Revert "Configurator: Apply config updates in non-daemon processes (#1003)" (#1008)

This reverts commit 1e88b88ee6.

.allstar/binary_artifacts.yaml

@@ -0,0 +1,19 @@
+# Ignore reason: These crafted binaries are used in tests
+ignorePaths:
+- Fuzzing/common/MachOParse_corpus/ret0
+- Source/common/testdata/bad_pagezero
+- Source/common/testdata/missing_pagezero
+- Source/common/testdata/missing_pagezero
+- Source/common/testdata/missing_pagezero
+- Source/common/testdata/32bitplist
+- Source/common/testdata/BundleExample.app/Contents/MacOS/BundleExample
+- Source/common/testdata/DirectoryBundle/Contents/MacOS/DirectoryBundle
+- Source/common/testdata/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/MacOS/BundleExample
+- Source/santad/testdata/binaryrules/badbinary
+- Source/santad/testdata/binaryrules/goodbinary
+- Source/santad/testdata/binaryrules/badcert
+- Source/santad/testdata/binaryrules/banned_teamid_allowed_binary
+- Source/santad/testdata/binaryrules/banned_teamid
+- Source/santad/testdata/binaryrules/goodcert
+- Source/santad/testdata/binaryrules/noop
+- Source/santad/testdata/binaryrules/rules.db

.bazelrc

@@ -3,3 +3,23 @@ build --apple_generate_dsym --define=apple.propagate_embedded_extra_outputs=yes
 build --copt=-Werror
 build --copt=-Wall
 build --copt=-Wno-error=deprecated-declarations
+build --per_file_copt=.*\.mm\$@-std=c++17
+build --cxxopt=-std=c++17
+
+build --copt=-DSANTA_OPEN_SOURCE=1
+build --cxxopt=-DSANTA_OPEN_SOURCE=1
+
+build:asan --strip=never
+build:asan --copt="-Wno-macro-redefined"
+build:asan --copt="-D_FORTIFY_SOURCE=0"
+build:asan --copt="-O1"
+build:asan --copt="-fno-omit-frame-pointer"
+build:asan --copt="-fsanitize=address"
+build:asan --copt="-DADDRESS_SANITIZER"
+build:asan --linkopt="-fsanitize=address"
+
+build:fuzz --copt="-Wno-macro-redefined"
+build:fuzz --copt="-D_FORTIFY_SOURCE=0"
+build:fuzz --@rules_fuzzing//fuzzing:cc_engine=@rules_fuzzing//fuzzing/engines:libfuzzer
+build:fuzz --@rules_fuzzing//fuzzing:cc_engine_instrumentation=libfuzzer
+build:fuzz --@rules_fuzzing//fuzzing:cc_engine_sanitizer=asan

.bazelversion

@@ -1 +1 @@
-5.0.0
+5.3.0

.github/workflows/check-markdown.yml

@@ -11,4 +11,4 @@ jobs:
     steps:
     - uses: actions/checkout@master
     - uses: gaurav-nelson/github-action-markdown-link-check@v1
-    - run: "! git grep -EIn $'[ \t]+$'"
+    - run: "! git grep -EIn $'[ \t]+$' -- ':(exclude)*.patch'"

.github/workflows/ci.yml

@@ -20,23 +20,22 @@ jobs:
       - name: Run linters
         run: ./Testing/lint.sh
 
-
   build_userspace:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-10.15, macos-11, macos-12]
+        os: [macos-11, macos-12]
     runs-on: ${{ matrix.os }}
     steps:
-     - uses: actions/checkout@v2
-     - name: Build Userspace
-       run: bazel build --apple_generate_dsym -c opt :release --define=SANTA_BUILD_TYPE=adhoc
+      - uses: actions/checkout@v2
+      - name: Build Userspace
+        run: bazel build --apple_generate_dsym -c opt :release --define=SANTA_BUILD_TYPE=adhoc
 
   unit_tests:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-10.15, macos-11, macos-12]
+        os: [macos-11, macos-12]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
@@ -55,10 +54,3 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           path-to-lcov: ./bazel-out/_coverage/_coverage_report.dat
           flag-name: Unit
-
-  benchmark:
-    runs-on: macos-11
-    steps:
-      - uses: actions/checkout@v2
-      - name: Run All Tests
-        run: ./Testing/benchmark.sh

.github/workflows/continuous.yml

@@ -1,7 +1,7 @@
 name: continuous
 on:
   schedule:
-    - cron: '* 10 * * *' # Every day at 10:00 UTC
+    - cron: '0 10 * * *' # Every day at 10:00 UTC
   workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
 
 jobs:

.github/workflows/e2e.yml

@@ -0,0 +1,41 @@
+name: E2E
+
+on: workflow_dispatch
+
+jobs:
+  start_vm:
+    runs-on: e2e-host
+    steps:
+      - uses: actions/checkout@v2
+      - name: Start VM
+        run: python3 Testing/integration/actions/start_vm.py macOS_12.bundle.tar.gz
+
+  integration:
+    runs-on: e2e-vm
+    env:
+      VM_PASSWORD: ${{ secrets.VM_PASSWORD }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install configuration profile
+        run: bazel run //Testing/integration:install_profile -- Testing/integration/configs/default.mobileconfig
+      - name: Add homebrew to PATH
+        run: echo "/opt/homebrew/bin/" >> $GITHUB_PATH
+      - name: Build, install, and start moroz
+        run: |
+          bazel build @com_github_groob_moroz//cmd/moroz:moroz
+          cp bazel-bin/external/com_github_groob_moroz/cmd/moroz/moroz_/moroz /tmp/moroz
+          /tmp/moroz -configs="$GITHUB_WORKSPACE/Testing/integration/configs/moroz_default/global.toml" -use-tls=false &
+      - name: Build, install, and sync santa
+        run: |
+          bazel run :reload --define=SANTA_BUILD_TYPE=adhoc
+          bazel run //Testing/integration:allow_sysex
+          sudo santactl sync --debug
+      - name: Run integration test binaries
+        run: bazel test //Testing/integration:integration_tests
+      - name: Test config changes
+        run: ./Testing/integration/test_config_changes.sh
+      - name: Test sync server changes
+        run: ./Testing/integration/test_sync_changes.sh
+      - name: Poweroff
+        if: ${{ always() }}
+        run: sudo shutdown -h +1

.github/workflows/fuzz.yml

@@ -0,0 +1,35 @@
+name: Fuzzing
+
+on:
+  schedule:
+    - cron: '0 6 * * *' # Every day at 6:00 UTC
+  workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
+
+jobs:
+  start_vm:
+    runs-on: e2e-host
+    steps:
+      - uses: actions/checkout@v2
+      - name: Start VM
+        run: python3 Testing/integration/actions/start_vm.py macOS_13.bundle.tar.gz
+
+  fuzz:
+    runs-on: e2e-vm
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup libfuzzer
+        run: Fuzzing/install_libclang_fuzzer.sh
+      - name: Fuzz
+        run: |
+          for target in $(bazel query 'kind(fuzzing_launcher, //Fuzzing:all)'); do
+            bazel run --config=fuzz $target -- -- -max_len=32768 -runs=1000000 -timeout=5
+          done
+      - name: Upload crashes
+        uses: actions/upload-artifact@v1
+        if: failure()
+        with:
+          name: artifacts
+          path: /tmp/fuzzing/artifacts
+      - name: Poweroff VM
+        if: ${{ always() }}
+        run: sudo shutdown -h +1

.pylintrc

@@ -0,0 +1,429 @@
+# This Pylint rcfile contains a best-effort configuration to uphold the
+# best-practices and style described in the Google Python style guide:
+#   https://google.github.io/styleguide/pyguide.html
+#
+# Its canonical open-source location is:
+#   https://google.github.io/styleguide/pylintrc
+
+[MASTER]
+
+# Files or directories to be skipped. They should be base names, not paths.
+ignore=third_party
+
+# Files or directories matching the regex patterns are skipped. The regex
+# matches against base names, not paths.
+ignore-patterns=
+
+# Pickle collected data for later comparisons.
+persistent=no
+
+# List of plugins (as comma separated values of python modules names) to load,
+# usually to register additional checkers.
+load-plugins=
+
+# Use multiple processes to speed up Pylint.
+jobs=4
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
+confidence=
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+#enable=
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once).You can also use "--disable=all" to
+# disable everything first and then reenable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use"--disable=all --enable=classes
+# --disable=W"
+disable=abstract-method,
+        apply-builtin,
+        arguments-differ,
+        attribute-defined-outside-init,
+        backtick,
+        bad-option-value,
+        basestring-builtin,
+        buffer-builtin,
+        c-extension-no-member,
+        consider-using-enumerate,
+        cmp-builtin,
+        cmp-method,
+        coerce-builtin,
+        coerce-method,
+        delslice-method,
+        div-method,
+        duplicate-code,
+        eq-without-hash,
+        execfile-builtin,
+        file-builtin,
+        filter-builtin-not-iterating,
+        fixme,
+        getslice-method,
+        global-statement,
+        hex-method,
+        idiv-method,
+        implicit-str-concat,
+        import-error,
+        import-self,
+        import-star-module-level,
+        inconsistent-return-statements,
+        input-builtin,
+        intern-builtin,
+        invalid-str-codec,
+        locally-disabled,
+        long-builtin,
+        long-suffix,
+        map-builtin-not-iterating,
+        misplaced-comparison-constant,
+        missing-function-docstring,
+        metaclass-assignment,
+        next-method-called,
+        next-method-defined,
+        no-absolute-import,
+        no-else-break,
+        no-else-continue,
+        no-else-raise,
+        no-else-return,
+        no-init,  # added
+        no-member,
+        no-name-in-module,
+        no-self-use,
+        nonzero-method,
+        oct-method,
+        old-division,
+        old-ne-operator,
+        old-octal-literal,
+        old-raise-syntax,
+        parameter-unpacking,
+        print-statement,
+        raising-string,
+        range-builtin-not-iterating,
+        raw_input-builtin,
+        rdiv-method,
+        reduce-builtin,
+        relative-import,
+        reload-builtin,
+        round-builtin,
+        setslice-method,
+        signature-differs,
+        standarderror-builtin,
+        suppressed-message,
+        sys-max-int,
+        too-few-public-methods,
+        too-many-ancestors,
+        too-many-arguments,
+        too-many-boolean-expressions,
+        too-many-branches,
+        too-many-instance-attributes,
+        too-many-locals,
+        too-many-nested-blocks,
+        too-many-public-methods,
+        too-many-return-statements,
+        too-many-statements,
+        trailing-newlines,
+        unichr-builtin,
+        unicode-builtin,
+        unnecessary-pass,
+        unpacking-in-except,
+        useless-else-on-loop,
+        useless-object-inheritance,
+        useless-suppression,
+        using-cmp-argument,
+        wrong-import-order,
+        xrange-builtin,
+        zip-builtin-not-iterating,
+
+
+[REPORTS]
+
+# Set the output format. Available formats are text, parseable, colorized, msvs
+# (visual studio) and html. You can also give a reporter class, eg
+# mypackage.mymodule.MyReporterClass.
+output-format=text
+
+# Tells whether to display a full report or only the messages
+reports=no
+
+# Python expression which should return a note less than 10 (10 is the highest
+# note). You have access to the variables errors warning, statement which
+# respectively contain the number of errors / warnings messages and the total
+# number of statements analyzed. This is used by the global evaluation report
+# (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details
+#msg-template=
+
+
+[BASIC]
+
+# Good variable names which should always be accepted, separated by a comma
+good-names=main,_
+
+# Bad variable names which should always be refused, separated by a comma
+bad-names=
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Include a hint for the correct naming format with invalid-name
+include-naming-hint=no
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+property-classes=abc.abstractproperty,cached_property.cached_property,cached_property.threaded_cached_property,cached_property.cached_property_with_ttl,cached_property.threaded_cached_property_with_ttl
+
+# Regular expression matching correct function names
+function-rgx=^(?:(?P<exempt>setUp|tearDown|setUpModule|tearDownModule)|(?P<camel_case>_?[A-Z][a-zA-Z0-9]*)|(?P<snake_case>_?[a-z][a-z0-9_]*))$
+
+# Regular expression matching correct variable names
+variable-rgx=^[a-z][a-z0-9_]*$
+
+# Regular expression matching correct constant names
+const-rgx=^(_?[A-Z][A-Z0-9_]*|__[a-z0-9_]+__|_?[a-z][a-z0-9_]*)$
+
+# Regular expression matching correct attribute names
+attr-rgx=^_{0,2}[a-z][a-z0-9_]*$
+
+# Regular expression matching correct argument names
+argument-rgx=^[a-z][a-z0-9_]*$
+
+# Regular expression matching correct class attribute names
+class-attribute-rgx=^(_?[A-Z][A-Z0-9_]*|__[a-z0-9_]+__|_?[a-z][a-z0-9_]*)$
+
+# Regular expression matching correct inline iteration names
+inlinevar-rgx=^[a-z][a-z0-9_]*$
+
+# Regular expression matching correct class names
+class-rgx=^_?[A-Z][a-zA-Z0-9]*$
+
+# Regular expression matching correct module names
+module-rgx=^(_?[a-z][a-z0-9_]*|__init__)$
+
+# Regular expression matching correct method names
+method-rgx=(?x)^(?:(?P<exempt>_[a-z0-9_]+__|runTest|setUp|tearDown|setUpTestCase|tearDownTestCase|setupSelf|tearDownClass|setUpClass|(test|assert)_*[A-Z0-9][a-zA-Z0-9_]*|next)|(?P<camel_case>_{0,2}[A-Z][a-zA-Z0-9_]*)|(?P<snake_case>_{0,2}[a-z][a-z0-9_]*))$
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=(__.*__|main|test.*|.*test|.*Test)$
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=10
+
+
+[TYPECHECK]
+
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager,contextlib2.contextmanager
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis. It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=optparse.Values,thread._local,_thread._local
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=
+
+
+[FORMAT]
+
+# Maximum number of characters on a single line.
+max-line-length=80
+
+# TODO(https://github.com/PyCQA/pylint/issues/3352): Direct pylint to exempt
+# lines made too long by directives to pytype.
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=(?x)(
+  ^\s*(\#\ )?<?https?://\S+>?$|
+  ^\s*(from\s+\S+\s+)?import\s+.+$)
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=yes
+
+# Maximum number of lines in a module
+max-module-lines=99999
+
+# String used as indentation unit.  The internal Google style guide mandates 2
+# spaces.  Google's externaly-published style guide says 4, consistent with
+# PEP 8.  Here, we use 2 spaces, for conformity with many open-sourced Google
+# projects (like TensorFlow).
+indent-string='  '
+
+# Number of spaces of indent required inside a hanging  or continued line.
+indent-after-paren=4
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=TODO
+
+
+[STRING]
+
+# This flag controls whether inconsistent-quotes generates a warning when the
+# character used as a quote delimiter is used inconsistently within a module.
+check-quote-consistency=yes
+
+
+[VARIABLES]
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# A regular expression matching the name of dummy variables (i.e. expectedly
+# not used).
+dummy-variables-rgx=^\*{0,2}(_$|unused_|dummy_)
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid to define new builtins when possible.
+additional-builtins=
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,_cb
+
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six,six.moves,past.builtins,future.builtins,functools
+
+
+[LOGGING]
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format
+logging-modules=logging,absl.logging,tensorflow.io.logging
+
+
+[SIMILARITIES]
+
+# Minimum lines number of a similarity.
+min-similarity-lines=4
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+# Ignore imports when computing similarities.
+ignore-imports=no
+
+
+[SPELLING]
+
+# Spelling dictionary name. Available dictionaries: none. To make it working
+# install python-enchant package.
+spelling-dict=
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to indicated private dictionary in
+# --spelling-private-dict-file option instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[IMPORTS]
+
+# Deprecated modules which should not be used, separated by a comma
+deprecated-modules=regsub,
+                   TERMIOS,
+                   Bastion,
+                   rexec,
+                   sets
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled)
+import-graph=
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled)
+ext-import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled)
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant, absl
+
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
+
+
+[CLASSES]
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,
+                      __new__,
+                      setUp
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,
+                  _fields,
+                  _replace,
+                  _source,
+                  _make
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls,
+                            class_
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=mcs
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "Exception"
+overgeneral-exceptions=StandardError,
+                       Exception,
+                       BaseException

BUILD

@@ -198,10 +198,3 @@ test_suite(
         "//Source/santasyncservice:unit_tests",
     ],
 )
-
-test_suite(
-    name = "benchmarks",
-    tests = [
-        "//Source/santad:SNTApplicationBenchmark",
-    ],
-)

CODEOWNERS

@@ -0,0 +1 @@
+* @google/macendpoints

Fuzzing/BUILD

@@ -0,0 +1,11 @@
+load("fuzzing.bzl", "objc_fuzz_test")
+
+objc_fuzz_test(
+    name = "MachOParse",
+    srcs = ["common/MachOParse.mm"],
+    corpus = glob(["common/MachOParse_corpus/*"]),
+    linkopts = ["-lsqlite3"],
+    deps = [
+        "//Source/common:SNTFileInfo",
+    ],
+)

Fuzzing/common/MachOParse.mm

@@ -0,0 +1,40 @@
+#import <Foundation/Foundation.h>
+#include <libproc.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#import "Source/common/SNTFileInfo.h"
+
+int get_num_fds() {
+  return proc_pidinfo(getpid(), PROC_PIDLISTFDS, 0, NULL, 0) / PROC_PIDLISTFD_SIZE;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  static NSString *tmpPath =
+    [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSUUID UUID] UUIDString]];
+
+  int num_fds_pre = get_num_fds();
+
+  @autoreleasepool {
+    NSData *input = [NSData dataWithBytesNoCopy:(void *)data length:size freeWhenDone:false];
+    [input writeToFile:tmpPath atomically:false];
+
+    NSError *error;
+    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithResolvedPath:tmpPath error:&error];
+    if (!fi || error != nil) {
+      NSLog(@"Error: %@", error);
+      return -1;
+    }
+
+    // Mach-O Parsing
+    [fi architectures];
+    [fi isMissingPageZero];
+    [fi infoPlist];
+  }
+
+  if (num_fds_pre != get_num_fds()) {
+    abort();
+  }
+
+  return 0;
+}

Fuzzing/fuzzing.bzl

@@ -0,0 +1,20 @@
+"""Utilities for fuzzing Santa"""
+
+load("@rules_fuzzing//fuzzing:cc_defs.bzl", "cc_fuzz_test")
+
+def objc_fuzz_test(name, srcs, deps, corpus, linkopts = [], **kwargs):
+    native.objc_library(
+        name = "%s_lib" % name,
+        srcs = srcs,
+        deps = deps,
+        **kwargs
+    )
+
+    cc_fuzz_test(
+        name = name,
+        deps = [
+            "%s_lib" % name,
+        ],
+        linkopts = linkopts,
+        corpus = corpus,
+    )

Fuzzing/install_libclang_fuzzer.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Xcode doesn't include the fuzzer runtime, but the one LLVM ships is compatible with Apple clang.
+set -uexo pipefail
+
+CLANG_VERSION=$(clang --version | head -n 1 | cut -d' ' -f 4)
+DST_PATH="$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a"
+
+if [ -f ${DST_PATH} ]; then
+  exit 0;
+fi
+
+curl -O -L https://github.com/llvm/llvm-project/releases/download/llvmorg-${CLANG_VERSION}/clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin.tar.xz
+tar xvf clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin.tar.xz clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a
+cp clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a ${DST_PATH}

Fuzzing/libFuzzer/.gitignore

@@ -1,4 +0,0 @@
-bin
-llvm-*.src
-llvm-*.src.tar.xz
-

Fuzzing/libFuzzer/build.sh

@@ -1,109 +0,0 @@
-#!/usr/bin/env bash
-
-LLVM_VERSION='5.0.1'
-LLVM_COMPILERRT_TARBALL_NAME="llvm-${LLVM_VERSION}.src.tar.xz"
-LLVM_COMPILERRT_SRC_FOLDER_NAME=`echo "${LLVM_COMPILERRT_TARBALL_NAME}" | cut -d '.' -f 1-4`
-LLVM_COMPILERRT_TARBALL_URL="http://releases.llvm.org/${LLVM_VERSION}/${LLVM_COMPILERRT_TARBALL_NAME}"
-
-LIBFUZZER_FOLDER="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-LOG_FILE=`mktemp`
-
-main() {
-  echo "libFuzzer build script"
-
-  echo " > Checking dependencies..."
-  checkDependencies || return 1
-
-  echo " > Entering libFuzzer folder..."
-  cd "${LIBFUZZER_FOLDER}" > /dev/null 2>&1
-  if [ $? -ne 0 ] ; then
-    echo "Failed to enter the libFuzzer folder: ${LIBFUZZER_FOLDER}"
-    return 1
-  fi
-
-  if [ ! -f "${LLVM_COMPILERRT_TARBALL_NAME}" ] ; then
-    echo " > Downloading the LLVM tarball..."
-    curl "${LLVM_COMPILERRT_TARBALL_URL}" -o "${LLVM_COMPILERRT_TARBALL_NAME}" > "${LOG_FILE}" 2>&1
-    if [ $? -ne 0 ] ; then
-      dumpLogFile "Failed to download the LLVM tarball"
-      return 1
-    fi
-  else
-    echo " > An existing LLVM tarball was found"
-  fi
-
-  if [ -d "${LLVM_COMPILERRT_SRC_FOLDER_NAME}" ] ; then
-    echo " > Deleting existing LLVM folder..."
-    rm -rf "${LLVM_COMPILERRT_SRC_FOLDER_NAME}" > "${LOG_FILE}" 2>&1
-    if [ $? -ne 0 ] ; then
-      dumpLogFile "Failed to delete the existing source folder"
-      return 1
-    fi
-  fi
-
-  echo " > Extracting the LLVM tarball..."
-  tar xf "${LLVM_COMPILERRT_TARBALL_NAME}" > "${LOG_FILE}" 2>&1
-  if [ $? -ne 0 ] ; then
-    rm "${LLVM_COMPILERRT_TARBALL_NAME}" "${LLVM_COMPILERRT_SRC_FOLDER_NAME}"
-    dumpLogFile "Failed to extract the LLVM tarball"
-    return 1
-  fi
-
-  if [ -d "bin" ] ; then
-    echo " > Deleting existing bin folder..."
-    rm -rf "bin" > "${LOG_FILE}" 2>&1
-    if [ $? -ne 0 ] ; then
-      dumpLogFile "Failed to delete the existing bin folder"
-      return 1
-    fi
-  fi
-
-  mkdir "bin" > "${LOG_FILE}" 2>&1
-  if [ $? -ne 0 ] ; then
-    dumpLogFile "Failed to create the bin folder"
-    return 1
-  fi
-
-  echo " > Building libFuzzer..."
-  ( cd "bin" && "../${LLVM_COMPILERRT_SRC_FOLDER_NAME}/lib/Fuzzer/build.sh" ) > "${LOG_FILE}" 2>&1
-  if [ $? -ne 0 ] ; then
-    dumpLogFile "Failed to build the library"
-    return 1
-  fi
-
-  printf "\nFinished building libFuzzer\n"
-  rm "${LOG_FILE}"
-
-  return 0
-}
-
-checkDependencies() {
-  executable_list=( "clang++" "curl" "tar" )
-
-  for executable in "${executable_list[@]}" ; do
-    which "${executable}" > /dev/null 2>&1
-    if [ $? -ne 0 ] ; then
-      echo "The following program was not found: ${executable}"
-      return 1
-    fi
-  done
-
-  return 0
-}
-
-dumpLogFile() {
-  if [ $# -eq 1 ] ; then
-    local message="$1"
-  else
-    local message="An error has occurred"
-  fi
-
-  printf "${message}\n"
-  printf "Log file follows\n===\n"
-  cat "${LOG_FILE}"
-  printf "\n===\n"
-  rm "${LOG_FILE}"
-}
-
-main $@
-exit $?

Fuzzing/santad/src/checkCacheForVnodeID.mm

@@ -20,6 +20,7 @@
 #import "SNTCommandController.h"
 #import "SNTRule.h"
 #import "SNTXPCControlInterface.h"
+#import "Source/common/SNTCommonEnums.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
   if (size > 16) {
@@ -28,7 +29,7 @@ extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size
     return 1;
   }
 
-  santa_vnode_id_t vnodeID = {};
+  SantaVnode vnodeID = {};
   std::memcpy(&vnodeID, data, size);
 
   MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
@@ -41,14 +42,14 @@ extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size
 
   [[daemonConn remoteObjectProxy]
     checkCacheForVnodeID:vnodeID
-               withReply:^(santa_action_t action) {
-                 if (action == ACTION_RESPOND_ALLOW) {
+               withReply:^(SNTAction action) {
+                 if (action == SNTActionRespondAllow) {
                    std::cerr << "File exists in [whitelist] kernel cache" << std::endl;
                    ;
-                 } else if (action == ACTION_RESPOND_DENY) {
+                 } else if (action == SNTActionRespondDeny) {
                    std::cerr << "File exists in [blacklist] kernel cache" << std::endl;
                    ;
-                 } else if (action == ACTION_UNSET) {
+                 } else if (action == SNTActionUnset) {
                    std::cerr << "File does not exist in cache" << std::endl;
                    ;
                  }

LICENSE

@@ -200,3 +200,13 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
+------------------
+
+Files: Testing/integration/VM/*
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -1,7 +1,7 @@
-# Santa [![CI](https://github.com/google/santa/actions/workflows/ci.yml/badge.svg)](https://github.com/google/santa/actions/workflows/ci.yml) [![Coverage Status](https://coveralls.io/repos/github/google/santa/badge.svg?branch=main)](https://coveralls.io/github/google/santa?branch=main)
+# Santa [![CI](https://github.com/google/santa/actions/workflows/ci.yml/badge.svg)](https://github.com/google/santa/actions/workflows/ci.yml)
 
 <p align="center">
-    <img src="https://raw.githubusercontent.com/google/santa/main/Source/santa/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
+    <img src="https://raw.githubusercontent.com/google/santa/main/Source/gui/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
 </p>
 
 Santa is a binary authorization system for macOS. It consists of a system

SECURITY.md

@@ -7,6 +7,6 @@ whichever comes first.
 
 To report vulnerabilities to us privately, please e-mail `santa-team@google.com`.
 If you want to encrypt your e-mail, you can use our GPG key `0x92AFE41DAB49BBB6`
-available on pool.sks-keyservers.net:
+available on keyserver.ubuntu.com:
 
-`gpg --keyserver pool.sks-keyservers.net --recv-key 0x92AFE41DAB49BBB6`
+`gpg --keyserver keyserver.ubuntu.com --recv-key 0x92AFE41DAB49BBB6`

Source/common/BUILD

@@ -1,5 +1,5 @@
 load("//:helper.bzl", "santa_unit_test")
-load("@rules_proto_grpc//objc:defs.bzl", "objc_proto_library")
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
 
 package(
     default_visibility = ["//:santa_package_group"],
@@ -16,26 +16,67 @@ proto_library(
     ],
 )
 
-objc_proto_library(
-    name = "santa_objc_proto",
-    copts = ["-fno-objc-arc"],
-    non_arc_srcs = ["Santa.pbobjc.m"],
-    protos = [":santa_proto"],
+cc_proto_library(
+    name = "santa_cc_proto",
+    deps = [":santa_proto"],
+)
+
+# Note: Simple wrapper for a `cc_proto_library` target which cannot be directly
+# depended upon by an `objc_library` target.
+cc_library(
+    name = "santa_cc_proto_library_wrapper",
+    hdrs = ["santa_proto_include_wrapper.h"],
+    deps = [
+        ":santa_cc_proto",
+    ],
+)
+
+objc_library(
+    name = "SystemResources",
+    srcs = ["SystemResources.mm"],
+    hdrs = ["SystemResources.h"],
+    deps = [
+        ":SNTLogging",
+    ],
 )
 
 cc_library(
     name = "SantaCache",
     hdrs = ["SantaCache.h"],
-    deps = ["//Source/common:SNTCommon"],
+    deps = [":BranchPrediction"],
 )
 
 santa_unit_test(
     name = "SantaCacheTest",
-    srcs = [
-        "SantaCache.h",
-        "SantaCacheTest.mm",
+    srcs = ["SantaCacheTest.mm"],
+    deps = [
+        ":SantaCache",
+    ],
+)
+
+objc_library(
+    name = "BranchPrediction",
+    hdrs = ["BranchPrediction.h"],
+)
+
+objc_library(
+    name = "SantaVnode",
+    hdrs = ["SantaVnode.h"],
+)
+
+objc_library(
+    name = "Platform",
+    hdrs = ["Platform.h"],
+)
+
+objc_library(
+    name = "SantaVnodeHash",
+    srcs = ["SantaVnodeHash.mm"],
+    hdrs = ["SantaVnodeHash.h"],
+    deps = [
+        ":SantaCache",
+        ":SantaVnode",
     ],
-    deps = ["//Source/common:SNTCommon"],
 )
 
 objc_library(
@@ -66,11 +107,11 @@ objc_library(
 
 objc_library(
     name = "SNTCachedDecision",
-    srcs = ["SNTCachedDecision.m"],
+    srcs = ["SNTCachedDecision.mm"],
     hdrs = ["SNTCachedDecision.h"],
     deps = [
-        ":SNTCommon",
         ":SNTCommonEnums",
+        ":SantaVnode",
     ],
 )
 
@@ -83,15 +124,9 @@ objc_library(
     ],
 )
 
-objc_library(
-    name = "SNTAllowlistInfo",
-    srcs = ["SNTAllowlistInfo.m"],
-    hdrs = ["SNTAllowlistInfo.h"],
-)
-
 objc_library(
     name = "SNTCommonEnums",
-    hdrs = ["SNTCommonEnums.h"],
+    textual_hdrs = ["SNTCommonEnums.h"],
 )
 
 objc_library(
@@ -106,6 +141,23 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "SNTKVOManager",
+    srcs = ["SNTKVOManager.mm"],
+    hdrs = ["SNTKVOManager.h"],
+    deps = [
+        ":SNTLogging",
+    ],
+)
+
+santa_unit_test(
+    name = "SNTKVOManagerTest",
+    srcs = ["SNTKVOManagerTest.mm"],
+    deps = [
+        ":SNTKVOManager",
+    ],
+)
+
 objc_library(
     name = "SNTDropRootPrivs",
     srcs = ["SNTDropRootPrivs.m"],
@@ -117,20 +169,12 @@ objc_library(
     srcs = ["SNTFileInfo.m"],
     hdrs = ["SNTFileInfo.h"],
     deps = [
+        ":SNTLogging",
         "@FMDB",
         "@MOLCodesignChecker",
     ],
 )
 
-cc_library(
-    name = "SNTCommon",
-    hdrs = ["SNTCommon.h"],
-    defines = [
-        "TARGET_OS_OSX",
-        "TARGET_OS_MAC",
-    ],
-)
-
 objc_library(
     name = "SNTLogging",
     srcs = ["SNTLogging.m"],
@@ -138,12 +182,18 @@ objc_library(
     deps = [":SNTConfigurator"],
 )
 
-cc_library(
-    name = "SNTPrefixTree",
-    srcs = ["SNTPrefixTree.cc"],
-    hdrs = ["SNTPrefixTree.h"],
-    copts = ["-std=c++11"],
-    deps = [":SNTLogging"],
+objc_library(
+    name = "PrefixTree",
+    hdrs = ["PrefixTree.h"],
+    deps = [
+        ":SNTLogging",
+        "@com_google_absl//absl/synchronization",
+    ],
+)
+
+objc_library(
+    name = "Unit",
+    hdrs = ["Unit.h"],
 )
 
 objc_library(
@@ -261,11 +311,11 @@ objc_library(
     srcs = ["SNTXPCUnprivilegedControlInterface.m"],
     hdrs = ["SNTXPCUnprivilegedControlInterface.h"],
     deps = [
-        ":SNTCommon",
         ":SNTCommonEnums",
         ":SNTRule",
         ":SNTStoredEvent",
         ":SNTXPCBundleServiceInterface",
+        ":SantaVnode",
         "@MOLCertificate",
         "@MOLXPCConnection",
     ],
@@ -287,9 +337,9 @@ santa_unit_test(
 )
 
 santa_unit_test(
-    name = "SNTPrefixTreeTest",
-    srcs = ["SNTPrefixTreeTest.mm"],
-    deps = [":SNTPrefixTree"],
+    name = "PrefixTreeTest",
+    srcs = ["PrefixTreeTest.mm"],
+    deps = [":PrefixTree"],
 )
 
 santa_unit_test(
@@ -298,13 +348,41 @@ santa_unit_test(
     deps = [":SNTMetricSet"],
 )
 
+santa_unit_test(
+    name = "SNTCachedDecisionTest",
+    srcs = ["SNTCachedDecisionTest.mm"],
+    deps = [
+        "//Source/common:SNTCachedDecision",
+        "//Source/common:TestUtils",
+        "@OCMock",
+    ],
+)
+
 test_suite(
     name = "unit_tests",
     tests = [
+        ":PrefixTreeTest",
+        ":SNTCachedDecisionTest",
         ":SNTFileInfoTest",
+        ":SNTKVOManagerTest",
         ":SNTMetricSetTest",
-        ":SNTPrefixTreeTest",
+        ":SNTRuleTest",
         ":SantaCacheTest",
     ],
     visibility = ["//:santa_package_group"],
 )
+
+objc_library(
+    name = "TestUtils",
+    testonly = 1,
+    srcs = ["TestUtils.mm"],
+    hdrs = ["TestUtils.h"],
+    sdk_dylibs = [
+        "bsm",
+    ],
+    deps = [
+        ":SystemResources",
+        "@OCMock",
+        "@com_google_googletest//:gtest",
+    ],
+)

Source/common/BranchPrediction.h

@@ -0,0 +1,22 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__BRANCHPREDICTION_H
+#define SANTA__COMMON__BRANCHPREDICTION_H
+
+// Helpful macros to use when the the outcome is largely known
+#define likely(x) __builtin_expect(!!(x), 1)
+#define unlikely(x) __builtin_expect(!!(x), 0)
+
+#endif

Source/common/Platform.h

@@ -0,0 +1,34 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__PLATFORM_H
+#define SANTA__COMMON__PLATFORM_H
+
+#include <Availability.h>
+
+#if defined(MAC_OS_VERSION_12_0) && \
+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_12_0
+#define HAVE_MACOS_12 1
+#else
+#define HAVE_MACOS_12 0
+#endif
+
+#if defined(MAC_OS_VERSION_13_0) && \
+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_13_0
+#define HAVE_MACOS_13 1
+#else
+#define HAVE_MACOS_13 0
+#endif
+
+#endif

