search

google / upvote_py2

A multi-platform binary whitelisting solution
Apache License 2.0
452 stars 35 forks source link

Transitive / Compiler Rule Support #66

Closed ericzinnikas closed 3 years ago

ericzinnikas commented 3 years ago

I'm attempting to understand how I can actually create/manage a compiler rule with Upvote. The use-case being, we would enable transitive whitelisting for certain folks who are using certain tools.

I see the codebase fully supports enabling transitive whitelisting mode on clients (and it works). However I see limited references to compiler rules, the main one being WHITELIST_COMPILER as part of a list of Santa rule policies.

Even if there is no UI support, is this something I can manually add to the Datastore Rules table, so it would get synced to clients?

ericzinnikas commented 3 years ago

For those following along at home, I was able to manually insert a Rule key into the Upvote Datastore -- just following the format of existing keys and setting the policy to WHITELIST_COMPILER and the parent/hash to the compiler/writing file (i.e. go / ld). After syncing and compiling some test files, I can confirms it works: Rule : Whitelisted (Transitive)

Only thing you'd be missing by direct insert into Datastore is BigQuery logging, etc.