endpoint_sec/
event.rs

1//! Definitions of Endpoint Security events.
2
3use endpoint_sec_sys::{es_event_type_t, es_events_t};
4
5/// Helper macro to define the whole Event enum at once, avoiding endless repetitions of the CFGs
6macro_rules! define_event_enum {
7    (
8        $(#[$enum_meta: meta])*
9        pub enum $enum_name: ident from ($raw_ev: ident, $version: ident) {
10            $(
11                $(#[$b_v_doc: meta])*
12                $b_v_const: ident => $b_v_name: ident($b_v_inner: ident [$b_v_var: pat => $b_v_expected_resp_type: expr] {
13                    $($b_v_new_name: ident $(: $b_v_new_expr: expr)?,)+
14                }),
15            )*
16            $(
17                == #[$v_cfg: meta]
18                $(
19                    $(#[$v_doc: meta])*
20                    $v_const: ident => $v_name: ident($v_inner: ident [$v_var: pat => $v_expected_resp_type: expr] {
21                        $($v_new_name: ident $(: $v_new_expr: expr)?,)+
22                    }),
23                )+
24            )*
25        }
26    ) => {
27        $(#[$enum_meta])*
28        pub enum $enum_name<'a> {
29            $( $(#[$b_v_doc])* $b_v_name($b_v_inner<'a>), )*
30            $( $( #[$v_cfg] $(#[$v_doc])* $v_name($v_inner<'a>), )* )*
31        }
32
33        ::static_assertions::assert_impl_all!(Event<'_>: Send);
34
35        impl<'a> $enum_name<'a> {
36            /// Create an instance from raw parts.
37            ///
38            /// # Safety
39            ///
40            /// `event_type`, `raw_event` and `version` must be coming from the same [`crate::message::Message`].
41            #[inline(always)]
42            pub(crate) unsafe fn from_raw_parts(
43                event_type: es_event_type_t,
44                $raw_ev: &'a es_events_t,
45                $version: u32,
46            ) -> Option<Self> {
47                // Safety: Safe as we select the union field corresponding to that type and the
48                // caller must have respected the calling condition.
49                let v = unsafe {
50                    match event_type {
51                        $( es_event_type_t::$b_v_const => Self::$b_v_name($b_v_inner { $( $b_v_new_name $(: $b_v_new_expr)? ),* }), )*
52                        $( $( #[$v_cfg] es_event_type_t::$v_const => Self::$v_name($v_inner { $( $v_new_name $(: $v_new_expr)? ),* }), )* )*
53                        _ => return None,
54                    }
55                };
56                Some(v)
57            }
58
59            /// For `Auth` events, returns the type of response to use when allowing or denying.
60            pub fn expected_response_type(&self) -> Option<ExpectedResponseType> {
61                match self {
62                    $( Self::$b_v_name($b_v_var) => $b_v_expected_resp_type, )*
63                    $( $( #[$v_cfg] Self::$v_name($v_var) => $v_expected_resp_type, )* )*
64                }
65            }
66        }
67    };
68}
69
70define_event_enum!(
71    /// Information related to an event.
72    #[derive(Debug, PartialEq, Eq, Hash)]
73    pub enum Event from (raw_event, version) {
74        /// Authorization request for a process execution.
75        ES_EVENT_TYPE_AUTH_EXEC => AuthExec(EventExec [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.exec, version, }),
76        /// Authorization request for a file system object being opened.
77        ES_EVENT_TYPE_AUTH_OPEN => AuthOpen(EventOpen [e => Some(ExpectedResponseType::Flags { flags: e.fflag() as u32, }) ] { raw: &raw_event.open, }),
78        /// Authorization request for a kernel extension being loaded.
79        ES_EVENT_TYPE_AUTH_KEXTLOAD => AuthKextLoad(EventKextLoad [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.kextload, }),
80        /// Authorization request for a memory map of a file.
81        ES_EVENT_TYPE_AUTH_MMAP => AuthMmap(EventMmap [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.mmap, }),
82        /// Authorization request for a change of protection for pages.
83        ES_EVENT_TYPE_AUTH_MPROTECT => AuthMprotect(EventMprotect [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.mprotect, }),
84        /// Authorization request for a file system being mounted.
85        ES_EVENT_TYPE_AUTH_MOUNT => AuthMount(EventMount [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.mount, }),
86        /// Authorization request for a file system object being renamed.
87        ES_EVENT_TYPE_AUTH_RENAME => AuthRename(EventRename [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.rename, }),
88        /// Authorization request for a signal being sent to a process.
89        ES_EVENT_TYPE_AUTH_SIGNAL => AuthSignal(EventSignal [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.signal, version, }),
90        /// Authorization request for a file system object being unlinked.
91        ES_EVENT_TYPE_AUTH_UNLINK => AuthUnlink(EventUnlink [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.unlink, }),
92        /// Notify a process execution.
93        ES_EVENT_TYPE_NOTIFY_EXEC => NotifyExec(EventExec [_ => None ] { raw: &raw_event.exec, version, }),
94        /// Notify a file system object being open.
95        ES_EVENT_TYPE_NOTIFY_OPEN => NotifyOpen(EventOpen [_ => None ] { raw: &raw_event.open, }),
96        /// Notify a new process being forked.
97        ES_EVENT_TYPE_NOTIFY_FORK => NotifyFork(EventFork [_ => None ] { raw: &raw_event.fork, version, }),
98        /// Notify a new file system object being closed.
99        ES_EVENT_TYPE_NOTIFY_CLOSE => NotifyClose(EventClose [_ => None ] { raw: &raw_event.close, version, }),
100        /// Notify a file system object being created.
