Skip to content

Commit f0e7396

Browse files
mlwmlw
committed
lint
1 parent 8d1978c commit f0e7396

4 files changed

Lines changed: 74 additions & 63 deletions

File tree

‎Source/common/MOLCodesignCheckerTest.mm‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -138,19 +138,24 @@ - (void)testInitWithFileDescriptor {
138138
// cdhash.
139139
- (void)testInitWithFileDescriptor_SurvivesAtomicRenameSwap {
140140
NSString* tmp = NSTemporaryDirectory();
141-
NSString* a = [tmp stringByAppendingPathComponent:[NSString
142-
stringWithFormat:@"mol_a_%d_%@", getpid(), [[NSUUID UUID] UUIDString]]];
143-
NSString* b = [tmp stringByAppendingPathComponent:[NSString
144-
stringWithFormat:@"mol_b_%d_%@", getpid(), [[NSUUID UUID] UUIDString]]];
141+
NSString* a =
142+
[tmp stringByAppendingPathComponent:[NSString stringWithFormat:@"mol_a_%d_%@", getpid(),
143+
[[NSUUID UUID] UUIDString]]];
144+
NSString* b =
145+
[tmp stringByAppendingPathComponent:[NSString stringWithFormat:@"mol_b_%d_%@", getpid(),
146+
[[NSUUID UUID] UUIDString]]];
145147
NSError* err;
146-
XCTAssertTrue([[NSFileManager defaultManager] copyItemAtPath:@"/usr/bin/yes" toPath:a error:&err]);
147-
XCTAssertTrue([[NSFileManager defaultManager] copyItemAtPath:@"/usr/bin/true" toPath:b error:&err]);
148+
XCTAssertTrue([[NSFileManager defaultManager] copyItemAtPath:@"/usr/bin/yes"
149+
toPath:a
150+
error:&err]);
151+
XCTAssertTrue([[NSFileManager defaultManager] copyItemAtPath:@"/usr/bin/true"
152+
toPath:b
153+
error:&err]);
148154

149155
int fd = open(a.UTF8String, O_RDONLY | O_CLOEXEC);
150156
XCTAssertGreaterThanOrEqual(fd, 0, "open: %s", strerror(errno));
151157

152-
MOLCodesignChecker* aRef =
153-
[[MOLCodesignChecker alloc] initWithBinaryPath:a fileDescriptor:fd];
158+
MOLCodesignChecker* aRef = [[MOLCodesignChecker alloc] initWithBinaryPath:a fileDescriptor:fd];
154159
MOLCodesignChecker* bRef = [[MOLCodesignChecker alloc] initWithBinaryPath:b];
155160
XCTAssertNotNil(aRef.cdhash);
156161
XCTAssertNotNil(bRef.cdhash);
@@ -163,8 +168,7 @@ - (void)testInitWithFileDescriptor_SurvivesAtomicRenameSwap {
163168
XCTAssertEqual(rename(b.UTF8String, a.UTF8String), 0, "rename: %s", strerror(errno));
164169

165170
// fd-based: must still see A's identity.
166-
MOLCodesignChecker* afterFD =
167-
[[MOLCodesignChecker alloc] initWithBinaryPath:a fileDescriptor:fd];
171+
MOLCodesignChecker* afterFD = [[MOLCodesignChecker alloc] initWithBinaryPath:a fileDescriptor:fd];
168172
XCTAssertEqualObjects(afterFD.cdhash, originalACdhash);
169173

170174
// Path-based control: now sees B's identity (proving the rename happened
@@ -180,8 +184,9 @@ - (void)testInitWithFileDescriptor_SurvivesAtomicRenameSwap {
180184
// after the caller's open(): the fd holds the vnode regardless.
181185
- (void)testInitWithFileDescriptor_SurvivesUnlink {
182186
NSString* tmp = NSTemporaryDirectory();
183-
NSString* path = [tmp stringByAppendingPathComponent:[NSString
184-
stringWithFormat:@"mol_unlink_%d_%@", getpid(), [[NSUUID UUID] UUIDString]]];
187+
NSString* path =
188+
[tmp stringByAppendingPathComponent:[NSString stringWithFormat:@"mol_unlink_%d_%@", getpid(),
189+
[[NSUUID UUID] UUIDString]]];
185190
NSError* err;
186191
XCTAssertTrue([[NSFileManager defaultManager] copyItemAtPath:@"/usr/bin/yes"
187192
toPath:path
@@ -192,15 +197,13 @@ - (void)testInitWithFileDescriptor_SurvivesUnlink {
192197

