santactl/sync: In --debug log the full NSError for failed requests

santad: Add user/group info to file changelogs also
santactl: Rename binaryinfo -> fileinfo.
2026-01-15 01:08:12 -05:00 · 2015-12-15 12:36:07 -05:00 · 2015-12-14 22:32:59 -05:00 · 2015-12-14 18:09:40 -05:00 · 2015-12-14 17:25:32 -05:00 · 2015-12-14 16:37:19 -05:00
35 changed files with 445 additions and 148 deletions
--- a/21
+++ b/21
@@ -25,6 +25,17 @@ def xcodebuild(opts)
  end
 end

+def xcodebuilddir
+  if not $xcode_build_dir
+    output = `xcodebuild #{XCODEBUILD_DEFAULTS} -scheme All -showBuildSettings`
+    if match = output.match(/BUILD_DIR = (.*)/)
+        $xcode_build_dir = match.captures.first
+        puts "Found Xcode build dir #{$xcode_build_dir}"
+    end
+  end
+  $xcode_build_dir
+end
+
 task :init do
  unless File.exists?(WORKSPACE) and File.exists?('Pods')
    puts "Pods missing, running 'pod install'"
@@ -88,8 +99,8 @@ namespace :install do
    Rake::Task['build:build'].invoke(config)
    puts "Installing with configuration: #{config}"
    Rake::Task['remove_existing'].invoke()
-    system "sudo cp -r #{OUTPUT_PATH}/Products/#{config}/santa-driver.kext /Library/Extensions"
-    system "sudo cp -r #{OUTPUT_PATH}/Products/#{config}/Santa.app /Applications"
+    system "sudo cp -r #{xcodebuilddir}/#{config}/santa-driver.kext /Library/Extensions"
+    system "sudo cp -r #{xcodebuilddir}/#{config}/Santa.app /Applications"
  end
 end

@@ -107,11 +118,11 @@ task :dist do
  FileUtils.mkdir_p("#{DIST_PATH}/dsym")

  BINARIES.each do |x|
-    FileUtils.cp_r("#{OUTPUT_PATH}/Products/Release/#{x}", "#{DIST_PATH}/binaries")
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{DIST_PATH}/binaries")
  end

  DSYMS.each do |x|
-    FileUtils.cp_r("#{OUTPUT_PATH}/Products/Release/#{x}", "#{DIST_PATH}/dsym")
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{DIST_PATH}/dsym")
  end


