trailofbits / sinter

A user-mode application authorization system for MacOS written in Swift
https://blog.trailofbits.com/2020/08/12/sinter-new-user-mode-security-enforcement-for-macos/
GNU Affero General Public License v3.0
301 stars 15 forks source link

[Feature request] execute (shell) script when specified apps/processes launch #94

Open JayBrown opened 4 years ago

JayBrown commented 4 years ago

It would be great to somehow configure sinter to execute shell scripts when apps with specified bundle IDs launch (or processes from a certain path): sinter would halt the app/process launch, pass process information to the script (bundle ID, process ID, execution path etc.), and wait for the script to finish, before applying any rules. Possible?

JayBrown commented 4 years ago

Something like this, which I'm currently using in my own solution, that I cobbled together (getting info from NSDistributedNotifications, which however only works for actual applications, not CLIs, not even most menu bar apps):

-(void) launchedApp: (NSNotification*) notification {
  NSDictionary *userInfo = [notification userInfo]; // read full application launch info
  NSString* AppPID = [userInfo objectForKey:@"NSApplicationProcessIdentifier"]; // parse for AppPID
  int killPID = [AppPID intValue]; // define integer from NSString
  kill((killPID), SIGSTOP); // interrupt app launch
  NSString* AppPath = [userInfo objectForKey:@"NSApplicationPath"]; // read application path
  NSString* AppBundleID = [userInfo objectForKey:@"NSApplicationBundleIdentifier"]; // read BundleID
  NSString* AppName = [userInfo objectForKey:@"NSApplicationName"]; // read AppName
  NSLog(@":::%@:::%@:::%@:::%@", AppPID, AppPath, AppBundleID, AppName); // output to stderr
}