Packaging: Keep package versions simple (#737 )

Project: Add build version (#736 )
Add a USB device blocking popup. (#728 )
2026-01-18 02:37:53 -05:00 · 2022-03-02 10:36:39 -05:00 · 2022-02-28 14:18:18 -05:00 · 2022-02-28 13:30:56 -05:00 · 2022-02-17 11:36:21 -05:00 · 2022-02-16 20:02:12 -05:00
43 changed files with 1218 additions and 488 deletions
--- a/7
+++ b/7
@@ -11,7 +11,12 @@ exports_files(["LICENSE"])
 # The version label for mac_* rules.
 apple_bundle_version(
    name = "version",
-    build_version = SANTA_VERSION,
+    build_label_pattern = "{build}",
+    build_version = SANTA_VERSION + ".{build}",
+    capture_groups = {
+        "build": "\\d+",
+    },
+    fallback_build_label = "1",
    short_version_string = SANTA_VERSION,
 )

--- a/Conf/Package/Distribution.xml
+++ b/Conf/Package/Distribution.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <installer-gui-script minSpecVersion="1">
 <title>Santa</title>
-<options customize="never" allow-external-scripts="no"/>
+<options customize="never" allow-external-scripts="no" hostArchitectures="x86_64,arm64" />

 <choices-outline>
 	<line choice="default" />
--- a/Conf/Package/package_and_sign.sh
+++ b/Conf/Package/package_and_sign.sh
@@ -50,7 +50,7 @@ readonly INPUT_SANTACTL="${INPUT_APP}/Contents/MacOS/santactl"
 readonly INPUT_SANTABS="${INPUT_APP}/Contents/MacOS/santabundleservice"
 readonly INPUT_SANTAMS="${INPUT_APP}/Contents/MacOS/santametricservice"

-readonly RELEASE_NAME="santa-$(/usr/bin/defaults read "${INPUT_APP}/Contents/Info.plist" CFBundleVersion)"
+readonly RELEASE_NAME="santa-$(/usr/bin/defaults read "${INPUT_APP}/Contents/Info.plist" CFBundleShortVersionString)"

 readonly SCRATCH=$(/usr/bin/mktemp -d "${TMPDIR}/santa-"XXXXXX)
 readonly APP_PKG_ROOT="${SCRATCH}/app_pkg_root"
--- a/Source/common/BUILD
+++ b/Source/common/BUILD
@@ -30,6 +30,15 @@ objc_library(
    ],
 )

+objc_library(
+    name = "SNTDeviceEvent",
+    srcs = ["SNTDeviceEvent.m"],
+    hdrs = ["SNTDeviceEvent.h"],
+    deps = [
+        ":SNTCommonEnums",
+    ],
+)
+
 objc_library(
    name = "SNTBlockMessage_SantaGUI",
    srcs = ["SNTBlockMessage.m"],
@@ -37,6 +46,7 @@ objc_library(
    defines = ["SANTAGUI"],
    deps = [
        ":SNTConfigurator",
+        ":SNTDeviceEvent",
        ":SNTLogging",
        ":SNTStoredEvent",
    ],
--- a/Source/common/SNTBlockMessage.h
+++ b/Source/common/SNTBlockMessage.h
@@ -24,12 +24,17 @@

 ///
 ///  Return a message suitable for presenting to the user.
-///  Uses either the configured message depending on the event type or a custom message
-///  if the rule that blocked this file included one.
 ///
 ///  In SantaGUI this will return an NSAttributedString with links and formatting included
 ///  while for santad all HTML will be properly stripped.
 ///
+ (NSAttributedString *)formatMessage:(NSString *)message;
+
+///
+///  Uses either the configured message depending on the event type or a custom message
+///  if the rule that blocked this file included one, formatted using
+///  +[SNTBlockMessage formatMessage].
+///
 + (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                         customMessage:(NSString *)customMessage;

--- a/Source/common/SNTBlockMessage.m
+++ b/Source/common/SNTBlockMessage.m
@@ -21,8 +21,7 @@

@implementation SNTBlockMessage

-+ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
-                                         customMessage:(NSString *)customMessage {
+ (NSAttributedString *)formatMessage:(NSString *)message {
  NSString *htmlHeader =
    @"<html><head><style>"
    @"body {"
@@ -48,6 +47,22 @@

  NSString *htmlFooter = @"</body></html>";

+  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
+
+#ifdef SANTAGUI
+  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
+  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
+#else
+  NSString *strippedHTML = [self stringFromHTML:fullHTML];
+  if (!strippedHTML) {
+    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
+  }
+  return [[NSAttributedString alloc] initWithString:strippedHTML];
+#endif
+}
+
+ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
+                                         customMessage:(NSString *)customMessage {
  NSString *message;
  if (customMessage.length) {
    message = customMessage;
@@ -64,19 +79,7 @@
                @"because it has been deemed malicious.";
    }
  }
-
-  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
-
-#ifdef SANTAGUI
-  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
-  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
-#else
-  NSString *strippedHTML = [self stringFromHTML:fullHTML];
-  if (!strippedHTML) {
-    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
-  }
-  return [[NSAttributedString alloc] initWithString:strippedHTML];
-#endif
+  return [SNTBlockMessage formatMessage:message];
 }

 + (NSString *)stringFromHTML:(NSString *)html {
--- a/Source/common/SNTConfigurator.h
+++ b/Source/common/SNTConfigurator.h
@@ -26,7 +26,7 @@
 #pragma mark - Daemon Settings

 ///
-///  The operating mode.
+///  The operating mode. Defaults to MONITOR.
 ///
@property(readonly, nonatomic) SNTClientMode clientMode;

@@ -35,6 +35,17 @@
 ///
 - (void)setSyncServerClientMode:(SNTClientMode)newMode;

+///
+///  Enable Fail Close mode. Defaults to NO.
+///  This controls Santa's behavior when a failure occurs, such as an
+///  inability to read a file. By default, to prevent bugs or misconfiguration
+///  from rendering a machine inoperable Santa will fail open and allow
+///  execution. With this setting enabled, Santa will fail closed if the client
+///  is in LOCKDOWN mode, offering a higher level of security but with a higher
+///  potential for causing problems.
+///
+@property(readonly, nonatomic) BOOL failClosed;
+
 ///
 ///  The regex of allowed paths. Regexes are specified in ICU format.
 ///
@@ -235,6 +246,20 @@
 ///
@property(readonly, nonatomic) NSString *bannedBlockMessage;

+///
+/// This is the message shown to the user when a USB storage device's mount is denied
+/// from the BlockUSB configuration setting. If not configured, a reasonable
+/// default is provided.
+///
+@property(readonly, nonatomic) NSString *bannedUSBBlockMessage;
+
+///
+/// This is the message shown to the user when a USB storage device's mount is forcibly
+/// remounted to a different set of permissions from the BlockUSB and RemountUSBMode
+/// configuration settings. If not configured, a reasonable default is provided.
+///
+@property(readonly, nonatomic) NSString *remountUSBBlockMessage;
+
 ///
 ///  The notification text to display when the client goes into MONITOR mode.
 ///  Defaults to "Switching into Monitor mode"
@@ -427,6 +452,11 @@
 ///
@property(readonly, nonatomic) NSUInteger metricExportInterval;

+///
+/// Duration in seconds for metrics export timeout. Defaults to 30;
+///
+@property(readonly, nonatomic) NSUInteger metricExportTimeout;
+
 ///
 ///  Retrieve an initialized singleton configurator object using the default file path.
 ///
--- a/Source/common/SNTConfigurator.m
+++ b/Source/common/SNTConfigurator.m
@@ -66,6 +66,9 @@ static NSString *const kEventDetailURLKey = @"EventDetailURL";
 static NSString *const kEventDetailTextKey = @"EventDetailText";
 static NSString *const kUnknownBlockMessage = @"UnknownBlockMessage";
 static NSString *const kBannedBlockMessage = @"BannedBlockMessage";
+static NSString *const kBannedUSBBlockMessage = @"BannedUSBBlockMessage";
+static NSString *const kRemountUSBBlockMessage = @"RemountUSBBlockMessage";
+
 static NSString *const kModeNotificationMonitor = @"ModeNotificationMonitor";
 static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";

@@ -96,6 +99,7 @@ static NSString *const kFCMAPIKey = @"FCMAPIKey";

 // The keys managed by a sync server or mobileconfig.
 static NSString *const kClientModeKey = @"ClientMode";
+static NSString *const kFailClosedKey = @"FailClosed";
 static NSString *const kBlockUSBMountKey = @"BlockUSBMount";
 static NSString *const kRemountUSBModeKey = @"RemountUSBMode";
 static NSString *const kEnableTransitiveRulesKey = @"EnableTransitiveRules";
@@ -109,6 +113,7 @@ static NSString *const kBlockedPathRegexKeyDeprecated = @"BlacklistRegex";
 static NSString *const kMetricFormat = @"MetricFormat";
 static NSString *const kMetricURL = @"MetricURL";
 static NSString *const kMetricExportInterval = @"MetricExportInterval";
+static NSString *const kMetricExportTimeout = @"MetricExportTimeout";
 static NSString *const kMetricExtraLabels = @"MetricExtraLabels";

 // The keys managed by a sync server.
@@ -142,6 +147,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
    };
    _forcedConfigKeyTypes = @{
      kClientModeKey : number,
+      kFailClosedKey : number,
      kEnableTransitiveRulesKey : number,
      kEnableTransitiveRulesKeyDeprecated : number,
      kFileChangesRegexKey : re,
@@ -160,6 +166,8 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
      kEventDetailTextKey : string,
      kUnknownBlockMessage : string,
      kBannedBlockMessage : string,
+      kBannedUSBBlockMessage : string,
+      kRemountUSBBlockMessage : string,
      kModeNotificationMonitor : string,
      kModeNotificationLockdown : string,
      kSyncBaseURLKey : string,
@@ -191,6 +199,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
      kMetricFormat : string,
      kMetricURL : string,
      kMetricExportInterval : number,
+      kMetricExportTimeout : number,
      kMetricExtraLabels : dictionary,
    };
    _defaults = [NSUserDefaults standardUserDefaults];
@@ -429,6 +438,12 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  }
 }

+- (BOOL)failClosed {
+  NSNumber *n = self.configState[kFailClosedKey];
+  if (n) return [n boolValue];
+  return NO;
+}
+
 - (BOOL)enableTransitiveRules {
  NSNumber *n = self.syncState[kEnableTransitiveRulesKey];
  if (n) return [n boolValue];
@@ -553,6 +568,21 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  return self.configState[kBannedBlockMessage];
 }

+- (NSString *)bannedUSBBlockMessage {
+  if (!self.configState[kBannedUSBBlockMessage]) {
+    return @"The following device has been blocked from mounting.";
+  }
+
+  return self.configState[kBannedUSBBlockMessage];
+}
+
+- (NSString *)remountUSBBlockMessage {
+  if (!self.configState[kRemountUSBBlockMessage]) {
+    return @"The following device has been remounted with reduced permissions.";
+  }
+  return self.configState[kRemountUSBBlockMessage];
+}
+
 - (NSString *)modeNotificationMonitor {
  return self.configState[kModeNotificationMonitor];
 }
@@ -751,6 +781,16 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
  return [configuredInterval unsignedIntegerValue];
 }