101        ES_EVENT_TYPE_NOTIFY_CREATE => NotifyCreate(EventCreate [_ => None ] { raw: &raw_event.create, version, }),
102        /// Notify data being atomically exchanged between two files.
103        ES_EVENT_TYPE_NOTIFY_EXCHANGEDATA => NotifyExchangeData(EventExchangeData [_ => None ] { raw: &raw_event.exchangedata, }),
104        /// Notify a process termination.
105        ES_EVENT_TYPE_NOTIFY_EXIT => NotifyExit(EventExit [_ => None ] { raw: &raw_event.exit, }),
106        /// Notify a process's task control port event.
107        ES_EVENT_TYPE_NOTIFY_GET_TASK => NotifyGetTask(EventGetTask [_ => None ] { raw: &raw_event.get_task, version, }),
108        /// Notify a kernel extension being loaded.
109        ES_EVENT_TYPE_NOTIFY_KEXTLOAD => NotifyKextLoad(EventKextLoad [_ => None ] { raw: &raw_event.kextload, }),
110        /// Notify a kernel extension being unloaded.
111        ES_EVENT_TYPE_NOTIFY_KEXTUNLOAD => NotifyKextUnload(EventKextUnload[_ => None ]{ raw: &raw_event.kextunload, }),
112        /// Notify a file system object being linked.
113        ES_EVENT_TYPE_NOTIFY_LINK => NotifyLink(EventLink[_ => None ]{ raw: &raw_event.link, }),
114        /// Notify a memory map of a file.
115        ES_EVENT_TYPE_NOTIFY_MMAP => NotifyMmap(EventMmap [_ => None ] { raw: &raw_event.mmap, }),
116        /// Notify a change of protection for pages.
117        ES_EVENT_TYPE_NOTIFY_MPROTECT => NotifyMprotect(EventMprotect [_ => None ] { raw: &raw_event.mprotect, }),
118        /// Notify a file system being mounted.
119        ES_EVENT_TYPE_NOTIFY_MOUNT => NotifyMount(EventMount [_ => None ] { raw: &raw_event.mount, }),
120        /// Notify a file system being unmounted.
121        ES_EVENT_TYPE_NOTIFY_UNMOUNT => NotifyUnmount(EventUnmount [_ => None ] { raw: &raw_event.unmount, }),
122        /// Notify a connection being opened to an I/O Kit IOService.
123        ES_EVENT_TYPE_NOTIFY_IOKIT_OPEN => NotifyIoKitOpen(EventIoKitOpen [_ => None ] { raw: &raw_event.iokit_open, }),
124        /// Notify a file system object being renamed.
125        ES_EVENT_TYPE_NOTIFY_RENAME => NotifyRename(EventRename [_ => None ] { raw: &raw_event.rename, }),
126        /// Notify when file system attributes are being modified.
127        ES_EVENT_TYPE_NOTIFY_SETATTRLIST => NotifySetAttrlist(EventSetAttrlist [_ => None ] { raw: &raw_event.setattrlist, }),
128        /// Notify when extended attribute are being set.
129        ES_EVENT_TYPE_NOTIFY_SETEXTATTR => NotifySetExtAttr(EventSetExtAttr[_ => None ]{ raw: &raw_event.setextattr, }),
130        /// Notify when a file system object flags are being modified.
131        ES_EVENT_TYPE_NOTIFY_SETFLAGS => NotifySetFlags(EventSetFlags [_ => None ] { raw: &raw_event.setflags, }),
132        /// Notify when a file system object mode is being modified.
133        ES_EVENT_TYPE_NOTIFY_SETMODE => NotifySetMode(EventSetMode [_ => None ] { raw: &raw_event.setmode, }),
134        /// Notify when a file system object owner is being modified.
135        ES_EVENT_TYPE_NOTIFY_SETOWNER => NotifySetOwner(EventSetOwner [_ => None ] { raw: &raw_event.setowner, }),
136        /// Notify a signal being sent to a process.
137        ES_EVENT_TYPE_NOTIFY_SIGNAL => NotifySignal(EventSignal [_ => None ] { raw: &raw_event.signal, version, }),
138        /// Notify a file system object being unlinked.
139        ES_EVENT_TYPE_NOTIFY_UNLINK => NotifyUnlink(EventUnlink [_ => None ] { raw: &raw_event.unlink, }),
140        /// Notify a write to a file.
141        ES_EVENT_TYPE_NOTIFY_WRITE => NotifyWrite(EventWrite [_ => None ] { raw: &raw_event.write, }),
142        /// Authorization request for a file being materialize via the FileProvider framework.
143        ES_EVENT_TYPE_AUTH_FILE_PROVIDER_MATERIALIZE => AuthFileProviderMaterialize( EventFileProviderMaterialize [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.file_provider_materialize, version, } ),
144        /// Notify a file being materialize via the FileProvider framework.
145        ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_MATERIALIZE => NotifyFileProviderMaterialize(EventFileProviderMaterialize [_ => None ] { raw: &raw_event.file_provider_materialize, version, }),
146        /// Authorization request for file contents being updated via the FileProvider framework.
147        ES_EVENT_TYPE_AUTH_FILE_PROVIDER_UPDATE => AuthFileProviderUpdate( EventFileProviderUpdate [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.file_provider_update, } ),
148        /// Notify a file contents being updated via the FileProvider framework.
149        ES_EVENT_TYPE_NOTIFY_FILE_PROVIDER_UPDATE => NotifyFileProviderUpdate( EventFileProviderUpdate [_ => None ] { raw: &raw_event.file_provider_update, } ),
150        /// Authorization request for a symbolic link being resolved.
151        ES_EVENT_TYPE_AUTH_READLINK => AuthReadLink(EventReadLink [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.readlink, }),
152        /// Notify a symbolic link being resolved.
