endpoint_security 0.1.0-universal-darwin

data/support/esmock/esmock.c

@@ -0,0 +1,482 @@
+/* esmock.c
+ * Calling threads: tests invoke injection; the copied ES handler may enqueue without the GVL.
+ */
+#include "esmock.h"
+
+#include <Block.h>
+#include <mach/mach_time.h>
+#include <pthread.h>
+#include <stdatomic.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+struct es_client_s {
+    es_handler_block_t handler;
+    pthread_t creator;
+    bool subscriptions[ES_EVENT_TYPE_LAST];
+};
+
+typedef struct {
+    _Atomic size_t references;
+    es_process_t process;
+    es_process_t target;
+    es_file_t executable;
+    es_file_t target_executable;
+    struct statfs statfs;
+    es_sha256_t sha256;
+    void *event_data;
+    es_message_t message;
+} mock_message_t;
+
+static _Atomic size_t responses;
+static _Atomic uint32_t last_response;
+static _Atomic bool inverted[3];
+static _Atomic int next_new_client_result;
+static _Atomic int next_respond_result;
+static _Atomic int next_delete_result;
+static _Atomic size_t clients;
+static _Atomic bool delete_on_creator_thread;
+
+static mock_message_t *
+mock_from_message(const es_message_t *message)
+{
+    return (mock_message_t *)((char *)message - offsetof(mock_message_t, message));
+}
+
+es_new_client_result_t
+es_new_client(es_client_t **client, es_handler_block_t handler)
+{
+    es_new_client_result_t result = atomic_exchange_explicit(
+        &next_new_client_result, ES_NEW_CLIENT_RESULT_SUCCESS, memory_order_relaxed);
+    if (result != ES_NEW_CLIENT_RESULT_SUCCESS) {
+        *client = NULL;
+        return result;
+    }
+    *client = calloc(1, sizeof(**client));
+    if (*client == NULL) {
+        return ES_NEW_CLIENT_RESULT_ERR_INTERNAL;
+    }
+    (*client)->creator = pthread_self();
+    (*client)->handler = Block_copy(handler);
+    atomic_fetch_add_explicit(&clients, 1, memory_order_relaxed);
+    return ES_NEW_CLIENT_RESULT_SUCCESS;
+}
+
+es_return_t
+es_delete_client(es_client_t *client)
+{
+    if (client == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    atomic_store_explicit(
+        &delete_on_creator_thread, pthread_equal(client->creator, pthread_self()), memory_order_relaxed);
+    Block_release(client->handler);
+    atomic_fetch_sub_explicit(&clients, 1, memory_order_relaxed);
+    free(client);
+    return atomic_exchange_explicit(&next_delete_result, ES_RETURN_SUCCESS, memory_order_relaxed);
+}
+
+es_return_t
+es_subscribe(es_client_t *client, const es_event_type_t *events, uint32_t event_count)
+{
+    if (client == NULL || events == NULL || event_count == 0) {
+        return ES_RETURN_ERROR;
+    }
+    for (uint32_t index = 0; index < event_count; index++) {
+        if (events[index] < 0 || events[index] >= ES_EVENT_TYPE_LAST || events[index] == ES_EVENT_TYPE_RESERVED_0) {
+            return ES_RETURN_ERROR;
+        }
+    }
+    for (uint32_t index = 0; index < event_count; index++) {
+        client->subscriptions[events[index]] = true;
+    }
+    return ES_RETURN_SUCCESS;
+}
+
+es_return_t
+es_unsubscribe(es_client_t *client, const es_event_type_t *events, uint32_t event_count)
+{
+    if (client == NULL || events == NULL || event_count == 0) {
+        return ES_RETURN_ERROR;
+    }
+    for (uint32_t index = 0; index < event_count; index++) {
+        if (events[index] < 0 || events[index] >= ES_EVENT_TYPE_LAST) {
+            return ES_RETURN_ERROR;
+        }
+        client->subscriptions[events[index]] = false;
+    }
+    return ES_RETURN_SUCCESS;
+}
+
+es_return_t
+es_unsubscribe_all(es_client_t *client)
+{
+    if (client == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    memset(client->subscriptions, 0, sizeof(client->subscriptions));
