Add kSyncEnableCleanSyncEventUpload to the _forcedConfigKeyTypes dict (#1123)

* Add kSyncEnableCleanSyncEventUpload to the _forcedConfigTypes dict.

* Add KVO helper.

---------

Co-authored-by: Russell Hancox <russellhancox@users.noreply.github.com>

.bazelrc

@@ -3,6 +3,10 @@ build --apple_generate_dsym --define=apple.propagate_embedded_extra_outputs=yes
 build --copt=-Werror
 build --copt=-Wall
 build --copt=-Wno-error=deprecated-declarations
+# Disable -Wunknown-warning-option because deprecated-non-prototype
+# isn't recognized on older SDKs
+build --copt=-Wno-unknown-warning-option
+build --copt=-Wno-error=deprecated-non-prototype
 build --per_file_copt=.*\.mm\$@-std=c++17
 build --cxxopt=-std=c++17
 

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-11, macos-12]
+        os: [macos-11, macos-12, macos-13]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3
@@ -35,7 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-11, macos-12]
+        os: [macos-11, macos-12, macos-13]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3

Conf/Package/notarization_tool.sh

@@ -2,5 +2,5 @@
 
 # Example NOTARIZATION_TOOL wrapper.
 
-/usr/bin/xcrun altool --notarize-app "${2}" --primary-bundle-id "${4}" \
-  -u "${NOTARIZATION_USERNAME}" -p "${NOTARIZATION_PASSWORD}"
+/usr/bin/xcrun notarytool submit "${2}" --wait \
+  --apple-id "${NOTARIZATION_USERNAME}" --password "${NOTARIZATION_PASSWORD}"

Conf/Package/package_and_sign.sh

@@ -28,8 +28,6 @@
 # tool around the tool to use for notarization. The tool must take 2 flags:
 #    --file
 #        - pointing at a zip file containing the artifact to notarize
-#    --primary-bundle-id
-#        - specifying the CFBundleID of the artifact being notarized
 [[ -n "${NOTARIZATION_TOOL}" ]] || die "NOTARIZATION_TOOL unset"
 
 # ARTIFACTS_DIR is a required environment variable pointing at a directory to
@@ -92,7 +90,7 @@ for ARTIFACT in "${INPUT_SYSX}" "${INPUT_APP}"; do
 
   echo "notarizing ${BN}"
   PBID=$(/usr/bin/defaults read "${ARTIFACT}/Contents/Info.plist" CFBundleIdentifier)
-  "${NOTARIZATION_TOOL}" --file "${SCRATCH}/${BN}.zip" --primary-bundle-id "${PBID}"
+  "${NOTARIZATION_TOOL}" --file "${SCRATCH}/${BN}.zip"
 done
 
 # Staple the App.
@@ -166,8 +164,7 @@ echo "verifying pkg signature"
 /usr/sbin/pkgutil --check-signature "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg" || die "bad pkg signature"
 
 echo "notarizing pkg"
-"${NOTARIZATION_TOOL}" --file "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg" \
-    --primary-bundle-id "com.google.santa"
+"${NOTARIZATION_TOOL}" --file "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg"
 
 echo "stapling pkg"
 /usr/bin/xcrun stapler staple "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg" || die "failed to staple pkg"
@@ -179,7 +176,7 @@ echo "wrapping pkg in dmg"
     -srcfolder "${SCRATCH}/${RELEASE_NAME}/" "${DMG_PATH}" || die "failed to wrap pkg in dmg"
 
 echo "notarizing dmg"
-"${NOTARIZATION_TOOL}" --file "${DMG_PATH}" --primary-bundle-id "com.google.santa"
+"${NOTARIZATION_TOOL}" --file "${DMG_PATH}"
 
 echo "stapling dmg"
 /usr/bin/xcrun stapler staple "${DMG_PATH}" || die "failed to staple dmg"

SECURITY.md

@@ -1,12 +1,14 @@
 # Reporting a Vulnerability
 
-If you believe you have found a security vulnerability, we would appreciate private disclosure
-so that we can work on a fix before disclosure. Any vulnerabilities reported to us will be
+If you believe you have found a security vulnerability, we would appreciate a private report
+so that we can work on and release a fix before public disclosure. Any vulnerabilities reported to us will be
 disclosed publicly either when a new version with fixes is released or 90 days has passed,
 whichever comes first.
 
-To report vulnerabilities to us privately, please e-mail `santa-team@google.com`.
-If you want to encrypt your e-mail, you can use our GPG key `0x92AFE41DAB49BBB6`
-available on keyserver.ubuntu.com:
+To report vulnerabilities to us privately, either:
 
-`gpg --keyserver keyserver.ubuntu.com --recv-key 0x92AFE41DAB49BBB6`
+1) Report the vulnerability [through GitHub](https://github.com/google/santa/security/advisories/new).
+
+2) E-mail `santa-team@google.com`. If you want to encrypt your e-mail, you can use our GPG key `0x92AFE41DAB49BBB6` available on keyserver.ubuntu.com:
+
+    `gpg --keyserver keyserver.ubuntu.com --recv-key 0x92AFE41DAB49BBB6`

Source/common/BUILD

@@ -133,6 +133,19 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "SNTFileAccessEvent",
+    srcs = ["SNTFileAccessEvent.m"],
+    hdrs = ["SNTFileAccessEvent.h"],
+    module_name = "santa_common_SNTFileAccessEvent",
+    sdk_frameworks = [
+        "Foundation",
+    ],
+    deps = [
+        "@MOLCertificate",
+    ],
+)
+
 objc_library(
     name = "SNTCommonEnums",
     textual_hdrs = ["SNTCommonEnums.h"],

Source/common/SNTCachedDecision.h

@@ -29,6 +29,7 @@
 
 @property SantaVnode vnodeId;
 @property SNTEventState decision;
+@property SNTClientMode decisionClientMode;
 @property NSString *decisionExtra;
 @property NSString *sha256;
 
@@ -36,6 +37,7 @@
 @property NSString *certCommonName;
 @property NSArray<MOLCertificate *> *certChain;
 @property NSString *teamID;
+@property NSString *signingID;
 
 @property NSString *quarantineURL;
 

Source/common/SNTCommonEnums.h

@@ -36,12 +36,20 @@ typedef NS_ENUM(NSInteger, SNTAction) {
 #define RESPONSE_VALID(x) \
   (x == SNTActionRespondAllow || x == SNTActionRespondDeny || x == SNTActionRespondAllowCompiler)
 
+// Supported Rule Types
+//
+// Note: These enum values should be in order of decreasing precedence as
+// evaluated by Santa. When adding new enum values, leave some space so that
+// additional rules can be added without violating this. The ordering isn't
+// strictly necessary but improves readability and may preemptively prevent
+// issues should SQLite behavior change.
 typedef NS_ENUM(NSInteger, SNTRuleType) {
-  SNTRuleTypeUnknown,
+  SNTRuleTypeUnknown = 0,
 
-  SNTRuleTypeBinary = 1,
-  SNTRuleTypeCertificate = 2,
-  SNTRuleTypeTeamID = 3,
+  SNTRuleTypeBinary = 1000,
+  SNTRuleTypeSigningID = 2000,
+  SNTRuleTypeCertificate = 3000,
+  SNTRuleTypeTeamID = 4000,
 };
 
 typedef NS_ENUM(NSInteger, SNTRuleState) {
@@ -63,32 +71,34 @@ typedef NS_ENUM(NSInteger, SNTClientMode) {
   SNTClientModeLockdown = 2,
 };
 
-typedef NS_ENUM(NSInteger, SNTEventState) {
+typedef NS_ENUM(uint64_t, SNTEventState) {
   // Bits 0-15 bits store non-decision types
   SNTEventStateUnknown = 0,
   SNTEventStateBundleBinary = 1,
 
-  // Bits 16-23 store deny decision types
-  SNTEventStateBlockUnknown = 1 << 16,
-  SNTEventStateBlockBinary = 1 << 17,
-  SNTEventStateBlockCertificate = 1 << 18,
-  SNTEventStateBlockScope = 1 << 19,
-  SNTEventStateBlockTeamID = 1 << 20,
-  SNTEventStateBlockLongPath = 1 << 21,
+  // Bits 16-39 store deny decision types
+  SNTEventStateBlockUnknown = 1ULL << 16,
+  SNTEventStateBlockBinary = 1ULL << 17,
+  SNTEventStateBlockCertificate = 1ULL << 18,
+  SNTEventStateBlockScope = 1ULL << 19,
+  SNTEventStateBlockTeamID = 1ULL << 20,
+  SNTEventStateBlockLongPath = 1ULL << 21,
+  SNTEventStateBlockSigningID = 1ULL << 22,
 
-  // Bits 24-31 store allow decision types
-  SNTEventStateAllowUnknown = 1 << 24,
-  SNTEventStateAllowBinary = 1 << 25,
-  SNTEventStateAllowCertificate = 1 << 26,
-  SNTEventStateAllowScope = 1 << 27,
-  SNTEventStateAllowCompiler = 1 << 28,
-  SNTEventStateAllowTransitive = 1 << 29,
-  SNTEventStateAllowPendingTransitive = 1 << 30,
-  SNTEventStateAllowTeamID = 1 << 31,
+  // Bits 40-63 store allow decision types
+  SNTEventStateAllowUnknown = 1ULL << 40,
+  SNTEventStateAllowBinary = 1ULL << 41,
+  SNTEventStateAllowCertificate = 1ULL << 42,
+  SNTEventStateAllowScope = 1ULL << 43,
+  SNTEventStateAllowCompiler = 1ULL << 44,
+  SNTEventStateAllowTransitive = 1ULL << 45,
+  SNTEventStateAllowPendingTransitive = 1ULL << 46,
+  SNTEventStateAllowTeamID = 1ULL << 47,
+  SNTEventStateAllowSigningID = 1ULL << 48,
 
   // Block and Allow masks
-  SNTEventStateBlock = 0xFF << 16,
-  SNTEventStateAllow = 0xFF << 24
+  SNTEventStateBlock = 0xFFFFFFULL << 16,
+  SNTEventStateAllow = 0xFFFFFFULL << 40,
 };
 
 typedef NS_ENUM(NSInteger, SNTRuleTableError) {
@@ -111,6 +121,7 @@ typedef NS_ENUM(NSInteger, SNTEventLogType) {
   SNTEventLogTypeSyslog,
   SNTEventLogTypeFilelog,
   SNTEventLogTypeProtobuf,
+  SNTEventLogTypeJSON,
   SNTEventLogTypeNull,
 };
 

Source/common/SNTConfigurator.m

@@ -194,6 +194,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kModeNotificationLockdown : string,
       kStaticRules : array,
       kSyncBaseURLKey : string,
+      kSyncEnableCleanSyncEventUpload : number,
       kSyncProxyConfigKey : dictionary,
       kClientAuthCertificateFileKey : string,
       kClientAuthCertificatePasswordKey : string,
@@ -314,6 +315,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingEnableCleanSyncEventUpload {
+  return [self configStateSet];
+}
+
 + (NSSet *)keyPathsForValuesAffectingEnablePageZeroProtection {
   return [self configStateSet];
 }
@@ -794,6 +799,8 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
     return SNTEventLogTypeSyslog;
   } else if ([logType isEqualToString:@"null"]) {
     return SNTEventLogTypeNull;
+  } else if ([logType isEqualToString:@"json"]) {
+    return SNTEventLogTypeJSON;
   } else if ([logType isEqualToString:@"file"]) {
     return SNTEventLogTypeFilelog;
   } else {

Source/common/SNTFileAccessEvent.h

@@ -0,0 +1,83 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+#import <MOLCertificate/MOLCertificate.h>
+
+///
+///  Represents an event stored in the database.
+///
+@interface SNTFileAccessEvent : NSObject <NSSecureCoding>
+
+///
+/// The watched path that was accessed
+///
+@property NSString *accessedPath;
+
+///
+/// The rule version and name that were violated
+///
+@property NSString *ruleVersion;
+@property NSString *ruleName;
+
+///
+/// The SHA256 of the process that accessed the path
+///
+@property NSString *fileSHA256;
+
+///
+/// The path of the process that accessed the watched path
+///
+@property NSString *filePath;
+
+///
+/// If the process is part of a bundle, the name of the application
+///
+@property NSString *application;
+
+///
+/// If the executed file was signed, this is the Team ID if present in the signature information.
+///
+@property NSString *teamID;
+
+///
+/// If the executed file was signed, this is the Signing ID if present in the signature information.
+///
+@property NSString *signingID;
+
+///
+///  The user who executed the binary.
+///
+@property NSString *executingUser;
+
+///
+///  The process ID of the binary being executed.
+///
+@property NSNumber *pid;
+
+///
+///  The parent process ID of the binary being executed.
+///
+@property NSNumber *ppid;
+
+///
+///  The name of the parent process.
+///
+@property NSString *parentName;
+
+// TODO(mlw): Store signing chain info
+// @property NSArray<MOLCertificate*> *signingChain;
+
+@end

Source/common/SNTFileAccessEvent.m

@@ -0,0 +1,79 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/SNTFileAccessEvent.h"
+
+@implementation SNTFileAccessEvent
+
+#define ENCODE(o)                               \
+  do {                                          \
+    if (self.o) {                               \
+      [coder encodeObject:self.o forKey:@(#o)]; \
+    }                                           \
+  } while (0)
+
+#define DECODE(o, c)                                             \
+  do {                                                           \
+    _##o = [decoder decodeObjectOfClass:[c class] forKey:@(#o)]; \
+  } while (0)
+
+- (instancetype)init {
+  self = [super init];
+  if (self) {
+  }
+  return self;
+}
+
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
+
+- (void)encodeWithCoder:(NSCoder *)coder {
+  ENCODE(accessedPath);
+  ENCODE(ruleVersion);
+  ENCODE(ruleName);
+  ENCODE(fileSHA256);
+  ENCODE(filePath);
+  ENCODE(application);
+  ENCODE(teamID);
+  ENCODE(teamID);
+  ENCODE(pid);
+  ENCODE(ppid);
+  ENCODE(parentName);
+}
+
+- (instancetype)initWithCoder:(NSCoder *)decoder {
+  self = [super init];
+  if (self) {
+    DECODE(accessedPath, NSString);
+    DECODE(ruleVersion, NSString);
+    DECODE(ruleName, NSString);
+    DECODE(fileSHA256, NSString);
+    DECODE(filePath, NSString);
+    DECODE(application, NSString);
+    DECODE(teamID, NSString);
+    DECODE(teamID, NSString);
+    DECODE(pid, NSNumber);
+    DECODE(ppid, NSNumber);
+    DECODE(parentName, NSString);
+  }
+  return self;
+}
+
+- (NSString *)description {
+  return [NSString
+    stringWithFormat:@"SNTFileAccessEvent: Accessed: %@, By: %@", self.accessedPath, self.filePath];
+}
+
+@end

Source/common/SNTRule.m

@@ -100,6 +100,8 @@
     type = SNTRuleTypeCertificate;
   } else if ([ruleTypeString isEqual:kRuleTypeTeamID]) {
     type = SNTRuleTypeTeamID;
+  } else if ([ruleTypeString isEqual:kRuleTypeSigningID]) {
+    type = SNTRuleTypeSigningID;
   } else {
     return nil;
   }

Source/common/SNTStoredEvent.h

@@ -100,6 +100,11 @@
 ///
 @property NSString *teamID;
 
+///
+/// If the executed file was signed, this is the Signing ID if present in the signature information.
+///
+@property NSString *signingID;
+
 ///
 ///  The user who executed the binary.
 ///

Source/common/SNTStoredEvent.m

@@ -50,6 +50,7 @@
 
   ENCODE(self.signingChain, @"signingChain");
   ENCODE(self.teamID, @"teamID");
+  ENCODE(self.signingID, @"signingID");
 
   ENCODE(self.executingUser, @"executingUser");
   ENCODE(self.occurrenceDate, @"occurrenceDate");
@@ -95,10 +96,11 @@
 
     _signingChain = DECODEARRAY(MOLCertificate, @"signingChain");
     _teamID = DECODE(NSString, @"teamID");
+    _signingID = DECODE(NSString, @"signingID");
 
     _executingUser = DECODE(NSString, @"executingUser");
     _occurrenceDate = DECODE(NSDate, @"occurrenceDate");
-    _decision = (SNTEventState)[DECODE(NSNumber, @"decision") intValue];
+    _decision = (SNTEventState)[DECODE(NSNumber, @"decision") unsignedLongLongValue];
     _pid = DECODE(NSNumber, @"pid");
     _ppid = DECODE(NSNumber, @"ppid");
     _parentName = DECODE(NSString, @"parentName");

Source/common/SNTSyncConstants.h

@@ -42,6 +42,7 @@ extern NSString *const kCertificateRuleCount;
 extern NSString *const kCompilerRuleCount;
 extern NSString *const kTransitiveRuleCount;
 extern NSString *const kTeamIDRuleCount;
+extern NSString *const kSigningIDRuleCount;
 extern NSString *const kFullSyncInterval;
 extern NSString *const kFCMToken;
 extern NSString *const kFCMFullSyncInterval;
@@ -66,11 +67,13 @@ extern NSString *const kDecisionAllowBinary;
 extern NSString *const kDecisionAllowCertificate;
 extern NSString *const kDecisionAllowScope;
 extern NSString *const kDecisionAllowTeamID;
+extern NSString *const kDecisionAllowSigningID;
 extern NSString *const kDecisionBlockUnknown;
 extern NSString *const kDecisionBlockBinary;
 extern NSString *const kDecisionBlockCertificate;
 extern NSString *const kDecisionBlockScope;
 extern NSString *const kDecisionBlockTeamID;
+extern NSString *const kDecisionBlockSigningID;
 extern NSString *const kDecisionUnknown;
 extern NSString *const kDecisionBundleBinary;
 extern NSString *const kLoggedInUsers;
@@ -95,6 +98,7 @@ extern NSString *const kCertOU;
 extern NSString *const kCertValidFrom;
 extern NSString *const kCertValidUntil;
 extern NSString *const kTeamID;
+extern NSString *const kSigningID;
 extern NSString *const kQuarantineDataURL;
 extern NSString *const kQuarantineRefererURL;
 extern NSString *const kQuarantineTimestamp;
@@ -118,6 +122,7 @@ extern NSString *const kRuleType;
 extern NSString *const kRuleTypeBinary;
 extern NSString *const kRuleTypeCertificate;
 extern NSString *const kRuleTypeTeamID;
+extern NSString *const kRuleTypeSigningID;
 extern NSString *const kRuleCustomMsg;
 extern NSString *const kCursor;
 

Source/common/SNTSyncConstants.m

@@ -42,6 +42,7 @@ NSString *const kCertificateRuleCount = @"certificate_rule_count";
 NSString *const kCompilerRuleCount = @"compiler_rule_count";
 NSString *const kTransitiveRuleCount = @"transitive_rule_count";
 NSString *const kTeamIDRuleCount = @"teamid_rule_count";
+NSString *const kSigningIDRuleCount = @"signingid_rule_count";
 NSString *const kFullSyncInterval = @"full_sync_interval";
 NSString *const kFCMToken = @"fcm_token";
 NSString *const kFCMFullSyncInterval = @"fcm_full_sync_interval";
@@ -67,11 +68,13 @@ NSString *const kDecisionAllowBinary = @"ALLOW_BINARY";
 NSString *const kDecisionAllowCertificate = @"ALLOW_CERTIFICATE";
 NSString *const kDecisionAllowScope = @"ALLOW_SCOPE";
 NSString *const kDecisionAllowTeamID = @"ALLOW_TEAMID";
+NSString *const kDecisionAllowSigningID = @"ALLOW_SIGNINGID";
 NSString *const kDecisionBlockUnknown = @"BLOCK_UNKNOWN";
 NSString *const kDecisionBlockBinary = @"BLOCK_BINARY";
 NSString *const kDecisionBlockCertificate = @"BLOCK_CERTIFICATE";
 NSString *const kDecisionBlockScope = @"BLOCK_SCOPE";
 NSString *const kDecisionBlockTeamID = @"BLOCK_TEAMID";
+NSString *const kDecisionBlockSigningID = @"BLOCK_SIGNINGID";
 NSString *const kDecisionUnknown = @"UNKNOWN";
 NSString *const kDecisionBundleBinary = @"BUNDLE_BINARY";
 NSString *const kLoggedInUsers = @"logged_in_users";
@@ -96,6 +99,7 @@ NSString *const kCertOU = @"ou";
 NSString *const kCertValidFrom = @"valid_from";
 NSString *const kCertValidUntil = @"valid_until";
 NSString *const kTeamID = @"team_id";
+NSString *const kSigningID = @"signing_id";
 NSString *const kQuarantineDataURL = @"quarantine_data_url";
 NSString *const kQuarantineRefererURL = @"quarantine_referer_url";
 NSString *const kQuarantineTimestamp = @"quarantine_timestamp";
@@ -119,6 +123,7 @@ NSString *const kRuleType = @"rule_type";
 NSString *const kRuleTypeBinary = @"BINARY";
 NSString *const kRuleTypeCertificate = @"CERTIFICATE";
 NSString *const kRuleTypeTeamID = @"TEAMID";
+NSString *const kRuleTypeSigningID = @"SIGNINGID";
 NSString *const kRuleCustomMsg = @"custom_msg";
 NSString *const kCursor = @"cursor";
 

Source/common/SNTXPCControlInterface.h

@@ -35,6 +35,7 @@
 - (void)databaseRuleForBinarySHA256:(NSString *)binarySHA256
                   certificateSHA256:(NSString *)certificateSHA256
                              teamID:(NSString *)teamID
+                          signingID:(NSString *)signingID
                               reply:(void (^)(SNTRule *))reply;
 
 ///

Source/common/SNTXPCNotifierInterface.h

@@ -17,13 +17,16 @@
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTXPCBundleServiceInterface.h"
 
-@class SNTStoredEvent;
 @class SNTDeviceEvent;
+@class SNTFileAccessEvent;
+@class SNTStoredEvent;
 
 /// Protocol implemented by SantaGUI and utilized by santad
 @protocol SNTNotifierXPC
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
 - (void)postUSBBlockNotification:(SNTDeviceEvent *)event withCustomMessage:(NSString *)message;
+- (void)postFileAccessBlockNotification:(SNTFileAccessEvent *)event
+                      withCustomMessage:(NSString *)message API_AVAILABLE(macos(13.0));
 - (void)postClientModeNotification:(SNTClientMode)clientmode;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
 - (void)updateCountsForEvent:(SNTStoredEvent *)event

Source/common/SNTXPCUnprivilegedControlInterface.h

@@ -37,7 +37,7 @@
 ///  Database ops
 ///
 - (void)databaseRuleCounts:(void (^)(int64_t binary, int64_t certificate, int64_t compiler,
-                                     int64_t transitive, int64_t teamID))reply;
+                                     int64_t transitive, int64_t teamID, int64_t signingID))reply;
 - (void)databaseEventCount:(void (^)(int64_t count))reply;
 - (void)staticRuleCount:(void (^)(int64_t count))reply;
 
@@ -57,6 +57,7 @@
                  fileSHA256:(NSString *)fileSHA256
           certificateSHA256:(NSString *)certificateSHA256
                      teamID:(NSString *)teamID
+                  signingID:(NSString *)signingID
                       reply:(void (^)(SNTEventState))reply;
 
 ///

Source/common/String.h

@@ -30,6 +30,14 @@ static inline std::string NSStringToUTF8String(NSString *str) {
   return std::string(str.UTF8String, [str lengthOfBytesUsingEncoding:NSUTF8StringEncoding]);
 }
 
+static inline NSString *StringToNSString(const std::string &str) {
+  return [NSString stringWithUTF8String:str.c_str()];
+}
+
+static inline NSString *StringToNSString(const char *str) {
+  return [NSString stringWithUTF8String:str];
+}
+
 }  // namespace santa::common
 
 #endif

Source/common/TestUtils.h

@@ -38,9 +38,12 @@
 // Pretty print C++ string match errors
 #define XCTAssertCppStringEqual(got, want) XCTAssertCStringEqual((got).c_str(), (want).c_str())
 
+// Note: Delta between local formatter and the one run on Github. Disable for now.
+// clang-format off
 #define XCTAssertSemaTrue(s, sec, m) \
   XCTAssertEqual(                    \
-    0, dispatch_semaphore_wait((s), dispatch_time(DISPATCH_TIME_NOW, (sec)*NSEC_PER_SEC)), m)
+    0, dispatch_semaphore_wait((s), dispatch_time(DISPATCH_TIME_NOW, (sec) * NSEC_PER_SEC)), m)
+// clang-format on
 
 // Helper to ensure at least `ms` milliseconds are slept, even if the sleep
 // function returns early due to interrupts.

