endpoint_security 0.1.0-universal-darwin

data/codegen/ir.rb

@@ -0,0 +1,193 @@
+# frozen_string_literal: true
+
+module EndpointSecurity
+  module Codegen
+    Event = Data.define(:name, :symbol, :value, :minimum_os, :reserved)
+    EventTypes = Data.define(:events, :last)
+    Field = Data.define(:name, :type, :minimum_version)
+    Record = Data.define(:name, :fields)
+    EnumValue = Data.define(:name, :symbol, :value)
+    Enumeration = Data.define(:name, :values)
+
+    class IR
+      AVAILABILITY = /available beginning in macOS ([0-9]+(?:\.[0-9]+){1,2})/i
+      EVENT = /\b(ES_EVENT_TYPE_[A-Z0-9_]+)\b/
+      SCALAR_TYPES = [
+        "bool", "_Bool", "unsigned long long", "uint64_t", "long long", "int64_t", "unsigned long", "long",
+        "unsigned int", "uint32_t", "int", "int32_t", "unsigned short", "uint16_t", "short", "int16_t",
+        "unsigned char", "uint8_t", "signed char", "int8_t", "char", "es_string_token_t", "es_token_t",
+        "audit_token_t", "struct stat", "struct timespec", "struct timeval", "struct attrlist"
+      ].freeze
+      POINTER_TYPES = ["struct statfs *", "struct _acl *", "es_sha256_t *", "audit_token_t *"].freeze
+      SPECIAL_FIELDS = %w[
+        es_token_t.data es_string_token_t.data es_muted_path_t.events es_muted_process_t.events
+        es_muted_paths_t.paths es_muted_processes_t.processes es_event_su_t.argv es_event_su_t.env
+        es_event_authorization_petition_t.rights es_event_authorization_judgement_t.results
+        es_event_od_attribute_set_t.attribute_values es_message_t.opaque es_message_t.action es_result_t.result
+        es_fd_t.pipe es_event_rename_t.destination es_event_create_t.destination es_event_authentication_t.data
+        es_event_authentication_touchid_t.uid es_event_openssh_login_t.uid es_event_login_login_t.uid
+        es_event_su_t.to_uid es_event_sudo_t.from_uid es_event_sudo_t.to_uid
+        es_event_gatekeeper_user_override_t.file es_event_setacl_t.acl es_od_member_id_t.member_value
+        es_od_member_id_array_t.member_array
+      ].freeze
+
+      def self.event_types(ast:, source:)
+        availability = scan_availability(source)
+        value = -1
+        last = nil
+        entries = ast.enum_containing("ES_EVENT_TYPE_AUTH_EXEC").fetch("inner", []).filter_map do |node|
+          next unless node["kind"] == "EnumConstantDecl"
+
+          value = explicit_value(node) || (value + 1)
+          if node["name"] == "ES_EVENT_TYPE_LAST"
+            last = value
+            next
+          end
+
+          symbol = node["name"].delete_prefix("ES_EVENT_TYPE_").downcase.to_sym
+          Event.new(node["name"], symbol, value, availability.fetch(node["name"]), symbol.start_with?("reserved_"))
+        end
+
+        unless last == entries.length
+          raise CodegenError, "ES_EVENT_TYPE_LAST=#{last}, but #{entries.length} events were parsed"
+        end
+
+        EventTypes.new(entries.freeze, last)
+      end
+
+      def self.scan_availability(source)
+        first_event = source.index("ES_EVENT_TYPE_AUTH_EXEC")
+        raise CodegenError, "es_event_type_t was not found" unless first_event
+
+        source = source[source.rindex("typedef enum {", first_event)..]
+        current = nil
+
+        source.each_line.with_object({}) do |line, versions|
+          availability_match = line.match(AVAILABILITY)
+          current = availability_match[1] if availability_match
+          name = line[EVENT, 1]
+          versions[name] = current if name && name != "ES_EVENT_TYPE_LAST"
+          break versions if line.include?("} es_event_type_t;")
+        end
+      end
+
+      def self.explicit_value(node)
+        pending = node.fetch("inner", []).dup
+        until pending.empty?
