mirror of
https://github.com/google/santa.git
synced 2026-01-15 01:08:12 -05:00
e89cdbcf64
* Support CDHash rules * Ensure hardened runtime for cdhash eval. Update docs. * minor fixups * Clarify docs
427 lines
13 KiB
Plaintext
427 lines
13 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>$archiver</key>
|
|
<string>NSKeyedArchiver</string>
|
|
<key>$objects</key>
|
|
<array>
|
|
<string>$null</string>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>25</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>2</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>30</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>29</integer>
|
|
</dict>
|
|
<key>currentSessions</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>26</integer>
|
|
</dict>
|
|
<key>decision</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>19</integer>
|
|
</dict>
|
|
<key>executingUser</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>16</integer>
|
|
</dict>
|
|
<key>filePath</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>5</integer>
|
|
</dict>
|
|
<key>fileSHA256</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>4</integer>
|
|
</dict>
|
|
<key>idx</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>3</integer>
|
|
</dict>
|
|
<key>loggedInUsers</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>23</integer>
|
|
</dict>
|
|
<key>occurrenceDate</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>17</integer>
|
|
</dict>
|
|
<key>parentName</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>22</integer>
|
|
</dict>
|
|
<key>pid</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>20</integer>
|
|
</dict>
|
|
<key>ppid</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>21</integer>
|
|
</dict>
|
|
<key>signingChain</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>6</integer>
|
|
</dict>
|
|
<key>teamID</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>39</integer>
|
|
</dict>
|
|
<key>signingID</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>40</integer>
|
|
</dict>
|
|
<key>cdhash</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>41</integer>
|
|
</dict>
|
|
</dict>
|
|
<integer>14887</integer>
|
|
<string>ff98fa0c0a1095fedcbe4d388a9760e71399a5c3c017a847ffa545663b57929a</string>
|
|
<string>/usr/bin/yes</string>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>15</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>7</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>11</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>13</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>10</integer>
|
|
</dict>
|
|
<key>certData</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>8</integer>
|
|
</dict>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>9</integer>
|
|
</dict>
|
|
<key>NS.data</key>
|
|
<data>MIIFOzCCBCOgAwIBAgIIKtpxuqe9F58wDQYJKoZIhvcNAQEFBQAwfzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCkFwcGxlIEluYy4xJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTMwMQYDVQQDDCpBcHBsZSBDb2RlIFNpZ25pbmcgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTMwNDEyMjIzNDM1WhcNMjEwNDEyMjIzNDM1WjBWMQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUgSW5jLjEXMBUGA1UECwwOQXBwbGUgU29mdHdhcmUxGTAXBgNVBAMMEFNvZnR3YXJlIFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/MLh0mE+uBguklG4xVG0J0TyjsDkQqdDmqmAiXdPkhKJAQZBkxmA9kWHaUqhFJ54sZMvkHqgkClI6s9PsFkF4wZ7RBuZ4JWMI89/KQeYd/jXpUVwTFYvp0Z1xe9HJqkuemdqPwCm4L5BvpLtlj4Bq1z1obeR4wqUSL/gy6X7JXVyMPhYgG9denRuGLQj3vBmkTQ5BpErbaxqARVAEqUyNFQfqaie9u4iePD+yUjmX47fI61RSmIovI1Zl5ekq2VG0I/oE3ffroN/VmvJeCPFfh/CxR2x1sbGM0RPjesHsYkF0poM08fladGQ5P1luzyzAYIMpPOfeT18N85M5XzCNAgMBAAGjggHiMIIB3jAdBgNVHQ4EFgQUxu0+Svsu6D8T1aAVs13Z57P3aDUwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBSOaabEd0JOBKVWQpxRH4ba0iCPCTCCARwGA1UdIASCARMwggEPMIIBCwYJKoZIhvdjZAUBMIH9MDUGCCsGAQUFBwIBFilodHRwOi8vd3d3LmFwcGxlLmNvbS9jZXJ0aWZpY2F0ZWF1dGhvcml0eTCBwwYIKwYBBQUHAgIwgbYMgbNSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRlIHBvbGljeSBhbmQgY2VydGlmaWNhdGlvbiBwcmFjdGljZSBzdGF0ZW1lbnRzLjA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vY3JsLmFwcGxlLmNvbS9jb2Rlc2lnbmluZy5jcmwwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMA8GCSqGSIb3Y2QGFgQCBQAwDQYJKoZIhvcNAQEFBQADggEBAFfUxSFXGxTaEjIsEQUMBA+VqtTi+vLEbWjeUlINInPIhXMd71FO8IpJsGiUZVEi3/1AjzW0aEBSuyWOzPrOfBJW2MDQVQW1SrG1YfyVfJFectEotB0rbdpLZ58F/ObnWUpDXh97hDe+/rqKKzMFlFCDuP6a2wO7jWLyGW13k+N1zzZZMV4IbV0BHGVTUpN2eJwXCxAelLw2kFZLRC6Y2aYxofAcZpSZVHMTtVE4vCSioDA7emWHrMC8FfReMMedoyoE38TPR4Rtn/3/RcOgGaw8u62PlPm5x8hxNhHt6AG6tHVIgqQqUxoFBZudxkcb9eggcqAbS+W+ZPw4DZr/Q0E=</data>
|
|
</dict>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>NSMutableData</string>
|
|
<string>NSData</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>NSMutableData</string>
|
|
</dict>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>MOLCertificate</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>MOLCertificate</string>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>10</integer>
|
|
</dict>
|
|
<key>certData</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>12</integer>
|
|
</dict>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>9</integer>
|
|
</dict>
|
|
<key>NS.data</key>
|
|