@@ -137,7 +148,7 @@ namespace :tests do
    begin
      puts "\033[?25l\033[12h"  # hide cursor
      puts "Running kernel tests"
-      system "cd /tmp/santa_kerneltests_tmp && sudo #{Dir.pwd}/#{OUTPUT_PATH}/Products/Debug/KernelTests"
+      system "cd /tmp/santa_kerneltests_tmp && sudo #{xcodebuilddir}/Debug/KernelTests"
    rescue Exception
    ensure
      puts "\033[?25h\033[12l\n\n"  # unhide cursor
--- a/Santa.xcodeproj/project.pbxproj
+++ b/Santa.xcodeproj/project.pbxproj
@@ -89,8 +89,8 @@
 		0D6FDC8718C6913D0044685C /* apple.pem in Resources */ = {isa = PBXBuildFile; fileRef = 0D6FDC8618C6913D0044685C /* apple.pem */; };
 		0D6FDC9618C93A020044685C /* SNTXPCConnection.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D6FDC9518C93A020044685C /* SNTXPCConnection.m */; };
 		0D6FDC9718C93A020044685C /* SNTXPCConnection.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D6FDC9518C93A020044685C /* SNTXPCConnection.m */; };
-		0D7A7AF3174FCF4C00B77646 /* SantaMessage.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0D7A7AF1174FCF4C00B77646 /* SantaMessage.cc */; };
-		0D7A7AF4174FCF4C00B77646 /* SantaMessage.h in Headers */ = {isa = PBXBuildFile; fileRef = 0D7A7AF2174FCF4C00B77646 /* SantaMessage.h */; };
+		0D7A7AF3174FCF4C00B77646 /* SantaCachedDecision.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0D7A7AF1174FCF4C00B77646 /* SantaCachedDecision.cc */; };
+		0D7A7AF4174FCF4C00B77646 /* SantaCachedDecision.h in Headers */ = {isa = PBXBuildFile; fileRef = 0D7A7AF2174FCF4C00B77646 /* SantaCachedDecision.h */; };
 		0D7D01871774F93A005DBAB4 /* SNTDriverManager.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7D01861774F93A005DBAB4 /* SNTDriverManager.m */; };
 		0D7FFD4B1A017D4B00F34435 /* SNTDERDecoder.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */; };
 		0D827E6519DF392E006EC811 /* SNTConfigurator.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D42D2B719D2042900955F08 /* SNTConfigurator.m */; };
@@ -113,13 +113,15 @@
 		0DB390991AB1E11400614002 /* SNTCommandVersion.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB390981AB1E11400614002 /* SNTCommandVersion.m */; };
 		0DB537871AFD36EB00487F92 /* SNTRuleTableTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB537861AFD36EB00487F92 /* SNTRuleTableTest.m */; };
 		0DB8ACC1185662DC00FEF9C7 /* SNTApplication.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB8ACC0185662DC00FEF9C7 /* SNTApplication.m */; };
+		0DB98BFA1C1B9F3000B65DB1 /* SantaPIDAndPPID.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0DB98BF81C1B9F3000B65DB1 /* SantaPIDAndPPID.cc */; settings = {ASSET_TAGS = (); }; };
+		0DB98BFB1C1B9F3000B65DB1 /* SantaPIDAndPPID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0DB98BF91C1B9F3000B65DB1 /* SantaPIDAndPPID.h */; settings = {ASSET_TAGS = (); }; };
 		0DC5D86D191AED220078A5C0 /* SNTRuleTable.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DC5D86C191AED220078A5C0 /* SNTRuleTable.m */; };
 		0DC5D86E191AED220078A5C0 /* SNTRuleTable.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DC5D86C191AED220078A5C0 /* SNTRuleTable.m */; };
 		0DC5D871192160180078A5C0 /* SNTCommandSyncLogUpload.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DC5D870192160180078A5C0 /* SNTCommandSyncLogUpload.m */; };
 		0DC765EA1B28D9EA00BAE651 /* santad in CopyFiles */ = {isa = PBXBuildFile; fileRef = 0D9A7F3D1759330500035EB5 /* santad */; settings = {ATTRIBUTES = (CodeSignOnCopy, ); }; };
 		0DC765EB1B28D9EA00BAE651 /* santactl in CopyFiles */ = {isa = PBXBuildFile; fileRef = 0D35BD9E18FD71CE00921A21 /* santactl */; settings = {ATTRIBUTES = (CodeSignOnCopy, ); }; };
 		0DCA552718C95928002A7DAE /* SNTXPCConnection.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D6FDC9518C93A020044685C /* SNTXPCConnection.m */; };
-		0DCD5FBF1909D64A006B445C /* SNTCommandBinaryInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD5FBE1909D64A006B445C /* SNTCommandBinaryInfo.m */; };
+		0DCD5FBF1909D64A006B445C /* SNTCommandFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */; };
 		0DCD6042190ACCB8006B445C /* SNTFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD6041190ACCB8006B445C /* SNTFileInfo.m */; };
 		0DCD6043190ACCB8006B445C /* SNTFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD6041190ACCB8006B445C /* SNTFileInfo.m */; };
 		0DCD6044190ACCB8006B445C /* SNTFileInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD6041190ACCB8006B445C /* SNTFileInfo.m */; };
@@ -306,8 +308,8 @@
 		0D6FDC8618C6913D0044685C /* apple.pem */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = apple.pem; sourceTree = "<group>"; };
 		0D6FDC9418C93A020044685C /* SNTXPCConnection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTXPCConnection.h; sourceTree = "<group>"; };
 		0D6FDC9518C93A020044685C /* SNTXPCConnection.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTXPCConnection.m; sourceTree = "<group>"; };
-		0D7A7AF1174FCF4C00B77646 /* SantaMessage.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SantaMessage.cc; sourceTree = "<group>"; };
-		0D7A7AF2174FCF4C00B77646 /* SantaMessage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SantaMessage.h; sourceTree = "<group>"; };
+		0D7A7AF1174FCF4C00B77646 /* SantaCachedDecision.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SantaCachedDecision.cc; sourceTree = "<group>"; };
+		0D7A7AF2174FCF4C00B77646 /* SantaCachedDecision.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SantaCachedDecision.h; sourceTree = "<group>"; };
 		0D7D01851774F93A005DBAB4 /* SNTDriverManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTDriverManager.h; sourceTree = "<group>"; };
 		0D7D01861774F93A005DBAB4 /* SNTDriverManager.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 2; lastKnownFileType = sourcecode.c.objc; path = SNTDriverManager.m; sourceTree = "<group>"; };
 		0D7FFD491A017D4B00F34435 /* SNTDERDecoder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTDERDecoder.h; sourceTree = "<group>"; };
@@ -334,12 +336,14 @@
 		0DB8ACBF185662DC00FEF9C7 /* SNTApplication.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTApplication.h; sourceTree = "<group>"; };
 		0DB8ACC0185662DC00FEF9C7 /* SNTApplication.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; lineEnding = 0; path = SNTApplication.m; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objc; };
 		0DB8ACE41858D73000FEF9C7 /* santad-Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = "santad-Info.plist"; sourceTree = "<group>"; };
+		0DB98BF81C1B9F3000B65DB1 /* SantaPIDAndPPID.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SantaPIDAndPPID.cc; sourceTree = "<group>"; };
+		0DB98BF91C1B9F3000B65DB1 /* SantaPIDAndPPID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SantaPIDAndPPID.h; sourceTree = "<group>"; };
 		0DC5D86C191AED220078A5C0 /* SNTRuleTable.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTRuleTable.m; sourceTree = "<group>"; };
 		0DC5D86F192160180078A5C0 /* SNTCommandSyncLogUpload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncLogUpload.h; sourceTree = "<group>"; };
 		0DC5D870192160180078A5C0 /* SNTCommandSyncLogUpload.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncLogUpload.m; sourceTree = "<group>"; };
 		0DC8C9E3180CC3BC00FCFB29 /* SNTXPCNotifierInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTXPCNotifierInterface.h; sourceTree = "<group>"; };
 		0DCD5F771909C659006B445C /* SecurityInterface.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = SecurityInterface.framework; path = System/Library/Frameworks/SecurityInterface.framework; sourceTree = SDKROOT; };
-		0DCD5FBE1909D64A006B445C /* SNTCommandBinaryInfo.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandBinaryInfo.m; sourceTree = "<group>"; };
+		0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandFileInfo.m; sourceTree = "<group>"; };
 		0DCD6040190ACCB8006B445C /* SNTFileInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTFileInfo.h; sourceTree = "<group>"; };
 		0DCD6041190ACCB8006B445C /* SNTFileInfo.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTFileInfo.m; sourceTree = "<group>"; };
 		0DCD604919105433006B445C /* SNTStoredEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTStoredEvent.h; sourceTree = "<group>"; };
@@ -482,15 +486,10 @@
 		0D35BDA018FD71CE00921A21 /* santactl */ = {
 			isa = PBXGroup;
 			children = (
-				0D35BDA118FD71CE00921A21 /* main.m */,
 				0D35BDAA18FD7CFD00921A21 /* SNTCommandController.h */,
+				0D35BDA118FD71CE00921A21 /* main.m */,
 				0D35BDAB18FD7CFD00921A21 /* SNTCommandController.m */,
-				0DCD5FBC1909D4FD006B445C /* binaryinfo */,
-				0DE4C8A318FF3AFA00466D04 /* flushcache */,
-				409232751A51914400A04527 /* rule */,
-				0D827E6819DF4F3F006EC811 /* status */,
-				0D35BDB618FD84FC00921A21 /* sync */,
-				0DB390971AB1E0F200614002 /* version */,
+				0DAF01141C1B794B00F5B6C3 /* Commands */,
 				0D35BDA318FD71CE00921A21 /* Resources */,
 			);
 			name = santactl;
@@ -642,14 +641,16 @@
 		0D91BCB9174E8A7E00131A7D /* santa-driver */ = {
 			isa = PBXGroup;
 			children = (
+				0D7A7AF2174FCF4C00B77646 /* SantaCachedDecision.h */,
+				0D7A7AF1174FCF4C00B77646 /* SantaCachedDecision.cc */,
+				0D4644C4182AF81700098690 /* SantaDecisionManager.h */,
+				0D4644C3182AF81700098690 /* SantaDecisionManager.cc */,
 				0D9A7F321759144800035EB5 /* SantaDriver.h */,
 				0D9A7F311759144800035EB5 /* SantaDriver.cc */,
 				0D9A7F361759148E00035EB5 /* SantaDriverClient.h */,
 				0D9A7F351759148E00035EB5 /* SantaDriverClient.cc */,
-				0D4644C4182AF81700098690 /* SantaDecisionManager.h */,
-				0D4644C3182AF81700098690 /* SantaDecisionManager.cc */,
-				0D7A7AF2174FCF4C00B77646 /* SantaMessage.h */,
-				0D7A7AF1174FCF4C00B77646 /* SantaMessage.cc */,
+				0DB98BF91C1B9F3000B65DB1 /* SantaPIDAndPPID.h */,
+				0DB98BF81C1B9F3000B65DB1 /* SantaPIDAndPPID.cc */,
 				0DA36C1F199EA46600A129D6 /* Resources */,
 			);
 			name = "santa-driver";
@@ -734,6 +735,19 @@
 			name = DataLayer;
 			sourceTree = "<group>";
 		};
+		0DAF01141C1B794B00F5B6C3 /* Commands */ = {
+			isa = PBXGroup;
+			children = (
+				0DCD5FBC1909D4FD006B445C /* fileinfo */,
+				0DE4C8A318FF3AFA00466D04 /* flushcache */,
+				409232751A51914400A04527 /* rule */,
+				0D827E6819DF4F3F006EC811 /* status */,
+				0D35BDB618FD84FC00921A21 /* sync */,
+				0DB390971AB1E0F200614002 /* version */,
+			);
+			name = Commands;
+			sourceTree = "<group>";
+		};
 		0DB390971AB1E0F200614002 /* version */ = {
 			isa = PBXGroup;
 			children = (
@@ -742,12 +756,12 @@
 			name = version;
 			sourceTree = "<group>";
 		};
-		0DCD5FBC1909D4FD006B445C /* binaryinfo */ = {
+		0DCD5FBC1909D4FD006B445C /* fileinfo */ = {
 			isa = PBXGroup;
 			children = (
-				0DCD5FBE1909D64A006B445C /* SNTCommandBinaryInfo.m */,
+				0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */,
 			);
-			path = binaryinfo;
+			path = fileinfo;
 			sourceTree = "<group>";
 		};
 		0DE4C8A318FF3AFA00466D04 /* flushcache */ = {
@@ -788,7 +802,8 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				0D7A7AF4174FCF4C00B77646 /* SantaMessage.h in Headers */,
+				0D7A7AF4174FCF4C00B77646 /* SantaCachedDecision.h in Headers */,
+				0DB98BFB1C1B9F3000B65DB1 /* SantaPIDAndPPID.h in Headers */,
 				0D4644C6182AF81700098690 /* SantaDecisionManager.h in Headers */,
 				0D9A7F341759144800035EB5 /* SantaDriver.h in Headers */,
 				0D9A7F381759148E00035EB5 /* SantaDriverClient.h in Headers */,
@@ -921,7 +936,7 @@
 		0D91BCA8174E8A6500131A7D /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 0510;
+				LastUpgradeCheck = 0700;
 				TargetAttributes = {
 					0D260DAB18B68E12002A0B55 = {
 						TestTargetID = 0D385DB5180DE4A900418BC6;
@@ -1276,7 +1291,7 @@
 			files = (
 				0DA73CA21934F88D0056D7C4 /* SNTLogging.m in Sources */,
 				0D35BDB518FD84F600921A21 /* SNTCommandSync.m in Sources */,
-				0DCD5FBF1909D64A006B445C /* SNTCommandBinaryInfo.m in Sources */,
+				0DCD5FBF1909D64A006B445C /* SNTCommandFileInfo.m in Sources */,
 				0DEFB7C01ACB28B000B92AAE /* SNTCommandSyncConstants.m in Sources */,
 				0DCD6062191188B1006B445C /* SNTAuthenticatingURLSession.m in Sources */,
 				0DCD605619115D17006B445C /* SNTXPCControlInterface.m in Sources */,
@@ -1329,7 +1344,8 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				0D7A7AF3174FCF4C00B77646 /* SantaMessage.cc in Sources */,
+				0D7A7AF3174FCF4C00B77646 /* SantaCachedDecision.cc in Sources */,
+				0DB98BFA1C1B9F3000B65DB1 /* SantaPIDAndPPID.cc in Sources */,
 				0D9A7F331759144800035EB5 /* SantaDriver.cc in Sources */,
 				0D9A7F371759148E00035EB5 /* SantaDriverClient.cc in Sources */,
 				0D4644C5182AF81700098690 /* SantaDecisionManager.cc in Sources */,
@@ -1521,6 +1537,7 @@
 					/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include,
 				);
 				INFOPLIST_FILE = "Tests/LogicTests/Resources/Tests-Info.plist";
+				PRODUCT_BUNDLE_IDENTIFIER = "com.google.${PRODUCT_NAME:rfc1034identifier}";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				WARNING_CFLAGS = "";
 				WRAPPER_EXTENSION = xctest;
@@ -1565,6 +1582,7 @@
 					/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include,
 				);
 				INFOPLIST_FILE = "Tests/LogicTests/Resources/Tests-Info.plist";
+				PRODUCT_BUNDLE_IDENTIFIER = "com.google.${PRODUCT_NAME:rfc1034identifier}";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				WARNING_CFLAGS = "";
 				WRAPPER_EXTENSION = xctest;
@@ -1734,6 +1752,7 @@
 				CLANG_CXX_LANGUAGE_STANDARD = "c++0x";
 				CLANG_WARN_CXX0X_EXTENSIONS = YES;
 				CODE_SIGN_IDENTITY = "Mac Developer";
+				ENABLE_TESTABILITY = YES;
 				GCC_C_LANGUAGE_STANDARD = c99;
 				MACOSX_DEPLOYMENT_TARGET = 10.9;
 				ONLY_ACTIVE_ARCH = YES;
--- a/Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
         <TestableReference
            skipped = "NO">
@@ -39,15 +39,18 @@
            </BuildableReference>
         </TestableReference>
      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <MacroExpansion>
         <BuildableReference
@@ -62,10 +65,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
   </ProfileAction>
   <AnalyzeAction
--- a/Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
      <MacroExpansion>
@@ -38,15 +38,18 @@
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
@@ -62,10 +65,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
         <TestableReference
            skipped = "NO">
@@ -48,15 +48,18 @@
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <MacroExpansion>
         <BuildableReference
@@ -71,10 +74,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
      <MacroExpansion>
         <BuildableReference
--- a/Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
      <MacroExpansion>
@@ -38,15 +38,18 @@
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
@@ -62,10 +65,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,21 +23,24 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <MacroExpansion>
         <BuildableReference
@@ -52,10 +55,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
   </ProfileAction>
   <AnalyzeAction
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
      <MacroExpansion>
@@ -38,15 +38,18 @@
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
@@ -62,10 +65,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme
+++ b/Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0620"
+   LastUpgradeVersion = "0700"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -23,10 +23,10 @@
      </BuildActionEntries>
   </BuildAction>
   <TestAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES"
-      buildConfiguration = "Debug">
+      shouldUseLaunchSchemeArgsEnv = "YES">
      <Testables>
      </Testables>
      <MacroExpansion>
@@ -38,16 +38,19 @@
            ReferencedContainer = "container:Santa.xcodeproj">
         </BuildableReference>
      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
   </TestAction>
   <LaunchAction
+      buildConfiguration = "Debug"
      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
      debugAsWhichUser = "root"
      launchStyle = "0"
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Debug"
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
@@ -63,10 +66,10 @@
      </AdditionalOptions>
   </LaunchAction>
   <ProfileAction
+      buildConfiguration = "Release"
      shouldUseLaunchSchemeArgsEnv = "YES"
      savedToolIdentifier = ""
      useCustomWorkingDirectory = "NO"
-      buildConfiguration = "Release"
      debugDocumentVersioning = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Source/SantaGUI/SNTMessageWindowController.m
+++ b/Source/SantaGUI/SNTMessageWindowController.m
@@ -134,14 +134,20 @@
  NSString *htmlFooter = @"</body></html>";