+    return ES_RETURN_SUCCESS;
+}
+
+es_return_t
+es_subscriptions(es_client_t *client, size_t *count, es_event_type_t **subscriptions)
+{
+    if (client == NULL || count == NULL || subscriptions == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    *count = 0;
+    for (size_t index = 0; index < ES_EVENT_TYPE_LAST; index++) {
+        *count += client->subscriptions[index] ? 1 : 0;
+    }
+    *subscriptions = *count == 0 ? NULL : malloc(*count * sizeof(**subscriptions));
+    if (*count > 0 && *subscriptions == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    size_t output = 0;
+    for (size_t index = 0; index < ES_EVENT_TYPE_LAST; index++) {
+        if (client->subscriptions[index]) {
+            (*subscriptions)[output++] = (es_event_type_t)index;
+        }
+    }
+    return ES_RETURN_SUCCESS;
+}
+
+es_return_t
+es_mute_process(es_client_t *client, const audit_token_t *token)
+{
+    return client != NULL && token != NULL ? ES_RETURN_SUCCESS : ES_RETURN_ERROR;
+}
+
+es_return_t
+es_unmute_process(es_client_t *client, const audit_token_t *token)
+{
+    return es_mute_process(client, token);
+}
+
+es_return_t
+es_mute_process_events(es_client_t *client, const audit_token_t *token, const es_event_type_t *events, size_t count)
+{
+    return client != NULL && token != NULL && events != NULL && count > 0 ? ES_RETURN_SUCCESS : ES_RETURN_ERROR;
+}
+
+es_return_t
+es_unmute_process_events(es_client_t *client, const audit_token_t *token, const es_event_type_t *events, size_t count)
+{
+    return es_mute_process_events(client, token, events, count);
+}
+
+es_return_t
+es_mute_path(es_client_t *client, const char *path, es_mute_path_type_t type)
+{
+    (void)type;
+    return client != NULL && path != NULL ? ES_RETURN_SUCCESS : ES_RETURN_ERROR;
+}
+
+es_return_t
+es_unmute_path(es_client_t *client, const char *path, es_mute_path_type_t type)
+{
+    return es_mute_path(client, path, type);
+}
+
+es_return_t
+es_mute_path_events(
+    es_client_t *client, const char *path, es_mute_path_type_t type, const es_event_type_t *events, size_t count)
+{
+    (void)type;
+    return client != NULL && path != NULL && events != NULL && count > 0 ? ES_RETURN_SUCCESS : ES_RETURN_ERROR;
+}
+
+es_return_t
+es_unmute_path_events(
+    es_client_t *client, const char *path, es_mute_path_type_t type, const es_event_type_t *events, size_t count)
+{
+    return es_mute_path_events(client, path, type, events, count);
+}
+
+es_return_t
+es_unmute_all_paths(es_client_t *client)
+{
+    return client == NULL ? ES_RETURN_ERROR : ES_RETURN_SUCCESS;
+}
+
+es_return_t
+es_unmute_all_target_paths(es_client_t *client)
+{
+    return es_unmute_all_paths(client);
+}
+
+es_return_t
+es_invert_muting(es_client_t *client, es_mute_inversion_type_t type)
+{
+    if (client == NULL || type < 0 || type >= ES_MUTE_INVERSION_TYPE_LAST) {
+        return ES_RETURN_ERROR;
+    }
+    atomic_fetch_xor_explicit(&inverted[type], true, memory_order_relaxed);
+    return ES_RETURN_SUCCESS;
+}
+
+es_mute_inverted_return_t
+es_muting_inverted(es_client_t *client, es_mute_inversion_type_t type)
+{
+    if (client == NULL || type < 0 || type >= ES_MUTE_INVERSION_TYPE_LAST) {
+        return ES_MUTE_INVERTED_ERROR;
+    }
+    return atomic_load_explicit(&inverted[type], memory_order_relaxed) ? ES_MUTE_INVERTED : ES_MUTE_NOT_INVERTED;
+}
+
+es_clear_cache_result_t
+es_clear_cache(es_client_t *client)
+{
+    return client == NULL ? ES_CLEAR_CACHE_RESULT_ERR_INTERNAL : ES_CLEAR_CACHE_RESULT_SUCCESS;
+}
+
+es_return_t
+es_muted_paths_events(es_client_t *client, es_muted_paths_t **paths)
+{
+    if (client == NULL || paths == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    *paths = calloc(1, sizeof(**paths));