153        ES_EVENT_TYPE_NOTIFY_READLINK => NotifyReadLink(EventReadLink [_ => None ] { raw: &raw_event.readlink, }),
154        /// Authorization request for a file being truncated.
155        ES_EVENT_TYPE_AUTH_TRUNCATE => AuthTruncate(EventTruncate [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.truncate, }),
156        /// Notify a file being truncated.
157        ES_EVENT_TYPE_NOTIFY_TRUNCATE => NotifyTruncate(EventTruncate [_ => None ] { raw: &raw_event.truncate, }),
158        /// Authorization request for a file system object being linked.
159        ES_EVENT_TYPE_AUTH_LINK => AuthLink(EventLink[_ => Some(ExpectedResponseType::Auth) ]{ raw: &raw_event.link, }),
160        /// Notify a file system object being lookup.
161        ES_EVENT_TYPE_NOTIFY_LOOKUP => NotifyLookup(EventLookup [_ => None ] { raw: &raw_event.lookup, }),
162        /// Authorization request for a file system object being created.
163        ES_EVENT_TYPE_AUTH_CREATE => AuthCreate(EventCreate [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.create, version, }),
164        /// Authorization request for file system attributes being modified.
165        ES_EVENT_TYPE_AUTH_SETATTRLIST => AuthSetAttrlist(EventSetAttrlist [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setattrlist, }),
166        /// Authorization request for an extended attribute being set.
167        ES_EVENT_TYPE_AUTH_SETEXTATTR => AuthSetExtAttr(EventSetExtAttr [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setextattr, }),
168        /// Authorization request for a file system object flags being modified.
169        ES_EVENT_TYPE_AUTH_SETFLAGS => AuthSetFlags(EventSetFlags [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setflags, }),
170        /// Authorization request for a file system object mode being modified.
171        ES_EVENT_TYPE_AUTH_SETMODE => AuthSetMode(EventSetMode [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setmode, }),
172        /// Authorization request for a file system object owner being modified.
173        ES_EVENT_TYPE_AUTH_SETOWNER => AuthSetOwner(EventSetOwner [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setowner, }),
174
175        == #[cfg(feature = "macos_10_15_1")]
176        /// Authorization request for when the current working directory of a process is being changed.
177        ES_EVENT_TYPE_AUTH_CHDIR => AuthChdir(EventChdir [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.chdir, }),
178        /// Notify when the current working directory change for a process.
179        ES_EVENT_TYPE_NOTIFY_CHDIR => NotifyChdir(EventChdir [_ => None ] { raw: &raw_event.chdir, }),
180        /// Authorization request for file system attributes being retrieved.
181        ES_EVENT_TYPE_AUTH_GETATTRLIST => AuthGetAttrlist(EventGetAttrlist [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.getattrlist, }),
182        /// Notify when file system attributes are being retrieved.
183        ES_EVENT_TYPE_NOTIFY_GETATTRLIST => NotifyGetAttrlist(EventGetAttrlist [_ => None ] { raw: &raw_event.getattrlist, }),
184        /// Notify when a file is being stat.
185        ES_EVENT_TYPE_NOTIFY_STAT => NotifyStat(EventStat [_ => None ] { raw: &raw_event.stat, }),
186        /// Notify when a file access test is performed.
187        ES_EVENT_TYPE_NOTIFY_ACCESS => NotifyAccess(EventAccess [_ => None ] { raw: &raw_event.access, }),
188        /// Authorization request for a chroot.
189        ES_EVENT_TYPE_AUTH_CHROOT => AuthChroot(EventChroot [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.chroot, }),
190        /// Notify when a chroot is performed.
191        ES_EVENT_TYPE_NOTIFY_CHROOT => NotifyChroot(EventChroot [_ => None ] { raw: &raw_event.chroot, }),
192        /// Authorization request for a file access and modification times change.
193        ES_EVENT_TYPE_AUTH_UTIMES => AuthUTimes(EventUTimes [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.utimes, }),
194        /// Notify when a file access and modification times changed.
195        ES_EVENT_TYPE_NOTIFY_UTIMES => NotifyUTimes(EventUTimes [_ => None ] { raw: &raw_event.utimes, }),
196        /// Authorization request for a file being cloned.
197        ES_EVENT_TYPE_AUTH_CLONE => AuthClone(EventClone [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.clone, }),
198        /// Notify for a file being cloned.
199        ES_EVENT_TYPE_NOTIFY_CLONE => NotifyClone(EventClone [_ => None ] { raw: &raw_event.clone, }),
200        /// Notify for a file control event.
201        ES_EVENT_TYPE_NOTIFY_FCNTL => NotifyFcntl(EventFcntl [_ => None ] { raw: &raw_event.fcntl, }),
202        /// Authorization request for extended attribute being retrieved.
203        ES_EVENT_TYPE_AUTH_GETEXTATTR => AuthGetExtAttr(EventGetExtAttr [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.getextattr, }),
204        /// Notify when extended attribute are being retrieved.
205        ES_EVENT_TYPE_NOTIFY_GETEXTATTR => NotifyGetExtAttr(EventGetExtAttr[_ => None ]{ raw: &raw_event.getextattr, }),
206        /// Authorization request for extended attributes being listed.
207        ES_EVENT_TYPE_AUTH_LISTEXTATTR => AuthListExtAttr(EventListExtAttr [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.listextattr, }),
208        /// Notify when extended attributes are being listed.
209        ES_EVENT_TYPE_NOTIFY_LISTEXTATTR => NotifyListExtAttr(EventListExtAttr [_ => None ] { raw: &raw_event.listextattr , }),
210        /// Authorization request for directory entries being read.