+          child = pending.shift
+          return Integer(child["value"]) if child.key?("value")
+
+          pending.concat(child.fetch("inner", []))
+        end
+        nil
+      end
+
+      private_class_method :explicit_value
+
+      def self.records(ast:, version_sources:)
+        versions = scan_field_versions(version_sources)
+        ast.typedef_records.filter_map do |name, node|
+          direct = node.fetch("inner", []).select { |child| child["kind"] == "FieldDecl" && child["name"] }
+          indirect_fields = node.fetch("inner", []).select { |child| child["kind"] == "IndirectFieldDecl" }
+          indirect = indirect_fields.filter_map do |child|
+            recursive_field(node, child["name"])
+          end
+          fields = (direct + indirect).uniq { |field| field["name"] }.filter_map do |field|
+            next if field["name"].start_with?("reserved")
+
+            type = normalize_type(field.dig("type", "desugaredQualType") || field.dig("type", "qualType"))
+            minimum_version = versions.fetch([name, field["name"]], 1)
+            Field.new(field["name"], type, minimum_version)
+          end
+          Record.new(name, fields.freeze)
+        end.freeze
+      end
+
+      def self.enumerations(ast:)
+        ast.typedef_enums.map do |name, node|
+          value = -1
+          prefix = "#{name.delete_suffix("_t").upcase}_"
+          values = node.fetch("inner", []).filter_map do |entry|
+            next unless entry["kind"] == "EnumConstantDecl"
+
+            value = explicit_value(entry) || (value + 1)
+            symbol = entry.fetch("name").delete_prefix(prefix).delete_prefix("ES_").downcase.to_sym
+            EnumValue.new(entry.fetch("name"), symbol, value)
+          end
+          Enumeration.new(name, values.freeze) unless values.empty?
+        end.compact.freeze
+      end
+
+      def self.normalize_type(type)
+        type.gsub(/\((?:unnamed|anonymous) at .*?:\d+:\d+\)/, "(anonymous)")
+      end
+
+      def self.validate_field_types!(records:, enumerations:)
+        record_names = records.map(&:name)
+        enum_names = enumerations.map(&:name)
+        records.each do |record|
+          record.fields.each do |field|
+            next if supported_field_type?(record, field, record_names, enum_names)
+
+            raise CodegenError, "unsupported field type #{field.type} at #{record.name}.#{field.name}"
+          end
+        end
+      end
+
+      def self.scan_field_versions(sources)
+        sources.each_with_object({}) do |source, versions|
+          fields = nil
+          source.each_line do |line|
+            fields = {} if fields.nil? && line.match?(/\btypedef\s+struct(?:\s+[a-zA-Z_]\w*)?\s*\{/)
+            if fields && (match = line.match(
+              /\b([a-zA-Z_]\w*)\s*(?:\[[^\]]*\])?\s*;[^\n]*(?:message|msg)\s+versions?\s*>=\s*(\d+)/i
+            ))
+              fields[match[1]] = Integer(match[2])
+            end
+            next unless fields && (record = line[/^\s*}\s*(es_[a-zA-Z0-9_]+_t)\s*;/, 1])
+
+            fields.each { |name, version| versions[[record, name]] = version }
+            fields = nil
+          end
+        end
+      end
+
+      def self.recursive_field(node, name)
+        pending = node.fetch("inner", []).dup
+        until pending.empty?
+          child = pending.shift
+          return child if child["kind"] == "FieldDecl" && child["name"] == name
+
+          pending.concat(child.fetch("inner", []))
+        end
+        nil
+      end
+
+      private_class_method :recursive_field
+
+      def self.supported_field_type?(record, field, record_names, enum_names)
+        type = field.type
+        return true if SPECIAL_FIELDS.include?("#{record.name}.#{field.name}")
+        return true if SCALAR_TYPES.include?(type) || enum_names.include?(type) || record_names.include?(type)
+        return true if type == "uint8_t[20]" || POINTER_TYPES.include?(type)
+
+        pointee = type.delete_prefix("const ").delete_suffix(" *")
+        type.end_with?(" *") && record_names.include?(pointee)
+      end
+
+      private_class_method :supported_field_type?