Source/common/PrefixTree.h

@@ -0,0 +1,302 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__PREFIXTREE_H
+#define SANTA__COMMON__PREFIXTREE_H
+
+#include <sys/syslimits.h>
+
+#include <optional>
+
+#import "Source/common/SNTLogging.h"
+#include "absl/synchronization/mutex.h"
+
+#if SANTA_PREFIX_TREE_DEBUG
+#define DEBUG_LOG LOGD
+#else
+#define DEBUG_LOG(format, ...)  // NOP
+#endif
+
+namespace santa::common {
+
+template <typename ValueT>
+class PrefixTree {
+ private:
+  // Forward declaration
+  enum class NodeType;
+  class TreeNode;
+
+ public:
+  PrefixTree(uint32_t max_depth = PATH_MAX)
+      : root_(new TreeNode()), max_depth_(max_depth), node_count_(0) {}
+
+  ~PrefixTree() { PruneLocked(root_); }
+
+  bool InsertPrefix(const char *s, ValueT value) {
+    absl::MutexLock lock(&lock_);
+    return InsertLocked(s, value, NodeType::kPrefix);
+  }
+
+  bool InsertLiteral(const char *s, ValueT value) {
+    absl::MutexLock lock(&lock_);
+    return InsertLocked(s, value, NodeType::kLiteral);
+  }
+
+  bool HasPrefix(const char *input) {
+    absl::ReaderMutexLock lock(&lock_);
+    return HasPrefixLocked(input);
+  }
+
+  std::optional<ValueT> LookupLongestMatchingPrefix(const char *input) {
+    if (!input) {
+      return std::nullopt;
+    }
+
+    absl::ReaderMutexLock lock(&lock_);
+    return LookupLongestMatchingPrefixLocked(input);
+  }
+
+  void Reset() {
+    absl::MutexLock lock(&lock_);
+    PruneLocked(root_);
+    root_ = new TreeNode();
+    node_count_ = 0;
+  }
+
+#if SANTA_PREFIX_TREE_DEBUG
+  void Print() {
+    char buf[max_depth_ + 1];
+    memset(buf, 0, sizeof(buf));
+
+    absl::ReaderMutexLock lock(&lock_);
+    PrintLocked(root_, buf, 0);
+  }
+
+  uint32_t NodeCount() {
+    absl::ReaderMutexLock lock(&lock_);
+    return node_count_;
+  }
+#endif
+
+ private:
+  ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_)
+  bool InsertLocked(const char *input, ValueT value, NodeType node_type) {
+    const char *p = input;
+    TreeNode *node = root_;
+
+    while (*p) {
+      uint8_t cur_byte = (uint8_t)*p;
+
+      TreeNode *child_node = node->children_[cur_byte];
+      if (!child_node) {
+        // Current node doesn't exist...
+        // Create the rest of the nodes in the tree for the given string
+
+        // Keep a pointer to where this new branch starts from. If the
+        // input length exceeds max_depth, the new branch will need to
+        // be pruned.
+        TreeNode *branch_start_node = node;
+        uint8_t branch_start_byte = (uint8_t)*p;
+
+        do {
+          TreeNode *new_node = new TreeNode();
+          node->children_[cur_byte] = new_node;
+          node = new_node;
+          node_count_++;
+
+          // Check current depth...
+          if (p - input >= max_depth_) {
+            // Attempted to add a string that exceeded max depth
+            // Prune tree from start of this new branch
+            PruneLocked(branch_start_node->children_[branch_start_byte]);
+            branch_start_node->children_[branch_start_byte] = nullptr;
+
+            return false;
+          }
+
+          cur_byte = (uint8_t) * ++p;
+        } while (*p);
+
+        node->node_type_ = node_type;
+        node->value_ = value;
+
+        return true;
+      } else if (*(p + 1) == '\0') {
+        // Current node exists and we're at the end of our input...
+        // Note: The current node's data will be overwritten
+
+        // Only increment node count if the previous node type wasn't already a
+        // prefix or literal type (in which case it was already counted)
+        if (child_node->node_type_ == NodeType::kInner) {
+          node_count_++;
+        }
+
+        child_node->node_type_ = node_type;
+        child_node->value_ = value;
+        return true;
+      }
+
+      node = child_node;
+      p++;
+    }
+
+    // Should only get here when input is an empty string
+    return false;
+  }
+
+  ABSL_SHARED_LOCKS_REQUIRED(lock_)
+  bool HasPrefixLocked(const char *input) {
+    TreeNode *node = root_;
+    const char *p = input;
+
+    while (*p) {
+      node = node->children_[(uint8_t)*p++];
+
+      if (!node) {
+        break;
+      }
+
+      if (node->node_type_ == NodeType::kPrefix ||
+          (*p == '\0' && node->node_type_ == NodeType::kLiteral)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  ABSL_SHARED_LOCKS_REQUIRED(lock_)
+  std::optional<ValueT> LookupLongestMatchingPrefixLocked(const char *input) {
+    TreeNode *node = root_;
+    TreeNode *match = nullptr;
+    const char *p = input;
+
+    while (*p) {
+      node = node->children_[(uint8_t)*p++];
+
+      if (!node) {
+        break;
+      }
+
+      if (node->node_type_ == NodeType::kPrefix ||
+          (*p == '\0' && node->node_type_ == NodeType::kLiteral)) {
+        match = node;
+      }
+    }
+
+    return match ? std::make_optional<ValueT>(match->value_) : std::nullopt;
+  }
+
+  ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_)
+  void PruneLocked(TreeNode *target) {
+    if (!target) {
+      return;
+    }
+
+    // For deep trees, a recursive approach will generate too many stack frames.
+    // Since the depth of the tree is configurable, err on the side of caution
+    // and use a "stack" to walk the tree in a non-recursive manner.
+    TreeNode **stack = new TreeNode *[node_count_ + 1];
+    if (!stack) {
+      LOGE(@"Unable to prune tree!");
+      return;
+    }
+
+    uint32_t count = 0;
+
+    // Seed the "stack" with a starting node.
+    stack[count++] = target;
+
+    // Start at the target node and walk the tree to find and delete all the
+    // sub-nodes.
+    while (count) {
+      TreeNode *node = stack[--count];
+
+      for (int i = 0; i < 256; ++i) {
+        if (!node->children_[i]) {
+          continue;
+        }
+        stack[count++] = node->children_[i];
+      }
+
+      delete node;
+      --node_count_;
+    }
+
+    delete[] stack;
+  }
+
+#if SANTA_PREFIX_TREE_DEBUG
+  ABSL_SHARED_LOCKS_REQUIRED(lock_)
+  void PrintLocked(TreeNode *node, char *buf, uint32_t depth) {
+    for (size_t i = 0; i < 256; i++) {
+      TreeNode *cur_node = node->children_[i];
+      if (cur_node) {
+        buf[depth] = i;
+        if (cur_node->node_type_ != NodeType::kInner) {
+          printf("\t%s (type: %s)\n", buf,
+                 cur_node->node_type_ == NodeType::kPrefix ? "prefix" : "literal");
+        }
+        PrintLocked(cur_node, buf, depth + 1);
+        buf[depth] = '\0';
+      }
+    }
+  }
+#endif
+
+  enum class NodeType {
+    kInner = 0,
+    kPrefix,
+    kLiteral,
+  };
+
+  ///
+  ///  TreeNode is a wrapper class that represents one byte.
+  ///  1 node can represent a whole ASCII character.
+  ///  For example a pointer to the 'A' node will be stored at children[0x41].
+  ///  It takes 1-4 nodes to represent a UTF-8 encoded Unicode character.
+  ///
+  ///  The path for "/🤘" would look like this:
+  ///      children[0x2f] -> children[0xf0] -> children[0x9f] -> children[0xa4]
+  ///      -> children[0x98]
+  ///
+  ///  The path for "/dev" is:
+  ///      children[0x2f] -> children[0x64] -> children[0x65] -> children[0x76]
+  ///
+  ///  Lookups of children are O(1).
+  ///
+  ///  Having the nodes represented by a smaller width, such as a nibble (1/2
+  ///  byte), would drastically decrease the memory footprint but would double
+  ///  required dereferences.
+  ///
+  ///  TODO(bur): Potentially convert this into a full on radix tree.
+  ///
+  class TreeNode {
+   public:
+    TreeNode() : children_(), node_type_(NodeType::kInner) {}
+    ~TreeNode() = default;
+    TreeNode *children_[256];
+    PrefixTree::NodeType node_type_;
+    ValueT value_;
+  };
+
+  TreeNode *root_;
+  const uint32_t max_depth_;
+  uint32_t node_count_ ABSL_GUARDED_BY(lock_);
+  absl::Mutex lock_;
+};
+
+}  // namespace santa::common
+
+#endif

Source/common/PrefixTreeTest.mm

@@ -0,0 +1,224 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#define SANTA_PREFIX_TREE_DEBUG 1
+#include "Source/common/PrefixTree.h"
+
+using santa::common::PrefixTree;
+
+@interface PrefixTreeTest : XCTestCase
+@end
+
+@implementation PrefixTreeTest
+
+- (void)testBasic {
+  PrefixTree<int> tree;
+
+  XCTAssertFalse(tree.HasPrefix("/foo/bar/baz"));
+  XCTAssertFalse(tree.HasPrefix("/foo/bar.txt"));
+  XCTAssertFalse(tree.HasPrefix("/baz"));
+
+  XCTAssertTrue(tree.InsertPrefix("/foo", 12));
+  XCTAssertTrue(tree.InsertPrefix("/bar", 34));
+  XCTAssertTrue(tree.InsertLiteral("/foo/bar", 56));
+
+  // Re-inserting something that exists is allowed
+  XCTAssertTrue(tree.InsertLiteral("/foo", 78));
+  XCTAssertTrue(tree.InsertPrefix("/foo", 56));
+
+  XCTAssertTrue(tree.HasPrefix("/foo/bar/baz"));
+  XCTAssertTrue(tree.HasPrefix("/foo/bar.txt"));
+  XCTAssertFalse(tree.HasPrefix("/baz"));
+
+  // Empty strings are not supported
+  XCTAssertFalse(tree.InsertLiteral("", 0));
+  XCTAssertFalse(tree.InsertPrefix("", 0));
+}
+
+- (void)testHasPrefix {
+  PrefixTree<int> tree;
+
+  XCTAssertTrue(tree.InsertPrefix("/foo", 0));
+  XCTAssertTrue(tree.InsertLiteral("/bar", 0));
+  XCTAssertTrue(tree.InsertLiteral("/baz", 0));
+  XCTAssertTrue(tree.InsertLiteral("/qaz", 0));
+
+  // Check that a tree with a matching prefix is successful
+  XCTAssertTrue(tree.HasPrefix("/foo.txt"));
+
+  // This shouldn't succeed because `/bar` `/baz` and `qaz` are literals
+  XCTAssertFalse(tree.HasPrefix("/bar.txt"));
+  XCTAssertFalse(tree.HasPrefix("/baz.txt"));
+  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
+
+  // Now change `/bar` to a prefix type and retest HasPrefix
+  // `/bar.txt` should now succeed, but `/baz.txt` should still not pass
+  XCTAssertTrue(tree.InsertPrefix("/bar", 0));
+  XCTAssertTrue(tree.HasPrefix("/bar.txt"));
+  XCTAssertFalse(tree.HasPrefix("/baz.txt"));
+  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
+
+  // Insert a new prefix string to allow `/baz.txt` to have a valid prefix
+  XCTAssertTrue(tree.InsertPrefix("/b", 0));
+  XCTAssertTrue(tree.HasPrefix("/baz.txt"));
+  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
+
+  // An exact match on a literal allows HasPrefix to succeed
+  XCTAssertTrue(tree.InsertLiteral("/qaz.txt", 0));
+  XCTAssertTrue(tree.HasPrefix("/qaz.txt"));
+}
+
+- (void)testLookupLongestMatchingPrefix {
+  PrefixTree<int> tree;
+
+  XCTAssertTrue(tree.InsertPrefix("/foo", 12));
+  XCTAssertTrue(tree.InsertPrefix("/bar", 34));
+  XCTAssertTrue(tree.InsertPrefix("/foo/bar.txt", 56));
+
+  std::optional<int> value;
+
+  // Matching exact prefix
+  value = tree.LookupLongestMatchingPrefix("/foo");
+  XCTAssertEqual(value.value_or(0), 12);
+
+  // Ensure changing node type works as expected
+  // Literals must match exactly.
+  value = tree.LookupLongestMatchingPrefix("/foo/bar.txt.tmp");
+  XCTAssertEqual(value.value_or(0), 56);
+  XCTAssertTrue(tree.InsertLiteral("/foo/bar.txt", 90));
+  value = tree.LookupLongestMatchingPrefix("/foo/bar.txt.tmp");
+  XCTAssertEqual(value.value_or(0), 12);
+
+  // Inserting over an exiting node returns the new value
+  XCTAssertTrue(tree.InsertPrefix("/foo", 78));
+  value = tree.LookupLongestMatchingPrefix("/foo");
+  XCTAssertEqual(value.value_or(0), 78);
+
+  // No matching prefix
+  value = tree.LookupLongestMatchingPrefix("/asdf");
+  XCTAssertEqual(value.value_or(0), 0);
+}
+
+- (void)testNodeCounts {
+  const uint32_t maxDepth = 100;
+  PrefixTree<int> tree(100);
+
+  XCTAssertEqual(tree.NodeCount(), 0);
+
+  // Start with a small string
+  XCTAssertTrue(tree.InsertPrefix("asdf", 0));
+  XCTAssertEqual(tree.NodeCount(), 4);
+
+  // Add a couple more characters to the existing string
+  XCTAssertTrue(tree.InsertPrefix("asdfgh", 0));
+  XCTAssertEqual(tree.NodeCount(), 6);
+
+  // Inserting a string that exceeds max depth doesn't increase node count
+  XCTAssertFalse(tree.InsertPrefix(std::string(maxDepth + 10, 'A').c_str(), 0));
+  XCTAssertEqual(tree.NodeCount(), 6);
+
+  // Add a new string that is a prefix of an existing string
+  // This should increment the count by one since a new terminal node exists
+  XCTAssertTrue(tree.InsertPrefix("as", 0));
+  XCTAssertEqual(tree.NodeCount(), 7);
+
+  // Re-inserting onto an existing node shouldn't modify the count
+  tree.InsertLiteral("as", 0);
+  tree.InsertPrefix("as", 0);
+  XCTAssertEqual(tree.NodeCount(), 7);
+}
+
+- (void)testReset {
+  // Ensure resetting a tree removes all content
+  PrefixTree<int> tree;
+
+  tree.Reset();
+  XCTAssertEqual(tree.NodeCount(), 0);
+
+  XCTAssertTrue(tree.InsertPrefix("asdf", 0));
+  XCTAssertTrue(tree.InsertPrefix("qwerty", 0));
+
+  XCTAssertTrue(tree.HasPrefix("asdf"));
+  XCTAssertTrue(tree.HasPrefix("qwerty"));
+  XCTAssertEqual(tree.NodeCount(), 10);
+
+  tree.Reset();
+  XCTAssertFalse(tree.HasPrefix("asdf"));
+  XCTAssertFalse(tree.HasPrefix("qwerty"));
+  XCTAssertEqual(tree.NodeCount(), 0);
+}
+
+- (void)testComplexValues {
+  class Foo {
+   public:
+    Foo(int x) : x_(x) {}
+    int X() { return x_; }
+
+   private:
+    int x_;
+  };
+
+  PrefixTree<std::shared_ptr<Foo>> tree;
+
+  XCTAssertTrue(tree.InsertPrefix("foo", std::make_shared<Foo>(123)));
+  XCTAssertTrue(tree.InsertPrefix("bar", std::make_shared<Foo>(456)));
+
+  std::optional<std::shared_ptr<Foo>> value;
+  value = tree.LookupLongestMatchingPrefix("foo");
+  XCTAssertTrue(value.has_value() && value->get()->X() == 123);
+
+  value = tree.LookupLongestMatchingPrefix("bar");
+  XCTAssertTrue(value.has_value() && value->get()->X() == 456);
+
+  value = tree.LookupLongestMatchingPrefix("asdf");
+  XCTAssertFalse(value.has_value());
+}
+
+- (void)testThreading {
+  uint32_t count = 4096;
+  auto t = new PrefixTree<int>(count * (uint32_t)[NSUUID UUID].UUIDString.length);
+
+  NSMutableArray *UUIDs = [NSMutableArray arrayWithCapacity:count];
+  for (int i = 0; i < count; ++i) {
+    [UUIDs addObject:[NSUUID UUID].UUIDString];
+  }
+
+  __block BOOL stop = NO;
+
+  // Create a bunch of background noise.
+  dispatch_async(dispatch_get_global_queue(0, 0), ^{
+    for (uint64_t i = 0; i < UINT64_MAX; ++i) {
+      dispatch_async(dispatch_get_global_queue(0, 0), ^{
+        t->HasPrefix([UUIDs[i % count] UTF8String]);
+      });
+      if (stop) return;
+    }
+  });
+
+  // Fill up the tree.
+  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
+    XCTAssertEqual(t->InsertPrefix([UUIDs[i] UTF8String], 0), true);
+  });
+
+  // Make sure every leaf byte is found.
+  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
+    XCTAssertTrue(t->HasPrefix([UUIDs[i] UTF8String]));
+  });
+
+  stop = YES;
+}
+
+@end

Source/common/SNTAllowlistInfo.m

@@ -1,32 +0,0 @@
-/// Copyright 2021 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "Source/common/SNTAllowlistInfo.h"
-
-@implementation SNTAllowlistInfo
-
-- (instancetype)initWithPid:(pid_t)pid
-                 pidversion:(int)pidver
-                 targetPath:(NSString *)targetPath
-                     sha256:(NSString *)hash {
-  self = [super init];
-  if (self) {
-    _pid = pid;
-    _pidversion = pidver;
-    _targetPath = targetPath;
-    _sha256 = hash;
-  }
-  return self;
-}
-@end

Source/common/SNTCachedDecision.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,10 +12,11 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#import <EndpointSecurity/EndpointSecurity.h>
 #import <Foundation/Foundation.h>
 
 #import "Source/common/SNTCommonEnums.h"
-#import "Source/common/SNTCommon.h"
+#import "Source/common/SantaVnode.h"
 
 @class MOLCertificate;
 
@@ -24,7 +25,9 @@
 ///
 @interface SNTCachedDecision : NSObject
 
-@property santa_vnode_id_t vnodeId;
+- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile;
+
+@property SantaVnode vnodeId;
 @property SNTEventState decision;
 @property NSString *decisionExtra;
 @property NSString *sha256;

Source/common/SNTCachedDecision.mm

@@ -1,4 +1,5 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -15,4 +16,13 @@
 #import "Source/common/SNTCachedDecision.h"
 
 @implementation SNTCachedDecision
+
+- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile {
+  self = [super init];
+  if (self) {
+    _vnodeId = SantaVnode::VnodeForFile(esFile);
+  }
+  return self;
+}
+
 @end

Source/common/SNTCachedDecisionTest.mm

@@ -0,0 +1,36 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#import "Source/common/SNTCachedDecision.h"
+#include "Source/common/TestUtils.h"
+
+@interface SNTCachedDecisionTest : XCTestCase
+@end
+
+@implementation SNTCachedDecisionTest
+
+- (void)testSNTCachedDecisionInit {
+  // Ensure the vnodeId field is properly set from the es_file_t
+  struct stat sb = MakeStat();
+  es_file_t file = MakeESFile("foo", sb);
+
+  SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:&file];
+
+  XCTAssertEqual(sb.st_ino, cd.vnodeId.fileid);
+  XCTAssertEqual(sb.st_dev, cd.vnodeId.fsid);
+}
+
+@end

Source/common/SNTCommon.h

@@ -1,102 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-///
-/// Common defines between daemon <-> client
-///
-
-#ifndef SANTA__COMMON__COMMON_H
-#define SANTA__COMMON__COMMON_H
-
-#include <stdint.h>
-#include <sys/param.h>
-
-// Branch prediction
-#define likely(x) __builtin_expect(!!(x), 1)
-#define unlikely(x) __builtin_expect(!!(x), 0)
-
-typedef enum {
-  ACTION_UNSET = 0,
-
-  // REQUESTS
-  ACTION_REQUEST_SHUTDOWN = 10,
-  ACTION_REQUEST_BINARY = 11,
-
-  // RESPONSES
-  ACTION_RESPOND_ALLOW = 20,
-  ACTION_RESPOND_DENY = 21,
-  ACTION_RESPOND_TOOLONG = 22,
-  ACTION_RESPOND_ACK = 23,
-  ACTION_RESPOND_ALLOW_COMPILER = 24,
-  // The following response is stored only in the kernel decision cache.
-  // It is removed by SNTCompilerController
-  ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE = 25,
-
-  // NOTIFY
-  ACTION_NOTIFY_EXEC = 30,
-  ACTION_NOTIFY_WRITE = 31,
-  ACTION_NOTIFY_RENAME = 32,
-  ACTION_NOTIFY_LINK = 33,
-  ACTION_NOTIFY_EXCHANGE = 34,
-  ACTION_NOTIFY_DELETE = 35,
-  ACTION_NOTIFY_WHITELIST = 36,
-  ACTION_NOTIFY_FORK = 37,
-  ACTION_NOTIFY_EXIT = 38,
-
-  // ERROR
-  ACTION_ERROR = 99,
-} santa_action_t;
-
-#define RESPONSE_VALID(x)                                   \
-  (x == ACTION_RESPOND_ALLOW || x == ACTION_RESPOND_DENY || \
-   x == ACTION_RESPOND_ALLOW_COMPILER ||                    \
-   x == ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE)
-
-// Struct to manage vnode IDs
-typedef struct santa_vnode_id_t {
-  uint64_t fsid;
-  uint64_t fileid;
-
-#ifdef __cplusplus
-  bool operator==(const santa_vnode_id_t &rhs) const {
-    return fsid == rhs.fsid && fileid == rhs.fileid;
-  }
-#endif
-} santa_vnode_id_t;
-
-typedef struct {
-  santa_action_t action;
-  santa_vnode_id_t vnode_id;
-  uid_t uid;
-  gid_t gid;
-  pid_t pid;
-  int pidversion;
-  pid_t ppid;
-  char path[MAXPATHLEN];
-  char newpath[MAXPATHLEN];
-  char ttypath[MAXPATHLEN];
-  // For file events, this is the process name.
-  // For exec requests, this is the parent process name.
-  // While process names can technically be 4*MAXPATHLEN, that never
-  // actually happens, so only take MAXPATHLEN and throw away any excess.
-  char pname[MAXPATHLEN];
-
-  // This points to a copy of the original ES message.
-  void *es_message;
-
-  // This points to an NSArray of the process arguments.
-  void *args_array;
-} santa_message_t;
-
-#endif  // SANTA__COMMON__COMMON_H

Source/common/SNTCommonEnums.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -19,6 +19,23 @@
 ///  The integer values are also stored in the database and so shouldn't be changed.
 ///
 
+typedef NS_ENUM(NSInteger, SNTAction) {
+  SNTActionUnset,
+
+  // REQUESTS
+  // If an operation is awaiting a cache decision from a similar operation
+  // currently being processed, it will poll about every 5 ms for an answer.
+  SNTActionRequestBinary,
+
+  // RESPONSES
+  SNTActionRespondAllow,
+  SNTActionRespondDeny,
+  SNTActionRespondAllowCompiler,
+};
+
+#define RESPONSE_VALID(x) \
+  (x == SNTActionRespondAllow || x == SNTActionRespondDeny || x == SNTActionRespondAllowCompiler)
+
 typedef NS_ENUM(NSInteger, SNTRuleType) {
   SNTRuleTypeUnknown,
 
@@ -57,6 +74,7 @@ typedef NS_ENUM(NSInteger, SNTEventState) {
   SNTEventStateBlockCertificate = 1 << 18,
   SNTEventStateBlockScope = 1 << 19,
   SNTEventStateBlockTeamID = 1 << 20,
+  SNTEventStateBlockLongPath = 1 << 21,
 
   // Bits 24-31 store allow decision types
   SNTEventStateAllowUnknown = 1 << 24,
@@ -117,8 +135,18 @@ typedef NS_ENUM(NSInteger, SNTMetricFormatType) {
   SNTMetricFormatTypeMonarchJSON,
 };
 
+#ifdef __cplusplus
+enum class FileAccessPolicyDecision {
+  kNoPolicy,
+  kDenied,
+  kDeniedInvalidSignature,
+  kAllowed,
+  kAllowedReadAccess,
+  kAllowedAuditOnly,
+};
+#endif
+
 static const char *kSantaDPath =
   "/Applications/Santa.app/Contents/Library/SystemExtensions/"
   "com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon";
-static const char *kSantaCtlPath = "/Applications/Santa.app/Contents/MacOS/santactl";
 static const char *kSantaAppPath = "/Applications/Santa.app";

Source/common/SNTConfigurator.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -65,7 +65,8 @@
 ///      <key>rule_type</key>
 ///      <string>BINARY</string>  (one of BINARY, CERTIFICATE or TEAMID)
 ///      <key>policy</key>
-///      <string>BLOCKLIST</string>  (one of ALLOWLIST, ALLOWLIST_COMPILER, BLOCKLIST, SILENT_BLOCKLIST)
+///      <string>BLOCKLIST</string>  (one of ALLOWLIST, ALLOWLIST_COMPILER, BLOCKLIST,
+///                                   SILENT_BLOCKLIST)
 ///    </dict>
 ///  </array>
 ///
@@ -182,10 +183,10 @@
 ///    SNTEventLogTypeSyslog "syslog": Sent to ASL or ULS (if built with the 10.12 SDK or later).
 ///    SNTEventLogTypeFilelog "file": Sent to a file on disk. Use eventLogPath to specify a path.
 ///    SNTEventLogTypeNull "null": Logs nothing
-///    SNTEventLogTypeProtobuf "protobuf": (BETA) Sent to a file on disk, using maildir format. Use
-///      mailDirectory to specify a path. Use mailDirectoryFileSizeThresholdKB,
-///      mailDirectorySizeThresholdMB and mailDirectoryEventMaxFlushTimeSec to configure
-///      additional maildir format settings.
+///    SNTEventLogTypeProtobuf "protobuf": (BETA) Sent to a file on disk, using a maildir-like
+///      format. Use spoolDirectory to specify a path. Use spoolDirectoryFileSizeThresholdKB,
+///      spoolDirectorySizeThresholdMB and spoolDirectoryEventMaxFlushTimeSec to configure
+///      additional settings.
 ///    Defaults to SNTEventLogTypeFilelog.
 ///    For mobileconfigs use EventLogType as the key and syslog or filelog strings as the value.
 ///
@@ -202,40 +203,57 @@
 @property(readonly, nonatomic) NSString *eventLogPath;
 
 ///
-///  If eventLogType is set to protobuf, mailDirectory will provide the base path used for
-///  saving logs using the maildir format.
-///  Defaults to /var/db/santa/mail.
+///  If eventLogType is set to protobuf, spoolDirectory will provide the base path used for
+///  saving logs using a maildir-like format.
+///  Defaults to /var/db/santa/spool.
 ///
 ///  @note: This property is KVO compliant, but should only be read once at santad startup.
 ///
-@property(readonly, nonatomic) NSString *mailDirectory;
+@property(readonly, nonatomic) NSString *spoolDirectory;
 
 ///
-///  If eventLogType is set to protobuf, mailDirectoryFileSizeThresholdKB sets the per-file size
-///  limit for files saved in the mailDirectory.
+///  If eventLogType is set to protobuf, spoolDirectoryFileSizeThresholdKB sets the per-file size
+///  limit for files saved in the spoolDirectory.
+///  Defaults to 250.
+///
+///  @note: This property is KVO compliant, but should only be read once at santad startup.
+///
+@property(readonly, nonatomic) NSUInteger spoolDirectoryFileSizeThresholdKB;
+
+///
+///  If eventLogType is set to protobuf, spoolDirectorySizeThresholdMB sets the total size
+///  limit for all files saved in the spoolDirectory.
 ///  Defaults to 100.
 ///
 ///  @note: This property is KVO compliant, but should only be read once at santad startup.
 ///
-@property(readonly, nonatomic) NSUInteger mailDirectoryFileSizeThresholdKB;
+@property(readonly, nonatomic) NSUInteger spoolDirectorySizeThresholdMB;
 
 ///
-///  If eventLogType is set to protobuf, mailDirectorySizeThresholdMB sets the total size
-///  limit for all files saved in the mailDirectory.
-///  Defaults to 500.
-///
-///  @note: This property is KVO compliant, but should only be read once at santad startup.
-///
-@property(readonly, nonatomic) NSUInteger mailDirectorySizeThresholdMB;
-
-///
-///  If eventLogType is set to protobuf, mailDirectoryEventMaxFlushTimeSec sets the maximum amount
+///  If eventLogType is set to protobuf, spoolDirectoryEventMaxFlushTimeSec sets the maximum amount
 ///  of time an event will be stored in memory before being written to disk.
-///  Defaults to 5.0.
+///  Defaults to 15.0.
 ///
 ///  @note: This property is KVO compliant, but should only be read once at santad startup.
 ///
-@property(readonly, nonatomic) float mailDirectoryEventMaxFlushTimeSec;
+@property(readonly, nonatomic) float spoolDirectoryEventMaxFlushTimeSec;
+
+///
+///  If set, contains the path to the filesystem access policy config plist.
+///
+///  @note: This property is KVO compliant, but is only read once at santad startup.
+///
+@property(readonly, nonatomic) NSString *fileAccessPolicyPlist;
+
+///
+///  If fileAccessPolicyPlist is set, fileAccessPolicyUpdateIntervalSec
+///  sets the number of seconds between times that the configuration file is
+///  re-read and policies reconstructed.
+///  Defaults to 600 seconds (10 minutes)
+///
+///  @note: This property is KVO compliant, but should only be read once at santad startup.
+///
+@property(readonly, nonatomic) uint32_t fileAccessPolicyUpdateIntervalSec;
 
 ///
 /// Enabling this appends the Santa machine ID to the end of each log line. If nothing
@@ -244,15 +262,6 @@
 ///
 @property(readonly, nonatomic) BOOL enableMachineIDDecoration;
 
-///
-///  Use an internal cache for decisions instead of relying on the caching
-///  mechanism built-in to the EndpointSecurity framework. This may increase
-///  performance, particularly when Santa is run alongside other system
-///  extensions.
-///  Has no effect if the system extension is not being used. Defaults to NO.
-///
-@property(readonly, nonatomic) BOOL enableSysxCache;
-
 #pragma mark - GUI Settings
 
 ///
@@ -387,12 +396,6 @@
 ///
 @property(nonatomic) NSArray<NSString *> *remountUSBMode;
 
-///
-/// When `blockUSBMount` is set, this is the message shown to the user when a device is blocked
-/// If this message is not configured, a reasonable default is provided.
-///
-@property(readonly, nonatomic) NSString *usbBlockMessage;
-
 ///
 ///  If set, this over-rides the default machine ID used for syncing.
 ///

Source/common/SNTConfigurator.m

@@ -1,4 +1,4 @@
-/// Copyright 2021 Google Inc. All rights reserved.
+/// Copyright 2014-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -37,6 +37,7 @@
 
 /// Holds the last processed hash of the static rules list.
 @property(atomic) NSDictionary *cachedStaticRules;
+
 @end
 
 @implementation SNTConfigurator
@@ -44,6 +45,10 @@
 /// The hard-coded path to the sync state file.
 NSString *const kSyncStateFilePath = @"/var/db/santa/sync-state.plist";
 
+#ifdef DEBUG
+NSString *const kConfigOverrideFilePath = @"/var/db/santa/config-overrides.plist";
+#endif
+
 /// The domain used by mobileconfig.
 static NSString *const kMobileConfigDomain = @"com.google.santa";
 
@@ -87,15 +92,16 @@ static NSString *const kFileChangesPrefixFiltersKey = @"FileChangesPrefixFilters
 
 static NSString *const kEventLogType = @"EventLogType";
 static NSString *const kEventLogPath = @"EventLogPath";
-static NSString *const kMailDirectory = @"MailDirectory";
-static NSString *const kMailDirectoryFileSizeThresholdKB = @"MailDirectoryFileSizeThresholdKB";
-static NSString *const kMailDirectorySizeThresholdMB = @"MailDirectorySizeThresholdMB";
-static NSString *const kMailDirectoryEventMaxFlushTimeSec = @"MailDirectoryEventMaxFlushTimeSec";
+static NSString *const kSpoolDirectory = @"SpoolDirectory";
+static NSString *const kSpoolDirectoryFileSizeThresholdKB = @"SpoolDirectoryFileSizeThresholdKB";
+static NSString *const kSpoolDirectorySizeThresholdMB = @"SpoolDirectorySizeThresholdMB";
+static NSString *const kSpoolDirectoryEventMaxFlushTimeSec = @"SpoolDirectoryEventMaxFlushTimeSec";
+
+static NSString *const kFileAccessPolicyPlist = @"FileAccessPolicyPlist";
+static NSString *const kFileAccessPolicyUpdateIntervalSec = @"FileAccessPolicyUpdateIntervalSec";
 
 static NSString *const kEnableMachineIDDecoration = @"EnableMachineIDDecoration";
 
-static NSString *const kEnableSysxCache = @"EnableSysxCache";
-
 static NSString *const kEnableForkAndExitLogging = @"EnableForkAndExitLogging";
 static NSString *const kIgnoreOtherEndpointSecurityClients = @"IgnoreOtherEndpointSecurityClients";
 static NSString *const kEnableDebugLogging = @"EnableDebugLogging";
@@ -173,7 +179,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kRemountUSBModeKey : array,
       kEnablePageZeroProtectionKey : number,
       kEnableBadSignatureProtectionKey : number,
-      kEnableSilentModeKey : string,
+      kEnableSilentModeKey : number,
       kAboutTextKey : string,
       kMoreInfoURLKey : string,
       kEventDetailURLKey : string,
@@ -201,12 +207,13 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kMachineIDPlistKeyKey : string,
       kEventLogType : string,
       kEventLogPath : string,
-      kMailDirectory : string,
-      kMailDirectoryFileSizeThresholdKB : number,
-      kMailDirectorySizeThresholdMB : number,
-      kMailDirectoryEventMaxFlushTimeSec : number,
+      kSpoolDirectory : string,
+      kSpoolDirectoryFileSizeThresholdKB : number,
+      kSpoolDirectorySizeThresholdMB : number,
+      kSpoolDirectoryEventMaxFlushTimeSec : number,
+      kFileAccessPolicyPlist : string,
+      kFileAccessPolicyUpdateIntervalSec : number,
       kEnableMachineIDDecoration : number,
-      kEnableSysxCache : number,
       kEnableForkAndExitLogging : number,
       kIgnoreOtherEndpointSecurityClients : number,
       kEnableDebugLogging : number,
@@ -393,19 +400,27 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingMailDirectory {
++ (NSSet *)keyPathsForValuesAffectingSpoolDirectory {
   return [self configStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingMailDirectoryFileSizeThresholdKB {
++ (NSSet *)keyPathsForValuesAffectingSpoolDirectoryFileSizeThresholdKB {
   return [self configStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingMailDirectorySizeThresholdMB {
++ (NSSet *)keyPathsForValuesAffectingSpoolDirectorySizeThresholdMB {
   return [self configStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingMailDirectoryEventMaxFlushTimeSec {
++ (NSSet *)keyPathsForValuesAffectingSpoolDirectoryEventMaxFlushTimeSec {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingFileAccessPolicyPlist {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingFileAccessPolicyUpdateIntervalSec {
   return [self configStateSet];
 }
 
@@ -425,10 +440,6 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self syncAndConfigStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingEnableSysxCache {
-  return [self configStateSet];
-}
-
 + (NSSet *)keyPathsForValuesAffectingEnableForkAndExitLogging {
   return [self configStateSet];
 }
@@ -474,15 +485,15 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 }
 
 + (NSSet *)keyPathsForValuesAffectingRemountUSBMode {
-  return [self configStateSet];
+  return [self syncAndConfigStateSet];
 }
 
 + (NSSet *)keyPathsForValuesAffectingRemountUSBBlockMessage {
-  return [self syncAndConfigStateSet];
+  return [self configStateSet];
 }
 
 + (NSSet *)keyPathsForValuesAffectingUsbBlockMessage {
-  return [self syncAndConfigStateSet];
+  return [self configStateSet];
 }
 
 #pragma mark Public Interface
@@ -583,7 +594,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 }
 
 - (NSArray<NSString *> *)remountUSBMode {
-  NSArray<NSString *> *args = self.configState[kRemountUSBModeKey];
+  NSArray<NSString *> *args = self.syncState[kRemountUSBModeKey];
+  if (!args) {
+    args = (NSArray<NSString *> *)self.configState[kRemountUSBModeKey];
+  }
   for (id arg in args) {
     if (![arg isKindOfClass:[NSString class]]) {
       return nil;
@@ -766,26 +780,36 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return self.configState[kEventLogPath] ?: @"/var/db/santa/santa.log";
 }
 
-- (NSString *)mailDirectory {
-  return self.configState[kMailDirectory] ?: @"/var/db/santa/mail";
+- (NSString *)spoolDirectory {
+  return self.configState[kSpoolDirectory] ?: @"/var/db/santa/spool";
 }
 
-- (NSUInteger)mailDirectoryFileSizeThresholdKB {
-  return self.configState[kMailDirectoryFileSizeThresholdKB]
-           ? [self.configState[kMailDirectoryFileSizeThresholdKB] unsignedIntegerValue]
+- (NSUInteger)spoolDirectoryFileSizeThresholdKB {
+  return self.configState[kSpoolDirectoryFileSizeThresholdKB]
+           ? [self.configState[kSpoolDirectoryFileSizeThresholdKB] unsignedIntegerValue]
+           : 250;
+}
+
+- (NSUInteger)spoolDirectorySizeThresholdMB {
+  return self.configState[kSpoolDirectorySizeThresholdMB]
+           ? [self.configState[kSpoolDirectorySizeThresholdMB] unsignedIntegerValue]
            : 100;
 }
 
-- (NSUInteger)mailDirectorySizeThresholdMB {
-  return self.configState[kMailDirectorySizeThresholdMB]
-           ? [self.configState[kMailDirectorySizeThresholdMB] unsignedIntegerValue]
-           : 500;
+- (float)spoolDirectoryEventMaxFlushTimeSec {
+  return self.configState[kSpoolDirectoryEventMaxFlushTimeSec]
+           ? [self.configState[kSpoolDirectoryEventMaxFlushTimeSec] floatValue]
+           : 15.0;
 }
 
-- (float)mailDirMaxFlushTime {
-  return self.configState[kMailDirectoryEventMaxFlushTimeSec]
-           ? [self.configState[kMailDirectoryEventMaxFlushTimeSec] floatValue]
-           : 5.0;
+- (NSString *)fileAccessPolicyPlist {
+  return self.configState[kFileAccessPolicyPlist];
+}
+
+- (uint32_t)fileAccessPolicyUpdateIntervalSec {
+  return self.configState[kFileAccessPolicyUpdateIntervalSec]
+           ? [self.configState[kFileAccessPolicyUpdateIntervalSec] unsignedIntValue]
+           : 60 * 10;
 }
 
 - (BOOL)enableMachineIDDecoration {
@@ -793,11 +817,6 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return number ? [number boolValue] : NO;
 }
 
-- (BOOL)enableSysxCache {
-  NSNumber *number = self.configState[kEnableSysxCache];
-  return number ? [number boolValue] : YES;
-}
-
 - (BOOL)enableCleanSyncEventUpload {
   NSNumber *number = self.configState[kSyncEnableCleanSyncEventUpload];
   return number ? [number boolValue] : NO;
@@ -866,8 +885,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 }
 
