docs: Colorize callout and make the link work (#1445)

* Use runtime platform binary check for exec evals

* PR Feedback

* Remove parens to mitigate insane clang-formatting

.bazelrc

@@ -9,6 +9,7 @@ build --copt=-Wno-unknown-warning-option
 build --copt=-Wno-error=deprecated-non-prototype
 build --per_file_copt=.*\.mm\$@-std=c++17
 build --cxxopt=-std=c++17
+build --host_cxxopt=-std=c++17
 
 build --copt=-DSANTA_OPEN_SOURCE=1
 build --cxxopt=-DSANTA_OPEN_SOURCE=1

.bazelversion

@@ -1 +1 @@
-5.3.0
+7.0.0

.github/workflows/check-markdown.yml

@@ -9,6 +9,12 @@ jobs:
   markdown-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
-    - run: "! git grep -EIn $'[ \t]+$' -- ':(exclude)*.patch'"
+      - name: "Checkout Santa"
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # ratchet:actions/checkout@v4
+      - name: "Check for deadlinks"
+        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # ratchet:lycheeverse/lychee-action@v1
+        with:
+          fail: true
+      - name: "Check for trailing whitespace and newlines"
+        if: '!cancelled()'
+        run: "! git grep -EIn $'[ \t]+$' -- ':(exclude)*.patch'"

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-
 on:
   push:
     branches:
@@ -11,45 +10,41 @@ on:
       - main
     paths:
       - 'Source/**'
-
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Run linters
         run: ./Testing/lint.sh
-
   build_userspace:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-11, macos-12, macos-13]
+        os: [macos-12, macos-13, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Build Userspace
         run: bazel build --apple_generate_dsym -c opt :release --define=SANTA_BUILD_TYPE=adhoc
-
   unit_tests:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-11, macos-12, macos-13]
+        os: [macos-12, macos-13, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Run All Tests
         run: bazel test :unit_tests --define=SANTA_BUILD_TYPE=adhoc --test_output=errors
-
   test_coverage:
-    runs-on: macos-11
+    runs-on: macos-14
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Generate test coverage
         run: sh ./generate_cov.sh
       - name: Coveralls
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # ratchet:coverallsapp/github-action@master
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           path-to-lcov: ./bazel-out/_coverage/_coverage_report.dat

.github/workflows/e2e.yml

@@ -1,41 +1,67 @@
 name: E2E
 
-on: workflow_dispatch
+on:
+  schedule:
+    - cron: '0 4 * * *' # Every day at 4:00 UTC (not to interfere with fuzzing)
+  workflow_dispatch:
 
 jobs:
+  update_vm:
+    runs-on: e2e-host
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - name: Update VM
+        env:
+          GCS_KEY: ${{ secrets.GCS_SERVICE_ACCOUNT_KEY }}
+        run: |
+          export GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp.json
+          echo "${GCS_KEY}" > ${GOOGLE_APPLICATION_CREDENTIALS}
+          function cleanup {
+            rm /tmp/gcp.json
+          }
+          trap cleanup EXIT
+          python3 Testing/integration/actions/update_vm.py macOS_14.bundle.tar.gz
+
   start_vm:
     runs-on: e2e-host
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Start VM
-        run: python3 Testing/integration/actions/start_vm.py macOS_12.bundle.tar.gz
+        env:
+          RUNNER_REG_TOKEN: ${{ secrets.RUNNER_REG_TOKEN }}
+        run: python3 Testing/integration/actions/start_vm.py macOS_14.bundle.tar.gz
 
   integration:
     runs-on: e2e-vm
     env:
       VM_PASSWORD: ${{ secrets.VM_PASSWORD }}
     steps:
-      - uses: actions/checkout@v3
-      - name: Install configuration profile
-        run: bazel run //Testing/integration:install_profile -- Testing/integration/configs/default.mobileconfig
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       - name: Add homebrew to PATH
         run: echo "/opt/homebrew/bin/" >> $GITHUB_PATH
+      - name: Install configuration profile
+        run: bazel run //Testing/integration:install_profile -- Testing/integration/configs/default.mobileconfig
+      - name: Build, install, and sync santa
+        run: |
+          bazel run :reload --define=SANTA_BUILD_TYPE=adhoc
+          bazel run //Testing/integration:allow_sysex
+      - name: Test config changes
+        run: ./Testing/integration/test_config_changes.sh
       - name: Build, install, and start moroz
         run: |
           bazel build @com_github_groob_moroz//cmd/moroz:moroz
           cp bazel-bin/external/com_github_groob_moroz/cmd/moroz/moroz_/moroz /tmp/moroz
           /tmp/moroz -configs="$GITHUB_WORKSPACE/Testing/integration/configs/moroz_default/global.toml" -use-tls=false &
-      - name: Build, install, and sync santa
-        run: |
-          bazel run :reload --define=SANTA_BUILD_TYPE=adhoc
-          bazel run //Testing/integration:allow_sysex
           sudo santactl sync --debug
       - name: Run integration test binaries
-        run: bazel test //Testing/integration:integration_tests
-      - name: Test config changes
-        run: ./Testing/integration/test_config_changes.sh
+        run: |
+          bazel test //Testing/integration:integration_tests
+          sleep 3
+          bazel run //Testing/integration:dismiss_santa_popup || true
       - name: Test sync server changes
         run: ./Testing/integration/test_sync_changes.sh
+      - name: Test USB blocking
+        run: ./Testing/integration/test_usb.sh
       - name: Poweroff
         if: ${{ always() }}
         run: sudo shutdown -h +1

.gitignore

@@ -2,7 +2,7 @@
 *.profraw
 *.provisionprofile
 bazel-*
-Pods
+MODULE.bazel.lock
 Santa.xcodeproj/*
 Santa.xcworkspace/*
 CoverageData/*

.pyink-config

@@ -0,0 +1,5 @@
+[tool.pyink]
+pyink = true
+line-length = 80
+pyink-indentation = 2
+pyink-use-majority-quotes = true

.pylintrc

@@ -1,429 +0,0 @@
-# This Pylint rcfile contains a best-effort configuration to uphold the
-# best-practices and style described in the Google Python style guide:
-#   https://google.github.io/styleguide/pyguide.html
-#
-# Its canonical open-source location is:
-#   https://google.github.io/styleguide/pylintrc
-
-[MASTER]
-
-# Files or directories to be skipped. They should be base names, not paths.
-ignore=third_party
-
-# Files or directories matching the regex patterns are skipped. The regex
-# matches against base names, not paths.
-ignore-patterns=
-
-# Pickle collected data for later comparisons.
-persistent=no
-
-# List of plugins (as comma separated values of python modules names) to load,
-# usually to register additional checkers.
-load-plugins=
-
-# Use multiple processes to speed up Pylint.
-jobs=4
-
-# Allow loading of arbitrary C extensions. Extensions are imported into the
-# active Python interpreter and may run arbitrary code.
-unsafe-load-any-extension=no
-
-
-[MESSAGES CONTROL]
-
-# Only show warnings with the listed confidence levels. Leave empty to show
-# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
-confidence=
-
-# Enable the message, report, category or checker with the given id(s). You can
-# either give multiple identifier separated by comma (,) or put this option
-# multiple time (only on the command line, not in the configuration file where
-# it should appear only once). See also the "--disable" option for examples.
-#enable=
-
-# Disable the message, report, category or checker with the given id(s). You
-# can either give multiple identifiers separated by comma (,) or put this
-# option multiple times (only on the command line, not in the configuration
-# file where it should appear only once).You can also use "--disable=all" to
-# disable everything first and then reenable specific checks. For example, if
-# you want to run only the similarities checker, you can use "--disable=all
-# --enable=similarities". If you want to run only the classes checker, but have
-# no Warning level messages displayed, use"--disable=all --enable=classes
-# --disable=W"
-disable=abstract-method,
-        apply-builtin,
-        arguments-differ,
-        attribute-defined-outside-init,
-        backtick,
-        bad-option-value,
-        basestring-builtin,
-        buffer-builtin,
-        c-extension-no-member,
-        consider-using-enumerate,
-        cmp-builtin,
-        cmp-method,
-        coerce-builtin,
-        coerce-method,
-        delslice-method,
-        div-method,
-        duplicate-code,
-        eq-without-hash,
-        execfile-builtin,
-        file-builtin,
-        filter-builtin-not-iterating,
-        fixme,
-        getslice-method,
-        global-statement,
-        hex-method,
-        idiv-method,
-        implicit-str-concat,
-        import-error,
-        import-self,
-        import-star-module-level,
-        inconsistent-return-statements,
-        input-builtin,
-        intern-builtin,
-        invalid-str-codec,
-        locally-disabled,
-        long-builtin,
-        long-suffix,
-        map-builtin-not-iterating,
-        misplaced-comparison-constant,
-        missing-function-docstring,
-        metaclass-assignment,
-        next-method-called,
-        next-method-defined,
-        no-absolute-import,
-        no-else-break,
-        no-else-continue,
-        no-else-raise,
-        no-else-return,
-        no-init,  # added
-        no-member,
-        no-name-in-module,
-        no-self-use,
-        nonzero-method,
-        oct-method,
-        old-division,
-        old-ne-operator,
-        old-octal-literal,
-        old-raise-syntax,
-        parameter-unpacking,
-        print-statement,
-        raising-string,
-        range-builtin-not-iterating,
-        raw_input-builtin,
-        rdiv-method,
-        reduce-builtin,
-        relative-import,
-        reload-builtin,
-        round-builtin,
-        setslice-method,
-        signature-differs,
-        standarderror-builtin,
-        suppressed-message,
-        sys-max-int,
-        too-few-public-methods,
-        too-many-ancestors,
-        too-many-arguments,
-        too-many-boolean-expressions,
-        too-many-branches,
-        too-many-instance-attributes,
-        too-many-locals,
-        too-many-nested-blocks,
-        too-many-public-methods,
-        too-many-return-statements,
-        too-many-statements,
-        trailing-newlines,
-        unichr-builtin,
-        unicode-builtin,
-        unnecessary-pass,
-        unpacking-in-except,
-        useless-else-on-loop,
-        useless-object-inheritance,
-        useless-suppression,
-        using-cmp-argument,
-        wrong-import-order,
-        xrange-builtin,
-        zip-builtin-not-iterating,
-
-
-[REPORTS]
-
-# Set the output format. Available formats are text, parseable, colorized, msvs
-# (visual studio) and html. You can also give a reporter class, eg
-# mypackage.mymodule.MyReporterClass.
-output-format=text
-
-# Tells whether to display a full report or only the messages
-reports=no
-
-# Python expression which should return a note less than 10 (10 is the highest
-# note). You have access to the variables errors warning, statement which
-# respectively contain the number of errors / warnings messages and the total
-# number of statements analyzed. This is used by the global evaluation report
-# (RP0004).
-evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
-
-# Template used to display messages. This is a python new-style format string
-# used to format the message information. See doc for all details
-#msg-template=
-
-
-[BASIC]
-
-# Good variable names which should always be accepted, separated by a comma
-good-names=main,_
-
-# Bad variable names which should always be refused, separated by a comma
-bad-names=
-
-# Colon-delimited sets of names that determine each other's naming style when
-# the name regexes allow several styles.
-name-group=
-
-# Include a hint for the correct naming format with invalid-name
-include-naming-hint=no
-
-# List of decorators that produce properties, such as abc.abstractproperty. Add
-# to this list to register other decorators that produce valid properties.
-property-classes=abc.abstractproperty,cached_property.cached_property,cached_property.threaded_cached_property,cached_property.cached_property_with_ttl,cached_property.threaded_cached_property_with_ttl
-
-# Regular expression matching correct function names
-function-rgx=^(?:(?P<exempt>setUp|tearDown|setUpModule|tearDownModule)|(?P<camel_case>_?[A-Z][a-zA-Z0-9]*)|(?P<snake_case>_?[a-z][a-z0-9_]*))$
-
-# Regular expression matching correct variable names
-variable-rgx=^[a-z][a-z0-9_]*$
-
-# Regular expression matching correct constant names
-const-rgx=^(_?[A-Z][A-Z0-9_]*|__[a-z0-9_]+__|_?[a-z][a-z0-9_]*)$
-
-# Regular expression matching correct attribute names
-attr-rgx=^_{0,2}[a-z][a-z0-9_]*$
-
-# Regular expression matching correct argument names
-argument-rgx=^[a-z][a-z0-9_]*$
-
-# Regular expression matching correct class attribute names
-class-attribute-rgx=^(_?[A-Z][A-Z0-9_]*|__[a-z0-9_]+__|_?[a-z][a-z0-9_]*)$
-
-# Regular expression matching correct inline iteration names
-inlinevar-rgx=^[a-z][a-z0-9_]*$
-
-# Regular expression matching correct class names
-class-rgx=^_?[A-Z][a-zA-Z0-9]*$
-
-# Regular expression matching correct module names
-module-rgx=^(_?[a-z][a-z0-9_]*|__init__)$
-
-# Regular expression matching correct method names
-method-rgx=(?x)^(?:(?P<exempt>_[a-z0-9_]+__|runTest|setUp|tearDown|setUpTestCase|tearDownTestCase|setupSelf|tearDownClass|setUpClass|(test|assert)_*[A-Z0-9][a-zA-Z0-9_]*|next)|(?P<camel_case>_{0,2}[A-Z][a-zA-Z0-9_]*)|(?P<snake_case>_{0,2}[a-z][a-z0-9_]*))$
-
-# Regular expression which should only match function or class names that do
-# not require a docstring.
-no-docstring-rgx=(__.*__|main|test.*|.*test|.*Test)$
-
-# Minimum line length for functions/classes that require docstrings, shorter
-# ones are exempt.
-docstring-min-length=10
-
-
-[TYPECHECK]
-
-# List of decorators that produce context managers, such as
-# contextlib.contextmanager. Add to this list to register other decorators that
-# produce valid context managers.
-contextmanager-decorators=contextlib.contextmanager,contextlib2.contextmanager
-
-# Tells whether missing members accessed in mixin class should be ignored. A
-# mixin class is detected if its name ends with "mixin" (case insensitive).
-ignore-mixin-members=yes
-
-# List of module names for which member attributes should not be checked
-# (useful for modules/projects where namespaces are manipulated during runtime
-# and thus existing member attributes cannot be deduced by static analysis. It
-# supports qualified module names, as well as Unix pattern matching.
-ignored-modules=
-
-# List of class names for which member attributes should not be checked (useful
-# for classes with dynamically set attributes). This supports the use of
-# qualified names.
-ignored-classes=optparse.Values,thread._local,_thread._local
-
-# List of members which are set dynamically and missed by pylint inference
-# system, and so shouldn't trigger E1101 when accessed. Python regular
-# expressions are accepted.
-generated-members=
-
-
-[FORMAT]
-
-# Maximum number of characters on a single line.
-max-line-length=80
-
-# TODO(https://github.com/PyCQA/pylint/issues/3352): Direct pylint to exempt
-# lines made too long by directives to pytype.
-
-# Regexp for a line that is allowed to be longer than the limit.
-ignore-long-lines=(?x)(
-  ^\s*(\#\ )?<?https?://\S+>?$|
-  ^\s*(from\s+\S+\s+)?import\s+.+$)
-
-# Allow the body of an if to be on the same line as the test if there is no
-# else.
-single-line-if-stmt=yes
-
-# Maximum number of lines in a module
-max-module-lines=99999
-
-# String used as indentation unit.  The internal Google style guide mandates 2
-# spaces.  Google's externaly-published style guide says 4, consistent with
-# PEP 8.  Here, we use 2 spaces, for conformity with many open-sourced Google
-# projects (like TensorFlow).
-indent-string='  '
-
-# Number of spaces of indent required inside a hanging  or continued line.
-indent-after-paren=4
-
-# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
-expected-line-ending-format=
-
-
-[MISCELLANEOUS]
-
-# List of note tags to take in consideration, separated by a comma.
-notes=TODO
-
-
-[STRING]
-
-# This flag controls whether inconsistent-quotes generates a warning when the
-# character used as a quote delimiter is used inconsistently within a module.
-check-quote-consistency=yes
-
-
-[VARIABLES]
-
-# Tells whether we should check for unused import in __init__ files.
-init-import=no
-
-# A regular expression matching the name of dummy variables (i.e. expectedly
-# not used).
-dummy-variables-rgx=^\*{0,2}(_$|unused_|dummy_)
-
-# List of additional names supposed to be defined in builtins. Remember that
-# you should avoid to define new builtins when possible.
-additional-builtins=
-
-# List of strings which can identify a callback function by name. A callback
-# name must start or end with one of those strings.
-callbacks=cb_,_cb
-
-# List of qualified module names which can have objects that can redefine
-# builtins.
-redefining-builtins-modules=six,six.moves,past.builtins,future.builtins,functools
-
-
-[LOGGING]
-
-# Logging modules to check that the string format arguments are in logging
-# function parameter format
-logging-modules=logging,absl.logging,tensorflow.io.logging
-
-
-[SIMILARITIES]
-
-# Minimum lines number of a similarity.
-min-similarity-lines=4
-
-# Ignore comments when computing similarities.
-ignore-comments=yes
-
-# Ignore docstrings when computing similarities.
-ignore-docstrings=yes
-
-# Ignore imports when computing similarities.
-ignore-imports=no
-
-
-[SPELLING]
-
-# Spelling dictionary name. Available dictionaries: none. To make it working
-# install python-enchant package.
-spelling-dict=
-
-# List of comma separated words that should not be checked.
-spelling-ignore-words=
-
-# A path to a file that contains private dictionary; one word per line.
-spelling-private-dict-file=
-
-# Tells whether to store unknown words to indicated private dictionary in
-# --spelling-private-dict-file option instead of raising a message.
-spelling-store-unknown-words=no
-
-
-[IMPORTS]
-
-# Deprecated modules which should not be used, separated by a comma
-deprecated-modules=regsub,
-                   TERMIOS,
-                   Bastion,
-                   rexec,
-                   sets
-
-# Create a graph of every (i.e. internal and external) dependencies in the
-# given file (report RP0402 must not be disabled)
-import-graph=
-
-# Create a graph of external dependencies in the given file (report RP0402 must
-# not be disabled)
-ext-import-graph=
-
-# Create a graph of internal dependencies in the given file (report RP0402 must
-# not be disabled)
-int-import-graph=
-
-# Force import order to recognize a module as part of the standard
-# compatibility libraries.
-known-standard-library=
-
-# Force import order to recognize a module as part of a third party library.
-known-third-party=enchant, absl
-
-# Analyse import fallback blocks. This can be used to support both Python 2 and
-# 3 compatible code, which means that the block might have code that exists
-# only in one or another interpreter, leading to false positives when analysed.
-analyse-fallback-blocks=no
-
-
-[CLASSES]
-
-# List of method names used to declare (i.e. assign) instance attributes.
-defining-attr-methods=__init__,
-                      __new__,
-                      setUp
-
-# List of member names, which should be excluded from the protected access
-# warning.
-exclude-protected=_asdict,
-                  _fields,
-                  _replace,
-                  _source,
-                  _make
-
-# List of valid names for the first argument in a class method.
-valid-classmethod-first-arg=cls,
-                            class_
-
-# List of valid names for the first argument in a metaclass class method.
-valid-metaclass-classmethod-first-arg=mcs
-
-
-[EXCEPTIONS]
-
-# Exceptions that will emit a warning when being caught. Defaults to
-# "Exception"
-overgeneral-exceptions=StandardError,
-                       Exception,
-                       BaseException

BUILD

@@ -1,7 +1,9 @@
 load("@build_bazel_rules_apple//apple:versioning.bzl", "apple_bundle_version")
 load("//:helper.bzl", "run_command")
 
-package(default_visibility = ["//:santa_package_group"])
+package(
+    default_visibility = ["//:santa_package_group"],
+)
 
 licenses(["notice"])
 

Conf/Package/package_and_sign.sh

@@ -53,11 +53,10 @@ readonly RELEASE_NAME="santa-$(/usr/bin/defaults read "${INPUT_APP}/Contents/Inf
 readonly SCRATCH=$(/usr/bin/mktemp -d "${TMPDIR}/santa-"XXXXXX)
 readonly APP_PKG_ROOT="${SCRATCH}/app_pkg_root"
 readonly APP_PKG_SCRIPTS="${SCRATCH}/pkg_scripts"
-readonly ENTITLEMENTS="${SCRATCH}/entitlements"
 
 readonly SCRIPT_PATH="$(/usr/bin/dirname -- ${BASH_SOURCE[0]})"
 
-/bin/mkdir -p "${APP_PKG_ROOT}" "${APP_PKG_SCRIPTS}" "${ENTITLEMENTS}"
+/bin/mkdir -p "${APP_PKG_ROOT}" "${APP_PKG_SCRIPTS}"
 
 readonly DMG_PATH="${ARTIFACTS_DIR}/${RELEASE_NAME}.dmg"
 readonly TAR_PATH="${ARTIFACTS_DIR}/${RELEASE_NAME}.tar.gz"
@@ -65,19 +64,9 @@ readonly TAR_PATH="${ARTIFACTS_DIR}/${RELEASE_NAME}.tar.gz"
 # Sign all of binaries/bundles. Maintain inside-out ordering where necessary
 for ARTIFACT in "${INPUT_SANTACTL}" "${INPUT_SANTABS}" "${INPUT_SANTAMS}" "${INPUT_SANTASS}" "${INPUT_SYSX}" "${INPUT_APP}"; do
   BN=$(/usr/bin/basename "${ARTIFACT}")
-  EN="${ENTITLEMENTS}/${BN}.entitlements"
-
-  echo "extracting ${BN} entitlements"
-  /usr/bin/codesign -d --entitlements "${EN}" "${ARTIFACT}"
-  if [[ -s "${EN}" ]]; then
-    EN="--entitlements ${EN}"
-  else
-    EN=""
-  fi
-
   echo "codesigning ${BN}"
   /usr/bin/codesign --sign "${SIGNING_IDENTITY}" --keychain "${SIGNING_KEYCHAIN}" \
-        ${EN} --timestamp --force --generate-entitlement-der \
+        --preserve-metadata=entitlements --timestamp --force --generate-entitlement-der \
         --options library,kill,runtime "${ARTIFACT}"
 done
 

Fuzzing/santad/src/databaseRuleAddRules.mm

@@ -18,6 +18,7 @@
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
 #import "SNTCommandController.h"
+#import "SNTCommonEnums.h"
 #import "SNTRule.h"
 #import "SNTXPCControlInterface.h"
 
@@ -58,7 +59,7 @@ extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size
   [daemonConn resume];
   [[daemonConn remoteObjectProxy]
     databaseRuleAddRules:@[ newRule ]
-              cleanSlate:NO
+             ruleCleanup:SNTRuleCleanupNone
                    reply:^(NSError *error) {
                      if (!error) {
                        if (newRule.state == SNTRuleStateRemove) {

LICENSE

@@ -201,12 +201,3 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
-------------------
-
-Files: Testing/integration/VM/*
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

MODULE.bazel

@@ -0,0 +1,56 @@
+module(name = "santa")
+
+bazel_dep(name = "apple_support", version = "1.15.1", repo_name = "build_bazel_apple_support")
+bazel_dep(name = "abseil-cpp", version = "20240116.2", repo_name = "com_google_absl")
+bazel_dep(name = "rules_python", version = "0.33.2")
+bazel_dep(name = "rules_cc", version = "0.0.9")
+bazel_dep(name = "rules_apple", version = "3.8.0", repo_name = "build_bazel_rules_apple")
+bazel_dep(name = "rules_swift", version = "2.0.0-rc1", repo_name = "build_bazel_rules_swift")
+bazel_dep(name = "rules_fuzzing", version = "0.5.2")
+bazel_dep(name = "protobuf", version = "27.2", repo_name = "com_google_protobuf")
+bazel_dep(name = "googletest", version = "1.14.0.bcr.1", repo_name = "com_google_googletest")
+
+# MOLCertificate
+bazel_dep(name = "molcertificate", version = "2.1", repo_name = "MOLCertificate")
+git_override(
+    module_name = "molcertificate",
+    commit = "34f0ccf68a34a07cc636ada89057c529f90bec3a",
+    remote = "https://github.com/google/macops-molcertificate.git",
+)
+
+# MOLAuthenticatingURLSession
+bazel_dep(name = "molauthenticatingurlsession", version = "3.0", repo_name = "MOLAuthenticatingURLSession")
+git_override(
+    module_name = "molauthenticatingurlsession",
+    commit = "0a50a67f29d635a4012981714c1dedef9ac25fe6",
+    remote = "https://github.com/google/macops-molauthenticatingurlsession.git",
+)
+
+# MOLCodesignChecker
+bazel_dep(name = "molcodesignchecker", version = "3.0", repo_name = "MOLCodesignChecker")
+git_override(
+    module_name = "molcodesignchecker",
+    commit = "5060bcc8baa90bae3b0ca705d14850328bbbec53",
+    remote = "https://github.com/google/macops-molcodesignchecker.git",
+)
+
+# MOLXPCConnection
+bazel_dep(name = "molxpcconnection", version = "2.1", repo_name = "MOLXPCConnection")
+git_override(
+    module_name = "molxpcconnection",
+    commit = "da816dc49becac96d941ef6a5c4153ed39d1fe7c",
+    remote = "https://github.com/russellhancox/macops-molxpcconnection.git",
+)
+
+# FMDB
+non_module_deps = use_extension("//:non_module_deps.bzl", "non_module_deps")
+use_repo(non_module_deps, "FMDB")
+use_repo(non_module_deps, "OCMock")
+
+# Hedron's Compile Commands Extractor
+bazel_dep(name = "hedron_compile_commands", dev_dependency = True)
+git_override(
+    module_name = "hedron_compile_commands",
+    commit = "0e990032f3c5a866e72615cf67e5ce22186dcb97",
+    remote = "https://github.com/hedronvision/bazel-compile-commands-extractor.git",
+)

README.md

@@ -1,5 +1,12 @@
 # Santa
 
+> [!NOTE]
+> **As of 2025, Santa is no longer maintained by Google.**  We encourage
+> existing users to migrate to an actively maintained fork of Santa, such as
+> https://github.com/northpolesec/santa.
+
+---
+
 [![license](https://img.shields.io/github/license/google/santa)](https://github.com/google/santa/blob/main/LICENSE)
 [![CI](https://github.com/google/santa/actions/workflows/ci.yml/badge.svg)](https://github.com/google/santa/actions/workflows/ci.yml)
 [![latest release](https://img.shields.io/github/v/release/google/santa.svg)](https://github.com/google/santa/releases/latest)
@@ -7,10 +14,10 @@
 [![downloads](https://img.shields.io/github/downloads/google/santa/latest/total)](https://github.com/google/santa/releases/latest)
 
 <p align="center">
-    <img src="https://raw.githubusercontent.com/google/santa/main/Source/gui/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
+    <img src="./docs/images/santa-sleigh-256.png" height="128" alt="Santa Icon" />
 </p>
 
-Santa is a binary authorization system for macOS. It consists of a system
+Santa is a binary and file access authorization system for macOS. It consists of a system
 extension that monitors for executions, a daemon that makes execution decisions
 based on the contents of a local database, a GUI agent that notifies the user in
 case of a block decision and a command-line utility for managing the system and
@@ -21,7 +28,7 @@ It is named Santa because it keeps track of binaries that are naughty or nice.
 # Docs
 
 The Santa docs are stored in the
-[Docs](https://github.com/google/santa/blob/main/docs) directory and published
+[Docs](https://github.com/google/santa/blob/main/docs) directory and are published
 at https://santa.dev.
 
 The docs include deployment options, details on how parts of Santa work and
@@ -48,9 +55,7 @@ disclosure reporting.
   the events database. In LOCKDOWN mode, only listed binaries are allowed to
   run.
 
-* Event logging: When the kext is loaded, all binary launches are logged.  When
-  in either mode, all unknown or denied binaries are stored in the database to
-  enable later aggregation.
+* Event logging: When the system extension is loaded, all binary launches are logged. When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.
 
 * Certificate-based rules, with override levels: Instead of relying on a
   binary's hash (or 'fingerprint'), executables can be allowed/blocked by their
@@ -140,7 +145,7 @@ A tool like Santa doesn't really lend itself to screenshots, so here's a video
 instead.
 
 
-<p align="center"> <img src="https://thumbs.gfycat.com/MadFatalAmphiuma-small.gif" alt="Santa Block Video" /> </p>
+<p align="center"> <img src="./docs/images/santa-block.gif" alt="Santa Block Video" /> </p>
 
 # Contributing
 Patches to this project are very much welcome. Please see the

Source/common/BUILD

@@ -1,5 +1,5 @@
-load("//:helper.bzl", "santa_unit_test")
 load("@rules_cc//cc:defs.bzl", "cc_proto_library")
+load("//:helper.bzl", "santa_unit_test")
 
 package(
     default_visibility = ["//:santa_package_group"],
@@ -11,6 +11,7 @@ proto_library(
     name = "santa_proto",
     srcs = ["santa.proto"],
     deps = [
+        "//Source/santad/ProcessTree:process_tree_proto",
         "@com_google_protobuf//:any_proto",
         "@com_google_protobuf//:timestamp_proto",
     ],
@@ -40,6 +41,12 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "SNTDeepCopy",
+    srcs = ["SNTDeepCopy.m"],
+    hdrs = ["SNTDeepCopy.h"],
+)
+
 cc_library(
     name = "SantaCache",
     hdrs = ["SantaCache.h"],
@@ -54,6 +61,56 @@ santa_unit_test(
     ],
 )
 
+# This target shouldn't be used directly.
+# Use a more specific scoped type instead.
+objc_library(
+    name = "ScopedTypeRef",
+    hdrs = ["ScopedTypeRef.h"],
+    visibility = ["//Source/common:__pkg__"],
+)
+
+objc_library(
+    name = "ScopedCFTypeRef",
+    hdrs = ["ScopedCFTypeRef.h"],
+    deps = [
+        ":ScopedTypeRef",
+    ],
+)
+
+santa_unit_test(
+    name = "ScopedCFTypeRefTest",
+    srcs = ["ScopedCFTypeRefTest.mm"],
+    sdk_frameworks = [
+        "Security",
+    ],
+    deps = [
+        ":ScopedCFTypeRef",
+    ],
+)
+
+objc_library(
+    name = "ScopedIOObjectRef",
+    hdrs = ["ScopedIOObjectRef.h"],
+    sdk_frameworks = [
+        "IOKit",
+    ],
+    deps = [
+        ":ScopedTypeRef",
+    ],
+)
+
+santa_unit_test(
+    name = "ScopedIOObjectRefTest",
+    srcs = ["ScopedIOObjectRefTest.mm"],
+    sdk_frameworks = [
+        "IOKit",
+    ],
+    deps = [
+        ":ScopedIOObjectRef",
+        "//Source/santad:EndpointSecuritySerializerUtilities",
+    ],
+)
+
 objc_library(
     name = "BranchPrediction",
     hdrs = ["BranchPrediction.h"],
@@ -84,12 +141,32 @@ objc_library(
     ],
 )
 
+objc_library(
+    name = "CertificateHelpers",
+    srcs = ["CertificateHelpers.m"],
+    hdrs = ["CertificateHelpers.h"],
+    deps = [
+        "@MOLCertificate",
+    ],
+)
+
+objc_library(
+    name = "SigningIDHelpers",
+    srcs = ["SigningIDHelpers.m"],
+    hdrs = ["SigningIDHelpers.h"],
+    deps = [
+        ":SNTLogging",
+        "@MOLCodesignChecker",
+    ],
+)
+
 objc_library(
     name = "SNTBlockMessage",
     srcs = ["SNTBlockMessage.m"],
     hdrs = ["SNTBlockMessage.h"],
     deps = [
         ":SNTConfigurator",
+        ":SNTFileAccessEvent",
         ":SNTLogging",
         ":SNTStoredEvent",
         ":SNTSystemInfo",
@@ -103,7 +180,7 @@ objc_library(
     defines = ["SANTAGUI"],
     deps = [
         ":SNTConfigurator",
-        ":SNTDeviceEvent",
+        ":SNTFileAccessEvent",
         ":SNTLogging",
         ":SNTStoredEvent",
         ":SNTSystemInfo",
@@ -142,7 +219,8 @@ objc_library(
         "Foundation",
     ],
     deps = [
-        "@MOLCertificate",
+        ":CertificateHelpers",
+        ":SNTStoredEvent",
     ],
 )
 
@@ -196,6 +274,7 @@ objc_library(
     hdrs = ["SNTFileInfo.h"],
     deps = [
         ":SNTLogging",
+        ":SantaVnode",
         "@FMDB",
         "@MOLCodesignChecker",
     ],
@@ -238,7 +317,17 @@ objc_library(
 santa_unit_test(
     name = "SNTRuleTest",
     srcs = ["SNTRuleTest.m"],
-    deps = [":SNTRule"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTRule",
+        ":SNTSyncConstants",
+    ],
+)
+
+objc_library(
+    name = "SNTRuleIdentifiers",
+    srcs = ["SNTRuleIdentifiers.m"],
+    hdrs = ["SNTRuleIdentifiers.h"],
 )
 
 objc_library(
@@ -306,6 +395,7 @@ objc_library(
         ":SNTCommonEnums",
         ":SNTConfigurator",
         ":SNTRule",
+        ":SNTRuleIdentifiers",
         ":SNTStoredEvent",
         ":SNTXPCUnprivilegedControlInterface",
         "@MOLCodesignChecker",
@@ -348,6 +438,7 @@ objc_library(
     deps = [
         ":SNTCommonEnums",
         ":SNTRule",
+        ":SNTRuleIdentifiers",
         ":SNTStoredEvent",
         ":SNTXPCBundleServiceInterface",
         ":SantaVnode",
@@ -393,16 +484,46 @@ santa_unit_test(
     ],
 )
 
+santa_unit_test(
+    name = "SNTBlockMessageTest",
+    srcs = ["SNTBlockMessageTest.m"],
+    sdk_frameworks = [
+        "AppKit",
+    ],
+    deps = [
+        ":SNTBlockMessage_SantaGUI",
+        ":SNTConfigurator",
+        ":SNTFileAccessEvent",
+        ":SNTStoredEvent",
+        ":SNTSystemInfo",
+        "@OCMock",
+    ],
+)
+
+santa_unit_test(
+    name = "SNTConfiguratorTest",
+    srcs = ["SNTConfiguratorTest.m"],
+    deps = [
+        ":SNTCommonEnums",
+        ":SNTConfigurator",
+        "@OCMock",
+    ],
+)
+
 test_suite(
     name = "unit_tests",
     tests = [
         ":PrefixTreeTest",
+        ":SNTBlockMessageTest",
         ":SNTCachedDecisionTest",
+        ":SNTConfiguratorTest",
         ":SNTFileInfoTest",
         ":SNTKVOManagerTest",
         ":SNTMetricSetTest",
         ":SNTRuleTest",
         ":SantaCacheTest",
+        ":ScopedCFTypeRefTest",
+        ":ScopedIOObjectRefTest",
     ],
     visibility = ["//:santa_package_group"],
 )
@@ -416,6 +537,7 @@ objc_library(
         "bsm",
     ],
     deps = [
+        ":Platform",
         ":SystemResources",
         "@OCMock",
         "@com_google_googletest//:gtest",

Source/common/CertificateHelpers.h

@@ -0,0 +1,43 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+#import <MOLCertificate/MOLCertificate.h>
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
+/**
+  Return a string representing publisher info from the provided certs
+
+  @param certs A certificate chain
+  @param teamID A team ID to be displayed for apps from the App Store
+
+  @return A string that tries to be more helpful to users by extracting
+  appropriate information from the certificate chain.
+*/
+NSString *Publisher(NSArray<MOLCertificate *> *certs, NSString *teamID);
+
+/**
+  Return an array of the underlying SecCertificateRef's for the given array
+  of MOLCertificates.
+
+  @param certs An array of MOLCertificates
+
+  @return An array of SecCertificateRefs. WARNING: If the refs need to be used
+  for a long time be careful to properly CFRetain/CFRelease the returned items.
+*/
+NSArray<id> *CertificateChain(NSArray<MOLCertificate *> *certs);
+
+__END_DECLS

Source/common/CertificateHelpers.m

@@ -0,0 +1,42 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/CertificateHelpers.h"
+
+#include <Security/SecCertificate.h>
+
+NSString *Publisher(NSArray<MOLCertificate *> *certs, NSString *teamID) {
+  MOLCertificate *leafCert = [certs firstObject];
+
+  if ([leafCert.commonName isEqualToString:@"Apple Mac OS Application Signing"]) {
+    return [NSString stringWithFormat:@"App Store (Team ID: %@)", teamID];
+  } else if (leafCert.commonName && leafCert.orgName) {
+    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
+  } else if (leafCert.commonName) {
+    return leafCert.commonName;
+  } else if (leafCert.orgName) {
+    return leafCert.orgName;
+  } else {
+    return nil;
+  }
+}
+
+NSArray<id> *CertificateChain(NSArray<MOLCertificate *> *certs) {
+  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[certs count]];
+  for (MOLCertificate *cert in certs) {
+    [certArray addObject:(id)cert.certRef];
+  }
+
+  return certArray;
+}

Source/common/Platform.h

@@ -17,13 +17,6 @@
 
 #include <Availability.h>
 
-#if defined(MAC_OS_VERSION_12_0) && \
-    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_12_0
-#define HAVE_MACOS_12 1
-#else
-#define HAVE_MACOS_12 0
-#endif
-
 #if defined(MAC_OS_VERSION_13_0) && \
     MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_13_0
 #define HAVE_MACOS_13 1
@@ -31,4 +24,18 @@
 #define HAVE_MACOS_13 0
 #endif
 
+#if defined(MAC_OS_VERSION_14_0) && \
+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
+#define HAVE_MACOS_14 1
+#else
+#define HAVE_MACOS_14 0
+#endif
+
+#if defined(MAC_OS_VERSION_15_0) && \
+    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_15_0
+#define HAVE_MACOS_15 1
+#else
+#define HAVE_MACOS_15 0
+#endif
+
 #endif

Source/common/PrefixTree.h

@@ -28,7 +28,7 @@
 #define DEBUG_LOG(format, ...)  // NOP
 #endif
 
-namespace santa::common {
+namespace santa {
 
 template <typename ValueT>
 class PrefixTree {
@@ -74,6 +74,11 @@ class PrefixTree {
     node_count_ = 0;
   }
 
+  uint32_t NodeCount() {
+    absl::ReaderMutexLock lock(&lock_);
+    return node_count_;
+  }
+
 #if SANTA_PREFIX_TREE_DEBUG
   void Print() {
     char buf[max_depth_ + 1];
@@ -82,11 +87,6 @@ class PrefixTree {
     absl::ReaderMutexLock lock(&lock_);
     PrintLocked(root_, buf, 0);
   }
-
-  uint32_t NodeCount() {
-    absl::ReaderMutexLock lock(&lock_);
-    return node_count_;
-  }
 #endif
 
  private:
@@ -125,7 +125,10 @@ class PrefixTree {
             return false;
           }
 
-          cur_byte = (uint8_t) * ++p;
+          // Disabling clang format due to local/remote version differences.
+          // clang-format off
+          cur_byte = (uint8_t)*++p;
+          // clang-format on
         } while (*p);
 
         node->node_type_ = node_type;
@@ -297,6 +300,6 @@ class PrefixTree {
   absl::Mutex lock_;
 };
 
-}  // namespace santa::common
+}  // namespace santa
 
 #endif

Source/common/PrefixTreeTest.mm

@@ -17,7 +17,7 @@
 #define SANTA_PREFIX_TREE_DEBUG 1
 #include "Source/common/PrefixTree.h"
 
-using santa::common::PrefixTree;
+using santa::PrefixTree;
 
 @interface PrefixTreeTest : XCTestCase
 @end

Source/common/SNTBlockMessage.h

@@ -18,6 +18,9 @@
 #import <Foundation/Foundation.h>
 #endif
 
+#import "Source/common/SNTFileAccessEvent.h"
+#import "Source/common/SNTStoredEvent.h"
+
 @class SNTStoredEvent;
 
 @interface SNTBlockMessage : NSObject
@@ -38,11 +41,15 @@
 + (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                          customMessage:(NSString *)customMessage;
 
++ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
+                                                   customMessage:(NSString *)customMessage;
+
 ///
 ///  Return a URL generated from the EventDetailURL configuration key
 ///  after replacing templates in the URL with values from the event.
 ///
-+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event;
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url;
++ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url;
 
 ///
 ///  Strip HTML from a string, replacing <br /> with newline.