  NSString *message;
-  if ([self.customMessage length] > 0) {
+  if (self.customMessage.length) {
    message = self.customMessage;
-  } else {
-    message = [[SNTConfigurator configurator] defaultBlockMessage];
+  } else if (self.event.decision == EVENTSTATE_BLOCK_UNKNOWN) {
+    message = [[SNTConfigurator configurator] unknownBlockMessage];
    if (!message) {
      message = @"The following application has been blocked from executing<br />"
                @"because its trustworthiness cannot be determined.";
    }
+  } else {
+    message = [[SNTConfigurator configurator] bannedBlockMessage];
+    if (!message) {
+      message = @"The following application has been blocked from executing<br />"
+                @"because it has been deemed malicious.";
+    }
  }

  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
--- a/Source/common/SNTCommonEnums.h
+++ b/Source/common/SNTCommonEnums.h
@@ -62,6 +62,8 @@ typedef enum {
  EVENTSTATE_BLOCK_CERTIFICATE = 7,
  EVENTSTATE_BLOCK_SCOPE       = 8,

+  EVENTSTATE_RELATED_BINARY    = 9,
+
  EVENTSTATE_MAX
 } santa_eventstate_t;

--- a/Source/common/SNTConfigurator.h
+++ b/Source/common/SNTConfigurator.h
@@ -94,10 +94,17 @@ extern NSString * const kDefaultConfigFilePath;
@property(readonly, nonatomic) NSString *eventDetailText;

