endpoint_security 0.1.0-universal-darwin

data/ext/endpoint_security/mute.c

@@ -0,0 +1,291 @@
+/* mute.c
+ * Calling thread: Ruby control/dispatcher threads with the GVL.
+ * Returned ES-owned mute sets are copied before their mandatory release.
+ */
+#include "mute.h"
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <bsm/libbsm.h>
+#include <limits.h>
+#include <mach/mach.h>
+#include <stdint.h>
+#include <unistd.h>
+
+#include "client.h"
+#include "field.h"
+
+static esrb_client_t *
+mute_client(VALUE self)
+{
+    esrb_client_t *client;
+    TypedData_Get_Struct(self, esrb_client_t, &esrb_client_type, client);
+    if (client->owner_pid != getpid()) {
+        rb_raise(rb_path2class("EndpointSecurity::ForkedClientError"), "Endpoint Security clients cannot be used after fork");
+    }
+    if (atomic_load_explicit(&client->closed, memory_order_acquire)) {
+        rb_raise(rb_path2class("EndpointSecurity::ClientError"), "client is closed");
+    }
+    return client;
+}
+
+static audit_token_t
+audit_token_from_value(VALUE value)
+{
+    audit_token_t token = {0};
+    token.val[0] = NUM2UINT(rb_funcall(value, rb_intern("auid"), 0));
+    token.val[1] = NUM2UINT(rb_funcall(value, rb_intern("euid"), 0));
+    token.val[2] = NUM2UINT(rb_funcall(value, rb_intern("egid"), 0));
+    token.val[3] = NUM2UINT(rb_funcall(value, rb_intern("ruid"), 0));
+    token.val[4] = NUM2UINT(rb_funcall(value, rb_intern("rgid"), 0));
+    token.val[5] = NUM2UINT(rb_funcall(value, rb_intern("pid"), 0));
+    token.val[6] = NUM2UINT(rb_funcall(value, rb_intern("asid"), 0));
+    token.val[7] = NUM2UINT(rb_funcall(value, rb_intern("pidversion"), 0));
+    return token;
+}
+
+static VALUE
+audit_token_value(audit_token_t token)
+{
+    VALUE arguments[] = {
+        UINT2NUM(audit_token_to_pid(token)), UINT2NUM(audit_token_to_pidversion(token)),
+        UINT2NUM(audit_token_to_ruid(token)), UINT2NUM(audit_token_to_euid(token)),
+        UINT2NUM(audit_token_to_rgid(token)), UINT2NUM(audit_token_to_egid(token)),
+        UINT2NUM(audit_token_to_asid(token)), UINT2NUM(audit_token_to_auid(token))
+    };
+    return rb_funcallv(rb_path2class("EndpointSecurity::AuditToken"), rb_intern("__native_new"), 8, arguments);
+}
+
+static es_event_type_t *
+event_values(VALUE values, size_t *count, VALUE *storage)
+{
+    Check_Type(values, T_ARRAY);
+    *count = (size_t)RARRAY_LEN(values);
+    if (*count == 0) {
+        *storage = Qnil;
+        return NULL;
+    }
+    if (*count > LONG_MAX / sizeof(es_event_type_t)) {
+        rb_raise(rb_eArgError, "too many events");
+    }
+    *storage = rb_str_new(NULL, (long)(*count * sizeof(es_event_type_t)));
+    es_event_type_t *events = (es_event_type_t *)RSTRING_PTR(*storage);
+    for (size_t index = 0; index < *count; index++) {
+        events[index] = (es_event_type_t)NUM2INT(rb_ary_entry(values, (long)index));
+    }
+    return events;
+}
+
+static void
+check_mute_result(es_return_t result)
+{
+    if (result != ES_RETURN_SUCCESS) {
+        rb_raise(rb_path2class("EndpointSecurity::MuteError"), "Endpoint Security mute operation failed");
+    }
+}
+
+static VALUE
+mute_path(VALUE self, VALUE action, VALUE path, VALUE type_value, VALUE values)
+{
+    esrb_client_t *client = mute_client(self);
+    ID action_id = SYM2ID(action);
