northpolesec / santa

A binary authorization and monitoring system for macOS
https://northpole.dev
Apache License 2.0
30 stars 4 forks source link

Fix tree aware clients handleContextMessage default return #17

Closed mlw closed 5 days ago

mlw commented 5 days ago

This fixes an issue for tree aware clients that have not enabled any process tree annotations but also do no subscribe to the set of force-enabled tree aware client event types (fork/exec/exit).

Before this change, handleContextMessage would always return false when process trees weren't in use. Instead it should return whether or not the event type was force added.

This bug does not currently affect Santa's current implementation as the only tree aware client (the recorder) subscribes to the full set of force-enabled events. But it does affect various debug routines where event subscriptions are manipulated.

This PR also begins including tree aware client tests.