Source/common/SNTBlockMessage.m

@@ -15,10 +15,15 @@
 #import "Source/common/SNTBlockMessage.h"
 
 #import "Source/common/SNTConfigurator.h"
+#import "Source/common/SNTFileAccessEvent.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #import "Source/common/SNTSystemInfo.h"
 
+static id ValueOrNull(id value) {
+  return value ?: [NSNull null];
+}
+
 @implementation SNTBlockMessage
 
 + (NSAttributedString *)formatMessage:(NSString *)message {
@@ -51,7 +56,11 @@
 
 #ifdef SANTAGUI
   NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
-  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
+  NSDictionary *options = @{
+    NSDocumentTypeDocumentAttribute : NSHTMLTextDocumentType,
+    NSCharacterEncodingDocumentAttribute : @(NSUTF8StringEncoding),
+  };
+  return [[NSAttributedString alloc] initWithHTML:htmlData options:options documentAttributes:NULL];
 #else
   NSString *strippedHTML = [self stringFromHTML:fullHTML];
   if (!strippedHTML) {
@@ -82,6 +91,18 @@
   return [SNTBlockMessage formatMessage:message];
 }
 
++ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
+                                                   customMessage:(NSString *)customMessage {
+  NSString *message = customMessage;
+  if (!message.length) {
+    message = [[SNTConfigurator configurator] fileAccessBlockMessage];
+    if (!message.length) {
+      message = @"Access to a file has been denied.";
+    }
+  }
+  return [SNTBlockMessage formatMessage:message];
+}
+
 + (NSString *)stringFromHTML:(NSString *)html {
   NSError *error;
   NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
@@ -109,46 +130,113 @@
   return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
 }
 
-+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
++ (NSString *)replaceFormatString:(NSString *)str
+                         withDict:(NSDictionary<NSString *, NSString *> *)replacements {
+  __block NSString *formatStr = str;
+
+  [replacements enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSString *value, BOOL *stop) {
+    if ((id)value != [NSNull null]) {
+      formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];
+    }
+  }];
+
+  return formatStr;
+}
+
+//
+//   The following "format strings" will be replaced in the URL provided by
+//   `+eventDetailURLForEvent:customURL:templateMapping:`.
+//
+//   %file_identifier%           - The SHA-256 of the binary being executed.
+//   %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
+//                                 if no bundle hash is present.
+//   %file_bundle_id%            - The bundle id of the binary, if any.
+//   %team_id%                   - The Team ID if present in the signature information.
+//   %signing_id%                - The Signing ID if present in the signature information.
+//   %cdhash%                    - If signed, the CDHash.
+//   %username%                  - The executing user's name.
+//   %machine_id%                - The configured machine ID for this host.
+//   %hostname%                  - The machine's FQDN.
+//   %uuid%                      - The machine's UUID.
+//   %serial%                    - The machine's serial number.
+//
++ (NSDictionary *)eventDetailTemplateMappingForEvent:(SNTStoredEvent *)event {
+  SNTConfigurator *config = [SNTConfigurator configurator];
+  return @{
+    @"%file_sha%" : ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
+    @"%file_identifier%" : ValueOrNull(event.fileSHA256),
+    @"%bundle_or_file_identifier%" :
+      ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
+    @"%username%" : ValueOrNull(event.executingUser),
+    @"%file_bundle_id%" : ValueOrNull(event.fileBundleID),
+    @"%team_id%" : ValueOrNull(event.teamID),
+    @"%signing_id%" : ValueOrNull(event.signingID),
+    @"%cdhash%" : ValueOrNull(event.cdhash),
+    @"%machine_id%" : ValueOrNull(config.machineID),
+    @"%hostname%" : ValueOrNull([SNTSystemInfo longHostname]),
+    @"%uuid%" : ValueOrNull([SNTSystemInfo hardwareUUID]),
+    @"%serial%" : ValueOrNull([SNTSystemInfo serialNumber]),
+  };
+}
+
+//
+//   Everything from `+eventDetailTemplateMappingForEvent:` with the following file access
+//   specific templates.
+//
+//   %rule_version%    - The version of the rule that was violated.
+//   %rule_name%       - The name of the rule that was violated.
+//   %accessed_path%   - The path accessed by the binary.
+//
++ (NSDictionary *)fileAccessEventDetailTemplateMappingForEvent:(SNTFileAccessEvent *)event {
+  NSMutableDictionary *d = [self eventDetailTemplateMappingForEvent:event].mutableCopy;
+  [d addEntriesFromDictionary:@{
+    @"%rule_version%" : ValueOrNull(event.ruleVersion),
+    @"%rule_name%" : ValueOrNull(event.ruleName),
+    @"%accessed_path%" : ValueOrNull(event.accessedPath),
+  }];
+  return d;
+}
+
+// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
+// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
+// URL is passed and there is no configured EventDetailURL template, nil will be returned.
+// The "format strings" in `templateMapping` will be replaced in the URL, if they are present.
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event
+                        customURL:(NSString *)url
+                  templateMapping:(NSDictionary *)templateMapping {
   SNTConfigurator *config = [SNTConfigurator configurator];
 
-  NSString *hostname = [SNTSystemInfo longHostname];
-  NSString *uuid = [SNTSystemInfo hardwareUUID];
-  NSString *serial = [SNTSystemInfo serialNumber];
-  NSString *formatStr = config.eventDetailURL;
-  if (!formatStr.length) return nil;
-
-  if (event.fileSHA256) {
-    // This key is deprecated, use %file_identifier% or %bundle_or_file_identifier%
-    formatStr =
-      [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
-                                           withString:event.fileBundleHash ?: event.fileSHA256];
-
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_identifier%"
-                                                     withString:event.fileSHA256];
-    formatStr =
-      [formatStr stringByReplacingOccurrencesOfString:@"%bundle_or_file_identifier%"
-                                           withString:event.fileBundleHash ?: event.fileSHA256];
-  }
-  if (event.executingUser) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
-                                                     withString:event.executingUser];
-  }
-  if (config.machineID) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
-                                                     withString:config.machineID];
-  }
-  if (hostname.length) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%hostname%" withString:hostname];
-  }
-  if (uuid.length) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%uuid%" withString:uuid];
-  }
-  if (serial.length) {
-    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%serial%" withString:serial];
+  NSString *formatStr = url;
+  if (!formatStr.length) {
+    formatStr = config.eventDetailURL;
+    if (!formatStr.length) {
+      return nil;
+    }
   }
 
-  return [NSURL URLWithString:formatStr];
+  if ([formatStr isEqualToString:@"null"]) {
+    return nil;
+  }
+
+  formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:templateMapping];
+  NSURL *u = [NSURL URLWithString:formatStr];
+  if (!u) {
+    LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);
+  }
+
+  return u;
+}
+
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url {
+  return [self eventDetailURLForEvent:event
+                            customURL:url
+                      templateMapping:[self eventDetailTemplateMappingForEvent:event]];
+}
+
++ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url {
+  return [self eventDetailURLForEvent:event
+                            customURL:url
+                      templateMapping:[self fileAccessEventDetailTemplateMappingForEvent:event]];
 }
 
 @end

Source/common/SNTBlockMessageTest.m

@@ -0,0 +1,129 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <OCMock/OCMock.h>
+#import <XCTest/XCTest.h>
+
+#import "Source/common/SNTBlockMessage.h"
+#import "Source/common/SNTConfigurator.h"
+#include "Source/common/SNTFileAccessEvent.h"
+#include "Source/common/SNTStoredEvent.h"
+#import "Source/common/SNTSystemInfo.h"
+
+@interface SNTBlockMessageTest : XCTestCase
+@property id mockConfigurator;
+@property id mockSystemInfo;
+@end
+
+@implementation SNTBlockMessageTest
+
+- (void)setUp {
+  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
+  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
+  OCMStub([self.mockConfigurator machineID]).andReturn(@"my_mid");
+
+  self.mockSystemInfo = OCMClassMock([SNTSystemInfo class]);
+  OCMStub([self.mockSystemInfo longHostname]).andReturn(@"my_hn");
+  OCMStub([self.mockSystemInfo hardwareUUID]).andReturn(@"my_u");
+  OCMStub([self.mockSystemInfo serialNumber]).andReturn(@"my_s");
+}
+
+- (void)testFormatMessage {
+  NSString *input = @"Testing with somé Ünicode çharacters";
+  NSAttributedString *got = [SNTBlockMessage formatMessage:input];
+  XCTAssertEqualObjects([got string], input);
+}
+
+- (void)testEventDetailURLForEvent {
+  SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+
+  se.fileSHA256 = @"my_fi";
+  se.executingUser = @"my_un";
+  se.fileBundleID = @"s.n.t";
+  se.cdhash = @"abc";
+  se.teamID = @"SNT";
+  se.signingID = @"SNT:s.n.t";
+
+  NSString *url = @"http://"
+                  @"localhost?fs=%file_sha%&fi=%file_identifier%&bfi=%bundle_or_file_identifier%&"
+                  @"fbid=%file_bundle_id%&ti=%team_id%&si=%signing_id%&ch=%cdhash%&"
+                  @"un=%username%&mid=%machine_id%&hn=%hostname%&u=%uuid%&s=%serial%";
+  NSString *wantUrl = @"http://"
+                      @"localhost?fs=my_fi&fi=my_fi&bfi=my_fi&"
+                      @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
+                      @"un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
+
+  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
+
+  // Set fileBundleHash and test again for newly expected values
+  se.fileBundleHash = @"my_fbh";
+
+  wantUrl = @"http://"
+            @"localhost?fs=my_fbh&fi=my_fi&bfi=my_fbh&"
+            @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
+            @"un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
+
+  gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
+
+  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
+
+  XCTAssertNil([SNTBlockMessage eventDetailURLForEvent:se customURL:nil]);
+  XCTAssertNil([SNTBlockMessage eventDetailURLForEvent:se customURL:@"null"]);
+}
+
+- (void)testEventDetailURLForFileAccessEvent {
+  SNTFileAccessEvent *fae = [[SNTFileAccessEvent alloc] init];
+
+  fae.ruleVersion = @"my_rv";
+  fae.ruleName = @"my_rn";
+  fae.fileSHA256 = @"my_fi";
+  fae.fileBundleID = @"s.n.t";
+  fae.cdhash = @"abc";
+  fae.teamID = @"SNT";
+  fae.signingID = @"SNT:s.n.t";
+  fae.accessedPath = @"my_ap";
+  fae.executingUser = @"my_un";
+
+  NSString *url =
+    @"http://"
+    @"localhost?rv=%rule_version%&rn=%rule_name%&fi=%file_identifier%&"
+    @"fbid=%file_bundle_id%&ti=%team_id%&si=%signing_id%&ch=%cdhash%&"
+    @"ap=%accessed_path%&un=%username%&mid=%machine_id%&hn=%hostname%&u=%uuid%&s=%serial%";
+  NSString *wantUrl = @"http://"
+                      @"localhost?rv=my_rv&rn=my_rn&fi=my_fi&"
+                      @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
+                      @"ap=my_ap&un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
+
+  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:url];
+
+  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
+
+  XCTAssertNil([SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:nil]);
+  XCTAssertNil([SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:@"null"]);
+}
+
+- (void)testEventDetailURLMissingDetails {
+  SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+
+  se.fileSHA256 = @"my_fi";
+
+  NSString *url = @"http://localhost?fi=%file_identifier%";
+  NSString *wantUrl = @"http://localhost?fi=my_fi";
+
+  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
+
+  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
+}
+
+@end

Source/common/SNTCachedDecision.h

@@ -25,7 +25,9 @@
 ///
 @interface SNTCachedDecision : NSObject
 
+- (instancetype)init;
 - (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile;
+- (instancetype)initWithVnode:(SantaVnode)vnode NS_DESIGNATED_INITIALIZER;
 
 @property SantaVnode vnodeId;
 @property SNTEventState decision;
@@ -38,10 +40,14 @@
 @property NSArray<MOLCertificate *> *certChain;
 @property NSString *teamID;
 @property NSString *signingID;
+@property NSString *cdhash;
+@property NSDictionary *entitlements;
+@property BOOL entitlementsFiltered;
 
 @property NSString *quarantineURL;
 
 @property NSString *customMsg;
+@property NSString *customURL;
 @property BOOL silentBlock;
 
 @end

Source/common/SNTCachedDecision.mm

@@ -17,10 +17,18 @@
 
 @implementation SNTCachedDecision
 
+- (instancetype)init {
+  return [self initWithVnode:(SantaVnode){}];
+}
+
 - (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile {
+  return [self initWithVnode:SantaVnode::VnodeForFile(esFile)];
+}
+
+- (instancetype)initWithVnode:(SantaVnode)vnode {
   self = [super init];
   if (self) {
-    _vnodeId = SantaVnode::VnodeForFile(esFile);
+    _vnodeId = vnode;
   }
   return self;
 }

Source/common/SNTCommonEnums.h

@@ -46,6 +46,7 @@ typedef NS_ENUM(NSInteger, SNTAction) {
 typedef NS_ENUM(NSInteger, SNTRuleType) {
   SNTRuleTypeUnknown = 0,
 
+  SNTRuleTypeCDHash = 500,
   SNTRuleTypeBinary = 1000,
   SNTRuleTypeSigningID = 2000,
   SNTRuleTypeCertificate = 3000,
@@ -84,6 +85,7 @@ typedef NS_ENUM(uint64_t, SNTEventState) {
   SNTEventStateBlockTeamID = 1ULL << 20,
   SNTEventStateBlockLongPath = 1ULL << 21,
   SNTEventStateBlockSigningID = 1ULL << 22,
+  SNTEventStateBlockCDHash = 1ULL << 23,
 
   // Bits 40-63 store allow decision types
   SNTEventStateAllowUnknown = 1ULL << 40,
@@ -95,6 +97,7 @@ typedef NS_ENUM(uint64_t, SNTEventState) {
   SNTEventStateAllowPendingTransitive = 1ULL << 46,
   SNTEventStateAllowTeamID = 1ULL << 47,
   SNTEventStateAllowSigningID = 1ULL << 48,
+  SNTEventStateAllowCDHash = 1ULL << 49,
 
   // Block and Allow masks
   SNTEventStateBlock = 0xFFFFFFULL << 16,
@@ -152,7 +155,34 @@ typedef NS_ENUM(NSInteger, SNTMetricFormatType) {
   SNTMetricFormatTypeMonarchJSON,
 };
 
+typedef NS_ENUM(NSInteger, SNTOverrideFileAccessAction) {
+  SNTOverrideFileAccessActionNone,
+  SNTOverrideFileAccessActionAuditOnly,
+  SNTOverrideFileAccessActionDiable,
+};
+
+typedef NS_ENUM(NSInteger, SNTDeviceManagerStartupPreferences) {
+  SNTDeviceManagerStartupPreferencesNone,
+  SNTDeviceManagerStartupPreferencesUnmount,
+  SNTDeviceManagerStartupPreferencesForceUnmount,
+  SNTDeviceManagerStartupPreferencesRemount,
+  SNTDeviceManagerStartupPreferencesForceRemount,
+};
+
+typedef NS_ENUM(NSInteger, SNTSyncType) {
+  SNTSyncTypeNormal,
+  SNTSyncTypeClean,
+  SNTSyncTypeCleanAll,
+};
+
+typedef NS_ENUM(NSInteger, SNTRuleCleanup) {
+  SNTRuleCleanupNone,
+  SNTRuleCleanupAll,
+  SNTRuleCleanupNonTransitive,
+};
+
 #ifdef __cplusplus
+
 enum class FileAccessPolicyDecision {
   kNoPolicy,
   kDenied,
@@ -161,6 +191,19 @@ enum class FileAccessPolicyDecision {
   kAllowedReadAccess,
   kAllowedAuditOnly,
 };
+
+enum class StatChangeStep {
+  kNoChange = 0,
+  kMessageCreate,
+  kCodesignValidation,
+};
+
+enum class StatResult {
+  kOK = 0,
+  kStatError,
+  kDevnoInodeMismatch,
+};
+
 #endif
 
 static const char *kSantaDPath =

Source/common/SNTConfigurator.h

@@ -40,7 +40,8 @@
 ///
 ///  Enable Fail Close mode. Defaults to NO.
 ///  This controls Santa's behavior when a failure occurs, such as an
-///  inability to read a file. By default, to prevent bugs or misconfiguration
+///  inability to read a file and as a default response when deadlines
+///  are about to expire. By default, to prevent bugs or misconfiguration
 ///  from rendering a machine inoperable Santa will fail open and allow
 ///  execution. With this setting enabled, Santa will fail closed if the client
 ///  is in LOCKDOWN mode, offering a higher level of security but with a higher
@@ -262,6 +263,16 @@
 ///
 @property(readonly, nonatomic) NSString *fileAccessPolicyPlist;
 
+///
+///  This is the message shown to the user when access to a file is blocked
+///  by a binary due to some rule in the current File Access policy if that rule
+///  doesn't provide a custom message. If this is not configured, a reasonable
+///  default is provided.
+///
+///  @note: This property is KVO compliant.
+///
+@property(readonly, nonatomic) NSString *fileAccessBlockMessage;
+
 ///
 ///  If fileAccessPolicyPlist is set, fileAccessPolicyUpdateIntervalSec
 ///  sets the number of seconds between times that the configuration file is
@@ -274,7 +285,7 @@
 
 ///
 /// Enabling this appends the Santa machine ID to the end of each log line. If nothing
-/// has been overriden, this is the host's UUID.
+/// has been overridden, this is the host's UUID.
 /// Defaults to NO.
 ///
 @property(readonly, nonatomic) BOOL enableMachineIDDecoration;
@@ -336,6 +347,11 @@
 ///
 @property(readonly, nonatomic) NSString *eventDetailText;
 
+///
+///  This string represents the text to show on the "Dismiss" button in the UI instead of "Dismiss".
+///
+@property(readonly, nonatomic) NSString *dismissText;
+
 ///
 ///  In lockdown mode this is the message shown to the user when an unknown binary
 ///  is blocked. If this message is not configured, a reasonable default is provided.
@@ -382,14 +398,41 @@
 ///
 @property(readonly, nonatomic) NSURL *syncBaseURL;
 
+///
+///  If enabled, syncing will use binary protobufs for transfer instead
+///  of JSON. Defaults to NO.
+///
+@property(readonly, nonatomic) BOOL syncEnableProtoTransfer;
+
 ///
 ///  Proxy settings for syncing.
 ///  This dictionary is passed directly to NSURLSession. The allowed keys
 ///  are loosely documented at
-///  https://developer.apple.com/documentation/cfnetwork/global_proxy_settings_constants.
+///  https://developer.apple.com/documentation/cfnetwork/global-proxy-settings-constants.
 ///
 @property(readonly, nonatomic) NSDictionary *syncProxyConfig;
 
+///
+///  Extra headers to include in all requests made during syncing.
+///  Keys and values must all be strings, any other type will be silently ignored.
+///  Some headers cannot be set through this key, including:
+///
+///    * Content-Encoding
+///    * Content-Length
+///    * Content-Type
+///    * Connection
+///    * Host
+///    * Proxy-Authenticate
+///    * Proxy-Authorization
+///    * WWW-Authenticate
+///
+///  The header "Authorization" is also documented by Apple to be one that will
+///  be ignored but this is not really the case, at least at present. If you
+///  are able to use a different header for this that would be safest but if not
+///  using Authorization /should/ be fine.
+///
+@property(readonly, nonatomic) NSDictionary *syncExtraHeaders;
+
 ///
 ///  The machine owner.
 ///
@@ -406,9 +449,9 @@
 @property(nonatomic) NSDate *ruleSyncLastSuccess;
 
 ///
-///  If YES a clean sync is required.
+///  Type of sync required (e.g. normal, clean, etc.).
 ///
-@property(nonatomic) BOOL syncCleanRequired;
+@property(nonatomic) SNTSyncType syncTypeRequired;
 
 #pragma mark - USB Settings
 
@@ -418,11 +461,44 @@
 @property(nonatomic) BOOL blockUSBMount;
 
 ///
-/// Comma-seperated `$ mount -o` arguments used for forced remounting of USB devices. Default
+/// Comma-separated `$ mount -o` arguments used for forced remounting of USB devices. Default
 /// to fully allow/deny without remounting if unset.
 ///
 @property(nonatomic) NSArray<NSString *> *remountUSBMode;
 
+///
+/// If set, defines the action that should be taken on existing USB mounts when
+/// Santa starts up.
+///
+/// Supported values are:
+///   * "Unmount": Unmount mass storage devices
+///   * "ForceUnmount": Force unmount mass storage devices
+///
+///
+/// Note: Existing mounts with mount flags that are a superset of RemountUSBMode
+/// are unaffected and left mounted.
+///
+@property(readonly, nonatomic) SNTDeviceManagerStartupPreferences onStartUSBOptions;
+
+///
+/// If set, will override the action taken when a file access rule violation
+/// occurs. This setting will apply across all rules in the file access policy.
+///
+/// Possible values are
+///   * "AuditOnly": When a rule is violated, it will be logged, but the access
+///     will not be blocked
+///   * "Disable": No access will be logged or blocked.
+///
+/// If not set, no override will take place and the file acces spolicy will
+/// apply as configured.
+///
+@property(readonly, nonatomic) SNTOverrideFileAccessAction overrideFileAccessAction;
+
+///
+///  Set the action that will override file access policy config action
+///
+- (void)setSyncServerOverrideFileAccessAction:(NSString *)action;
+
 ///
 ///  If set, this over-rides the default machine ID used for syncing.
 ///
@@ -578,6 +654,24 @@
 ///
 @property(readonly, nonatomic) NSUInteger metricExportTimeout;
 
+///
+/// List of prefix strings for which individual entitlement keys with a matching
+/// prefix should not be logged.
+///
+@property(readonly, nonatomic) NSArray<NSString *> *entitlementsPrefixFilter;
+
+///
+/// List of TeamIDs for which entitlements should not be logged. Use the string
+/// "platform" to refer to platform binaries.
+///
+@property(readonly, nonatomic) NSArray<NSString *> *entitlementsTeamIDFilter;
+
+///
+/// List of enabled process annotations.
+/// This property is not KVO compliant.
+///
+@property(readonly, nonatomic) NSArray<NSString *> *enabledProcessAnnotations;
+
 ///
 ///  Retrieve an initialized singleton configurator object using the default file path.
 ///

Source/common/SNTConfigurator.m

@@ -13,7 +13,6 @@
 ///    limitations under the License.
 
 #import "Source/common/SNTConfigurator.h"
-#import "Source/common/SNTCommonEnums.h"
 
 #include <sys/stat.h>
 
@@ -21,6 +20,21 @@
 #import "Source/common/SNTStrengthify.h"
 #import "Source/common/SNTSystemInfo.h"
 
+// Ensures the given object is an NSArray and only contains NSString value types
+static NSArray<NSString *> *EnsureArrayOfStrings(id obj) {
+  if (![obj isKindOfClass:[NSArray class]]) {
+    return nil;
+  }
+
+  for (id item in obj) {
+    if (![item isKindOfClass:[NSString class]]) {
+      return nil;
+    }
+  }
+
+  return obj;
+}
+
 @interface SNTConfigurator ()
 /// A NSUserDefaults object set to use the com.google.santa suite.
 @property(readonly, nonatomic) NSUserDefaults *defaults;
@@ -39,6 +53,9 @@
 /// Holds the last processed hash of the static rules list.
 @property(atomic) NSDictionary *cachedStaticRules;
 
+@property(readonly, nonatomic) NSString *syncStateFilePath;
+@property(nonatomic, copy) BOOL (^syncStateAccessAuthorizerBlock)();
+
 @end
 
 @implementation SNTConfigurator
@@ -56,7 +73,9 @@ static NSString *const kMobileConfigDomain = @"com.google.santa";
 /// The keys managed by a mobileconfig.
 static NSString *const kStaticRules = @"StaticRules";
 static NSString *const kSyncBaseURLKey = @"SyncBaseURL";
+static NSString *const kSyncEnableProtoTransfer = @"SyncEnableProtoTransfer";
 static NSString *const kSyncProxyConfigKey = @"SyncProxyConfiguration";
+static NSString *const kSyncExtraHeadersKey = @"SyncExtraHeaders";
 static NSString *const kSyncEnableCleanSyncEventUpload = @"SyncEnableCleanSyncEventUpload";
 static NSString *const kClientAuthCertificateFileKey = @"ClientAuthCertificateFile";
 static NSString *const kClientAuthCertificatePasswordKey = @"ClientAuthCertificatePassword";
@@ -78,6 +97,7 @@ static NSString *const kAboutTextKey = @"AboutText";
 static NSString *const kMoreInfoURLKey = @"MoreInfoURL";
 static NSString *const kEventDetailURLKey = @"EventDetailURL";
 static NSString *const kEventDetailTextKey = @"EventDetailText";
+static NSString *const kDismissTextKey = @"DismissText";
 static NSString *const kUnknownBlockMessage = @"UnknownBlockMessage";
 static NSString *const kBannedBlockMessage = @"BannedBlockMessage";
 static NSString *const kBannedUSBBlockMessage = @"BannedUSBBlockMessage";
@@ -88,6 +108,8 @@ static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";
 
 static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection";
 static NSString *const kEnableBadSignatureProtectionKey = @"EnableBadSignatureProtection";
+static NSString *const kFailClosedKey = @"FailClosed";
+static NSString *const kDisableUnknownEventUploadKey = @"DisableUnknownEventUpload";
 
 static NSString *const kFileChangesRegexKey = @"FileChangesRegex";
 static NSString *const kFileChangesPrefixFiltersKey = @"FileChangesPrefixFilters";
@@ -101,6 +123,7 @@ static NSString *const kSpoolDirectoryEventMaxFlushTimeSec = @"SpoolDirectoryEve
 
 static NSString *const kFileAccessPolicy = @"FileAccessPolicy";
 static NSString *const kFileAccessPolicyPlist = @"FileAccessPolicyPlist";
+static NSString *const kFileAccessBlockMessage = @"FileAccessBlockMessage";
 static NSString *const kFileAccessPolicyUpdateIntervalSec = @"FileAccessPolicyUpdateIntervalSec";
 
 static NSString *const kEnableMachineIDDecoration = @"EnableMachineIDDecoration";
@@ -115,9 +138,21 @@ static NSString *const kFCMProject = @"FCMProject";
 static NSString *const kFCMEntity = @"FCMEntity";
 static NSString *const kFCMAPIKey = @"FCMAPIKey";
 
+static NSString *const kEntitlementsPrefixFilterKey = @"EntitlementsPrefixFilter";
+static NSString *const kEntitlementsTeamIDFilterKey = @"EntitlementsTeamIDFilter";
+
+static NSString *const kOnStartUSBOptions = @"OnStartUSBOptions";
+
+static NSString *const kMetricFormat = @"MetricFormat";
+static NSString *const kMetricURL = @"MetricURL";
+static NSString *const kMetricExportInterval = @"MetricExportInterval";
+static NSString *const kMetricExportTimeout = @"MetricExportTimeout";
+static NSString *const kMetricExtraLabels = @"MetricExtraLabels";
+
+static NSString *const kEnabledProcessAnnotations = @"EnabledProcessAnnotations";
+
 // The keys managed by a sync server or mobileconfig.
 static NSString *const kClientModeKey = @"ClientMode";
-static NSString *const kFailClosedKey = @"FailClosed";
 static NSString *const kBlockUSBMountKey = @"BlockUSBMount";
 static NSString *const kRemountUSBModeKey = @"RemountUSBMode";
 static NSString *const kEnableTransitiveRulesKey = @"EnableTransitiveRules";
@@ -127,20 +162,24 @@ static NSString *const kAllowedPathRegexKeyDeprecated = @"WhitelistRegex";
 static NSString *const kBlockedPathRegexKey = @"BlockedPathRegex";
 static NSString *const kBlockedPathRegexKeyDeprecated = @"BlacklistRegex";
 static NSString *const kEnableAllEventUploadKey = @"EnableAllEventUpload";
-static NSString *const kDisableUnknownEventUploadKey = @"DisableUnknownEventUpload";
-
-static NSString *const kMetricFormat = @"MetricFormat";
-static NSString *const kMetricURL = @"MetricURL";
-static NSString *const kMetricExportInterval = @"MetricExportInterval";
-static NSString *const kMetricExportTimeout = @"MetricExportTimeout";
-static NSString *const kMetricExtraLabels = @"MetricExtraLabels";
+static NSString *const kOverrideFileAccessActionKey = @"OverrideFileAccessAction";
 
 // The keys managed by a sync server.
 static NSString *const kFullSyncLastSuccess = @"FullSyncLastSuccess";
 static NSString *const kRuleSyncLastSuccess = @"RuleSyncLastSuccess";
-static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
+static NSString *const kSyncCleanRequiredDeprecated = @"SyncCleanRequired";
+static NSString *const kSyncTypeRequired = @"SyncTypeRequired";
 
 - (instancetype)init {
+  return [self initWithSyncStateFile:kSyncStateFilePath
+           syncStateAccessAuthorizer:^BOOL() {
+             // Only access the sync state if a sync server is configured and running as root
+             return self.syncBaseURL != nil && geteuid() == 0;
+           }];
+}
+
+- (instancetype)initWithSyncStateFile:(NSString *)syncStateFilePath
+            syncStateAccessAuthorizer:(BOOL (^)(void))syncStateAccessAuthorizer {
   self = [super init];
   if (self) {
     Class number = [NSNumber class];
@@ -162,8 +201,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kRemountUSBModeKey : array,
       kFullSyncLastSuccess : date,
       kRuleSyncLastSuccess : date,
-      kSyncCleanRequired : number,
+      kSyncCleanRequiredDeprecated : number,
+      kSyncTypeRequired : number,
       kEnableAllEventUploadKey : number,
+      kOverrideFileAccessActionKey : string,
     };
     _forcedConfigKeyTypes = @{
       kClientModeKey : number,
@@ -178,6 +219,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kBlockedPathRegexKeyDeprecated : re,
       kBlockUSBMountKey : number,
       kRemountUSBModeKey : array,
+      kOnStartUSBOptions : string,
       kEnablePageZeroProtectionKey : number,
       kEnableBadSignatureProtectionKey : number,
       kEnableSilentModeKey : number,
@@ -186,6 +228,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kMoreInfoURLKey : string,
       kEventDetailURLKey : string,
       kEventDetailTextKey : string,
+      kDismissTextKey : string,
       kUnknownBlockMessage : string,
       kBannedBlockMessage : string,
       kBannedUSBBlockMessage : string,
@@ -194,8 +237,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kModeNotificationLockdown : string,
       kStaticRules : array,
       kSyncBaseURLKey : string,
+      kSyncEnableProtoTransfer : number,
       kSyncEnableCleanSyncEventUpload : number,
       kSyncProxyConfigKey : dictionary,
+      kSyncExtraHeadersKey : dictionary,
       kClientAuthCertificateFileKey : string,
       kClientAuthCertificatePasswordKey : string,
       kClientAuthCertificateCNKey : string,
@@ -217,6 +262,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kSpoolDirectoryEventMaxFlushTimeSec : number,
       kFileAccessPolicy : dictionary,
       kFileAccessPolicyPlist : string,
+      kFileAccessBlockMessage : string,
       kFileAccessPolicyUpdateIntervalSec : number,
       kEnableMachineIDDecoration : number,
       kEnableForkAndExitLogging : number,
@@ -232,12 +278,26 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       kMetricExtraLabels : dictionary,
       kEnableAllEventUploadKey : number,
       kDisableUnknownEventUploadKey : number,
+      kOverrideFileAccessActionKey : string,
+      kEntitlementsPrefixFilterKey : array,
+      kEntitlementsTeamIDFilterKey : array,
+      kEnabledProcessAnnotations : array,
     };
+
+    _syncStateFilePath = syncStateFilePath;
+    _syncStateAccessAuthorizerBlock = syncStateAccessAuthorizer;
+
     _defaults = [NSUserDefaults standardUserDefaults];
     [_defaults addSuiteNamed:@"com.google.santa"];
     _configState = [self readForcedConfig];
     [self cacheStaticRules];
+
     _syncState = [self readSyncStateFromDisk] ?: [NSMutableDictionary dictionary];
+    if ([self migrateDeprecatedSyncStateKeys]) {
+      // Save the updated sync state if any keys were migrated.
+      [self saveSyncStateToDisk];
+    }
+
     _debugFlag = [[NSProcessInfo processInfo].arguments containsObject:@"--debug"];
     [self startWatchingDefaults];
   }
@@ -308,13 +368,26 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 }
 
 + (NSSet *)keyPathsForValuesAffectingStaticRules {
-  return [self configStateSet];
+  static NSSet *set;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    set = [NSSet setWithObject:NSStringFromSelector(@selector(cachedStaticRules))];
+  });
+  return set;
 }
 
 + (NSSet *)keyPathsForValuesAffectingSyncBaseURL {
   return [self configStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingSyncEnableProtoTransfer {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingSyncExtraHeaders {
+  return [self configStateSet];
+}
+
 + (NSSet *)keyPathsForValuesAffectingEnableCleanSyncEventUpload {
   return [self configStateSet];
 }
@@ -343,6 +416,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingDismissText {
+  return [self configStateSet];
+}
+
 + (NSSet *)keyPathsForValuesAffectingUnknownBlockMessage {
   return [self configStateSet];
 }
@@ -399,7 +476,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self syncStateSet];
 }
 
-+ (NSSet *)keyPathsForValuesAffectingSyncCleanRequired {
++ (NSSet *)keyPathsForValuesAffectingSyncTypeRequired {
   return [self syncStateSet];
 }
 
@@ -435,6 +512,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingFileAccessBlockMessage {
+  return [self configStateSet];
+}
+
 + (NSSet *)keyPathsForValuesAffectingFileAccessPolicyUpdateIntervalSec {
   return [self configStateSet];
 }
@@ -507,6 +588,18 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self configStateSet];
 }
 
++ (NSSet *)keyPathsForValuesAffectingOverrideFileAccessActionKey {
+  return [self syncAndConfigStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEntitlementsPrefixFilter {
+  return [self configStateSet];
+}
+
++ (NSSet *)keyPathsForValuesAffectingEntitlementsTeamIDFilter {
+  return [self configStateSet];
+}
+
 #pragma mark Public Interface
 
 - (SNTClientMode)clientMode {
@@ -531,8 +624,7 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 
 - (BOOL)failClosed {
   NSNumber *n = self.configState[kFailClosedKey];
-  if (n) return [n boolValue];
-  return NO;
+  return [n boolValue] && self.clientMode == SNTClientModeLockdown;
 }
 
 - (BOOL)enableTransitiveRules {
@@ -617,6 +709,22 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return args;
 }
 
+- (SNTDeviceManagerStartupPreferences)onStartUSBOptions {
+  NSString *action = [self.configState[kOnStartUSBOptions] lowercaseString];
+
+  if ([action isEqualToString:@"unmount"]) {
+    return SNTDeviceManagerStartupPreferencesUnmount;
+  } else if ([action isEqualToString:@"forceunmount"]) {
+    return SNTDeviceManagerStartupPreferencesForceUnmount;
+  } else if ([action isEqualToString:@"remount"]) {
+    return SNTDeviceManagerStartupPreferencesRemount;
+  } else if ([action isEqualToString:@"forceremount"]) {
+    return SNTDeviceManagerStartupPreferencesForceRemount;
+  } else {
+    return SNTDeviceManagerStartupPreferencesNone;
+  }
+}
+
 - (NSDictionary<NSString *, SNTRule *> *)staticRules {
   return self.cachedStaticRules;
 }
@@ -628,10 +736,19 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return url;
 }
 
+- (BOOL)syncEnableProtoTransfer {
+  NSNumber *number = self.configState[kSyncEnableProtoTransfer];
+  return number ? [number boolValue] : NO;
+}
+
 - (NSDictionary *)syncProxyConfig {
   return self.configState[kSyncProxyConfigKey];
 }
 
+- (NSDictionary *)syncExtraHeaders {
+  return self.configState[kSyncExtraHeadersKey];
+}
+
 - (BOOL)enablePageZeroProtection {
   NSNumber *number = self.configState[kEnablePageZeroProtectionKey];
   return number ? [number boolValue] : YES;
@@ -668,6 +785,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return self.configState[kEventDetailTextKey];
 }
 
+- (NSString *)dismissText {
+  return self.configState[kDismissTextKey];
+}
+
 - (NSString *)unknownBlockMessage {
   return self.configState[kUnknownBlockMessage];
 }
@@ -754,12 +875,12 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   [self updateSyncStateForKey:kRuleSyncLastSuccess value:ruleSyncLastSuccess];
 }
 
-- (BOOL)syncCleanRequired {
-  return [self.syncState[kSyncCleanRequired] boolValue];
+- (SNTSyncType)syncTypeRequired {
+  return (SNTSyncType)[self.syncState[kSyncTypeRequired] integerValue];
 }
 
-- (void)setSyncCleanRequired:(BOOL)syncCleanRequired {
-  [self updateSyncStateForKey:kSyncCleanRequired value:@(syncCleanRequired)];
+- (void)setSyncTypeRequired:(SNTSyncType)syncTypeRequired {
+  [self updateSyncStateForKey:kSyncTypeRequired value:@(syncTypeRequired)];
 }
 
 - (NSString *)machineOwner {
@@ -851,6 +972,10 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   }
 }
 
+- (NSString *)fileAccessBlockMessage {
+  return self.configState[kFileAccessBlockMessage];
+}
+
 - (uint32_t)fileAccessPolicyUpdateIntervalSec {
   return self.configState[kFileAccessPolicyUpdateIntervalSec]
            ? [self.configState[kFileAccessPolicyUpdateIntervalSec] unsignedIntValue]
@@ -931,6 +1056,34 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [self.configState[kBlockUSBMountKey] boolValue];
 }
 
+- (void)setSyncServerOverrideFileAccessAction:(NSString *)action {
+  NSString *a = [action lowercaseString];
+  if ([a isEqualToString:@"auditonly"] || [a isEqualToString:@"disable"] ||
+      [a isEqualToString:@"none"] || [a isEqualToString:@""]) {
+    [self updateSyncStateForKey:kOverrideFileAccessActionKey value:action];
+  }
+}
+
+- (SNTOverrideFileAccessAction)overrideFileAccessAction {
+  NSString *action = [self.syncState[kOverrideFileAccessActionKey] lowercaseString];
+
+  if (!action) {
+    action = [self.configState[kOverrideFileAccessActionKey] lowercaseString];
+    if (!action) {
+      return SNTOverrideFileAccessActionNone;
+    }
+  }
+
+  // Note: `auditonly` without an underscore is a deprecated, but still accepted form.
+  if ([action isEqualToString:@"audit_only"] || [action isEqualToString:@"auditonly"]) {
+    return SNTOverrideFileAccessActionAuditOnly;
+  } else if ([action isEqualToString:@"disable"]) {
+    return SNTOverrideFileAccessActionDiable;
+  } else {
+    return SNTOverrideFileAccessActionNone;
+  }
+}
+
 ///
 /// Returns YES if all of the necessary options are set to export metrics, NO
 /// otherwise.
@@ -982,6 +1135,16 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return self.configState[kMetricExtraLabels];
 }
 
+- (NSArray<NSString *> *)enabledProcessAnnotations {
+  NSArray<NSString *> *annotations = self.configState[kEnabledProcessAnnotations];
+  for (id annotation in annotations) {
+    if (![annotation isKindOfClass:[NSString class]]) {
+      return nil;
+    }
+  }
+  return annotations;
+}
+
 #pragma mark Private
 
 ///
@@ -1000,12 +1163,12 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
 ///  Read the saved syncState.
 ///
 - (NSMutableDictionary *)readSyncStateFromDisk {
-  // Only read the sync state if a sync server is configured.
-  if (!self.syncBaseURL) return nil;
-  // Only santad should read this file.
-  if (geteuid() != 0) return nil;
+  if (!self.syncStateAccessAuthorizerBlock()) {
+    return nil;
+  }
+
   NSMutableDictionary *syncState =
-    [NSMutableDictionary dictionaryWithContentsOfFile:kSyncStateFilePath];
+    [NSMutableDictionary dictionaryWithContentsOfFile:self.syncStateFilePath];
   for (NSString *key in syncState.allKeys) {
     if (self.syncServerKeyTypes[key] == [NSRegularExpression class]) {
       NSString *pattern = [syncState[key] isKindOfClass:[NSString class]] ? syncState[key] : nil;
@@ -1015,24 +1178,54 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       continue;
     }
   }
+
   return syncState;
 }
 
+///
+///  Migrate any deprecated sync state keys/values to alternative keys/values.
+///
+///  Returns YES if any keys were migrated. Otherwise NO.
+///
+- (BOOL)migrateDeprecatedSyncStateKeys {
+  // Currently only one key to migrate
+  if (!self.syncState[kSyncCleanRequiredDeprecated]) {
+    return NO;
+  }
+
+  NSMutableDictionary *syncState = self.syncState.mutableCopy;
+
+  // If the kSyncTypeRequired key exists, its current value will take precedence.
+  // Otherwise, migrate the old value to be compatible with the new logic.
+  if (!self.syncState[kSyncTypeRequired]) {
+    syncState[kSyncTypeRequired] = [self.syncState[kSyncCleanRequiredDeprecated] boolValue]
+                                     ? @(SNTSyncTypeClean)
+                                     : @(SNTSyncTypeNormal);
+  }
+
+  // Delete the deprecated key
+  syncState[kSyncCleanRequiredDeprecated] = nil;
+
+  self.syncState = syncState;
+
+  return YES;
+}
+
 ///
 ///  Saves the current effective syncState to disk.
 ///
 - (void)saveSyncStateToDisk {
-  // Only save the sync state if a sync server is configured.
-  if (!self.syncBaseURL) return;
-  // Only santad should write to this file.
-  if (geteuid() != 0) return;
+  if (!self.syncStateAccessAuthorizerBlock()) {
+    return;
+  }
+
   // Either remove
   NSMutableDictionary *syncState = self.syncState.mutableCopy;
   syncState[kAllowedPathRegexKey] = [syncState[kAllowedPathRegexKey] pattern];
   syncState[kBlockedPathRegexKey] = [syncState[kBlockedPathRegexKey] pattern];
-  [syncState writeToFile:kSyncStateFilePath atomically:YES];
+  [syncState writeToFile:self.syncStateFilePath atomically:YES];
   [[NSFileManager defaultManager] setAttributes:@{NSFilePosixPermissions : @0600}
-                                   ofItemAtPath:kSyncStateFilePath
+                                   ofItemAtPath:self.syncStateFilePath
                                           error:NULL];
 }
 
@@ -1040,6 +1233,14 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   self.syncState = [NSMutableDictionary dictionary];
 }
 
+- (NSArray *)entitlementsPrefixFilter {
+  return EnsureArrayOfStrings(self.configState[kEntitlementsPrefixFilterKey]);
+}
+
+- (NSArray *)entitlementsTeamIDFilter {
+  return EnsureArrayOfStrings(self.configState[kEntitlementsTeamIDFilterKey]);
+}
+
 #pragma mark Private Defaults Methods
 
 - (NSRegularExpression *)expressionForPattern:(NSString *)pattern {
@@ -1048,6 +1249,39 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
   return [NSRegularExpression regularExpressionWithPattern:pattern options:0 error:NULL];
 }
 
+- (void)applyOverrides:(NSMutableDictionary *)forcedConfig {
+  // Overrides should only be applied under debug builds.
+#ifdef DEBUG
+  if ([[[NSProcessInfo processInfo] processName] isEqualToString:@"xctest"] &&
+      ![[[NSProcessInfo processInfo] environment] objectForKey:@"ENABLE_CONFIG_OVERRIDES"]) {
+    // By default, config overrides are not applied when running tests to help
+    // mitigate potential issues due to unexpected config values. This behavior
+    // can be overriden if desired by using the env variable: `ENABLE_CONFIG_OVERRIDES`.
+    //
+    // E.g.:
+    //   bazel test --test_env=ENABLE_CONFIG_OVERRIDES=1 ...other test args...
+    return;
+  }
+
+  NSDictionary *overrides = [NSDictionary dictionaryWithContentsOfFile:kConfigOverrideFilePath];
+  for (NSString *key in overrides) {
+    id obj = overrides[key];
+    if (![obj isKindOfClass:self.forcedConfigKeyTypes[key]] ||
+        ([self.forcedConfigKeyTypes[key] isKindOfClass:[NSRegularExpression class]] &&
+         ![obj isKindOfClass:[NSString class]])) {
+      continue;
+    }
+
+    forcedConfig[key] = obj;
+
+    if (self.forcedConfigKeyTypes[key] == [NSRegularExpression class]) {
+      NSString *pattern = [obj isKindOfClass:[NSString class]] ? obj : nil;
+      forcedConfig[key] = [self expressionForPattern:pattern];
+    }
+  }
+#endif
+}
+
 - (NSMutableDictionary *)readForcedConfig {
   NSMutableDictionary *forcedConfig = [NSMutableDictionary dictionary];
   for (NSString *key in self.forcedConfigKeyTypes) {
@@ -1059,18 +1293,9 @@ static NSString *const kSyncCleanRequired = @"SyncCleanRequired";
       forcedConfig[key] = [self expressionForPattern:pattern];
     }
   }
-#ifdef DEBUG
-  NSDictionary *overrides = [NSDictionary dictionaryWithContentsOfFile:kConfigOverrideFilePath];
-  for (NSString *key in overrides) {
-    id obj = overrides[key];
-    if (![obj isKindOfClass:self.forcedConfigKeyTypes[key]]) continue;
-    forcedConfig[key] = obj;
-    if (self.forcedConfigKeyTypes[key] == [NSRegularExpression class]) {
-      NSString *pattern = [obj isKindOfClass:[NSString class]] ? obj : nil;
-      forcedConfig[key] = [self expressionForPattern:pattern];
-    }
-  }
-#endif
+
+  [self applyOverrides:forcedConfig];
+
   return forcedConfig;
 }
 

Source/common/SNTConfiguratorTest.m

@@ -0,0 +1,102 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+#import <XCTest/XCTest.h>
+
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTConfigurator.h"
+
+@interface SNTConfigurator (Testing)
+- (instancetype)initWithSyncStateFile:(NSString *)syncStateFilePath
+            syncStateAccessAuthorizer:(BOOL (^)(void))syncStateAccessAuthorizer;
+
+@property NSDictionary *syncState;
+@end
+
+@interface SNTConfiguratorTest : XCTestCase
+@property NSFileManager *fileMgr;
+@property NSString *testDir;
+@end
+
+@implementation SNTConfiguratorTest
+
+- (void)setUp {
+  self.fileMgr = [NSFileManager defaultManager];
+  self.testDir =
+    [NSString stringWithFormat:@"%@santa-configurator-%d", NSTemporaryDirectory(), getpid()];
+
+  XCTAssertTrue([self.fileMgr createDirectoryAtPath:self.testDir
+                        withIntermediateDirectories:YES
+                                         attributes:nil
+                                              error:nil]);
+}
+
+- (void)tearDown {
+  XCTAssertTrue([self.fileMgr removeItemAtPath:self.testDir error:nil]);
+}
+
+- (void)runMigrationTestsWithSyncState:(NSDictionary *)syncStatePlist
+                              verifier:(void (^)(SNTConfigurator *))verifierBlock {
+  NSString *syncStatePlistPath =
+    [NSString stringWithFormat:@"%@/test-sync-state.plist", self.testDir];
+
+  XCTAssertTrue([syncStatePlist writeToFile:syncStatePlistPath atomically:YES]);
+
+  SNTConfigurator *cfg = [[SNTConfigurator alloc] initWithSyncStateFile:syncStatePlistPath
+                                              syncStateAccessAuthorizer:^{
+                                                // Allow all access to the test plist
+                                                return YES;
+                                              }];
+
+  NSLog(@"sync state: %@", cfg.syncState);
+
+  verifierBlock(cfg);
+
+  XCTAssertTrue([self.fileMgr removeItemAtPath:syncStatePlistPath error:nil]);
+}
+
+- (void)testInitMigratesSyncStateKeys {
+  // SyncCleanRequired = YES
+  [self runMigrationTestsWithSyncState:@{@"SyncCleanRequired" : [NSNumber numberWithBool:YES]}
+                              verifier:^(SNTConfigurator *cfg) {
+                                XCTAssertEqual(cfg.syncState.count, 1);
+                                XCTAssertNil(cfg.syncState[@"SyncCleanRequired"]);
+                                XCTAssertNotNil(cfg.syncState[@"SyncTypeRequired"]);
+                                XCTAssertEqual([cfg.syncState[@"SyncTypeRequired"] integerValue],
+                                               SNTSyncTypeClean);
+                                XCTAssertEqual(cfg.syncState.count, 1);
+                              }];
+
+  // SyncCleanRequired = NO
+  [self runMigrationTestsWithSyncState:@{@"SyncCleanRequired" : [NSNumber numberWithBool:NO]}
+                              verifier:^(SNTConfigurator *cfg) {
+                                XCTAssertEqual(cfg.syncState.count, 1);
+                                XCTAssertNil(cfg.syncState[@"SyncCleanRequired"]);
+                                XCTAssertNotNil(cfg.syncState[@"SyncTypeRequired"]);
+                                XCTAssertEqual([cfg.syncState[@"SyncTypeRequired"] integerValue],
+                                               SNTSyncTypeNormal);
+                                XCTAssertEqual(cfg.syncState.count, 1);
+                              }];
+
+  // Empty state
+  [self runMigrationTestsWithSyncState:@{}
+                              verifier:^(SNTConfigurator *cfg) {
+                                XCTAssertEqual(cfg.syncState.count, 0);
+                                XCTAssertNil(cfg.syncState[@"SyncCleanRequired"]);
+                                XCTAssertNil(cfg.syncState[@"SyncTypeRequired"]);
+                              }];
+}
+
+@end

Source/common/SNTDeepCopy.h

@@ -0,0 +1,27 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+@interface NSArray (SNTDeepCopy)
+
+- (instancetype)sntDeepCopy;
+
+@end
+
+@interface NSDictionary (SNTDeepCopy)
+
+- (instancetype)sntDeepCopy;
+
+@end

Source/common/SNTDeepCopy.m

@@ -0,0 +1,53 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/SNTDeepCopy.h"
+
+@implementation NSArray (SNTDeepCopy)
+
+- (instancetype)sntDeepCopy {
+  NSMutableArray<__kindof NSObject *> *deepCopy = [NSMutableArray arrayWithCapacity:self.count];
+  for (id object in self) {
+    if ([object respondsToSelector:@selector(sntDeepCopy)]) {
+      [deepCopy addObject:[object sntDeepCopy]];
+    } else if ([object respondsToSelector:@selector(copyWithZone:)]) {
+      [deepCopy addObject:[object copy]];
+    } else {
+      [deepCopy addObject:object];
+    }
+  }
+  return deepCopy;
+}
+
+@end
+
+@implementation NSDictionary (SNTDeepCopy)
+
+- (instancetype)sntDeepCopy {
+  NSMutableDictionary<__kindof NSObject *, __kindof NSObject *> *deepCopy =
+    [NSMutableDictionary dictionary];
+  for (id key in self) {
+    id value = self[key];
+    if ([value respondsToSelector:@selector(sntDeepCopy)]) {
+      deepCopy[key] = [value sntDeepCopy];
+    } else if ([value respondsToSelector:@selector(copyWithZone:)]) {
+      deepCopy[key] = [value copy];
+    } else {
+      deepCopy[key] = value;
+    }
+  }
+  return deepCopy;
+}
+
+@end

Source/common/SNTFileAccessEvent.h

@@ -14,12 +14,12 @@
 
 #import <Foundation/Foundation.h>
 
-#import <MOLCertificate/MOLCertificate.h>
+#import "Source/common/SNTStoredEvent.h"
 
 ///
 ///  Represents an event stored in the database.
 ///
-@interface SNTFileAccessEvent : NSObject <NSSecureCoding>
+@interface SNTFileAccessEvent : SNTStoredEvent <NSSecureCoding>
 
 ///
 /// The watched path that was accessed
@@ -32,52 +32,22 @@
 @property NSString *ruleVersion;
 @property NSString *ruleName;
 
-///
-/// The SHA256 of the process that accessed the path
-///
-@property NSString *fileSHA256;
-
-///
-/// The path of the process that accessed the watched path
-///
-@property NSString *filePath;
-
 ///
 /// If the process is part of a bundle, the name of the application
 ///
 @property NSString *application;
 
 ///
-/// If the executed file was signed, this is the Team ID if present in the signature information.
+/// A string representing the publisher based on the signingChain
 ///
-@property NSString *teamID;
+@property(readonly) NSString *publisherInfo;
 
 ///
-/// If the executed file was signed, this is the Signing ID if present in the signature information.
+/// Return an array of the underlying SecCertificateRef's of the signingChain
 ///
-@property NSString *signingID;
-
+/// WARNING: If the refs need to be used for a long time be careful to properly
+/// CFRetain/CFRelease the returned items.
 ///
-///  The user who executed the binary.
-///
-@property NSString *executingUser;
-
-///
-///  The process ID of the binary being executed.
-///
-@property NSNumber *pid;
-
-///
-///  The parent process ID of the binary being executed.
-///
-@property NSNumber *ppid;
-
-///
-///  The name of the parent process.
-///
-@property NSString *parentName;
-
-// TODO(mlw): Store signing chain info
-// @property NSArray<MOLCertificate*> *signingChain;
+@property(readonly) NSArray *signingChainCertRefs;
 
 @end

Source/common/SNTFileAccessEvent.m

@@ -14,6 +14,8 @@
 
 #import "Source/common/SNTFileAccessEvent.h"
 
+#import "Source/common/CertificateHelpers.h"
+
 @implementation SNTFileAccessEvent
 
 #define ENCODE(o)                               \
@@ -28,6 +30,12 @@
     _##o = [decoder decodeObjectOfClass:[c class] forKey:@(#o)]; \
   } while (0)
 
+#define DECODEARRAY(o, c)                                                                        \
+  do {                                                                                           \
+    _##o = [decoder decodeObjectOfClasses:[NSSet setWithObjects:[NSArray class], [c class], nil] \
+                                   forKey:@(#o)];                                                \
+  } while (0)
+
 - (instancetype)init {
   self = [super init];
   if (self) {
@@ -40,33 +48,20 @@
 }
 
 - (void)encodeWithCoder:(NSCoder *)coder {
+  [super encodeWithCoder:coder];
   ENCODE(accessedPath);
   ENCODE(ruleVersion);
   ENCODE(ruleName);
-  ENCODE(fileSHA256);
-  ENCODE(filePath);
   ENCODE(application);
-  ENCODE(teamID);
-  ENCODE(teamID);
-  ENCODE(pid);
-  ENCODE(ppid);
-  ENCODE(parentName);
 }
 
 - (instancetype)initWithCoder:(NSCoder *)decoder {
-  self = [super init];
+  self = [super initWithCoder:decoder];
   if (self) {
     DECODE(accessedPath, NSString);
     DECODE(ruleVersion, NSString);
     DECODE(ruleName, NSString);
-    DECODE(fileSHA256, NSString);
-    DECODE(filePath, NSString);
     DECODE(application, NSString);
-    DECODE(teamID, NSString);
-    DECODE(teamID, NSString);
-    DECODE(pid, NSNumber);
-    DECODE(ppid, NSNumber);
-    DECODE(parentName, NSString);
   }
   return self;
 }
@@ -76,4 +71,12 @@
     stringWithFormat:@"SNTFileAccessEvent: Accessed: %@, By: %@", self.accessedPath, self.filePath];
 }
 
+- (NSString *)publisherInfo {
+  return Publisher(self.signingChain, self.teamID);
+}
+
+- (NSArray *)signingChainCertRefs {
+  return CertificateChain(self.signingChain);
+}
+
 @end

Source/common/SNTFileInfo.h

@@ -15,6 +15,8 @@
 #import <EndpointSecurity/EndpointSecurity.h>
 #import <Foundation/Foundation.h>
 
+#import "Source/common/SantaVnode.h"
+
 @class MOLCodesignChecker;
 
 ///
@@ -220,6 +222,11 @@
 ///
 - (NSUInteger)fileSize;
 
+///
+///  @return The devno/ino pair of the file
+///
+- (SantaVnode)vnode;
+
 ///
 ///  @return The underlying file handle.
 ///

Source/common/SNTFileInfo.m

@@ -49,6 +49,7 @@
 @property NSString *path;
 @property NSFileHandle *fileHandle;
 @property NSUInteger fileSize;
+@property SantaVnode vnode;
 @property NSString *fileOwnerHomeDir;
 @property NSString *sha256Storage;
 
@@ -110,6 +111,7 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
     }
 
     _fileSize = fileStat->st_size;
+    _vnode = (SantaVnode){.fsid = fileStat->st_dev, .fileid = fileStat->st_ino};
 
     if (_fileSize == 0) return nil;
 
@@ -421,8 +423,14 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
       return self.infoDict;
     }
 
-    d = self.bundle.infoDictionary;
-    if (d) {
+    // `-[NSBundle infoDictionary]` is heavily cached, changes to the Info.plist are not realized.
+    // Use `CFBundleCopyInfoDictionaryInDirectory` instead, which does not appear to cache.
+    NSString *bundlePath = [self bundlePath];
+    if (bundlePath.length) {
+      d = CFBridgingRelease(CFBundleCopyInfoDictionaryInDirectory(
+        (__bridge CFURLRef)[NSURL fileURLWithPath:bundlePath]));
+    }
+    if (d.count) {
       self.infoDict = d;
       return self.infoDict;
     }

Source/common/SNTKVOManager.h

@@ -15,7 +15,7 @@
 #import <Foundation/Foundation.h>
 
 // The callback type when KVO notifications are received for observed key paths.
-// The first parameter is the previous value, the second paramter is the new value.
+// The first parameter is the previous value, the second parameter is the new value.
 typedef void (^KVOCallback)(id oldValue, id newValue);
 
 @interface SNTKVOManager : NSObject

Source/common/SNTMetricSet.m

@@ -605,10 +605,15 @@ NSString *SNTMetricMakeStringFromMetricType(SNTMetricType metricType) {
 
 /** Export current state of the SNTMetricSet as an NSDictionary. */
 - (NSDictionary *)export {
-  NSDictionary *exported = nil;
+  NSDictionary *exported;
+
+  NSArray *callbacks;
+  @synchronized(self) {
+    callbacks = [_callbacks mutableCopy];
+  }
 
   // Invoke callbacks to ensure metrics are up to date.
-  for (void (^cb)(void) in _callbacks) {
+  for (void (^cb)(void) in callbacks) {
     cb();
   }
 
@@ -639,20 +644,9 @@ NSString *SNTMetricStringFromMetricFormatType(SNTMetricFormatType format) {
 NSDictionary *SNTMetricConvertDatesToISO8601Strings(NSDictionary *metrics) {
   NSMutableDictionary *mutableMetrics = [metrics mutableCopy];
 
-  id formatter;
-
-  if (@available(macOS 10.13, *)) {
-    NSISO8601DateFormatter *isoFormatter = [[NSISO8601DateFormatter alloc] init];
-
-    isoFormatter.formatOptions =
-      NSISO8601DateFormatWithInternetDateTime | NSISO8601DateFormatWithFractionalSeconds;
-    formatter = isoFormatter;
-  } else {
-    NSDateFormatter *localFormatter = [[NSDateFormatter alloc] init];
-    [localFormatter setDateFormat:@"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"];
-    [localFormatter setTimeZone:[NSTimeZone timeZoneWithName:@"UTC"]];
-    formatter = localFormatter;
-  }
+  NSISO8601DateFormatter *formatter = [[NSISO8601DateFormatter alloc] init];
+  formatter.formatOptions =
+    NSISO8601DateFormatWithInternetDateTime | NSISO8601DateFormatWithFractionalSeconds;
 
   for (NSString *metricName in mutableMetrics[@"metrics"]) {
     NSMutableDictionary *metric = mutableMetrics[@"metrics"][metricName];

Source/common/SNTRule.h

@@ -41,6 +41,11 @@
 ///
 @property(copy) NSString *customMsg;
 
+///
+///  A custom URL to take the user to when this binary is blocked from executing.
+///
+@property(copy) NSString *customURL;
+
 ///
 ///  The time when this rule was last retrieved from the rules database, if rule is transitive.
 ///  Stored as number of seconds since 00:00:00 UTC on 1 January 2001.
@@ -74,4 +79,9 @@
 ///
 - (void)resetTimestamp;
 
+///
+///  Returns a dictionary representation of the rule.
+///
+- (NSDictionary *)dictionaryRepresentation;
+
 @end

Source/common/SNTRule.m

@@ -13,8 +13,16 @@
 ///    limitations under the License.
 
