endpoint_security 0.1.0-universal-darwin

data/lib/endpoint_security/generated/availability.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+# Generated by codegen/run.rb. Do not edit.
+
+module EndpointSecurity
+  # Runtime support metadata for SDK events.
+  module Availability
+    # Minimum macOS version keyed by event symbol.
+    EVENT_MIN_OS = {
+      auth_exec: "10.15",
+      auth_open: "10.15",
+      auth_kextload: "10.15",
+      auth_mmap: "10.15",
+      auth_mprotect: "10.15",
+      auth_mount: "10.15",
+      auth_rename: "10.15",
+      auth_signal: "10.15",
+      auth_unlink: "10.15",
+      notify_exec: "10.15",
+      notify_open: "10.15",
+      notify_fork: "10.15",
+      notify_close: "10.15",
+      notify_create: "10.15",
+      notify_exchangedata: "10.15",
+      notify_exit: "10.15",
+      notify_get_task: "10.15",
+      notify_kextload: "10.15",
+      notify_kextunload: "10.15",
+      notify_link: "10.15",
+      notify_mmap: "10.15",
+      notify_mprotect: "10.15",
+      notify_mount: "10.15",
+      notify_unmount: "10.15",
+      notify_iokit_open: "10.15",
+      notify_rename: "10.15",
+      notify_setattrlist: "10.15",
+      notify_setextattr: "10.15",
+      notify_setflags: "10.15",
+      notify_setmode: "10.15",
+      notify_setowner: "10.15",
+      notify_signal: "10.15",
+      notify_unlink: "10.15",
+      notify_write: "10.15",
+      auth_file_provider_materialize: "10.15",
+      notify_file_provider_materialize: "10.15",
+      auth_file_provider_update: "10.15",
+      notify_file_provider_update: "10.15",
+      auth_readlink: "10.15",
+      notify_readlink: "10.15",
+      auth_truncate: "10.15",
+      notify_truncate: "10.15",
+      auth_link: "10.15",
+      notify_lookup: "10.15",
+      auth_create: "10.15",
+      auth_setattrlist: "10.15",
+      auth_setextattr: "10.15",
+      auth_setflags: "10.15",
+      auth_setmode: "10.15",
+      auth_setowner: "10.15",
+      auth_chdir: "10.15.1",
+      notify_chdir: "10.15.1",
+      auth_getattrlist: "10.15.1",
+      notify_getattrlist: "10.15.1",
+      notify_stat: "10.15.1",
+      notify_access: "10.15.1",
+      auth_chroot: "10.15.1",
+      notify_chroot: "10.15.1",
+      auth_utimes: "10.15.1",
+      notify_utimes: "10.15.1",
+      auth_clone: "10.15.1",
+      notify_clone: "10.15.1",
+      notify_fcntl: "10.15.1",
+      auth_getextattr: "10.15.1",
+      notify_getextattr: "10.15.1",
+      auth_listextattr: "10.15.1",
+      notify_listextattr: "10.15.1",
+      auth_readdir: "10.15.1",
+      notify_readdir: "10.15.1",
+      auth_deleteextattr: "10.15.1",
+      notify_deleteextattr: "10.15.1",
+      auth_fsgetpath: "10.15.1",
+      notify_fsgetpath: "10.15.1",
+      notify_dup: "10.15.1",
+      auth_settime: "10.15.1",
+      notify_settime: "10.15.1",
+      notify_uipc_bind: "10.15.1",
+      auth_uipc_bind: "10.15.1",
+      notify_uipc_connect: "10.15.1",
+      auth_uipc_connect: "10.15.1",
+      auth_exchangedata: "10.15.1",