211        ES_EVENT_TYPE_AUTH_READDIR => AuthReadDir(EventReadDir [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.readdir, }),
212        /// Notify when directory entries are being read.
213        ES_EVENT_TYPE_NOTIFY_READDIR => NotifyReadDir(EventReadDir [_ => None ] { raw: &raw_event.readdir, }),
214        /// Authorization request for an extended attribute being deleted.
215        ES_EVENT_TYPE_AUTH_DELETEEXTATTR => AuthDeleteExtAttr(EventDeleteExtAttr [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.deleteextattr , }),
216        /// Notify when an extended attribute are being deleted.
217        ES_EVENT_TYPE_NOTIFY_DELETEEXTATTR => NotifyDeleteExtAttr( EventDeleteExtAttr [_ => None ] { raw: &raw_event.deleteextattr, } ),
218        /// Authorization request for a file system path being retrieved based on FSID.
219        ES_EVENT_TYPE_AUTH_FSGETPATH => AuthFsGetPath(EventFsGetPath [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.fsgetpath, }),
220        /// Notify when a file system path is retrieved based on FSID.
221        ES_EVENT_TYPE_NOTIFY_FSGETPATH => NotifyFsGetPath(EventFsGetPath [_ => None ] { raw: &raw_event.fsgetpath, }),
222        /// Notify when a file descriptor is being duplicated.
223        ES_EVENT_TYPE_NOTIFY_DUP => NotifyDup(EventDup [_ => None ] { raw: &raw_event.dup, }),
224        /// Authorization request for the system time being modified.
225        ES_EVENT_TYPE_AUTH_SETTIME => AuthSetTime(EventSetTime [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.settime, }),
226        /// Notify the system time being modified.
227        ES_EVENT_TYPE_NOTIFY_SETTIME => NotifySetTime(EventSetTime [_ => None ] { raw: &raw_event.settime, }),
228        /// Notify a UNIX-domain socket is about to be bound to a path.
229        ES_EVENT_TYPE_NOTIFY_UIPC_BIND => NotifyUipcBind(EventUipcBind [_ => None ] { raw: &raw_event.uipc_bind, }),
230        /// Authorization request to bind a UNIX-domain socket to a path.
231        ES_EVENT_TYPE_AUTH_UIPC_BIND => AuthUipcBind(EventUipcBind [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.uipc_bind, }),
232        /// Notify a UNIX-domain socket is about to be connected.
233        ES_EVENT_TYPE_NOTIFY_UIPC_CONNECT => NotifyUipcConnect(EventUipcConnect [_ => None ] { raw: &raw_event.uipc_connect , }),
234        /// Authorization request to connect a UNIX-domain socket.
235        ES_EVENT_TYPE_AUTH_UIPC_CONNECT => AuthUipcConnect(EventUipcConnect[_ => Some(ExpectedResponseType::Auth) ]{ raw: &raw_event.uipc_connect, }),
236        /// Authorization request for data being atomically exchanged between two files.
237        ES_EVENT_TYPE_AUTH_EXCHANGEDATA => AuthExchangeData(EventExchangeData [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.exchangedata , }),
238        /// Authorization request to set a file's ACL.
239        ES_EVENT_TYPE_AUTH_SETACL => AuthSetAcl(EventSetAcl [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.setacl, }),
240        /// Notify a file's ACL was set.
241        ES_EVENT_TYPE_NOTIFY_SETACL => NotifySetAcl(EventSetAcl [_ => None ] { raw: &raw_event.setacl, }),
242
243        == #[cfg(feature = "macos_10_15_4")]
244        /// Notify a pseudoterminal control device was granted.
245        ES_EVENT_TYPE_NOTIFY_PTY_GRANT => NotifyPtyGrant(EventPtyGrant [_ => None ] { raw: &raw_event.pty_grant, }),
246        /// Notify a pseudoterminal control device was closed.
247        ES_EVENT_TYPE_NOTIFY_PTY_CLOSE => NotifyPtyClose(EventPtyClose [_ => None ] { raw: &raw_event.pty_close, }),
248        /// Authorization request for retrieving process information.
249        ES_EVENT_TYPE_AUTH_PROC_CHECK => AuthProcCheck(EventProcCheck [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.proc_check, version, }),
250        /// Notify about retrieval of process information.
251        ES_EVENT_TYPE_NOTIFY_PROC_CHECK => NotifyProcCheck(EventProcCheck [_ => None ] { raw: &raw_event.proc_check, version, }),
252        /// Authorization request for a process's task control port event.
253        ES_EVENT_TYPE_AUTH_GET_TASK => AuthGetTask(EventGetTask [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.get_task, version, }),
254
255        == #[cfg(feature = "macos_11_0_0")]
256        /// Authorization request for an access control check being performed when searching a volume or mounted filesystem.
257        ES_EVENT_TYPE_AUTH_SEARCHFS => AuthSearchFs(EventSearchFs [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.searchfs, }),
258        /// Notify for an access control check performed when searching a volume or mounted filesystem.
259        ES_EVENT_TYPE_NOTIFY_SEARCHFS => NotifySearchFs(EventSearchFs [_ => None ] { raw: &raw_event.searchfs, }),
260        /// Authorization request for a file control.
261        ES_EVENT_TYPE_AUTH_FCNTL => AuthFcntl(EventFcntl [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.fcntl, }),
262        /// Authorization request for a connection being opened to an I/O Kit IOService.
263        ES_EVENT_TYPE_AUTH_IOKIT_OPEN => AuthIoKitOpen(EventIoKitOpen [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.iokit_open, }),
264        /// Authorization request for one of `pid_suspend()`, `pid_resume()` or `pid_shutdown_sockets()` to be called
265        ES_EVENT_TYPE_AUTH_PROC_SUSPEND_RESUME => AuthProcSuspendResume( EventProcSuspendResume [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.proc_suspend_resume, version, } ),
266        /// called on a process.