 ///
-///  For any rule that doesn't have a custom message, this setting overrides the message
-///  text that is display. If unset, a reasonable default is provided.
+///  In lockdown mode this is the message shown to the user when an unknown binary
+///  is blocked. If this message is not configured, a reasonable default is provided.
 ///
-@property(readonly, nonatomic) NSString *defaultBlockMessage;
+@property(readonly, nonatomic) NSString *unknownBlockMessage;
+
+///
+///  This is the message shown to the user when a binary is blocked because of a rule,
+///  if that rule doesn't provide a custom message. If this is not configured, a reasonable
+///  default is provided.
+///
+@property(readonly, nonatomic) NSString *bannedBlockMessage;

 #pragma mark - Sync Settings

--- a/Source/common/SNTConfigurator.m
+++ b/Source/common/SNTConfigurator.m
@@ -45,7 +45,8 @@ static NSString * const kEnablePageZeroProtectionKey = @"EnablePageZeroProtectio
 static NSString * const kMoreInfoURLKey = @"MoreInfoURL";
 static NSString * const kEventDetailURLKey = @"EventDetailURL";
 static NSString * const kEventDetailTextKey = @"EventDetailText";
-static NSString * const kDefaultBlockMessage = @"DefaultBlockMessage";
+static NSString * const kUnknownBlockMessage = @"UnknownBlockMessage";
+static NSString * const kBannedBlockMessage = @"BannedBlockMessage";

 static NSString * const kSyncBaseURLKey = @"SyncBaseURL";
 static NSString * const kSyncLastSuccess = @"SyncLastSuccess";
@@ -192,8 +193,12 @@ static NSString * const kMachineIDPlistKeyKey = @"MachineIDKey";
  return self.configData[kEventDetailTextKey];
 }

- (NSString *)defaultBlockMessage {
-  return self.configData[kDefaultBlockMessage];
+- (NSString *)unknownBlockMessage {
+  return self.configData[kUnknownBlockMessage];
+}
+
+- (NSString *)bannedBlockMessage {
+  return self.configData[kBannedBlockMessage];
 }

 - (NSURL *)syncBaseURL {
--- a/Source/common/SNTFileInfo.h
+++ b/Source/common/SNTFileInfo.h
@@ -51,12 +51,6 @@
 ///
 - (NSString *)SHA256;

-///
-///  @return The type of Mach-O file, one of:
-///  Dynamic Library, Kernel Extension, Fat Binary or Thin Binary.
-///
- (NSString *)machoType;
-
 ///
 ///  @return The architectures included in this binary (e.g. x86_64, ppc).
 ///
@@ -97,6 +91,11 @@
 ///
 - (BOOL)isMissingPageZero;

+///
+///  @return YES if this file is an XAR archive.
+///
+- (BOOL)isXARArchive;
+
 ///
 ///  @return An NSBundle if this file is part of a bundle.
 ///
--- a/Source/common/SNTFileInfo.m
+++ b/Source/common/SNTFileInfo.m
@@ -85,6 +85,8 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  return [self initWithPath:path error:NULL];
 }

+# pragma mark Hashing
+
 - (NSString *)SHA1 {
  const int chunkSize = 4096;

@@ -153,19 +155,19 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  return buf;
 }

- (NSString *)machoType {
-  if ([self isScript]) return @"Script";
-  if ([self isDylib])  return @"Dynamic Library";
-  if ([self isKext])   return @"Kernel Extension";
-  if ([self isFat])    return @"Fat Binary";
-  if ([self isMachO])  return @"Thin Binary";
-  return @"Unknown (not executable?)";
-}
+# pragma mark File Type Info

 - (NSArray *)architectures {
  return [self.machHeaders allKeys];
 }

+
+- (BOOL)isExecutable {
+  struct mach_header *mach_header = [self firstMachHeader];
+  if (mach_header && mach_header->filetype == MH_EXECUTE) return YES;
+  return NO;
+}
+
 - (BOOL)isDylib {
  struct mach_header *mach_header = [self firstMachHeader];
  if (mach_header && mach_header->filetype == MH_DYLIB) return YES;
@@ -191,10 +193,9 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
  return (strncmp("#!", magic, 2) == 0);
 }

- (BOOL)isExecutable {
-  struct mach_header *mach_header = [self firstMachHeader];
-  if (mach_header && mach_header->filetype == MH_EXECUTE) return YES;
-  return NO;
+- (BOOL)isXARArchive {
+  const char *magic = (const char *)[[self safeSubdataWithRange:NSMakeRange(0, 4)] bytes];
+  return (strncmp("xar!", magic, 4) == 0);
 }

 - (BOOL)isMissingPageZero {
@@ -288,19 +289,19 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 }

 - (NSString *)bundleIdentifier {
-  return [self.infoPlist objectForKey:@"CFBundleIdentifier"];
+  return [[self.infoPlist objectForKey:@"CFBundleIdentifier"] description];
 }

 - (NSString *)bundleName {
-  return [self.infoPlist objectForKey:@"CFBundleName"];
+  return [[self.infoPlist objectForKey:@"CFBundleName"] description];
 }

 - (NSString *)bundleVersion {
-  return [self.infoPlist objectForKey:@"CFBundleVersion"];
+  return [[self.infoPlist objectForKey:@"CFBundleVersion"] description];
 }

 - (NSString *)bundleShortVersionString {
-  return [self.infoPlist objectForKey:@"CFBundleShortVersionString"];
+  return [[self.infoPlist objectForKey:@"CFBundleShortVersionString"] description];
 }

 #pragma mark Quarantine Data
--- a/Source/santa-driver/SantaCachedDecision.cc
+++ b/Source/santa-driver/SantaCachedDecision.cc
@@ -12,19 +12,19 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#include "SantaMessage.h"
+#include "SantaCachedDecision.h"

-OSDefineMetaClassAndStructors(SantaMessage, OSObject);
+OSDefineMetaClassAndStructors(SantaCachedDecision, OSObject);

-uint64_t SantaMessage::getMicrosecs() const {
+uint64_t SantaCachedDecision::getMicrosecs() const {
  return microsecs_;
 }

-santa_action_t SantaMessage::getAction() const {
+santa_action_t SantaCachedDecision::getAction() const {
  return action_;
 }

-void SantaMessage::setAction(
+void SantaCachedDecision::setAction(
    const santa_action_t action, const uint64_t microsecs) {
  action_ = action;
  microsecs_ = microsecs;
--- a/Source/santa-driver/SantaCachedDecision.h
+++ b/Source/santa-driver/SantaCachedDecision.h
@@ -12,19 +12,19 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.

