/ln -sf /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin/santactl
 
-user=$(/usr/bin/stat -f '%u' /dev/console)
-[[ -z "$user" ]] && exit 0
-/bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+# Remove the kext before com.google.santa.daemon loads if the SystemExtension is already present.
+# This prevents Santa from dueling itself if the "EnableSystemExtension" config is set to false.
+/bin/launchctl list EQHXZ8M8AV.com.google.santa.daemon > /dev/null 2>&1 && rm -rf /Library/Extensions/santa-driver.kext
 
+# Load com.google.santa.daemon, its main has logic to handle loading the kext
+# or relaunching itself as a SystemExtension.
+/bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
+
+# Load com.google.santa.bundleservice
+/bin/launchctl load -w /Library/LaunchDaemons/com.google.santa.bundleservice.plist
+
+GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -z "${GUI_USER}" ]] && exit 0
+
+/bin/launchctl asuser "${GUI_USER}" /bin/launchctl load /Library/LaunchAgents/com.google.santa.plist
 exit 0

Conf/Package/preinstall

@@ -6,22 +6,26 @@
 
 [[ $3 != "/" ]] && exit 0
 
-/bin/launchctl remove com.google.santad
+/bin/launchctl remove com.google.santad || true
+/bin/launchctl remove com.google.santa.bundleservice || true
 
-sleep 1
+/bin/sleep 1
 
-/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1 || true
 
 # Remove cruft from old Santa versions
-/bin/rm /usr/libexec/santad
-/bin/rm /usr/sbin/santactl
+/bin/rm -f /usr/libexec/santad
+/bin/rm -f /usr/sbin/santactl
 /bin/launchctl remove com.google.santasync
-/bin/rm /Library/LaunchDaemons/com.google.santasync.plist
+/bin/rm -f /Library/LaunchDaemons/com.google.santasync.plist
 /bin/rm -rf /Applications/Santa.app
+/bin/rm -rf /Library/Extensions/santa-driver.kext
 
-sleep 1
+/bin/sleep 1
 
-user=$(/usr/bin/stat -f '%u' /dev/console)
-[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -z "${GUI_USER}" ]] && exit 0
 
+/bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santagui
+/bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santa
 exit 0

Conf/com.google.santa.bundleservice.plist

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>com.google.santa.bundleservice</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/Santa.app/Contents/MacOS/santabundleservice</string>
+		<string>--syslog</string>
+	</array>
+	<key>MachServices</key>
+	<dict>
+		<key>com.google.santa.bundleservice</key>
+		<true/>
+	</dict>
+	<key>RunAtLoad</key>
+	<false/>
+	<key>KeepAlive</key>
+	<false/>
+	<key>ProcessType</key>
+	<string>Interactive</string>
+	<key>ThrottleInterval</key>
+	<integer>0</integer>
+</dict>
+</plist>

Conf/com.google.santa.plist

@@ -3,10 +3,10 @@
 <plist version="1.0">
 <dict>
 				<key>Label</key>
-				<string>com.google.santagui</string>
+				<string>com.google.santa</string>
 				<key>ProgramArguments</key>
 				<array>
-					<string>/Library/Extensions/santa-driver.kext/Contents/Resources/Santa.app/Contents/MacOS/Santa</string>
+					<string>/Applications/Santa.app/Contents/MacOS/Santa</string>
 					<string>--syslog</string>
 				</array>
 				<key>RunAtLoad</key>

Conf/com.google.santa.syncservice.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>com.google.santa.syncservice</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/Santa.app/Contents/MacOS/santasyncservice</string>
+		<string>--syslog</string>
+	</array>
+	<key>MachServices</key>
+	<dict>
+		<key>com.google.santa.syncservice</key>
+		<true/>
+	</dict>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+</dict>
+</plist>

Conf/com.google.santad.plist

@@ -1,24 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-				<key>Label</key>
-				<string>com.google.santad</string>
-				<key>ProgramArguments</key>
-				<array>
-					<string>/Library/Extensions/santa-driver.kext/Contents/MacOS/santad</string>
-					<string>--syslog</string>
-				</array>
-				<key>MachServices</key>
-				<dict>
-					<key>SantaXPCControl</key>
-					<true/>
-				</dict>
-				<key>RunAtLoad</key>
-				<true/>
-				<key>KeepAlive</key>
-				<true />
-				<key>ProcessType</key>
-				<string>Interactive</string>
+	<key>Label</key>
+	<string>com.google.santad</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/Santa.app/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon</string>
+		<string>--syslog</string>
+	</array>
+	<key>MachServices</key>
+	<dict>
+		<key>com.google.santa.daemon</key>
+		<true/>
+	</dict>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>ProcessType</key>
+	<string>Interactive</string>
 </dict>
 </plist>

Conf/install.sh

@@ -21,6 +21,9 @@ fi
 # Unload santad and scheduled sync job.
 /bin/launchctl remove com.google.santad >/dev/null 2>&1
 
+# Unload bundle service
+/bin/launchctl remove com.google.santa.bundleservice >/dev/null 2>&1
+
 # Unload kext.
 /sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
 
@@ -28,8 +31,10 @@ fi
 GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
 
 # Unload GUI agent if someone is logged in.
+[[ -n "${GUI_USER}" ]] && \
+  /bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santagui
 [[ -n "$GUI_USER" ]] && \
-  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove com.google.santagui
+  /bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santa
 
 # Cleanup cruft from old versions
 /bin/launchctl remove com.google.santasync >/dev/null 2>&1
@@ -40,31 +45,34 @@ GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
 /bin/rm -rf /Library/Extensions/santa-driver.kext 2>&1
 
 # Copy new files.
-/bin/cp -r ${BINARIES}/santa-driver.kext /Library/Extensions
+/bin/mkdir -p /var/db/santa
+
+/bin/cp -r ${BINARIES}/Santa.app /Applications
+
+# Only copy the kext if the SystemExtension is not present.
+# This prevents Santa from dueling itself if the "EnableSystemExtension" config is set to false.
+/bin/launchctl list EQHXZ8M8AV.com.google.santa.daemon > /dev/null 2>&1 || /bin/cp -r ${BINARIES}/santa-driver.kext /Library/Extensions && /usr/sbin/kextcache -update-volume / -bundle-id com.google.santa-driver
+
 /bin/mkdir -p /usr/local/bin
-/bin/ln -s /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin 2>/dev/null
-
-if [ ! -d /var/db/santa ] ; then
-  /bin/mkdir /var/db/santa
-fi
+/bin/ln -s /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin 2>/dev/null
 
+/bin/cp ${CONF}/com.google.santa.plist /Library/LaunchAgents
+/bin/cp ${CONF}/com.google.santa.bundleservice.plist /Library/LaunchDaemons
 /bin/cp ${CONF}/com.google.santad.plist /Library/LaunchDaemons
-/bin/cp ${CONF}/com.google.santagui.plist /Library/LaunchAgents
 /bin/cp ${CONF}/com.google.santa.asl.conf /etc/asl/
 /bin/cp ${CONF}/com.google.santa.newsyslog.conf /etc/newsyslog.d/
 
 # Reload syslogd to pick up ASL configuration change.
 /usr/bin/killall -HUP syslogd
 
-# Load kext.
-/sbin/kextload /Library/Extensions/santa-driver.kext
-
-# Load santad and scheduled sync jobs.
+# Load com.google.santa.daemon
 /bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist
 
-# Load GUI agent if someone is logged in.
-[[ -n "$GUI_USER" ]] && \
-  /bin/launchctl asuser ${GUI_USER} \
-  /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
+# Load com.google.santa.bundleservice
+/bin/launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist
 
+# Load GUI agent if someone is logged in.
+[[ -z "${GUI_USER}" ]] && exit 0
+
+/bin/launchctl asuser "${GUI_USER}" /bin/launchctl load -w /Library/LaunchAgents/com.google.santa.plist
 exit 0

Conf/uninstall.sh

@@ -6,18 +6,24 @@
 
 [ "$EUID" != 0 ] && printf "%s\n" "This requires running as root/sudo." && exit 1
 
+# For macOS 10.15+ this will block up to 60 seconds
+/bin/launchctl list EQHXZ8M8AV.com.google.santa.daemon > /dev/null 2>&1 && /Applications/Santa.app/Contents/MacOS/Santa --unload-system-extension
+
 /bin/launchctl remove com.google.santad
 sleep 1
 /sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
 user=$(/usr/bin/stat -f '%u' /dev/console)
 [[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santa
 # and to clean out the log config, although it won't write after wiping the binary
 /usr/bin/killall -HUP syslogd
 # delete artifacts on-disk
 /bin/rm -rf /Applications/Santa.app
 /bin/rm -rf /Library/Extensions/santa-driver.kext
 /bin/rm -f /Library/LaunchAgents/com.google.santagui.plist
+/bin/rm -f /Library/LaunchAgents/com.google.santa.plist
 /bin/rm -f /Library/LaunchDaemons/com.google.santad.plist
+/bin/rm -f /Library/LaunchDaemons/com.google.santa.bundleservice.plist
 /bin/rm -f /private/etc/asl/com.google.santa.asl.conf
 /bin/rm -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf
 /bin/rm -f /usr/local/bin/santactl # just a symlink

Docs/details/events.md

@@ -1,141 +0,0 @@
-# Events
-
-Events are a defined set of data, core to how Santa interacts with a sync server. Events are generated when there is a blocked `execve()` while in Lockdown or Monitor mode. Events are also generated in Monitor mode for an `execve()` that was allowed to run, but would have been blocked in Lockdown mode. This allows an admin to roll out Santa to their macOS fleet in Monitor mode but still collect meaningful data. The events collected while in Monitor mode can be used to build a reasonably comprehensive whitelist of signing certificates and binaries before switching the fleet to Lockdown mode.
-
-##### Event Data
-
-Events begin their life as an [SNTStoredEvent](https://github.com/google/santa/blob/master/Source/common/SNTStoredEvent.h) object. The SNTStoredEvent class is just a simple storage class that has properties for all the relevant bits of information. More importantly the class implements the [NSSecureCoding](https://developer.apple.com/documentation/foundation/nssecurecoding?language=objc) protocol. This allows the objects to be encoded and decoded for storage in the events sqlite3 database on disk and sent over XPC to another process.
-
-Events are temporarily stored in a database until they are uploaded. The format is subject the change; accessing the events database directly will most likely break in future releases. If direct access to the events database is required, raise a [issue on the Santa GitHub](https://github.com/google/santa/issues).
-
-###### JSON
-
-Before an event is uploaded to a sync server, the event data is copied into a JSON blob. Here is an example of Firefox being blocked and sent for upload:
-
-```json
-{
-  "events": [
-    {
-      "file_path": "/var/folders/l5/pd9rhsp54s79_9_qcy746_tw00b_4p/T/AppTranslocation/254C1357-7461-457B-B734-A0FDAF0F26D9/d/Firefox.app/Contents/MacOS",
-      "file_bundle_version": "5417.6.28",
-      "parent_name": "launchd",
-      "logged_in_users": [
-        "bur"
-      ],
-      "quarantine_timestamp": 0,
-      "signing_chain": [
-        {
-          "cn": "Developer ID Application: Mozilla Corporation (43AQ936H96)",
-          "valid_until": 1652123338,
-          "org": "Mozilla Corporation",
-          "valid_from": 1494270538,
-          "ou": "43AQ936H96",
-          "sha256": "96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b"
-        },
-        {
-          "cn": "Developer ID Certification Authority",
-          "valid_until": 1801519935,
-          "org": "Apple Inc.",
-          "valid_from": 1328134335,
-          "ou": "Apple Certification Authority",
-          "sha256": "7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f"
-        },
-        {
-          "cn": "Apple Root CA",
-          "valid_until": 2054670036,
-          "org": "Apple Inc.",
-          "valid_from": 1146001236,
-          "ou": "Apple Certification Authority",
-          "sha256": "b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024"
-        }
-      ],
-      "file_bundle_name": "Firefox",
-      "executing_user": "bur",
-      "ppid": 1,
-      "file_bundle_path": "/var/folders/l5/pd9rhsp54s79_9_qcy746_tw00b_4p/T/AppTranslocation/254C1357-7461-457B-B734-A0FDAF0F26D9/d/Firefox.app",
-      "file_name": "firefox",
-      "execution_time": 1501691337.059514,
-      "file_sha256": "dd78f456a0929faf5dcbb6d952992d900bfdf025e1e77af60f0b029f0b85bf09",
-      "decision": "BLOCK_BINARY",
-      "file_bundle_id": "org.mozilla.firefox",
-      "file_bundle_version_string": "54.0.1",
-      "pid": 49368,
-      "current_sessions": [
-        "bur@console",
-        "bur@ttys000",
-        "bur@ttys001",
-        "bur@ttys002",
-        "bur@ttys003",
-        "bur@ttys004"
-      ]
-    }
-  ]
-}
-```
-
-
-
-##### Event Lifecycle
-
-1. santad generates a new event
-2. santad compares, or adds if not present, the event's SHA-256 file hash to an in-memory cache with a timeout of 10 min. If an event with an matching hash is present in cache, the event is dropped.
-3. santad saves the event to `/var/db/santa/events.db` with a unique ID assigned as the key.
-4. santad sends an XPC message to the santactl daemon. The message contains the event with instructions to upload the event immediately. This is non-blocking and is performed on a background thread.
-
-##### Bundle Events
-
-Bundle events are a special type of event that are generated when a sync server supports receiving the associated bundle events, instead of just the original event. For example: `/Applications/Keynote.app/Contents/MacOS/Keynote` is blocked and an event representing the binary is uploaded. A whitelist rule is created for that one binary. Great, you can now run `/Applications/Keynote.app/Contents/MacOS/Keynote`, but what about all the other supporting binaries contained in the bundle? You would have to wait until they are executed until an event would be generated. It is very common for a bundle to contain multiple binaries, as shown here with Keynote.app. Waiting to get a block is not a very good user experience.
-
-```sh
-⇒  santactl bundleinfo /Applications/Keynote.app
-Hashing time: 1047 ms
-9 events found
-BundleHash: b475667ab1ab6eddea48bfc2bed76fcef89b8f85ed456c8068351292f7cb4806
-BundleID: com.apple.iWork.Keynote
-	SHA-256: be3aa404ee79c2af863132b93b0eedfdbc34c6e35d4fda2ade6dd637692ead84
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.MovieCompatibilityConverter.xpc/Contents/MacOS/com.apple.iWork.MovieCompatibilityConverter
-BundleID: com.apple.iWork.Keynote
-	SHA-256: 3b2582fd5e7652b653276b3980c248dc973e8082e9d0678c96a08d7d1a8366ba
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.PICTConverter.xpc/Contents/MacOS/com.apple.iWork.PICTConverter
-BundleID: com.apple.iWork.Keynote
-	SHA-256: f1bf3be05d511d7c7f651cf7b130d4977f8d28d0bfcd7c5de4144b95eaab7ad7
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.xpc/Contents/MacOS/com.apple.iWork.TCMovieExtractor
-BundleID: com.apple.iWork.Keynote
-	SHA-256: b59bc8548c91088a40d9023abb5d22fa8731b4aa17693fcb5b98c795607d219a
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.BitmapTracer.xpc/Contents/MacOS/com.apple.iWork.BitmapTracer
-BundleID: com.apple.iWork.Keynote
-	SHA-256: 08cb407f541d867f1a63dc3ae44eeedd5181ca06c61df6ef62b5dc7192951a4b
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.TCUtilities32.xpc/Contents/MacOS/com.apple.iWork.TCUtilities32
-BundleID: com.apple.iWork.Keynote
-	SHA-256: b965ae7be992d1ce818262752d0cf44297a88324a593c67278d78ca4d16fcc39
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.xpc/Contents/XPCServices/com.apple.iWork.TCMovieExtractor.TCUtilities32.xpc/Contents/MacOS/com.apple.iWork.TCMovieExtractor.TCUtilities32
-BundleID: com.apple.iWork.Keynote
-	SHA-256: 59668dc27314f0f6f5daa5f02b564c176f64836c88e2dfe166e90548f47336f1
-	Path: /Applications/Keynote.app/Contents/MacOS/Keynote
-BundleID: com.apple.iWork.Keynote
-	SHA-256: 7ce324f919b14e14d327004b09f83ca81345fd4438c87ead4b699f89e9485595
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/XPCServices/com.apple.iWork.ExternalResourceValidator.xpc/Contents/MacOS/com.apple.iWork.ExternalResourceValidator
-BundleID: com.apple.iWork.Keynote
-	SHA-256: 6b47f551565d886388eeec5e876b6de9cdd71ef36d43b0762e6ebf02bdd8515d
-	Path: /Applications/Keynote.app/Contents/XPCServices/com.apple.iWork.ExternalResourceAccessor.xpc/Contents/MacOS/com.apple.iWork.ExternalResourceAccessor
-```
-
-Bundle events provide a mechanism to generate and upload events for all the executable Mach-O binaries within a bundle. To enable bundle event generation a configuration must be set in the preflight sync stage on the sync server. Once set the sync server can use bundle events to drive a better user experience.
-
-Bundle events can be differentiated by the existence of these fields:
-
-| Field                    | Value                                    |
-| ------------------------ | ---------------------------------------- |
-| decision                 | BUNDLE_BINARY                            |
-| file_bundle_hash         | Super Hash of all binary hashes          |
-| file_bundle_hash_millis  | The time in milliseconds it took to find all of the binaries, hash and produce a super hash |
-| file_bundle_binary_count | Number of binaries within the bundle     |
-
-To avoid redundant uploads of a bundle event Santa will wait for the sync server to ask for them. The server will respond to event uploads with a request like this:
-
-| Field                        | Value                                    |
-| ---------------------------- | ---------------------------------------- |
-| event_upload_bundle_binaries | An array of bundle hashes that the sync server needs to be uploaded |
-
-When santactl receives this type of request, it sends an XPC reply to santad to save all the bundle events to the events.db. It then attempts to upload all the bundle events, purging the successes from the events.db. Any failures will be uploaded during the next full sync.
-

Docs/details/ipc.md

@@ -1,43 +0,0 @@
-# Interprocess Communication (IPC)
-
-Most IPC within Santa is done by way of Apple's [XPC](https://developer.apple.com/documentation/xpc?language=objc). Santa wraps [NSXPCConnection](https://developer.apple.com/documentation/foundation/nsxpcconnection?language=objc) to provide client multiplexing, signature validation of connecting clients and forced connection establishment. This is called SNTXPCConnection.
-
-Communication between santad and santa-driver (KEXT) is done with a [IOUserClient](https://developer.apple.com/documentation/kernel/iouserclient?language=objc) subclass and IOKit/IOKitLib.h functions.
-
-##### Who starts who?
-
-The santad and Santa (GUI) processes are both started and kept alive by launchd as a LaunchDaemon and a LaunchAgent, respectively. This means santad runs as root and Santa (GUI) runs as the console user. 
-
-There can be multiple Santa (GUI) processes running, one per user logged into the GUI (assuming fast-user switching is enabled). While multiple processes might be running, only the one for the user currently logged-in will be connected to santad and receiving notifications.
-
-When using a sync server, the santactl process is started by santad. Before the new process starts, all privileges are dropped. santactl runs as _nobody_.
-
-The santabs process is started by launchd via an XPC service connection from santad. XPC services inherit their initiator's privileges meaning santabs runs as root, which is necessary to ensure it has permission to read all files.
-
-| Process  | Parent Process | Running User |
-| -------- | -------------- | ------------ |
-| santad   | launchd        | root         |
-| Santa    | launchd        | user         |
-| santactl | santad         | nobody       |
-| santabs  | launchd        | root         |
-
-
-
-##### Who communicates with who?
-
-In short, santad has two-way communication with every other process. In addition, Santa and santabs have two-way communication between each other. For other combinations, there is no direct communication.
-
-![Santa IPC](santa_ipc.png)
-
-##### SNTXPCConnection and two way communication
-
-`SNTXPCConnection` enforces a server / client model for XPC connections. This allows for strong signature validation and forced connection establishment. The only problem with this model is the lack of two-way communication. For example, process A can call methods on process B and retrieve a response, but process B cannot call methods on process A.
-
-To accomplish two-way communication, the following approach can be used:
-
-1. Process A creates a server with an anonymous `NSXPCListener`.
-2. Process A sends the anonymous `NSXPCListenerEndpoint` to process B over an already established `SNTXPCConnection`.
-3. Process B can now communicate directly with process A.
-
-This is a powerful notion. It enables forced connection establishment between both processes, which is critical when reliability is a concern.
-