+    return *paths == NULL ? ES_RETURN_ERROR : ES_RETURN_SUCCESS;
+}
+
+void
+es_release_muted_paths(es_muted_paths_t *paths)
+{
+    free(paths);
+}
+
+es_return_t
+es_muted_processes_events(es_client_t *client, es_muted_processes_t **processes)
+{
+    if (client == NULL || processes == NULL) {
+        return ES_RETURN_ERROR;
+    }
+    *processes = calloc(1, sizeof(**processes));
+    return *processes == NULL ? ES_RETURN_ERROR : ES_RETURN_SUCCESS;
+}
+
+void
+es_release_muted_processes(es_muted_processes_t *processes)
+{
+    free(processes);
+}
+
+es_respond_result_t
+es_respond_auth_result(es_client_t *client, const es_message_t *message, es_auth_result_t result, bool cache)
+{
+    (void)cache;
+    if (client == NULL || message == NULL) {
+        return ES_RESPOND_RESULT_ERR_INVALID_ARGUMENT;
+    }
+    es_respond_result_t response = atomic_exchange_explicit(
+        &next_respond_result, ES_RESPOND_RESULT_SUCCESS, memory_order_relaxed);
+    if (response != ES_RESPOND_RESULT_SUCCESS) {
+        return response;
+    }
+    atomic_store_explicit(&last_response, (uint32_t)result, memory_order_relaxed);
+    atomic_fetch_add_explicit(&responses, 1, memory_order_relaxed);
+    return ES_RESPOND_RESULT_SUCCESS;
+}
+
+es_respond_result_t
+es_respond_flags_result(es_client_t *client, const es_message_t *message, uint32_t flags, bool cache)
+{
+    (void)cache;
+    if (client == NULL || message == NULL) {
+        return ES_RESPOND_RESULT_ERR_INVALID_ARGUMENT;
+    }
+    es_respond_result_t response = atomic_exchange_explicit(
+        &next_respond_result, ES_RESPOND_RESULT_SUCCESS, memory_order_relaxed);
+    if (response != ES_RESPOND_RESULT_SUCCESS) {
+        return response;
+    }
+    atomic_store_explicit(&last_response, flags, memory_order_relaxed);
+    atomic_fetch_add_explicit(&responses, 1, memory_order_relaxed);
+    return ES_RESPOND_RESULT_SUCCESS;
+}
+
+void
+es_retain_message(const es_message_t *message)
+{
+    atomic_fetch_add_explicit(&mock_from_message(message)->references, 1, memory_order_relaxed);
+}
+
+void
+es_release_message(const es_message_t *message)
+{
+    mock_message_t *mock = mock_from_message(message);
+    if (atomic_fetch_sub_explicit(&mock->references, 1, memory_order_acq_rel) == 1) {
+        free(mock->event_data);
+        free(mock);
+    }
+}
+
+void
+esmock_inject(
+    es_client_t *client, es_event_type_t event_type, es_action_type_t action_type, uint64_t deadline, uint32_t version,
+    size_t event_size, es_result_type_t result_type, uint32_t result, bool source_es_client)
+{
+    mock_message_t *mock = calloc(1, sizeof(*mock));
+    atomic_init(&mock->references, 1);
+    mock->message.version = version;
+    clock_gettime(CLOCK_REALTIME, &mock->message.time);
+    mock->message.mach_time = mach_absolute_time();
+    mock->message.deadline = deadline;
+    static const char executable_path[] = "/usr/bin/mock-source";
+    static const char target_path[] = "/usr/bin/mock-target";
+    mock->executable.path.data = executable_path;
+    mock->executable.path.length = sizeof(executable_path) - 1;
+    mock->executable.path_truncated = true;
+    mock->target_executable.path.data = target_path;
+    mock->target_executable.path.length = sizeof(target_path) - 1;
+    mock->target_executable.path_truncated = true;
+    mock->process.executable = &mock->executable;
+    mock->target.executable = &mock->target_executable;
+    mock->process.cdhash[0] = 0xff;
+    mock->process.is_es_client = source_es_client;
+    mock->target.cdhash[0] = 0xff;
+    mock->message.process = &mock->process;
+    mock->message.event_type = event_type;
+    mock->message.action_type = action_type;
+    if (action_type == ES_ACTION_TYPE_NOTIFY) {