-#ifndef SANTA__SANTA_DRIVER__SANTAMESSAGE_H
-#define SANTA__SANTA_DRIVER__SANTAMESSAGE_H
+#ifndef SANTA__SANTA_DRIVER__SANTACACHEDDECISION_H
+#define SANTA__SANTA_DRIVER__SANTACACHEDDECISION_H

 #include <libkern/c++/OSObject.h>

 #include "SNTKernelCommon.h"

 ///
-///  An OSObject wrapper around a @c santa_action_t and a time.
+///  An OSObject subclass to store a @c santa_action_t and a timestamp.
 ///  Only OSObject subclasses can be inserted into an OSDictionary.
 ///
-class SantaMessage : public OSObject {
-  OSDeclareDefaultStructors(SantaMessage)
+class SantaCachedDecision : public OSObject {
+  OSDeclareDefaultStructors(SantaCachedDecision)

 public:
  // Returns the time the action was last set.
@@ -41,4 +41,4 @@ class SantaMessage : public OSObject {
  uint64_t microsecs_;
 };

-#endif  // SANTA__SANTA_DRIVER__SANTAMESSAGE_H
+#endif  // SANTA__SANTA_DRIVER__SANTACACHEDDECISIONWRAPPER_H
--- a/Source/santa-driver/SantaDecisionManager.cc
+++ b/Source/santa-driver/SantaDecisionManager.cc
@@ -29,8 +29,10 @@ bool SantaDecisionManager::init() {

  dataqueue_lock_ = lck_mtx_alloc_init(sdm_lock_grp_, sdm_lock_attr_);
  cached_decisions_lock_ = lck_rw_alloc_init(sdm_lock_grp_, sdm_lock_attr_);
+  vnode_pid_map_lock_ = lck_rw_alloc_init(sdm_lock_grp_, sdm_lock_attr_);

  cached_decisions_ = OSDictionary::withCapacity(1000);
+  vnode_pid_map_ = OSDictionary::withCapacity(1000);

  dataqueue_ = IOSharedDataQueue::withEntries(kMaxQueueEvents,
                                              sizeof(santa_message_t));
@@ -42,14 +44,16 @@ bool SantaDecisionManager::init() {
 }

 void SantaDecisionManager::free() {
-  OSSafeReleaseNULL(dataqueue_);
-  OSSafeReleaseNULL(cached_decisions_);
-
  if (cached_decisions_lock_) {
    lck_rw_free(cached_decisions_lock_, sdm_lock_grp_);
    cached_decisions_lock_ = nullptr;
  }

+  if (vnode_pid_map_lock_) {
+    lck_rw_free(vnode_pid_map_lock_, sdm_lock_grp_);
+    vnode_pid_map_lock_ = nullptr;
+  }
+
  if (dataqueue_lock_) {
    lck_mtx_free(dataqueue_lock_, sdm_lock_grp_);
    dataqueue_lock_ = nullptr;
@@ -70,6 +74,10 @@ void SantaDecisionManager::free() {
    sdm_lock_grp_attr_ = nullptr;
  }

+  OSSafeReleaseNULL(dataqueue_);
+  OSSafeReleaseNULL(cached_decisions_);
+  OSSafeReleaseNULL(vnode_pid_map_);
+
  super::free();
 }

@@ -181,7 +189,7 @@ void SantaDecisionManager::AddToCache(
  }

  if (decision == ACTION_REQUEST_CHECKBW) {
-    SantaMessage *pending = new SantaMessage();
+    SantaCachedDecision *pending = new SantaCachedDecision();
    pending->setAction(ACTION_REQUEST_CHECKBW, 0);
    lck_rw_lock_exclusive(cached_decisions_lock_);
    cached_decisions_->setObject(identifier, pending);
@@ -189,8 +197,8 @@ void SantaDecisionManager::AddToCache(
    pending->release();  // it was retained when added to the dictionary
  } else {
    lck_rw_lock_exclusive(cached_decisions_lock_);
-    SantaMessage *pending =
-        OSDynamicCast(SantaMessage, cached_decisions_->getObject(identifier));
+    SantaCachedDecision *pending = OSDynamicCast(
+        SantaCachedDecision, cached_decisions_->getObject(identifier));
    if (pending) {
      pending->setAction(decision, microsecs);
    }
@@ -232,8 +240,8 @@ santa_action_t SantaDecisionManager::GetFromCache(const char *identifier) {
  uint64_t decision_time = 0;

  lck_rw_lock_shared(cached_decisions_lock_);
-  SantaMessage *cached_decision =
-      OSDynamicCast(SantaMessage, cached_decisions_->getObject(identifier));
+  SantaCachedDecision *cached_decision = OSDynamicCast(
+      SantaCachedDecision, cached_decisions_->getObject(identifier));
  if (cached_decision) {
    result = cached_decision->getAction();
    decision_time = cached_decision->getMicrosecs();
@@ -390,6 +398,8 @@ void SantaDecisionManager::DecrementListenerInvocations() {
  OSDecrementAtomic(&listener_invocations_);
 }

+#pragma mark Callbacks
+
 int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
                                        const vfs_context_t ctx,
                                        const vnode_t vp,
@@ -414,8 +424,19 @@ int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
  }

  switch (returnedAction) {
-    case ACTION_RESPOND_CHECKBW_ALLOW:
+    case ACTION_RESPOND_CHECKBW_ALLOW: {
+      proc_t proc = vfs_context_proc(ctx);
+      if (proc) {
+        SantaPIDAndPPID *pidWrapper = new SantaPIDAndPPID;
+        pidWrapper->pid = proc_pid(proc);
+        pidWrapper->ppid = proc_ppid(proc);
+        lck_rw_lock_exclusive(vnode_pid_map_lock_);
+        vnode_pid_map_->setObject(vnode_str, pidWrapper);
+        lck_rw_unlock_exclusive(vnode_pid_map_lock_);
+        pidWrapper->release();
+      }
      return KAUTH_RESULT_ALLOW;
+    }
    case ACTION_RESPOND_CHECKBW_DENY:
      *errno = EPERM;
      return KAUTH_RESULT_DENY;
@@ -444,6 +465,19 @@ void SantaDecisionManager::FileOpCallback(
      message->vnode_id = vnode_id;
      message->action = ACTION_NOTIFY_EXEC;
      strlcpy(message->path, path, sizeof(message->path));
+
+      char vnode_str[MAX_VNODE_ID_STR];
+      snprintf(vnode_str, MAX_VNODE_ID_STR, "%llu", vnode_id);
+
+      lck_rw_lock_shared(vnode_pid_map_lock_);
+      SantaPIDAndPPID *pidWrapper = OSDynamicCast(
+          SantaPIDAndPPID, vnode_pid_map_->getObject(vnode_str));
+      if (pidWrapper) {
+        message->pid = pidWrapper->pid;
+        message->ppid = pidWrapper->ppid;
+      }
+      lck_rw_unlock_shared(vnode_pid_map_lock_);
+
      PostToQueue(message);
      delete message;
      return;
@@ -478,8 +512,6 @@ void SantaDecisionManager::FileOpCallback(

 #undef super

-#pragma mark Kauth Callbacks
-
 extern "C" int fileop_scope_callback(
    kauth_cred_t credential, void *idata, kauth_action_t action,
    uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3) {
--- a/Source/santa-driver/SantaDecisionManager.h
+++ b/Source/santa-driver/SantaDecisionManager.h
@@ -24,9 +24,10 @@
 #include <sys/proc.h>
 #include <sys/vnode.h>

-#include "SantaMessage.h"
+#include "SantaCachedDecision.h"
 #include "SNTKernelCommon.h"
 #include "SNTLogging.h"
+#include "SantaPIDAndPPID.h"

 ///
 ///  SantaDecisionManager is responsible for intercepting Vnode execute actions
@@ -201,8 +202,10 @@ class SantaDecisionManager : public OSObject {
  lck_attr_t *sdm_lock_attr_;
  lck_rw_t *cached_decisions_lock_;
  lck_mtx_t *dataqueue_lock_;
+  lck_rw_t *vnode_pid_map_lock_;

  OSDictionary *cached_decisions_;
+  OSDictionary *vnode_pid_map_;

  IOSharedDataQueue *dataqueue_;
  SInt32 failed_queue_requests_;
--- a/Source/santa-driver/SantaDriverClient.h
+++ b/Source/santa-driver/SantaDriverClient.h
@@ -22,7 +22,6 @@