Docs/details/santa-driver.md

@@ -1,94 +0,0 @@
-# santa-driver
-
-santa-driver is a macOS [kernel extension](https://developer.apple.com/library/content/documentation/Darwin/Conceptual/KEXTConcept/KEXTConceptIntro/introduction.html) (KEXT) that makes use of the [Kernel Authorization](https://developer.apple.com/library/content/technotes/tn2127/_index.html) (Kauth) KPI. This allows santa-driver to listen for events and either deny or defer the decision of those events. The santa-driver acts as an intermediary layer between Kauth and santad, with some caching to lower the overhead of decision making.
-
-##### Kauth
-
-santa-driver utilizes two Kauth scopes `KAUTH_SCOPE_VNODE` and `KAUTH_SCOPE_FILEOP `. It registers itself with the Kauth API by calling `kauth_listen_scope()` for each scope. This function takes three arguments:
-
-* `const char *scope`
-* `kauth_scope_callback_t _callback`_
-* `void *contex`
-
-It returns a `kauth_listener_t` that is stored for later use, in Santa's case to stop listening.
-
-###### KAUTH_SCOPE_VNODE
-
-Here is how santa-driver starts listening for `KAUTH_SCOPE_VNODE` events.
-
-```c++
-vnode_listener_ = kauth_listen_scope(
-    KAUTH_SCOPE_VNODE, vnode_scope_callback, reinterpret_cast<void *>(this));
-```
-
-The function `vnode_scope_callback` is called for every vnode event. There are many types of vnode events, they complete list can be viewed in the kauth.h. There are many types of vnode events, the complete list can be viewed in kauth.h. Santa is only concerned with regular files generating `KAUTH_VNODE_EXECUTE` [1] and `KAUTH_VNODE_WRITE_DATA` events. All non-regular files and unnecessary vnode events are filtered out.
-
-Here is how santa-driver stops listening for `KAUTH_SCOPE_VNODE` events:
-
-```c++
-kauth_unlisten_scope(vnode_listener_);
-```
-
-[1] `KAUTH_VNODE_EXECUTE` events that do not have the `KAUTH_VNODE_ACCESS` advisory bit set.
-
-###### KAUTH_SCOPE_FILEOP
-
-Santa also listens for file operations, this is mainly used for logging [1] and cache invalidation. 
-
-* `KAUTH_FILEOP_DELETE`, `KAUTH_FILEOP_RENAME`, `KAUTH_FILEOP_EXCHANGE` and `KAUTH_FILEOP_LINK` are logged
-* `KAUTH_FILEOP_EXEC` is used to log `execve()`s. Since the `KAUTH_VNODE_EXECUTE` is used to allow or deny an `execve()` the process arguments have not been setup yet. Since `KAUTH_FILEOP_EXEC` is triggered after an `execve()` it is used to log the `execve()`.
-
-[1] `KAUTH_FILEOP_CLOSE` is used to invalidate that file's representation in the cache. If a file has changed it needs to be re-evalauted. This is particularly necessary for files that were added to the cache with an action of allow.
-
-##### Driver Interface
-
-santa-driver implements an [IOUserClient](https://developer.apple.com/documentation/kernel/iouserclient?language=objc) subclass and santad interacts with it through IOKit/IOKitLib.h functions.
-
-[//]: # "TODO(bur, rah) Flesh out the details"
-
-##### Cache
-
-To aid in performance, santa-driver utilizes a caching system to hold the state of all observed `execve()` events.
-
-###### Key
-
-The key is a `uint64_t`. The top 32 bits hold the filesystem ID, while the bottom 32 bits hold the file unique ID. Together we call this the vnode_id.
-
-```c++
-uint64_t vnode_id = (((uint64_t)fsid << 32) | fileid);
-```
-
-###### Value
-
-The value is a `uint64_t` containing the action necessary, along with the decision timestamp. The action is stored in the top 8 bits. The decision timestamp is stored in the remaining 56 bits.
-
-```c++
-santa_action_t action = (santa_action_t)(cache_val >> 56);
-uint64_t decision_time = (cache_val & ~(0xFF00000000000000));
-```
-
-The possible actions are:
-
-| Actions                 | Expiry Time      | Description                              |
-| ----------------------- | ---------------- | ---------------------------------------- |
-| `ACTION_REQUEST_BINARY` | None             | Awaiting an allow or deny decision from santad. |
-| `ACTION_RESPOND_ALLOW`  | None             | Allow the `execve()`                     |
-| `ACTION_RESPOND_DENY`   | 500 milliseconds | Deny the `execve()`, but re-evalaute after 500 milliseconds. If someone is trying to run a banned binary continually every millisecond for example, only 2 evaluation requests to santad for would occur per second. This mitigates a denial of service type attack on santad. |
-
-###### Invalidation
-
-Besides the expiry time for individual entries, the entire cache will be cleared if any of the following events takes place:
-
-* Addition of a blacklist rule
-* Addition of a blacklist regex scope
-* Cache fills up. This defaults to `5000` entries for the root volume and `500` for all other mounted volumes.
-
-To view the current kernel cache count see the "Kernel info" section of `santactl status`:
-
-```sh
-⇒  santactl status
->>> Kernel Info
-    Root cache count          | 107
-    Non-root cache count      | 0
-```
-