193198
XCTAssertEqual(unlink(path.UTF8String), 0);
194199

195-
MOLCodesignChecker* sut =
196-
[[MOLCodesignChecker alloc] initWithBinaryPath:path fileDescriptor:fd];
200+
MOLCodesignChecker* sut = [[MOLCodesignChecker alloc] initWithBinaryPath:path fileDescriptor:fd];
197201
XCTAssertNotNil(sut.cdhash);
198202

199203
// Path-based at the now-missing path must fail, confirming the fd was the
200204
// load-bearing source.
201205
NSError* pathErr;
202-
MOLCodesignChecker* viaPath = [[MOLCodesignChecker alloc] initWithBinaryPath:path
203-
error:&pathErr];
206+
MOLCodesignChecker* viaPath = [[MOLCodesignChecker alloc] initWithBinaryPath:path error:&pathErr];
204207
XCTAssertNil(viaPath);
205208
XCTAssertNotNil(pathErr);
206209

‎Source/santad/Logs/EndpointSecurity/Serializers/ProtobufTest.mm‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -548,7 +548,9 @@ - (void)testGetReasonEnum {
548548
case SNTEventStateUnknown: want = ::pbv1::Execution::REASON_UNKNOWN; break;
549549
case SNTEventStateBundleBinary: want = ::pbv1::Execution::REASON_UNKNOWN; break;
550550
case SNTEventStateBlockUnknown: want = ::pbv1::Execution::REASON_UNKNOWN; break;
551-
case SNTEventStateBlockBinaryMismatch: want = ::pbv1::Execution::REASON_BINARY_MISMATCH; break;
551+
case SNTEventStateBlockBinaryMismatch:
552+
want = ::pbv1::Execution::REASON_BINARY_MISMATCH;
553+
break;
552554
case SNTEventStateBlockBinary: want = ::pbv1::Execution::REASON_BINARY; break;
553555
case SNTEventStateBlockCertificate: want = ::pbv1::Execution::REASON_CERT; break;
554556
case SNTEventStateBlockScope: want = ::pbv1::Execution::REASON_SCOPE; break;

‎Source/santad/SNTPolicyProcessor.mm‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -626,8 +626,7 @@ + (IdentityVerifyResult)verifyIdentityForTargetProc:(const es_process_t*)targetP
626626
case IdentityVerifyResult::kDriftAllowed:
627627
cd.decisionExtra = @"CDHash drift allowed by matching TeamID/SigningID";
628628
break;
629-
case IdentityVerifyResult::kMatch:
630-
break;
629+
case IdentityVerifyResult::kMatch: break;
631630
}
632631
}
633632

‎Source/santad/SNTPolicyProcessorTest.mm‎

Lines changed: 51 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,8 @@ BOOL RuleIdentifiersAreEqual(struct RuleIdentifiers r1, struct RuleIdentifiers r
7777

7878
static NSString* HexOf(const uint8_t* b, size_t n) {
7979
NSMutableString* s = [NSMutableString stringWithCapacity:n * 2];
80-
for (size_t i = 0; i < n; i++) [s appendFormat:@"%02x", b[i]];
80+
for (size_t i = 0; i < n; i++)
81+
[s appendFormat:@"%02x", b[i]];
8182
return s;
8283
}
8384

@@ -1338,8 +1339,8 @@ - (void)testOuter_Unsigned_StatMismatch_ReturnsBlockBinaryMismatch {
13381339
/*filename_template=*/@"santa_test_XXXXXX", /*keep_path=*/true);
13391340
XCTAssertStatusOk(scopedFile);
13401341

1341-
NSError *err;
1342-
SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
1342+
NSError* err;
1343+
SNTFileInfo* fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
13431344
XCTAssertNotNil(fi);
13441345

13451346
struct stat fakeStat = MakeStat(/*offset=*/42); // differs from the real file's stat
@@ -1349,13 +1350,13 @@ - (void)testOuter_Unsigned_StatMismatch_ReturnsBlockBinaryMismatch {
13491350
esProc.team_id = MakeESStringToken("");
13501351
esProc.signing_id = MakeESStringToken("");
13511352