 #import "Source/common/SNTRule.h"
+
+#include <CommonCrypto/CommonCrypto.h>
+#include <Kernel/kern/cs_blobs.h>
+#include <os/base.h>
+
 #import "Source/common/SNTSyncConstants.h"
 
+// https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/
+static const NSUInteger kExpectedTeamIDLength = 10;
+
 @interface SNTRule ()
 @property(readwrite) NSUInteger timestamp;
 @end
@@ -28,20 +36,92 @@
                          timestamp:(NSUInteger)timestamp {
   self = [super init];
   if (self) {
+    if (identifier.length == 0) {
+      return nil;
+    }
+
+    NSCharacterSet *nonHex =
+      [[NSCharacterSet characterSetWithCharactersInString:@"0123456789abcdef"] invertedSet];
+    NSCharacterSet *nonUppercaseAlphaNumeric = [[NSCharacterSet
+      characterSetWithCharactersInString:@"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"] invertedSet];
+
+    switch (type) {
+      case SNTRuleTypeBinary: OS_FALLTHROUGH;
+      case SNTRuleTypeCertificate: {
+        // For binary and certificate rules, force the hash identifier to be lowercase hex.
+        identifier = [identifier lowercaseString];
+
+        identifier = [identifier stringByTrimmingCharactersInSet:nonHex];
+        if (identifier.length != (CC_SHA256_DIGEST_LENGTH * 2)) {
+          return nil;
+        }
+
+        break;
+      }
+
+      case SNTRuleTypeTeamID: {
+        // TeamIDs are always [0-9A-Z], so enforce that the identifier is uppercase
+        identifier =
+          [[identifier uppercaseString] stringByTrimmingCharactersInSet:nonUppercaseAlphaNumeric];
+        if (identifier.length != kExpectedTeamIDLength) {
+          return nil;
+        }
+
+        break;
+      }
+
+      case SNTRuleTypeSigningID: {
+        // SigningID rules are a combination of `TeamID:SigningID`. The TeamID should
+        // be forced to be uppercase, but because very loose rules exist for SigningIDs,
+        // their case will be kept as-is. However, platform binaries are expected to
+        // have the hardcoded string "platform" as the team ID and the case will be left
+        // as is.
+        NSArray *sidComponents = [identifier componentsSeparatedByString:@":"];
+        if (!sidComponents || sidComponents.count < 2) {
+          return nil;
+        }
+
+        // The first component is the TeamID
+        NSString *teamID = sidComponents[0];
+
+        if (![teamID isEqualToString:@"platform"]) {
+          teamID =
+            [[teamID uppercaseString] stringByTrimmingCharactersInSet:nonUppercaseAlphaNumeric];
+          if (teamID.length != kExpectedTeamIDLength) {
+            return nil;
+          }
+        }
+
+        // The rest of the components are the Signing ID since ":" a legal character.
+        // Join all but the last element of the components to rebuild the SigningID.
+        NSString *signingID = [[sidComponents
+          subarrayWithRange:NSMakeRange(1, sidComponents.count - 1)] componentsJoinedByString:@":"];
+        if (signingID.length == 0) {
+          return nil;
+        }
+
+        identifier = [NSString stringWithFormat:@"%@:%@", teamID, signingID];
+        break;
+      }
+
+      case SNTRuleTypeCDHash: {
+        identifier = [[identifier lowercaseString] stringByTrimmingCharactersInSet:nonHex];
+        if (identifier.length != CS_CDHASH_LEN * 2) {
+          return nil;
+        }
+        break;
+      }
+
+      default: {
+        break;
+      }
+    }
+
     _identifier = identifier;
     _state = state;
     _type = type;
     _customMsg = customMsg;
     _timestamp = timestamp;
-
-    if (_type == SNTRuleTypeBinary || _type == SNTRuleTypeCertificate) {
-      NSCharacterSet *nonHex =
-        [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
-      if ([[_identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length != 64)
-        return nil;
-    } else if (_identifier.length == 0) {
-      return nil;
-    }
   }
   return self;
 }
@@ -102,6 +182,8 @@
     type = SNTRuleTypeTeamID;
   } else if ([ruleTypeString isEqual:kRuleTypeSigningID]) {
     type = SNTRuleTypeSigningID;
+  } else if ([ruleTypeString isEqual:kRuleTypeCDHash]) {
+    type = SNTRuleTypeCDHash;
   } else {
     return nil;
   }
@@ -111,7 +193,14 @@
     customMsg = nil;
   }
 
-  return [self initWithIdentifier:identifier state:state type:type customMsg:customMsg];
+  NSString *customURL = dict[kRuleCustomURL];
+  if (![customURL isKindOfClass:[NSString class]] || customURL.length == 0) {
+    customURL = nil;
+  }
+
+  SNTRule *r = [self initWithIdentifier:identifier state:state type:type customMsg:customMsg];
+  r.customURL = customURL;
+  return r;
 }
 
 #pragma mark NSSecureCoding
@@ -131,6 +220,7 @@
   ENCODE(@(self.state), @"state");
   ENCODE(@(self.type), @"type");
   ENCODE(self.customMsg, @"custommsg");
+  ENCODE(self.customURL, @"customurl");
   ENCODE(@(self.timestamp), @"timestamp");
 }
 
@@ -141,11 +231,49 @@
     _state = [DECODE(NSNumber, @"state") intValue];
     _type = [DECODE(NSNumber, @"type") intValue];
     _customMsg = DECODE(NSString, @"custommsg");
+    _customURL = DECODE(NSString, @"customurl");
     _timestamp = [DECODE(NSNumber, @"timestamp") unsignedIntegerValue];
   }
   return self;
 }
 
+- (NSString *)ruleStateToPolicyString:(SNTRuleState)state {
+  switch (state) {
+    case SNTRuleStateAllow: return kRulePolicyAllowlist;
+    case SNTRuleStateAllowCompiler: return kRulePolicyAllowlistCompiler;
+    case SNTRuleStateBlock: return kRulePolicyBlocklist;
+    case SNTRuleStateSilentBlock: return kRulePolicySilentBlocklist;
+    case SNTRuleStateRemove: return kRulePolicyRemove;
+    case SNTRuleStateAllowTransitive: return @"AllowTransitive";
+    // This should never be hit. But is here for completion.
+    default: return @"Unknown";
+  }
+}
+
+- (NSString *)ruleTypeToString:(SNTRuleType)ruleType {
+  switch (ruleType) {
+    case SNTRuleTypeBinary: return kRuleTypeBinary;
+    case SNTRuleTypeCertificate: return kRuleTypeCertificate;
+    case SNTRuleTypeTeamID: return kRuleTypeTeamID;
+    case SNTRuleTypeSigningID: return kRuleTypeSigningID;
+    // This should never be hit. If we have rule types of Unknown then there's a
+    // coding error somewhere.
+    default: return @"Unknown";
+  }
+}
+
+// Returns an NSDictionary representation of the rule. Primarily use for
+// exporting rules.
+- (NSDictionary *)dictionaryRepresentation {
+  return @{
+    kRuleIdentifier : self.identifier,
+    kRulePolicy : [self ruleStateToPolicyString:self.state],
+    kRuleType : [self ruleTypeToString:self.type],
+    kRuleCustomMsg : self.customMsg ?: @"",
+    kRuleCustomURL : self.customURL ?: @""
+  };
+}
+
 #undef DECODE
 #undef ENCODE
 #pragma clang diagnostic pop

Source/common/SNTRuleIdentifiers.h

@@ -0,0 +1,51 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+/**
+ * This file declares two types that are mirrors of each other.
+ *
+ * The C struct serves as a way to group and pass valid rule identifiers around
+ * in order to minimize interface changes needed when new rule types are added
+ * and also alleviate the need to allocate a short lived object.
+ *
+ * The Objective C class is used for an XPC boundary to easily pass rule
+ * identifiers between Santa components.
+ */
+
+#import <Foundation/Foundation.h>
+
+struct RuleIdentifiers {
+  NSString *cdhash;
+  NSString *binarySHA256;
+  NSString *signingID;
+  NSString *certificateSHA256;
+  NSString *teamID;
+};
+
+@interface SNTRuleIdentifiers : NSObject <NSSecureCoding>
+@property(readonly) NSString *cdhash;
+@property(readonly) NSString *binarySHA256;
+@property(readonly) NSString *signingID;
+@property(readonly) NSString *certificateSHA256;
+@property(readonly) NSString *teamID;
+
+/// Please use `initWithRuleIdentifiers:`
+- (instancetype)init NS_UNAVAILABLE;
+
+- (instancetype)initWithRuleIdentifiers:(struct RuleIdentifiers)identifiers
+  NS_DESIGNATED_INITIALIZER;
+
+- (struct RuleIdentifiers)toStruct;
+
+@end

Source/common/SNTRuleIdentifiers.m

@@ -0,0 +1,73 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/SNTRuleIdentifiers.h"
+
+@implementation SNTRuleIdentifiers
+
+- (instancetype)initWithRuleIdentifiers:(struct RuleIdentifiers)identifiers {
+  self = [super init];
+  if (self) {
+    _cdhash = identifiers.cdhash;
+    _binarySHA256 = identifiers.binarySHA256;
+    _signingID = identifiers.signingID;
+    _certificateSHA256 = identifiers.certificateSHA256;
+    _teamID = identifiers.teamID;
+  }
+  return self;
+}
+
+- (struct RuleIdentifiers)toStruct {
+  return (struct RuleIdentifiers){.cdhash = self.cdhash,
+                                  .binarySHA256 = self.binarySHA256,
+                                  .signingID = self.signingID,
+                                  .certificateSHA256 = self.certificateSHA256,
+                                  .teamID = self.teamID};
+}
+
+#pragma mark NSSecureCoding
+
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wobjc-literal-conversion"
+#define ENCODE(obj, key) \
+  if (obj) [coder encodeObject:obj forKey:key]
+#define DECODE(cls, key) [decoder decodeObjectOfClass:[cls class] forKey:key]
+
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
+
+- (instancetype)initWithCoder:(NSCoder *)decoder {
+  self = [self init];
+  if (self) {
+    _cdhash = DECODE(NSString, @"cdhash");
+    _binarySHA256 = DECODE(NSString, @"binarySHA256");
+    _signingID = DECODE(NSString, @"signingID");
+    _certificateSHA256 = DECODE(NSString, @"certificateSHA256");
+    _teamID = DECODE(NSString, @"teamID");
+  }
+  return self;
+}
+
+- (void)encodeWithCoder:(NSCoder *)coder {
+  ENCODE(self.cdhash, @"cdhash");
+  ENCODE(self.binarySHA256, @"binarySHA256");
+  ENCODE(self.signingID, @"signingID");
+  ENCODE(self.certificateSHA256, @"certificateSHA256");
+  ENCODE(self.teamID, @"teamID");
+}
+
+#pragma clang diagnostic pop
+
+@end

Source/common/SNTRuleTest.m

@@ -14,6 +14,9 @@
 
 #import <XCTest/XCTest.h>
 
+#import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTSyncConstants.h"
+
 #import "Source/common/SNTRule.h"
 
 @interface SNTRuleTest : XCTestCase
@@ -46,13 +49,25 @@
   XCTAssertEqual(sut.type, SNTRuleTypeCertificate);
   XCTAssertEqual(sut.state, SNTRuleStateBlock);
 
+  // Ensure a Binary and Certificate rules properly convert identifiers to lowercase.
+  for (NSString *ruleType in @[ @"BINARY", @"CERTIFICATE" ]) {
+    sut = [[SNTRule alloc] initWithDictionary:@{
+      @"identifier" : @"B7C1E3FD640C5F211C89B02C2C6122F78CE322AA5C56EB0BB54BC422A8F8B670",
+      @"policy" : @"BLOCKLIST",
+      @"rule_type" : ruleType,
+    }];
+    XCTAssertNotNil(sut);
+    XCTAssertEqualObjects(sut.identifier,
+                          @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670");
+  }
+
   sut = [[SNTRule alloc] initWithDictionary:@{
-    @"identifier" : @"some-sort-of-identifier",
+    @"identifier" : @"ABCDEFGHIJ",
     @"policy" : @"SILENT_BLOCKLIST",
     @"rule_type" : @"TEAMID",
   }];
   XCTAssertNotNil(sut);
-  XCTAssertEqualObjects(sut.identifier, @"some-sort-of-identifier");
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ");
   XCTAssertEqual(sut.type, SNTRuleTypeTeamID);
   XCTAssertEqual(sut.state, SNTRuleStateSilentBlock);
 
@@ -68,26 +83,114 @@
   XCTAssertEqual(sut.state, SNTRuleStateAllowCompiler);
 
   sut = [[SNTRule alloc] initWithDictionary:@{
-    @"identifier" : @"some-sort-of-identifier",
+    @"identifier" : @"ABCDEFGHIJ",
     @"policy" : @"REMOVE",
     @"rule_type" : @"TEAMID",
   }];
   XCTAssertNotNil(sut);
-  XCTAssertEqualObjects(sut.identifier, @"some-sort-of-identifier");
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ");
   XCTAssertEqual(sut.type, SNTRuleTypeTeamID);
   XCTAssertEqual(sut.state, SNTRuleStateRemove);
 
   sut = [[SNTRule alloc] initWithDictionary:@{
-    @"identifier" : @"some-sort-of-identifier",
+    @"identifier" : @"ABCDEFGHIJ",
     @"policy" : @"ALLOWLIST",
     @"rule_type" : @"TEAMID",
     @"custom_msg" : @"A custom block message",
+    @"custom_url" : @"https://example.com",
   }];
   XCTAssertNotNil(sut);
-  XCTAssertEqualObjects(sut.identifier, @"some-sort-of-identifier");
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ");
   XCTAssertEqual(sut.type, SNTRuleTypeTeamID);
   XCTAssertEqual(sut.state, SNTRuleStateAllow);
   XCTAssertEqualObjects(sut.customMsg, @"A custom block message");
+  XCTAssertEqualObjects(sut.customURL, @"https://example.com");
+
+  // TeamIDs must be 10 chars in length
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"A",
+    @"policy" : @"ALLOWLIST",
+    @"rule_type" : @"TEAMID",
+  }];
+  XCTAssertNil(sut);
+
+  // TeamIDs must be only alphanumeric chars
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"ßßßßßßßßßß",
+    @"policy" : @"ALLOWLIST",
+    @"rule_type" : @"TEAMID",
+  }];
+  XCTAssertNil(sut);
+
+  // TeamIDs are converted to uppercase
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"abcdefghij",
+    @"policy" : @"REMOVE",
+    @"rule_type" : @"TEAMID",
+  }];
+  XCTAssertNotNil(sut);
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ");
+
+  // SigningID tests
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"ABCDEFGHIJ:com.example",
+    @"policy" : @"REMOVE",
+    @"rule_type" : @"SIGNINGID",
+  }];
+  XCTAssertNotNil(sut);
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ:com.example");
+  XCTAssertEqual(sut.type, SNTRuleTypeSigningID);
+  XCTAssertEqual(sut.state, SNTRuleStateRemove);
+
+  // Invalid SingingID tests:
+  for (NSString *ident in @[
+         @":com.example",     // missing team ID
+         @"ABCDEFGHIJ:",      // missing signing ID
+         @"ABC:com.example",  // Invalid team id
+         @":",                // missing team and signing IDs
+         @"",                 // empty string
+       ]) {
+    sut = [[SNTRule alloc] initWithDictionary:@{
+      @"identifier" : ident,
+      @"policy" : @"REMOVE",
+      @"rule_type" : @"SIGNINGID",
+    }];
+    XCTAssertNil(sut);
+  }
+
+  // Signing ID with lower team ID has case fixed up
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"abcdefghij:com.example",
+    @"policy" : @"REMOVE",
+    @"rule_type" : @"SIGNINGID",
+  }];
+  XCTAssertNotNil(sut);
+  XCTAssertEqualObjects(sut.identifier, @"ABCDEFGHIJ:com.example");
+
+  // Signing ID with lower platform team ID is left alone
+  sut = [[SNTRule alloc] initWithDictionary:@{
+    @"identifier" : @"platform:com.example",
+    @"policy" : @"REMOVE",
+    @"rule_type" : @"SIGNINGID",
+  }];
+  XCTAssertNotNil(sut);
+  XCTAssertEqualObjects(sut.identifier, @"platform:com.example");
+
+  // Signing ID can contain the TID:SID delimiter character (":")
+  for (NSString *ident in @[
+         @"ABCDEFGHIJ:com:",
+         @"ABCDEFGHIJ:com:example",
+         @"ABCDEFGHIJ::",
+         @"ABCDEFGHIJ:com:example:with:more:components:",
+       ]) {
+    sut = [[SNTRule alloc] initWithDictionary:@{
+      @"identifier" : ident,
+      @"policy" : @"ALLOWLIST",
+      @"rule_type" : @"SIGNINGID",
+    }];
+    XCTAssertNotNil(sut);
+    XCTAssertEqualObjects(sut.identifier, ident);
+  }
 }
 
 - (void)testInitWithDictionaryInvalid {
@@ -123,4 +226,63 @@
   XCTAssertNil(sut);
 }
 
+- (void)testRuleDictionaryRepresentation {
+  NSDictionary *expectedTeamID = @{
+    @"identifier" : @"ABCDEFGHIJ",
+    @"policy" : @"ALLOWLIST",
+    @"rule_type" : @"TEAMID",
+    @"custom_msg" : @"A custom block message",
+    @"custom_url" : @"https://example.com",
+  };
+
+  SNTRule *sut = [[SNTRule alloc] initWithDictionary:expectedTeamID];
+  NSDictionary *dict = [sut dictionaryRepresentation];
+  XCTAssertEqualObjects(expectedTeamID, dict);
+
+  NSDictionary *expectedBinary = @{
+    @"identifier" : @"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6",
+    @"policy" : @"BLOCKLIST",
+    @"rule_type" : @"BINARY",
+    @"custom_msg" : @"",
+    @"custom_url" : @"",
+  };
+
+  sut = [[SNTRule alloc] initWithDictionary:expectedBinary];
+  dict = [sut dictionaryRepresentation];
+
+  XCTAssertEqualObjects(expectedBinary, dict);
+}
+
+- (void)testRuleStateToPolicyString {
+  NSDictionary *expected = @{
+    @"identifier" : @"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6",
+    @"policy" : @"ALLOWLIST",
+    @"rule_type" : @"BINARY",
+    @"custom_msg" : @"A custom block message",
+    @"custom_url" : @"https://example.com",
+  };
+
+  SNTRule *sut = [[SNTRule alloc] initWithDictionary:expected];
+  sut.state = SNTRuleStateBlock;
+  XCTAssertEqualObjects(kRulePolicyBlocklist, [sut dictionaryRepresentation][kRulePolicy]);
+  sut.state = SNTRuleStateSilentBlock;
+  XCTAssertEqualObjects(kRulePolicySilentBlocklist, [sut dictionaryRepresentation][kRulePolicy]);
+  sut.state = SNTRuleStateAllow;
+  XCTAssertEqualObjects(kRulePolicyAllowlist, [sut dictionaryRepresentation][kRulePolicy]);
+  sut.state = SNTRuleStateAllowCompiler;
+  XCTAssertEqualObjects(kRulePolicyAllowlistCompiler, [sut dictionaryRepresentation][kRulePolicy]);
+  // Invalid states
+  sut.state = SNTRuleStateRemove;
+  XCTAssertEqualObjects(kRulePolicyRemove, [sut dictionaryRepresentation][kRulePolicy]);
+}
+
+/*
+- (void)testRuleTypeToString {
+  SNTRule *sut = [[SNTRule alloc] init];
+  XCTAssertEqual(kRuleTypeBinary, [sut ruleTypeToString:@""]);//SNTRuleTypeBinary]);
+  XCTAssertEqual(kRuleTypeCertificate,[sut ruleTypeToString:SNTRuleTypeCertificate]);
+  XCTAssertEqual(kRuleTypeTeamID, [sut ruleTypeToString:SNTRuleTypeTeamID]);
+  XCTAssertEqual(kRuleTypeSigningID,[sut ruleTypeToString:SNTRuleTypeSigningID]);
+}*/
+
 @end

Source/common/SNTStoredEvent.h

@@ -105,6 +105,11 @@
 ///
 @property NSString *signingID;
 
+///
+/// If the executed file was signed, this is the CDHash of the binary.
+///
+@property NSString *cdhash;
+
 ///
 ///  The user who executed the binary.
 ///

Source/common/SNTStoredEvent.m

@@ -51,6 +51,7 @@
   ENCODE(self.signingChain, @"signingChain");
   ENCODE(self.teamID, @"teamID");
   ENCODE(self.signingID, @"signingID");
+  ENCODE(self.cdhash, @"cdhash");
 
   ENCODE(self.executingUser, @"executingUser");
   ENCODE(self.occurrenceDate, @"occurrenceDate");
@@ -97,6 +98,7 @@
     _signingChain = DECODEARRAY(MOLCertificate, @"signingChain");
     _teamID = DECODE(NSString, @"teamID");
     _signingID = DECODE(NSString, @"signingID");
+    _cdhash = DECODE(NSString, @"cdhash");
 
     _executingUser = DECODE(NSString, @"executingUser");
     _occurrenceDate = DECODE(NSDate, @"occurrenceDate");

Source/common/SNTSyncConstants.h

@@ -32,7 +32,8 @@ extern NSString *const kClientModeMonitor;
 extern NSString *const kClientModeLockdown;
 extern NSString *const kBlockUSBMount;
 extern NSString *const kRemountUSBMode;
-extern NSString *const kCleanSync;
+extern NSString *const kCleanSyncDeprecated;
+extern NSString *const kSyncType;
 extern NSString *const kAllowedPathRegex;
 extern NSString *const kAllowedPathRegexDeprecated;
 extern NSString *const kBlockedPathRegex;
@@ -43,6 +44,7 @@ extern NSString *const kCompilerRuleCount;
 extern NSString *const kTransitiveRuleCount;
 extern NSString *const kTeamIDRuleCount;
 extern NSString *const kSigningIDRuleCount;
+extern NSString *const kCDHashRuleCount;
 extern NSString *const kFullSyncInterval;
 extern NSString *const kFCMToken;
 extern NSString *const kFCMFullSyncInterval;
@@ -54,6 +56,7 @@ extern NSString *const kEnableTransitiveRulesDeprecated;
 extern NSString *const kEnableTransitiveRulesSuperDeprecated;
 extern NSString *const kEnableAllEventUpload;
 extern NSString *const kDisableUnknownEventUpload;
+extern NSString *const kOverrideFileAccessAction;
 
 extern NSString *const kEvents;
 extern NSString *const kFileSHA256;
@@ -68,12 +71,14 @@ extern NSString *const kDecisionAllowCertificate;
 extern NSString *const kDecisionAllowScope;
 extern NSString *const kDecisionAllowTeamID;
 extern NSString *const kDecisionAllowSigningID;
+extern NSString *const kDecisionAllowCDHash;
 extern NSString *const kDecisionBlockUnknown;
 extern NSString *const kDecisionBlockBinary;
 extern NSString *const kDecisionBlockCertificate;
 extern NSString *const kDecisionBlockScope;
 extern NSString *const kDecisionBlockTeamID;
 extern NSString *const kDecisionBlockSigningID;
+extern NSString *const kDecisionBlockCDHash;
 extern NSString *const kDecisionUnknown;
 extern NSString *const kDecisionBundleBinary;
 extern NSString *const kLoggedInUsers;
@@ -99,6 +104,7 @@ extern NSString *const kCertValidFrom;
 extern NSString *const kCertValidUntil;
 extern NSString *const kTeamID;
 extern NSString *const kSigningID;
+extern NSString *const kCDHash;
 extern NSString *const kQuarantineDataURL;
 extern NSString *const kQuarantineRefererURL;
 extern NSString *const kQuarantineTimestamp;
@@ -123,7 +129,9 @@ extern NSString *const kRuleTypeBinary;
 extern NSString *const kRuleTypeCertificate;
 extern NSString *const kRuleTypeTeamID;
 extern NSString *const kRuleTypeSigningID;
+extern NSString *const kRuleTypeCDHash;
 extern NSString *const kRuleCustomMsg;
+extern NSString *const kRuleCustomURL;
 extern NSString *const kCursor;
 
 extern NSString *const kBackoffInterval;
@@ -135,6 +143,9 @@ extern NSString *const kLogSync;
 
 extern const NSUInteger kDefaultEventBatchSize;
 
+extern NSString *const kPostflightRulesReceived;
+extern NSString *const kPostflightRulesProcessed;
+
 ///
 ///  kDefaultFullSyncInterval
 ///  kDefaultFCMFullSyncInterval

Source/common/SNTSyncConstants.m

@@ -32,7 +32,8 @@ NSString *const kBlockUSBMount = @"block_usb_mount";
 NSString *const kRemountUSBMode = @"remount_usb_mode";
 NSString *const kClientModeMonitor = @"MONITOR";
 NSString *const kClientModeLockdown = @"LOCKDOWN";
-NSString *const kCleanSync = @"clean_sync";
+NSString *const kCleanSyncDeprecated = @"clean_sync";
+NSString *const kSyncType = @"sync_type";
 NSString *const kAllowedPathRegex = @"allowed_path_regex";
 NSString *const kAllowedPathRegexDeprecated = @"whitelist_regex";
 NSString *const kBlockedPathRegex = @"blocked_path_regex";
@@ -43,10 +44,12 @@ NSString *const kCompilerRuleCount = @"compiler_rule_count";
 NSString *const kTransitiveRuleCount = @"transitive_rule_count";
 NSString *const kTeamIDRuleCount = @"teamid_rule_count";
 NSString *const kSigningIDRuleCount = @"signingid_rule_count";
+NSString *const kCDHashRuleCount = @"cdhash_rule_count";
 NSString *const kFullSyncInterval = @"full_sync_interval";
 NSString *const kFCMToken = @"fcm_token";
 NSString *const kFCMFullSyncInterval = @"fcm_full_sync_interval";
 NSString *const kFCMGlobalRuleSyncDeadline = @"fcm_global_rule_sync_deadline";
+NSString *const kOverrideFileAccessAction = @"override_file_access_action";
 
 NSString *const kEnableBundles = @"enable_bundles";
 NSString *const kEnableBundlesDeprecated = @"bundles_enabled";
@@ -69,12 +72,14 @@ NSString *const kDecisionAllowCertificate = @"ALLOW_CERTIFICATE";
 NSString *const kDecisionAllowScope = @"ALLOW_SCOPE";
 NSString *const kDecisionAllowTeamID = @"ALLOW_TEAMID";
 NSString *const kDecisionAllowSigningID = @"ALLOW_SIGNINGID";
+NSString *const kDecisionAllowCDHash = @"ALLOW_CDHASH";
 NSString *const kDecisionBlockUnknown = @"BLOCK_UNKNOWN";
 NSString *const kDecisionBlockBinary = @"BLOCK_BINARY";
 NSString *const kDecisionBlockCertificate = @"BLOCK_CERTIFICATE";
 NSString *const kDecisionBlockScope = @"BLOCK_SCOPE";
 NSString *const kDecisionBlockTeamID = @"BLOCK_TEAMID";
 NSString *const kDecisionBlockSigningID = @"BLOCK_SIGNINGID";
+NSString *const kDecisionBlockCDHash = @"BLOCK_CDHASH";
 NSString *const kDecisionUnknown = @"UNKNOWN";
 NSString *const kDecisionBundleBinary = @"BUNDLE_BINARY";
 NSString *const kLoggedInUsers = @"logged_in_users";
@@ -100,6 +105,7 @@ NSString *const kCertValidFrom = @"valid_from";
 NSString *const kCertValidUntil = @"valid_until";
 NSString *const kTeamID = @"team_id";
 NSString *const kSigningID = @"signing_id";
+NSString *const kCDHash = @"cdhash";
 NSString *const kQuarantineDataURL = @"quarantine_data_url";
 NSString *const kQuarantineRefererURL = @"quarantine_referer_url";
 NSString *const kQuarantineTimestamp = @"quarantine_timestamp";
@@ -124,7 +130,9 @@ NSString *const kRuleTypeBinary = @"BINARY";
 NSString *const kRuleTypeCertificate = @"CERTIFICATE";
 NSString *const kRuleTypeTeamID = @"TEAMID";
 NSString *const kRuleTypeSigningID = @"SIGNINGID";
+NSString *const kRuleTypeCDHash = @"CDHASH";
 NSString *const kRuleCustomMsg = @"custom_msg";
+NSString *const kRuleCustomURL = @"custom_url";
 NSString *const kCursor = @"cursor";
 
 NSString *const kBackoffInterval = @"backoff";
@@ -134,6 +142,9 @@ NSString *const kRuleSync = @"rule_sync";
 NSString *const kConfigSync = @"config_sync";
 NSString *const kLogSync = @"log_sync";
 
+NSString *const kPostflightRulesReceived = @"rules_received";
+NSString *const kPostflightRulesProcessed = @"rules_processed";
+
 const NSUInteger kDefaultEventBatchSize = 50;
 const NSUInteger kDefaultFullSyncInterval = 600;
 const NSUInteger kDefaultPushNotificationsFullSyncInterval = 14400;

Source/common/SNTSystemInfo.h

@@ -54,4 +54,19 @@
 ///
 + (NSString *)modelIdentifier;
 
+///
+///  @return The Santa product version, e.g. 2024.6
+///
++ (NSString *)santaProductVersion;
+
+///
+///  @return The Santa build version, e.g. 655965194
+///
++ (NSString *)santaBuildVersion;
+
+///
+///  @return The full Santa versoin, e.g. 2024.6.655965194
+///
++ (NSString *)santaFullVersion;
+
 @end

Source/common/SNTSystemInfo.m

@@ -74,6 +74,21 @@
   return @(model);
 }
 
++ (NSString *)santaProductVersion {
+  NSDictionary *info_dict = [[NSBundle mainBundle] infoDictionary];
+  return info_dict[@"CFBundleShortVersionString"];
+}
+
++ (NSString *)santaBuildVersion {
+  NSDictionary *info_dict = [[NSBundle mainBundle] infoDictionary];
+  return [[info_dict[@"CFBundleVersion"] componentsSeparatedByString:@"."] lastObject];
+}
+
++ (NSString *)santaFullVersion {
+  NSDictionary *info_dict = [[NSBundle mainBundle] infoDictionary];
+  return info_dict[@"CFBundleVersion"];
+}
+
 #pragma mark - Internal
 
 + (NSDictionary *)_systemVersionDictionary {

Source/common/SNTXPCBundleServiceInterface.h

@@ -21,7 +21,7 @@
 ///  A block that takes the calculated bundle hash, associated events and hashing time in ms.
 typedef void (^SNTBundleHashBlock)(NSString *, NSArray<SNTStoredEvent *> *, NSNumber *);
 
-///  Protocol implemented by santabs and utilized by SantaGUI for bundle hashing
+///  Protocol implemented by santabundleservice and utilized by SantaGUI for bundle hashing
 @protocol SNTBundleServiceXPC
 
 ///

Source/common/SNTXPCControlInterface.h

@@ -12,6 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#import "Source/common/SNTRuleIdentifiers.h"
 #import "Source/common/SNTXPCUnprivilegedControlInterface.h"
 
 ///
@@ -28,15 +29,13 @@
 ///  Database ops
 ///
 - (void)databaseRuleAddRules:(NSArray *)rules
-                  cleanSlate:(BOOL)cleanSlate
+                 ruleCleanup:(SNTRuleCleanup)cleanupType
                        reply:(void (^)(NSError *error))reply;
 - (void)databaseEventsPending:(void (^)(NSArray *events))reply;
 - (void)databaseRemoveEventsWithIDs:(NSArray *)ids;
-- (void)databaseRuleForBinarySHA256:(NSString *)binarySHA256
-                  certificateSHA256:(NSString *)certificateSHA256
-                             teamID:(NSString *)teamID
-                          signingID:(NSString *)signingID
-                              reply:(void (^)(SNTRule *))reply;
+- (void)databaseRuleForIdentifiers:(SNTRuleIdentifiers *)identifiers
+                             reply:(void (^)(SNTRule *))reply;
+- (void)retrieveAllRules:(void (^)(NSArray<SNTRule *> *rules, NSError *error))reply;
 
 ///
 ///  Config ops
@@ -44,7 +43,7 @@
 - (void)setClientMode:(SNTClientMode)mode reply:(void (^)(void))reply;
 - (void)setFullSyncLastSuccess:(NSDate *)date reply:(void (^)(void))reply;
 - (void)setRuleSyncLastSuccess:(NSDate *)date reply:(void (^)(void))reply;
-- (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)(void))reply;
+- (void)setSyncTypeRequired:(SNTSyncType)syncType reply:(void (^)(void))reply;
 - (void)setAllowedPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
 - (void)setBlockedPathRegex:(NSString *)pattern reply:(void (^)(void))reply;
 - (void)setBlockUSBMount:(BOOL)enabled reply:(void (^)(void))reply;
@@ -53,6 +52,7 @@
 - (void)setEnableTransitiveRules:(BOOL)enabled reply:(void (^)(void))reply;
 - (void)setEnableAllEventUpload:(BOOL)enabled reply:(void (^)(void))reply;
 - (void)setDisableUnknownEventUpload:(BOOL)enabled reply:(void (^)(void))reply;
+- (void)setOverrideFileAccessAction:(NSString *)action reply:(void (^)(void))reply;
 
 ///
 ///  Syncd Ops

Source/common/SNTXPCControlInterface.m

@@ -34,8 +34,7 @@ NSString *const kBundleID = @"com.google.santa.daemon";
 #else
   MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithSelf];
   // "teamid.com.google.santa.daemon.xpc"
-  NSString *t = cs.signingInformation[@"teamid"];
-  return [NSString stringWithFormat:@"%@.%@.xpc", t, kBundleID];
+  return [NSString stringWithFormat:@"%@.%@.xpc", cs.teamID, kBundleID];
 #endif
 }
 
@@ -50,9 +49,14 @@ NSString *const kBundleID = @"com.google.santa.daemon";
           ofReply:YES];
 
   [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTRule class], nil]
-      forSelector:@selector(databaseRuleAddRules:cleanSlate:reply:)
+      forSelector:@selector(databaseRuleAddRules:ruleCleanup:reply:)
     argumentIndex:0
           ofReply:NO];
+
+  [r setClasses:[NSSet setWithObjects:[NSArray class], [SNTRule class], nil]
+      forSelector:@selector(retrieveAllRules:)
+    argumentIndex:0
+          ofReply:YES];
 }
 
 + (NSXPCInterface *)controlInterface {

Source/common/SNTXPCNotifierInterface.h

@@ -23,10 +23,14 @@
 
 /// Protocol implemented by SantaGUI and utilized by santad
 @protocol SNTNotifierXPC
-- (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
+- (void)postBlockNotification:(SNTStoredEvent *)event
+            withCustomMessage:(NSString *)message
+                 andCustomURL:(NSString *)url;
 - (void)postUSBBlockNotification:(SNTDeviceEvent *)event withCustomMessage:(NSString *)message;
 - (void)postFileAccessBlockNotification:(SNTFileAccessEvent *)event
-                      withCustomMessage:(NSString *)message API_AVAILABLE(macos(13.0));
+                          customMessage:(NSString *)message
+                              customURL:(NSString *)url
+                             customText:(NSString *)text API_AVAILABLE(macos(13.0));
 - (void)postClientModeNotification:(SNTClientMode)clientmode;
 - (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message;
 - (void)updateCountsForEvent:(SNTStoredEvent *)event

Source/common/SNTXPCSyncServiceInterface.h

@@ -44,7 +44,7 @@
 // Pass true to isClean to perform a clean sync, defaults to false.
 //
 - (void)syncWithLogListener:(NSXPCListenerEndpoint *)logListener
-                    isClean:(BOOL)cleanSync
+                   syncType:(SNTSyncType)syncType
                       reply:(void (^)(SNTSyncStatusType))reply;
 
 // Spindown the syncservice. The syncservice will not automatically start back up.