+    es_mute_path_type_t type = (es_mute_path_type_t)NUM2INT(type_value);
+    const char *path_string = StringValueCStr(path);
+    size_t count;
+    VALUE storage;
+    es_event_type_t *events = event_values(values, &count, &storage);
+    es_return_t result;
+    if (action_id == rb_intern("mute")) {
+        result = count == 0 ? es_mute_path(client->client, path_string, type)
+                            : es_mute_path_events(client->client, path_string, type, events, count);
+    } else {
+        result = count == 0 ? es_unmute_path(client->client, path_string, type)
+                            : es_unmute_path_events(client->client, path_string, type, events, count);
+    }
+    RB_GC_GUARD(storage);
+    check_mute_result(result);
+    return Qtrue;
+}
+
+static VALUE
+mute_process(VALUE self, VALUE action, VALUE token_value, VALUE values)
+{
+    esrb_client_t *client = mute_client(self);
+    audit_token_t token = audit_token_from_value(token_value);
+    size_t count;
+    VALUE storage;
+    es_event_type_t *events = event_values(values, &count, &storage);
+    es_return_t result;
+    if (SYM2ID(action) == rb_intern("mute")) {
+        result = count == 0 ? es_mute_process(client->client, &token)
+                            : es_mute_process_events(client->client, &token, events, count);
+    } else {
+        result = count == 0 ? es_unmute_process(client->client, &token)
+                            : es_unmute_process_events(client->client, &token, events, count);
+    }
+    RB_GC_GUARD(storage);
+    check_mute_result(result);
+    return Qtrue;
+}
+
+static VALUE
+unmute_all(VALUE self, VALUE target)
+{
+    esrb_client_t *client = mute_client(self);
+    check_mute_result(RTEST(target) ? es_unmute_all_target_paths(client->client) : es_unmute_all_paths(client->client));
+    return Qtrue;
+}
+
+static VALUE
+invert_muting(VALUE self, VALUE type)
+{
+    esrb_client_t *client = mute_client(self);
+    check_mute_result(es_invert_muting(client->client, (es_mute_inversion_type_t)NUM2INT(type)));
+    return Qtrue;
+}
+
+static VALUE
+muting_inverted(VALUE self, VALUE type)
+{
+    esrb_client_t *client = mute_client(self);
+    es_mute_inverted_return_t result = es_muting_inverted(client->client, (es_mute_inversion_type_t)NUM2INT(type));
+    if (result == ES_MUTE_INVERTED_ERROR) {
+        rb_raise(rb_path2class("EndpointSecurity::MuteError"), "failed to query mute inversion state");
+    }
+    return result == ES_MUTE_INVERTED ? Qtrue : Qfalse;
+}
+
+static VALUE
+clear_cache(VALUE self)
+{
+    es_clear_cache_result_t result = es_clear_cache(mute_client(self)->client);
+    if (result != ES_CLEAR_CACHE_RESULT_SUCCESS) {
+        rb_raise(rb_path2class("EndpointSecurity::ClientError"), "failed to clear Endpoint Security cache (%d)", result);
+    }
+    return Qtrue;
+}
+
+static VALUE
+event_symbols(const es_event_type_t *events, size_t count)
+{
+    VALUE result = rb_ary_new_capa((long)count);
+    VALUE event_type = rb_path2class("EndpointSecurity::EventType");
+    for (size_t index = 0; index < count; index++) {
+        rb_ary_push(result, rb_funcall(event_type, rb_intern("symbol"), 1, INT2NUM(events[index])));
+    }
+    return result;
+}
+
+static VALUE
+copy_muted_paths(VALUE pointer_value)
+{
+    es_muted_paths_t *paths = (es_muted_paths_t *)(uintptr_t)NUM2ULL(pointer_value);