+// Returns a default value of 30 (for 30 seconds).
+- (NSUInteger)metricExportTimeout {
+  NSNumber *configuredInterval = self.configState[kMetricExportTimeout];
+
+  if (configuredInterval == nil) {
+    return 30;
+  }
+  return [configuredInterval unsignedIntegerValue];
+}
+
 - (NSDictionary *)extraMetricLabels {
  return self.configState[kMetricExtraLabels];
 }
--- a/Source/common/SNTDeviceEvent.h
+++ b/Source/common/SNTDeviceEvent.h
@@ -0,0 +1,27 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+@interface SNTDeviceEvent : NSObject <NSSecureCoding>
+
+- (instancetype)initWithOnName:(NSString *)mntonname fromName:(NSString *)mntfromname;
+
+@property NSString *mntonname;
+@property NSString *mntfromname;
+@property NSArray<NSString *> *remountArgs;
+
+- (NSString *)readableRemountArgs;
+
+@end
--- a/Source/common/SNTDeviceEvent.m
+++ b/Source/common/SNTDeviceEvent.m
@@ -0,0 +1,63 @@
+#import "Source/common/SNTDeviceEvent.h"
+
+@implementation SNTDeviceEvent
+
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wobjc-literal-conversion"
+
+#define ENCODE(obj, key) \
+  if (obj) [coder encodeObject:obj forKey:key]
+#define DECODE(cls, key) [decoder decodeObjectOfClass:[cls class] forKey:key]
+#define DECODEARRAY(cls, key)                                                             \
+  [decoder decodeObjectOfClasses:[NSSet setWithObjects:[NSArray class], [cls class], nil] \
+                          forKey:key]
+
+- (instancetype)initWithOnName:(NSString *)mntonname fromName:(NSString *)mntfromname {
+  self = [super init];
+  if (self) {
+    _mntonname = mntonname;
+    _mntfromname = mntfromname;
+  }
+  return self;
+}
+
+ (BOOL)supportsSecureCoding {
+  return YES;
+}
+
+- (void)encodeWithCoder:(NSCoder *)coder {
+  ENCODE(self.mntonname, @"mntonname");
+  ENCODE(self.mntfromname, @"mntfromname");
+  ENCODE(self.remountArgs, @"remountArgs");
+}
+
+- (instancetype)initWithCoder:(NSCoder *)decoder {
+  self = [super init];
+  if (self) {
+    _mntonname = DECODE(NSString, @"mntonname");
+    _mntfromname = DECODE(NSString, @"mntfromname");
+    _remountArgs = DECODEARRAY(NSString, @"remountArgs");
+  }
+  return self;
+}
+- (NSString *)description {
+  return [NSString stringWithFormat:@"SNTDeviceEvent '%@' -> '%@' (with permissions: [%@]",
+                                    self.mntfromname, self.mntonname,
+                                    [self.remountArgs componentsJoinedByString:@", "]];
+}
+
+- (NSString *)readableRemountArgs {
+  NSMutableArray<NSString *> *readable = [NSMutableArray array];
+  for (NSString *arg in self.remountArgs) {
+    if ([arg isEqualToString:@"rdonly"]) {
+      [readable addObject:@"read-only"];
+    } else if ([arg isEqualToString:@"noexec"]) {
+      [readable addObject:@"block executables"];
+    } else {
+      [readable addObject:arg];
+    }
+  }
+  return [readable componentsJoinedByString:@", "];
+}
+
+@end
--- a/Source/common/SNTXPCNotifierInterface.h
+++ b/Source/common/SNTXPCNotifierInterface.h
@@ -18,10 +18,12 @@
 #import "Source/common/SNTXPCBundleServiceInterface.h"

@class SNTStoredEvent;
+@class SNTDeviceEvent;

