Feat/bundle id rules#964
Closed
yuvraj-garhwal wants to merge 3 commits into
Closed
Conversation
Introduces a new rule identifier type, SNTRuleTypeBundleID (5000), keyed on "<TEAMID>:<CFBundleIdentifier>" (or "platform:<CFBundleIdentifier>" for Apple platform binaries). CFBundleIdentifier alone is attacker-controlled, so the TeamID prefix is mandatory at insert time — bare bundle IDs are rejected. Lookup precedence is unchanged for the existing types and slots BundleID at the lowest priority (CDHash > Binary > SigningID > Certificate > TeamID > BundleID). Wired through SNTRule parsing/validation, SNTRuleIdentifiers, the SQLite executionRuleForIdentifiers UNION, the static-rules cache, the policy processor (populates the lookup key from SNTFileInfo.bundleIdentifier and cd.teamID/platformBinary), `santactl rule --bundle-id`, and all SNTEventState switches (log serializers, block message strings, event counters). Sync wire format is unchanged: SNTSyncEventUpload returns nullptr for BundleID decisions and Protobuf logging emits REASON_UNKNOWN, pending the follow-up change to northpolesec/protos to add BUNDLE_ID to the RuleType and Reason enums. Tests: SNTRuleTest covers validator accept/reject paths (incl. platform prefix); SNTRuleTableTest adds fetch, team-mismatch isolation, and Binary>BundleID precedence cases. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The default XPC code-signing requirement pins peers to TeamID ZMCG7MLDV9 (North Pole Security). Adhoc-signed builds have no team identifier, so every inter-Santa XPC connection (santactl → daemon, syncservice → daemon, bundleservice → daemon) was being rejected with errSecCSReqFailed and the daemon was unreachable. When SANTAADHOC is defined, CopyDefaultCodeSigningRequirement now returns nil so no requirement is set on the connection. This is only safe because adhoc builds are intended for SIP-disabled dev/test machines where the sysext is loaded via systemextensionsctl developer mode. Adds the SANTAADHOC define to the MOLXPCConnection target (previously it was only set on SNTXPCControlInterface). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
SNTCommandFileInfo was building its RuleIdentifiers without the new bundleID field, so 'santactl fileinfo' always reported 'Rule: None' for binaries matched only by a BundleID rule, even when the daemon would correctly block them at exec time. Adds a shared FormatBundleID helper in SigningIDHelpers (mirroring FormatSigningID) and uses it from both santactl fileinfo and the policy processor so the two paths can't drift again. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
comp/santad
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (26)
Disabled knowledge base sources:
📝 WalkthroughWalkthroughThis PR adds comprehensive bundle identifier rule support to Santa. Bundle ID rules permit whitelisting or blocking based on ChangesBundle ID Rule Type and Execution
Ad-hoc Build Signing Support
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.