267        ES_EVENT_TYPE_NOTIFY_PROC_SUSPEND_RESUME => NotifyProcSuspendResume( EventProcSuspendResume [_ => None ] { raw: &raw_event.proc_suspend_resume, version, } ),
268        /// Notify for one of `pid_suspend()`, `pid_resume()` or `pid_shutdown_sockets()` is being
269        ES_EVENT_TYPE_NOTIFY_CS_INVALIDATED => NotifyCSInvalidated( EventCSInvalidated [_ => None ] { raw: &raw_event.cs_invalidated, } ),
270        /// called on a process.
271        ES_EVENT_TYPE_NOTIFY_GET_TASK_NAME => NotifyGetTaskName(EventGetTaskName [_ => None ] { raw: &raw_event.get_task_name, version, }),
272        /// Notify for a code signing status for a process being invalidated.
273        ES_EVENT_TYPE_NOTIFY_TRACE => NotifyTrace(EventTrace [_ => None ] { raw: &raw_event.trace, version, }),
274        /// Notify for the recuperation of a process's task name port.
275        ES_EVENT_TYPE_NOTIFY_REMOTE_THREAD_CREATE => NotifyRemoteThreadCreate( EventRemoteThreadCreate [_ => None ] { raw: &raw_event.remote_thread_create, version, } ),
276        /// Notify for an attempt to attach another process.
277        ES_EVENT_TYPE_AUTH_REMOUNT => AuthRemount(EventRemount [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.remount, }),
278        /// Notify a process has attempted to create a thread in another process.
279        ES_EVENT_TYPE_NOTIFY_REMOUNT => NotifyRemount(EventRemount [_ => None ] { raw: &raw_event.remount, }),
280
281        == #[cfg(feature = "macos_11_3_0")]
282        /// Authorization request for a file system being remounted.
283        ES_EVENT_TYPE_AUTH_GET_TASK_READ => AuthGetTaskRead(EventGetTaskRead [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.get_task_read, version, }),
284        /// Notify a file system being remounted.
285        ES_EVENT_TYPE_NOTIFY_GET_TASK_READ => NotifyGetTaskRead(EventGetTaskRead [_ => None ] { raw: &raw_event.get_task_read, version, }),
286        /// Authorization request for the recuperation of a process's task read port.
287        ES_EVENT_TYPE_NOTIFY_GET_TASK_INSPECT => NotifyGetTaskInspect(EventGetTaskInspect [_ => None ]{ raw: &raw_event.get_task_inspect, version, }),
288
289        == #[cfg(feature = "macos_12_0_0")]
290        /// Notify for the recuperation of a process's task read port.
291        ES_EVENT_TYPE_NOTIFY_SETUID => NotifySetuid(EventSetuid [_ => None ] { raw: &raw_event.setuid, }),
292        /// Notify for the recuperation of a process's task inspect port.
293        ES_EVENT_TYPE_NOTIFY_SETGID => NotifySetgid(EventSetgid [_ => None ] { raw: &raw_event.setgid, }),
294        /// Notify a process has called `setuid()`.
295        ES_EVENT_TYPE_NOTIFY_SETEUID => NotifySeteuid(EventSeteuid [_ => None ] { raw: &raw_event.seteuid, }),
296        /// Notify a process has called `setgid()`.
297        ES_EVENT_TYPE_NOTIFY_SETEGID => NotifySetegid(EventSetegid [_ => None ] { raw: &raw_event.setegid, }),
298        /// Notify a process has called `seteuid()`.
299        ES_EVENT_TYPE_NOTIFY_SETREUID => NotifySetreuid(EventSetreuid [_ => None ] { raw: &raw_event.setreuid, }),
300        /// Notify a process has called `setegid()`.
301        ES_EVENT_TYPE_NOTIFY_SETREGID => NotifySetregid(EventSetregid [_ => None ] { raw: &raw_event.setregid, }),
302        /// Notify a process has called `setreuid()`.
303        ES_EVENT_TYPE_AUTH_COPYFILE => AuthCopyFile(EventCopyFile [_ => Some(ExpectedResponseType::Auth) ] { raw: &raw_event.copyfile, }),
304        /// Notify a process has called `setregid()`.
305        ES_EVENT_TYPE_NOTIFY_COPYFILE => NotifyCopyFile(EventCopyFile [_ => None ] { raw: &raw_event.copyfile, }),
306
307        == #[cfg(feature = "macos_13_0_0")]
308        /// Notify an authentication was performed.
309        ES_EVENT_TYPE_NOTIFY_AUTHENTICATION => NotifyAuthentication(EventAuthentication [_ => None] { raw: raw_event.authentication.as_opt()?, version, }),
310        /// Notify that XProtect detected malware.
311        ES_EVENT_TYPE_NOTIFY_XP_MALWARE_DETECTED => NotifyXpMalwareDetected(EventXpMalwareDetected [_ => None] { raw: raw_event.xp_malware_detected.as_opt()?, }),
312        /// Notify that XProtect remediated malware.
313        ES_EVENT_TYPE_NOTIFY_XP_MALWARE_REMEDIATED => NotifyXpMalwareRemediated(EventXpMalwareRemediated [_ => None] { raw: raw_event.xp_malware_remediated.as_opt()?, }),
314        /// Notify that LoginWindow has logged in a user.
315        ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN => NotifyLwSessionLogin(EventLwSessionLogin [_ => None] { raw: raw_event.lw_session_login.as_opt()?, }),
316        /// Notify that LoginWindow has logged out a user.