Docs/details/santabs.md

@@ -1,44 +0,0 @@
-# santabs
-
-The santabs process is an XPC service for the santa-driver.kext bundle, meaning only binaries within that bundle can launch santabs. It will be launched with the same privileges as its calling process. Currently, santad is the only caller of santabs, so santabs runs as root.
-
-##### Events
-
-The santabs process is quite simple and only does one thing: it generates non-execution events for the contents of a bundle.
-
-When there is an `execve()` that is blocked within a bundle, a few actions take place:
-
-1. The highest ancestor bundle in the tree is found
-
-   * So `/Applications/DVD Player.app/Contents/MacOS/DVD Player` would be `/Applications/DVD Player.app`
-   * Or `/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension` would be `/Applications/Safari.app`
-
-2. The ancestor bundle is then searched for Mach-O executables
-
-   * For Safari that would currently be 4 binaries
-
-   * ```sh
-     Hashing time: 53 ms
-     4 events found
-     BundleHash: 718773556ca5ea798f984fde2fe1a5994f175900b26d2964c9358a0f469a4ac6
-     BundleID: com.apple.Safari
-     	SHA-256: ea872e83a518ce442ed050c4408a448d915e2bae90ef8455ce7805448d864a3e
-     	Path: /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
-     BundleID: com.apple.Safari
-     	SHA-256: 1a43283857b1822164f82af274c476204748c0a2894dbcaa11ed17f78e0273cc
-     	Path: /Applications/Safari.app/Contents/MacOS/Safari
-     BundleID: com.apple.Safari
-     	SHA-256: ab0ac54dd90144931b681d1e84e198c6510be44ac5339437bc004e60777af7ba
-     	Path: /Applications/Safari.app/Contents/Resources/appdiagnose
-     BundleID: com.apple.Safari
-     	SHA-256: f49c5aa3a7373127d0b4945782b1fa375dd3707d66808fd66b7c0756430defa8
-     	Path: /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService
-     ```
-
-3. Events are created for each binary and the bundle hash is calculated
-
-4. These events are sent to the sync server for processing
-
-##### Bundle Hash
-
-The found events are sorted by their file SHA-256 hash. The hashes are concatenated and then SHA-256 hashed. This is now a strong indicator on what Mach-O executables were within the bundle at the time of scan. This can then be verified by the sync server when deciding to generate rules.

Docs/details/santad.md

@@ -1,23 +0,0 @@
-# santad
-
-The santad process does the heavy lifting when it comes to making decisions about binary executions. It also handles brokering all of the XPC connections between the various components of Santa. It does all of this with performance being at the forefront. 
-
-##### A note on performance
-
-On an idling machine, santad and the other components of Santa consume virtually no CPU and a minimal amount of memory (5-50MB). When lots of processes `execve()` at the same time, the CPU and memory usage can spike. All of the `execve()` decisions are made on high priority threads to ensure decisions are posted back to the kernel as soon as possible. A watchdog thread will log warnings when sustained high CPU (>20%) and memory (>250MB) usage by santad is detected.
-
-##### On Launch
-
-The very first thing santad does once it has been launched is to load and connect to santa-driver. Only one connection may be active at any given time.
-
-At this point, santa-driver is loaded and running in the kernel, but is allowing all executions and not sending any messages to santad. Before santad tells santa-driver it is ready to receive messages, it needs to setup a few more things:
-
-* The rule and event databases are initialized
-* Connections to Santa (GUI) and santactl sync daemon are established. 
-* The config file is processed.
-
-santad is now ready to start processing decision and logging messages from santa-driver. The listeners are started and santad sits in a run loop awaiting messages from santa-driver. 
-
-##### Running
-
-Messages are read from a shared memory queue (`IODataQueueMemory` ) on a single thread. A callback is invoked for each message. The callback then dispatches all the work of processing a decision message to a concurrent high priority queue. The log messages are dispatched to a low priority queue for processing.

Docs/details/scopes.md

@@ -1,27 +0,0 @@
-# Scopes
-
-In addition to rules, Santa can whitelist or blacklist based on scopes. Currently, only a few scopes are implemented. They fall into one of two categories: a whitelist scope or blacklist scope. Scopes are evaluated after rules, with blacklist evaluation preceding whitelist.
-
-Scopes are a broader way of whitelisting or blacklisting `execve()`s.
-
-For configuration of scopes see [configuration.md](../deployment/configuration.md).
-
-##### Blacklist Scopes
-
-| Scope                | Configurable |
-| -------------------- | ------------ |
-| Blacklist Path Regex | Yes          |
-| Missing __PAGEZERO   | Yes          |
-
-##### Whitelist Scopes
-
-| Scope                | Configurable |
-| -------------------- | ------------ |
-| Whitelist Path Regex | Yes          |
-| Not a Mach-O         | No           |
-
-As seen above, Santa will whitelist any non Mach-O binary under a whitelist scope. However, a blacklist regex or binary SHA-256 rule can be used to block non Mach-O `execve()`s since they are evaluated before the whitelist scopes.
-
-##### Regex Caveats
-
-The paths covered by the whitelist and blacklist regex patterns are not tracked. If an `execve()` is allowed initially, then moved into a blacklist directory, Santa has no knowledge of that move. Since santa-driver caches decisions, the recently moved file will continue to be allowed to `execve()` even though it is now within a blacklisted regex path. The cache holds "allow" decisions until invalidated and "deny" decisions for 500 milliseconds. Going from a blacklist path to a whitelist path is not largely affected.

Docs/introduction/binary-whitelisting-overview.md

@@ -1,31 +0,0 @@
-# Binary Whitelisting Overview
-
-#### Background
-
-The decision flow starts in the kernel. The macOS kernel is extensible by way of a kernel extension (KEXT). macOS makes available kernel programming interfaces (KPIs) to be used by a KEXT. Santa utilizes the Kernel Authorization (Kauth) KPI. This is a very powerful and verbose interface that gives Santa the ability to listen in on most vnode and file systems operations and to take actions, directly or indirectly, on the operations being performed. Still, there are some limitations to Kauth which are pointed out in the santa-driver document. For more information on the santa-driver KEXT see the [santa-driver.md](../details/santa-driver.md) document.
-
-#### Flow of an execve()
-
-This is a high level overview of the binary whitelisting / blacklisting decision process. For a more detailed account of each part, see the respective documentation. This flow does not cover the logging component of Santa, see the [logs.md](../details/logs.md) documentation for more info.
-
-###### Kernel Space
-
-0. santa-driver registers itself as a `KAUTH_SCOPE_VNODE` listener. This flow follows how santa-driver handles `KAUTH_VNODE_EXECUTE` events.
-1. A santa-driver Kauth callback function is executed by the kernel when a process is trying to `execve()`. In most cases, the `execve()` takes place right after a process calls `fork()` to start a new process. This function is running on a kernel thread representing the new process. Information on where to find the executable is provided. This information is known as the `vnode_id`.
-2. santa-driver then checks if its cache has an allow or deny entry for the `vnode_id`. If so it returns that decision to the Kauth KPI. 
-   * If Kauth receives a deny, it will stop the `execve()` from taking place. 
-   * If Kauth receives an allow, it will defer the decision. If there are other Kauth listeners, they also have a chance deny or defer.
-3. If there is no entry for the `vnode_id` in the cache a few actions occur:
-   * santa-driver hands off the decision making to santad.
-   * A new entry is created in the cache for the `vnode_id` with a special value of `ACTION_REQUEST_BINARY`.  This is used as a placeholder until the decision from santad comes back. If another process tries to `execve()` the same `vnode_id`, santa-driver will have that thread wait for the in-flight decision from santad. All subsequent `execve()`s for the same `vnode_id` will use the decision in the cache as explained in #2, until the cache is invalidated. See the [santa-driver.md](../details/santa-driver.md) document for more details on the cache invalidation.
-   * If the executing file is written to while any of the threads are waiting for a response the `ACTION_REQUEST_BINARY` entry is removed, forcing the decision-making process to be restarted.
-
-###### User Space
-
-1. santad is listening for decision requests from santa-driver.
-   * More information is collected about the executable that lives at the `vnode_id`. Since this codepath has a sleeping kernel thread waiting for a decision, extra care is taken to be as performant as possible.
-2. santad uses the information it has gathered to make a decision to allow or deny the `execve()`. There are more details on how these decisions are made in the [rules.md](../details/rules.md) and [scopes.md](../details/scopes.md) documents.
-3. The decision is posted back to santa-driver.
-4. If there was a deny decision, a message is sent to Santa GUI to display a user popup notification.
-
-

Docs/introduction/syncing-overview.md

@@ -1,27 +0,0 @@
-# Syncing Overview
-
-#### Background
-
-Santa can be run and configured without a sync server. Doing so will enable an admin to configure rules with the `santactl rule` command. Using a sync server will enable an admin to configures rules and multiple other settings from the sync server itself. Santa was designed from the start with a sync server in mind. This allows an admin to easily configure and sync rules across a fleet of macOS systems. This document explains the syncing process.
-
-#### Flow of a full sync
-
-This is a high level overview of the syncing process. For a more a more detailed account of each part, see the respective documentation. The santaclt binary can be run in one of two modes, daemon and non-daemon. The non-daemon mode does one full sync and exits. This is the typical way a user will interact with Santa, mainly to force a full sync. The daemon mode is used by santad to schedule full syncs, listen for push notifications and upload events.
-
-0. When the santad process starts up, it looks for a `SyncBaseURL` key/value in the config. If one exists it will `fork()` and `execve()` `santactl sync —-daemon`. Before the new process calls `execve()`, all privileges are dropped. All privileged actions are then restricted to the XPC interface made available to santactl by santad. Since this santactl process is running as a daemon it too exports an XPC interface so santad can interact with the process efficiently and securely. To ensure syncing reliability santad will restart the santactl daemon if it is killed or crashes.
-1. The santactl daemon process now schedules a full sync for 15 sec in the future. The 15 sec is used to let santad settle before santactl starts sending rules from the sync server to process.
-2. The full sync starts. There are a number of stages to a full sync:
-   1. preflight: The sync server can set various settings for Santa.
-   2. logupload (optional): The sync server can request that the Santa logs be uploaded to an endpoint.
-   3. eventupload (optional): If Santa has generated events, it will upload them to the sync-server.
-   4. ruledownload: Download rules from the sync server.
-   5. postflight: Updates timestamps for successful syncs.
-3. After the full sync completes a new full sync will be scheduled, by default this will be 10min. However there are a few ways to manipulate this:
-   1. The sync server can send down a configuration in the preflight to override the 10min interval. It can be anything greater than 10min.
-   2. Firebase Cloud Messaging (FCM) can be used. The sync server can send down a configuration in the preflight to have the santactl daemon to start listening for FCM messages. If a connection to FCM is made, the full sync interval drops to a default of 4 hours. This can be further configured by a preflight configuration. The FCM connection allows the sync-sever to talk directly with Santa. This way we can reduce polling the sync server dramatically.
-4. Full syncs will continue to take place at their configured interval. If configured FCM messages will continue to be digested and acted upon.
-
-#### santactl XPC interface
-
-When running as a daemon, the santactl process makes available an XPC interface for use by santad. This allows santad to send blocked binary or bundle events directly to santactl for immediate upload to the sync-server, enabling a smoother user experience. The binary that was blocked on macOS is immediately available for viewing or handling on the sync-server.
-

Podfile

@@ -0,0 +1,22 @@
+
+def common_pods
+   pod 'MOLXPCConnection'
+   pod 'MOLCodesignChecker'
+   pod 'FMDB'
+   pod 'MOLCertificate'
+   pod 'OCMock'
+   pod 'MOLAuthenticatingURLSession'
+   pod 'MOLFCMClient'
+end
+
+project './Santa.xcodeproj'
+
+project = Xcodeproj::Project.open "./Santa.xcodeproj"
+project.targets.each do |t|
+  if t.name == "santa-driver"
+      next
+  end
+  target t.name do
+      common_pods
+  end
+end

Podfile.lock

@@ -0,0 +1,46 @@
+PODS:
+  - FMDB (2.7.5):
+    - FMDB/standard (= 2.7.5)
+  - FMDB/standard (2.7.5)
+  - MOLAuthenticatingURLSession (2.4):
+    - MOLCertificate (~> 1.8)
+  - MOLCertificate (1.9)
+  - MOLCodesignChecker (1.10):
+    - MOLCertificate (~> 1.8)
+  - MOLFCMClient (1.8):
+    - MOLAuthenticatingURLSession (~> 2.4)
+  - MOLXPCConnection (1.2):
+    - MOLCodesignChecker (~> 1.9)
+  - OCMock (3.5)
+
+DEPENDENCIES:
+  - FMDB
+  - MOLAuthenticatingURLSession
+  - MOLCertificate
+  - MOLCodesignChecker
+  - MOLFCMClient
+  - MOLXPCConnection
+  - OCMock
+
+SPEC REPOS:
+  https://github.com/CocoaPods/Specs.git:
+    - FMDB
+    - MOLAuthenticatingURLSession
+    - MOLCertificate
+    - MOLCodesignChecker
+    - MOLFCMClient
+    - MOLXPCConnection
+    - OCMock
+
+SPEC CHECKSUMS:
+  FMDB: 2ce00b547f966261cd18927a3ddb07cb6f3db82a
+  MOLAuthenticatingURLSession: c238aa1c9a7b1077eb39a6f40204bfe76a7d204e
+  MOLCertificate: e9e88a396c57032cab847f51a46e20c730cd752a
+  MOLCodesignChecker: b0d5db9d2f9bd94e0fd093891a5d40e5ad77cbc0
+  MOLFCMClient: 2bfbacd45cc11e1ca3c077e97b80401c4e4a54f1
+  MOLXPCConnection: c27af5cb1c43b18319698b0e568a8ddc2fc1e306
+  OCMock: 4ab4577fc941af31f4a0398f6e7e230cf21fc72a
+
+PODFILE CHECKSUM: d03767a9915896232523962c98d9ff7294aec2b7
+
+COCOAPODS: 1.10.0

README.md

@@ -1,19 +1,15 @@
-# Santa [![Build Status][build-status-img]][build-status-link] [![Documentation Status][doc-status-img]][doc-status-link]
-
-[build-status-img]: https://travis-ci.org/google/santa.png?branch=master
-[build-status-link]: https://travis-ci.org/google/santa
-[doc-status-img]: https://readthedocs.org/projects/santa/badge/?version=latest
-[doc-status-link]: https://santa.readthedocs.io/en/latest/?badge=latest
+# Santa ![CI](https://github.com/google/santa/workflows/CI/badge.svg?branch=main)
 
 <p align="center">
-    <img src="./Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
+    <img src="./Source/santa/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
 </p>
 
-Santa is a binary whitelisting/blacklisting system for macOS. It consists of a
-kernel extension that monitors for executions, a userland daemon that makes
-execution decisions based on the contents of a SQLite database, a GUI agent
-that notifies the user in case of a block decision and a command-line utility
-for managing the system and synchronizing the database with a server.
+Santa is a binary authorization system for macOS. It consists of a kernel
+extension (or a system extension on macOS 10.15+) that monitors for executions,
+a userland daemon that makes execution decisions based on the contents of a
+SQLite database, a GUI agent that notifies the user in case of a block decision
+and a command-line utility for managing the system and synchronizing the
+database with a server.
 
 It is named Santa because it keeps track of binaries that are naughty or nice.
 
@@ -22,7 +18,7 @@ Santa is a project of Google's Macintosh Operations Team.
 # Docs
 
 The Santa docs are stored in the
-[Docs](https://github.com/google/santa/blob/master/Docs) directory. A Read the
+[Docs](https://github.com/google/santa/blob/master/docs) directory. A Read the
 Docs instance is available here: https://santa.readthedocs.io.
 
 The docs include deployment options, details on how parts of Santa work and
@@ -38,26 +34,29 @@ If you believe you have a bug, feel free to report [an
 issue](https://github.com/google/santa/isues) and we'll respond as soon as we
 can.
 
+If you believe you've found a vulnerability, please read the
+[security policy](https://github.com/google/santa/security/policy) for
+disclosure reporting.
 
 # Admin-Related Features
 
 * Multiple modes: In the default MONITOR mode, all binaries except those marked
-  as blacklisted will be allowed to run, whilst being logged and recorded in
-  the events database. In LOCKDOWN mode, only whitelisted binaries are allowed
-  to run.
+  as blocked will be allowed to run, whilst being logged and recorded in
+  the events database. In LOCKDOWN mode, only listed binaries are allowed to
+  run.
 
 * Event logging: When the kext is loaded, all binary launches are logged.  When
   in either mode, all unknown or denied binaries are stored in the database to
   enable later aggregation.
 
 * Certificate-based rules, with override levels: Instead of relying on a
-  binary's hash (or 'fingerprint'), executables can be whitelisted/blacklisted
-  by their signing certificate. You can therefore trust/block all binaries by a
+  binary's hash (or 'fingerprint'), executables can be allowed/blocked by their
+  signing certificate. You can therefore allow/block all binaries by a
   given publisher that were signed with that cert across version updates. A
-  binary can only be whitelisted by its certificate if its signature validates
-  correctly, but a rule for a binary's fingerprint will override a decision for
-  a certificate; i.e. you can whitelist a certificate while blacklisting a
-  binary signed with that certificate, or vice-versa.
+  binary can only be allowed by its certificate if its signature validates
+  correctly but a rule for a binary's fingerprint will override a decision for
+  a certificate; i.e. you can allowlist a certificate while blocking a binary
+  signed with that certificate, or vice-versa.
 
 * Path-based rules (via NSRegularExpression/ICU): This allows a similar feature
   to that found in Managed Client (the precursor to configuration profiles,
@@ -70,10 +69,10 @@ can.
 * Failsafe cert rules: You cannot put in a deny rule that would block the
   certificate used to sign launchd, a.k.a. pid 1, and therefore all components
   used in macOS. The binaries in every OS update (and in some cases entire new
-  versions) are therefore auto-whitelisted. This does not affect binaries from
-  Apple's App Store, which use various certs that change regularly for common
-  apps. Likewise, you cannot blacklist Santa itself, and Santa uses a distinct
-  separate cert than other Google apps.
+  versions) are therefore automatically allowed. This does not affect binaries
+  from Apple's App Store, which use various certs that change regularly for
+  common apps. Likewise, you cannot block Santa itself, and Santa uses a
+  distinct separate cert than other Google apps.
 
 # Intentions and Expectations
 
@@ -90,7 +89,7 @@ protect hosts in whatever other ways you see fit.
 
 # Security and Performance-Related Features
 
-* In-kernel caching: whitelisted binaries are cached in the kernel so the
+* In-kernel caching: allowed binaries are cached in the kernel so the
   processing required to make a request is only done if the binary isn't
   already cached.
 
@@ -125,7 +124,7 @@ protect hosts in whatever other ways you see fit.
   binary. This is because after weighing the administration cost vs the
   benefit, we found it wasn't worthwhile. Additionally, a number of
   applications make use of temporary generated scripts, which we can't possibly
-  whitelist and not doing so would cause problems. We're happy to revisit this
+  allowlist and not doing so would cause problems. We're happy to revisit this
   (or at least make it an option) if it would be useful to others.
 
 # Sync Servers
@@ -141,6 +140,9 @@ protect hosts in whatever other ways you see fit.
     * [Zentral](https://github.com/zentralopensource/zentral/wiki) - A
       centralized service that pulls data from multiple sources and deploy
       configurations to multiple services.
+    * [Zercurity](https://github.com/zercurity/zercurity) - A dockerized service 