<data>MIIEDjCCAvagAwIBAgIBITANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMTExMDI0MTczOTQxWhcNMjYxMDI0MTczOTQxWjB/MQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUgSW5jLjEmMCQGA1UECwwdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxMzAxBgNVBAMMKkFwcGxlIENvZGUgU2lnbmluZyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKoEXH/DvkLa/glDZiBXWtZvVobibPn5e7OOZgjNTlInyGrJ9nunCDwZDgIawynz9xQth0GxFvxXRqbVGWGcy9i5Ti9ARBkcm18aUdhnBAFJuPrhcIsJNxqwj+I/MysKUyhSXkRmnV25R640NIJtExTePvfGHahj6SpMsqRp7b6l705qs0bUBGIq2rt62bKIEusOy3vqufWyYgtacKkKmEv24cC86EhuUyfDvj52S3KcgR/Ha5u+j+Is8yjQO4XhxhRlrzP5C2twulZTl0cZTMnA6pno5Mkh8eHeQK5XZizDu7NaQg+jEiSJLJt1zC+z9jkyKeXgdAeI9w4mV9h/oUCAwEAAaOBsTCBrjAOBgNVHQ8BAf8EBAMCAYYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjmmmxHdCTgSlVkKcUR+G2tIgjwkwHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5hcHBsZS5jb20vYXBwbGVjYS9yb290LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAcHOt9lIVarcVGN6pKtGddpsesmmWx8LD4SvQ7wddcPjaPFpIR9s5bIDKc95iG7c6yqNaHuOH2iVKk5vvcxCTc13j9J1+3g+B9qmZwVhunPSJAL7PT/8C0w789fP0choysconDt6o05mPauaZ+2HJT/IXsRhn8DDAxgruyESBpIm78XlBw+6uyGtnfMxsSYZMAtPTam4YnPhcOMgwh5ow2mcouOKaedqfpTsfUWI7IvF+U3waC8PwTdxJRPKIiM46W7md6bK3W1KnxtVYiXK32MyzqBgdUJc/Hdpqrji/e3kxvmO594WFF+ltisTiGJQv129SpZmx3USbB3CSiCZ32w==</data>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>10</integer>
|
|
</dict>
|
|
<key>certData</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>14</integer>
|
|
</dict>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>9</integer>
|
|
</dict>
|
|
<key>NS.data</key>
|
|
<data>MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmELes2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRrEdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6wsIG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCSC7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CWQYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMUZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4wggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggrBgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvMIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9saWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVudHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J20ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNiiPvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJBzewdXUh</data>
|
|
</dict>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>NSMutableArray</string>
|
|
<string>NSArray</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>NSMutableArray</string>
|
|
</dict>
|
|
<string>root</string>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>18</integer>
|
|
</dict>
|
|
<key>NS.time</key>
|
|
<real>485894498.537635</real>
|
|
</dict>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>NSDate</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>NSDate</string>
|
|
</dict>
|
|
<integer>131072</integer>
|
|
<integer>11196</integer>
|
|
<integer>10760</integer>
|
|
<string>bash</string>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>25</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>24</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<string>foouser</string>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>NSArray</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>NSArray</string>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>25</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>27</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>28</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<string>foouser@console</string>
|
|
<string>foouser@ttys000</string>
|
|
<dict>
|
|
<key>$classes</key>
|
|
<array>
|
|
<string>SNTStoredEvent</string>
|
|
<string>NSObject</string>
|
|
</array>
|
|
<key>$classname</key>
|
|
<string>SNTStoredEvent</string>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>29</integer>
|
|
</dict>
|
|
<key>currentSessions</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>38</integer>
|
|
</dict>
|
|
<key>decision</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>35</integer>
|
|
</dict>
|
|
<key>executingUser</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>24</integer>
|
|
</dict>
|
|
<key>filePath</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>33</integer>
|
|
</dict>
|
|
<key>fileSHA256</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>32</integer>
|
|
</dict>
|
|
<key>idx</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>31</integer>
|
|
</dict>
|
|
<key>loggedInUsers</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>37</integer>
|
|
</dict>
|
|
<key>occurrenceDate</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>34</integer>
|
|
</dict>
|
|
<key>parentName</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>22</integer>
|
|
</dict>
|
|
<key>pid</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>36</integer>
|
|
</dict>
|
|
<key>ppid</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>21</integer>
|
|
</dict>
|
|
</dict>
|
|
<integer>14888</integer>
|
|
<string>2b3a38f4e4e981afc517b0c7903ffe2f79193c67e2329dd77cf2e74b046ca3a7</string>
|
|
<string>/usr/local/Cellar/hub/2.2.3/bin/hub</string>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>18</integer>
|
|
</dict>
|
|
<key>NS.time</key>
|
|
<real>485894568.928225</real>
|
|
</dict>
|
|
<integer>1</integer>
|
|
<integer>11427</integer>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>25</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>24</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<dict>
|
|
<key>$class</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>25</integer>
|
|
</dict>
|
|
<key>NS.objects</key>
|
|
<array>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>27</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>28</integer>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<string>012345678910</string>
|
|
<string>signing.id</string>
|
|
<string>abc123</string>
|
|
</array>
|
|
<key>$top</key>
|
|
<dict>
|
|
<key>root</key>
|
|
<dict>
|
|
<key>CF$UID</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
</dict>
|
|
<key>$version</key>
|
|
<integer>100000</integer>
|
|
</dict>
|
|
</plist>
|