 #include "SantaDecisionManager.h"
 #include "SantaDriver.h"
-#include "SantaMessage.h"
 #include "SNTKernelCommon.h"

 ///
--- a/Source/santa-driver/SantaPIDAndPPID.cc
+++ b/Source/santa-driver/SantaPIDAndPPID.cc
@@ -0,0 +1,17 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "SantaPIDAndPPID.h"
+
+OSDefineMetaClassAndStructors(SantaPIDAndPPID, OSObject);
--- a/Source/santa-driver/SantaPIDAndPPID.h
+++ b/Source/santa-driver/SantaPIDAndPPID.h
@@ -0,0 +1,32 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTA_DRIVER__SANTAPIDANDPPID_H
+#define SANTA__SANTA_DRIVER__SANTAPIDANDPPID_H
+
+#include <libkern/c++/OSObject.h>
+
+///
+///  An OSObject wrapper around a PID and PPID.
+///  Only OSObject subclasses can be inserted into an OSDictionary.
+///
+class SantaPIDAndPPID : public OSObject {
+  OSDeclareDefaultStructors(SantaPIDAndPPID)
+
+ public:
+  pid_t pid;
+  pid_t ppid;
+};
+
+#endif  // SANTA__SANTA_DRIVER__SANTAPIDANDPPID_H
--- a/Source/santactl/binaryinfo/SNTCommandBinaryInfo.m
+++ b/Source/santactl/binaryinfo/SNTCommandBinaryInfo.m
@@ -20,12 +20,12 @@
 #import "MOLCodesignChecker.h"
 #import "SNTFileInfo.h"

-@interface SNTCommandBinaryInfo : NSObject<SNTCommand>
+@interface SNTCommandFileInfo : NSObject<SNTCommand>
@end

-@implementation SNTCommandBinaryInfo
+@implementation SNTCommandFileInfo

-REGISTER_COMMAND_NAME(@"binaryinfo")
+REGISTER_COMMAND_NAME(@"fileinfo")

 + (BOOL)requiresRoot {
  return NO;
@@ -36,13 +36,13 @@ REGISTER_COMMAND_NAME(@"binaryinfo")
 }

 + (NSString *)shortHelpText {
-  return @"Prints information about a binary.";
+  return @"Prints information about a file.";
 }

 + (NSString *)longHelpText {
  return (@"The details provided will be the same ones Santa uses to make a decision\n"
-          @"about binaries. This includes SHA-256, SHA-1, code signing information and\n"
-          @"the type of binary.");
+          @"about executables. This includes SHA-256, SHA-1, code signing information and\n"
+          @"the type of file.");
 }

 + (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
@@ -81,14 +81,15 @@ REGISTER_COMMAND_NAME(@"binaryinfo")
  }

  NSArray *archs = [fileInfo architectures];
-  if (archs) {
-    NSString *s = [NSString stringWithFormat:@"%@ (%@)",
-                      fileInfo.machoType, [archs componentsJoinedByString:@", "]];
-    [self printKey:@"Type" value:s];
-  } else {
-    [self printKey:@"Type" value:fileInfo.machoType];
+  if (archs.count == 0) {
+    [self printKey:@"Type" value:[self humanReadableFileType:fileInfo]];
+    exit(0);
  }

+  NSString *s = [NSString stringWithFormat:@"%@ (%@)",
+                    [self humanReadableFileType:fileInfo], [archs componentsJoinedByString:@", "]];
+  [self printKey:@"Type" value:s];
+
  if ([fileInfo isMissingPageZero]) {
    [self printKey:@"Page Zero" value:@"__PAGEZERO segment missing/bad!"];
  }
@@ -121,4 +122,14 @@ REGISTER_COMMAND_NAME(@"binaryinfo")
  printf("%-21s: %s\n", [key UTF8String], [value UTF8String]);
 }

+ (NSString *)humanReadableFileType:(SNTFileInfo *)fi {
+  if ([fi isScript])     return @"Script";
+  if ([fi isXARArchive]) return @"XAR Archive";
+  if ([fi isDylib])      return @"Dynamic Library";
+  if ([fi isKext])       return @"Kernel Extension";
+  if ([fi isFat])        return @"Fat Binary";
+  if ([fi isMachO])      return @"Thin Binary";
+  return @"Unknown";
+}
+
@end
--- a/Source/santactl/sync/SNTCommandSyncConstants.h
+++ b/Source/santactl/sync/SNTCommandSyncConstants.h
@@ -49,6 +49,7 @@ extern NSString * const kDecisionBlockBinary;
 extern NSString * const kDecisionBlockCertificate;
 extern NSString * const kDecisionBlockScope;
 extern NSString * const kDecisionUnknown;
+extern NSString * const kDecisionRelatedBinary;
 extern NSString * const kLoggedInUsers;
 extern NSString * const kCurrentSessions;
 extern NSString * const kFileBundleID;
--- a/Source/santactl/sync/SNTCommandSyncConstants.m
+++ b/Source/santactl/sync/SNTCommandSyncConstants.m
@@ -51,6 +51,7 @@ NSString * const kDecisionBlockBinary = @"BLOCK_BINARY";
 NSString * const kDecisionBlockCertificate = @"BLOCK_CERTIFICATE";
 NSString * const kDecisionBlockScope = @"BLOCK_SCOPE";
 NSString * const kDecisionUnknown = @"UNKNOWN";
+NSString * const kDecisionRelatedBinary = @"RELATED_BINARY";
 NSString * const kLoggedInUsers = @"logged_in_users";
 NSString * const kCurrentSessions = @"current_sessions";
 NSString * const kFileBundleID = @"file_bundle_id";
--- a/Source/santactl/sync/SNTCommandSyncEventUpload.m
+++ b/Source/santactl/sync/SNTCommandSyncEventUpload.m
@@ -18,8 +18,10 @@

 #import "NSData+Zlib.h"
 #import "MOLCertificate.h"
+#import "MOLCodesignChecker.h"
 #import "SNTCommandSyncConstants.h"
 #import "SNTCommandSyncState.h"
+#import "SNTFileInfo.h"
 #import "SNTStoredEvent.h"
 #import "SNTXPCConnection.h"
 #import "SNTXPCControlInterface.h"
@@ -82,6 +84,11 @@
    [uploadEvents addObject:[self dictionaryForEvent:event]];
    [eventIds addObject:event.idx];

+    if (event.fileBundleID) {
+      NSArray *relatedBinaries = [self findRelatedBinaries:event];
+      [uploadEvents addObjectsFromArray:relatedBinaries];
+    }
+
    if (eventIds.count >= batchSize) break;
  }

@@ -115,6 +122,7 @@
          LOGE(@"HTTP Response: %ld %@",
               statusCode,
               [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+          LOGD(@"%@", error);
        handler(NO);
      } else {
        LOGI(@"Uploaded %lu events", eventIds.count);
@@ -162,6 +170,7 @@
      ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);
      break;
    case EVENTSTATE_BLOCK_SCOPE: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
+    case EVENTSTATE_RELATED_BINARY: ADDKEY(newEvent, kDecision, kDecisionRelatedBinary); break;
    default: ADDKEY(newEvent, kDecision, kDecisionUnknown);
  }