+      for managing and monitoring applications across a large fleet utilizing 
+      Santa + Osquery.
 
 * Alternatively, `santactl` can configure rules locally (without a sync
   server).
@@ -150,8 +152,8 @@ protect hosts in whatever other ways you see fit.
 A tool like Santa doesn't really lend itself to screenshots, so here's a video
 instead.
 
-<p align="center"> <img src="https://zippy.gfycat.com/MadFatalAmphiuma.gif"
-alt="Santa Block Video" /> </p>
+
+<p align="center"> <img src="https://thumbs.gfycat.com/MadFatalAmphiuma-small.gif" alt="Santa Block Video" /> </p>
 
 # Kext Signing
 Kernel extensions on macOS 10.9 and later must be signed using an Apple-provided

SECURITY.md

@@ -0,0 +1,12 @@
+# Reporting a Vulnerability
+
+If you believe you have found a security vulnerability, we would appreciate private disclosure
+so that we can work on a fix before disclosure. Any vulnerabilities reported to us will be 
+disclosed publicly either when a new version with fixes is released or 90 days has passed,
+whichever comes first.
+
+To report vulnerabilities to us privately, please e-mail `santa-team@google.com`.
+If you want to encrypt your e-mail, you can use our GPG key `0x92AFE41DAB49BBB6`
+available on pool.sks-keyservers.net:
+
+`gpg --keyserver pool.sks-keyservers.net --recv-key 0x92AFE41DAB49BBB6`

Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1100"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
+               BuildableName = "Santa.app"
+               BlueprintName = "Santa"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
+            BuildableName = "Santa.app"
+            BlueprintName = "Santa"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C779C2DD22F0E95000EE2541"
+            BuildableName = "Santa.app"
+            BlueprintName = "Santa"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme

@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1100"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+               BuildableName = "com.google.santa.daemon"
+               BlueprintName = "com.google.santa.daemon"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      debugAsWhichUser = "root"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+            BuildableName = "com.google.santa.daemon"
+            BlueprintName = "com.google.santa.daemon"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C779C4E522F0F51400EE2541"
+            BuildableName = "com.google.santa.daemon"
+            BlueprintName = "com.google.santa.daemon"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcworkspace/contents.xcworkspacedata

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "group:Santa.xcodeproj">
+   </FileRef>
+   <FileRef
+      location = "group:Pods/Pods.xcodeproj">
+   </FileRef>
+</Workspace>

Source/common/BUILD

@@ -1,8 +1,23 @@
-package(default_visibility = ["//visibility:public"])
+load("//:helper.bzl", "santa_unit_test")
+
+package(default_visibility = ["//:santa_package_group"])
 
 licenses(["notice"])  # Apache 2.0
 
-load("//:helper.bzl", "santa_unit_test")
+cc_library(
+    name = "SantaCache",
+    srcs = ["SantaCache.h"],
+    deps = ["//Source/common:SNTKernelCommon"],
+)
+
+santa_unit_test(
+    name = "SantaCacheTest",
+    srcs = [
+        "SantaCache.h",
+        "SantaCacheTest.mm",
+    ],
+    deps = ["//Source/common:SNTKernelCommon"],
+)
 
 objc_library(
     name = "SNTBlockMessage",
@@ -10,6 +25,7 @@ objc_library(
     hdrs = ["SNTBlockMessage.h"],
     deps = [
         ":SNTConfigurator",
+        ":SNTLogging",
         ":SNTStoredEvent",
     ],
 )
@@ -18,11 +34,12 @@ objc_library(
     name = "SNTBlockMessage_SantaGUI",
     srcs = ["SNTBlockMessage.m"],
     hdrs = ["SNTBlockMessage.h"],
+    defines = ["SANTAGUI"],
     deps = [
         ":SNTConfigurator",
+        ":SNTLogging",
         ":SNTStoredEvent",
     ],
-    defines = ["SANTAGUI"],
 )
 
 objc_library(
@@ -35,7 +52,7 @@ objc_library(
     ],
 )
 
-cc_library(
+objc_library(
     name = "SNTCommonEnums",
     hdrs = ["SNTCommonEnums.h"],
 )
@@ -46,7 +63,6 @@ objc_library(
     hdrs = ["SNTConfigurator.h"],
     deps = [
         ":SNTCommonEnums",
-        ":SNTLogging",
         ":SNTStrengthify",
         ":SNTSystemInfo",
     ],
@@ -76,12 +92,39 @@ cc_library(
 cc_library(
     name = "SNTLoggingKernel",
     hdrs = ["SNTLogging.h"],
+    copts = [
+        "-mkernel",
+        "-I__BAZEL_XCODE_SDKROOT__/System/Library/Frameworks/Kernel.framework/Headers",
+    ],
+    defines = ["KERNEL"],
 )
 
 objc_library(
     name = "SNTLogging",
     srcs = ["SNTLogging.m"],
     hdrs = ["SNTLogging.h"],
+    deps = [":SNTConfigurator"],
+)
+
+cc_library(
+    name = "SNTPrefixTree",
+    srcs = ["SNTPrefixTree.cc"],
+    hdrs = ["SNTPrefixTree.h"],
+    copts = ["-std=c++11"],
+    deps = [":SNTLogging"],
+)
+
+cc_library(
+    name = "SNTPrefixTreeKernel",
+    srcs = ["SNTPrefixTree.cc"],
+    hdrs = ["SNTPrefixTree.h"],
+    copts = [
+        "-std=c++11",
+        "-mkernel",
+        "-I__BAZEL_XCODE_SDKROOT__/System/Library/Frameworks/Kernel.framework/Headers",
+    ],
+    defines = ["KERNEL"],
+    deps = [":SNTLoggingKernel"],
 )
 
 objc_library(
@@ -117,7 +160,10 @@ objc_library(
     name = "SNTXPCBundleServiceInterface",
     srcs = ["SNTXPCBundleServiceInterface.m"],
     hdrs = ["SNTXPCBundleServiceInterface.h"],
-    deps = [":SNTStoredEvent"],
+    deps = [
+        ":SNTStoredEvent",
+        "@MOLXPCConnection",
+    ],
 )
 
 objc_library(
@@ -125,6 +171,7 @@ objc_library(
     srcs = ["SNTXPCControlInterface.m"],
     hdrs = ["SNTXPCControlInterface.h"],
     deps = [
+        ":SNTConfigurator",
         ":SNTStoredEvent",
         ":SNTXPCUnprivilegedControlInterface",
         "@MOLXPCConnection",
@@ -151,6 +198,16 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "SNTXPCSyncServiceInterface",
+    srcs = ["SNTXPCSyncServiceInterface.m"],
+    hdrs = ["SNTXPCSyncServiceInterface.h"],
+    deps = [
+        ":SNTStoredEvent",
+        "@MOLXPCConnection",
+    ],
+)
+
 objc_library(
     name = "SNTXPCUnprivilegedControlInterface",
     srcs = ["SNTXPCUnprivilegedControlInterface.m"],
@@ -172,6 +229,7 @@ santa_unit_test(
     resources = [
         "testdata/bad_pagezero",
         "testdata/missing_pagezero",
+        "testdata/32bitplist",
     ],
     structured_resources = glob([
         "testdata/BundleExample.app/**",
@@ -179,3 +237,9 @@ santa_unit_test(
     ]),
     deps = [":SNTFileInfo"],
 )
+
+santa_unit_test(
+    name = "SNTPrefixTreeTest",
+    srcs = ["SNTPrefixTreeTest.mm"],
+    deps = ["SNTPrefixTree"],
+)

Source/common/SNTBlockMessage.m

@@ -17,6 +17,7 @@
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
+#import "Source/common/SNTSystemInfo.h"
 
 @implementation SNTBlockMessage
 
@@ -106,6 +107,9 @@
 + (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
   SNTConfigurator *config = [SNTConfigurator configurator];
 
+  NSString *hostname = [SNTSystemInfo longHostname];
+  NSString *uuid = [SNTSystemInfo hardwareUUID];
+  NSString *serial = [SNTSystemInfo serialNumber];
   NSString *formatStr = config.eventDetailURL;
   if (!formatStr.length) return nil;
 
@@ -122,6 +126,15 @@
     formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
                                                      withString:config.machineID];
   }
+  if (hostname.length) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%hostname%" withString:hostname];
+  }
+  if (uuid.length) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%uuid%" withString:uuid];
+  }
+  if (serial.length) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%serial%" withString:serial];
+  }
 
   return [NSURL URLWithString:formatStr];
 }

Source/common/SNTCachedDecision.h

@@ -17,6 +17,8 @@
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTKernelCommon.h"
 
+@class MOLCertificate;
+
 ///
 ///  Store information about executions from decision making for later logging.
 ///
@@ -26,8 +28,11 @@
 @property SNTEventState decision;
 @property NSString *decisionExtra;
 @property NSString *sha256;
+
 @property NSString *certSHA256;
 @property NSString *certCommonName;
+@property NSArray<MOLCertificate *> *certChain;
+
 @property NSString *quarantineURL;
 
 @property NSString *customMsg;

Source/common/SNTCommonEnums.h

@@ -29,13 +29,13 @@ typedef NS_ENUM(NSInteger, SNTRuleType) {
 typedef NS_ENUM(NSInteger, SNTRuleState) {
   SNTRuleStateUnknown,
 
-  SNTRuleStateWhitelist = 1,
-  SNTRuleStateBlacklist = 2,
-  SNTRuleStateSilentBlacklist = 3,
+  SNTRuleStateAllow = 1,
+  SNTRuleStateBlock = 2,
+  SNTRuleStateSilentBlock = 3,
   SNTRuleStateRemove = 4,
 
-  SNTRuleStateWhitelistCompiler = 5,
-  SNTRuleStateWhitelistTransitive = 6,
+  SNTRuleStateAllowCompiler = 5,
+  SNTRuleStateAllowTransitive = 6,
 };
 
 typedef NS_ENUM(NSInteger, SNTClientMode) {
@@ -74,7 +74,6 @@ typedef NS_ENUM(NSInteger, SNTRuleTableError) {
   SNTRuleTableErrorEmptyRuleArray,
   SNTRuleTableErrorInsertOrReplaceFailed,
   SNTRuleTableErrorInvalidRule,
-  SNTRuleTableErrorMissingRequiredRule,
   SNTRuleTableErrorRemoveFailed
 };
 
@@ -93,6 +92,6 @@ typedef NS_ENUM(NSInteger, SNTEventLogType) {
 };
 
 static const char *kKextPath = "/Library/Extensions/santa-driver.kext";
-static const char *kSantaDPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santad";
-static const char *kSantaCtlPath = "/Library/Extensions/santa-driver.kext/Contents/MacOS/santactl";
-static const char *kSantaAppPath = "/Library/Extensions/santa-driver.kext/Contents/Resources/Santa.app";
+static const char *kSantaDPath = "/Applications/Santa.app/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon";
+static const char *kSantaCtlPath = "/Applications/Santa.app/Contents/MacOS/santactl";
+static const char *kSantaAppPath = "/Applications/Santa.app";

Source/common/SNTConfigurator.h

@@ -36,32 +36,32 @@
 - (void)setSyncServerClientMode:(SNTClientMode)newMode;
 
 ///
-///  The regex of whitelisted paths. Regexes are specified in ICU format.
+///  The regex of allowed paths. Regexes are specified in ICU format.
 ///
 ///  The regex flags IXSM can be used, though the s (dotall) and m (multiline) flags are
 ///  pointless as a path only ever has a single line.
 ///  If the regex doesn't begin with ^ to match from the beginning of the line, it will be added.
 ///
-@property(readonly, nonatomic) NSRegularExpression *whitelistPathRegex;
+@property(readonly, nonatomic) NSRegularExpression *allowedPathRegex;
 
 ///
-///  Set the regex of whitelisted paths as received from a sync server.
+///  Set the regex of allowed paths as received from a sync server.
 ///
-- (void)setSyncServerWhitelistPathRegex:(NSRegularExpression *)re;
+- (void)setSyncServerAllowedPathRegex:(NSRegularExpression *)re;
 
 ///
-///  The regex of blacklisted paths. Regexes are specified in ICU format.
+///  The regex of blocked paths. Regexes are specified in ICU format.
 ///
 ///  The regex flags IXSM can be used, though the s (dotall) and m (multiline) flags are
 ///  pointless as a path only ever has a single line.
 ///  If the regex doesn't begin with ^ to match from the beginning of the line, it will be added.
 ///
-@property(readonly, nonatomic) NSRegularExpression *blacklistPathRegex;
+@property(readonly, nonatomic) NSRegularExpression *blockedPathRegex;
 
 ///
-///  Set the regex of blacklisted paths as received from a sync server.
+///  Set the regex of blocked paths as received from a sync server.
 ///
-- (void)setSyncServerBlacklistPathRegex:(NSRegularExpression *)re;
+- (void)setSyncServerBlockedPathRegex:(NSRegularExpression *)re;
 
 ///
 ///  The regex of paths to log file changes for. Regexes are specified in ICU format.
@@ -130,6 +130,14 @@
 ///
 @property(readonly, nonatomic) BOOL enablePageZeroProtection;
 
+///
+///  Enable bad signature protection, defaults to NO.
+///  When enabled, a binary that is signed but has a bad signature (cert revoked, binary
+///  tampered with, etc.) will be blocked regardless of client-mode unless a binary allowlist
+///  rule exists.
+///
+@property(readonly, nonatomic) BOOL enableBadSignatureProtection;
+
 ///
 ///  Defines how event logs are stored. Options are:
 ///    SNTEventLogTypeSyslog: Sent to ASL or ULS (if built with the 10.12 SDK or later).
@@ -156,6 +164,24 @@
 ///
 @property(readonly, nonatomic) BOOL enableMachineIDDecoration;
 
+///
+///  Use the bundled SystemExtension on macOS 10.15+, defaults to YES.
+///  Disable to continue using the bundled KEXT.
+///  This is a one way switch, if this is ever true on macOS 10.15+ the KEXT will be deleted.
+///  This gives admins control over the timing of switching to the SystemExtension. The intended use case is to have an MDM deliver
+///  the requisite SystemExtension and TCC profiles before attempting to load.
+///
+@property(readonly, nonatomic) BOOL enableSystemExtension;
+
+///
+///  Use an internal cache for decisions instead of relying on the caching
+///  mechanism built-in to the EndpointSecurity framework. This may increase
+///  performance, particularly when Santa is run alongside other system
+///  extensions.
+///  Has no effect if the system extension is not being used. Defaults to NO.
+///
+@property(readonly, nonatomic) BOOL enableSysxCache;
+
 #pragma mark - GUI Settings
 
 ///
@@ -174,6 +200,9 @@
 ///  %file_sha%    -- SHA-256 of the file that was blocked.
 ///  %machine_id%  -- ID of the machine.
 ///  %username%    -- executing user.
+///  %serial%      -- System's serial number.
+///  %uuid%        -- System's UUID.
+///  %hostname%    -- System's full hostname.
 ///
 ///  @note: This is not an NSURL because the format-string parsing is done elsewhere.
 ///
@@ -249,14 +278,14 @@
 ///
 @property BOOL enableBundles;
 
-#pragma mark Transitive Whitelisting Settings
+#pragma mark Transitive Allowlist Settings
 
 ///
-///  If YES, binaries marked with SNTRuleStateWhitelistCompiler rules are allowed to transitively
-///  whitelist any executables that they produce.  If NO, SNTRuleStateWhitelistCompiler rules are
-///  interpreted as if they were simply SNTRuleStateWhitelist rules.  Defaults to NO.
+///  If YES, binaries marked with SNTRuleStateAllowCompiler rules are allowed to transitively
+///  allow any executables that they produce.  If NO, SNTRuleStateAllowCompiler rules are
+///  interpreted as if they were simply SNTRuleStateAllow rules.  Defaults to NO.
 ///
-@property BOOL enableTransitiveWhitelisting;
+@property BOOL enableTransitiveRules;
 
 #pragma mark Server Auth Settings
 
@@ -295,6 +324,31 @@
 ///
 @property(readonly, nonatomic) NSString *syncClientAuthCertificateIssuer;
 
+///
+///  If true, forks and exits will be logged. Defaults to false.
+///
+@property(readonly, nonatomic) BOOL enableForkAndExitLogging;
+
+///
+///  If true, ignore actions from other endpoint security clients. Defaults to false. This only
+///  applies when running as a sysx.
+///
+@property(readonly, nonatomic) BOOL ignoreOtherEndpointSecurityClients;
+
+///
+///  If true, debug logging will be enabled for all Santa components. Defaults to false.
+///  Passing --debug as an executable argument will enable debug logging for that specific component.
+///
+@property(readonly, nonatomic) BOOL enableDebugLogging;
+
+///
+///  If true, compressed requests from "santactl sync" will set "Content-Encoding" to "zlib"
+///  instead of the new default "deflate". If syncing with Upvote deployed at commit 0b4477d
+///  or below, set this option to true.
+///  Defaults to false.
+///
+@property(readonly, nonatomic) BOOL enableBackwardsCompatibleContentEncoding;
+
 ///
 ///  Retrieve an initialized singleton configurator object using the default file path.
 ///

Source/common/SNTConfigurator.m

@@ -16,7 +16,6 @@
 
 #include <sys/stat.h>
 
-#import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStrengthify.h"
 #import "Source/common/SNTSystemInfo.h"
 
@@ -24,13 +23,16 @@
 /// A NSUserDefaults object set to use the com.google.santa suite.
 @property(readonly, nonatomic) NSUserDefaults *defaults;
 
-// Keys and expected value types.
+/// Keys and expected value types.
 @property(readonly, nonatomic) NSDictionary *syncServerKeyTypes;
 @property(readonly, nonatomic) NSDictionary *forcedConfigKeyTypes;
 
 /// Holds the configurations from a sync server and mobileconfig.
 @property NSMutableDictionary *syncState;
 @property NSMutableDictionary *configState;
+
+/// Was --debug passed as an argument to this process?
+@property(readonly, nonatomic) BOOL debugFlag;
 @end
 
 @implementation SNTConfigurator
@@ -66,6 +68,7 @@ static NSString *const kModeNotificationMonitor = @"ModeNotificationMonitor";
 static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";
 
 static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection";
+static NSString *const kEnableBadSignatureProtectionKey = @"EnableBadSignatureProtection";
 
 static NSString *const kFileChangesRegexKey = @"FileChangesRegex";
 static NSString *const kFileChangesPrefixFiltersKey = @"FileChangesPrefixFilters";
@@ -75,11 +78,23 @@ static NSString *const kEventLogPath = @"EventLogPath";
 
 static NSString *const kEnableMachineIDDecoration = @"EnableMachineIDDecoration";
 
+static NSString *const kEnableSystemExtension = @"EnableSystemExtension";
+static NSString *const kEnableSysxCache = @"EnableSysxCache";
+
+static NSString *const kEnableForkAndExitLogging = @"EnableForkAndExitLogging";
+static NSString *const kIgnoreOtherEndpointSecurityClients = @"IgnoreOtherEndpointSecurityClients";
+static NSString *const kEnableDebugLogging = @"EnableDebugLogging";
+
+static NSString *const kEnableBackwardsCompatibleContentEncoding = @"EnableBackwardsCompatibleContentEncoding";
+
 // The keys managed by a sync server or mobileconfig.
 static NSString *const kClientModeKey = @"ClientMode";
-static NSString *const kEnableTransitiveWhitelistingKey = @"EnableTransitiveWhitelisting";
-static NSString *const kWhitelistRegexKey = @"WhitelistRegex";
-static NSString *const kBlacklistRegexKey = @"BlacklistRegex";
+static NSString *const kEnableTransitiveRulesKey = @"EnableTransitiveRules";
+static NSString *const kEnableTransitiveRulesKeyDeprecated = @"EnableTransitiveWhitelisting";
+static NSString *const kAllowedPathRegexKey = @"AllowedPathRegex";
+static NSString *const kAllowedPathRegexKeyDeprecated = @"WhitelistRegex";
+static NSString *const kBlockedPathRegexKey = @"BlockedPathRegex";
+static NSString *const kBlockedPathRegexKeyDeprecated = @"BlacklistRegex";
 
 // The keys managed by a sync server.
 static NSString *const kFullSyncLastSuccess = @"FullSyncLastSuccess";
@@ -97,21 +112,28 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
     Class array = [NSArray class];
     _syncServerKeyTypes = @{
       kClientModeKey : number,
-      kEnableTransitiveWhitelistingKey : number,
-      kWhitelistRegexKey : re,
-      kBlacklistRegexKey : re,
+      kEnableTransitiveRulesKey : number,
+      kEnableTransitiveRulesKeyDeprecated : number,
+      kAllowedPathRegexKey : re,
+      kAllowedPathRegexKeyDeprecated : re,
+      kBlockedPathRegexKey : re,
+      kBlockedPathRegexKeyDeprecated : re,
       kFullSyncLastSuccess : date,
       kRuleSyncLastSuccess : date,
       kSyncCleanRequired : number
     };
     _forcedConfigKeyTypes = @{
       kClientModeKey : number,
-      kEnableTransitiveWhitelistingKey : number,
+      kEnableTransitiveRulesKey : number,
+      kEnableTransitiveRulesKeyDeprecated : number,
       kFileChangesRegexKey : re,
       kFileChangesPrefixFiltersKey : array,
-      kWhitelistRegexKey : re,
-      kBlacklistRegexKey : re,
+      kAllowedPathRegexKey : re,
+      kAllowedPathRegexKeyDeprecated : re,
+      kBlockedPathRegexKey : re,
+      kBlockedPathRegexKeyDeprecated : re,
       kEnablePageZeroProtectionKey : number,
+      kEnableBadSignatureProtectionKey : number,
       kMoreInfoURLKey : string,
       kEventDetailURLKey : string,
       kEventDetailTextKey : string,
@@ -124,7 +146,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kClientAuthCertificatePasswordKey : string,
       kClientAuthCertificateCNKey : string,
       kClientAuthCertificateIssuerKey : string,
-      kServerAuthRootsDataKey  : data,
+      kServerAuthRootsDataKey : data,
       kServerAuthRootsFileKey : string,
       kMachineOwnerKey : string,
       kMachineIDKey : string,
@@ -135,11 +157,18 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kEventLogType : string,
       kEventLogPath : string,
       kEnableMachineIDDecoration : number,
+      kEnableSystemExtension : number,
+      kEnableSysxCache : number,
+      kEnableForkAndExitLogging : number,
+      kIgnoreOtherEndpointSecurityClients : number,
+      kEnableDebugLogging : number,
+      kEnableBackwardsCompatibleContentEncoding : number,
     };
     _defaults = [NSUserDefaults standardUserDefaults];
     [_defaults addSuiteNamed:@"com.google.santa"];
     _configState = [self readForcedConfig];