 - (BOOL)blockUSBMount {
-  NSNumber *number = self.configState[kBlockUSBMountKey];
-  return number ? [number boolValue] : NO;
+  NSNumber *n = self.syncState[kBlockUSBMountKey];
+  if (n) return [n boolValue];
+
+  return [self.configState[kBlockUSBMountKey] boolValue];
 }
 
 ///
@@ -998,6 +1019,18 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       forcedConfig[key] = [self expressionForPattern:pattern];
     }
   }
+#ifdef DEBUG
+  NSDictionary *overrides = [NSDictionary dictionaryWithContentsOfFile:kConfigOverrideFilePath];
+  for (NSString *key in overrides) {
+    id obj = overrides[key];
+    if (![obj isKindOfClass:self.forcedConfigKeyTypes[key]]) continue;
+    forcedConfig[key] = obj;
+    if (self.forcedConfigKeyTypes[key] == [NSRegularExpression class]) {
+      NSString *pattern = [obj isKindOfClass:[NSString class]] ? obj : nil;
+      forcedConfig[key] = [self expressionForPattern:pattern];
+    }
+  }
+#endif
   return forcedConfig;
 }
 
@@ -1014,12 +1047,50 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
                                            selector:@selector(defaultsChanged:)
                                                name:NSUserDefaultsDidChangeNotification
                                              object:nil];
+#ifdef DEBUG
+  dispatch_async(dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^{
+    [self watchOverridesFile];
+  });
+#endif
 }
 
+#ifdef DEBUG
+- (void)watchOverridesFile {
+  while (![[NSFileManager defaultManager] fileExistsAtPath:kConfigOverrideFilePath]) {
+    [NSThread sleepForTimeInterval:0.2];
+  }
+  [self defaultsChanged:nil];
+
+  int descriptor = open([kConfigOverrideFilePath fileSystemRepresentation], O_EVTONLY);
+  if (descriptor < 0) {
+    return;
+  }
+
+  dispatch_source_t source =
+    dispatch_source_create(DISPATCH_SOURCE_TYPE_VNODE, descriptor,
+                           DISPATCH_VNODE_WRITE | DISPATCH_VNODE_RENAME | DISPATCH_VNODE_DELETE,
+                           dispatch_get_global_queue(QOS_CLASS_UTILITY, 0));
+  dispatch_source_set_event_handler(source, ^{
+    dispatch_async(dispatch_get_main_queue(), ^{
+      [self defaultsChanged:nil];
+    });
+    unsigned long events = dispatch_source_get_data(source);
+    if ((events & DISPATCH_VNODE_DELETE) || (events & DISPATCH_VNODE_RENAME)) {
+      dispatch_source_cancel(source);
+    }
+  });
+  dispatch_source_set_cancel_handler(source, ^{
+    close(descriptor);
+    [self watchOverridesFile];
+  });
+  dispatch_resume(source);
+}
+#endif
+
 - (void)defaultsChanged:(void *)v {
   SEL handleChange = @selector(handleChange);
   [NSObject cancelPreviousPerformRequestsWithTarget:self selector:handleChange object:nil];
-  [self performSelector:handleChange withObject:nil afterDelay:5.0f];
+  [self performSelector:handleChange withObject:nil afterDelay:1.0f];
 }
 
 ///

Source/common/SNTFileInfo.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,6 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#import <EndpointSecurity/EndpointSecurity.h>
 #import <Foundation/Foundation.h>
 
 @class MOLCodesignChecker;
@@ -32,6 +33,14 @@
 ///
 - (instancetype)initWithPath:(NSString *)path error:(NSError **)error;
 
+///
+///  Convenience initializer.
+///
+///  @param esFile Pointer to an es_file_t provided by the EndpointSecurity framework.
+///      Assumes that the path is a resolved path.
+///
+- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile error:(NSError **)error;
+
 ///
 ///  Convenience initializer.
 ///

Source/common/SNTFileInfo.m

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -25,6 +25,8 @@
 #include <sys/stat.h>
 #include <sys/xattr.h>
 
+#import "Source/common/SNTLogging.h"
+
 // Simple class to hold the data of a mach_header and the offset within the file
 // in which that header was found.
 @interface MachHeaderWithOffset : NSObject
@@ -48,6 +50,7 @@
 @property NSFileHandle *fileHandle;
 @property NSUInteger fileSize;
 @property NSString *fileOwnerHomeDir;
+@property NSString *sha256Storage;
 
 // Cached properties
 @property NSBundle *bundleRef;
@@ -63,6 +66,26 @@
 extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 
 - (instancetype)initWithResolvedPath:(NSString *)path error:(NSError **)error {
+  struct stat fileStat;
+  if (path.length) {
+    lstat(path.UTF8String, &fileStat);
+  }
+  return [self initWithResolvedPath:path stat:&fileStat error:error];
+}
+
+- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile error:(NSError **)error {
+  return [self initWithResolvedPath:@(esFile->path.data) stat:&esFile->stat error:error];
+}
+
+- (instancetype)initWithResolvedPath:(NSString *)path
+                                stat:(const struct stat *)fileStat
+                               error:(NSError **)error {
+  if (!fileStat) {
+    // This is a programming error. Bail.
+    LOGE(@"NULL stat buffer unsupported");
+    exit(EXIT_FAILURE);
+  }
+
   self = [super init];
   if (self) {
     _path = path;
@@ -76,9 +99,7 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
       return nil;
     }
 
-    struct stat fileStat;
-    lstat(_path.UTF8String, &fileStat);
-    if (!((S_IFMT & fileStat.st_mode) == S_IFREG)) {
+    if (!((S_IFMT & fileStat->st_mode) == S_IFREG)) {
       if (error) {
         NSString *errStr = [NSString stringWithFormat:@"Non regular file: %s", strerror(errno)];
         *error = [NSError errorWithDomain:@"com.google.santa.fileinfo"
@@ -88,12 +109,12 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
       return nil;
     }
 
-    _fileSize = fileStat.st_size;
+    _fileSize = fileStat->st_size;
 
     if (_fileSize == 0) return nil;
 
-    if (fileStat.st_uid != 0) {
-      struct passwd *pwd = getpwuid(fileStat.st_uid);
+    if (fileStat->st_uid != 0) {
+      struct passwd *pwd = getpwuid(fileStat->st_uid);
       if (pwd) {
         _fileOwnerHomeDir = @(pwd->pw_dir);
       }
@@ -214,9 +235,13 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 }
 
 - (NSString *)SHA256 {
-  NSString *sha256;
-  [self hashSHA1:NULL SHA256:&sha256];
-  return sha256;
+  // Memoize the value
+  if (!self.sha256Storage) {
+    NSString *sha256;
+    [self hashSHA1:NULL SHA256:&sha256];
+    self.sha256Storage = sha256;
+  }
+  return self.sha256Storage;
 }
 
 #pragma mark File Type Info
@@ -547,6 +572,10 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
     NSData *cmdData = [self safeSubdataWithRange:NSMakeRange(offset, sz_segment)];
     if (!cmdData) return nil;
 
+    if (((struct load_command *)[cmdData bytes])->cmdsize < sizeof(struct load_command)) {
+      return nil;
+    }
+
     if (is64) {
       struct segment_command_64 *lc = (struct segment_command_64 *)[cmdData bytes];
       if (lc->cmd == LC_SEGMENT_64 && memcmp(lc->segname, "__TEXT", 6) == 0) {
@@ -617,7 +646,10 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 ///
 - (NSData *)safeSubdataWithRange:(NSRange)range {
   @try {
-    if ((range.location + range.length) > self.fileSize) return nil;
+    NSUInteger size;
+    if (__builtin_add_overflow(range.location, range.length, &size) || size > self.fileSize) {
+      return nil;
+    }
     [self.fileHandle seekToFileOffset:range.location];
     NSData *d = [self.fileHandle readDataOfLength:range.length];
     if (d.length != range.length) return nil;

Source/common/SNTFileInfoTest.m

@@ -34,7 +34,12 @@
 - (void)testPathStandardizing {
   SNTFileInfo *sut = [[SNTFileInfo alloc] initWithPath:@"/Applications/Safari.app"];
   XCTAssertNotNil(sut);
-  XCTAssertEqualObjects(sut.path, @"/Applications/Safari.app/Contents/MacOS/Safari");
+  if (@available(macOS 13.0, *)) {
+    XCTAssertEqualObjects(sut.path, @"/System/Volumes/Preboot/Cryptexes/App/System/Applications/"
+                                    @"Safari.app/Contents/MacOS/Safari");
+  } else {
+    XCTAssertEqualObjects(sut.path, @"/Applications/Safari.app/Contents/MacOS/Safari");
+  }
 
   sut = [[SNTFileInfo alloc] initWithPath:@"../../../../../../../../../../../../../../../bin/ls"];
   XCTAssertEqualObjects(sut.path, @"/bin/ls");
@@ -90,6 +95,11 @@
 }
 
 - (void)testKext {
+  // Skip this test on macOS 13 as KEXTs have moved into the kernelcache.
+  if (@available(macOS 13.0, *)) {
+    return;
+  }
+
   SNTFileInfo *sut = [[SNTFileInfo alloc]
     initWithPath:@"/System/Library/Extensions/AppleAPIC.kext/Contents/MacOS/AppleAPIC"];
 

Source/common/SNTKVOManager.h

@@ -0,0 +1,34 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+// The callback type when KVO notifications are received for observed key paths.
+// The first parameter is the previous value, the second paramter is the new value.
+typedef void (^KVOCallback)(id oldValue, id newValue);
+
+@interface SNTKVOManager : NSObject
+
+// Add an observer for the selector on the given object. When a KVO notification
+// is received, the callback is called. If the notification contains objects that
+// are not of the expectedType, nil is passed as the argument to the callback.
+// The observer is removed when the returned instance is deallocated.
+- (instancetype)initWithObject:(id)object
+                      selector:(SEL)selector
+                          type:(Class)expectedType
+                      callback:(KVOCallback)callback;
+
+- (instancetype)init NS_UNAVAILABLE;
+
+@end

Source/common/SNTKVOManager.mm

@@ -0,0 +1,72 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/SNTKVOManager.h"
+
+#import "Source/common/SNTLogging.h"
+
+@interface SNTKVOManager ()
+@property KVOCallback callback;
+@property Class expectedType;
+@property NSString *keyPath;
+@property id object;
+@end
+
+@implementation SNTKVOManager
+
+- (instancetype)initWithObject:(id)object
+                      selector:(SEL)selector
+                          type:(Class)expectedType
+                      callback:(KVOCallback)callback {
+  self = [super self];
+  if (self) {
+    NSString *selectorName = NSStringFromSelector(selector);
+    if (![object respondsToSelector:selector]) {
+      LOGE(@"Attempt to add observer for an unknown selector (%@) for object (%@)", selectorName,
+           [object class]);
+      return nil;
+    }
+
+    _object = object;
+    _keyPath = selectorName;
+    _expectedType = expectedType;
+    _callback = callback;
+
+    [object addObserver:self
+             forKeyPath:selectorName
+                options:(NSKeyValueObservingOptionNew | NSKeyValueObservingOptionOld)
+                context:NULL];
+  }
+  return self;
+}
+
+- (void)dealloc {
+  [self.object removeObserver:self forKeyPath:self.keyPath context:NULL];
+}
+
+- (void)observeValueForKeyPath:(NSString *)keyPath
+                      ofObject:(id)object
+                        change:(NSDictionary<NSString *, id> *)change
+                       context:(void *)context {
+  id oldValue = [change[NSKeyValueChangeOldKey] isKindOfClass:self.expectedType]
+                  ? change[NSKeyValueChangeOldKey]
+                  : nil;
+  id newValue = [change[NSKeyValueChangeNewKey] isKindOfClass:self.expectedType]
+                  ? change[NSKeyValueChangeNewKey]
+                  : nil;
+
+  self.callback(oldValue, newValue);
+}
+
+@end

Source/common/SNTKVOManagerTest.mm

@@ -0,0 +1,129 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#import "Source/common/SNTKVOManager.h"
+
+@interface Foo : NSObject
+@property NSNumber *propNumber;
+@property NSArray *propArray;
+@property id propId;
+@end
+
+@implementation Foo
+@end
+
+@interface SNTKVOManagerTest : XCTestCase
+@end
+
+@implementation SNTKVOManagerTest
+
+- (void)testInvalidSelector {
+  Foo *foo = [[Foo alloc] init];
+
+  SNTKVOManager *kvo = [[SNTKVOManager alloc] initWithObject:foo
+                                                    selector:NSSelectorFromString(@"doesNotExist")
+                                                        type:[NSNumber class]
+                                                    callback:^(id, id){
+                                                    }];
+
+  XCTAssertNil(kvo);
+}
+
+- (void)testNormalOperation {
+  Foo *foo = [[Foo alloc] init];
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  int origVal = 123;
+  int update1 = 456;
+  int update2 = 789;
+
+  foo.propNumber = @(origVal);
+
+  // Store the values from the callback to test against expected values
+  __block int oldVal;
+  __block int newVal;
+
+  SNTKVOManager *kvo =
+    [[SNTKVOManager alloc] initWithObject:foo
+                                 selector:@selector(propNumber)
+                                     type:[NSNumber class]
+                                 callback:^(NSNumber *oldValue, NSNumber *newValue) {
+                                   oldVal = [oldValue intValue];
+                                   newVal = [newValue intValue];
+                                   dispatch_semaphore_signal(sema);
+                                 }];
+  XCTAssertNotNil(kvo);
+
+  // Ensure an update to the observed property triggers the callback
+  foo.propNumber = @(update1);
+
+  XCTAssertEqual(0,
+                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 10 * NSEC_PER_SEC)),
+                 "Failed waiting for first observable update");
+  XCTAssertEqual(oldVal, origVal);
+  XCTAssertEqual(newVal, update1);
+
+  // One more time why not
+  foo.propNumber = @(update2);
+
+  XCTAssertEqual(0,
+                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 10 * NSEC_PER_SEC)),
+                 "Failed waiting for second observable update");
+  XCTAssertEqual(oldVal, update1);
+  XCTAssertEqual(newVal, update2);
+}
+
+- (void)testUnexpectedTypes {
+  Foo *foo = [[Foo alloc] init];
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+  NSString *origVal = @"any_val";
+  NSString *update = @"new_val";
+  foo.propId = origVal;
+
+  __block id oldVal;
+  __block id newVal;
+
+  SNTKVOManager *kvo = [[SNTKVOManager alloc] initWithObject:foo
+                                                    selector:@selector(propId)
+                                                        type:[NSString class]
+                                                    callback:^(id oldValue, id newValue) {
+                                                      oldVal = oldValue;
+                                                      newVal = newValue;
+                                                      dispatch_semaphore_signal(sema);
+                                                    }];
+  XCTAssertNotNil(kvo);
+
+  // Update to an unexpected type (here, NSNumber instead of NSString)
+  foo.propId = @(123);
+
+  XCTAssertEqual(0,
+                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 10 * NSEC_PER_SEC)),
+                 "Failed waiting for first observable update");
+  XCTAssertEqualObjects(oldVal, origVal);
+  XCTAssertNil(newVal);
+
+  // Update again with an expected type, ensure oldVal is now nil
+  foo.propId = update;
+
+  XCTAssertEqual(0,
+                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 10 * NSEC_PER_SEC)),
+                 "Failed waiting for first observable update");
+  XCTAssertNil(oldVal);
+  XCTAssertEqualObjects(newVal, update);
+}
+
+@end

Source/common/SNTMetricSet.m

@@ -280,15 +280,12 @@ NSString *SNTMetricMakeStringFromMetricType(SNTMetricType metricType) {
   if (_fieldNames.count == 0) {
     metricDict[@"fields"][@""] = @[ [self encodeMetricValueForFieldValues:@[]] ];
   } else {
-    for (NSString *fieldName in _fieldNames) {
-      NSMutableArray *fieldVals = [[NSMutableArray alloc] init];
+    NSMutableArray *fieldVals = [[NSMutableArray alloc] init];
 
-      for (NSArray<NSString *> *fieldValues in _metricsForFieldValues) {
-        [fieldVals addObject:[self encodeMetricValueForFieldValues:fieldValues]];
-      }
-
-      metricDict[@"fields"][fieldName] = fieldVals;
+    for (NSArray<NSString *> *fieldValues in _metricsForFieldValues) {
+      [fieldVals addObject:[self encodeMetricValueForFieldValues:fieldValues]];
     }
+    metricDict[@"fields"][[_fieldNames componentsJoinedByString:@","]] = fieldVals;
   }
   return metricDict;
 }

Source/common/SNTMetricSetTest.m

@@ -672,4 +672,35 @@
                           output);
   }
 }
+
+- (void)testEnsureMetricsWithMultipleFieldNamesSerializeOnce {
+  SNTMetricSet *metricSet = [[SNTMetricSet alloc] initWithHostname:@"testHost"
+                                                          username:@"testUser"];
+
+  SNTMetricCounter *c =
+    [metricSet counterWithName:@"/santa/events"
+                    fieldNames:@[ @"client", @"event_type" ]
+                      helpText:@"Count of events on the host for a given ES client"];
+  [c incrementBy:1 forFieldValues:@[ @"device_manager", @"auth_mount" ]];
+
+  NSDictionary *expected = @{
+    @"/santa/events" : @{
+      @"description" : @"Count of events on the host for a given ES client",
+      @"type" : [NSNumber numberWithInt:(int)SNTMetricTypeCounter],
+      @"fields" : @{
+        @"client,event_type" : @[
+          @{
+            @"value" : @"device_manager,auth_mount",
+            @"created" : [NSDate date],
+            @"last_updated" : [NSDate date],
+            @"data" : [NSNumber numberWithInt:1],
+          },
+        ],
+      },
+    },
+  };
+
+  NSDictionary *got = [metricSet export][@"metrics"];
+  XCTAssertEqualObjects(expected, got, @"metrics do not match expected");
+}
 @end

Source/common/SNTPrefixTree.cc

@@ -1,227 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include "Source/common/SNTPrefixTree.h"
-
-#include <string.h>
-
-#include <mutex>
-
-#define LOGD(format, ...)  // NOP
-#define LOGE(format, ...)  // NOP
-
-#define lck_rw_lock_shared(l) pthread_rwlock_rdlock(&l)
-#define lck_rw_unlock_shared(l) pthread_rwlock_unlock(&l)
-#define lck_rw_lock_exclusive(l) pthread_rwlock_wrlock(&l)
-#define lck_rw_unlock_exclusive(l) pthread_rwlock_unlock(&l)
-
-#define lck_rw_lock_shared_to_exclusive(l) \
-  ({                                       \
-    pthread_rwlock_unlock(&l);             \
-    false;                                 \
-  })
-#define lck_rw_lock_exclusive_to_shared(l) \
-  ({                                       \
-    pthread_rwlock_unlock(&l);             \
-    pthread_rwlock_rdlock(&l);             \
-  })
-
-#define lck_mtx_lock(l) l->lock()
-#define lck_mtx_unlock(l) l->unlock()
-
-SNTPrefixTree::SNTPrefixTree(uint32_t max_nodes) {
-  root_ = new SantaPrefixNode();
-  node_count_ = 0;
-  max_nodes_ = max_nodes;
-
-  pthread_rwlock_init(&spt_lock_, nullptr);
-  spt_add_lock_ = new std::mutex;
-}
-
-IOReturn SNTPrefixTree::AddPrefix(const char *prefix, uint64_t *node_count) {
-  // Serialize requests to AddPrefix. Otherwise one AddPrefix thread could
-  // overwrite whole branches of another. HasPrefix is still free to read the
-  // tree, until AddPrefix needs to modify it.
-  lck_mtx_lock(spt_add_lock_);
-
-  // Don't allow an empty prefix.
-  if (prefix[0] == '\0') return kIOReturnBadArgument;
-
-  LOGD("Trying to add prefix: %s", prefix);
-
-  // Enforce max tree depth.
-  size_t len = strnlen(prefix, max_nodes_);
-
-  // Grab a shared lock until a new branch is required.
-  lck_rw_lock_shared(spt_lock_);
-
-  SantaPrefixNode *node = root_;
-  for (size_t i = 0; i < len; ++i) {
-    // If there is a node in the path that is considered a prefix, stop adding.
-    // For our purposes we only care about the shortest path that matches.
-    if (node->isPrefix) break;
-
-    // Only process a byte at a time.
-    uint8_t value = (uint8_t)prefix[i];
-
-    // Create the child if it does not exist.
-    if (!node->children[value]) {
-      // Upgrade the shared lock.
-      // If the upgrade fails, the shared lock is released.
-      if (!lck_rw_lock_shared_to_exclusive(spt_lock_)) {
-        // Grab a new exclusive lock.
-        lck_rw_lock_exclusive(spt_lock_);
-      }
-
-      // Is there enough room for the rest of the prefix?
-      if ((node_count_ + (len - i)) > max_nodes_) {
-        LOGE("Prefix tree is full, can not add: %s", prefix);
-
-        if (node_count) *node_count = node_count_;
-        lck_rw_unlock_exclusive(spt_lock_);
-        lck_mtx_unlock(spt_add_lock_);
-        return kIOReturnNoResources;
-      }
-
-      // Create the rest of the prefix.
-      while (i < len) {
-        value = (uint8_t)prefix[i++];
-
-        SantaPrefixNode *new_node = new SantaPrefixNode();
-        node->children[value] = new_node;
-        ++node_count_;
-
-        node = new_node;
-      }
-
-      // This is the end, mark the node as a prefix.
-      LOGD("Added prefix: %s", prefix);
-
-      node->isPrefix = true;
-
-      // Downgrade the exclusive lock
-      lck_rw_lock_exclusive_to_shared(spt_lock_);
-    } else if (i + 1 == len) {
-      // If the child does exist and it is the end...
-      // Set the new, higher prefix and prune the now dead nodes.
-
-      if (!lck_rw_lock_shared_to_exclusive(spt_lock_)) {
-        lck_rw_lock_exclusive(spt_lock_);
-      }
-
-      PruneNode(node->children[value]);
-
-      SantaPrefixNode *new_node = new SantaPrefixNode();
-      new_node->isPrefix = true;
-
-      node->children[value] = new_node;
-      ++node_count_;
-
-      LOGD("Added prefix: %s", prefix);
-
-      lck_rw_lock_exclusive_to_shared(spt_lock_);
-    }
-
-    // Get ready for the next iteration.
-    node = node->children[value];
-  }
-
-  if (node_count) *node_count = node_count_;
-
-  lck_rw_unlock_shared(spt_lock_);
-  lck_mtx_unlock(spt_add_lock_);
-
-  return kIOReturnSuccess;
-}
-
-bool SNTPrefixTree::HasPrefix(const char *string) {
-  lck_rw_lock_shared(spt_lock_);
-
-  auto found = false;
-
-  SantaPrefixNode *node = root_;
-
-  // A well formed tree will always break this loop. Even if string doesn't
-  // terminate.
-  const char *p = string;
-  while (*p) {
-    // Only process a byte at a time.
-    node = node->children[(uint8_t)*p++];
-
-    // If it doesn't exist in the tree, no match.
-    if (!node) break;
-
-    // If it does exist, is it a prefix?
-    if (node->isPrefix) {
-      found = true;
-      break;
-    }
-  }
-
-  lck_rw_unlock_shared(spt_lock_);
-
-  return found;
-}
-
-void SNTPrefixTree::Reset() {
-  lck_rw_lock_exclusive(spt_lock_);
-
-  PruneNode(root_);
-  root_ = new SantaPrefixNode();
-  node_count_ = 0;
-
-  lck_rw_unlock_exclusive(spt_lock_);
-}
-
-void SNTPrefixTree::PruneNode(SantaPrefixNode *target) {
-  if (!target) return;
-
-  // For deep trees, a recursive approach will generate too many stack frames.
-  // Make a "stack" and walk the tree.
-  auto stack = new SantaPrefixNode *[node_count_ + 1];
-  if (!stack) {
-    LOGE("Unable to prune tree!");
-
-    return;
-  }
-  auto count = 0;
-
-  // Seed the "stack" with a starting node.
-  stack[count++] = target;
-
-  // Start at the target node and walk the tree to find and delete all the
-  // sub-nodes.
-  while (count) {
-    auto node = stack[--count];
-
-    for (int i = 0; i < 256; ++i) {
-      if (!node->children[i]) continue;
-      stack[count++] = node->children[i];
-    }
-
-    delete node;
-    --node_count_;
-  }
-
-  delete[] stack;
-}
-
-SNTPrefixTree::~SNTPrefixTree() {
-  lck_rw_lock_exclusive(spt_lock_);
-  PruneNode(root_);
-  root_ = nullptr;
-  lck_rw_unlock_exclusive(spt_lock_);
-
-  pthread_rwlock_destroy(&spt_lock_);
-}

Source/common/SNTPrefixTree.h

@@ -1,91 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#ifndef SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H
-#define SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H
-
-#include <IOKit/IOReturn.h>
-#include <sys/param.h>
-
-// Support for unit testing.
-#include <pthread.h>
-#include <stdint.h>
-
-#include <mutex>
-
-///
-///  SantaPrefixTree is a simple prefix tree implementation.
-///  Operations are thread safe.
-///
-class SNTPrefixTree {
- public:
-  // Add a prefix to the tree.
-  // Optionally pass node_count to get the number of nodes after the add.
-  IOReturn AddPrefix(const char *, uint64_t *node_count = nullptr);
-
-  // Check if the tree has a prefix for string.
-  bool HasPrefix(const char *string);
-
-  // Reset the tree.
-  void Reset();
-
-  SNTPrefixTree(uint32_t max_nodes = kDefaultMaxNodes);
-  ~SNTPrefixTree();
-
- private:
-  ///
-  ///  SantaPrefixNode is a wrapper class that represents one byte.
-  ///  1 node can represent a whole ASCII character.
-  ///  For example a pointer to the 'A' node will be stored at children[0x41].
-  ///  It takes 1-4 nodes to represent a UTF-8 encoded Unicode character.
-  ///
-  ///  The path for "/🤘" would look like this:
-  ///      children[0x2f] -> children[0xf0] -> children[0x9f] -> children[0xa4]
-  ///      -> children[0x98]
-  ///
-  ///  The path for "/dev" is:
-  ///      children[0x2f] -> children[0x64] -> children[0x65] -> children[0x76]
-  ///
-  ///  Lookups of children are O(1).
-  ///
-  ///  Having the nodes represented by a smaller width, such as a nibble (1/2
-  ///  byte), would drastically decrease the memory footprint but would double
-  ///  required dereferences.
-  ///
-  ///  TODO(bur): Potentially convert this into a full on radix tree.
-  ///
-  class SantaPrefixNode {
-   public:
-    bool isPrefix;
-    SantaPrefixNode *children[256];
-  };
-
-  // PruneNode will remove the passed in node from the tree.
-  // The passed in node and all subnodes will be deleted.
-  // It is the caller's responsibility to reset the pointer to this node (held
-  // by the parent). If the tree is in use grab the exclusive lock.
-  void PruneNode(SantaPrefixNode *);
-
-  SantaPrefixNode *root_;
-
-  // Each node takes up ~2k, assuming MAXPATHLEN is 1024 max out at ~2MB.
-  static const uint32_t kDefaultMaxNodes = MAXPATHLEN;
-  uint32_t max_nodes_;
-  uint32_t node_count_;
-
-  pthread_rwlock_t spt_lock_;
-  std::mutex *spt_add_lock_;
-};
-
-#endif /* SANTA__SANTA_DRIVER__SANTAPREFIXTREE_H */

Source/common/SNTPrefixTreeTest.mm

@@ -1,73 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import <XCTest/XCTest.h>
-
-#include "Source/common/SNTPrefixTree.h"
-
-@interface SNTPrefixTreeTest : XCTestCase
-@end
-
-@implementation SNTPrefixTreeTest
-
-- (void)testAddAndHas {
-  auto t = SNTPrefixTree();
-  XCTAssertFalse(t.HasPrefix("/private/var/tmp/file1"));
-  t.AddPrefix("/private/var/tmp/");
-  XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
-}
-
-- (void)testReset {
-  auto t = SNTPrefixTree();
-  t.AddPrefix("/private/var/tmp/");
-  XCTAssertTrue(t.HasPrefix("/private/var/tmp/file1"));
-  t.Reset();
-  XCTAssertFalse(t.HasPrefix("/private/var/tmp/file1"));
-}
-
-- (void)testThreading {
-  uint32_t count = 4096;
-  auto t = new SNTPrefixTree(count * (uint32_t)[NSUUID UUID].UUIDString.length);
-
-  NSMutableArray *UUIDs = [NSMutableArray arrayWithCapacity:count];
-  for (int i = 0; i < count; ++i) {
-    [UUIDs addObject:[NSUUID UUID].UUIDString];
-  }
-
-  __block BOOL stop = NO;
-
-  // Create a bunch of background noise.
-  dispatch_async(dispatch_get_global_queue(0, 0), ^{
-    for (uint64_t i = 0; i < UINT64_MAX; ++i) {
-      dispatch_async(dispatch_get_global_queue(0, 0), ^{
-        t->HasPrefix([UUIDs[i % count] UTF8String]);
-      });
-      if (stop) return;
-    }
-  });
-
-  // Fill up the tree.
-  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
-    XCTAssertEqual(t->AddPrefix([UUIDs[i] UTF8String]), kIOReturnSuccess);
-  });
-
-  // Make sure every leaf byte is found.
-  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
-    XCTAssertTrue(t->HasPrefix([UUIDs[i] UTF8String]));
-  });
-
-  stop = YES;
-}
-
-@end

Source/common/SNTRule.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -51,18 +51,18 @@
 ///  Designated initializer.
 ///
 - (instancetype)initWithIdentifier:(NSString *)identifier
-                         state:(SNTRuleState)state
-                          type:(SNTRuleType)type
-                     customMsg:(NSString *)customMsg
-                     timestamp:(NSUInteger)timestamp;
+                             state:(SNTRuleState)state
+                              type:(SNTRuleType)type
+                         customMsg:(NSString *)customMsg
+                         timestamp:(NSUInteger)timestamp;
 
 ///
 ///  Initialize with a default timestamp: current time if rule state is transitive, 0 otherwise.
 ///
 - (instancetype)initWithIdentifier:(NSString *)identifier
-                         state:(SNTRuleState)state
-                          type:(SNTRuleType)type
-                     customMsg:(NSString *)customMsg;
+                             state:(SNTRuleState)state
+                              type:(SNTRuleType)type
+                         customMsg:(NSString *)customMsg;
 
 ///
 ///  Initialize with a dictionary received from a sync server.

Source/common/SNTStoredEvent.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -95,7 +95,6 @@
 ///
 @property NSArray *signingChain;
 
-
 ///
 /// If the executed file was signed, this is the Team ID if present in the signature information.
 ///

Source/common/SNTStrengthify.h

@@ -1,4 +1,4 @@
-/// Copyright 2016 Google Inc. All rights reserved.
+/// Copyright 2016-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -12,10 +12,14 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#define STRONGIFY(var)                                 \
-  _Pragma("clang diagnostic push")                     \
-      _Pragma("clang diagnostic ignored \"-Wshadow\"") \
-          __strong __typeof(var) var = (Weak_##var);   \
+// clang-format off
+
+#define STRONGIFY(var)                             \
+  _Pragma("clang diagnostic push")                 \
+  _Pragma("clang diagnostic ignored \"-Wshadow\"") \
+  __strong __typeof(var) var = (Weak_##var);   \
   _Pragma("clang diagnostic pop")
 
 #define WEAKIFY(var) __weak __typeof(var) Weak_##var = (var);
+
+// clang-format on

Source/common/SNTSystemInfo.m

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -18,8 +18,11 @@
 @implementation SNTSystemInfo
 
 + (NSString *)serialNumber {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
   io_service_t platformExpert =
     IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"));
+#pragma clang diagnostic pop
   if (!platformExpert) return nil;
 
   NSString *serial = CFBridgingRelease(IORegistryEntryCreateCFProperty(
@@ -31,8 +34,11 @@
 }
 
 + (NSString *)hardwareUUID {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
   io_service_t platformExpert =
     IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOPlatformExpertDevice"));
+#pragma clang diagnostic pop
   if (!platformExpert) return nil;
 
   NSString *uuid = CFBridgingRelease(IORegistryEntryCreateCFProperty(

Source/common/SNTXPCUnprivilegedControlInterface.h

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@
 #import <MOLCertificate/MOLCertificate.h>
 
 #import "Source/common/SNTCommonEnums.h"
-#import "Source/common/SNTCommon.h"
+#import "Source/common/SantaVnode.h"
 
 @class SNTRule;
 @class SNTStoredEvent;
@@ -31,8 +31,7 @@
 ///  Cache Ops
 ///
 - (void)cacheCounts:(void (^)(uint64_t rootCache, uint64_t nonRootCache))reply;
-- (void)cacheBucketCount:(void (^)(NSArray *))reply;
-- (void)checkCacheForVnodeID:(santa_vnode_id_t)vnodeID withReply:(void (^)(santa_action_t))reply;
+- (void)checkCacheForVnodeID:(SantaVnode)vnodeID withReply:(void (^)(SNTAction))reply;
 
 ///
 ///  Database ops
@@ -64,6 +63,7 @@
 ///  Config ops
 ///
 - (void)watchdogInfo:(void (^)(uint64_t, uint64_t, double, double))reply;
+- (void)watchItemsState:(void (^)(BOOL, uint64_t, NSString *, NSString *, NSTimeInterval))reply;
 - (void)clientMode:(void (^)(SNTClientMode))reply;
 - (void)fullSyncLastSuccess:(void (^)(NSDate *))reply;
 - (void)ruleSyncLastSuccess:(void (^)(NSDate *))reply;

Source/common/SantaCache.h

@@ -1,4 +1,4 @@
-/// Copyright 2016 Google Inc. All rights reserved.
+/// Copyright 2016-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 
 #include <libkern/OSAtomic.h>
 #include <libkern/OSTypes.h>
+#include <os/log.h>
 #include <stdint.h>
 #include <sys/cdefs.h>
 
@@ -24,12 +25,7 @@
 #include <cstdlib>
 #include <cstring>
 
-#include "Source/common/SNTCommon.h"
-
-#define panic(args...) \
-  printf(args);        \
-  printf("\n");        \
-  abort()
+#include "Source/common/BranchPrediction.h"
 
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
@@ -334,7 +330,9 @@ class SantaCache {
   inline void unlock(struct bucket *bucket) const {
     if (unlikely(OSAtomicTestAndClear(7, (volatile uint8_t *)&bucket->head) ==
                  0)) {
-      panic("SantaCache::unlock(): Tried to unlock an unlocked lock");
+      os_log_error(OS_LOG_DEFAULT,
+                   "SantaCache::unlock(): Tried to unlock an unlocked lock");
+      abort();
     }
   }
 

Source/common/SantaVnode.h

@@ -0,0 +1,40 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SANTAVNODE_H
+#define SANTA__COMMON__SANTAVNODE_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <sys/types.h>
+
+// Struct to manage vnode IDs
+typedef struct SantaVnode {
+  dev_t fsid;
+  ino_t fileid;
+
+#ifdef __cplusplus
+  bool operator==(const SantaVnode &rhs) const {
+    return fsid == rhs.fsid && fileid == rhs.fileid;
+  }
+
+  static inline SantaVnode VnodeForFile(const es_file_t *es_file) {
+    return SantaVnode{
+        .fsid = es_file->stat.st_dev,
+        .fileid = es_file->stat.st_ino,
+    };
+  }
+#endif
+} SantaVnode;
+
+#endif

Source/common/SantaVnodeHash.h

@@ -0,0 +1,24 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SANTAVNODEHASH_H
+#define SANTA__COMMON__SANTAVNODEHASH_H
+
+#include "Source/common/SantaCache.h"
+#include "Source/common/SantaVnode.h"
+
+template <>
+uint64_t SantaCacheHasher<SantaVnode>(SantaVnode const &t);
+
+#endif

Source/common/SantaVnodeHash.mm

@@ -0,0 +1,20 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include "Source/common/SantaVnodeHash.h"
+
+template <>
+uint64_t SantaCacheHasher<SantaVnode>(SantaVnode const &t) {
+  return (SantaCacheHasher<uint64_t>(t.fsid) << 1) ^ SantaCacheHasher<uint64_t>(t.fileid);
+}

Source/common/SystemResources.h

@@ -0,0 +1,41 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SYSTEMRESOURCES_H
+#define SANTA__COMMON__SYSTEMRESOURCES_H
+
+#import <Foundation/Foundation.h>
+#include <mach/mach_time.h>
+#include <sys/cdefs.h>
+#include <sys/proc_info.h>
+
+#include <optional>
+
+struct SantaTaskInfo {
+  uint64_t virtual_size;
+  uint64_t resident_size;
+  uint64_t total_user_nanos;
+  uint64_t total_system_nanos;
+};
+
+// Convert mach absolute time to nanoseconds
+uint64_t MachTimeToNanos(uint64_t mach_time);
+
+// Convert nanoseconds to mach absolute time
+uint64_t NanosToMachTime(uint64_t nanos);
+
+// Get the result of proc_pidinfo with the PROC_PIDTASKINFO flavor
+std::optional<SantaTaskInfo> GetTaskInfo();
+
+#endif