317        ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT => NotifyLwSessionLogout(EventLwSessionLogout [_ => None] { raw: raw_event.lw_session_logout.as_opt()?, }),
318        /// Notify that LoginWindow locked the screen of a session.
319        ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK => NotifyLwSessionLock(EventLwSessionLock [_ => None] { raw: raw_event.lw_session_lock.as_opt()?, }),
320        /// Notify that LoginWindow unlocked the screen of a session.
321        ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK => NotifyLwSessionUnlock(EventLwSessionUnlock [_ => None] { raw: raw_event.lw_session_unlock.as_opt()?, }),
322        /// that Screen Sharing has attached to a graphical session.
323        ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH => NotifyScreensharingAttach(EventScreensharingAttach [_ => None] { raw: raw_event.screensharing_attach.as_opt()?, }),
324        /// Notify that Screen Sharing has detached from a graphical session.
325        ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH => NotifyScreensharingDetach(EventScreensharingDetach [_ => None] { raw: raw_event.screensharing_detach.as_opt()?, }),
326        /// Notify about an OpenSSH login event.
327        ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN => NotifyOpensshLogin(EventOpensshLogin [_ => None] { raw: raw_event.openssh_login.as_opt()?, }),
328        /// Notify about an OpenSSH logout event.
329        ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT => NotifyOpensshLogout(EventOpensshLogout [_ => None] { raw: raw_event.openssh_logout.as_opt()?, }),
330        /// Notify about an authenticated login event from `/usr/bin/login`.
331        ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN => NotifyLoginLogin(EventLoginLogin [_ => None] { raw: raw_event.login_login.as_opt()?, }),
332        /// Notify about an authenticated logout event from `/usr/bin/login`.
333        ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT => NotifyLoginLogout(EventLoginLogout [_ => None] { raw: raw_event.login_logout.as_opt()?, }),
334        /// Notify for a launch item being made known to background task management.
335        ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_ADD => NotifyBtmLaunchItemAdd(EventBtmLaunchItemAdd [_ => None] { raw: raw_event.btm_launch_item_add.as_opt()?, version, }),
336        /// Notify for a launch item being removed from background task management.
337        ES_EVENT_TYPE_NOTIFY_BTM_LAUNCH_ITEM_REMOVE => NotifyBtmLaunchItemRemove(EventBtmLaunchItemRemove [_ => None] { raw: raw_event.btm_launch_item_remove.as_opt()?, version, }),
338
339        == #[cfg(feature = "macos_14_0_0")]
340        /// Notify about Profiles installed on the system.
341        ES_EVENT_TYPE_NOTIFY_PROFILE_ADD => NotifyProfileAdd (EventProfileAdd [_ => None] { raw: raw_event.profile_add.as_opt()?, version, }),
342        /// Notify about Profiles removed on the system.
343        ES_EVENT_TYPE_NOTIFY_PROFILE_REMOVE => NotifyProfileRemove (EventProfileRemove [_ => None] { raw: raw_event.profile_remove.as_opt()?, version, }),
344        /// Notify about a su policy decisions event.
345        ES_EVENT_TYPE_NOTIFY_SU => NotifySu(EventSu [_ => None] { raw: raw_event.su.as_opt()?, }),
346        /// Notify about a process petitioned for certain authorization rights.
347        ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_PETITION => NotifyAuthorizationPetition (EventAuthorizationPetition [_ => None] { raw: raw_event.authorization_petition.as_opt()?, version, }),
348        /// Notification that a process had it's right petition judged
349        ES_EVENT_TYPE_NOTIFY_AUTHORIZATION_JUDGEMENT => NotifyAuthorizationJudgement (EventAuthorizationJudgement [_ => None] { raw: raw_event.authorization_judgement.as_opt()?, version, }),
350        /// Notification about a sudo event.
351        ES_EVENT_TYPE_NOTIFY_SUDO => NotifySudo (EventSudo [_ => None] { raw: raw_event.sudo.as_opt()?, }),
352        /// Notification about an OD group add event.
353        ES_EVENT_TYPE_NOTIFY_OD_GROUP_ADD => NotifyOdGroupAdd (EventOdGroupAdd [_ => None] { raw: raw_event.od_group_add.as_opt()?, version, }),
354        /// Notification about an OD group remove event.
355        ES_EVENT_TYPE_NOTIFY_OD_GROUP_REMOVE => NotifyOdGroupRemove (EventOdGroupRemove [_ => None] { raw: raw_event.od_group_remove.as_opt()?, version, }),
356        /// Notification about a group that had its members initialised or replaced.
357        ES_EVENT_TYPE_NOTIFY_OD_GROUP_SET => NotifyOdGroupSet (EventOdGroupSet [_ => None] { raw: raw_event.od_group_set.as_opt()?, version, }),
358        /// Notification about a account that had its password modified.
359        ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD => NotifyOdModifyPassword (EventOdModifyPassword [_ => None] { raw: raw_event.od_modify_password.as_opt()?, version, }),
360        /// Notification about a user account that was disabled.
361        ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER => NotifyOdDisableUser (EventOdDisableUser [_ => None] { raw: raw_event.od_disable_user.as_opt()?, version, }),
362        /// Notification about a user account that was enabled.
363        ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER => NotifyOdEnableUser (EventOdEnableUser [_ => None] { raw: raw_event.od_enable_user.as_opt()?, version, }),
364        /// Notification about an attribute value that was added to a record.
365        ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_ADD => NotifyOdAttributeValueAdd (EventOdAttributeValueAdd [_ => None] { raw: raw_event.od_attribute_value_add.as_opt()?, version, }),
366        /// Notification about an attribute value that was removed from a record.