     _syncState = [self readSyncStateFromDisk] ?: [NSMutableDictionary dictionary];
+    _debugFlag = [[NSProcessInfo processInfo].arguments containsObject:@"--debug"];
     [self startWatchingDefaults];
   }
   return self;
@@ -189,11 +218,11 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self syncAndConfigStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingWhitelistPathRegex {
++ (NSSet *)keyPathsForValuesAffectingAllowlistPathRegex {
   return [self syncAndConfigStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingBlacklistPathRegex {
++ (NSSet *)keyPathsForValuesAffectingBlocklistPathRegex {
   return [self syncAndConfigStateSet];
 }
 
@@ -297,10 +326,34 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingEnableTransitiveWhitelisting {
++ (NSSet *)keyPathsForValuesAffectingEnableTransitiveRules {
   return [self syncAndConfigStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingEnableSystemExtension {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEnableSysxCache {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEnableForkAndExitLogging {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingIgnoreOtherEndpointSecurityClients {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEnableDebugLogging {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEnableBackwardsCompatibleContentEncoding {
+  return [self configStateSet];
+}
+
 #pragma mark Public Interface
 
 - (SNTClientMode)clientMode {
@@ -320,37 +373,58 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 - (void)setSyncServerClientMode:(SNTClientMode)newMode {
   if (newMode == SNTClientModeMonitor || newMode == SNTClientModeLockdown) {
     [self updateSyncStateForKey:kClientModeKey value:@(newMode)];
-  } else {
-    LOGW(@"Ignoring request to change client mode to %ld", newMode);
   }
 }
 
-- (BOOL)enableTransitiveWhitelisting {
-  NSNumber *n = self.syncState[kEnableTransitiveWhitelistingKey];
-  if (n) {
-    return [n boolValue];
-  }
-  return [self.configState[kEnableTransitiveWhitelistingKey] boolValue];
+- (BOOL)enableTransitiveRules {
+  NSNumber *n = self.syncState[kEnableTransitiveRulesKey];
+  if (n) return [n boolValue];
+
+  n = self.syncState[kEnableTransitiveRulesKeyDeprecated];
+  if (n) return [n boolValue];
+
+  n = self.configState[kEnableTransitiveRulesKeyDeprecated];
+  if (n) return [n boolValue];
+
+  return [self.configState[kEnableTransitiveRulesKey] boolValue];
 }
 
-- (void)setEnableTransitiveWhitelisting:(BOOL)enabled {
-  [self updateSyncStateForKey:kEnableTransitiveWhitelistingKey value:@(enabled)];
+- (void)setEnableTransitiveRules:(BOOL)enabled {
+  [self updateSyncStateForKey:kEnableTransitiveRulesKey value:@(enabled)];
 }
 
-- (NSRegularExpression *)whitelistPathRegex {
-  return self.syncState[kWhitelistRegexKey] ?: self.configState[kWhitelistRegexKey];
+- (NSRegularExpression *)allowedPathRegex {
+  NSRegularExpression *r = self.syncState[kAllowedPathRegexKey];
+  if (r) return r;
+
+  r = self.syncState[kAllowedPathRegexKeyDeprecated];
+  if (r) return r;
+
+  r = self.configState[kAllowedPathRegexKey];
+  if (r) return r;
+
+  return self.configState[kAllowedPathRegexKeyDeprecated];
 }
 
-- (void)setSyncServerWhitelistPathRegex:(NSRegularExpression *)re {
-  [self updateSyncStateForKey:kWhitelistRegexKey value:re];
+- (void)setSyncServerAllowedPathRegex:(NSRegularExpression *)re {
+  [self updateSyncStateForKey:kAllowedPathRegexKey value:re];
 }
 
-- (NSRegularExpression *)blacklistPathRegex {
-  return self.syncState[kBlacklistRegexKey] ?: self.configState[kBlacklistRegexKey];
+- (NSRegularExpression *)blockedPathRegex {
+  NSRegularExpression *r = self.syncState[kBlockedPathRegexKey];
+  if (r) return r;
+
+  r = self.syncState[kBlockedPathRegexKeyDeprecated];
+  if (r) return r;
+
+  r = self.configState[kBlockedPathRegexKey];
+  if (r) return r;
+
+  return self.configState[kBlockedPathRegexKeyDeprecated];
 }
 
-- (void)setSyncServerBlacklistPathRegex:(NSRegularExpression *)re {
-  [self updateSyncStateForKey:kBlacklistRegexKey value:re];
+- (void)setSyncServerBlockedPathRegex:(NSRegularExpression *)re {
+  [self updateSyncStateForKey:kBlockedPathRegexKey value:re];
 }
 
 - (NSRegularExpression *)fileChangesRegex {
@@ -361,7 +435,6 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   NSArray *filters = self.configState[kFileChangesPrefixFiltersKey];
   for (id filter in filters) {
     if (![filter isKindOfClass:[NSString class]]) {
-      LOGE(@"Ignoring FileChangesPrefixFilters: array contains a non-string %@", filter);
       return nil;
     }
   }
@@ -372,7 +445,6 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   NSString *urlString = self.configState[kSyncBaseURLKey];
   if (![urlString hasSuffix:@"/"]) urlString = [urlString stringByAppendingString:@"/"];
   NSURL *url = [NSURL URLWithString:urlString];
-  if (urlString && !url) LOGW(@"SyncBaseURL is not a valid URL!");
   return url;
 }
 
@@ -381,6 +453,11 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return number ? [number boolValue] : YES;
 }
 
+- (BOOL)enableBadSignatureProtection {
+  NSNumber *number = self.configState[kEnableBadSignatureProtectionKey];
+  return number ? [number boolValue] : NO;
+}
+
 - (NSURL *)moreInfoURL {
   return [NSURL URLWithString:self.configState[kMoreInfoURLKey]];
 }
@@ -501,6 +578,42 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return number ? [number boolValue] : NO;
 }
 
+- (BOOL)enableSystemExtension {
+  if (@available(macOS 10.15, *)) {
+    NSFileManager *fm = [NSFileManager defaultManager];
+    if (![fm fileExistsAtPath:@"/Library/Extensions/santa-driver.kext"]) return YES;
+    NSNumber *number = self.configState[kEnableSystemExtension];
+    return number ? [number boolValue] : YES;
+  } else {
+    return NO;
+  }
+}
+
+- (BOOL)enableSysxCache {
+  NSNumber *number = self.configState[kEnableSysxCache];
+  return number ? [number boolValue] : NO;
+}
+
+- (BOOL)enableForkAndExitLogging {
+  NSNumber *number = self.configState[kEnableForkAndExitLogging];
+  return number ? [number boolValue] : NO;
+}
+
+- (BOOL)ignoreOtherEndpointSecurityClients {
+  NSNumber *number = self.configState[kIgnoreOtherEndpointSecurityClients];
+  return number ? [number boolValue] : NO;
+}
+
+- (BOOL)enableDebugLogging {
+  NSNumber *number = self.configState[kEnableDebugLogging];
+  return [number boolValue] || self.debugFlag;
+}
+
+- (BOOL)enableBackwardsCompatibleContentEncoding {
+  NSNumber *number = self.configState[kEnableBackwardsCompatibleContentEncoding];
+  return number ? [number boolValue] : NO;
+}
+
 #pragma mark Private
 
 ///
@@ -547,8 +660,8 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   if (geteuid() != 0) return;
   // Either remove
   NSMutableDictionary *syncState = self.syncState.mutableCopy;
-  syncState[kWhitelistRegexKey] = [syncState[kWhitelistRegexKey] pattern];
-  syncState[kBlacklistRegexKey] = [syncState[kBlacklistRegexKey] pattern];
+  syncState[kAllowedPathRegexKey] = [syncState[kAllowedPathRegexKey] pattern];
+  syncState[kBlockedPathRegexKey] = [syncState[kBlockedPathRegexKey] pattern];
   [syncState writeToFile:kSyncStateFilePath atomically:YES];
   [[NSFileManager defaultManager] setAttributes:@{ NSFilePosixPermissions : @0644 }
                                    ofItemAtPath:kSyncStateFilePath error:NULL];
@@ -586,8 +699,9 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 }
 
 - (void)startWatchingDefaults {
-  // Only santad should listen.
-  if (geteuid() != 0) return;
+  // Only com.google.santa.daemon should listen.
+  NSString *processName = [[NSProcessInfo processInfo] processName];
+  if (![processName isEqualToString:@"com.google.santa.daemon"]) return;
   [[NSNotificationCenter defaultCenter] addObserver:self
                                            selector:@selector(defaultsChanged:)
                                                name:NSUserDefaultsDidChangeNotification

Source/common/SNTFileInfo.m

@@ -143,67 +143,71 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 - (void)hashSHA1:(NSString **)sha1 SHA256:(NSString **)sha256 {
   const int MAX_CHUNK_SIZE = 256 * 1024;  // 256 KB
   const size_t chunkSize = _fileSize > MAX_CHUNK_SIZE ? MAX_CHUNK_SIZE : _fileSize;
-  char chunk[chunkSize];
+  char *chunk = malloc(chunkSize);
 
-  CC_SHA1_CTX c1;
-  CC_SHA256_CTX c256;
+  @try {
+    CC_SHA1_CTX c1;
+    CC_SHA256_CTX c256;
 
-  if (sha1) CC_SHA1_Init(&c1);
-  if (sha256) CC_SHA256_Init(&c256);
+    if (sha1) CC_SHA1_Init(&c1);
+    if (sha256) CC_SHA256_Init(&c256);
 
-  int fd = self.fileHandle.fileDescriptor;
+    int fd = self.fileHandle.fileDescriptor;
 
-  fcntl(fd, F_RDAHEAD, 1);
-  struct radvisory radv;
-  radv.ra_offset = 0;
-  const int MAX_ADVISORY_READ = 10 * 1024 * 1024;
-  radv.ra_count = (int)_fileSize < MAX_ADVISORY_READ ? (int)_fileSize : MAX_ADVISORY_READ;
-  fcntl(fd, F_RDADVISE, &radv);
-  ssize_t bytesRead;
+    fcntl(fd, F_RDAHEAD, 1);
+    struct radvisory radv;
+    radv.ra_offset = 0;
+    const int MAX_ADVISORY_READ = 10 * 1024 * 1024;
+    radv.ra_count = (int)_fileSize < MAX_ADVISORY_READ ? (int)_fileSize : MAX_ADVISORY_READ;
+    fcntl(fd, F_RDADVISE, &radv);
+    ssize_t bytesRead;
 
-  for (uint64_t offset = 0; offset < _fileSize;) {
-    bytesRead = pread(fd, chunk, chunkSize, offset);
-    if (bytesRead > 0) {
-      if (sha1) CC_SHA1_Update(&c1, chunk, (CC_LONG)bytesRead);
-      if (sha256) CC_SHA256_Update(&c256, chunk, (CC_LONG)bytesRead);
-      offset += bytesRead;
-    } else if (bytesRead == -1 && errno == EINTR) {
-      continue;
-    } else {
-      return;
+    for (uint64_t offset = 0; offset < _fileSize;) {
+      bytesRead = pread(fd, chunk, chunkSize, offset);
+      if (bytesRead > 0) {
+        if (sha1) CC_SHA1_Update(&c1, chunk, (CC_LONG)bytesRead);
+        if (sha256) CC_SHA256_Update(&c256, chunk, (CC_LONG)bytesRead);
+        offset += bytesRead;
+      } else if (bytesRead == -1 && errno == EINTR) {
+        continue;
+      } else {
+        return;
+      }
     }
-  }
 
-  // We turn off Read Ahead that we turned on
-  fcntl(fd, F_RDAHEAD, 0);
-  if (sha1) {
-    unsigned char digest[CC_SHA1_DIGEST_LENGTH];
-    CC_SHA1_Final(digest, &c1);
-    NSString *const SHA1FormatString =
-        @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
-    *sha1 = [[NSString alloc]
-        initWithFormat:SHA1FormatString, digest[0], digest[1], digest[2],
-                       digest[3], digest[4], digest[5], digest[6], digest[7],
-                       digest[8], digest[9], digest[10], digest[11], digest[12],
-                       digest[13], digest[14], digest[15], digest[16],
-                       digest[17], digest[18], digest[19]];
-  }
-  if (sha256) {
-    unsigned char digest[CC_SHA256_DIGEST_LENGTH];
-    CC_SHA256_Final(digest, &c256);
-    NSString *const SHA256FormatString =
-        @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
-         "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
+    // We turn off Read Ahead that we turned on
+    fcntl(fd, F_RDAHEAD, 0);
+    if (sha1) {
+      unsigned char digest[CC_SHA1_DIGEST_LENGTH];
+      CC_SHA1_Final(digest, &c1);
+      NSString *const SHA1FormatString =
+          @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
+      *sha1 = [[NSString alloc]
+          initWithFormat:SHA1FormatString, digest[0], digest[1], digest[2],
+                         digest[3], digest[4], digest[5], digest[6], digest[7],
+                         digest[8], digest[9], digest[10], digest[11], digest[12],
+                         digest[13], digest[14], digest[15], digest[16],
+                         digest[17], digest[18], digest[19]];
+    }
+    if (sha256) {
+      unsigned char digest[CC_SHA256_DIGEST_LENGTH];
+      CC_SHA256_Final(digest, &c256);
+      NSString *const SHA256FormatString =
+          @"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+           "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x";
 
-    *sha256 = [[NSString alloc]
-        initWithFormat:SHA256FormatString, digest[0], digest[1], digest[2],
-                       digest[3], digest[4], digest[5], digest[6], digest[7],
-                       digest[8], digest[9], digest[10], digest[11], digest[12],
-                       digest[13], digest[14], digest[15], digest[16],
-                       digest[17], digest[18], digest[19], digest[20],
-                       digest[21], digest[22], digest[23], digest[24],
-                       digest[25], digest[26], digest[27], digest[28],
-                       digest[29], digest[30], digest[31]];
+      *sha256 = [[NSString alloc]
+          initWithFormat:SHA256FormatString, digest[0], digest[1], digest[2],
+                         digest[3], digest[4], digest[5], digest[6], digest[7],
+                         digest[8], digest[9], digest[10], digest[11], digest[12],
+                         digest[13], digest[14], digest[15], digest[16],
+                         digest[17], digest[18], digest[19], digest[20],
+                         digest[21], digest[22], digest[23], digest[24],
+                         digest[25], digest[26], digest[27], digest[28],
+                         digest[29], digest[30], digest[31]];
+    }
+  } @finally {
+    free(chunk);
   }
 }
 
@@ -358,7 +362,7 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
   while (pathComponents.count > 1) {
     NSBundle *bndl = [NSBundle bundleWithPath:[NSString pathWithComponents:pathComponents]];
     if ([bndl objectForInfoDictionaryKey:@"CFBundleIdentifier"]) {
-      if (!ancestor ||
+      if ((!ancestor && bndl.bundlePath.pathExtension.length) ||
           [[self allowedAncestorExtensions] containsObject:bndl.bundlePath.pathExtension]) {
         bundle = bndl;
       }
@@ -547,24 +551,51 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
   for (uint32_t i = 0; i < ncmds; ++i) {
     NSData *cmdData = [self safeSubdataWithRange:NSMakeRange(offset, sz_segment)];
     if (!cmdData) return nil;
-    struct segment_command_64 *lc = (struct segment_command_64 *)[cmdData bytes];
-    if (lc->cmd == LC_SEGMENT || lc->cmd == LC_SEGMENT_64) {
-      if (memcmp(lc->segname, "__TEXT", 6) == 0) {
+
+    if (is64) {
+      struct segment_command_64 *lc = (struct segment_command_64 *)[cmdData bytes];
+      if (lc->cmd == LC_SEGMENT_64 && memcmp(lc->segname, "__TEXT", 6) == 0) {
+          nsects = lc->nsects;
+          offset += sz_segment;
+          break;
+      }
+      offset += lc->cmdsize;
+    } else {
+      struct segment_command *lc = (struct segment_command *)[cmdData bytes];
+      if (lc->cmd == LC_SEGMENT && memcmp(lc->segname, "__TEXT", 6) == 0) {
         nsects = lc->nsects;
         offset += sz_segment;
         break;
       }
+      offset += lc->cmdsize;
     }
-    offset += lc->cmdsize;
   }
 
   // Loop through the sections in the __TEXT segment looking for an __info_plist section.
   for (uint32_t i = 0; i < nsects; ++i) {
     NSData *sectData = [self safeSubdataWithRange:NSMakeRange(offset, sz_section)];
     if (!sectData) return nil;
-    struct section_64 *sect = (struct section_64 *)[sectData bytes];
-    if (sect && memcmp(sect->sectname, "__info_plist", 12) == 0 && sect->size < 2000000) {
-      NSData *plistData = [self safeSubdataWithRange:NSMakeRange(sect->offset, sect->size)];
+    uint64_t sectoffset, sectsize = 0;
+    BOOL found = NO;
+    if (is64) {
+      struct section_64 *sect = (struct section_64 *)[sectData bytes];
+      if (sect && memcmp(sect->sectname, "__info_plist", 12) == 0 && sect->size < 2000000) {
+        sectoffset = sect->offset;
+        sectsize = sect->size;
+        found = YES;
+      }
+    } else {
+      struct section *sect = (struct section *)[sectData bytes];
+      if (sect && memcmp(sect->sectname, "__info_plist", 12) == 0 && sect->size < 2000000) {
+        sectoffset = sect->offset;
+        sectsize = sect->size;
+        found = YES;
+      }
+    }
+
+    if (found) {
+      NSData *plistData = [self safeSubdataWithRange:NSMakeRange(mhwo.offset + sectoffset,
+                                                                 sectsize)];
       if (!plistData) return nil;
       NSDictionary *plist;
       plist = [NSPropertyListSerialization propertyListWithData:plistData

Source/common/SNTFileInfoTest.m

@@ -39,9 +39,8 @@
   sut = [[SNTFileInfo alloc] initWithPath:@"../../../../../../../../../../../../../../../bin/ls"];
   XCTAssertEqualObjects(sut.path, @"/bin/ls");
 
-  sut = [[SNTFileInfo alloc] initWithPath:@"/usr/bin/qlmanage"];
-  XCTAssertEqualObjects(sut.path, @"/System/Library/Frameworks/QuickLook.framework/Versions/A/"
-                                  @"Resources/quicklookd.app/Contents/MacOS/qlmanage");
+  sut = [[SNTFileInfo alloc] initWithPath:@"/usr/sbin/DirectoryService"];
+  XCTAssertEqualObjects(sut.path, @"/usr/libexec/dspluginhelperd");
 }
 
 - (void)testSHA1 {
@@ -72,7 +71,6 @@
   XCTAssertTrue(sut.isExecutable);
 
   XCTAssertFalse(sut.isDylib);
-  XCTAssertFalse(sut.isFat);
   XCTAssertFalse(sut.isKext);
   XCTAssertFalse(sut.isScript);
 }
@@ -106,7 +104,7 @@
 }
 
 - (void)testDylibs {
-  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:@"/usr/lib/libsqlite3.dylib"];
+  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:@"/usr/lib/system/libsystem_platform.dylib"];
 
   XCTAssertTrue(sut.isMachO);
   XCTAssertTrue(sut.isDylib);
@@ -231,10 +229,16 @@
 }
 
 - (void)testEmbeddedInfoPlist {
+  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:@"32bitplist"
+                                                                    ofType:@""];
+  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:path];
+  XCTAssertNotNil([sut infoPlist]);
+  XCTAssertEqualObjects([sut infoPlist][@"CFBundleShortVersionString"], @"1.0");
+  XCTAssertEqualObjects([sut infoPlist][@"CFBundleIdentifier"], @"com.google.i386plist");
+
   // csreq is installed on all machines with Xcode installed. If you're running these tests,
   // it should be available..
-  SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:@"/usr/bin/csreq"];
-
+  sut = [[SNTFileInfo alloc] initWithPath:@"/usr/bin/csreq"];
   XCTAssertNotNil([sut infoPlist]);
 }
 

Source/common/SNTKernelCommon.h

@@ -16,11 +16,12 @@
 /// Common defines between kernel <-> userspace
 ///
 
-#include <sys/param.h>
-
 #ifndef SANTA__COMMON__KERNELCOMMON_H
 #define SANTA__COMMON__KERNELCOMMON_H
 
+#include <stdint.h>
+#include <sys/param.h>
+
 // Defines the name of the userclient class and the driver bundle ID.
 #define USERCLIENT_CLASS "com_google_SantaDriver"
 #define USERCLIENT_ID "com.google.santa-driver"
@@ -81,6 +82,8 @@ typedef enum {
   ACTION_NOTIFY_EXCHANGE = 34,
   ACTION_NOTIFY_DELETE = 35,
   ACTION_NOTIFY_WHITELIST = 36,
+  ACTION_NOTIFY_FORK = 37,
+  ACTION_NOTIFY_EXIT = 38,
 
   // ERROR
   ACTION_ERROR = 99,
@@ -116,6 +119,7 @@ typedef struct {
   uid_t uid;
   gid_t gid;
   pid_t pid;
+  int pidversion;
   pid_t ppid;
   char path[MAXPATHLEN];
   char newpath[MAXPATHLEN];
@@ -124,6 +128,12 @@ typedef struct {
   // While process names can technically be 4*MAXPATHLEN, that never
   // actually happens, so only take MAXPATHLEN and throw away any excess.
   char pname[MAXPATHLEN];
+
+  // For messages that originate from EndpointSecurity, this points to a copy of the message.
+  void *es_message;
+
+  // For messages that originate from EndpointSecurity, this points to an NSArray of the arguments.
+  void *args_array;
 } santa_message_t;
 
 // Used for the kSantaUserClientCacheBucketCount request.

Source/common/SNTLogging.h

@@ -34,6 +34,10 @@
 
 #else  // KERNEL
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 #import <Foundation/Foundation.h>
 
 typedef enum : NSUInteger {
@@ -60,6 +64,10 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...)
 #define LOGW(logFormat, ...) logMessage(LOG_LEVEL_WARN, stderr, logFormat, ##__VA_ARGS__)
 #define LOGE(logFormat, ...) logMessage(LOG_LEVEL_ERROR, stderr, logFormat, ##__VA_ARGS__)
 
+#ifdef __cplusplus
+} // extern C
+#endif
+
 #endif  // KERNEL
 
 #endif  // SANTA__COMMON__LOGGING_H

Source/common/SNTLogging.m

@@ -14,6 +14,8 @@
 
 #import "Source/common/SNTLogging.h"
 
+#import "Source/common/SNTConfigurator.h"
+
 #import <asl.h>
 #import <pthread.h>
 
@@ -39,13 +41,13 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
   dispatch_once(&pred, ^{
     binaryName = [[NSProcessInfo processInfo] processName];
 
-    // If debug logging is enabled, the process must be restarted.
-    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--debug"]) {
+    if ([SNTConfigurator configurator].enableDebugLogging) {
       logLevel = LOG_LEVEL_DEBUG;
     }
 
     // If requested, redirect output to syslog.
-    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--syslog"]) {
+    if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--syslog"] ||
+        [binaryName isEqualToString:@"com.google.santa.daemon"]) {
       useSyslog = YES;
