objective-see/FileMonitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update signing.m

Browse Source 
...now uses process auth token (instead of pid) for dynamic checks
This commit is contained in:
Objective-See
2020-12-16 12:04:47 -10:00
parent 26ec32c816
commit dd96f1edb2
1 changed files with 6 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Library/Source/signing.m
+6 -16
View File
@@ -3,7 +3,7 @@
// Project: FileMonitor
//
// Created by: Patrick Wardle
// Copyright: 2020 Objective-See
// Copyright: 2017 Objective-See
// License: Creative Commons Attribution-NonCommercial 4.0 International License
//
@@ -65,15 +65,6 @@ NSMutableDictionary* generateSigningInfo(Process* process, NSUInteger options, S
goto bail;
}
/*
//extract code signing flags
if(nil != [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoFlags])
{
//extract/save
signingInfo[KEY_SIGNATURE_FLAGS] = [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoFlags];
}
*/
//extract code signing id
if(nil != [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoIdentifier])
{
@@ -111,7 +102,7 @@ bail:
return signingInfo;
}
//extract signing info/check via dynamic code ref (process pid)
//extract signing info/check via dynamic code ref (process auth token)
CFDictionaryRef dynamicCodeCheck(Process* process, SecCSFlags flags, NSMutableDictionary* signingInfo)
{
//status
@@ -123,18 +114,17 @@ CFDictionaryRef dynamicCodeCheck(Process* process, SecCSFlags flags, NSMutableDi
//signing details
CFDictionaryRef signingDetails = NULL;
//attempt to generate dynamic code ref via pid
// if this fails, perform static code checks via path
status = SecCodeCopyGuestWithAttributes(NULL, (__bridge CFDictionaryRef _Nullable)(@{(__bridge NSString *)kSecGuestAttributePid : [NSNumber numberWithInt:process.pid]}), kSecCSDefaultFlags, &dynamicCode);
//obtain dynamic code ref from (audit) token
status = SecCodeCopyGuestWithAttributes(NULL, (__bridge CFDictionaryRef _Nullable)(@{(__bridge NSString *)kSecGuestAttributeAudit:process.auditToken}), kSecCSDefaultFlags, &dynamicCode);
if(errSecSuccess != status)
{
//set error
signingInfo[KEY_SIGNATURE_STATUS] = [NSNumber numberWithInt:status];
//bail
goto bail;
}
//validate code
status = SecCodeCheckValidity(dynamicCode, flags, NULL);
if(errSecSuccess != status)