+      auth_setacl: "10.15.1",
+      notify_setacl: "10.15.1",
+      notify_pty_grant: "10.15.4",
+      notify_pty_close: "10.15.4",
+      auth_proc_check: "10.15.4",
+      notify_proc_check: "10.15.4",
+      auth_get_task: "10.15.4",
+      auth_searchfs: "11.0",
+      notify_searchfs: "11.0",
+      auth_fcntl: "11.0",
+      auth_iokit_open: "11.0",
+      auth_proc_suspend_resume: "11.0",
+      notify_proc_suspend_resume: "11.0",
+      notify_cs_invalidated: "11.0",
+      notify_get_task_name: "11.0",
+      notify_trace: "11.0",
+      notify_remote_thread_create: "11.0",
+      auth_remount: "11.0",
+      notify_remount: "11.0",
+      auth_get_task_read: "11.3",
+      notify_get_task_read: "11.3",
+      notify_get_task_inspect: "11.3",
+      notify_setuid: "12.0",
+      notify_setgid: "12.0",
+      notify_seteuid: "12.0",
+      notify_setegid: "12.0",
+      notify_setreuid: "12.0",
+      notify_setregid: "12.0",
+      auth_copyfile: "12.0",
+      notify_copyfile: "12.0",
+      notify_authentication: "13.0",
+      notify_xp_malware_detected: "13.0",
+      notify_xp_malware_remediated: "13.0",
+      notify_lw_session_login: "13.0",
+      notify_lw_session_logout: "13.0",
+      notify_lw_session_lock: "13.0",
+      notify_lw_session_unlock: "13.0",
+      notify_screensharing_attach: "13.0",
+      notify_screensharing_detach: "13.0",
+      notify_openssh_login: "13.0",
+      notify_openssh_logout: "13.0",
+      notify_login_login: "13.0",
+      notify_login_logout: "13.0",
+      notify_btm_launch_item_add: "13.0",
+      notify_btm_launch_item_remove: "13.0",
+      notify_profile_add: "14.0",
+      notify_profile_remove: "14.0",
+      notify_su: "14.0",
+      notify_authorization_petition: "14.0",
+      notify_authorization_judgement: "14.0",
+      notify_sudo: "14.0",
+      notify_od_group_add: "14.0",
+      notify_od_group_remove: "14.0",
+      notify_od_group_set: "14.0",
+      notify_od_modify_password: "14.0",
+      notify_od_disable_user: "14.0",
+      notify_od_enable_user: "14.0",
+      notify_od_attribute_value_add: "14.0",
+      notify_od_attribute_value_remove: "14.0",
+      notify_od_attribute_set: "14.0",
+      notify_od_create_user: "14.0",
+      notify_od_create_group: "14.0",
+      notify_od_delete_user: "14.0",
+      notify_od_delete_group: "14.0",
+      notify_xpc_connect: "14.0",
+      notify_gatekeeper_user_override: "15.0",
+      notify_tcc_modify: "15.4",
+      reserved_0: "26.3",
+      reserved_1: "26.3",
+      reserved_2: "26.3",
+      reserved_3: "26.4.0",
+      reserved_4: "26.4.0",
+      reserved_5: "26.4.0",
+      reserved_6: "26.4.0",
+      reserved_7: "26.5",
+      reserved_8: "26.5"
+    }.freeze
+  end
+end

data/lib/endpoint_security/generated/enums.rb

@@ -0,0 +1,409 @@
+# frozen_string_literal: true
+
+# Generated by codegen/run.rb. Do not edit.
+
+module EndpointSecurity
+  # Symbol conversion for SDK enumeration fields.
+  module Enum
+    # Numeric-to-symbol tables keyed by SDK typedef name.