 /// Protocol implemented by SantaGUI and utilized by santad
@protocol SNTNotifierXPC
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
+- (void)postUSBBlockNotification:(SNTDeviceEvent *)event withCustomMessage:(NSString *)message;
 - (void)postClientModeNotification:(SNTClientMode)clientmode;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
 - (void)updateCountsForEvent:(SNTStoredEvent *)event
--- a/Source/santa/BUILD
+++ b/Source/santa/BUILD
@@ -15,6 +15,10 @@ objc_library(
        "SNTAccessibleTextField.m",
        "SNTAppDelegate.h",
        "SNTAppDelegate.m",
+        "SNTBinaryMessageWindowController.h",
+        "SNTBinaryMessageWindowController.m",
+        "SNTDeviceMessageWindowController.h",
+        "SNTDeviceMessageWindowController.m",
        "SNTMessageWindow.h",
        "SNTMessageWindow.m",
        "SNTMessageWindowController.h",
@@ -25,6 +29,7 @@ objc_library(
    ],
    data = [
        "Resources/AboutWindow.xib",
+        "Resources/DeviceMessageWindow.xib",
        "Resources/MessageWindow.xib",
    ],
    sdk_frameworks = [
--- a/Source/santa/Resources/AboutWindow.xib
+++ b/Source/santa/Resources/AboutWindow.xib
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14460.31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="19455" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14460.31"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="19455"/>
        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
    </dependencies>
    <objects>
@@ -17,7 +17,7 @@
        <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
            <rect key="contentRect" x="196" y="240" width="480" height="200"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="3840" height="1577"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1415"/>
            <view key="contentView" id="se5-gp-TjO">
                <rect key="frame" x="0.0" y="0.0" width="480" height="200"/>
                <autoresizingMask key="autoresizingMask"/>
@@ -47,7 +47,7 @@ There are no user-configurable settings.</string>
                        </textFieldCell>
                    </textField>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="SRu-Kf-vu5">
-                        <rect key="frame" x="130" y="21" width="111" height="32"/>
+                        <rect key="frame" x="129" y="21" width="113" height="32"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="99" id="JHv-2J-QSe"/>
                        </constraints>
@@ -60,7 +60,7 @@ There are no user-configurable settings.</string>
                        </connections>
                    </button>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Udo-BY-n7e">
-                        <rect key="frame" x="240" y="21" width="111" height="32"/>
+                        <rect key="frame" x="239" y="21" width="113" height="32"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="99" id="2Xc-ax-2bV"/>
                        </constraints>
--- a/Source/santa/Resources/DeviceMessageWindow.xib
+++ b/Source/santa/Resources/DeviceMessageWindow.xib
@@ -0,0 +1,193 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="19455" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+    <dependencies>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="19455"/>
+        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
+    </dependencies>
+    <objects>
+        <customObject id="-2" userLabel="File's Owner" customClass="SNTDeviceMessageWindowController">
+            <connections>
+                <outlet property="window" destination="9Bq-yh-54f" id="Uhs-WF-TV9"/>
+            </connections>
+        </customObject>
+        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
+        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+            <windowStyleMask key="styleMask" utility="YES"/>
+            <rect key="contentRect" x="167" y="107" width="515" height="318"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="1440" height="875"/>
+            <view key="contentView" id="Iwq-Lx-rLv">
+                <rect key="frame" x="0.0" y="0.0" width="515" height="318"/>
+                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
+                <userGuides>
+                    <userLayoutGuide location="344" affinity="minX"/>
+                </userGuides>
+                <subviews>
+                    <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
+                        <rect key="frame" x="16" y="290" width="37" height="32"/>
+                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
+                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </buttonCell>
+                    </button>
+                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" textCompletion="NO" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="31" y="210" width="454" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" refusesFirstResponder="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="A message to the user goes here..." allowsEditingTextAttributes="YES" id="5tH-bG-UJA">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.attributedCustomMessage" id="376-sj-4Q1"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="139" width="142" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="Kqd-nX-7df"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Device Name" id="KgY-X1-ESG">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="115" width="142" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="3wU-P0-gAC"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Device BSD Path" id="adC-be-Beh">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Device Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" ambiguous="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="139" width="315" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="xVR-j3-dLw"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Device Name" id="E7T-9h-ofr">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.mntonname" id="bOu-gv-1Vh"/>
+                        </connections>
+                    </textField>
+                    <textField toolTip="Device BSD Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" ambiguous="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="115" width="315" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="p1W-f9-KBX"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Device BSD Path" id="H1b-Ui-CYo">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.mntfromname" id="Sry-KY-HDb"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
+                        <rect key="frame" x="217" y="248" width="82" height="40"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
+                            <font key="font" metaFont="systemUltraLight" size="34"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField verticalHuggingPriority="750" ambiguous="YES" translatesAutoresizingMaskIntoConstraints="NO" id="i8e-8n-tZS" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="91" width="142" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="138" id="a3r-ng-zxJ"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Remount Mode" id="4D0-8L-ihK">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Device BSD Path" verticalHuggingPriority="750" ambiguous="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kmz-be-oWf" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="187" y="91" width="315" height="16"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="311" id="cbM-i5-bJ9"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Remount Mode" id="qI0-Na-kxN">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.readableRemountArgs" id="bOu-gv-1Vl"/>
+                        </connections>
+                    </textField>
+                    <button verticalHuggingPriority="750" misplaced="YES" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
+                        <rect key="frame" x="202" y="18" width="112" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
+                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
+                        </constraints>
+                        <buttonCell key="cell" type="roundTextured" title="Ok" bezelStyle="texturedRounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                            <modifierMask key="keyEquivalentModifierMask" shift="YES"/>
+                        </buttonCell>
+                        <accessibility description="Dismiss Dialog"/>
+                        <connections>
+                            <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>
+                        </connections>
+                    </button>
+                </subviews>
+                <constraints>
+                    <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" priority="500" constant="193" id="2uo-Cm-Tfp"/>
+                    <constraint firstItem="kmz-be-oWf" firstAttribute="height" secondItem="i8e-8n-tZS" secondAttribute="height" id="6Ow-Sl-6Wc"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="FPe-Rd-G4n"/>
+                    <constraint firstItem="t8c-Fx-e5h" firstAttribute="top" secondItem="Iwq-Lx-rLv" secondAttribute="top" constant="30" id="FuB-GX-0jg"/>
+                    <constraint firstItem="YNz-ka-cBi" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="KmX-kX-VCN"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="55" id="Nsl-zf-poH"/>
+                    <constraint firstItem="YNz-ka-cBi" firstAttribute="centerY" secondItem="bDE-Tl-UHg" secondAttribute="centerY" id="ObQ-RA-S5V"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="centerY" secondItem="pc8-G9-4pJ" secondAttribute="centerY" id="SLv-F7-w5k"/>
+                    <constraint firstAttribute="centerX" secondItem="cD5-Su-lXR" secondAttribute="centerX" id="V0a-Py-iEc"/>
+                    <constraint firstItem="cD5-Su-lXR" firstAttribute="top" secondItem="t8c-Fx-e5h" secondAttribute="bottom" constant="22" id="dYg-zP-wh2"/>
+                    <constraint firstAttribute="centerX" secondItem="t8c-Fx-e5h" secondAttribute="centerX" id="h3d-Kc-q88"/>
+                    <constraint firstItem="kmz-be-oWf" firstAttribute="centerY" secondItem="i8e-8n-tZS" secondAttribute="centerY" id="ilC-5x-LNe"/>
+                    <constraint firstItem="bDE-Tl-UHg" firstAttribute="top" secondItem="pc8-G9-4pJ" secondAttribute="bottom" constant="8" id="pis-of-f93"/>
+                    <constraint firstItem="i8e-8n-tZS" firstAttribute="centerY" secondItem="YNz-ka-cBi" secondAttribute="centerY" constant="24" id="uZs-XT-PuZ"/>
+                    <constraint firstAttribute="bottom" secondItem="BbV-3h-mmL" secondAttribute="bottom" constant="35" id="ukF-FH-DE8"/>
+                    <constraint firstItem="YNz-ka-cBi" firstAttribute="firstBaseline" secondItem="d9e-Wv-Y5H" secondAttribute="baseline" constant="24" id="xZu-AY-wX5"/>
+                    <constraint firstItem="i8e-8n-tZS" firstAttribute="top" secondItem="YNz-ka-cBi" secondAttribute="bottom" constant="8" symbolic="YES" id="ylw-3s-9JW"/>
+                </constraints>
+            </view>
+            <connections>
+                <outlet property="initialFirstResponder" destination="kiB-jZ-69S" id="I96-dS-lq5"/>
+            </connections>
+            <point key="canvasLocation" x="261.5" y="246"/>
+        </window>
+        <userDefaultsController representsSharedInstance="YES" id="iXx-cu-WYe"/>
+    </objects>
+</document>
--- a/Source/santa/Resources/MessageWindow.xib
+++ b/Source/santa/Resources/MessageWindow.xib
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="14460.31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="19455" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
    <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="14460.31"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="19455"/>
        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
    </dependencies>
    <objects>
@@ -21,8 +21,8 @@
        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
            <windowStyleMask key="styleMask" utility="YES"/>
            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="3840" height="1577"/>
-            <view key="contentView" id="Iwq-Lx-rLv">
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1415"/>
+            <view key="contentView" misplaced="YES" id="Iwq-Lx-rLv">
                <rect key="frame" x="0.0" y="0.0" width="540" height="479"/>
                <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                <subviews>
@@ -41,7 +41,7 @@
                        </connections>
                    </button>
                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" textCompletion="NO" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="43" y="369" width="454" height="17"/>
+                        <rect key="frame" x="43" y="354" width="454" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
                        </constraints>
@@ -56,7 +56,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="297" width="142" height="17"/>
+                        <rect key="frame" x="8" y="283" width="142" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="138" id="Kqd-nX-7df"/>
                        </constraints>
@@ -70,7 +70,7 @@
                        </textFieldCell>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="272" width="142" height="17"/>
+                        <rect key="frame" x="8" y="259" width="142" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="138" id="3wU-P0-gAC"/>
                        </constraints>
@@ -84,7 +84,7 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="Binary Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="297" width="315" height="17"/>
+                        <rect key="frame" x="187" y="283" width="315" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="311" id="xVR-j3-dLw"/>
                        </constraints>
@@ -98,7 +98,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5" userLabel="Label: Publisher">
-                        <rect key="frame" x="8" y="247" width="142" height="17"/>
+                        <rect key="frame" x="8" y="235" width="142" height="16"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Publisher" id="yL9-yD-JXX">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -109,7 +109,7 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="Publisher" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w" userLabel="Publisher" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="247" width="315" height="17"/>
+                        <rect key="frame" x="187" y="235" width="315" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="311" id="Dem-wH-KHm"/>
                        </constraints>
@@ -127,7 +127,7 @@
                        </connections>
                    </textField>
                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
-                        <rect key="frame" x="62" y="248" width="15" height="15"/>
+                        <rect key="frame" x="62" y="235" width="15" height="15"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
@@ -149,7 +149,7 @@
                        </connections>
                    </button>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y" userLabel="Label: Identifier">
-                        <rect key="frame" x="8" y="222" width="142" height="17"/>
+                        <rect key="frame" x="8" y="212" width="142" height="16"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Identifier" id="eKN-Ic-5zy">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -160,7 +160,7 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
-                        <rect key="frame" x="187" y="222" width="219" height="17"/>
+                        <rect key="frame" x="187" y="214" width="219" height="13"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="215" id="4hh-R2-86s"/>
                        </constraints>
@@ -177,7 +177,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="MhO-U0-MLR" userLabel="Label: Bundle Identifier">
-                        <rect key="frame" x="8" y="197" width="142" height="17"/>
+                        <rect key="frame" x="8" y="191" width="142" height="16"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Bundle Identifier" id="LEe-u0-52o">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -195,7 +195,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="eQb-0a-76J" userLabel="Label: Parent">
-                        <rect key="frame" x="8" y="157" width="142" height="17"/>
+                        <rect key="frame" x="8" y="156" width="142" height="16"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Parent" id="gze-4A-1w5">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -206,7 +206,7 @@
                        </textFieldCell>
                    </textField>
                    <textField toolTip="Parent Process" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="f1p-GL-O3o" userLabel="Parent" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="157" width="294" height="17"/>
+                        <rect key="frame" x="187" y="156" width="294" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="290" id="h3Y-mO-38F"/>
                        </constraints>
@@ -229,7 +229,7 @@
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="oFj-ol-xpL" userLabel="Label: User">
-                        <rect key="frame" x="8" y="132" width="142" height="17"/>
+                        <rect key="frame" x="8" y="132" width="142" height="16"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="User" id="1ut-uT-hQD">
                            <font key="font" metaFont="systemBold"/>
                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
@@ -240,7 +240,7 @@
                        </textFieldCell>
                    </textField>
                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
-                        <rect key="frame" x="154" y="34" width="112" height="23"/>
+                        <rect key="frame" x="153" y="35" width="114" height="23"/>
                        <constraints>
                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
                        </constraints>
@@ -258,7 +258,7 @@ DQ
                        </connections>
                    </button>
                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="272" width="315" height="17"/>
+                        <rect key="frame" x="187" y="259" width="315" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="311" id="p1W-f9-KBX"/>
                        </constraints>
@@ -272,7 +272,7 @@ DQ
                        </connections>
                    </textField>
                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
-                        <rect key="frame" x="113" y="80" width="315" height="29"/>
+                        <rect key="frame" x="110" y="80" width="319" height="29"/>
                        <constraints>
                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
                        </constraints>
@@ -285,7 +285,7 @@ DQ
                        </connections>
                    </button>
                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
-                        <rect key="frame" x="278" y="34" width="110" height="23"/>
+                        <rect key="frame" x="277" y="33" width="112" height="25"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
@@ -305,7 +305,7 @@ DQ
                        </connections>
                    </button>
                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="132" width="294" height="17"/>
+                        <rect key="frame" x="187" y="132" width="294" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
                        </constraints>
@@ -322,14 +322,14 @@ DQ
                            </binding>
                        </connections>
                    </textField>
-                    <progressIndicator wantsLayer="YES" canDrawConcurrently="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" maxValue="1" bezeled="NO" controlSize="small" style="bar" translatesAutoresizingMaskIntoConstraints="NO" id="VyY-Yg-JOe">
-                        <rect key="frame" x="187" y="199" width="217" height="12"/>
+                    <progressIndicator wantsLayer="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" maxValue="1" bezeled="NO" controlSize="small" style="bar" translatesAutoresizingMaskIntoConstraints="NO" id="VyY-Yg-JOe">
+                        <rect key="frame" x="187" y="193" width="217" height="12"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="217" id="M22-Dv-KIP"/>
                        </constraints>
                    </progressIndicator>
                    <textField toolTip="Bundle SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="xP7-jE-NF8">
-                        <rect key="frame" x="187" y="197" width="219" height="17"/>
+                        <rect key="frame" x="187" y="193" width="219" height="13"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="215" id="s7W-o9-2nN"/>
                        </constraints>
@@ -346,7 +346,7 @@ DQ
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="LHV-gV-vyf">
-                        <rect key="frame" x="187" y="182" width="219" height="17"/>
+                        <rect key="frame" x="187" y="180" width="219" height="13"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="215" id="LUu-Vd-peN"/>
                        </constraints>
@@ -357,7 +357,7 @@ DQ
                        </textFieldCell>
                    </textField>
                    <box horizontalHuggingPriority="750" boxType="custom" borderType="line" title="Line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
-                        <rect key="frame" x="168" y="132" width="1" height="207"/>
+                        <rect key="frame" x="168" y="132" width="1" height="191"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="1" id="0o1-Jh-epf"/>
                        </constraints>
@@ -366,7 +366,7 @@ DQ
                        <font key="titleFont" metaFont="system"/>
                    </box>
                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="322" width="315" height="17"/>
+                        <rect key="frame" x="187" y="307" width="315" height="17"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="311" id="Pav-ZA-iAu"/>
                        </constraints>
@@ -384,7 +384,7 @@ DQ
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="pDa-fA-vnC" userLabel="Label: Application">
-                        <rect key="frame" x="8" y="322" width="142" height="17"/>
+                        <rect key="frame" x="8" y="307" width="142" height="16"/>
                        <constraints>
                            <constraint firstAttribute="width" constant="138" id="8mA-zi-Ev7"/>
                        </constraints>
@@ -405,7 +405,7 @@ DQ
                        </connections>
                    </textField>
                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
-                        <rect key="frame" x="229" y="408" width="82" height="41"/>
+                        <rect key="frame" x="229" y="392" width="82" height="40"/>
                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
                            <font key="font" metaFont="systemUltraLight" size="34"/>
                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
--- a/Source/santa/SNTBinaryMessageWindowController.h
+++ b/Source/santa/SNTBinaryMessageWindowController.h
@@ -0,0 +1,65 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <Cocoa/Cocoa.h>
+
+#import "Source/santa/SNTMessageWindowController.h"
+
+@class SNTStoredEvent;
+
+///
+///  Controller for a single message window.
+///
+@interface SNTBinaryMessageWindowController : SNTMessageWindowController
+
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message;
+
+- (IBAction)showCertInfo:(id)sender;
+- (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash;
+
+///  Reference to the "Bundle Hash" label in the XIB. Used to remove if application
+///  doesn't have a bundle hash.
+@property(weak) IBOutlet NSTextField *bundleHashLabel;
+
+///  Reference to the "Bundle Identifier" label in the XIB. Used to remove if application
+///  doesn't have a bundle hash.
+@property(weak) IBOutlet NSTextField *bundleHashTitle;
+
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSProgressIndicator *hashingIndicator;
+
+///
+/// Is displayed if calculating the bundle hash is taking a bit.
+///
+@property(weak) IBOutlet NSTextField *foundFileCountLabel;
+
+///
+///  Reference to the "Open Event" button in the XIB. Used to either remove the button
+///  if it isn't needed or set its title if it is.
+///
+@property(weak) IBOutlet NSButton *openEventButton;
+
+///
+///  The execution event that this window is for
+///
+@property(readonly) SNTStoredEvent *event;
+
+///
+///  The root progress object. Child nodes are vended to santad to report on work being done.
+///
+@property NSProgress *progress;
+
+@end
--- a/Source/santa/SNTBinaryMessageWindowController.m
+++ b/Source/santa/SNTBinaryMessageWindowController.m
@@ -0,0 +1,176 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "Source/santa/SNTBinaryMessageWindowController.h"
+
+#import <MOLCertificate/MOLCertificate.h>
+#import <SecurityInterface/SFCertificatePanel.h>
+
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTStoredEvent.h"
+#import "Source/santa/SNTMessageWindow.h"
+
+@interface SNTBinaryMessageWindowController ()
+///  The custom message to display for this event
+@property(copy) NSString *customMessage;
+
+///  A 'friendly' string representing the certificate information
+@property(readonly, nonatomic) NSString *publisherInfo;
+
+///  An optional message to display with this block.
+@property(readonly, nonatomic) NSAttributedString *attributedCustomMessage;
+
+///  Reference to the "Application Name" label in the XIB. Used to remove if application
+///  doesn't have a CFBundleName.
+@property(weak) IBOutlet NSTextField *applicationNameLabel;
+
+@end
+
+@implementation SNTBinaryMessageWindowController
+
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message {
+  self = [super initWithWindowNibName:@"MessageWindow"];
+  if (self) {
+    _event = event;
+    _customMessage = message;
+    _progress = [NSProgress discreteProgressWithTotalUnitCount:1];
+    [_progress addObserver:self
+                forKeyPath:@"fractionCompleted"
+                   options:NSKeyValueObservingOptionNew
+                   context:NULL];
+  }
+  return self;
+}
+
+- (void)dealloc {
+  [_progress removeObserver:self forKeyPath:@"fractionCompleted"];
+}
+
+- (void)observeValueForKeyPath:(NSString *)keyPath
+                      ofObject:(id)object
+                        change:(NSDictionary *)change
+                       context:(void *)context {
+  if ([keyPath isEqualToString:@"fractionCompleted"]) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+      NSProgress *progress = object;
+      if (progress.fractionCompleted != 0.0) {
+        self.hashingIndicator.indeterminate = NO;
+      }
+      self.hashingIndicator.doubleValue = progress.fractionCompleted;
+    });
+  }
+}
+
+- (void)loadWindow {
+  [super loadWindow];
+  if (![[SNTConfigurator configurator] eventDetailURL]) {
+    [self.openEventButton removeFromSuperview];
+  } else {
+    NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
+    if (eventDetailText) {
+      [self.openEventButton setTitle:eventDetailText];
+    }
+  }
+
+  if (!self.event.needsBundleHash) {
+    [self.bundleHashLabel removeFromSuperview];
+    [self.hashingIndicator removeFromSuperview];
+    [self.foundFileCountLabel removeFromSuperview];
+  } else {
+    self.openEventButton.enabled = NO;
+    self.hashingIndicator.indeterminate = YES;
+    [self.hashingIndicator startAnimation:self];
+    self.bundleHashLabel.hidden = YES;
+    self.foundFileCountLabel.stringValue = @"";
+  }
+
+  if (!self.event.fileBundleName) {
+    [self.applicationNameLabel removeFromSuperview];
+  }
+}
+
+- (NSString *)messageHash {
+  return self.event.fileSHA256;
+}
+
+- (IBAction)showCertInfo:(id)sender {
+  // SFCertificatePanel expects an NSArray of SecCertificateRef's
+  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.signingChain count]];
+  for (MOLCertificate *cert in self.event.signingChain) {
+    [certArray addObject:(id)cert.certRef];
+  }
+
+  [[[SFCertificatePanel alloc] init] beginSheetForWindow:self.window
+                                           modalDelegate:nil
+                                          didEndSelector:nil
+                                             contextInfo:nil
+                                            certificates:certArray
+                                               showGroup:YES];
+}
+
+- (IBAction)openEventDetails:(id)sender {
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
+  [self closeWindow:sender];
+  [[NSWorkspace sharedWorkspace] openURL:url];
+}
+
+#pragma mark Generated properties
+
+ (NSSet *)keyPathsForValuesAffectingValueForKey:(NSString *)key {
+  if (![key isEqualToString:@"event"]) {
+    return [NSSet setWithObject:@"event"];
+  } else {
+    return [NSSet set];
+  }
+}
+
+- (NSString *)publisherInfo {
+  MOLCertificate *leafCert = [self.event.signingChain firstObject];
+
+  if (leafCert.commonName && leafCert.orgName) {
+    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
+  } else if (leafCert.commonName) {
+    return leafCert.commonName;
+  } else if (leafCert.orgName) {
+    return leafCert.orgName;
+  } else {
+    return nil;
+  }
+}
+
+- (NSAttributedString *)attributedCustomMessage {
+  return [SNTBlockMessage attributedBlockMessageForEvent:self.event
+                                           customMessage:self.customMessage];
+}
+
+- (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash {
+  // UI updates must happen on the main thread.
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if ([self.event.idx isEqual:event.idx]) {
+      if (bundleHash) {
+        [self.bundleHashLabel setHidden:NO];
+      } else {
+        [self.bundleHashLabel removeFromSuperview];
+        [self.bundleHashTitle removeFromSuperview];
+      }
+      self.event.fileBundleHash = bundleHash;
+      [self.foundFileCountLabel removeFromSuperview];
+      [self.hashingIndicator setHidden:YES];
+      [self.openEventButton setEnabled:YES];
+    }
+  });
+}
+
+@end
--- a/Source/santa/SNTDeviceMessageWindowController.h
+++ b/Source/santa/SNTDeviceMessageWindowController.h
@@ -0,0 +1,38 @@
+/// Copyright 2021 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+#import <Cocoa/Cocoa.h>
+
+#import "Source/common/SNTDeviceEvent.h"
+#import "Source/santa/SNTMessageWindowController.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@class SNTStoredEvent;
+
+///
+///  Controller for a single message window.
+///
+@interface SNTDeviceMessageWindowController : SNTMessageWindowController
+
+@property(weak) IBOutlet NSTextField *remountArgsLabel;
+@property(weak) IBOutlet NSTextField *remountArgsTitle;
+
+// The device event this window is for.
+@property(readonly) SNTDeviceEvent *event;
+
+- (instancetype)initWithEvent:(SNTDeviceEvent *)event message:(nullable NSString *)message;
+
+@end
+
+NS_ASSUME_NONNULL_END
--- a/Source/santa/SNTDeviceMessageWindowController.m
+++ b/Source/santa/SNTDeviceMessageWindowController.m
@@ -0,0 +1,57 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "Source/santa/SNTDeviceMessageWindowController.h"
+
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTDeviceEvent.h"
+#import "Source/santa/SNTMessageWindow.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface SNTDeviceMessageWindowController ()
+@property(copy, nullable) NSString *customMessage;
+@end
+
+@implementation SNTDeviceMessageWindowController
+
+- (instancetype)initWithEvent:(SNTDeviceEvent *)event message:(nullable NSString *)message {
+  self = [super initWithWindowNibName:@"DeviceMessageWindow"];
+  if (self) {
+    _event = event;
+    _customMessage = message;
+  }
+  return self;
+}
+
+- (void)loadWindow {
+  [super loadWindow];
+  if (!self.event.remountArgs || [self.event.remountArgs count] <= 0) {
+    [self.remountArgsLabel removeFromSuperview];
+    [self.remountArgsTitle removeFromSuperview];
+  }
+}
+
+- (NSAttributedString *)attributedCustomMessage {
+  return [SNTBlockMessage formatMessage:self.customMessage];
+}
+
+- (NSString *)messageHash {
+  return self.event.mntonname;
+}
+
+@end
+
+NS_ASSUME_NONNULL_END
--- a/Source/santa/SNTMessageWindowController.h
+++ b/Source/santa/SNTMessageWindowController.h
@@ -1,73 +1,21 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
 #import <Cocoa/Cocoa.h>

