From dd96f1edb2096042e3666db3ff1ffb07952f1d82 Mon Sep 17 00:00:00 2001
From: Objective-See <code@objective-see.com>
Date: Wed, 16 Dec 2020 12:04:47 -1000
Subject: [PATCH] Update signing.m

...now uses process auth token (instead of pid) for dynamic checks
---
 Library/Source/signing.m | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/Library/Source/signing.m b/Library/Source/signing.m
index c01bf55..d72c528 100644
--- a/Library/Source/signing.m
+++ b/Library/Source/signing.m
@@ -3,7 +3,7 @@
 //  Project: FileMonitor
 //
 //  Created by: Patrick Wardle
-//  Copyright:  2020 Objective-See
+//  Copyright:  2017 Objective-See
 //  License:    Creative Commons Attribution-NonCommercial 4.0 International License
 //
 
@@ -65,15 +65,6 @@ NSMutableDictionary* generateSigningInfo(Process* process, NSUInteger options, S
         goto bail;
     }
     
-    /*
-    //extract code signing flags
-    if(nil != [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoFlags])
-    {
-        //extract/save
-        signingInfo[KEY_SIGNATURE_FLAGS] = [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoFlags];
-    }
-    */
-    
     //extract code signing id
     if(nil != [(__bridge NSDictionary*)signingDetails objectForKey:(__bridge NSString*)kSecCodeInfoIdentifier])
     {
@@ -111,7 +102,7 @@ bail:
     return signingInfo;
 }
 
-//extract signing info/check via dynamic code ref (process pid)
+//extract signing info/check via dynamic code ref (process auth token)
 CFDictionaryRef dynamicCodeCheck(Process* process, SecCSFlags flags, NSMutableDictionary* signingInfo)
 {
     //status
@@ -123,18 +114,17 @@ CFDictionaryRef dynamicCodeCheck(Process* process, SecCSFlags flags, NSMutableDi
     //signing details
     CFDictionaryRef signingDetails = NULL;
     
-    //attempt to generate dynamic code ref via pid
-    // if this fails, perform static code checks via path
-    status = SecCodeCopyGuestWithAttributes(NULL, (__bridge CFDictionaryRef _Nullable)(@{(__bridge NSString *)kSecGuestAttributePid : [NSNumber numberWithInt:process.pid]}), kSecCSDefaultFlags, &dynamicCode);
+    //obtain dynamic code ref from (audit) token
+    status = SecCodeCopyGuestWithAttributes(NULL, (__bridge CFDictionaryRef _Nullable)(@{(__bridge NSString *)kSecGuestAttributeAudit:process.auditToken}), kSecCSDefaultFlags, &dynamicCode);
     if(errSecSuccess != status)
     {
         //set error
         signingInfo[KEY_SIGNATURE_STATUS] = [NSNumber numberWithInt:status];
-        
+    
         //bail
         goto bail;
     }
-
+    
     //validate code
     status = SecCodeCheckValidity(dynamicCode, flags, NULL);
     if(errSecSuccess != status)