+        mock->message.action.notify.result_type = result_type;
+        if (result_type == ES_RESULT_TYPE_FLAGS) {
+            mock->message.action.notify.result.flags = result;
+        } else {
+            mock->message.action.notify.result.auth = (es_auth_result_t)result;
+        }
+    }
+    if (event_size > 0) {
+        mock->event_data = calloc(1, event_size);
+        if (mock->event_data == NULL) {
+            es_release_message(&mock->message);
+            return;
+        }
+        memcpy(&mock->message.event, &mock->event_data, sizeof(mock->event_data));
+    }
+    if (event_type == ES_EVENT_TYPE_AUTH_EXEC || event_type == ES_EVENT_TYPE_NOTIFY_EXEC) {
+        mock->message.event.exec.target = &mock->target;
+    }
+    if (event_type == ES_EVENT_TYPE_NOTIFY_MOUNT) {
+        mock->statfs.f_bsize = 4096;
+        memcpy(mock->statfs.f_fstypename, "mockfs", sizeof("mockfs"));
+        mock->message.event.mount.statfs = &mock->statfs;
+    }
+    if (event_type == ES_EVENT_TYPE_NOTIFY_GETATTRLIST) {
+        mock->message.event.getattrlist.attrlist.bitmapcount = ATTR_BIT_MAP_COUNT;
+        mock->message.event.getattrlist.attrlist.commonattr = 1;
+    }
+    if (event_type == ES_EVENT_TYPE_NOTIFY_GATEKEEPER_USER_OVERRIDE) {
+        es_event_gatekeeper_user_override_t *gatekeeper = mock->event_data;
+        mock->sha256[0] = 0xff;
+        gatekeeper->sha256 = &mock->sha256;
+    }
+    client->handler(client, &mock->message);
+    es_release_message(&mock->message);
+}
+
+size_t
+esmock_response_count(void)
+{
+    return atomic_load_explicit(&responses, memory_order_relaxed);
+}
+
+uint32_t
+esmock_last_response(void)
+{
+    return atomic_load_explicit(&last_response, memory_order_relaxed);
+}
+
+size_t
+esmock_client_count(void)
+{
+    return atomic_load_explicit(&clients, memory_order_relaxed);
+}
+
+bool
+esmock_delete_on_creator_thread(void)
+{
+    return atomic_load_explicit(&delete_on_creator_thread, memory_order_relaxed);
+}
+
+void
+esmock_set_new_client_result(es_new_client_result_t result)
+{
+    atomic_store_explicit(&next_new_client_result, result, memory_order_relaxed);
+}
+
+void
+esmock_set_respond_result(es_respond_result_t result)
+{
+    atomic_store_explicit(&next_respond_result, result, memory_order_relaxed);
+}
+
+void
+esmock_set_delete_result(es_return_t result)
+{
+    atomic_store_explicit(&next_delete_result, result, memory_order_relaxed);
+}
+
+void
+esmock_reset(void)
+{
+    atomic_store_explicit(&responses, 0, memory_order_relaxed);
+    atomic_store_explicit(&last_response, 0, memory_order_relaxed);
+    atomic_store_explicit(&next_new_client_result, ES_NEW_CLIENT_RESULT_SUCCESS, memory_order_relaxed);
+    atomic_store_explicit(&next_respond_result, ES_RESPOND_RESULT_SUCCESS, memory_order_relaxed);
+    atomic_store_explicit(&next_delete_result, ES_RETURN_SUCCESS, memory_order_relaxed);
+    atomic_store_explicit(&clients, 0, memory_order_relaxed);
+    atomic_store_explicit(&delete_on_creator_thread, true, memory_order_relaxed);
+    for (size_t index = 0; index < 3; index++) {
+        atomic_store_explicit(&inverted[index], false, memory_order_relaxed);
+    }
+}
+
+uint32_t
+es_exec_arg_count(const es_event_exec_t *event)
+{
+    (void)event;
+    return 0;
+}
+
+uint32_t
+es_exec_env_count(const es_event_exec_t *event)
+{
+    (void)event;
+    return 0;
+}
+
+uint32_t
+es_exec_fd_count(const es_event_exec_t *event)
+{
+    (void)event;
+    return 0;
+}
+
+es_string_token_t
+es_exec_arg(const es_event_exec_t *event, uint32_t index)
+{
+    (void)event;
+    (void)index;
+    return (es_string_token_t){0};
+}
+
+es_string_token_t
+es_exec_env(const es_event_exec_t *event, uint32_t index)
+{