-@class SNTStoredEvent;
-
@protocol SNTMessageWindowControllerDelegate
 - (void)windowDidCloseSilenceHash:(NSString *)hash;
@end

-///
-///  Controller for a single message window.
-///
@interface SNTMessageWindowController : NSWindowController

- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message;
-
 - (IBAction)showWindow:(id)sender;
 - (IBAction)closeWindow:(id)sender;
- (IBAction)showCertInfo:(id)sender;

-///  Reference to the "Bundle Hash" label in the XIB. Used to remove if application
-///  doesn't have a bundle hash.
-@property(weak) IBOutlet NSTextField *bundleHashLabel;
+/// Generate a distinct key for a given displayed event. This key is used for silencing future
+/// notifications.
+- (NSString *)messageHash;

-///  Reference to the "Bundle Identifier" label in the XIB. Used to remove if application
-///  doesn't have a bundle hash.
-@property(weak) IBOutlet NSTextField *bundleHashTitle;
+///  Linked to checkbox in UI to prevent future notifications for the given event.
+@property BOOL silenceFutureNotifications;

-///
-/// Is displayed if calculating the bundle hash is taking a bit.
-///
-@property(weak) IBOutlet NSProgressIndicator *hashingIndicator;
-
-///
-/// Is displayed if calculating the bundle hash is taking a bit.
-///
-@property(weak) IBOutlet NSTextField *foundFileCountLabel;
-
-///
-///  Reference to the "Open Event" button in the XIB. Used to either remove the button
-///  if it isn't needed or set its title if it is.
-///
-@property(weak) IBOutlet NSButton *openEventButton;
-
-///
-///  The execution event that this window is for
-///
-@property(readonly) SNTStoredEvent *event;
-
-///
-///  The root progress object. Child nodes are vended to santad to report on work being done.
-///
-@property NSProgress *progress;
-
-///
-///  The delegate to inform when the notification is dismissed
-///
@property(weak) id<SNTMessageWindowControllerDelegate> delegate;

@end
--- a/Source/santa/SNTMessageWindowController.m
+++ b/Source/santa/SNTMessageWindowController.m
@@ -1,117 +1,13 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
 #import "Source/santa/SNTMessageWindowController.h"

-#import <MOLCertificate/MOLCertificate.h>
-#import <SecurityInterface/SFCertificatePanel.h>
-
-#import "Source/common/SNTBlockMessage.h"
-#import "Source/common/SNTConfigurator.h"
-#import "Source/common/SNTStoredEvent.h"
 #import "Source/santa/SNTMessageWindow.h"

-@interface SNTMessageWindowController ()
-///  The custom message to display for this event
-@property(copy) NSString *customMessage;
-
-///  A 'friendly' string representing the certificate information
-@property(readonly, nonatomic) NSString *publisherInfo;
-
-///  An optional message to display with this block.
-@property(readonly, nonatomic) NSAttributedString *attributedCustomMessage;
-
-///  Reference to the "Application Name" label in the XIB. Used to remove if application
-///  doesn't have a CFBundleName.
-@property(weak) IBOutlet NSTextField *applicationNameLabel;
-
-///  Linked to checkbox in UI to prevent future notifications for this binary.
-@property BOOL silenceFutureNotifications;
-@end
-
@implementation SNTMessageWindowController

- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message {
-  self = [super initWithWindowNibName:@"MessageWindow"];
-  if (self) {
-    _event = event;
-    _customMessage = message;
-    _progress = [NSProgress discreteProgressWithTotalUnitCount:1];
-    [_progress addObserver:self
-                forKeyPath:@"fractionCompleted"
-                   options:NSKeyValueObservingOptionNew
-                   context:NULL];
-  }
-  return self;
-}
-
- (void)dealloc {
-  [_progress removeObserver:self forKeyPath:@"fractionCompleted"];
-}
-
- (void)observeValueForKeyPath:(NSString *)keyPath
-                      ofObject:(id)object
-                        change:(NSDictionary *)change
-                       context:(void *)context {
-  if ([keyPath isEqualToString:@"fractionCompleted"]) {
-    dispatch_async(dispatch_get_main_queue(), ^{
-      NSProgress *progress = object;
-      if (progress.fractionCompleted != 0.0) {
-        self.hashingIndicator.indeterminate = NO;
-      }
-      self.hashingIndicator.doubleValue = progress.fractionCompleted;
-    });
-  }
-}
-
- (void)loadWindow {
-  [super loadWindow];
-  [self.window setLevel:NSPopUpMenuWindowLevel];
-  [self.window setMovableByWindowBackground:YES];
-
-  if (![[SNTConfigurator configurator] eventDetailURL]) {
-    [self.openEventButton removeFromSuperview];
-  } else {
-    NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
-    if (eventDetailText) {
-      [self.openEventButton setTitle:eventDetailText];
-    }
-  }
-
-  if (!self.event.needsBundleHash) {
-    [self.bundleHashLabel removeFromSuperview];
-    [self.hashingIndicator removeFromSuperview];
-    [self.foundFileCountLabel removeFromSuperview];
-  } else {
-    self.openEventButton.enabled = NO;
-    self.hashingIndicator.indeterminate = YES;
-    [self.hashingIndicator startAnimation:self];
-    self.bundleHashLabel.hidden = YES;
-    self.foundFileCountLabel.stringValue = @"";
-  }
-
-  if (!self.event.fileBundleName) {
-    [self.applicationNameLabel removeFromSuperview];
-  }
-}
-
 - (IBAction)showWindow:(id)sender {
  [(SNTMessageWindow *)self.window fadeIn:sender];
 }
-
 - (IBAction)closeWindow:(id)sender {
-  [self.progress cancel];
  [(SNTMessageWindow *)self.window fadeOut:sender];
 }

@@ -119,60 +15,20 @@
  if (!self.delegate) return;

  if (self.silenceFutureNotifications) {
-    [self.delegate windowDidCloseSilenceHash:self.event.fileSHA256];
+    [self.delegate windowDidCloseSilenceHash:[self messageHash]];
  } else {
    [self.delegate windowDidCloseSilenceHash:nil];
  }
 }

- (IBAction)showCertInfo:(id)sender {
-  // SFCertificatePanel expects an NSArray of SecCertificateRef's
-  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.signingChain count]];
-  for (MOLCertificate *cert in self.event.signingChain) {
-    [certArray addObject:(id)cert.certRef];
-  }
-
-  [[[SFCertificatePanel alloc] init] beginSheetForWindow:self.window
-                                           modalDelegate:nil
-                                          didEndSelector:nil
-                                             contextInfo:nil
-                                            certificates:certArray
-                                               showGroup:YES];
+- (void)loadWindow {
+  [super loadWindow];
+  [self.window setLevel:NSPopUpMenuWindowLevel];
+  [self.window setMovableByWindowBackground:YES];
 }

- (IBAction)openEventDetails:(id)sender {
-  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
-  [self closeWindow:sender];
-  [[NSWorkspace sharedWorkspace] openURL:url];
-}
-
-#pragma mark Generated properties
-
-+ (NSSet *)keyPathsForValuesAffectingValueForKey:(NSString *)key {
-  if (![key isEqualToString:@"event"]) {
-    return [NSSet setWithObject:@"event"];
-  } else {
-    return [NSSet set];
-  }
-}
-
- (NSString *)publisherInfo {
-  MOLCertificate *leafCert = [self.event.signingChain firstObject];
-
-  if (leafCert.commonName && leafCert.orgName) {
-    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
-  } else if (leafCert.commonName) {
-    return leafCert.commonName;
-  } else if (leafCert.orgName) {
-    return leafCert.orgName;
-  } else {
-    return nil;
-  }
-}
-
- (NSAttributedString *)attributedCustomMessage {
-  return [SNTBlockMessage attributedBlockMessageForEvent:self.event
-                                           customMessage:self.customMessage];
+- (NSString *)messageHash {
+  return @"";
 }

@end
--- a/Source/santa/SNTNotificationManager.h
+++ b/Source/santa/SNTNotificationManager.h
@@ -15,6 +15,8 @@
 #import <Cocoa/Cocoa.h>

 #import "Source/common/SNTXPCNotifierInterface.h"
+#import "Source/santa/SNTBinaryMessageWindowController.h"
+#import "Source/santa/SNTDeviceMessageWindowController.h"
 #import "Source/santa/SNTMessageWindowController.h"

 ///
--- a/Source/santa/SNTNotificationManager.m
+++ b/Source/santa/SNTNotificationManager.m
@@ -18,10 +18,12 @@

 #import "Source/common/SNTBlockMessage.h"
 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTDeviceEvent.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #import "Source/common/SNTStrengthify.h"
 #import "Source/common/SNTXPCControlInterface.h"
+#import "Source/santa/SNTMessageWindowController.h"

@interface SNTNotificationManager ()

@@ -57,13 +59,7 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
  self.currentWindowController = nil;

  if ([self.pendingNotifications count]) {
-    self.currentWindowController = [self.pendingNotifications firstObject];
-    [self.currentWindowController showWindow:self];
-    if (self.currentWindowController.event.needsBundleHash) {
-      dispatch_async(self.hashBundleBinariesQueue, ^{
-        [self hashBundleBinariesForEvent:self.currentWindowController.event];
-      });
-    }
+    [self showQueuedWindow];
  } else {
    MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
    [bc resume];
@@ -85,6 +81,130 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
  [ud setObject:d forKey:silencedNotificationsKey];
 }