Source/common/SNTXPCUnprivilegedControlInterface.h

@@ -16,12 +16,23 @@
 #import <MOLCertificate/MOLCertificate.h>
 
 #import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTRuleIdentifiers.h"
 #import "Source/common/SantaVnode.h"
 
 @class SNTRule;
 @class SNTStoredEvent;
 @class MOLXPCConnection;
 
+struct RuleCounts {
+  int64_t binary;
+  int64_t certificate;
+  int64_t compiler;
+  int64_t transitive;
+  int64_t teamID;
+  int64_t signingID;
+  int64_t cdhash;
+};
+
 ///
 ///  Protocol implemented by santad and utilized by santactl (unprivileged operations)
 ///
@@ -36,8 +47,7 @@
 ///
 ///  Database ops
 ///
-- (void)databaseRuleCounts:(void (^)(int64_t binary, int64_t certificate, int64_t compiler,
-                                     int64_t transitive, int64_t teamID, int64_t signingID))reply;
+- (void)databaseRuleCounts:(void (^)(struct RuleCounts ruleCounts))reply;
 - (void)databaseEventCount:(void (^)(int64_t count))reply;
 - (void)staticRuleCount:(void (^)(int64_t count))reply;
 
@@ -47,17 +57,10 @@
 
 ///
 ///  @param filePath A Path to the file, can be nil.
-///  @param fileSHA256 The pre-calculated SHA256 hash for the file, can be nil. If nil the hash will
-///                    be calculated by this method from the filePath.
-///  @param certificateSHA256 A SHA256 hash of the signing certificate, can be nil.
-///  @note If fileInfo and signingCertificate are both passed in, the most specific rule will be
-///        returned. Binary rules take precedence over cert rules.
+///  @param identifiers The various identifiers to be used when making a decision.
 ///
 - (void)decisionForFilePath:(NSString *)filePath
-                 fileSHA256:(NSString *)fileSHA256
-          certificateSHA256:(NSString *)certificateSHA256
-                     teamID:(NSString *)teamID
-                  signingID:(NSString *)signingID
+                identifiers:(SNTRuleIdentifiers *)identifiers
                       reply:(void (^)(SNTEventState))reply;
 
 ///
@@ -68,9 +71,11 @@
 - (void)clientMode:(void (^)(SNTClientMode))reply;
 - (void)fullSyncLastSuccess:(void (^)(NSDate *))reply;
 - (void)ruleSyncLastSuccess:(void (^)(NSDate *))reply;
-- (void)syncCleanRequired:(void (^)(BOOL))reply;
+- (void)syncTypeRequired:(void (^)(SNTSyncType))reply;
 - (void)enableBundles:(void (^)(BOOL))reply;
 - (void)enableTransitiveRules:(void (^)(BOOL))reply;
+- (void)blockUSBMount:(void (^)(BOOL))reply;
+- (void)remountUSBMode:(void (^)(NSArray<NSString *> *))reply;
 
 ///
 /// Metrics ops

Source/common/SantaCache.h

@@ -320,8 +320,8 @@ class SantaCache {
     Lock a bucket. Spins until the lock is acquired.
   */
   inline void lock(struct bucket *bucket) const {
-    while (OSAtomicTestAndSet(7, (volatile uint8_t *)&bucket->head))
-      ;
+    while (OSAtomicTestAndSet(7, (volatile uint8_t *)&bucket->head)) {
+    }
   }
 
   /**

Source/common/SantaCacheTest.mm

@@ -245,7 +245,7 @@ struct S {
   uint64_t first_val;
   uint64_t second_val;
 
-  bool operator==(const S &rhs) {
+  bool operator==(const S &rhs) const {
     return first_val == rhs.first_val && second_val == rhs.second_val;
   }
 };

Source/common/ScopedCFTypeRef.h

@@ -0,0 +1,29 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SCOPEDCFTYPEREF_H
+#define SANTA__COMMON__SCOPEDCFTYPEREF_H
+
+#include <CoreFoundation/CoreFoundation.h>
+
+#include "Source/common/ScopedTypeRef.h"
+
+namespace santa {
+
+template <typename CFT>
+using ScopedCFTypeRef = ScopedTypeRef<CFT, (CFT)NULL, CFRetain, CFRelease>;
+
+}  // namespace santa
+
+#endif

Source/common/ScopedCFTypeRefTest.mm

@@ -0,0 +1,141 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+#import <XCTest/XCTest.h>
+#include "XCTest/XCTest.h"
+
+#include "Source/common/ScopedCFTypeRef.h"
+
+using santa::ScopedCFTypeRef;
+
+@interface ScopedCFTypeRefTest : XCTestCase
+@end
+
+@implementation ScopedCFTypeRefTest
+
+- (void)testDefaultConstruction {
+  // Default construction creates wraps a NULL object
+  ScopedCFTypeRef<CFNumberRef> scopedRef;
+  XCTAssertFalse(scopedRef.Unsafe());
+}
+
+- (void)testOperatorBool {
+  // Operator bool is `false` when object is null
+  {
+    ScopedCFTypeRef<CFNumberRef> scopedNullRef;
+    XCTAssertFalse(scopedNullRef.Unsafe());
+    XCTAssertFalse(scopedNullRef);
+  }
+
+  // Operator bool is `true` when object is NOT null
+  {
+    int x = 123;
+    CFNumberRef numRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &x);
+
+    ScopedCFTypeRef<CFNumberRef> scopedNumRef = ScopedCFTypeRef<CFNumberRef>::Assume(numRef);
+    XCTAssertTrue(scopedNumRef.Unsafe());
+    XCTAssertTrue(scopedNumRef);
+  }
+}
+
+// Note that CFMutableArray is used for testing, even when subtypes aren't
+// needed, because it is never optimized into immortal constant values, unlike
+// other types.
+- (void)testAssume {
+  int want = 123;
+  int got = 0;
+  CFMutableArrayRef array = CFArrayCreateMutable(nullptr, /*capacity=*/0, &kCFTypeArrayCallBacks);
+
+  // Baseline state, initial retain count is 1 after object creation
+  XCTAssertEqual(1, CFGetRetainCount(array));
+
+  CFNumberRef numRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &want);
+  CFArrayAppendValue(array, numRef);
+  CFRelease(numRef);
+
+  XCTAssertEqual(1, CFArrayGetCount(array));
+
+  {
+    ScopedCFTypeRef<CFMutableArrayRef> scopedArray =
+      ScopedCFTypeRef<CFMutableArrayRef>::Assume(array);
+
+    // Ensure ownership was taken, and retain count remains unchanged
+    XCTAssertTrue(scopedArray.Unsafe());
+    XCTAssertEqual(1, CFGetRetainCount(scopedArray.Unsafe()));
+
+    // Make sure the object contains expected contents
+    CFMutableArrayRef ref = scopedArray.Unsafe();
+    XCTAssertEqual(1, CFArrayGetCount(ref));
+    XCTAssertTrue(
+      CFNumberGetValue((CFNumberRef)CFArrayGetValueAtIndex(ref, 0), kCFNumberIntType, &got));
+    XCTAssertEqual(want, got);
+  }
+}
+
+// Note that CFMutableArray is used for testing, even when subtypes aren't
+// needed, because it is never optimized into immortal constant values, unlike
+// other types.
+- (void)testRetain {
+  int want = 123;
+  int got = 0;
+  CFMutableArrayRef array = CFArrayCreateMutable(nullptr, /*capacity=*/0, &kCFTypeArrayCallBacks);
+
+  // Baseline state, initial retain count is 1 after object creation
+  XCTAssertEqual(1, CFGetRetainCount(array));
+
+  CFNumberRef numRef = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &want);
+  CFArrayAppendValue(array, numRef);
+  CFRelease(numRef);
+
+  XCTAssertEqual(1, CFArrayGetCount(array));
+
+  {
+    ScopedCFTypeRef<CFMutableArrayRef> scopedArray =
+      ScopedCFTypeRef<CFMutableArrayRef>::Retain(array);
+
+    // Ensure ownership was taken, and retain count was incremented
+    XCTAssertTrue(scopedArray.Unsafe());
+    XCTAssertEqual(2, CFGetRetainCount(scopedArray.Unsafe()));
+
+    // Make sure the object contains expected contents
+    CFMutableArrayRef ref = scopedArray.Unsafe();
+    XCTAssertEqual(1, CFArrayGetCount(ref));
+    XCTAssertTrue(
+      CFNumberGetValue((CFNumberRef)CFArrayGetValueAtIndex(ref, 0), kCFNumberIntType, &got));
+    XCTAssertEqual(want, got);
+  }
+
+  // The original `array` object should still be valid due to the extra retain.
+  // Ensure the retain count has decreased since `scopedArray` went out of scope
+  XCTAssertEqual(1, CFArrayGetCount(array));
+}
+
+- (void)testInto {
+  ScopedCFTypeRef<CFURLRef> scopedURLRef =
+    ScopedCFTypeRef<CFURLRef>::Assume(CFURLCreateWithFileSystemPath(
+      kCFAllocatorDefault, CFSTR("/usr/bin/true"), kCFURLPOSIXPathStyle, YES));
+
+  ScopedCFTypeRef<SecStaticCodeRef> scopedCodeRef;
+  XCTAssertFalse(scopedCodeRef);
+
+  SecStaticCodeCreateWithPath(scopedURLRef.Unsafe(), kSecCSDefaultFlags,
+                              scopedCodeRef.InitializeInto());
+
+  // Ensure the scoped object was initialized
+  XCTAssertTrue(scopedCodeRef);
+}
+
+@end

Source/common/ScopedIOObjectRef.h

@@ -0,0 +1,30 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SCOPEDIOOBJECTREF_H
+#define SANTA__COMMON__SCOPEDIOOBJECTREF_H
+
+#include <IOKit/IOKitLib.h>
+
+#include "Source/common/ScopedTypeRef.h"
+
+namespace santa {
+
+template <typename IOT>
+using ScopedIOObjectRef =
+    ScopedTypeRef<IOT, (IOT)IO_OBJECT_NULL, IOObjectRetain, IOObjectRelease>;
+
+}
+
+#endif  // namespace santa

Source/common/ScopedIOObjectRefTest.mm

@@ -0,0 +1,104 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <IOKit/IOKitLib.h>
+#include <IOKit/usb/IOUSBLib.h>
+#import <XCTest/XCTest.h>
+
+#include "Source/common/ScopedIOObjectRef.h"
+#include "Source/santad/Logs/EndpointSecurity/Serializers/Utilities.h"
+
+using santa::GetDefaultIOKitCommsPort;
+using santa::ScopedIOObjectRef;
+
+@interface ScopedIOObjectRefTest : XCTestCase
+@end
+
+@implementation ScopedIOObjectRefTest
+
+- (void)testDefaultConstruction {
+  // Default construction creates wraps a NULL object
+  ScopedIOObjectRef<io_object_t> scopedRef;
+  XCTAssertFalse(scopedRef.Unsafe());
+}
+
+- (void)testOperatorBool {
+  // Operator bool is `false` when object is null
+  {
+    ScopedIOObjectRef<io_object_t> scopedNullRef;
+    XCTAssertFalse(scopedNullRef.Unsafe());
+    XCTAssertFalse(scopedNullRef);
+  }
+
+  // Operator bool is `true` when object is NOT null
+  {
+    CFMutableDictionaryRef matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
+    XCTAssertNotEqual((CFMutableDictionaryRef)NULL, matchingDict);
+
+    io_service_t service = IOServiceGetMatchingService(GetDefaultIOKitCommsPort(), matchingDict);
+
+    ScopedIOObjectRef<io_service_t> scopedServiceRef =
+      ScopedIOObjectRef<io_service_t>::Assume(service);
+
+    XCTAssertTrue(scopedServiceRef.Unsafe());
+    XCTAssertTrue(scopedServiceRef);
+  }
+}
+
+- (void)testAssume {
+  CFMutableDictionaryRef matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
+  XCTAssertNotEqual((CFMutableDictionaryRef)NULL, matchingDict);
+
+  io_service_t service = IOServiceGetMatchingService(GetDefaultIOKitCommsPort(), matchingDict);
+
+  // Baseline state, initial retain count is 1 after object creation
+  XCTAssertEqual(1, IOObjectGetUserRetainCount(service));
+  XCTAssertNotEqual(IO_OBJECT_NULL, service);
+
+  {
+    ScopedIOObjectRef<io_service_t> scopedIORef = ScopedIOObjectRef<io_service_t>::Assume(service);
+
+    // Ensure ownership was taken, and retain count remains unchanged
+    XCTAssertTrue(scopedIORef.Unsafe());
+    XCTAssertEqual(1, IOObjectGetUserRetainCount(scopedIORef.Unsafe()));
+    XCTAssertNotEqual(IO_OBJECT_NULL, scopedIORef.Unsafe());
+  }
+}
+
+- (void)testRetain {
+  CFMutableDictionaryRef matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
+  XCTAssertNotEqual((CFMutableDictionaryRef)NULL, matchingDict);
+
+  io_service_t service = IOServiceGetMatchingService(GetDefaultIOKitCommsPort(), matchingDict);
+
+  // Baseline state, initial retain count is 1 after object creation
+  XCTAssertEqual(1, IOObjectGetUserRetainCount(service));
+  XCTAssertNotEqual(IO_OBJECT_NULL, service);
+
+  {
+    ScopedIOObjectRef<io_service_t> scopedIORef = ScopedIOObjectRef<io_service_t>::Retain(service);
+
+    // Ensure ownership was taken, and retain count was incremented
+    XCTAssertTrue(scopedIORef.Unsafe());
+    XCTAssertEqual(2, IOObjectGetUserRetainCount(scopedIORef.Unsafe()));
+    XCTAssertNotEqual(IO_OBJECT_NULL, scopedIORef.Unsafe());
+  }
+
+  // The original `service` object should still be valid due to the extra retain.
+  // Ensure the retain count has decreased since `scopedIORef` went out of scope.
+  XCTAssertEqual(1, IOObjectGetUserRetainCount(service));
+}
+
+@end

Source/common/ScopedTypeRef.h

@@ -0,0 +1,80 @@
+/// Copyright 2023 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#ifndef SANTA__COMMON__SCOPEDTYPEREF_H
+#define SANTA__COMMON__SCOPEDTYPEREF_H
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <assert.h>
+
+namespace santa {
+
+template <typename ElementT, ElementT InvalidV, auto RetainFunc,
+          auto ReleaseFunc>
+class ScopedTypeRef {
+ public:
+  ScopedTypeRef() : object_(InvalidV) {}
+
+  // Can be implemented safely, but not currently needed
+  ScopedTypeRef(ScopedTypeRef&& other) = delete;
+  ScopedTypeRef& operator=(ScopedTypeRef&& rhs) = delete;
+  ScopedTypeRef(const ScopedTypeRef& other) = delete;
+  ScopedTypeRef& operator=(const ScopedTypeRef& other) = delete;
+
+  // Take ownership of a given object
+  static ScopedTypeRef<ElementT, InvalidV, RetainFunc, ReleaseFunc> Assume(
+      ElementT object) {
+    return ScopedTypeRef<ElementT, InvalidV, RetainFunc, ReleaseFunc>(object);
+  }
+
+  // Retain and take ownership of a given object
+  static ScopedTypeRef<ElementT, InvalidV, RetainFunc, ReleaseFunc> Retain(
+      ElementT object) {
+    if (object) {
+      RetainFunc(object);
+    }
+    return ScopedTypeRef<ElementT, InvalidV, RetainFunc, ReleaseFunc>(object);
+  }
+
+  ~ScopedTypeRef() {
+    if (object_) {
+      ReleaseFunc(object_);
+      object_ = InvalidV;
+    }
+  }
+
+  explicit operator bool() { return object_ != InvalidV; }
+
+  ElementT Unsafe() { return object_; }
+
+  // This is to be used only to take ownership of objects that are created by
+  // pass-by-pointer create functions. The object must not already be valid.
+  // In non-opt builds, this is enforced by an assert that will terminate the
+  // process.
+  ElementT* InitializeInto() {
+    assert(object_ == InvalidV);
+    return &object_;
+  }
+
+ private:
+  // Not API.
+  // Use Assume or Retain static methods.
+  ScopedTypeRef(ElementT object) : object_(object) {}
+
+  ElementT object_;
+};
+
+}  // namespace santa
+
+#endif

Source/common/SigningIDHelpers.h

@@ -0,0 +1,30 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+#import <MOLCodesignChecker/MOLCodesignChecker.h>
+
+__BEGIN_DECLS
+
+/**
+  Return a string representing normalized SigningID (prefixed with TeamID and a
+  colon).
+
+  @param csc A MOLCodesignChecker instance
+
+  @return An NSString formated as teamID:signingID or nil if there isn't a valid signing ID.
+*/
+NSString *FormatSigningID(MOLCodesignChecker *csc);
+
+__END_DECLS

Source/common/SigningIDHelpers.m

@@ -0,0 +1,33 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import "Source/common/SigningIDHelpers.h"
+#import "Source/common/SNTLogging.h"
+
+NSString *FormatSigningID(MOLCodesignChecker *csc) {
+  if (!csc.signingID.length) {
+    return nil;
+  }
+
+  if (!csc.teamID.length) {
+    if (csc.platformBinary) {
+      return [NSString stringWithFormat:@"%@:%@", @"platform", csc.signingID];
+    } else {
+      LOGD(@"unable to format signing ID missing team ID for non-platform binary");
+      return nil;
+    }
+  }
+
+  return [NSString stringWithFormat:@"%@:%@", csc.teamID, csc.signingID];
+}

Source/common/String.h

@@ -15,12 +15,14 @@
 #ifndef SANTA__COMMON__STRING_H
 #define SANTA__COMMON__STRING_H
 
+#include <EndpointSecurity/ESTypes.h>
 #include <Foundation/Foundation.h>
 
+#include <optional>
 #include <string>
 #include <string_view>
 
-namespace santa::common {
+namespace santa {
 
 static inline std::string_view NSStringToUTF8StringView(NSString *str) {
   return std::string_view(str.UTF8String, [str lengthOfBytesUsingEncoding:NSUTF8StringEncoding]);
@@ -38,6 +40,19 @@ static inline NSString *StringToNSString(const char *str) {
   return [NSString stringWithUTF8String:str];
 }
 
-}  // namespace santa::common
+static inline NSString *OptionalStringToNSString(const std::optional<std::string> &optional_str) {
+  std::string str = optional_str.value_or("");
+  if (str.length() == 0) {
+    return nil;
+  } else {
+    return StringToNSString(str);
+  }
+}
+
+static inline std::string_view StringTokenToStringView(es_string_token_t es_str) {
+  return std::string_view(es_str.data, es_str.length);
+}
+
+}  // namespace santa
 
 #endif

Source/common/TestUtils.h

@@ -22,6 +22,8 @@
 #include <gtest/gtest.h>
 #include <sys/stat.h>
 
+#include <string>
+
 #define NOBODY_UID ((unsigned int)-2)
 #define NOGROUP_GID ((unsigned int)-1)
 
@@ -38,6 +40,10 @@
 // Pretty print C++ string match errors
 #define XCTAssertCppStringEqual(got, want) XCTAssertCStringEqual((got).c_str(), (want).c_str())
 
+#define XCTAssertCppStringBeginsWith(got, want)                                               \
+  XCTAssertTrue((got).rfind((want), 0) == 0, "\nPrefix not found.\n\t got: %s\n\twant: %s\n", \
+                (got).c_str(), (want).c_str())
+
 // Note: Delta between local formatter and the one run on Github. Disable for now.
 // clang-format off
 #define XCTAssertSemaTrue(s, sec, m) \
@@ -49,15 +55,18 @@
 // function returns early due to interrupts.
 void SleepMS(long ms);
 
-enum class ActionType {
-  Auth,
-  Notify,
-};
+// Helper to construct strings of a given length
+NSString *RepeatedString(NSString *str, NSUInteger len);
 
 //
 // Helpers to construct various ES structs
 //
 
+enum class ActionType {
+  Auth,
+  Notify,
+};
+
 audit_token_t MakeAuditToken(pid_t pid, pid_t pidver);
 
 /// Construct a `struct stat` buffer with each member having a unique value.
@@ -67,12 +76,13 @@ audit_token_t MakeAuditToken(pid_t pid, pid_t pidver);
 struct stat MakeStat(int offset = 0);
 
 es_string_token_t MakeESStringToken(const char *s);
-es_file_t MakeESFile(const char *path, struct stat sb = {});
+es_file_t MakeESFile(const char *path, struct stat sb = MakeStat());
 es_process_t MakeESProcess(es_file_t *file, audit_token_t tok = {}, audit_token_t parent_tok = {});
 es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc,
                            ActionType action_type = ActionType::Notify,
                            uint64_t future_deadline_ms = 100000);
 
 uint32_t MaxSupportedESMessageVersionForCurrentOS();
+uint32_t MinSupportedESMessageVersion(es_event_type_t event_type);
 
 #endif

Source/common/TestUtils.mm

@@ -19,8 +19,14 @@
 #include <mach/mach_time.h>
 #include <time.h>
 #include <uuid/uuid.h>
+
+#include "Source/common/Platform.h"
 #include "Source/common/SystemResources.h"
 
+NSString *RepeatedString(NSString *str, NSUInteger len) {
+  return [@"" stringByPaddingToLength:len withString:str startingAtIndex:0];
+}
+
 audit_token_t MakeAuditToken(pid_t pid, pid_t pidver) {
   return audit_token_t{
     .val =
@@ -60,7 +66,7 @@ struct stat MakeStat(int offset) {
 
 es_string_token_t MakeESStringToken(const char *s) {
   return es_string_token_t{
-    .length = strlen(s),
+    .length = s ? strlen(s) : 0,
     .data = s,
   };
 }
@@ -87,21 +93,6 @@ es_process_t MakeESProcess(es_file_t *file, audit_token_t tok, audit_token_t par
   };
 }
 
-uint32_t MaxSupportedESMessageVersionForCurrentOS() {
-  // Note: ES message v3 was only in betas.
-  if (@available(macOS 13.0, *)) {
-    return 6;
-  } else if (@available(macOS 12.3, *)) {
-    return 5;
-  } else if (@available(macOS 11.0, *)) {
-    return 4;
-  } else if (@available(macOS 10.15.4, *)) {
-    return 2;
-  } else {
-    return 1;
-  }
-}
-
 es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc, ActionType action_type,
                            uint64_t future_deadline_ms) {
   es_message_t es_msg = {
@@ -126,3 +117,204 @@ void SleepMS(long ms) {
     XCTAssertEqual(errno, EINTR);
   }
 }
+
+uint32_t MaxSupportedESMessageVersionForCurrentOS() {
+  // Note 1: This function only returns a subset of versions. This is due to the
+  // minimum supported OS build version as well as features in latest versions
+  // not currently being used. Capping the max means unnecessary duuplicate test
+  // JSON files are not needed.
+  //
+  // Note 2: The following table maps ES message versions to lmin macOS version:
+  //   ES Version | macOS Version
+  //            1 | 10.15.0
+  //            2 | 10.15.4
+  //            3 | Only in a beta
+  //            4 | 11.0
+  //            5 | 12.3
+  //            6 | 13.0
+  //            7 | 14.0
+  //            8 | 15.0
+  if (@available(macOS 13.0, *)) {
+    return 6;
+  } else if (@available(macOS 12.3, *)) {
+    return 5;
+  } else {
+    return 4;
+  }
+}
+
+uint32_t MinSupportedESMessageVersion(es_event_type_t event_type) {
+  switch (event_type) {
+    // The following events are available beginning in macOS 10.15
+    case ES_EVENT_TYPE_AUTH_EXEC:
+    case ES_EVENT_TYPE_AUTH_OPEN:
+    case ES_EVENT_TYPE_AUTH_KEXTLOAD:
+    case ES_EVENT_TYPE_AUTH_MMAP:
+    case ES_EVENT_TYPE_AUTH_MPROTECT:
+    case ES_EVENT_TYPE_AUTH_MOUNT:
+    case ES_EVENT_TYPE_AUTH_RENAME:
+    case ES_EVENT_TYPE_AUTH_SIGNAL:
+    case ES_EVENT_TYPE_AUTH_UNLINK:
+    case ES_EVENT_TYPE_NOTIFY_EXEC:
+    case ES_EVENT_TYPE_NOTIFY_OPEN:
+    case ES_EVENT_TYPE_NOTIFY_FORK:
+    case ES_EVENT_TYPE_NOTIFY_CLOSE:
+    case ES_EVENT_TYPE_NOTIFY_CREATE:
+    case ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA:
+    case ES_EVENT_TYPE_NOTIFY_EXIT:
+    case ES_EVENT_TYPE_NOTIFY_GET_TASK:
+    case ES_EVENT_TYPE_NOTIFY_KEXTLOAD:
+    case ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD:
+    case ES_EVENT_TYPE_NOTIFY_LINK:
+    case ES_EVENT_TYPE_NOTIFY_MMAP:
+    case ES_EVENT_TYPE_NOTIFY_MPROTECT:
+    case ES_EVENT_TYPE_NOTIFY_MOUNT:
+    case ES_EVENT_TYPE_NOTIFY_UNMOUNT:
+    case ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN:
+    case ES_EVENT_TYPE_NOTIFY_RENAME:
+    case ES_EVENT_TYPE_NOTIFY_SETATTRLIST:
+    case ES_EVENT_TYPE_NOTIFY_SETEXTATTR:
+    case ES_EVENT_TYPE_NOTIFY_SETFLAGS:
+    case ES_EVENT_TYPE_NOTIFY_SETMODE:
+    case ES_EVENT_TYPE_NOTIFY_SETOWNER:
+    case ES_EVENT_TYPE_NOTIFY_SIGNAL:
+    case ES_EVENT_TYPE_NOTIFY_UNLINK:
+    case ES_EVENT_TYPE_NOTIFY_WRITE:
+    case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE:
+    case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE:
+    case ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE:
+    case ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE:
+    case ES_EVENT_TYPE_AUTH_READLINK:
+    case ES_EVENT_TYPE_NOTIFY_READLINK:
+    case ES_EVENT_TYPE_AUTH_TRUNCATE:
+    case ES_EVENT_TYPE_NOTIFY_TRUNCATE:
+    case ES_EVENT_TYPE_AUTH_LINK:
+    case ES_EVENT_TYPE_NOTIFY_LOOKUP:
+    case ES_EVENT_TYPE_AUTH_CREATE:
+    case ES_EVENT_TYPE_AUTH_SETATTRLIST:
+    case ES_EVENT_TYPE_AUTH_SETEXTATTR:
+    case ES_EVENT_TYPE_AUTH_SETFLAGS:
+    case ES_EVENT_TYPE_AUTH_SETMODE:
+    case ES_EVENT_TYPE_AUTH_SETOWNER: return 1;
+
+    // The following events are available beginning in macOS 10.15.1
+    case ES_EVENT_TYPE_AUTH_CHDIR:
+    case ES_EVENT_TYPE_NOTIFY_CHDIR:
+    case ES_EVENT_TYPE_AUTH_GETATTRLIST:
+    case ES_EVENT_TYPE_NOTIFY_GETATTRLIST:
+    case ES_EVENT_TYPE_NOTIFY_STAT:
+    case ES_EVENT_TYPE_NOTIFY_ACCESS:
+    case ES_EVENT_TYPE_AUTH_CHROOT:
+    case ES_EVENT_TYPE_NOTIFY_CHROOT:
+    case ES_EVENT_TYPE_AUTH_UTIMES:
+    case ES_EVENT_TYPE_NOTIFY_UTIMES:
+    case ES_EVENT_TYPE_AUTH_CLONE:
+    case ES_EVENT_TYPE_NOTIFY_CLONE:
+    case ES_EVENT_TYPE_NOTIFY_FCNTL:
+    case ES_EVENT_TYPE_AUTH_GETEXTATTR:
+    case ES_EVENT_TYPE_NOTIFY_GETEXTATTR:
+    case ES_EVENT_TYPE_AUTH_LISTEXTATTR:
+    case ES_EVENT_TYPE_NOTIFY_LISTEXTATTR:
+    case ES_EVENT_TYPE_AUTH_READDIR:
+    case ES_EVENT_TYPE_NOTIFY_READDIR:
+    case ES_EVENT_TYPE_AUTH_DELETEEXTATTR:
+    case ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR:
+    case ES_EVENT_TYPE_AUTH_FSGETPATH:
+    case ES_EVENT_TYPE_NOTIFY_FSGETPATH:
+    case ES_EVENT_TYPE_NOTIFY_DUP:
+    case ES_EVENT_TYPE_AUTH_SETTIME:
+    case ES_EVENT_TYPE_NOTIFY_SETTIME:
+    case ES_EVENT_TYPE_NOTIFY_UIPC_BIND:
+    case ES_EVENT_TYPE_AUTH_UIPC_BIND:
+    case ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT:
+    case ES_EVENT_TYPE_AUTH_UIPC_CONNECT:
+    case ES_EVENT_TYPE_AUTH_EXCHANGEDATA:
+    case ES_EVENT_TYPE_AUTH_SETACL:
+    case ES_EVENT_TYPE_NOTIFY_SETACL: return 1;
+
+    // The following events are available beginning in macOS 10.15.4
+    case ES_EVENT_TYPE_NOTIFY_PTY_GRANT:
+    case ES_EVENT_TYPE_NOTIFY_PTY_CLOSE:
+    case ES_EVENT_TYPE_AUTH_PROC_CHECK:
+    case ES_EVENT_TYPE_NOTIFY_PROC_CHECK:
+    case ES_EVENT_TYPE_AUTH_GET_TASK: return 2;
+
+    // The following events are available beginning in macOS 11.0
+    case ES_EVENT_TYPE_AUTH_SEARCHFS:
+    case ES_EVENT_TYPE_NOTIFY_SEARCHFS:
+    case ES_EVENT_TYPE_AUTH_FCNTL:
+    case ES_EVENT_TYPE_AUTH_IOKIT_OPEN:
+    case ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME:
+    case ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME:
+    case ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED:
+    case ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME:
+    case ES_EVENT_TYPE_NOTIFY_TRACE:
+    case ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE:
+    case ES_EVENT_TYPE_AUTH_REMOUNT:
+    case ES_EVENT_TYPE_NOTIFY_REMOUNT: return 4;
+
+    // The following events are available beginning in macOS 11.3
+    case ES_EVENT_TYPE_AUTH_GET_TASK_READ:
+    case ES_EVENT_TYPE_NOTIFY_GET_TASK_READ:
+    case ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT: return 4;
+
+    // The following events are available beginning in macOS 12.0
+    case ES_EVENT_TYPE_NOTIFY_SETUID:
+    case ES_EVENT_TYPE_NOTIFY_SETGID:
+    case ES_EVENT_TYPE_NOTIFY_SETEUID:
+    case ES_EVENT_TYPE_NOTIFY_SETEGID:
+    case ES_EVENT_TYPE_NOTIFY_SETREUID:
+    case ES_EVENT_TYPE_NOTIFY_SETREGID:
+    case ES_EVENT_TYPE_AUTH_COPYFILE:
+    case ES_EVENT_TYPE_NOTIFY_COPYFILE: return 4;
+
+#if HAVE_MACOS_13
+    // The following events are available beginning in macOS 13.0
+    case ES_EVENT_TYPE_NOTIFY_AUTHENTICATION:
+    case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED:
+    case ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED:
+    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN:
+    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT:
+    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK:
+    case ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK:
+    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH:
+    case ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH:
+    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN:
+    case ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT:
+    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN:
+    case ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT:
+    case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD:
+    case ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE: return 6;
+#endif
+
+#if HAVE_MACOS_14
+    // The following events are available beginning in macOS 14.0
+    case ES_EVENT_TYPE_NOTIFY_PROFILE_ADD:
+    case ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE:
+    case ES_EVENT_TYPE_NOTIFY_SU:
+    case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION:
+    case ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT:
+    case ES_EVENT_TYPE_NOTIFY_SUDO:
+    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD:
+    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE:
+    case ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET:
+    case ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD:
+    case ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER:
+    case ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER:
+    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD:
+    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE:
+    case ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET:
+    case ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER:
+    case ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP:
+    case ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER:
+    case ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP:
+    case ES_EVENT_TYPE_NOTIFY_XPC_CONNECT: return 7;
+#endif
+
+#if HAVE_MACOS_15
+    case ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE: return 8;
+#endif
+
+    default: return UINT32_MAX;
+  }
+}

Source/common/Unit.h

@@ -15,10 +15,10 @@
 #ifndef SANTA__COMMON__UNIT_H
 #define SANTA__COMMON__UNIT_H
 
-namespace santa::common {
+namespace santa {
 
 struct Unit {};
 
-}  // namespace santa::common
+}  // namespace santa
 
 #endif

Source/common/santa.proto

@@ -4,6 +4,7 @@ syntax = "proto3";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/timestamp.proto";
+import "Source/santad/ProcessTree/process_tree.proto";
 
 option objc_class_prefix = "SNTPB";
 
@@ -173,6 +174,8 @@ message ProcessInfo {
 
   // Time the process was started
   optional google.protobuf.Timestamp start_time = 17;
+
+  optional process_tree.Annotations annotations = 18;
 }
 
 // Light variant of ProcessInfo message to help minimize on-disk/on-wire sizes
@@ -202,6 +205,8 @@ message ProcessInfoLight {
 
   // File information for the executable backing this process
   optional FileInfoLight executable = 10;
+
+  optional process_tree.Annotations annotations = 11;
 }
 
 // Certificate information
@@ -213,6 +218,27 @@ message CertificateInfo {
   optional string common_name = 2;
 }
 
+// Information about a single entitlement key/value pair
+message Entitlement {
+  // The name of an entitlement
+  optional string key = 1;
+
+  // The value of an entitlement
+  optional string value = 2;
+}
+
+// Information about entitlements
+message EntitlementInfo {
+  // Whether or not the set of reported entilements is complete or has been
+  // filtered (e.g. by configuration or clipped because too many to log).
+  optional bool entitlements_filtered = 1;
+
+  // The set of entitlements associated with the target executable
+  // Only top level keys are represented
+  // Values (including nested keys) are JSON serialized
+  repeated Entitlement entitlements = 2;
+}
+
 // Information about a process execution event
 message Execution {
   // The process that executed the new image (e.g. the process that called
@@ -263,6 +289,7 @@ message Execution {
     REASON_LONG_PATH = 9;
     REASON_NOT_RUNNING = 10;
     REASON_SIGNING_ID = 11;
+    REASON_CDHASH = 12;
   }
   optional Reason reason = 10;
 
@@ -286,6 +313,9 @@ message Execution {
   // The original path on disk of the target executable
   // Applies when executables are translocated
   optional string original_path = 15;
+
+  // Entitlement information about the target executbale
+  optional EntitlementInfo entitlement_info = 16;
 }
 
 // Information about a fork event
@@ -381,6 +411,11 @@ message Unlink {
   optional FileInfo target = 2;
 }
 
+// Information about a processes codesigning invalidation event
+message CodesigningInvalidated {
+  optional ProcessInfoLight instigator = 1;
+}
+
 // Information about a link event
 message Link {
   // The process performing the link
@@ -429,6 +464,9 @@ message Disk {
 
   // Time device appeared/disappeared
   optional google.protobuf.Timestamp appearance = 10;
+
+  // Path mounted from
+  optional string mount_from = 11;
 }
 
 // Information emitted when Santa captures bundle information
@@ -500,6 +538,225 @@ message FileAccess {
   optional PolicyDecision policy_decision = 6;
 }
 
+// Session identifier for a graphical session
+// Note: Identifiers are opaque and have no meaning outside of correlating Santa
+// events with the same identifier
+message GraphicalSession {
+  optional uint32 id = 1;
+}
+
+// Information about a socket address and its type
+message SocketAddress {
+  // The socket address
+  optional bytes address = 1;
+
+  enum Type {
+    TYPE_UNKNOWN = 0;
+    TYPE_NONE = 1;
+    TYPE_IPV4 = 2;
+    TYPE_IPV6 = 3;
+    TYPE_NAMED_SOCKET = 4;
+  }
+
+  // The type of the socket address
+  optional Type type = 2;
+}
+
+// Information about a user logging in via loginwindow
+message LoginWindowSessionLogin {
+  // The process that emitted the login event
+  optional ProcessInfoLight instigator = 1;
+
+  // Name of the user logging in
+  optional UserInfo user = 2;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 3;
+}
+
+// Information about a user logging out via loginwindow
+message LoginWindowSessionLogout {
+  // The process that emitted the logout event
+  optional ProcessInfoLight instigator = 1;
+
+  // Name of the user logging out
+  optional UserInfo user = 2;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 3;
+}
+
+// Information about a user locking their session via loginwindow
+message LoginWindowSessionLock {
+  // The process that emitted the lock event
+  optional ProcessInfoLight instigator = 1;
+
+  // Name of the user locking their session
+  optional UserInfo user = 2;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 3;
+}
+
+// Information about a user unlocking their session via loginwindow
+message LoginWindowSessionUnlock {
+  // The process that emitted the unlock event
+  optional ProcessInfoLight instigator = 1;
+
+  // Name of the user unlocking their session
+  optional UserInfo user = 2;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 3;
+}
+
+// Information about loginwindow events
+message LoginWindowSession {
+  oneof event {
+    LoginWindowSessionLogin login = 1;
+    LoginWindowSessionLogout logout = 2;
+    LoginWindowSessionLock lock = 3;
+    LoginWindowSessionUnlock unlock = 4;
+  }
+}
+
+// Information about a login event from the `login(1)` utility
+message Login {
+  // The process that emitted the login event
+  optional ProcessInfoLight instigator = 1;
+
+  // Whether or not the login was successful
+  optional bool success = 2;
+
+  // Login failure message, if applicable
+  optional bytes failure_message = 3;
+
+  // Information about the user that attempted to log in
+  // Note: `uid` data may not always exist on failed attempts
+  optional UserInfo user = 4;
+}
+
+// Information about a logout event from the `login(1)` utility
+message Logout {
+  // The process that emitted the logout event
+  optional ProcessInfoLight instigator = 1;
+
+  // Information about the user that logged out
+  optional UserInfo user = 2;
+}
+
+// Information about login and logout events from the `login(1)` utility
+message LoginLogout {
+  oneof event {
+    Login login = 1;
+    Logout logout = 2;
+  }
+}
+
+// Information related to Screen Sharing attaching to a graphical session
+message ScreenSharingAttach {
+  // The process that emitted the attach event
+  optional ProcessInfoLight instigator = 1;
+
+  // Whether or not the attach was successful
+  optional bool success = 2;
+
+  // Source address information
+  optional SocketAddress source = 3;
+
+  // Apple ID of the viewer
+  optional bytes viewer = 4;
+
+  // Type of authentication used
+  optional bytes authentication_type = 5;
+
+  // User that attempted authentication, if applicable
+  optional UserInfo authentication_user = 6;
+
+  // Username of the loginwindow session, if available
+  optional UserInfo session_user = 7;
+
+  // Whether or not there was an existing session
+  optional bool existing_session = 8;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 9;
+}
+
+// Information related to Screen Sharing detaching from a graphical session
+message ScreenSharingDetach {
+  // The process that emitted the detach event
+  optional ProcessInfoLight instigator = 1;
+
+  // Source address information
+  optional SocketAddress source = 2;
+
+  // Apple ID of the viewer
+  optional bytes viewer = 3;
+
+  // Graphical session information for this session
+  optional GraphicalSession graphical_session = 4;
+}
+
+// Information about Screen Sharing attach and detach events
+message ScreenSharing {
+  oneof event {
+    ScreenSharingAttach attach = 1;
+    ScreenSharingDetach detach = 2;
+  }
+}
+
+// Information about SSH login events from the macOS OpenSSH implementation
+message OpenSSHLogin {
+  // The process that emitted the login event
+  optional ProcessInfoLight instigator = 1;
+
+  enum Result {
+    RESULT_UNKNOWN = 0;
+    RESULT_LOGIN_EXCEED_MAXTRIES = 1;
+    RESULT_LOGIN_ROOT_DENIED = 2;
+    RESULT_AUTH_SUCCESS = 3;
+    RESULT_AUTH_FAIL_NONE = 4;
+    RESULT_AUTH_FAIL_PASSWD = 5;
+    RESULT_AUTH_FAIL_KBDINT = 6;
+    RESULT_AUTH_FAIL_PUBKEY = 7;
+    RESULT_AUTH_FAIL_HOSTBASED = 8;
+    RESULT_AUTH_FAIL_GSSAPI = 9;
+    RESULT_INVALID_USER = 10;
+  }
+
+  // The result of the login attempt
+  // Note: Successful if type == `RESULT_AUTH_SUCCESS`
+  optional Result result = 2;
+
+  // Source address of the connection
+  optional SocketAddress source = 3;
+
+  // Name of the user that attempted to login
+  // Note: `uid` data may not always exist on failed attempts
+  optional UserInfo user = 4;
+}
+
+// Information about SSH logout events from the macOS OpenSSH implementation
+message OpenSSHLogout {
+  // The process that emitted the logout event
+  optional ProcessInfoLight instigator = 1;
+
+  // Source address of the connection
+  optional SocketAddress source = 2;
+
+  // Information about the user that logged out
+  optional UserInfo user = 3;
+}
+
+// Information about login/logout events from the macOS OpenSSH implementation
+message OpenSSH {
+  oneof event {
+    OpenSSHLogin login = 1;
+    OpenSSHLogout logout = 2;
+  }
+}
+
 // A message encapsulating a single event
 message SantaMessage {
   // Machine ID of the host emitting this log
@@ -526,6 +783,11 @@ message SantaMessage {
     Bundle bundle = 19;
     Allowlist allowlist = 20;
     FileAccess file_access = 21;
+    CodesigningInvalidated codesigning_invalidated = 22;
+    LoginWindowSession login_window_session = 23;
+    LoginLogout login_logout = 24;
+    ScreenSharing screen_sharing = 25;
+    OpenSSH open_ssh = 26;
   };
 }
 

Source/gui/BUILD

@@ -79,6 +79,7 @@ objc_library(
         ":SNTAboutWindowView",
         ":SNTDeviceMessageWindowView",
         ":SNTFileAccessMessageWindowView",
+        "//Source/common:CertificateHelpers",
         "//Source/common:SNTBlockMessage_SantaGUI",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTDeviceEvent",
@@ -118,7 +119,7 @@ macos_application(
         "//conditions:default": None,
     }),
     infoplists = ["Info.plist"],
-    minimum_os_version = "11.0",
+    minimum_os_version = "12.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",

Source/gui/Resources/MessageWindow.xib

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="20037" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="32700.99.1234" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
     <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="20037"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="22689"/>
         <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
     </dependencies>
     <objects>
@@ -13,23 +13,24 @@
                 <outlet property="foundFileCountLabel" destination="LHV-gV-vyf" id="Sr0-T2-xGx"/>
                 <outlet property="hashingIndicator" destination="VyY-Yg-JOe" id="Yq4-tZ-9ep"/>
                 <outlet property="openEventButton" destination="7ua-5a-uSd" id="9s4-ZA-Vlo"/>
+                <outlet property="dismissEventButton" destination="BbV-3h-mmL" id="5s4-ZB-xlo"/>
                 <outlet property="window" destination="9Bq-yh-54f" id="Uhs-WF-TV9"/>
             </connections>
         </customObject>
         <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
         <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
-            <windowStyleMask key="styleMask" utility="YES"/>
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" titlebarAppearsTransparent="YES" titleVisibility="hidden" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+            <windowStyleMask key="styleMask" titled="YES" utility="YES"/>
             <rect key="contentRect" x="167" y="107" width="540" height="479"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1728" height="1079"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="1916" height="1099"/>
             <view key="contentView" id="Iwq-Lx-rLv">
                 <rect key="frame" x="0.0" y="0.0" width="540" height="462"/>
                 <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                 <subviews>
                     <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
-                        <rect key="frame" x="16" y="434" width="37" height="32"/>
+                        <rect key="frame" x="16" y="434" width="37" height="23"/>
                         <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
+                        <buttonCell key="cell" type="roundTextured" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="texturedRounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                             <userDefinedRuntimeAttributes>
@@ -128,10 +129,6 @@
                     </textField>
                     <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
                         <rect key="frame" x="62" y="235" width="15" height="15"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
-                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
-                        </constraints>
                         <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSInfo" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
@@ -139,6 +136,10 @@
                                 <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
                             </userDefinedRuntimeAttributes>
                         </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
+                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
+                        </constraints>
                         <connections>
                             <action selector="showCertInfo:" target="-2" id="dB0-a3-X31"/>
                             <binding destination="-2" name="hidden" keyPath="self.publisherInfo" id="fFR-f3-Oiw">
@@ -241,16 +242,17 @@
                     </textField>
                     <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
                         <rect key="frame" x="147" y="30" width="126" height="32"/>
-                        <constraints>
-                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
-                        </constraints>
-                        <buttonCell key="cell" type="push" title="Open Event..." bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
+                        <buttonCell key="cell" type="push" title="Open..." bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                             <string key="keyEquivalent" base64-UTF8="YES">
 DQ
 </string>
+                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
                         </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
+                        </constraints>
                         <connections>
                             <action selector="openEventDetails:" target="-2" id="VhL-ql-rCV"/>
                             <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
@@ -272,30 +274,30 @@ DQ
                     </textField>
                     <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
                         <rect key="frame" x="110" y="80" width="319" height="29"/>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
-                        </constraints>
                         <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
                             <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
                             <font key="font" metaFont="smallSystem"/>
                         </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                        </constraints>
                         <connections>
                             <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
                         </connections>
                     </button>
                     <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
                         <rect key="frame" x="271" y="28" width="124" height="34"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
-                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
-                        </constraints>
-                        <buttonCell key="cell" type="push" title="Ignore" bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
+                        <buttonCell key="cell" type="push" title="Dismiss" bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                             <string key="keyEquivalent" base64-UTF8="YES">
 Gw
 </string>
                         </buttonCell>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
+                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
+                        </constraints>
                         <accessibility description="Dismiss Dialog"/>
                         <connections>
                             <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>

Source/gui/SNTBinaryMessageWindowController.h

@@ -23,7 +23,9 @@
 ///
 @interface SNTBinaryMessageWindowController : SNTMessageWindowController
 
-- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message;
+- (instancetype)initWithEvent:(SNTStoredEvent *)event
+                    customMsg:(NSString *)message
+                    customURL:(NSString *)url;
 
 - (IBAction)showCertInfo:(id)sender;
 - (void)updateBlockNotification:(SNTStoredEvent *)event withBundleHash:(NSString *)bundleHash;
@@ -52,6 +54,11 @@
 ///
 @property(weak) IBOutlet NSButton *openEventButton;
 
+///
+///   Reference to the "Dismiss Event" button in the XIB. Used to update its title.
+///
+@property(weak) IBOutlet NSButton *dismissEventButton;
+
 ///
 ///  The execution event that this window is for
 ///

Source/gui/SNTBinaryMessageWindowController.m

@@ -17,6 +17,7 @@
 #import <MOLCertificate/MOLCertificate.h>
 #import <SecurityInterface/SFCertificatePanel.h>
 
+#import "Source/common/CertificateHelpers.h"
 #import "Source/common/SNTBlockMessage.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTStoredEvent.h"
@@ -25,6 +26,9 @@
 ///  The custom message to display for this event
 @property(copy) NSString *customMessage;
 
+///  The custom URL to use for this event
+@property(copy) NSString *customURL;
+
 ///  A 'friendly' string representing the certificate information
 @property(readonly, nonatomic) NSString *publisherInfo;
 
@@ -39,11 +43,14 @@
 
 @implementation SNTBinaryMessageWindowController
 
-- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message {
+- (instancetype)initWithEvent:(SNTStoredEvent *)event
+                    customMsg:(NSString *)message
+                    customURL:(NSString *)url {
   self = [super initWithWindowNibName:@"MessageWindow"];
   if (self) {
     _event = event;
     _customMessage = message;
+    _customURL = url;
     _progress = [NSProgress discreteProgressWithTotalUnitCount:1];
     [_progress addObserver:self
                 forKeyPath:@"fractionCompleted"
@@ -74,15 +81,29 @@
 
 - (void)loadWindow {
   [super loadWindow];
-  if (![[SNTConfigurator configurator] eventDetailURL]) {
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event customURL:self.customURL];
+
+  if (!url) {
     [self.openEventButton removeFromSuperview];
-  } else {
+  } else if (self.customURL.length == 0) {
+    // Set the button text only if a per-rule custom URL is not used. If a
+    // custom URL is used, it is assumed that the `EventDetailText` config value
+    // does not apply and the default text will be used.
     NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
     if (eventDetailText) {
       [self.openEventButton setTitle:eventDetailText];
+      // Require the button keyEquivalent set to be CMD + Return
+      [self.openEventButton setKeyEquivalent:@"\r"];  // Return Key
+      [self.openEventButton
+        setKeyEquivalentModifierMask:NSEventModifierFlagCommand];  // Command Key
     }
   }
 
+  NSString *dismissButtonText = [[SNTConfigurator configurator] dismissText];
+  if (dismissButtonText.length) {
+    [self.dismissEventButton setTitle:dismissButtonText];
+  }
+
   if (!self.event.needsBundleHash) {
     [self.bundleHashLabel removeFromSuperview];
     [self.hashingIndicator removeFromSuperview];
@@ -106,21 +127,17 @@
 
 - (IBAction)showCertInfo:(id)sender {
   // SFCertificatePanel expects an NSArray of SecCertificateRef's
-  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.signingChain count]];
-  for (MOLCertificate *cert in self.event.signingChain) {
-    [certArray addObject:(id)cert.certRef];
-  }
-
   [[[SFCertificatePanel alloc] init] beginSheetForWindow:self.window
                                            modalDelegate:nil
                                           didEndSelector:nil
                                              contextInfo:nil
-                                            certificates:certArray
+                                            certificates:CertificateChain(self.event.signingChain)
                                                showGroup:YES];
 }
 
 - (IBAction)openEventDetails:(id)sender {
-  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event customURL:self.customURL];
+
   [self closeWindow:sender];
   [[NSWorkspace sharedWorkspace] openURL:url];
 }
@@ -136,19 +153,7 @@
 }
 
 - (NSString *)publisherInfo {
-  MOLCertificate *leafCert = [self.event.signingChain firstObject];
-
-  if ([leafCert.commonName isEqualToString:@"Apple Mac OS Application Signing"]) {
-    return [NSString stringWithFormat:@"App Store (Team ID: %@)", self.event.teamID];
-  } else if (leafCert.commonName && leafCert.orgName) {
-    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
-  } else if (leafCert.commonName) {
-    return leafCert.commonName;
-  } else if (leafCert.orgName) {
-    return leafCert.orgName;
-  } else {
-    return nil;
-  }
+  return Publisher(self.event.signingChain, self.event.teamID);
 }
 
 - (NSAttributedString *)attributedCustomMessage {

Source/gui/SNTDeviceMessageWindowController.m

@@ -50,18 +50,9 @@ NS_ASSUME_NONNULL_BEGIN
                                               customMsg:self.attributedCustomMessage];
   self.window.delegate = self;
 
-  // Add app to Cmd+Tab and Dock.
-  NSApp.activationPolicy = NSApplicationActivationPolicyRegular;
-
   [super showWindow:sender];
 }
 
-- (void)windowWillClose:(NSNotification *)notification {
-  // Remove app from Cmd+Tab and Dock.
-  NSApp.activationPolicy = NSApplicationActivationPolicyAccessory;
-  [super windowWillClose:notification];
-}
-
 - (NSAttributedString *)attributedCustomMessage {
   return [SNTBlockMessage formatMessage:self.customMessage];
 }

Source/gui/SNTFileAccessMessageWindowController.h

@@ -26,7 +26,10 @@ NS_ASSUME_NONNULL_BEGIN
 API_AVAILABLE(macos(13.0))
 @interface SNTFileAccessMessageWindowController : SNTMessageWindowController <NSWindowDelegate>
 
-- (instancetype)initWithEvent:(SNTFileAccessEvent *)event message:(nullable NSString *)message;
+- (instancetype)initWithEvent:(SNTFileAccessEvent *)event
+                customMessage:(nullable NSString *)message
+                    customURL:(nullable NSString *)url
+                   customText:(nullable NSString *)text;
 
 @property(readonly) SNTFileAccessEvent *event;
 

Source/gui/SNTFileAccessMessageWindowController.m

@@ -21,16 +21,23 @@
 
 @interface SNTFileAccessMessageWindowController ()
 @property NSString *customMessage;
+@property NSString *customURL;
+@property NSString *customText;
 @property SNTFileAccessEvent *event;
 @end
 
 @implementation SNTFileAccessMessageWindowController
 
-- (instancetype)initWithEvent:(SNTFileAccessEvent *)event message:(nullable NSString *)message {
+- (instancetype)initWithEvent:(SNTFileAccessEvent *)event
+                customMessage:(nullable NSString *)message
+                    customURL:(nullable NSString *)url
+                   customText:(nullable NSString *)text {
   self = [super init];
   if (self) {
-    _customMessage = message;
     _event = event;
+    _customMessage = message;
+    _customURL = url;
+    _customText = text;
   }
   return self;
 }
@@ -40,40 +47,40 @@
     [self.window orderOut:sender];
   }
 
-  self.window =
-    [[NSWindow alloc] initWithContentRect:NSMakeRect(0, 0, 0, 0)
-                                styleMask:NSWindowStyleMaskClosable | NSWindowStyleMaskTitled
-                                  backing:NSBackingStoreBuffered
-                                    defer:NO];
+  self.window = [[NSWindow alloc] initWithContentRect:NSMakeRect(0, 0, 0, 0)
+                                            styleMask:NSWindowStyleMaskBorderless
+                                              backing:NSBackingStoreBuffered
+                                                defer:NO];
 
-  self.window.contentViewController =
-    [SNTFileAccessMessageWindowViewFactory createWithWindow:self.window
-                                                      event:self.event
-                                                  customMsg:self.attributedCustomMessage];
+  self.window.contentViewController = [SNTFileAccessMessageWindowViewFactory
+    createWithWindow:self.window
+               event:self.event
+       customMessage:self.attributedCustomMessage
+           customURL:[SNTBlockMessage eventDetailURLForFileAccessEvent:self.event
+                                                             customURL:self.customURL]
+                       .absoluteString
+          customText:self.customText
+     uiStateCallback:^(BOOL preventNotificationsForADay) {
+       self.silenceFutureNotifications = preventNotificationsForADay;
+     }];
 
   self.window.delegate = self;
 
-  // Add app to Cmd+Tab and Dock.
-  NSApp.activationPolicy = NSApplicationActivationPolicyRegular;
-
   [super showWindow:sender];
 }
 
-- (void)windowWillClose:(NSNotification *)notification {
-  // Remove app from Cmd+Tab and Dock.
-  NSApp.activationPolicy = NSApplicationActivationPolicyAccessory;
-  [super windowWillClose:notification];
-}
-
 - (NSAttributedString *)attributedCustomMessage {
-  return [SNTBlockMessage formatMessage:self.customMessage];
+  return [SNTBlockMessage attributedBlockMessageForFileAccessEvent:self.event
+                                                     customMessage:self.customMessage];
 }
 
 - (NSString *)messageHash {
-  // TODO(mlw): This is not the final form. As this feature is expanded this
-  // hash will need to be revisted to ensure it meets our needs.
-  return [NSString stringWithFormat:@"%@|%@|%d", self.event.ruleName, self.event.ruleVersion,
-                                    [self.event.pid intValue]];
+  // The hash for display de-duplication/silencing purposes is a combination of:
+  // 1. The current file access rule version
+  // 2. The name of the rule that was violated
+  // 3. The path of the process
+  return [NSString
+    stringWithFormat:@"%@|%@|%@", self.event.ruleVersion, self.event.ruleName, self.event.filePath];
 }
 
 @end

Source/gui/SNTFileAccessMessageWindowView.swift

@@ -12,14 +12,25 @@
 /// See the License for the specific language governing permissions and
 /// limitations under the License.
 