       pthread_key_create(&syslogKey, syslogClientDestructor);
     }
@@ -86,7 +88,10 @@ void logMessage(LogLevel level, FILE *destination, NSString *format, ...) {
         break;
       case LOG_LEVEL_DEBUG:
         levelName = "D";
-        syslogLevel = ASL_LEVEL_DEBUG;
+        // Log debug messages at the same ASL level as INFO.
+        // While it would make sense to use DEBUG, watching debug-level logs
+        // in Console means enabling all debug logs, which is absurdly noisy.
+        syslogLevel = ASL_LEVEL_NOTICE;
         break;
     }
 

Source/common/SNTPrefixTree.cc

@@ -12,55 +12,51 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#include "Source/santa_driver/SantaPrefixTree.h"
+#include "Source/common/SNTPrefixTree.h"
 
 #ifdef KERNEL
 #include <libkern/locks.h>
-
 #include "Source/common/SNTLogging.h"
+
 #else
+
+#include <mutex>
 #include <string.h>
 
 #define LOGD(format, ...) // NOP
 #define LOGE(format, ...) // NOP
 
-#define lck_grp_attr_alloc_init() nullptr
-#define lck_grp_alloc_init(name, attr) nullptr
-#define lck_attr_alloc_init() nullptr
+#define lck_rw_lock_shared(l) pthread_rwlock_rdlock(&l)
+#define lck_rw_unlock_shared(l) pthread_rwlock_unlock(&l)
+#define lck_rw_lock_exclusive(l) pthread_rwlock_wrlock(&l)
+#define lck_rw_unlock_exclusive(l) pthread_rwlock_unlock(&l)
 
-#define lck_rw_alloc_init(g, a) new std::shared_mutex
-#define lck_mtx_alloc_init(g, a) new std::mutex
-
-#define lck_attr_free(attr) // NOP
-#define lck_grp_free(grp) // NOP
-#define lck_grp_attr_free(grp_attr) // NOP
-
-#define lck_rw_lock_shared(l) l->lock_shared()
-#define lck_rw_unlock_shared(l) l->unlock_shared()
-#define lck_rw_lock_exclusive(l) l->lock()
-#define lck_rw_unlock_exclusive(l) l->unlock()
-
-#define lck_rw_lock_shared_to_exclusive(l) ({ l->unlock_shared(); false; })
-#define lck_rw_lock_exclusive_to_shared(l) l->unlock(); l->lock_shared()
+#define lck_rw_lock_shared_to_exclusive(l) ({ pthread_rwlock_unlock(&l); false; })
+#define lck_rw_lock_exclusive_to_shared(l) ({ pthread_rwlock_unlock(&l); pthread_rwlock_rdlock(&l); })
 
 #define lck_mtx_lock(l) l->lock()
 #define lck_mtx_unlock(l) l->unlock()
 #endif // KERNEL
 
-SantaPrefixTree::SantaPrefixTree(uint32_t max_nodes) {
+SNTPrefixTree::SNTPrefixTree(uint32_t max_nodes) {
   root_ = new SantaPrefixNode();
   node_count_ = 0;
   max_nodes_ = max_nodes;
 
+#ifdef KERNEL
   spt_lock_grp_attr_ = lck_grp_attr_alloc_init();
   spt_lock_grp_ = lck_grp_alloc_init("santa-prefix-tree-lock", spt_lock_grp_attr_);
   spt_lock_attr_ = lck_attr_alloc_init();
 
   spt_lock_ = lck_rw_alloc_init(spt_lock_grp_, spt_lock_attr_);
   spt_add_lock_ = lck_mtx_alloc_init(spt_lock_grp_, spt_lock_attr_);
+#else
+  pthread_rwlock_init(&spt_lock_, nullptr);
+  spt_add_lock_ = new std::mutex;
+#endif
 }
 
-IOReturn SantaPrefixTree::AddPrefix(const char *prefix, uint64_t *node_count) {
+IOReturn SNTPrefixTree::AddPrefix(const char *prefix, uint64_t *node_count) {
   // Serialize requests to AddPrefix. Otherwise one AddPrefix thread could overwrite whole
   // branches of another. HasPrefix is still free to read the tree, until AddPrefix needs to
   // modify it.
@@ -156,7 +152,7 @@ IOReturn SantaPrefixTree::AddPrefix(const char *prefix, uint64_t *node_count) {
   return kIOReturnSuccess;
 }
 
-bool SantaPrefixTree::HasPrefix(const char *string) {
+bool SNTPrefixTree::HasPrefix(const char *string) {
   lck_rw_lock_shared(spt_lock_);
 
   auto found = false;
@@ -184,7 +180,7 @@ bool SantaPrefixTree::HasPrefix(const char *string) {
   return found;
 }
 
-void SantaPrefixTree::Reset() {
+void SNTPrefixTree::Reset() {
   lck_rw_lock_exclusive(spt_lock_);
 
   PruneNode(root_);
@@ -194,7 +190,7 @@ void SantaPrefixTree::Reset() {
   lck_rw_unlock_exclusive(spt_lock_);
 }
 
-void SantaPrefixTree::PruneNode(SantaPrefixNode *target) {
+void SNTPrefixTree::PruneNode(SantaPrefixNode *target) {
   if (!target) return;
 
   // For deep trees, a recursive approach will generate too many stack frames. Make a "stack"
@@ -226,13 +222,13 @@ void SantaPrefixTree::PruneNode(SantaPrefixNode *target) {
   delete[] stack;
 }
 
-SantaPrefixTree::~SantaPrefixTree() {
+SNTPrefixTree::~SNTPrefixTree() {
   lck_rw_lock_exclusive(spt_lock_);
   PruneNode(root_);
   root_ = nullptr;
   lck_rw_unlock_exclusive(spt_lock_);
 
-  #ifdef KERNEL
+#ifdef KERNEL
   if (spt_lock_) {
     lck_rw_free(spt_lock_, spt_lock_grp_);
     spt_lock_ = nullptr;
@@ -242,7 +238,6 @@ SantaPrefixTree::~SantaPrefixTree() {
     lck_mtx_free(spt_add_lock_, spt_lock_grp_);
     spt_add_lock_ = nullptr;
   }
-  #endif
 
   if (spt_lock_attr_) {
     lck_attr_free(spt_lock_attr_);
@@ -258,4 +253,7 @@ SantaPrefixTree::~SantaPrefixTree() {
     lck_grp_attr_free(spt_lock_grp_attr_);
     spt_lock_grp_attr_ = nullptr;
   }
+#else
+  pthread_rwlock_destroy(&spt_lock_);
+#endif
 }

Source/common/SNTPrefixTree.h

@@ -22,16 +22,16 @@
 #include <libkern/locks.h>
 #else
 // Support for unit testing.
-// Requires c++17 / macOS 10.12.
-// TODO(bur): Handle warnings from bumping target version of the tests to 10.12.
-#include <shared_mutex>
+#include <mutex>
+#include <pthread.h>
+#include <stdint.h>
 #endif // KERNEL
 
 ///
 ///  SantaPrefixTree is a simple prefix tree implementation.
 ///  Operations are thread safe.
 ///
-class SantaPrefixTree {
+class SNTPrefixTree {
  public:
   // Add a prefix to the tree.
   // Optionally pass node_count to get the number of nodes after the add.
@@ -43,8 +43,8 @@ class SantaPrefixTree {
   // Reset the tree.
   void Reset();
 
-  SantaPrefixTree(uint32_t max_nodes = kDefaultMaxNodes);
-  ~SantaPrefixTree();
+  SNTPrefixTree(uint32_t max_nodes = kDefaultMaxNodes);
+  ~SNTPrefixTree();
 
  private:
   ///
@@ -85,19 +85,16 @@ class SantaPrefixTree {
   uint32_t max_nodes_;
   uint32_t node_count_;
 
-  #ifdef KERNEL
+#ifdef KERNEL
   lck_grp_t *spt_lock_grp_;
   lck_grp_attr_t *spt_lock_grp_attr_;
   lck_attr_t *spt_lock_attr_;
   lck_rw_t *spt_lock_;
   lck_mtx_t *spt_add_lock_;
-  #else // KERNEL
-  void *spt_lock_grp_;
-  void *spt_lock_grp_attr_;
-  void *spt_lock_attr_;
-  std::shared_mutex *spt_lock_;
+#else // KERNEL
+  pthread_rwlock_t spt_lock_;
   std::mutex *spt_add_lock_;
-  #endif // KERNEL
+#endif // KERNEL
 };
 
 #endif /* SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H */

Source/common/SNTPrefixTreeTest.mm

@@ -14,22 +14,22 @@
 
 #import <XCTest/XCTest.h>
 
-#include "Source/santa_driver/SantaPrefixTree.h"
+#include "Source/common/SNTPrefixTree.h"
 
-@interface SantaPrefixTreeTest : XCTestCase
+@interface SNTPrefixTreeTest : XCTestCase
 @end
 
-@implementation SantaPrefixTreeTest
+@implementation SNTPrefixTreeTest
 
 - (void)testAddAndHas {
-  auto t = SantaPrefixTree();
+  auto t = SNTPrefixTree();
   XCTAssertFalse(t.HasPrefix("/private/var/tmp/file1"));
   t.AddPrefix("/private/var/tmp/");
   XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
 }
 
 - (void)testReset {
-  auto t = SantaPrefixTree();
+  auto t = SNTPrefixTree();
   t.AddPrefix("/private/var/tmp/");
   XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
   t.Reset();
@@ -38,7 +38,7 @@
 
 - (void)testThreading {
   uint32_t count = 4096;
-  auto t = new SantaPrefixTree(count * (uint32_t)[NSUUID UUID].UUIDString.length);
+  auto t = new SNTPrefixTree(count * (uint32_t)[NSUUID UUID].UUIDString.length);
 
   NSMutableArray *UUIDs = [NSMutableArray arrayWithCapacity:count];
   for (int i = 0; i < count; ++i) {

Source/common/SNTRule.m

@@ -46,7 +46,7 @@
                     customMsg:customMsg
                     timestamp:0];
   // Initialize timestamp to current time if rule is transitive.
-  if (self && state == SNTRuleStateWhitelistTransitive) {
+  if (self && state == SNTRuleStateAllowTransitive) {
     [self resetTimestamp];
   }
   return self;

Source/common/SNTXPCBundleServiceInterface.h

@@ -14,6 +14,8 @@
 
 #import <Foundation/Foundation.h>
 
+#import <MOLXPCConnection/MOLXPCConnection.h>
+
 @class SNTStoredEvent;
 
 ///  A block that takes the calculated bundle hash, associated events and hashing time in ms.
@@ -25,7 +27,7 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 ///  @param listener The listener to connect back to the SantaGUI.
 ///
-- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
+- (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;
 
 ///
 ///  Hash a bundle for an event. The SNTBundleHashBlock will be called with nil parameters if a
@@ -39,6 +41,11 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 - (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
 
+///
+///  santabundleservice is launched on demand by launchd, call spindown to let santabundleservice know you are done with it.
+///
+- (void)spindown;
+
 @end
 
 @interface SNTXPCBundleServiceInterface : NSObject
@@ -52,6 +59,12 @@ typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNu
 ///
 ///  Returns the MachService ID for this service.
 ///
-+ (NSString *)serviceId;
++ (NSString *)serviceID;
+
+///
+///  Retrieve a pre-configured MOLXPCConnection for communicating with santabundleservice.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
++ (MOLXPCConnection *)configuredConnection;
 
 @end

Source/common/SNTXPCBundleServiceInterface.m

@@ -29,8 +29,15 @@
   return r;
 }
 
-+ (NSString *)serviceId {
-  return @"com.google.santabs";
++ (NSString *)serviceID {
+  return @"com.google.santa.bundleservice";
+}
+
++ (MOLXPCConnection *)configuredConnection {
+  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceID]
+                                                          privileged:YES];
+  c.remoteInterface = [self bundleServiceInterface];
+  return c;
 }
 
 @end

Source/common/SNTXPCControlInterface.h

@@ -44,10 +44,10 @@
 - (void)setFullSyncLastSuccess:(NSDate *)date reply:(void (^)(void))reply;
 - (void)setRuleSyncLastSuccess:(NSDate *)date reply:(void (^)(void))reply;
 - (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)(void))reply;
-- (void)setWhitelistPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
-- (void)setBlacklistPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
+- (void)setAllowedPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
+- (void)setBlockedPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
 - (void)setEnableBundles:(BOOL)bundlesEnabled reply:(void (^)(void))reply;
-- (void)setEnableTransitiveWhitelisting:(BOOL)enabled reply:(void (^)(void))reply;
+- (void)setEnableTransitiveRules:(BOOL)enabled reply:(void (^)(void))reply;
 
 ///
 ///  Syncd Ops
@@ -57,12 +57,28 @@
 
 @end
 
-@interface SNTXPCControlInterface : SNTXPCUnprivilegedControlInterface
+@interface SNTXPCControlInterface : NSObject
 
 ///
-///  Internal method used to initialize the control interface
+///  Returns the MachService ID for this service.
 ///
++ (NSString *)serviceID;
 
-+ (void)initializeControlInterface:(NSXPCInterface *)r;
+///
+///  Returns the SystemExtension ID for this service.
+///
++ (NSString *)systemExtensionID;
+
+///
+///  Returns an initialized NSXPCInterface for the SNTUnprivilegedDaemonControlXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning
+///
++ (NSXPCInterface *)controlInterface;
+
+///
+///  Retrieve a pre-configured MOLXPCConnection for communicating with santad.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
++ (MOLXPCConnection *)configuredConnection;
 
 @end

Source/common/SNTXPCControlInterface.m

@@ -14,20 +14,33 @@
 
 #import "Source/common/SNTXPCControlInterface.h"
 
+#import <MOLCodesignChecker/MOLCodesignChecker.h>
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTRule.h"
 #import "Source/common/SNTStoredEvent.h"
 
+NSString *const kBundleID = @"com.google.santa.daemon";
+
 @implementation SNTXPCControlInterface
 
-+ (NSString *)serviceId {
-  return @"SantaXPCControl";
++ (NSString *)serviceID {
+  if ([[SNTConfigurator configurator] enableSystemExtension]) {
+    MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithSelf];
+    // "teamid.com.google.santa.daemon.xpc"
+    NSString *t = cs.signingInformation[@"teamid"];
+    return [NSString stringWithFormat:@"%@.%@.xpc", t, kBundleID];
+  }
+  return kBundleID;
+}
+
++ (NSString *)systemExtensionID {
+  return kBundleID;
 }
 
 + (void)initializeControlInterface:(NSXPCInterface *)r {
-  [super initializeControlInterface:r];
-
   [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
         forSelector:@selector(databaseEventsPending:)
       argumentIndex:0
@@ -47,7 +60,7 @@
 }
 
 + (MOLXPCConnection *)configuredConnection {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceId]
+  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceID]
                                                           privileged:YES];
   c.remoteInterface = [self controlInterface];
   return c;

Source/common/SNTXPCNotifierInterface.h

@@ -24,16 +24,10 @@
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
 - (void)postClientModeNotification:(SNTClientMode)clientmode;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
-@end
-
-/// Protocol implemented by SantaGUI and utilized by santabs
-@protocol SNTBundleNotifierXPC
 - (void)updateCountsForEvent:(SNTStoredEvent *)event
                  binaryCount:(uint64_t)binaryCount
                    fileCount:(uint64_t)fileCount
                  hashedCount:(uint64_t)hashedCount;
-
-- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener;
 @end
 
 @interface SNTXPCNotifierInterface : NSObject
@@ -44,10 +38,4 @@
 ///
 + (NSXPCInterface *)notifierInterface;
 
-///
-///  @return an initialized NSXPCInterface for the SNTBundleNotifierXPC protocol.
-///  Ensures any methods that accept custom classes as arguments are set-up before returning
-///
-+ (NSXPCInterface *)bundleNotifierInterface;
-
 @end

Source/common/SNTXPCNotifierInterface.m

@@ -20,8 +20,4 @@
   return [NSXPCInterface interfaceWithProtocol:@protocol(SNTNotifierXPC)];
 }
 
-+ (NSXPCInterface *)bundleNotifierInterface {
-  return [NSXPCInterface interfaceWithProtocol:@protocol(SNTBundleNotifierXPC)];
-}
-
 @end

Source/common/SNTXPCSyncServiceInterface.h

@@ -0,0 +1,56 @@
+/// Copyright 2020 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+#import <MOLXPCConnection/MOLXPCConnection.h>
+
+#import "Source/common/SNTCommonEnums.h"
+
+@class SNTStoredEvent;
+
+///  A block that reports the number of rules processed.
+///  TODO(bur): Add more details about the sync.
+typedef void (^SNTFullSyncReplyBlock)(NSNumber *rulesProcessed);
+
+///  Protocol implemented by syncservice and utilized by daemon and ctl for communication with a sync server.
+@protocol SNTSyncServiceXPC
+- (void)postEventsToSyncServer:(NSArray<SNTStoredEvent *> *)events fromBundle:(BOOL)fromBundle;
+- (void)postBundleEventToSyncServer:(SNTStoredEvent *)event
+                              reply:(void (^)(SNTBundleEventAction))reply;
+- (void)isFCMListening:(void (^)(BOOL))reply;
+- (void)performFullSyncWithReply:(SNTFullSyncReplyBlock)reply;
+@end
+
+@interface SNTXPCSyncServiceInterface : NSObject
+
+///
+///  Returns an initialized NSXPCInterface for the SNTSyncServiceXPC protocol.
+///  Ensures any methods that accept custom classes as arguments are set-up before returning.
+///
++ (NSXPCInterface *)syncServiceInterface;
+
+///
+///  Returns the MachService ID for this service.
+///
++ (NSString *)serviceID;
+
+///
+///  Retrieve a pre-configured MOLXPCConnection for communicating with syncservice.
+///  Connections just needs any handlers set and then can be resumed and used.
+///
++ (MOLXPCConnection *)configuredConnection;
+
+@end
+

Source/common/SNTXPCSyncServiceInterface.m

@@ -0,0 +1,43 @@
+/// Copyright 2020 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "Source/common/SNTXPCSyncServiceInterface.h"
+
+#import "Source/common/SNTStoredEvent.h"
+
+@implementation SNTXPCSyncServiceInterface
+
++ (NSXPCInterface *)syncServiceInterface {
+  NSXPCInterface *r = [NSXPCInterface interfaceWithProtocol:@protocol(SNTSyncServiceXPC)];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
+        forSelector:@selector(postEventsToSyncServer:fromBundle:)
+      argumentIndex:0
+            ofReply:NO];
+
+  return r;
+}
+
++ (NSString *)serviceID {
+  return @"com.google.santa.syncservice";
+}
+
++ (MOLXPCConnection *)configuredConnection {
+  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceID]
+                                                          privileged:YES];
+  c.remoteInterface = [self syncServiceInterface];
+  return c;
+}
+
+@end

Source/common/SNTXPCUnprivilegedControlInterface.h

@@ -17,7 +17,6 @@
 
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTKernelCommon.h"
-#import "Source/common/SNTXPCBundleServiceInterface.h"
 
 @class SNTRule;
 @class SNTStoredEvent;
@@ -72,13 +71,12 @@
 - (void)ruleSyncLastSuccess:(void (^)(NSDate *))reply;
 - (void)syncCleanRequired:(void (^)(BOOL))reply;
 - (void)enableBundles:(void (^)(BOOL))reply;
-- (void)enableTransitiveWhitelisting:(void (^)(BOOL))reply;
+- (void)enableTransitiveRules:(void (^)(BOOL))reply;
 
 ///
 ///  GUI Ops
 ///
 - (void)setNotificationListener:(NSXPCListenerEndpoint *)listener;
-- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener;
 
 ///
 ///  Syncd Ops
@@ -88,34 +86,21 @@
 ///
 ///  Bundle Ops
 ///
-- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event reply:(SNTBundleHashBlock)reply;
 - (void)syncBundleEvent:(SNTStoredEvent *)event relatedEvents:(NSArray<SNTStoredEvent *> *)events;
 
 @end
 
 @interface SNTXPCUnprivilegedControlInterface : NSObject
 
-///
-///  Returns the MachService ID for this service.
-///
-+ (NSString *)serviceId;
-
 ///
 ///  Returns an initialized NSXPCInterface for the SNTUnprivilegedDaemonControlXPC protocol.
 ///  Ensures any methods that accept custom classes as arguments are set-up before returning
 ///
 + (NSXPCInterface *)controlInterface;
 
-///
-///  Retrieve a pre-configured MOLXPCConnection for communicating with santad.
-///  Connections just needs any handlers set and then can be resumed and used.
-///
-+ (MOLXPCConnection *)configuredConnection;
-
 ///
 ///  Internal method used to initialize the control interface
 ///
-
 + (void)initializeControlInterface:(NSXPCInterface *)r;
 
 @end

Source/common/SNTXPCUnprivilegedControlInterface.m

@@ -21,16 +21,7 @@
 
 @implementation SNTXPCUnprivilegedControlInterface
 
-+ (NSString *)serviceId {
-  return @"SantaUnprivilegedXPCControl";
-}
-
 + (void)initializeControlInterface:(NSXPCInterface *)r {
-  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
-        forSelector:@selector(hashBundleBinariesForEvent:reply:)
-      argumentIndex:1
-            ofReply:YES];
-
   [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTStoredEvent class], nil]
         forSelector:@selector(syncBundleEvent:relatedEvents:)
       argumentIndex:1
@@ -44,11 +35,4 @@
   return r;
 }
 
-+ (MOLXPCConnection *)configuredConnection {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithName:[self serviceId]
-                                                          privileged:YES];
-  c.remoteInterface = [self controlInterface];
-  return c;
-}
-
 @end

Source/common/SantaCache.h

@@ -29,7 +29,6 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-// TODO(rah): Consider templatizing these.
 #define panic(args...) printf(args); printf("\n"); abort()
 #define IOMallocAligned(sz, alignment) malloc(sz);
 #define IOFreeAligned(addr, sz) free(addr)
@@ -37,6 +36,8 @@
 #define OSTestAndClear(bit, addr) OSAtomicTestAndClear(bit, addr) == 0
 #define OSIncrementAtomic(addr) OSAtomicIncrement64((volatile int64_t *)addr)
 #define OSDecrementAtomic(addr) OSAtomicDecrement64((volatile int64_t *)addr)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
 #endif // KERNEL
 
 /**
@@ -78,6 +79,7 @@ template<typename KeyT, typename ValueT> class SantaCache {
     if (unlikely(per_bucket > 64)) per_bucket = 64;
     max_size_ = maximum_size;
     bucket_count_ = (1 << (32 - __builtin_clz((((uint32_t)max_size_ / per_bucket) - 1) ?: 1)));
+    if (unlikely(bucket_count_ > UINT32_MAX)) bucket_count_ = UINT32_MAX;
     buckets_ = (struct bucket *)IOMallocAligned(bucket_count_ * sizeof(struct bucket), 2);
     bzero(buckets_, bucket_count_ * sizeof(struct bucket));
   }
@@ -197,6 +199,11 @@ template<typename KeyT, typename ValueT> class SantaCache {
     if (per_bucket_counts == nullptr || array_size == nullptr || start_bucket == nullptr) return;
 
     uint64_t start = *start_bucket;
+    if (start >= bucket_count_) {
+      *start_bucket = 0;
+      return;
+    }
+
     uint16_t size = *array_size;
     if (start + size > bucket_count_) size = bucket_count_ - start;
 
@@ -357,4 +364,8 @@ template<typename KeyT, typename ValueT> class SantaCache {
   }
 };
 
+#ifndef KERNEL
+#pragma clang diagnostic pop
+#endif
+
 #endif // SANTA__SANTA_DRIVER__SANTACACHE_H

Source/common/SantaCacheTest.mm

@@ -18,7 +18,7 @@
 #include <string>
 #include <vector>
 
-#include "Source/santa_driver/SantaCache.h"
+#include "Source/common/SantaCache.h"
 
 @interface SantaCacheTest : XCTestCase
 @end