+    TABLES = {
+  "es_action_type_t" => {
+        0 => :auth,
+        1 => :notify
+  }.freeze,
+  "es_set_or_clear_t" => {
+        0 => :set,
+        1 => :clear
+  }.freeze,
+  "es_proc_check_type_t" => {
+        1 => :listpids,
+        2 => :pidinfo,
+        3 => :pidfdinfo,
+        4 => :kernmsgbuf,
+        5 => :setcontrol,
+        6 => :pidfileportinfo,
+        7 => :terminate,
+        8 => :dirtycontrol,
+        9 => :pidrusage,
+        14 => :udata_info
+  }.freeze,
+  "es_xpc_domain_type_t" => {
+        1 => :system,
+        2 => :user,
+        3 => :user_login,
+        4 => :session,
+        5 => :pid,
+        6 => :manager,
+        7 => :port,
+        8 => :gui
+  }.freeze,
+  "es_authentication_type_t" => {
+        0 => :od,
+        1 => :touchid,
+        2 => :token,
+        3 => :auto_unlock,
+        4 => :last
+  }.freeze,
+  "es_sudo_plugin_type_t" => {
+        0 => :unknown,
+        1 => :front_end,
+        2 => :policy,
+        3 => :io,
+        4 => :audit,
+        5 => :approval
+  }.freeze,
+  "es_event_type_t" => {
+        0 => :auth_exec,
+        1 => :auth_open,
+        2 => :auth_kextload,
+        3 => :auth_mmap,
+        4 => :auth_mprotect,
+        5 => :auth_mount,
+        6 => :auth_rename,
+        7 => :auth_signal,
+        8 => :auth_unlink,
+        9 => :notify_exec,
+        10 => :notify_open,
+        11 => :notify_fork,
+        12 => :notify_close,
+        13 => :notify_create,
+        14 => :notify_exchangedata,
+        15 => :notify_exit,
+        16 => :notify_get_task,
+        17 => :notify_kextload,
+        18 => :notify_kextunload,
+        19 => :notify_link,
+        20 => :notify_mmap,
+        21 => :notify_mprotect,
+        22 => :notify_mount,
+        23 => :notify_unmount,
+        24 => :notify_iokit_open,
+        25 => :notify_rename,
+        26 => :notify_setattrlist,
+        27 => :notify_setextattr,
+        28 => :notify_setflags,
+        29 => :notify_setmode,
+        30 => :notify_setowner,
+        31 => :notify_signal,
+        32 => :notify_unlink,
+        33 => :notify_write,
+        34 => :auth_file_provider_materialize,
+        35 => :notify_file_provider_materialize,
+        36 => :auth_file_provider_update,
+        37 => :notify_file_provider_update,
+        38 => :auth_readlink,
+        39 => :notify_readlink,
+        40 => :auth_truncate,
+        41 => :notify_truncate,
+        42 => :auth_link,
+        43 => :notify_lookup,
+        44 => :auth_create,
+        45 => :auth_setattrlist,
+        46 => :auth_setextattr,
+        47 => :auth_setflags,
+        48 => :auth_setmode,
+        49 => :auth_setowner,
+        50 => :auth_chdir,
+        51 => :notify_chdir,
+        52 => :auth_getattrlist,
+        53 => :notify_getattrlist,
+        54 => :notify_stat,
+        55 => :notify_access,
+        56 => :auth_chroot,
+        57 => :notify_chroot,
+        58 => :auth_utimes,
+        59 => :notify_utimes,
+        60 => :auth_clone,
+        61 => :notify_clone,
+        62 => :notify_fcntl,
+        63 => :auth_getextattr,
+        64 => :notify_getextattr,
+        65 => :auth_listextattr,
+        66 => :notify_listextattr,
+        67 => :auth_readdir,
+        68 => :notify_readdir,
+        69 => :auth_deleteextattr,
+        70 => :notify_deleteextattr,
+        71 => :auth_fsgetpath,
+        72 => :notify_fsgetpath,
+        73 => :notify_dup,
+        74 => :auth_settime,
+        75 => :notify_settime,
+        76 => :notify_uipc_bind,
+        77 => :auth_uipc_bind,
+        78 => :notify_uipc_connect,
+        79 => :auth_uipc_connect,
+        80 => :auth_exchangedata,
+        81 => :auth_setacl,
+        82 => :notify_setacl,
+        83 => :notify_pty_grant,
+        84 => :notify_pty_close,
+        85 => :auth_proc_check,
+        86 => :notify_proc_check,