Source/common/santa.proto

@@ -262,6 +262,7 @@ message Execution {
     REASON_TRANSITIVE = 8;
     REASON_LONG_PATH = 9;
     REASON_NOT_RUNNING = 10;
+    REASON_SIGNING_ID = 11;
   }
   optional Reason reason = 10;
 

Source/gui/BUILD

@@ -31,6 +31,17 @@ swift_library(
     ],
 )
 
+swift_library(
+    name = "SNTFileAccessMessageWindowView",
+    srcs = [
+        "SNTFileAccessMessageWindowView.swift",
+    ],
+    generates_header = 1,
+    deps = [
+        "//Source/common:SNTFileAccessEvent",
+    ],
+)
+
 objc_library(
     name = "SantaGUI_lib",
     srcs = [
@@ -44,6 +55,8 @@ objc_library(
         "SNTBinaryMessageWindowController.m",
         "SNTDeviceMessageWindowController.h",
         "SNTDeviceMessageWindowController.m",
+        "SNTFileAccessMessageWindowController.h",
+        "SNTFileAccessMessageWindowController.m",
         "SNTMessageWindowController.h",
         "SNTMessageWindowController.m",
         "SNTNotificationManager.h",
@@ -65,9 +78,11 @@ objc_library(
     deps = [
         ":SNTAboutWindowView",
         ":SNTDeviceMessageWindowView",
+        ":SNTFileAccessMessageWindowView",
         "//Source/common:SNTBlockMessage_SantaGUI",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTDeviceEvent",
+        "//Source/common:SNTFileAccessEvent",
         "//Source/common:SNTLogging",
         "//Source/common:SNTStoredEvent",
         "//Source/common:SNTStrengthify",

Source/gui/SNTDeviceMessageWindowView.swift

@@ -1,3 +1,17 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
 import SwiftUI
 
 import santa_common_SNTConfigurator

Source/gui/SNTFileAccessMessageWindowController.h

@@ -0,0 +1,35 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Cocoa/Cocoa.h>
+
+#import "Source/gui/SNTMessageWindowController.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@class SNTFileAccessEvent;
+
+///
+///  Controller for a single message window.
+///
+API_AVAILABLE(macos(13.0))
+@interface SNTFileAccessMessageWindowController : SNTMessageWindowController <NSWindowDelegate>
+
+- (instancetype)initWithEvent:(SNTFileAccessEvent *)event message:(nullable NSString *)message;
+
+@property(readonly) SNTFileAccessEvent *event;
+
+@end
+
+NS_ASSUME_NONNULL_END

Source/gui/SNTFileAccessMessageWindowController.m

@@ -0,0 +1,79 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/gui/SNTFileAccessMessageWindowController.h"
+#import "Source/gui/SNTFileAccessMessageWindowView-Swift.h"
+
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTFileAccessEvent.h"
+#import "Source/common/SNTLogging.h"
+
+@interface SNTFileAccessMessageWindowController ()
+@property NSString *customMessage;
+@property SNTFileAccessEvent *event;
+@end
+
+@implementation SNTFileAccessMessageWindowController
+
+- (instancetype)initWithEvent:(SNTFileAccessEvent *)event message:(nullable NSString *)message {
+  self = [super init];
+  if (self) {
+    _customMessage = message;
+    _event = event;
+  }
+  return self;
+}
+
+- (void)showWindow:(id)sender {
+  if (self.window) {
+    [self.window orderOut:sender];
+  }
+
+  self.window =
+    [[NSWindow alloc] initWithContentRect:NSMakeRect(0, 0, 0, 0)
+                                styleMask:NSWindowStyleMaskClosable | NSWindowStyleMaskTitled
+                                  backing:NSBackingStoreBuffered
+                                    defer:NO];
+
+  self.window.contentViewController =
+    [SNTFileAccessMessageWindowViewFactory createWithWindow:self.window
+                                                      event:self.event
+                                                  customMsg:self.attributedCustomMessage];
+
+  self.window.delegate = self;
+
+  // Add app to Cmd+Tab and Dock.
+  NSApp.activationPolicy = NSApplicationActivationPolicyRegular;
+
+  [super showWindow:sender];
+}
+
+- (void)windowWillClose:(NSNotification *)notification {
+  // Remove app from Cmd+Tab and Dock.
+  NSApp.activationPolicy = NSApplicationActivationPolicyAccessory;
+  [super windowWillClose:notification];
+}
+
+- (NSAttributedString *)attributedCustomMessage {
+  return [SNTBlockMessage formatMessage:self.customMessage];
+}
+
+- (NSString *)messageHash {
+  // TODO(mlw): This is not the final form. As this feature is expanded this
+  // hash will need to be revisted to ensure it meets our needs.
+  return [NSString stringWithFormat:@"%@|%@|%d", self.event.ruleName, self.event.ruleVersion,
+                                    [self.event.pid intValue]];
+}
+
+@end

Source/gui/SNTFileAccessMessageWindowView.swift

@@ -0,0 +1,158 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+import SwiftUI
+
+import santa_common_SNTFileAccessEvent
+
+@available(macOS 13, *)
+@objc public class SNTFileAccessMessageWindowViewFactory : NSObject {
+  @objc public static func createWith(window: NSWindow, event: SNTFileAccessEvent, customMsg: NSAttributedString?) -> NSViewController {
+    return NSHostingController(rootView:SNTFileAccessMessageWindowView(window:window, event:event, customMsg:customMsg)
+      .frame(width:800, height:600))
+  }
+}
+
+@available(macOS 13, *)
+struct Property : View {
+  var lbl: String
+  var val: String
+
+  var body: some View {
+    let width: CGFloat? = 150
+
+    HStack(spacing: 5) {
+      Text(lbl + ":")
+        .frame(width: width, alignment: .trailing)
+        .lineLimit(1)
+        .font(.system(size: 12, weight: .bold))
+        .padding(Edge.Set.horizontal, 10)
+
+      Text(val)
+        .fixedSize(horizontal: false, vertical: true)
+        .frame(minWidth: 0, maxWidth: .infinity, alignment: .leading)
+    }
+
+  }
+}
+
+@available(macOS 13, *)
+struct Event: View {
+  let e: SNTFileAccessEvent
+
+  var body: some View {
+    VStack(spacing:10) {
+      Property(lbl: "Path Accessed", val: e.accessedPath)
+      Property(lbl: "Rule Name", val: e.ruleName)
+      Property(lbl: "Rule Version", val: e.ruleVersion)
+
+      Divider()
+        .frame(width: 700)
+
+      if let app = e.application {
+        Property(lbl: "Application", val: app)
+      }
+
+      Property(lbl: "Name", val: (e.filePath as NSString).lastPathComponent)
+      Property(lbl: "Path", val: e.filePath)
+      Property(lbl: "Identifier", val: e.fileSHA256)
+      Property(lbl: "Parent", val: e.parentName + " (" + e.ppid.stringValue + ")")
+    }
+  }
+}
+
+@available(macOS 13, *)
+struct SNTFileAccessMessageWindowView: View {
+  let window: NSWindow?
+  let event: SNTFileAccessEvent?
+  let customMsg: NSAttributedString?
+
+  @State private var checked = false
+
+  var body: some View {
+    VStack(spacing:20.0) {
+      Spacer()
+      Text("Santa").font(Font.custom("HelveticaNeue-UltraLight", size: 34.0))
+
+      if let msg = customMsg {
+        Text(AttributedString(msg)).multilineTextAlignment(.center).padding(15.0)
+      } else {
+        Text("Access to a protected resource was denied.").multilineTextAlignment(.center).padding(15.0)
+      }
+
+      Event(e: event!)
+
+      Toggle(isOn: $checked) {
+        Text("Prevent future notifications for this application for a day")
+          .font(Font.system(size: 11.0));
+      }
+
+      VStack(spacing:15) {
+          Button(action: openButton, label: {
+            Text("Open Event Info...").frame(maxWidth:.infinity)
+          })
+          Button(action: dismissButton, label: {
+            Text("Dismiss").frame(maxWidth:.infinity)
+          })
+          .keyboardShortcut(.return)
+      }.frame(width: 220)
+
+      Spacer()
+
+    }.frame(maxWidth:800.0).fixedSize()
+  }
+
+  func publisherInfo() {
+    // TODO(mlw): Will hook up in a separate PR
+    print("showing publisher popup...")
+  }
+
+  func openButton() {
+    // TODO(mlw): Will hook up in a separate PR
+    print("opening event info...")
+  }
+
+  func dismissButton() {
+    window?.close()
+    print("close window")
+  }
+}
+
+@available(macOS 13, *)
+func testFileAccessEvent() -> SNTFileAccessEvent {
+  let faaEvent = SNTFileAccessEvent()
+
+  faaEvent.accessedPath = "/accessed/path"
+  faaEvent.ruleVersion = "watched_path.v1"
+  faaEvent.ruleName = "watched_path"
+  faaEvent.fileSHA256 = "b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
+  faaEvent.filePath = "/Applications/gShoe.app/Contents/MacOS/gShoe"
+  faaEvent.application = "gShoe"
+  faaEvent.teamID = "EQHXZ8M8AV"
+  faaEvent.signingID = "com.google.gShoe"
+  faaEvent.executingUser = "nobody"
+  faaEvent.pid = 456
+  faaEvent.ppid = 123
+  faaEvent.parentName = "gLauncher"
+
+  return faaEvent
+}
+
+// Enable previews in Xcode.
+@available(macOS 13, *)
+struct SNTFileAccessMessageWindowView_Previews: PreviewProvider {
+  static var previews: some View {
+    SNTFileAccessMessageWindowView(window: nil, event: testFileAccessEvent(), customMsg: nil)
+  }
+}

Source/gui/SNTNotificationManager.h

@@ -15,8 +15,6 @@
 #import <Cocoa/Cocoa.h>
 
 #import "Source/common/SNTXPCNotifierInterface.h"
-#import "Source/gui/SNTBinaryMessageWindowController.h"
-#import "Source/gui/SNTDeviceMessageWindowController.h"
 #import "Source/gui/SNTMessageWindowController.h"
 
 ///

Source/gui/SNTNotificationManager.m

@@ -26,6 +26,9 @@
 #import "Source/common/SNTStrengthify.h"
 #import "Source/common/SNTSyncConstants.h"
 #import "Source/common/SNTXPCControlInterface.h"
+#import "Source/gui/SNTBinaryMessageWindowController.h"
+#import "Source/gui/SNTDeviceMessageWindowController.h"
+#import "Source/gui/SNTFileAccessMessageWindowController.h"
 #import "Source/gui/SNTMessageWindowController.h"
 
 @interface SNTNotificationManager ()
@@ -342,6 +345,19 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
   [self queueMessage:pendingMsg];
 }
 
+- (void)postFileAccessBlockNotification:(SNTFileAccessEvent *)event
+                      withCustomMessage:(NSString *)message API_AVAILABLE(macos(13.0)) {
+  if (!event) {
+    LOGI(@"Error: Missing event object in message received from daemon!");
+    return;
+  }
+
+  SNTFileAccessMessageWindowController *pendingMsg =
+    [[SNTFileAccessMessageWindowController alloc] initWithEvent:event message:message];
+
+  [self queueMessage:pendingMsg];
+}
+
 #pragma mark SNTBundleNotifierXPC protocol methods
 
 - (void)updateCountsForEvent:(SNTStoredEvent *)event

Source/santactl/Commands/SNTCommandFileInfo.m

@@ -42,6 +42,7 @@ static NSString *const kRule = @"Rule";
 static NSString *const kSigningChain = @"Signing Chain";
 static NSString *const kUniversalSigningChain = @"Universal Signing Chain";
 static NSString *const kTeamID = @"Team ID";
+static NSString *const kSigningID = @"Signing ID";
 
 // signing chain keys
 static NSString *const kCommonName = @"Common Name";
@@ -111,6 +112,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);
 @property(readonly, copy, nonatomic) SNTAttributeBlock downloadTimestamp;
 @property(readonly, copy, nonatomic) SNTAttributeBlock downloadAgent;
 @property(readonly, copy, nonatomic) SNTAttributeBlock teamID;
+@property(readonly, copy, nonatomic) SNTAttributeBlock signingID;
 @property(readonly, copy, nonatomic) SNTAttributeBlock type;
 @property(readonly, copy, nonatomic) SNTAttributeBlock pageZero;
 @property(readonly, copy, nonatomic) SNTAttributeBlock codeSigned;
@@ -184,8 +186,8 @@ REGISTER_COMMAND_NAME(@"fileinfo")
 + (NSArray<NSString *> *)fileInfoKeys {
   return @[
     kPath, kSHA256, kSHA1, kBundleName, kBundleVersion, kBundleVersionStr, kDownloadReferrerURL,
-    kDownloadURL, kDownloadTimestamp, kDownloadAgent, kTeamID, kType, kPageZero, kCodeSigned, kRule,
-    kSigningChain, kUniversalSigningChain
+    kDownloadURL, kDownloadTimestamp, kDownloadAgent, kTeamID, kSigningID, kType, kPageZero,
+    kCodeSigned, kRule, kSigningChain, kUniversalSigningChain
   ];
 }
 
@@ -218,6 +220,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
       kSigningChain : self.signingChain,
       kUniversalSigningChain : self.universalSigningChain,
       kTeamID : self.teamID,
+      kSigningID : self.signingID,
     };
 
     _printQueue = dispatch_queue_create("com.google.santactl.print_queue", DISPATCH_QUEUE_SERIAL);
@@ -357,15 +360,34 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
     NSError *err;
     MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:&err];
-    [[cmd.daemonConn remoteObjectProxy]
-      decisionForFilePath:fileInfo.path
-               fileSHA256:fileInfo.SHA256
-        certificateSHA256:err ? nil : csc.leafCertificate.SHA256
-                   teamID:[csc.signingInformation valueForKey:@"teamid"]
-                    reply:^(SNTEventState s) {
-                      state = s;
-                      dispatch_semaphore_signal(sema);
-                    }];
+
+    NSString *teamID =
+      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
+    NSString *identifier =
+      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+
+    NSString *signingID;
+    if (identifier) {
+      if (teamID) {
+        signingID = [NSString stringWithFormat:@"%@:%@", teamID, identifier];
+      } else {
+        id platformID =
+          [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
+        if ([platformID isKindOfClass:[NSNumber class]] && [platformID intValue] != 0) {
+          signingID = [NSString stringWithFormat:@"platform:%@", identifier];
+        }
+      }
+    }
+
+    [[cmd.daemonConn remoteObjectProxy] decisionForFilePath:fileInfo.path
+                                                 fileSHA256:fileInfo.SHA256
+                                          certificateSHA256:err ? nil : csc.leafCertificate.SHA256
+                                                     teamID:teamID
+                                                  signingID:signingID
+                                                      reply:^(SNTEventState s) {
+                                                        state = s;
+                                                        dispatch_semaphore_signal(sema);
+                                                      }];
     if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
       cmd.daemonUnavailable = YES;
       return kCommunicationErrorMsg;
@@ -381,6 +403,8 @@ REGISTER_COMMAND_NAME(@"fileinfo")
         case SNTEventStateBlockCertificate: [output appendString:@" (Certificate)"]; break;
         case SNTEventStateAllowTeamID:
         case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
+        case SNTEventStateAllowSigningID:
+        case SNTEventStateBlockSigningID: [output appendString:@" (SigningID)"]; break;
         case SNTEventStateAllowScope:
         case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
         case SNTEventStateAllowCompiler: [output appendString:@" (Compiler)"]; break;
@@ -473,6 +497,13 @@ REGISTER_COMMAND_NAME(@"fileinfo")
   };
 }
 
+- (SNTAttributeBlock)signingID {
+  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
+    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
+    return [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+  };
+}
+
 #pragma mark -
 
 // Entry point for the command.

Source/santactl/Commands/SNTCommandRule.m

@@ -60,16 +60,28 @@ REGISTER_COMMAND_NAME(@"rule")
           @"                   Will add the hash of the file currently at that path.\n"
           @"                   Does not work with --check. Use the fileinfo verb to check.\n"
           @"                   the rule state of a file.\n"
-          @"    --identifier {sha256|teamID}: identifier to add/remove/check\n"
+          @"    --identifier {sha256|teamID|signingID}: identifier to add/remove/check\n"
           @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
           @"\n"
           @"  Optionally:\n"
           @"    --teamid: add or check a team ID rule instead of binary\n"
+          @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
           @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
 #ifdef DEBUG
           @"    --force: allow manual changes even when SyncBaseUrl is set\n"
 #endif
-          @"    --message {message}: custom message\n");
+          @"    --message {message}: custom message\n"
+          @"\n"
+          @"  Notes:\n"
+          @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
+          @"\n"
+          @"      `TeamID:SigningID`\n"
+          @"\n"
+          @"    Because signing IDs are controlled by the binary author, this ensures\n"
+          @"    that the signing ID is properly scoped to a developer. For the special\n"
+          @"    case of platform binaries, `TeamID` should be replaced with the string\n"
+          @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
+          @"    targeting Apple-signed binaries that do not have a team ID.\n");
 }
 
 - (void)runWithArguments:(NSArray *)arguments {
@@ -116,6 +128,8 @@ REGISTER_COMMAND_NAME(@"rule")
       newRule.type = SNTRuleTypeCertificate;
     } else if ([arg caseInsensitiveCompare:@"--teamid"] == NSOrderedSame) {
       newRule.type = SNTRuleTypeTeamID;
+    } else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {
+      newRule.type = SNTRuleTypeSigningID;
     } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
       if (++i > arguments.count - 1) {
         [self printErrorUsageAndExit:@"--path requires an argument"];
@@ -145,6 +159,22 @@ REGISTER_COMMAND_NAME(@"rule")
     }
   }
 
+  if (path) {
+    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
+    if (!fi.path) {
+      [self printErrorUsageAndExit:@"Provided path was not a plain file"];
+    }
+
+    if (newRule.type == SNTRuleTypeBinary) {
+      newRule.identifier = fi.SHA256;
+    } else if (newRule.type == SNTRuleTypeCertificate) {
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
+      newRule.identifier = cs.leafCertificate.SHA256;
+    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
+      // noop
+    }
+  }
+
   if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) {
     NSCharacterSet *nonHex =
       [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
@@ -159,21 +189,6 @@ REGISTER_COMMAND_NAME(@"rule")
     return [self printStateOfRule:newRule daemonConnection:self.daemonConn];
   }
 
-  if (path) {
-    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
-    if (!fi.path) {
-      [self printErrorUsageAndExit:@"Provided path was not a plain file"];
-    }
-
-    if (newRule.type == SNTRuleTypeBinary) {
-      newRule.identifier = fi.SHA256;
-    } else if (newRule.type == SNTRuleTypeCertificate) {
-      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
-      newRule.identifier = cs.leafCertificate.SHA256;
-    } else if (newRule.type == SNTRuleTypeTeamID) {
-    }
-  }
-
   if (newRule.state == SNTRuleStateUnknown) {
     [self printErrorUsageAndExit:@"No state specified"];
   } else if (!newRule.identifier) {
@@ -220,11 +235,13 @@ REGISTER_COMMAND_NAME(@"rule")
   NSString *fileSHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil;
   NSString *certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil;
   NSString *teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil;
+  NSString *signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil;
   __block NSMutableString *output;
   [rop decisionForFilePath:nil
                 fileSHA256:fileSHA256
          certificateSHA256:certificateSHA256
                     teamID:teamID
+                 signingID:signingID
                      reply:^(SNTEventState s) {
                        output =
                          (SNTEventStateAllow & s) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;
@@ -247,6 +264,10 @@ REGISTER_COMMAND_NAME(@"rule")
                            break;
                          case SNTEventStateAllowTeamID:
                          case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
+                         case SNTEventStateAllowSigningID:
+                         case SNTEventStateBlockSigningID:
+                           [output appendString:@" (SigningID)"];
+                           break;
                          default: output = @"None".mutableCopy; break;
                        }
                        if (isatty(STDOUT_FILENO)) {
@@ -266,6 +287,7 @@ REGISTER_COMMAND_NAME(@"rule")
   [rop databaseRuleForBinarySHA256:fileSHA256
                  certificateSHA256:certificateSHA256
                             teamID:teamID
+                         signingID:signingID
                              reply:^(SNTRule *r) {
                                if (r.state == SNTRuleStateAllowTransitive) {
                                  NSDate *date =

Source/santactl/Commands/SNTCommandStatus.m

@@ -81,13 +81,19 @@ REGISTER_COMMAND_NAME(@"status")
   }];
 
   // Database counts
-  __block int64_t eventCount = -1, binaryRuleCount = -1, certRuleCount = -1, teamIDRuleCount = -1;
-  __block int64_t compilerRuleCount = -1, transitiveRuleCount = -1;
+  __block int64_t eventCount = -1;
+  __block int64_t binaryRuleCount = -1;
+  __block int64_t certRuleCount = -1;
+  __block int64_t teamIDRuleCount = -1;
+  __block int64_t signingIDRuleCount = -1;
+  __block int64_t compilerRuleCount = -1;
+  __block int64_t transitiveRuleCount = -1;
   [rop databaseRuleCounts:^(int64_t binary, int64_t certificate, int64_t compiler,
-                            int64_t transitive, int64_t teamID) {
+                            int64_t transitive, int64_t teamID, int64_t signingID) {
     binaryRuleCount = binary;
     certRuleCount = certificate;
     teamIDRuleCount = teamID;
+    signingIDRuleCount = signingID;
     compilerRuleCount = compiler;
     transitiveRuleCount = transitive;
   }];
@@ -193,6 +199,8 @@ REGISTER_COMMAND_NAME(@"status")
       @"database" : @{
         @"binary_rules" : @(binaryRuleCount),
         @"certificate_rules" : @(certRuleCount),
+        @"teamid_rules" : @(teamIDRuleCount),
+        @"signingid_rules" : @(signingIDRuleCount),
         @"compiler_rules" : @(compilerRuleCount),
         @"transitive_rules" : @(transitiveRuleCount),
         @"events_pending_upload" : @(eventCount),
@@ -258,6 +266,7 @@ REGISTER_COMMAND_NAME(@"status")
     printf("  %-25s | %lld\n", "Binary Rules", binaryRuleCount);
     printf("  %-25s | %lld\n", "Certificate Rules", certRuleCount);
     printf("  %-25s | %lld\n", "TeamID Rules", teamIDRuleCount);
+    printf("  %-25s | %lld\n", "SigningID Rules", signingIDRuleCount);
     printf("  %-25s | %lld\n", "Compiler Rules", compilerRuleCount);
     printf("  %-25s | %lld\n", "Transitive Rules", transitiveRuleCount);
     printf("  %-25s | %lld\n", "Events Pending Upload", eventCount);

Source/santad/BUILD

@@ -209,6 +209,16 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "TTYWriter",
+    srcs = ["TTYWriter.mm"],
+    hdrs = ["TTYWriter.h"],
+    deps = [
+        "//Source/common:SNTLogging",
+        "//Source/common:String",
+    ],
+)
+
 objc_library(
     name = "SNTExecutionController",
     srcs = ["SNTExecutionController.mm"],
@@ -221,6 +231,7 @@ objc_library(
         ":SNTPolicyProcessor",
         ":SNTRuleTable",
         ":SNTSyncdQueue",
+        ":TTYWriter",
         "//Source/common:BranchPrediction",
         "//Source/common:SNTBlockMessage",
         "//Source/common:SNTCachedDecision",
@@ -286,7 +297,9 @@ objc_library(
         ":SNTEndpointSecurityClient",
         ":SNTEndpointSecurityEventHandler",
         "//Source/common:PrefixTree",
+        "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
+        "//Source/common:String",
         "//Source/common:Unit",
     ],
 )
@@ -332,6 +345,9 @@ objc_library(
     name = "SNTEndpointSecurityFileAccessAuthorizer",
     srcs = ["EventProviders/SNTEndpointSecurityFileAccessAuthorizer.mm"],
     hdrs = ["EventProviders/SNTEndpointSecurityFileAccessAuthorizer.h"],
+    sdk_dylibs = [
+        "bsm",
+    ],
     deps = [
         ":EndpointSecurityAPI",
         ":EndpointSecurityEnrichedTypes",
@@ -348,11 +364,13 @@ objc_library(
         "//Source/common:Platform",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SNTFileAccessEvent",
         "//Source/common:SNTMetricSet",
         "//Source/common:SNTStrengthify",
         "//Source/common:SantaCache",
         "//Source/common:SantaVnode",
         "//Source/common:SantaVnodeHash",
+        "//Source/common:String",
         "@MOLCertificate",
         "@MOLCodesignChecker",
     ],
@@ -486,7 +504,6 @@ objc_library(
         ":EndpointSecuritySerializerUtilities",
         ":SNTDecisionCache",
         "//Source/common:SNTCachedDecision",
-        "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
         "//Source/common:SNTStoredEvent",
     ],
@@ -574,6 +591,7 @@ objc_library(
         ":EndpointSecurityWriterNull",
         ":EndpointSecurityWriterSpool",
         ":EndpointSecurityWriterSyslog",
+        ":SNTDecisionCache",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTLogging",
         "//Source/common:SNTStoredEvent",
@@ -678,6 +696,7 @@ objc_library(
         "//Source/common:PrefixTree",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SNTFileAccessEvent",
         "//Source/common:SNTKVOManager",
         "//Source/common:SNTLogging",
         "//Source/common:SNTXPCNotifierInterface",
@@ -699,11 +718,13 @@ objc_library(
         ":Metrics",
         ":SNTCompilerController",
         ":SNTDatabaseController",
+        ":SNTDecisionCache",
         ":SNTEventTable",
         ":SNTExecutionController",
         ":SNTNotificationQueue",
         ":SNTRuleTable",
         ":SNTSyncdQueue",
+        ":TTYWriter",
         ":WatchItems",
         "//Source/common:PrefixTree",
         "//Source/common:SNTConfigurator",
@@ -1256,6 +1277,7 @@ santa_unit_test(
         ":SNTCompilerController",
         ":SNTEndpointSecurityRecorder",
         "//Source/common:PrefixTree",
+        "//Source/common:SNTConfigurator",
         "//Source/common:TestUtils",
         "//Source/common:Unit",
         "@OCMock",

Source/santad/DataLayer/SNTDatabaseTable.m

@@ -39,9 +39,10 @@
           bail = YES;
           return;
         }
-        [db close];
-        [[NSFileManager defaultManager] removeItemAtPath:[db databasePath] error:NULL];
-        [db open];
+        [self closeDeleteReopenDatabase:db];
+      } else if ([db userVersion] > [self currentSupportedVersion]) {
+        LOGW(@"Database version newer than supported. Deleting.");
+        [self closeDeleteReopenDatabase:db];
       }
     }];
 
@@ -58,11 +59,22 @@
   return nil;
 }
 
+- (void)closeDeleteReopenDatabase:(FMDatabase *)db {
+  [db close];
+  [[NSFileManager defaultManager] removeItemAtPath:[db databasePath] error:NULL];
+  [db open];
+}
+
 - (uint32_t)initializeDatabase:(FMDatabase *)db fromVersion:(uint32_t)version {
   [self doesNotRecognizeSelector:_cmd];
   return 0;
 }
 
+- (uint32_t)currentSupportedVersion {
+  [self doesNotRecognizeSelector:_cmd];
+  return 0;
+}
+
 /// Called at the end of initialization to ensure the table in the
 /// database exists and uses the latest schema.
 - (void)updateTableSchema {

Source/santad/DataLayer/SNTEventTable.m

@@ -18,8 +18,14 @@
 
 #import "Source/common/SNTStoredEvent.h"
 
+static const uint32_t kEventTableCurrentVersion = 3;
+
 @implementation SNTEventTable
 
+- (uint32_t)currentSupportedVersion {
+  return kEventTableCurrentVersion;
+}
+
 - (uint32_t)initializeDatabase:(FMDatabase *)db fromVersion:(uint32_t)version {
   int newVersion = 0;
 

Source/santad/DataLayer/SNTRuleTable.h

@@ -57,10 +57,16 @@
 - (NSUInteger)teamIDRuleCount;
 
 ///
-///  @return Rule for binary or certificate with given SHA-256. The binary rule will be returned
-///          if it exists. If not, the certificate rule will be returned if it exists.
+/// @return Number of signing ID rules in the database
+///
+- (NSUInteger)signingIDRuleCount;
+
+///
+///  @return Rule for binary, signingID, certificate or teamID (in that order).
+///          The first matching rule found is returned.
 ///
 - (SNTRule *)ruleForBinarySHA256:(NSString *)binarySHA256
+                       signingID:(NSString *)signingID
                certificateSHA256:(NSString *)certificateSHA256
                           teamID:(NSString *)teamID;
 

Source/santad/DataLayer/SNTRuleTable.m

@@ -25,6 +25,8 @@
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTRule.h"
 
+static const uint32_t kRuleTableCurrentVersion = 5;
+
 // TODO(nguyenphillip): this should be configurable.
 // How many rules must be in database before we start trying to remove transitive rules.
 static const NSUInteger kTransitiveRuleCullingThreshold = 500000;
@@ -173,6 +175,10 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   self.criticalSystemBinaries = bins;
 }
 
+- (uint32_t)currentSupportedVersion {
+  return kRuleTableCurrentVersion;
+}
+
 - (uint32_t)initializeDatabase:(FMDatabase *)db fromVersion:(uint32_t)version {
   // Lock this database from other processes
   [[db executeQuery:@"PRAGMA locking_mode = EXCLUSIVE;"] close];
@@ -204,12 +210,25 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
     [db executeUpdate:@"ALTER TABLE 'rules' ADD 'timestamp' INTEGER"];
     newVersion = 3;
   }
+
   if (version < 4) {
     // Rename `shasum` column to `identifier`.
     [db executeUpdate:@"ALTER TABLE 'rules' RENAME COLUMN 'shasum' TO 'identifier'"];
     newVersion = 4;
   }
 
+  if (version < 5) {
+    // Migrate SNTRuleType enum values
+    // Note: The reordering is intentional so that the type values are in order
+    // of precedence.
+    [db executeUpdate:@"UPDATE rules SET type = 1000 WHERE type = 1"];
+    [db executeUpdate:@"UPDATE rules SET type = 3000 WHERE type = 2"];
+    [db executeUpdate:@"UPDATE rules SET type = 4000 WHERE type = 3"];
+    [db executeUpdate:@"UPDATE rules SET type = 2000 WHERE type = 4"];
+
+    newVersion = 5;
+  }
+
   // Save signing info for launchd and santad. Used to ensure they are always allowed.
   self.santadCSInfo = [[MOLCodesignChecker alloc] initWithSelf];
   self.launchdCSInfo = [[MOLCodesignChecker alloc] initWithPID:1];
@@ -230,20 +249,20 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   return count;
 }
 
-- (NSUInteger)binaryRuleCount {
+- (NSUInteger)ruleCountForRuleType:(SNTRuleType)ruleType {
   __block NSUInteger count = 0;
   [self inDatabase:^(FMDatabase *db) {
-    count = [db longForQuery:@"SELECT COUNT(*) FROM rules WHERE type=1"];
+    count = [db longForQuery:@"SELECT COUNT(*) FROM rules WHERE type=?", @(ruleType)];
   }];
   return count;
 }
 
+- (NSUInteger)binaryRuleCount {
+  return [self ruleCountForRuleType:SNTRuleTypeBinary];
+}
+
 - (NSUInteger)certificateRuleCount {
-  __block NSUInteger count = 0;
-  [self inDatabase:^(FMDatabase *db) {
-    count = [db longForQuery:@"SELECT COUNT(*) FROM rules WHERE type=2"];
-  }];
-  return count;
+  return [self ruleCountForRuleType:SNTRuleTypeCertificate];
 }
 
 - (NSUInteger)compilerRuleCount {
@@ -265,11 +284,11 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 }
 
 - (NSUInteger)teamIDRuleCount {
-  __block NSUInteger count = 0;
-  [self inDatabase:^(FMDatabase *db) {
-    count = [db longForQuery:@"SELECT COUNT(*) FROM rules WHERE type=3"];
-  }];
-  return count;
+  return [self ruleCountForRuleType:SNTRuleTypeTeamID];
+}
+
+- (NSUInteger)signingIDRuleCount {
+  return [self ruleCountForRuleType:SNTRuleTypeSigningID];
 }
 