1352-
SNTConfigState *cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
1353+
SNTConfigState* cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
13531354

1354-
SNTCachedDecision *cd = [self.processor decisionForFileInfo:fi
1355-
targetProcess:&esProc
1356-
configState:cs
1357-
activationCallback:nil
1358-
cachedDecision:nil];
1355+
SNTCachedDecision* cd = [self.processor decisionForFileInfo:fi
1356+
targetProcess:&esProc
1357+
configState:cs
1358+
activationCallback:nil
1359+
cachedDecision:nil];
13591360

13601361
XCTAssertEqual(cd.decision, SNTEventStateBlockBinaryMismatch);
13611362
XCTAssertEqualObjects(cd.decisionExtra,
@@ -1372,8 +1373,8 @@ - (void)testOuter_ReEvalPath_VerificationSkipped {
13721373
/*keep_path=*/true);
13731374
XCTAssertStatusOk(scopedFile);
13741375

1375-
NSError *err;
1376-
SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
1376+
NSError* err;
1377+
SNTFileInfo* fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
13771378
XCTAssertNotNil(fi);
13781379

13791380
// Deliberate stat mismatch — if verifyIdentity ran, this would short-circuit to
@@ -1390,16 +1391,16 @@ - (void)testOuter_ReEvalPath_VerificationSkipped {
13901391
// if it were non-nil. The bypass invariant under test is that the outer method
13911392
// passes verifyIdentity:nil whenever existingDecision is non-nil (per spec §4),
13921393
// independent of the inner method's certSHA256-skip optimization.
1393-
SNTCachedDecision *existing = [[SNTCachedDecision alloc] init];
1394+
SNTCachedDecision* existing = [[SNTCachedDecision alloc] init];
13941395
// Do NOT set certSHA256.
13951396

1396-
SNTConfigState *cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
1397+
SNTConfigState* cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
13971398

1398-
SNTCachedDecision *cd = [self.processor decisionForFileInfo:fi
1399-
targetProcess:&esProc
1400-
configState:cs
1401-
activationCallback:nil
1402-
cachedDecision:existing];
1399+
SNTCachedDecision* cd = [self.processor decisionForFileInfo:fi
1400+
targetProcess:&esProc
1401+
configState:cs
1402+
activationCallback:nil
1403+
cachedDecision:existing];
14031404

14041405
XCTAssertNotEqual(cd.decision, SNTEventStateBlockBinaryMismatch,
14051406
@"re-eval path must never surface BinaryMismatch (outer method "
@@ -1413,8 +1414,8 @@ - (void)testOuter_Unsigned_StatMatches_NoMismatch {
14131414
/*keep_path=*/true);
14141415
XCTAssertStatusOk(scopedFile);
14151416

1416-
NSError *err;
1417-
SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
1417+
NSError* err;
1418+
SNTFileInfo* fi = [[SNTFileInfo alloc] initWithPath:scopedFile->Path() error:&err];
14181419
XCTAssertNotNil(fi);
14191420

14201421
struct stat realStat;
@@ -1426,13 +1427,13 @@ - (void)testOuter_Unsigned_StatMatches_NoMismatch {
14261427
esProc.team_id = MakeESStringToken("");
14271428
esProc.signing_id = MakeESStringToken("");
14281429

1429-
SNTConfigState *cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
1430+
SNTConfigState* cs = [[SNTConfigState alloc] initWithConfig:[SNTConfigurator configurator]];
14301431

1431-
SNTCachedDecision *cd = [self.processor decisionForFileInfo:fi
1432-
targetProcess:&esProc
1433-
configState:cs
1434-
activationCallback:nil
1435-
cachedDecision:nil];
1432+
SNTCachedDecision* cd = [self.processor decisionForFileInfo:fi
1433+
targetProcess:&esProc
1434+
configState:cs
1435+
activationCallback:nil
1436+
cachedDecision:nil];
14361437