@@ -199,4 +208,68 @@
 #undef ADDKEY
 }

+ (NSArray *)findRelatedBinaries:(SNTStoredEvent *)event {
+  // Prevent processing the same bundle twice.
+  static NSMutableDictionary *previouslyProcessedBundles;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    previouslyProcessedBundles = [NSMutableDictionary dictionary];
+  });
+  if (previouslyProcessedBundles[event.fileBundleID]) return nil;
+  previouslyProcessedBundles[event.fileBundleID] = @YES;
+
+  NSMutableArray *relatedEvents = [NSMutableArray array];
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  __block BOOL shouldCancel = NO;
+  dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0), ^{
+    SNTFileInfo *originalFile = [[SNTFileInfo alloc] initWithPath:event.filePath];
+    NSString *bundlePath = originalFile.bundlePath;
+    originalFile = nil;  // release originalFile early.
+
+    NSDirectoryEnumerator *dirEnum = [[NSFileManager defaultManager] enumeratorAtPath:bundlePath];
+    NSString *file;
+
+    while (file = [dirEnum nextObject]) {
+      @autoreleasepool {
+        if (shouldCancel) break;
+        if ([dirEnum fileAttributes][NSFileType] != NSFileTypeRegular) continue;
+
+        file = [bundlePath stringByAppendingPathComponent:file];
+
+        // Don't record the binary that triggered this event as a related binary.
+        if ([file isEqual:event.filePath]) continue;
+
+        SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:file];
+        if (fi.isExecutable) {
+          SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+          se.filePath = fi.path;
+          se.fileSHA256 = fi.SHA256;
+          se.decision = EVENTSTATE_RELATED_BINARY;
+          se.fileBundleID = event.fileBundleID;
+          se.fileBundleName = event.fileBundleName;
+          se.fileBundleVersion = event.fileBundleVersion;
+          se.fileBundleVersionString = event.fileBundleVersionString;
+
+          MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithBinaryPath:se.filePath];
+          se.signingChain = cs.certificates;
+
+          [relatedEvents addObject:[self dictionaryForEvent:se]];
+        }
+      }
+    }
+
+    dispatch_semaphore_signal(sema);
+  });
+
+  // Give the search up to 5s per event to run.
+  // This might need tweaking if it seems to slow down syncing or misses too much to be useful.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 5))) {
+    shouldCancel = YES;
+    LOGD(@"Timed out while searching for related events. Bundle ID: %@", event.fileBundleID);
+  }
+
+  return relatedEvents;
+}
+
@end
--- a/Source/santactl/sync/SNTCommandSyncLogUpload.m
+++ b/Source/santactl/sync/SNTCommandSyncLogUpload.m
@@ -48,6 +48,7 @@
        LOGE(@"HTTP Response: %ld %@",
             statusCode,
             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+        LOGD(@"%@", error);
        handler(NO);
      } else {
        LOGI(@"Uploaded %lu logs", [logsToUpload count]);
--- a/Source/santactl/sync/SNTCommandSyncPostflight.m
+++ b/Source/santactl/sync/SNTCommandSyncPostflight.m
@@ -40,6 +40,7 @@
      LOGE(@"HTTP Response: %ld %@",
           statusCode,
           [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+      LOGD(@"%@", error);
      handler(NO);
    } else {
      NSDictionary *r = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
--- a/Source/santactl/sync/SNTCommandSyncPreflight.m
+++ b/Source/santactl/sync/SNTCommandSyncPreflight.m
@@ -72,6 +72,7 @@
        LOGE(@"HTTP Response: %ld %@",
             statusCode,
             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+        LOGD(@"%@", error);
        handler(NO);
      } else {
        NSDictionary *r = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
--- a/Source/santactl/sync/SNTCommandSyncRuleDownload.m
+++ b/Source/santactl/sync/SNTCommandSyncRuleDownload.m
@@ -65,6 +65,7 @@
        LOGE(@"HTTP Response: %ld %@",
             statusCode,
             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
+        LOGD(@"%@", error);
        handler(NO);
      } else {
        NSDictionary *resp = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
--- a/Source/santad/SNTApplication.m
+++ b/Source/santad/SNTApplication.m
@@ -112,10 +112,15 @@
 - (void)run {
  LOGI(@"Connected to driver, activating.");

-  // Create a concurrent queue to put requests on, then set its priority to high.
-  dispatch_queue_t q =
-      dispatch_queue_create("com.google.santad.driver_queue", DISPATCH_QUEUE_CONCURRENT);
-  dispatch_set_target_queue(q, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0));
+  // Create the queues used for execution requests and logging.
+  dispatch_queue_t exec_queue = dispatch_queue_create(
+      "com.google.santad.execution_queue", DISPATCH_QUEUE_CONCURRENT);
+  dispatch_set_target_queue(exec_queue, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0));
+
+  dispatch_queue_t log_queue = dispatch_queue_create(
+      "com.google.santad.log_queue", DISPATCH_QUEUE_CONCURRENT);
+  dispatch_set_target_queue(
+      log_queue, dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_LOW, 0));

  [self.driverManager listenWithBlock:^(santa_message_t message) {
      @autoreleasepool {
@@ -129,7 +134,7 @@
          case ACTION_NOTIFY_LINK:
          case ACTION_NOTIFY_RENAME:
          case ACTION_NOTIFY_WRITE: {
-            dispatch_async(q, ^{
+            dispatch_async(log_queue, ^{
              NSRegularExpression *re = [[SNTConfigurator configurator] fileChangesRegex];
              NSString *path = @(message.path);
              if ([re numberOfMatchesInString:path options:0 range:NSMakeRange(0, path.length)]) {
@@ -139,13 +144,13 @@
            break;
          }
          case ACTION_NOTIFY_EXEC: {
-            dispatch_async(q, ^{
+            dispatch_async(log_queue, ^{
              [self.eventLog logAllowedExecution:message];
            });
            break;
          }
          case ACTION_REQUEST_CHECKBW: {
-            dispatch_async(q, ^{
+            dispatch_async(exec_queue, ^{
                [self.execController validateBinaryWithMessage:message];
            });
            break;
--- a/Source/santad/SNTEventLog.m
+++ b/Source/santad/SNTEventLog.m
@@ -14,7 +14,9 @@

 #import "SNTEventLog.h"

+#include <grp.h>
 #include <libproc.h>
+#include <pwd.h>
 #include <sys/sysctl.h>

 #import "SNTCachedDecision.h"
@@ -88,9 +90,17 @@
  if (proc_pidpath(message.pid, ppath, PATH_MAX) < 1) {
    strncpy(ppath, "(null)", 6);
  }
-  outStr =
-      [outStr stringByAppendingFormat:@"|pid=%d|ppid=%d|process=%s|processpath=%s|uid=%d|gid=%d",
-          message.pid, message.ppid, message.pname, ppath, message.uid, message.gid];
+
+  NSString *user, *group;
+  struct passwd *pw = getpwuid(message.uid);
+  if (pw) user = @(pw->pw_name);
+  struct group *gr = getgrgid(message.gid);
+  if (gr) group = @(gr->gr_name);
+
+  outStr = [outStr stringByAppendingFormat:(@"|pid=%d|ppid=%d|process=%s|processpath=%s|"
+                                            @"uid=%d|user=%@|gid=%d|group=%@"),
+               message.pid, message.ppid, message.pname, ppath,
+               message.uid, user, message.gid, group];
  if (sha256) {
    outStr = [outStr stringByAppendingFormat:@"|sha256=%@", sha256];
  }
@@ -145,8 +155,14 @@
                 cd.certSHA256, [self sanitizeString:cd.certCommonName]];
  }