Source/common/SystemResources.mm

@@ -0,0 +1,68 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include "Source/common/SystemResources.h"
+
+#include <dispatch/dispatch.h>
+#include <libproc.h>
+#include <mach/kern_return.h>
+#include <unistd.h>
+#include <optional>
+
+#include "Source/common/SNTLogging.h"
+
+static mach_timebase_info_data_t GetTimebase() {
+  static dispatch_once_t once_token;
+  static mach_timebase_info_data_t timebase;
+
+  dispatch_once(&once_token, ^{
+    if (mach_timebase_info(&timebase) != KERN_SUCCESS) {
+      // This shouldn't fail. Assume transitory and exit the program.
+      // Hopefully fixes itself on restart...
+      LOGE(@"Failed to get timebase info. Exiting.");
+      exit(EXIT_FAILURE);
+    }
+  });
+
+  return timebase;
+}
+
+uint64_t MachTimeToNanos(uint64_t mach_time) {
+  mach_timebase_info_data_t timebase = GetTimebase();
+
+  return mach_time * timebase.numer / timebase.denom;
+}
+
+uint64_t NanosToMachTime(uint64_t nanos) {
+  mach_timebase_info_data_t timebase = GetTimebase();
+
+  return nanos * timebase.denom / timebase.numer;
+}
+
+std::optional<SantaTaskInfo> GetTaskInfo() {
+  struct proc_taskinfo pti;
+
+  if (proc_pidinfo(getpid(), PROC_PIDTASKINFO, 0, &pti, PROC_PIDTASKINFO_SIZE) <
+      PROC_PIDTASKINFO_SIZE) {
+    LOGW(@"Unable to get system resource information");
+    return std::nullopt;
+  }
+
+  return SantaTaskInfo{
+    .virtual_size = pti.pti_virtual_size,
+    .resident_size = pti.pti_resident_size,
+    .total_user_nanos = MachTimeToNanos(pti.pti_total_user),
+    .total_system_nanos = MachTimeToNanos(pti.pti_total_system),
+  };
+}

Source/common/TestUtils.h

@@ -0,0 +1,75 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__COMMON__TESTUTILS_H
+#define SANTA__COMMON__TESTUTILS_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#import <XCTest/XCTest.h>
+#include <bsm/libbsm.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <sys/stat.h>
+
+#define NOBODY_UID ((unsigned int)-2)
+#define NOGROUP_GID ((unsigned int)-1)
+
+// Bubble up googletest expectation failures to XCTest failures
+#define XCTBubbleMockVerifyAndClearExpectations(mock)              \
+  XCTAssertTrue(::testing::Mock::VerifyAndClearExpectations(mock), \
+                "Expected calls were not properly mocked")
+
+// Pretty print C string match errors
+#define XCTAssertCStringEqual(got, want)                                                      \
+  XCTAssertTrue(strcmp((got), (want)) == 0, @"\nMismatched strings.\n\t got: %s\n\twant: %s", \
+                (got), (want))
+
+// Pretty print C++ string match errors
+#define XCTAssertCppStringEqual(got, want) XCTAssertCStringEqual((got).c_str(), (want).c_str())
+
+#define XCTAssertSemaTrue(s, sec, m) \
+  XCTAssertEqual(                    \
+    0, dispatch_semaphore_wait((s), dispatch_time(DISPATCH_TIME_NOW, (sec)*NSEC_PER_SEC)), m)
+
+// Helper to ensure at least `ms` milliseconds are slept, even if the sleep
+// function returns early due to interrupts.
+void SleepMS(long ms);
+
+enum class ActionType {
+  Auth,
+  Notify,
+};
+
+//
+// Helpers to construct various ES structs
+//
+
+audit_token_t MakeAuditToken(pid_t pid, pid_t pidver);
+
+/// Construct a `struct stat` buffer with each member having a unique value.
+/// @param offset An optional offset to be added to each member. useful when
+///   a test has multiple stats and you'd like for them each to have different
+///   values across the members.
+struct stat MakeStat(int offset = 0);
+
+es_string_token_t MakeESStringToken(const char *s);
+es_file_t MakeESFile(const char *path, struct stat sb = {});
+es_process_t MakeESProcess(es_file_t *file, audit_token_t tok = {}, audit_token_t parent_tok = {});
+es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc,
+                           ActionType action_type = ActionType::Notify,
+                           uint64_t future_deadline_ms = 100000);
+
+uint32_t MaxSupportedESMessageVersionForCurrentOS();
+
+#endif

Source/common/TestUtils.mm

@@ -0,0 +1,138 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/common/TestUtils.h"
+
+#include <EndpointSecurity/ESTypes.h>
+#include <dispatch/dispatch.h>
+#include <mach/mach_time.h>
+#include <time.h>
+#include <uuid/uuid.h>
+#include "Source/common/SystemResources.h"
+
+audit_token_t MakeAuditToken(pid_t pid, pid_t pidver) {
+  return audit_token_t{
+    .val =
+      {
+        0,
+        NOBODY_UID,
+        NOGROUP_GID,
+        NOBODY_UID,
+        NOGROUP_GID,
+        (unsigned int)pid,
+        0,
+        (unsigned int)pidver,
+      },
+  };
+}
+
+struct stat MakeStat(int offset) {
+  return (struct stat){
+    .st_dev = 1 + offset,
+    .st_mode = (mode_t)(2 + offset),
+    .st_nlink = (nlink_t)(3 + offset),
+    .st_ino = (uint64_t)(4 + offset),
+    .st_uid = NOBODY_UID,
+    .st_gid = NOGROUP_GID,
+    .st_rdev = 5 + offset,
+    .st_atimespec = {.tv_sec = 100 + offset, .tv_nsec = 200 + offset},
+    .st_mtimespec = {.tv_sec = 101 + offset, .tv_nsec = 21 + offset},
+    .st_ctimespec = {.tv_sec = 102 + offset, .tv_nsec = 202 + offset},
+    .st_birthtimespec = {.tv_sec = 103 + offset, .tv_nsec = 203 + offset},
+    .st_size = 6 + offset,
+    .st_blocks = 7 + offset,
+    .st_blksize = 8 + offset,
+    .st_flags = (uint32_t)(9 + offset),
+    .st_gen = (uint32_t)(10 + offset),
+  };
+}
+
+es_string_token_t MakeESStringToken(const char *s) {
+  return es_string_token_t{
+    .length = strlen(s),
+    .data = s,
+  };
+}
+
+es_file_t MakeESFile(const char *path, struct stat sb) {
+  return es_file_t{
+    .path = MakeESStringToken(path),
+    .path_truncated = false,
+    .stat = sb,
+  };
+}
+
+es_process_t MakeESProcess(es_file_t *file, audit_token_t tok, audit_token_t parent_tok) {
+  return es_process_t{
+    .audit_token = tok,
+    .ppid = audit_token_to_pid(parent_tok),
+    .original_ppid = audit_token_to_pid(parent_tok),
+    .group_id = 111,
+    .session_id = 222,
+    .is_platform_binary = true,
+    .is_es_client = true,
+    .executable = file,
+    .parent_audit_token = parent_tok,
+  };
+}
+
+static uint64_t AddMillisToMachTime(uint64_t ms, uint64_t machTime) {
+  uint64_t nanoTime = MachTimeToNanos(machTime);
+
+  // Add the ms offset
+  nanoTime += (ms * NSEC_PER_MSEC);
+
+  // Convert back to machTime
+  return NanosToMachTime(nanoTime);
+}
+
+uint32_t MaxSupportedESMessageVersionForCurrentOS() {
+  // Note: ES message v3 was only in betas.
+  if (@available(macOS 13.0, *)) {
+    return 6;
+  } else if (@available(macOS 12.3, *)) {
+    return 5;
+  } else if (@available(macOS 11.0, *)) {
+    return 4;
+  } else if (@available(macOS 10.15.4, *)) {
+    return 2;
+  } else {
+    return 1;
+  }
+}
+
+es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc, ActionType action_type,
+                           uint64_t future_deadline_ms) {
+  es_message_t es_msg = {
+    .deadline = AddMillisToMachTime(future_deadline_ms, mach_absolute_time()),
+    .process = proc,
+    .action_type =
+      (action_type == ActionType::Notify) ? ES_ACTION_TYPE_NOTIFY : ES_ACTION_TYPE_AUTH,
+    .event_type = et,
+  };
+
+  es_msg.version = MaxSupportedESMessageVersionForCurrentOS();
+
+  return es_msg;
+}
+
+void SleepMS(long ms) {
+  struct timespec ts {
+    .tv_sec = ms / 1000, .tv_nsec = (long)((ms % 1000) * NSEC_PER_MSEC),
+  };
+
+  while (nanosleep(&ts, &ts) != 0) {
+    XCTAssertEqual(errno, EINTR);
+  }
+}

Source/common/Unit.h

@@ -0,0 +1,24 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__UNIT_H
+#define SANTA__COMMON__UNIT_H
+
+namespace santa::common {
+
+struct Unit {};
+
+}  // namespace santa::common
+
+#endif

Source/common/santa.proto

@@ -1,6 +1,7 @@
 //
 // !!! WARNING !!!
-// This proto is in beta format and subject to change.
+// This proto is for demonstration purposes only and will be changing.
+// Do not rely on this format.
 //
 
 syntax = "proto3";
@@ -10,135 +11,529 @@ import "google/protobuf/timestamp.proto";
 
 option objc_class_prefix = "SNTPB";
 
-package santa;
+package santa.pb.v1;
 
-message ProcessInfo {
+// User ID and associated username
+message UserInfo {
+  optional int32 uid = 1;
+  optional string name = 2;
+}
+
+// Group ID and associated group name
+message GroupInfo {
+  optional int32 gid = 1;
+  optional string name = 2;
+}
+
+// A process is uniquely identified on macOS by its pid and pidversion
+message ProcessID {
   optional int32 pid = 1;
   optional int32 pidversion = 2;
-  optional int32 ppid = 3;
-  optional int32 uid = 4;
-  optional string user = 5;
-  optional int32 gid = 6;
-  optional string group = 7;
 }
 
-message FileModification {
-  enum Action {
-    ACTION_UNKNOWN = 0;
-    ACTION_DELETE = 1;
-    ACTION_EXCHANGE = 2;
-    ACTION_LINK = 3;
-    ACTION_RENAME = 4;
-    ACTION_WRITE = 5;
+// Code signature information
+message CodeSignature {
+  // The code directory hash identifies a specific version of a program
+  optional bytes cdhash = 1;
+
+  // The signing id of the code signature
+  optional string signing_id = 2;
+
+  // The team id of the code signature
+  optional string team_id = 3;
+}
+
+// Stat information for a file
+// Mimics data from `stat(2)`
+message Stat {
+  optional int32 dev = 1;
+  optional uint32 mode = 2;
+  optional uint32 nlink = 3;
+  optional uint64 ino = 4;
+  optional UserInfo user = 5;
+  optional GroupInfo group = 6;
+  optional int32 rdev = 7;
+  optional google.protobuf.Timestamp access_time = 8;
+  optional google.protobuf.Timestamp modification_time = 9;
+  optional google.protobuf.Timestamp change_time = 10;
+  optional google.protobuf.Timestamp birth_time = 11;
+  optional int64 size = 12;
+  optional int64 blocks = 13;
+  optional int32 blksize = 14;
+  optional uint32 flags = 15;
+  optional int32 gen = 16;
+}
+
+// Hash value and metadata describing hash algorithm used
+message Hash {
+  enum HashAlgo {
+    HASH_ALGO_UNKNOWN = 0;
+    HASH_ALGO_SHA256 = 1;
   }
 
-  optional Action action = 1;
-  optional string path = 2;
-  optional string newpath = 3;
-  optional string process = 4;
-  optional string process_path = 5;
-  optional ProcessInfo process_info = 6;
-  optional string machine_id = 7;
+  optional HashAlgo type = 1;
+  optional string hash = 2;
 }
 
+// File information
+message FileInfo {
+  // File path
+  optional string path = 1;
+
+  // Whether or not the path is truncated
+  optional bool truncated = 2;
+
+  // Stat information
+  optional Stat stat = 3;
+
+  // Hash of file contents
+  optional Hash hash = 4;
+}
+
+// Light variant of `FileInfo` message to help minimize on-disk/on-wire sizes
+message FileInfoLight {
+  // File path
+  optional string path = 1;
+
+  // Whether or not the path is truncated
+  optional bool truncated = 2;
+}
+
+// File descriptor information
+message FileDescriptor {
+  // Enum types gathered from `<sys/proc_info.h>`
+  enum FDType {
+    FD_TYPE_UNKNOWN = 0;
+    FD_TYPE_ATALK = 1;
+    FD_TYPE_VNODE = 2;
+    FD_TYPE_SOCKET = 3;
+    FD_TYPE_PSHM = 4;
+    FD_TYPE_PSEM = 5;
+    FD_TYPE_KQUEUE = 6;
+    FD_TYPE_PIPE = 7;
+    FD_TYPE_FSEVENTS = 8;
+    FD_TYPE_NETPOLICY = 9;
+    FD_TYPE_CHANNEL = 10;
+    FD_TYPE_NEXUS = 11;
+  }
+
+  // File descriptor value
+  optional int32 fd = 1;
+
+  // Type of file object
+  optional FDType fd_type = 2;
+
+  // Unique id of the pipe for correlation with other file descriptors
+  // pointing to the same or other end of the same pipe
+  // Note: Only valid when `fd_type` is `FD_TYPE_PIPE`
+  optional uint64 pipe_id = 3;
+}
+
+// Process information
+message ProcessInfo {
+  // Process ID of the process
+  optional ProcessID id = 1;
+
+  // Process ID of the parent process
+  optional ProcessID parent_id = 2;
+
+  // Process ID of the process responsible for this one
+  optional ProcessID responsible_id = 3;
+
+  // Original parent ID, remains stable in the event a process is reparented
+  optional int32 original_parent_pid = 4;
+
+  // Process group id the process belongs to
+  optional int32 group_id = 5;
+
+  // Session id the process belongs to
+  optional int32 session_id = 6;
+
+  // Effective user/group info
+  optional UserInfo effective_user = 7;
+  optional GroupInfo effective_group = 8;
+
+  // Real user/group info
+  optional UserInfo real_user = 9;
+  optional GroupInfo real_group = 10;
+
+  // Whether or not the process was signed with Apple certificates
+  optional bool is_platform_binary = 11;
+
+  // Whether or not the process is an ES client
+  optional bool is_es_client = 12;
+
+  // Code signature information for the process
+  optional CodeSignature code_signature = 13;
+
+  // Codesigning flags for the process (from `<Kernel/kern/cs_blobs.h>`)
+  optional uint32 cs_flags = 14;
+
+  // File information for the executable backing this process
+  optional FileInfo executable = 15;
+
+  // File information for the associated TTY
+  optional FileInfoLight tty = 16;
+
+  // Time the process was started
+  optional google.protobuf.Timestamp start_time = 17;
+}
+
+// Light variant of ProcessInfo message to help minimize on-disk/on-wire sizes
+message ProcessInfoLight {
+  // Process ID of the process
+  optional ProcessID id = 1;
+
+  // Process ID of the parent process
+  optional ProcessID parent_id = 2;
+
+  // Original parent ID, remains stable in the event a process is reparented
+  optional int32 original_parent_pid = 3;
+
+  // Process group id the process belongs to
+  optional int32 group_id = 4;
+
+  // Session id the process belongs to
+  optional int32 session_id = 5;
+
+  // Effective user/group info
+  optional UserInfo effective_user = 6;
+  optional GroupInfo effective_group = 7;
+
+  // Real user/group info
+  optional UserInfo real_user = 8;
+  optional GroupInfo real_group = 9;
+
+  // File information for the executable backing this process
+  optional FileInfoLight executable = 10;
+}
+
+// Certificate information
+message CertificateInfo {
+  // Hash of the certificate data
+  optional Hash hash = 1;
+
+  // Common name used in the certificate
+  optional string common_name = 2;
+}
+
+// Information about a process execution event
 message Execution {
+  // The process that executed the new image (e.g. the process that called
+  // `execve(2)` or `posix_spawn(2)``)
+  optional ProcessInfoLight instigator = 1;
+
+  // Process info for the newly formed execution
+  optional ProcessInfo target = 2;
+
+  // Script file information
+  // Only valid when a script was executed directly and not as an argument to
+  // an interpreter (e.g.  `./foo.sh`, not `/bin/sh ./foo.sh`)
+  optional FileInfo script = 3;
+
+  // The current working directory of the `target` at exec time
+  optional FileInfo working_directory = 4;
+
+  // List of process arguments
+  repeated string args = 5;
+
+  // List of environment variables
+  repeated string envs = 6;
+
+  // List of file descriptors
+  repeated FileDescriptor fds = 7;
+
+  // Whether or not the list of `fds` is complete or contains partial info
+  optional bool fd_list_truncated = 8;
+
+  // Whether or not the target execution was allowed
   enum Decision {
     DECISION_UNKNOWN = 0;
     DECISION_ALLOW = 1;
     DECISION_DENY = 2;
   }
+  optional Decision decision = 9;
 
+  // The policy applied when determining the decision
   enum Reason {
     REASON_UNKNOWN = 0;
     REASON_BINARY = 1;
     REASON_CERT = 2;
     REASON_COMPILER = 3;
-    REASON_NOT_RUNNING = 4;
     REASON_PENDING_TRANSITIVE = 5;
     REASON_SCOPE = 6;
     REASON_TEAM_ID = 7;
     REASON_TRANSITIVE = 8;
+    REASON_LONG_PATH = 9;
+    REASON_NOT_RUNNING = 10;
   }
+  optional Reason reason = 10;
 
+  // The mode Santa was in when the decision was applied
   enum Mode {
     MODE_UNKNOWN = 0;
     MODE_LOCKDOWN = 1;
     MODE_MONITOR = 2;
   }
+  optional Mode mode = 11;
 
-  optional Decision decision = 1;
-  optional Reason reason = 2;
-  optional string explain = 3;
-  optional string sha256 = 4;
-  optional string cert_sha256 = 5;
-  optional string cert_cn = 6;
-  optional string quarantine_url = 7;
-  optional ProcessInfo process_info = 8;
-  optional Mode mode = 9;
-  optional string path = 10;
-  optional string original_path = 11;
-  repeated string args = 12;
-  optional string machine_id = 13;
-  optional string team_id = 14;
+  // Certificate information for the target executable
+  optional CertificateInfo certificate_info = 12;
+
+  // Additional Santa metadata
+  optional string explain = 13;
+
+  // Information known to LaunchServices about the target executable file
+  optional string quarantine_url = 14;
+
+  // The original path on disk of the target executable
+  // Applies when executables are translocated
+  optional string original_path = 15;
 }
 
-message DiskAppeared {
-  optional string mount = 1;
-  optional string volume = 2;
-  optional string bsd_name = 3;
-  optional string fs = 4;
-  optional string model = 5;
-  optional string serial = 6;
-  optional string bus = 7;
-  optional string dmg_path = 8;
-  optional string appearance = 9;
+// Information about a fork event
+message Fork {
+  // The forking process
+  optional ProcessInfoLight instigator = 1;
+
+  // The newly formed child process
+  optional ProcessInfoLight child = 2;
 }
 
-message DiskDisappeared {
-  optional string mount = 1;
-  optional string volume = 2;
-  optional string bsd_name = 3;
+// Information about an exit event
+message Exit {
+  // The process that is exiting
+  optional ProcessInfoLight instigator = 1;
+
+  // Exit status code information
+  message Exited {
+    optional int32 exit_status = 1;
+  }
+
+  // Signal code
+  message Signaled {
+    optional int32 signal = 1;
+  }
+
+  // Information on how/why the process exited
+  oneof ExitType {
+    Exited exited = 2;
+    Signaled signaled = 3;
+    Signaled stopped = 4;
+  }
 }
 
+// Information about an open event
+message Open {
+  // The process that is opening the file
+  optional ProcessInfoLight instigator = 1;
+
+  // The file being opened
+  optional FileInfo target = 2;
+
+  // Bitmask of flags used to open the file
+  // Note: Represents the mask applied by the kernel, not the typical `open(2)`
+  // flags (e.g. FREAD, FWRITE instead of O_RDONLY, O_RDWR, etc...)
+  optional int32 flags = 3;
+}
+
+// Information about a close event
+message Close {
+  // The process closing the file
+  optional ProcessInfoLight instigator = 1;
+
+  // The file being closed
+  optional FileInfo target = 2;
+
+  // Whether or not the file was written to
+  optional bool modified = 3;
+}
+
+// Information about an exchagedata event
+// This event is not applicable to all filesystems (notably APFS)
+message Exchangedata {
+  // The process that is exchanging the data
+  optional ProcessInfoLight instigator = 1;
+
+  // File information for the two files in the exchangedata operation
+  optional FileInfo file1 = 2;
+  optional FileInfo file2 = 3;
+}
+
+// Information about a rename event
+message Rename {
+  // The process renaming the file
+  optional ProcessInfoLight instigator = 1;
+
+  // The source file being renamed
+  optional FileInfo source = 2;
+
+  // The target path when the rename is complete
+  optional string target = 3;
+
+  // Whether or not the target path previously existed
+  optional bool target_existed = 4;
+}
+
+// Information about an unlink event
+message Unlink {
+  // The process deleting the file
+  optional ProcessInfoLight instigator = 1;
+
+  // The file being deleted
+  optional FileInfo target = 2;
+}
+
+// Information about a link event
+message Link {
+  // The process performing the link
+  optional ProcessInfoLight instigator = 1;
+
+  // The source file being linked
+  optional FileInfo source = 2;
+
+  // The path of the new link
+  optional string target = 3;
+}
+
+// Information about when disks are added or removed
+message Disk {
+  // Whether the disk just appeared or disappeared from the system
+  enum Action {
+    ACTION_UNKNOWN = 0;
+    ACTION_APPEARED = 1;
+    ACTION_DISAPPEARED = 2;
+  }
+  optional Action action = 1;
+
+  // Volume path
+  optional string mount = 2;
+
+  // Volume name
+  optional string volume = 3;
+
+  // Media BSD name
+  optional string bsd_name = 4;
+
+  // Kind of volume
+  optional string fs = 5;
+
+  // Device vendor and model information
+  optional string model = 6;
+
+  // Serial number of the device
+  optional string serial = 7;
+
+  // Device protocol
+  optional string bus = 8;
+
+  // Path of the DMG
+  optional string dmg_path = 9;
+
+  // Time device appeared/disappeared
+  optional google.protobuf.Timestamp appearance = 10;
+}
+
+// Information emitted when Santa captures bundle information
 message Bundle {
   // This is the hash of the file within the bundle that triggered the event
-  optional string sha256 = 1;
+  optional Hash file_hash = 1;
+
   // This is the hash of the hashes of all executables in the bundle
-  optional string bundle_hash = 2;
+  optional Hash bundle_hash = 2;
+
+  // Name of the bundle
   optional string bundle_name = 3;
+
+  // Bundle identifier
   optional string bundle_id = 4;
+
+  // Bundle path
   optional string bundle_path = 5;
+
+  // Path of the file within the bundle that triggered the event
   optional string path = 6;
 }
 
-message Fork {
-  optional ProcessInfo process_info = 1;
-}
-
-message Exit {
-  optional ProcessInfo process_info = 1;
-}
-
+// Information for a transitive allowlist rule
 message Allowlist {
-  optional int32 pid = 1;
-  optional int32 pidversion = 2;
-  optional string path = 3;
-  optional string sha256 = 4;
+  // The process that caused the allowlist rule to be generated
+  optional ProcessInfoLight instigator = 1;
+
+  // The file the new allowlist rule applies to
+  optional FileInfo target = 2;
 }
 
-message SantaMessage {
-  google.protobuf.Timestamp event_time = 1;
+// Information about access to a watched path
+message FileAccess {
+  // The process that attempted to access the watched path
+  optional ProcessInfo instigator = 1;
 
-  oneof message {
-    FileModification file_modification = 2;
-    Execution execution = 3;
-    DiskAppeared disk_appeared = 4;
-    DiskDisappeared disk_disappeared = 5;
-    Bundle bundle = 6;
-    Fork fork = 7;
-    Exit exit = 8;
-    Allowlist allowlist = 9;
+  // The path that was accessed
+  optional FileInfoLight target = 2;
+
+  // The version of the policy when the decision was made
+  optional string policy_version = 3;
+
+  // The name of the specific policy that triggered this log
+  optional string policy_name = 4;
+
+  // The event type that attempted to access the watched path
+  enum AccessType {
+    ACCESS_TYPE_UNKNOWN = 0;
+    ACCESS_TYPE_OPEN = 1;
+    ACCESS_TYPE_RENAME = 2;
+    ACCESS_TYPE_UNLINK = 3;
+    ACCESS_TYPE_LINK = 4;
+    ACCESS_TYPE_CLONE = 5;
+    ACCESS_TYPE_EXCHANGEDATA = 6;
+    ACCESS_TYPE_COPYFILE = 7;
+    ACCESS_TYPE_CREATE = 8;
+    ACCESS_TYPE_TRUNCATE = 9;
   }
+  optional AccessType access_type = 5;
+
+  // Whether the operation was allowed or denied and why
+  enum PolicyDecision {
+    POLICY_DECISION_UNKNOWN = 0;
+    POLICY_DECISION_DENIED = 1;
+    POLICY_DECISION_DENIED_INVALID_SIGNATURE = 2;
+    POLICY_DECISION_ALLOWED_AUDIT_ONLY = 3;
+  }
+  optional PolicyDecision policy_decision = 6;
+}
+
+// A message encapsulating a single event
+message SantaMessage {
+  // Machine ID of the host emitting this log
+  // Only valid when EnableMachineIDDecoration configuration option is set
+  optional string machine_id = 1;
+
+  // Timestamp when the event occurred
+  optional google.protobuf.Timestamp event_time = 2;
+
+  // Timestamp when Santa finished processing the event
+  optional google.protobuf.Timestamp processed_time = 3;
+
+  // Event type being described by this message
+  oneof event {
+    Execution execution = 10;
+    Fork fork = 11;
+    Exit exit = 12;
+    Close close = 13;
+    Rename rename = 14;
+    Unlink unlink = 15;
+    Link link = 16;
+    Exchangedata exchangedata = 17;
+    Disk disk = 18;
+    Bundle bundle = 19;
+    Allowlist allowlist = 20;
+    FileAccess file_access = 21;
+  };
+}
+
+message SantaMessageBatch {
+  repeated SantaMessage messages = 1;
 }
 
 message LogBatch {

Source/common/santa_proto_include_wrapper.h

@@ -0,0 +1,20 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON_SANTA_PROTO_INCLUDE_WRAPPER_H
+#define SANTA__COMMON_SANTA_PROTO_INCLUDE_WRAPPER_H
+
+#include "Source/common/santa.pb.h"
+
+#endif

Source/gui/BUILD

@@ -85,7 +85,7 @@ macos_application(
         "//conditions:default": None,
     }),
     infoplists = ["Info.plist"],
-    minimum_os_version = "10.15",
+    minimum_os_version = "11.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",

Source/gui/SNTNotificationManager.m

@@ -92,10 +92,16 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 }
 
 - (void)queueMessage:(SNTMessageWindowController *)pendingMsg {
-  NSString *messageHash = [pendingMsg messageHash];
+  // Post a distributed notification, regardless of queue state.
+  [self postDistributedNotification:pendingMsg];
+
+  // If GUI is in silent mode or if there's already a notification queued for
+  // this message, don't do anything else.
+  if ([SNTConfigurator configurator].enableSilentMode) return;
   if ([self notificationAlreadyQueued:pendingMsg]) return;
 
-  // See if this message is silenced.
+  // See if this message has been user-silenced.
+  NSString *messageHash = [pendingMsg messageHash];
   NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
   NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][messageHash];
   if ([silenceDate isKindOfClass:[NSDate class]]) {
@@ -114,7 +120,6 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 
   pendingMsg.delegate = self;
   [self.pendingNotifications addObject:pendingMsg];
-  [self postDistributedNotification:pendingMsg];
 
   if (!self.currentWindowController) {
     [self showQueuedWindow];
@@ -315,8 +320,6 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 }
 
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
-  if ([SNTConfigurator configurator].enableSilentMode) return;
-
   if (!event) {
     LOGI(@"Error: Missing event object in message received from daemon!");
     return;
@@ -329,8 +332,6 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 }
 
 - (void)postUSBBlockNotification:(SNTDeviceEvent *)event withCustomMessage:(NSString *)message {
-  if ([SNTConfigurator configurator].enableSilentMode) return;
-
   if (!event) {
     LOGI(@"Error: Missing event object in message received from daemon!");
     return;

Source/gui/SNTNotificationManagerTest.m

@@ -12,8 +12,6 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-// #import <MOLCertificate/MOLCertificate.h>
-// #import <MOLCodesignChecker/MOLCodesignChecker.h>
 #import <OCMock/OCMock.h>
 #import <XCTest/XCTest.h>
 

Source/gui/main.m

@@ -62,28 +62,24 @@ int main(int argc, const char *argv[]) {
       sysxOperation = @(2);
     }
     if (sysxOperation) {
-      if (@available(macOS 10.15, *)) {
-        NSString *e = [SNTXPCControlInterface systemExtensionID];
-        dispatch_queue_t q = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0);
-        OSSystemExtensionRequest *req;
-        if (sysxOperation.intValue == 1) {
-          NSLog(@"Requesting SystemExtension activation");
-          req = [OSSystemExtensionRequest activationRequestForExtension:e queue:q];
-        } else if (sysxOperation.intValue == 2) {
-          NSLog(@"Requesting SystemExtension deactivation");
-          req = [OSSystemExtensionRequest deactivationRequestForExtension:e queue:q];
-        }
-        if (req) {
-          SNTSystemExtensionDelegate *ed = [[SNTSystemExtensionDelegate alloc] init];
-          req.delegate = ed;
-          [[OSSystemExtensionManager sharedManager] submitRequest:req];
-          dispatch_after(dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 60), q, ^{
-            exit(1);
-          });
-          [[NSRunLoop mainRunLoop] run];
-        }
-      } else {
-        exit(1);
+      NSString *e = [SNTXPCControlInterface systemExtensionID];
+      dispatch_queue_t q = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_HIGH, 0);
+      OSSystemExtensionRequest *req;
+      if (sysxOperation.intValue == 1) {
+        NSLog(@"Requesting SystemExtension activation");
+        req = [OSSystemExtensionRequest activationRequestForExtension:e queue:q];
+      } else if (sysxOperation.intValue == 2) {
+        NSLog(@"Requesting SystemExtension deactivation");
+        req = [OSSystemExtensionRequest deactivationRequestForExtension:e queue:q];
+      }
+      if (req) {
+        SNTSystemExtensionDelegate *ed = [[SNTSystemExtensionDelegate alloc] init];
+        req.delegate = ed;
+        [[OSSystemExtensionManager sharedManager] submitRequest:req];
+        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 60), q, ^{
+          exit(1);
+        });
+        [[NSRunLoop mainRunLoop] run];
       }
     }
 

Source/santabundleservice/BUILD

@@ -34,7 +34,7 @@ macos_command_line_application(
         "--options library,kill,runtime",
     ],
     infoplists = ["Info.plist"],
-    minimum_os_version = "10.15",
+    minimum_os_version = "11.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",

Source/santactl/BUILD

@@ -7,13 +7,36 @@ package(
     default_visibility = ["//:santa_package_group"],
 )
 
+objc_library(
+    name = "santactl_cmd",
+    srcs = [
+        "SNTCommand.m",
+        "SNTCommandController.m",
+    ],
+    hdrs = [
+        "SNTCommand.h",
+        "SNTCommandController.h",
+    ],
+    deps = [
+        "//Source/common:SNTXPCControlInterface",
+        "@MOLXPCConnection",
+    ],
+)
+
+objc_library(
+    name = "SNTCommandPrintLog",
+    srcs = ["Commands/SNTCommandPrintLog.mm"],
+    deps = [
+        ":santactl_cmd",
+        "//Source/common:SNTLogging",
+        "//Source/common:santa_cc_proto_library_wrapper",
+        "//Source/santad/Logs/EndpointSecurity/Writers/FSSpool:binaryproto_cc_proto_library_wrapper",
+    ],
+)
+
 objc_library(
     name = "santactl_lib",
     srcs = [
-        "SNTCommand.h",
-        "SNTCommand.m",
-        "SNTCommandController.h",
-        "SNTCommandController.m",
         "main.m",
         "Commands/SNTCommandFileInfo.m",
         "Commands/SNTCommandRule.m",
@@ -26,7 +49,6 @@ objc_library(
         "//:opt_build": [],
         "//conditions:default": [
             "Commands/SNTCommandBundleInfo.m",
-            "Commands/SNTCommandCacheHistogram.m",
             "Commands/SNTCommandCheckCache.m",
             "Commands/SNTCommandFlushCache.m",
         ],
@@ -34,8 +56,9 @@ objc_library(
     sdk_dylibs = ["libz"],
     sdk_frameworks = ["IOKit"],
     deps = [
+        ":SNTCommandPrintLog",
+        ":santactl_cmd",
         "//Source/common:SNTCachedDecision",
-        "//Source/common:SNTCommon",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTDropRootPrivs",
@@ -67,7 +90,7 @@ macos_command_line_application(
         "--options library,kill,runtime",
     ],
     infoplists = ["Info.plist"],
-    minimum_os_version = "10.15",
+    minimum_os_version = "11.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",

Source/santactl/Commands/SNTCommandCacheHistogram.m

@@ -1,79 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#ifdef DEBUG
-
-#import <Foundation/Foundation.h>
-#import <MOLXPCConnection/MOLXPCConnection.h>
-
-#import "Source/common/SNTLogging.h"
-#import "Source/common/SNTXPCControlInterface.h"
-#import "Source/santactl/SNTCommand.h"
-#import "Source/santactl/SNTCommandController.h"
-
-@interface SNTCommandCacheHistogram : SNTCommand <SNTCommandProtocol>
-@end
-
-@implementation SNTCommandCacheHistogram
-
-REGISTER_COMMAND_NAME(@"cachehistogram")
-
-+ (BOOL)requiresRoot {
-  return YES;
-}
-
-+ (BOOL)requiresDaemonConn {
-  return YES;
-}
-
-+ (NSString *)shortHelpText {
-  return @"Print a cache distribution histogram.";
-}
-
-+ (NSString *)longHelpText {
-  return (@"Prints a histogram of each bucket of the in-kernel cache\n"
-          @"  Use -g to get 'graphical' output\n"
-          @"Only available in DEBUG builds.");
-}
-
-- (void)runWithArguments:(NSArray *)arguments {
-  [[self.daemonConn remoteObjectProxy] cacheBucketCount:^(NSArray *counts) {
-    NSMutableDictionary<NSNumber *, NSNumber *> *d = [NSMutableDictionary dictionary];
-    [counts enumerateObjectsUsingBlock:^(id _Nonnull obj, NSUInteger idx, BOOL *_Nonnull stop) {
-      d[obj] = @([d[obj] intValue] + 1);
-    }];
-    printf("There are %llu empty buckets\n", [d[@0] unsignedLongLongValue]);
-
-    for (NSNumber *key in [d.allKeys sortedArrayUsingSelector:@selector(compare:)]) {
-      if ([key isEqual:@0]) continue;
-      uint64_t k = [key unsignedLongLongValue];
-      uint64_t v = [d[key] unsignedLongLongValue];
-
-      if ([[[NSProcessInfo processInfo] arguments] containsObject:@"-g"]) {
-        printf("%4llu: ", k);
-        for (uint64_t y = 0; y < v; ++y) {
-          printf("#");
-        }
-        printf("\n");
-      } else {
-        printf("%4llu bucket[s] have %llu %s\n", v, k, k > 1 ? "entries" : "entry");
-      }
-    }
-    exit(0);
-  }];
-}
-
-@end
-
-#endif

Source/santactl/Commands/SNTCommandCheckCache.m

@@ -1,4 +1,4 @@
-/// Copyright 2016 Google Inc. All rights reserved.
+/// Copyright 2016-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -49,33 +49,30 @@ REGISTER_COMMAND_NAME(@"checkcache")
 }
 
 - (void)runWithArguments:(NSArray *)arguments {
-  santa_vnode_id_t vnodeID = [self vnodeIDForFile:arguments.firstObject];
+  SantaVnode vnodeID = [self vnodeIDForFile:arguments.firstObject];
   [[self.daemonConn remoteObjectProxy]
     checkCacheForVnodeID:vnodeID
-               withReply:^(santa_action_t action) {
-                 if (action == ACTION_RESPOND_ALLOW) {
+               withReply:^(SNTAction action) {
+                 if (action == SNTActionRespondAllow) {
                    LOGI(@"File exists in [allowlist] kernel cache");
                    exit(0);
-                 } else if (action == ACTION_RESPOND_DENY) {
+                 } else if (action == SNTActionRespondDeny) {
                    LOGI(@"File exists in [blocklist] kernel cache");
                    exit(0);
-                 } else if (action == ACTION_RESPOND_ALLOW_COMPILER) {
+                 } else if (action == SNTActionRespondAllowCompiler) {
                    LOGI(@"File exists in [allowlist compiler] kernel cache");
                    exit(0);
-                 } else if (action == ACTION_RESPOND_ALLOW_PENDING_TRANSITIVE) {
-                   LOGI(@"File exists in [allowlist pending_transitive] kernel cache");
-                   exit(0);
-                 } else if (action == ACTION_UNSET) {
+                 } else if (action == SNTActionUnset) {
                    LOGE(@"File does not exist in cache");
                    exit(1);
                  }
                }];
 }
 