+import SecurityInterface
 import SwiftUI
 
 import santa_common_SNTFileAccessEvent
 
 @available(macOS 13, *)
 @objc public class SNTFileAccessMessageWindowViewFactory : NSObject {
-  @objc public static func createWith(window: NSWindow, event: SNTFileAccessEvent, customMsg: NSAttributedString?) -> NSViewController {
-    return NSHostingController(rootView:SNTFileAccessMessageWindowView(window:window, event:event, customMsg:customMsg)
+  @objc public static func createWith(window: NSWindow,
+                                      event: SNTFileAccessEvent,
+                                      customMessage: NSAttributedString?,
+                                      customURL: NSString?,
+                                      customText: NSString?,
+                                      uiStateCallback: ((Bool) -> Void)?) -> NSViewController {
+    return NSHostingController(rootView:SNTFileAccessMessageWindowView(window:window,
+                                                                       event:event,
+                                                                       customMessage:customMessage,
+                                                                       customURL:customURL as String?,
+                                                                       customText:customText as String?,
+                                                                       uiStateCallback:uiStateCallback)
       .frame(width:800, height:600))
   }
 }
@@ -28,16 +39,26 @@ import santa_common_SNTFileAccessEvent
 struct Property : View {
   var lbl: String
   var val: String
+  var propertyAction: (() -> Void)? = nil
 
   var body: some View {
     let width: CGFloat? = 150
 
     HStack(spacing: 5) {
-      Text(lbl + ":")
-        .frame(width: width, alignment: .trailing)
-        .lineLimit(1)
-        .font(.system(size: 12, weight: .bold))
-        .padding(Edge.Set.horizontal, 10)
+      HStack {
+        if let block = propertyAction {
+          Button(action: {
+            block()
+          }) {
+            Image(systemName: "info.circle.fill")
+          }.buttonStyle(BorderlessButtonStyle())
+        }
+        Text(lbl + ":")
+          .frame(alignment: .trailing)
+          .lineLimit(1)
+          .font(.system(size: 12, weight: .bold))
+          .padding(Edge.Set.horizontal, 10)
+      }.frame(width: width, alignment: .trailing)
 
       Text(val)
         .fixedSize(horizontal: false, vertical: true)
@@ -50,6 +71,7 @@ struct Property : View {
 @available(macOS 13, *)
 struct Event: View {
   let e: SNTFileAccessEvent
+  let window: NSWindow?
 
   var body: some View {
     VStack(spacing:10) {
@@ -64,6 +86,18 @@ struct Event: View {
         Property(lbl: "Application", val: app)
       }
 
+      if let pub = e.publisherInfo {
+        Property(lbl: "Publisher", val: pub) {
+          SFCertificatePanel.shared()
+                .beginSheet(for: window,
+                            modalDelegate: nil,
+                            didEnd: nil,
+                            contextInfo: nil,
+                            certificates: e.signingChainCertRefs,
+                            showGroup: true)
+        }
+      }
+
       Property(lbl: "Name", val: (e.filePath as NSString).lastPathComponent)
       Property(lbl: "Path", val: e.filePath)
       Property(lbl: "Identifier", val: e.fileSHA256)
@@ -76,22 +110,26 @@ struct Event: View {
 struct SNTFileAccessMessageWindowView: View {
   let window: NSWindow?
   let event: SNTFileAccessEvent?
-  let customMsg: NSAttributedString?
+  let customMessage: NSAttributedString?
+  let customURL: String?
+  let customText: String?
+  let uiStateCallback: ((Bool) -> Void)?
 
-  @State private var checked = false
+  @Environment(\.openURL) var openURL
+  @State public var checked = false
 
   var body: some View {
     VStack(spacing:20.0) {
       Spacer()
       Text("Santa").font(Font.custom("HelveticaNeue-UltraLight", size: 34.0))
 
-      if let msg = customMsg {
+      if let msg = customMessage {
         Text(AttributedString(msg)).multilineTextAlignment(.center).padding(15.0)
       } else {
         Text("Access to a protected resource was denied.").multilineTextAlignment(.center).padding(15.0)
       }
 
-      Event(e: event!)
+      Event(e: event!, window: window)
 
       Toggle(isOn: $checked) {
         Text("Prevent future notifications for this application for a day")
@@ -99,9 +137,14 @@ struct SNTFileAccessMessageWindowView: View {
       }
 
       VStack(spacing:15) {
-          Button(action: openButton, label: {
-            Text("Open Event Info...").frame(maxWidth:.infinity)
-          })
+          if customURL != nil {
+            Button(action: openButton, label: {
+
+              Text(customText ?? "Open Event...").frame(maxWidth:.infinity)
+            })
+            .buttonStyle(.borderedProminent)
+            .keyboardShortcut(.defaultAction)
+          }
           Button(action: dismissButton, label: {
             Text("Dismiss").frame(maxWidth:.infinity)
           })
@@ -113,19 +156,25 @@ struct SNTFileAccessMessageWindowView: View {
     }.frame(maxWidth:800.0).fixedSize()
   }
 
-  func publisherInfo() {
-    // TODO(mlw): Will hook up in a separate PR
-    print("showing publisher popup...")
-  }
-
   func openButton() {
-    // TODO(mlw): Will hook up in a separate PR
-    print("opening event info...")
+    guard let urlString = customURL else {
+      print("No URL available")
+      return
+    }
+
+    guard let url = URL(string: urlString) else {
+      print("Failed to create URL")
+      return
+    }
+
+    openURL(url)
   }
 
   func dismissButton() {
+    if let block = uiStateCallback {
+      block(self.checked)
+    }
     window?.close()
-    print("close window")
   }
 }
 
@@ -153,6 +202,11 @@ func testFileAccessEvent() -> SNTFileAccessEvent {
 @available(macOS 13, *)
 struct SNTFileAccessMessageWindowView_Previews: PreviewProvider {
   static var previews: some View {
-    SNTFileAccessMessageWindowView(window: nil, event: testFileAccessEvent(), customMsg: nil)
+    SNTFileAccessMessageWindowView(window: nil,
+                                    event: testFileAccessEvent(),
+                            customMessage: nil,
+                                customURL: nil,
+                               customText: nil,
+                          uiStateCallback: nil)
   }
 }

Source/gui/SNTNotificationManager.m

@@ -71,6 +71,8 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
     [bc resume];
     [[bc remoteObjectProxy] spindown];
     [bc invalidate];
+    // Remove app from Cmd+Tab and Dock.
+    NSApp.activationPolicy = NSApplicationActivationPolicyAccessory;
     [NSApp hide:self];
   }
 }
@@ -101,32 +103,37 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
   // If GUI is in silent mode or if there's already a notification queued for
   // this message, don't do anything else.
   if ([SNTConfigurator configurator].enableSilentMode) return;
-  if ([self notificationAlreadyQueued:pendingMsg]) return;
 
-  // See if this message has been user-silenced.
-  NSString *messageHash = [pendingMsg messageHash];
-  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
-  NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][messageHash];
-  if ([silenceDate isKindOfClass:[NSDate class]]) {
-    NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
-    if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
-      LOGI(@"Notification silence: date is in the future, ignoring");
-      [self updateSilenceDate:nil forHash:messageHash];
-    } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
-      LOGI(@"Notification silence: date is more than one day ago, ignoring");
-      [self updateSilenceDate:nil forHash:messageHash];
-    } else {
-      LOGI(@"Notification silence: dropping notification for %@", messageHash);
-      return;
+  dispatch_async(dispatch_get_main_queue(), ^{
+    if ([self notificationAlreadyQueued:pendingMsg]) return;
+
+    // See if this message has been user-silenced.
+    NSString *messageHash = [pendingMsg messageHash];
+    NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+    NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][messageHash];
+    if ([silenceDate isKindOfClass:[NSDate class]]) {
+      NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
+      if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
+        LOGI(@"Notification silence: date is in the future, ignoring");
+        [self updateSilenceDate:nil forHash:messageHash];
+      } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
+        LOGI(@"Notification silence: date is more than one day ago, ignoring");
+        [self updateSilenceDate:nil forHash:messageHash];
+      } else {
+        LOGI(@"Notification silence: dropping notification for %@", messageHash);
+        return;
+      }
     }
-  }
 
-  pendingMsg.delegate = self;
-  [self.pendingNotifications addObject:pendingMsg];
+    pendingMsg.delegate = self;
+    [self.pendingNotifications addObject:pendingMsg];
 
-  if (!self.currentWindowController) {
-    [self showQueuedWindow];
-  }
+    if (!self.currentWindowController) {
+      // Add app to Cmd+Tab and Dock.
+      NSApp.activationPolicy = NSApplicationActivationPolicyRegular;
+      [self showQueuedWindow];
+    }
+  });
 }
 
 // For blocked execution notifications, post an NSDistributedNotificationCenter
@@ -172,7 +179,8 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 
   [dc postNotificationName:@"com.google.santa.notification.blockedeexecution"
                     object:@"com.google.santa"
-                  userInfo:userInfo];
+                  userInfo:userInfo
+        deliverImmediately:YES];
 }
 
 - (void)showQueuedWindow {
@@ -322,14 +330,16 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
   [un addNotificationRequest:req withCompletionHandler:nil];
 }
 
-- (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
+- (void)postBlockNotification:(SNTStoredEvent *)event
+            withCustomMessage:(NSString *)message
+                 andCustomURL:(NSString *)url {
   if (!event) {
     LOGI(@"Error: Missing event object in message received from daemon!");
     return;
   }
 
   SNTBinaryMessageWindowController *pendingMsg =
-    [[SNTBinaryMessageWindowController alloc] initWithEvent:event andMessage:message];
+    [[SNTBinaryMessageWindowController alloc] initWithEvent:event customMsg:message customURL:url];
 
   [self queueMessage:pendingMsg];
 }
@@ -346,14 +356,19 @@ static NSString *const silencedNotificationsKey = @"SilencedNotifications";
 }
 
 - (void)postFileAccessBlockNotification:(SNTFileAccessEvent *)event
-                      withCustomMessage:(NSString *)message API_AVAILABLE(macos(13.0)) {
+                          customMessage:(NSString *)message
+                              customURL:(NSString *)url
+                             customText:(NSString *)text API_AVAILABLE(macos(13.0)) {
   if (!event) {
     LOGI(@"Error: Missing event object in message received from daemon!");
     return;
   }
 
   SNTFileAccessMessageWindowController *pendingMsg =
-    [[SNTFileAccessMessageWindowController alloc] initWithEvent:event message:message];
+    [[SNTFileAccessMessageWindowController alloc] initWithEvent:event
+                                                  customMessage:message
+                                                      customURL:url
+                                                     customText:text];
 
   [self queueMessage:pendingMsg];
 }

Source/gui/SNTNotificationManagerTest.m

@@ -58,7 +58,7 @@
   id dncMock = OCMClassMock([NSDistributedNotificationCenter class]);
   OCMStub([dncMock defaultCenter]).andReturn(dncMock);
 
-  [sut postBlockNotification:ev withCustomMessage:@""];
+  [sut postBlockNotification:ev withCustomMessage:@"" andCustomURL:@""];
 
   OCMVerify([dncMock postNotificationName:@"com.google.santa.notification.blockedeexecution"
                                    object:@"com.google.santa"
@@ -68,7 +68,8 @@
                                    XCTAssertEqualObjects(userInfo[@"ppid"], @1);
                                    XCTAssertEqualObjects(userInfo[@"execution_time"], @1660221048);
                                    return YES;
-                                 }]]);
+                                 }]
+                       deliverImmediately:YES]);
 }
 
 @end

Source/gui/main.m

@@ -28,24 +28,22 @@
 
 - (OSSystemExtensionReplacementAction)request:(OSSystemExtensionRequest *)request
                   actionForReplacingExtension:(OSSystemExtensionProperties *)old
-                                withExtension:
-                                  (OSSystemExtensionProperties *)new API_AVAILABLE(macos(10.15)) {
+                                withExtension:(OSSystemExtensionProperties *)new {
   NSLog(@"SystemExtension \"%@\" request for replacement", request.identifier);
   return OSSystemExtensionReplacementActionReplace;
 }
 
-- (void)requestNeedsUserApproval:(OSSystemExtensionRequest *)request API_AVAILABLE(macos(10.15)) {
+- (void)requestNeedsUserApproval:(OSSystemExtensionRequest *)request {
   NSLog(@"SystemExtension \"%@\" request needs user approval", request.identifier);
 }
 
-- (void)request:(OSSystemExtensionRequest *)request
-  didFailWithError:(NSError *)error API_AVAILABLE(macos(10.15)) {
+- (void)request:(OSSystemExtensionRequest *)request didFailWithError:(NSError *)error {
   NSLog(@"SystemExtension \"%@\" request did fail: %@", request.identifier, error);
   exit((int)error.code);
 }
 
 - (void)request:(OSSystemExtensionRequest *)request
-  didFinishWithResult:(OSSystemExtensionRequestResult)result API_AVAILABLE(macos(10.15)) {
+  didFinishWithResult:(OSSystemExtensionRequestResult)result {
   NSLog(@"SystemExtension \"%@\" request did finish: %ld", request.identifier, (long)result);
   exit(0);
 }

Source/santabundleservice/BUILD

@@ -19,6 +19,7 @@ objc_library(
         "//Source/common:SNTStoredEvent",
         "//Source/common:SNTXPCBundleServiceInterface",
         "//Source/common:SNTXPCNotifierInterface",
+        "//Source/common:SigningIDHelpers",
         "@FMDB",
         "@MOLCodesignChecker",
         "@MOLXPCConnection",
@@ -34,7 +35,7 @@ macos_command_line_application(
         "--options library,kill,runtime",
     ],
     infoplists = ["Info.plist"],
-    minimum_os_version = "11.0",
+    minimum_os_version = "12.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",

Source/santabundleservice/SNTBundleService.m

@@ -25,6 +25,7 @@
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTStoredEvent.h"
 #import "Source/common/SNTXPCNotifierInterface.h"
+#import "Source/common/SigningIDHelpers.h"
 
 @interface SNTBundleService ()
 @property MOLXPCConnection *notifierConnection;
@@ -226,6 +227,9 @@
 
       MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
       se.signingChain = cs.certificates;
+      se.cdhash = cs.cdhash;
+      se.teamID = cs.teamID;
+      se.signingID = FormatSigningID(cs);
 
       dispatch_sync(dispatch_get_main_queue(), ^{
         relatedEvents[se.fileSHA256] = se;

Source/santactl/BUILD

@@ -31,6 +31,7 @@ objc_library(
         "//Source/common:SNTLogging",
         "//Source/common:santa_cc_proto_library_wrapper",
         "//Source/santad/Logs/EndpointSecurity/Writers/FSSpool:binaryproto_cc_proto_library_wrapper",
+        "@com_google_protobuf//src/google/protobuf/json",
     ],
 )
 
@@ -40,6 +41,7 @@ objc_library(
         "Commands/SNTCommandFileInfo.m",
         "Commands/SNTCommandMetrics.h",
         "Commands/SNTCommandMetrics.m",
+        "Commands/SNTCommandRule.h",
         "Commands/SNTCommandRule.m",
         "Commands/SNTCommandStatus.m",
         "Commands/SNTCommandSync.m",
@@ -66,6 +68,7 @@ objc_library(
         "//Source/common:SNTLogging",
         "//Source/common:SNTMetricSet",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
         "//Source/common:SNTStoredEvent",
         "//Source/common:SNTStrengthify",
         "//Source/common:SNTSystemInfo",
@@ -73,6 +76,7 @@ objc_library(
         "//Source/common:SNTXPCControlInterface",
         "//Source/common:SNTXPCSyncServiceInterface",
         "//Source/common:SNTXPCUnprivilegedControlInterface",
+        "//Source/common:SigningIDHelpers",
         "//Source/santasyncservice:sync_lib",
         "@FMDB",
         "@MOLCertificate",
@@ -90,7 +94,7 @@ macos_command_line_application(
         "--options library,kill,runtime",
     ],
     infoplists = ["Info.plist"],
-    minimum_os_version = "11.0",
+    minimum_os_version = "12.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:santa_dev",
@@ -114,7 +118,11 @@ santa_unit_test(
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTLogging",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
+        "//Source/common:SNTStoredEvent",
+        "//Source/common:SNTXPCBundleServiceInterface",
         "//Source/common:SNTXPCControlInterface",
+        "//Source/common:SigningIDHelpers",
         "@MOLCertificate",
         "@MOLCodesignChecker",
         "@MOLXPCConnection",
@@ -144,11 +152,27 @@ santa_unit_test(
     ],
 )
 
+santa_unit_test(
+    name = "SNTCommandRuleTest",
+    srcs = [
+        "Commands/SNTCommandRule.h",
+        "Commands/SNTCommandRuleTest.mm",
+        "SNTCommand.h",
+        "SNTCommandController.h",
+    ],
+    deps = [
+        ":santactl_lib",
+        "//Source/common:SNTCommonEnums",
+        "//Source/common:SNTRule",
+    ],
+)
+
 test_suite(
     name = "unit_tests",
     tests = [
         ":SNTCommandFileInfoTest",
         ":SNTCommandMetricsTest",
+        ":SNTCommandRuleTest",
     ],
     visibility = ["//:santa_package_group"],
 )

Source/santactl/Commands/SNTCommandFileInfo.m

@@ -22,7 +22,11 @@
 #import "Source/common/SNTFileInfo.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTRule.h"
+#import "Source/common/SNTRuleIdentifiers.h"
+#import "Source/common/SNTStoredEvent.h"
+#import "Source/common/SNTXPCBundleServiceInterface.h"
 #import "Source/common/SNTXPCControlInterface.h"
+#import "Source/common/SigningIDHelpers.h"
 #import "Source/santactl/SNTCommand.h"
 #import "Source/santactl/SNTCommandController.h"
 
@@ -43,6 +47,7 @@ static NSString *const kSigningChain = @"Signing Chain";
 static NSString *const kUniversalSigningChain = @"Universal Signing Chain";
 static NSString *const kTeamID = @"Team ID";
 static NSString *const kSigningID = @"Signing ID";
+static NSString *const kCDHash = @"CDHash";
 
 // signing chain keys
 static NSString *const kCommonName = @"Common Name";
@@ -55,6 +60,13 @@ static NSString *const kValidUntil = @"Valid Until";
 static NSString *const kSHA256 = @"SHA-256";
 static NSString *const kSHA1 = @"SHA-1";
 
+// bundle info keys
+static NSString *const kBundleInfo = @"Bundle Info";
+static NSString *const kBundlePath = @"Main Bundle Path";
+static NSString *const kBundleID = @"Main Bundle ID";
+static NSString *const kBundleHash = @"Bundle Hash";
+static NSString *const kBundleHashes = @"Bundle Hashes";
+
 // Message displayed when daemon communication fails
 static NSString *const kCommunicationErrorMsg = @"Could not communicate with daemon";
 
@@ -72,6 +84,8 @@ NSString *formattedStringForKeyArray(NSArray<NSString *> *array) {
 // Properties set from commandline flags
 @property(nonatomic) BOOL recursive;
 @property(nonatomic) BOOL jsonOutput;
+@property(nonatomic) BOOL bundleInfo;
+@property(nonatomic) BOOL filterInclusive;
 @property(nonatomic) NSNumber *certIndex;
 @property(nonatomic, copy) NSArray<NSString *> *outputKeyList;
 @property(nonatomic, copy) NSDictionary<NSString *, NSRegularExpression *> *outputFilters;
@@ -113,6 +127,7 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);
 @property(readonly, copy, nonatomic) SNTAttributeBlock downloadAgent;
 @property(readonly, copy, nonatomic) SNTAttributeBlock teamID;
 @property(readonly, copy, nonatomic) SNTAttributeBlock signingID;
+@property(readonly, copy, nonatomic) SNTAttributeBlock cdhash;
 @property(readonly, copy, nonatomic) SNTAttributeBlock type;
 @property(readonly, copy, nonatomic) SNTAttributeBlock pageZero;
 @property(readonly, copy, nonatomic) SNTAttributeBlock codeSigned;
@@ -156,6 +171,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
                 @"\n"
                 @"Usage: santactl fileinfo [options] [file-paths]\n"
                 @"    --recursive (-r): Search directories recursively.\n"
+                @"                      Incompatible with --bundleinfo.\n"
                 @"    --json: Output in JSON format.\n"
                 @"    --key: Search and return this one piece of information.\n"
                 @"           You may specify multiple keys by repeating this flag.\n"
@@ -167,12 +183,20 @@ REGISTER_COMMAND_NAME(@"fileinfo")
                 @"                  signing chain to show info only for that certificate.\n"
                 @"                     0 up to n for the leaf certificate up to the root\n"
                 @"                    -1 down to -n-1 for the root certificate down to the leaf\n"
+                @"                  Incompatible with --bundleinfo."
                 @"\n"
                 @"    --filter: Use predicates of the form 'key=regex' to filter out which files\n"
                 @"              are displayed. Valid keys are the same as for --key. Value is a\n"
                 @"              case-insensitive regular expression which must match anywhere in\n"
                 @"              the keyed property value for the file's info to be displayed.\n"
                 @"              You may specify multiple filters by repeating this flag.\n"
+                @"              If multiple filters are specified, any match will display the\n"
+                @"              file.\n"
+                @"    --filter-inclusive: If multiple filters are specified, they must all match\n"
+                @"                        for the file to be displayed.\n"
+                @"    --bundleinfo: If the file is part of a bundle, will also display bundle\n"
+                @"                  hash information and hashes of all bundle executables.\n"
+                @"                  Incompatible with --recursive and --cert-index.\n"
                 @"\n"
                 @"Examples: santactl fileinfo --cert-index 1 --key SHA-256 --json /usr/bin/yes\n"
                 @"          santactl fileinfo --key SHA-256 --json /usr/bin/yes\n"
@@ -186,8 +210,8 @@ REGISTER_COMMAND_NAME(@"fileinfo")
 + (NSArray<NSString *> *)fileInfoKeys {
   return @[
     kPath, kSHA256, kSHA1, kBundleName, kBundleVersion, kBundleVersionStr, kDownloadReferrerURL,
-    kDownloadURL, kDownloadTimestamp, kDownloadAgent, kTeamID, kSigningID, kType, kPageZero,
-    kCodeSigned, kRule, kSigningChain, kUniversalSigningChain
+    kDownloadURL, kDownloadTimestamp, kDownloadAgent, kTeamID, kSigningID, kCDHash, kType,
+    kPageZero, kCodeSigned, kRule, kSigningChain, kUniversalSigningChain
   ];
 }
 
@@ -221,6 +245,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
       kUniversalSigningChain : self.universalSigningChain,
       kTeamID : self.teamID,
       kSigningID : self.signingID,
+      kCDHash : self.cdhash,
     };
 
     _printQueue = dispatch_queue_create("com.google.santactl.print_queue", DISPATCH_QUEUE_SERIAL);
@@ -361,33 +386,25 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     NSError *err;
     MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:&err];
 
-    NSString *teamID =
-      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
-    NSString *identifier =
-      [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+    NSString *cdhash = csc.cdhash;
+    NSString *teamID = csc.teamID;
+    NSString *signingID = FormatSigningID(csc);
 
-    NSString *signingID;
-    if (identifier) {
-      if (teamID) {
-        signingID = [NSString stringWithFormat:@"%@:%@", teamID, identifier];
-      } else {
-        id platformID =
-          [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
-        if ([platformID isKindOfClass:[NSNumber class]] && [platformID intValue] != 0) {
-          signingID = [NSString stringWithFormat:@"platform:%@", identifier];
-        }
-      }
-    }
+    struct RuleIdentifiers identifiers = {
+      .cdhash = cdhash,
+      .binarySHA256 = fileInfo.SHA256,
+      .signingID = signingID,
+      .certificateSHA256 = err ? nil : csc.leafCertificate.SHA256,
+      .teamID = teamID,
+    };
 
-    [[cmd.daemonConn remoteObjectProxy] decisionForFilePath:fileInfo.path
-                                                 fileSHA256:fileInfo.SHA256
-                                          certificateSHA256:err ? nil : csc.leafCertificate.SHA256
-                                                     teamID:teamID
-                                                  signingID:signingID
-                                                      reply:^(SNTEventState s) {
-                                                        state = s;
-                                                        dispatch_semaphore_signal(sema);
-                                                      }];
+    [[cmd.daemonConn remoteObjectProxy]
+      decisionForFilePath:fileInfo.path
+              identifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]
+                    reply:^(SNTEventState s) {
+                      state = s;
+                      dispatch_semaphore_signal(sema);
+                    }];
     if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
       cmd.daemonUnavailable = YES;
       return kCommunicationErrorMsg;
@@ -405,6 +422,8 @@ REGISTER_COMMAND_NAME(@"fileinfo")
         case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
         case SNTEventStateAllowSigningID:
         case SNTEventStateBlockSigningID: [output appendString:@" (SigningID)"]; break;
+        case SNTEventStateAllowCDHash:
+        case SNTEventStateBlockCDHash: [output appendString:@" (CDHash)"]; break;
         case SNTEventStateAllowScope:
         case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
         case SNTEventStateAllowCompiler: [output appendString:@" (Compiler)"]; break;
@@ -493,14 +512,22 @@ REGISTER_COMMAND_NAME(@"fileinfo")
 - (SNTAttributeBlock)teamID {
   return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
     MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
-    return [csc.signingInformation valueForKey:@"teamid"];
+    return csc.teamID;
   };
 }
 
 - (SNTAttributeBlock)signingID {
   return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
     MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
-    return [csc.signingInformation objectForKey:(__bridge NSString *)kSecCodeInfoIdentifier];
+
+    return FormatSigningID(csc);
+  };
+}
+
+- (SNTAttributeBlock)cdhash {
+  return ^id(SNTCommandFileInfo *cmd, SNTFileInfo *fileInfo) {
+    MOLCodesignChecker *csc = [fileInfo codesignCheckerWithError:NULL];
+    return csc.cdhash;
   };
 }
 
@@ -578,6 +605,31 @@ REGISTER_COMMAND_NAME(@"fileinfo")
   NSOperationQueue *operationQueue = [[NSOperationQueue alloc] init];
   operationQueue.qualityOfService = NSQualityOfServiceUserInitiated;
 
+  // Limit the number of concurrent operations to 2. By default it is unlimited. Querying for the
+  // `Rule` results in an XPC message to the santa daemon. On an M1 Max we are
+  // seeing issues with dropped XPC messages when there are 64 or more in-flight messages. The
+  // number of in-flight requests to the santa daemon to will be capped to
+  // `maxConcurrentOperationCount`.
+  //
+  // Why 2? We are seeing diminishing wall-time improvements for anything over 2 Qs.
+  //
+  // 1 Q
+  // bazel run //Source/santactl -- fileinfo --recursive --key Path --key Rule /usr/libexec/
+  // 1.16s user 0.92s system 35% cpu 5.775 total
+
+  // 2 Qs
+  // bazel run //Source/santactl -- fileinfo --recursive --key Path --key Rule /usr/libexec/
+  // 1.22s user 1.07s system 62% cpu 3.675 total
+
+  // 4 Qs
+  // bazel run //Source/santactl -- fileinfo --recursive --key Path --key Rule /usr/libexec/
+  // 1.22s user 1.16s system 72% cpu 3.275 total
+
+  // 8 Qs
+  // bazel run //Source/santactl -- fileinfo --recursive --key Path --key Rule /usr/libexec/
+  // 1.25s user 1.26s system 75% cpu 3.304 total
+  operationQueue.maxConcurrentOperationCount = 2;
+
   if (isDir && self.recursive) {
     NSDirectoryEnumerator *dirEnum = [fm enumeratorAtPath:path];
     NSString *file = [dirEnum nextObject];
@@ -607,8 +659,29 @@ REGISTER_COMMAND_NAME(@"fileinfo")
   [operationQueue waitUntilAllOperationsAreFinished];
 }
 
+- (BOOL)shouldOutputValueToDictionary:(NSMutableDictionary *)outputDict
+                          valueForKey:(NSString * (^)(NSString *key))valueForKey {
+  if (self.outputFilters.count == 0) return YES;
+
+  int matches = 0;
+  for (NSString *key in self.outputFilters) {
+    NSString *value = valueForKey(key);
+    NSRegularExpression *regex = self.outputFilters[key];
+    if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
+    // If this is a value we want to show, store it in the output dictionary.
+    // This does a linear search on an array, but it's a small array.
+    if (outputDict && value.length && [self.outputKeyList containsObject:key]) {
+      outputDict[key] = value;
+    }
+    ++matches;
+  }
+
+  return self.filterInclusive ? matches == self.outputFilters.count : matches > 0;
+}
+
 // Prints out the info for a single (non-directory) file.  Which info is printed is controlled
 // by the keys in self.outputKeyList.
+// TODO: Refactor so this method is testable.
 - (void)printInfoForFile:(NSString *)path {
   SNTFileInfo *fileInfo = [[SNTFileInfo alloc] initWithPath:path];
   if (!fileInfo) {
@@ -642,46 +715,78 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     NSDictionary *cert = signingChain[index];
 
     // Check if we should skip over this item based on outputFilters.
-    BOOL filterMatch = self.outputFilters.count == 0;
-    for (NSString *key in self.outputFilters) {
-      NSString *value = cert[key] ?: @"";
-      NSRegularExpression *regex = self.outputFilters[key];
-      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
-      filterMatch = YES;
-      break;
+    BOOL shouldOutput = [self shouldOutputValueToDictionary:nil
+                                                valueForKey:^NSString *(NSString *key) {
+                                                  return cert[key] ?: @"";
+                                                }];
+    if (!shouldOutput) {
+      return;
     }
 
-    if (!filterMatch) return;
-
     // Filter out the info we want now, in case JSON output
     for (NSString *key in self.outputKeyList) {
       outputDict[key] = cert[key];
     }
   } else {
-    // Check if we should skip over this item based on outputFilters.  We do this before collecting
+    // Check if we should skip over this item based on outputFilters. We do this before collecting
     // output info because there's a chance that we can bail out early if a filter doesn't match.
     // However we also don't want to recompute info, so we save any values that we plan to show.
-    BOOL filterMatch = self.outputFilters.count == 0;
-    for (NSString *key in self.outputFilters) {
-      NSString *value = self.propertyMap[key](self, fileInfo) ?: @"";
-      NSRegularExpression *regex = self.outputFilters[key];
-      if (![regex firstMatchInString:value options:0 range:NSMakeRange(0, value.length)]) continue;
-      // If this is a value we want to show, store it in the output dictionary.
-      // This does a linear search on an array, but it's a small array.
-      if (value.length && [self.outputKeyList containsObject:key]) {
-        outputDict[key] = value;
-      }
-      filterMatch = YES;
-      break;
+    BOOL shouldOutput =
+      [self shouldOutputValueToDictionary:outputDict
+                              valueForKey:^NSString *(NSString *key) {
+                                return self.propertyMap[key](self, fileInfo) ?: @"";
+                              }];
+    if (!shouldOutput) {
+      return;
     }
 
-    if (!filterMatch) return;
-
     // Then fill the outputDict with the rest of the missing values.
     for (NSString *key in self.outputKeyList) {
       if (outputDict[key]) continue;  // ignore keys that we've already set due to a filter
       outputDict[key] = self.propertyMap[key](self, fileInfo);
     }
+
+    if (self.bundleInfo) {
+      SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
+      se.fileBundlePath = fileInfo.bundlePath;
+
+      MOLXPCConnection *bc = [SNTXPCBundleServiceInterface configuredConnection];
+      [bc resume];
+
+      __block NSMutableDictionary *bundleInfo = [[NSMutableDictionary alloc] init];
+
+      bundleInfo[kBundlePath] = fileInfo.bundle.bundlePath;
+      bundleInfo[kBundleID] = fileInfo.bundle.bundleIdentifier;
+
+      dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+
+      [[bc remoteObjectProxy]
+        hashBundleBinariesForEvent:se
+                             reply:^(NSString *hash, NSArray<SNTStoredEvent *> *events,
+                                     NSNumber *time) {
+                               bundleInfo[kBundleHash] = hash;
+
+                               NSMutableArray *bundleHashes = [[NSMutableArray alloc] init];
+
+                               for (SNTStoredEvent *event in events) {
+                                 [bundleHashes
+                                   addObject:@{kSHA256 : event.fileSHA256, kPath : event.filePath}];
+                               }
+
+                               bundleInfo[kBundleHashes] = bundleHashes;
+                               [[bc remoteObjectProxy] spindown];
+                               dispatch_semaphore_signal(sema);
+                             }];
+
+      int secondsToWait = 30;
+      if (dispatch_semaphore_wait(sema,
+                                  dispatch_time(DISPATCH_TIME_NOW, secondsToWait * NSEC_PER_SEC))) {
+        fprintf(stderr, "The bundle service did not finish collecting hashes within %d seconds\n",
+                secondsToWait);
+      }
+
+      outputDict[kBundleInfo] = bundleInfo;
+    }
   }
 
   // If there's nothing in the outputDict, then don't need to print anything.
@@ -710,6 +815,11 @@ REGISTER_COMMAND_NAME(@"fileinfo")
         }
       }
     }
+
+    if (self.bundleInfo) {
+      [output appendString:[self stringForBundleInfo:outputDict[kBundleInfo] key:kBundleInfo]];
+    }
+
     if (!singleKey) [output appendString:@"\n"];
   }
 
@@ -739,6 +849,9 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     if ([arg caseInsensitiveCompare:@"--json"] == NSOrderedSame) {
       self.jsonOutput = YES;
     } else if ([arg caseInsensitiveCompare:@"--cert-index"] == NSOrderedSame) {
+      if (self.bundleInfo) {
+        [self printErrorUsageAndExit:@"\n--cert-index is incompatible with --bundleinfo"];
+      }
       i += 1;  // advance to next argument and grab index
       if (i >= nargs || [arguments[i] hasPrefix:@"--"]) {
         [self printErrorUsageAndExit:@"\n--cert-index requires an argument"];
@@ -788,7 +901,19 @@ REGISTER_COMMAND_NAME(@"fileinfo")
       filters[key] = regex;
     } else if ([arg caseInsensitiveCompare:@"--recursive"] == NSOrderedSame ||
                [arg caseInsensitiveCompare:@"-r"] == NSOrderedSame) {
+      if (self.bundleInfo) {
+        [self printErrorUsageAndExit:@"\n--recursive is incompatible with --bundleinfo"];
+      }
       self.recursive = YES;
+    } else if ([arg caseInsensitiveCompare:@"--bundleinfo"] == NSOrderedSame ||
+               [arg caseInsensitiveCompare:@"-b"] == NSOrderedSame) {
+      if (self.recursive || self.certIndex) {
+        [self printErrorUsageAndExit:
+                @"\n--bundleinfo is incompatible with --recursive and --cert-index"];
+      }
+      self.bundleInfo = YES;
+    } else if ([arg caseInsensitiveCompare:@"--filter-inclusive"] == NSOrderedSame) {
+      self.filterInclusive = YES;
     } else {
       [paths addObject:arg];
     }
@@ -868,6 +993,22 @@ REGISTER_COMMAND_NAME(@"fileinfo")
   return result.copy;
 }
 
+- (NSString *)stringForBundleInfo:(NSDictionary *)bundleInfo key:(NSString *)key {
+  NSMutableString *result = [NSMutableString string];
+
+  [result appendFormat:@"%@:\n", key];
+
+  [result appendFormat:@"       %-20s: %@\n", kBundlePath.UTF8String, bundleInfo[kBundlePath]];
+  [result appendFormat:@"       %-20s: %@\n", kBundleID.UTF8String, bundleInfo[kBundleID]];
+  [result appendFormat:@"       %-20s: %@\n", kBundleHash.UTF8String, bundleInfo[kBundleHash]];
+
+  for (NSDictionary *hashPath in bundleInfo[kBundleHashes]) {
+    [result appendFormat:@"              %@  %@\n", hashPath[kSHA256], hashPath[kPath]];
+  }
+
+  return [result copy];
+}
+
 - (NSString *)stringForCertificate:(NSDictionary *)cert withKeys:(NSArray *)keys index:(int)index {
   if (!cert) return @"";
   NSMutableString *result = [NSMutableString string];

Source/santactl/Commands/SNTCommandFileInfoTest.m

@@ -24,6 +24,7 @@
 typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);
 @property(nonatomic) BOOL recursive;
 @property(nonatomic) BOOL jsonOutput;
+@property(nonatomic) BOOL filterInclusive;
 @property(nonatomic) NSNumber *certIndex;
 @property(nonatomic, copy) NSArray<NSString *> *outputKeyList;
 @property(nonatomic) NSDictionary<NSString *, SNTAttributeBlock> *propertyMap;
@@ -250,4 +251,10 @@ typedef id (^SNTAttributeBlock)(SNTCommandFileInfo *, SNTFileInfo *);
   XCTAssertEqualObjects(self.cfi.codeSigned(self.cfi, self.fileInfo), expected);
 }
 
+- (void)testParseArgumentsFilterInclusiveTrue {
+  NSArray *filePaths = [self.cfi parseArguments:@[ @"--filter-inclusive", @"/usr/bin/yes" ]];
+  XCTAssertTrue(self.cfi.filterInclusive);
+  XCTAssertTrue([filePaths containsObject:@"/usr/bin/yes"]);
+}
+
 @end

Source/santactl/Commands/SNTCommandPrintLog.mm

@@ -13,7 +13,7 @@
 /// limitations under the License.
 