 - (SNTRule *)ruleFromResultSet:(FMResultSet *)rs {
@@ -281,6 +300,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 }
 
 - (SNTRule *)ruleForBinarySHA256:(NSString *)binarySHA256
+                       signingID:(NSString *)signingID
                certificateSHA256:(NSString *)certificateSHA256
                           teamID:(NSString *)teamID {
   __block SNTRule *rule;
@@ -288,12 +308,27 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // Look for a static rule that matches.
   NSDictionary *staticRules = [[SNTConfigurator configurator] staticRules];
   if (staticRules.count) {
+    // IMPORTANT: The order static rules are checked here should be the same
+    // order as given by the SQL query for the rules database.
     rule = staticRules[binarySHA256];
-    if (rule.type == SNTRuleTypeBinary) return rule;
+    if (rule.type == SNTRuleTypeBinary) {
+      return rule;
+    }
+
+    rule = staticRules[signingID];
+    if (rule.type == SNTRuleTypeSigningID) {
+      return rule;
+    }
+
     rule = staticRules[certificateSHA256];
-    if (rule.type == SNTRuleTypeCertificate) return rule;
+    if (rule.type == SNTRuleTypeCertificate) {
+      return rule;
+    }
+
     rule = staticRules[teamID];
-    if (rule.type == SNTRuleTypeTeamID) return rule;
+    if (rule.type == SNTRuleTypeTeamID) {
+      return rule;
+    }
   }
 
   // Now query the database.
@@ -301,7 +336,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // NOTE: This code is written with the intention that the binary rule is searched for first
   // as Santa is designed to go with the most-specific rule possible.
   //
-  // The intended order of precedence is Binaries > Certificates > Team IDs.
+  // The intended order of precedence is Binaries > Signing IDs > Certificates > Team IDs.
   //
   // As such the query should have "ORDER BY type DESC" before the LIMIT, to ensure that is the
   // case. However, in all tested versions of SQLite that ORDER BY clause is unnecessary: the query
@@ -316,10 +351,12 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // There is a test for this in SNTRuleTableTests in case SQLite behavior changes in the future.
   //
   [self inDatabase:^(FMDatabase *db) {
-    FMResultSet *rs =
-      [db executeQuery:@"SELECT * FROM rules WHERE (identifier=? and type=1) OR "
-                       @"(identifier=? AND type=2) OR (identifier=? AND type=3) LIMIT 1",
-                       binarySHA256, certificateSHA256, teamID];
+    FMResultSet *rs = [db executeQuery:@"SELECT * FROM rules WHERE "
+                                       @"   (identifier=? and type=1000) "
+                                       @"OR (identifier=? AND type=2000) "
+                                       @"OR (identifier=? AND type=3000) "
+                                       @"OR (identifier=? AND type=4000) LIMIT 1",
+                                       binarySHA256, signingID, certificateSHA256, teamID];
     if ([rs next]) {
       rule = [self ruleFromResultSet:rs];
     }

Source/santad/DataLayer/SNTRuleTableTest.m

@@ -43,6 +43,19 @@
   return r;
 }
 
+- (SNTRule *)_exampleSigningIDRuleIsPlatform:(BOOL)isPlatformBinary {
+  SNTRule *r = [[SNTRule alloc] init];
+  if (isPlatformBinary) {
+    r.identifier = @"platform:signingID";
+  } else {
+    r.identifier = @"teamID:signingID";
+  }
+  r.state = SNTRuleStateBlock;
+  r.type = SNTRuleTypeSigningID;
+  r.customMsg = @"A teamID rule";
+  return r;
+}
+
 - (SNTRule *)_exampleBinaryRule {
   SNTRule *r = [[SNTRule alloc] init];
   r.identifier = @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670";
@@ -127,6 +140,7 @@
 
   SNTRule *r = [self.sut
     ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
+              signingID:nil
       certificateSHA256:nil
                  teamID:nil];
   XCTAssertNotNil(r);
@@ -136,6 +150,7 @@
 
   r = [self.sut
     ruleForBinarySHA256:@"b6ee1c3c5a715c049d14a8457faa6b6701b8507efe908300e238e0768bd759c2"
+              signingID:nil
       certificateSHA256:nil
                  teamID:nil];
   XCTAssertNil(r);
@@ -148,6 +163,7 @@
 
   SNTRule *r = [self.sut
     ruleForBinarySHA256:nil
+              signingID:nil
       certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
                  teamID:nil];
   XCTAssertNotNil(r);
@@ -157,6 +173,7 @@
 
   r = [self.sut
     ruleForBinarySHA256:nil
+              signingID:nil
       certificateSHA256:@"5bdab1288fc16892fef50c658db54f1e2e19cf8f71cc55f77de2b95e051e2562"
                  teamID:nil];
   XCTAssertNil(r);
@@ -167,26 +184,66 @@
           cleanSlate:NO
                error:nil];
 
-  SNTRule *r = [self.sut ruleForBinarySHA256:nil certificateSHA256:nil teamID:@"teamID"];
+  SNTRule *r = [self.sut ruleForBinarySHA256:nil
+                                   signingID:nil
+                           certificateSHA256:nil
+                                      teamID:@"teamID"];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier, @"teamID");
   XCTAssertEqual(r.type, SNTRuleTypeTeamID);
   XCTAssertEqual([self.sut teamIDRuleCount], 1);
 
-  r = [self.sut ruleForBinarySHA256:nil certificateSHA256:nil teamID:@"nonexistentTeamID"];
+  r = [self.sut ruleForBinarySHA256:nil
+                          signingID:nil
+                  certificateSHA256:nil
+                             teamID:@"nonexistentTeamID"];
+  XCTAssertNil(r);
+}
+
+- (void)testFetchSigningIDRule {
+  [self.sut addRules:@[
+    [self _exampleBinaryRule], [self _exampleSigningIDRuleIsPlatform:YES],
+    [self _exampleSigningIDRuleIsPlatform:NO]
+  ]
+          cleanSlate:NO
+               error:nil];
+
+  XCTAssertEqual([self.sut signingIDRuleCount], 2);
+
+  SNTRule *r = [self.sut ruleForBinarySHA256:nil
+                                   signingID:@"teamID:signingID"
+                           certificateSHA256:nil
+                                      teamID:nil];
+
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"teamID:signingID");
+  XCTAssertEqual(r.type, SNTRuleTypeSigningID);
+
+  r = [self.sut ruleForBinarySHA256:nil
+                          signingID:@"platform:signingID"
+                  certificateSHA256:nil
+                             teamID:nil];
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"platform:signingID");
+  XCTAssertEqual(r.type, SNTRuleTypeSigningID);
+
+  r = [self.sut ruleForBinarySHA256:nil signingID:@"nonexistent" certificateSHA256:nil teamID:nil];
   XCTAssertNil(r);
 }
 
 - (void)testFetchRuleOrdering {
-  [self.sut
-      addRules:@[ [self _exampleCertRule], [self _exampleBinaryRule], [self _exampleTeamIDRule] ]
-    cleanSlate:NO
-         error:nil];
+  [self.sut addRules:@[
+    [self _exampleCertRule], [self _exampleBinaryRule], [self _exampleTeamIDRule],
+    [self _exampleSigningIDRuleIsPlatform:NO]
+  ]
+          cleanSlate:NO
+               error:nil];
 
   // This test verifies that the implicit rule ordering we've been abusing is still working.
   // See the comment in SNTRuleTable#ruleForBinarySHA256:certificateSHA256:teamID
   SNTRule *r = [self.sut
     ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
+              signingID:@"teamID:signingID"
       certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
                  teamID:@"teamID"];
   XCTAssertNotNil(r);
@@ -196,6 +253,7 @@
 
   r = [self.sut
     ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
+              signingID:@"teamID:signingID"
       certificateSHA256:@"unknowncert"
                  teamID:@"teamID"];
   XCTAssertNotNil(r);
@@ -205,12 +263,29 @@
 
   r = [self.sut
     ruleForBinarySHA256:@"unknown"
+              signingID:@"unknown"
       certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
                  teamID:@"teamID"];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258");
   XCTAssertEqual(r.type, SNTRuleTypeCertificate, @"Implicit rule ordering failed");
+
+  r = [self.sut ruleForBinarySHA256:@"unknown"
+                          signingID:@"teamID:signingID"
+                  certificateSHA256:@"unknown"
+                             teamID:@"teamID"];
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"teamID:signingID");
+  XCTAssertEqual(r.type, SNTRuleTypeSigningID, @"Implicit rule ordering failed (SigningID)");
+
+  r = [self.sut ruleForBinarySHA256:@"unknown"
+                          signingID:@"unknown"
+                  certificateSHA256:@"unknown"
+                             teamID:@"teamID"];
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"teamID");
+  XCTAssertEqual(r.type, SNTRuleTypeTeamID, @"Implicit rule ordering failed (TeamID)");
 }
 
 - (void)testBadDatabase {

Source/santad/DataLayer/WatchItemPolicy.h

@@ -33,6 +33,7 @@ static constexpr WatchItemPathType kWatchItemPolicyDefaultPathType =
     WatchItemPathType::kLiteral;
 static constexpr bool kWatchItemPolicyDefaultAllowReadAccess = false;
 static constexpr bool kWatchItemPolicyDefaultAuditOnly = true;
+static constexpr bool kWatchItemPolicyDefaultInvertProcessExceptions = false;
 
 struct WatchItemPolicy {
   struct Process {
@@ -69,19 +70,23 @@ struct WatchItemPolicy {
                   WatchItemPathType pt = kWatchItemPolicyDefaultPathType,
                   bool ara = kWatchItemPolicyDefaultAllowReadAccess,
                   bool ao = kWatchItemPolicyDefaultAuditOnly,
+                  bool ipe = kWatchItemPolicyDefaultInvertProcessExceptions,
                   std::vector<Process> procs = {})
       : name(n),
         path(p),
         path_type(pt),
         allow_read_access(ara),
         audit_only(ao),
+        invert_process_exceptions(ipe),
         processes(std::move(procs)) {}
 
   bool operator==(const WatchItemPolicy &other) const {
     return name == other.name && path == other.path &&
            path_type == other.path_type &&
            allow_read_access == other.allow_read_access &&
-           audit_only == other.audit_only && processes == other.processes;
+           audit_only == other.audit_only &&
+           invert_process_exceptions == other.invert_process_exceptions &&
+           processes == other.processes;
   }
 
   bool operator!=(const WatchItemPolicy &other) const {
@@ -93,7 +98,12 @@ struct WatchItemPolicy {
   WatchItemPathType path_type;
   bool allow_read_access;
   bool audit_only;
+  bool invert_process_exceptions;
   std::vector<Process> processes;
+
+  // WIP - No current way to control via config
+  bool silent = true;
+  std::string version = "temp_version";
 };
 
 }  // namespace santa::santad::data_layer

Source/santad/DataLayer/WatchItems.h

@@ -39,6 +39,7 @@ extern NSString *const kWatchItemConfigKeyPathsIsPrefix;
 extern NSString *const kWatchItemConfigKeyOptions;
 extern NSString *const kWatchItemConfigKeyOptionsAllowReadAccess;
 extern NSString *const kWatchItemConfigKeyOptionsAuditOnly;
+extern NSString *const kWatchItemConfigKeyOptionsInvertProcessExceptions;
 extern NSString *const kWatchItemConfigKeyProcesses;
 extern NSString *const kWatchItemConfigKeyProcessesBinaryPath;
 extern NSString *const kWatchItemConfigKeyProcessesCertificateSha256;

Source/santad/DataLayer/WatchItems.mm

@@ -53,6 +53,7 @@ NSString *const kWatchItemConfigKeyPathsIsPrefix = @"IsPrefix";
 NSString *const kWatchItemConfigKeyOptions = @"Options";
 NSString *const kWatchItemConfigKeyOptionsAllowReadAccess = @"AllowReadAccess";
 NSString *const kWatchItemConfigKeyOptionsAuditOnly = @"AuditOnly";
+NSString *const kWatchItemConfigKeyOptionsInvertProcessExceptions = @"InvertProcessExceptions";
 NSString *const kWatchItemConfigKeyProcesses = @"Processes";
 NSString *const kWatchItemConfigKeyProcessesBinaryPath = @"BinaryPath";
 NSString *const kWatchItemConfigKeyProcessesCertificateSha256 = @"CertificateSha256";
@@ -376,6 +377,8 @@ std::variant<Unit, ProcessList> VerifyConfigWatchItemProcesses(NSDictionary *wat
 ///     <false/>
 ///     <key>AuditOnly</key>
 ///     <false/>
+///     <key>InvertProcessExceptions</key>
+///     <false/>
 ///   </dict>
 ///   <key>Processes</key>
 ///   <array>
@@ -410,6 +413,11 @@ bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
     if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsAuditOnly, [NSNumber class], err)) {
       return false;
     }
+
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsInvertProcessExceptions,
+                         [NSNumber class], err)) {
+      return false;
+    }
   }
 
   bool allow_read_access = options[kWatchItemConfigKeyOptionsAllowReadAccess]
@@ -418,6 +426,10 @@ bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
   bool audit_only = options[kWatchItemConfigKeyOptionsAuditOnly]
                       ? [options[kWatchItemConfigKeyOptionsAuditOnly] boolValue]
                       : kWatchItemPolicyDefaultAuditOnly;
+  bool invert_process_exceptions =
+    options[kWatchItemConfigKeyOptionsInvertProcessExceptions]
+      ? [options[kWatchItemConfigKeyOptionsInvertProcessExceptions] boolValue]
+      : kWatchItemPolicyDefaultInvertProcessExceptions;
 
   std::variant<Unit, ProcessList> proc_list = VerifyConfigWatchItemProcesses(watch_item, err);
   if (std::holds_alternative<Unit>(proc_list)) {
@@ -427,7 +439,7 @@ bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
   for (const PathAndTypePair &path_type_pair : std::get<PathList>(path_list)) {
     policies.push_back(std::make_shared<WatchItemPolicy>(
       NSStringToUTF8StringView(name), path_type_pair.first, path_type_pair.second,
-      allow_read_access, audit_only, std::get<ProcessList>(proc_list)));
+      allow_read_access, audit_only, invert_process_exceptions, std::get<ProcessList>(proc_list)));
   }
 
   return true;

Source/santad/DataLayer/WatchItemsTest.mm

@@ -35,6 +35,7 @@
 using santa::common::Unit;
 using santa::santad::data_layer::kWatchItemPolicyDefaultAllowReadAccess;
 using santa::santad::data_layer::kWatchItemPolicyDefaultAuditOnly;
+using santa::santad::data_layer::kWatchItemPolicyDefaultInvertProcessExceptions;
 using santa::santad::data_layer::kWatchItemPolicyDefaultPathType;
 using santa::santad::data_layer::WatchItemPathType;
 using santa::santad::data_layer::WatchItemPolicy;
@@ -777,6 +778,17 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   },
                                            policies, &err));
 
+  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsInvertProcessExceptions : @""}
+  },
+                                            policies, &err));
+  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
+    kWatchItemConfigKeyPaths : @[ @"a" ],
+    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsInvertProcessExceptions : @(0)}
+  },
+                                           policies, &err));
+
   // If processes are specified, they must be valid format
   // Note: Full tests in `testVerifyConfigWatchItemProcesses`
   XCTAssertFalse(ParseConfigSingleWatchItem(
@@ -790,9 +802,11 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   XCTAssertTrue(
     ParseConfigSingleWatchItem(@"rule", @{kWatchItemConfigKeyPaths : @[ @"a" ]}, policies, &err));
   XCTAssertEqual(policies.size(), 1);
-  XCTAssertEqual(*policies[0].get(), WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
-                                                     kWatchItemPolicyDefaultAllowReadAccess,
-                                                     kWatchItemPolicyDefaultAuditOnly, {}));
+  XCTAssertEqual(
+    *policies[0].get(),
+    WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
+                    kWatchItemPolicyDefaultAllowReadAccess, kWatchItemPolicyDefaultAuditOnly,
+                    kWatchItemPolicyDefaultInvertProcessExceptions, {}));
 
   // Test multiple paths, options, and processes
   policies.clear();
@@ -806,7 +820,8 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
       @[ @"a", @{kWatchItemConfigKeyPathsPath : @"b", kWatchItemConfigKeyPathsIsPrefix : @(YES)} ],
     kWatchItemConfigKeyOptions : @{
       kWatchItemConfigKeyOptionsAllowReadAccess : @(YES),
-      kWatchItemConfigKeyOptionsAuditOnly : @(NO)
+      kWatchItemConfigKeyOptionsAuditOnly : @(NO),
+      kWatchItemConfigKeyOptionsInvertProcessExceptions : @(YES),
     },
     kWatchItemConfigKeyProcesses : @[
       @{kWatchItemConfigKeyProcessesBinaryPath : @"pa"},
@@ -815,10 +830,10 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   },
                                            policies, &err));
   XCTAssertEqual(policies.size(), 2);
-  XCTAssertEqual(*policies[0].get(),
-                 WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType, true, false, procs));
-  XCTAssertEqual(*policies[1].get(),
-                 WatchItemPolicy("rule", "b", WatchItemPathType::kPrefix, true, false, procs));
+  XCTAssertEqual(*policies[0].get(), WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
+                                                     true, false, true, procs));
+  XCTAssertEqual(*policies[1].get(), WatchItemPolicy("rule", "b", WatchItemPathType::kPrefix, true,
+                                                     false, true, procs));
 }
 
 - (void)testState {

Source/santad/EventProviders/EndpointSecurity/ClientTest.mm

@@ -16,6 +16,8 @@
 #import <XCTest/XCTest.h>
 #include <dispatch/dispatch.h>
 
+#include <utility>
+
 #include "Source/santad/EventProviders/EndpointSecurity/Client.h"
 
 using santa::santad::event_providers::endpoint_security::Client;

Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h

@@ -46,7 +46,11 @@ class EnrichedFile {
         group_(std::move(other.group_)),
         hash_(std::move(other.hash_)) {}
 
+  // Note: Move assignment could be safely implemented but not currently needed
+  EnrichedFile &operator=(EnrichedFile &&other) = delete;
+
   EnrichedFile(const EnrichedFile &other) = delete;
+  EnrichedFile &operator=(const EnrichedFile &other) = delete;
 
   const std::optional<std::shared_ptr<std::string>> &user() const {
     return user_;
@@ -87,7 +91,11 @@ class EnrichedProcess {
         real_group_(std::move(other.real_group_)),
         executable_(std::move(other.executable_)) {}
 
+  // Note: Move assignment could be safely implemented but not currently needed
+  EnrichedProcess &operator=(EnrichedProcess &&other) = delete;
+
   EnrichedProcess(const EnrichedProcess &other) = delete;
+  EnrichedProcess &operator=(const EnrichedProcess &other) = delete;
 
   const std::optional<std::shared_ptr<std::string>> &effective_user() const {
     return effective_user_;
@@ -123,7 +131,12 @@ class EnrichedEventType {
         instigator_(std::move(other.instigator_)),
         enrichment_time_(std::move(other.enrichment_time_)) {}
 
+  // Note: Move assignment could be safely implemented but not currently needed
+  // so no sense in implementing across all child classes
+  EnrichedEventType &operator=(EnrichedEventType &&other) = delete;
+
   EnrichedEventType(const EnrichedEventType &other) = delete;
+  EnrichedEventType &operator=(const EnrichedEventType &other) = delete;
 
   virtual ~EnrichedEventType() = default;
 

Source/santad/EventProviders/EndpointSecurity/Enricher.h

@@ -34,7 +34,7 @@ class Enricher {
  public:
   Enricher();
   virtual ~Enricher() = default;
-  virtual std::shared_ptr<EnrichedMessage> Enrich(Message &&msg);
+  virtual std::unique_ptr<EnrichedMessage> Enrich(Message &&msg);
   virtual EnrichedProcess Enrich(
       const es_process_t &es_proc,
       EnrichOptions options = EnrichOptions::kDefault);

Source/santad/EventProviders/EndpointSecurity/Enricher.mm

@@ -30,19 +30,19 @@ namespace santa::santad::event_providers::endpoint_security {
 
 Enricher::Enricher() : username_cache_(256), groupname_cache_(256) {}
 
-std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
+std::unique_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
   // TODO(mlw): Consider potential design patterns that could help reduce memory usage under load
   // (such as maybe the flyweight pattern)
   switch (es_msg->event_type) {
     case ES_EVENT_TYPE_NOTIFY_CLOSE:
-      return std::make_shared<EnrichedMessage>(EnrichedClose(
+      return std::make_unique<EnrichedMessage>(EnrichedClose(
         std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.close.target)));
     case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
-      return std::make_shared<EnrichedMessage>(EnrichedExchange(
+      return std::make_unique<EnrichedMessage>(EnrichedExchange(
         std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exchangedata.file1),
         Enrich(*es_msg->event.exchangedata.file2)));
     case ES_EVENT_TYPE_NOTIFY_EXEC:
-      return std::make_shared<EnrichedMessage>(EnrichedExec(
+      return std::make_unique<EnrichedMessage>(EnrichedExec(
         std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.exec.target),
         (es_msg->version >= 2 && es_msg->event.exec.script)
           ? std::make_optional(Enrich(*es_msg->event.exec.script))
@@ -51,28 +51,28 @@ std::shared_ptr<EnrichedMessage> Enricher::Enrich(Message &&es_msg) {
           ? std::make_optional(Enrich(*es_msg->event.exec.cwd))
           : std::nullopt));
     case ES_EVENT_TYPE_NOTIFY_FORK:
-      return std::make_shared<EnrichedMessage>(EnrichedFork(
+      return std::make_unique<EnrichedMessage>(EnrichedFork(
         std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.fork.child)));
     case ES_EVENT_TYPE_NOTIFY_EXIT:
-      return std::make_shared<EnrichedMessage>(
+      return std::make_unique<EnrichedMessage>(
         EnrichedExit(std::move(es_msg), Enrich(*es_msg->process)));
     case ES_EVENT_TYPE_NOTIFY_LINK:
-      return std::make_shared<EnrichedMessage>(
+      return std::make_unique<EnrichedMessage>(
         EnrichedLink(std::move(es_msg), Enrich(*es_msg->process),
                      Enrich(*es_msg->event.link.source), Enrich(*es_msg->event.link.target_dir)));
     case ES_EVENT_TYPE_NOTIFY_RENAME: {
       if (es_msg->event.rename.destination_type == ES_DESTINATION_TYPE_NEW_PATH) {
-        return std::make_shared<EnrichedMessage>(EnrichedRename(
+        return std::make_unique<EnrichedMessage>(EnrichedRename(
           std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
           std::nullopt, Enrich(*es_msg->event.rename.destination.new_path.dir)));
       } else {
-        return std::make_shared<EnrichedMessage>(EnrichedRename(
+        return std::make_unique<EnrichedMessage>(EnrichedRename(
           std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.rename.source),
           Enrich(*es_msg->event.rename.destination.existing_file), std::nullopt));
       }
     }
     case ES_EVENT_TYPE_NOTIFY_UNLINK:
-      return std::make_shared<EnrichedMessage>(EnrichedUnlink(
+      return std::make_unique<EnrichedMessage>(EnrichedUnlink(
         std::move(es_msg), Enrich(*es_msg->process), Enrich(*es_msg->event.unlink.target)));
     default:
       // This is a programming error

Source/santad/EventProviders/SNTEndpointSecurityClient.mm

@@ -193,13 +193,12 @@ constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db"
   return _esApi->UnsubscribeAll(_esClient);
 }
 
-- (bool)unmuteEverything {
-  bool result = _esApi->UnmuteAllPaths(_esClient);
-  result = _esApi->UnmuteAllTargetPaths(_esClient) && result;
-  return result;
+- (bool)unmuteAllTargetPaths {
+  return _esApi->UnmuteAllTargetPaths(_esClient);
 }
 
 - (bool)enableTargetPathWatching {
+  [self unmuteAllTargetPaths];
   return _esApi->InvertTargetPathMuting(_esClient);
 }
 
@@ -236,9 +235,9 @@ constexpr std::string_view kProtectedFiles[] = {"/private/var/db/santa/rules.db"
   }
 }
 
-- (void)processEnrichedMessage:(std::shared_ptr<EnrichedMessage>)msg
-                       handler:(void (^)(std::shared_ptr<EnrichedMessage>))messageHandler {
-  __block std::shared_ptr<EnrichedMessage> msgTmp = std::move(msg);
+- (void)processEnrichedMessage:(std::unique_ptr<EnrichedMessage>)msg
+                       handler:(void (^)(std::unique_ptr<EnrichedMessage>))messageHandler {
+  __block std::unique_ptr<EnrichedMessage> msgTmp = std::move(msg);
   dispatch_async(_notifyQueue, ^{
     messageHandler(std::move(msgTmp));
   });

Source/santad/EventProviders/SNTEndpointSecurityClientBase.h

@@ -49,7 +49,7 @@
 - (bool)subscribeAndClearCache:(const std::set<es_event_type_t> &)events;
 
 - (bool)unsubscribeAll;
-- (bool)unmuteEverything;
+- (bool)unmuteAllTargetPaths;
 - (bool)enableTargetPathWatching;
 - (bool)muteTargetPaths:
   (const std::vector<std::pair<std::string, santa::santad::data_layer::WatchItemPathType>> &)paths;
@@ -72,9 +72,9 @@
 
 - (void)
   processEnrichedMessage:
-    (std::shared_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage>)msg
+    (std::unique_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage>)msg
                  handler:
-                   (void (^)(std::shared_ptr<
+                   (void (^)(std::unique_ptr<
                              santa::santad::event_providers::endpoint_security::EnrichedMessage>))
                      messageHandler;
 

Source/santad/EventProviders/SNTEndpointSecurityClientTest.mm

@@ -274,23 +274,20 @@ using santa::santad::event_providers::endpoint_security::Message;
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
 }
 
-- (void)testUnmuteEverything {
+- (void)testUnmuteAllTargetPaths {
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   SNTEndpointSecurityClient *client =
     [[SNTEndpointSecurityClient alloc] initWithESAPI:mockESApi
                                              metrics:nullptr
                                            processor:Processor::kUnknown];
 
-  // Test variations of underlying unmute impls returning both true and false
-  EXPECT_CALL(*mockESApi, UnmuteAllPaths)
-    .WillOnce(testing::Return(true))
-    .WillOnce(testing::Return(false));
+  // Test the underlying unmute impl returning both true and false
   EXPECT_CALL(*mockESApi, UnmuteAllTargetPaths)
     .WillOnce(testing::Return(true))
-    .WillOnce(testing::Return(true));
+    .WillOnce(testing::Return(false));
 
-  XCTAssertTrue([client unmuteEverything]);
-  XCTAssertFalse([client unmuteEverything]);
+  XCTAssertTrue([client unmuteAllTargetPaths]);
+  XCTAssertFalse([client unmuteAllTargetPaths]);
 
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
 }
@@ -302,6 +299,9 @@ using santa::santad::event_providers::endpoint_security::Message;
                                              metrics:nullptr
                                            processor:Processor::kUnknown];
 
+  // UnmuteAllTargetPaths is always attempted.
+  EXPECT_CALL(*mockESApi, UnmuteAllTargetPaths).Times(2).WillRepeatedly(testing::Return(true));
+
   // Test the underlying invert nute impl returning both true and false
   EXPECT_CALL(*mockESApi, InvertTargetPathMuting)
     .WillOnce(testing::Return(true))
@@ -406,14 +406,14 @@ using santa::santad::event_providers::endpoint_security::Message;
                                              metrics:nullptr
                                            processor:Processor::kUnknown];
   {
-    auto enrichedMsg = std::make_shared<EnrichedMessage>(
+    auto enrichedMsg = std::make_unique<EnrichedMessage>(
       EnrichedClose(Message(mockESApi, &esMsg),
                     EnrichedProcess(std::nullopt, std::nullopt, std::nullopt, std::nullopt,
                                     EnrichedFile(std::nullopt, std::nullopt, std::nullopt)),
                     EnrichedFile(std::nullopt, std::nullopt, std::nullopt)));
 
-    [client processEnrichedMessage:enrichedMsg
-                           handler:^(std::shared_ptr<EnrichedMessage> msg) {
+    [client processEnrichedMessage:std::move(enrichedMsg)
+                           handler:^(std::unique_ptr<EnrichedMessage> msg) {
                              // reset the shared_ptr to drop the held message.
                              // This is a workaround for a TSAN only false positive
                              // which happens if we switch back to the sem wait