14371438
XCTAssertNotEqual(cd.decision, SNTEventStateBlockBinaryMismatch);
14381439
}
@@ -1559,9 +1560,10 @@ - (void)testVerifyIdentity_Unsigned_StatMatches_ReturnsMatch {
15591560
es_file_t file;
15601561
es_process_t proc;
15611562
MakeTargetProc(&file, &proc, "/tmp/test", realStat, /*csFlags=*/0, "", "", kHashA);
1562-
XCTAssertEqual(
1563-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1564-
IdentityVerifyResult::kMatch);
1563+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1564+
fd:scopedFile->UnsafeFD()
1565+
csInfo:nil],
1566+
IdentityVerifyResult::kMatch);
15651567
}
15661568

15671569
// Case 5: both unsigned, st_dev differs -> Mismatch.
@@ -1574,9 +1576,10 @@ - (void)testVerifyIdentity_Unsigned_DevDiffers_ReturnsMismatch {
15741576
es_file_t file;
15751577
es_process_t proc;
15761578
MakeTargetProc(&file, &proc, "/tmp/test", realStat, 0, "", "", kHashA);
1577-
XCTAssertEqual(
1578-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1579-
IdentityVerifyResult::kMismatch);
1579+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1580+
fd:scopedFile->UnsafeFD()
1581+
csInfo:nil],
1582+
IdentityVerifyResult::kMismatch);
15801583
}
15811584

15821585
// Case 5: both unsigned, st_ino differs -> Mismatch.
@@ -1589,9 +1592,10 @@ - (void)testVerifyIdentity_Unsigned_InoDiffers_ReturnsMismatch {
15891592
es_file_t file;
15901593
es_process_t proc;
15911594
MakeTargetProc(&file, &proc, "/tmp/test", realStat, 0, "", "", kHashA);
1592-
XCTAssertEqual(
1593-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1594-
IdentityVerifyResult::kMismatch);
1595+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1596+
fd:scopedFile->UnsafeFD()
1597+
csInfo:nil],
1598+
IdentityVerifyResult::kMismatch);
15951599
}
15961600

15971601
// Case 5: both unsigned, st_size differs -> Mismatch.
@@ -1604,9 +1608,10 @@ - (void)testVerifyIdentity_Unsigned_SizeDiffers_ReturnsMismatch {
16041608
es_file_t file;
16051609
es_process_t proc;
16061610
MakeTargetProc(&file, &proc, "/tmp/test", realStat, 0, "", "", kHashA);
1607-
XCTAssertEqual(
1608-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1609-
IdentityVerifyResult::kMismatch);
1611+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1612+
fd:scopedFile->UnsafeFD()
1613+
csInfo:nil],
1614+
IdentityVerifyResult::kMismatch);
16101615
}
16111616

16121617
// Case 5: both unsigned, st_mtimespec.tv_sec differs -> Mismatch.
@@ -1619,9 +1624,10 @@ - (void)testVerifyIdentity_Unsigned_MtimeSecDiffers_ReturnsMismatch {
16191624
es_file_t file;
16201625
es_process_t proc;
16211626
MakeTargetProc(&file, &proc, "/tmp/test", realStat, 0, "", "", kHashA);
1622-
XCTAssertEqual(
1623-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1624-
IdentityVerifyResult::kMismatch);
1627+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1628+
fd:scopedFile->UnsafeFD()
1629+
csInfo:nil],
1630+
IdentityVerifyResult::kMismatch);
16251631
}
16261632

16271633
// Case 5: both unsigned, st_mtimespec.tv_nsec differs -> Mismatch.
@@ -1634,9 +1640,10 @@ - (void)testVerifyIdentity_Unsigned_MtimeNsecDiffers_ReturnsMismatch {
16341640
es_file_t file;
16351641
es_process_t proc;
16361642
MakeTargetProc(&file, &proc, "/tmp/test", realStat, 0, "", "", kHashA);
1637-
XCTAssertEqual(
1638-
[SNTPolicyProcessor verifyIdentityForTargetProc:&proc fd:scopedFile->UnsafeFD() csInfo:nil],
1639-
IdentityVerifyResult::kMismatch);
1643+
XCTAssertEqual([SNTPolicyProcessor verifyIdentityForTargetProc:&proc
1644+
fd:scopedFile->UnsafeFD()
1645+
csInfo:nil],
1646+
IdentityVerifyResult::kMismatch);
16401647
}
16411648

16421649
// Case 5: both unsigned, fstat fails (invalid fd) -> Mismatch (fail-closed).

0 commit comments

Comments
 (0)