+- (BOOL)notificationAlreadyQueued:(SNTMessageWindowController *)pendingMsg {
+  for (SNTMessageWindowController *msg in self.pendingNotifications) {
+    if ([msg messageHash] == [pendingMsg messageHash]) {
+      return YES;
+    }
+  }
+  return NO;
+}
+
+- (void)queueMessage:(SNTMessageWindowController *)pendingMsg {
+  NSString *messageHash = [pendingMsg messageHash];
+  if ([self notificationAlreadyQueued:pendingMsg]) return;
+
+  // See if this message is silenced.
+  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+  NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][messageHash];
+  if ([silenceDate isKindOfClass:[NSDate class]]) {
+    NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
+    if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
+      LOGI(@"Notification silence: date is in the future, ignoring");
+      [self updateSilenceDate:nil forHash:messageHash];
+    } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
+      LOGI(@"Notification silence: date is more than one day ago, ignoring");
+      [self updateSilenceDate:nil forHash:messageHash];
+    } else {
+      LOGI(@"Notification silence: dropping notification for %@", messageHash);
+      return;
+    }
+  }
+
+  pendingMsg.delegate = self;
+  [self.pendingNotifications addObject:pendingMsg];
+
+  if (!self.currentWindowController) {
+    [self showQueuedWindow];
+  }
+}
+
+- (void)showQueuedWindow {
+  // Notifications arrive on a background thread but UI updates must happen on the main thread.
+  // This includes making windows.
+  dispatch_async(dispatch_get_main_queue(), ^{
+    // If a notification isn't currently being displayed, display the incoming one.
+    // This check will generally be redundant, as we'd generally want to check this prior to
+    // starting work on the main thread.
+    if (!self.currentWindowController) {
+      self.currentWindowController = [self.pendingNotifications firstObject];
+      [self.currentWindowController showWindow:self];
+
+      if ([self.currentWindowController isKindOfClass:[SNTBinaryMessageWindowController class]]) {
+        SNTBinaryMessageWindowController *controller =
+          (SNTBinaryMessageWindowController *)self.currentWindowController;
+        dispatch_async(self.hashBundleBinariesQueue, ^{
+          [self hashBundleBinariesForEvent:controller.event withController:controller];
+        });
+      }
+    }
+  });
+}
+
+- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event
+                    withController:(SNTBinaryMessageWindowController *)withController {
+  withController.foundFileCountLabel.stringValue = @"Searching for files...";
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+  bc.acceptedHandler = ^{
+    dispatch_semaphore_signal(sema);
+  };
+  [bc resume];
+
+  // Wait a max of 5 secs for the bundle service
+  // Otherwise abandon bundle hashing and display the blockable event.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
+    [withController updateBlockNotification:event withBundleHash:nil];
+    return;
+  }
+
+  [[bc remoteObjectProxy] setNotificationListener:self.notificationListener];
+
+  // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
+  [withController.progress becomeCurrentWithPendingUnitCount:100];
+
+  // Start hashing. Progress is reported to the root NSProgress
+  // (currentWindowController.progress).
+  [[bc remoteObjectProxy]
+    hashBundleBinariesForEvent:event
+                         reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
+                           // Revert to displaying the blockable event if we fail to calculate the
+                           // bundle hash
+                           if (!bh)
+                             return [withController updateBlockNotification:event
+                                                             withBundleHash:nil];
+
+                           event.fileBundleHash = bh;
+                           event.fileBundleBinaryCount = @(events.count);
+                           event.fileBundleHashMilliseconds = ms;
+                           event.fileBundleExecutableRelPath =
+                             [events.firstObject fileBundleExecutableRelPath];
+                           for (SNTStoredEvent *se in events) {
+                             se.fileBundleHash = bh;
+                             se.fileBundleBinaryCount = @(events.count);
+                             se.fileBundleHashMilliseconds = ms;
+                           }
+
+                           // Send the results to santad. It will decide if they need to be
+                           // synced.
+                           MOLXPCConnection *daemonConn =
+                             [SNTXPCControlInterface configuredConnection];
+                           [daemonConn resume];
+                           [[daemonConn remoteObjectProxy] syncBundleEvent:event
+                                                             relatedEvents:events];
+                           [daemonConn invalidate];
+
+                           // Update the UI with the bundle hash. Also make the openEventButton
+                           // available.
+                           [withController updateBlockNotification:event withBundleHash:bh];
+
+                           [bc invalidate];
+                         }];
+
+  [withController.progress resignCurrent];
+}
+
 #pragma mark SNTNotifierXPC protocol methods

 - (void)postClientModeNotification:(SNTClientMode)clientmode {
@@ -113,52 +233,15 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 }

 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
-  // See if this binary is already in the list of pending notifications.
-  NSPredicate *predicate =
-    [NSPredicate predicateWithFormat:@"event.fileSHA256==%@", event.fileSHA256];
-  if ([[self.pendingNotifications filteredArrayUsingPredicate:predicate] count]) return;
-
-  // See if this binary is silenced.
-  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
-  NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][event.fileSHA256];
-  if ([silenceDate isKindOfClass:[NSDate class]]) {
-    NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
-    if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
-      LOGI(@"Notification silence: date is in the future, ignoring");
-      [self updateSilenceDate:nil forHash:event.fileSHA256];
-    } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
-      LOGI(@"Notification silence: date is more than one day ago, ignoring");
-      [self updateSilenceDate:nil forHash:event.fileSHA256];
-    } else {
-      LOGI(@"Notification silence: dropping notification for %@", event.fileSHA256);
-      return;
-    }
-  }
-
  if (!event) {
    LOGI(@"Error: Missing event object in message received from daemon!");
    return;
  }

-  // Notifications arrive on a background thread but UI updates must happen on the main thread.
-  // This includes making windows.
-  dispatch_async(dispatch_get_main_queue(), ^{
-    SNTMessageWindowController *pendingMsg =
-      [[SNTMessageWindowController alloc] initWithEvent:event andMessage:message];
-    pendingMsg.delegate = self;
-    [self.pendingNotifications addObject:pendingMsg];
+  SNTBinaryMessageWindowController *pendingMsg =
+    [[SNTBinaryMessageWindowController alloc] initWithEvent:event andMessage:message];

-    // If a notification isn't currently being displayed, display the incoming one.
-    if (!self.currentWindowController) {
-      self.currentWindowController = pendingMsg;
-      [pendingMsg showWindow:nil];
-      if (self.currentWindowController.event.needsBundleHash) {
-        dispatch_async(self.hashBundleBinariesQueue, ^{
-          [self hashBundleBinariesForEvent:self.currentWindowController.event];
-        });
-      }
-    }
-  });
+  [self queueMessage:pendingMsg];
 }

 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message {
@@ -169,98 +252,35 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
 }

+- (void)postUSBBlockNotification:(SNTDeviceEvent *)event withCustomMessage:(NSString *)message {
+  if (!event) {
+    LOGI(@"Error: Missing event object in message received from daemon!");
+    return;
+  }
+  SNTDeviceMessageWindowController *pendingMsg =
+    [[SNTDeviceMessageWindowController alloc] initWithEvent:event message:message];
+
+  [self queueMessage:pendingMsg];
+}
+
 #pragma mark SNTBundleNotifierXPC protocol methods

 - (void)updateCountsForEvent:(SNTStoredEvent *)event
                 binaryCount:(uint64_t)binaryCount
                   fileCount:(uint64_t)fileCount
                 hashedCount:(uint64_t)hashedCount {
-  if ([self.currentWindowController.event.idx isEqual:event.idx]) {
-    dispatch_async(dispatch_get_main_queue(), ^{
-      self.currentWindowController.foundFileCountLabel.stringValue =
-        [NSString stringWithFormat:@"%llu binaries / %llu %@", binaryCount,
-                                   hashedCount ?: fileCount, hashedCount ? @"hashed" : @"files"];
-    });
-  }
-}
+  if ([self.currentWindowController isKindOfClass:[SNTBinaryMessageWindowController class]]) {
+    SNTBinaryMessageWindowController *controller =
+      (SNTBinaryMessageWindowController *)self.currentWindowController;

-#pragma mark SNTBundleNotifierXPC helper methods
-
- (void)hashBundleBinariesForEvent:(SNTStoredEvent *)event {
-  self.currentWindowController.foundFileCountLabel.stringValue = @"Searching for files...";
-
-  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
-  MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
-  bc.acceptedHandler = ^{
-    dispatch_semaphore_signal(sema);
-  };
-  [bc resume];
-
-  // Wait a max of 5 secs for the bundle service
-  // Otherwise abandon bundle hashing and display the blockable event.
-  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self updateBlockNotification:event withBundleHash:nil];
-    return;
-  }
-
-  [[bc remoteObjectProxy] setNotificationListener:self.notificationListener];
-
-  // NSProgress becomes current for this thread. XPC messages vend a child node to the receiver.
-  [self.currentWindowController.progress becomeCurrentWithPendingUnitCount:100];
-
-  // Start hashing. Progress is reported to the root NSProgress (currentWindowController.progress).
-  [[bc remoteObjectProxy]
-    hashBundleBinariesForEvent:event
-                         reply:^(NSString *bh, NSArray<SNTStoredEvent *> *events, NSNumber *ms) {
-                           // Revert to displaying the blockable event if we fail to calculate the
-                           // bundle hash
-                           if (!bh) return [self updateBlockNotification:event withBundleHash:nil];
-
-                           event.fileBundleHash = bh;
-                           event.fileBundleBinaryCount = @(events.count);
-                           event.fileBundleHashMilliseconds = ms;
-                           event.fileBundleExecutableRelPath =
-                             [events.firstObject fileBundleExecutableRelPath];
-                           for (SNTStoredEvent *se in events) {
-                             se.fileBundleHash = bh;
-                             se.fileBundleBinaryCount = @(events.count);
-                             se.fileBundleHashMilliseconds = ms;
-                           }
-
-                           // Send the results to santad. It will decide if they need to be
-                           // synced.
-                           MOLXPCConnection *daemonConn =
-                             [SNTXPCControlInterface configuredConnection];
-                           [daemonConn resume];
-                           [[daemonConn remoteObjectProxy] syncBundleEvent:event
-                                                             relatedEvents:events];
-                           [daemonConn invalidate];
-
-                           // Update the UI with the bundle hash. Also make the openEventButton
-                           // available.
-                           [self updateBlockNotification:event withBundleHash:bh];
-
-                           [bc invalidate];
-                         }];
-
-  [self.currentWindowController.progress resignCurrent];
-}
-
- (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash {
-  dispatch_async(dispatch_get_main_queue(), ^{
-    if ([self.currentWindowController.event.idx isEqual:event.idx]) {
-      if (bundleHash) {
-        [self.currentWindowController.bundleHashLabel setHidden:NO];
-      } else {
-        [self.currentWindowController.bundleHashLabel removeFromSuperview];
-        [self.currentWindowController.bundleHashTitle removeFromSuperview];
-      }
-      self.currentWindowController.event.fileBundleHash = bundleHash;
-      [self.currentWindowController.foundFileCountLabel removeFromSuperview];
-      [self.currentWindowController.hashingIndicator setHidden:YES];
-      [self.currentWindowController.openEventButton setEnabled:YES];
+    if ([controller.event.idx isEqual:event.idx]) {
+      dispatch_async(dispatch_get_main_queue(), ^{
+        controller.foundFileCountLabel.stringValue =
+          [NSString stringWithFormat:@"%llu binaries / %llu %@", binaryCount,
+                                     hashedCount ?: fileCount, hashedCount ? @"hashed" : @"files"];
+      });
    }
-  });
+  }
 }

@end
--- a/Source/santactl/Commands/SNTCommandStatus.m
+++ b/Source/santactl/Commands/SNTCommandStatus.m
@@ -188,6 +188,10 @@ REGISTER_COMMAND_NAME(@"status")
        @"watchdog_ram_events" : @(ramEvents),
        @"watchdog_cpu_peak" : @(cpuPeak),
        @"watchdog_ram_peak" : @(ramPeak),
+        @"block_usb" : @(configurator.blockUSBMount),
+        @"remount_usb_mode" : (configurator.blockUSBMount && configurator.remountUSBMode.count
+                                 ? configurator.remountUSBMode
+                                 : @""),
      },
      @"database" : @{
        @"binary_rules" : @(binaryRuleCount),
@@ -229,6 +233,14 @@ REGISTER_COMMAND_NAME(@"status")
      printf("  %-25s | %lld\n", "Root cache count", rootCacheCount);
      printf("  %-25s | %lld\n", "Non-root cache count", nonRootCacheCount);
    }
+
+    printf("  %-25s | %s\n", "USB Blocking", (configurator.blockUSBMount ? "Yes" : "No"));
+
+    if (configurator.blockUSBMount && configurator.remountUSBMode.count > 0) {
+      printf("  %-25s | %s\n", "USB Remounting Mode:",
+             [[configurator.remountUSBMode componentsJoinedByString:@", "] UTF8String]);
+    }
+
    printf(">>> Database Info\n");
    printf("  %-25s | %lld\n", "Binary Rules", binaryRuleCount);
    printf("  %-25s | %lld\n", "Certificate Rules", certRuleCount);
--- a/Source/santactl/Commands/SNTCommandVersion.m
+++ b/Source/santactl/Commands/SNTCommandVersion.m
@@ -90,18 +90,25 @@ REGISTER_COMMAND_NAME(@"version")
  return @"not found";
 }