+    if (paths->count > LONG_MAX) {
+        rb_raise(rb_eRangeError, "muted path count is too large");
+    }
+    VALUE result = rb_ary_new_capa((long)paths->count);
+    for (size_t index = 0; index < paths->count; index++) {
+        const es_muted_path_t *path = &paths->paths[index];
+        VALUE item = rb_hash_new();
+        rb_hash_aset(item, ID2SYM(rb_intern("type")), INT2NUM(path->type));
+        rb_hash_aset(item, ID2SYM(rb_intern("path")), esrb_string_token_value(&path->path));
+        rb_hash_aset(item, ID2SYM(rb_intern("events")), event_symbols(path->events, path->event_count));
+        rb_ary_push(result, item);
+    }
+    return result;
+}
+
+static VALUE
+release_muted_paths(VALUE pointer_value)
+{
+    es_release_muted_paths((es_muted_paths_t *)(uintptr_t)NUM2ULL(pointer_value));
+    return Qnil;
+}
+
+static VALUE
+muted_paths(VALUE self)
+{
+    es_muted_paths_t *paths = NULL;
+    check_mute_result(es_muted_paths_events(mute_client(self)->client, &paths));
+    if (paths == NULL) {
+        return rb_ary_new();
+    }
+    VALUE pointer_value = ULL2NUM((uintptr_t)paths);
+    return rb_ensure(copy_muted_paths, pointer_value, release_muted_paths, pointer_value);
+}
+
+static VALUE
+copy_muted_processes(VALUE pointer_value)
+{
+    es_muted_processes_t *processes = (es_muted_processes_t *)(uintptr_t)NUM2ULL(pointer_value);
+    if (processes->count > LONG_MAX) {
+        rb_raise(rb_eRangeError, "muted process count is too large");
+    }
+    VALUE result = rb_ary_new_capa((long)processes->count);
+    for (size_t index = 0; index < processes->count; index++) {
+        const es_muted_process_t *process = &processes->processes[index];
+        VALUE item = rb_hash_new();
+        rb_hash_aset(item, ID2SYM(rb_intern("audit_token")), audit_token_value(process->audit_token));
+        rb_hash_aset(item, ID2SYM(rb_intern("events")), event_symbols(process->events, process->event_count));
+        rb_ary_push(result, item);
+    }
+    return result;
+}
+
+static VALUE
+release_muted_processes(VALUE pointer_value)
+{
+    es_release_muted_processes((es_muted_processes_t *)(uintptr_t)NUM2ULL(pointer_value));
+    return Qnil;
+}
+
+static VALUE
+muted_processes(VALUE self)
+{
+    es_muted_processes_t *processes = NULL;
+    check_mute_result(es_muted_processes_events(mute_client(self)->client, &processes));
+    if (processes == NULL) {
+        return rb_ary_new();
+    }
+    VALUE pointer_value = ULL2NUM((uintptr_t)processes);
+    return rb_ensure(copy_muted_processes, pointer_value, release_muted_processes, pointer_value);
+}
+
+static VALUE
+audit_token_for_pid(VALUE self, VALUE pid_value)
+{
+    (void)self;
+    pid_t pid = NUM2PIDT(pid_value);
+    mach_port_t task = mach_task_self();
+    bool release_task = false;
+    if (pid != getpid()) {
+        kern_return_t result = task_for_pid(mach_task_self(), pid, &task);
+        if (result != KERN_SUCCESS) {
+            rb_raise(rb_eArgError, "could not obtain task port for pid %d", pid);
+        }
+        release_task = true;
+    }
+    audit_token_t token;
+    mach_msg_type_number_t count = TASK_AUDIT_TOKEN_COUNT;
+    kern_return_t result = task_info(task, TASK_AUDIT_TOKEN, (task_info_t)&token, &count);
+    if (release_task) {