-- (santa_vnode_id_t)vnodeIDForFile:(NSString *)path {
+- (SantaVnode)vnodeIDForFile:(NSString *)path {
   struct stat fstat = {};
   stat(path.fileSystemRepresentation, &fstat);
-  santa_vnode_id_t ret = {.fsid = fstat.st_dev, .fileid = fstat.st_ino};
+  SantaVnode ret = {.fsid = fstat.st_dev, .fileid = fstat.st_ino};
   return ret;
 }
 

Source/santactl/Commands/SNTCommandFileInfo.m

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -385,6 +385,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
         case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
         case SNTEventStateAllowCompiler: [output appendString:@" (Compiler)"]; break;
         case SNTEventStateAllowTransitive: [output appendString:@" (Transitive)"]; break;
+        case SNTEventStateBlockLongPath: [output appendString:@" (Long Path)"]; break;
 
         default: output = @"None".mutableCopy; break;
       }

Source/santactl/Commands/SNTCommandMetrics.m

@@ -68,14 +68,34 @@ REGISTER_COMMAND_NAME(@"metrics")
 
     for (NSString *fieldName in metric[@"fields"]) {
       for (NSDictionary *field in metric[@"fields"][fieldName]) {
-        const char *fieldNameStr = [fieldName cStringUsingEncoding:NSUTF8StringEncoding];
-        const char *fieldValueStr = [field[@"value"] cStringUsingEncoding:NSUTF8StringEncoding];
         const char *createdStr = [field[@"created"] UTF8String];
         const char *lastUpdatedStr = [field[@"last_updated"] UTF8String];
         const char *data = [[NSString stringWithFormat:@"%@", field[@"data"]] UTF8String];
 
-        if (strlen(fieldNameStr) > 0) {
-          printf("  %-25s | %s=%s\n", "Field", fieldNameStr, fieldValueStr);
+        NSArray<NSString *> *fields = [fieldName componentsSeparatedByString:@","];
+        NSArray<NSString *> *fieldValues = [field[@"value"] componentsSeparatedByString:@","];
+
+        if (fields.count != fieldValues.count) {
+          fprintf(stderr, "metric %s has a different number of field names and field values",
+                  [fieldName UTF8String]);
+          continue;
+        }
+
+        NSString *fieldDisplayString = @"";
+
+        if (fields.count >= 1 && fields[0].length) {
+          for (int i = 0; i < fields.count; i++) {
+            fieldDisplayString = [fieldDisplayString
+              stringByAppendingString:[NSString
+                                        stringWithFormat:@"%@=%@", fields[i], fieldValues[i]]];
+            if (i < fields.count - 1) {
+              fieldDisplayString = [fieldDisplayString stringByAppendingString:@","];
+            }
+          }
+        }
+
+        if (![fieldDisplayString isEqualToString:@""]) {
+          printf("  %-25s | %s\n", "Field", [fieldDisplayString UTF8String]);
         }
 
         printf("  %-25s | %s\n", "Created", createdStr);

Source/santactl/Commands/SNTCommandPrintLog.mm

@@ -0,0 +1,131 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+#include <google/protobuf/util/json_util.h>
+#include <stdlib.h>
+
+#include <iostream>
+#include <string>
+
+#include "Source/common/SNTLogging.h"
+#include "Source/common/santa_proto_include_wrapper.h"
+#import "Source/santactl/SNTCommand.h"
+#import "Source/santactl/SNTCommandController.h"
+#include "Source/santad/Logs/EndpointSecurity/Writers/FSSpool/binaryproto_proto_include_wrapper.h"
+#include "google/protobuf/any.pb.h"
+
+using google::protobuf::util::JsonPrintOptions;
+using google::protobuf::util::MessageToJsonString;
+using santa::fsspool::binaryproto::LogBatch;
+namespace pbv1 = ::santa::pb::v1;
+
+@interface SNTCommandPrintLog : SNTCommand <SNTCommandProtocol>
+@end
+
+@implementation SNTCommandPrintLog
+
+REGISTER_COMMAND_NAME(@"printlog")
+
++ (BOOL)requiresRoot {
+  return NO;
+}
+
++ (BOOL)requiresDaemonConn {
+  return NO;
+}
+
++ (NSString *)shortHelpText {
+  return @"Prints the contents of Santa protobuf log files as JSON.";
+}
+
++ (NSString *)longHelpText {
+  return @"Prints the contents of serialized Santa protobuf logs as JSON.\n"
+         @"Multiple paths can be provided. The output is a list of all the \n"
+         @"SantaMessage entries per-file. E.g.: \n"
+         @"  [\n"
+         @"    [\n"
+         @"      ... file 1 contents ...\n"
+         @"    ],\n"
+         @"    [\n"
+         @"      ... file N contents ...\n"
+         @"    ]\n"
+         @"  ]";
+}
+
+- (void)runWithArguments:(NSArray *)arguments {
+  JsonPrintOptions options;
+  options.always_print_enums_as_ints = false;
+  options.always_print_primitive_fields = true;
+  options.preserve_proto_field_names = true;
+  options.add_whitespace = true;
+
+  for (int argIdx = 0; argIdx < [arguments count]; argIdx++) {
+    NSString *path = arguments[argIdx];
+    int fd = open([path UTF8String], O_RDONLY);
+    if (fd == -1) {
+      LOGE(@"Failed to open '%@': errno: %d: %s", path, errno, strerror(errno));
+      continue;
+    }
+
+    LogBatch logBatch;
+    bool ret = logBatch.ParseFromFileDescriptor(fd);
+    close(fd);
+
+    if (!ret) {
+      LOGE(@"Failed to parse '%@'", path);
+      continue;
+    }
+
+    if (argIdx != 0) {
+      std::cout << ",";
+    } else {
+      // Print the opening outer JSON array
+      std::cout << "[";
+    }
+    std::cout << "\n[\n";
+
+    int numRecords = logBatch.records_size();
+
+    for (int i = 0; i < numRecords; i++) {
+      const google::protobuf::Any &any = logBatch.records(i);
+      ::pbv1::SantaMessage santaMsg;
+      if (!any.UnpackTo(&santaMsg)) {
+        LOGE(@"Failed to unpack Any proto to SantaMessage in file '%@'", path);
+        break;
+      }
+
+      if (i != 0) {
+        std::cout << ",\n";
+      }
+
+      std::string json;
+      if (!MessageToJsonString(santaMsg, &json, options).ok()) {
+        LOGE(@"Unable to convert message to JSON in file: '%@'", path);
+      }
+      std::cout << json;
+    }
+
+    std::cout << "]" << std::flush;
+
+    if (argIdx == ([arguments count] - 1)) {
+      // Print the closing outer JSON array
+      std::cout << "]\n";
+    }
+  }
+
+  exit(EXIT_SUCCESS);
+}
+
+@end

Source/santactl/Commands/SNTCommandStatus.m

@@ -1,4 +1,4 @@
-/// Copyright 2015 Google Inc. All rights reserved.
+/// Copyright 2015-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -74,18 +74,14 @@ REGISTER_COMMAND_NAME(@"status")
 
   SNTConfigurator *configurator = [SNTConfigurator configurator];
 
-  BOOL cachingEnabled = [configurator enableSysxCache];
-
   // Cache status
   __block uint64_t rootCacheCount = -1, nonRootCacheCount = -1;
-  if (cachingEnabled) {
-    dispatch_group_enter(group);
-    [[self.daemonConn remoteObjectProxy] cacheCounts:^(uint64_t rootCache, uint64_t nonRootCache) {
-      rootCacheCount = rootCache;
-      nonRootCacheCount = nonRootCache;
-      dispatch_group_leave(group);
-    }];
-  }
+  dispatch_group_enter(group);
+  [[self.daemonConn remoteObjectProxy] cacheCounts:^(uint64_t rootCache, uint64_t nonRootCache) {
+    rootCacheCount = rootCache;
+    nonRootCacheCount = nonRootCache;
+    dispatch_group_leave(group);
+  }];
 
   // Database counts
   __block int64_t eventCount = -1, binaryRuleCount = -1, certRuleCount = -1, teamIDRuleCount = -1;
@@ -162,6 +158,26 @@ REGISTER_COMMAND_NAME(@"status")
     dispatch_group_leave(group);
   }];
 
+  __block BOOL watchItemsEnabled = NO;
+  __block uint64_t watchItemsRuleCount = 0;
+  __block NSString *watchItemsPolicyVersion = nil;
+  __block NSString *watchItemsConfigPath = nil;
+  __block NSTimeInterval watchItemsLastUpdateEpoch = 0;
+  dispatch_group_enter(group);
+  [[self.daemonConn remoteObjectProxy]
+    watchItemsState:^(BOOL enabled, uint64_t ruleCount, NSString *policyVersion,
+                      NSString *configPath, NSTimeInterval lastUpdateEpoch) {
+      watchItemsEnabled = enabled;
+      if (enabled) {
+        watchItemsRuleCount = ruleCount;
+        watchItemsPolicyVersion = policyVersion;
+        watchItemsConfigPath = configPath;
+        watchItemsLastUpdateEpoch = lastUpdateEpoch;
+      }
+
+      dispatch_group_leave(group);
+    }];
+
   // Wait a maximum of 5s for stats collected from daemon to arrive.
   if (dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 5))) {
     fprintf(stderr, "Failed to retrieve some stats from daemon\n\n");
@@ -174,6 +190,10 @@ REGISTER_COMMAND_NAME(@"status")
   NSString *ruleSyncLastSuccessStr =
     [dateFormatter stringFromDate:ruleSyncLastSuccess] ?: fullSyncLastSuccessStr;
 
+  NSString *watchItemsLastUpdateStr =
+    [dateFormatter stringFromDate:[NSDate dateWithTimeIntervalSince1970:watchItemsLastUpdateEpoch]]
+      ?: @"Never";
+
   NSString *syncURLStr = configurator.syncBaseURL.absoluteString;
 
   BOOL exportMetrics = configurator.exportMetrics;
@@ -215,12 +235,28 @@ REGISTER_COMMAND_NAME(@"status")
         @"transitive_rules" : @(enableTransitiveRules),
       },
     } mutableCopy];
-    if (cachingEnabled) {
-      stats[@"cache"] = @{
-        @"root_cache_count" : @(rootCacheCount),
-        @"non_root_cache_count" : @(nonRootCacheCount),
+
+    NSDictionary *watchItems;
+    if (watchItemsEnabled) {
+      watchItems = @{
+        @"enabled" : @(watchItemsEnabled),
+        @"rule_count" : @(watchItemsRuleCount),
+        @"policy_version" : watchItemsPolicyVersion,
+        @"config_path" : watchItemsConfigPath,
+        @"last_policy_update" : watchItemsLastUpdateStr ?: @"null",
+      };
+    } else {
+      watchItems = @{
+        @"enabled" : @(watchItemsEnabled),
       };
     }
+    stats[@"watch_items"] = watchItems;
+
+    stats[@"cache"] = @{
+      @"root_cache_count" : @(rootCacheCount),
+      @"non_root_cache_count" : @(nonRootCacheCount),
+    };
+
     NSData *statsData = [NSJSONSerialization dataWithJSONObject:stats
                                                         options:NSJSONWritingPrettyPrinted
                                                           error:nil];
@@ -238,11 +274,9 @@ REGISTER_COMMAND_NAME(@"status")
     printf("  %-25s | %lld  (Peak: %.2f%%)\n", "Watchdog CPU Events", cpuEvents, cpuPeak);
     printf("  %-25s | %lld  (Peak: %.2fMB)\n", "Watchdog RAM Events", ramEvents, ramPeak);
 
-    if (cachingEnabled) {
-      printf(">>> Cache Info\n");
-      printf("  %-25s | %lld\n", "Root cache count", rootCacheCount);
-      printf("  %-25s | %lld\n", "Non-root cache count", nonRootCacheCount);
-    }
+    printf(">>> Cache Info\n");
+    printf("  %-25s | %lld\n", "Root cache count", rootCacheCount);
+    printf("  %-25s | %lld\n", "Non-root cache count", nonRootCacheCount);
 
     printf(">>> Database Info\n");
     printf("  %-25s | %lld\n", "Binary Rules", binaryRuleCount);
@@ -257,6 +291,15 @@ REGISTER_COMMAND_NAME(@"status")
       printf("  %-25s | %lld\n", "Rules", staticRuleCount);
     }
 
+    printf(">>> Watch Items\n");
+    printf("  %-25s | %s\n", "Enabled", (watchItemsEnabled ? "Yes" : "No"));
+    if (watchItemsEnabled) {
+      printf("  %-25s | %s\n", "Policy Version", watchItemsPolicyVersion.UTF8String);
+      printf("  %-25s | %llu\n", "Rule Count", watchItemsRuleCount);
+      printf("  %-25s | %s\n", "Config Path", watchItemsConfigPath.UTF8String);
+      printf("  %-25s | %s\n", "Last Policy Update", watchItemsLastUpdateStr.UTF8String);
+    }
+
     if (syncURLStr) {
       printf(">>> Sync Info\n");
       printf("  %-25s | %s\n", "Sync Server", [syncURLStr UTF8String]);

Source/santactl/Commands/SNTCommandVersion.m

@@ -15,7 +15,6 @@
 #import <Foundation/Foundation.h>
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
-#import "Source/common/SNTCommon.h"
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTFileInfo.h"

Source/santactl/Commands/testdata/metrics-prettyprint.json

@@ -38,18 +38,18 @@
       "type" : 9,
       "description" : "Count of process exec events on the host",
       "fields" : {
-        "rule_type" : [
+        "rule_type,client" : [
           {
             "created" : "2021-09-16T21:07:34.826Z",
             "last_updated" : "2021-09-16T21:07:34.826Z",
-            "value" : "binary",
-            "data" : 1
+            "value" : "certificate,authorizer",
+            "data" : 2
           },
           {
             "created" : "2021-09-16T21:07:34.826Z",
             "last_updated" : "2021-09-16T21:07:34.826Z",
-            "value" : "certificate",
-            "data" : 2
+            "value" : "binary,authorizer",
+            "data" : 1
           }
         ]
       }

Source/santactl/Commands/testdata/metrics-prettyprint.txt

@@ -30,14 +30,14 @@
   Metric Name               | /santa/events
   Description               | Count of process exec events on the host
   Type                      | SNTMetricTypeCounter
-  Field                     | rule_type=binary
-  Created                   | 2021-09-16T21:07:34.826Z
-  Last Updated              | 2021-09-16T21:07:34.826Z
-  Data                      | 1
-  Field                     | rule_type=certificate
+  Field                     | rule_type=certificate,client=authorizer
   Created                   | 2021-09-16T21:07:34.826Z
   Last Updated              | 2021-09-16T21:07:34.826Z
   Data                      | 2
+  Field                     | rule_type=binary,client=authorizer
+  Created                   | 2021-09-16T21:07:34.826Z
+  Last Updated              | 2021-09-16T21:07:34.826Z
+  Data                      | 1
 
   Metric Name               | /santa/using_endpoint_security_framework
   Description               | Is santad using the endpoint security framework

Source/santad/DataLayer/SNTRuleTable.m

@@ -18,6 +18,7 @@
 #import <MOLCertificate/MOLCertificate.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
 
+#import "Source/common/Platform.h"
 #import "Source/common/SNTCachedDecision.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTFileInfo.h"
@@ -36,7 +37,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // instead we use the following preprocessor macros to conditionally compile these API. The
   // drawback here is that if a pre-macOS 12 SDK is used to build Santa and it is then deployed
   // on macOS 12 or later, the dynamic mute set will not be computed.
-#if defined(MAC_OS_VERSION_12_0) && MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_12_0
+#if HAVE_MACOS_12
   // Create a temporary ES client in order to grab the default set of muted paths.
   // TODO(mlw): Reorganize this code so that a temporary ES client doesn't need to be created
   es_client_t *client = NULL;
@@ -105,6 +106,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 
     // This is a Santa-curated list of paths to check on startup. This list will be merged
     // with the set of default muted paths from ES.
+
     NSSet *santaDefinedCriticalPaths = [NSSet setWithArray:@[
       @"/usr/libexec/trustd",
       @"/usr/lib/dyld",
@@ -136,6 +138,12 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   NSMutableDictionary *bins = [NSMutableDictionary dictionary];
   for (NSString *path in [SNTRuleTable criticalSystemBinaryPaths]) {
     SNTFileInfo *binInfo = [[SNTFileInfo alloc] initWithPath:path];
+    if (!binInfo.SHA256) {
+      // If there isn't a hash, no need to compute the other info here.
+      // Just continue on to the next binary.
+      LOGW(@"Unable to compute hash for critical system binary %@.", path);
+      continue;
+    }
     MOLCodesignChecker *csInfo = [binInfo codesignCheckerWithError:NULL];
 
     // Make sure the critical system binary is signed by the same chain as launchd/self
@@ -143,9 +151,9 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
     if ([csInfo signingInformationMatches:self.launchdCSInfo]) {
       systemBin = YES;
     } else if (![csInfo signingInformationMatches:self.santadCSInfo]) {
-      LOGE(@"Unable to validate critical system binary. "
+      LOGW(@"Unable to validate critical system binary %@. "
            @"pid 1: %@, santad: %@ and %@: %@ do not match.",
-           self.launchdCSInfo.leafCertificate, self.santadCSInfo.leafCertificate, path,
+           path, self.launchdCSInfo.leafCertificate, self.santadCSInfo.leafCertificate, path,
            csInfo.leafCertificate);
       continue;
     }

Source/santad/DataLayer/WatchItemPolicy.h

@@ -0,0 +1,95 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__SANTAD__DATALAYER_WATCHITEMPOLICY_H
+#define SANTA__SANTAD__DATALAYER_WATCHITEMPOLICY_H
+
+#include <Kernel/kern/cs_blobs.h>
+
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace santa::santad::data_layer {
+
+enum class WatchItemPathType {
+  kPrefix,
+  kLiteral,
+};
+
+static constexpr WatchItemPathType kWatchItemPolicyDefaultPathType =
+    WatchItemPathType::kLiteral;
+static constexpr bool kWatchItemPolicyDefaultAllowReadAccess = false;
+static constexpr bool kWatchItemPolicyDefaultAuditOnly = true;
+
+struct WatchItemPolicy {
+  struct Process {
+    Process(std::string bp, std::string sid, std::string ti,
+            std::vector<uint8_t> cdh, std::string ch)
+        : binary_path(bp),
+          signing_id(sid),
+          team_id(ti),
+          cdhash(std::move(cdh)),
+          certificate_sha256(ch) {}
+
+    bool operator==(const Process &other) const {
+      return binary_path == other.binary_path &&
+             signing_id == other.signing_id && team_id == other.team_id &&
+             cdhash == other.cdhash &&
+             certificate_sha256 == other.certificate_sha256;
+    }
+
+    bool operator!=(const Process &other) const { return !(*this == other); }
+
+    std::string binary_path;
+    std::string signing_id;
+    std::string team_id;
+    std::vector<uint8_t> cdhash;
+    std::string certificate_sha256;
+  };
+
+  WatchItemPolicy(std::string_view n, std::string_view p,
+                  WatchItemPathType pt = kWatchItemPolicyDefaultPathType,
+                  bool ara = kWatchItemPolicyDefaultAllowReadAccess,
+                  bool ao = kWatchItemPolicyDefaultAuditOnly,
+                  std::vector<Process> procs = {})
+      : name(n),
+        path(p),
+        path_type(pt),
+        allow_read_access(ara),
+        audit_only(ao),
+        processes(std::move(procs)) {}
+
+  bool operator==(const WatchItemPolicy &other) const {
+    return name == other.name && path == other.path &&
+           path_type == other.path_type &&
+           allow_read_access == other.allow_read_access &&
+           audit_only == other.audit_only && processes == other.processes;
+  }
+
+  bool operator!=(const WatchItemPolicy &other) const {
+    return !(*this == other);
+  }
+
+  std::string name;
+  std::string path;
+  WatchItemPathType path_type;
+  bool allow_read_access;
+  bool audit_only;
+  std::vector<Process> processes;
+};
+
+}  // namespace santa::santad::data_layer
+
+#endif

Source/santad/DataLayer/WatchItems.h

@@ -0,0 +1,118 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__SANTAD__DATALAYER_WATCHITEMS_H
+#define SANTA__SANTAD__DATALAYER_WATCHITEMS_H
+
+#include <CommonCrypto/CommonDigest.h>
+#import <Foundation/Foundation.h>
+#include <dispatch/dispatch.h>
+
+#include <array>
+#include <memory>
+#include <optional>
+#include <set>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "Source/common/PrefixTree.h"
+#include "Source/santad/DataLayer/WatchItemPolicy.h"
+#import "Source/santad/EventProviders/SNTEndpointSecurityEventHandler.h"
+
+extern NSString *const kWatchItemConfigKeyVersion;
+extern NSString *const kWatchItemConfigKeyWatchItems;
+extern NSString *const kWatchItemConfigKeyPaths;
+extern NSString *const kWatchItemConfigKeyPathsPath;
+extern NSString *const kWatchItemConfigKeyPathsIsPrefix;
+extern NSString *const kWatchItemConfigKeyOptions;
+extern NSString *const kWatchItemConfigKeyOptionsAllowReadAccess;
+extern NSString *const kWatchItemConfigKeyOptionsAuditOnly;
+extern NSString *const kWatchItemConfigKeyProcesses;
+extern NSString *const kWatchItemConfigKeyProcessesBinaryPath;
+extern NSString *const kWatchItemConfigKeyProcessesCertificateSha256;
+extern NSString *const kWatchItemConfigKeyProcessesSigningID;
+extern NSString *const kWatchItemConfigKeyProcessesTeamID;
+extern NSString *const kWatchItemConfigKeyProcessesCDHash;
+
+// Forward declarations
+namespace santa::santad::data_layer {
+class WatchItemsPeer;
+}
+
+namespace santa::santad::data_layer {
+
+struct WatchItemsState {
+  uint64_t rule_count;
+  NSString *policy_version;
+  NSString *config_path;
+  NSTimeInterval last_config_load_epoch;
+};
+
+class WatchItems : public std::enable_shared_from_this<WatchItems> {
+ public:
+  using VersionAndPolicies =
+    std::pair<std::string, std::vector<std::optional<std::shared_ptr<WatchItemPolicy>>>>;
+  using WatchItemsTree = santa::common::PrefixTree<std::shared_ptr<WatchItemPolicy>>;
+
+  // Factory
+  static std::shared_ptr<WatchItems> Create(NSString *config_path,
+                                            uint64_t reapply_config_frequency_secs);
+
+  WatchItems(NSString *config_path_, dispatch_queue_t q, dispatch_source_t timer_source,
+             void (^periodic_task_complete_f)(void) = nullptr);
+  ~WatchItems();
+
+  void BeginPeriodicTask();
+
+  void RegisterClient(id<SNTEndpointSecurityDynamicEventHandler> client);
+
+  void SetConfigPath(NSString *config_path);
+  VersionAndPolicies FindPolciesForPaths(const std::vector<std::string_view> &paths);
+
+  std::optional<WatchItemsState> State();
+
+  friend class santa::santad::data_layer::WatchItemsPeer;
+
+ private:
+  NSDictionary *ReadConfig();
+  NSDictionary *ReadConfigLocked() ABSL_SHARED_LOCKS_REQUIRED(lock_);
+  void ReloadConfig(NSDictionary *new_config);
+  void UpdateCurrentState(std::unique_ptr<WatchItemsTree> new_tree,
+                          std::set<std::pair<std::string, WatchItemPathType>> &&new_monitored_paths,
+                          NSDictionary *new_config);
+  bool BuildPolicyTree(const std::vector<std::shared_ptr<WatchItemPolicy>> &watch_items,
+                       WatchItemsTree &tree,
+                       std::set<std::pair<std::string, WatchItemPathType>> &paths);
+
+  NSString *config_path_;
+  dispatch_queue_t q_;
+  dispatch_source_t timer_source_;
+  void (^periodic_task_complete_f_)(void);
+
+  absl::Mutex lock_;
+
+  std::unique_ptr<WatchItemsTree> watch_items_ ABSL_GUARDED_BY(lock_);
+  NSDictionary *current_config_ ABSL_GUARDED_BY(lock_);
+  NSTimeInterval last_update_time_ ABSL_GUARDED_BY(lock_);
+  std::set<std::pair<std::string, WatchItemPathType>> currently_monitored_paths_
+    ABSL_GUARDED_BY(lock_);
+  std::string policy_version_ ABSL_GUARDED_BY(lock_);
+  std::set<id<SNTEndpointSecurityDynamicEventHandler>> registerd_clients_ ABSL_GUARDED_BY(lock_);
+  bool periodic_task_started_ = false;
+};
+
+}  // namespace santa::santad::data_layer
+
+#endif