 #import <Foundation/Foundation.h>
-#include <google/protobuf/util/json_util.h>
+#include <google/protobuf/json/json.h>
 #include <stdlib.h>
 
 #include <iostream>
@@ -26,8 +26,8 @@
 #include "Source/santad/Logs/EndpointSecurity/Writers/FSSpool/binaryproto_proto_include_wrapper.h"
 #include "google/protobuf/any.pb.h"
 
-using google::protobuf::util::JsonPrintOptions;
-using google::protobuf::util::MessageToJsonString;
+using JsonPrintOptions = google::protobuf::json::PrintOptions;
+using google::protobuf::json::MessageToJsonString;
 using santa::fsspool::binaryproto::LogBatch;
 namespace pbv1 = ::santa::pb::v1;
 
@@ -67,7 +67,7 @@ REGISTER_COMMAND_NAME(@"printlog")
 - (void)runWithArguments:(NSArray *)arguments {
   JsonPrintOptions options;
   options.always_print_enums_as_ints = false;
-  options.always_print_primitive_fields = true;
+  options.always_print_fields_with_no_presence = true;
   options.preserve_proto_field_names = true;
   options.add_whitespace = true;
 

Source/santactl/Commands/SNTCommandRule.h

@@ -0,0 +1,20 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+
+#import "Source/santactl/SNTCommand.h"
+
+@interface SNTCommandRule : SNTCommand <SNTCommandProtocol>
+@end

Source/santactl/Commands/SNTCommandRule.m

@@ -12,7 +12,9 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#import <CommonCrypto/CommonDigest.h>
 #import <Foundation/Foundation.h>
+#import <Kernel/kern/cs_blobs.h>
 #import <MOLCertificate/MOLCertificate.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
 #import <MOLXPCConnection/MOLXPCConnection.h>
@@ -22,13 +24,12 @@
 #import "Source/common/SNTFileInfo.h"
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTRule.h"
+#import "Source/common/SNTRuleIdentifiers.h"
 #import "Source/common/SNTXPCControlInterface.h"
+#import "Source/santactl/Commands/SNTCommandRule.h"
 #import "Source/santactl/SNTCommand.h"
 #import "Source/santactl/SNTCommandController.h"
 
-@interface SNTCommandRule : SNTCommand <SNTCommandProtocol>
-@end
-
 @implementation SNTCommandRule
 
 REGISTER_COMMAND_NAME(@"rule")
@@ -46,42 +47,67 @@ REGISTER_COMMAND_NAME(@"rule")
 }
 
 + (NSString *)longHelpText {
-  return (@"Usage: santactl rule [options]\n"
-          @"  One of:\n"
-          @"    --allow: add to allow\n"
-          @"    --block: add to block\n"
-          @"    --silent-block: add to silent block\n"
-          @"    --compiler: allow and mark as a compiler\n"
-          @"    --remove: remove existing rule\n"
-          @"    --check: check for an existing rule\n"
-          @"\n"
-          @"  One of:\n"
-          @"    --path {path}: path of binary/bundle to add/remove.\n"
-          @"                   Will add the hash of the file currently at that path.\n"
-          @"                   Does not work with --check. Use the fileinfo verb to check.\n"
-          @"                   the rule state of a file.\n"
-          @"    --identifier {sha256|teamID|signingID}: identifier to add/remove/check\n"
-          @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
-          @"\n"
-          @"  Optionally:\n"
-          @"    --teamid: add or check a team ID rule instead of binary\n"
-          @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
-          @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
+  return (
+    @"Usage: santactl rule [options]\n"
+    @"  One of:\n"
+    @"    --allow: add to allow\n"
+    @"    --block: add to block\n"
+    @"    --silent-block: add to silent block\n"
+    @"    --compiler: allow and mark as a compiler\n"
+    @"    --remove: remove existing rule\n"
+    @"    --check: check for an existing rule\n"
+    @"    --import {path}: import rules from a JSON file\n"
+    @"    --export {path}: export rules to a JSON file\n"
+    @"\n"
+    @"  One of:\n"
+    @"    --path {path}: path of binary/bundle to add/remove.\n"
+    @"                   Will add an appropriate rule for the file currently at that path.\n"
+    @"                   Defaults to a SHA-256 rule unless overridden with another flag.\n"
+    @"                   Does not work with --check. Use the fileinfo verb to check.\n"
+    @"                   the rule state of a file.\n"
+    @"    --identifier {sha256|teamID|signingID|cdhash}: identifier to add/remove/check\n"
+    @"    --sha256 {sha256}: hash to add/remove/check [deprecated]\n"
+    @"\n"
+    @"  Optionally:\n"
+    @"    --teamid: add or check a team ID rule instead of binary\n"
+    @"    --signingid: add or check a signing ID rule instead of binary (see notes)\n"
+    @"    --certificate: add or check a certificate sha256 rule instead of binary\n"
+    @"    --cdhash: add or check a cdhash rule instead of binary\n"
 #ifdef DEBUG
-          @"    --force: allow manual changes even when SyncBaseUrl is set\n"
+    @"    --force: allow manual changes even when SyncBaseUrl is set\n"
 #endif
-          @"    --message {message}: custom message\n"
-          @"\n"
-          @"  Notes:\n"
-          @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
-          @"\n"
-          @"      `TeamID:SigningID`\n"
-          @"\n"
-          @"    Because signing IDs are controlled by the binary author, this ensures\n"
-          @"    that the signing ID is properly scoped to a developer. For the special\n"
-          @"    case of platform binaries, `TeamID` should be replaced with the string\n"
-          @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
-          @"    targeting Apple-signed binaries that do not have a team ID.\n");
+    @"    --message {message}: custom message\n"
+    @"    --clean: when importing rules via JSON clear all non-transitive rules before importing\n"
+    @"    --clean-all: when importing rules via JSON clear all rules before importing\n"
+    @"\n"
+    @"  Notes:\n"
+    @"    The format of `identifier` when adding/checking a `signingid` rule is:\n"
+    @"\n"
+    @"      `TeamID:SigningID`\n"
+    @"\n"
+    @"    Because signing IDs are controlled by the binary author, this ensures\n"
+    @"    that the signing ID is properly scoped to a developer. For the special\n"
+    @"    case of platform binaries, `TeamID` should be replaced with the string\n"
+    @"    \"platform\" (e.g. `platform:SigningID`). This allows for rules\n"
+    @"    targeting Apple-signed binaries that do not have a team ID.\n"
+    @"\n"
+    @"  Importing / Exporting Rules:\n"
+    @"    If santa is not configured to use a sync server one can export\n"
+    @"    & import its non-static rules to and from JSON files using the \n"
+    @"    --export/--import flags. These files have the following form:\n"
+    @"\n"
+    @"    {\"rules\": [{rule-dictionaries}]}\n"
+    @"    e.g. {\"rules\": [\n"
+    @"                      {\"policy\": \"BLOCKLIST\",\n"
+    @"                       \"identifier\": "
+    @"\"84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6\"\n"
+    @"                       \"custom_url\" : \"\",\n"
+    @"                       \"custom_msg\": \"/bin/ls block for demo\"}\n"
+    @"                      ]}\n"
+    @"\n"
+    @"    By default rules are not cleared when importing. To clear the\n"
+    @"    database you must use either --clean or --clean-all\n"
+    @"\n");
 }
 
 - (void)runWithArguments:(NSArray *)arguments {
@@ -103,7 +129,11 @@ REGISTER_COMMAND_NAME(@"rule")
   newRule.type = SNTRuleTypeBinary;
 
   NSString *path;
+  NSString *jsonFilePath;
   BOOL check = NO;
+  SNTRuleCleanup cleanupType = SNTRuleCleanupNone;
+  BOOL importRules = NO;
+  BOOL exportRules = NO;
 
   // Parse arguments
   for (NSUInteger i = 0; i < arguments.count; ++i) {
@@ -130,6 +160,8 @@ REGISTER_COMMAND_NAME(@"rule")
       newRule.type = SNTRuleTypeTeamID;
     } else if ([arg caseInsensitiveCompare:@"--signingid"] == NSOrderedSame) {
       newRule.type = SNTRuleTypeSigningID;
+    } else if ([arg caseInsensitiveCompare:@"--cdhash"] == NSOrderedSame) {
+      newRule.type = SNTRuleTypeCDHash;
     } else if ([arg caseInsensitiveCompare:@"--path"] == NSOrderedSame) {
       if (++i > arguments.count - 1) {
         [self printErrorUsageAndExit:@"--path requires an argument"];
@@ -154,11 +186,67 @@ REGISTER_COMMAND_NAME(@"rule")
     } else if ([arg caseInsensitiveCompare:@"--force"] == NSOrderedSame) {
       // Don't do anything special.
 #endif
+    } else if ([arg caseInsensitiveCompare:@"--import"] == NSOrderedSame) {
+      if (exportRules) {
+        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
+      }
+      importRules = YES;
+      if (++i > arguments.count - 1) {
+        [self printErrorUsageAndExit:@"--import requires an argument"];
+      }
+      jsonFilePath = arguments[i];
+    } else if ([arg caseInsensitiveCompare:@"--clean"] == NSOrderedSame) {
+      cleanupType = SNTRuleCleanupNonTransitive;
+    } else if ([arg caseInsensitiveCompare:@"--clean-all"] == NSOrderedSame) {
+      cleanupType = SNTRuleCleanupAll;
+    } else if ([arg caseInsensitiveCompare:@"--export"] == NSOrderedSame) {
+      if (importRules) {
+        [self printErrorUsageAndExit:@"--import and --export are mutually exclusive"];
+      }
+      exportRules = YES;
+      if (++i > arguments.count - 1) {
+        [self printErrorUsageAndExit:@"--export requires an argument"];
+      }
+      jsonFilePath = arguments[i];
+    } else if ([arg caseInsensitiveCompare:@"--help"] == NSOrderedSame ||
+               [arg caseInsensitiveCompare:@"-h"] == NSOrderedSame) {
+      printf("%s\n", self.class.longHelpText.UTF8String);
+      exit(0);
     } else {
       [self printErrorUsageAndExit:[@"Unknown argument: " stringByAppendingString:arg]];
     }
   }
 
+  if (!importRules && cleanupType != SNTRuleCleanupNone) {
+    switch (cleanupType) {
+      case SNTRuleCleanupNonTransitive:
+        [self printErrorUsageAndExit:@"--clean can only be used with --import"];
+        break;
+      case SNTRuleCleanupAll:
+        [self printErrorUsageAndExit:@"--clean-all can only be used with --import"];
+        break;
+      default:
+        // This is a programming error.
+        LOGE(@"Unexpected SNTRuleCleanupType %ld", cleanupType);
+        exit(EXIT_FAILURE);
+    }
+  }
+
+  if (jsonFilePath.length > 0) {
+    if (importRules) {
+      if (newRule.identifier != nil || path != nil || check) {
+        [self printErrorUsageAndExit:@"--import can only be used by itself"];
+      }
+      [self importJSONFile:jsonFilePath with:cleanupType];
+    } else if (exportRules) {
+      if (newRule.identifier != nil || path != nil || check) {
+        [self printErrorUsageAndExit:@"--export can only be used by itself"];
+      }
+      [self exportJSONFile:jsonFilePath];
+    }
+    return;
+  }
+
   if (path) {
     SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:path];
     if (!fi.path) {
@@ -170,17 +258,36 @@ REGISTER_COMMAND_NAME(@"rule")
     } else if (newRule.type == SNTRuleTypeCertificate) {
       MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
       newRule.identifier = cs.leafCertificate.SHA256;
-    } else if (newRule.type == SNTRuleTypeTeamID || newRule.type == SNTRuleTypeSigningID) {
-      // noop
+    } else if (newRule.type == SNTRuleTypeCDHash) {
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
+      newRule.identifier = cs.cdhash;
+    } else if (newRule.type == SNTRuleTypeTeamID) {
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
+      newRule.identifier = cs.teamID;
+    } else if (newRule.type == SNTRuleTypeSigningID) {
+      MOLCodesignChecker *cs = [fi codesignCheckerWithError:NULL];
+      if (cs.teamID.length) {
+        newRule.identifier = [NSString stringWithFormat:@"%@:%@", cs.teamID, cs.signingID];
+      } else if (cs.platformBinary) {
+        newRule.identifier = [NSString stringWithFormat:@"platform:%@", cs.signingID];
+      }
     }
   }
 
-  if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) {
+  if (newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate ||
+      newRule.type == SNTRuleTypeCDHash) {
     NSCharacterSet *nonHex =
       [[NSCharacterSet characterSetWithCharactersInString:@"0123456789ABCDEF"] invertedSet];
-    if ([[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length !=
-        64) {
+    NSUInteger length =
+      [[newRule.identifier uppercaseString] stringByTrimmingCharactersInSet:nonHex].length;
+
+    if ((newRule.type == SNTRuleTypeBinary || newRule.type == SNTRuleTypeCertificate) &&
+        length != CC_SHA256_DIGEST_LENGTH * 2) {
       [self printErrorUsageAndExit:@"BINARY or CERTIFICATE rules require a valid SHA-256"];
+    } else if (newRule.type == SNTRuleTypeCDHash && length != CS_CDHASH_LEN * 2) {
+      [self printErrorUsageAndExit:
+              [NSString stringWithFormat:@"CDHASH rules require a valid hex string of length %d",
+                                         CS_CDHASH_LEN * 2]];
     }
   }
 
@@ -192,12 +299,13 @@ REGISTER_COMMAND_NAME(@"rule")
   if (newRule.state == SNTRuleStateUnknown) {
     [self printErrorUsageAndExit:@"No state specified"];
   } else if (!newRule.identifier) {
-    [self printErrorUsageAndExit:@"Either SHA-256, team ID, or path to file must be specified"];
+    [self printErrorUsageAndExit:
+            @"A valid SHA-256, CDHash, Signing ID, team ID, or path to file must be specified"];
   }
 
   [[self.daemonConn remoteObjectProxy]
     databaseRuleAddRules:@[ newRule ]
-              cleanSlate:NO
+             ruleCleanup:SNTRuleCleanupNone
                    reply:^(NSError *error) {
                      if (error) {
                        printf("Failed to modify rules: %s",
@@ -207,7 +315,7 @@ REGISTER_COMMAND_NAME(@"rule")
                      } else {
                        NSString *ruleType;
                        switch (newRule.type) {
-                         case SNTRuleTypeCertificate:
+                         case SNTRuleTypeCertificate: ruleType = @"Certificate SHA-256"; break;
                          case SNTRuleTypeBinary: {
                            ruleType = @"SHA-256";
                            break;
@@ -216,6 +324,14 @@ REGISTER_COMMAND_NAME(@"rule")
                            ruleType = @"Team ID";
                            break;
                          }
+                         case SNTRuleTypeSigningID: {
+                           ruleType = @"Signing ID";
+                           break;
+                         }
+                         case SNTRuleTypeCDHash: {
+                           ruleType = @"CDHash";
+                           break;
+                         }
                          default: ruleType = @"(Unknown type)";
                        }
                        if (newRule.state == SNTRuleStateRemove) {
@@ -230,76 +346,203 @@ REGISTER_COMMAND_NAME(@"rule")
                    }];
 }
 
+// IMPORTANT: This method makes no attempt to validate whether or not the data
+// in a rule is valid. It merely constructs a string with the given data.
+// E.g., TeamID compiler rules are not currently supproted, but if a test rule
+// is provided with that state, an appropriate string will be returned.
++ (NSString *)stringifyRule:(SNTRule *)rule withColor:(BOOL)colorize {
+  NSMutableString *output;
+  // Rule state is saved as eventState for output colorization down below
+  SNTEventState eventState = SNTEventStateUnknown;
+
+  switch (rule.state) {
+    case SNTRuleStateUnknown:
+      output = [@"No rule exists with the given parameters" mutableCopy];
+      break;
+    case SNTRuleStateAllow: OS_FALLTHROUGH;
+    case SNTRuleStateAllowCompiler: OS_FALLTHROUGH;
+    case SNTRuleStateAllowTransitive:
+      output = [@"Allowed" mutableCopy];
+      eventState = SNTEventStateAllow;
+      break;
+    case SNTRuleStateBlock: OS_FALLTHROUGH;
+    case SNTRuleStateSilentBlock:
+      output = [@"Blocked" mutableCopy];
+      eventState = SNTEventStateBlock;
+      break;
+    case SNTRuleStateRemove: OS_FALLTHROUGH;
+    default:
+      output = [NSMutableString stringWithFormat:@"Unexpected rule state: %ld", rule.state];
+      break;
+  }
+
+  if (rule.state == SNTRuleStateUnknown) {
+    // No more output to append
+    return output;
+  }
+
+  [output appendString:@" ("];
+
+  switch (rule.type) {
+    case SNTRuleTypeUnknown: [output appendString:@"Unknown"]; break;
+    case SNTRuleTypeCDHash: [output appendString:@"CDHash"]; break;
+    case SNTRuleTypeBinary: [output appendString:@"Binary"]; break;
+    case SNTRuleTypeSigningID: [output appendString:@"SigningID"]; break;
+    case SNTRuleTypeCertificate: [output appendString:@"Certificate"]; break;
+    case SNTRuleTypeTeamID: [output appendString:@"TeamID"]; break;
+    default:
+      output = [NSMutableString stringWithFormat:@"Unexpected rule type: %ld", rule.type];
+      break;
+  }
+
+  // Add additional attributes
+  switch (rule.state) {
+    case SNTRuleStateAllowCompiler: [output appendString:@", Compiler"]; break;
+    case SNTRuleStateAllowTransitive: [output appendString:@", Transitive"]; break;
+    case SNTRuleStateSilentBlock: [output appendString:@", Silent"]; break;
+    default: break;
+  }
+
+  [output appendString:@")"];
+
+  // Colorize
+  if (colorize) {
+    if ((SNTEventStateAllow & eventState)) {
+      [output insertString:@"\033[32m" atIndex:0];
+      [output appendString:@"\033[0m"];
+    } else if ((SNTEventStateBlock & eventState)) {
+      [output insertString:@"\033[31m" atIndex:0];
+      [output appendString:@"\033[0m"];
+    } else {
+      [output insertString:@"\033[33m" atIndex:0];
+      [output appendString:@"\033[0m"];
+    }
+  }
+
+  if (rule.state == SNTRuleStateAllowTransitive) {
+    NSDate *date = [NSDate dateWithTimeIntervalSinceReferenceDate:rule.timestamp];
+    [output appendString:[NSString stringWithFormat:@"\nlast access date: %@", [date description]]];
+  }
+  return output;
+}
+
 - (void)printStateOfRule:(SNTRule *)rule daemonConnection:(MOLXPCConnection *)daemonConn {
   id<SNTDaemonControlXPC> rop = [daemonConn synchronousRemoteObjectProxy];
-  NSString *fileSHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil;
-  NSString *certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil;
-  NSString *teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil;
-  NSString *signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil;
-  __block NSMutableString *output;
-  [rop decisionForFilePath:nil
-                fileSHA256:fileSHA256
-         certificateSHA256:certificateSHA256
-                    teamID:teamID
-                 signingID:signingID
-                     reply:^(SNTEventState s) {
-                       output =
-                         (SNTEventStateAllow & s) ? @"Allowed".mutableCopy : @"Blocked".mutableCopy;
-                       switch (s) {
-                         case SNTEventStateAllowUnknown:
-                         case SNTEventStateBlockUnknown: [output appendString:@" (Unknown)"]; break;
-                         case SNTEventStateAllowBinary:
-                         case SNTEventStateBlockBinary: [output appendString:@" (Binary)"]; break;
-                         case SNTEventStateAllowCertificate:
-                         case SNTEventStateBlockCertificate:
-                           [output appendString:@" (Certificate)"];
-                           break;
-                         case SNTEventStateAllowScope:
-                         case SNTEventStateBlockScope: [output appendString:@" (Scope)"]; break;
-                         case SNTEventStateAllowCompiler:
-                           [output appendString:@" (Compiler)"];
-                           break;
-                         case SNTEventStateAllowTransitive:
-                           [output appendString:@" (Transitive)"];
-                           break;
-                         case SNTEventStateAllowTeamID:
-                         case SNTEventStateBlockTeamID: [output appendString:@" (TeamID)"]; break;
-                         case SNTEventStateAllowSigningID:
-                         case SNTEventStateBlockSigningID:
-                           [output appendString:@" (SigningID)"];
-                           break;
-                         default: output = @"None".mutableCopy; break;
-                       }
-                       if (isatty(STDOUT_FILENO)) {
-                         if ((SNTEventStateAllow & s)) {
-                           [output insertString:@"\033[32m" atIndex:0];
-                           [output appendString:@"\033[0m"];
-                         } else if ((SNTEventStateBlock & s)) {
-                           [output insertString:@"\033[31m" atIndex:0];
-                           [output appendString:@"\033[0m"];
-                         } else {
-                           [output insertString:@"\033[33m" atIndex:0];
-                           [output appendString:@"\033[0m"];
-                         }
-                       }
-                     }];
+  __block NSString *output;
 
-  [rop databaseRuleForBinarySHA256:fileSHA256
-                 certificateSHA256:certificateSHA256
-                            teamID:teamID
-                         signingID:signingID
-                             reply:^(SNTRule *r) {
-                               if (r.state == SNTRuleStateAllowTransitive) {
-                                 NSDate *date =
-                                   [NSDate dateWithTimeIntervalSinceReferenceDate:r.timestamp];
-                                 [output appendString:[NSString
-                                                        stringWithFormat:@"\nlast access date: %@",
-                                                                         [date description]]];
-                               }
-                             }];
+  struct RuleIdentifiers identifiers = {
+    .cdhash = (rule.type == SNTRuleTypeCDHash) ? rule.identifier : nil,
+    .binarySHA256 = (rule.type == SNTRuleTypeBinary) ? rule.identifier : nil,
+    .certificateSHA256 = (rule.type == SNTRuleTypeCertificate) ? rule.identifier : nil,
+    .teamID = (rule.type == SNTRuleTypeTeamID) ? rule.identifier : nil,
+    .signingID = (rule.type == SNTRuleTypeSigningID) ? rule.identifier : nil,
+  };
+
+  [rop databaseRuleForIdentifiers:[[SNTRuleIdentifiers alloc] initWithRuleIdentifiers:identifiers]
+                            reply:^(SNTRule *r) {
+                              output = [SNTCommandRule stringifyRule:r
+                                                           withColor:(isatty(STDOUT_FILENO) == 1)];
+                            }];
 
   printf("%s\n", output.UTF8String);
   exit(0);
 }
 
+- (void)importJSONFile:(NSString *)jsonFilePath with:(SNTRuleCleanup)cleanupType {
+  // If the file exists parse it and then add the rules one at a time.
+  NSError *error;
+  NSData *data = [NSData dataWithContentsOfFile:jsonFilePath options:0 error:&error];
+  if (error) {
+    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to read %@: %@", jsonFilePath,
+                                                            error.localizedDescription]];
+  }
+
+  // We expect a JSON object with one key "rules". This is an array of rule
+  // objects.
+  // e.g.
+  // {"rules": [{
+  //  "policy" : "BLOCKLIST",
+  //    "rule_type" : "BINARY",
+  //    "identifier" : "84de9c61777ca36b13228e2446d53e966096e78db7a72c632b5c185b2ffe68a6"
+  //    "custom_url" : "",
+  //    "custom_msg" : "/bin/ls block for demo"
+  //  }]}
+  NSDictionary *rules = [NSJSONSerialization JSONObjectWithData:data options:0 error:&error];
+  if (error) {
+    [self printErrorUsageAndExit:[NSString stringWithFormat:@"Failed to parse %@: %@", jsonFilePath,
+                                                            error.localizedDescription]];
+  }
+
+  NSMutableArray<SNTRule *> *parsedRules = [[NSMutableArray alloc] init];
+
+  for (NSDictionary *jsonRule in rules[@"rules"]) {
+    SNTRule *rule = [[SNTRule alloc] initWithDictionary:jsonRule];
+    if (!rule) {
+      [self printErrorUsageAndExit:[NSString stringWithFormat:@"Invalid rule: %@", jsonRule]];
+    }
+    [parsedRules addObject:rule];
+  }
+
+  [[self.daemonConn remoteObjectProxy]
+    databaseRuleAddRules:parsedRules
+             ruleCleanup:cleanupType
+                   reply:^(NSError *error) {
+                     if (error) {
+                       printf("Failed to modify rules: %s",
+                              [error.localizedDescription UTF8String]);
+                       LOGD(@"Failure reason: %@", error.localizedFailureReason);
+                       exit(1);
+                     }
+                     exit(0);
+                   }];
+}
+
+- (void)exportJSONFile:(NSString *)jsonFilePath {
+  // Get the rules from the daemon and then write them to the file.
+  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
+  [rop retrieveAllRules:^(NSArray<SNTRule *> *rules, NSError *error) {
+    if (error) {
+      printf("Failed to get rules: %s", [error.localizedDescription UTF8String]);
+      LOGD(@"Failure reason: %@", error.localizedFailureReason);
+      exit(1);
+    }
+
+    if (rules.count == 0) {
+      printf("No rules to export.\n");
+      exit(1);
+    }
+    // Convert Rules to an NSDictionary.
+    NSMutableArray *rulesAsDicts = [[NSMutableArray alloc] init];
+
+    for (SNTRule *rule in rules) {
+      // Omit transitive and remove rules as they're not relevant.
+      if (rule.state == SNTRuleStateAllowTransitive || rule.state == SNTRuleStateRemove) {
+        continue;
+      }
+
+      [rulesAsDicts addObject:[rule dictionaryRepresentation]];
+    }
+
+    NSOutputStream *outputStream = [[NSOutputStream alloc] initToFileAtPath:jsonFilePath append:NO];
+    [outputStream open];
+
+    // Write the rules to the file.
+    // File should look like the following JSON:
+    // {"rules": [{"policy": "ALLOWLIST", "identifier": hash, "rule_type: "BINARY"},}]}
+    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:@{@"rules" : rulesAsDicts}
+                                                       options:NSJSONWritingPrettyPrinted
+                                                         error:&error];
+    // Print error
+    if (error) {
+      printf("Failed to jsonify rules: %s", [error.localizedDescription UTF8String]);
+      LOGD(@"Failure reason: %@", error.localizedFailureReason);
+      exit(1);
+    }
+    // Write jsonData to the file
+    [outputStream write:jsonData.bytes maxLength:jsonData.length];
+    [outputStream close];
+    exit(0);
+  }];
+}
+
 @end

Source/santactl/Commands/SNTCommandRuleTest.mm

@@ -0,0 +1,96 @@
+/// Copyright 2024 Google LLC
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///     https://www.apache.org/licenses/LICENSE-2.0
+///
+/// Unless required by applicable law or agreed to in writing, software
+/// distributed under the License is distributed on an "AS IS" BASIS,
+/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+/// See the License for the specific language governing permissions and
+/// limitations under the License.
+
+#import <Foundation/Foundation.h>
+#import <XCTest/XCTest.h>
+
+#include <map>
+#include <utility>
+
+#import "Source/common/SNTRule.h"
+#import "Source/santactl/Commands/SNTCommandRule.h"
+
+@interface SNTCommandRule (Testing)
++ (NSString *)stringifyRule:(SNTRule *)rule withColor:(BOOL)colorize;
+@end
+
+@interface SNTRule ()
+@property(readwrite) NSUInteger timestamp;
+@end
+
+@interface SNTCommandRuleTest : XCTestCase
+@end
+
+@implementation SNTCommandRuleTest
+
+- (void)testStringifyRule {
+  std::map<std::pair<SNTRuleType, SNTRuleState>, NSString *> ruleCheckToString = {
+    {{SNTRuleTypeUnknown, SNTRuleStateUnknown}, @"No rule exists with the given parameters"},
+    {{SNTRuleTypeUnknown, SNTRuleStateAllow}, @"Allowed (Unknown)"},
+    {{SNTRuleTypeUnknown, SNTRuleStateBlock}, @"Blocked (Unknown)"},
+    {{SNTRuleTypeUnknown, SNTRuleStateSilentBlock}, @"Blocked (Unknown, Silent)"},
+    {{SNTRuleTypeUnknown, SNTRuleStateRemove}, @"Unexpected rule state: 4 (Unknown)"},
+    {{SNTRuleTypeUnknown, SNTRuleStateAllowCompiler}, @"Allowed (Unknown, Compiler)"},
+    {{SNTRuleTypeUnknown, SNTRuleStateAllowTransitive},
+     @"Allowed (Unknown, Transitive)\nlast access date: 2023-03-08 20:26:40 +0000"},
+
+    {{SNTRuleTypeBinary, SNTRuleStateUnknown}, @"No rule exists with the given parameters"},
+    {{SNTRuleTypeBinary, SNTRuleStateAllow}, @"Allowed (Binary)"},
+    {{SNTRuleTypeBinary, SNTRuleStateBlock}, @"Blocked (Binary)"},
+    {{SNTRuleTypeBinary, SNTRuleStateSilentBlock}, @"Blocked (Binary, Silent)"},
+    {{SNTRuleTypeBinary, SNTRuleStateRemove}, @"Unexpected rule state: 4 (Binary)"},
+    {{SNTRuleTypeBinary, SNTRuleStateAllowCompiler}, @"Allowed (Binary, Compiler)"},
+    {{SNTRuleTypeBinary, SNTRuleStateAllowTransitive},
+     @"Allowed (Binary, Transitive)\nlast access date: 2023-03-08 20:26:40 +0000"},
+
+    {{SNTRuleTypeSigningID, SNTRuleStateUnknown}, @"No rule exists with the given parameters"},
+    {{SNTRuleTypeSigningID, SNTRuleStateAllow}, @"Allowed (SigningID)"},
+    {{SNTRuleTypeSigningID, SNTRuleStateBlock}, @"Blocked (SigningID)"},
+    {{SNTRuleTypeSigningID, SNTRuleStateSilentBlock}, @"Blocked (SigningID, Silent)"},
+    {{SNTRuleTypeSigningID, SNTRuleStateRemove}, @"Unexpected rule state: 4 (SigningID)"},
+    {{SNTRuleTypeSigningID, SNTRuleStateAllowCompiler}, @"Allowed (SigningID, Compiler)"},
+    {{SNTRuleTypeSigningID, SNTRuleStateAllowTransitive},
+     @"Allowed (SigningID, Transitive)\nlast access date: 2023-03-08 20:26:40 +0000"},
+
+    {{SNTRuleTypeCertificate, SNTRuleStateUnknown}, @"No rule exists with the given parameters"},
+    {{SNTRuleTypeCertificate, SNTRuleStateAllow}, @"Allowed (Certificate)"},
+    {{SNTRuleTypeCertificate, SNTRuleStateBlock}, @"Blocked (Certificate)"},
+    {{SNTRuleTypeCertificate, SNTRuleStateSilentBlock}, @"Blocked (Certificate, Silent)"},
+    {{SNTRuleTypeCertificate, SNTRuleStateRemove}, @"Unexpected rule state: 4 (Certificate)"},
+    {{SNTRuleTypeCertificate, SNTRuleStateAllowCompiler}, @"Allowed (Certificate, Compiler)"},
+    {{SNTRuleTypeCertificate, SNTRuleStateAllowTransitive},
+     @"Allowed (Certificate, Transitive)\nlast access date: 2023-03-08 20:26:40 +0000"},
+
+    {{SNTRuleTypeTeamID, SNTRuleStateUnknown}, @"No rule exists with the given parameters"},
+    {{SNTRuleTypeTeamID, SNTRuleStateAllow}, @"Allowed (TeamID)"},
+    {{SNTRuleTypeTeamID, SNTRuleStateBlock}, @"Blocked (TeamID)"},
+    {{SNTRuleTypeTeamID, SNTRuleStateSilentBlock}, @"Blocked (TeamID, Silent)"},
+    {{SNTRuleTypeTeamID, SNTRuleStateRemove}, @"Unexpected rule state: 4 (TeamID)"},
+    {{SNTRuleTypeTeamID, SNTRuleStateAllowCompiler}, @"Allowed (TeamID, Compiler)"},
+    {{SNTRuleTypeTeamID, SNTRuleStateAllowTransitive},
+     @"Allowed (TeamID, Transitive)\nlast access date: 2023-03-08 20:26:40 +0000"},
+  };
+
+  SNTRule *rule = [[SNTRule alloc] init];
+  rule.timestamp = 700000000;  // time interval since reference date
+
+  for (const auto &[typeAndState, want] : ruleCheckToString) {
+    rule.type = typeAndState.first;
+    rule.state = typeAndState.second;
+
+    NSString *got = [SNTCommandRule stringifyRule:rule withColor:NO];
+    XCTAssertEqualObjects(got, want);
+  }
+}
+@end

Source/santactl/Commands/SNTCommandStatus.m

@@ -15,11 +15,22 @@
 #import <Foundation/Foundation.h>
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
+#import "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTXPCControlInterface.h"
 #import "Source/santactl/SNTCommand.h"
 #import "Source/santactl/SNTCommandController.h"
 
+NSString *StartupOptionToString(SNTDeviceManagerStartupPreferences pref) {
+  switch (pref) {
+    case SNTDeviceManagerStartupPreferencesUnmount: return @"Unmount";
+    case SNTDeviceManagerStartupPreferencesForceUnmount: return @"ForceUnmount";
+    case SNTDeviceManagerStartupPreferencesRemount: return @"Remount";
+    case SNTDeviceManagerStartupPreferencesForceRemount: return @"ForceRemount";
+    default: return @"None";
+  }
+}
+
 @interface SNTCommandStatus : SNTCommand <SNTCommandProtocol>
 @end
 
@@ -45,7 +56,6 @@ REGISTER_COMMAND_NAME(@"status")
 }
 
 - (void)runWithArguments:(NSArray *)arguments {
-  dispatch_group_t group = dispatch_group_create();
   id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
 
   // Daemon status
@@ -81,22 +91,20 @@ REGISTER_COMMAND_NAME(@"status")
   }];
 
   // Database counts
-  __block int64_t eventCount = -1;
-  __block int64_t binaryRuleCount = -1;
-  __block int64_t certRuleCount = -1;
-  __block int64_t teamIDRuleCount = -1;
-  __block int64_t signingIDRuleCount = -1;
-  __block int64_t compilerRuleCount = -1;
-  __block int64_t transitiveRuleCount = -1;
-  [rop databaseRuleCounts:^(int64_t binary, int64_t certificate, int64_t compiler,
-                            int64_t transitive, int64_t teamID, int64_t signingID) {
-    binaryRuleCount = binary;
-    certRuleCount = certificate;
-    teamIDRuleCount = teamID;
-    signingIDRuleCount = signingID;
-    compilerRuleCount = compiler;
-    transitiveRuleCount = transitive;
+  __block struct RuleCounts ruleCounts = {
+    .binary = -1,
+    .certificate = -1,
+    .compiler = -1,
+    .transitive = -1,
+    .teamID = -1,
+    .signingID = -1,
+    .cdhash = -1,
+  };
+  [rop databaseRuleCounts:^(struct RuleCounts counts) {
+    ruleCounts = counts;
   }];
+
+  __block int64_t eventCount = -1;
   [rop databaseEventCount:^(int64_t count) {
     eventCount = count;
   }];
@@ -119,8 +127,8 @@ REGISTER_COMMAND_NAME(@"status")
   }];
 
   __block BOOL syncCleanReqd = NO;
-  [rop syncCleanRequired:^(BOOL clean) {
-    syncCleanReqd = clean;
+  [rop syncTypeRequired:^(SNTSyncType syncType) {
+    syncCleanReqd = (syncType == SNTSyncTypeClean || syncType == SNTSyncTypeCleanAll);
   }];
 
   __block BOOL pushNotifications = NO;
@@ -158,10 +166,15 @@ REGISTER_COMMAND_NAME(@"status")
     }
   }];
 
-  // Wait a maximum of 5s for stats collected from daemon to arrive.
-  if (dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 5))) {
-    fprintf(stderr, "Failed to retrieve some stats from daemon\n\n");
-  }
+  __block BOOL blockUSBMount = NO;
+  [rop blockUSBMount:^(BOOL response) {
+    blockUSBMount = response;
+  }];
+
+  __block NSArray<NSString *> *remountUSBMode;
+  [rop remountUSBMode:^(NSArray<NSString *> *response) {
+    remountUSBMode = response;
+  }];
 
   // Format dates
   NSDateFormatter *dateFormatter = [[NSDateFormatter alloc] init];
@@ -185,24 +198,25 @@ REGISTER_COMMAND_NAME(@"status")
       @"daemon" : @{
         @"driver_connected" : @(YES),
         @"mode" : clientMode ?: @"null",
+        @"transitive_rules" : @(enableTransitiveRules),
         @"log_type" : eventLogType,
         @"file_logging" : @(fileLogging),
         @"watchdog_cpu_events" : @(cpuEvents),
         @"watchdog_ram_events" : @(ramEvents),
         @"watchdog_cpu_peak" : @(cpuPeak),
         @"watchdog_ram_peak" : @(ramPeak),
-        @"block_usb" : @(configurator.blockUSBMount),
-        @"remount_usb_mode" : (configurator.blockUSBMount && configurator.remountUSBMode.count
-                                 ? configurator.remountUSBMode
-                                 : @""),
+        @"block_usb" : @(blockUSBMount),
+        @"remount_usb_mode" : (blockUSBMount && remountUSBMode.count ? remountUSBMode : @""),
+        @"on_start_usb_options" : StartupOptionToString(configurator.onStartUSBOptions),
       },
       @"database" : @{
-        @"binary_rules" : @(binaryRuleCount),
-        @"certificate_rules" : @(certRuleCount),
-        @"teamid_rules" : @(teamIDRuleCount),
-        @"signingid_rules" : @(signingIDRuleCount),
-        @"compiler_rules" : @(compilerRuleCount),
-        @"transitive_rules" : @(transitiveRuleCount),
+        @"binary_rules" : @(ruleCounts.binary),
+        @"certificate_rules" : @(ruleCounts.certificate),
+        @"teamid_rules" : @(ruleCounts.teamID),
+        @"signingid_rules" : @(ruleCounts.signingID),
+        @"cdhash_rules" : @(ruleCounts.cdhash),
+        @"compiler_rules" : @(ruleCounts.compiler),
+        @"transitive_rules" : @(ruleCounts.transitive),
         @"events_pending_upload" : @(eventCount),
       },
       @"static_rules" : @{
@@ -215,7 +229,6 @@ REGISTER_COMMAND_NAME(@"status")
         @"last_successful_rule" : ruleSyncLastSuccessStr ?: @"null",
         @"push_notifications" : pushNotifications ? @"Connected" : @"Disconnected",
         @"bundle_scanning" : @(enableBundles),
-        @"transitive_rules" : @(enableTransitiveRules),
       },
     } mutableCopy];
 
@@ -248,13 +261,20 @@ REGISTER_COMMAND_NAME(@"status")
   } else {
     printf(">>> Daemon Info\n");
     printf("  %-25s | %s\n", "Mode", [clientMode UTF8String]);
+
+    if (enableTransitiveRules) {
+      printf("  %-25s | %s\n", "Transitive Rules", (enableTransitiveRules ? "Yes" : "No"));
+    }
+
     printf("  %-25s | %s\n", "Log Type", [eventLogType UTF8String]);
     printf("  %-25s | %s\n", "File Logging", (fileLogging ? "Yes" : "No"));
-    printf("  %-25s | %s\n", "USB Blocking", (configurator.blockUSBMount ? "Yes" : "No"));
-    if (configurator.blockUSBMount && configurator.remountUSBMode.count > 0) {
-      printf("  %-25s | %s\n", "USB Remounting Mode:",
-             [[configurator.remountUSBMode componentsJoinedByString:@", "] UTF8String]);
+    printf("  %-25s | %s\n", "USB Blocking", (blockUSBMount ? "Yes" : "No"));
+    if (blockUSBMount && remountUSBMode.count > 0) {
+      printf("  %-25s | %s\n", "USB Remounting Mode",
+             [[remountUSBMode componentsJoinedByString:@", "] UTF8String]);
     }
+    printf("  %-25s | %s\n", "On Start USB Options",
+           StartupOptionToString(configurator.onStartUSBOptions).UTF8String);
     printf("  %-25s | %lld  (Peak: %.2f%%)\n", "Watchdog CPU Events", cpuEvents, cpuPeak);
     printf("  %-25s | %lld  (Peak: %.2fMB)\n", "Watchdog RAM Events", ramEvents, ramPeak);
 
@@ -263,12 +283,13 @@ REGISTER_COMMAND_NAME(@"status")
     printf("  %-25s | %lld\n", "Non-root cache count", nonRootCacheCount);
 
     printf(">>> Database Info\n");
-    printf("  %-25s | %lld\n", "Binary Rules", binaryRuleCount);
-    printf("  %-25s | %lld\n", "Certificate Rules", certRuleCount);
-    printf("  %-25s | %lld\n", "TeamID Rules", teamIDRuleCount);
-    printf("  %-25s | %lld\n", "SigningID Rules", signingIDRuleCount);
-    printf("  %-25s | %lld\n", "Compiler Rules", compilerRuleCount);
-    printf("  %-25s | %lld\n", "Transitive Rules", transitiveRuleCount);
+    printf("  %-25s | %lld\n", "Binary Rules", ruleCounts.binary);
+    printf("  %-25s | %lld\n", "Certificate Rules", ruleCounts.certificate);
+    printf("  %-25s | %lld\n", "TeamID Rules", ruleCounts.teamID);
+    printf("  %-25s | %lld\n", "SigningID Rules", ruleCounts.signingID);
+    printf("  %-25s | %lld\n", "CDHash Rules", ruleCounts.cdhash);
+    printf("  %-25s | %lld\n", "Compiler Rules", ruleCounts.compiler);
+    printf("  %-25s | %lld\n", "Transitive Rules", ruleCounts.transitive);
     printf("  %-25s | %lld\n", "Events Pending Upload", eventCount);
 
     if ([SNTConfigurator configurator].staticRules.count) {
@@ -294,7 +315,6 @@ REGISTER_COMMAND_NAME(@"status")
       printf("  %-25s | %s\n", "Push Notifications",
              (pushNotifications ? "Connected" : "Disconnected"));
       printf("  %-25s | %s\n", "Bundle Scanning", (enableBundles ? "Yes" : "No"));
-      printf("  %-25s | %s\n", "Transitive Rules", (enableTransitiveRules ? "Yes" : "No"));
     }
 
     if (exportMetrics) {

Source/santactl/Commands/SNTCommandSync.m

@@ -32,7 +32,7 @@ REGISTER_COMMAND_NAME(@"sync")
 #pragma mark SNTCommand protocol methods
 
 + (BOOL)requiresRoot {
-  return YES;
+  return NO;
 }
 
 + (BOOL)requiresDaemonConn {
@@ -47,8 +47,10 @@ REGISTER_COMMAND_NAME(@"sync")
   return (@"If Santa is configured to synchronize with a server, "
           @"this is the command used for syncing.\n\n"
           @"Options:\n"
-          @"  --clean: Perform a clean sync, erasing all existing rules and requesting a\n"
-          @"           clean sync from the server.");
+          @"  --clean: Perform a clean sync, erasing all existing non-transitive rules and\n"
+          @"           requesting a clean sync from the server.\n"
+          @"  --clean-all: Perform a clean sync, erasing all existing rules and requesting a\n"
+          @"               clean sync from the server.");
 }
 
 - (void)runWithArguments:(NSArray *)arguments {
@@ -75,10 +77,17 @@ REGISTER_COMMAND_NAME(@"sync")
   lr.unprivilegedInterface =
     [NSXPCInterface interfaceWithProtocol:@protocol(SNTSyncServiceLogReceiverXPC)];
   [lr resume];
-  BOOL isClean = [NSProcessInfo.processInfo.arguments containsObject:@"--clean"];
+
+  SNTSyncType syncType = SNTSyncTypeNormal;
+  if ([NSProcessInfo.processInfo.arguments containsObject:@"--clean-all"]) {
+    syncType = SNTSyncTypeCleanAll;
+  } else if ([NSProcessInfo.processInfo.arguments containsObject:@"--clean"]) {
+    syncType = SNTSyncTypeClean;
+  }
+
   [[ss remoteObjectProxy]
     syncWithLogListener:logListener.endpoint
-                isClean:isClean
+               syncType:syncType
                   reply:^(SNTSyncStatusType status) {
                     if (status == SNTSyncStatusTypeTooManySyncsInProgress) {
                       [self didReceiveLog:@"Too many syncs in progress, try again later."];

Source/santad/BUILD

@@ -21,6 +21,9 @@ objc_library(
     name = "SNTRuleTable",
     srcs = ["DataLayer/SNTRuleTable.m"],
     hdrs = ["DataLayer/SNTRuleTable.h"],
+    sdk_dylibs = [
+        "EndpointSecurity",
+    ],
     deps = [
         ":SNTDatabaseTable",
         "//Source/common:Platform",
@@ -30,6 +33,7 @@ objc_library(
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTLogging",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
         "@MOLCertificate",
         "@MOLCodesignChecker",
     ],
@@ -189,23 +193,36 @@ objc_library(
 
 objc_library(
     name = "SNTPolicyProcessor",
-    srcs = [
-        "DataLayer/SNTDatabaseTable.h",
-        "DataLayer/SNTRuleTable.h",
-        "SNTPolicyProcessor.m",
-    ],
+    srcs = ["SNTPolicyProcessor.mm"],
     hdrs = ["SNTPolicyProcessor.h"],
     deps = [
+        ":SNTRuleTable",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SNTDeepCopy",
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTLogging",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
+        "//Source/common:SigningIDHelpers",
         "@FMDB",
         "@MOLCertificate",
         "@MOLCodesignChecker",
         "@MOLXPCConnection",
+        "@com_google_absl//absl/container:flat_hash_map",
+    ],
+)
+
+santa_unit_test(
+    name = "SNTPolicyProcessorTest",
+    srcs = ["SNTPolicyProcessorTest.mm"],
+    deps = [
+        ":SNTPolicyProcessor",
+        "//Source/common:SNTCachedDecision",
+        "//Source/common:SNTConfigurator",
+        "//Source/common:SNTRule",
+        "//Source/common:TestUtils",
     ],
 )
 
@@ -213,6 +230,9 @@ objc_library(
     name = "TTYWriter",
     srcs = ["TTYWriter.mm"],
     hdrs = ["TTYWriter.h"],
+    sdk_dylibs = [
+        "EndpointSecurity",
+    ],
     deps = [
         "//Source/common:SNTLogging",
         "//Source/common:String",
@@ -233,10 +253,12 @@ objc_library(
         ":SNTSyncdQueue",
         ":TTYWriter",
         "//Source/common:BranchPrediction",
+        "//Source/common:PrefixTree",
         "//Source/common:SNTBlockMessage",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SNTDeepCopy",
         "//Source/common:SNTDropRootPrivs",
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTLogging",
@@ -245,7 +267,9 @@ objc_library(
         "//Source/common:SNTStoredEvent",
         "//Source/common:SantaVnode",
         "//Source/common:String",
+        "//Source/common:Unit",
         "@MOLCodesignChecker",
+        "@com_google_absl//absl/synchronization",
     ],
 )
 
@@ -275,12 +299,27 @@ objc_library(
         ":SNTEndpointSecurityClientBase",
         ":WatchItemPolicy",
         "//Source/common:BranchPrediction",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
         "//Source/common:SystemResources",
     ],
 )
 
+objc_library(
+    name = "SNTEndpointSecurityTreeAwareClient",
+    srcs = ["EventProviders/SNTEndpointSecurityTreeAwareClient.mm"],
+    hdrs = ["EventProviders/SNTEndpointSecurityTreeAwareClient.h"],
+    deps = [
+        ":EndpointSecurityAPI",
+        ":EndpointSecurityMessage",
+        ":Metrics",
+        ":SNTEndpointSecurityClient",
+        "//Source/santad/ProcessTree:SNTEndpointSecurityAdapter",
+        "//Source/santad/ProcessTree:process_tree",
+    ],
+)
+
 objc_library(
     name = "SNTEndpointSecurityRecorder",
     srcs = ["EventProviders/SNTEndpointSecurityRecorder.mm"],
@@ -294,13 +333,15 @@ objc_library(
         ":EndpointSecurityMessage",
         ":Metrics",
         ":SNTCompilerController",
-        ":SNTEndpointSecurityClient",
         ":SNTEndpointSecurityEventHandler",
+        ":SNTEndpointSecurityTreeAwareClient",
+        "//Source/common:Platform",
         "//Source/common:PrefixTree",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
         "//Source/common:String",
         "//Source/common:Unit",
+        "//Source/santad/ProcessTree:process_tree",
     ],
 )
 
@@ -359,9 +400,11 @@ objc_library(
         ":SNTDecisionCache",
         ":SNTEndpointSecurityClient",
         ":SNTEndpointSecurityEventHandler",
+        ":TTYWriter",
         ":WatchItemPolicy",
         ":WatchItems",
         "//Source/common:Platform",
+        "//Source/common:SNTBlockMessage",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTFileAccessEvent",
@@ -373,6 +416,8 @@ objc_library(
         "//Source/common:String",
         "@MOLCertificate",
         "@MOLCodesignChecker",
+        "@com_google_absl//absl/container:flat_hash_map",
+        "@com_google_absl//absl/container:flat_hash_set",
     ],
 )
 
@@ -388,8 +433,10 @@ objc_library(
         ":Metrics",
         ":SNTEndpointSecurityClient",
         ":SNTEndpointSecurityEventHandler",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTDeviceEvent",
         "//Source/common:SNTLogging",
+        "//Source/common:SNTMetricSet",
     ],
 )
 
@@ -426,8 +473,12 @@ objc_library(
     hdrs = ["EventProviders/EndpointSecurity/Enricher.h"],
     deps = [
         ":EndpointSecurityEnrichedTypes",
+        "//Source/common:Platform",
         "//Source/common:SNTLogging",
         "//Source/common:SantaCache",
+        "//Source/common:String",
+        "//Source/santad/ProcessTree:SNTEndpointSecurityAdapter",
+        "//Source/santad/ProcessTree:process_tree",
     ],
 )
 
@@ -436,6 +487,7 @@ objc_library(
     hdrs = ["EventProviders/EndpointSecurity/EnrichedTypes.h"],
     deps = [
         ":EndpointSecurityMessage",
+        "//Source/santad/ProcessTree:process_tree_cc_proto",
     ],
 )
 
@@ -461,12 +513,12 @@ objc_library(
         "bsm",
     ],
     deps = [
-        ":EndpointSecurityEnrichedTypes",
         ":EndpointSecurityMessage",
         ":SNTDecisionCache",
         "//Source/common:SantaCache",
         "//Source/common:SantaVnode",
         "//Source/common:SantaVnodeHash",
+        "//Source/common:String",
     ],
 )
 
@@ -503,6 +555,7 @@ objc_library(
         ":EndpointSecuritySerializer",
         ":EndpointSecuritySerializerUtilities",
         ":SNTDecisionCache",
+        "//Source/common:Platform",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTLogging",
         "//Source/common:SNTStoredEvent",
@@ -518,12 +571,15 @@ objc_library(
         ":EndpointSecuritySerializer",
         ":EndpointSecuritySerializerUtilities",
         ":SNTDecisionCache",
+        "//Source/common:Platform",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
         "//Source/common:SNTStoredEvent",
         "//Source/common:String",
         "//Source/common:santa_cc_proto_library_wrapper",
+        "@com_google_absl//absl/status",
+        "@com_google_protobuf//src/google/protobuf/json",
     ],
 )
 
@@ -608,6 +664,8 @@ objc_library(
     deps = [
         ":EndpointSecurityClient",
         ":WatchItemPolicy",
+        "//Source/common:SNTCommonEnums",
+        "//Source/santad/ProcessTree:process_tree",
     ],
 )
 