Source/santad/EventProviders/SNTEndpointSecurityFileAccessAuthorizer.h

@@ -16,6 +16,7 @@
 
 #include <memory>
 
+#import "Source/common/SNTFileAccessEvent.h"
 #include "Source/santad/DataLayer/WatchItems.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
 #include "Source/santad/EventProviders/EndpointSecurity/Enricher.h"
@@ -25,6 +26,8 @@
 #include "Source/santad/Metrics.h"
 #import "Source/santad/SNTDecisionCache.h"
 
+typedef void (^SNTFileAccessBlockCallback)(SNTFileAccessEvent *event);
+
 @interface SNTEndpointSecurityFileAccessAuthorizer
     : SNTEndpointSecurityClient <SNTEndpointSecurityDynamicEventHandler>
 
@@ -38,4 +41,6 @@
          (std::shared_ptr<santa::santad::event_providers::endpoint_security::Enricher>)enricher
   decisionCache:(SNTDecisionCache *)decisionCache;
 
+@property SNTFileAccessBlockCallback fileAccessBlockCallback;
+
 @end

Source/santad/EventProviders/SNTEndpointSecurityFileAccessAuthorizer.mm

@@ -18,6 +18,7 @@
 #include <Kernel/kern/cs_blobs.h>
 #import <MOLCertificate/MOLCertificate.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
+#include <bsm/libbsm.h>
 #include <sys/fcntl.h>
 
 #include <algorithm>
@@ -32,17 +33,20 @@
 #include "Source/common/Platform.h"
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
+#include "Source/common/SNTFileAccessEvent.h"
 #import "Source/common/SNTMetricSet.h"
 #import "Source/common/SNTStrengthify.h"
 #include "Source/common/SantaCache.h"
 #include "Source/common/SantaVnode.h"
 #include "Source/common/SantaVnodeHash.h"
+#include "Source/common/String.h"
 #include "Source/santad/DataLayer/WatchItemPolicy.h"
 #include "Source/santad/DataLayer/WatchItems.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
 #include "Source/santad/EventProviders/EndpointSecurity/Message.h"
 #include "Source/santad/EventProviders/RateLimiter.h"
 
+using santa::common::StringToNSString;
 using santa::santad::EventDisposition;
 using santa::santad::data_layer::WatchItemPathType;
 using santa::santad::data_layer::WatchItemPolicy;
@@ -241,7 +245,6 @@ void PopulatePathTargets(const Message &msg, std::vector<PathTarget> &targets) {
     [self establishClientOrDie];
 
     [super enableTargetPathWatching];
-    [super unmuteEverything];
   }
   return self;
 }
@@ -426,19 +429,35 @@ void PopulatePathTargets(const Message &msg, std::vector<PathTarget> &targets) {
     return specialCase;
   }
 
+  FileAccessPolicyDecision decision = FileAccessPolicyDecision::kDenied;
+
   for (const WatchItemPolicy::Process &process : policy->processes) {
     if ([self policyProcess:process matchesESProcess:msg->process]) {
-      return FileAccessPolicyDecision::kAllowed;
+      decision = FileAccessPolicyDecision::kAllowed;
+      break;
     }
   }
 
-  if (policy->audit_only) {
-    return FileAccessPolicyDecision::kAllowedAuditOnly;
-  } else {
-    // TODO(xyz): Write to TTY like in exec controller?
-    // TODO(xyz): Need new config item for custom message in UI
-    return FileAccessPolicyDecision::kDenied;
+  // If the `invert_process_exceptions` option is set, the decision should be
+  // inverted from allowed to denied or vice versa. Note that this inversion
+  // must be made prior to checking the policy's audit-only flag.
+  if (policy->invert_process_exceptions) {
+    if (decision == FileAccessPolicyDecision::kAllowed) {
+      decision = FileAccessPolicyDecision::kDenied;
+    } else {
+      decision = FileAccessPolicyDecision::kAllowed;
+    }
   }
+
+  if (decision == FileAccessPolicyDecision::kDenied && policy->audit_only) {
+    decision = FileAccessPolicyDecision::kAllowedAuditOnly;
+  }
+
+  // https://github.com/google/santa/issues/1084
+  // TODO(xyz): Write to TTY like in exec controller?
+  // TODO(xyz): Need new config item for custom message in UI
+
+  return decision;
 }
 
 - (FileAccessPolicyDecision)handleMessage:(const Message &)msg
@@ -466,6 +485,27 @@ void PopulatePathTargets(const Message &msg, std::vector<PathTarget> &targets) {
                               targetPathCopy, policyDecision);
                           }];
     }
+
+    if (!optionalPolicy.value()->silent && self.fileAccessBlockCallback) {
+      SNTCachedDecision *cd =
+        [self.decisionCache cachedDecisionForFile:msg->process->executable->stat];
+
+      SNTFileAccessEvent *event = [[SNTFileAccessEvent alloc] init];
+
+      event.accessedPath = StringToNSString(target.path);
+      event.ruleVersion = StringToNSString(optionalPolicy.value()->version);
+      event.ruleName = StringToNSString(optionalPolicy.value()->name);
+
+      event.fileSHA256 = cd.sha256 ?: @"<unknown sha>";
+      event.filePath = StringToNSString(msg->process->executable->path.data);
+      event.teamID = cd.teamID ?: @"<unknown team id>";
+      event.teamID = cd.signingID ?: @"<unknown signing id>";
+      event.pid = @(audit_token_to_pid(msg->process->audit_token));
+      event.ppid = @(audit_token_to_pid(msg->process->parent_audit_token));
+      event.parentName = StringToNSString(msg.ParentProcessName());
+
+      self.fileAccessBlockCallback(event);
+    }
   }
 
   return policyDecision;
@@ -554,7 +594,7 @@ void PopulatePathTargets(const Message &msg, std::vector<PathTarget> &targets) {
     if ([super unsubscribeAll]) {
       self.isSubscribed = false;
     }
-    [super unmuteEverything];
+    [super unmuteAllTargetPaths];
   }
 }
 

Source/santad/EventProviders/SNTEndpointSecurityFileAccessAuthorizerTest.mm

@@ -61,7 +61,6 @@ extern es_auth_result_t CombinePolicyResults(es_auth_result_t result1, es_auth_r
 void SetExpectationsForFileAccessAuthorizerInit(
   std::shared_ptr<MockEndpointSecurityAPI> mockESApi) {
   EXPECT_CALL(*mockESApi, InvertTargetPathMuting).WillOnce(testing::Return(true));
-  EXPECT_CALL(*mockESApi, UnmuteAllPaths).WillOnce(testing::Return(true));
   EXPECT_CALL(*mockESApi, UnmuteAllTargetPaths).WillOnce(testing::Return(true));
 }
 
@@ -532,8 +531,9 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
 
   // If no policy exists, the operation is allowed
   {
-    Message msg(mockESApi, &esMsg);
-    XCTAssertEqual([accessClient applyPolicy:std::nullopt forTarget:target toMessage:msg],
+    XCTAssertEqual([accessClient applyPolicy:std::nullopt
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
                    FileAccessPolicyDecision::kNoPolicy);
   }
 
@@ -546,8 +546,9 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
   {
     OCMExpect([self.mockConfigurator enableBadSignatureProtection]).andReturn(YES);
     esMsg.process->codesigning_flags = CS_SIGNED;
-    Message msg(mockESApi, &esMsg);
-    XCTAssertEqual([accessClient applyPolicy:optionalPolicy forTarget:target toMessage:msg],
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
                    FileAccessPolicyDecision::kDeniedInvalidSignature);
   }
 
@@ -557,11 +558,12 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
   {
     OCMExpect([self.mockConfigurator enableBadSignatureProtection]).andReturn(NO);
     esMsg.process->codesigning_flags = CS_SIGNED;
-    Message msg(mockESApi, &esMsg);
     OCMExpect([accessClientMock policyProcess:policyProc matchesESProcess:&esProc])
       .ignoringNonObjectArgs()
       .andReturn(true);
-    XCTAssertEqual([accessClient applyPolicy:optionalPolicy forTarget:target toMessage:msg],
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
                    FileAccessPolicyDecision::kAllowed);
   }
 
@@ -574,8 +576,9 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
       .ignoringNonObjectArgs()
       .andReturn(false);
     policy->audit_only = false;
-    Message msg(mockESApi, &esMsg);
-    XCTAssertEqual([accessClient applyPolicy:optionalPolicy forTarget:target toMessage:msg],
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
                    FileAccessPolicyDecision::kDenied);
   }
 
@@ -585,8 +588,50 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
       .ignoringNonObjectArgs()
       .andReturn(false);
     policy->audit_only = true;
-    Message msg(mockESApi, &esMsg);
-    XCTAssertEqual([accessClient applyPolicy:optionalPolicy forTarget:target toMessage:msg],
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
+                   FileAccessPolicyDecision::kAllowedAuditOnly);
+  }
+
+  // The remainder of the tests set the policy's `invert_process_exceptions` option
+  policy->invert_process_exceptions = true;
+
+  // If no exceptions for inverted policy, operations are allowed
+  {
+    OCMExpect([accessClientMock policyProcess:policyProc matchesESProcess:&esProc])
+      .ignoringNonObjectArgs()
+      .andReturn(false);
+    policy->audit_only = false;
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
+                   FileAccessPolicyDecision::kAllowed);
+  }
+
+  // For audit only policies with no exception matches and inverted exceptions, operations are
+  // allowed
+  {
+    OCMExpect([accessClientMock policyProcess:policyProc matchesESProcess:&esProc])
+      .ignoringNonObjectArgs()
+      .andReturn(false);
+    policy->audit_only = true;
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
+                   FileAccessPolicyDecision::kAllowed);
+  }
+
+  // For audit only policies with exception match and inverted exceptions, operations are allowed
+  // audit only
+  {
+    OCMExpect([accessClientMock policyProcess:policyProc matchesESProcess:&esProc])
+      .ignoringNonObjectArgs()
+      .andReturn(true);
+    policy->audit_only = true;
+    XCTAssertEqual([accessClient applyPolicy:optionalPolicy
+                                   forTarget:target
+                                   toMessage:Message(mockESApi, &esMsg)],
                    FileAccessPolicyDecision::kAllowedAuditOnly);
   }
 
@@ -636,7 +681,6 @@ void ClearWatchItemPolicyProcess(WatchItemPolicy::Process &proc) {
                                                      decisionCache:nil];
 
   EXPECT_CALL(*mockESApi, UnsubscribeAll);
-  EXPECT_CALL(*mockESApi, UnmuteAllPaths).WillOnce(testing::Return(true));
   EXPECT_CALL(*mockESApi, UnmuteAllTargetPaths).WillOnce(testing::Return(true));
 
   accessClient.isSubscribed = true;

Source/santad/EventProviders/SNTEndpointSecurityRecorder.mm

@@ -16,7 +16,9 @@
 
 #include <EndpointSecurity/EndpointSecurity.h>
 
+#import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTLogging.h"
+#include "Source/common/String.h"
 #include "Source/santad/EventProviders/AuthResultCache.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
 #include "Source/santad/EventProviders/EndpointSecurity/Message.h"
@@ -44,6 +46,7 @@ es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
 
 @interface SNTEndpointSecurityRecorder ()
 @property SNTCompilerController *compilerController;
+@property SNTConfigurator *configurator;
 @end
 
 @implementation SNTEndpointSecurityRecorder {
@@ -69,6 +72,7 @@ es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
     _compilerController = compilerController;
     _authResultCache = authResultCache;
     _prefixTree = prefixTree;
+    _configurator = [SNTConfigurator configurator];
 
     [self establishClientOrDie];
   }
@@ -83,7 +87,7 @@ es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
    recordEventMetrics:(void (^)(EventDisposition))recordEventMetrics {
   // Pre-enrichment processing
   switch (esMsg->event_type) {
-    case ES_EVENT_TYPE_NOTIFY_CLOSE:
+    case ES_EVENT_TYPE_NOTIFY_CLOSE: {
       // TODO(mlw): Once we move to building with the macOS 13 SDK, we should also check
       // the `was_mapped_writable` field
       if (esMsg->event.close.modified == false) {
@@ -95,7 +99,23 @@ es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
       }
 
       self->_authResultCache->RemoveFromCache(esMsg->event.close.target);
+
+      // Only log file changes that match the given regex
+      NSString *targetPath = santa::common::StringToNSString(esMsg->event.close.target->path.data);
+      if (![[self.configurator fileChangesRegex]
+            numberOfMatchesInString:targetPath
+                            options:0
+                              range:NSMakeRange(0, targetPath.length)]) {
+        // Note: Do not record metrics in this case. These are not considered "drops"
+        // because this is not a failure case.
+        // TODO(mlw): Consider changes to configuration that would allow muting paths
+        // to filter on the kernel side rather than in user space.
+        return;
+      }
+
       break;
+    }
+
     default: break;
   }
 
@@ -110,11 +130,11 @@ es_file_t *GetTargetFileForPrefixTree(const es_message_t *msg) {
 
   // Enrich the message inline with the ES handler block to capture enrichment
   // data as close to the source event as possible.
-  std::shared_ptr<EnrichedMessage> sharedEnrichedMessage = _enricher->Enrich(std::move(esMsg));
+  std::unique_ptr<EnrichedMessage> enrichedMessage = _enricher->Enrich(std::move(esMsg));
 
   // Asynchronously log the message
-  [self processEnrichedMessage:std::move(sharedEnrichedMessage)
-                       handler:^(std::shared_ptr<EnrichedMessage> msg) {
+  [self processEnrichedMessage:std::move(enrichedMessage)
+                       handler:^(std::unique_ptr<EnrichedMessage> msg) {
                          self->_logger->Log(std::move(msg));
                          recordEventMetrics(EventDisposition::kProcessed);
                        }];

Source/santad/EventProviders/SNTEndpointSecurityRecorderTest.mm

@@ -23,6 +23,7 @@
 #include <set>
 
 #include "Source/common/PrefixTree.h"
+#import "Source/common/SNTConfigurator.h"
 #include "Source/common/TestUtils.h"
 #include "Source/common/Unit.h"
 #import "Source/santad/EventProviders/AuthResultCache.h"
@@ -48,7 +49,7 @@ using santa::santad::logs::endpoint_security::Logger;
 
 class MockEnricher : public Enricher {
  public:
-  MOCK_METHOD(std::shared_ptr<EnrichedMessage>, Enrich, (Message &&));
+  MOCK_METHOD(std::unique_ptr<EnrichedMessage>, Enrich, (Message &&));
 };
 
 class MockAuthResultCache : public AuthResultCache {
@@ -62,14 +63,25 @@ class MockLogger : public Logger {
  public:
   using Logger::Logger;
 
-  MOCK_METHOD(void, Log, (std::shared_ptr<EnrichedMessage>));
+  MOCK_METHOD(void, Log, (std::unique_ptr<EnrichedMessage>));
 };
 
 @interface SNTEndpointSecurityRecorderTest : XCTestCase
+@property id mockConfigurator;
 @end
 
 @implementation SNTEndpointSecurityRecorderTest
 
+- (void)setUp {
+  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
+  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
+  NSString *testPattern = @"^/foo/match.*";
+  NSRegularExpression *re = [NSRegularExpression regularExpressionWithPattern:testPattern
+                                                                      options:0
+                                                                        error:NULL];
+  OCMStub([self.mockConfigurator fileChangesRegex]).andReturn(re);
+}
+
 - (void)testEnable {
   // Ensure the client subscribes to expected event types
   std::set<es_event_type_t> expectedEventSubs{
@@ -94,19 +106,21 @@ class MockLogger : public Logger {
   es_file_t file = MakeESFile("foo");
   es_process_t proc = MakeESProcess(&file);
   es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_NOTIFY_CLOSE, &proc, ActionType::Auth);
-  es_file_t targetFile = MakeESFile("bar");
+  es_file_t targetFileMatchesRegex = MakeESFile("/foo/matches");
+  es_file_t targetFileMissesRegex = MakeESFile("/foo/misses");
 
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   mockESApi->SetExpectationsESNewClient();
   mockESApi->SetExpectationsRetainReleaseMessage();
 
-  std::shared_ptr<EnrichedMessage> enrichedMsg = std::shared_ptr<EnrichedMessage>(nullptr);
+  std::unique_ptr<EnrichedMessage> enrichedMsg = std::unique_ptr<EnrichedMessage>(nullptr);
 
   auto mockEnricher = std::make_shared<MockEnricher>();
-  EXPECT_CALL(*mockEnricher, Enrich).WillOnce(testing::Return(enrichedMsg));
+  EXPECT_CALL(*mockEnricher, Enrich).WillOnce(testing::Return(std::move(enrichedMsg)));
 
   auto mockAuthCache = std::make_shared<MockAuthResultCache>(nullptr, nil);
-  EXPECT_CALL(*mockAuthCache, RemoveFromCache(&targetFile)).Times(1);
+  EXPECT_CALL(*mockAuthCache, RemoveFromCache(&targetFileMatchesRegex)).Times(1);
+  EXPECT_CALL(*mockAuthCache, RemoveFromCache(&targetFileMissesRegex)).Times(1);
 
   dispatch_semaphore_t semaMetrics = dispatch_semaphore_create(0);
 
@@ -145,11 +159,11 @@ class MockLogger : public Logger {
                                 }]);
   }
 
-  // CLOSE modified, remove from cache
+  // CLOSE modified, remove from cache, and matches fileChangesRegex
   {
     esMsg.event_type = ES_EVENT_TYPE_NOTIFY_CLOSE;
     esMsg.event.close.modified = true;
-    esMsg.event.close.target = &targetFile;
+    esMsg.event.close.target = &targetFileMatchesRegex;
     Message msg(mockESApi, &esMsg);
 
     OCMExpect([mockCC handleEvent:msg withLogger:nullptr]).ignoringNonObjectArgs();
@@ -164,10 +178,22 @@ class MockLogger : public Logger {
     XCTAssertSemaTrue(sema, 5, "Log wasn't called within expected time window");
   }
 
+  // CLOSE modified, remove from cache, but doesn't match fileChangesRegex
+  {
+    esMsg.event_type = ES_EVENT_TYPE_NOTIFY_CLOSE;
+    esMsg.event.close.modified = true;
+    esMsg.event.close.target = &targetFileMissesRegex;
+    Message msg(mockESApi, &esMsg);
+    XCTAssertNoThrow([recorderClient handleMessage:Message(mockESApi, &esMsg)
+                                recordEventMetrics:^(EventDisposition d) {
+                                  XCTFail("Metrics record callback should not be called here");
+                                }]);
+  }
+
   // LINK, Prefix match, bail early
   {
     esMsg.event_type = ES_EVENT_TYPE_NOTIFY_LINK;
-    esMsg.event.link.source = &targetFile;
+    esMsg.event.link.source = &targetFileMatchesRegex;
     prefixTree->InsertPrefix(esMsg.event.link.source->path.data, Unit{});
     Message msg(mockESApi, &esMsg);
 

Source/santad/EventProviders/SNTEndpointSecurityTamperResistance.mm

@@ -111,7 +111,6 @@ static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-drive
 
 - (void)enable {
   [super enableTargetPathWatching];
-  [super unmuteEverything];
 
   // Get the set of protected paths
   std::set<std::string> protectedPaths = [SNTEndpointSecurityTamperResistance getProtectedPaths];

Source/santad/EventProviders/SNTEndpointSecurityTamperResistanceTest.mm

@@ -65,7 +65,6 @@ static constexpr std::string_view kSantaKextIdentifier = "com.google.santa-drive
 
   // Setup mocks to handle inverting target path muting
   EXPECT_CALL(*mockESApi, InvertTargetPathMuting).WillOnce(testing::Return(true));
-  EXPECT_CALL(*mockESApi, UnmuteAllPaths).WillOnce(testing::Return(true));
   EXPECT_CALL(*mockESApi, UnmuteAllTargetPaths).WillOnce(testing::Return(true));
 
   // Setup mocks to handle muting the rules db and events db

Source/santad/Logs/EndpointSecurity/Logger.h

@@ -26,6 +26,7 @@
 #include "Source/santad/EventProviders/EndpointSecurity/Message.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h"
 #include "Source/santad/Logs/EndpointSecurity/Writers/Writer.h"
+#import "Source/santad/SNTDecisionCache.h"
 
 // Forward declarations
 @class SNTStoredEvent;
@@ -39,8 +40,8 @@ class Logger {
  public:
   static std::unique_ptr<Logger> Create(
     std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
-    SNTEventLogType log_type, NSString *event_log_path, NSString *spool_log_path,
-    size_t spool_dir_size_threshold, size_t spool_file_size_threshold,
+    SNTEventLogType log_type, SNTDecisionCache *decision_cache, NSString *event_log_path,
+    NSString *spool_log_path, size_t spool_dir_size_threshold, size_t spool_file_size_threshold,
     uint64_t spool_flush_timeout_ms);
 
   Logger(std::shared_ptr<serializers::Serializer> serializer,
@@ -49,7 +50,7 @@ class Logger {
   virtual ~Logger() = default;
 
   virtual void Log(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage> msg);
+    std::unique_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage> msg);
 
   void LogAllowlist(const santa::santad::event_providers::endpoint_security::Message &msg,
                     const std::string_view hash);

Source/santad/Logs/EndpointSecurity/Logger.mm

@@ -20,10 +20,12 @@
 #include "Source/santad/Logs/EndpointSecurity/Serializers/BasicString.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/Empty.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.h"
+#include "Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h"
 #include "Source/santad/Logs/EndpointSecurity/Writers/File.h"
 #include "Source/santad/Logs/EndpointSecurity/Writers/Null.h"
 #include "Source/santad/Logs/EndpointSecurity/Writers/Spool.h"
 #include "Source/santad/Logs/EndpointSecurity/Writers/Syslog.h"
+#include "Source/santad/SNTDecisionCache.h"
 
 using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
 using santa::santad::event_providers::endpoint_security::EnrichedMessage;
@@ -48,26 +50,33 @@ static const size_t kMaxExpectedWriteSizeBytes = 4096;
 
 // Translate configured log type to appropriate Serializer/Writer pairs
 std::unique_ptr<Logger> Logger::Create(std::shared_ptr<EndpointSecurityAPI> esapi,
-                                       SNTEventLogType log_type, NSString *event_log_path,
-                                       NSString *spool_log_path, size_t spool_dir_size_threshold,
+                                       SNTEventLogType log_type, SNTDecisionCache *decision_cache,
+                                       NSString *event_log_path, NSString *spool_log_path,
+                                       size_t spool_dir_size_threshold,
                                        size_t spool_file_size_threshold,
                                        uint64_t spool_flush_timeout_ms) {
   switch (log_type) {
     case SNTEventLogTypeFilelog:
       return std::make_unique<Logger>(
-        BasicString::Create(esapi),
+        BasicString::Create(esapi, std::move(decision_cache)),
         File::Create(event_log_path, kFlushBufferTimeoutMS, kBufferBatchSizeBytes,
                      kMaxExpectedWriteSizeBytes));
     case SNTEventLogTypeSyslog:
-      return std::make_unique<Logger>(BasicString::Create(esapi, false), Syslog::Create());
+      return std::make_unique<Logger>(BasicString::Create(esapi, std::move(decision_cache), false),
+                                      Syslog::Create());
     case SNTEventLogTypeNull: return std::make_unique<Logger>(Empty::Create(), Null::Create());
     case SNTEventLogTypeProtobuf:
       LOGW(@"The EventLogType value protobuf is currently in beta. The protobuf schema is subject "
            @"to change.");
       return std::make_unique<Logger>(
-        Protobuf::Create(esapi),
+        Protobuf::Create(esapi, std::move(decision_cache)),
         Spool::Create([spool_log_path UTF8String], spool_dir_size_threshold,
                       spool_file_size_threshold, spool_flush_timeout_ms));
+    case SNTEventLogTypeJSON:
+      return std::make_unique<Logger>(
+        Protobuf::Create(esapi, std::move(decision_cache), true),
+        File::Create(event_log_path, kFlushBufferTimeoutMS, kBufferBatchSizeBytes,
+                     kMaxExpectedWriteSizeBytes));
     default: LOGE(@"Invalid log type: %ld", log_type); return nullptr;
   }
 }
@@ -76,7 +85,7 @@ Logger::Logger(std::shared_ptr<serializers::Serializer> serializer,
                std::shared_ptr<writers::Writer> writer)
     : serializer_(std::move(serializer)), writer_(std::move(writer)) {}
 
-void Logger::Log(std::shared_ptr<EnrichedMessage> msg) {
+void Logger::Log(std::unique_ptr<EnrichedMessage> msg) {
   writer_->Write(serializer_->SerializeMessage(std::move(msg)));
 }
 

Source/santad/Logs/EndpointSecurity/LoggerTest.mm

@@ -103,28 +103,33 @@ class MockWriter : public Null {
   // Ensure that the factory method creates expected serializers/writers pairs
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
 
-  XCTAssertEqual(nullptr, Logger::Create(mockESApi, (SNTEventLogType)123, @"/tmp/temppy",
+  XCTAssertEqual(nullptr, Logger::Create(mockESApi, (SNTEventLogType)123, nil, @"/tmp/temppy",
                                          @"/tmp/spool", 1, 1, 1));
 
   LoggerPeer logger(
-    Logger::Create(mockESApi, SNTEventLogTypeFilelog, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
+    Logger::Create(mockESApi, SNTEventLogTypeFilelog, nil, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<BasicString>(logger.Serializer()));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<File>(logger.Writer()));
 
   logger = LoggerPeer(
-    Logger::Create(mockESApi, SNTEventLogTypeSyslog, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
+    Logger::Create(mockESApi, SNTEventLogTypeSyslog, nil, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<BasicString>(logger.Serializer()));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Syslog>(logger.Writer()));
 
   logger = LoggerPeer(
-    Logger::Create(mockESApi, SNTEventLogTypeNull, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
+    Logger::Create(mockESApi, SNTEventLogTypeNull, nil, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Empty>(logger.Serializer()));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Null>(logger.Writer()));
 
-  logger = LoggerPeer(
-    Logger::Create(mockESApi, SNTEventLogTypeProtobuf, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
+  logger = LoggerPeer(Logger::Create(mockESApi, SNTEventLogTypeProtobuf, nil, @"/tmp/temppy",
+                                     @"/tmp/spool", 1, 1, 1));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Protobuf>(logger.Serializer()));
   XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Spool>(logger.Writer()));
+
+  logger = LoggerPeer(
+    Logger::Create(mockESApi, SNTEventLogTypeJSON, nil, @"/tmp/temppy", @"/tmp/spool", 1, 1, 1));
+  XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<Protobuf>(logger.Serializer()));
+  XCTAssertNotEqual(nullptr, std::dynamic_pointer_cast<File>(logger.Writer()));
 }
 
 - (void)testLog {
@@ -136,16 +141,19 @@ class MockWriter : public Null {
   es_message_t msg;
 
   mockESApi->SetExpectationsRetainReleaseMessage();
-  auto enrichedMsg = std::make_shared<EnrichedMessage>(
-    EnrichedClose(Message(mockESApi, &msg),
-                  EnrichedProcess(std::nullopt, std::nullopt, std::nullopt, std::nullopt,
-                                  EnrichedFile(std::nullopt, std::nullopt, std::nullopt)),
-                  EnrichedFile(std::nullopt, std::nullopt, std::nullopt)));
 
-  EXPECT_CALL(*mockSerializer, SerializeMessage(testing::A<const EnrichedClose &>())).Times(1);
-  EXPECT_CALL(*mockWriter, Write).Times(1);
+  {
+    auto enrichedMsg = std::make_unique<EnrichedMessage>(
+      EnrichedClose(Message(mockESApi, &msg),
+                    EnrichedProcess(std::nullopt, std::nullopt, std::nullopt, std::nullopt,
+                                    EnrichedFile(std::nullopt, std::nullopt, std::nullopt)),
+                    EnrichedFile(std::nullopt, std::nullopt, std::nullopt)));
 
-  Logger(mockSerializer, mockWriter).Log(enrichedMsg);
+    EXPECT_CALL(*mockSerializer, SerializeMessage(testing::A<const EnrichedClose &>())).Times(1);
+    EXPECT_CALL(*mockWriter, Write).Times(1);
+
+    Logger(mockSerializer, mockWriter).Log(std::move(enrichedMsg));
+  }
 
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
   XCTBubbleMockVerifyAndClearExpectations(mockSerializer.get());

Source/santad/Logs/EndpointSecurity/Serializers/BasicString.h

@@ -24,6 +24,7 @@
 #import "Source/common/SNTCachedDecision.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h"
+#import "Source/santad/SNTDecisionCache.h"
 
 namespace santa::santad::logs::endpoint_security::serializers {
 
@@ -31,11 +32,11 @@ class BasicString : public Serializer {
  public:
   static std::shared_ptr<BasicString> Create(
     std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
-    bool prefix_time_name = true);
+    SNTDecisionCache *decision_cache, bool prefix_time_name = true);
 
   BasicString(
     std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
-    bool prefix_time_name);
+    SNTDecisionCache *decision_cache, bool prefix_time_name);
 
   std::vector<uint8_t> SerializeMessage(
     const santa::santad::event_providers::endpoint_security::EnrichedClose &) override;

Source/santad/Logs/EndpointSecurity/Serializers/BasicString.mm

@@ -29,7 +29,6 @@
 #include <string>
 
 #import "Source/common/SNTCachedDecision.h"
-#import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/SanitizableString.h"
@@ -92,11 +91,13 @@ std::string GetReasonString(SNTEventState event_state) {
     case SNTEventStateAllowCertificate: return "CERT";
     case SNTEventStateAllowScope: return "SCOPE";
     case SNTEventStateAllowTeamID: return "TEAMID";
+    case SNTEventStateAllowSigningID: return "SIGNINGID";
     case SNTEventStateAllowUnknown: return "UNKNOWN";
     case SNTEventStateBlockBinary: return "BINARY";
     case SNTEventStateBlockCertificate: return "CERT";
     case SNTEventStateBlockScope: return "SCOPE";
     case SNTEventStateBlockTeamID: return "TEAMID";
+    case SNTEventStateBlockSigningID: return "SIGNINGID";
     case SNTEventStateBlockLongPath: return "LONG_PATH";
     case SNTEventStateBlockUnknown: return "UNKNOWN";
     default: return "NOTRUNNING";
@@ -177,12 +178,14 @@ static char *FormattedDateString(char *buf, size_t len) {
 }
 
 std::shared_ptr<BasicString> BasicString::Create(std::shared_ptr<EndpointSecurityAPI> esapi,
+                                                 SNTDecisionCache *decision_cache,
                                                  bool prefix_time_name) {
-  return std::make_shared<BasicString>(esapi, prefix_time_name);
+  return std::make_shared<BasicString>(esapi, decision_cache, prefix_time_name);
 }
 
-BasicString::BasicString(std::shared_ptr<EndpointSecurityAPI> esapi, bool prefix_time_name)
-    : esapi_(esapi), prefix_time_name_(prefix_time_name) {}
+BasicString::BasicString(std::shared_ptr<EndpointSecurityAPI> esapi,
+                         SNTDecisionCache *decision_cache, bool prefix_time_name)
+    : Serializer(std::move(decision_cache)), esapi_(esapi), prefix_time_name_(prefix_time_name) {}
 
 std::string BasicString::CreateDefaultString(size_t reserved_size) {
   std::string str;
@@ -245,9 +248,6 @@ std::vector<uint8_t> BasicString::SerializeMessage(const EnrichedExec &msg, SNTC
   const es_message_t &esm = msg.es_msg();
   std::string str = CreateDefaultString(1024);  // EXECs tend to be bigger, reserve more space.
 