+        87 => :auth_get_task,
+        88 => :auth_searchfs,
+        89 => :notify_searchfs,
+        90 => :auth_fcntl,
+        91 => :auth_iokit_open,
+        92 => :auth_proc_suspend_resume,
+        93 => :notify_proc_suspend_resume,
+        94 => :notify_cs_invalidated,
+        95 => :notify_get_task_name,
+        96 => :notify_trace,
+        97 => :notify_remote_thread_create,
+        98 => :auth_remount,
+        99 => :notify_remount,
+        100 => :auth_get_task_read,
+        101 => :notify_get_task_read,
+        102 => :notify_get_task_inspect,
+        103 => :notify_setuid,
+        104 => :notify_setgid,
+        105 => :notify_seteuid,
+        106 => :notify_setegid,
+        107 => :notify_setreuid,
+        108 => :notify_setregid,
+        109 => :auth_copyfile,
+        110 => :notify_copyfile,
+        111 => :notify_authentication,
+        112 => :notify_xp_malware_detected,
+        113 => :notify_xp_malware_remediated,
+        114 => :notify_lw_session_login,
+        115 => :notify_lw_session_logout,
+        116 => :notify_lw_session_lock,
+        117 => :notify_lw_session_unlock,
+        118 => :notify_screensharing_attach,
+        119 => :notify_screensharing_detach,
+        120 => :notify_openssh_login,
+        121 => :notify_openssh_logout,
+        122 => :notify_login_login,
+        123 => :notify_login_logout,
+        124 => :notify_btm_launch_item_add,
+        125 => :notify_btm_launch_item_remove,
+        126 => :notify_profile_add,
+        127 => :notify_profile_remove,
+        128 => :notify_su,
+        129 => :notify_authorization_petition,
+        130 => :notify_authorization_judgement,
+        131 => :notify_sudo,
+        132 => :notify_od_group_add,
+        133 => :notify_od_group_remove,
+        134 => :notify_od_group_set,
+        135 => :notify_od_modify_password,
+        136 => :notify_od_disable_user,
+        137 => :notify_od_enable_user,
+        138 => :notify_od_attribute_value_add,
+        139 => :notify_od_attribute_value_remove,
+        140 => :notify_od_attribute_set,
+        141 => :notify_od_create_user,
+        142 => :notify_od_create_group,
+        143 => :notify_od_delete_user,
+        144 => :notify_od_delete_group,
+        145 => :notify_xpc_connect,
+        146 => :notify_gatekeeper_user_override,
+        147 => :notify_tcc_modify,
+        148 => :reserved_0,
+        149 => :reserved_1,
+        150 => :reserved_2,
+        151 => :reserved_3,
+        152 => :reserved_4,
+        153 => :reserved_5,
+        154 => :reserved_6,
+        155 => :reserved_7,
+        156 => :reserved_8,
+        157 => :last
+  }.freeze,
+  "es_auth_result_t" => {
+        0 => :allow,
+        1 => :deny
+  }.freeze,
+  "es_result_type_t" => {
+        0 => :auth,
+        1 => :flags
+  }.freeze,
+  "es_return_t" => {
+        0 => :success,
+        1 => :error
+  }.freeze,
+  "es_respond_result_t" => {
+        0 => :success,
+        1 => :err_invalid_argument,
+        2 => :err_internal,
+        3 => :not_found,
+        4 => :err_duplicate_response,
+        5 => :err_event_type
+  }.freeze,
+  "es_new_client_result_t" => {
+        0 => :success,
+        1 => :err_invalid_argument,
+        2 => :err_internal,
+        3 => :err_not_entitled,
+        4 => :err_not_permitted,
+        5 => :err_not_privileged,
+        6 => :err_too_many_clients
+  }.freeze,
+  "es_clear_cache_result_t" => {
+        0 => :success,
+        1 => :err_internal,
+        2 => :err_throttle
+  }.freeze,
+  "es_mute_path_type_t" => {
+        0 => :prefix,
+        1 => :literal,
+        2 => :target_prefix,
+        3 => :target_literal
+  }.freeze,
+  "es_address_type_t" => {
+        0 => :none,
+        1 => :ipv4,
+        2 => :ipv6,
+        3 => :named_socket
+  }.freeze,
+  "es_mute_inversion_type_t" => {
+        0 => :process,