+- (NSString *)composeVersionsFromDict:(NSDictionary *)dict {
+  if (!dict[@"CFBundleVersion"]) return @"";
+  NSString *productVersion = dict[@"CFBundleShortVersionString"];
+  NSString *buildVersion = [[dict[@"CFBundleVersion"] componentsSeparatedByString:@"."] lastObject];
+  return [NSString stringWithFormat:@"%@ (build %@)", productVersion, buildVersion];
+}
+
 - (NSString *)santadVersion {
  SNTFileInfo *daemonInfo = [[SNTFileInfo alloc] initWithPath:@(kSantaDPath)];
-  return daemonInfo.bundleVersion ?: @"";
+  return [self composeVersionsFromDict:daemonInfo.infoPlist];
 }

 - (NSString *)santaAppVersion {
  SNTFileInfo *guiInfo = [[SNTFileInfo alloc] initWithPath:@(kSantaAppPath)];
-  return guiInfo.bundleVersion ?: @"";
+  return [self composeVersionsFromDict:guiInfo.infoPlist];
 }

 - (NSString *)santactlVersion {
-  return [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"] ?: @"";
+  return [self composeVersionsFromDict:[[NSBundle mainBundle] infoDictionary]];
 }

@end
--- a/Source/santad/BUILD
+++ b/Source/santad/BUILD
@@ -58,6 +58,7 @@ objc_library(
        "//Source/common:SNTCachedDecision",
        "//Source/common:SNTCommonEnums",
        "//Source/common:SNTConfigurator",
+        "//Source/common:SNTDeviceEvent",
        "//Source/common:SNTDropRootPrivs",
        "//Source/common:SNTFileInfo",
        "//Source/common:SNTKernelCommon",
--- a/Source/santad/EventProviders/SNTDeviceManager.h
+++ b/Source/santad/EventProviders/SNTDeviceManager.h
@@ -16,6 +16,12 @@

 #include <EndpointSecurity/EndpointSecurity.h>

+#include "Source/common/SNTDeviceEvent.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+typedef void (^SNTDeviceBlockCallback)(SNTDeviceEvent *event);
+
 /*
 * Manages DiskArbitration and EndpointSecurity to monitor/block/remount USB
 * storage devices.
@@ -25,9 +31,12 @@
@property(nonatomic, readwrite) BOOL subscribed;
@property(nonatomic, readwrite) BOOL blockUSBMount;
@property(nonatomic, readwrite, nullable) NSArray<NSString *> *remountArgs;
+@property(nonatomic, nullable) SNTDeviceBlockCallback deviceBlockCallback;

- (instancetype _Nonnull)init;
+- (instancetype)init;
 - (void)listen;
 - (BOOL)subscribed;

@end
+
+NS_ASSUME_NONNULL_END
--- a/Source/santad/EventProviders/SNTDeviceManager.mm
+++ b/Source/santad/EventProviders/SNTDeviceManager.mm
@@ -23,6 +23,7 @@
 #include <atomic>
 #include <memory>

+#import "Source/common/SNTDeviceEvent.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/santad/Logs/SNTEventLog.h"

@@ -105,6 +106,8 @@ long mountArgsToMask(NSArray<NSString *> *args) {
  return flags;
 }

+NS_ASSUME_NONNULL_BEGIN
+
@interface SNTDeviceManager ()

@property DASessionRef diskArbSession;
@@ -115,7 +118,7 @@ long mountArgsToMask(NSArray<NSString *> *args) {

@implementation SNTDeviceManager

- (instancetype _Nonnull)init API_AVAILABLE(macos(10.15)) {
+- (instancetype)init API_AVAILABLE(macos(10.15)) {
  self = [super init];
  if (self) {
    _blockUSBMount = false;
@@ -216,9 +219,14 @@ long mountArgsToMask(NSArray<NSString *> *args) {
    return;
  }

+  SNTDeviceEvent *event = [[SNTDeviceEvent alloc]
+    initWithOnName:[NSString stringWithUTF8String:m->event.mount.statfs->f_mntonname]
+          fromName:[NSString stringWithUTF8String:m->event.mount.statfs->f_mntfromname]];
+
  BOOL shouldRemount = self.remountArgs != nil && [self.remountArgs count] > 0;

  if (shouldRemount) {
+    event.remountArgs = self.remountArgs;
    long remountOpts = mountArgsToMask(self.remountArgs);
    if (mountMode & remountOpts) {
      es_respond_auth_result(self.client, m, ES_AUTH_RESULT_ALLOW, false);
@@ -231,6 +239,11 @@ long mountArgsToMask(NSArray<NSString *> *args) {
         newMode);
    [self remount:disk mountMode:newMode];
  }
+
+  if (self.deviceBlockCallback) {
+    self.deviceBlockCallback(event);
+  }
+
  es_respond_auth_result(self.client, m, ES_AUTH_RESULT_DENY, false);
 }

@@ -298,3 +311,5 @@ long mountArgsToMask(NSArray<NSString *> *args) {
 }

@end
+
+NS_ASSUME_NONNULL_END
--- a/Source/santad/EventProviders/SNTDeviceManagerTest.mm
+++ b/Source/santad/EventProviders/SNTDeviceManagerTest.mm
@@ -19,6 +19,7 @@
 #include <sys/mount.h>

 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTDeviceEvent.h"
 #import "Source/santad/EventProviders/SNTDeviceManager.h"

 #import "Source/santad/EventProviders/DiskArbitrationTestUtil.h"
@@ -132,10 +133,28 @@
  deviceManager.blockUSBMount = YES;
  deviceManager.remountArgs = @[ @"noexec", @"rdonly" ];

+  XCTestExpectation *expectation =
+    [self expectationWithDescription:@"Wait for SNTDeviceManager's blockCallback to trigger"];
+
+  __block NSString *gotmntonname, *gotmntfromname;
+  __block NSArray<NSString *> *gotRemountedArgs;
+  deviceManager.deviceBlockCallbacks = ^(SNTDeviceEvent *event) {
+    gotRemountedArgs = event.remountArgs;
+    gotmntonname = event.mntonname;
+    gotmntfromname = event.mntfromname;
+    [expectation fulfill];
+  };
+
  ESResponse *got = [self triggerTestMount:deviceManager mockES:mockES mockDA:mockDA];

  XCTAssertEqual(got.result, ES_AUTH_RESULT_DENY);
  XCTAssertEqual(mockDA.wasRemounted, YES);
+
+  [self waitForExpectations:@[ expectation ] timeout:60.0];
+
+  XCTAssertEqualObjects(gotRemountedArgs, deviceManager.remountArgs);
+  XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");
+  XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");
 }

 - (void)testBlockNoRemount {
@@ -148,10 +167,27 @@
  SNTDeviceManager *deviceManager = [[SNTDeviceManager alloc] init];
  deviceManager.blockUSBMount = YES;

+  XCTestExpectation *expectation =
+    [self expectationWithDescription:@"Wait for SNTDeviceManager's blockCallback to trigger"];
+
+  __block NSString *gotmntonname, *gotmntfromname;
+  __block NSArray<NSString *> *gotRemountedArgs;
+  deviceManager.deviceBlockCallbacks = ^(SNTDeviceEvent *event) {
+    gotRemountedArgs = event.remountArgs;
+    gotmntonname = event.mntonname;
+    gotmntfromname = event.mntfromname;
+    [expectation fulfill];
+  };
+
  ESResponse *got = [self triggerTestMount:deviceManager mockES:mockES mockDA:mockDA];

  XCTAssertEqual(got.result, ES_AUTH_RESULT_DENY);
-  XCTAssertEqual(mockDA.wasRemounted, NO);
+
+  [self waitForExpectations:@[ expectation ] timeout:60.0];
+
+  XCTAssertNil(gotRemountedArgs);
+  XCTAssertEqualObjects(gotmntonname, @"/Volumes/KATE'S 4G");
+  XCTAssertEqualObjects(gotmntfromname, @"/dev/disk2s1");
 }

@end
--- a/Source/santad/EventProviders/SNTEndpointSecurityManager.h
+++ b/Source/santad/EventProviders/SNTEndpointSecurityManager.h
@@ -19,9 +19,6 @@

 #include <EndpointSecurity/EndpointSecurity.h>

-// Gleaned from https://opensource.apple.com/source/xnu/xnu-4903.241.1/bsd/sys/proc_internal.h
-const pid_t PID_MAX = 99999;
-
@interface SNTEndpointSecurityManager : NSObject <SNTEventProvider>
 - (santa_vnode_id_t)vnodeIDForFile:(es_file_t *)file;

@@ -29,6 +26,10 @@ const pid_t PID_MAX = 99999;
 - (void)setIsCompilerPID:(pid_t)pid;
 - (void)setNotCompilerPID:(pid_t)pid;

+// Returns YES if the path was truncated.
+// The populated buffer will be NUL terminated.
+ (BOOL)populateBufferFromESFile:(es_file_t *)file buffer:(char *)buffer size:(size_t)size;
+
@property(nonatomic, copy) void (^decisionCallback)(santa_message_t);
@property(nonatomic, copy) void (^logCallback)(santa_message_t);
@property(readonly, nonatomic) es_client_t *client;
--- a/Source/santad/EventProviders/SNTEndpointSecurityManager.mm
+++ b/Source/santad/EventProviders/SNTEndpointSecurityManager.mm
@@ -24,6 +24,9 @@
 #include <libproc.h>
 #include <atomic>

+// Gleaned from https://opensource.apple.com/source/xnu/xnu-4903.241.1/bsd/sys/proc_internal.h
+static const pid_t PID_MAX = 99999;
+
@interface SNTEndpointSecurityManager () {
  std::atomic<bool> _compilerPIDs[PID_MAX];
 }
@@ -111,9 +114,9 @@
          // Create a transitive rule if the file was modified by a running compiler
          if ([self isCompilerPID:pid]) {
            santa_message_t sm = {};
-            BOOL truncated = [self populateBufferFromESFile:m->event.close.target
-                                                     buffer:sm.path
-                                                       size:sizeof(sm.path)];
+            BOOL truncated = [SNTEndpointSecurityManager populateBufferFromESFile:m->event.close.target
+                                                                           buffer:sm.path
+                                                                             size:sizeof(sm.path)];
            if (truncated) {
              LOGE(@"CLOSE: error creating transitive rule, the path is truncated: path=%s pid=%d",
                   sm.path, pid);
@@ -373,10 +376,9 @@
      targetProcess = m->process;
      NSString *p = @(m->event.link.target_dir->path.data);
      p = [p stringByAppendingPathComponent:@(m->event.link.target_filename.data)];
-      [self populateBufferFromString:p.UTF8String
-                              length:p.length
-                              buffer:sm.newpath
-                                size:sizeof(sm.newpath)];
+      [SNTEndpointSecurityManager populateBufferFromString:p.UTF8String
+                                                    buffer:sm.newpath
+                                                      size:sizeof(sm.newpath)];
      callback = self.logCallback;
      break;
    }
@@ -395,7 +397,9 @@

  // Deny auth exec events if the path doesn't fit in the santa message.
  // TODO(bur/rah): Add support for larger paths.
-  if ([self populateBufferFromESFile:targetFile buffer:sm.path size:sizeof(sm.path)] &&
+  if ([SNTEndpointSecurityManager populateBufferFromESFile:targetFile
+                                                    buffer:sm.path
+                                                      size:sizeof(sm.path)] &&
      m->event_type == ES_EVENT_TYPE_AUTH_EXEC) {
    LOGE(@"path is truncated, deny: %s", sm.path);
    es_respond_auth_result(self.client, m, ES_AUTH_RESULT_DENY, false);
@@ -523,22 +527,17 @@
 #pragma mark helpers