-  // Only need to grab the shared instance once
-  static SNTConfigurator *configurator = [SNTConfigurator configurator];
-
   str.append("action=EXEC|decision=");
   str.append(GetDecisionString(cd.decision));
   str.append("|reason=");
@@ -291,7 +291,7 @@ std::vector<uint8_t> BasicString::SerializeMessage(const EnrichedExec &msg, SNTC
                   msg.instigator().real_group());
 
   str.append("|mode=");
-  str.append(GetModeString([configurator clientMode]));
+  str.append(GetModeString(cd.decisionClientMode));
   str.append("|path=");
   str.append(FilePath(esm.event.exec.target->executable).Sanitized());
 

Source/santad/Logs/EndpointSecurity/Serializers/BasicStringTest.mm

@@ -56,10 +56,10 @@ using santa::santad::logs::endpoint_security::serializers::GetModeString;
 using santa::santad::logs::endpoint_security::serializers::GetReasonString;
 
 std::string BasicStringSerializeMessage(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
-                                        es_message_t *esMsg) {
+                                        es_message_t *esMsg, SNTDecisionCache *decisionCache) {
   mockESApi->SetExpectationsRetainReleaseMessage();
 
-  std::shared_ptr<Serializer> bs = BasicString::Create(mockESApi, false);
+  std::shared_ptr<Serializer> bs = BasicString::Create(mockESApi, decisionCache, false);
   std::vector<uint8_t> ret = bs->SerializeMessage(Enricher().Enrich(Message(mockESApi, esMsg)));
 
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
@@ -69,7 +69,7 @@ std::string BasicStringSerializeMessage(std::shared_ptr<MockEndpointSecurityAPI>
 
 std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
-  return BasicStringSerializeMessage(mockESApi, esMsg);
+  return BasicStringSerializeMessage(mockESApi, esMsg, nil);
 }
 
 @interface BasicStringTest : XCTestCase
@@ -94,6 +94,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   self.testCachedDecision.sha256 = @"1234_hash";
   self.testCachedDecision.quarantineURL = @"google.com";
   self.testCachedDecision.certSHA256 = @"5678_hash";
+  self.testCachedDecision.decisionClientMode = SNTClientModeLockdown;
 
   self.mockDecisionCache = OCMClassMock([SNTDecisionCache class]);
   OCMStub([self.mockDecisionCache sharedCache]).andReturn(self.mockDecisionCache);
@@ -163,7 +164,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
     .WillOnce(testing::Return(es_string_token_t{5, "-l\n-t"}))
     .WillOnce(testing::Return(es_string_token_t{8, "-v\r--foo"}));
 
-  std::string got = BasicStringSerializeMessage(mockESApi, &esMsg);
+  std::string got = BasicStringSerializeMessage(mockESApi, &esMsg, self.mockDecisionCache);
   std::string want =
     "action=EXEC|decision=ALLOW|reason=BINARY|explain=extra!|sha256=1234_hash|"
     "cert_sha256=5678_hash|cert_cn=|quarantine_url=google.com|pid=12|pidversion="
@@ -289,7 +290,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   mockESApi->SetExpectationsRetainReleaseMessage();
 
   std::vector<uint8_t> ret =
-    BasicString::Create(nullptr, false)
+    BasicString::Create(nullptr, nil, false)
       ->SerializeFileAccess("v1.0", "pol_name", Message(mockESApi, &esMsg),
                             Enricher().Enrich(*esMsg.process), "file_target",
                             FileAccessPolicyDecision::kAllowedAuditOnly);
@@ -310,7 +311,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   mockESApi->SetExpectationsRetainReleaseMessage();
 
-  std::vector<uint8_t> ret = BasicString::Create(mockESApi, false)
+  std::vector<uint8_t> ret = BasicString::Create(mockESApi, nil, false)
                                ->SerializeAllowlist(Message(mockESApi, &esMsg), "test_hash");
 
   XCTAssertTrue(testing::Mock::VerifyAndClearExpectations(mockESApi.get()),
@@ -333,7 +334,8 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   se.fileBundlePath = @"file_bundle_path";
   se.filePath = @"file_path";
 
-  std::vector<uint8_t> ret = BasicString::Create(nullptr, false)->SerializeBundleHashingEvent(se);
+  std::vector<uint8_t> ret =
+    BasicString::Create(nullptr, nil, false)->SerializeBundleHashingEvent(se);
   std::string got(ret.begin(), ret.end());
 
   std::string want = "action=BUNDLE|sha256=file_hash"
@@ -360,7 +362,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
   OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
   OCMStub([self.mockConfigurator enableMachineIDDecoration]).andReturn(NO);
 
-  std::vector<uint8_t> ret = BasicString::Create(nullptr, false)->SerializeDiskAppeared(props);
+  std::vector<uint8_t> ret = BasicString::Create(nullptr, nil, false)->SerializeDiskAppeared(props);
   std::string got(ret.begin(), ret.end());
 
   std::string want = "action=DISKAPPEAR|mount=path|volume=|bsdname=bsd|fs=apfs"
@@ -376,7 +378,8 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
     @"DAMediaBSDName" : @"bsd",
   };
 
-  std::vector<uint8_t> ret = BasicString::Create(nullptr, false)->SerializeDiskDisappeared(props);
+  std::vector<uint8_t> ret =
+    BasicString::Create(nullptr, nil, false)->SerializeDiskDisappeared(props);
   std::string got(ret.begin(), ret.end());
 
   std::string want = "action=DISKDISAPPEAR|mount=path|volume=|bsdname=bsd|machineid=my_id\n";
@@ -418,6 +421,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
     {SNTEventStateBlockCertificate, "CERT"},
     {SNTEventStateBlockScope, "SCOPE"},
     {SNTEventStateBlockTeamID, "TEAMID"},
+    {SNTEventStateBlockSigningID, "SIGNINGID"},
     {SNTEventStateBlockLongPath, "LONG_PATH"},
     {SNTEventStateAllowUnknown, "UNKNOWN"},
     {SNTEventStateAllowBinary, "BINARY"},
@@ -427,6 +431,7 @@ std::string BasicStringSerializeMessage(es_message_t *esMsg) {
     {SNTEventStateAllowTransitive, "TRANSITIVE"},
     {SNTEventStateAllowPendingTransitive, "PENDING_TRANSITIVE"},
     {SNTEventStateAllowTeamID, "TEAMID"},
+    {SNTEventStateAllowSigningID, "SIGNINGID"},
   };
 
   for (const auto &kv : stateToReason) {

Source/santad/Logs/EndpointSecurity/Serializers/Empty.h

@@ -28,6 +28,7 @@ namespace santa::santad::logs::endpoint_security::serializers {
 class Empty : public Serializer {
  public:
   static std::shared_ptr<Empty> Create();
+  Empty();
 
   std::vector<uint8_t> SerializeMessage(
     const santa::santad::event_providers::endpoint_security::EnrichedClose &) override;

Source/santad/Logs/EndpointSecurity/Serializers/Empty.mm

@@ -31,6 +31,8 @@ std::shared_ptr<Empty> Empty::Create() {
   return std::make_shared<Empty>();
 }
 
+Empty::Empty() : Serializer(nil) {}
+
 std::vector<uint8_t> Empty::SerializeMessage(const EnrichedClose &msg) {
   return {};
 }

Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.h

@@ -25,16 +25,19 @@
 #include "Source/common/santa_proto_include_wrapper.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
 #include "Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h"
+#import "Source/santad/SNTDecisionCache.h"
 
 namespace santa::santad::logs::endpoint_security::serializers {
 
 class Protobuf : public Serializer {
  public:
   static std::shared_ptr<Protobuf> Create(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi);
+    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
+    SNTDecisionCache *decision_cache, bool json = false);
 
   Protobuf(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi);
+    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
+    SNTDecisionCache *decision_cache, bool json = false);
 
   std::vector<uint8_t> SerializeMessage(
     const santa::santad::event_providers::endpoint_security::EnrichedClose &) override;
@@ -84,6 +87,9 @@ class Protobuf : public Serializer {
   std::vector<uint8_t> FinalizeProto(::santa::pb::v1::SantaMessage *santa_msg);
 
   std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi_;
+  // Toggle for transforming protobuf output to its JSON form.
+  // See https://protobuf.dev/programming-guides/proto3/#json
+  bool json_;
 };
 
 }  // namespace santa::santad::logs::endpoint_security::serializers

Source/santad/Logs/EndpointSecurity/Serializers/Protobuf.mm

@@ -17,6 +17,8 @@
 #include <EndpointSecurity/EndpointSecurity.h>
 #include <Kernel/kern/cs_blobs.h>
 #include <bsm/libbsm.h>
+#include <google/protobuf/stubs/status.h>
+#include <google/protobuf/util/json_util.h>
 #include <mach/message.h>
 #include <math.h>
 #include <sys/proc_info.h>
@@ -28,7 +30,6 @@
 #include <string_view>
 
 #import "Source/common/SNTCachedDecision.h"
-#import "Source/common/SNTConfigurator.h"
 #include "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #import "Source/common/String.h"
@@ -39,6 +40,8 @@
 
 using google::protobuf::Arena;
 using google::protobuf::Timestamp;
+using google::protobuf::util::JsonPrintOptions;
+using google::protobuf::util::MessageToJsonString;
 
 using santa::common::NSStringToUTF8StringView;
 using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
@@ -66,11 +69,14 @@ namespace pbv1 = ::santa::pb::v1;
 
 namespace santa::santad::logs::endpoint_security::serializers {
 
-std::shared_ptr<Protobuf> Protobuf::Create(std::shared_ptr<EndpointSecurityAPI> esapi) {
-  return std::make_shared<Protobuf>(esapi);
+std::shared_ptr<Protobuf> Protobuf::Create(std::shared_ptr<EndpointSecurityAPI> esapi,
+                                           SNTDecisionCache *decision_cache, bool json) {
+  return std::make_shared<Protobuf>(esapi, std::move(decision_cache), json);
 }
 
-Protobuf::Protobuf(std::shared_ptr<EndpointSecurityAPI> esapi) : esapi_(esapi) {}
+Protobuf::Protobuf(std::shared_ptr<EndpointSecurityAPI> esapi, SNTDecisionCache *decision_cache,
+                   bool json)
+    : Serializer(std::move(decision_cache)), esapi_(esapi), json_(json) {}
 
 static inline void EncodeTimestamp(Timestamp *timestamp, struct timespec ts) {
   timestamp->set_seconds(ts.tv_sec);
@@ -287,11 +293,13 @@ static inline void EncodeCertificateInfo(::pbv1::CertificateInfo *pb_cert_info,
     case SNTEventStateAllowCertificate: return ::pbv1::Execution::REASON_CERT;
     case SNTEventStateAllowScope: return ::pbv1::Execution::REASON_SCOPE;
     case SNTEventStateAllowTeamID: return ::pbv1::Execution::REASON_TEAM_ID;
+    case SNTEventStateAllowSigningID: return ::pbv1::Execution::REASON_SIGNING_ID;
     case SNTEventStateAllowUnknown: return ::pbv1::Execution::REASON_UNKNOWN;
     case SNTEventStateBlockBinary: return ::pbv1::Execution::REASON_BINARY;
     case SNTEventStateBlockCertificate: return ::pbv1::Execution::REASON_CERT;
     case SNTEventStateBlockScope: return ::pbv1::Execution::REASON_SCOPE;
     case SNTEventStateBlockTeamID: return ::pbv1::Execution::REASON_TEAM_ID;
+    case SNTEventStateBlockSigningID: return ::pbv1::Execution::REASON_SIGNING_ID;
     case SNTEventStateBlockLongPath: return ::pbv1::Execution::REASON_LONG_PATH;
     case SNTEventStateBlockUnknown: return ::pbv1::Execution::REASON_UNKNOWN;
     default: return ::pbv1::Execution::REASON_NOT_RUNNING;
@@ -384,6 +392,26 @@ static inline void EncodeCertificateInfo(::pbv1::CertificateInfo *pb_cert_info,
 }
 
 std::vector<uint8_t> Protobuf::FinalizeProto(::pbv1::SantaMessage *santa_msg) {
+  if (this->json_) {
+    // TODO: Profile this. It's probably not the most efficient way to do this.
+    JsonPrintOptions options;
+    options.always_print_enums_as_ints = false;
+    options.always_print_primitive_fields = true;
+    options.preserve_proto_field_names = true;
+    std::string json;
+
+    google::protobuf::util::Status status = MessageToJsonString(*santa_msg, &json, options);
+
+    if (!status.ok()) {
+      LOGE(@"Failed to convert protobuf to JSON: %s", status.ToString().c_str());
+    }
+
+    std::vector<uint8_t> vec(json.begin(), json.end());
+    // Add a newline to the end of the JSON row.
+    vec.push_back('\n');
+    return vec;
+  }
+
   std::vector<uint8_t> vec(santa_msg->ByteSizeLong());
   santa_msg->SerializeWithCachedSizesToArray(vec.data());
   return vec;
@@ -423,9 +451,6 @@ std::vector<uint8_t> Protobuf::SerializeMessage(const EnrichedExec &msg, SNTCach
   Arena arena;
   ::pbv1::SantaMessage *santa_msg = CreateDefaultProto(&arena, msg);
 
-  // Only need to grab the shared instance once
-  static SNTConfigurator *configurator = [SNTConfigurator configurator];
-
   GetDecisionEnum(cd.decision);
 
   ::pbv1::Execution *pb_exec = santa_msg->mutable_execution();
@@ -486,7 +511,7 @@ std::vector<uint8_t> Protobuf::SerializeMessage(const EnrichedExec &msg, SNTCach
 
   pb_exec->set_decision(GetDecisionEnum(cd.decision));
   pb_exec->set_reason(GetReasonEnum(cd.decision));
-  pb_exec->set_mode(GetModeEnum([configurator clientMode]));
+  pb_exec->set_mode(GetModeEnum(cd.decisionClientMode));
 
   if (cd.certSHA256 || cd.certCommonName) {
     EncodeCertificateInfo(pb_exec->mutable_certificate_info(), cd.certSHA256, cd.certCommonName);

Source/santad/Logs/EndpointSecurity/Serializers/ProtobufTest.mm

@@ -18,6 +18,7 @@
 #import <OCMock/OCMock.h>
 #import <XCTest/XCTest.h>
 #include <gmock/gmock.h>
+#include <google/protobuf/util/json_util.h>
 #include <gtest/gtest.h>
 #include <sys/proc_info.h>
 #include <sys/signal.h>
@@ -26,8 +27,6 @@
 #include <uuid/uuid.h>
 #include <cstring>
 
-#include <google/protobuf/util/json_util.h>
-
 #import "Source/common/SNTCachedDecision.h"
 #include "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
@@ -46,6 +45,7 @@
 
 using google::protobuf::Timestamp;
 using google::protobuf::util::JsonPrintOptions;
+using google::protobuf::util::JsonStringToMessage;
 using santa::santad::event_providers::endpoint_security::EnrichedEventType;
 using santa::santad::event_providers::endpoint_security::EnrichedMessage;
 using santa::santad::event_providers::endpoint_security::Enricher;
@@ -128,12 +128,6 @@ bool CompareTime(const Timestamp &timestamp, struct timespec ts) {
   return timestamp.seconds() == ts.tv_sec && timestamp.nanos() == ts.tv_nsec;
 }
 
-void CheckSantaMessage(const ::pbv1::SantaMessage &santaMsg, const es_message_t &esMsg,
-                       struct timespec enrichmentTime) {
-  XCTAssertTrue(CompareTime(santaMsg.processed_time(), enrichmentTime));
-  XCTAssertTrue(CompareTime(santaMsg.event_time(), esMsg.time));
-}
-
 const google::protobuf::Message &SantaMessageEvent(const ::pbv1::SantaMessage &santaMsg) {
   switch (santaMsg.event_case()) {
     case ::pbv1::SantaMessage::kExecution: return santaMsg.execution();
@@ -167,23 +161,34 @@ std::string ConvertMessageToJsonString(const ::pbv1::SantaMessage &santaMsg) {
   return json;
 }
 
-void CheckProto(const ::pbv1::SantaMessage &santaMsg,
-                std::shared_ptr<EnrichedMessage> enrichedMsg) {
-  return std::visit(
-    [santaMsg](const EnrichedEventType &enrichedEvent) {
-      CheckSantaMessage(santaMsg, enrichedEvent.es_msg(), enrichedEvent.enrichment_time());
-      NSString *wantData = LoadTestJson(EventTypeToFilename(enrichedEvent.es_msg().event_type),
-                                        enrichedEvent.es_msg().version);
-      std::string got = ConvertMessageToJsonString(santaMsg);
+NSDictionary *findDelta(NSDictionary *a, NSDictionary *b) {
+  NSMutableDictionary *delta = NSMutableDictionary.dictionary;
 
-      XCTAssertEqualObjects([NSString stringWithUTF8String:got.c_str()], wantData);
-    },
-    enrichedMsg->GetEnrichedMessage());
+  // Find objects in a that don't exist or are different in b.
+  [a enumerateKeysAndObjectsUsingBlock:^(id _Nonnull key, id _Nonnull obj, BOOL *_Nonnull stop) {
+    id otherObj = b[key];
+
+    if (![obj isEqual:otherObj]) {
+      delta[key] = obj;
+    }
+  }];
+
+  // Find objects in the other dictionary that don't exist in self
+  [b enumerateKeysAndObjectsUsingBlock:^(id _Nonnull key, id _Nonnull obj, BOOL *_Nonnull stop) {
+    id aObj = a[key];
+
+    if (!aObj) {
+      delta[key] = obj;
+    }
+  }];
+
+  return delta;
 }
 
 void SerializeAndCheck(es_event_type_t eventType,
                        void (^messageSetup)(std::shared_ptr<MockEndpointSecurityAPI>,
-                                            es_message_t *)) {
+                                            es_message_t *),
+                       SNTDecisionCache *decisionCache, bool json = false) {
   std::shared_ptr<MockEndpointSecurityAPI> mockESApi = std::make_shared<MockEndpointSecurityAPI>();
 
   for (uint32_t cur_version = 1; cur_version <= MaxSupportedESMessageVersionForCurrentOS();
@@ -204,16 +209,62 @@ void SerializeAndCheck(es_event_type_t eventType,
 
     messageSetup(mockESApi, &esMsg);
 
-    std::shared_ptr<Serializer> bs = Protobuf::Create(mockESApi);
-    std::shared_ptr<EnrichedMessage> enrichedMsg = Enricher().Enrich(Message(mockESApi, &esMsg));
+    std::shared_ptr<Serializer> bs = Protobuf::Create(mockESApi, decisionCache, json);
+    std::unique_ptr<EnrichedMessage> enrichedMsg = Enricher().Enrich(Message(mockESApi, &esMsg));
 
-    std::vector<uint8_t> vec = bs->SerializeMessage(enrichedMsg);
+    // Copy some values we need to check later before the object is moved out of this funciton
+    struct timespec enrichmentTime;
+    struct timespec msgTime;
+    NSString *wantData = std::visit(
+      [&msgTime, &enrichmentTime](const EnrichedEventType &enrichedEvent) {
+        msgTime = enrichedEvent.es_msg().time;
+        enrichmentTime = enrichedEvent.enrichment_time();
+
+        return LoadTestJson(EventTypeToFilename(enrichedEvent.es_msg().event_type),
+                            enrichedEvent.es_msg().version);
+      },
+      enrichedMsg->GetEnrichedMessage());
+
+    std::vector<uint8_t> vec = bs->SerializeMessage(std::move(enrichedMsg));
     std::string protoStr(vec.begin(), vec.end());
 
+    // if we're checking against JSON then we should already have a jsonified string and just need
+    // to
     ::pbv1::SantaMessage santaMsg;
-    XCTAssertTrue(santaMsg.ParseFromString(protoStr));
+    std::string gotData;
 
-    CheckProto(santaMsg, enrichedMsg);
+    if (json) {
+      // Parse the jsonified string into the protobuf
+      // gotData = protoStr;
+      google::protobuf::util::JsonParseOptions options;
+      options.ignore_unknown_fields = true;
+      google::protobuf::util::Status status = JsonStringToMessage(protoStr, &santaMsg, options);
+      gotData = ConvertMessageToJsonString(santaMsg);
+    } else {
+      XCTAssertTrue(santaMsg.ParseFromString(protoStr));
+      gotData = ConvertMessageToJsonString(santaMsg);
+    }
+
+    XCTAssertTrue(CompareTime(santaMsg.processed_time(), enrichmentTime));
+    XCTAssertTrue(CompareTime(santaMsg.event_time(), msgTime));
+
+    // Convert JSON strings to objects and compare each key-value set.
+    NSError *jsonError;
+    NSData *objectData = [wantData dataUsingEncoding:NSUTF8StringEncoding];
+    NSDictionary *wantJSONDict =
+      [NSJSONSerialization JSONObjectWithData:objectData
+                                      options:NSJSONReadingMutableContainers
+                                        error:&jsonError];
+    XCTAssertNil(jsonError, @"failed to parse want data as JSON");
+    NSDictionary *gotJSONDict = [NSJSONSerialization
+      JSONObjectWithData:[NSData dataWithBytes:gotData.data() length:gotData.length()]
+                 options:NSJSONReadingMutableContainers
+                   error:&jsonError];
+    XCTAssertNil(jsonError, @"failed to parse got data as JSON");
+
+    // XCTAssertEqualObjects([NSString stringWithUTF8String:gotData.c_str()], wantData);
+    NSDictionary *delta = findDelta(wantJSONDict, gotJSONDict);
+    XCTAssertEqualObjects(@{}, delta);
   }
 
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
@@ -226,7 +277,7 @@ void SerializeAndCheckNonESEvents(
                                         const Message &msg)) {
   std::shared_ptr<MockEndpointSecurityAPI> mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   mockESApi->SetExpectationsRetainReleaseMessage();
-  std::shared_ptr<Serializer> bs = Protobuf::Create(mockESApi);
+  std::shared_ptr<Serializer> bs = Protobuf::Create(mockESApi, nil);
 
   for (uint32_t cur_version = 1; cur_version <= MaxSupportedESMessageVersionForCurrentOS();
        cur_version++) {
@@ -280,6 +331,7 @@ void SerializeAndCheckNonESEvents(
   self.testCachedDecision.sha256 = @"1234_file_hash";
   self.testCachedDecision.quarantineURL = @"google.com";
   self.testCachedDecision.certSHA256 = @"5678_cert_hash";
+  self.testCachedDecision.decisionClientMode = SNTClientModeLockdown;
 
   self.mockDecisionCache = OCMClassMock([SNTDecisionCache class]);
   OCMStub([self.mockDecisionCache sharedCache]).andReturn(self.mockDecisionCache);
@@ -293,25 +345,36 @@ void SerializeAndCheckNonESEvents(
   [self.mockDecisionCache stopMocking];
 }
 
+- (void)serializeAndCheckEvent:(es_event_type_t)eventType
+                  messageSetup:(void (^)(std::shared_ptr<MockEndpointSecurityAPI>,
+                                         es_message_t *))messageSetup
+                          json:(BOOL)json {
+  SerializeAndCheck(eventType, messageSetup, self.mockDecisionCache, (bool)json);
+}
+
 - (void)testSerializeMessageClose {
   __block es_file_t file = MakeESFile("close_file", MakeStat(300));
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_CLOSE,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.close.modified = true;
-                      esMsg->event.close.target = &file;
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_CLOSE
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.close.modified = true;
+                    esMsg->event.close.target = &file;
+                  }
+                          json:NO];
 }
 
 - (void)testSerializeMessageExchange {
   __block es_file_t file1 = MakeESFile("exchange_file_1", MakeStat(300));
   __block es_file_t file2 = MakeESFile("exchange_file_1", MakeStat(400));
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.exchangedata.file1 = &file1;
-                      esMsg->event.exchangedata.file2 = &file2;
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.exchangedata.file1 = &file1;
+                    esMsg->event.exchangedata.file2 = &file2;
+                  }
+                          json:NO];
 }
 
 - (void)testGetDecisionEnum {
@@ -335,7 +398,7 @@ void SerializeAndCheckNonESEvents(
   };
 
   for (const auto &kv : stateToDecision) {
-    XCTAssertEqual(GetDecisionEnum(kv.first), kv.second, @"Bad decision for state: %ld", kv.first);
+    XCTAssertEqual(GetDecisionEnum(kv.first), kv.second, @"Bad decision for state: %llu", kv.first);
   }
 }
 
@@ -348,6 +411,7 @@ void SerializeAndCheckNonESEvents(
     {SNTEventStateBlockCertificate, ::pbv1::Execution::REASON_CERT},
     {SNTEventStateBlockScope, ::pbv1::Execution::REASON_SCOPE},
     {SNTEventStateBlockTeamID, ::pbv1::Execution::REASON_TEAM_ID},
+    {SNTEventStateBlockSigningID, ::pbv1::Execution::REASON_SIGNING_ID},
     {SNTEventStateBlockLongPath, ::pbv1::Execution::REASON_LONG_PATH},
     {SNTEventStateAllowUnknown, ::pbv1::Execution::REASON_UNKNOWN},
     {SNTEventStateAllowBinary, ::pbv1::Execution::REASON_BINARY},
@@ -357,10 +421,11 @@ void SerializeAndCheckNonESEvents(
     {SNTEventStateAllowTransitive, ::pbv1::Execution::REASON_TRANSITIVE},
     {SNTEventStateAllowPendingTransitive, ::pbv1::Execution::REASON_PENDING_TRANSITIVE},
     {SNTEventStateAllowTeamID, ::pbv1::Execution::REASON_TEAM_ID},
+    {SNTEventStateAllowSigningID, ::pbv1::Execution::REASON_SIGNING_ID},
   };
 
   for (const auto &kv : stateToReason) {
-    XCTAssertEqual(GetReasonEnum(kv.first), kv.second, @"Bad reason for state: %ld", kv.first);
+    XCTAssertEqual(GetReasonEnum(kv.first), kv.second, @"Bad reason for state: %llu", kv.first);
   }
 }
 