+        mach_port_deallocate(mach_task_self(), task);
+    }
+    if (result != KERN_SUCCESS) {
+        rb_raise(rb_eArgError, "could not obtain audit token for pid %d", pid);
+    }
+    return audit_token_value(token);
+}
+
+void
+esrb_init_mute(VALUE client_class)
+{
+    rb_define_method(client_class, "__mute_path", mute_path, 4);
+    rb_define_method(client_class, "__mute_process", mute_process, 3);
+    rb_define_method(client_class, "__unmute_all_paths", unmute_all, 1);
+    rb_define_method(client_class, "__invert_muting", invert_muting, 1);
+    rb_define_method(client_class, "__muting_inverted", muting_inverted, 1);
+    rb_define_method(client_class, "__clear_cache", clear_cache, 0);
+    rb_define_method(client_class, "__muted_paths", muted_paths, 0);
+    rb_define_method(client_class, "__muted_processes", muted_processes, 0);
+    rb_define_method(client_class, "__audit_token_for_pid", audit_token_for_pid, 1);
+}

data/ext/endpoint_security/mute.h

@@ -0,0 +1,8 @@
+#ifndef ESRB_MUTE_H
+#define ESRB_MUTE_H
+
+#include <ruby.h>
+
+void esrb_init_mute(VALUE client_class);
+
+#endif

data/ext/endpoint_security/queue.c

@@ -0,0 +1,124 @@
+/* queue.c
+ * Calling threads: producer = ES handler (no GVL), consumer = Ruby dispatcher (GVL).
+ * The watchdog reads occupied slots without taking a lock.
+ */
+#include "queue.h"
+
+#include <sched.h>
+#include <stdlib.h>
+
+bool
+esrb_queue_init(esrb_queue_t *queue, size_t capacity)
+{
+    if (capacity < 2 || (capacity & (capacity - 1)) != 0) {
+        return false;
+    }
+
+    queue->slots = calloc(capacity, sizeof(*queue->slots));
+    if (queue->slots == NULL) {
+        return false;
+    }
+
+    queue->capacity = capacity;
+    queue->mask = capacity - 1;
+    atomic_init(&queue->enqueue_position, 0);
+    atomic_init(&queue->dequeue_position, 0);
+    atomic_init(&queue->depth_max, 0);
+    for (size_t index = 0; index < capacity; index++) {
+        atomic_init(&queue->slots[index].sequence, index);
+        atomic_init(&queue->slots[index].occupied, false);
+        atomic_init(&queue->slots[index].answer_state, ESRB_ANSWER_NOT_AUTH);
+        atomic_init(&queue->slots[index].readers, 0);
+        queue->slots[index].watchdog_index = SIZE_MAX;
+    }
+    return true;
+}
+
+void
+esrb_queue_destroy(esrb_queue_t *queue)
+{
+    free(queue->slots);
+    queue->slots = NULL;
+}
+
+esrb_slot_t *
+esrb_queue_enqueue(esrb_queue_t *queue)
+{
+    size_t position = atomic_load_explicit(&queue->enqueue_position, memory_order_relaxed);
+
+    for (;;) {
+        esrb_slot_t *slot = &queue->slots[position & queue->mask];
+        size_t sequence = atomic_load_explicit(&slot->sequence, memory_order_acquire);
+        intptr_t difference = (intptr_t)sequence - (intptr_t)position;
+
+        if (difference == 0) {
+            if (atomic_compare_exchange_weak_explicit(
+                    &queue->enqueue_position, &position, position + 1, memory_order_relaxed, memory_order_relaxed)) {
+                slot->position = position;
+                return slot;
+            }
+        } else if (difference < 0) {
+            return NULL;
+        } else {
+            position = atomic_load_explicit(&queue->enqueue_position, memory_order_relaxed);
+        }
+    }
+}
+
+void
+esrb_queue_publish(esrb_queue_t *queue, esrb_slot_t *slot)
+{