 // Returns YES if the path was truncated.
-// The populated path will be NUL terminated.
- (BOOL)populateBufferFromESFile:(es_file_t *)file buffer:(char *)buffer size:(size_t)size {
-  return [self populateBufferFromString:file->path.data
-                                 length:file->path.length
-                                 buffer:buffer
-                                   size:size];
+// The populated buffer will be NUL terminated.
+ (BOOL)populateBufferFromESFile:(es_file_t *)file buffer:(char *)buffer size:(size_t)size {
+  return [SNTEndpointSecurityManager populateBufferFromString:file->path.data
+                                                       buffer:buffer
+                                                         size:size];
 }

 // Returns YES if the path was truncated.
-// The populated path will be NUL terminated.
- (BOOL)populateBufferFromString:(const char *)string
-                          length:(size_t)length
-                          buffer:(char *)buffer
-                            size:(size_t)size {
-  if (length++ > size) length = size;
-  return strlcpy(buffer, string, length) >= length;
+// The populated buffer will be NUL terminated.
+ (BOOL)populateBufferFromString:(const char *)string buffer:(char *)buffer size:(size_t)size {
+  return strlcpy(buffer, string, size) >= size;
 }

 - (BOOL)populateRenamedNewPathFromESMessage:(es_event_rename_t)mv
@@ -549,16 +548,15 @@
    case ES_DESTINATION_TYPE_NEW_PATH: {
      NSString *p = @(mv.destination.new_path.dir->path.data);
      p = [p stringByAppendingPathComponent:@(mv.destination.new_path.filename.data)];
-      truncated = [self populateBufferFromString:p.UTF8String
-                                          length:p.length
-                                          buffer:buffer
-                                            size:size];
+      truncated = [SNTEndpointSecurityManager populateBufferFromString:p.UTF8String
+                                                                buffer:buffer
+                                                                  size:size];
      break;
    }
    case ES_DESTINATION_TYPE_EXISTING_FILE: {
-      truncated = [self populateBufferFromESFile:mv.destination.existing_file
-                                          buffer:buffer
-                                            size:size];
+      truncated = [SNTEndpointSecurityManager populateBufferFromESFile:mv.destination.existing_file
+                                                                buffer:buffer
+                                                                  size:size];
      break;
    }
  }
--- a/Source/santad/Logs/SNTSyslogEventLog.m
+++ b/Source/santad/Logs/SNTSyslogEventLog.m
@@ -21,6 +21,7 @@
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
+#import "Source/santad/EventProviders/SNTEndpointSecurityManager.h"

@implementation SNTSyslogEventLog

@@ -66,10 +67,11 @@
  char ppath[PATH_MAX] = "(null)";
  if (message.es_message) {
    es_message_t *m = message.es_message;
-    es_string_token_t path = m->process->executable->path;
-    strlcpy(ppath, path.data, sizeof(ppath));
+    [SNTEndpointSecurityManager populateBufferFromESFile:m->process->executable
+                                                  buffer:ppath
+                                                    size:sizeof(ppath)];
  } else {
-    proc_pidpath(message.pid, ppath, PATH_MAX);
+    proc_pidpath(message.pid, ppath, sizeof(ppath));
  }

  [outStr
--- a/Source/santad/SNTApplication.m
+++ b/Source/santad/SNTApplication.m
@@ -19,6 +19,7 @@

 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTDeviceEvent.h"
 #import "Source/common/SNTDropRootPrivs.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTMetricSet.h"
@@ -92,12 +93,26 @@
      return nil;
    }

-    _deviceManager = [[SNTDeviceManager alloc] init];
-    self.deviceManager.blockUSBMount = [configurator blockUSBMount];
+    self.notQueue = [[SNTNotificationQueue alloc] init];
+
+    SNTDeviceManager *deviceManager = [[SNTDeviceManager alloc] init];
+    deviceManager.blockUSBMount = [configurator blockUSBMount];
    if ([configurator remountUSBMode] != nil) {
-      self.deviceManager.remountArgs = [configurator remountUSBMode];
+      deviceManager.remountArgs = [configurator remountUSBMode];
    }

+    NSString *deviceBlockMsg = deviceManager.remountArgs != nil
+                                 ? [configurator remountUSBBlockMessage]
+                                 : [configurator bannedUSBBlockMessage];
+
+    deviceManager.deviceBlockCallback = ^(SNTDeviceEvent *event) {
+      [[self.notQueue.notifierConnection remoteObjectProxy]
+        postUSBBlockNotification:event
+               withCustomMessage:deviceBlockMsg];
+    };
+
+    _deviceManager = deviceManager;
+
    dispatch_async(dispatch_get_global_queue(QOS_CLASS_BACKGROUND, 0), ^{
      // The filter is reset when santad disconnects from the driver.
      // Add the default filters.
@@ -107,7 +122,6 @@
      [self.eventProvider fileModificationPrefixFilterAdd:[configurator fileChangesPrefixFilters]];
    });

-    self.notQueue = [[SNTNotificationQueue alloc] init];
    SNTSyncdQueue *syncdQueue = [[SNTSyncdQueue alloc] init];

    // Restart santactl if it goes down
--- a/Source/santad/SNTExecutionController.h
+++ b/Source/santad/SNTExecutionController.h
@@ -33,6 +33,7 @@ const static NSString *kAllowTransitive = @"AllowTransitive";
 const static NSString *kUnknownEventState = @"Unknown";
 const static NSString *kBlockPrinterWorkaround = @"BlockPrinterWorkaround";
 const static NSString *kAllowNoFileInfo = @"AllowNoFileInfo";
+const static NSString *kDenyNoFileInfo = @"DenyNoFileInfo";
 const static NSString *kAllowNullVNode = @"AllowNullVNode";

@class MOLCodesignChecker;
--- a/Source/santad/SNTExecutionController.m
+++ b/Source/santad/SNTExecutionController.m
@@ -130,12 +130,19 @@ static NSString *const kPrinterProxyPostMonterey =
    return;
  }

+  SNTConfigurator *config = [SNTConfigurator configurator];
+
  NSError *fileInfoError;
  SNTFileInfo *binInfo = [[SNTFileInfo alloc] initWithPath:@(message.path) error:&fileInfoError];
  if (unlikely(!binInfo)) {
    LOGE(@"Failed to read file %@: %@", @(message.path), fileInfoError.localizedDescription);
-    [self.eventProvider postAction:ACTION_RESPOND_ALLOW forMessage:message];
-    [self.events incrementForFieldValues:@[ (NSString *)kAllowNoFileInfo ]];
+    if (config.failClosed && config.clientMode == SNTClientModeLockdown) {
+      [self.eventProvider postAction:ACTION_RESPOND_DENY forMessage:message];
+      [self.events incrementForFieldValues:@[ (NSString *)kDenyNoFileInfo ]];
+    } else {
+      [self.eventProvider postAction:ACTION_RESPOND_ALLOW forMessage:message];
+      [self.events incrementForFieldValues:@[ (NSString *)kAllowNoFileInfo ]];
+    }
    return;
  }

@@ -224,7 +231,7 @@ static NSString *const kPrinterProxyPostMonterey =
    se.quarantineAgentBundleID = binInfo.quarantineAgentBundleID;

    // Only store events if there is a sync server configured.
-    if ([SNTConfigurator configurator].syncBaseURL) {
+    if (config.syncBaseURL) {
      dispatch_async(_eventQueue, ^{
        [self.eventTable addStoredEvent:se];
      });
@@ -234,13 +241,13 @@ static NSString *const kPrinterProxyPostMonterey =
    if (action != ACTION_RESPOND_ALLOW && action != ACTION_RESPOND_ALLOW_COMPILER) {
      [[SNTEventLog logger] logDeniedExecution:cd withMessage:message];

-      if ([[SNTConfigurator configurator] enableBundles] && binInfo.bundle) {
+      if (config.enableBundles && binInfo.bundle) {
        // If the binary is part of a bundle, find and hash all the related binaries in the bundle.
        // Let the GUI know hashing is needed. Once the hashing is complete the GUI will send a
        // message to santad to perform the upload logic for bundles.
        // See syncBundleEvent:relatedEvents: for more info.
        se.needsBundleHash = YES;
-      } else if ([[SNTConfigurator configurator] syncBaseURL]) {
+      } else if (config.syncBaseURL) {
        // So the server has something to show the user straight away, initiate an event
        // upload for the blocked binary rather than waiting for the next sync.
        dispatch_async(_eventQueue, ^{
--- a/Source/santad/SNTExecutionControllerTest.m
+++ b/Source/santad/SNTExecutionControllerTest.m
@@ -95,12 +95,11 @@
  NSDictionary *eventCounter = [metricSet export][@"metrics"][@"/santa/events"];
  BOOL foundField;
  for (NSDictionary *fieldValue in eventCounter[@"fields"][@"action_response"]) {
-    if ([expectedFieldValueName isEqualToString:fieldValue[@"value"]]) {
-      XCTAssertEqualObjects(expectedValue, fieldValue[@"data"],
-                            @"%@ counter does not match expected value", expectedFieldValueName);
-      foundField = YES;
-      break;
-    }
+    if (![expectedFieldValueName isEqualToString:fieldValue[@"value"]]) continue;
+    XCTAssertEqualObjects(expectedValue, fieldValue[@"data"],
+                          @"%@ counter does not match expected value", expectedFieldValueName);
+    foundField = YES;
+    break;
  }

  if (!foundField) {
@@ -277,6 +276,54 @@
  [self checkMetricCounters:kAllowUnknown expected:@1];
 }

+- (void)testUnreadableFailOpenLockdown {
+  // Undo the default mocks
+  [self.mockFileInfo stopMocking];
+  self.mockFileInfo = OCMClassMock([SNTFileInfo class]);
+
+  OCMStub([self.mockFileInfo alloc]).andReturn(nil);
+  OCMStub([self.mockFileInfo initWithPath:OCMOCK_ANY error:[OCMArg setTo:nil]]).andReturn(nil);
+
+  // Lockdown mode, no fail-closed
+  OCMStub([self.mockConfigurator failClosed]).andReturn(NO);
+  OCMStub([self.mockConfigurator clientMode]).andReturn(SNTClientModeLockdown);
+  [self.sut validateBinaryWithMessage:[self getMessage]];
+  OCMVerify([self.mockDriverManager postAction:ACTION_RESPOND_ALLOW forMessage:[self getMessage]]);
+  [self checkMetricCounters:kAllowNoFileInfo expected:@2];
+}
+
+- (void)testUnreadableFailClosedLockdown {
+  // Undo the default mocks
+  [self.mockFileInfo stopMocking];
+  self.mockFileInfo = OCMClassMock([SNTFileInfo class]);
+
+  OCMStub([self.mockFileInfo alloc]).andReturn(nil);
+  OCMStub([self.mockFileInfo initWithPath:OCMOCK_ANY error:[OCMArg setTo:nil]]).andReturn(nil);
+
+  // Lockdown mode, fail-closed
+  OCMStub([self.mockConfigurator failClosed]).andReturn(YES);
+  OCMStub([self.mockConfigurator clientMode]).andReturn(SNTClientModeLockdown);
+  [self.sut validateBinaryWithMessage:[self getMessage]];
+  OCMVerify([self.mockDriverManager postAction:ACTION_RESPOND_DENY forMessage:[self getMessage]]);
+  [self checkMetricCounters:kDenyNoFileInfo expected:@1];
+}
+
+- (void)testUnreadableFailClosedMonitor {
+  // Undo the default mocks
+  [self.mockFileInfo stopMocking];
+  self.mockFileInfo = OCMClassMock([SNTFileInfo class]);
+
+  OCMStub([self.mockFileInfo alloc]).andReturn(nil);
+  OCMStub([self.mockFileInfo initWithPath:OCMOCK_ANY error:[OCMArg setTo:nil]]).andReturn(nil);
+
+  // Monitor mode, fail-closed
+  OCMStub([self.mockConfigurator failClosed]).andReturn(YES);
+  OCMStub([self.mockConfigurator clientMode]).andReturn(SNTClientModeMonitor);
+  [self.sut validateBinaryWithMessage:[self getMessage]];
+  OCMVerify([self.mockDriverManager postAction:ACTION_RESPOND_ALLOW forMessage:[self getMessage]]);
+  [self checkMetricCounters:kAllowNoFileInfo expected:@1];
+}
+
 - (void)testMissingShasum {
  [self.sut validateBinaryWithMessage:[self getMessage]];
  OCMVerify([self.mockDriverManager postAction:ACTION_RESPOND_ALLOW forMessage:[self getMessage]]);
--- a/Source/santad/main.m
+++ b/Source/santad/main.m
@@ -122,12 +122,16 @@ int main(int argc, const char *argv[]) {
    NSDictionary *infoDict = [[NSBundle mainBundle] infoDictionary];
    NSProcessInfo *pi = [NSProcessInfo processInfo];