+        1 => :path,
+        2 => :target_path,
+        3 => :last
+  }.freeze,
+  "es_mute_inverted_return_t" => {
+        0 => :mute_inverted,
+        1 => :mute_not_inverted,
+        2 => :mute_inverted_error
+  }.freeze,
+  "es_authorization_rule_class_t" => {
+        0 => :user,
+        1 => :rule,
+        2 => :mechanism,
+        3 => :allow,
+        4 => :deny,
+        5 => :unknown,
+        6 => :invalid
+  }.freeze,
+  "es_od_member_type_t" => {
+        0 => :user_name,
+        1 => :user_uuid,
+        2 => :group_uuid
+  }.freeze,
+  "es_od_account_type_t" => {
+        0 => :user,
+        1 => :computer
+  }.freeze,
+  "es_od_record_type_t" => {
+        0 => :user,
+        1 => :group
+  }.freeze,
+  "es_gatekeeper_user_override_file_type_t" => {
+        0 => :path,
+        1 => :file
+  }.freeze,
+  "es_tcc_event_type_t" => {
+        0 => :unknown,
+        1 => :create,
+        2 => :modify,
+        3 => :delete
+  }.freeze,
+  "es_tcc_authorization_right_t" => {
+        0 => :denied,
+        1 => :unknown,
+        2 => :allowed,
+        3 => :limited,
+        4 => :add_modify_added,
+        5 => :session_pid,
+        6 => :learn_more
+  }.freeze,
+  "es_tcc_authorization_reason_t" => {
+        0 => :none,
+        1 => :error,
+        2 => :user_consent,
+        3 => :user_set,
+        4 => :system_set,
+        5 => :service_policy,
+        6 => :mdm_policy,
+        7 => :service_override_policy,
+        8 => :missing_usage_string,
+        9 => :prompt_timeout,
+        10 => :preflight_unknown,
+        11 => :entitled,
+        12 => :app_type_policy,
+        13 => :prompt_cancel
+  }.freeze,
+  "es_tcc_identity_type_t" => {
+        0 => :bundle_id,
+        1 => :executable_path,
+        2 => :policy_id,
+        3 => :file_provider_domain_id
+  }.freeze,
+  "es_cs_validation_category_t" => {
+        0 => :invalid,
+        1 => :platform,
+        2 => :testflight,
+        3 => :development,
+        4 => :app_store,
+        5 => :enterprise,
+        6 => :developer_id,
+        7 => :local_signing,
+        8 => :rosetta,
+        9 => :oopjit,
+        10 => :none
+  }.freeze,
+  "es_auto_unlock_type_t" => {
+        1 => :auto_unlock_machine_unlock,
+        2 => :auto_unlock_auth_prompt
+  }.freeze,
+  "es_btm_item_type_t" => {
+        0 => :user_item,
+        1 => :app,
+        2 => :login_item,
+        3 => :agent,
+        4 => :daemon
+  }.freeze,
+  "es_destination_type_t" => {
+        0 => :existing_file,
+        1 => :new_path
+  }.freeze,
+  "es_get_task_type_t" => {
+        0 => :task_for_pid,
+        1 => :expose_task,
+        2 => :identity_token
+  }.freeze,
+  "es_openssh_login_result_type_t" => {
+        0 => :openssh_login_exceed_maxtries,
+        1 => :openssh_login_root_denied,
+        2 => :openssh_auth_success,
+        3 => :openssh_auth_fail_none,
+        4 => :openssh_auth_fail_passwd,
+        5 => :openssh_auth_fail_kbdint,
+        6 => :openssh_auth_fail_pubkey,
+        7 => :openssh_auth_fail_hostbased,
+        8 => :openssh_auth_fail_gssapi,
+        9 => :openssh_invalid_user
+  }.freeze,
+  "es_mount_disposition_t" => {
+        0 => :external,
+        1 => :internal,
+        2 => :network,
+        3 => :virtual,
+        4 => :nullfs,
+        5 => :unknown
+  }.freeze,
+  "es_proc_suspend_resume_type_t" => {
+        0 => :suspend,
+        1 => :resume,
+        3 => :shutdown_sockets
+  }.freeze,
+  "es_profile_source_t" => {
+        0 => :managed,
+        1 => :install
+  }.freeze,
+  "es_touchid_mode_t" => {
+        0 => :verification,
+        1 => :identification
+  }.freeze
+    }.freeze
+
+    module_function
+
+    # Returns the symbolic enum value, preserving unknown numeric values.
+    # @return [Symbol, Integer]
+    def symbol(type, value) = TABLES.fetch(type, {}).fetch(value, value)
+  end
+end