Source/santad/DataLayer/WatchItems.mm

@@ -0,0 +1,702 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include "Source/santad/DataLayer/WatchItems.h"
+
+#include <CommonCrypto/CommonDigest.h>
+#include <Kernel/kern/cs_blobs.h>
+#include <ctype.h>
+#include <glob.h>
+#include <objc/NSObjCRuntime.h>
+#include <sys/syslimits.h>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdlib>
+#include <iterator>
+#include <memory>
+#include <optional>
+#include <set>
+#include <string>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#import "Source/common/PrefixTree.h"
+#import "Source/common/SNTLogging.h"
+#import "Source/common/Unit.h"
+#include "Source/santad/DataLayer/WatchItemPolicy.h"
+using santa::common::PrefixTree;
+using santa::common::Unit;
+using santa::santad::data_layer::WatchItemPathType;
+using santa::santad::data_layer::WatchItemPolicy;
+
+NSString *const kWatchItemConfigKeyVersion = @"Version";
+NSString *const kWatchItemConfigKeyWatchItems = @"WatchItems";
+NSString *const kWatchItemConfigKeyPaths = @"Paths";
+NSString *const kWatchItemConfigKeyPathsPath = @"Path";
+NSString *const kWatchItemConfigKeyPathsIsPrefix = @"IsPrefix";
+NSString *const kWatchItemConfigKeyOptions = @"Options";
+NSString *const kWatchItemConfigKeyOptionsAllowReadAccess = @"AllowReadAccess";
+NSString *const kWatchItemConfigKeyOptionsAuditOnly = @"AuditOnly";
+NSString *const kWatchItemConfigKeyProcesses = @"Processes";
+NSString *const kWatchItemConfigKeyProcessesBinaryPath = @"BinaryPath";
+NSString *const kWatchItemConfigKeyProcessesCertificateSha256 = @"CertificateSha256";
+NSString *const kWatchItemConfigKeyProcessesSigningID = @"SigningID";
+NSString *const kWatchItemConfigKeyProcessesTeamID = @"TeamID";
+NSString *const kWatchItemConfigKeyProcessesCDHash = @"CDHash";
+
+// https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/
+static constexpr NSUInteger kMaxTeamIDLength = 10;
+
+// Semi-arbitrary upper bound.
+static constexpr NSUInteger kMaxSigningIDLength = 512;
+
+// Semi-arbitrary minimum allowed reapplication frequency.
+// Goal is to prevent a configuration setting that would cause too much
+// churn rebuilding glob paths based on the state of the filesystem.
+static constexpr uint64_t kMinReapplyConfigFrequencySecs = 15;
+
+namespace santa::santad::data_layer {
+
+// Type aliases
+using ValidatorBlock = bool (^)(id, NSError **);
+using PathAndTypePair = std::pair<std::string, WatchItemPathType>;
+using PathList = std::vector<PathAndTypePair>;
+using ProcessList = std::vector<WatchItemPolicy::Process>;
+
+static void PopulateError(NSError **err, NSString *msg) {
+  if (err) {
+    *err = [NSError errorWithDomain:@"com.google.santa.watchitems"
+                               code:0
+                           userInfo:@{NSLocalizedDescriptionKey : msg}];
+  }
+}
+
+/// Ensure the given string has the expected length and only
+/// contains valid hex digits
+bool ConfirmValidHexString(NSString *str, size_t expected_length) {
+  if (str.length != expected_length) {
+    return false;
+  }
+
+  for (int i = 0; i < str.length; i++) {
+    if (!isxdigit([str characterAtIndex:i])) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static std::vector<uint8_t> HexStringToBytes(NSString *str) {
+  if (!str) {
+    return std::vector<uint8_t>{};
+  }
+
+  std::vector<uint8_t> bytes;
+  bytes.reserve(str.length / 2);
+
+  char cur_byte[3];
+  cur_byte[2] = '\0';
+
+  for (int i = 0; i < str.length / 2; i++) {
+    cur_byte[0] = [str characterAtIndex:(i * 2)];
+    cur_byte[1] = [str characterAtIndex:(i * 2 + 1)];
+
+    bytes.push_back(std::strtoul(cur_byte, nullptr, 16));
+  }
+
+  return bytes;
+}
+
+// Given a length, returns a ValidatorBlock that confirms the
+// string is a valid hex string of the given length.
+ValidatorBlock HexValidator(NSUInteger expected_length) {
+  return ^bool(NSString *val, NSError **err) {
+    if (!ConfirmValidHexString(val, expected_length)) {
+      PopulateError(
+        err, [NSString stringWithFormat:@"Expected hex string of length %lu", expected_length]);
+      return false;
+    }
+
+    return true;
+  };
+}
+
+// Given a max length, returns a ValidatorBlock that confirms the
+// string is a not longer than the max.
+ValidatorBlock LenRangeValidator(NSUInteger min_length, NSUInteger max_length) {
+  return ^bool(NSString *val, NSError **err) {
+    if (val.length < min_length) {
+      PopulateError(err, [NSString stringWithFormat:@"Value too short. Got: %lu, Min: %lu",
+                                                    val.length, min_length]);
+      return false;
+    } else if (val.length > max_length) {
+      PopulateError(err, [NSString stringWithFormat:@"Value too long. Got: %lu, Max: %lu",
+                                                    val.length, max_length]);
+      return false;
+    }
+
+    return true;
+  };
+}
+
+/// Ensure the key exists (if required) and the value matches the expected type
+bool VerifyConfigKey(NSDictionary *dict, const NSString *key, Class expected, NSError **err,
+                     bool required = false, bool (^Validator)(id, NSError **) = nil) {
+  if (dict[key]) {
+    if (![dict[key] isKindOfClass:expected]) {
+      PopulateError(err, [NSString stringWithFormat:@"Expected type '%@' for key '%@' (got: %@)",
+                                                    NSStringFromClass(expected), key,
+                                                    NSStringFromClass([dict[key] class])]);
+      return false;
+    }
+
+    NSError *validator_err;
+    if (Validator && !Validator(dict[key], &validator_err)) {
+      PopulateError(err, [NSString stringWithFormat:@"Invalid content in key '%@': %@", key,
+                                                    validator_err.localizedDescription]);
+      return false;
+    }
+  } else if (required) {
+    PopulateError(err, [NSString stringWithFormat:@"Missing required key '%@'", key]);
+    return false;
+  }
+
+  return true;
+}
+
+/// Ensure all values of the array key in the dictionary conform to the
+/// expected type. If a Validator block is supplied, each item is also
+/// subject to the custom validation method.
+bool VerifyConfigKeyArray(NSDictionary *dict, NSString *key, Class expected, NSError **err,
+                          bool (^Validator)(id, NSError **) = nil) {
+  if (!VerifyConfigKey(dict, key, [NSArray class], err)) {
+    return false;
+  }
+
+  __block bool success = true;
+  __block NSError *block_err;
+
+  [dict[key] enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) {
+    if (![obj isKindOfClass:expected]) {
+      success = false;
+      PopulateError(&block_err,
+                    [NSString stringWithFormat:@"Expected all '%@' types in array key '%@'",
+                                               NSStringFromClass(expected), key]);
+      *stop = YES;
+      return;
+    }
+
+    NSError *validator_err;
+    if (Validator && !Validator(obj, &validator_err)) {
+      PopulateError(&block_err,
+                    [NSString stringWithFormat:@"Invalid content in array key '%@': %@", key,
+                                               validator_err.localizedDescription]);
+      success = false;
+      *stop = YES;
+      return;
+    }
+  }];
+
+  if (!success && block_err) {
+    PopulateError(err, block_err.localizedDescription);
+  }
+
+  return success;
+}
+
+/// The `Paths` array can contain only `string` and `dict` types:
+/// - For `string` types, the default path type `kDefaultPathType` is used
+/// - For `dict` types, there is a required `Path` key. and an optional
+///   `IsPrefix` key to set the path type to something other than the default
+///
+/// Example:
+/// <array>
+///   <string>/my/path</string>
+///   <dict>
+///     <key>Path</key>
+///     <string>/another/partial/path</string>
+///     <key>IsPrefix</key>
+///     <true/>
+///   </dict>
+/// </array>
+std::variant<Unit, PathList> VerifyConfigWatchItemPaths(NSArray<id> *paths, NSError **err) {
+  PathList path_list;
+
+  for (id path in paths) {
+    if ([path isKindOfClass:[NSDictionary class]]) {
+      NSDictionary *path_dict = (NSDictionary *)path;
+      if (!VerifyConfigKey(path_dict, kWatchItemConfigKeyPathsPath, [NSString class], err, true,
+                           LenRangeValidator(1, PATH_MAX))) {
+        return Unit{};
+      }
+
+      NSString *path_str = path_dict[kWatchItemConfigKeyPathsPath];
+      WatchItemPathType path_type = kWatchItemPolicyDefaultPathType;
+
+      if (VerifyConfigKey(path_dict, kWatchItemConfigKeyPathsIsPrefix, [NSNumber class], err)) {
+        path_type = ([(NSNumber *)path_dict[kWatchItemConfigKeyPathsIsPrefix] boolValue] == NO
+                       ? WatchItemPathType::kLiteral
+                       : WatchItemPathType::kPrefix);
+      } else {
+        return Unit{};
+      }
+
+      path_list.push_back({std::string(path_str.UTF8String, path_str.length), path_type});
+    } else if ([path isKindOfClass:[NSString class]]) {
+      if (!LenRangeValidator(1, PATH_MAX)(path, err)) {
+        PopulateError(err, [NSString stringWithFormat:@"Invalid path length: %@",
+                                                      (err && *err) ? (*err).localizedDescription
+                                                                    : @"Unknown error"]);
+        return Unit{};
+      }
+
+      path_list.push_back({std::string(((NSString *)path).UTF8String, ((NSString *)path).length),
+                           kWatchItemPolicyDefaultPathType});
+    } else {
+      PopulateError(
+        err, [NSString stringWithFormat:
+                         @"%@ array item with invalid type. Expected 'dict' or 'string' (got: %@)",
+                         kWatchItemConfigKeyPaths, NSStringFromClass([path class])]);
+      return Unit{};
+    }
+  }
+
+  if (path_list.size() == 0) {
+    PopulateError(err, [NSString stringWithFormat:@"No paths specified"]);
+    return Unit{};
+  }
+
+  return path_list;
+}
+
+/// The `Processes` array can only contain dictionaries. Each dictionary can
+/// contain the attributes that describe a single process.
+///
+/// <array>
+///   <dict>
+///     <key>BinaryPath</key>
+///     <string>AAAA</string>
+///     <key>TeamID</key>
+///     <string>BBBB</string>
+///   </dict>
+///   <dict>
+///     <key>CertificateSha256</key>
+///     <string>CCCC</string>
+///     <key>CDHash</key>
+///     <string>DDDD</string>
+///     <key>SigningID</key>
+///     <string>EEEE</string>
+///   </dict>
+/// </array>
+std::variant<Unit, ProcessList> VerifyConfigWatchItemProcesses(NSDictionary *watch_item,
+                                                               NSError **err) {
+  __block ProcessList proc_list;
+
+  if (!VerifyConfigKeyArray(
+        watch_item, kWatchItemConfigKeyProcesses, [NSDictionary class], err,
+        ^bool(NSDictionary *process, NSError **err) {
+          if (!VerifyConfigKey(process, kWatchItemConfigKeyProcessesBinaryPath, [NSString class],
+                               err, false, LenRangeValidator(1, PATH_MAX)) ||
+              !VerifyConfigKey(process, kWatchItemConfigKeyProcessesSigningID, [NSString class],
+                               err, false, LenRangeValidator(1, kMaxSigningIDLength)) ||
+              !VerifyConfigKey(process, kWatchItemConfigKeyProcessesTeamID, [NSString class], err,
+                               false, LenRangeValidator(kMaxTeamIDLength, kMaxTeamIDLength)) ||
+              !VerifyConfigKey(process, kWatchItemConfigKeyProcessesCDHash, [NSString class], err,
+                               false, HexValidator(CS_CDHASH_LEN * 2)) ||
+              !VerifyConfigKey(process, kWatchItemConfigKeyProcessesCertificateSha256,
+                               [NSString class], err, false,
+                               HexValidator(CC_SHA256_DIGEST_LENGTH * 2))) {
+            PopulateError(err, @"Failed to verify key content");
+            return false;
+          }
+
+          // Ensure at least one attribute set
+          if (!process[kWatchItemConfigKeyProcessesBinaryPath] &&
+              !process[kWatchItemConfigKeyProcessesSigningID] &&
+              !process[kWatchItemConfigKeyProcessesTeamID] &&
+              !process[kWatchItemConfigKeyProcessesCDHash] &&
+              !process[kWatchItemConfigKeyProcessesCertificateSha256]) {
+            PopulateError(err, @"No valid attributes set in process dictionary");
+            return false;
+          }
+
+          proc_list.push_back(WatchItemPolicy::Process(
+            std::string([(process[kWatchItemConfigKeyProcessesBinaryPath] ?: @"") UTF8String]),
+            std::string([(process[kWatchItemConfigKeyProcessesSigningID] ?: @"") UTF8String]),
+            std::string([(process[kWatchItemConfigKeyProcessesTeamID] ?: @"") UTF8String]),
+            HexStringToBytes(process[kWatchItemConfigKeyProcessesCDHash]),
+            std::string(
+              [(process[kWatchItemConfigKeyProcessesCertificateSha256] ?: @"") UTF8String])));
+
+          return true;
+        })) {
+    return Unit{};
+  }
+
+  return proc_list;
+}
+
+/// Ensure that a given watch item conforms to expected structure
+///
+/// Example:
+/// <dict>
+///   <key>Paths</key>
+///   <array>
+///   ... See VerifyConfigWatchItemPaths for more details ...
+///   </array>
+///   <key>Options</key>
+///   <dict>
+///     <key>AllowReadAccess</key>
+///     <false/>
+///     <key>AuditOnly</key>
+///     <false/>
+///   </dict>
+///   <key>Processes</key>
+///   <array>
+///   ... See VerifyConfigWatchItemProcesses for more details ...
+///   </array>
+/// </dict>
+bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
+                                std::vector<std::shared_ptr<WatchItemPolicy>> &policies,
+                                NSError **err) {
+  if (!VerifyConfigKey(watch_item, kWatchItemConfigKeyPaths, [NSArray class], err, true)) {
+    return false;
+  }
+
+  std::variant<Unit, PathList> path_list =
+    VerifyConfigWatchItemPaths(watch_item[kWatchItemConfigKeyPaths], err);
+
+  if (std::holds_alternative<Unit>(path_list)) {
+    return false;
+  }
+
+  if (!VerifyConfigKey(watch_item, kWatchItemConfigKeyOptions, [NSDictionary class], err)) {
+    return false;
+  }
+
+  NSDictionary *options = watch_item[kWatchItemConfigKeyOptions];
+  if (options) {
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsAllowReadAccess, [NSNumber class],
+                         err)) {
+      return false;
+    }
+
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsAuditOnly, [NSNumber class], err)) {
+      return false;
+    }
+  }
+
+  bool allow_read_access = options[kWatchItemConfigKeyOptionsAllowReadAccess]
+                             ? [options[kWatchItemConfigKeyOptionsAllowReadAccess] boolValue]
+                             : kWatchItemPolicyDefaultAllowReadAccess;
+  bool audit_only = options[kWatchItemConfigKeyOptionsAuditOnly]
+                      ? [options[kWatchItemConfigKeyOptionsAuditOnly] boolValue]
+                      : kWatchItemPolicyDefaultAuditOnly;
+
+  std::variant<Unit, ProcessList> proc_list = VerifyConfigWatchItemProcesses(watch_item, err);
+  if (std::holds_alternative<Unit>(proc_list)) {
+    return false;
+  }
+
+  for (const PathAndTypePair &path_type_pair : std::get<PathList>(path_list)) {
+    policies.push_back(std::make_shared<WatchItemPolicy>(
+      [name UTF8String], path_type_pair.first, path_type_pair.second, allow_read_access, audit_only,
+      std::get<ProcessList>(proc_list)));
+  }
+
+  return true;
+}
+
+bool ParseConfig(NSDictionary *config, std::vector<std::shared_ptr<WatchItemPolicy>> &policies,
+                 NSError **err) {
+  if (![config[kWatchItemConfigKeyVersion] isKindOfClass:[NSString class]]) {
+    PopulateError(err, [NSString stringWithFormat:@"Missing top level string key '%@'",
+                                                  kWatchItemConfigKeyVersion]);
+    return false;
+  }
+
+  if ([(NSString *)config[kWatchItemConfigKeyVersion] length] == 0) {
+    PopulateError(err, [NSString stringWithFormat:@"Top level key '%@' has empty value",
+                                                  kWatchItemConfigKeyVersion]);
+    return false;
+  }
+
+  if (config[kWatchItemConfigKeyWatchItems] &&
+      ![config[kWatchItemConfigKeyWatchItems] isKindOfClass:[NSDictionary class]]) {
+    PopulateError(err, [NSString stringWithFormat:@"Top level key '%@' must be a dictionary",
+                                                  kWatchItemConfigKeyWatchItems]);
+    return false;
+  }
+
+  NSDictionary *watch_items = config[kWatchItemConfigKeyWatchItems];
+
+  for (id key in watch_items) {
+    if (![key isKindOfClass:[NSString class]]) {
+      PopulateError(err,
+                    [NSString stringWithFormat:@"Invalid %@ key %@: Expected type '%@' (got: %@)",
+                                               kWatchItemConfigKeyWatchItems, key,
+                                               NSStringFromClass([NSString class]),
+                                               NSStringFromClass([key class])]);
+      return false;
+    }
+
+    if ([(NSString *)key length] == 0) {
+      PopulateError(err, [NSString stringWithFormat:@"Invalid %@ key with length zero",
+                                                    kWatchItemConfigKeyWatchItems]);
+      return false;
+    }
+
+    if (![watch_items[key] isKindOfClass:[NSDictionary class]]) {
+      PopulateError(
+        err,
+        [NSString stringWithFormat:@"Value type for watch item '%@' must be a dictionary (got %@)",
+                                   key, NSStringFromClass([watch_items[key] class])]);
+      return false;
+    }
+
+    if (!ParseConfigSingleWatchItem(key, watch_items[key], policies, err)) {
+      PopulateError(err, [NSString stringWithFormat:@"In watch item '%@': %@", key,
+                                                    (err && *err) ? (*err).localizedDescription
+                                                                  : @"Unknown failure"]);
+      return false;
+    }
+  }
+
+  return true;
+}
+
+std::shared_ptr<WatchItems> WatchItems::Create(NSString *config_path,
+                                               uint64_t reapply_config_frequency_secs) {
+  if (reapply_config_frequency_secs < kMinReapplyConfigFrequencySecs) {
+    LOGW(@"Invalid watch item update interval provided: %llu. Min allowed: %llu",
+         reapply_config_frequency_secs, kMinReapplyConfigFrequencySecs);
+    return nullptr;
+  }
+
+  dispatch_queue_t q = dispatch_queue_create("com.google.santa.daemon.watch_items.q",
+                                             DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);
+  dispatch_source_t timer_source = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);
+  dispatch_source_set_timer(timer_source, dispatch_time(DISPATCH_TIME_NOW, 0),
+                            NSEC_PER_SEC * reapply_config_frequency_secs, 0);
+
+  return std::make_shared<WatchItems>(config_path, q, timer_source);
+}
+
+WatchItems::WatchItems(NSString *config_path, dispatch_queue_t q, dispatch_source_t timer_source,
+                       void (^periodic_task_complete_f)(void))
+    : config_path_(config_path),
+      q_(q),
+      timer_source_(timer_source),
+      periodic_task_complete_f_(periodic_task_complete_f),
+      watch_items_(std::make_unique<WatchItemsTree>()) {}
+
+WatchItems::~WatchItems() {
+  if (!periodic_task_started_ && timer_source_ != NULL) {
+    // The timer_source_ must be resumed to ensure it has a proper retain count before being
+    // destroyed. Additionally, it should first be cancelled to ensure the timer isn't ever
+    // fired (see man page for `dispatch_source_cancel(3)`).
+    dispatch_source_cancel(timer_source_);
+    dispatch_resume(timer_source_);
+  }
+}
+
+bool WatchItems::BuildPolicyTree(const std::vector<std::shared_ptr<WatchItemPolicy>> &watch_items,
+                                 PrefixTree<std::shared_ptr<WatchItemPolicy>> &tree,
+                                 std::set<std::pair<std::string, WatchItemPathType>> &paths) {
+  glob_t *g = (glob_t *)alloca(sizeof(glob_t));
+  for (const std::shared_ptr<WatchItemPolicy> &item : watch_items) {
+    int err = glob(item->path.c_str(), 0, nullptr, g);
+    if (err != 0 && err != GLOB_NOMATCH) {
+      LOGE(@"Failed to generate path names for watch item: %s", item->name.c_str());
+      return false;
+    }
+
+    for (size_t i = g->gl_offs; i < g->gl_pathc; i++) {
+      if (item->path_type == WatchItemPathType::kPrefix) {
+        tree.InsertPrefix(g->gl_pathv[i], item);
+      } else {
+        tree.InsertLiteral(g->gl_pathv[i], item);
+      }
+
+      paths.insert({g->gl_pathv[i], item->path_type});
+    }
+    globfree(g);
+  }
+
+  return true;
+}
+
+void WatchItems::RegisterClient(id<SNTEndpointSecurityDynamicEventHandler> client) {
+  absl::MutexLock lock(&lock_);
+  registerd_clients_.insert(client);
+}
+
+void WatchItems::UpdateCurrentState(
+  std::unique_ptr<PrefixTree<std::shared_ptr<WatchItemPolicy>>> new_tree,
+  std::set<std::pair<std::string, WatchItemPathType>> &&new_monitored_paths,
+  NSDictionary *new_config) {
+  absl::MutexLock lock(&lock_);
+
+  // The following conditions require updating the current config:
+  // 1. The current config doesn't exist but the new one does
+  // 2. The current config exists but the new one doesn't
+  // 3. The set of monitored paths changed
+  // 4. The configuration changed
+  if ((current_config_ != nil && new_config == nil) ||
+      (current_config_ == nil && new_config != nil) ||
+      (currently_monitored_paths_ != new_monitored_paths) ||
+      (new_config && ![current_config_ isEqualToDictionary:new_config])) {
+    std::vector<std::pair<std::string, WatchItemPathType>> paths_to_watch;
+    std::vector<std::pair<std::string, WatchItemPathType>> paths_to_stop_watching;
+
+    // New paths to watch are those that are in the new set, but not current
+    std::set_difference(new_monitored_paths.begin(), new_monitored_paths.end(),
+                        currently_monitored_paths_.begin(), currently_monitored_paths_.end(),
+                        std::back_inserter(paths_to_watch));
+
+    // Paths to stop watching are in the current set, but not new
+    std::set_difference(currently_monitored_paths_.begin(), currently_monitored_paths_.end(),
+                        new_monitored_paths.begin(), new_monitored_paths.end(),
+                        std::back_inserter(paths_to_stop_watching));
+
+    std::swap(watch_items_, new_tree);
+    std::swap(currently_monitored_paths_, new_monitored_paths);
+    current_config_ = new_config;
+    if (new_config) {
+      policy_version_ = [new_config[kWatchItemConfigKeyVersion] UTF8String];
+    } else {
+      policy_version_ = "";
+    }
+
+    last_update_time_ = [[NSDate date] timeIntervalSince1970];
+
+    for (const id<SNTEndpointSecurityDynamicEventHandler> &client : registerd_clients_) {
+      // Note: Enable clients on an async queue in case they perform any
+      // synchronous work that could trigger ES events. Otherwise they might
+      // trigger AUTH ES events that would attempt to re-enter this object and
+      // potentially deadlock.
+      dispatch_async(q_, ^{
+        [client watchItemsCount:currently_monitored_paths_.size()
+                       newPaths:paths_to_watch
+                   removedPaths:paths_to_stop_watching];
+      });
+    }
+  } else {
+    LOGD(@"No changes to set of watched paths.");
+  }
+}
+
+void WatchItems::ReloadConfig(NSDictionary *new_config) {
+  std::vector<std::shared_ptr<WatchItemPolicy>> new_policies;
+  auto new_tree = std::make_unique<PrefixTree<std::shared_ptr<WatchItemPolicy>>>();
+  std::set<std::pair<std::string, WatchItemPathType>> new_monitored_paths;
+
+  if (new_config) {
+    NSError *err;
+    if (!ParseConfig(new_config, new_policies, &err)) {
+      LOGE(@"Failed to parse watch item config: %@",
+           err ? err.localizedDescription : @"Unknown failure");
+      return;
+    }
+
+    if (!BuildPolicyTree(new_policies, *new_tree, new_monitored_paths)) {
+      LOGE(@"Failed to build new filesystem monitoring policy");
+      return;
+    }
+  }
+
+  UpdateCurrentState(std::move(new_tree), std::move(new_monitored_paths), new_config);
+}
+
+NSDictionary *WatchItems::ReadConfig() {
+  absl::ReaderMutexLock lock(&lock_);
+  return ReadConfigLocked();
+}
+
+NSDictionary *WatchItems::ReadConfigLocked() {
+  if (config_path_) {
+    return [NSDictionary dictionaryWithContentsOfFile:config_path_];
+  } else {
+    return nil;
+  }
+}
+
+void WatchItems::BeginPeriodicTask() {
+  if (periodic_task_started_) {
+    return;
+  }
+
+  std::weak_ptr<WatchItems> weak_watcher = weak_from_this();
+  dispatch_source_set_event_handler(timer_source_, ^{
+    std::shared_ptr<WatchItems> shared_watcher = weak_watcher.lock();
+    if (!shared_watcher) {
+      return;
+    }
+
+    shared_watcher->ReloadConfig(shared_watcher->ReadConfig());
+
+    if (shared_watcher->periodic_task_complete_f_) {
+      shared_watcher->periodic_task_complete_f_();
+    }
+  });
+
+  dispatch_resume(timer_source_);
+  periodic_task_started_ = true;
+}
+
+WatchItems::VersionAndPolicies WatchItems::FindPolciesForPaths(
+  const std::vector<std::string_view> &paths) {
+  absl::ReaderMutexLock lock(&lock_);
+  std::vector<std::optional<std::shared_ptr<WatchItemPolicy>>> policies;
+
+  for (const auto &path : paths) {
+    policies.push_back(watch_items_->LookupLongestMatchingPrefix(path.data()));
+  }
+
+  return {policy_version_, policies};
+}
+
+void WatchItems::SetConfigPath(NSString *config_path) {
+  // Acquire the lock to set the config path and read the config, but drop
+  // the lock before reloading the config
+  NSDictionary *config;
+  {
+    absl::MutexLock lock(&lock_);
+    config_path_ = config_path;
+    config = ReadConfigLocked();
+  }
+  ReloadConfig(config);
+}
+
+std::optional<WatchItemsState> WatchItems::State() {
+  absl::ReaderMutexLock lock(&lock_);
+
+  if (!current_config_) {
+    return std::nullopt;
+  }
+
+  WatchItemsState state = {
+    .rule_count = [current_config_[kWatchItemConfigKeyWatchItems] count],
+    .policy_version = [NSString stringWithUTF8String:policy_version_.c_str()],
+    .config_path = [config_path_ copy],
+    .last_config_load_epoch = last_update_time_,
+  };
+
+  return state;
+}
+
+}  // namespace santa::santad::data_layer

Source/santad/DataLayer/WatchItemsTest.mm

@@ -0,0 +1,807 @@
+/// Copyright 2022 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include <CommonCrypto/CommonDigest.h>
+#import <Foundation/Foundation.h>
+#include <Kernel/kern/cs_blobs.h>
+#import <XCTest/XCTest.h>
+#include <dispatch/dispatch.h>
+#include <sys/syslimits.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <iostream>
+#include <map>
+#include <memory>
+#include <variant>
+#include <vector>
+
+#include "Source/common/TestUtils.h"
+#import "Source/common/Unit.h"
+#include "Source/santad/DataLayer/WatchItemPolicy.h"
+#include "Source/santad/DataLayer/WatchItems.h"
+
+using santa::common::Unit;
+using santa::santad::data_layer::kWatchItemPolicyDefaultAllowReadAccess;
+using santa::santad::data_layer::kWatchItemPolicyDefaultAuditOnly;
+using santa::santad::data_layer::kWatchItemPolicyDefaultPathType;
+using santa::santad::data_layer::WatchItemPathType;
+using santa::santad::data_layer::WatchItemPolicy;
+using santa::santad::data_layer::WatchItems;
+using santa::santad::data_layer::WatchItemsState;
+
+namespace santatest {
+using PathAndTypePair = std::pair<std::string, WatchItemPathType>;
+using PathList = std::vector<PathAndTypePair>;
+using ProcessList = std::vector<WatchItemPolicy::Process>;
+}  // namespace santatest
+
+namespace santa::santad::data_layer {
+
+extern bool ParseConfig(NSDictionary *config,
+                        std::vector<std::shared_ptr<WatchItemPolicy>> &policies, NSError **err);
+extern bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
+                                       std::vector<std::shared_ptr<WatchItemPolicy>> &policies,
+                                       NSError **err);
+extern std::variant<Unit, santatest::PathList> VerifyConfigWatchItemPaths(NSArray<id> *paths,
+                                                                          NSError **err);
+extern std::variant<Unit, santatest::ProcessList> VerifyConfigWatchItemProcesses(
+  NSDictionary *watch_item, NSError **err);
+class WatchItemsPeer : public WatchItems {
+ public:
+  using WatchItems::ReloadConfig;
+  using WatchItems::WatchItems;
+};
+
+}  // namespace santa::santad::data_layer
+
+using santa::santad::data_layer::ParseConfig;
+using santa::santad::data_layer::ParseConfigSingleWatchItem;
+using santa::santad::data_layer::VerifyConfigWatchItemPaths;
+using santa::santad::data_layer::VerifyConfigWatchItemProcesses;
+using santa::santad::data_layer::WatchItemsPeer;
+
+static constexpr std::string_view kBadPolicyName("__BAD_NAME__");
+static constexpr std::string_view kBadPolicyPath("__BAD_PATH__");
+static constexpr std::string_view kVersion("v0.1");
+
+static std::shared_ptr<WatchItemPolicy> MakeBadPolicy() {
+  return std::make_shared<WatchItemPolicy>(kBadPolicyName, kBadPolicyPath);
+}
+
+static NSMutableDictionary *WrapWatchItemsConfig(NSDictionary *config) {
+  return [@{@"Version" : @(kVersion.data()), @"WatchItems" : [config mutableCopy]} mutableCopy];
+}
+
+static NSString *RepeatedString(NSString *str, NSUInteger len) {
+  return [@"" stringByPaddingToLength:len withString:str startingAtIndex:0];
+}
+
+@interface WatchItemsTest : XCTestCase
+@property NSFileManager *fileMgr;
+@property NSString *testDir;
+@property NSMutableArray *dirStack;
+@property dispatch_queue_t q;
+@end
+
+@implementation WatchItemsTest
+
+- (void)setUp {
+  self.dirStack = [[NSMutableArray alloc] init];
+  self.fileMgr = [NSFileManager defaultManager];
+  self.testDir =
+    [NSString stringWithFormat:@"%@santa-watchitems-%d", NSTemporaryDirectory(), getpid()];
+
+  XCTAssertTrue([self.fileMgr createDirectoryAtPath:self.testDir
+                        withIntermediateDirectories:YES
+                                         attributes:nil
+                                              error:nil]);
+
+  self.q = dispatch_queue_create(NULL, DISPATCH_QUEUE_SERIAL);
+  XCTAssertNotNil(self.q);
+}
+
+- (void)tearDown {
+  XCTAssertTrue([self.fileMgr removeItemAtPath:self.testDir error:nil]);
+}
+
+- (void)pushd:(NSString *)path withRoot:(NSString *)root {
+  NSString *dir = [NSString pathWithComponents:@[ root, path ]];
+  NSString *origCwd = [self.fileMgr currentDirectoryPath];
+  XCTAssertNotNil(origCwd);
+
+  XCTAssertTrue([self.fileMgr changeCurrentDirectoryPath:dir]);
+  [self.dirStack addObject:origCwd];
+}
+
+- (void)pushd:(NSString *)dir {
+  [self pushd:dir withRoot:self.testDir];
+}
+
+- (void)popd {
+  NSString *dir = [self.dirStack lastObject];
+  XCTAssertTrue([self.fileMgr changeCurrentDirectoryPath:dir]);
+  [self.dirStack removeLastObject];
+}
+
+- (void)createTestDirStructure:(NSArray *)fs rootedAt:(NSString *)root {
+  NSString *origCwd = [self.fileMgr currentDirectoryPath];
+  XCTAssertNotNil(origCwd);
+  XCTAssertTrue([self.fileMgr changeCurrentDirectoryPath:root]);
+
+  for (id item in fs) {
+    if ([item isKindOfClass:[NSString class]]) {
+      XCTAssertTrue([self.fileMgr createFileAtPath:item contents:nil attributes:nil]);
+    } else if ([item isKindOfClass:[NSDictionary class]]) {
+      for (id dir in item) {
+        XCTAssertTrue([item[dir] isKindOfClass:[NSArray class]]);
+        XCTAssertTrue([self.fileMgr createDirectoryAtPath:dir
+                              withIntermediateDirectories:NO
+                                               attributes:nil
+                                                    error:nil]);
+
+        [self createTestDirStructure:item[dir] rootedAt:dir];
+      }
+    } else {
+      XCTFail("Unexpected dir structure item: %@: %@", item, [item class]);
+    }
+  }
+
+  XCTAssertTrue([self.fileMgr changeCurrentDirectoryPath:origCwd]);
+}
+
+- (void)createTestDirStructure:(NSArray *)fs {
+  [self createTestDirStructure:fs rootedAt:self.testDir];
+}
+
+- (void)testReloadScenarios {
+  [self createTestDirStructure:@[
+    @{
+      @"a" : @[ @"f1", @"f2" ],
+    },
+    @{
+      @"b" : @[ @"f1" ],
+    },
+  ]];
+
+  NSDictionary *allFilesPolicy = @{kWatchItemConfigKeyPaths : @[ @"*" ]};
+  NSDictionary *configAllFilesOriginal =
+    WrapWatchItemsConfig(@{@"all_files_orig" : allFilesPolicy});
+  NSDictionary *configAllFilesRename =
+    WrapWatchItemsConfig(@{@"all_files_rename" : allFilesPolicy});
+
+  WatchItems::VersionAndPolicies policies;
+
+  std::vector<std::string_view> f1Path = {"f1"};
+  std::vector<std::string_view> f2Path = {"f2"};
+
+  // Changes in config dictionary will update policy info even if the
+  // filesystem didn't change.
+  {
+    WatchItemsPeer watchItems(nil, NULL, NULL);
+    [self pushd:@"a"];
+    watchItems.ReloadConfig(configAllFilesOriginal);
+
+    policies = watchItems.FindPolciesForPaths(f1Path);
+    XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                          "all_files_orig");
+
+    watchItems.ReloadConfig(configAllFilesRename);
+    policies = watchItems.FindPolciesForPaths(f1Path);
+    XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                          "all_files_rename");
+
+    policies = watchItems.FindPolciesForPaths(f1Path);
+    XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                          "all_files_rename");
+    [self popd];
+  }
+
+  // Changes to fileystem structure are reflected when a config is reloaded
+  {
+    WatchItemsPeer watchItems(nil, NULL, NULL);
+    [self pushd:@"a"];
+    watchItems.ReloadConfig(configAllFilesOriginal);
+    [self popd];
+
+    policies = watchItems.FindPolciesForPaths(f2Path);
+    XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                          "all_files_orig");
+
+    [self pushd:@"b"];
+    watchItems.ReloadConfig(configAllFilesOriginal);
+    [self popd];
+
+    policies = watchItems.FindPolciesForPaths(f2Path);
+    XCTAssertFalse(policies.second[0].has_value());
+  }
+}
+
+- (void)testPeriodicTask {
+  // Ensure watch item policy memory is properly handled
+  [self createTestDirStructure:@[ @"f1", @"f2", @"weird1" ]];
+
+  NSDictionary *fFiles = @{
+    kWatchItemConfigKeyPaths : @[ @{
+      kWatchItemConfigKeyPathsPath : @"f?",
+      kWatchItemConfigKeyPathsIsPrefix : @(NO),
+    } ]
+  };
+  NSDictionary *weirdFiles = @{
+    kWatchItemConfigKeyPaths : @[ @{
+      kWatchItemConfigKeyPathsPath : @"weird?",
+      kWatchItemConfigKeyPathsIsPrefix : @(NO),
+    } ]
+  };
+
+  NSString *configFile = @"config.plist";
+  NSDictionary *firstConfig = WrapWatchItemsConfig(@{@"f_files" : fFiles});
+  NSDictionary *secondConfig =
+    WrapWatchItemsConfig(@{@"f_files" : fFiles, @"weird_files" : weirdFiles});
+
+  dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, self.q);
+
+  const uint64 periodicFlushMS = 1000;
+  dispatch_source_set_timer(timer, dispatch_time(DISPATCH_TIME_NOW, 0),
+                            NSEC_PER_MSEC * periodicFlushMS, 0);
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  auto watchItems = std::make_shared<WatchItemsPeer>(configFile, self.q, timer, ^{
+    dispatch_semaphore_signal(sema);
+  });
+
+  // Move into the base test directory and write the config to disk
+  [self pushd:@""];
+  XCTAssertTrue([firstConfig writeToFile:configFile atomically:YES]);
+
+  std::vector<std::string_view> f1Path = {"f1"};
+  std::vector<std::string_view> weird1Path = {"weird1"};
+
+  // Ensure no policy has been loaded yet
+  XCTAssertFalse(watchItems->FindPolciesForPaths(f1Path).second[0].has_value());
+  XCTAssertFalse(watchItems->FindPolciesForPaths(weird1Path).second[0].has_value());
+
+  // Begin the periodic task
+  watchItems->BeginPeriodicTask();
+
+  // The first run of the task starts immediately
+  // Wait for the first iteration and check for the expected policy
+  XCTAssertSemaTrue(sema, 5, "Periodic task did not complete within expected window");
+  XCTAssertTrue(watchItems->FindPolciesForPaths(f1Path).second[0].has_value());
+  XCTAssertFalse(watchItems->FindPolciesForPaths(weird1Path).second[0].has_value());
+
+  // Write the config update
+  XCTAssertTrue([secondConfig writeToFile:configFile atomically:YES]);
+
+  // Wait for the new config to be loaded and check for the new expected policies
+  XCTAssertSemaTrue(sema, 5, "Periodic task did not complete within expected window");
+  XCTAssertTrue(watchItems->FindPolciesForPaths(f1Path).second[0].has_value());
+  XCTAssertTrue(watchItems->FindPolciesForPaths(weird1Path).second[0].has_value());
+
+  [self popd];
+}
+
+- (void)testPolicyLookup {
+  // Test multiple, more comprehensive policies before/after config reload
+  [self createTestDirStructure:@[
+    @{
+      @"foo" : @[ @"bar.txt", @"bar.txt.tmp" ],
+      @"baz" : @[ @{@"qaz" : @[]} ],
+    },
+    @"f1",
+  ]];
+
+  NSMutableDictionary *config = WrapWatchItemsConfig(@{
+    @"foo_subdir" : @{
+      kWatchItemConfigKeyPaths : @[ @{
+        kWatchItemConfigKeyPathsPath : @"./foo",
+        kWatchItemConfigKeyPathsIsPrefix : @(YES),
+      } ]
+    }
+  });
+
+  WatchItemsPeer watchItems(nil, NULL, NULL);
+  WatchItems::VersionAndPolicies policies;
+
+  // Resultant vector is same size as input vector
+  // Initially nothing should be in the map
+  std::vector<std::string_view> paths = {};
+  XCTAssertEqual(watchItems.FindPolciesForPaths(paths).second.size(), 0);
+  paths.push_back("./foo");
+  XCTAssertEqual(watchItems.FindPolciesForPaths(paths).second.size(), 1);
+  XCTAssertFalse(watchItems.FindPolciesForPaths(paths).second[0].has_value());
+  paths.push_back("./baz");
+  XCTAssertEqual(watchItems.FindPolciesForPaths(paths).second.size(), 2);
+
+  // Load the initial config
+  [self pushd:@""];
+  watchItems.ReloadConfig(config);
+  [self popd];
+
+  {
+    // Test expected values with the inital policy
+    const std::map<std::vector<std::string_view>, std::string_view> pathToPolicyName = {
+      {{"./foo"}, "foo_subdir"},
+      {{"./foo/bar.txt.tmp"}, "foo_subdir"},
+      {{"./foo/bar.txt"}, "foo_subdir"},
+      {{"./does/not/exist"}, kBadPolicyName},
+    };
+
+    for (const auto &kv : pathToPolicyName) {
+      policies = watchItems.FindPolciesForPaths(kv.first);
+      XCTAssertCStringEqual(policies.first.data(), kVersion.data());
+      XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                            kv.second.data());
+    }
+
+    // Test multiple lookup
+    policies = watchItems.FindPolciesForPaths({"./foo", "./does/not/exist"});
+    XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(), "foo_subdir");
+    XCTAssertFalse(policies.second[1].has_value());
+  }
+
+  // Add a new policy and reload the config
+  NSDictionary *barTxtFilePolicy = @{
+    kWatchItemConfigKeyPaths : @[ @{
+      kWatchItemConfigKeyPathsPath : @"./foo/bar.txt",
+      kWatchItemConfigKeyPathsIsPrefix : @(NO),
+    } ]
+  };
+  [config[@"WatchItems"] setObject:barTxtFilePolicy forKey:@"bar_txt"];
+
+  // Load the updated config
+  [self pushd:@""];
+  watchItems.ReloadConfig(config);
+  [self popd];
+
+  {
+    // Test expected values with the updated policy
+    const std::map<std::vector<std::string_view>, std::string_view> pathToPolicyName = {
+      {{"./foo"}, "foo_subdir"},
+      {{"./foo/bar.txt.tmp"}, "foo_subdir"},
+      {{"./foo/bar.txt"}, "bar_txt"},
+      {{"./does/not/exist"}, kBadPolicyName},
+    };
+
+    for (const auto &kv : pathToPolicyName) {
+      policies = watchItems.FindPolciesForPaths(kv.first);
+      XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                            kv.second.data());
+    }
+  }
+
+  // Add a catch-all policy that should only affect the previously non-matching path
+  NSDictionary *catchAllFilePolicy = @{
+    kWatchItemConfigKeyPaths : @[ @{
+      kWatchItemConfigKeyPathsPath : @".",
+      kWatchItemConfigKeyPathsIsPrefix : @(YES),
+    } ]
+  };
+  [config[@"WatchItems"] setObject:catchAllFilePolicy forKey:@"dot_everything"];
+
+  // Load the updated config
+  [self pushd:@""];
+  watchItems.ReloadConfig(config);
+  [self popd];
+
+  {
+    // Test expected values with the catch-all policy
+    const std::map<std::vector<std::string_view>, std::string_view> pathToPolicyName = {
+      {{"./foo"}, "foo_subdir"},
+      {{"./foo/bar.txt.tmp"}, "foo_subdir"},
+      {{"./foo/bar.txt"}, "bar_txt"},
+      {{"./does/not/exist"}, "dot_everything"},
+    };
+
+    for (const auto &kv : pathToPolicyName) {
+      policies = watchItems.FindPolciesForPaths(kv.first);
+      XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                            kv.second.data());
+    }
+  }
+
+  // Now remove the foo_subdir rule, previous matches should fallback to the catch-all
+  [config[@"WatchItems"] removeObjectForKey:@"foo_subdir"];
+  [self pushd:@""];
+  watchItems.ReloadConfig(config);
+  [self popd];
+
+  {
+    // Test expected values with the foo_subdir policy removed
+    const std::map<std::vector<std::string_view>, std::string_view> pathToPolicyName = {
+      {{"./foo"}, "dot_everything"},
+      {{"./foo/bar.txt.tmp"}, "dot_everything"},
+      {{"./foo/bar.txt"}, "bar_txt"},
+      {{"./does/not/exist"}, "dot_everything"},
+    };
+
+    for (const auto &kv : pathToPolicyName) {
+      policies = watchItems.FindPolciesForPaths(kv.first);
+      XCTAssertCStringEqual(policies.second[0].value_or(MakeBadPolicy())->name.c_str(),
+                            kv.second.data());
+    }
+  }
+}
+
+- (void)testVerifyConfigWatchItemPaths {
+  std::variant<Unit, santatest::PathList> path_list;
+  NSError *err;
+
+  // Test no paths specified
+  path_list = VerifyConfigWatchItemPaths(@[], &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(path_list));
+
+  // Test invalid types in paths array
+  path_list = VerifyConfigWatchItemPaths(@[ @(0) ], &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(path_list));
+
+  // Test path array with long string
+  path_list = VerifyConfigWatchItemPaths(@[ RepeatedString(@"A", PATH_MAX + 1) ], &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(path_list));
+
+  // Test path array dictionary with missing required key
+  path_list = VerifyConfigWatchItemPaths(@[ @{@"FakePath" : @"A"} ], &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(path_list));
+
+  // Test path array dictionary with long string
+  path_list = VerifyConfigWatchItemPaths(
+    @[ @{kWatchItemConfigKeyPathsPath : RepeatedString(@"A", PATH_MAX + 1)} ], &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(path_list));
+
+  // Test path array dictionary with default path type
+  path_list = VerifyConfigWatchItemPaths(@[ @{kWatchItemConfigKeyPathsPath : @"A"} ], &err);
+  XCTAssertTrue(std::holds_alternative<santatest::PathList>(path_list));
+  XCTAssertEqual(std::get<santatest::PathList>(path_list).size(), 1);
+  XCTAssertCStringEqual(std::get<santatest::PathList>(path_list)[0].first.c_str(), "A");
+  XCTAssertEqual(std::get<santatest::PathList>(path_list)[0].second,
+                 kWatchItemPolicyDefaultPathType);
+
+  // Test path array dictionary with custom path type
+  path_list = VerifyConfigWatchItemPaths(
+    @[ @{kWatchItemConfigKeyPathsPath : @"A", kWatchItemConfigKeyPathsIsPrefix : @(YES)} ], &err);
+  XCTAssertTrue(std::holds_alternative<santatest::PathList>(path_list));
+  XCTAssertEqual(std::get<santatest::PathList>(path_list).size(), 1);
+  XCTAssertCStringEqual(std::get<santatest::PathList>(path_list)[0].first.c_str(), "A");
+  XCTAssertEqual(std::get<santatest::PathList>(path_list)[0].second, WatchItemPathType::kPrefix);
+}
+
+- (void)testVerifyConfigWatchItemProcesses {
+  std::variant<Unit, santatest::ProcessList> proc_list;
+  NSError *err;
+
+  // Non-existent process list parses successfully, but has no items
+  proc_list = VerifyConfigWatchItemProcesses(@{}, &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 0);
+
+  // Process list fails to parse if contains non-array type
+  proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @""}, &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+  proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @(0)}, &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+  proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @{}}, &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+  proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @[]}, &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+
+  // Test a process dictionary with no valid attributes set
+  proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @[ @{} ]}, &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test BinaryPath length limits
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesBinaryPath : RepeatedString(@"A", PATH_MAX + 1)} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test valid BinaryPath
+  proc_list = VerifyConfigWatchItemProcesses(
+    @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesBinaryPath : @"mypath"} ]},
+    &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("mypath", "", "", {}, ""));
+
+  // Test SigningID length limits
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesSigningID : RepeatedString(@"A", 513)} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test valid SigningID
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesSigningID : @"com.google.test"} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("", "com.google.test", "", {}, ""));
+
+  // Test TeamID length limits
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesTeamID : @"LongerThanExpectedTeamID"} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test valid TeamID
+  proc_list = VerifyConfigWatchItemProcesses(
+    @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesTeamID : @"myvalidtid"} ]},
+    &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("", "", "myvalidtid", {}, ""));
+
+  // Test CDHash length limits
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesCDHash : RepeatedString(@"A", CS_CDHASH_LEN * 2 + 1)} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test CDHash hex-only
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses :
+      @[ @{kWatchItemConfigKeyProcessesCDHash : RepeatedString(@"Z", CS_CDHASH_LEN * 2)} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test valid CDHash
+  NSString *cdhash = RepeatedString(@"A", CS_CDHASH_LEN * 2);
+  std::vector<uint8_t> cdhashBytes(cdhash.length / 2);
+  std::fill(cdhashBytes.begin(), cdhashBytes.end(), 0xAA);
+  proc_list = VerifyConfigWatchItemProcesses(
+    @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesCDHash : cdhash} ]}, &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("", "", "", cdhashBytes, ""));
+
+  // Test Cert Hash length limits
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses : @[ @{
+      kWatchItemConfigKeyProcessesCertificateSha256 :
+        RepeatedString(@"A", CC_SHA256_DIGEST_LENGTH * 2 + 1)
+    } ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test Cert Hash hex-only
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses : @[ @{
+      kWatchItemConfigKeyProcessesCertificateSha256 :
+        RepeatedString(@"Z", CC_SHA256_DIGEST_LENGTH * 2)
+    } ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
+
+  // Test valid Cert Hash
+  NSString *certHash = RepeatedString(@"A", CC_SHA256_DIGEST_LENGTH * 2);
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesCertificateSha256 : certHash} ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("", "", "", {}, [certHash UTF8String]));
+
+  // Test valid multiple attributes, multiple procs
+  proc_list = VerifyConfigWatchItemProcesses(@{
+    kWatchItemConfigKeyProcesses : @[
+      @{
+        kWatchItemConfigKeyProcessesBinaryPath : @"mypath1",
+        kWatchItemConfigKeyProcessesSigningID : @"com.google.test1",
+        kWatchItemConfigKeyProcessesTeamID : @"validtid_1",
+        kWatchItemConfigKeyProcessesCDHash : cdhash,
+        kWatchItemConfigKeyProcessesCertificateSha256 : certHash,
+      },
+      @{
+        kWatchItemConfigKeyProcessesBinaryPath : @"mypath2",
+        kWatchItemConfigKeyProcessesSigningID : @"com.google.test2",
+        kWatchItemConfigKeyProcessesTeamID : @"validtid_2",
+        kWatchItemConfigKeyProcessesCDHash : cdhash,
+        kWatchItemConfigKeyProcessesCertificateSha256 : certHash,
+      },
+    ]
+  },
+                                             &err);
+  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 2);
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+                 WatchItemPolicy::Process("mypath1", "com.google.test1", "validtid_1", cdhashBytes,
+                                          [certHash UTF8String]));
+  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[1],
+                 WatchItemPolicy::Process("mypath2", "com.google.test2", "validtid_2", cdhashBytes,
+                                          [certHash UTF8String]));
+}
+
+- (void)testParseConfig {
+  NSError *err;
+  std::vector<std::shared_ptr<WatchItemPolicy>> policies;
+
+  // Ensure top level keys must exist and be correct types
+  XCTAssertFalse(ParseConfig(@{}, policies, &err));
+  XCTAssertFalse(ParseConfig(@{kWatchItemConfigKeyVersion : @(0)}, policies, &err));
+  XCTAssertFalse(ParseConfig(@{kWatchItemConfigKeyVersion : @{}}, policies, &err));
+  XCTAssertFalse(ParseConfig(@{kWatchItemConfigKeyVersion : @[]}, policies, &err));
+  XCTAssertFalse(ParseConfig(@{kWatchItemConfigKeyVersion : @""}, policies, &err));
+  XCTAssertFalse(ParseConfig(
+    @{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @""}, policies, &err));
+  XCTAssertFalse(ParseConfig(
+    @{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @[]}, policies, &err));
+  XCTAssertFalse(ParseConfig(
+    @{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @(0)}, policies, &err));
+
+  // Minimally successful configs without watch items
+  XCTAssertTrue(ParseConfig(@{kWatchItemConfigKeyVersion : @"1"}, policies, &err));
+  XCTAssertTrue(ParseConfig(
+    @{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @{}}, policies, &err));
+
+  // Ensure constraints on watch items entries match expectations
+  XCTAssertFalse(ParseConfig(
+    @{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @{@(0) : @(0)}}, policies,
+    &err));
+  XCTAssertFalse(
+    ParseConfig(@{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @{@"" : @{}}},
+                policies, &err));
+  XCTAssertFalse(
+    ParseConfig(@{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @{@"1" : @[]}},
+                policies, &err));
+  XCTAssertFalse(
+    ParseConfig(@{kWatchItemConfigKeyVersion : @"1", kWatchItemConfigKeyWatchItems : @{@"1" : @{}}},
+                policies, &err));
+
+  // Minimally successful config with watch item
+  XCTAssertTrue(ParseConfig(@{
+    kWatchItemConfigKeyVersion : @"1",
+    kWatchItemConfigKeyWatchItems : @{@"1" : @{kWatchItemConfigKeyPaths : @[ @"asdf" ]}}
+  },
+                            policies, &err));
+}
+
+- (void)testParseConfigSingleWatchItem {
+  std::vector<std::shared_ptr<WatchItemPolicy>> policies;
+  NSError *err;
+
+  // There must be valid Paths in a watch item
+  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{}, policies, &err));
+  XCTAssertFalse(
+    ParseConfigSingleWatchItem(@"", @{kWatchItemConfigKeyPaths : @[ @"" ]}, policies, &err));
+  XCTAssertTrue(
+    ParseConfigSingleWatchItem(@"", @{kWatchItemConfigKeyPaths : @[ @"a" ]}, policies, &err));
+
+  // Empty options are fine
+  XCTAssertTrue(ParseConfigSingleWatchItem(
+    @"", @{kWatchItemConfigKeyPaths : @[ @"a" ], kWatchItemConfigKeyOptions : @{}}, policies,
+    &err));
+
+  // If an Options key exist, it must be a dictionary type
+  XCTAssertFalse(ParseConfigSingleWatchItem(
+    @"", @{kWatchItemConfigKeyPaths : @[ @"a" ], kWatchItemConfigKeyOptions : @[]}, policies,
+    &err));
+  XCTAssertFalse(ParseConfigSingleWatchItem(
+    @"", @{kWatchItemConfigKeyPaths : @[ @"a" ], kWatchItemConfigKeyOptions : @""}, policies,
+    &err));
+  XCTAssertFalse(ParseConfigSingleWatchItem(
+    @"", @{kWatchItemConfigKeyPaths : @[ @"a" ], kWatchItemConfigKeyOptions : @(0)}, policies,
+    &err));
+
+  // Options keys must be valid types
+  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAllowReadAccess : @""}
+  },
+                                            policies, &err));
+  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAllowReadAccess : @(0)}
+  },
+                                           policies, &err));
+  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAuditOnly : @""}
+  },
+                                            policies, &err));
+  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAuditOnly : @(0)}
+  },
+                                           policies, &err));
+
+  // If processes are specified, they must be valid format
+  // Note: Full tests in `testVerifyConfigWatchItemProcesses`
+  XCTAssertFalse(ParseConfigSingleWatchItem(
+    @"", @{kWatchItemConfigKeyPaths : @[ @"a" ], kWatchItemConfigKeyProcesses : @""}, policies,
+    &err));
+
+  // Test the policy vector is populated as expected
+
+  // Test default options with no processes
+  policies.clear();
+  XCTAssertTrue(
+    ParseConfigSingleWatchItem(@"rule", @{kWatchItemConfigKeyPaths : @[ @"a" ]}, policies, &err));
+  XCTAssertEqual(policies.size(), 1);
+  XCTAssertEqual(*policies[0].get(), WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
+                                                     kWatchItemPolicyDefaultAllowReadAccess,
+                                                     kWatchItemPolicyDefaultAuditOnly, {}));
+
+  // Test multiple paths, options, and processes
+  policies.clear();
+  std::vector<WatchItemPolicy::Process> procs = {
+    WatchItemPolicy::Process("pa", "", "", {}, ""),
+    WatchItemPolicy::Process("pb", "", "", {}, ""),
+  };
+
+  XCTAssertTrue(ParseConfigSingleWatchItem(@"rule", @{
+    kWatchItemConfigKeyPaths :
+      @[ @"a", @{kWatchItemConfigKeyPathsPath : @"b", kWatchItemConfigKeyPathsIsPrefix : @(YES)} ],
+    kWatchItemConfigKeyOptions : @{
+      kWatchItemConfigKeyOptionsAllowReadAccess : @(YES),
+      kWatchItemConfigKeyOptionsAuditOnly : @(NO)
+    },
+    kWatchItemConfigKeyProcesses : @[
+      @{kWatchItemConfigKeyProcessesBinaryPath : @"pa"},
+      @{kWatchItemConfigKeyProcessesBinaryPath : @"pb"}
+    ]
+  },
+                                           policies, &err));
+  XCTAssertEqual(policies.size(), 2);
+  XCTAssertEqual(*policies[0].get(),
+                 WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType, true, false, procs));
+  XCTAssertEqual(*policies[1].get(),
+                 WatchItemPolicy("rule", "b", WatchItemPathType::kPrefix, true, false, procs));
+}
+
+- (void)testState {
+  NSString *configPath = @"my_config_path";
+  NSTimeInterval startTime = [[NSDate date] timeIntervalSince1970];
+
+  NSMutableDictionary *config = WrapWatchItemsConfig(@{
+    @"rule1" : @{kWatchItemConfigKeyPaths : @[ @"abc" ]},
+    @"rule2" : @{kWatchItemConfigKeyPaths : @[ @"xyz" ]}
+  });
+
+  WatchItemsPeer watchItems(configPath, NULL, NULL);
+
+  // If no policy yet exists, nullopt is returned
+  std::optional<WatchItemsState> optionalState = watchItems.State();
+  XCTAssertFalse(optionalState.has_value());
+
+  watchItems.ReloadConfig(config);
+
+  optionalState = watchItems.State();
+  XCTAssertTrue(optionalState.has_value());
+  WatchItemsState state = optionalState.value();
+
+  XCTAssertEqual(state.rule_count, [config[kWatchItemConfigKeyWatchItems] count]);
+  XCTAssertCStringEqual(state.policy_version.UTF8String, kVersion.data());
+  XCTAssertEqual(state.config_path, configPath);
+  XCTAssertGreaterThanOrEqual(state.last_config_load_epoch, startTime);
+}
+
+@end