@@ -620,6 +678,9 @@ objc_library(
     name = "EndpointSecurityAPI",
     srcs = ["EventProviders/EndpointSecurity/EndpointSecurityAPI.mm"],
     hdrs = ["EventProviders/EndpointSecurity/EndpointSecurityAPI.h"],
+    sdk_dylibs = [
+        "EndpointSecurity",
+    ],
     deps = [
         ":EndpointSecurityClient",
         ":EndpointSecurityMessage",
@@ -648,6 +709,7 @@ objc_library(
         "//Source/common:SNTLogging",
         "//Source/common:SNTMetricSet",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
         "//Source/common:SNTStoredEvent",
         "//Source/common:SNTStrengthify",
         "//Source/common:SNTXPCControlInterface",
@@ -663,7 +725,10 @@ objc_library(
     srcs = ["Metrics.mm"],
     hdrs = ["Metrics.h"],
     deps = [
+        ":EndpointSecurityMessage",
         ":SNTApplicationCoreMetrics",
+        "//Source/common:Platform",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTLogging",
         "//Source/common:SNTMetricSet",
         "//Source/common:SNTXPCMetricServiceInterface",
@@ -692,6 +757,7 @@ objc_library(
         ":SNTExecutionController",
         ":SNTNotificationQueue",
         ":SNTSyncdQueue",
+        ":TTYWriter",
         ":WatchItems",
         "//Source/common:PrefixTree",
         "//Source/common:SNTCommonEnums",
@@ -702,6 +768,7 @@ objc_library(
         "//Source/common:SNTXPCNotifierInterface",
         "//Source/common:SNTXPCSyncServiceInterface",
         "//Source/common:Unit",
+        "//Source/santad/ProcessTree:process_tree",
         "@MOLXPCConnection",
     ],
 )
@@ -733,6 +800,8 @@ objc_library(
         "//Source/common:SNTXPCControlInterface",
         "//Source/common:SNTXPCUnprivilegedControlInterface",
         "//Source/common:Unit",
+        "//Source/santad/ProcessTree:process_tree",
+        "//Source/santad/ProcessTree/annotations:originator",
         "@MOLXPCConnection",
     ],
 )
@@ -754,6 +823,7 @@ objc_library(
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTLogging",
         "//Source/common:SNTMetricSet",
+        "//Source/common:SNTSystemInfo",
         "//Source/common:SNTXPCControlInterface",
         "//Source/common:SystemResources",
     ],
@@ -775,7 +845,7 @@ macos_bundle(
     }),
     infoplists = ["Info.plist"],
     linkopts = ["-execute"],
-    minimum_os_version = "11.0",
+    minimum_os_version = "12.0",
     provisioning_profile = select({
         "//:adhoc_build": None,
         "//conditions:default": "//profiles:daemon_dev",
@@ -855,19 +925,17 @@ santa_unit_test(
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTLogging",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
         "@FMDB",
         "@MOLCertificate",
         "@MOLCodesignChecker",
+        "@OCMock",
     ],
 )
 
 santa_unit_test(
     name = "SantadTest",
     srcs = ["SantadTest.mm"],
-    data = [
-        "//Source/santad/testdata:binaryrules_testdata",
-    ],
-    minimum_os_version = "11.0",
     sdk_dylibs = [
         "bsm",
         "EndpointSecurity",
@@ -875,14 +943,20 @@ santa_unit_test(
     sdk_frameworks = [
         "DiskArbitration",
     ],
+    structured_resources = [
+        "//Source/santad/testdata:binaryrules_testdata",
+    ],
     tags = ["exclusive"],
     deps = [
         ":EndpointSecurityMessage",
         ":Metrics",
         ":MockEndpointSecurityAPI",
         ":SNTDatabaseController",
+        ":SNTDecisionCache",
         ":SNTEndpointSecurityAuthorizer",
+        ":SNTEndpointSecurityClient",
         ":SantadDeps",
+        "//Source/common:SNTCachedDecision",
         "//Source/common:SNTConfigurator",
         "//Source/common:TestUtils",
         "@MOLCertificate",
@@ -897,7 +971,6 @@ santa_unit_test(
     srcs = [
         "SNTApplicationCoreMetricsTest.mm",
     ],
-    minimum_os_version = "11.0",
     deps = [
         ":SNTApplicationCoreMetrics",
         "//Source/common:SNTCommonEnums",
@@ -950,6 +1023,7 @@ santa_unit_test(
         ":EndpointSecuritySerializerBasicString",
         ":MockEndpointSecurityAPI",
         ":SNTDecisionCache",
+        "//Source/common:Platform",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
@@ -963,7 +1037,7 @@ santa_unit_test(
 santa_unit_test(
     name = "EndpointSecuritySerializerProtobufTest",
     srcs = ["Logs/EndpointSecurity/Serializers/ProtobufTest.mm"],
-    data = [
+    structured_resources = [
         "//Source/santad/testdata:protobuf_json_testdata",
     ],
     deps = [
@@ -974,6 +1048,7 @@ santa_unit_test(
         ":EndpointSecuritySerializerProtobuf",
         ":MockEndpointSecurityAPI",
         ":SNTDecisionCache",
+        "//Source/common:Platform",
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
@@ -981,7 +1056,9 @@ santa_unit_test(
         "//Source/common:TestUtils",
         "//Source/common:santa_cc_proto_library_wrapper",
         "@OCMock",
+        "@com_google_absl//absl/status",
         "@com_google_googletest//:gtest",
+        "@com_google_protobuf//src/google/protobuf/json",
     ],
 )
 
@@ -1116,7 +1193,10 @@ santa_unit_test(
     name = "MetricsTest",
     srcs = ["MetricsTest.mm"],
     deps = [
+        ":EndpointSecurityMessage",
         ":Metrics",
+        ":MockEndpointSecurityAPI",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTMetricSet",
         "//Source/common:TestUtils",
         "@OCMock",
@@ -1136,6 +1216,7 @@ santa_unit_test(
         "//Source/common:SNTCachedDecision",
         "//Source/common:SNTCommonEnums",
         "//Source/common:SNTRule",
+        "//Source/common:SantaVnode",
         "//Source/common:TestUtils",
         "@OCMock",
     ],
@@ -1156,7 +1237,9 @@ santa_unit_test(
         ":MockEndpointSecurityAPI",
         ":SNTEndpointSecurityClient",
         ":WatchItemPolicy",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
+        "//Source/common:SystemResources",
         "//Source/common:TestUtils",
         "@OCMock",
         "@com_google_googletest//:gtest",
@@ -1184,6 +1267,7 @@ santa_unit_test(
         "//Source/common:SNTFileInfo",
         "//Source/common:SNTMetricSet",
         "//Source/common:SNTRule",
+        "//Source/common:SNTRuleIdentifiers",
         "//Source/common:TestUtils",
         "@MOLCertificate",
         "@MOLCodesignChecker",
@@ -1230,6 +1314,7 @@ santa_unit_test(
         ":WatchItems",
         "//Source/common:Platform",
         "//Source/common:SNTCachedDecision",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
         "//Source/common:TestUtils",
         "@MOLCertificate",
@@ -1276,6 +1361,7 @@ santa_unit_test(
         ":MockEndpointSecurityAPI",
         ":SNTCompilerController",
         ":SNTEndpointSecurityRecorder",
+        "//Source/common:Platform",
         "//Source/common:PrefixTree",
         "//Source/common:SNTConfigurator",
         "//Source/common:TestUtils",
@@ -1299,7 +1385,9 @@ santa_unit_test(
         ":EndpointSecurityMessage",
         ":Metrics",
         ":MockEndpointSecurityAPI",
+        ":SNTEndpointSecurityClient",
         ":SNTEndpointSecurityDeviceManager",
+        "//Source/common:SNTCommonEnums",
         "//Source/common:SNTConfigurator",
         "//Source/common:SNTDeviceEvent",
         "//Source/common:TestUtils",
@@ -1356,10 +1444,13 @@ test_suite(
         ":SNTEndpointSecurityTamperResistanceTest",
         ":SNTEventTableTest",
         ":SNTExecutionControllerTest",
+        ":SNTPolicyProcessorTest",
         ":SNTRuleTableTest",
         ":SantadTest",
         ":WatchItemsTest",
         "//Source/santad/Logs/EndpointSecurity/Writers/FSSpool:fsspool_test",
+        "//Source/santad/ProcessTree:process_tree_test",
+        "//Source/santad/ProcessTree/annotations:originator_test",
     ],
     visibility = ["//:santa_package_group"],
 )

Source/santad/DataLayer/SNTRuleTable.h

@@ -15,6 +15,7 @@
 #import <Foundation/Foundation.h>
 
 #import "Source/common/SNTCommonEnums.h"
+#import "Source/common/SNTRuleIdentifiers.h"
 #import "Source/santad/DataLayer/SNTDatabaseTable.h"
 
 @class SNTCachedDecision;
@@ -29,57 +30,60 @@
 ///
 ///  @return Number of rules in the database
 ///
-- (NSUInteger)ruleCount;
+- (int64_t)ruleCount;
 
 ///
 ///  @return Number of binary rules in the database
 ///
-- (NSUInteger)binaryRuleCount;
+- (int64_t)binaryRuleCount;
 
 ///
 ///  @return Number of compiler rules in the database
 ///
-- (NSUInteger)compilerRuleCount;
+- (int64_t)compilerRuleCount;
 
 ///
 ///  @return Number of transitive rules in the database
 ///
-- (NSUInteger)transitiveRuleCount;
+- (int64_t)transitiveRuleCount;
 
 ///
 ///  @return Number of certificate rules in the database
 ///
-- (NSUInteger)certificateRuleCount;
+- (int64_t)certificateRuleCount;
 
 ///
 /// @return Number of team ID rules in the database
 ///
-- (NSUInteger)teamIDRuleCount;
+- (int64_t)teamIDRuleCount;
 
 ///
 /// @return Number of signing ID rules in the database
 ///
-- (NSUInteger)signingIDRuleCount;
+- (int64_t)signingIDRuleCount;
 
 ///
-///  @return Rule for binary, signingID, certificate or teamID (in that order).
+/// @return Number of cdhash rules in the database
+///
+- (int64_t)cdhashRuleCount;
+
+///
+///  @return Rule for given identifiers.
+///          Currently: binary, signingID, certificate or teamID (in that order).
 ///          The first matching rule found is returned.
 ///
-- (SNTRule *)ruleForBinarySHA256:(NSString *)binarySHA256
-                       signingID:(NSString *)signingID
-               certificateSHA256:(NSString *)certificateSHA256
-                          teamID:(NSString *)teamID;
+- (SNTRule *)ruleForIdentifiers:(struct RuleIdentifiers)identifiers;
 
 ///
 ///  Add an array of rules to the database. The rules will be added within a transaction and the
 ///  transaction will abort if any rule fails to add.
 ///
 ///  @param rules Array of SNTRule's to add.
-///  @param cleanSlate If true, remove all rules before adding the new rules.
+///  @param ruleCleanup Rule cleanup type to perform (e.g. all, none, non-transitive).
 ///  @param error When returning NO, will be filled with appropriate error.
 ///  @return YES if adding all rules passed, NO if any were rejected.
 ///
-- (BOOL)addRules:(NSArray *)rules cleanSlate:(BOOL)cleanSlate error:(NSError **)error;
+- (BOOL)addRules:(NSArray *)rules ruleCleanup:(SNTRuleCleanup)cleanupType error:(NSError **)error;
 
 ///
 ///  Checks the given array of rules to see if adding any of them to the rules database would
@@ -101,6 +105,11 @@
 ///
 - (void)removeOutdatedTransitiveRules;
 
+///
+///  Retrieve all rules from the database for export.
+///
+- (NSArray<SNTRule *> *)retrieveAllRules;
+
 ///
 ///  A map of a file hashes to cached decisions. This is used to pre-validate and whitelist
 ///  certain critical system binaries that are integral to Santa's functionality.

Source/santad/DataLayer/SNTRuleTable.m

@@ -25,21 +25,15 @@
 #import "Source/common/SNTLogging.h"
 #import "Source/common/SNTRule.h"
 
-static const uint32_t kRuleTableCurrentVersion = 5;
+static const uint32_t kRuleTableCurrentVersion = 7;
 
 // TODO(nguyenphillip): this should be configurable.
 // How many rules must be in database before we start trying to remove transitive rules.
-static const NSUInteger kTransitiveRuleCullingThreshold = 500000;
+static const int64_t kTransitiveRuleCullingThreshold = 500000;
 // Consider transitive rules out of date if they haven't been used in six months.
 static const NSUInteger kTransitiveRuleExpirationSeconds = 6 * 30 * 24 * 3600;
 
-static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABLE(macos(12.0)) {
-  // Note: This function uses API introduced in macOS 12, but we want to continue to support
-  // building in older environments. API Availability checks do not help for this use case,
-  // instead we use the following preprocessor macros to conditionally compile these API. The
-  // drawback here is that if a pre-macOS 12 SDK is used to build Santa and it is then deployed
-  // on macOS 12 or later, the dynamic mute set will not be computed.
-#if HAVE_MACOS_12
+static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) {
   // Create a temporary ES client in order to grab the default set of muted paths.
   // TODO(mlw): Reorganize this code so that a temporary ES client doesn't need to be created
   es_client_t *client = NULL;
@@ -69,7 +63,6 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 
   es_release_muted_paths(mps);
   es_delete_client(client);
-#endif
 }
 
 @interface SNTRuleTable ()
@@ -125,10 +118,8 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
     NSMutableSet *superSet = [NSMutableSet setWithSet:fallbackDefaultMuteSet];
     [superSet unionSet:santaDefinedCriticalPaths];
 
-    if (@available(macOS 12.0, *)) {
-      // Attempt to add the real default mute set
-      addPathsFromDefaultMuteSet(superSet);
-    }
+    // Attempt to add the real default mute set
+    addPathsFromDefaultMuteSet(superSet);
 
     criticalPaths = [superSet allObjects];
   });
@@ -194,7 +185,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
                       @")"];
     [db executeUpdate:@"CREATE UNIQUE INDEX rulesunique ON rules (shasum, type)"];
 
-    [[SNTConfigurator configurator] setSyncCleanRequired:YES];
+    [[SNTConfigurator configurator] setSyncTypeRequired:SNTSyncTypeCleanAll];
 
     newVersion = 1;
   }
@@ -229,6 +220,28 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
     newVersion = 5;
   }
 
+  if (version < 6) {
+    // Force hash identifiers for Binary and Certificate rules to always be lowercase
+    [db executeUpdate:@"UPDATE rules SET identifier = LOWER(identifier) WHERE type = ? OR type = ?",
+                      @(SNTRuleTypeBinary), @(SNTRuleTypeCertificate)];
+
+    // Force team ID identifiers for TeamID rules to always be uppercase
+    [db executeUpdate:@"UPDATE rules SET identifier = UPPER(identifier) WHERE type = ?",
+                      @(SNTRuleTypeTeamID)];
+
+    // Note: Intentionally not attempting to migrate exsting SigningID rules to enforce
+    // the TeamID component to be uppercase. Since this is a newer rule type, it is
+    // assumed to be unnecessary and we'd rather not maintain the SQL to perform this
+    // migration automatically.
+
+    newVersion = 6;
+  }
+
+  if (version < 7) {
+    [db executeUpdate:@"ALTER TABLE 'rules' ADD 'customurl' TEXT"];
+    newVersion = 7;
+  }
+
   // Save signing info for launchd and santad. Used to ensure they are always allowed.
   self.santadCSInfo = [[MOLCodesignChecker alloc] initWithSelf];
   self.launchdCSInfo = [[MOLCodesignChecker alloc] initWithPID:1];
@@ -241,7 +254,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 
 #pragma mark Entry Counts
 
-- (NSUInteger)ruleCount {
+- (int64_t)ruleCount {
   __block NSUInteger count = 0;
   [self inDatabase:^(FMDatabase *db) {
     count = [db longForQuery:@"SELECT COUNT(*) FROM rules"];
@@ -249,23 +262,23 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   return count;
 }
 
-- (NSUInteger)ruleCountForRuleType:(SNTRuleType)ruleType {
-  __block NSUInteger count = 0;
+- (int64_t)ruleCountForRuleType:(SNTRuleType)ruleType {
+  __block int64_t count = 0;
   [self inDatabase:^(FMDatabase *db) {
     count = [db longForQuery:@"SELECT COUNT(*) FROM rules WHERE type=?", @(ruleType)];
   }];
   return count;
 }
 
-- (NSUInteger)binaryRuleCount {
+- (int64_t)binaryRuleCount {
   return [self ruleCountForRuleType:SNTRuleTypeBinary];
 }
 
-- (NSUInteger)certificateRuleCount {
+- (int64_t)certificateRuleCount {
   return [self ruleCountForRuleType:SNTRuleTypeCertificate];
 }
 
-- (NSUInteger)compilerRuleCount {
+- (int64_t)compilerRuleCount {
   __block NSUInteger count = 0;
   [self inDatabase:^(FMDatabase *db) {
     count =
@@ -274,7 +287,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   return count;
 }
 
-- (NSUInteger)transitiveRuleCount {
+- (int64_t)transitiveRuleCount {
   __block NSUInteger count = 0;
   [self inDatabase:^(FMDatabase *db) {
     count =
@@ -283,26 +296,29 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   return count;
 }
 
-- (NSUInteger)teamIDRuleCount {
+- (int64_t)teamIDRuleCount {
   return [self ruleCountForRuleType:SNTRuleTypeTeamID];
 }
 
-- (NSUInteger)signingIDRuleCount {
+- (int64_t)signingIDRuleCount {
   return [self ruleCountForRuleType:SNTRuleTypeSigningID];
 }
 
-- (SNTRule *)ruleFromResultSet:(FMResultSet *)rs {
-  return [[SNTRule alloc] initWithIdentifier:[rs stringForColumn:@"identifier"]
-                                       state:[rs intForColumn:@"state"]
-                                        type:[rs intForColumn:@"type"]
-                                   customMsg:[rs stringForColumn:@"custommsg"]
-                                   timestamp:[rs intForColumn:@"timestamp"]];
+- (int64_t)cdhashRuleCount {
+  return [self ruleCountForRuleType:SNTRuleTypeCDHash];
 }
 
-- (SNTRule *)ruleForBinarySHA256:(NSString *)binarySHA256
-                       signingID:(NSString *)signingID
-               certificateSHA256:(NSString *)certificateSHA256
-                          teamID:(NSString *)teamID {
+- (SNTRule *)ruleFromResultSet:(FMResultSet *)rs {
+  SNTRule *r = [[SNTRule alloc] initWithIdentifier:[rs stringForColumn:@"identifier"]
+                                             state:[rs intForColumn:@"state"]
+                                              type:[rs intForColumn:@"type"]
+                                         customMsg:[rs stringForColumn:@"custommsg"]
+                                         timestamp:[rs intForColumn:@"timestamp"]];
+  r.customURL = [rs stringForColumn:@"customurl"];
+  return r;
+}
+
+- (SNTRule *)ruleForIdentifiers:(struct RuleIdentifiers)identifiers {
   __block SNTRule *rule;
 
   // Look for a static rule that matches.
@@ -310,22 +326,27 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   if (staticRules.count) {
     // IMPORTANT: The order static rules are checked here should be the same
     // order as given by the SQL query for the rules database.
-    rule = staticRules[binarySHA256];
+    rule = staticRules[identifiers.cdhash];
+    if (rule.type == SNTRuleTypeCDHash) {
+      return rule;
+    }
+
+    rule = staticRules[identifiers.binarySHA256];
     if (rule.type == SNTRuleTypeBinary) {
       return rule;
     }
 
-    rule = staticRules[signingID];
+    rule = staticRules[identifiers.signingID];
     if (rule.type == SNTRuleTypeSigningID) {
       return rule;
     }
 
-    rule = staticRules[certificateSHA256];
+    rule = staticRules[identifiers.certificateSHA256];
     if (rule.type == SNTRuleTypeCertificate) {
       return rule;
     }
 
-    rule = staticRules[teamID];
+    rule = staticRules[identifiers.teamID];
     if (rule.type == SNTRuleTypeTeamID) {
       return rule;
     }
@@ -336,9 +357,9 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // NOTE: This code is written with the intention that the binary rule is searched for first
   // as Santa is designed to go with the most-specific rule possible.
   //
-  // The intended order of precedence is Binaries > Signing IDs > Certificates > Team IDs.
+  // The intended order of precedence is CDHash > Binaries > Signing IDs > Certificates > Team IDs.
   //
-  // As such the query should have "ORDER BY type DESC" before the LIMIT, to ensure that is the
+  // As such the query should have "ORDER BY type ASC" before the LIMIT, to ensure that is the
   // case. However, in all tested versions of SQLite that ORDER BY clause is unnecessary: the query
   // is performed 'as written' by doing separate lookups in the index and the later lookups are if
   // the first returns a result. That behavior can be checked here: http://sqlfiddle.com/#!5/cdc42/1
@@ -351,12 +372,15 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   // There is a test for this in SNTRuleTableTests in case SQLite behavior changes in the future.
   //
   [self inDatabase:^(FMDatabase *db) {
-    FMResultSet *rs = [db executeQuery:@"SELECT * FROM rules WHERE "
-                                       @"   (identifier=? and type=1000) "
-                                       @"OR (identifier=? AND type=2000) "
-                                       @"OR (identifier=? AND type=3000) "
-                                       @"OR (identifier=? AND type=4000) LIMIT 1",
-                                       binarySHA256, signingID, certificateSHA256, teamID];
+    FMResultSet *rs =
+      [db executeQuery:@"SELECT * FROM rules WHERE "
+                       @"   (identifier=? AND type=500) "
+                       @"OR (identifier=? AND type=1000) "
+                       @"OR (identifier=? AND type=2000) "
+                       @"OR (identifier=? AND type=3000) "
+                       @"OR (identifier=? AND type=4000) LIMIT 1",
+                       identifiers.cdhash, identifiers.binarySHA256, identifiers.signingID,
+                       identifiers.certificateSHA256, identifiers.teamID];
     if ([rs next]) {
       rule = [self ruleFromResultSet:rs];
     }
@@ -365,8 +389,8 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 
   // Allow binaries signed by the "Software Signing" cert used to sign launchd
   // if no existing rule has matched.
-  if (!rule && [certificateSHA256 isEqual:self.launchdCSInfo.leafCertificate.SHA256]) {
-    rule = [[SNTRule alloc] initWithIdentifier:certificateSHA256
+  if (!rule && [identifiers.certificateSHA256 isEqual:self.launchdCSInfo.leafCertificate.SHA256]) {
+    rule = [[SNTRule alloc] initWithIdentifier:identifiers.certificateSHA256
                                          state:SNTRuleStateAllow
                                           type:SNTRuleTypeCertificate
                                      customMsg:nil
@@ -379,7 +403,7 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 #pragma mark Adding
 
 - (BOOL)addRules:(NSArray *)rules
-      cleanSlate:(BOOL)cleanSlate
+     ruleCleanup:(SNTRuleCleanup)cleanupType
            error:(NSError *__autoreleasing *)error {
   if (!rules || rules.count < 1) {
     [self fillError:error code:SNTRuleTableErrorEmptyRuleArray message:nil];
@@ -389,8 +413,10 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   __block BOOL failed = NO;
 
   [self inTransaction:^(FMDatabase *db, BOOL *rollback) {
-    if (cleanSlate) {
+    if (cleanupType == SNTRuleCleanupAll) {
       [db executeUpdate:@"DELETE FROM rules"];
+    } else if (cleanupType == SNTRuleCleanupNonTransitive) {
+      [db executeUpdate:@"DELETE FROM rules WHERE state != ?", @(SNTRuleStateAllowTransitive)];
     }
 
     for (SNTRule *rule in rules) {
@@ -410,10 +436,10 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
         }
       } else {
         if (![db executeUpdate:@"INSERT OR REPLACE INTO rules "
-                               @"(identifier, state, type, custommsg, timestamp) "
-                               @"VALUES (?, ?, ?, ?, ?);",
+                               @"(identifier, state, type, custommsg, customurl, timestamp) "
+                               @"VALUES (?, ?, ?, ?, ?, ?);",
                                rule.identifier, @(rule.state), @(rule.type), rule.customMsg,
-                               @(rule.timestamp)]) {
+                               rule.customURL, @(rule.timestamp)]) {
           [self fillError:error
                      code:SNTRuleTableErrorInsertOrReplaceFailed
                   message:[db lastErrorMessage]];
@@ -428,25 +454,59 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
 }
 
 - (BOOL)addedRulesShouldFlushDecisionCache:(NSArray *)rules {
-  // Check for non-plain-allowlist rules first before querying the database.
+  uint64_t nonAllowRuleCount = 0;
+
   for (SNTRule *rule in rules) {
-    if (rule.state != SNTRuleStateAllow) return YES;
+    // If the rule is a remove rule, act conservatively and flush the cache.
+    // This is to make sure cached rules of different precedence rules do not
+    // impact final decision.
+    if (rule.state == SNTRuleStateRemove) {
+      return YES;
+    }
+    if (rule.state != SNTRuleStateAllow) {
+      nonAllowRuleCount++;
+
+      // Just flush if we more than 1000 block rules.
+      if (nonAllowRuleCount >= 1000) return YES;
+    }
   }
 
-  // If still here, then all rules in the array are allowlist rules.  So now we look for allowlist
-  // rules where there is a previously existing allowlist compiler rule for the same identifier.
-  // If so we find such a rule, then cache should be flushed.
+  // Check newly synced rules for any blocking rules. If any are found, check
+  // in the db to see if they already exist. If they're not found or were
+  // previously allow rules flush the cache.
+  //
+  // If all rules in the array are allowlist rules,  look for allowlist rules
+  // where there is a previously existing allowlist compiler rule for the same
+  // identifier.  If so we find such a rule, then cache should be flushed.
   __block BOOL flushDecisionCache = NO;
+
   [self inTransaction:^(FMDatabase *db, BOOL *rollback) {
     for (SNTRule *rule in rules) {
-      // Allowlist certificate rules are ignored
-      if (rule.type == SNTRuleTypeCertificate) continue;
+      // If the rule is a block rule, silent block rule, or a compiler rule check if it already
+      // exists in the database.
+      //
+      // If it does not then flush the cache. To ensure that the new rule is honored.
+      if ((rule.state != SNTRuleStateAllow)) {
+        if ([db longForQuery:
+                  @"SELECT COUNT(*) FROM rules WHERE identifier=? AND type=? AND state=? LIMIT 1",
+                  rule.identifier, @(rule.type), @(rule.state)] == 0) {
+          flushDecisionCache = YES;
+          return;
+        }
+      } else {
+        // At this point we know the rule is an allowlist rule. Check if it's
+        // overriding a compiler rule.
 
-      if ([db longForQuery:
-                @"SELECT COUNT(*) FROM rules WHERE identifier=? AND type=? AND state=? LIMIT 1",
-                rule.identifier, @(SNTRuleTypeBinary), @(SNTRuleStateAllowCompiler)] > 0) {
-        flushDecisionCache = YES;
-        break;
+        // Skip certificate and TeamID rules as they cannot be compiler rules.
+        if (rule.type == SNTRuleTypeCertificate || rule.type == SNTRuleTypeTeamID) continue;
+
+        if ([db longForQuery:@"SELECT COUNT(*) FROM rules WHERE identifier=? AND type IN (?, ?, ?)"
+                             @" AND state=? LIMIT 1",
+                             rule.identifier, @(SNTRuleTypeCDHash), @(SNTRuleTypeBinary),
+                             @(SNTRuleTypeSigningID), @(SNTRuleStateAllowCompiler)] > 0) {
+          flushDecisionCache = YES;
+          return;
+        }
       }
     }
   }];
@@ -514,5 +574,19 @@ static void addPathsFromDefaultMuteSet(NSMutableSet *criticalPaths) API_AVAILABL
   *error = [NSError errorWithDomain:@"com.google.santad.ruletable" code:code userInfo:d];
   return YES;
 }
+#pragma mark Querying
+
+// Retrieve all rules from the Database
+- (NSArray<SNTRule *> *)retrieveAllRules {
+  NSMutableArray<SNTRule *> *rules = [NSMutableArray array];
+  [self inDatabase:^(FMDatabase *db) {
+    FMResultSet *rs = [db executeQuery:@"SELECT * FROM rules"];
+    while ([rs next]) {
+      [rules addObject:[self ruleFromResultSet:rs]];
+    }
+    [rs close];
+  }];
+  return rules;
+}
 
 @end

Source/santad/DataLayer/SNTRuleTableTest.m

@@ -14,15 +14,19 @@
 
 #import <MOLCertificate/MOLCertificate.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
+#import <OCMock/OCMock.h>
 #import <XCTest/XCTest.h>
 
+#import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTRule.h"
+#import "Source/common/SNTRuleIdentifiers.h"
 #import "Source/santad/DataLayer/SNTRuleTable.h"
 
 /// This test case actually tests SNTRuleTable and SNTRule
 @interface SNTRuleTableTest : XCTestCase
 @property SNTRuleTable *sut;
 @property FMDatabaseQueue *dbq;
+@property id mockConfigurator;
 @end
 
 @implementation SNTRuleTableTest
@@ -32,11 +36,18 @@
 
   self.dbq = [[FMDatabaseQueue alloc] init];
   self.sut = [[SNTRuleTable alloc] initWithDatabaseQueue:self.dbq];
+
+  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
+  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
+}
+
+- (void)tearDown {
+  [self.mockConfigurator stopMocking];
 }
 
 - (SNTRule *)_exampleTeamIDRule {
   SNTRule *r = [[SNTRule alloc] init];
-  r.identifier = @"teamID";
+  r.identifier = @"ABCDEFGHIJ";
   r.state = SNTRuleStateBlock;
   r.type = SNTRuleTypeTeamID;
   r.customMsg = @"A teamID rule";
@@ -48,11 +59,20 @@
   if (isPlatformBinary) {
     r.identifier = @"platform:signingID";
   } else {
-    r.identifier = @"teamID:signingID";
+    r.identifier = @"ABCDEFGHIJ:signingID";
   }
   r.state = SNTRuleStateBlock;
   r.type = SNTRuleTypeSigningID;
-  r.customMsg = @"A teamID rule";
+  r.customMsg = @"A signingID rule";
+  return r;
+}
+
+- (SNTRule *)_exampleCDHashRule {
+  SNTRule *r = [[SNTRule alloc] init];
+  r.identifier = @"dbe8c39801f93e05fc7bc53a02af5b4d3cfc670a";
+  r.state = SNTRuleStateBlock;
+  r.type = SNTRuleTypeCDHash;
+  r.customMsg = @"A cdhash rule";
   return r;
 }
 
@@ -65,6 +85,15 @@
   return r;
 }
 
+- (SNTRule *)_exampleTransitiveRule {
+  SNTRule *r = [[SNTRule alloc] init];
+  r.identifier = @"1111e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b111";
+  r.state = SNTRuleStateAllowTransitive;
+  r.type = SNTRuleTypeBinary;
+  r.customMsg = @"Transitive rule";
+  return r;
+}
+
 - (SNTRule *)_exampleCertRule {
   SNTRule *r = [[SNTRule alloc] init];
   r.identifier = @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258";
@@ -78,7 +107,7 @@
   NSUInteger binaryRuleCount = self.sut.binaryRuleCount;
 
   NSError *error;
-  [self.sut addRules:@[ [self _exampleBinaryRule] ] cleanSlate:NO error:&error];
+  [self.sut addRules:@[ [self _exampleBinaryRule] ] ruleCleanup:SNTRuleCleanupNone error:&error];
 
   XCTAssertEqual(self.sut.ruleCount, ruleCount + 1);
   XCTAssertEqual(self.sut.binaryRuleCount, binaryRuleCount + 1);
@@ -88,24 +117,49 @@
 - (void)testAddRulesClean {
   // Add a binary rule without clean slate
   NSError *error = nil;
-  XCTAssertTrue([self.sut addRules:@[ [self _exampleBinaryRule] ] cleanSlate:NO error:&error]);
+  XCTAssertTrue([self.sut addRules:@[ [self _exampleBinaryRule] ]
+                       ruleCleanup:SNTRuleCleanupNone
+                             error:&error]);
   XCTAssertNil(error);
 
   // Now add a cert rule with a clean slate, assert that the binary rule was removed
   error = nil;
-  XCTAssertTrue(([self.sut addRules:@[ [self _exampleCertRule] ] cleanSlate:YES error:&error]));
+  XCTAssertTrue(([self.sut addRules:@[ [self _exampleCertRule] ]
+                        ruleCleanup:SNTRuleCleanupAll
+                              error:&error]));
   XCTAssertEqual([self.sut binaryRuleCount], 0);
   XCTAssertNil(error);
 }
 
+- (void)testAddRulesCleanNonTransitive {
+  // Add a multiple binary rules, including a transitive rule
+  NSError *error = nil;
+  XCTAssertTrue(([self.sut addRules:@[
+    [self _exampleBinaryRule], [self _exampleCertRule], [self _exampleTransitiveRule]
+  ]
+                        ruleCleanup:SNTRuleCleanupNone
+                              error:&error]));
+  XCTAssertEqual([self.sut binaryRuleCount], 2);
+  XCTAssertNil(error);
+
+  // Now add a cert rule while cleaning non-transitive rules. Ensure the transitive rule remains
+  error = nil;
+  XCTAssertTrue(([self.sut addRules:@[ [self _exampleCertRule] ]
+                        ruleCleanup:SNTRuleCleanupNonTransitive
+                              error:&error]));
+  XCTAssertEqual([self.sut binaryRuleCount], 1);
+  XCTAssertEqual([self.sut certificateRuleCount], 1);
+  XCTAssertNil(error);
+}
+
 - (void)testAddMultipleRules {
   NSUInteger ruleCount = self.sut.ruleCount;
 
   NSError *error;
   [self.sut
-      addRules:@[ [self _exampleBinaryRule], [self _exampleCertRule], [self _exampleBinaryRule] ]
-    cleanSlate:NO
-         error:&error];
+       addRules:@[ [self _exampleBinaryRule], [self _exampleCertRule], [self _exampleBinaryRule] ]
+    ruleCleanup:SNTRuleCleanupNone
+          error:&error];
 
   XCTAssertEqual(self.sut.ruleCount, ruleCount + 2);
   XCTAssertNil(error);
@@ -113,13 +167,13 @@
 
 - (void)testAddRulesEmptyArray {
   NSError *error;
-  XCTAssertFalse([self.sut addRules:@[] cleanSlate:YES error:&error]);
+  XCTAssertFalse([self.sut addRules:@[] ruleCleanup:SNTRuleCleanupAll error:&error]);
   XCTAssertEqual(error.code, SNTRuleTableErrorEmptyRuleArray);
 }
 
 - (void)testAddRulesNilArray {
   NSError *error;
-  XCTAssertFalse([self.sut addRules:nil cleanSlate:YES error:&error]);
+  XCTAssertFalse([self.sut addRules:nil ruleCleanup:SNTRuleCleanupAll error:&error]);
   XCTAssertEqual(error.code, SNTRuleTableErrorEmptyRuleArray);
 }
 
@@ -129,74 +183,72 @@
   r.type = SNTRuleTypeCertificate;
 
   NSError *error;
-  XCTAssertFalse([self.sut addRules:@[ r ] cleanSlate:NO error:&error]);
+  XCTAssertFalse([self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error]);
   XCTAssertEqual(error.code, SNTRuleTableErrorInvalidRule);
 }
 
 - (void)testFetchBinaryRule {
   [self.sut addRules:@[ [self _exampleBinaryRule], [self _exampleCertRule] ]
-          cleanSlate:NO
+         ruleCleanup:SNTRuleCleanupNone
                error:nil];
 
   SNTRule *r = [self.sut
-    ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
-              signingID:nil
-      certificateSHA256:nil
-                 teamID:nil];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .binarySHA256 =
+                           @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670",
+                       }];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670");
   XCTAssertEqual(r.type, SNTRuleTypeBinary);
 
   r = [self.sut
-    ruleForBinarySHA256:@"b6ee1c3c5a715c049d14a8457faa6b6701b8507efe908300e238e0768bd759c2"
-              signingID:nil
-      certificateSHA256:nil
-                 teamID:nil];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .binarySHA256 =
+                           @"b6ee1c3c5a715c049d14a8457faa6b6701b8507efe908300e238e0768bd759c2",
+                       }];
   XCTAssertNil(r);
 }
 
 - (void)testFetchCertificateRule {
   [self.sut addRules:@[ [self _exampleBinaryRule], [self _exampleCertRule] ]
-          cleanSlate:NO
+         ruleCleanup:SNTRuleCleanupNone
                error:nil];
 
   SNTRule *r = [self.sut
-    ruleForBinarySHA256:nil
-              signingID:nil
-      certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
-                 teamID:nil];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .certificateSHA256 =
+                           @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258",
+                       }];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258");
   XCTAssertEqual(r.type, SNTRuleTypeCertificate);
 
   r = [self.sut
-    ruleForBinarySHA256:nil
-              signingID:nil
-      certificateSHA256:@"5bdab1288fc16892fef50c658db54f1e2e19cf8f71cc55f77de2b95e051e2562"
-                 teamID:nil];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .certificateSHA256 =
+                           @"5bdab1288fc16892fef50c658db54f1e2e19cf8f71cc55f77de2b95e051e2562",
+                       }];
   XCTAssertNil(r);
 }
 
 - (void)testFetchTeamIDRule {
   [self.sut addRules:@[ [self _exampleBinaryRule], [self _exampleTeamIDRule] ]
-          cleanSlate:NO
+         ruleCleanup:SNTRuleCleanupNone
                error:nil];
 
-  SNTRule *r = [self.sut ruleForBinarySHA256:nil
-                                   signingID:nil
-                           certificateSHA256:nil
-                                      teamID:@"teamID"];
+  SNTRule *r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                              .teamID = @"ABCDEFGHIJ",
+                                            }];
   XCTAssertNotNil(r);
-  XCTAssertEqualObjects(r.identifier, @"teamID");
+  XCTAssertEqualObjects(r.identifier, @"ABCDEFGHIJ");
   XCTAssertEqual(r.type, SNTRuleTypeTeamID);
   XCTAssertEqual([self.sut teamIDRuleCount], 1);
 
-  r = [self.sut ruleForBinarySHA256:nil
-                          signingID:nil
-                  certificateSHA256:nil
-                             teamID:@"nonexistentTeamID"];
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .teamID = @"nonexistentTeamID",
+                                   }];
   XCTAssertNil(r);
 }
 
@@ -205,86 +257,148 @@
     [self _exampleBinaryRule], [self _exampleSigningIDRuleIsPlatform:YES],
     [self _exampleSigningIDRuleIsPlatform:NO]
   ]
-          cleanSlate:NO
+         ruleCleanup:SNTRuleCleanupNone
                error:nil];
 
   XCTAssertEqual([self.sut signingIDRuleCount], 2);
 
-  SNTRule *r = [self.sut ruleForBinarySHA256:nil
-                                   signingID:@"teamID:signingID"
-                           certificateSHA256:nil
-                                      teamID:nil];
+  SNTRule *r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                              .signingID = @"ABCDEFGHIJ:signingID",
+                                            }];
 
   XCTAssertNotNil(r);
-  XCTAssertEqualObjects(r.identifier, @"teamID:signingID");
+  XCTAssertEqualObjects(r.identifier, @"ABCDEFGHIJ:signingID");
   XCTAssertEqual(r.type, SNTRuleTypeSigningID);
 
-  r = [self.sut ruleForBinarySHA256:nil
-                          signingID:@"platform:signingID"
-                  certificateSHA256:nil
-                             teamID:nil];
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .signingID = @"platform:signingID",
+                                   }];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier, @"platform:signingID");
   XCTAssertEqual(r.type, SNTRuleTypeSigningID);
 
-  r = [self.sut ruleForBinarySHA256:nil signingID:@"nonexistent" certificateSHA256:nil teamID:nil];
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .signingID = @"nonexistent",
+                                   }];
+  XCTAssertNil(r);
+}
+
+- (void)testFetchCDHashRule {
+  [self.sut
+       addRules:@[ [self _exampleBinaryRule], [self _exampleTeamIDRule], [self _exampleCDHashRule] ]
+    ruleCleanup:SNTRuleCleanupNone
+          error:nil];
+
+  XCTAssertEqual([self.sut cdhashRuleCount], 1);
+
+  SNTRule *r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                              .cdhash = @"dbe8c39801f93e05fc7bc53a02af5b4d3cfc670a",
+                                            }];
+
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"dbe8c39801f93e05fc7bc53a02af5b4d3cfc670a");
+  XCTAssertEqual(r.type, SNTRuleTypeCDHash);
+
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .cdhash = @"nonexistent",
+                                   }];
   XCTAssertNil(r);
 }
 
 - (void)testFetchRuleOrdering {
+  NSError *err;
   [self.sut addRules:@[
-    [self _exampleCertRule], [self _exampleBinaryRule], [self _exampleTeamIDRule],
-    [self _exampleSigningIDRuleIsPlatform:NO]
+    [self _exampleCertRule],
+    [self _exampleBinaryRule],
+    [self _exampleTeamIDRule],
+    [self _exampleSigningIDRuleIsPlatform:NO],
+    [self _exampleCDHashRule],
   ]
-          cleanSlate:NO
-               error:nil];
+         ruleCleanup:SNTRuleCleanupNone
+               error:&err];
+  XCTAssertNil(err);
 
   // This test verifies that the implicit rule ordering we've been abusing is still working.
-  // See the comment in SNTRuleTable#ruleForBinarySHA256:certificateSHA256:teamID
+  // See the comment in SNTRuleTable#ruleForIdentifiers:
   SNTRule *r = [self.sut
-    ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
-              signingID:@"teamID:signingID"
-      certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
-                 teamID:@"teamID"];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .cdhash = @"dbe8c39801f93e05fc7bc53a02af5b4d3cfc670a",
+                         .binarySHA256 =
+                           @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670",
+                         .signingID = @"ABCDEFGHIJ:signingID",
+                         .certificateSHA256 =
+                           @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258",
+                         .teamID = @"ABCDEFGHIJ",
+                       }];
+  XCTAssertNotNil(r);
+  XCTAssertEqualObjects(r.identifier, @"dbe8c39801f93e05fc7bc53a02af5b4d3cfc670a");
+  XCTAssertEqual(r.type, SNTRuleTypeCDHash, @"Implicit rule ordering failed");
+
+  r = [self.sut
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .cdhash = @"unknown",
+                         .binarySHA256 =
+                           @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670",
+                         .signingID = @"ABCDEFGHIJ:signingID",
+                         .certificateSHA256 =
+                           @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258",
+                         .teamID = @"ABCDEFGHIJ",
+                       }];
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670");
   XCTAssertEqual(r.type, SNTRuleTypeBinary, @"Implicit rule ordering failed");
 
   r = [self.sut
-    ruleForBinarySHA256:@"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670"
-              signingID:@"teamID:signingID"
-      certificateSHA256:@"unknowncert"
-                 teamID:@"teamID"];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .cdhash = @"unknown",
+                         .binarySHA256 =
+                           @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670",
+                         .signingID = @"ABCDEFGHIJ:signingID",
+                         .certificateSHA256 = @"unknown",
+                         .teamID = @"ABCDEFGHIJ",
+                       }];
+
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"b7c1e3fd640c5f211c89b02c2c6122f78ce322aa5c56eb0bb54bc422a8f8b670");
   XCTAssertEqual(r.type, SNTRuleTypeBinary, @"Implicit rule ordering failed");
 
   r = [self.sut
-    ruleForBinarySHA256:@"unknown"
-              signingID:@"unknown"
-      certificateSHA256:@"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258"
-                 teamID:@"teamID"];
+    ruleForIdentifiers:(struct RuleIdentifiers){
+                         .cdhash = @"unknown",
+                         .binarySHA256 = @"unknown",
+                         .signingID = @"unknown",
+                         .certificateSHA256 =
+                           @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258",
+                         .teamID = @"ABCDEFGHIJ",
+                       }];
+
   XCTAssertNotNil(r);
   XCTAssertEqualObjects(r.identifier,
                         @"7ae80b9ab38af0c63a9a81765f434d9a7cd8f720eb6037ef303de39d779bc258");
   XCTAssertEqual(r.type, SNTRuleTypeCertificate, @"Implicit rule ordering failed");
 
-  r = [self.sut ruleForBinarySHA256:@"unknown"
-                          signingID:@"teamID:signingID"
-                  certificateSHA256:@"unknown"
-                             teamID:@"teamID"];
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .cdhash = @"unknown",
+                                     .binarySHA256 = @"unknown",
+                                     .signingID = @"ABCDEFGHIJ:signingID",
+                                     .certificateSHA256 = @"unknown",
+                                     .teamID = @"ABCDEFGHIJ",
+                                   }];
   XCTAssertNotNil(r);
-  XCTAssertEqualObjects(r.identifier, @"teamID:signingID");
+  XCTAssertEqualObjects(r.identifier, @"ABCDEFGHIJ:signingID");
   XCTAssertEqual(r.type, SNTRuleTypeSigningID, @"Implicit rule ordering failed (SigningID)");
 
-  r = [self.sut ruleForBinarySHA256:@"unknown"
-                          signingID:@"unknown"
-                  certificateSHA256:@"unknown"
-                             teamID:@"teamID"];
+  r = [self.sut ruleForIdentifiers:(struct RuleIdentifiers){
+                                     .cdhash = @"unknown",
+                                     .binarySHA256 = @"unknown",
+                                     .signingID = @"unknown",
+                                     .certificateSHA256 = @"unknown",
+                                     .teamID = @"ABCDEFGHIJ",
+                                   }];
   XCTAssertNotNil(r);
-  XCTAssertEqualObjects(r.identifier, @"teamID");
+  XCTAssertEqualObjects(r.identifier, @"ABCDEFGHIJ");
   XCTAssertEqual(r.type, SNTRuleTypeTeamID, @"Implicit rule ordering failed (TeamID)");
 }
 
@@ -295,10 +409,108 @@
   FMDatabaseQueue *dbq = [[FMDatabaseQueue alloc] initWithPath:dbPath];
   SNTRuleTable *sut = [[SNTRuleTable alloc] initWithDatabaseQueue:dbq];
 
-  [sut addRules:@[ [self _exampleBinaryRule] ] cleanSlate:NO error:nil];
+  [sut addRules:@[ [self _exampleBinaryRule] ] ruleCleanup:SNTRuleCleanupNone error:nil];
   XCTAssertGreaterThan(sut.ruleCount, 0);
 