@@ -373,7 +438,7 @@ void SerializeAndCheckNonESEvents(
   };
 
   for (const auto &kv : clientModeToExecMode) {
-    XCTAssertEqual(GetModeEnum(kv.first), kv.second, @"Bad mode for state: %ld", kv.first);
+    XCTAssertEqual(GetModeEnum(kv.first), kv.second, @"Bad mode for client mode: %ld", kv.first);
   }
 }
 
@@ -413,45 +478,102 @@ void SerializeAndCheckNonESEvents(
   procTarget.signing_id = MakeESStringToken("my_signing_id");
   procTarget.team_id = MakeESStringToken("my_team_id");
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_EXEC, ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
-                                                 es_message_t *esMsg) {
-    esMsg->event.exec.target = &procTarget;
-    esMsg->event.exec.cwd = &fileCwd;
-    esMsg->event.exec.script = &fileScript;
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_EXEC
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.exec.target = &procTarget;
+                    esMsg->event.exec.cwd = &fileCwd;
+                    esMsg->event.exec.script = &fileScript;
 
-    // For version 5, simulate a "truncated" set of FDs
-    if (esMsg->version == 5) {
-      esMsg->event.exec.last_fd = 123;
-    } else {
-      esMsg->event.exec.last_fd = 3;
-    }
+                    // For version 5, simulate a "truncated" set of FDs
+                    if (esMsg->version == 5) {
+                      esMsg->event.exec.last_fd = 123;
+                    } else {
+                      esMsg->event.exec.last_fd = 3;
+                    }
 
-    EXPECT_CALL(*mockESApi, ExecArgCount).WillOnce(testing::Return(3));
-    EXPECT_CALL(*mockESApi, ExecArg)
-      .WillOnce(testing::Return(MakeESStringToken("exec_path")))
-      .WillOnce(testing::Return(MakeESStringToken("-l")))
-      .WillOnce(testing::Return(MakeESStringToken("--foo")));
+                    EXPECT_CALL(*mockESApi, ExecArgCount).WillOnce(testing::Return(3));
+                    EXPECT_CALL(*mockESApi, ExecArg)
+                      .WillOnce(testing::Return(MakeESStringToken("exec_path")))
+                      .WillOnce(testing::Return(MakeESStringToken("-l")))
+                      .WillOnce(testing::Return(MakeESStringToken("--foo")));
 
-    EXPECT_CALL(*mockESApi, ExecEnvCount).WillOnce(testing::Return(2));
-    EXPECT_CALL(*mockESApi, ExecEnv)
-      .WillOnce(testing::Return(MakeESStringToken("ENV_PATH=/path/to/bin:/and/another")))
-      .WillOnce(testing::Return(MakeESStringToken("DEBUG=1")));
+                    EXPECT_CALL(*mockESApi, ExecEnvCount).WillOnce(testing::Return(2));
+                    EXPECT_CALL(*mockESApi, ExecEnv)
+                      .WillOnce(
+                        testing::Return(MakeESStringToken("ENV_PATH=/path/to/bin:/and/another")))
+                      .WillOnce(testing::Return(MakeESStringToken("DEBUG=1")));
 
-    if (esMsg->version >= 4) {
-      EXPECT_CALL(*mockESApi, ExecFDCount).WillOnce(testing::Return(3));
-      EXPECT_CALL(*mockESApi, ExecFD)
-        .WillOnce(testing::Return(&fd1))
-        .WillOnce(testing::Return(&fd2))
-        .WillOnce(testing::Return(&fd3));
-    }
-  });
+                    if (esMsg->version >= 4) {
+                      EXPECT_CALL(*mockESApi, ExecFDCount).WillOnce(testing::Return(3));
+                      EXPECT_CALL(*mockESApi, ExecFD)
+                        .WillOnce(testing::Return(&fd1))
+                        .WillOnce(testing::Return(&fd2))
+                        .WillOnce(testing::Return(&fd3));
+                    }
+                  }
+                          json:NO];
+}
+
+- (void)testSerializeMessageExecJSON {
+  es_file_t procFileTarget = MakeESFile("fooexec", MakeStat(300));
+  __block es_process_t procTarget =
+    MakeESProcess(&procFileTarget, MakeAuditToken(23, 45), MakeAuditToken(67, 89));
+  __block es_file_t fileCwd = MakeESFile("cwd", MakeStat(400));
+  __block es_file_t fileScript = MakeESFile("script.sh", MakeStat(500));
+  __block es_fd_t fd1 = {.fd = 1, .fdtype = PROX_FDTYPE_VNODE};
+  __block es_fd_t fd2 = {.fd = 2, .fdtype = PROX_FDTYPE_SOCKET};
+  __block es_fd_t fd3 = {.fd = 3, .fdtype = PROX_FDTYPE_PIPE, .pipe = {.pipe_id = 123}};
+
+  procTarget.codesigning_flags = CS_SIGNED | CS_HARD | CS_KILL;
+  memset(procTarget.cdhash, 'A', sizeof(procTarget.cdhash));
+  procTarget.signing_id = MakeESStringToken("my_signing_id");
+  procTarget.team_id = MakeESStringToken("my_team_id");
+
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_EXEC
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.exec.target = &procTarget;
+                    esMsg->event.exec.cwd = &fileCwd;
+                    esMsg->event.exec.script = &fileScript;
+
+                    // For version 5, simulate a "truncated" set of FDs
+                    if (esMsg->version == 5) {
+                      esMsg->event.exec.last_fd = 123;
+                    } else {
+                      esMsg->event.exec.last_fd = 3;
+                    }
+
+                    EXPECT_CALL(*mockESApi, ExecArgCount).WillOnce(testing::Return(3));
+                    EXPECT_CALL(*mockESApi, ExecArg)
+                      .WillOnce(testing::Return(MakeESStringToken("exec_path")))
+                      .WillOnce(testing::Return(MakeESStringToken("-l")))
+                      .WillOnce(testing::Return(MakeESStringToken("--foo")));
+
+                    EXPECT_CALL(*mockESApi, ExecEnvCount).WillOnce(testing::Return(2));
+                    EXPECT_CALL(*mockESApi, ExecEnv)
+                      .WillOnce(
+                        testing::Return(MakeESStringToken("ENV_PATH=/path/to/bin:/and/another")))
+                      .WillOnce(testing::Return(MakeESStringToken("DEBUG=1")));
+
+                    if (esMsg->version >= 4) {
+                      EXPECT_CALL(*mockESApi, ExecFDCount).WillOnce(testing::Return(3));
+                      EXPECT_CALL(*mockESApi, ExecFD)
+                        .WillOnce(testing::Return(&fd1))
+                        .WillOnce(testing::Return(&fd2))
+                        .WillOnce(testing::Return(&fd3));
+                    }
+                  }
+                          json:YES];
 }
 
 - (void)testSerializeMessageExit {
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_EXIT,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.exit.stat = W_EXITCODE(1, 0);
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_EXIT
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.exit.stat = W_EXITCODE(1, 0);
+                  }
+                          json:NO];
 }
 
 - (void)testEncodeExitStatus {
@@ -484,10 +606,12 @@ void SerializeAndCheckNonESEvents(
     MakeESProcess(&procFileChild, MakeAuditToken(12, 34), MakeAuditToken(56, 78));
   procChild.tty = &ttyFileChild;
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_FORK,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.fork.child = &procChild;
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_FORK
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.fork.child = &procChild;
+                  }
+                          json:NO];
 }
 
 - (void)testSerializeMessageLink {
@@ -495,12 +619,14 @@ void SerializeAndCheckNonESEvents(
   __block es_file_t fileTargetDir = MakeESFile("target_dir");
   es_string_token_t targetTok = MakeESStringToken("target_file");
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_LINK,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.link.source = &fileSource;
-                      esMsg->event.link.target_dir = &fileTargetDir;
-                      esMsg->event.link.target_filename = targetTok;
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_LINK
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.link.source = &fileSource;
+                    esMsg->event.link.target_dir = &fileTargetDir;
+                    esMsg->event.link.target_filename = targetTok;
+                  }
+                          json:NO];
 }
 
 - (void)testSerializeMessageRename {
@@ -508,30 +634,34 @@ void SerializeAndCheckNonESEvents(
   __block es_file_t fileTargetDir = MakeESFile("target_dir");
   es_string_token_t targetTok = MakeESStringToken("target_file");
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_RENAME,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.rename.source = &fileSource;
-                      // Test new and existing destination types
-                      if (esMsg->version == 4) {
-                        esMsg->event.rename.destination.existing_file = &fileTargetDir;
-                        esMsg->event.rename.destination_type = ES_DESTINATION_TYPE_EXISTING_FILE;
-                      } else {
-                        esMsg->event.rename.destination.new_path.dir = &fileTargetDir;
-                        esMsg->event.rename.destination.new_path.filename = targetTok;
-                        esMsg->event.rename.destination_type = ES_DESTINATION_TYPE_NEW_PATH;
-                      }
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_RENAME
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.rename.source = &fileSource;
+                    // Test new and existing destination types
+                    if (esMsg->version == 4) {
+                      esMsg->event.rename.destination.existing_file = &fileTargetDir;
+                      esMsg->event.rename.destination_type = ES_DESTINATION_TYPE_EXISTING_FILE;
+                    } else {
+                      esMsg->event.rename.destination.new_path.dir = &fileTargetDir;
+                      esMsg->event.rename.destination.new_path.filename = targetTok;
+                      esMsg->event.rename.destination_type = ES_DESTINATION_TYPE_NEW_PATH;
+                    }
+                  }
+                          json:NO];
 }
 
 - (void)testSerializeMessageUnlink {
   __block es_file_t fileTarget = MakeESFile("unlink_file", MakeStat(300));
   __block es_file_t fileTargetParent = MakeESFile("unlink_file_parent", MakeStat(400));
 
-  SerializeAndCheck(ES_EVENT_TYPE_NOTIFY_UNLINK,
-                    ^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi, es_message_t *esMsg) {
-                      esMsg->event.unlink.target = &fileTarget;
-                      esMsg->event.unlink.parent_dir = &fileTargetParent;
-                    });
+  [self serializeAndCheckEvent:ES_EVENT_TYPE_NOTIFY_UNLINK
+                  messageSetup:^(std::shared_ptr<MockEndpointSecurityAPI> mockESApi,
+                                 es_message_t *esMsg) {
+                    esMsg->event.unlink.target = &fileTarget;
+                    esMsg->event.unlink.parent_dir = &fileTargetParent;
+                  }
+                          json:NO];
 }
 
 - (void)testGetAccessType {
@@ -608,7 +738,7 @@ void SerializeAndCheckNonESEvents(
   se.fileBundlePath = @"file_bundle_path";
   se.filePath = @"file_path";
 
-  std::vector<uint8_t> vec = Protobuf::Create(nullptr)->SerializeBundleHashingEvent(se);
+  std::vector<uint8_t> vec = Protobuf::Create(nullptr, nil)->SerializeBundleHashingEvent(se);
   std::string protoStr(vec.begin(), vec.end());
 
   ::pbv1::SantaMessage santaMsg;
@@ -643,7 +773,7 @@ void SerializeAndCheckNonESEvents(
     @"DADeviceProtocol" : @"usb",
   };
 
-  std::vector<uint8_t> vec = Protobuf::Create(nullptr)->SerializeDiskAppeared(props);
+  std::vector<uint8_t> vec = Protobuf::Create(nullptr, nil)->SerializeDiskAppeared(props);
   std::string protoStr(vec.begin(), vec.end());
 
   ::pbv1::SantaMessage santaMsg;
@@ -680,7 +810,7 @@ void SerializeAndCheckNonESEvents(
     @"DADeviceProtocol" : @"usb",
   };
 
-  std::vector<uint8_t> vec = Protobuf::Create(nullptr)->SerializeDiskDisappeared(props);
+  std::vector<uint8_t> vec = Protobuf::Create(nullptr, nil)->SerializeDiskDisappeared(props);
   std::string protoStr(vec.begin(), vec.end());
 
   ::pbv1::SantaMessage santaMsg;

Source/santad/Logs/EndpointSecurity/Serializers/Serializer.h

@@ -17,12 +17,14 @@
 
 #import <Foundation/Foundation.h>
 
+#include <functional>
 #include <memory>
 #include <vector>
 
 #import "Source/common/SNTCachedDecision.h"
 #import "Source/common/SNTCommonEnums.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EnrichedTypes.h"
+#import "Source/santad/SNTDecisionCache.h"
 
 @class SNTStoredEvent;
 
@@ -30,11 +32,11 @@ namespace santa::santad::logs::endpoint_security::serializers {
 
 class Serializer {
  public:
-  Serializer();
+  Serializer(SNTDecisionCache *decision_cache);
   virtual ~Serializer() = default;
 
   std::vector<uint8_t> SerializeMessage(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage> msg) {
+    std::unique_ptr<santa::santad::event_providers::endpoint_security::EnrichedMessage> msg) {
     return std::visit([this](const auto &arg) { return this->SerializeMessageTemplate(arg); },
                       msg->GetEnrichedMessage());
   }
@@ -96,6 +98,7 @@ class Serializer {
 
   bool enabled_machine_id_ = false;
   std::string machine_id_;
+  SNTDecisionCache *decision_cache_;
 };
 
 }  // namespace santa::santad::logs::endpoint_security::serializers

Source/santad/Logs/EndpointSecurity/Serializers/Serializer.mm

@@ -24,7 +24,7 @@ namespace es = santa::santad::event_providers::endpoint_security;
 
 namespace santa::santad::logs::endpoint_security::serializers {
 
-Serializer::Serializer() {
+Serializer::Serializer(SNTDecisionCache *decision_cache) : decision_cache_(decision_cache) {
   if ([[SNTConfigurator configurator] enableMachineIDDecoration]) {
     enabled_machine_id_ = true;
     machine_id_ = [[[SNTConfigurator configurator] machineID] UTF8String] ?: "";
@@ -46,17 +46,15 @@ std::vector<uint8_t> Serializer::SerializeMessageTemplate(const es::EnrichedExch
   return SerializeMessage(msg);
 }
 std::vector<uint8_t> Serializer::SerializeMessageTemplate(const es::EnrichedExec &msg) {
-  static SNTDecisionCache *decision_cache = [SNTDecisionCache sharedCache];
-
   SNTCachedDecision *cd;
   const es_message_t &es_msg = msg.es_msg();
   if (es_msg.action_type == ES_ACTION_TYPE_NOTIFY &&
       es_msg.action.notify.result.auth == ES_AUTH_RESULT_ALLOW) {
     // For allowed execs, cached decision timestamps must be updated
-    cd = [decision_cache
+    cd = [decision_cache_
       resetTimestampForCachedDecision:msg.es_msg().event.exec.target->executable->stat];
   } else {
-    cd = [decision_cache cachedDecisionForFile:msg.es_msg().event.exec.target->executable->stat];
+    cd = [decision_cache_ cachedDecisionForFile:msg.es_msg().event.exec.target->executable->stat];
   }
 
   return SerializeMessage(msg, cd);

Source/santad/Logs/EndpointSecurity/Writers/FSSpool/fsspool_log_batch_writer.cc

@@ -56,7 +56,12 @@ absl::Status FsSpoolLogBatchWriter::FlushNoLock() {
       return status;
     }
   }
-  cache_.mutable_records()->Clear();
+  // We assign a new LogBatch() object here instead of calling Clear() method to
+  // make sure the memory used by the cache_ is actually freed. It seems that
+  // internal implementation of protobuf has some very generous way of managing
+  // memory allocations and in certain scenarios it keeps objects for a very
+  // long time (forever?).
+  cache_ = santa::fsspool::binaryproto::LogBatch();
   cache_.mutable_records()->Reserve(max_batch_size_);
   return absl::OkStatus();
 }

Source/santad/Logs/EndpointSecurity/Writers/FSSpool/fsspool_log_batch_writer.h

@@ -62,7 +62,7 @@ class FsSpoolLogBatchWriter {
   absl::Mutex cache_mutex_;
   santa::fsspool::binaryproto::LogBatch cache_ ABSL_GUARDED_BY(cache_mutex_);
 
-  absl::Status FlushNoLock() ABSL_SHARED_LOCKS_REQUIRED(cache_mutex_);
+  absl::Status FlushNoLock() ABSL_EXCLUSIVE_LOCKS_REQUIRED(cache_mutex_);
 };
 
 }  // namespace fsspool

Source/santad/SNTCompilerController.mm

@@ -144,7 +144,10 @@ static constexpr std::string_view kIgnoredCompilerProcessPathPrefix = "/dev/";
     // Check if there is an existing (non-transitive) rule for this file.  We leave existing rules
     // alone, so that a allowlist or blocklist rule can't be overwritten by a transitive one.
     SNTRuleTable *ruleTable = [SNTDatabaseController ruleTable];
-    SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256 certificateSHA256:nil teamID:nil];
+    SNTRule *prevRule = [ruleTable ruleForBinarySHA256:fi.SHA256
+                                             signingID:nil
+                                     certificateSHA256:nil
+                                                teamID:nil];
     if (!prevRule || prevRule.state == SNTRuleStateAllowTransitive) {
       // Construct a new transitive allowlist rule for the executable.
       SNTRule *rule = [[SNTRule alloc] initWithIdentifier:fi.SHA256

Source/santad/SNTDaemonControlController.mm

@@ -98,10 +98,10 @@ double watchdogRAMPeak = 0;
 #pragma mark Database ops
 
 - (void)databaseRuleCounts:(void (^)(int64_t binary, int64_t certificate, int64_t compiler,
-                                     int64_t transitive, int64_t teamID))reply {
+                                     int64_t transitive, int64_t teamID, int64_t signingID))reply {
   SNTRuleTable *rdb = [SNTDatabaseController ruleTable];
   reply([rdb binaryRuleCount], [rdb certificateRuleCount], [rdb compilerRuleCount],
-        [rdb transitiveRuleCount], [rdb teamIDRuleCount]);
+        [rdb transitiveRuleCount], [rdb teamIDRuleCount], [rdb signingIDRuleCount]);
 }
 
 - (void)databaseRuleAddRules:(NSArray *)rules
@@ -144,8 +144,10 @@ double watchdogRAMPeak = 0;
 - (void)databaseRuleForBinarySHA256:(NSString *)binarySHA256
                   certificateSHA256:(NSString *)certificateSHA256
                              teamID:(NSString *)teamID
+                          signingID:(NSString *)signingID
                               reply:(void (^)(SNTRule *))reply {
   reply([[SNTDatabaseController ruleTable] ruleForBinarySHA256:binarySHA256
+                                                     signingID:signingID
                                              certificateSHA256:certificateSHA256
                                                         teamID:teamID]);
 }
@@ -160,11 +162,13 @@ double watchdogRAMPeak = 0;
                  fileSHA256:(NSString *)fileSHA256
           certificateSHA256:(NSString *)certificateSHA256
                      teamID:(NSString *)teamID
+                  signingID:(NSString *)signingID
                       reply:(void (^)(SNTEventState))reply {
   reply([self.policyProcessor decisionForFilePath:filePath
                                        fileSHA256:fileSHA256
                                 certificateSHA256:certificateSHA256
-                                           teamID:teamID]
+                                           teamID:teamID
+                                        signingID:signingID]
           .decision);
 }
 

Source/santad/SNTDatabaseController.m

@@ -39,8 +39,6 @@ static NSString *const kEventsDatabaseName = @"events.db";
     NSString *fullPath =
       [[SNTDatabaseController databasePath] stringByAppendingPathComponent:kEventsDatabaseName];
     FMDatabaseQueue *dbq = [[FMDatabaseQueue alloc] initWithPath:fullPath];
-    chown([fullPath UTF8String], 0, 0);
-    chmod([fullPath UTF8String], 0600);
 
 #ifndef DEBUG
     [dbq inDatabase:^(FMDatabase *db) {
@@ -49,6 +47,9 @@ static NSString *const kEventsDatabaseName = @"events.db";
 #endif
 
     eventDatabase = [[SNTEventTable alloc] initWithDatabaseQueue:dbq];
+
+    chown([fullPath UTF8String], 0, 0);
+    chmod([fullPath UTF8String], 0600);
   });
 
   return eventDatabase;
@@ -62,8 +63,6 @@ static NSString *const kEventsDatabaseName = @"events.db";
     NSString *fullPath =
       [[SNTDatabaseController databasePath] stringByAppendingPathComponent:kRulesDatabaseName];
     FMDatabaseQueue *dbq = [[FMDatabaseQueue alloc] initWithPath:fullPath];
-    chown([fullPath UTF8String], 0, 0);
-    chmod([fullPath UTF8String], 0600);
 
 #ifndef DEBUG
     [dbq inDatabase:^(FMDatabase *db) {
@@ -72,6 +71,9 @@ static NSString *const kEventsDatabaseName = @"events.db";
 #endif
 
     ruleDatabase = [[SNTRuleTable alloc] initWithDatabaseQueue:dbq];
+
+    chown([fullPath UTF8String], 0, 0);
+    chmod([fullPath UTF8String], 0600);
   });
   return ruleDatabase;
 }

Source/santad/SNTExecutionController.h

@@ -14,9 +14,9 @@
 
 #import <Foundation/Foundation.h>
 
-#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
-
 #import "Source/common/SNTCommonEnums.h"
+#include "Source/santad/EventProviders/EndpointSecurity/Message.h"
+#include "Source/santad/TTYWriter.h"
 
 const static NSString *kBlockBinary = @"BlockBinary";
 const static NSString *kAllowBinary = @"AllowBinary";
@@ -24,6 +24,8 @@ const static NSString *kBlockCertificate = @"BlockCertificate";
 const static NSString *kAllowCertificate = @"AllowCertificate";
 const static NSString *kBlockTeamID = @"BlockTeamID";
 const static NSString *kAllowTeamID = @"AllowTeamID";
+const static NSString *kBlockSigningID = @"BlockSigningID";
+const static NSString *kAllowSigningID = @"AllowSigningID";
 const static NSString *kBlockScope = @"BlockScope";
 const static NSString *kAllowScope = @"AllowScope";
 const static NSString *kAllowUnknown = @"AllowUnknown";
@@ -54,7 +56,8 @@ const static NSString *kBlockLongPath = @"BlockLongPath";
 - (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable
                        eventTable:(SNTEventTable *)eventTable
                     notifierQueue:(SNTNotificationQueue *)notifierQueue
-                       syncdQueue:(SNTSyncdQueue *)syncdQueue;
+                       syncdQueue:(SNTSyncdQueue *)syncdQueue
+                        ttyWriter:(std::shared_ptr<santa::santad::TTYWriter>)ttyWriter;
 
 ///
 ///  Handles the logic of deciding whether to allow the binary to run or not, sends the response to

Source/santad/SNTExecutionController.mm

@@ -15,6 +15,7 @@
 
 #import "Source/santad/SNTExecutionController.h"
 
+#import <MOLCodesignChecker/MOLCodesignChecker.h>
 #include <bsm/libbsm.h>
 #include <copyfile.h>
 #include <libproc.h>
@@ -22,7 +23,7 @@
 #include <sys/param.h>
 #include <utmpx.h>
 
-#import <MOLCodesignChecker/MOLCodesignChecker.h>
+#include <memory>
 
 #include "Source/common/BranchPrediction.h"
 #import "Source/common/SNTBlockMessage.h"
@@ -44,6 +45,7 @@
 #import "Source/santad/SNTPolicyProcessor.h"
 #import "Source/santad/SNTSyncdQueue.h"
 
+using santa::santad::TTYWriter;
 using santa::santad::event_providers::endpoint_security::Message;
 
 static const size_t kMaxAllowedPathLength = MAXPATHLEN - 1;  // -1 to account for null terminator
@@ -59,7 +61,9 @@ static const size_t kMaxAllowedPathLength = MAXPATHLEN - 1;  // -1 to account fo
 @property dispatch_queue_t eventQueue;
 @end
 
-@implementation SNTExecutionController
+@implementation SNTExecutionController {
+  std::shared_ptr<TTYWriter> _ttyWriter;
+}
 
 static NSString *const kPrinterProxyPreMonterey =
   (@"/System/Library/Frameworks/Carbon.framework/Versions/Current/"
@@ -74,13 +78,15 @@ static NSString *const kPrinterProxyPostMonterey =
 - (instancetype)initWithRuleTable:(SNTRuleTable *)ruleTable
                        eventTable:(SNTEventTable *)eventTable
                     notifierQueue:(SNTNotificationQueue *)notifierQueue
-                       syncdQueue:(SNTSyncdQueue *)syncdQueue {
+                       syncdQueue:(SNTSyncdQueue *)syncdQueue
+                        ttyWriter:(std::shared_ptr<TTYWriter>)ttyWriter {
   self = [super init];
   if (self) {
     _ruleTable = ruleTable;
     _eventTable = eventTable;
     _notifierQueue = notifierQueue;
     _syncdQueue = syncdQueue;
+    _ttyWriter = std::move(ttyWriter);
     _policyProcessor = [[SNTPolicyProcessor alloc] initWithRuleTable:_ruleTable];
 
     _eventQueue =
@@ -108,6 +114,8 @@ static NSString *const kPrinterProxyPostMonterey =
     case SNTEventStateAllowCertificate: eventTypeStr = kAllowCertificate; break;
     case SNTEventStateBlockTeamID: eventTypeStr = kBlockTeamID; break;
     case SNTEventStateAllowTeamID: eventTypeStr = kAllowTeamID; break;
+    case SNTEventStateBlockSigningID: eventTypeStr = kBlockSigningID; break;
+    case SNTEventStateAllowSigningID: eventTypeStr = kAllowSigningID; break;
     case SNTEventStateBlockScope: eventTypeStr = kBlockScope; break;
     case SNTEventStateAllowScope: eventTypeStr = kAllowScope; break;
     case SNTEventStateBlockUnknown: eventTypeStr = kBlockUnknown; break;
@@ -200,7 +208,8 @@ static NSString *const kPrinterProxyPostMonterey =
   // TODO(markowsky): Maybe add a metric here for how many large executables we're seeing.
   // if (binInfo.fileSize > SomeUpperLimit) ...
 