Source/santad/EventProviders/AuthResultCache.h

@@ -0,0 +1,76 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_AUTHRESULTCACHE_H
+#define SANTA__SANTAD__EVENTPROVIDERS_AUTHRESULTCACHE_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#import <Foundation/Foundation.h>
+#include <dispatch/dispatch.h>
+#include <sys/stat.h>
+#include <memory>
+
+#import "Source/common/SNTCommonEnums.h"
+#include "Source/common/SantaCache.h"
+#import "Source/common/SantaVnode.h"
+#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
+
+namespace santa::santad::event_providers {
+
+enum class FlushCacheMode {
+  kNonRootOnly,
+  kAllCaches,
+};
+
+class AuthResultCache {
+ public:
+  // Santa currently only flushes caches when new DENY rules are added, not
+  // ALLOW rules. This means this value should be low enough so that if a
+  // previously denied binary is allowed, it can be re-executed by the user in a
+  // timely manner. But the value should be high enough to allow the cache to be
+  // effective in the event the binary is executed in rapid succession.
+  AuthResultCache(
+    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
+    uint64_t cache_deny_time_ms = 1500);
+  virtual ~AuthResultCache();
+
+  AuthResultCache(AuthResultCache &&other) = delete;
+  AuthResultCache &operator=(AuthResultCache &&rhs) = delete;
+  AuthResultCache(const AuthResultCache &other) = delete;
+  AuthResultCache &operator=(const AuthResultCache &other) = delete;
+
+  virtual bool AddToCache(const es_file_t *es_file, SNTAction decision);
+  virtual void RemoveFromCache(const es_file_t *es_file);
+  virtual SNTAction CheckCache(const es_file_t *es_file);
+  virtual SNTAction CheckCache(SantaVnode vnode_id);
+
+  virtual void FlushCache(FlushCacheMode mode);
+
+  virtual NSArray<NSNumber *> *CacheCounts();
+
+ private:
+  virtual SantaCache<SantaVnode, uint64_t> *CacheForVnodeID(SantaVnode vnode_id);
+
+  SantaCache<SantaVnode, uint64_t> *root_cache_;
+  SantaCache<SantaVnode, uint64_t> *nonroot_cache_;
+
+  std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi_;
+  uint64_t root_devno_;
+  uint64_t cache_deny_time_ns_;
+  dispatch_queue_t q_;
+};
+
+}  // namespace santa::santad::event_providers
+
+#endif

Source/santad/EventProviders/AuthResultCache.mm

@@ -0,0 +1,143 @@
+
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/santad/EventProviders/AuthResultCache.h"
+
+#include <mach/clock_types.h>
+#include <time.h>
+
+#import "Source/common/SNTLogging.h"
+#import "Source/common/SantaVnodeHash.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
+
+using santa::santad::event_providers::endpoint_security::Client;
+using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
+
+namespace santa::santad::event_providers {
+
+static inline uint64_t GetCurrentUptime() {
+  return clock_gettime_nsec_np(CLOCK_MONOTONIC);
+}
+
+// Decision is stored in upper 8 bits, timestamp in remaining 56.
+static inline uint64_t CacheableAction(SNTAction action, uint64_t timestamp = GetCurrentUptime()) {
+  return ((uint64_t)action << 56) | (timestamp & 0xFFFFFFFFFFFFFF);
+}
+
+static inline SNTAction ActionFromCachedValue(uint64_t cachedValue) {
+  return (SNTAction)(cachedValue >> 56);
+}
+
+static inline uint64_t TimestampFromCachedValue(uint64_t cachedValue) {
+  return (cachedValue & ~(0xFF00000000000000));
+}
+
+AuthResultCache::AuthResultCache(std::shared_ptr<EndpointSecurityAPI> esapi,
+                                 uint64_t cache_deny_time_ms)
+    : esapi_(esapi), cache_deny_time_ns_(cache_deny_time_ms * NSEC_PER_MSEC) {
+  root_cache_ = new SantaCache<SantaVnode, uint64_t>();
+  nonroot_cache_ = new SantaCache<SantaVnode, uint64_t>();
+
+  struct stat sb;
+  if (stat("/", &sb) == 0) {
+    root_devno_ = sb.st_dev;
+  }
+
+  q_ = dispatch_queue_create(
+    "com.google.santa.daemon.auth_result_cache.q",
+    dispatch_queue_attr_make_with_qos_class(DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL,
+                                            QOS_CLASS_USER_INTERACTIVE, 0));
+}
+
+AuthResultCache::~AuthResultCache() {
+  delete root_cache_;
+  delete nonroot_cache_;
+}
+
+bool AuthResultCache::AddToCache(const es_file_t *es_file, SNTAction decision) {
+  SantaVnode vnode_id = SantaVnode::VnodeForFile(es_file);
+  SantaCache<SantaVnode, uint64_t> *cache = CacheForVnodeID(vnode_id);
+  switch (decision) {
+    case SNTActionRequestBinary:
+      return cache->set(vnode_id, CacheableAction(SNTActionRequestBinary, 0), 0);
+    case SNTActionRespondAllow: OS_FALLTHROUGH;
+    case SNTActionRespondAllowCompiler: OS_FALLTHROUGH;
+    case SNTActionRespondDeny:
+      return cache->set(vnode_id, CacheableAction(decision),
+                        CacheableAction(SNTActionRequestBinary, 0));
+    default:
+      // This is a programming error. Bail.
+      LOGE(@"Invalid cache value, exiting.");
+      exit(EXIT_FAILURE);
+  }
+}
+
+void AuthResultCache::RemoveFromCache(const es_file_t *es_file) {
+  SantaVnode vnode_id = SantaVnode::VnodeForFile(es_file);
+  CacheForVnodeID(vnode_id)->remove(vnode_id);
+}
+
+SNTAction AuthResultCache::CheckCache(const es_file_t *es_file) {
+  return CheckCache(SantaVnode::VnodeForFile(es_file));
+}
+
+SNTAction AuthResultCache::CheckCache(SantaVnode vnode_id) {
+  SantaCache<SantaVnode, uint64_t> *cache = CacheForVnodeID(vnode_id);
+
+  uint64_t cached_val = cache->get(vnode_id);
+  if (cached_val == 0) {
+    return SNTActionUnset;
+  }
+
+  SNTAction result = ActionFromCachedValue(cached_val);
+
+  if (result == SNTActionRespondDeny) {
+    uint64_t expiry_time = TimestampFromCachedValue(cached_val) + cache_deny_time_ns_;
+    if (expiry_time < GetCurrentUptime()) {
+      cache->remove(vnode_id);
+      return SNTActionUnset;
+    }
+  }
+
+  return result;
+}
+
+SantaCache<SantaVnode, uint64_t> *AuthResultCache::CacheForVnodeID(SantaVnode vnode_id) {
+  return (vnode_id.fsid == root_devno_ || root_devno_ == 0) ? root_cache_ : nonroot_cache_;
+}
+
+void AuthResultCache::FlushCache(FlushCacheMode mode) {
+  nonroot_cache_->clear();
+  if (mode == FlushCacheMode::kAllCaches) {
+    root_cache_->clear();
+
+    // Clear the ES cache when all local caches are flushed. Assume the ES cache
+    // doesn't need to be cleared when only flushing the non-root cache.
+    //
+    // Calling into ES should be done asynchronously since it could otherwise
+    // potentially deadlock.
+    auto shared_esapi = esapi_->shared_from_this();
+    dispatch_async(q_, ^{
+      // ES does not need a connected client to clear cache
+      shared_esapi->ClearCache(Client());
+    });
+  }
+}
+
+NSArray<NSNumber *> *AuthResultCache::CacheCounts() {
+  return @[ @(root_cache_->count()), @(nonroot_cache_->count()) ];
+}
+
+}  // namespace santa::santad::event_providers

Source/santad/EventProviders/AuthResultCacheTest.mm

@@ -0,0 +1,218 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <Foundation/Foundation.h>
+#import <OCMock/OCMock.h>
+#import <XCTest/XCTest.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <time.h>
+
+#include <memory>
+
+#include "Source/common/SantaVnode.h"
+#include "Source/common/TestUtils.h"
+#include "Source/santad/EventProviders/AuthResultCache.h"
+#include "Source/santad/EventProviders/EndpointSecurity/MockEndpointSecurityAPI.h"
+
+using santa::santad::event_providers::AuthResultCache;
+using santa::santad::event_providers::FlushCacheMode;
+
+// Grab the st_dev number of the root volume to match the root cache
+static uint64_t RootDevno() {
+  static dispatch_once_t once_token;
+  static uint64_t devno;
+  dispatch_once(&once_token, ^{
+    struct stat sb;
+    stat("/", &sb);
+    devno = sb.st_dev;
+  });
+  return devno;
+}
+
+static inline es_file_t MakeCacheableFile(uint64_t devno, uint64_t ino) {
+  return es_file_t{
+    .path = {}, .path_truncated = false, .stat = {.st_dev = (dev_t)devno, .st_ino = ino}};
+}
+
+static inline void AssertCacheCounts(std::shared_ptr<AuthResultCache> cache, uint64_t root_count,
+                                     uint64_t nonroot_count) {
+  NSArray<NSNumber *> *counts = cache->CacheCounts();
+
+  XCTAssertNotNil(counts);
+  XCTAssertEqual([counts count], 2);
+  XCTAssertNotNil(counts[0]);
+  XCTAssertNotNil(counts[1]);
+  XCTAssertEqual([counts[0] unsignedLongLongValue], root_count);
+  XCTAssertEqual([counts[1] unsignedLongLongValue], nonroot_count);
+}
+
+@interface AuthResultCacheTest : XCTestCase
+@end
+
+@implementation AuthResultCacheTest
+
+- (void)testEmptyCacheExpectedNumberOfCacheCounts {
+  auto esapi = std::make_shared<MockEndpointSecurityAPI>();
+  auto cache = std::make_shared<AuthResultCache>(esapi);
+
+  AssertCacheCounts(cache, 0, 0);
+}
+
+- (void)testBasicOperation {
+  auto esapi = std::make_shared<MockEndpointSecurityAPI>();
+  auto cache = std::make_shared<AuthResultCache>(esapi);
+
+  es_file_t rootFile = MakeCacheableFile(RootDevno(), 111);
+  es_file_t nonrootFile = MakeCacheableFile(RootDevno() + 123, 222);
+
+  // Add the root file to the cache
+  cache->AddToCache(&rootFile, SNTActionRequestBinary);
+
+  AssertCacheCounts(cache, 1, 0);
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRequestBinary);
+  XCTAssertEqual(cache->CheckCache(&nonrootFile), SNTActionUnset);
+
+  // Now add the non-root file
+  cache->AddToCache(&nonrootFile, SNTActionRequestBinary);
+
+  AssertCacheCounts(cache, 1, 1);
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRequestBinary);
+  XCTAssertEqual(cache->CheckCache(&nonrootFile), SNTActionRequestBinary);
+
+  // Update the cached values
+  cache->AddToCache(&rootFile, SNTActionRespondAllow);
+  cache->AddToCache(&nonrootFile, SNTActionRespondDeny);
+
+  AssertCacheCounts(cache, 1, 1);
+  XCTAssertEqual(cache->CheckCache(SantaVnode::VnodeForFile(&rootFile)), SNTActionRespondAllow);
+  XCTAssertEqual(cache->CheckCache(SantaVnode::VnodeForFile(&nonrootFile)), SNTActionRespondDeny);
+
+  // Remove the root file
+  cache->RemoveFromCache(&rootFile);
+
+  AssertCacheCounts(cache, 0, 1);
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionUnset);
+  XCTAssertEqual(cache->CheckCache(&nonrootFile), SNTActionRespondDeny);
+}
+
+- (void)testFlushCache {
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  auto cache = std::make_shared<AuthResultCache>(mockESApi);
+
+  es_file_t rootFile = MakeCacheableFile(RootDevno(), 111);
+  es_file_t nonrootFile = MakeCacheableFile(RootDevno() + 123, 111);
+
+  cache->AddToCache(&rootFile, SNTActionRequestBinary);
+  cache->AddToCache(&nonrootFile, SNTActionRequestBinary);
+
+  AssertCacheCounts(cache, 1, 1);
+
+  // Flush non-root only
+  cache->FlushCache(FlushCacheMode::kNonRootOnly);
+
+  AssertCacheCounts(cache, 1, 0);
+
+  // Add back the non-root file
+  cache->AddToCache(&nonrootFile, SNTActionRequestBinary);
+
+  AssertCacheCounts(cache, 1, 1);
+
+  // Flush all caches
+  // The call to ClearCache is asynchronous. Use a semaphore to
+  // be notified when the mock is called.
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  EXPECT_CALL(*mockESApi, ClearCache).WillOnce(testing::InvokeWithoutArgs(^() {
+    dispatch_semaphore_signal(sema);
+    return true;
+  }));
+  cache->FlushCache(FlushCacheMode::kAllCaches);
+
+  XCTAssertEqual(0,
+                 dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC)),
+                 "ClearCache wasn't called within expected time window");
+
+  XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
+
+  AssertCacheCounts(cache, 0, 0);
+}
+
+- (void)testCacheStateMachine {
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  auto cache = std::make_shared<AuthResultCache>(mockESApi);
+
+  es_file_t rootFile = MakeCacheableFile(RootDevno(), 111);
+
+  // Cached items must first be in the SNTActionRequestBinary state
+  XCTAssertFalse(cache->AddToCache(&rootFile, SNTActionRespondAllow));
+  XCTAssertFalse(cache->AddToCache(&rootFile, SNTActionRespondAllowCompiler));
+  XCTAssertFalse(cache->AddToCache(&rootFile, SNTActionRespondDeny));
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionUnset);
+
+  XCTAssertTrue(cache->AddToCache(&rootFile, SNTActionRequestBinary));
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRequestBinary);
+
+  // Items in the `SNTActionRequestBinary` state cannot reenter the same state
+  XCTAssertFalse(cache->AddToCache(&rootFile, SNTActionRequestBinary));
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRequestBinary);
+
+  SNTAction allowed_transitions[] = {
+    SNTActionRespondAllow,
+    SNTActionRespondAllowCompiler,
+    SNTActionRespondDeny,
+  };
+
+  for (size_t i = 0; i < sizeof(allowed_transitions) / sizeof(allowed_transitions[0]); i++) {
+    // First make sure the item doesn't exist
+    cache->RemoveFromCache(&rootFile);
+    XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionUnset);
+
+    // Now add the item to be in the first allowed state
+    XCTAssertTrue(cache->AddToCache(&rootFile, SNTActionRequestBinary));
+    XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRequestBinary);
+
+    // Now assert the allowed transition
+    XCTAssertTrue(cache->AddToCache(&rootFile, allowed_transitions[i]));
+    XCTAssertEqual(cache->CheckCache(&rootFile), allowed_transitions[i]);
+  }
+}
+
+- (void)testCacheExpiry {
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  // Create a cache with a lowered cache expiry value
+  uint64_t expiryMS = 250;
+  auto cache = std::make_shared<AuthResultCache>(mockESApi, expiryMS);
+
+  es_file_t rootFile = MakeCacheableFile(RootDevno(), 111);
+
+  // Add a file to the cache and put into the SNTActionRespondDeny state
+  XCTAssertTrue(cache->AddToCache(&rootFile, SNTActionRequestBinary));
+  XCTAssertTrue(cache->AddToCache(&rootFile, SNTActionRespondDeny));
+
+  // Ensure the file exists
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionRespondDeny);
+
+  // Wait for the item to expire
+  SleepMS(expiryMS);
+
+  // Check cache counts to make sure the item still exists
+  AssertCacheCounts(cache, 1, 0);
+
+  // Now check the cache, which will remove the item
+  XCTAssertEqual(cache->CheckCache(&rootFile), SNTActionUnset);
+  AssertCacheCounts(cache, 0, 0);
+}
+
+@end

Source/santad/EventProviders/DiskArbitrationTestUtil.h

@@ -1,4 +1,4 @@
-/// Copyright 2021 Google Inc. All rights reserved.
+/// Copyright 2021-2022 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -50,7 +50,8 @@ typedef void (^MockDADiskAppearedCallback)(DADiskRef ref);
 @end
 
 //
-// All DiskArbitration functions used in SNTDeviceManager and shimmed out accordingly.
+// All DiskArbitration functions used in SNTEndpointSecurityDeviceManager
+// and shimmed out accordingly.
 //
 CF_EXTERN_C_BEGIN
 

Source/santad/EventProviders/EndpointSecurity/Client.h

@@ -0,0 +1,69 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_CLIENT_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_CLIENT_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+
+#include <cstddef>
+
+namespace santa::santad::event_providers::endpoint_security {
+
+class Client {
+ public:
+  explicit Client(es_client_t* client, es_new_client_result_t result)
+      : client_(client), result_(result) {}
+
+  Client() : client_(nullptr), result_(ES_NEW_CLIENT_RESULT_ERR_INTERNAL) {}
+
+  virtual ~Client() {
+    if (client_) {
+      // Special case: Not using EndpointSecurityAPI here due to circular refs.
+      es_delete_client(client_);
+    }
+  }
+
+  Client(Client&& other) {
+    client_ = other.client_;
+    result_ = other.result_;
+    other.client_ = nullptr;
+    other.result_ = ES_NEW_CLIENT_RESULT_ERR_INTERNAL;
+  }
+
+  Client& operator=(Client&& rhs) {
+    client_ = rhs.client_;
+    result_ = rhs.result_;
+    rhs.client_ = nullptr;
+    rhs.result_ = ES_NEW_CLIENT_RESULT_ERR_INTERNAL;
+    return *this;
+  }
+
+  Client(const Client& other) = delete;
+  void operator=(const Client& rhs) = delete;
+
+  inline bool IsConnected() { return result_ == ES_NEW_CLIENT_RESULT_SUCCESS; }
+
+  inline es_new_client_result_t NewClientResult() { return result_; }
+
+  inline es_client_t* Get() const { return client_; }
+
+ private:
+  es_client_t* client_;
+  es_new_client_result_t result_;
+};
+
+}  // namespace santa::santad::event_providers::endpoint_security
+
+#endif

Source/santad/EventProviders/EndpointSecurity/ClientTest.mm

@@ -0,0 +1,118 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <OCMock/OCMock.h>
+#import <XCTest/XCTest.h>
+#include <dispatch/dispatch.h>
+
+#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
+
+using santa::santad::event_providers::endpoint_security::Client;
+
+// Global semaphore used for custom `es_delete_client` function
+dispatch_semaphore_t gSema;
+
+// Note: The Client class does not use the `EndpointSecurityAPI` wrappers due
+// to circular dependency issues. It is a special case that uses the underlying
+// ES API `es_delete_client` directly. This test override will signal the
+// `gSema` semaphore to indicate it has been called.
+es_return_t es_delete_client(es_client_t *_Nullable client) {
+  dispatch_semaphore_signal(gSema);
+  return ES_RETURN_SUCCESS;
+};
+
+@interface ClientTest : XCTestCase
+@end
+
+@implementation ClientTest
+
+- (void)setUp {
+  gSema = dispatch_semaphore_create(0);
+}
+
+- (void)testConstructorsAndDestructors {
+  // Ensure constructors set internal state properly
+  // Anonymous scopes used to ensure destructors called as expected
+
+  // Null `es_client_t*` *shouldn't* trigger `es_delete_client`
+  {
+    Client c;
+    XCTAssertEqual(c.Get(), nullptr);
+    XCTAssertEqual(c.NewClientResult(), ES_NEW_CLIENT_RESULT_ERR_INTERNAL);
+  }
+
+  XCTAssertNotEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                    "es_delete_client called unexpectedly");
+
+  // Nonnull `es_client_t*` *should* trigger `es_delete_client`
+  {
+    int fake;
+    es_client_t *fakeClient = (es_client_t *)&fake;
+    Client c(fakeClient, ES_NEW_CLIENT_RESULT_SUCCESS);
+    XCTAssertEqual(c.Get(), fakeClient);
+    XCTAssertEqual(c.NewClientResult(), ES_NEW_CLIENT_RESULT_SUCCESS);
+  }
+
+  XCTAssertEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                 "es_delete_client not called within expected time window");
+
+  // Test move constructor
+  {
+    int fake;
+    es_client_t *fakeClient = (es_client_t *)&fake;
+    Client c1(fakeClient, ES_NEW_CLIENT_RESULT_SUCCESS);
+
+    Client c2(std::move(c1));
+
+    XCTAssertEqual(c1.Get(), nullptr);
+    XCTAssertEqual(c2.Get(), fakeClient);
+    XCTAssertEqual(c2.NewClientResult(), ES_NEW_CLIENT_RESULT_SUCCESS);
+  }
+
+  // Ensure `es_delete_client` was only called once when both `c1` and `c2`
+  // are destructed.
+  XCTAssertEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                 "es_delete_client not called within expected time window");
+  XCTAssertNotEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                    "es_delete_client called unexpectedly");
+
+  // Test move assignment
+  {
+    int fake;
+    es_client_t *fakeClient = (es_client_t *)&fake;
+    Client c1(fakeClient, ES_NEW_CLIENT_RESULT_SUCCESS);
+    Client c2;
+
+    c2 = std::move(c1);
+
+    XCTAssertEqual(c1.Get(), nullptr);
+    XCTAssertEqual(c2.Get(), fakeClient);
+    XCTAssertEqual(c2.NewClientResult(), ES_NEW_CLIENT_RESULT_SUCCESS);
+  }
+
+  // Ensure `es_delete_client` was only called once when both `c1` and `c2`
+  // are destructed.
+  XCTAssertEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                 "es_delete_client not called within expected time window");
+  XCTAssertNotEqual(0, dispatch_semaphore_wait(gSema, DISPATCH_TIME_NOW),
+                    "es_delete_client called unexpectedly");
+}
+
+- (void)testIsConnected {
+  XCTAssertFalse(Client().IsConnected());
+  XCTAssertFalse(Client(nullptr, ES_NEW_CLIENT_RESULT_ERR_NOT_ENTITLED).IsConnected());
+  XCTAssertTrue(Client(nullptr, ES_NEW_CLIENT_RESULT_SUCCESS).IsConnected());
+}
+
+@end

Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h

@@ -0,0 +1,74 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENDPOINTSECURITYAPI_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENDPOINTSECURITYAPI_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#import <Foundation/Foundation.h>
+
+#include <set>
+#include <string_view>
+
+#include "Source/santad/DataLayer/WatchItemPolicy.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+
+namespace santa::santad::event_providers::endpoint_security {
+
+class EndpointSecurityAPI : public std::enable_shared_from_this<EndpointSecurityAPI> {
+ public:
+  virtual ~EndpointSecurityAPI() = default;
+
+  virtual Client NewClient(void (^message_handler)(es_client_t *, Message));
+
+  virtual bool Subscribe(const Client &client, const std::set<es_event_type_t> &);
+  virtual bool UnsubscribeAll(const Client &client);
+
+  virtual bool UnmuteAllPaths(const Client &client);
+  virtual bool UnmuteAllTargetPaths(const Client &client);
+
+  virtual bool IsTargetPathMutingInverted(const Client &client);
+  virtual bool InvertTargetPathMuting(const Client &client);
+
+  virtual bool MuteTargetPath(const Client &client, std::string_view path,
+                              santa::santad::data_layer::WatchItemPathType path_type);
+  virtual bool UnmuteTargetPath(const Client &client, std::string_view path,
+                                santa::santad::data_layer::WatchItemPathType path_type);
+
+  virtual void RetainMessage(const es_message_t *msg);
+  virtual void ReleaseMessage(const es_message_t *msg);
+
+  virtual bool RespondAuthResult(const Client &client, const Message &msg, es_auth_result_t result,
+                                 bool cache);
+  virtual bool RespondFlagsResult(const Client &client, const Message &msg, uint32_t allowed_flags,
+                                  bool cache);
+
+  virtual bool MuteProcess(const Client &client, const audit_token_t *tok);
+
+  virtual bool ClearCache(const Client &client);
+
+  virtual uint32_t ExecArgCount(const es_event_exec_t *event);
+  virtual es_string_token_t ExecArg(const es_event_exec_t *event, uint32_t index);
+
+  virtual uint32_t ExecEnvCount(const es_event_exec_t *event);
+  virtual es_string_token_t ExecEnv(const es_event_exec_t *event, uint32_t index);
+
+  virtual uint32_t ExecFDCount(const es_event_exec_t *event);
+  virtual const es_fd_t *ExecFD(const es_event_exec_t *event, uint32_t index);
+};
+
+}  // namespace santa::santad::event_providers::endpoint_security
+
+#endif

Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.mm

@@ -0,0 +1,174 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
+
+#include <set>
+#include <vector>
+
+#include "Source/common/Platform.h"
+
+using santa::santad::data_layer::WatchItemPathType;
+
+namespace santa::santad::event_providers::endpoint_security {
+
+Client EndpointSecurityAPI::NewClient(void (^message_handler)(es_client_t *, Message)) {
+  es_client_t *client = NULL;
+
+  auto shared_esapi = shared_from_this();
+  es_new_client_result_t res = es_new_client(&client, ^(es_client_t *c, const es_message_t *msg) {
+    @autoreleasepool {
+      message_handler(c, Message(shared_esapi, msg));
+    }
+  });
+
+  return Client(client, res);
+}
+
+void EndpointSecurityAPI::RetainMessage(const es_message_t *msg) {
+  es_retain_message(msg);
+}
+
+void EndpointSecurityAPI::ReleaseMessage(const es_message_t *msg) {
+  es_release_message(msg);
+}
+
+bool EndpointSecurityAPI::Subscribe(const Client &client,
+                                    const std::set<es_event_type_t> &event_types) {
+  std::vector<es_event_type_t> subs(event_types.begin(), event_types.end());
+  return es_subscribe(client.Get(), subs.data(), (uint32_t)subs.size()) == ES_RETURN_SUCCESS;
+}
+
+bool EndpointSecurityAPI::UnsubscribeAll(const Client &client) {
+  return es_unsubscribe_all(client.Get()) == ES_RETURN_SUCCESS;
+}
+
+bool EndpointSecurityAPI::UnmuteAllPaths(const Client &client) {
+  return es_unmute_all_paths(client.Get()) == ES_RETURN_SUCCESS;
+}
+
+bool EndpointSecurityAPI::UnmuteAllTargetPaths(const Client &client) {
+#if HAVE_MACOS_13
+  if (@available(macOS 13.0, *)) {
+    return es_unmute_all_target_paths(client.Get()) == ES_RETURN_SUCCESS;
+  }
+#endif
+
+  return true;
+}
+
+bool EndpointSecurityAPI::IsTargetPathMutingInverted(const Client &client) {
+#if HAVE_MACOS_13
+  if (@available(macOS 13.0, *)) {
+    return es_muting_inverted(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) == ES_MUTE_INVERTED;
+  }
+#endif
+
+  return false;
+}
+
+bool EndpointSecurityAPI::InvertTargetPathMuting(const Client &client) {
+#if HAVE_MACOS_13
+  if (@available(macOS 13.0, *)) {
+    if (!IsTargetPathMutingInverted(client)) {
+      return es_invert_muting(client.Get(), ES_MUTE_INVERSION_TYPE_TARGET_PATH) ==
+             ES_RETURN_SUCCESS;
+    } else {
+      return true;
+    }
+  }
+#endif
+
+  return false;
+}
+
+bool EndpointSecurityAPI::MuteTargetPath(const Client &client, std::string_view path,
+                                         WatchItemPathType path_type) {
+#if HAVE_MACOS_13
+  if (@available(macOS 13.0, *)) {
+    return es_mute_path(client.Get(), path.data(),
+                        path_type == WatchItemPathType::kPrefix
+                          ? ES_MUTE_PATH_TYPE_TARGET_PREFIX
+                          : ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;
+  }
+#endif
+
+  return false;
+}
+
+bool EndpointSecurityAPI::UnmuteTargetPath(const Client &client, std::string_view path,
+                                           WatchItemPathType path_type) {
+#if HAVE_MACOS_13
+  if (@available(macOS 13.0, *)) {
+    return es_unmute_path(client.Get(), path.data(),
+                          path_type == WatchItemPathType::kPrefix
+                            ? ES_MUTE_PATH_TYPE_TARGET_PREFIX
+                            : ES_MUTE_PATH_TYPE_TARGET_LITERAL) == ES_RETURN_SUCCESS;
+  }
+#endif
+
+  return true;
+}
+
+bool EndpointSecurityAPI::RespondAuthResult(const Client &client, const Message &msg,
+                                            es_auth_result_t result, bool cache) {
+  return es_respond_auth_result(client.Get(), &(*msg), result, cache) == ES_RESPOND_RESULT_SUCCESS;
+}
+
+bool EndpointSecurityAPI::RespondFlagsResult(const Client &client, const Message &msg,
+                                             uint32_t allowed_flags, bool cache) {
+  return es_respond_flags_result(client.Get(), &(*msg), allowed_flags, cache);
+}
+
+bool EndpointSecurityAPI::MuteProcess(const Client &client, const audit_token_t *tok) {
+  return es_mute_process(client.Get(), tok) == ES_RETURN_SUCCESS;
+}
+
+bool EndpointSecurityAPI::ClearCache(const Client &client) {
+  return es_clear_cache(client.Get()) == ES_CLEAR_CACHE_RESULT_SUCCESS;
+}
+
+uint32_t EndpointSecurityAPI::ExecArgCount(const es_event_exec_t *event) {
+  return es_exec_arg_count(event);
+}
+
+es_string_token_t EndpointSecurityAPI::ExecArg(const es_event_exec_t *event, uint32_t index) {
+  return es_exec_arg(event, index);
+}
+
+uint32_t EndpointSecurityAPI::ExecEnvCount(const es_event_exec_t *event) {
+  return es_exec_env_count(event);
+}
+
+es_string_token_t EndpointSecurityAPI::ExecEnv(const es_event_exec_t *event, uint32_t index) {
+  return es_exec_env(event, index);
+}
+
+uint32_t EndpointSecurityAPI::ExecFDCount(const es_event_exec_t *event) {
+  if (@available(macOS 11.0, *)) {
+    return es_exec_fd_count(event);
+  } else {
+    return 0;
+  }
+}
+
+const es_fd_t *EndpointSecurityAPI::ExecFD(const es_event_exec_t *event, uint32_t index) {
+  if (@available(macOS 11.0, *)) {
+    return es_exec_fd(event, index);
+  } else {
+    return NULL;
+  }
+}
+
+}  // namespace santa::santad::event_providers::endpoint_security

Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h

@@ -0,0 +1,326 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+/// This file groups all of the enriched message types - that is the
+/// objects that are constructed to hold all enriched event data prior
+/// to being logged.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENRICHEDTYPES_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENRICHEDTYPES_H
+
+#include <time.h>
+
+#include <optional>
+#include <string>
+#include <variant>
+
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+
+namespace santa::santad::event_providers::endpoint_security {
+
+class EnrichedFile {
+ public:
+  EnrichedFile()
+      : user_(std::nullopt), group_(std::nullopt), hash_(std::nullopt) {}
+
+  EnrichedFile(std::optional<std::shared_ptr<std::string>> &&user,
+               std::optional<std::shared_ptr<std::string>> &&group,
+               std::optional<std::shared_ptr<std::string>> &&hash)
+      : user_(std::move(user)),
+        group_(std::move(group)),
+        hash_(std::move(hash)) {}
+
+  EnrichedFile(EnrichedFile &&other)
+      : user_(std::move(other.user_)),
+        group_(std::move(other.group_)),
+        hash_(std::move(other.hash_)) {}
+
+  EnrichedFile(const EnrichedFile &other) = delete;
+
+  const std::optional<std::shared_ptr<std::string>> &user() const {
+    return user_;
+  }
+  const std::optional<std::shared_ptr<std::string>> &group() const {
+    return group_;
+  }
+
+ private:
+  std::optional<std::shared_ptr<std::string>> user_;
+  std::optional<std::shared_ptr<std::string>> group_;
+  std::optional<std::shared_ptr<std::string>> hash_;
+};
+
+class EnrichedProcess {
+ public:
+  EnrichedProcess()
+      : effective_user_(std::nullopt),
+        effective_group_(std::nullopt),
+        real_user_(std::nullopt),
+        real_group_(std::nullopt) {}
+
+  EnrichedProcess(std::optional<std::shared_ptr<std::string>> &&effective_user,
+                  std::optional<std::shared_ptr<std::string>> &&effective_group,
+                  std::optional<std::shared_ptr<std::string>> &&real_user,
+                  std::optional<std::shared_ptr<std::string>> &&real_group,
+                  EnrichedFile &&executable)
+      : effective_user_(std::move(effective_user)),
+        effective_group_(std::move(effective_group)),
+        real_user_(std::move(real_user)),
+        real_group_(std::move(real_group)),
+        executable_(std::move(executable)) {}
+
+  EnrichedProcess(EnrichedProcess &&other)
+      : effective_user_(std::move(other.effective_user_)),
+        effective_group_(std::move(other.effective_group_)),
+        real_user_(std::move(other.real_user_)),
+        real_group_(std::move(other.real_group_)),
+        executable_(std::move(other.executable_)) {}
+
+  EnrichedProcess(const EnrichedProcess &other) = delete;
+
+  const std::optional<std::shared_ptr<std::string>> &effective_user() const {
+    return effective_user_;
+  }
+  const std::optional<std::shared_ptr<std::string>> &effective_group() const {
+    return effective_group_;
+  }
+  const std::optional<std::shared_ptr<std::string>> &real_user() const {
+    return real_user_;
+  }
+  const std::optional<std::shared_ptr<std::string>> &real_group() const {
+    return real_group_;
+  }
+  const EnrichedFile &executable() const { return executable_; }
+
+ private:
+  std::optional<std::shared_ptr<std::string>> effective_user_;
+  std::optional<std::shared_ptr<std::string>> effective_group_;
+  std::optional<std::shared_ptr<std::string>> real_user_;
+  std::optional<std::shared_ptr<std::string>> real_group_;
+  EnrichedFile executable_;
+};
+
+class EnrichedEventType {
+ public:
+  EnrichedEventType(Message &&es_msg, EnrichedProcess &&instigator)
+      : es_msg_(std::move(es_msg)), instigator_(std::move(instigator)) {
+    clock_gettime(CLOCK_REALTIME, &enrichment_time_);
+  }
+
+  EnrichedEventType(EnrichedEventType &&other)
+      : es_msg_(std::move(other.es_msg_)),
+        instigator_(std::move(other.instigator_)),
+        enrichment_time_(std::move(other.enrichment_time_)) {}
+
+  EnrichedEventType(const EnrichedEventType &other) = delete;
+
+  virtual ~EnrichedEventType() = default;
+
+  const es_message_t &es_msg() const { return *es_msg_; }
+  const EnrichedProcess &instigator() const { return instigator_; }
+  struct timespec enrichment_time() const {
+    // No reason to return a reference
+    return enrichment_time_;
+  }
+
+ private:
+  Message es_msg_;
+  EnrichedProcess instigator_;
+  struct timespec enrichment_time_;
+};
+
+class EnrichedClose : public EnrichedEventType {
+ public:
+  EnrichedClose(Message &&es_msg, EnrichedProcess &&instigator,
+                EnrichedFile &&target)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        target_(std::move(target)) {}
+
+  EnrichedClose(EnrichedClose &&other)
+      : EnrichedEventType(std::move(other)),
+        target_(std::move(other.target_)) {}
+
+  EnrichedClose(const EnrichedClose &other) = delete;
+
+  const EnrichedFile &target() const { return target_; }
+
+ private:
+  EnrichedFile target_;
+};
+
+class EnrichedExchange : public EnrichedEventType {
+ public:
+  EnrichedExchange(Message &&es_msg, EnrichedProcess &&instigator,
+                   EnrichedFile &&file1, EnrichedFile &&file2)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        file1_(std::move(file1)),
+        file2_(std::move(file2)) {}
+
+  EnrichedExchange(EnrichedExchange &&other)
+      : EnrichedEventType(std::move(other)),
+        file1_(std::move(other.file1_)),
+        file2_(std::move(other.file2_)) {}
+
+  EnrichedExchange(const EnrichedExchange &other) = delete;
+
+  const EnrichedFile &file1() const { return file1_; }
+  const EnrichedFile &file2() const { return file2_; }
+
+ private:
+  EnrichedFile file1_;
+  EnrichedFile file2_;
+};
+
+class EnrichedExec : public EnrichedEventType {
+ public:
+  EnrichedExec(Message &&es_msg, EnrichedProcess &&instigator,
+               EnrichedProcess &&target, std::optional<EnrichedFile> &&script,
+               std::optional<EnrichedFile> working_dir)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        target_(std::move(target)),
+        script_(std::move(script)),
+        working_dir_(std::move(working_dir)) {}
+
+  EnrichedExec(EnrichedExec &&other)
+      : EnrichedEventType(std::move(other)),
+        target_(std::move(other.target_)),
+        script_(std::move(other.script_)),
+        working_dir_(std::move(other.working_dir_)) {}
+
+  EnrichedExec(const EnrichedExec &other) = delete;
+
+  const EnrichedProcess &target() const { return target_; }
+  const std::optional<EnrichedFile> &script() const { return script_; }
+  const std::optional<EnrichedFile> &working_dir() const {
+    return working_dir_;
+  }
+
+ private:
+  EnrichedProcess target_;
+  std::optional<EnrichedFile> script_;
+  std::optional<EnrichedFile> working_dir_;
+};
+
+class EnrichedExit : public EnrichedEventType {
+ public:
+  EnrichedExit(Message &&es_msg, EnrichedProcess &&instigator)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)) {}
+
+  EnrichedExit(EnrichedExit &&other) : EnrichedEventType(std::move(other)) {}
+
+  EnrichedExit(const EnrichedExit &other) = delete;
+};
+
+class EnrichedFork : public EnrichedEventType {
+ public:
+  EnrichedFork(Message &&es_msg, EnrichedProcess &&instigator,
+               EnrichedProcess &&child)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        child_(std::move(child)) {}
+
+  EnrichedFork(EnrichedFork &&other)
+      : EnrichedEventType(std::move(other)), child_(std::move(other.child_)) {}
+
+  EnrichedFork(const EnrichedFork &other) = delete;
+
+  const EnrichedProcess &child() const { return child_; }
+
+ private:
+  EnrichedProcess child_;
+};
+
+class EnrichedLink : public EnrichedEventType {
+ public:
+  EnrichedLink(Message &&es_msg, EnrichedProcess &&instigator,
+               EnrichedFile &&source, EnrichedFile &&target_dir)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        source_(std::move(source)),
+        target_dir_(std::move(target_dir)) {}
+
+  EnrichedLink(EnrichedLink &&other)
+      : EnrichedEventType(std::move(other)),
+        source_(std::move(other.source_)),
+        target_dir_(std::move(other.target_dir_)) {}
+
+  EnrichedLink(const EnrichedLink &other) = delete;
+
+  const EnrichedFile &source() const { return source_; }
+
+ private:
+  EnrichedFile source_;
+  EnrichedFile target_dir_;
+};
+
+class EnrichedRename : public EnrichedEventType {
+ public:
+  EnrichedRename(Message &&es_msg, EnrichedProcess &&instigator,
+                 EnrichedFile &&source, std::optional<EnrichedFile> &&target,
+                 std::optional<EnrichedFile> &&target_dir)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        source_(std::move(source)),
+        target_(std::move(target)),
+        target_dir_(std::move(target_dir)) {}
+
+  EnrichedRename(EnrichedRename &&other)
+      : EnrichedEventType(std::move(other)),
+        source_(std::move(other.source_)),
+        target_(std::move(other.target_)),
+        target_dir_(std::move(other.target_dir_)) {}
+
+  EnrichedRename(const EnrichedRename &other) = delete;
+
+  const EnrichedFile &source() const { return source_; }
+
+ private:
+  EnrichedFile source_;
+  std::optional<EnrichedFile> target_;
+  std::optional<EnrichedFile> target_dir_;
+};
+
+class EnrichedUnlink : public EnrichedEventType {
+ public:
+  EnrichedUnlink(Message &&es_msg, EnrichedProcess &&instigator,
+                 EnrichedFile &&target)
+      : EnrichedEventType(std::move(es_msg), std::move(instigator)),
+        target_(std::move(target)) {}
+
+  EnrichedUnlink(EnrichedUnlink &&other)
+      : EnrichedEventType(std::move(other)),
+        target_(std::move(other.target_)) {}
+
+  EnrichedUnlink(const EnrichedUnlink &other) = delete;
+
+  const EnrichedFile &target() const { return target_; }
+
+ private:
+  EnrichedFile target_;
+};
+
+using EnrichedType =
+    std::variant<EnrichedClose, EnrichedExchange, EnrichedExec, EnrichedExit,
+                 EnrichedFork, EnrichedLink, EnrichedRename, EnrichedUnlink>;
+
+class EnrichedMessage {
+ public:
+  EnrichedMessage(EnrichedType &&msg) : msg_(std::move(msg)) {}
+
+  const EnrichedType &GetEnrichedMessage() { return msg_; }
+
+ private:
+  EnrichedType msg_;
+};
+
+}  // namespace santa::santad::event_providers::endpoint_security
+
+#endif

Source/santad/EventProviders/EndpointSecurity/Enricher.h

@@ -0,0 +1,58 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENRICHER_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_ENRICHER_H
+
+#include <memory>
+
+#include "Source/common/SantaCache.h"
+#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
+
+namespace santa::santad::event_providers::endpoint_security {
+
+enum class EnrichOptions {
+  // Specifies default enricher operation.
+  kDefault,
+
+  // This option tells the enricher to only enrich with information that can be
+  // gathered without potentially triggering work from external processes.
+  kLocalOnly,
+};
+
+class Enricher {
+ public:
+  Enricher();
+  virtual ~Enricher() = default;
+  virtual std::shared_ptr<EnrichedMessage> Enrich(Message &&msg);
+  virtual EnrichedProcess Enrich(
+      const es_process_t &es_proc,
+      EnrichOptions options = EnrichOptions::kDefault);
+  virtual EnrichedFile Enrich(const es_file_t &es_file,
+                              EnrichOptions options = EnrichOptions::kDefault);
+
+  virtual std::optional<std::shared_ptr<std::string>> UsernameForUID(
+      uid_t uid, EnrichOptions options = EnrichOptions::kDefault);
+  virtual std::optional<std::shared_ptr<std::string>> UsernameForGID(
+      gid_t gid, EnrichOptions options = EnrichOptions::kDefault);
+
+ private:
+  SantaCache<uid_t, std::optional<std::shared_ptr<std::string>>>
+      username_cache_;
+  SantaCache<gid_t, std::optional<std::shared_ptr<std::string>>>
+      groupname_cache_;
+};
+
+}  // namespace santa::santad::event_providers::endpoint_security
+
+#endif

Source/santad/EventProviders/EndpointSecurity/Enricher.mm

@@ -0,0 +1,145 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
+
+#include <EndpointSecurity/ESTypes.h>
+#include <bsm/libbsm.h>
+#include <grp.h>
+#include <pwd.h>
+#include <sys/types.h>
+
+#include <memory>
+#include <optional>
+
+#include "Source/common/SNTLogging.h"
+#include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
+
+namespace santa::santad::event_providers::endpoint_security {
+
+Enricher::Enricher() : username_cache_(256), groupname_cache_(256) {}
+
+std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
+  // TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
+  // (such as maybe the flyweight pattern)
+  switch (es_msg->event_type) {
+    case ES_EVENT_TYPE_NOTIFY_CLOSE:
+      return std::make_shared<EnrichedMessage>(EnrichedClose(
+        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.close.target)));
+    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
+      return std::make_shared<EnrichedMessage>(EnrichedExchange(
+        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exchangedata.file1),
+        Enrich(*es_msg->event.exchangedata.file2)));
+    case ES_EVENT_TYPE_NOTIFY_EXEC:
+      return std::make_shared<EnrichedMessage>(EnrichedExec(
+        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exec.target),
+        (es_msg->version >= 2 && es_msg->event.exec.script)
+          ? std::make_optional(Enrich(*es_msg->event.exec.script))
+          : std::nullopt,
+        (es_msg->version >= 3 && es_msg->event.exec.cwd)
+          ? std::make_optional(Enrich(*es_msg->event.exec.cwd))
+          : std::nullopt));
+    case ES_EVENT_TYPE_NOTIFY_FORK:
+      return std::make_shared<EnrichedMessage>(EnrichedFork(
+        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.fork.child)));
+    case ES_EVENT_TYPE_NOTIFY_EXIT:
+      return std::make_shared<EnrichedMessage>(
+        EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));
+    case ES_EVENT_TYPE_NOTIFY_LINK:
+      return std::make_shared<EnrichedMessage>(
+        EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),
+                     Enrich(*es_msg->event.link.source), Enrich(*es_msg->event.link.target_dir)));
+    case ES_EVENT_TYPE_NOTIFY_RENAME: {
+      if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {
+        return std::make_shared<EnrichedMessage>(EnrichedRename(
+          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
+          std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));
+      } else {
+        return std::make_shared<EnrichedMessage>(EnrichedRename(
+          std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
+          Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));
+      }
+    }
+    case ES_EVENT_TYPE_NOTIFY_UNLINK:
+      return std::make_shared<EnrichedMessage>(EnrichedUnlink(
+        std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.unlink.target)));
+    default:
+      // This is a programming error
+      LOGE(@"Attempting to enrich an unhandled event type: %d", es_msg->event_type);
+      exit(EXIT_FAILURE);
+  }
+}
+
+EnrichedProcess Enricher::Enrich(const es_process_t &es_proc, EnrichOptions options) {
+  return EnrichedProcess(UsernameForUID(audit_token_to_euid(es_proc.audit_token), options),
+                         UsernameForGID(audit_token_to_egid(es_proc.audit_token), options),
+                         UsernameForUID(audit_token_to_ruid(es_proc.audit_token), options),
+                         UsernameForGID(audit_token_to_rgid(es_proc.audit_token), options),
+                         Enrich(*es_proc.executable, options));
+}
+
+EnrichedFile Enricher::Enrich(const es_file_t &es_file, EnrichOptions options) {
+  // TODO(mlw): Consider having the enricher perform file hashing. This will
+  // make more sense if we start including hashes in more event types.
+  return EnrichedFile(UsernameForUID(es_file.stat.st_uid, options),
+                      UsernameForGID(es_file.stat.st_gid, options), std::nullopt);
+}
+
+std::optional<std::shared_ptr<std::string>> Enricher::UsernameForUID(uid_t uid,
+                                                                     EnrichOptions options) {
+  std::optional<std::shared_ptr<std::string>> username = username_cache_.get(uid);
+
+  if (username.has_value()) {
+    return username;
+  } else if (options == EnrichOptions::kLocalOnly) {
+    // If `kLocalOnly` option is set, do not attempt a lookup
+    return std::nullopt;
+  } else {
+    struct passwd *pw = getpwuid(uid);
+    if (pw) {
+      username = std::make_shared<std::string>(pw->pw_name);
+    } else {
+      username = std::nullopt;
+    }
+
+    username_cache_.set(uid, username);
+
+    return username;
+  }
+}
+
+std::optional<std::shared_ptr<std::string>> Enricher::UsernameForGID(gid_t gid,
+                                                                     EnrichOptions options) {
+  std::optional<std::shared_ptr<std::string>> groupname = groupname_cache_.get(gid);
+
+  if (groupname.has_value()) {
+    return groupname;
+  } else if (options == EnrichOptions::kLocalOnly) {
+    // If `kLocalOnly` option is set, do not attempt a lookup
+    return std::nullopt;
+  } else {
+    struct group *gr = getgrgid(gid);
+    if (gr) {
+      groupname = std::make_shared<std::string>(gr->gr_name);
+    } else {
+      groupname = std::nullopt;
+    }
+
+    groupname_cache_.set(gid, groupname);
+
+    return groupname;
+  }
+}
+
+}  // namespace santa::santad::event_providers::endpoint_security

Source/santad/EventProviders/EndpointSecurity/EnricherTest.mm

@@ -0,0 +1,49 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <OCMock/OCMock.h>
+#import <XCTest/XCTest.h>
+
+#include "Source/common/TestUtils.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
+
+using santa::santad::event_providers::endpoint_security::Enricher;
+
+@interface EnricherTest : XCTestCase
+@end
+
+@implementation EnricherTest
+
+- (void)testUidGid {
+  Enricher enricher;
+
+  std::optional<std::shared_ptr<std::string>> user = enricher.UsernameForUID(NOBODY_UID);
+  XCTAssertTrue(user.has_value());
+  XCTAssertEqual(strcmp(user->get()->c_str(), "nobody"), 0);
+
+  std::optional<std::shared_ptr<std::string>> group = enricher.UsernameForGID(NOGROUP_GID);
+  XCTAssertTrue(group.has_value());
+  XCTAssertEqual(strcmp(group->get()->c_str(), "nogroup"), 0);
+
+  uid_t invalidUID = (uid_t)-123;
+  gid_t invalidGID = (gid_t)-123;
+
+  std::optional<std::shared_ptr<std::string>> invalidUser = enricher.UsernameForUID(invalidUID);
+  XCTAssertFalse(invalidUser.has_value());
+
+  std::optional<std::shared_ptr<std::string>> invalidGroup = enricher.UsernameForGID(invalidGID);
+  XCTAssertFalse(invalidGroup.has_value());
+}
+
+@end

Source/santad/EventProviders/EndpointSecurity/Message.h

@@ -0,0 +1,55 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_MESSAGE_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_MESSAGE_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+
+#include <memory>
+#include <string>
+
+namespace santa::santad::event_providers::endpoint_security {
+
+class EndpointSecurityAPI;
+
+class Message {
+ public:
+  Message(std::shared_ptr<EndpointSecurityAPI> esapi,
+          const es_message_t* es_msg);
+  ~Message();
+
+  Message(Message&& other);
+  // Note: Safe to implement this, just not currently needed so left deleted.
+  Message& operator=(Message&& rhs) = delete;
+
+  Message(const Message& other);
+  Message& operator=(const Message& other) = delete;
+
+  // Operators to access underlying es_message_t
+  const es_message_t* operator->() const { return es_msg_; }
+  const es_message_t& operator*() const { return *es_msg_; }
+
+  std::string ParentProcessName() const;
+
+ private:
+  std::shared_ptr<EndpointSecurityAPI> esapi_;
+  const es_message_t* es_msg_;
+
+  std::string GetProcessName(pid_t pid) const;
+};
+
+}  // namespace santa::santad::event_providers::endpoint_security
+
+#endif

Source/santad/EventProviders/EndpointSecurity/Message.mm

@@ -0,0 +1,62 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+
+#include <bsm/libbsm.h>
+#include <libproc.h>
+
+#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
+
+namespace santa::santad::event_providers::endpoint_security {
+
+Message::Message(std::shared_ptr<EndpointSecurityAPI> esapi, const es_message_t *es_msg)
+    : esapi_(std::move(esapi)), es_msg_(es_msg) {
+  esapi_->RetainMessage(es_msg);
+}
+
+Message::~Message() {
+  if (es_msg_) {
+    esapi_->ReleaseMessage(es_msg_);
+  }
+}
+
+Message::Message(Message &&other) {
+  esapi_ = std::move(other.esapi_);
+  es_msg_ = other.es_msg_;
+  other.es_msg_ = nullptr;
+}
+
+Message::Message(const Message &other) {
+  esapi_ = other.esapi_;
+  es_msg_ = other.es_msg_;
+  esapi_->RetainMessage(es_msg_);
+}
+
+std::string Message::ParentProcessName() const {
+  return GetProcessName(es_msg_->process->ppid);
+}
+
+std::string Message::GetProcessName(pid_t pid) const {
+  // Note: proc_name() accesses the `pbi_name` field of `struct proc_bsdinfo`. The size of `pname`
+  // here is meant to match the size of `pbi_name`, and one extra byte ensure zero-terminated.
+  char pname[MAXCOMLEN * 2 + 1] = {};
+  if (proc_name(pid, pname, sizeof(pname)) > 0) {
+    return std::string(pname);
+  } else {
+    return std::string("");
+  }
+}
+
+}  // namespace santa::santad::event_providers::endpoint_security

Source/santad/EventProviders/EndpointSecurity/MessageTest.mm

@@ -0,0 +1,133 @@
+/// Copyright 2022 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <OCMock/OCMock.h>
+#import <XCTest/XCTest.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <libproc.h>
+#include <stdlib.h>
+
+#include "Source/common/TestUtils.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+#include "Source/santad/EventProviders/EndpointSecurity/MockEndpointSecurityAPI.h"
+
+using santa::santad::event_providers::endpoint_security::Message;
+
+bool IsPidInUse(pid_t pid) {
+  char pname[MAXCOMLEN * 2 + 1] = {};
+  errno = 0;
+  if (proc_name(pid, pname, sizeof(pname)) <= 0 && errno == ESRCH) {
+    return false;
+  }
+
+  // The PID may or may not actually be in use, but assume it is
+  return true;
+}
+
+// Try to find an unused PID by looking for libproc returning ESRCH errno.
+// Start searching backwards from PID_MAX to increase likelyhood that the
+// returned PID will still be unused by the time it's being used.
+// TODO(mlw): Alternatively, we could inject the `proc_name` function into
+// the `Message` object to remove the guesswork here.
+pid_t AttemptToFindUnusedPID() {
+  for (pid_t pid = 99999 /* PID_MAX */; pid > 1; pid--) {
+    if (!IsPidInUse(pid)) {
+      return pid;
+    }
+  }
+
+  return 0;
+}
+
+@interface MessageTest : XCTestCase
+@end
+
+@implementation MessageTest
+
+- (void)setUp {
+}
+
+- (void)testConstructorsAndDestructors {
+  es_file_t procFile = MakeESFile("foo");
+  es_process_t proc = MakeESProcess(&procFile, MakeAuditToken(12, 34), MakeAuditToken(56, 78));
+  es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXIT, &proc);
+
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  mockESApi->SetExpectationsRetainReleaseMessage();
+
+  // Constructing a `Message` retains the underlying `es_message_t` and it is
+  // released when the `Message` object is destructed.
+  { Message m(mockESApi, &esMsg); }
+
+  XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
+}
+
+- (void)testCopyConstructor {
+  es_file_t procFile = MakeESFile("foo");
+  es_process_t proc = MakeESProcess(&procFile, MakeAuditToken(12, 34), MakeAuditToken(56, 78));
+  es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXIT, &proc);
+
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  EXPECT_CALL(*mockESApi, ReleaseMessage(testing::_))
+    .Times(2)
+    .After(EXPECT_CALL(*mockESApi, RetainMessage(testing::_)).Times(2));
+
+  {
+    Message msg1(mockESApi, &esMsg);
+    Message msg2(msg1);
+
+    // Both messages should now point to the same `es_message_t`
+    XCTAssertEqual(msg1.operator->(), &esMsg);
+    XCTAssertEqual(msg2.operator->(), &esMsg);
+  }
+
+  // Ensure the retain/release mocks were called the expected number of times
+  XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
+}
+
+- (void)testGetParentProcessName {
+  // Construct a message where the parent pid is ourself
+  es_file_t procFile = MakeESFile("foo");
+  es_process_t proc = MakeESProcess(&procFile, MakeAuditToken(12, 34), MakeAuditToken(getpid(), 0));
+  es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_EXIT, &proc);
+
+  auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
+  mockESApi->SetExpectationsRetainReleaseMessage();
+
+  // Search for an *existing* parent process.
+  {
+    Message msg(mockESApi, &esMsg);
+
+    std::string got = msg.ParentProcessName();
+    std::string want = getprogname();
+
+    XCTAssertCppStringEqual(got, want);
+  }
+
+  // Search for a *non-existent* parent process.
+  {
+    pid_t newPpid = AttemptToFindUnusedPID();
+    proc = MakeESProcess(&procFile, MakeAuditToken(12, 34), MakeAuditToken(newPpid, 34));
+
+    Message msg(mockESApi, &esMsg);
+
+    std::string got = msg.ParentProcessName();
+    std::string want = "";
+
+    XCTAssertCppStringEqual(got, want);
+  }
+}
+
+@end

Source/santad/EventProviders/EndpointSecurity/MockEndpointSecurityAPI.h

@@ -0,0 +1,100 @@
+/// Copyright 2021 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#ifndef SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_MOCKENDPOINTSECURITYAPI_H
+#define SANTA__SANTAD__EVENTPROVIDERS_ENDPOINTSECURITY_MOCKENDPOINTSECURITYAPI_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#import <Foundation/Foundation.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <set>
+
+#include "Source/santad/DataLayer/WatchItemPolicy.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Client.h"
+#include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+
+using santa::santad::event_providers::endpoint_security::Client;
+
+class MockEndpointSecurityAPI
+    : public santa::santad::event_providers::endpoint_security::EndpointSecurityAPI {
+ public:
+  MOCK_METHOD(santa::santad::event_providers::endpoint_security::Client, NewClient,
+              (void (^message_handler)(
+                es_client_t *, santa::santad::event_providers::endpoint_security::Message)));
+
+  MOCK_METHOD(bool, Subscribe,
+              (const santa::santad::event_providers::endpoint_security::Client &,
+               const std::set<es_event_type_t> &));
+  MOCK_METHOD(bool, UnsubscribeAll, (const Client &client));
+
+  MOCK_METHOD(bool, UnmuteAllPaths, (const Client &client));
+  MOCK_METHOD(bool, UnmuteAllTargetPaths, (const Client &client));
+
+  MOCK_METHOD(bool, IsTargetPathMutingInverted, (const Client &client));
+  MOCK_METHOD(bool, InvertTargetPathMuting, (const Client &client));
+
+  MOCK_METHOD(bool, MuteTargetPath,
+              (const Client &client, std::string_view path,
+               santa::santad::data_layer::WatchItemPathType path_type));
+  MOCK_METHOD(bool, UnmuteTargetPath,
+              (const Client &client, std::string_view path,
+               santa::santad::data_layer::WatchItemPathType path_type));
+
+  MOCK_METHOD(void, RetainMessage, (const es_message_t *msg));
+  MOCK_METHOD(void, ReleaseMessage, (const es_message_t *msg));
+
+  MOCK_METHOD(bool, RespondAuthResult,
+              (const santa::santad::event_providers::endpoint_security::Client &,
+               const santa::santad::event_providers::endpoint_security::Message &msg,
+               es_auth_result_t result, bool cache));
+  MOCK_METHOD(bool, RespondFlagsResult,
+              (const santa::santad::event_providers::endpoint_security::Client &client,
+               const santa::santad::event_providers::endpoint_security::Message &msg,
+               uint32_t allowed_flags, bool cache));
+
+  MOCK_METHOD(bool, MuteProcess,
+              (const santa::santad::event_providers::endpoint_security::Client &,
+               const audit_token_t *tok));
+
+  MOCK_METHOD(bool, ClearCache,
+              (const santa::santad::event_providers::endpoint_security::Client &));
+
+  MOCK_METHOD(uint32_t, ExecArgCount, (const es_event_exec_t *event));
+  MOCK_METHOD(es_string_token_t, ExecArg, (const es_event_exec_t *event, uint32_t index));
+
+  MOCK_METHOD(uint32_t, ExecEnvCount, (const es_event_exec_t *event));
+  MOCK_METHOD(es_string_token_t, ExecEnv, (const es_event_exec_t *event, uint32_t index));
+
+  MOCK_METHOD(uint32_t, ExecFDCount, (const es_event_exec_t *event));
+  MOCK_METHOD(const es_fd_t *, ExecFD, (const es_event_exec_t *event, uint32_t index));
+
+  void SetExpectationsESNewClient() {
+    EXPECT_CALL(*this, NewClient)
+      .WillOnce(testing::Return(santa::santad::event_providers::endpoint_security::Client(
+        nullptr, ES_NEW_CLIENT_RESULT_SUCCESS)));
+    EXPECT_CALL(*this, MuteProcess).WillOnce(testing::Return(true));
+    EXPECT_CALL(*this, ClearCache).WillRepeatedly(testing::Return(true));
+    EXPECT_CALL(*this, Subscribe).WillRepeatedly(testing::Return(true));
+  }
+
+  void SetExpectationsRetainReleaseMessage() {
+    EXPECT_CALL(*this, ReleaseMessage).Times(testing::AnyNumber());
+    EXPECT_CALL(*this, RetainMessage).Times(testing::AnyNumber());
+  }
+};
+
+#endif

Source/santad/EventProviders/EndpointSecurityTestUtil.h

@@ -1,104 +0,0 @@
-/// Copyright 2021 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <EndpointSecurity/EndpointSecurity.h>
-#include <Foundation/Foundation.h>
-#include <bsm/libbsm.h>
-
-CF_EXTERN_C_BEGIN
-es_string_token_t MakeStringToken(const NSString *_Nonnull s);
-
-es_file_t MakeESFile(const char *_Nonnull path);
-es_process_t MakeESProcess(es_file_t *_Nonnull esFile);
-es_message_t MakeESMessage(es_event_type_t eventType, es_process_t *_Nonnull instigator,
-                           struct timespec ts);
-CF_EXTERN_C_END
-
-@class ESMessage;
-typedef void (^ESMessageBuilderBlock)(ESMessage *_Nonnull builder);
-
-// An ObjC builder wrapper around es_message_t
-@interface ESMessage : NSObject
-@property(nonatomic, readwrite, strong) NSString *_Nullable binaryPath;
-@property(nonatomic, readwrite) es_file_t *_Nonnull executable;
-@property(nonatomic, readwrite) es_process_t *_Nonnull process;
-@property(nonatomic, readwrite) es_message_t *_Nonnull message;
-@property(nonatomic, readonly) pid_t pid;
-
-- (instancetype _Nonnull)initWithBlock:(ESMessageBuilderBlock _Nullable)block
-  NS_DESIGNATED_INITIALIZER;
-@end
-
-@interface ESResponse : NSObject
-@property(nonatomic) es_auth_result_t result;
-@property(nonatomic) bool shouldCache;
-@end
-
-typedef void (^ESCallback)(ESResponse *_Nonnull);
-
-// Singleton wrapper around all of the kernel-level EndpointSecurity framework functions.
-@interface MockEndpointSecurity : NSObject
-@property NSMutableArray *_Nonnull subscriptions;
-- (void)reset;
-- (void)registerResponseCallback:(es_event_type_t)t withCallback:(ESCallback _Nonnull)callback;
-- (void)triggerHandler:(es_message_t *_Nonnull)msg;
-
-///  Retrieve an initialized singleton MockEndpointSecurity object
-+ (instancetype _Nonnull)mockEndpointSecurity;
-@end
-
-API_UNAVAILABLE(ios, tvos, watchos)
-es_message_t *_Nullable es_copy_message(const es_message_t *_Nonnull msg);
-
-API_UNAVAILABLE(ios, tvos, watchos)
-void es_free_message(es_message_t *_Nonnull msg);
-
-API_AVAILABLE(macos(10.15))
-API_UNAVAILABLE(ios, tvos, watchos)
-es_new_client_result_t es_new_client(es_client_t *_Nullable *_Nonnull client,
-                                     es_handler_block_t _Nonnull handler);
-
-API_AVAILABLE(macos(10.15)) API_UNAVAILABLE(ios, tvos, watchos)
-es_return_t es_mute_process(es_client_t * _Nonnull client,
-                            const audit_token_t * _Nonnull audit_token);
-
-#if defined(MAC_OS_VERSION_12_0) && MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_12_0
-API_AVAILABLE(macos(12.0))
-API_UNAVAILABLE(ios, tvos, watchos)
-es_return_t es_muted_paths_events(es_client_t *_Nonnull client,
-                                  es_muted_paths_t *_Nonnull *_Nullable muted_paths);
-
-API_AVAILABLE(macos(12.0))
-API_UNAVAILABLE(ios, tvos, watchos)
-void es_release_muted_paths(es_muted_paths_t *_Nonnull muted_paths);
-#endif
-
-API_AVAILABLE(macos(10.15))
-API_UNAVAILABLE(ios, tvos, watchos)
-es_respond_result_t es_respond_auth_result(es_client_t *_Nonnull client,
-                                           const es_message_t *_Nonnull message,
-                                           es_auth_result_t result, bool cache);
-
-API_AVAILABLE(macos(10.15))
-API_UNAVAILABLE(ios, tvos, watchos)
-es_return_t es_subscribe(es_client_t *_Nonnull client, const es_event_type_t *_Nonnull events,
-                         uint32_t event_count);
-
-API_AVAILABLE(macos(10.15))
-API_UNAVAILABLE(ios, tvos, watchos) es_return_t es_delete_client(es_client_t *_Nullable client);
-
-API_AVAILABLE(macos(10.15))
-API_UNAVAILABLE(ios, tvos, watchos)
-es_return_t es_unsubscribe(es_client_t *_Nonnull client, const es_event_type_t *_Nonnull events,
-                           uint32_t event_count);