google / santa

A binary authorization and monitoring system for macOS
https://santa.dev
Apache License 2.0
4.37k stars 295 forks source link

Login/logout events #1371

Closed mlw closed 2 weeks ago

mlw commented 3 weeks ago

This PR sets is the first step in adding support for the following event types:

ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGOUT
ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOCK
ES_EVENT_TYPE_NOTIFY_LW_SESSION_UNLOCK
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH
ES_EVENT_TYPE_NOTIFY_SCREENSHARING_DETACH
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGIN
ES_EVENT_TYPE_NOTIFY_OPENSSH_LOGOUT
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGIN
ES_EVENT_TYPE_NOTIFY_LOGIN_LOGOUT

The string and protobuf serializer implementations have been relegated into a separate branch for a future PR to try and keep this already large PR a bit smaller. So while this branch will subscribe to the new events, nothing is actually logged yet.