+
+      def self.cacheable_events(source, events)
+        cacheable_structs = source.to_enum(:scan, /}\s*(es_event_[a-zA-Z0-9_]+_t);/).filter_map do
+          match = Regexp.last_match
+          comment_start = source.rindex("/**", match.begin(0))
+          match[1] if comment_start && source[comment_start...match.begin(0)].include?("Cache key for this event type")
+        end
+        suffixes = cacheable_structs.map { |name| name.delete_prefix("es_event_").delete_suffix("_t") }
+        events.events.select do |event|
+          event.symbol.start_with?("auth_") && suffixes.include?(event.symbol.to_s.delete_prefix("auth_"))
+        end.map(&:symbol)
+      end
+    end
+  end
+end

data/codegen/overlay/availability.yml

@@ -0,0 +1,158 @@
+---
+auth_exec: '10.15'
+auth_open: '10.15'
+auth_kextload: '10.15'
+auth_mmap: '10.15'
+auth_mprotect: '10.15'
+auth_mount: '10.15'
+auth_rename: '10.15'
+auth_signal: '10.15'
+auth_unlink: '10.15'
+notify_exec: '10.15'
+notify_open: '10.15'
+notify_fork: '10.15'
+notify_close: '10.15'
+notify_create: '10.15'
+notify_exchangedata: '10.15'
+notify_exit: '10.15'
+notify_get_task: '10.15'
+notify_kextload: '10.15'
+notify_kextunload: '10.15'
+notify_link: '10.15'
+notify_mmap: '10.15'
+notify_mprotect: '10.15'
+notify_mount: '10.15'
+notify_unmount: '10.15'
+notify_iokit_open: '10.15'
+notify_rename: '10.15'
+notify_setattrlist: '10.15'
+notify_setextattr: '10.15'
+notify_setflags: '10.15'
+notify_setmode: '10.15'
+notify_setowner: '10.15'
+notify_signal: '10.15'
+notify_unlink: '10.15'
+notify_write: '10.15'
+auth_file_provider_materialize: '10.15'
+notify_file_provider_materialize: '10.15'
+auth_file_provider_update: '10.15'
+notify_file_provider_update: '10.15'
+auth_readlink: '10.15'
+notify_readlink: '10.15'
+auth_truncate: '10.15'
+notify_truncate: '10.15'
+auth_link: '10.15'
+notify_lookup: '10.15'
+auth_create: '10.15'
+auth_setattrlist: '10.15'
+auth_setextattr: '10.15'
+auth_setflags: '10.15'
+auth_setmode: '10.15'
+auth_setowner: '10.15'
+auth_chdir: 10.15.1
+notify_chdir: 10.15.1
+auth_getattrlist: 10.15.1
+notify_getattrlist: 10.15.1
+notify_stat: 10.15.1
+notify_access: 10.15.1
+auth_chroot: 10.15.1
+notify_chroot: 10.15.1
+auth_utimes: 10.15.1
+notify_utimes: 10.15.1
+auth_clone: 10.15.1
+notify_clone: 10.15.1
+notify_fcntl: 10.15.1
+auth_getextattr: 10.15.1
+notify_getextattr: 10.15.1
+auth_listextattr: 10.15.1
+notify_listextattr: 10.15.1
+auth_readdir: 10.15.1
+notify_readdir: 10.15.1
+auth_deleteextattr: 10.15.1
+notify_deleteextattr: 10.15.1
+auth_fsgetpath: 10.15.1
+notify_fsgetpath: 10.15.1
+notify_dup: 10.15.1
+auth_settime: 10.15.1
+notify_settime: 10.15.1
+notify_uipc_bind: 10.15.1
+auth_uipc_bind: 10.15.1
+notify_uipc_connect: 10.15.1
+auth_uipc_connect: 10.15.1
+auth_exchangedata: 10.15.1
+auth_setacl: 10.15.1
+notify_setacl: 10.15.1
+notify_pty_grant: 10.15.4
+notify_pty_close: 10.15.4
+auth_proc_check: 10.15.4
+notify_proc_check: 10.15.4
+auth_get_task: 10.15.4
+auth_searchfs: '11.0'
+notify_searchfs: '11.0'
+auth_fcntl: '11.0'
+auth_iokit_open: '11.0'
+auth_proc_suspend_resume: '11.0'
+notify_proc_suspend_resume: '11.0'
+notify_cs_invalidated: '11.0'
+notify_get_task_name: '11.0'
+notify_trace: '11.0'
+notify_remote_thread_create: '11.0'
+auth_remount: '11.0'
+notify_remount: '11.0'
+auth_get_task_read: '11.3'
+notify_get_task_read: '11.3'
+notify_get_task_inspect: '11.3'
+notify_setuid: '12.0'
+notify_setgid: '12.0'
+notify_seteuid: '12.0'
+notify_setegid: '12.0'