   [[NSFileManager defaultManager] removeItemAtPath:dbPath error:NULL];
 }
 
+- (void)testRetrieveAllRulesWithEmptyDatabase {
+  NSArray<SNTRule *> *rules = [self.sut retrieveAllRules];
+  XCTAssertEqual(rules.count, 0);
+}
+
+- (void)testRetrieveAllRulesWithMultipleRules {
+  [self.sut addRules:@[
+    [self _exampleCertRule],
+    [self _exampleBinaryRule],
+    [self _exampleTeamIDRule],
+    [self _exampleSigningIDRuleIsPlatform:NO],
+    [self _exampleCDHashRule],
+  ]
+         ruleCleanup:SNTRuleCleanupNone
+               error:nil];
+
+  NSArray<SNTRule *> *rules = [self.sut retrieveAllRules];
+  XCTAssertEqual(rules.count, 5);
+  XCTAssertEqualObjects(rules[0], [self _exampleCertRule]);
+  XCTAssertEqualObjects(rules[1], [self _exampleBinaryRule]);
+  XCTAssertEqualObjects(rules[2], [self _exampleTeamIDRule]);
+  XCTAssertEqualObjects(rules[3], [self _exampleSigningIDRuleIsPlatform:NO]);
+  XCTAssertEqualObjects(rules[4], [self _exampleCDHashRule]);
+}
+
+- (void)testAddedRulesShouldFlushDecisionCacheWithNewBlockRule {
+  // Ensure that a brand new block rule flushes the decision cache.
+  NSError *error;
+  SNTRule *r = [self _exampleBinaryRule];
+  [self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error];
+  XCTAssertNil(error);
+  XCTAssertEqual(self.sut.ruleCount, 1);
+  XCTAssertEqual(self.sut.binaryRuleCount, 1);
+
+  // Change the identifer so that the hash of a block rule is not found in the
+  // db.
+  r.identifier = @"bfff7d3f6c389ebf7a76a666c484d42ea447834901bc29141439ae7c7b96ff09";
+  XCTAssertEqual(YES, [self.sut addedRulesShouldFlushDecisionCache:@[ r ]]);
+}
+
+// Ensure that a brand new block rule flushes the decision cache.
+- (void)testAddedRulesShouldFlushDecisionCacheWithOldBlockRule {
+  NSError *error;
+  SNTRule *r = [self _exampleBinaryRule];
+  [self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error];
+  XCTAssertNil(error);
+  XCTAssertEqual(self.sut.ruleCount, 1);
+  XCTAssertEqual(self.sut.binaryRuleCount, 1);
+  XCTAssertEqual(NO, [self.sut addedRulesShouldFlushDecisionCache:@[ r ]]);
+}
+
+// Ensure that a larger number of blocks flushes the decision cache.
+- (void)testAddedRulesShouldFlushDecisionCacheWithLargeNumberOfBlocks {
+  NSError *error;
+  SNTRule *r = [self _exampleBinaryRule];
+  [self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error];
+  XCTAssertNil(error);
+  XCTAssertEqual(self.sut.ruleCount, 1);
+  XCTAssertEqual(self.sut.binaryRuleCount, 1);
+  NSMutableArray<SNTRule *> *newRules = [NSMutableArray array];
+  for (int i = 0; i < 1000; i++) {
+    newRules[i] = r;
+  }
+
+  XCTAssertEqual(YES, [self.sut addedRulesShouldFlushDecisionCache:newRules]);
+}
+
+// Ensure that an allow rule that overrides a compiler rule flushes the
+// decision cache.
+- (void)testAddedRulesShouldFlushDecisionCacheWithCompilerRule {
+  NSError *error;
+  SNTRule *r = [self _exampleBinaryRule];
+  r.type = SNTRuleTypeBinary;
+  r.state = SNTRuleStateAllowCompiler;
+  [self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error];
+  XCTAssertNil(error);
+  XCTAssertEqual(self.sut.ruleCount, 1);
+  XCTAssertEqual(self.sut.binaryRuleCount, 1);
+  // make the rule an allow rule
+  r.state = SNTRuleStateAllow;
+  XCTAssertEqual(YES, [self.sut addedRulesShouldFlushDecisionCache:@[ r ]]);
+}
+
+// Ensure that an Remove rule targeting an allow rule causes a flush of the cache.
+- (void)testAddedRulesShouldFlushDecisionCacheWithRemoveRule {
+  NSError *error;
+  SNTRule *r = [self _exampleBinaryRule];
+  r.type = SNTRuleTypeBinary;
+  r.state = SNTRuleStateAllow;
+  [self.sut addRules:@[ r ] ruleCleanup:SNTRuleCleanupNone error:&error];
+  XCTAssertNil(error);
+  XCTAssertEqual(self.sut.ruleCount, 1);
+  XCTAssertEqual(self.sut.binaryRuleCount, 1);
+
+  r.state = SNTRuleStateRemove;
+  XCTAssertEqual(YES, [self.sut addedRulesShouldFlushDecisionCache:@[ r ]]);
+}
+
 @end

Source/santad/DataLayer/WatchItemPolicy.h

@@ -15,6 +15,7 @@
 #ifndef SANTA__SANTAD__DATALAYER_WATCHITEMPOLICY_H
 #define SANTA__SANTAD__DATALAYER_WATCHITEMPOLICY_H
 
+#import <Foundation/Foundation.h>
 #include <Kernel/kern/cs_blobs.h>
 
 #include <optional>
@@ -22,23 +23,24 @@
 #include <string_view>
 #include <vector>
 
-namespace santa::santad::data_layer {
+namespace santa {
 
 enum class WatchItemPathType {
   kPrefix,
   kLiteral,
 };
 
-static constexpr WatchItemPathType kWatchItemPolicyDefaultPathType =
-    WatchItemPathType::kLiteral;
+static constexpr WatchItemPathType kWatchItemPolicyDefaultPathType = WatchItemPathType::kLiteral;
 static constexpr bool kWatchItemPolicyDefaultAllowReadAccess = false;
 static constexpr bool kWatchItemPolicyDefaultAuditOnly = true;
 static constexpr bool kWatchItemPolicyDefaultInvertProcessExceptions = false;
+static constexpr bool kWatchItemPolicyDefaultEnableSilentMode = false;
+static constexpr bool kWatchItemPolicyDefaultEnableSilentTTYMode = false;
 
 struct WatchItemPolicy {
   struct Process {
-    Process(std::string bp, std::string sid, std::string ti,
-            std::vector<uint8_t> cdh, std::string ch, std::optional<bool> pb)
+    Process(std::string bp, std::string sid, std::string ti, std::vector<uint8_t> cdh,
+            std::string ch, std::optional<bool> pb)
         : binary_path(bp),
           signing_id(sid),
           team_id(ti),
@@ -47,13 +49,11 @@ struct WatchItemPolicy {
           platform_binary(pb) {}
 
     bool operator==(const Process &other) const {
-      return binary_path == other.binary_path &&
-             signing_id == other.signing_id && team_id == other.team_id &&
-             cdhash == other.cdhash &&
+      return binary_path == other.binary_path && signing_id == other.signing_id &&
+             team_id == other.team_id && cdhash == other.cdhash &&
              certificate_sha256 == other.certificate_sha256 &&
              platform_binary.has_value() == other.platform_binary.has_value() &&
-             platform_binary.value_or(false) ==
-                 other.platform_binary.value_or(false);
+             platform_binary.value_or(false) == other.platform_binary.value_or(false);
     }
 
     bool operator!=(const Process &other) const { return !(*this == other); }
@@ -71,27 +71,34 @@ struct WatchItemPolicy {
                   bool ara = kWatchItemPolicyDefaultAllowReadAccess,
                   bool ao = kWatchItemPolicyDefaultAuditOnly,
                   bool ipe = kWatchItemPolicyDefaultInvertProcessExceptions,
-                  std::vector<Process> procs = {})
+                  bool esm = kWatchItemPolicyDefaultEnableSilentMode,
+                  bool estm = kWatchItemPolicyDefaultEnableSilentTTYMode, std::string_view cm = "",
+                  NSString *edu = nil, NSString *edt = nil, std::vector<Process> procs = {})
       : name(n),
         path(p),
         path_type(pt),
         allow_read_access(ara),
         audit_only(ao),
         invert_process_exceptions(ipe),
+        silent(esm),
+        silent_tty(estm),
+        custom_message(cm.length() == 0 ? std::nullopt : std::make_optional<std::string>(cm)),
+        // Note: Empty string considered valid for event_detail_url to allow rules
+        // overriding global setting in order to hide the button.
+        event_detail_url(edu == nil ? std::nullopt : std::make_optional<NSString *>(edu)),
+        event_detail_text(edt.length == 0 ? std::nullopt : std::make_optional<NSString *>(edt)),
         processes(std::move(procs)) {}
 
   bool operator==(const WatchItemPolicy &other) const {
-    return name == other.name && path == other.path &&
-           path_type == other.path_type &&
-           allow_read_access == other.allow_read_access &&
-           audit_only == other.audit_only &&
-           invert_process_exceptions == other.invert_process_exceptions &&
-           processes == other.processes;
+    // Note: custom_message, event_detail_url, and event_detail_text are not currently considered
+    // for equality purposes
+    return name == other.name && path == other.path && path_type == other.path_type &&
+           allow_read_access == other.allow_read_access && audit_only == other.audit_only &&
+           invert_process_exceptions == other.invert_process_exceptions && silent == other.silent &&
+           silent_tty == other.silent_tty && processes == other.processes;
   }
 
-  bool operator!=(const WatchItemPolicy &other) const {
-    return !(*this == other);
-  }
+  bool operator!=(const WatchItemPolicy &other) const { return !(*this == other); }
 
   std::string name;
   std::string path;
@@ -99,13 +106,17 @@ struct WatchItemPolicy {
   bool allow_read_access;
   bool audit_only;
   bool invert_process_exceptions;
+  bool silent;
+  bool silent_tty;
+  std::optional<std::string> custom_message;
+  std::optional<NSString *> event_detail_url;
+  std::optional<NSString *> event_detail_text;
   std::vector<Process> processes;
 
   // WIP - No current way to control via config
-  bool silent = true;
   std::string version = "temp_version";
 };
 
-}  // namespace santa::santad::data_layer
+}  // namespace santa
 
 #endif

Source/santad/DataLayer/WatchItems.h

@@ -40,6 +40,9 @@ extern NSString *const kWatchItemConfigKeyOptions;
 extern NSString *const kWatchItemConfigKeyOptionsAllowReadAccess;
 extern NSString *const kWatchItemConfigKeyOptionsAuditOnly;
 extern NSString *const kWatchItemConfigKeyOptionsInvertProcessExceptions;
+extern NSString *const kWatchItemConfigKeyOptionsEnableSilentMode;
+extern NSString *const kWatchItemConfigKeyOptionsEnableSilentTTYMode;
+extern NSString *const kWatchItemConfigKeyOptionsCustomMessage;
 extern NSString *const kWatchItemConfigKeyProcesses;
 extern NSString *const kWatchItemConfigKeyProcessesBinaryPath;
 extern NSString *const kWatchItemConfigKeyProcessesCertificateSha256;
@@ -49,11 +52,11 @@ extern NSString *const kWatchItemConfigKeyProcessesCDHash;
 extern NSString *const kWatchItemConfigKeyProcessesPlatformBinary;
 
 // Forward declarations
-namespace santa::santad::data_layer {
+namespace santa {
 class WatchItemsPeer;
 }
 
-namespace santa::santad::data_layer {
+namespace santa {
 
 struct WatchItemsState {
   uint64_t rule_count;
@@ -66,7 +69,7 @@ class WatchItems : public std::enable_shared_from_this<WatchItems> {
  public:
   using VersionAndPolicies =
     std::pair<std::string, std::vector<std::optional<std::shared_ptr<WatchItemPolicy>>>>;
-  using WatchItemsTree = santa::common::PrefixTree<std::shared_ptr<WatchItemPolicy>>;
+  using WatchItemsTree = santa::PrefixTree<std::shared_ptr<WatchItemPolicy>>;
 
   // Factory
   static std::shared_ptr<WatchItems> Create(NSString *config_path,
@@ -93,7 +96,10 @@ class WatchItems : public std::enable_shared_from_this<WatchItems> {
 
   std::optional<WatchItemsState> State();
 
-  friend class santa::santad::data_layer::WatchItemsPeer;
+  std::pair<NSString *, NSString *> EventDetailLinkInfo(
+    const std::shared_ptr<WatchItemPolicy> &watch_item);
+
+  friend class santa::WatchItemsPeer;
 
  private:
   static std::shared_ptr<WatchItems> CreateInternal(NSString *config_path, NSDictionary *config,
@@ -125,8 +131,10 @@ class WatchItems : public std::enable_shared_from_this<WatchItems> {
   std::string policy_version_ ABSL_GUARDED_BY(lock_);
   std::set<id<SNTEndpointSecurityDynamicEventHandler>> registerd_clients_ ABSL_GUARDED_BY(lock_);
   bool periodic_task_started_ = false;
+  NSString *policy_event_detail_url_ ABSL_GUARDED_BY(lock_);
+  NSString *policy_event_detail_text_ ABSL_GUARDED_BY(lock_);
 };
 
-}  // namespace santa::santad::data_layer
+}  // namespace santa
 
 #endif

Source/santad/DataLayer/WatchItems.mm

@@ -38,14 +38,16 @@
 #import "Source/common/Unit.h"
 #include "Source/santad/DataLayer/WatchItemPolicy.h"
 
-using santa::common::NSStringToUTF8String;
-using santa::common::NSStringToUTF8StringView;
-using santa::common::PrefixTree;
-using santa::common::Unit;
-using santa::santad::data_layer::WatchItemPathType;
-using santa::santad::data_layer::WatchItemPolicy;
+using santa::NSStringToUTF8String;
+using santa::NSStringToUTF8StringView;
+using santa::PrefixTree;
+using santa::Unit;
+using santa::WatchItemPathType;
+using santa::WatchItemPolicy;
 
 NSString *const kWatchItemConfigKeyVersion = @"Version";
+NSString *const kWatchItemConfigKeyEventDetailURL = @"EventDetailURL";
+NSString *const kWatchItemConfigKeyEventDetailText = @"EventDetailText";
 NSString *const kWatchItemConfigKeyWatchItems = @"WatchItems";
 NSString *const kWatchItemConfigKeyPaths = @"Paths";
 NSString *const kWatchItemConfigKeyPathsPath = @"Path";
@@ -54,6 +56,11 @@ NSString *const kWatchItemConfigKeyOptions = @"Options";
 NSString *const kWatchItemConfigKeyOptionsAllowReadAccess = @"AllowReadAccess";
 NSString *const kWatchItemConfigKeyOptionsAuditOnly = @"AuditOnly";
 NSString *const kWatchItemConfigKeyOptionsInvertProcessExceptions = @"InvertProcessExceptions";
+NSString *const kWatchItemConfigKeyOptionsEnableSilentMode = @"EnableSilentMode";
+NSString *const kWatchItemConfigKeyOptionsEnableSilentTTYMode = @"EnableSilentTTYMode";
+NSString *const kWatchItemConfigKeyOptionsCustomMessage = @"BlockMessage";
+NSString *const kWatchItemConfigKeyOptionsEventDetailURL = kWatchItemConfigKeyEventDetailURL;
+NSString *const kWatchItemConfigKeyOptionsEventDetailText = kWatchItemConfigKeyEventDetailText;
 NSString *const kWatchItemConfigKeyProcesses = @"Processes";
 NSString *const kWatchItemConfigKeyProcessesBinaryPath = @"BinaryPath";
 NSString *const kWatchItemConfigKeyProcessesCertificateSha256 = @"CertificateSha256";
@@ -73,13 +80,31 @@ static constexpr NSUInteger kMaxSigningIDLength = 512;
 // churn rebuilding glob paths based on the state of the filesystem.
 static constexpr uint64_t kMinReapplyConfigFrequencySecs = 15;
 
-namespace santa::santad::data_layer {
+// Semi-arbitrary max custom message length. The goal is to protect against
+// potential unbounded lengths, but no real reason this cannot be higher.
+static constexpr NSUInteger kWatchItemConfigOptionCustomMessageMaxLength = 2048;
 
+// Semi-arbitrary max event detail text length. The text has to fit on a button
+// and shouldn't be too large.
+static constexpr NSUInteger kWatchItemConfigEventDetailTextMaxLength = 48;
+
+// Servers are recommended to support up to 8000 octets.
+// https://www.rfc-editor.org/rfc/rfc9110#section-4.1-5
+//
+// Seems excessive but no good reason to not allow long URLs. However because
+// the URL supports pseudo-format strings that can extend the length, a smaller
+// max is used here.
+static constexpr NSUInteger kWatchItemConfigEventDetailURLMaxLength = 6000;
+
+namespace santa {
+
+namespace {
 // Type aliases
 using ValidatorBlock = bool (^)(id, NSError **);
 using PathAndTypePair = std::pair<std::string, WatchItemPathType>;
-using PathList = std::vector<PathAndTypePair>;
-using ProcessList = std::vector<WatchItemPolicy::Process>;
+using PathAndTypeVec = std::vector<PathAndTypePair>;
+using PolicyProcessVec = std::vector<WatchItemPolicy::Process>;
+}  // namespace
 
 static void PopulateError(NSError **err, NSString *msg) {
   if (err) {
@@ -126,6 +151,10 @@ static std::vector<uint8_t> HexStringToBytes(NSString *str) {
   return bytes;
 }
 
+static inline bool GetBoolValue(NSDictionary *options, NSString *key, bool default_value) {
+  return options[key] ? [options[key] boolValue] : default_value;
+}
+
 // Given a length, returns a ValidatorBlock that confirms the
 // string is a valid hex string of the given length.
 ValidatorBlock HexValidator(NSUInteger expected_length) {
@@ -140,8 +169,8 @@ ValidatorBlock HexValidator(NSUInteger expected_length) {
   };
 }
 
-// Given a max length, returns a ValidatorBlock that confirms the
-// string is a not longer than the max.
+// Given a min and max length, returns a ValidatorBlock that confirms the
+// string is within the given bounds.
 ValidatorBlock LenRangeValidator(NSUInteger min_length, NSUInteger max_length) {
   return ^bool(NSString *val, NSError **err) {
     if (val.length < min_length) {
@@ -238,8 +267,8 @@ bool VerifyConfigKeyArray(NSDictionary *dict, NSString *key, Class expected, NSE
 ///     <true/>
 ///   </dict>
 /// </array>
-std::variant<Unit, PathList> VerifyConfigWatchItemPaths(NSArray<id> *paths, NSError **err) {
-  PathList path_list;
+std::variant<Unit, PathAndTypeVec> VerifyConfigWatchItemPaths(NSArray<id> *paths, NSError **err) {
+  PathAndTypeVec path_list;
 
   for (id path in paths) {
     if ([path isKindOfClass:[NSDictionary class]]) {
@@ -309,9 +338,9 @@ std::variant<Unit, PathList> VerifyConfigWatchItemPaths(NSArray<id> *paths, NSEr
 ///     <string>EEEE</string>
 ///   </dict>
 /// </array>
-std::variant<Unit, ProcessList> VerifyConfigWatchItemProcesses(NSDictionary *watch_item,
-                                                               NSError **err) {
-  __block ProcessList proc_list;
+std::variant<Unit, PolicyProcessVec> VerifyConfigWatchItemProcesses(NSDictionary *watch_item,
+                                                                    NSError **err) {
+  __block PolicyProcessVec proc_list;
 
   if (!VerifyConfigKeyArray(
         watch_item, kWatchItemConfigKeyProcesses, [NSDictionary class], err,
@@ -379,6 +408,16 @@ std::variant<Unit, ProcessList> VerifyConfigWatchItemProcesses(NSDictionary *wat
 ///     <false/>
 ///     <key>InvertProcessExceptions</key>
 ///     <false/>
+///     <key>EnableSilentMode</key>
+///     <true/>
+///     <key>EnableSilentTTYMode</key>
+///     <true/>
+///     <key>BlockMessage</key>
+///     <string>...</string>
+///     <key>EventDetailURL</key>
+///     <string>...</string>
+///     <key>EventDetailText</key>
+///     <string>...</string>
 ///   </dict>
 ///   <key>Processes</key>
 ///   <array>
@@ -392,7 +431,7 @@ bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
     return false;
   }
 
-  std::variant<Unit, PathList> path_list =
+  std::variant<Unit, PathAndTypeVec> path_list =
     VerifyConfigWatchItemPaths(watch_item[kWatchItemConfigKeyPaths], err);
 
   if (std::holds_alternative<Unit>(path_list)) {
@@ -405,41 +444,62 @@ bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
 
   NSDictionary *options = watch_item[kWatchItemConfigKeyOptions];
   if (options) {
-    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsAllowReadAccess, [NSNumber class],
-                         err)) {
+    NSArray<NSString *> *boolOptions = @[
+      kWatchItemConfigKeyOptionsAllowReadAccess,
+      kWatchItemConfigKeyOptionsAuditOnly,
+      kWatchItemConfigKeyOptionsInvertProcessExceptions,
+      kWatchItemConfigKeyOptionsEnableSilentMode,
+      kWatchItemConfigKeyOptionsEnableSilentTTYMode,
+    ];
+
+    for (NSString *key in boolOptions) {
+      if (!VerifyConfigKey(options, key, [NSNumber class], err)) {
+        return false;
+      }
+    }
+
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsCustomMessage, [NSString class], err,
+                         false,
+                         LenRangeValidator(0, kWatchItemConfigOptionCustomMessageMaxLength))) {
       return false;
     }
 
-    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsAuditOnly, [NSNumber class], err)) {
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsEventDetailURL, [NSString class], err,
+                         false, LenRangeValidator(0, kWatchItemConfigEventDetailURLMaxLength))) {
       return false;
     }
 
-    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsInvertProcessExceptions,
-                         [NSNumber class], err)) {
+    if (!VerifyConfigKey(options, kWatchItemConfigKeyOptionsEventDetailText, [NSString class], err,
+                         false, LenRangeValidator(0, kWatchItemConfigEventDetailTextMaxLength))) {
       return false;
     }
   }
 
-  bool allow_read_access = options[kWatchItemConfigKeyOptionsAllowReadAccess]
-                             ? [options[kWatchItemConfigKeyOptionsAllowReadAccess] boolValue]
-                             : kWatchItemPolicyDefaultAllowReadAccess;
-  bool audit_only = options[kWatchItemConfigKeyOptionsAuditOnly]
-                      ? [options[kWatchItemConfigKeyOptionsAuditOnly] boolValue]
-                      : kWatchItemPolicyDefaultAuditOnly;
+  bool allow_read_access = GetBoolValue(options, kWatchItemConfigKeyOptionsAllowReadAccess,
+                                        kWatchItemPolicyDefaultAllowReadAccess);
+  bool audit_only =
+    GetBoolValue(options, kWatchItemConfigKeyOptionsAuditOnly, kWatchItemPolicyDefaultAuditOnly);
   bool invert_process_exceptions =
-    options[kWatchItemConfigKeyOptionsInvertProcessExceptions]
-      ? [options[kWatchItemConfigKeyOptionsInvertProcessExceptions] boolValue]
-      : kWatchItemPolicyDefaultInvertProcessExceptions;
+    GetBoolValue(options, kWatchItemConfigKeyOptionsInvertProcessExceptions,
+                 kWatchItemPolicyDefaultInvertProcessExceptions);
+  bool enable_silent_mode = GetBoolValue(options, kWatchItemConfigKeyOptionsEnableSilentMode,
+                                         kWatchItemPolicyDefaultEnableSilentMode);
+  bool enable_silent_tty_mode = GetBoolValue(options, kWatchItemConfigKeyOptionsEnableSilentTTYMode,
+                                             kWatchItemPolicyDefaultEnableSilentTTYMode);
 
-  std::variant<Unit, ProcessList> proc_list = VerifyConfigWatchItemProcesses(watch_item, err);
+  std::variant<Unit, PolicyProcessVec> proc_list = VerifyConfigWatchItemProcesses(watch_item, err);
   if (std::holds_alternative<Unit>(proc_list)) {
     return false;
   }
 
-  for (const PathAndTypePair &path_type_pair : std::get<PathList>(path_list)) {
+  for (const PathAndTypePair &path_type_pair : std::get<PathAndTypeVec>(path_list)) {
     policies.push_back(std::make_shared<WatchItemPolicy>(
       NSStringToUTF8StringView(name), path_type_pair.first, path_type_pair.second,
-      allow_read_access, audit_only, invert_process_exceptions, std::get<ProcessList>(proc_list)));
+      allow_read_access, audit_only, invert_process_exceptions, enable_silent_mode,
+      enable_silent_tty_mode,
+      NSStringToUTF8StringView(options[kWatchItemConfigKeyOptionsCustomMessage]),
+      options[kWatchItemConfigKeyOptionsEventDetailURL],
+      options[kWatchItemConfigKeyOptionsEventDetailText], std::get<PolicyProcessVec>(proc_list)));
   }
 
   return true;
@@ -487,6 +547,16 @@ bool ParseConfig(NSDictionary *config, std::vector<std::shared_ptr<WatchItemPoli
     return false;
   }
 
+  if (!VerifyConfigKey(config, kWatchItemConfigKeyEventDetailURL, [NSString class], err, false,
+                       LenRangeValidator(0, kWatchItemConfigEventDetailURLMaxLength))) {
+    return false;
+  }
+
+  if (!VerifyConfigKey(config, kWatchItemConfigKeyEventDetailText, [NSString class], err, false,
+                       LenRangeValidator(0, kWatchItemConfigEventDetailTextMaxLength))) {
+    return false;
+  }
+
   if (config[kWatchItemConfigKeyWatchItems] &&
       ![config[kWatchItemConfigKeyWatchItems] isKindOfClass:[NSDictionary class]]) {
     PopulateError(err, [NSString stringWithFormat:@"Top level key '%@' must be a dictionary",
@@ -661,8 +731,18 @@ void WatchItems::UpdateCurrentState(
     current_config_ = new_config;
     if (new_config) {
       policy_version_ = NSStringToUTF8String(new_config[kWatchItemConfigKeyVersion]);
+      // Non-existent kWatchItemConfigKeyEventDetailURL key or zero length value
+      // will both result in a nil global policy event detail URL.
+      if (((NSString *)new_config[kWatchItemConfigKeyEventDetailURL]).length) {
+        policy_event_detail_url_ = new_config[kWatchItemConfigKeyEventDetailURL];
+      } else {
+        policy_event_detail_url_ = nil;
+      }
+      policy_event_detail_text_ = new_config[kWatchItemConfigKeyEventDetailText];
     } else {
       policy_version_ = "";
+      policy_event_detail_url_ = nil;
+      policy_event_detail_text_ = nil;
     }
 
     last_update_time_ = [[NSDate date] timeIntervalSince1970];
@@ -794,4 +874,29 @@ std::optional<WatchItemsState> WatchItems::State() {
   return state;
 }
 
-}  // namespace santa::santad::data_layer
+std::pair<NSString *, NSString *> WatchItems::EventDetailLinkInfo(
+  const std::shared_ptr<WatchItemPolicy> &watch_item) {
+  absl::ReaderMutexLock lock(&lock_);
+  if (!watch_item) {
+    return {policy_event_detail_url_, policy_event_detail_text_};
+  }
+
+  NSString *url = watch_item->event_detail_url.has_value() ? watch_item->event_detail_url.value()
+                                                           : policy_event_detail_url_;
+
+  NSString *text = watch_item->event_detail_text.has_value() ? watch_item->event_detail_text.value()
+                                                             : policy_event_detail_text_;
+
+  // Ensure empty strings are repplaced with nil
+  if (!url.length) {
+    url = nil;
+  }
+
+  if (!text.length) {
+    text = nil;
+  }
+
+  return {url, text};
+}
+
+}  // namespace santa

Source/santad/DataLayer/WatchItemsTest.mm

@@ -32,23 +32,23 @@
 #include "Source/santad/DataLayer/WatchItemPolicy.h"
 #include "Source/santad/DataLayer/WatchItems.h"
 
-using santa::common::Unit;
-using santa::santad::data_layer::kWatchItemPolicyDefaultAllowReadAccess;
-using santa::santad::data_layer::kWatchItemPolicyDefaultAuditOnly;
-using santa::santad::data_layer::kWatchItemPolicyDefaultInvertProcessExceptions;
-using santa::santad::data_layer::kWatchItemPolicyDefaultPathType;
-using santa::santad::data_layer::WatchItemPathType;
-using santa::santad::data_layer::WatchItemPolicy;
-using santa::santad::data_layer::WatchItems;
-using santa::santad::data_layer::WatchItemsState;
+using santa::kWatchItemPolicyDefaultAllowReadAccess;
+using santa::kWatchItemPolicyDefaultAuditOnly;
+using santa::kWatchItemPolicyDefaultInvertProcessExceptions;
+using santa::kWatchItemPolicyDefaultPathType;
+using santa::Unit;
+using santa::WatchItemPathType;
+using santa::WatchItemPolicy;
+using santa::WatchItems;
+using santa::WatchItemsState;
 
-namespace santatest {
+namespace {
 using PathAndTypePair = std::pair<std::string, WatchItemPathType>;
-using PathList = std::vector<PathAndTypePair>;
-using ProcessList = std::vector<WatchItemPolicy::Process>;
-}  // namespace santatest
+using PathAndTypeVec = std::vector<PathAndTypePair>;
+using PolicyProcessVec = std::vector<WatchItemPolicy::Process>;
+}  // namespace
 
-namespace santa::santad::data_layer {
+namespace santa {
 
 extern bool ParseConfig(NSDictionary *config,
                         std::vector<std::shared_ptr<WatchItemPolicy>> &policies, NSError **err);
@@ -56,10 +56,10 @@ extern bool IsWatchItemNameValid(NSString *watch_item_name, NSError **err);
 extern bool ParseConfigSingleWatchItem(NSString *name, NSDictionary *watch_item,
                                        std::vector<std::shared_ptr<WatchItemPolicy>> &policies,
                                        NSError **err);
-extern std::variant<Unit, santatest::PathList> VerifyConfigWatchItemPaths(NSArray<id> *paths,
-                                                                          NSError **err);
-extern std::variant<Unit, santatest::ProcessList> VerifyConfigWatchItemProcesses(
-  NSDictionary *watch_item, NSError **err);
+extern std::variant<Unit, PathAndTypeVec> VerifyConfigWatchItemPaths(NSArray<id> *paths,
+                                                                     NSError **err);
+extern std::variant<Unit, PolicyProcessVec> VerifyConfigWatchItemProcesses(NSDictionary *watch_item,
+                                                                           NSError **err);
 class WatchItemsPeer : public WatchItems {
  public:
   using WatchItems::WatchItems;
@@ -72,14 +72,14 @@ class WatchItemsPeer : public WatchItems {
   using WatchItems::embedded_config_;
 };
 
-}  // namespace santa::santad::data_layer
+}  // namespace santa
 
-using santa::santad::data_layer::IsWatchItemNameValid;
-using santa::santad::data_layer::ParseConfig;
-using santa::santad::data_layer::ParseConfigSingleWatchItem;
-using santa::santad::data_layer::VerifyConfigWatchItemPaths;
-using santa::santad::data_layer::VerifyConfigWatchItemProcesses;
-using santa::santad::data_layer::WatchItemsPeer;
+using santa::IsWatchItemNameValid;
+using santa::ParseConfig;
+using santa::ParseConfigSingleWatchItem;
+using santa::VerifyConfigWatchItemPaths;
+using santa::VerifyConfigWatchItemProcesses;
+using santa::WatchItemsPeer;
 
 static constexpr std::string_view kBadPolicyName("__BAD_NAME__");
 static constexpr std::string_view kBadPolicyPath("__BAD_PATH__");
@@ -93,10 +93,6 @@ static NSMutableDictionary *WrapWatchItemsConfig(NSDictionary *config) {
   return [@{@"Version" : @(kVersion.data()), @"WatchItems" : [config mutableCopy]} mutableCopy];
 }
 
-static NSString *RepeatedString(NSString *str, NSUInteger len) {
-  return [@"" stringByPaddingToLength:len withString:str startingAtIndex:0];
-}
-
 @interface WatchItemsTest : XCTestCase
 @property NSFileManager *fileMgr;
 @property NSString *testDir;
@@ -444,7 +440,7 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
 }
 
 - (void)testVerifyConfigWatchItemPaths {
-  std::variant<Unit, santatest::PathList> path_list;
+  std::variant<Unit, PathAndTypeVec> path_list;
   NSError *err;
 
   // Test no paths specified
@@ -470,29 +466,28 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
 
   // Test path array dictionary with default path type
   path_list = VerifyConfigWatchItemPaths(@[ @{kWatchItemConfigKeyPathsPath : @"A"} ], &err);
-  XCTAssertTrue(std::holds_alternative<santatest::PathList>(path_list));
-  XCTAssertEqual(std::get<santatest::PathList>(path_list).size(), 1);
-  XCTAssertCStringEqual(std::get<santatest::PathList>(path_list)[0].first.c_str(), "A");
-  XCTAssertEqual(std::get<santatest::PathList>(path_list)[0].second,
-                 kWatchItemPolicyDefaultPathType);
+  XCTAssertTrue(std::holds_alternative<PathAndTypeVec>(path_list));
+  XCTAssertEqual(std::get<PathAndTypeVec>(path_list).size(), 1);
+  XCTAssertCStringEqual(std::get<PathAndTypeVec>(path_list)[0].first.c_str(), "A");
+  XCTAssertEqual(std::get<PathAndTypeVec>(path_list)[0].second, kWatchItemPolicyDefaultPathType);
 
   // Test path array dictionary with custom path type
   path_list = VerifyConfigWatchItemPaths(
     @[ @{kWatchItemConfigKeyPathsPath : @"A", kWatchItemConfigKeyPathsIsPrefix : @(YES)} ], &err);
-  XCTAssertTrue(std::holds_alternative<santatest::PathList>(path_list));
-  XCTAssertEqual(std::get<santatest::PathList>(path_list).size(), 1);
-  XCTAssertCStringEqual(std::get<santatest::PathList>(path_list)[0].first.c_str(), "A");
-  XCTAssertEqual(std::get<santatest::PathList>(path_list)[0].second, WatchItemPathType::kPrefix);
+  XCTAssertTrue(std::holds_alternative<PathAndTypeVec>(path_list));
+  XCTAssertEqual(std::get<PathAndTypeVec>(path_list).size(), 1);
+  XCTAssertCStringEqual(std::get<PathAndTypeVec>(path_list)[0].first.c_str(), "A");
+  XCTAssertEqual(std::get<PathAndTypeVec>(path_list)[0].second, WatchItemPathType::kPrefix);
 }
 
 - (void)testVerifyConfigWatchItemProcesses {
-  std::variant<Unit, santatest::ProcessList> proc_list;
+  std::variant<Unit, PolicyProcessVec> proc_list;
   NSError *err;
 
   // Non-existent process list parses successfully, but has no items
   proc_list = VerifyConfigWatchItemProcesses(@{}, &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 0);
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 0);
 
   // Process list fails to parse if contains non-array type
   proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @""}, &err);
@@ -502,7 +497,7 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @{}}, &err);
   XCTAssertTrue(std::holds_alternative<Unit>(proc_list));
   proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @[]}, &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
 
   // Test a process dictionary with no valid attributes set
   proc_list = VerifyConfigWatchItemProcesses(@{kWatchItemConfigKeyProcesses : @[ @{} ]}, &err);
@@ -520,9 +515,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   proc_list = VerifyConfigWatchItemProcesses(
     @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesBinaryPath : @"mypath"} ]},
     &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("mypath", "", "", {}, "", std::nullopt));
 
   // Test SigningID length limits
@@ -539,9 +534,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
       @[ @{kWatchItemConfigKeyProcessesSigningID : @"com.google.test"} ]
   },
                                              &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("", "com.google.test", "", {}, "", std::nullopt));
 
   // Test TeamID length limits
@@ -556,9 +551,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   proc_list = VerifyConfigWatchItemProcesses(
     @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesTeamID : @"myvalidtid"} ]},
     &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("", "", "myvalidtid", {}, "", std::nullopt));
 
   // Test CDHash length limits
@@ -583,9 +578,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   std::fill(cdhashBytes.begin(), cdhashBytes.end(), 0xAA);
   proc_list = VerifyConfigWatchItemProcesses(
     @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesCDHash : cdhash} ]}, &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("", "", "", cdhashBytes, "", std::nullopt));
 
   // Test Cert Hash length limits
@@ -614,9 +609,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
     kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesCertificateSha256 : certHash} ]
   },
                                              &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("", "", "", {}, [certHash UTF8String], std::nullopt));
 
   // Test valid invalid PlatformBinary type
@@ -629,9 +624,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
   proc_list = VerifyConfigWatchItemProcesses(
     @{kWatchItemConfigKeyProcesses : @[ @{kWatchItemConfigKeyProcessesPlatformBinary : @(YES)} ]},
     &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 1);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 1);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("", "", "", {}, "", std::make_optional(true)));
 
   // Test valid multiple attributes, multiple procs
@@ -656,12 +651,12 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
     ]
   },
                                              &err);
-  XCTAssertTrue(std::holds_alternative<santatest::ProcessList>(proc_list));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list).size(), 2);
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[0],
+  XCTAssertTrue(std::holds_alternative<PolicyProcessVec>(proc_list));
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list).size(), 2);
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[0],
                  WatchItemPolicy::Process("mypath1", "com.google.test1", "validtid_1", cdhashBytes,
                                           [certHash UTF8String], std::make_optional(true)));
-  XCTAssertEqual(std::get<santatest::ProcessList>(proc_list)[1],
+  XCTAssertEqual(std::get<PolicyProcessVec>(proc_list)[1],
                  WatchItemPolicy::Process("mypath2", "com.google.test2", "validtid_2", cdhashBytes,
                                           [certHash UTF8String], std::make_optional(false)));
 }
@@ -757,37 +752,66 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
     &err));
 
   // Options keys must be valid types
-  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAllowReadAccess : @""}
-  },
-                                            policies, &err));
-  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAllowReadAccess : @(0)}
-  },
-                                           policies, &err));
-  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAuditOnly : @""}
-  },
-                                            policies, &err));
-  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsAuditOnly : @(0)}
-  },
-                                           policies, &err));
+  {
+    // Check bool option keys
+    for (NSString *key in @[
+           kWatchItemConfigKeyOptionsAllowReadAccess,
+           kWatchItemConfigKeyOptionsAuditOnly,
+           kWatchItemConfigKeyOptionsInvertProcessExceptions,
+           kWatchItemConfigKeyOptionsEnableSilentMode,
+           kWatchItemConfigKeyOptionsEnableSilentTTYMode,
+         ]) {
+      // Parse bool option with invliad type
+      XCTAssertFalse(ParseConfigSingleWatchItem(
+        @"",
+        @{kWatchItemConfigKeyPaths : @[ @"a" ],
+          kWatchItemConfigKeyOptions : @{key : @""}},
+        policies, &err));
 
-  XCTAssertFalse(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsInvertProcessExceptions : @""}
-  },
-                                            policies, &err));
-  XCTAssertTrue(ParseConfigSingleWatchItem(@"", @{
-    kWatchItemConfigKeyPaths : @[ @"a" ],
-    kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsInvertProcessExceptions : @(0)}
-  },
-                                           policies, &err));
+      // Parse bool option with valid type
+      XCTAssertTrue(ParseConfigSingleWatchItem(
+        @"",
+        @{kWatchItemConfigKeyPaths : @[ @"a" ],
+          kWatchItemConfigKeyOptions : @{key : @(0)}},
+        policies, &err));
+    }
+
+    // Check other option keys
+
+    // kWatchItemConfigKeyOptionsCustomMessage - Invalid type
+    XCTAssertFalse(ParseConfigSingleWatchItem(
+      @"", @{
+        kWatchItemConfigKeyPaths : @[ @"a" ],
+        kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsCustomMessage : @[]}
+      },
+      policies, &err));
+
+    // kWatchItemConfigKeyOptionsCustomMessage zero length
+    XCTAssertTrue(ParseConfigSingleWatchItem(
+      @"", @{
+        kWatchItemConfigKeyPaths : @[ @"a" ],
+        kWatchItemConfigKeyOptions : @{kWatchItemConfigKeyOptionsCustomMessage : @""}
+      },
+      policies, &err));
+
+    // kWatchItemConfigKeyOptionsCustomMessage valid "normal" length
+    XCTAssertTrue(ParseConfigSingleWatchItem(
+      @"", @{
+        kWatchItemConfigKeyPaths : @[ @"a" ],
+        kWatchItemConfigKeyOptions :
+          @{kWatchItemConfigKeyOptionsCustomMessage : @"This is a custom message"}
+      },
+      policies, &err));
+
+    // kWatchItemConfigKeyOptionsCustomMessage Invalid "long" length
+    XCTAssertFalse(ParseConfigSingleWatchItem(
+      @"", @{
+        kWatchItemConfigKeyPaths : @[ @"a" ],
+        kWatchItemConfigKeyOptions :
+          @{kWatchItemConfigKeyOptionsCustomMessage : RepeatedString(@"A", 4096)}
+      },
+      policies, &err));
+  }
 
   // If processes are specified, they must be valid format
   // Note: Full tests in `testVerifyConfigWatchItemProcesses`
@@ -806,7 +830,7 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
     *policies[0].get(),
     WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
                     kWatchItemPolicyDefaultAllowReadAccess, kWatchItemPolicyDefaultAuditOnly,
-                    kWatchItemPolicyDefaultInvertProcessExceptions, {}));
+                    kWatchItemPolicyDefaultInvertProcessExceptions));
 
   // Test multiple paths, options, and processes
   policies.clear();
@@ -822,6 +846,9 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
       kWatchItemConfigKeyOptionsAllowReadAccess : @(YES),
       kWatchItemConfigKeyOptionsAuditOnly : @(NO),
       kWatchItemConfigKeyOptionsInvertProcessExceptions : @(YES),
+      kWatchItemConfigKeyOptionsEnableSilentMode : @(YES),
+      kWatchItemConfigKeyOptionsEnableSilentMode : @(NO),
+      kWatchItemConfigKeyOptionsCustomMessage : @"",
     },
     kWatchItemConfigKeyProcesses : @[
       @{kWatchItemConfigKeyProcessesBinaryPath : @"pa"},
@@ -829,11 +856,14 @@ static NSString *RepeatedString(NSString *str, NSUInteger len) {
     ]
   },
                                            policies, &err));
+
   XCTAssertEqual(policies.size(), 2);
-  XCTAssertEqual(*policies[0].get(), WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType,
-                                                     true, false, true, procs));
-  XCTAssertEqual(*policies[1].get(), WatchItemPolicy("rule", "b", WatchItemPathType::kPrefix, true,
-                                                     false, true, procs));
+  XCTAssertEqual(*policies[0].get(),
+                 WatchItemPolicy("rule", "a", kWatchItemPolicyDefaultPathType, true, false, true,
+                                 true, false, "", nil, nil, procs));
+  XCTAssertEqual(*policies[1].get(),
+                 WatchItemPolicy("rule", "b", WatchItemPathType::kPrefix, true, false, true, true,
+                                 false, "", nil, nil, procs));
 }
 
 - (void)testState {

Source/santad/EventProviders/AuthResultCache.h

@@ -27,7 +27,7 @@
 #import "Source/common/SantaVnode.h"
 #include "Source/santad/EventProviders/EndpointSecurity/EndpointSecurityAPI.h"
 
-namespace santa::santad::event_providers {
+namespace santa {
 
 enum class FlushCacheMode {
   kNonRootOnly,
@@ -41,6 +41,8 @@ enum class FlushCacheReason {
   kStaticRulesChanged,
   kExplicitCommand,
   kFilesystemUnmounted,
+  kEntitlementsPrefixFilterChanged,
+  kEntitlementsTeamIDFilterChanged,
 };
 
 class AuthResultCache {
@@ -50,13 +52,12 @@ class AuthResultCache {
   // previously denied binary is allowed, it can be re-executed by the user in a
   // timely manner. But the value should be high enough to allow the cache to be
   // effective in the event the binary is executed in rapid succession.
-  static std::unique_ptr<AuthResultCache> Create(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
-    SNTMetricSet *metric_set, uint64_t cache_deny_time_ms = 1500);
+  static std::unique_ptr<AuthResultCache> Create(std::shared_ptr<santa::EndpointSecurityAPI> esapi,
+                                                 SNTMetricSet *metric_set,
+                                                 uint64_t cache_deny_time_ms = 1500);
 
-  AuthResultCache(
-    std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi,
-    SNTMetricCounter *flush_count, uint64_t cache_deny_time_ms = 1500);
+  AuthResultCache(std::shared_ptr<santa::EndpointSecurityAPI> esapi, SNTMetricCounter *flush_count,
+                  uint64_t cache_deny_time_ms = 1500);
   virtual ~AuthResultCache();
 
   AuthResultCache(AuthResultCache &&other) = delete;
@@ -79,13 +80,13 @@ class AuthResultCache {
   SantaCache<SantaVnode, uint64_t> *root_cache_;
   SantaCache<SantaVnode, uint64_t> *nonroot_cache_;
 
-  std::shared_ptr<santa::santad::event_providers::endpoint_security::EndpointSecurityAPI> esapi_;
+  std::shared_ptr<santa::EndpointSecurityAPI> esapi_;
   SNTMetricCounter *flush_count_;
   uint64_t root_devno_;
   uint64_t cache_deny_time_ns_;
   dispatch_queue_t q_;
 };
 
-}  // namespace santa::santad::event_providers
+}  // namespace santa
 
 #endif

Source/santad/EventProviders/AuthResultCache.mm

@@ -22,8 +22,8 @@
 #import "Source/common/SantaVnodeHash.h"
 #include "Source/santad/EventProviders/EndpointSecurity/Client.h"
 
-using santa::santad::event_providers::endpoint_security::Client;
-using santa::santad::event_providers::endpoint_security::EndpointSecurityAPI;
+using santa::Client;
+using santa::EndpointSecurityAPI;
 
 static NSString *const kFlushCacheReasonClientModeChanged = @"ClientModeChanged";
 static NSString *const kFlushCacheReasonPathRegexChanged = @"PathRegexChanged";
@@ -31,8 +31,12 @@ static NSString *const kFlushCacheReasonRulesChanged = @"RulesChanged";
 static NSString *const kFlushCacheReasonStaticRulesChanged = @"StaticRulesChanged";
 static NSString *const kFlushCacheReasonExplicitCommand = @"ExplicitCommand";
 static NSString *const kFlushCacheReasonFilesystemUnmounted = @"FilesystemUnmounted";
+static NSString *const kFlushCacheReasonEntitlementsPrefixFilterChanged =
+  @"EntitlementsPrefixFilterChanged";
+static NSString *const kFlushCacheReasonEntitlementsTeamIDFilterChanged =
+  @"EntitlementsTeamIDFilterChanged";
 
-namespace santa::santad::event_providers {
+namespace santa {
 
 static inline uint64_t GetCurrentUptime() {
   return clock_gettime_nsec_np(CLOCK_MONOTONIC);
@@ -59,8 +63,13 @@ NSString *const FlushCacheReasonToString(FlushCacheReason reason) {
     case FlushCacheReason::kStaticRulesChanged: return kFlushCacheReasonStaticRulesChanged;
     case FlushCacheReason::kExplicitCommand: return kFlushCacheReasonExplicitCommand;
     case FlushCacheReason::kFilesystemUnmounted: return kFlushCacheReasonFilesystemUnmounted;
+    case FlushCacheReason::kEntitlementsPrefixFilterChanged:
+      return kFlushCacheReasonEntitlementsPrefixFilterChanged;
+    case FlushCacheReason::kEntitlementsTeamIDFilterChanged:
+      return kFlushCacheReasonEntitlementsTeamIDFilterChanged;
     default:
-      [NSException raise:@"Invalid reason" format:@"Unknown reason value: %d", reason];
+      [NSException raise:@"Invalid reason"
+                  format:@"Unknown reason value: %d", static_cast<int>(reason)];
       return nil;
   }
 }
@@ -176,4 +185,4 @@ NSArray<NSNumber *> *AuthResultCache::CacheCounts() {
   return @[ @(root_cache_->count()), @(nonroot_cache_->count()) ];
 }
 
-}  // namespace santa::santad::event_providers
+}  // namespace santa