-
Notifications
You must be signed in to change notification settings - Fork 298
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add transitive whitelisting to Santa #224
Merged
Merged
Changes from 31 commits
Commits
Show all changes
46 commits
Select commit
Hold shift + click to select a range
8f972eb
prototype code for santa transitive whitelisting
nguyen-phillip 48b656d
prototype code for santa transitive whitelisting
nguyen-phillip 1a9d07b
added a separate message queue to handle events related to compiler w…
nguyen-phillip 0d77a2c
Merge remote-tracking branch 'origin/master' into compiler
nguyen-phillip a594175
forgot to add updated project.pbxproj file with commit
nguyen-phillip 881322f
Replaced functionality of compiler vnode cache with new ACTION_RESPON…
nguyen-phillip 7a32d31
Removed separate compiler message queue; send these messages to decis…
nguyen-phillip 0f9d63a
Remove references to DevelopmentTeam from project.pbxproj
nguyen-phillip 163ac9b
Define KAUTH_FILEOP_WRITE as a larger constant to avoid future conflicts
nguyen-phillip 47a981e
Remove reference to Podfile.lock
nguyen-phillip 16092cd
replace copyright notice
nguyen-phillip 0b106e4
moved compiler process exit monitoring from userspace to kernelspace
nguyen-phillip 9c4c7fa
switched from IOCreateThread to kernel_thread_start and friends
nguyen-phillip 6348fd1
added timestamps to transitive rules & extra info to santactl status
nguyen-phillip 04d8f41
Send transitive rule state back to kernel so that it is stored in dec…
nguyen-phillip fef9351
update timestamp of transitive rules whenever they are accessed for e…
nguyen-phillip 0e840d2
some minor cleanup
nguyen-phillip c4b47e1
Stop watching RENAME actions for transitive whitelisting. Don't look …
nguyen-phillip 43ce8aa
add ability for sync server to send down WHITELIST_COMPILER rules and…
nguyen-phillip 83649ee
made SNTRule timestamp property readonly, plus other fixes
nguyen-phillip 079a6d3
rename refreshTimestampForRule: to resetTimestampForRule
nguyen-phillip dc10e23
refresh transitive rule timestamps based on ACTION_NOTIFY_EXEC messag…
nguyen-phillip d35f0b5
fix broken testPreflighDatabaseCounts
nguyen-phillip 6cb4ad5
don't pass SantaDecisionManager ref to process monitoring threads, in…
nguyen-phillip aa01a79
remove most of the debugging cruft
nguyen-phillip a08e7f8
some minor fixes
nguyen-phillip 88b0972
fix merge conflict
nguyen-phillip 0cb3d6a
Merge branch 'master' into compiler
nguyen-phillip 1cd9551
Merge branch 'master' into compiler
nguyen-phillip 8f82370
added compiler and transitive rule tests to SNTExecutionControllerTest.m
nguyen-phillip 1b687a1
Merge branch 'compiler' of https://github.com/nguyen-phillip/santa in…
nguyen-phillip d2df097
merge with upstream, renumber ACTION_RESPOND_ALLOW enums
nguyen-phillip 340f59d
* Pass SantaDecisionManager to the pid monitor threads so that compil…
nguyen-phillip b9c7585
Allow enabling of transitive whitelisting from mobile config.
nguyen-phillip c293d5d
Add a temporary allow rule to kernel's decision cache for files writt…
nguyen-phillip a9201dd
compiler_pid_set_ now maps pid to ppid and a given process is considered
nguyen-phillip 91c5d71
renamed ACTION_RESPOND_TEMPORARY to ACTION_RESPOND_PENDING_TRANSITIVE…
nguyen-phillip e583712
Merge remote-tracking branch 'origin/master' into compiler
nguyen-phillip 75de096
fix formatting
nguyen-phillip 6d295c9
merged up to #267
nguyen-phillip ca00a28
Started watching for KAUTH_FILEOP_RENAME in addition to KAUTH_FILEOP_…
nguyen-phillip e0bf6dd
Merge remote-tracking branch 'origin/master' into compiler
nguyen-phillip 16769e8
merge
nguyen-phillip 93a7e86
Add kernel tests for transitive whitelisting
nguyen-phillip bba1aee
fix comments
nguyen-phillip 21561ef
don't hardcode ld path; fix indentation
nguyen-phillip File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There doesn't seem to be any corresponding keys in the .m for this, so it's not configurable in a mobileconfig or persisted between runs from a sync server. I think it should probably be one of those keys that can be configured with a mobileconfig but can be overridden by a server, so you'll need to add a key constant and add it to both the arrays in init.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done. added key to both with a DEBUG guard around the syncServerKeys entry to be removed when the sync server supports it.