@@ -251,7 +251,7 @@ template<> uint64_t SantaCacheHasher<S>(S const& s) {
 }
 
 - (void)testStructKeys {
-  auto sut =  SantaCache<S, uint64_t>(10, 2);
+  auto sut = SantaCache<S, uint64_t>(10, 2);
 
   S s1 = {1024, 2048};
   S s2 = {4096, 8192};
@@ -265,4 +265,22 @@ template<> uint64_t SantaCacheHasher<S>(S const& s) {
   XCTAssertEqual(sut.get(s3), 30);
 }
 
+- (void)testBucketCounts {
+  auto sut = new SantaCache<uint64_t, uint64_t>(UINT16_MAX, 1);
+
+  // These tests verify that the bucket_counts() function can't be abused
+  // with integer {over,under}flow issues in the input or going out-of-bounds
+  // on the buckets array.
+  uint16_t size = 2048;
+  uint64_t start = (UINT64_MAX - 2047);
+  uint16_t per_bucket_counts[2048];
+  sut->bucket_counts(per_bucket_counts, &size, &start);
+  XCTAssertEqual(start, 0, @"Check a high start can't overflow");
+
+  size = UINT16_MAX;
+  start = UINT16_MAX - 1;
+  sut->bucket_counts(per_bucket_counts, &size, &start);
+  XCTAssertEqual(start, 0, @"Check a large size can't overflow");
+}
+
 @end

Source/santa/BUILD

@@ -1,11 +1,11 @@
+load("@build_bazel_rules_apple//apple:macos.bzl", "macos_application")
+
 licenses(["notice"])  # Apache 2.0
 
 exports_files([
     "Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-256.png",
 ])
 
-load("@build_bazel_rules_apple//apple:macos.bzl", "macos_application")
-
 objc_library(
     name = "SantaGUI_lib",
     srcs = [
@@ -30,10 +30,12 @@ objc_library(
     sdk_frameworks = [
         "IOKit",
         "SecurityInterface",
+        "SystemExtensions",
     ],
     deps = [
         "//Source/common:SNTBlockMessage_SantaGUI",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SNTLogging",
         "//Source/common:SNTXPCControlInterface",
         "//Source/common:SNTXPCNotifierInterface",
         "@MOLCodesignChecker",
@@ -42,13 +44,18 @@ objc_library(
 )
 
 macos_application(
-    name = "SantaGUI",
+    name = "Santa",
+    additional_contents = {
+        "//Source/santactl": "MacOS",
+        "//Source/santabundleservice": "MacOS",
+        "//Source/santad:com.google.santa.daemon": "Library/SystemExtensions",
+    },
     app_icons = glob(["Resources/Images.xcassets/**"]),
-    bundle_id = "com.google.SantaGUI",
+    bundle_id = "com.google.santa",
     bundle_name = "Santa",
-    infoplists = ["Resources/SantaGUI-Info.plist"],
+    infoplists = ["Info.plist"],
     minimum_os_version = "10.9",
     version = "//:version",
-    visibility = ["//visibility:public"],
+    visibility = ["//:santa_package_group"],
     deps = [":SantaGUI_lib"],
 )

Source/santa/Info.plist

@@ -2,31 +2,31 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>Google, Inc.</string>
-	<key>CFBundleIdentifier</key>
-	<string>com.google.SantaGUI</string>
-	<key>CFBundleName</key>
-	<string>Santa</string>
 	<key>CFBundleExecutable</key>
 	<string>Santa</string>
-	<key>CFBundleVersion</key>
-	<string>${SANTA_VERSION}</string>
-	<key>CFBundleShortVersionString</key>
-	<string>${SANTA_VERSION}</string>
-	<key>LSMinimumSystemVersion</key>
-	<string>${MACOSX_VERSION_MIN}</string>
-	<key>LSUIElement</key>
-	<true/>
-	<key>NSPrincipalClass</key>
-	<string>NSApplication</string>
 	<key>CFBundleIconFile</key>
 	<string>AppIcon</string>
 	<key>CFBundleIconName</key>
 	<string>AppIcon</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>Santa</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>${MACOSX_VERSION_MIN}</string>
+	<key>LSUIElement</key>
+	<true/>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google LLC.</string>
+	<key>NSPrincipalClass</key>
+	<string>NSApplication</string>
 </dict>
 </plist>

Source/santa/Resources/AboutWindow.xib

@@ -38,7 +38,7 @@
                         <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
                         <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="center" id="CcT-ul-1eA">
                             <font key="font" metaFont="system"/>
-                            <string key="title">Santa is an application whitelisting system for macOS.
+                            <string key="title">Santa is an application control system for macOS.
 
 There are no user-configurable settings.</string>
                             <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>

Source/santa/Resources/Images.xcassets/Contents.json

@@ -3,4 +3,4 @@
     "version" : 1,
     "author" : "xcode"
   }
-}
+}

Source/santa/SNTAboutWindowController.m

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTAboutWindowController.h"
+#import "Source/santa/SNTAboutWindowController.h"
 
 #import "Source/common/SNTConfigurator.h"
 

Source/santa/SNTAccessibleTextField.m

@@ -12,14 +12,10 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTAccessibleTextField.h"
+#import "Source/santa/SNTAccessibleTextField.h"
 
 @implementation SNTAccessibleTextField
 
-- (BOOL)accessibilityIsIgnored {
-  return NO;
-}
-
 - (NSString *)accessibilityLabel {
   if (self.toolTip && self.stringValue) {
     return [NSString stringWithFormat:@"%@: %@", self.toolTip, self.stringValue];

Source/santa/SNTAppDelegate.m

@@ -12,21 +12,21 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTAppDelegate.h"
+#import "Source/santa/SNTAppDelegate.h"
 
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStrengthify.h"
 #import "Source/common/SNTXPCControlInterface.h"
-#import "Source/SantaGUI/SNTAboutWindowController.h"
-#import "Source/SantaGUI/SNTNotificationManager.h"
+#import "Source/santa/SNTAboutWindowController.h"
+#import "Source/santa/SNTNotificationManager.h"
 
 @interface SNTAppDelegate ()
 @property SNTAboutWindowController *aboutWindowController;
 @property SNTNotificationManager *notificationManager;
 @property MOLXPCConnection *daemonListener;
-@property MOLXPCConnection *bundleListener;
 @end
 
 @implementation SNTAppDelegate
@@ -46,21 +46,15 @@
     self.daemonListener.invalidationHandler = nil;
     [self.daemonListener invalidate];
     self.daemonListener = nil;
-
-    self.bundleListener.invalidationHandler = nil;
-    [self.bundleListener invalidate];
-    self.bundleListener = nil;
   }];
   [workspaceNotifications addObserverForName:NSWorkspaceSessionDidBecomeActiveNotification
                                       object:nil
                                        queue:[NSOperationQueue currentQueue]
                                   usingBlock:^(NSNotification *note) {
     [self attemptDaemonReconnection];
-    [self attemptBundleReconnection];
   }];
 
   [self createDaemonConnection];
-  [self createBundleConnection];
 }
 
 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
@@ -90,6 +84,11 @@
   };
   [self.daemonListener resume];
 
+  // This listener will also handle bundle service requests to update the GUI.
+  // When initializing connections with santabundleservice, the notification manager
+  // will send along the endpoint so santabundleservice knows where to find us.
+  self.notificationManager.notificationListener = listener.endpoint;
+
   // Tell daemon to connect back to the above listener.
   MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
   [daemonConn resume];
@@ -108,43 +107,6 @@
   [self performSelectorInBackground:@selector(createDaemonConnection) withObject:nil];
 }
 
-- (void)createBundleConnection {
-  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
-
-  WEAKIFY(self);
-
-  // Create listener for return connection from the bundle service.
-  NSXPCListener *listener = [NSXPCListener anonymousListener];
-  self.bundleListener = [[MOLXPCConnection alloc] initServerWithListener:listener];
-  self.bundleListener.privilegedInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
-  self.bundleListener.exportedObject = self.notificationManager;
-  self.bundleListener.acceptedHandler = ^{
-    dispatch_semaphore_signal(sema);
-  };
-  self.bundleListener.invalidationHandler = ^{
-    STRONGIFY(self);
-    [self attemptBundleReconnection];
-  };
-  [self.bundleListener resume];
-
-  // Tell santabs to connect back to the above listener.
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
-  [daemonConn resume];
-  [[daemonConn remoteObjectProxy] setBundleNotificationListener:listener.endpoint];
-  [daemonConn invalidate];
-
-  // Now wait for the connection to come in.
-  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self attemptBundleReconnection];
-  }
-}
-
-- (void)attemptBundleReconnection {
-  self.bundleListener.invalidationHandler = nil;
-  [self.bundleListener invalidate];
-  [self performSelectorInBackground:@selector(createBundleConnection) withObject:nil];
-}
-
 #pragma mark Menu Management
 
 - (void)setupMenu {

Source/santa/SNTMessageWindow.m

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTMessageWindow.h"
+#import "Source/santa/SNTMessageWindow.h"
 
 @implementation SNTMessageWindow
 

Source/santa/SNTMessageWindowController.m

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTMessageWindowController.h"
+#import "Source/santa/SNTMessageWindowController.h"
 
 #import <MOLCertificate/MOLCertificate.h>
 #import <SecurityInterface/SFCertificatePanel.h>
@@ -20,7 +20,7 @@
 #import "Source/common/SNTBlockMessage.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTStoredEvent.h"
-#import "Source/SantaGUI/SNTMessageWindow.h"
+#import "Source/santa/SNTMessageWindow.h"
 
 @interface SNTMessageWindowController ()
 ///  The custom message to display for this event

Source/santa/SNTNotificationManager.h

@@ -15,12 +15,13 @@
 #import <Cocoa/Cocoa.h>
 
 #import "Source/common/SNTXPCNotifierInterface.h"
-#import "Source/SantaGUI/SNTMessageWindowController.h"
+#import "Source/santa/SNTMessageWindowController.h"
 
 ///
 ///  Keeps track of pending notifications and ensures only one is presented to the user at a time.
 ///
-@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate,
-                                             SNTNotifierXPC, SNTBundleNotifierXPC>
+@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate, SNTNotifierXPC>
+
+@property NSXPCListenerEndpoint *notificationListener;
 
 @end

Source/santa/SNTNotificationManager.m

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/SantaGUI/SNTNotificationManager.h"
+#import "Source/santa/SNTNotificationManager.h"
 
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
@@ -31,12 +31,6 @@
 ///  The queue of pending notifications
 @property(readonly) NSMutableArray *pendingNotifications;
 
-///  The connection to the bundle service
-@property MOLXPCConnection *bundleServiceConnection;
-
-///  A semaphore to block bundle hashing until a connection is established
-@property dispatch_semaphore_t bundleServiceSema;
-
 // A serial queue for holding hashBundleBinaries requests
 @property dispatch_queue_t hashBundleBinariesQueue;
 
@@ -50,7 +44,6 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
   self = [super init];
   if (self) {
     _pendingNotifications = [[NSMutableArray alloc] init];
-    _bundleServiceSema = dispatch_semaphore_create(0);
     _hashBundleBinariesQueue = dispatch_queue_create("com.google.santagui.hashbundlebinaries",
                                                      DISPATCH_QUEUE_SERIAL);
   }
@@ -72,10 +65,10 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
       });
     }
   } else {
-    // Tear down the bundle service
-    self.bundleServiceSema = dispatch_semaphore_create(0);
-    [self.bundleServiceConnection invalidate];
-    self.bundleServiceConnection = nil;
+    MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+    [bc resume];
+    [[bc remoteObjectProxy] spindown];
+    [bc invalidate];
     [NSApp hide:self];
   }
 }
@@ -192,48 +185,35 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
   }
 }
 
-- (void)setBundleServiceListener:(NSXPCListenerEndpoint *)listener {
-  MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithListener:listener];
-  c.remoteInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
-  [c resume];
-  self.bundleServiceConnection = c;
-
-  WEAKIFY(self);
-  self.bundleServiceConnection.invalidationHandler = ^{
-    STRONGIFY(self);
-    if (self.currentWindowController) {
-      [self updateBlockNotification:self.currentWindowController.event withBundleHash:nil];
-    }
-    self.bundleServiceConnection.invalidationHandler = nil;
-    [self.bundleServiceConnection invalidate];
-  };
-
-  dispatch_semaphore_signal(self.bundleServiceSema);
-}
-
 #pragma mark SNTBundleNotifierXPC helper methods
 
 - (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event {
   self.currentWindowController.foundFileCountLabel.stringValue = @"Searching for files...";
 
-  // Wait a max of 6 secs for the bundle service. Should the bundle service fall over, it will
-  // reconnect within 5 secs. Otherwise abandon bundle hashing and display the blockable event.
-  if (dispatch_semaphore_wait(self.bundleServiceSema,
-                              dispatch_time(DISPATCH_TIME_NOW, 6 * NSEC_PER_SEC))) {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+  bc.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+  [bc resume];
+
+  // Wait a max of 5 secs for the bundle service
+  // Otherwise abandon bundle hashing and display the blockable event.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
     [self updateBlockNotification:event withBundleHash:nil];
     return;
   }
 
-  // Let all future requests flow, until the connection is terminated and we go back to waiting.
-  dispatch_semaphore_signal(self.bundleServiceSema);
+  [[bc remoteObjectProxy] setNotificationListener:self.notificationListener];
 
   // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
   [self.currentWindowController.progress becomeCurrentWithPendingUnitCount:100];
 
   // Start hashing. Progress is reported to the root NSProgress (currentWindowController.progress).
-  [[self.bundleServiceConnection remoteObjectProxy]
-      hashBundleBinariesForEvent:event
-                           reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
+  [[bc remoteObjectProxy] hashBundleBinariesForEvent:event
+                                               reply:^(NSString *bh,
+                                                       NSArray<SNTStoredEvent *> *events,
+                                                       NSNumber *ms) {
     // Revert to displaying the blockable event if we fail to calculate the bundle hash
     if (!bh) return [self updateBlockNotification:event withBundleHash:nil];
 
@@ -255,7 +235,10 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
 
     // Update the UI with the bundle hash. Also make the openEventButton available.
     [self updateBlockNotification:event withBundleHash:bh];
+
+    [bc invalidate];
   }];
+
   [self.currentWindowController.progress resignCurrent];
 }
 

Source/santa/Santa.app.entitlements

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.developer.system-extension.install</key>
+	<true/>
+</dict>
+</plist>

Source/santa/main.m

@@ -0,0 +1,100 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <Cocoa/Cocoa.h>
+#import <SystemExtensions/SystemExtensions.h>
+
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTXPCControlInterface.h"
+#import "Source/santa/SNTAppDelegate.h"
+
+@interface SNTSystemExtensionDelegate : NSObject<OSSystemExtensionRequestDelegate>
+@end
+
+@implementation SNTSystemExtensionDelegate
+
+#pragma mark OSSystemExtensionRequestDelegate
+
+- (OSSystemExtensionReplacementAction)request:(OSSystemExtensionRequest *)request
+                  actionForReplacingExtension:(OSSystemExtensionProperties *)old
+                                withExtension:(OSSystemExtensionProperties *)new
+    API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request for replacement", request.identifier);
+  return OSSystemExtensionReplacementActionReplace;
+}
+
+- (void)requestNeedsUserApproval:(OSSystemExtensionRequest *)request API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request needs user approval", request.identifier);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFailWithError:(NSError *)error API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request did fail: %@", request.identifier, error);
+  exit((int)error.code);
+}
+
+- (void)request:(OSSystemExtensionRequest *)request
+    didFinishWithResult:(OSSystemExtensionRequestResult)result API_AVAILABLE(macos(10.15)) {
+  NSLog(@"SystemExtension \"%@\" request did finish: %ld", request.identifier, (long)result);
+  exit(0);
+}
+
+@end
+
+int main(int argc, const char *argv[]) {
+  @autoreleasepool {
+    NSNumber *sysxOperation;
+    NSArray *args = [NSProcessInfo processInfo].arguments;
+    if ([args containsObject:@"--load-system-extension"]) {
+      sysxOperation = @(1);
+    } else if ([args containsObject:@"--unload-system-extension"]) {
+      sysxOperation = @(2);
+    }
+    if (sysxOperation) {
+      if (@available(macOS 10.15, *)) {
+        NSString *e = [SNTXPCControlInterface systemExtensionID];
+        dispatch_queue_t q = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0);
+        OSSystemExtensionRequest *req;
+        if (sysxOperation.intValue == 1) {
+          if (![[SNTConfigurator configurator] enableSystemExtension]) {
+            NSLog(@"EnableSystemExtension is disabled");
+            exit(1);
+          }
+          NSLog(@"Requesting SystemExtension activation");
+          req = [OSSystemExtensionRequest activationRequestForExtension:e queue:q];
+        } else if (sysxOperation.intValue == 2) {
+          NSLog(@"Requesting SystemExtension deactivation");
+          req = [OSSystemExtensionRequest deactivationRequestForExtension:e queue:q];
+        }
+        if (req) {
+          SNTSystemExtensionDelegate *ed = [[SNTSystemExtensionDelegate alloc] init];
+          req.delegate = ed;
+          [[OSSystemExtensionManager sharedManager] submitRequest:req];
+          dispatch_after(dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 60), q, ^{
+            exit(1);
+          });
+          [[NSRunLoop mainRunLoop] run];
+        }
+      } else {
+        exit(1);
+      }
+    }
+
+    NSApplication *app = [NSApplication sharedApplication];
+    SNTAppDelegate *delegate = [[SNTAppDelegate alloc] init];
+    [app setDelegate:delegate];
+    [app finishLaunching];
+    [app run];
+  }
+}

Source/santa_driver/BUILD

@@ -1,95 +1,53 @@
-licenses(["notice"])  # Apache 2.0
-
 load(
     "@build_bazel_rules_apple//apple:macos.bzl",
     "macos_command_line_application",
     "macos_kernel_extension",
 )
-load("//:helper.bzl", "run_command", "santa_unit_test")
+load("//:helper.bzl", "run_command")
 load("//:version.bzl", "SANTA_VERSION")
 
+licenses(["notice"])
+
 cc_library(
     name = "santa_driver_lib",
     srcs = [
-        "SantaCache.h",
         "SantaDecisionManager.cc",
         "SantaDecisionManager.h",
         "SantaDriver.cc",
         "SantaDriver.h",
         "SantaDriverClient.cc",
         "SantaDriverClient.h",
-        "SantaPrefixTree.cc",
-        "SantaPrefixTree.h",
         "main.cc",
     ],
     copts = [
         "-mkernel",
         "-fapple-kext",
-        "-I__BAZEL_XCODE_SDKROOT__/System/Library/Frameworks/Kernel.framework/PrivateHeaders",
+        "-Wno-ossharedptr-misuse",
         "-I__BAZEL_XCODE_SDKROOT__/System/Library/Frameworks/Kernel.framework/Headers",
     ],
     defines = [
         "KERNEL",
-        "KERNEL_PRIVATE",
-        "DRIVER_PRIVATE",
         "APPLE",
         "NeXT",
         "SANTA_VERSION=" + SANTA_VERSION,
     ],
     deps = [
+        "//Source/common:SantaCache",
         "//Source/common:SNTKernelCommon",
         "//Source/common:SNTLoggingKernel",
+        "//Source/common:SNTPrefixTreeKernel",
     ],
     alwayslink = 1,
 )
 
-santa_unit_test(
-    name = "SantaCacheTest",
-    srcs = [
-        "SantaCache.h",
-        "SantaCacheTest.mm",
-    ],
-    deps = ["//Source/common:SNTKernelCommon"],
-)
-
-santa_unit_test(
-    name = "SantaPrefixTreeTest",
-    srcs = [
-        "SantaPrefixTree.cc",
-        "SantaPrefixTree.h",
-        "SantaPrefixTreeTest.mm",
-    ],
-    copts = ["-std=c++1z"],
-    minimum_os_version = "10.12",
-    deps = ["//Source/common:SNTKernelCommon"],
-)
-
-# Full santa-driver.kext containing all Santa components
 macos_kernel_extension(
     name = "santa_driver",
-    additional_contents = {
-        "//Source/santabs": "XPCServices",
-        "//Source/SantaGUI": "Resources",
-        "//Source/santactl": "MacOS",
-        "//Source/santad": "MacOS",
-    },
-    bundle_id = "com.google.santa-driver",
-    bundle_name = "santa-driver",
-    infoplists = ["Info.plist"],
-    minimum_os_version = "10.9",
-    version = "//:version",
-    visibility = ["//visibility:public"],
-    deps = [":santa_driver_lib"],
-)
-
-# A minimal santa-driver.kext, no other Santa components
-macos_kernel_extension(
-    name = "santa_driver_min",
     bundle_id = "com.google.santa-driver",
     bundle_name = "santa-driver",
     infoplists = ["Info.plist"],
     minimum_os_version = "10.9",
     version = "//:version",