367        ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_VALUE_REMOVE => NotifyOdAttributeValueRemove (EventOdAttributeValueRemove [_ => None] { raw: raw_event.od_attribute_value_remove.as_opt()?, version, }),
368        /// Notification about an attribute that was set.
369        ES_EVENT_TYPE_NOTIFY_OD_ATTRIBUTE_SET => NotifyOdAttributeSet (EventOdAttributeSet [_ => None] { raw: raw_event.od_attribute_set.as_opt()?, version, }),
370        /// Notification about an account that was created.
371        ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER => NotifyOdCreateUser (EventOdCreateUser [_ => None] { raw: raw_event.od_create_user.as_opt()?, version, }),
372        /// Notification about a group that was created.
373        ES_EVENT_TYPE_NOTIFY_OD_CREATE_GROUP => NotifyOdCreateGroup (EventOdCreateGroup [_ => None] { raw: raw_event.od_create_group.as_opt()?, version, }),
374        /// Notification about an account that was deleted.
375        ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER => NotifyOdDeleteUser (EventOdDeleteUser [_ => None] { raw: raw_event.od_delete_user.as_opt()?, version, }),
376        /// Notification about a group that was deleted.
377        ES_EVENT_TYPE_NOTIFY_OD_DELETE_GROUP => NotifyOdDeleteGroup (EventOdDeleteGroup [_ => None] { raw: raw_event.od_delete_group.as_opt()?, version, }),
378        /// Notification for an XPC connection being established to a named service.
379        ES_EVENT_TYPE_NOTIFY_XPC_CONNECT => NotifyXpcConnect (EventXpcConnect [_ => None] { raw: raw_event.xpc_connect.as_opt()?, }),
380    }
381);
382
383/// Type of response function to use for this event.
384///
385/// - [`Client::respond_auth_result()`][crate::Client::respond_auth_result]
386/// - [`Client::respond_flags_result()`][crate::Client::respond_flags_result]
387#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash)]
388pub enum ExpectedResponseType {
389    /// Respond with [`Client::respond_auth_result()`][crate::Client::respond_auth_result]
390    Auth,
391    /// Respond with [`Client::respond_flags_result()`][crate::Client::respond_flags_result]
392    Flags {
393        /// Flags used by the original event
394        flags: u32,
395    },
396}
397
398/// Generate an iterator implementation for an array component of an event.
399///
400/// Safety:
401///
402/// - `raw_element_func` will be called like this: `raw_element_func(&raw_es_event, valid index)`,
403///   it must be safe to call under these conditions.
404/// - `raw_to_wrapped` will be called with the result of the preceding operation like this:
405///   `raw_to_wrapped(raw_token)`. This token COULD be null if `raw_element_func` can return `null`
406///   when called in the conditions described above. Usually Apple documents that if the event is
407///   a valid pointer and the index is correct, the function cannot return `null` and that calling
408///   outside the bounds is undefined behaviour.
409macro_rules! make_event_data_iterator {
410    ($wrapped_event: ident; $(#[$enum_doc:meta])+ $name:ident with $element_count: ident ($count_ty: ty); $item: ty; $raw_element_func: ident, $raw_to_wrapped: path$(,)?) => {
411        $(#[$enum_doc])*
412        pub struct $name<'event, 'raw> {
413            /// Wrapped event
414            ev: &'event $wrapped_event<'raw>,
415            /// Element count. When `current >= count`, the iterator is done and will only return
416            /// `None` for all subsequent calls to `next`.
417            count: $count_ty,
418            /// A call to `next` will yield element `current`
419            current: $count_ty,
420        }
421
422        impl $name<'_, '_> {
423            /// New iterator from event
424            fn new<'ev, 'raw>(ev: &'ev $wrapped_event<'raw>) -> $name<'ev, 'raw> {
425                $name {
426                    ev,
427                    count: ev.$element_count(),
428                    current: 0,
429                }
430            }
431        }
432
433        impl<'raw> std::iter::Iterator for $name<'_, 'raw> {
434            type Item = $item;
435
436            #[allow(unused_unsafe)]
437            fn next(&mut self) -> Option<Self::Item> {
438                if self.current < self.count {
439                    // Safety: Safe as raw is a reference and therefore cannot be null
440                    let raw_token = unsafe { $raw_element_func(self.ev.raw, self.current) };
441
442                    self.current = self.current.saturating_add(1);
443                    // Safety: Safe as we ensure the lifetime is rebound correctly in our wrappers
444                    Some(unsafe { $raw_to_wrapped(raw_token) })
445                } else {
446                    None
447                }
448            }
449
450            #[inline(always)]
451            fn nth(&mut self, n: usize) -> Option<Self::Item> {
452                // Overflow: the only `count_ty` used are u32 and usize. Since Apple machines are
453                // always 64-bits now (or more in the future, but that's still not a problem) it
454                // works out okay:
455                //
456                // - usize: the line does not change anything: `self.current = n`
457                // - u32: if `n > u32::MAX` is true, we clamp to `u32::MAX` to avoid something like
458                //   `.nth((u32::MAX + 1) as usize)` yielding `0` because of the truncation of
459                //   `as $count_ty`. Since the check in `.next()` is `<`, not `<=`, this will always
460                //   return `None` in that case and work correctly for valid `n`s.