+    (void)event;
+    (void)index;
+    return (es_string_token_t){0};
+}
+
+const es_fd_t *
+es_exec_fd(const es_event_exec_t *event, uint32_t index)
+{
+    static const es_fd_t empty = {0};
+    (void)event;
+    (void)index;
+    return &empty;
+}

data/support/esmock/esmock.h

@@ -0,0 +1,21 @@
+#ifndef ESMOCK_H
+#define ESMOCK_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+void esmock_inject(
+    es_client_t *client, es_event_type_t event_type, es_action_type_t action_type, uint64_t deadline, uint32_t version,
+    size_t event_size, es_result_type_t result_type, uint32_t result, bool source_es_client);
+size_t esmock_response_count(void);
+uint32_t esmock_last_response(void);
+size_t esmock_client_count(void);
+bool esmock_delete_on_creator_thread(void);
+void esmock_set_new_client_result(es_new_client_result_t result);
+void esmock_set_respond_result(es_respond_result_t result);
+void esmock_set_delete_result(es_return_t result);
+void esmock_reset(void);
+
+#endif

data/support/sign_ruby.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+source_ruby=${1:?ruby executable is required}
+identity=${2:--}
+project_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+destination="$project_root/build/es-ruby"
+
+mkdir -p "$project_root/build"
+cp "$source_ruby" "$destination"
+codesign --force --options runtime --entitlements "$project_root/support/entitlements.plist" --sign "$identity" "$destination"
+codesign --verify --strict --verbose=2 "$destination"
+codesign -d --entitlements - "$destination"

metadata

@@ -0,0 +1,90 @@
+--- !ruby/object:Gem::Specification
+name: endpoint_security
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: universal-darwin
+authors:
+- Yudai Takada
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: A native Ruby interface to macOS EndpointSecurity.
+email:
+- t.yudai92@gmail.com
+executables: []
+extensions:
+- ext/endpoint_security/extconf.rb
+extra_rdoc_files: []
+files:
+- ".rubocop.yml"
+- LICENSE.txt
+- README.md
+- Rakefile
+- codegen/ast.rb
+- codegen/emit_c.rb
+- codegen/emit_ruby.rb
+- codegen/ir.rb
+- codegen/overlay/availability.yml
+- codegen/overlay/version_map.yml
+- codegen/run.rb
+- codegen/snapshots/26.5.json
+- examples/eslogger_clone.rb
+- examples/execblock.rb
+- examples/filemon.rb
+- examples/procmon.rb
+- ext/endpoint_security/client.c
+- ext/endpoint_security/client.h
+- ext/endpoint_security/endpoint_security.c
+- ext/endpoint_security/extconf.rb
+- ext/endpoint_security/field.c
+- ext/endpoint_security/field.h
+- ext/endpoint_security/generated/es_schema.c
+- ext/endpoint_security/message.c
+- ext/endpoint_security/message.h
+- ext/endpoint_security/mute.c
+- ext/endpoint_security/mute.h
+- ext/endpoint_security/queue.c
+- ext/endpoint_security/queue.h
+- ext/endpoint_security/watchdog.c
+- lib/endpoint_security.rb
+- lib/endpoint_security/availability.rb
+- lib/endpoint_security/client.rb
+- lib/endpoint_security/diagnostics.rb
+- lib/endpoint_security/doctor.rb
+- lib/endpoint_security/errors.rb
+- lib/endpoint_security/generated/availability.rb
+- lib/endpoint_security/generated/enums.rb
+- lib/endpoint_security/generated/event_types.rb
+- lib/endpoint_security/message.rb
+- lib/endpoint_security/object_model.rb
+- lib/endpoint_security/recorder.rb
+- lib/endpoint_security/version.rb
+- support/entitlements.plist
+- support/esmock/esmock.c
+- support/esmock/esmock.h
+- support/sign_ruby.sh
+homepage: https://github.com/YudaiTakada/endpoint_security
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/YudaiTakada/endpoint_security
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.19
+specification_version: 4
+summary: Ruby bindings for Apple's EndpointSecurity framework
+test_files: []