+    NSString *productVersion = infoDict[@"CFBundleShortVersionString"];
+    NSString *buildVersion =
+      [[infoDict[@"CFBundleVersion"] componentsSeparatedByString:@"."] lastObject];
+
    if ([pi.arguments containsObject:@"-v"]) {
-      printf("%s\n", [infoDict[@"CFBundleVersion"] UTF8String]);
+      printf("%s (build %s)\n", [productVersion UTF8String], [buildVersion UTF8String]);
      return 0;
    }

-    LOGI(@"Started, version %@", infoDict[@"CFBundleVersion"]);
+    LOGI(@"Started, version %@ (build %@)", productVersion, buildVersion);

    // Handle the case of macOS < 10.15 updating to >= 10.15.
    if ([[SNTConfigurator configurator] enableSystemExtension]) {
--- a/Source/santametricservice/Writers/BUILD
+++ b/Source/santametricservice/Writers/BUILD
@@ -39,6 +39,7 @@ objc_library(
    ],
    deps = [
        ":SNTMetricWriter",
+        "//Source/common:SNTConfigurator",
        "//Source/common:SNTLogging",
        "@MOLAuthenticatingURLSession",
    ],
--- a/Source/santametricservice/Writers/SNTMetricHTTPWriter.m
+++ b/Source/santametricservice/Writers/SNTMetricHTTPWriter.m
@@ -14,6 +14,7 @@
 #import <MOLAuthenticatingURLSession/MOLAuthenticatingURLSession.h>
 #include <dispatch/dispatch.h>

+#import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/santametricservice/Writers/SNTMetricHTTPWriter.h"

@@ -49,37 +50,45 @@
    dispatch_group_enter(requests);

    request.HTTPBody = (NSData *)value;
-    [[_session dataTaskWithRequest:request
-                 completionHandler:^(NSData *_Nullable data, NSURLResponse *_Nullable response,
-                                     NSError *_Nullable err) {
-                   if (err != nil) {
-                     _blockError = err;
-                     *stop = YES;
-                   } else if (response == nil) {
-                     *stop = YES;
-                   } else if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
-                     NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
+    NSURLSessionDataTask *task = [_session
+      dataTaskWithRequest:request
+        completionHandler:^(NSData *_Nullable data, NSURLResponse *_Nullable response,
+                            NSError *_Nullable err) {
+          if (err != nil) {
+            _blockError = err;
+            *stop = YES;
+          } else if (response == nil) {
+            *stop = YES;
+          } else if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
+            NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;

-                     // Check HTTP error codes and create errors for any non-200.
-                     if (httpResponse && httpResponse.statusCode != 200) {
-                       _blockError = [[NSError alloc]
-                         initWithDomain:@"com.google.santa.metricservice.writers.http"
-                                   code:httpResponse.statusCode
-                               userInfo:@{
-                                 NSLocalizedDescriptionKey : [NSString
-                                   stringWithFormat:@"received http status code %ld from %@",
-                                                    httpResponse.statusCode, url]
-                               }];
-                       *stop = YES;
-                     }
-                   }
-                   dispatch_group_leave(requests);
-                 }] resume];
+            // Check HTTP error codes and create errors for any non-200.
+            if (httpResponse && httpResponse.statusCode != 200) {
+              _blockError = [[NSError alloc]
+                initWithDomain:@"com.google.santa.metricservice.writers.http"
+                          code:httpResponse.statusCode
+                      userInfo:@{
+                        NSLocalizedDescriptionKey :
+                          [NSString stringWithFormat:@"received http status code %ld from %@",
+                                                     httpResponse.statusCode, url]
+                      }];
+              *stop = YES;
+            }
+          }
+          dispatch_group_leave(requests);
+        }];

-    // Wait up to 30 seconds for the request to complete.
-    if (dispatch_group_wait(requests, (int64_t)(30.0 * NSEC_PER_SEC)) != 0) {
+    [task resume];
+
+    SNTConfigurator *config = [SNTConfigurator configurator];
+    int64_t timeout = (int64_t)config.metricExportTimeout;
+
+    // Wait up to timeout seconds for the request to complete.
+    if (dispatch_group_wait(requests, (timeout * NSEC_PER_SEC)) != 0) {
+      [task cancel];
      NSString *errMsg =
-        [NSString stringWithFormat:@"HTTP request to %@ timed out after 30 seconds", url];
+        [NSString stringWithFormat:@"HTTP request to %@ timed out after %lu seconds", url,
+                                   (unsigned long)timeout];

      _blockError = [[NSError alloc] initWithDomain:@"com.google.santa.metricservice.writers.http"
                                               code:ETIMEDOUT
--- a/Source/santametricservice/Writers/SNTMetricHTTPWriterTest.m
+++ b/Source/santametricservice/Writers/SNTMetricHTTPWriterTest.m
@@ -4,6 +4,7 @@
 #import <MOLAuthenticatingURLSession/MOLAuthenticatingURLSession.h>
 #import <OCMock/OCMock.h>

+#import "Source/common/SNTConfigurator.h"
 #import "Source/santametricservice/Writers/SNTMetricHTTPWriter.h"

@interface SNTMetricHTTPWriterTest : XCTestCase
@@ -12,6 +13,7 @@
@property id mockMOLAuthenticatingURLSession;
@property NSMutableArray<NSDictionary *> *mockResponses;
@property SNTMetricHTTPWriter *httpWriter;
+@property id mockConfigurator;
@end

@implementation SNTMetricHTTPWriterTest
@@ -28,6 +30,9 @@
  self.httpWriter = [[SNTMetricHTTPWriter alloc] init];
  self.mockResponses = [[NSMutableArray alloc] init];

+  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
+  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
+
  // This must be marked __unsafe_unretained because we're going to store into
  // it using NSInvocation's getArgument:atIndex: method which takes a void*
  // to populate. If we don't mark the variable __unsafe_unretained it will
@@ -181,4 +186,18 @@

  XCTAssertFalse(result);
 }
-@end
+
+- (void)testEnsureTimeoutsDoNotCrashWriter {
+  NSURL *url = [NSURL URLWithString:@"http://localhost:11444"];
+
+  // Queue up two responses for nil and NULL.
+  [self createMockResponseWithURL:url withCode:400 withData:nil withError:nil];
+  // Set the timeout to 0 second
+  OCMStub([self.mockConfigurator metricExportTimeout]).andReturn(0);
+
+  NSData *JSONdata = [@"{\"foo\": \"bar\"}\r\n" dataUsingEncoding:NSUTF8StringEncoding];
+
+  BOOL result = [self.httpWriter write:@[ JSONdata ] toURL:url error:nil];
+  XCTAssertEqual(NO, result);
+}
+@end
--- a/2
+++ b/2
@@ -8,7 +8,7 @@ load(

 git_repository(
    name = "build_bazel_rules_apple",
-    commit = "a2deaf0e557edaad295533d1b21aa88ce1f0227d",  # Latest commit that fixes https://github.com/google/santa/issues/595
+    commit = "4246cfe864953025cdaa105d8105679fcd1fba29",  # Latest commit that fixes https://github.com/google/santa/issues/1358
    remote = "https://github.com/bazelbuild/rules_apple.git",
 )

--- a/docs/deployment/configuration.md
+++ b/docs/deployment/configuration.md
@@ -21,10 +21,11 @@ also known as mobileconfig files, which are in an Apple-specific XML format.

 | Key                           | Value Type | Description                              |
 | ----------------------------- | ---------- | ---------------------------------------- |
-| ClientMode*                   | Integer    | 1 = MONITOR, 2 = LOCKDOWN, defaults to MONITOR |
-| FileChangesRegex*             | String     | The regex of paths to log file changes. Regexes are specified in ICU format. |
-| AllowedPathRegex*             | String     | A regex to allow if the binary or certificate scopes did not allow/block execution.  Regexes are specified in ICU format. |
-| BlockedPathRegex*             | String     | A regex to block if the binary or certificate scopes did not allow/block an execution.  Regexes are specified in ICU format. |
+| ClientMode\*                  | Integer    | 1 = MONITOR, 2 = LOCKDOWN, defaults to MONITOR |
+| FailClosed                    | Bool       | If true and the ClientMode is LOCKDOWN: execution will be denied when there is an error reading or processing an executable file. |
+| FileChangesRegex\*            | String     | The regex of paths to log file changes. Regexes are specified in ICU format. |
+| AllowedPathRegex\*            | String     | A regex to allow if the binary or certificate scopes did not allow/block execution.  Regexes are specified in ICU format. |
+| BlockedPathRegex\*            | String     | A regex to block if the binary or certificate scopes did not allow/block an execution.  Regexes are specified in ICU format. |
 | EnableBadSignatureProtection  | Bool       | Enable bad signature protection, defaults to NO. If this flag is set to YES, binaries with a bad signing chain will be blocked even in MONITOR mode, **unless** the binary is allowed by an explicit rule. |
 | EnablePageZeroProtection      | Bool       | Enable `__PAGEZERO` protection, defaults to YES. If this flag is set to YES, 32-bit binaries that are missing the `__PAGEZERO` segment will be blocked even in MONITOR mode, **unless** the binary is allowed by an explicit rule. |
 | EnableSysxCache               | Bool       | Enables a secondary cache that ensures better performance when multiple EndpointSecurity system extensions are installed. Defaults to YES in 2021.8, defaults to NO in earlier versions. |
@@ -55,7 +56,8 @@ also known as mobileconfig files, which are in an Apple-specific XML format.
 | EnableMachineIDDecoration     | Bool       | If YES, this appends the MachineID to the end of each log line. Defaults to NO.       |
 | MetricFormat                  | String     | Format to export metrics as, supported formats are "rawjson" for a single JSON blob and "monarchjson" for a format consumable by Google's Monarch tooling. Defaults to "". |
 | MetricURL                     | String     | URL describing where monitoring metrics should be exported.  |
-| MetricExportInterval          | Integer    | Number of seconds to wait between exporting metrics. Defaults to 30.  
+| MetricExportInterval          | Integer    | Number of seconds to wait between exporting metrics. Defaults to 30.  |
+| MetricExportTimeout           | Integer    | Number of seconds to wait before a timeout occurs when exporting metrics. Defaults to 30.  |
 | MetricExtraLabels             | Dictionary | A map of key value pairs to add to all metric root labels. (e.g. a=b,c=d) defaults to @{}). If a previously set key (e.g. host_name is set to "" then the key is remove from the metric root labels. Alternatively if a value is set for an existing key then the new value will override the old. |


--- a/version.bzl
+++ b/version.bzl
@@ -1,3 +1,3 @@
 """The version for all Santa components."""

-SANTA_VERSION = "2022.1"
+SANTA_VERSION = "2022.2"
Author	SHA1	Message	Date
Russell Hancox	e3e48aed1b	Packaging: Keep package versions simple (#737 )	2022-03-02 10:36:39 -05:00
Russell Hancox	e60f9cf6c5	Project: Add build version (#736 )	2022-02-28 14:18:18 -05:00
Kent Ma	c7e309ccb1	Add a USB device blocking popup. (#728 ) * Add a USB device blocking popup. * Refactor SNTNotificationManager and SNTMessageWindowController to make for generalized notification logic * Add the configuration keys for custom block messages and resize window	2022-02-28 13:30:56 -05:00
Russell Hancox	ad8aafbd07	Project: Bump version to 2022.2 (#734 )	2022-02-17 11:36:21 -05:00
Russell Hancox	9e671c3dee	Project: Add arm64 to hostArchitectures for productbuild (#733 ) This should avoid prompts to install Rosetta when installing the .pkg	2022-02-16 20:02:12 -05:00
Russell Hancox	d97abe36f2	santad: Fix fail open tests in SNTExecutionControllerTest (#730 )	2022-02-14 20:13:08 -05:00
Pete Markowsky	faa8946056	Fix: remediate a crash in santametricservice (#729 ) * Fix issue with task cancelation. * Make export timeouts configurable. This allows an export timeout to be set via configuration and eases testing.	2022-02-14 13:51:29 -05:00
Kent Ma	8b2b1f0bfc	Report USB blocking status with `santactl status` (#727 ) * Report USB blocking status with santactl status	2022-02-10 16:02:40 -05:00
Kent Ma	16678cd5a0	Update version of bazel rules_apple to fix broken 12.3 builds (#726 )	2022-02-10 14:32:43 -05:00
Matt W	0bd6a199a3	Fix additional strlcpy issue, simplify call paths (#723 ) * Fix additional strlcpy issue, simplify call paths * Remove unused interface from header	2022-02-03 12:53:22 -05:00
Russell Hancox	58e2b7e1b8	santad: Add fail-closed mode (#722 )	2022-01-28 18:29:18 -05:00