Only eval TID and SID rules when the binary signature is valid (#1191)

* Only eval TID and SID rules when the binary signature is valid * Simplify setting sid on cached decision
google · Sep 28, 2023 · 5a383eb · 5a383eb
1 parent 913af69
commit 5a383eb
Show file tree

Hide file tree

Showing 8 changed files with 169 additions and 81 deletions.
diff --git a/Source/santad/BUILD b/Source/santad/BUILD
@@ -893,8 +893,10 @@ santa_unit_test(
         ":Metrics",
         ":MockEndpointSecurityAPI",
         ":SNTDatabaseController",
+        ":SNTDecisionCache",
         ":SNTEndpointSecurityAuthorizer",
         ":SantadDeps",
+        "//Source/common:SNTCachedDecision",
         "//Source/common:SNTConfigurator",
         "//Source/common:TestUtils",
         "@MOLCertificate",

diff --git a/Source/santad/SNTPolicyProcessor.m b/Source/santad/SNTPolicyProcessor.m
@@ -82,27 +82,24 @@ - (nonnull SNTCachedDecision *)decisionForFileInfo:(nonnull SNTFileInfo *)fileIn
       cd.teamID = teamID
                     ?: [csInfo.signingInformation
                          objectForKey:(__bridge NSString *)kSecCodeInfoTeamIdentifier];
-      teamID = cd.teamID;
 
       // Ensure that if no teamID exists that the signing info confirms it is a
       // platform binary. If not, remove the signingID.
-      if (!teamID && signingID) {
+      if (!cd.teamID && cd.signingID) {
         id platformID = [csInfo.signingInformation
           objectForKey:(__bridge NSString *)kSecCodeInfoPlatformIdentifier];
         if (![platformID isKindOfClass:[NSNumber class]] || [platformID intValue] == 0) {
-          signingID = nil;
+          cd.signingID = nil;
         }
       }
-
-      cd.signingID = signingID;
     }
   }
   cd.quarantineURL = fileInfo.quarantineDataURL;
 
   SNTRule *rule = [self.ruleTable ruleForBinarySHA256:cd.sha256
-                                            signingID:signingID
+                                            signingID:cd.signingID
                                     certificateSHA256:cd.certSHA256
-                                               teamID:teamID];
+                                               teamID:cd.teamID];
   if (rule) {
     switch (rule.type) {
       case SNTRuleTypeBinary:

diff --git a/Source/santad/SantadTest.mm b/Source/santad/SantadTest.mm
diff --git a/Source/santad/testdata/binaryrules/allowed_signingid b/Source/santad/testdata/binaryrules/allowed_signingid
diff --git a/Source/santad/testdata/binaryrules/allowed_teamid b/Source/santad/testdata/binaryrules/allowed_teamid
diff --git a/Source/santad/testdata/binaryrules/banned_signingid b/Source/santad/testdata/binaryrules/banned_signingid
diff --git a/Source/santad/testdata/binaryrules/binary_hash_allowed_signingid_blocked b/Source/santad/testdata/binaryrules/binary_hash_allowed_signingid_blocked
diff --git a/Source/santad/testdata/binaryrules/rules.db b/Source/santad/testdata/binaryrules/rules.db