461                self.current = n.min(<$count_ty>::MAX as usize) as $count_ty;
462                self.next()
463            }
464
465            #[inline(always)]
466            fn last(mut self) -> Option<Self::Item>
467            where
468                Self: Sized,
469            {
470                self.current = self.count.saturating_sub(1);
471                self.next()
472            }
473
474            #[inline(always)]
475            fn size_hint(&self) -> (usize, Option<usize>) {
476                let len = self.len();
477                (len, Some(len))
478            }
479
480            #[inline(always)]
481            fn count(mut self) -> usize {
482                let len = self.len();
483                self.current = self.count;
484                len
485            }
486        }
487
488        impl std::iter::ExactSizeIterator for $name<'_, '_> {
489            #[inline(always)]
490            fn len(&self) -> usize {
491                // Casting to usize if ok: all macOS machines are 64 bits now so a u32 will always
492                // fit into a usize
493                self.count.saturating_sub(self.current) as usize
494            }
495        }
496
497        impl std::iter::FusedIterator for $name<'_, '_> {}
498    };
499}
500
501/// Wrapper for the `.as_ref()` call on `es_string_token_t` with lifetime extension.
502///
503/// This is **only** intended for `make_event_data_iterator!`, which ensures lifetimes are correctly
504/// bound to avoid use-after-free shenanigans.
505///
506/// # Safety
507///
508/// This is a horrible horrible hack. Apple documents that the `es_string_token_t` returned by
509/// both [`es_exec_env`] and [`es_exec_arg`] are zero-allocation when in bounds and that the
510/// returned string token must not outlive the original event, which it cannot do in our
511/// iterator so it's safe. Thanks Rust for references and the borrow checker.
512unsafe fn as_os_str<'a>(x: endpoint_sec_sys::es_string_token_t) -> &'a std::ffi::OsStr {
513    // Safety: this is only called inside the iterator where `'a` will be the lifetime of `&mut self`
514    unsafe { &*(x.as_os_str() as *const _) }
515}
516
517/// Helper macro to define the event modules without copying the cfgs dozens of times.
518macro_rules! cfg_mod {
519    (
520        $( mod $b_name: ident; )*
521        $(
522            == #[$cfg: meta];
523            $( mod $name: ident; )+
524        )*
525    ) => {
526        $( mod $b_name; pub use $b_name::*; )*
527        $( $( #[$cfg] mod $name; #[$cfg] pub use $name::*; )+ )*
528    };
529}
530
531cfg_mod! {
532    mod event_close;
533    mod event_create;
534    mod event_exchangedata;
535    mod event_exec;
536    mod event_exit;
537    mod event_file_provider_materialize;
538    mod event_file_provider_update;
539    mod event_fork;
540    mod event_get_task;
541    mod event_iokit_open;
542    mod event_kextload;
543    mod event_kextunload;
544    mod event_link;
545    mod event_lookup;
546    mod event_mmap;
547    mod event_mount;
548    mod event_mprotect;
549    mod event_open;
550    mod event_read_link;
551    mod event_rename;
552    mod event_setattrlist;
553    mod event_setextattr;
554    mod event_setflags;
555    mod event_setmode;
556    mod event_setowner;
557    mod event_signal;
558    mod event_truncate;
559    mod event_unlink;
560    mod event_unmount;
561    mod event_write;
562
563    == #[cfg(feature = "macos_10_15_1")];
564    mod event_access;
565    mod event_chdir;
566    mod event_chroot;
567    mod event_clone;
568    mod event_deleteextattr;
569    mod event_dup;
570    mod event_fcntl;
571    mod event_fsgetpath;
572    mod event_getattrlist;
573    mod event_getextattr;
574    mod event_listextattr;
575    mod event_readdir;
576    mod event_setacl;
577    mod event_settime;
578    mod event_stat;
579    mod event_uipc_bind;
580    mod event_uipc_connect;
581    mod event_utimes;
582
583    == #[cfg(feature = "macos_10_15_4")];
584    mod event_pty_grant;
585    mod event_proc_check;
586    mod event_pty_close;
587
588    == #[cfg(feature = "macos_11_0_0")];
589    mod event_cs_invalidated;
590    mod event_get_task_name;
591    mod event_proc_suspend_resume;
592    mod event_remote_thread_create;
593    mod event_remount;
594    mod event_searchfs;
595    mod event_trace;
596
597    == #[cfg(feature = "macos_11_3_0")];
598    mod event_get_task_inspect;
599    mod event_get_task_read;
600
601    == #[cfg(feature = "macos_12_0_0")];
602    mod event_copyfile;
603    mod event_setegid;
604    mod event_seteuid;
605    mod event_setgid;
606    mod event_setregid;
607    mod event_setreuid;
608    mod event_setuid;
609
610    == #[cfg(feature = "macos_13_0_0")];
611    mod event_authentication;
612    mod event_xp_malware_detected;
613    mod event_xp_malware_remediated;
614    mod event_lw_session_login;
615    mod event_lw_session_logout;
616    mod event_lw_session_lock;
617    mod event_lw_session_unlock;
618    mod event_screesharing_attach;
619    mod event_screesharing_detach;
620    mod event_openssh_login;
621    mod event_openssh_logout;
622    mod event_login_login;
623    mod event_login_logout;
624    mod event_btm_launch_item_add;
625    mod event_btm_launch_item_remove;
626
627    == #[cfg(feature = "macos_14_0_0")];
628    mod event_profile_add;
629    mod event_profile_remove;
630    mod event_su;
631    mod event_authorization_petition;
632    mod event_authorization_judgement;
633    mod event_sudo;
634    mod event_od_group_add;
635    mod event_od_group_remove;
636    mod event_od_group_set;
637    mod event_od_modify_password;
638    mod event_od_disable_user;
639    mod event_od_enable_user;
640    mod event_od_attribute_value_add;
641    mod event_od_attribute_value_remove;
642    mod event_od_attribute_set;
643    mod event_od_create_user;
644    mod event_od_create_group;
645    mod event_od_delete_user;
646    mod event_od_delete_group;
647    mod event_xpc_connect;
648}
endpoint_sec/event.rs

endpoint_sec/
event.rs