+notify_setreuid: '12.0'
+notify_setregid: '12.0'
+auth_copyfile: '12.0'
+notify_copyfile: '12.0'
+notify_authentication: '13.0'
+notify_xp_malware_detected: '13.0'
+notify_xp_malware_remediated: '13.0'
+notify_lw_session_login: '13.0'
+notify_lw_session_logout: '13.0'
+notify_lw_session_lock: '13.0'
+notify_lw_session_unlock: '13.0'
+notify_screensharing_attach: '13.0'
+notify_screensharing_detach: '13.0'
+notify_openssh_login: '13.0'
+notify_openssh_logout: '13.0'
+notify_login_login: '13.0'
+notify_login_logout: '13.0'
+notify_btm_launch_item_add: '13.0'
+notify_btm_launch_item_remove: '13.0'
+notify_profile_add: '14.0'
+notify_profile_remove: '14.0'
+notify_su: '14.0'
+notify_authorization_petition: '14.0'
+notify_authorization_judgement: '14.0'
+notify_sudo: '14.0'
+notify_od_group_add: '14.0'
+notify_od_group_remove: '14.0'
+notify_od_group_set: '14.0'
+notify_od_modify_password: '14.0'
+notify_od_disable_user: '14.0'
+notify_od_enable_user: '14.0'
+notify_od_attribute_value_add: '14.0'
+notify_od_attribute_value_remove: '14.0'
+notify_od_attribute_set: '14.0'
+notify_od_create_user: '14.0'
+notify_od_create_group: '14.0'
+notify_od_delete_user: '14.0'
+notify_od_delete_group: '14.0'
+notify_xpc_connect: '14.0'
+notify_gatekeeper_user_override: '15.0'
+notify_tcc_modify: '15.4'
+reserved_0: '26.3'
+reserved_1: '26.3'
+reserved_2: '26.3'
+reserved_3: 26.4.0
+reserved_4: 26.4.0
+reserved_5: 26.4.0
+reserved_6: 26.4.0
+reserved_7: '26.5'
+reserved_8: '26.5'

data/codegen/overlay/version_map.yml

@@ -0,0 +1,92 @@
+---
+es_process_t:
+  tty: 2
+  start_time: 3
+  responsible_audit_token: 4
+  parent_audit_token: 4
+  cs_validation_category: 10
+es_event_exec_t:
+  dyld_exec_path: 7
+  script: 2
+  cwd: 3
+  last_fd: 4
+  image_cputype: 6
+  image_cpusubtype: 6
+es_event_mount_t:
+  disposition: 8
+es_event_remount_t:
+  remount_flags: 8
+  disposition: 8
+es_event_signal_t:
+  instigator: 9
+es_event_close_t:
+  was_mapped_writable: 6
+es_event_create_t:
+  acl: 2
+es_event_iokit_open_t:
+  parent_registry_id: 10
+  parent_path: 10
+es_event_get_task_t:
+  type: 5
+es_event_get_task_read_t:
+  type: 5
+es_event_get_task_inspect_t:
+  type: 5
+es_event_get_task_name_t:
+  type: 5
+es_event_file_provider_materialize_t:
+  instigator_token: 8
+es_event_authentication_od_t:
+  instigator_token: 8
+es_event_authentication_touchid_t:
+  instigator_token: 8
+es_event_authentication_token_t:
+  instigator_token: 8
+es_event_xp_malware_detected_t:
+  detected_executable: 10
+es_event_btm_launch_item_add_t:
+  instigator_token: 8
+  app_token: 8
+es_event_btm_launch_item_remove_t:
+  instigator_token: 8
+  app_token: 8
+es_event_profile_add_t:
+  instigator_token: 8
+es_event_profile_remove_t:
+  instigator_token: 8
+es_event_authorization_petition_t:
+  instigator_token: 8
+  petitioner_token: 8
+es_event_authorization_judgement_t:
+  instigator_token: 8
+  petitioner_token: 8
+es_event_od_group_add_t:
+  instigator_token: 8
+es_event_od_group_remove_t:
+  instigator_token: 8
+es_event_od_group_set_t:
+  instigator_token: 8
+es_event_od_modify_password_t:
+  instigator_token: 8
+es_event_od_disable_user_t:
+  instigator_token: 8
+es_event_od_enable_user_t:
+  instigator_token: 8
+es_event_od_attribute_value_add_t:
+  instigator_token: 8
+es_event_od_attribute_value_remove_t:
+  instigator_token: 8
+es_event_od_attribute_set_t:
+  instigator_token: 8
+es_event_od_create_user_t:
+  instigator_token: 8
+es_event_od_create_group_t:
+  instigator_token: 8
+es_event_od_delete_user_t:
+  instigator_token: 8
+es_event_od_delete_group_t:
+  instigator_token: 8
+es_message_t:
+  seq_num: 2
+  thread: 4
+  global_seq_num: 4

data/codegen/run.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "open3"
+require "yaml"
+require_relative "../lib/endpoint_security/errors"
+require_relative "ast"
+require_relative "ir"
+require_relative "emit_ruby"
+require_relative "emit_c"
+
+module EndpointSecurity
+  module Codegen
+    module Run
+      module_function
+
+      def call
+        sdk = capture("xcrun", "--show-sdk-path")
+        version = capture("xcrun", "--show-sdk-version")
+        header = File.join(sdk, "usr/include/EndpointSecurity/ESTypes.h")
+        source = File.read(header)
+        ir = IR.event_types(ast: AST.load(header: header, sdk: sdk), source: source)
+        umbrella = File.join(sdk, "usr/include/EndpointSecurity/EndpointSecurity.h")
+        schema_ast = AST.load(header: umbrella, sdk: sdk)
+        message_sources = %w[ESMessage.h ESMessageCore.h].map do |name|
+          File.read(File.join(sdk, "usr/include/EndpointSecurity", name))
+        end
+        records = IR.records(ast: schema_ast, version_sources: message_sources)
+        enumerations = IR.enumerations(ast: schema_ast)
+        IR.validate_field_types!(records: records, enumerations: enumerations)
+        emitter = EmitRuby.new(
+          ir, cacheable: IR.cacheable_events(message_sources.first, ir), enumerations: enumerations
+        )
+
+        write("lib/endpoint_security/generated/event_types.rb", emitter.event_types)
+        write("lib/endpoint_security/generated/enums.rb", emitter.enums)
+        write("lib/endpoint_security/generated/availability.rb", emitter.availability)
+        write("ext/endpoint_security/generated/es_schema.c", EmitC.new(records, ir).schema)
+        availability = ir.events.to_h { |event| [event.symbol.to_s, event.minimum_os] }
+        write("codegen/overlay/availability.yml", YAML.dump(availability))
+        write("codegen/overlay/version_map.yml", YAML.dump(version_map(records)))
+        snapshot_json = JSON.pretty_generate(snapshot(version, ir, records, enumerations)) << "\n"
+        write("codegen/snapshots/#{version}.json", snapshot_json)
+      end
+
+      def capture(*command)
+        output, status = Open3.capture2(*command)
+        raise CodegenError, "#{command.join(" ")} failed" unless status.success?
+
+        output.strip
+      end
+
+      def write(path, content)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, content) unless File.exist?(path) && File.binread(path) == content
+      end
+
+      def version_map(records)
+        versions = records.to_h do |record|
+          fields = record.fields.select { |field| field.minimum_version > 1 }
+          [record.name, fields.to_h { |field| [field.name, field.minimum_version] }]
+        end
+        versions.reject { |_record, fields| fields.empty? }
+      end
+
+      def snapshot(version, event_types_ir, records, enumerations)
+        {
+          sdk_version: version,
+          last: event_types_ir.last,
+          events: event_types_ir.events.map(&:to_h),
+          records: records.to_h { |record| [record.name, record.fields.map(&:to_h)] },
+          enumerations: enumerations.to_h { |enumeration| [enumeration.name, enumeration.values.map(&:to_h)] }
+        }
+      end
+    end
+  end
+end
+
+EndpointSecurity::Codegen::Run.call if $PROGRAM_NAME == __FILE__