+    visibility = ["//:santa_package_group"],
     deps = [":santa_driver_lib"],
 )
 
@@ -114,7 +72,7 @@ run_command(
     name = "kernel_tests",
     srcs = [
         ":kernel_tests_bin",
-        ":santa_driver_min",
+        ":santa_driver",
     ],
     cmd = """
 env

Source/santa_driver/Info.plist

@@ -2,22 +2,20 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundlePackageType</key>
-	<string>KEXT</string>
-	<key>NSHumanReadableCopyright</key>
-	<string>Google, Inc.</string>
-	<key>CFBundleIdentifier</key>
-	<string>com.google.santa-driver</string>
-	<key>CFBundleName</key>
-	<string>santa-driver</string>
 	<key>CFBundleExecutable</key>
 	<string>santa-driver</string>
-	<key>CFBundleVersion</key>
-	<string>${SANTA_VERSION}</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.google.santa-driver</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>santa-driver</string>
+	<key>CFBundlePackageType</key>
+	<string>KEXT</string>
 	<key>CFBundleShortVersionString</key>
-	<string>${SANTA_VERSION}</string>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>IOKitPersonalities</key>
 	<dict>
 		<key>SantaDriver</key>
@@ -26,16 +24,18 @@
 			<string>com.google.santa-driver</string>
 			<key>IOClass</key>
 			<string>com_google_SantaDriver</string>
+			<key>IOMatchCategory</key>
+			<string>com_google_SantaDriver</string>
 			<key>IOProviderClass</key>
 			<string>IOResources</string>
 			<key>IOResourceMatch</key>
 			<string>IOKit</string>
 			<key>IOUserClientClass</key>
 			<string>com_google_SantaDriverClient</string>
-			<key>IOMatchCategory</key>
-			<string>com_google_SantaDriver</string>
 		</dict>
 	</dict>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google LLC.</string>
 	<key>OSBundleLibraries</key>
 	<dict>
 		<key>com.apple.kpi.bsd</key>

Source/santa_driver/SantaDecisionManager.cc

@@ -58,7 +58,7 @@ bool SantaDecisionManager::init() {
   root_fsid_ = 0;
 
   // Setup file modification prefix filter.
-  filemod_prefix_filter_ = new SantaPrefixTree();
+  filemod_prefix_filter_ = new SNTPrefixTree();
 
   return true;
 }
@@ -185,23 +185,35 @@ void SantaDecisionManager::SetLogPort(mach_port_t port) {
 }
 
 IOMemoryDescriptor *SantaDecisionManager::GetDecisionMemoryDescriptor() const {
-  return decision_dataqueue_->getMemoryDescriptor();
+  lck_mtx_lock(decision_dataqueue_lock_);
+  IOMemoryDescriptor *r = decision_dataqueue_->getMemoryDescriptor();
+  lck_mtx_unlock(decision_dataqueue_lock_);
+  return r;
 }
 
 IOMemoryDescriptor *SantaDecisionManager::GetLogMemoryDescriptor() const {
-  return log_dataqueue_->getMemoryDescriptor();
+  lck_mtx_lock(log_dataqueue_lock_);
+  IOMemoryDescriptor *r = log_dataqueue_->getMemoryDescriptor();
+  lck_mtx_unlock(log_dataqueue_lock_);
+  return r;
 }
 
 #pragma mark Listener Control
 
 kern_return_t SantaDecisionManager::StartListener() {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
   vnode_listener_ = kauth_listen_scope(
       KAUTH_SCOPE_VNODE, vnode_scope_callback, reinterpret_cast<void *>(this));
+#pragma clang diagnostic pop
   if (!vnode_listener_) return kIOReturnInternalError;
 
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
   fileop_listener_ = kauth_listen_scope(
       KAUTH_SCOPE_FILEOP, fileop_scope_callback,
       reinterpret_cast<void *>(this));
+#pragma clang diagnostic pop
   if (!fileop_listener_) return kIOReturnInternalError;
 
   LOGD("Listeners started.");
@@ -210,11 +222,14 @@ kern_return_t SantaDecisionManager::StartListener() {
 }
 
 kern_return_t SantaDecisionManager::StopListener() {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
   kauth_unlisten_scope(vnode_listener_);
   vnode_listener_ = nullptr;
 
   kauth_unlisten_scope(fileop_listener_);
   fileop_listener_ = nullptr;
+#pragma clang diagnostic pop
 
   // Wait for any active invocations to finish before returning
   do {
@@ -601,7 +616,7 @@ int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
         pid_t pid = proc_pid(proc);
         pid_t ppid = proc_ppid(proc);
         // pid_t is 32-bit; pid is in upper 32 bits, ppid in lower.
-        uint64_t val = ((uint64_t)pid << 32) | (ppid & 0xFFFFFFFF);
+        uint64_t val = ((uint64_t)pid << 32) | ((uint64_t)ppid & 0xFFFFFFFF);
         vnode_pid_map_->set(vnode_id, val);
         if (returnedAction == ACTION_RESPOND_ALLOW_COMPILER && ppid != 0) {
           // Do some additional bookkeeping for compilers:
@@ -659,8 +674,8 @@ void SantaDecisionManager::FileOpCallback(
     uint64_t val = vnode_pid_map_->get(vnode_id);
     if (val) {
       // pid_t is 32-bit, so pid is in upper 32 bits, ppid in lower.
-      message->pid = (val >> 32);
-      message->ppid = (val & ~0xFFFFFFFF00000000);
+      message->pid = (pid_t)(val >> 32);
+      message->ppid = (pid_t)(val & ~0xFFFFFFFF00000000);
     }
 
     PostToLogQueue(message);
@@ -801,7 +816,7 @@ extern "C" int vnode_scope_callback(
   // We only care about regular files.
   if (vnode_vtype(vp) != VREG) return KAUTH_RESULT_DEFER;
 
-  if ((action & KAUTH_VNODE_EXECUTE) && !(action & KAUTH_VNODE_ACCESS)) {  // NOLINT
+  if ((action & (int)KAUTH_VNODE_EXECUTE) && !(action & (int)KAUTH_VNODE_ACCESS)) {
     sdm->IncrementListenerInvocations();
     int result = sdm->VnodeCallback(credential,
                                     reinterpret_cast<vfs_context_t>(arg0),
@@ -809,9 +824,9 @@ extern "C" int vnode_scope_callback(
                                     reinterpret_cast<int *>(arg3));
     sdm->DecrementListenerInvocations();
     return result;
-  } else if (action & KAUTH_VNODE_WRITE_DATA || action & KAUTH_VNODE_APPEND_DATA) {
+  } else if (action & (int)KAUTH_VNODE_WRITE_DATA || action & (int)KAUTH_VNODE_APPEND_DATA) {
     sdm->IncrementListenerInvocations();
-    if (!(action & KAUTH_VNODE_ACCESS)) {  // NOLINT
+    if (!(action & (int)KAUTH_VNODE_ACCESS)) {
       auto vnode_id = sdm->GetVnodeIDForVnode(reinterpret_cast<vfs_context_t>(arg0), vp);
       sdm->RemoveFromCache(vnode_id);
     }

Source/santa_driver/SantaDecisionManager.h

@@ -23,10 +23,10 @@
 #include <sys/proc.h>
 #include <sys/vnode.h>
 
+#include "Source/common/SantaCache.h"
 #include "Source/common/SNTKernelCommon.h"
 #include "Source/common/SNTLogging.h"
-#include "Source/santa_driver/SantaCache.h"
-#include "Source/santa_driver/SantaPrefixTree.h"
+#include "Source/common/SNTPrefixTree.h"
 
 ///
 ///  SantaDecisionManager is responsible for intercepting Vnode execute actions
@@ -347,7 +347,7 @@ class SantaDecisionManager : public OSObject {
   SantaCache<santa_vnode_id_t, uint64_t> *vnode_pid_map_;
   SantaCache<pid_t, pid_t> *compiler_pid_set_;
 
-  SantaPrefixTree *filemod_prefix_filter_;
+  SNTPrefixTree *filemod_prefix_filter_;
 
   /**
    Return the correct cache for a given identifier.

Source/santa_driver/SantaDriverClient.cc

@@ -293,7 +293,7 @@ IOReturn SantaDriverClient::externalMethod(
     { &SantaDriverClient::filemod_prefix_filter_reset, 0, 0, 0, 0 },
   };
 
-  if (selector > static_cast<UInt32>(kSantaUserClientNMethods)) {
+  if (selector >= static_cast<UInt32>(kSantaUserClientNMethods)) {
     return kIOReturnBadArgument;
   }
 

Source/santa_driver/kernel_tests.mm

@@ -360,7 +360,7 @@
   }
 
   // Now replace the contents of the test file (which is cached) with the contents of /bin/ed,
-  // which is 'blacklisted' by SHA-256 during the tests.
+  // which is blocked by SHA-256 during the tests.
   FILE *infile = fopen("/bin/ed", "r");
   FILE *outfile = fopen(target.UTF8String, "w");
   int ch;

Source/santa_driver/main.cc

@@ -16,3 +16,14 @@ extern "C" {
 
   __private_extern__ int _kext_apple_cc = __APPLE_CC__ ;
 }
+
+#include <IOKit/IOService.h>
+#include <IOKit/IOUserClient.h>
+
+// The macOS 10.15 SDK added these Dispatch methods but they aren't
+// available on older macOS versions and so prevent kext linking.
+// Defining them here as hidden weak no-op's fixes linking and seems to work.
+kern_return_t __attribute__((visibility("hidden"))) __attribute__((weak)) OSMetaClassBase::Dispatch(const IORPC rpc) { return KERN_SUCCESS; }
+kern_return_t __attribute__((visibility("hidden"))) __attribute__((weak)) OSObject::Dispatch(const IORPC rpc) { return KERN_SUCCESS; }
+kern_return_t __attribute__((visibility("hidden"))) __attribute__((weak)) IOService::Dispatch(const IORPC rpc) { return KERN_SUCCESS; }
+kern_return_t __attribute__((visibility("hidden"))) __attribute__((weak)) IOUserClient::Dispatch(const IORPC rpc) { return KERN_SUCCESS; }

Source/santabundleservice/BUILD

@@ -1,6 +1,6 @@
-licenses(["notice"])  # Apache 2.0
+load("@build_bazel_rules_apple//apple:macos.bzl", "macos_command_line_application")
 
-load("@build_bazel_rules_apple//apple:macos.bzl", "macos_xpc_service")
+licenses(["notice"])  # Apache 2.0
 
 objc_library(
     name = "santabs_lib",
@@ -11,6 +11,7 @@ objc_library(
     ],
     deps = [
         "//Source/common:SNTFileInfo",
+        "//Source/common:SNTLogging",
         "//Source/common:SNTXPCBundleServiceInterface",
         "//Source/common:SNTXPCNotifierInterface",
         "@FMDB",
@@ -19,12 +20,12 @@ objc_library(
     ],
 )
 
-macos_xpc_service(
-    name = "santabs",
-    bundle_id = "com.google.santabs",
-    infoplists = ["Resources/santabs-Info.plist"],
+macos_command_line_application(
+    name = "santabundleservice",
+    bundle_id = "com.google.santa.bundleservice",
+    infoplists = ["Info.plist"],
     minimum_os_version = "10.9",
     version = "//:version",
-    visibility = ["//visibility:public"],
+    visibility = ["//:santa_package_group"],
     deps = [":santabs_lib"],
 )

Source/santabundleservice/Info.plist

@@ -5,27 +5,22 @@
 	<key>CFBundleDevelopmentRegion</key>
 	<string>en</string>
 	<key>CFBundleDisplayName</key>
-	<string>santabs</string>
+	<string>santabundleservice</string>
 	<key>CFBundleExecutable</key>
-	<string>santabs</string>
+	<string>santabundleservice</string>
 	<key>CFBundleIdentifier</key>
-	<string>com.google.santabs</string>
+	<string>com.google.santa.bundleservice</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundleName</key>
-	<string>santabs</string>
-	<key>CFBundlePackageType</key>
-	<string>XPC!</string>
+	<string>santabundleservice</string>
 	<key>CFBundleShortVersionString</key>
 	<string>${SANTA_VERSION}</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleVersion</key>
 	<string>${SANTA_VERSION}</string>
-	<key>XPCService</key>
-	<dict>
-		<key>ServiceType</key>
-		<string>Application</string>
-	</dict>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google LLC.</string>
 </dict>
 </plist>

Source/santabundleservice/SNTBundleService.m

@@ -12,16 +12,17 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/santabs/SNTBundleService.h"
+#import "Source/santabundleservice/SNTBundleService.h"
 
 #include <stdatomic.h>
-
 #import <CommonCrypto/CommonDigest.h>
-#import <MOLCodesignChecker/MOLCodesignChecker.h>
-#import <MOLXPCConnection/MOLXPCConnection.h>
 #import <pthread/pthread.h>
 
+#import <MOLCodesignChecker/MOLCodesignChecker.h>
+#import <MOLXPCConnection/MOLXPCConnection.h>
+
 #import "Source/common/SNTFileInfo.h"
+#import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #import "Source/common/SNTXPCNotifierInterface.h"
 
@@ -41,51 +42,21 @@
   return self;
 }
 
-#pragma mark Connection handling
-
-// Create a listener for SantaGUI to connect
-- (void)createConnection {
-  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
-
-  // Create listener for return connection from SantaGUI.
-  NSXPCListener *listener = [NSXPCListener anonymousListener];
-  self.listener = [[MOLXPCConnection alloc] initServerWithListener:listener];
-  self.listener.unprivilegedInterface = self.listener.privilegedInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
-  self.listener.exportedObject = self;
-  self.listener.acceptedHandler = ^{
-    dispatch_semaphore_signal(sema);
-  };
-
-  // Exit when SantaGUI is done with us.
-  self.listener.invalidationHandler = ^{
-    exit(0);
-  };
-
-  [self.listener resume];
-
-  // Tell SantaGUI to connect back to the above listener.
-  [[self.notifierConnection remoteObjectProxy] setBundleServiceListener:listener.endpoint];
-
-  // Now wait for the connection to come in.
-  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self attemptReconnection];
-  }
-}
-
-- (void)attemptReconnection {
-  [self performSelectorOnMainThread:@selector(createConnection) withObject:nil waitUntilDone:NO];
-}
-
 #pragma mark SNTBundleServiceXPC Methods
 
 // Connect to the SantaGUI
-- (void)setBundleNotificationListener:(NSXPCListenerEndpoint *)listener {
+- (void)setNotificationListener:(NSXPCListenerEndpoint *)listener {
   dispatch_async(dispatch_get_main_queue(), ^{
+    [self.notifierConnection invalidate];
+    self.notifierConnection = nil;
+
     MOLXPCConnection *c = [[MOLXPCConnection alloc] initClientWithListener:listener];
-    c.remoteInterface = [SNTXPCNotifierInterface bundleNotifierInterface];
+    c.remoteInterface = [SNTXPCNotifierInterface notifierInterface];
+    c.acceptedHandler = ^{
+      LOGI(@"Connected to Santa.app");
+    };
     [c resume];
     self.notifierConnection = c;
-    [self createConnection];
   });
 }
 
@@ -143,6 +114,11 @@
   });
 }
 
+- (void)spindown {
+  LOGI(@"Spinning down");
+  exit(0);
+}
+
 #pragma mark Internal Methods
 
 /**

Source/santabundleservice/main.m

@@ -13,15 +13,24 @@
 ///    limitations under the License.
 
 #import <Foundation/Foundation.h>
+
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
-#import "Source/santabs/SNTBundleService.h"
+#import "Source/common/SNTLogging.h"
 #import "Source/common/SNTXPCBundleServiceInterface.h"
+#import "Source/santabundleservice/SNTBundleService.h"
+
 
 int main(int argc, const char *argv[]) {
-  MOLXPCConnection *c =
-      [[MOLXPCConnection alloc] initServerWithListener:[NSXPCListener serviceListener]];
-  c.privilegedInterface = c.unprivilegedInterface = [SNTXPCBundleServiceInterface bundleServiceInterface];
-  c.exportedObject = [[SNTBundleService alloc] init];
-  [c resume];
+  @autoreleasepool {
+    NSDictionary *infoDict = [[NSBundle mainBundle] infoDictionary];
+    LOGI(@"Started, version %@", infoDict[@"CFBundleVersion"]);
+    MOLXPCConnection *c =
+        [[MOLXPCConnection alloc] initServerWithName:[SNTXPCBundleServiceInterface serviceID]];
+    c.privilegedInterface = c.unprivilegedInterface =
+        [SNTXPCBundleServiceInterface bundleServiceInterface];
+    c.exportedObject = [[SNTBundleService alloc] init];
+    [c resume];
+    [[NSRunLoop mainRunLoop] run];
+  }
 }

Source/santactl/BUILD

@@ -71,11 +71,11 @@ objc_library(
 
 macos_command_line_application(
     name = "santactl",
-    bundle_id = "com.google.santactl",
+    bundle_id = "com.google.santa.ctl",
     infoplists = ["Info.plist"],
     minimum_os_version = "10.9",
     version = "//:version",
-    visibility = ["//visibility:public"],
+    visibility = ["//:santa_package_group"],
     deps = [":santactl_lib"],
 )
 

Source/santactl/Commands/SNTCommandBundleInfo.m

@@ -17,7 +17,7 @@
 #import "Source/common/SNTFileInfo.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
-#import "Source/common/SNTXPCControlInterface.h"
+#import "Source/common/SNTXPCBundleServiceInterface.h"
 #import "Source/santactl/SNTCommand.h"
 #import "Source/santactl/SNTCommandController.h"
 
@@ -35,7 +35,7 @@ REGISTER_COMMAND_NAME(@"bundleinfo")
 }
 
 + (BOOL)requiresDaemonConn {
-  return YES;
+  return NO;
 }
 
 + (NSString *)shortHelpText {
@@ -60,10 +60,13 @@ REGISTER_COMMAND_NAME(@"bundleinfo")
   SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
   se.fileBundlePath = fi.bundlePath;
 
-  [[self.daemonConn remoteObjectProxy]
-      hashBundleBinariesForEvent:se
-                           reply:^(NSString *hash, NSArray<SNTStoredEvent *> *events,
-                                   NSNumber *time) {
+  MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+  [bc resume];
+
+  [[bc remoteObjectProxy] hashBundleBinariesForEvent:se
+                                               reply:^(NSString *hash,
+                                                       NSArray<SNTStoredEvent *> *events,
+                                                       NSNumber *time) {
     printf("Hashing time: %llu ms\n", time.unsignedLongLongValue);
     printf("%lu events found\n", events.count);
     printf("BundleHash: %s\n", hash.UTF8String);
@@ -72,6 +75,7 @@ REGISTER_COMMAND_NAME(@"bundleinfo")
       printf("BundleID: %s \n\tSHA-256: %s \n\tPath: %s\n",
              event.fileBundleID.UTF8String, event.fileSHA256.UTF8String, event.filePath.UTF8String);
     }
+    [[bc remoteObjectProxy] spindown];
     exit(0);
   }];
 }

Source/santactl/Commands/SNTCommandCheckCache.m

@@ -54,16 +54,16 @@ REGISTER_COMMAND_NAME(@"checkcache")
   [[self.daemonConn remoteObjectProxy] checkCacheForVnodeID:vnodeID
                                                   withReply:^(santa_action_t action) {
     if (action == ACTION_RESPOND_ALLOW) {
-      LOGI(@"File exists in [whitelist] kernel cache");
+      LOGI(@"File exists in [allowlist] kernel cache");
       exit(0);
     } else if (action == ACTION_RESPOND_DENY) {
-      LOGI(@"File exists in [blacklist] kernel cache");
+      LOGI(@"File exists in [blocklist] kernel cache");
       exit(0);
     } else if (action == ACTION_RESPOND_ALLOW_COMPILER) {
-      LOGI(@"File exists in [whitelist compiler] kernel cache");
+      LOGI(@"File exists in [allowlist compiler] kernel cache");
       exit(0);
     } else if (action == ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE) {
-      LOGI(@"File exists in [whitelist pending_transitive] kernel cache");
+      LOGI(@"File exists in [allowlist pending_transitive] kernel cache");
       exit(0);
     } else if (action == ACTION_UNSET) {
       LOGE(@"File does not exist in cache");

Source/santactl/Commands/SNTCommandFileInfo.m

@@ -330,6 +330,8 @@ REGISTER_COMMAND_NAME(@"fileinfo")
           if ([error.domain isEqualToString:@"com.google.molcodesignchecker"]) {
             return @"Yes, but signing is not consistent for all architectures";
           }
+        case CSSMERR_TP_CERT_REVOKED:
+          return @"Yes, but the signing certificate was revoked";
         default: {
           return [NSString stringWithFormat:@"Yes, but failed to validate (%ld)", error.code];
         }
@@ -364,7 +366,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
       return kCommunicationErrorMsg;
     } else {
       NSMutableString *output =
-          (SNTEventStateAllow & state) ? @"Whitelisted".mutableCopy : @"Blacklisted".mutableCopy;
+          (SNTEventStateAllow & state) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;
       switch (state) {
         case SNTEventStateAllowUnknown:
         case SNTEventStateBlockUnknown:
@@ -595,12 +597,17 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     NSDictionary *cert = signingChain[index];
 
     // Check if we should skip over this item based on outputFilters.
+    BOOL filterMatch = self.outputFilters.count == 0;
     for (NSString *key in self.outputFilters) {
-      NSString *value = cert[key];
+      NSString *value = cert[key] ?: @"";
       NSRegularExpression *regex = self.outputFilters[key];
-      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) return;
+      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
+      filterMatch = YES;
+      break;
     }
 
+    if (!filterMatch) return;
+
     // Filter out the info we want now, in case JSON output
     for (NSString *key in self.outputKeyList) {
       outputDict[key] = cert[key];
@@ -609,17 +616,22 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     // Check if we should skip over this item based on outputFilters.  We do this before collecting
     // output info because there's a chance that we can bail out early if a filter doesn't match.
     // However we also don't want to recompute info, so we save any values that we plan to show.
+    BOOL filterMatch = self.outputFilters.count == 0;
     for (NSString *key in self.outputFilters) {
-      NSString *value = self.propertyMap[key](self, fileInfo);
+      NSString *value = self.propertyMap[key](self, fileInfo) ?: @"";
       NSRegularExpression *regex = self.outputFilters[key];
-      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) return;
+      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
       // If this is a value we want to show, store it in the output dictionary.
       // This does a linear search on an array, but it's a small array.
-      if ([self.outputKeyList containsObject:key]) {
+      if (value.length && [self.outputKeyList containsObject:key]) {
         outputDict[key] = value;
       }
+      filterMatch = YES;
+      break;
     }
 
+    if (!filterMatch) return;
+
     // Then fill the outputDict with the rest of the missing values.
     for (NSString *key in self.outputKeyList) {
       if (outputDict[key]) continue;  // ignore keys that we've already set due to a filter