-  SNTCachedDecision *cd = [self.policyProcessor decisionForFileInfo:binInfo];
+  SNTCachedDecision *cd = [self.policyProcessor decisionForFileInfo:binInfo
+                                                      targetProcess:targetProc];
 
   cd.vnodeId = SantaVnode::VnodeForFile(targetProc->executable);
 
@@ -237,6 +246,7 @@ static NSString *const kPrinterProxyPostMonterey =
 
     se.signingChain = cd.certChain;
     se.teamID = cd.teamID;
+    se.signingID = cd.signingID;
     se.pid = @(audit_token_to_pid(targetProc->audit_token));
     se.ppid = @(audit_token_to_pid(targetProc->parent_audit_token));
     se.parentName = @(esMsg.ParentProcessName().c_str());
@@ -294,7 +304,8 @@ static NSString *const kPrinterProxyPostMonterey =
         NSAttributedString *s = [SNTBlockMessage attributedBlockMessageForEvent:se
                                                                   customMessage:cd.customMsg];
 
-        if (targetProc->tty && targetProc->tty->path.length > 0 && !config.enableSilentTTYMode) {
+        if (targetProc->tty && targetProc->tty->path.length > 0 && !config.enableSilentTTYMode &&
+            self->_ttyWriter) {
           NSMutableString *msg = [NSMutableString stringWithCapacity:1024];
           [msg appendFormat:@"\n\033[1mSanta\033[0m\n\n%@\n\n", s.string];
           [msg appendFormat:@"\033[1mPath:      \033[0m %@\n"
@@ -306,7 +317,7 @@ static NSString *const kPrinterProxyPostMonterey =
             [msg appendFormat:@"More info:\n%@\n\n", detailURL.absoluteString];
           }
 
-          [self printMessage:msg toTTY:targetProc->tty->path.data];
+          self->_ttyWriter->Write(targetProc->tty->path.data, msg);
         }
 
         [self.notifierQueue addEvent:se customMessage:cd.customMsg];
@@ -359,13 +370,6 @@ static NSString *const kPrinterProxyPostMonterey =
   return proxyInfo;
 }
 
-- (void)printMessage:(NSString *)msg toTTY:(const char *)path {
-  int fd = open(path, O_WRONLY | O_NOCTTY);
-  std::string_view str = santa::common::NSStringToUTF8StringView(msg);
-  write(fd, str.data(), str.length());
-  close(fd);
-}
-
 - (void)loggedInUsers:(NSArray **)users sessions:(NSArray **)sessions {
   NSMutableSet *loggedInUsers = [NSMutableSet set];
   NSMutableArray *loggedInHosts = [NSMutableArray array];

Source/santad/SNTExecutionControllerTest.mm

@@ -39,6 +39,9 @@ using santa::santad::event_providers::endpoint_security::Message;
 using PostActionBlock = bool (^)(SNTAction);
 using VerifyPostActionBlock = PostActionBlock (^)(SNTAction);
 
+static const char *kExampleSigningID = "example.signing.id";
+static const char *kExampleTeamID = "myteamid";
+
 VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction) {
   return ^bool(SNTAction gotAction) {
     XCTAssertEqual(gotAction, wantAction);
@@ -92,7 +95,8 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   self.sut = [[SNTExecutionController alloc] initWithRuleTable:self.mockRuleDatabase
                                                     eventTable:self.mockEventDatabase
                                                  notifierQueue:nil
-                                                    syncdQueue:nil];
+                                                    syncdQueue:nil
+                                                     ttyWriter:nullptr];
 }
 
 - (void)tearDown {
@@ -186,7 +190,8 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
 }
 
-- (void)validateExecEvent:(SNTAction)wantAction {
+- (void)validateExecEvent:(SNTAction)wantAction
+             messageSetup:(void (^)(es_message_t *))messageSetupBlock {
   es_file_t file = MakeESFile("foo");
   es_process_t proc = MakeESProcess(&file);
   es_file_t fileExec = MakeESFile("bar", {
@@ -194,9 +199,14 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
                                            .st_ino = 34,
                                          });
   es_process_t procExec = MakeESProcess(&fileExec);
+  procExec.is_platform_binary = false;
   es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_AUTH_EXEC, &proc);
   esMsg.event.exec.target = &procExec;
 
+  if (messageSetupBlock) {
+    messageSetupBlock(&esMsg);
+  }
+
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   mockESApi->SetExpectationsRetainReleaseMessage();
 
@@ -208,6 +218,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
 }
 
+- (void)validateExecEvent:(SNTAction)wantAction {
+  [self validateExecEvent:wantAction messageSetup:nil];
+}
+
 - (void)testBinaryAllowRule {
   OCMStub([self.mockFileInfo isMachO]).andReturn(YES);
   OCMStub([self.mockFileInfo SHA256]).andReturn(@"a");
@@ -215,7 +229,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllow;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllow];
@@ -229,13 +246,102 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateBlock;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondDeny];
   [self checkMetricCounters:kBlockBinary expected:@1];
 }
 
+- (void)testSigningIDAllowRule {
+  SNTRule *rule = [[SNTRule alloc] init];
+  rule.state = SNTRuleStateAllow;
+  rule.type = SNTRuleTypeSigningID;
+
+  NSString *signingID = [NSString stringWithFormat:@"%s:%s", kExampleTeamID, kExampleSigningID];
+
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:signingID
+                                   certificateSHA256:nil
+                                              teamID:@(kExampleTeamID)])
+    .andReturn(rule);
+
+  [self validateExecEvent:SNTActionRespondAllow
+             messageSetup:^(es_message_t *msg) {
+               msg->event.exec.target->signing_id = MakeESStringToken(kExampleSigningID);
+               msg->event.exec.target->team_id = MakeESStringToken(kExampleTeamID);
+             }];
+  [self checkMetricCounters:kAllowSigningID expected:@1];
+}
+
+- (void)testSigningIDBlockRule {
+  SNTRule *rule = [[SNTRule alloc] init];
+  rule.state = SNTRuleStateBlock;
+  rule.type = SNTRuleTypeSigningID;
+
+  NSString *signingID = [NSString stringWithFormat:@"%s:%s", kExampleTeamID, kExampleSigningID];
+
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:signingID
+                                   certificateSHA256:nil
+                                              teamID:@(kExampleTeamID)])
+    .andReturn(rule);
+
+  [self validateExecEvent:SNTActionRespondDeny
+             messageSetup:^(es_message_t *msg) {
+               msg->event.exec.target->signing_id = MakeESStringToken(kExampleSigningID);
+               msg->event.exec.target->team_id = MakeESStringToken(kExampleTeamID);
+             }];
+  [self checkMetricCounters:kBlockSigningID expected:@1];
+}
+
+- (void)testTeamIDAllowRule {
+  OCMStub([self.mockCodesignChecker signingInformation]).andReturn((@{
+    (__bridge NSString *)kSecCodeInfoTeamIdentifier : @(kExampleTeamID),
+  }));
+
+  SNTRule *rule = [[SNTRule alloc] init];
+  rule.state = SNTRuleStateAllow;
+  rule.type = SNTRuleTypeTeamID;
+
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:@(kExampleTeamID)])
+    .andReturn(rule);
+
+  [self validateExecEvent:SNTActionRespondAllow
+             messageSetup:^(es_message_t *msg) {
+               msg->event.exec.target->team_id = MakeESStringToken(kExampleTeamID);
+             }];
+  [self checkMetricCounters:kAllowTeamID expected:@1];
+}
+
+- (void)testTeamIDBlockRule {
+  OCMStub([self.mockCodesignChecker signingInformation]).andReturn((@{
+    (__bridge NSString *)kSecCodeInfoTeamIdentifier : @(kExampleTeamID),
+  }));
+
+  SNTRule *rule = [[SNTRule alloc] init];
+  rule.state = SNTRuleStateBlock;
+  rule.type = SNTRuleTypeTeamID;
+
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:@(kExampleTeamID)])
+    .andReturn(rule);
+
+  [self validateExecEvent:SNTActionRespondDeny
+             messageSetup:^(es_message_t *msg) {
+               msg->event.exec.target->team_id = MakeESStringToken(kExampleTeamID);
+             }];
+  [self checkMetricCounters:kBlockTeamID expected:@1];
+}
+
 - (void)testCertificateAllowRule {
   OCMStub([self.mockFileInfo isMachO]).andReturn(YES);
 
@@ -246,7 +352,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllow;
   rule.type = SNTRuleTypeCertificate;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil certificateSHA256:@"a" teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:nil
+                                   certificateSHA256:@"a"
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllow];
@@ -263,7 +372,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateBlock;
   rule.type = SNTRuleTypeCertificate;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil certificateSHA256:@"a" teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:nil
+                                           signingID:nil
+                                   certificateSHA256:@"a"
+                                              teamID:nil])
     .andReturn(rule);
 
   OCMExpect([self.mockEventDatabase addStoredEvent:OCMOCK_ANY]);
@@ -282,7 +394,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllowCompiler;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllowCompiler];
@@ -297,7 +412,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllowCompiler;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllow];
@@ -312,7 +430,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllowTransitive;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllow];
@@ -328,7 +449,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllowTransitive;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   OCMExpect([self.mockEventDatabase addStoredEvent:OCMOCK_ANY]);
@@ -439,7 +563,10 @@ VerifyPostActionBlock verifyPostAction = ^PostActionBlock(SNTAction wantAction)
   SNTRule *rule = [[SNTRule alloc] init];
   rule.state = SNTRuleStateAllow;
   rule.type = SNTRuleTypeBinary;
-  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a" certificateSHA256:nil teamID:nil])
+  OCMStub([self.mockRuleDatabase ruleForBinarySHA256:@"a"
+                                           signingID:nil
+                                   certificateSHA256:nil
+                                              teamID:nil])
     .andReturn(rule);
 
   [self validateExecEvent:SNTActionRespondAllow];

Source/santad/SNTPolicyProcessor.h

@@ -12,6 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#include <EndpointSecurity/EndpointSecurity.h>
 #import <Foundation/Foundation.h>
 #import <MOLCertificate/MOLCertificate.h>
 
@@ -44,10 +45,13 @@
 - (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                         fileSHA256:(nullable NSString *)fileSHA256
                                  certificateSHA256:(nullable NSString *)certificateSHA256
-                                            teamID:(nullable NSString *)teamID;
+                                            teamID:(nullable NSString *)teamID
+                                         signingID:(nullable NSString *)signingID;
 
-///  Convenience initializer with nil hashes for both the file and certificate.
-- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo;
+///  Convenience initializer. Will obtain the teamID and construct the signingID
+///  identifier if able.
+- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
+                                     targetProcess:(nonnull const es_process_t *)targetProc;
 
 ///
 ///  A wrapper for decisionForFileInfo:fileSHA256:certificateSHA256:. This method is slower as it
@@ -58,6 +62,7 @@
 - (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                         fileSHA256:(nullable NSString *)fileSHA256
                                  certificateSHA256:(nullable NSString *)certificateSHA256
-                                            teamID:(nullable NSString *)teamID;
+                                            teamID:(nullable NSString *)teamID
+                                         signingID:(nullable NSString *)signingID;
 
 @end

Source/santad/SNTPolicyProcessor.m

@@ -15,6 +15,7 @@
 #import "Source/santad/SNTPolicyProcessor.h"
 
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
+#import <Security/SecCode.h>
 
 #include "Source/common/SNTLogging.h"
 
@@ -41,10 +42,12 @@
 - (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
                                         fileSHA256:(nullable NSString *)fileSHA256
                                  certificateSHA256:(nullable NSString *)certificateSHA256
-                                            teamID:(nullable NSString *)teamID {
+                                            teamID:(nullable NSString *)teamID
+                                         signingID:(nullable NSString *)signingID {
   SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
   cd.sha256 = fileSHA256 ?: fileInfo.SHA256;
   cd.teamID = teamID;
+  cd.signingID = signingID;
 
   // If the binary is a critical system binary, don't check its signature.
   // The binary was validated at startup when the rule table was initialized.
@@ -62,17 +65,34 @@
       csInfo = nil;
       cd.decisionExtra =
         [NSString stringWithFormat:@"Signature ignored due to error: %ld", (long)csInfoError.code];
+      cd.teamID = nil;
+      cd.signingID = nil;
     } else {
       cd.certSHA256 = csInfo.leafCertificate.SHA256;
       cd.certCommonName = csInfo.leafCertificate.commonName;
       cd.certChain = csInfo.certificates;
-      cd.teamID = teamID ?: [csInfo.signingInformation valueForKey:@"teamid"];
+      cd.teamID = teamID
+                    ?: [csInfo.signingInformation
+                         objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
       teamID = cd.teamID;
+
+      // Ensure that if no teamID exists that the signing info confirms it is a
+      // platform binary. If not, remove the signingID.
+      if (!teamID && signingID) {
+        id platformID = [csInfo.signingInformation
+          objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
+        if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
+          signingID = nil;
+        }
+      }
+
+      cd.signingID = signingID;
     }
   }
   cd.quarantineURL = fileInfo.quarantineDataURL;
 
   SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256
+                                            signingID:signingID
                                     certificateSHA256:cd.certSHA256
                                                teamID:teamID];
   if (rule) {
@@ -108,6 +128,19 @@
           default: break;
         }
         break;
+      case SNTRuleTypeSigningID:
+        switch (rule.state) {
+          case SNTRuleStateAllow: cd.decision = SNTEventStateAllowSigningID; return cd;
+          case SNTRuleStateSilentBlock:
+            cd.silentBlock = YES;
+            // intentional fallthrough
+          case SNTRuleStateBlock:
+            cd.customMsg = rule.customMsg;
+            cd.decision = SNTEventStateBlockSigningID;
+            return cd;
+          default: break;
+        }
+        break;
       case SNTRuleTypeCertificate:
         switch (rule.state) {
           case SNTRuleStateAllow: cd.decision = SNTEventStateAllowCertificate; return cd;
@@ -161,22 +194,47 @@
     return cd;
   }
 
-  switch ([[SNTConfigurator configurator] clientMode]) {
+  SNTClientMode mode = [[SNTConfigurator configurator] clientMode];
+  cd.decisionClientMode = mode;
+
+  switch (mode) {
     case SNTClientModeMonitor: cd.decision = SNTEventStateAllowUnknown; return cd;
     case SNTClientModeLockdown: cd.decision = SNTEventStateBlockUnknown; return cd;
     default: cd.decision = SNTEventStateBlockUnknown; return cd;
   }
 }
 
-- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo {
-  return [self decisionForFileInfo:fileInfo fileSHA256:nil certificateSHA256:nil teamID:nil];
+- (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileInfo
+                                     targetProcess:(nonnull const es_process_t *)targetProc {
+  NSString *signingID;
+  NSString *teamID;
+
+  if (targetProc->signing_id.length > 0) {
+    if (targetProc->team_id.length > 0) {
+      teamID = [NSString stringWithUTF8String:targetProc->team_id.data];
+      signingID =
+        [NSString stringWithFormat:@"%@:%@", teamID,
+                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
+    } else if (targetProc->is_platform_binary) {
+      signingID =
+        [NSString stringWithFormat:@"platform:%@",
+                                   [NSString stringWithUTF8String:targetProc->signing_id.data]];
+    }
+  }
+
+  return [self decisionForFileInfo:fileInfo
+                        fileSHA256:nil
+                 certificateSHA256:nil
+                            teamID:teamID
+                         signingID:signingID];
 }
 
 // Used by `$ santactl fileinfo`.
 - (nonnull SNTCachedDecision *)decisionForFilePath:(nonnull NSString *)filePath
                                         fileSHA256:(nullable NSString *)fileSHA256
                                  certificateSHA256:(nullable NSString *)certificateSHA256
-                                            teamID:(nullable NSString *)teamID {
+                                            teamID:(nullable NSString *)teamID
+                                         signingID:(nullable NSString *)signingID {
   SNTFileInfo *fileInfo;
   NSError *error;
   fileInfo = [[SNTFileInfo alloc] initWithPath:filePath error:&error];
@@ -184,7 +242,8 @@
   return [self decisionForFileInfo:fileInfo
                         fileSHA256:fileSHA256
                  certificateSHA256:certificateSHA256
-                            teamID:teamID];
+                            teamID:teamID
+                         signingID:signingID];
 }
 
 ///

Source/santad/Santad.mm

@@ -20,6 +20,7 @@
 #include "Source/common/PrefixTree.h"
 #import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTFileAccessEvent.h"
 #import "Source/common/SNTKVOManager.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTXPCNotifierInterface.h"
@@ -130,18 +131,28 @@ void SantadMain(std::shared_ptr<EndpointSecurityAPI> esapi, std::shared_ptr<Logg
   SNTEndpointSecurityTamperResistance *tamper_client =
     [[SNTEndpointSecurityTamperResistance alloc] initWithESAPI:esapi metrics:metrics logger:logger];
 
-  SNTEndpointSecurityFileAccessAuthorizer *access_authorizer_client =
-    [[SNTEndpointSecurityFileAccessAuthorizer alloc] initWithESAPI:esapi
-                                                           metrics:metrics
-                                                            logger:logger
-                                                        watchItems:watch_items
-                                                          enricher:enricher
-                                                     decisionCache:[SNTDecisionCache sharedCache]];
-  watch_items->RegisterClient(access_authorizer_client);
+  if (@available(macOS 13.0, *)) {
+    SNTEndpointSecurityFileAccessAuthorizer *access_authorizer_client =
+      [[SNTEndpointSecurityFileAccessAuthorizer alloc]
+        initWithESAPI:esapi
+              metrics:metrics
+               logger:logger
+           watchItems:watch_items
+             enricher:enricher
+        decisionCache:[SNTDecisionCache sharedCache]];
+    watch_items->RegisterClient(access_authorizer_client);
+
+    access_authorizer_client.fileAccessBlockCallback = ^(SNTFileAccessEvent *event) {
+      [[notifier_queue.notifierConnection remoteObjectProxy]
+        postFileAccessBlockNotification:event
+                      withCustomMessage:@"Access to the resource has been denied!"];
+    };
+  }
 
   EstablishSyncServiceConnection(syncd_queue);
 
-  NSArray<SNTKVOManager *> *kvoObservers = @[
+  NSMutableArray<SNTKVOManager *> *kvoObservers = [[NSMutableArray alloc] init];
+  [kvoObservers addObjectsFromArray:@[
     [[SNTKVOManager alloc]
       initWithObject:configurator
             selector:@selector(clientMode)
@@ -294,37 +305,17 @@ void SantadMain(std::shared_ptr<EndpointSecurityAPI> esapi, std::shared_ptr<Logg
                                         [newValue componentsJoinedByString:@","]);
                                    device_client.remountArgs = newValue;
                                  }],
-    [[SNTKVOManager alloc]
-      initWithObject:configurator
-            selector:@selector(fileAccessPolicyPlist)
-                type:[NSString class]
-            callback:^(NSString *oldValue, NSString *newValue) {
-              if ([configurator fileAccessPolicy]) {
-                // Ignore any changes to this key if fileAccessPolicy is set
-                return;
-              }
-
-              if (oldValue != newValue || (newValue && ![oldValue isEqualToString:newValue])) {
-                LOGI(@"Filesystem monitoring policy config path changed: %@ -> %@", oldValue,
-                     newValue);
-                watch_items->SetConfigPath(newValue);
-              }
-            }],
-    [[SNTKVOManager alloc] initWithObject:configurator
-                                 selector:@selector(fileAccessPolicy)
-                                     type:[NSDictionary class]
-                                 callback:^(NSDictionary *oldValue, NSDictionary *newValue) {
-                                   if (oldValue != newValue ||
-                                       (newValue && ![oldValue isEqualToDictionary:newValue])) {
-                                     LOGI(@"Filesystem monitoring policy embedded config changed");
-                                     watch_items->SetConfig(newValue);
-                                   }
-                                 }],
     [[SNTKVOManager alloc] initWithObject:configurator
                                  selector:@selector(staticRules)
                                      type:[NSArray class]
                                  callback:^(NSArray *oldValue, NSArray *newValue) {
-                                   if ([oldValue isEqual:newValue]) return;
+                                   NSSet *oldValueSet = [NSSet setWithArray:oldValue ?: @[]];
+                                   NSSet *newValueSet = [NSSet setWithArray:newValue ?: @[]];
+
+                                   if ([oldValueSet isEqualToSet:newValueSet]) {
+                                     return;
+                                   }
+
                                    LOGI(@"StaticRules set has changed, flushing cache.");
                                    auth_result_cache->FlushCache(
                                      FlushCacheMode::kAllCaches,
@@ -360,7 +351,40 @@ void SantadMain(std::shared_ptr<EndpointSecurityAPI> esapi, std::shared_ptr<Logg
               // Forcefully exit. The daemon will be restarted immediately.
               exit(EXIT_SUCCESS);
             }],
-  ];
+  ]];
+
+  if (@available(macOS 13.0, *)) {
+    // Only watch file access auth keys on mac 13 and newer
+    [kvoObservers addObjectsFromArray:@[
+      [[SNTKVOManager alloc]
+        initWithObject:configurator
+              selector:@selector(fileAccessPolicyPlist)
+                  type:[NSString class]
+              callback:^(NSString *oldValue, NSString *newValue) {
+                if ([configurator fileAccessPolicy]) {
+                  // Ignore any changes to this key if fileAccessPolicy is set
+                  return;
+                }
+
+                if ((oldValue && !newValue) || (newValue && ![oldValue isEqualToString:newValue])) {
+                  LOGI(@"Filesystem monitoring policy config path changed: %@ -> %@", oldValue,
+                       newValue);
+                  watch_items->SetConfigPath(newValue);
+                }
+              }],
+      [[SNTKVOManager alloc] initWithObject:configurator
+                                   selector:@selector(fileAccessPolicy)
+                                       type:[NSDictionary class]
+                                   callback:^(NSDictionary *oldValue, NSDictionary *newValue) {
+                                     if ((oldValue && !newValue) ||
+                                         (newValue && ![oldValue isEqualToDictionary:newValue])) {
+                                       LOGI(
+                                         @"Filesystem monitoring policy embedded config changed");
+                                       watch_items->SetConfig(newValue);
+                                     }
+                                   }],
+    ]];
+  }
 
   // Make the compiler happy. The variable is only used to ensure proper lifetime
   // of the SNTKVOManager objects it contains.

Source/santad/SantadDeps.mm

@@ -14,6 +14,7 @@
 
 #include "Source/santad/SantadDeps.h"
 
+#include <cstdlib>
 #include <memory>
 
 #import "Source/common/SNTLogging.h"
@@ -24,10 +25,13 @@
 #include "Source/santad/DataLayer/WatchItems.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
 #import "Source/santad/SNTDatabaseController.h"
+#include "Source/santad/SNTDecisionCache.h"
+#include "Source/santad/TTYWriter.h"
 
 using santa::common::PrefixTree;
 using santa::common::Unit;
 using santa::santad::Metrics;
+using santa::santad::TTYWriter;
 using santa::santad::data_layer::WatchItems;
 using santa::santad::event_providers::AuthResultCache;
 using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
@@ -80,11 +84,17 @@ std::unique_ptr<SantadDeps> SantadDeps::Create(SNTConfigurator *configurator,
     exit(EXIT_FAILURE);
   }
 
+  std::shared_ptr<TTYWriter> tty_writer = TTYWriter::Create();
+  if (!tty_writer) {
+    LOGW(@"Unable to initialize TTY writer");
+  }
+
   SNTExecutionController *exec_controller =
     [[SNTExecutionController alloc] initWithRuleTable:rule_table
                                            eventTable:event_table
                                         notifierQueue:notifier_queue
-                                           syncdQueue:syncd_queue];
+                                           syncdQueue:syncd_queue
+                                            ttyWriter:tty_writer];
   if (!exec_controller) {
     LOGE(@"Failed to initialize exec controller.");
     exit(EXIT_FAILURE);
@@ -109,9 +119,10 @@ std::unique_ptr<SantadDeps> SantadDeps::Create(SNTConfigurator *configurator,
   size_t spool_dir_threshold_bytes = [configurator spoolDirectorySizeThresholdMB] * 1024 * 1024;
   uint64_t spool_flush_timeout_ms = [configurator spoolDirectoryEventMaxFlushTimeSec] * 1000;
 
-  std::unique_ptr<::Logger> logger = Logger::Create(
-    esapi, [configurator eventLogType], [configurator eventLogPath], [configurator spoolDirectory],
-    spool_dir_threshold_bytes, spool_file_threshold_bytes, spool_flush_timeout_ms);
+  std::unique_ptr<::Logger> logger =
+    Logger::Create(esapi, [configurator eventLogType], [SNTDecisionCache sharedCache],
+                   [configurator eventLogPath], [configurator spoolDirectory],
+                   spool_dir_threshold_bytes, spool_file_threshold_bytes, spool_flush_timeout_ms);
   if (!logger) {
     LOGE(@"Failed to create logger.");
     exit(EXIT_FAILURE);

Source/santad/SantadTest.mm

@@ -37,6 +37,11 @@ using santa::santad::SantadDeps;
 using santa::santad::event_providers::endpoint_security::Message;
 
 NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
+static const char *kAllowedSigningID = "com.google.allowed_signing_id";
+static const char *kBlockedSigningID = "com.google.blocked_signing_id";
+static const char *kNoRuleMatchSigningID = "com.google.no_rule_match_signing_id";
+static const char *kBlockedTeamID = "EQHXZ8M8AV";
+static const char *kNoRuleMatchTeamID = "ABC1234XYZ";
 
 @interface SantadTest : XCTestCase
 @property id mockSNTDatabaseController;
@@ -56,7 +61,8 @@ NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
 
 - (BOOL)checkBinaryExecution:(NSString *)binaryName
                   wantResult:(es_auth_result_t)wantResult
-                  clientMode:(NSInteger)clientMode {
+                  clientMode:(NSInteger)clientMode
+                messageSetup:(void (^)(es_message_t *))messageSetupBlock {
   auto mockESApi = std::make_shared<MockEndpointSecurityAPI>();
   mockESApi->SetExpectationsESNewClient();
 
@@ -102,6 +108,7 @@ NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
   lstat(binaryPath.UTF8String, &fileStat);
   es_file_t file = MakeESFile([binaryPath UTF8String], fileStat);
   es_process_t proc = MakeESProcess(&file);
+  proc.is_platform_binary = false;
   // Set a 6.5 second deadline for the message. The base SNTEndpointSecurityClient
   // class leaves a 5 second buffer to auto-respond to messages. A 6 second
   // deadline means there is a 1.5 second leeway given for the processing block
@@ -111,6 +118,10 @@ NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
   es_message_t esMsg = MakeESMessage(ES_EVENT_TYPE_AUTH_EXEC, &proc, ActionType::Auth, 6500);
   esMsg.event.exec.target = &proc;
 
+  if (messageSetupBlock) {
+    messageSetupBlock(&esMsg);
+  }
+
   // The test must wait for the ES client async message processing to complete.
   // Otherwise, the `es_message_t` stack variable will go out of scope and will
   // result in undefined behavior in the async dispatch queue block.
@@ -146,6 +157,15 @@ NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
   XCTBubbleMockVerifyAndClearExpectations(mockESApi.get());
 }
 
+- (BOOL)checkBinaryExecution:(NSString *)binaryName
+                  wantResult:(es_auth_result_t)wantResult
+                  clientMode:(NSInteger)clientMode {
+  return [self checkBinaryExecution:binaryName
+                         wantResult:wantResult
+                         clientMode:clientMode
+                       messageSetup:nil];
+}
+
 /**
  * testRules ensures that we get the expected outcome when the mocks "execute"
  * our test binaries.
@@ -211,6 +231,66 @@ NSString *testBinariesPath = @"santa/Source/santad/testdata/binaryrules";
                   clientMode:SNTClientModeMonitor];
 }
 
+- (void)testBinaryWithSigningIDBlockRuleAndCertAllowedRuleIsBlockedInMonitorMode {
+  [self checkBinaryExecution:@"cert_hash_allowed_signingid_blocked"
+                  wantResult:ES_AUTH_RESULT_DENY
+                  clientMode:SNTClientModeMonitor
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kBlockedTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kBlockedSigningID);
+                }];
+}
+
+- (void)testBinaryWithSigningIDNoRuleMatchAndCertAllowedRuleIsAllowedInMonitorMode {
+  [self checkBinaryExecution:@"cert_hash_allowed_signingid_not_matched"
+                  wantResult:ES_AUTH_RESULT_ALLOW
+                  clientMode:SNTClientModeMonitor
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kBlockedTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kNoRuleMatchSigningID);
+                }];
+}
+
+- (void)testBinaryWithSigningIDBlockRuleMatchAndCertAllowedRuleIsAllowedInMonitorMode {
+  [self checkBinaryExecution:@"binary_hash_allowed_signingid_blocked"
+                  wantResult:ES_AUTH_RESULT_ALLOW
+                  clientMode:SNTClientModeMonitor
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kBlockedTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kBlockedSigningID);
+                }];
+}
+
+- (void)testBinaryWithSigningIDNoRuleMatchIsAllowedInMonitorMode {
+  [self checkBinaryExecution:@"noop"
+                  wantResult:ES_AUTH_RESULT_ALLOW
+                  clientMode:SNTClientModeMonitor
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kNoRuleMatchTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kNoRuleMatchSigningID);
+                }];
+}
+
+- (void)testBinaryWithSigningIDNoRuleMatchIsBlockedInLockdownMode {
+  [self checkBinaryExecution:@"noop"
+                  wantResult:ES_AUTH_RESULT_DENY
+                  clientMode:SNTClientModeLockdown
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kNoRuleMatchTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kNoRuleMatchSigningID);
+                }];
+}
+
+- (void)testBinaryWithAllowedSigningIDRuleIsAllowedInLockdownMode {
+  [self checkBinaryExecution:@"noop"
+                  wantResult:ES_AUTH_RESULT_ALLOW
+                  clientMode:SNTClientModeLockdown
+                messageSetup:^(es_message_t *msg) {
+                  msg->event.exec.target->team_id = MakeESStringToken(kNoRuleMatchTeamID);
+                  msg->event.exec.target->signing_id = MakeESStringToken(kAllowedSigningID);
+                }];
+}
+
 - (void)testBinaryWithSHA256AllowRuleAndBlockedTeamIDRuleIsAllowedInLockdownMode {
   [self checkBinaryExecution:@"banned_teamid_allowed_binary"
                   wantResult:ES_AUTH_RESULT_ALLOW