-  outLog = [outLog stringByAppendingFormat:@"|pid=%d|ppid=%d|uid=%d|gid=%d",
-               message.pid, message.ppid, message.uid, message.gid];
+  NSString *user, *group;
+  struct passwd *pw = getpwuid(message.uid);
+  if (pw) user = @(pw->pw_name);
+  struct group *gr = getgrgid(message.gid);
+  if (gr) group = @(gr->gr_name);
+
+  outLog = [outLog stringByAppendingFormat:@"|pid=%d|ppid=%d|uid=%d|user=%@|gid=%d|group=%@",
+               message.pid, message.ppid, message.uid, user, message.gid, group];

  LOGI(@"%@", outLog);
 }
@@ -205,7 +221,7 @@
  NSMutableArray *args = [NSMutableArray arrayWithCapacity:argc];
  for (int i = 0; i < argc; i++) {
    NSString *arg = @(cp);
-    [args addObject:arg];
+    if (arg) [args addObject:arg];

    // Move the pointer past this string and the terminator at the end.
    cp += strlen(cp) + 1;
--- a/Source/santad/SNTEventTable.m
+++ b/Source/santad/SNTEventTable.m
@@ -32,6 +32,40 @@
    newVersion = 1;
  }

+  if (version < 2) {
+    // Clean-up: Find events where the bundle details might not be strings and update them.
+    FMResultSet *rs = [db executeQuery:@"SELECT * FROM events"];
+    while ([rs next]) {
+      SNTStoredEvent *se = [self eventFromResultSet:rs];
+      if (!se) continue;
+
+      Class NSStringClass = [NSString class];
+      if ([se.fileBundleID class] != NSStringClass) {
+        se.fileBundleID = [se.fileBundleID description];
+      }
+      if ([se.fileBundleName class] != NSStringClass) {
+        se.fileBundleName = [se.fileBundleName description];
+      }
+      if ([se.fileBundleVersion class] != NSStringClass) {
+        se.fileBundleVersion = [se.fileBundleVersion description];
+      }
+      if ([se.fileBundleVersionString class] != NSStringClass) {
+        se.fileBundleVersionString = [se.fileBundleVersionString description];
+      }
+
+      NSData *eventData;
+      NSNumber *idx = [rs objectForColumnName:@"idx"];
+      @try {
+        eventData = [NSKeyedArchiver archivedDataWithRootObject:se];
+        [db executeUpdate:@"UPDATE events SET eventdata=? WHERE idx=?", eventData, idx];
+      } @catch (NSException *exception) {
+        [db executeUpdate:@"DELETE FROM events WHERE idx=?", idx];
+      }
+    }
+    [rs close];
+    newVersion = 2;
+  }
+
  return newVersion;
 }

--- a/Source/santad/SNTExecutionController.m
+++ b/Source/santad/SNTExecutionController.m
@@ -53,7 +53,6 @@
    _notifierConnection = notifier;
    _eventLog = eventLog;

-    // Workaround for xpcproxy/libsecurity bug on Yosemite
    // This establishes the XPC connection between libsecurity and syspolicyd.
    // Not doing this causes a deadlock as establishing this link goes through xpcproxy.
    (void)[[MOLCodesignChecker alloc] initWithSelf];
@@ -168,7 +167,6 @@
    }

    struct passwd *user = getpwuid(message.uid);
-    endpwent();
    if (user) {
      se.executingUser = @(user->pw_name);
    }
@@ -285,7 +283,7 @@
  while ((nxt = getutxent())) {
    if (nxt->ut_type != USER_PROCESS) continue;

-    NSString *userName = [NSString stringWithUTF8String:nxt->ut_user];
+    NSString *userName = @(nxt->ut_user);

    NSString *sessionName;
    if (strnlen(nxt->ut_host, 1) > 0) {
--- a/Tests/LogicTests/Resources/Tests-Info.plist
+++ b/Tests/LogicTests/Resources/Tests-Info.plist
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${EXECUTABLE_NAME}</string>
 	<key>CFBundleIdentifier</key>
-	<string>com.google.${PRODUCT_NAME:rfc1034identifier}</string>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
 	<key>CFBundlePackageType</key>
Author	SHA1	Message	Date
Russell Hancox	d295f2391f	santactl/sync: In --debug log the full NSError for failed requests	2015-12-15 12:36:07 -05:00
Russell Hancox	c042222eea	santad: Add user/group info to file changelogs also	2015-12-14 22:32:59 -05:00
Russell Hancox	63f6596bc2	santactl: Rename binaryinfo -> fileinfo.	2015-12-14 18:09:40 -05:00
Russell Hancox	d8a8aba0ea	SNTFileInfo: Move machoType method to binaryinfo command, add XAR archive detection.	2015-12-14 17:25:32 -05:00
Russell Hancox	d9d9682029	santactl/sync: Let related-binary search take up to 5s	2015-12-14 16:37:19 -05:00
Russell Hancox	4a27a8ac70	Rakefile: Use Xcode to figure out where built products went, to avoid relying on particular Xcode settings.	2015-12-14 16:36:11 -05:00
Russell Hancox	32857ff304	Project: Apply latest Xcode recommendations	2015-12-14 16:35:34 -05:00
Russell Hancox	375bfd3862	santa-driver: Put locks around vnode_pid_map, use an OSObject subclass to store PID/PPID. Put a R/W lock around vnode_pid_map_ to prevent use-after-free. Create SantaPIDAndPPID to use instead of creating and then scanning strings. Also rename SantaMessage -> SantaCachedDecision, as that's what it is.	2015-12-14 16:34:38 -05:00
Russell Hancox	9430c41b8a	santad: Include user and group names in execution logs	2015-12-11 12:58:09 -05:00
Russell Hancox	9b342e146a	santactl/sync: Include code sign info with related executables and encode to dict.	2015-12-10 17:37:22 -05:00
Russell Hancox	e5685f2959	santad: Don't try to add empty argument to array when processing execution arguments	2015-12-10 17:02:11 -05:00
Russell Hancox	4150feece2	santactl/sync: When uploading events for bundles, look for other bundled executables. Many application bundles have related helper tools, which will individually need to be whitelisted unless they're covered by a certificate. To help make user's lives easier, when an event is triggered for a binary inside a bundle look for other executables in the same bundle and upload an event for those too (with an obvious tag) so that the server can let the user vote to whitelist all the binaries together.	2015-12-10 17:01:49 -05:00
Russell Hancox	6879ec5deb	santa-driver: in DecisionManager free locks before anything else	2015-12-10 16:56:13 -05:00
Russell Hancox	28ad00ffad	SantaGUI: Split block messages into unknown and banned. This is so that a message can be configured for banned executables without having to provide a custom message for every single one.	2015-12-10 12:13:52 -05:00
Russell Hancox	bf51049fbf	santa-driver: Save pid/ppid from VFS context when decision making for use when logging Previously the execution logging from fileop didn't work when using posix_spawn as proc_selfpid/proc_selfppid still refer to the process calling posix_spawn. We can get the correct pid/ppid from the vfs_context in the vnode scope but we can't log executions from there as the arguments end up being wrong. Instead, save the vnode_id->pid/ppid mapping in the vnode scope and use that in the fileop scope for logging.	2015-12-10 12:12:38 -05:00
Russell Hancox	36189e9122	santad: Update SNTFileInfo to always get strings from bundle Info.plist data. Also perform a one-time update of any events created before this change.	2015-12-04 13:09:56 -05:00
Russell Hancox	4c747463ac	santad: Separate execution requests and logging into separate queues with appropriate priorities.	2015-12-04 12:39:26 -05:00