+    size_t depth = slot->position + 1 - atomic_load_explicit(&queue->dequeue_position, memory_order_relaxed);
+    size_t maximum = atomic_load_explicit(&queue->depth_max, memory_order_relaxed);
+    while (depth > maximum && !atomic_compare_exchange_weak_explicit(
+               &queue->depth_max, &maximum, depth, memory_order_relaxed, memory_order_relaxed)) {
+    }
+    atomic_store_explicit(&slot->sequence, slot->position + 1, memory_order_release);
+}
+
+esrb_slot_t *
+esrb_queue_dequeue(esrb_queue_t *queue)
+{
+    size_t position = atomic_load_explicit(&queue->dequeue_position, memory_order_relaxed);
+
+    for (;;) {
+        esrb_slot_t *slot = &queue->slots[position & queue->mask];
+        size_t sequence = atomic_load_explicit(&slot->sequence, memory_order_acquire);
+        intptr_t difference = (intptr_t)sequence - (intptr_t)(position + 1);
+
+        if (difference == 0) {
+            if (atomic_compare_exchange_weak_explicit(
+                    &queue->dequeue_position, &position, position + 1, memory_order_relaxed, memory_order_relaxed)) {
+                return slot;
+            }
+        } else if (difference < 0) {
+            return NULL;
+        } else {
+            position = atomic_load_explicit(&queue->dequeue_position, memory_order_relaxed);
+        }
+    }
+}
+
+void
+esrb_queue_disarm(esrb_slot_t *slot)
+{
+    atomic_store_explicit(&slot->occupied, false, memory_order_release);
+    while (atomic_load_explicit(&slot->readers, memory_order_acquire) != 0) {
+        sched_yield();
+    }
+}
+
+void
+esrb_queue_release(esrb_queue_t *queue, esrb_slot_t *slot)
+{
+    esrb_queue_disarm(slot);
+    atomic_store_explicit(&slot->sequence, slot->position + queue->capacity, memory_order_release);
+}
+
+size_t
+esrb_queue_depth(const esrb_queue_t *queue)
+{
+    size_t enqueued = atomic_load_explicit(&queue->enqueue_position, memory_order_relaxed);
+    size_t dequeued = atomic_load_explicit(&queue->dequeue_position, memory_order_relaxed);
+    return enqueued - dequeued;
+}

data/ext/endpoint_security/queue.h

@@ -0,0 +1,46 @@
+#ifndef ESRB_QUEUE_H
+#define ESRB_QUEUE_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <stdbool.h>
+#include <stdatomic.h>
+#include <stddef.h>
+#include <stdint.h>
+
+enum {
+    ESRB_ANSWER_PENDING = 0,
+    ESRB_ANSWER_ANSWERED = 1,
+    ESRB_ANSWER_NOT_AUTH = 2
+};
+
+typedef struct {
+    _Atomic size_t sequence;
+    _Atomic bool occupied;
+    const es_message_t *message;
+    es_client_t *client;
+    size_t position;
+    uint64_t fire_at;
+    _Atomic uint32_t answer_state;
+    _Atomic uint32_t readers;
+    size_t watchdog_index;
+} esrb_slot_t;
+
+typedef struct {
+    size_t capacity;
+    size_t mask;
+    esrb_slot_t *slots;
+    _Atomic size_t enqueue_position;
+    _Atomic size_t dequeue_position;
+    _Atomic size_t depth_max;
+} esrb_queue_t;
+
+bool esrb_queue_init(esrb_queue_t *queue, size_t capacity);
+void esrb_queue_destroy(esrb_queue_t *queue);
+esrb_slot_t *esrb_queue_enqueue(esrb_queue_t *queue);
+void esrb_queue_publish(esrb_queue_t *queue, esrb_slot_t *slot);
+esrb_slot_t *esrb_queue_dequeue(esrb_queue_t *queue);
+void esrb_queue_disarm(esrb_slot_t *slot);
+void esrb_queue_release(esrb_queue_t *queue, esrb_slot_t *slot);
+size_t esrb_queue_depth(const esrb_queue_t *queue);
+
+#endif