Source/santad/TTYWriter.h

@@ -0,0 +1,48 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__SANTAD__TTYWRITER_H
+#define SANTA__SANTAD__TTYWRITER_H
+
+#import <Foundation/Foundation.h>
+#include <dispatch/dispatch.h>
+
+#include <memory>
+
+namespace santa::santad {
+
+// Small helper class to synchronize writing to TTYs
+class TTYWriter {
+ public:
+  static std::unique_ptr<TTYWriter> Create();
+
+  TTYWriter(dispatch_queue_t q);
+
+  // Moves can be safe, but not currently needed/implemented
+  TTYWriter(TTYWriter &&other) = delete;
+  TTYWriter &operator=(TTYWriter &&rhs) = delete;
+
+  // No copies
+  TTYWriter(const TTYWriter &other) = delete;
+  TTYWriter &operator=(const TTYWriter &other) = delete;
+
+  void Write(const char *tty, NSString *msg);
+
+ private:
+  dispatch_queue_t q_;
+};
+
+}  // namespace santa::santad
+
+#endif

Source/santad/TTYWriter.mm

@@ -0,0 +1,56 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include "Source/santad/TTYWriter.h"
+
+#include <string.h>
+#include <sys/errno.h>
+
+#import "Source/common/SNTLogging.h"
+#include "Source/common/String.h"
+
+namespace santa::santad {
+
+std::unique_ptr<TTYWriter> TTYWriter::Create() {
+  dispatch_queue_t q = dispatch_queue_create_with_target(
+    "com.google.santa.ttywriter", DISPATCH_QUEUE_SERIAL,
+    dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0));
+
+  if (!q) {
+    return nullptr;
+  }
+
+  return std::make_unique<TTYWriter>(q);
+}
+
+TTYWriter::TTYWriter(dispatch_queue_t q) : q_(q) {}
+
+void TTYWriter::Write(const char *tty, NSString *msg) {
+  dispatch_async(q_, ^{
+    @autoreleasepool {
+      int fd = open(tty, O_WRONLY | O_NOCTTY);
+      if (fd == -1) {
+        LOGW(@"Failed to open TTY for writing: %s", strerror(errno));
+        return;
+      }
+
+      std::string_view str = santa::common::NSStringToUTF8StringView(msg);
+      write(fd, str.data(), str.length());
+
+      close(fd);
+    }
+  });
+}
+
+}  // namespace santa::santad

Source/santasyncservice/SNTSyncEventUpload.m

@@ -101,6 +101,7 @@
       break;
     case SNTEventStateAllowScope: ADDKEY(newEvent, kDecision, kDecisionAllowScope); break;
     case SNTEventStateAllowTeamID: ADDKEY(newEvent, kDecision, kDecisionAllowTeamID); break;
+    case SNTEventStateAllowSigningID: ADDKEY(newEvent, kDecision, kDecisionAllowSigningID); break;
     case SNTEventStateBlockUnknown: ADDKEY(newEvent, kDecision, kDecisionBlockUnknown); break;
     case SNTEventStateBlockBinary: ADDKEY(newEvent, kDecision, kDecisionBlockBinary); break;
     case SNTEventStateBlockCertificate:
@@ -108,6 +109,7 @@
       break;
     case SNTEventStateBlockScope: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
     case SNTEventStateBlockTeamID: ADDKEY(newEvent, kDecision, kDecisionBlockTeamID); break;
+    case SNTEventStateBlockSigningID: ADDKEY(newEvent, kDecision, kDecisionBlockSigningID); break;
     case SNTEventStateBundleBinary:
       ADDKEY(newEvent, kDecision, kDecisionBundleBinary);
       [newEvent removeObjectForKey:kExecutionTime];
@@ -150,6 +152,7 @@
   }
   newEvent[kSigningChain] = signingChain;
   ADDKEY(newEvent, kTeamID, event.teamID);
+  ADDKEY(newEvent, kSigningID, event.signingID);
 
   return newEvent;
 #undef ADDKEY

Source/santasyncservice/SNTSyncPreflight.m

@@ -49,12 +49,13 @@
   // dispatch_group_t group = dispatch_group_create();
   // dispatch_group_enter(group);
   [rop databaseRuleCounts:^(int64_t binary, int64_t certificate, int64_t compiler,
-                            int64_t transitive, int64_t teamID) {
+                            int64_t transitive, int64_t teamID, int64_t signingID) {
     requestDict[kBinaryRuleCount] = @(binary);
     requestDict[kCertificateRuleCount] = @(certificate);
     requestDict[kCompilerRuleCount] = @(compiler);
     requestDict[kTransitiveRuleCount] = @(transitive);
     requestDict[kTeamIDRuleCount] = @(teamID);
+    requestDict[kSigningIDRuleCount] = @(signingID);
   }];
 
   [rop clientMode:^(SNTClientMode cm) {

Source/santasyncservice/SNTSyncTest.m

@@ -152,6 +152,7 @@
                                                     OCMOCK_VALUE(0),  // compiler
                                                     OCMOCK_VALUE(0),  // transitive
                                                     OCMOCK_VALUE(0),  // teamID
+                                                    OCMOCK_VALUE(0),  // signingID
                                                     nil])]);
   OCMStub([self.daemonConnRop syncCleanRequired:([OCMArg invokeBlockWithArgs:@NO, nil])]);
   OCMStub([self.daemonConnRop
@@ -320,12 +321,17 @@
 - (void)testPreflightDatabaseCounts {
   SNTSyncPreflight *sut = [[SNTSyncPreflight alloc] initWithState:self.syncState];
 
-  int64_t bin = 5, cert = 8, compiler = 2, transitive = 19, teamID = 3;
+  int64_t bin = 5;
+  int64_t cert = 8;
+  int64_t compiler = 2;
+  int64_t transitive = 19;
+  int64_t teamID = 3;
+  int64_t signingID = 123;
   OCMStub([self.daemonConnRop
     databaseRuleCounts:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(bin), OCMOCK_VALUE(cert),
                                                     OCMOCK_VALUE(compiler),
                                                     OCMOCK_VALUE(transitive), OCMOCK_VALUE(teamID),
-                                                    nil])]);
+                                                    OCMOCK_VALUE(signingID), nil])]);
 
   [self stubRequestBody:nil
                response:nil
@@ -337,6 +343,7 @@
             XCTAssertEqualObjects(requestDict[kCompilerRuleCount], @(2));
             XCTAssertEqualObjects(requestDict[kTransitiveRuleCount], @(19));
             XCTAssertEqualObjects(requestDict[kTeamIDRuleCount], @(3));
+            XCTAssertEqualObjects(requestDict[kSigningIDRuleCount], @(123));
             return YES;
           }];
 
@@ -352,6 +359,7 @@
                                                     OCMOCK_VALUE(0),  // compiler
                                                     OCMOCK_VALUE(0),  // transitive
                                                     OCMOCK_VALUE(0),  // teamID
+                                                    OCMOCK_VALUE(0),  // signingID
                                                     nil])]);
   OCMStub([self.daemonConnRop
     clientMode:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(SNTClientModeMonitor), nil])]);
@@ -433,6 +441,7 @@
         XCTAssertEqualObjects(cert[kCertValidUntil], @(1618266875));
 
         XCTAssertEqualObjects(event[kTeamID], @"012345678910");
+        XCTAssertEqualObjects(event[kSigningID], @"signing.id");
 
         event = events[1];
         XCTAssertEqualObjects(event[kFileName], @"hub");

Source/santasyncservice/testdata/sync_eventupload_input_basic.plist

@@ -96,6 +96,11 @@
 				<key>CF$UID</key>
 				<integer>39</integer>
 			</dict>
+			<key>signingID</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>40</integer>
+			</dict>
 		</dict>
 		<integer>14887</integer>
 		<string>ff98fa0c0a1095fedcbe4d388a9760e71399a5c3c017a847ffa545663b57929a</string>
@@ -398,7 +403,8 @@
 				</dict>
 			</array>
 		</dict>
-	        <string>012345678910</string>
+		<string>012345678910</string>
+		<string>signing.id</string>
 	</array>
 	<key>$top</key>
 	<dict>

docs/concepts/events.md

@@ -72,6 +72,7 @@ JSON blob. Here is an example of Firefox being blocked and sent for upload:
         }
       ],
       "team_id": "43AQ936H96",
+      "signing_id": "org.mozilla.firefox",
       "file_bundle_name": "Firefox",
       "executing_user": "bur",
       "ppid": 1,

docs/concepts/rules.md

@@ -4,17 +4,31 @@ parent: Concepts
 
 # Rules
 
-Rules provide the primary evaluation mechanism for allowing and blocking
-binaries with Santa on macOS. There are three types of rules: binary,
-certificate, and TeamID.
+## Rule Types
 
-##### Binary Rules
+Rules provide the primary evaluation mechanism for allowing and blocking
+binaries with Santa on macOS. There are four types of rules: binary, signing ID,
+certificate, and Team ID.
+
+### Binary Rules
 
 Binary rules use the SHA-256 hash of the entire binary as an identifier. This is
 the most specific rule in Santa. Even a small change in the binary will alter
 the SHA-256 hash, invalidating the rule.
 
-##### Certificate Rules
+### Signing ID Rules
+
+Signing IDs are arbitrary identifiers under developer control that are given to
+a binary at signing time. Typically, these use reverse domain name notation and
+include the name of the binary (e.g. `com.google.Chrome`). Because the signing
+IDs are arbitrary, the Santa rule identifier must be prefixed with the Team ID
+associated with the Apple developer certificate used to sign the application.
+For example, a signing ID rule for Google Chrome would be:
+`EQHXZ8M8AV:com.google.Chrome`. For platform binaries (i.e. those binaries
+shipped by Apple with the OS) which do not have a Team ID, the string `platform`
+must be used (e.g. `platform:com.apple.curl`).
+
+### Certificate Rules
 
 Certificate rules are formed from the SHA-256 fingerprint of an X.509 leaf
 signing certificate. This is a powerful rule type that has a much broader reach
@@ -64,49 +78,88 @@ chain's intermediates or roots has no effect on binaries signing by a leaf.
 Santa ignores the chain and is only concerned with the leaf certificate's
 SHA-256 hash.
 
-##### Apple Developer Team ID Rules
+### Apple Developer Team ID Rules
+
 The Apple Developer Program Team ID is a 10-character identifier issued by Apple
 and tied to developer accounts/organizations. This is distinct from Certificates,
 as a single developer account can and frequently will request/rotate between
 multiple different signing certificates and entitlements. This is an even more
 powerful rule with broader reach than individual certificate rules.
 
-##### Rule Evaluation
+## Rule Evaluation
 
-When a process is trying to `execve()` `santad` retrieves information on the
-binary, including a hash of the entire file and the signing chain (if any). The
-hash and signing leaf certificate are then passed through the
+When a process is trying to execute, `santad` retrieves information on the
+binary, including a hash of the entire file, signing ID, the signing chain (if
+any), and the team ID. The collected info is then passed through the
 [SNTPolicyProcessor](https://github.com/google/santa/blob/master/Source/santad/SNTPolicyProcessor.h).
-Rules are evaluated from most specific to least specific. First binary (either
-allow or block), then certificate (either allow or block), then team ID (either allow or block). If no rules are found
-that apply, scopes are then searched. See the [scopes.md](scopes.md) document
-for more information on scopes.
+
+Rules (both ALLOW and BLOCK) are evaluated in the following order, from most
+specific to least specific:
+
+```
+Most Specific                                  Least Specific
+
+Binary   -->   Signing ID   -->   Certificate   -->   Team ID
+```
+
+If no rules are found that apply, scopes are then searched. See the
+[scopes.md](scopes.md) document for more information on scopes.
+
+### Rule Examples
 
 You can use the `santactl fileinfo` command to check the status of any given
 binary on the filesystem.
 
-###### Allowed with a Binary Rule
+#### Allowed with a Binary Rule
 
 ```sh
 ⇒  santactl fileinfo /Applications/Hex\ Fiend.app --key Rule
 Allowed (Binary)
 ```
 
-###### Allowed with a Certificate Rule
+#### Allowed with a Signing ID Rule
+
+```sh
+⇒  santactl fileinfo /Applications/Example.app --key Rule
+Allowed (SigningID)
+```
+
+#### Allowed with a Certificate Rule
 
 ```sh
 ⇒  santactl fileinfo /Applications/Safari.app --key Rule
 Allowed (Certificate)
 ```
 
-###### Blocked with a Binary Rule
+#### Allowed with a Team ID rule
+
+```sh
+⇒ santactl fileinfo /Applications/Spotify.app --key Rule
+Allowed (TeamID)
+```
+
+For checking the Team ID of `/Applications/Microsoft\ Remote\ Desktop.app`
+
+```sh
+⇒  santactl fileinfo /Applications/Spotify.app --key "Team ID"
+2FNC3A47ZF
+```
+
+#### Blocked with a Binary Rule
 
 ```sh
 ⇒  santactl fileinfo /usr/bin/yes --key Rule
 Blocked (Binary)
 ```
 
-###### Blocked with a Certificate Rule
+#### Blocked with a Signing ID Rule
+
+```sh
+⇒  santactl fileinfo /Applications/Example.app --key Rule
+Blocked (SigningID)
+```
+
+#### Blocked with a Certificate Rule
 
 ```sh
 ⇒  santactl fileinfo /Applications/Malware.app --key Rule
@@ -130,20 +183,6 @@ For checking the SHA-256 hash of `/usr/bin/yes` signing certificate:
 Allowed (Certificate)
 ```
 
-##### Allowed with a Team ID rule
-
-```sh
-⇒ santactl fileinfo /Applications/Spotify.app --key Rule
-Allowed (TeamID)
-```
-
-For checking the Team ID of `/Applications/Microsoft\ Remote\ Desktop.app`
-
-```sh
-⇒  santactl fileinfo /Applications/Spotify.app --key "Team ID"
-2FNC3A47ZF
-```
-
 #### Blocked with a Team ID rule
 
 ```sh
@@ -158,7 +197,7 @@ For checking the Team ID of `/Applications/Microsoft\ Remote\ Desktop.app`
 UBF8T346G9
 ```
 
-##### Built-in rules
+### Built-in rules
 
 To avoid blocking any Apple system binaries or Santa binaries, `santad` will
 create 2 immutable certificate rules at startup:

docs/deployment/configuration.md

@@ -54,7 +54,8 @@ also known as mobileconfig files, which are in an Apple-specific XML format.
 | MachineOwnerKey                   | String     | The key to use on MachineOwnerPlist.     |
 | MachineIDPlist                    | String     | The path to a plist that contains the MachineOwnerKey / value pair. |
 | MachineIDKey                      | String     | The key to use on MachineIDPlist.        |
-| EventLogType                      | String     | Defines how event logs are stored. Options are 1) syslog: Sent to ASL or ULS (if built with the 10.12 SDK or later). 2) filelog: Sent to a file on disk. Use EventLogPath to specify a path. 3) protobuf (BETA): Sent to file on disk using a maildir-like format. 4) null: Don't output any event logs. Defaults to filelog.      |
+| EventLogType                      | String     | Defines how event logs are stored. Options are 1) syslog: Sent to ULS. 2) filelog: Sent to a file on disk. Use EventLogPath to specify a path. 3) protobuf (BETA): Sent to file on disk using a maildir-like format. 4) json (BETA): Same as file but output is one JSON object per line 5) null: Don't output any event logs. Defaults to filelog.      |
+| EventLogPath                      | String     | If EventLogType is set to filelog or json, EventLogPath will provide the path to save logs. Defaults to /var/db/santa/santa.log. If you change this value ensure you also update com.google.santa.newsyslog.conf with the new path.        |
 | EventLogPath                      | String     | If EventLogType is set to filelog, EventLogPath will provide the path to save logs. Defaults to /var/db/santa/santa.log. If you change this value ensure you also update com.google.santa.newsyslog.conf with the new path.        |
 | SpoolDirectory                    | String     | If EventLogType is set to protobuf, SpoolDirectory will provide the the base directory used to save files according to a maildir-like format. Defaults to /var/db/santa/spool. |
 | SpoolDirectoryFileSizeThresholdKB  | Integer    | If EventLogType is set to protobuf, SpoolDirectoryFileSizeThresholdKB defines the per-file size limit for files stored in the spool directory. Events are buffered in memory until this threshold would be exceeded (or SpoolDirectoryEventMaxFlushTimeSec is exceeded). Defaults to 100. |

docs/deployment/file-access-auth.md

@@ -18,24 +18,25 @@ To enable this feature, the `FileAccessPolicyPlist` key in the main [Santa confi
 
 ## Configuration
 
-| Key                 | Parent       | Type       | Required | Santa Version | Description |
-| :------------------ | :----------- | :--------- | :------- | :------------ | :---------- |
-| `Version`           | `<Root>`     | String     | Yes      | v2023.1+      | Version of the configuration. Will be reported in events. |
-| `WatchItems`        | `<Root>`     | Dictionary | No       | v2023.1+      | The set of configuration items that will be monitored by Santa. |
-| `<Name>`            | `WatchItems` | Dictionary | No       | v2023.1+      | A unique name that identifies a single watch item rule. This value will be reported in events. The name must be a legal C identifier (i.e., must conform to the regex `[A-Za-z_][A-Za-z0-9_]*`). |
-| `Paths`             | `<Name>`     | Array      | Yes      | v2023.1+      | A list of either String or Dictionary types that contain path globs to monitor. String type entires will have default values applied for the attributes that can be manually set with the Dictionary type. |
-| `Path`              | `Paths`      | String     | Yes      | v2023.1+      | The path glob to monitor. |
-| `IsPrefix`          | `Paths`      | Boolean    | No       | v2023.1+      | Whether or not the path glob represents a prefix path. (Default = `false`) |
-| `Options`           | `<Name>`     | Dictionary | No       | v2023.1+      | Customizes the actions for a given rule. |
-| `AllowReadAccess`   | `Options`    | Boolean    | No       | v2023.1+      | If true, indicates the rule will **not** be applied to actions that are read-only access (e.g., opening a watched path for reading, or cloning a watched path). If false, the rule will apply both to read-only access and access that could modify the watched path. (Default = `false`) |
-| `AuditOnly`         | `Options`    | Boolean    | No       | v2023.1+      | If true, operations violating the rule will only be logged. If false, operations violating the rule will be denied and logged. (Default = `true`) |
-| `Processes`         | `<Name>`     | Array      | No       | v2023.1+      | A list of dictionaries defining processes that are allowed to access paths matching the globs defined with the `Paths` key. For a process performing the operation to be considered a match, it must match all defined attributes of at least one entry in the list. |
-| `BinaryPath`        | `Processes`  | String     | No       | v2023.1+      | A path literal that an instigating process must be executed from. |
-| `TeamID`            | `Processes`  | String     | No       | v2023.1+      | Team ID of the instigating process. |
-| `CertificateSha256` | `Processes`  | String     | No       | v2023.1+      | SHA256 of the leaf certificate of the instigating process. |
-| `CDHash`            | `Processes`  | String     | No       | v2023.1+      | CDHash of the instigating process. |
-| `SigningID`         | `Processes`  | String     | No       | v2023.1+      | Signing ID of the instigating process. |
-| `PlatformBinary`    | `Processes`  | Boolean    | No       | v2023.2+      | Whether or not the instigating process is a platform binary. |
+| Key                       | Parent       | Type       | Required | Santa Version | Description |
+| :------------------------ | :----------- | :--------- | :------- | :------------ | :---------- |
+| `Version`                 | `<Root>`     | String     | Yes      | v2023.1+      | Version of the configuration. Will be reported in events. |
+| `WatchItems`              | `<Root>`     | Dictionary | No       | v2023.1+      | The set of configuration items that will be monitored by Santa. |
+| `<Name>`                  | `WatchItems` | Dictionary | No       | v2023.1+      | A unique name that identifies a single watch item rule. This value will be reported in events. The name must be a legal C identifier (i.e., must conform to the regex `[A-Za-z_][A-Za-z0-9_]*`). |
+| `Paths`                   | `<Name>`     | Array      | Yes      | v2023.1+      | A list of either String or Dictionary types that contain path globs to monitor. String type entires will have default values applied for the attributes that can be manually set with the Dictionary type. |
+| `Path`                    | `Paths`      | String     | Yes      | v2023.1+      | The path glob to monitor. |
+| `IsPrefix`                | `Paths`      | Boolean    | No       | v2023.1+      | Whether or not the path glob represents a prefix path. (Default = `false`) |
+| `Options`                 | `<Name>`     | Dictionary | No       | v2023.1+      | Customizes the actions for a given rule. |
+| `AllowReadAccess`         | `Options`    | Boolean    | No       | v2023.1+      | If true, indicates the rule will **not** be applied to actions that are read-only access (e.g., opening a watched path for reading, or cloning a watched path). If false, the rule will apply both to read-only access and access that could modify the watched path. (Default = `false`) |
+| `AuditOnly`               | `Options`    | Boolean    | No       | v2023.1+      | If true, operations violating the rule will only be logged. If false, operations violating the rule will be denied and logged. (Default = `true`) |
+| `InvertProcessExceptions` | `Options`    | Boolean    | No       | v2023.5+      | If true, logic is inverted for the list of processes defined by the `Processes` key such that the list becomes the set of processes that will be denied or allowed but audited. (Default = `false`) |
+| `Processes`               | `<Name>`     | Array      | No       | v2023.1+      | A list of dictionaries defining processes that are allowed to access paths matching the globs defined with the `Paths` key. For a process performing the operation to be considered a match, it must match all defined attributes of at least one entry in the list. |
+| `BinaryPath`              | `Processes`  | String     | No       | v2023.1+      | A path literal that an instigating process must be executed from. |
+| `TeamID`                  | `Processes`  | String     | No       | v2023.1+      | Team ID of the instigating process. |
+| `CertificateSha256`       | `Processes`  | String     | No       | v2023.1+      | SHA256 of the leaf certificate of the instigating process. |
+| `CDHash`                  | `Processes`  | String     | No       | v2023.1+      | CDHash of the instigating process. |
+| `SigningID`               | `Processes`  | String     | No       | v2023.1+      | Signing ID of the instigating process. |
+| `PlatformBinary`          | `Processes`  | Boolean    | No       | v2023.2+      | Whether or not the instigating process is a platform binary. |
 
 ### Example Configuration
 
@@ -67,6 +68,8 @@ This is an example configuration conforming to the specification outlined above:
 				<false/>
 				<key>AuditOnly</key>
 				<true/>
+				<key>InvertProcessExceptions</key>
+				<false/>
 			</dict>
 			<key>Processes</key>
 			<array>
@@ -170,3 +173,7 @@ action=FILE_ACCESS|policy_version=v0.1-experimental|policy_name=UserFoo|path=/Us
 ```
 
 When the `EventLogType` configuration key is set to `protobuf`, a log is emitted to match the `FileAccess` message in the [santa.proto](https://github.com/google/santa/blob/main/Source/common/santa.proto) schema.
+
+### Default Mute Set
+
+The EndpointSecurity framework maintains a set of paths dubbed the "default mute set" that are particularly difficult for ES clients to handle. Additionally, AUTH events from some of these paths have ES response deadline times set very low. In order to help increase stability of this feature, file accesses from binaries in the default mute set are not currently logged. A list of binaries that will not have operations logged can be found in [SNTRuleTable.m](https://github.com/google/santa/blob/2023.4/Source/santad/DataLayer/SNTRuleTable.m#L90-L105). This could be addressed in the future (see [Github Issue #1096](https://github.com/google/santa/issues/1096)).

docs/development/building.md

@@ -128,6 +128,31 @@ Run all the logic / unit tests
 bazel test :unit_tests --define=SANTA_BUILD_TYPE=adhoc --test_output=errors
 ```
 
+##### Testing Config Options Using `/var/db/santa/config-overrides.plist`
+
+Debug versions of Santa have the ability to set/override config settings using an override file, that will be applied over the top of the configuration from a profile.
+
+1. Create a plist in `/var/db/santa/config-overrides.plist`
+
+For example to point Santa at a sync server running on localhost here would be the config-override file.
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>SyncBaseURL</key>
+    <string>http://localhost:8080/v1/santa/</string>
+    <key>SyncClientContentEncoding</key>
+    <string>gzip</string>
+  </dict>
+</plist>
+```
+
+> :warning: Warning
+>  Make sure  the file is readable.
+
+2. run `bazel run //:reload` to rebuild and restart the Santa daemon.
+
 #### Releases
 
 Creates a release build of Santa with a version based of the newest tag. Also
@@ -136,5 +161,5 @@ interpreting future crashes much easier. Releases are handled by Google internal
 infrastructure.
 
 ```sh
-bazel build --apple_generate_dsym -c opt :release
+bazel build --apple_generate_dsym -c opt //:release
 ```

docs/development/sync-protocol.md

@@ -98,7 +98,7 @@ The request consists of the following JSON keys:
 | transitive_rule_count | NO | int | Number of transitive rules the client has at the time of sync |
 | teamid_rule_count | NO | int | Number of TeamID rules the client has at the time of sync | 24 |
 | client_mode | YES | string | the mode the client is operating in, either "LOCKDOWN" or "MONITOR" | LOCKDOWN |
-| clean_sync | NO | bool | the client has requested that a clean sync of its rules from the server. | true |
+| request_clean_sync | NO | bool | the client has requested a clean sync of its rules from the server. | true |
 
 
 ### Example preflight request JSON Payload:
@@ -118,7 +118,7 @@ The request consists of the following JSON keys:
   "transitive_rule_count" : 0,
   "os_version" : "12.4",
   "model_identifier" : "MacBookPro15,1",
-  "clean_sync": true,
+  "request_clean_sync": true,
 }
 ```
 
@@ -186,7 +186,7 @@ sequenceDiagram
 | file_path | YES | string | Absolute file path to the executable that was blocked | "/tmp/foo" |
 | file_name | YES | string | Command portion of the path of the blocked executable | "foo" |
 | executing_user | YES | string | Username that executed the binary | "markowsky" |
-| execution_time | YES | int | Unix timestamp of when the execution occured | 23344234232 |
+| execution_time | YES | float64 | Unix timestamp of when the execution occured | 23344234232 |
 | loggedin_users | NO | List of strings | list of usernames logged in according to utmp | ["markowsky"] |
 | current_sessions | YES | List of strings | list of user sessions | ["markowsky@console", "markowsky@ttys000"] |
 | decision | YES | string | The decision Santa made for this binary, BUNDLE_BINARY is used to preemptively report binaries in a bundle. **Must be one of the examples**.| "ALLOW_BINARY", "ALLOW_CERTIFICATE", "ALLOW_SCOPE", "ALLOW_TEAMID", "ALLOW_UNKNOWN", "BLOCK_BINARY", "BLOCK_CERTIFICATE", "BLOCK_SCOPE", "BLOCK_TEAMID", "BLOCK_UNKNOWN", "BUNDLE_BINARY" |
@@ -197,13 +197,13 @@ sequenceDiagram
 | file_bundle_version | NO | string | The bundle version string | "9999.1.1" |
 | file_bundle_version_string | NO | string | Bundle short version string | "2.3.4" |
 | file_bundle_hash | NO | string | SHA256 hash of all executables in the bundle | "7466e3687f540bcb7792c6d14d5a186667dbe18a85021857b42effe9f0370805" |
-| file_bundle_hash_millis | NO | int | The time in milliseconds it took to find all of the binaries, hash and produce the bundle_hash | 1234775 |
+| file_bundle_hash_millis | NO | float64 | The time in milliseconds it took to find all of the binaries, hash and produce the bundle_hash | 1234775 |
 | pid | YES | int | Process id of the executable that was blocked | 1234 |
 | ppid | YES | int | Parent process id of the executable that was blocked | 456 |
 | parent_name | YES | Parent process short command name of the executable that was blocked | "bar" |
 | quarantine_data_url | NO | string |  The actual URL of the quarantined item from the quarantine database that this binary was downloaded from | https://dl.google.com/chrome/mac/stable/GGRO/googlechrome.dmg |
 | quarantine_referer_url | NO | string | Referring URL that lead to the binary being downloaded if known.  | https://www.google.com/chrome/downloads/ |
-| quarantine_timestamp | NO | int | Unix Timestamp of when the binary was downloaded or 0 if not quarantined | 0 |
+| quarantine_timestamp | NO | float64 | Unix Timestamp of when the binary was downloaded or 0 if not quarantined | 0 |
 | quarantine_agent_bundle_id | NO | string | The bundle ID of the software that quarantined the binary | "com.apple.Safari" |
 | signing_chain | NO | list of signing chain objects | Certs used to code sign the executable | See next section |