| use std::collections::HashSet; |
| use tokio::io::AsyncBufReadExt; |
| use tokio::process::Child; |
| use tokio::task::JoinHandle; |
|
|
| use super::pid_tracker::PidTracker; |
|
|
| pub struct SandboxDenial { |
| pub name: String, |
| pub capability: String, |
| } |
|
|
| pub struct DenialLogger { |
| log_stream: Child, |
| pid_tracker: Option<PidTracker>, |
| log_reader: Option<JoinHandle<Vec<u8>>>, |
| } |
|
|
| impl DenialLogger { |
| pub(crate) fn new() -> Option<Self> { |
| let mut log_stream = start_log_stream()?; |
| let stdout = log_stream.stdout.take()?; |
| let log_reader = tokio::spawn(async move { |
| let mut reader = tokio::io::BufReader::new(stdout); |
| let mut logs = Vec::new(); |
| let mut chunk = Vec::new(); |
| loop { |
| match reader.read_until(b'\n', &mut chunk).await { |
| Ok(0) | Err(_) => break, |
| Ok(_) => { |
| logs.extend_from_slice(&chunk); |
| chunk.clear(); |
| } |
| } |
| } |
| logs |
| }); |
|
|
| Some(Self { |
| log_stream, |
| pid_tracker: None, |
| log_reader: Some(log_reader), |
| }) |
| } |
|
|
| pub(crate) fn on_child_spawn(&mut self, child: &Child) { |
| if let Some(root_pid) = child.id() { |
| self.pid_tracker = PidTracker::new(root_pid as i32); |
| } |
| } |
|
|
| pub(crate) async fn finish(mut self) -> Vec<SandboxDenial> { |
| let pid_set = match self.pid_tracker { |
| Some(tracker) => tracker.stop().await, |
| None => Default::default(), |
| }; |
|
|
| if pid_set.is_empty() { |
| return Vec::new(); |
| } |
|
|
| let _ = self.log_stream.kill().await; |
| let _ = self.log_stream.wait().await; |
|
|
| let logs_bytes = match self.log_reader.take() { |
| Some(handle) => handle.await.unwrap_or_default(), |
| None => Vec::new(), |
| }; |
| let logs = String::from_utf8_lossy(&logs_bytes); |
|
|
| let mut seen: HashSet<(String, String)> = HashSet::new(); |
| let mut denials: Vec<SandboxDenial> = Vec::new(); |
| for line in logs.lines() { |
| if let Ok(json) = serde_json::from_str::<serde_json::Value>(line) |
| && let Some(msg) = json.get("eventMessage").and_then(|v| v.as_str()) |
| && let Some((pid, name, capability)) = parse_message(msg) |
| && pid_set.contains(&pid) |
| && seen.insert((name.clone(), capability.clone())) |
| { |
| denials.push(SandboxDenial { name, capability }); |
| } |
| } |
| denials |
| } |
| } |
|
|
| fn start_log_stream() -> Option<Child> { |
| use std::process::Stdio; |
|
|
| const PREDICATE: &str = r#"(((processID == 0) AND (senderImagePath CONTAINS "/Sandbox")) OR (subsystem == "com.apple.sandbox.reporting"))"#; |
|
|
| tokio::process::Command::new("log") |
| .args(["stream", "--style", "ndjson", "--predicate", PREDICATE]) |
| .stdin(Stdio::null()) |
| .stdout(Stdio::piped()) |
| .stderr(Stdio::null()) |
| .kill_on_drop(true) |
| .spawn() |
| .ok() |
| } |
|
|
| fn parse_message(msg: &str) -> Option<(i32, String, String)> { |
| |
| |
| static RE: std::sync::OnceLock<regex_lite::Regex> = std::sync::OnceLock::new(); |
| let re = RE.get_or_init(|| { |
| #[expect(clippy::unwrap_used)] |
| regex_lite::Regex::new(r"^Sandbox:\s*(.+?)\((\d+)\)\s+deny\(.*?\)\s*(.+)$").unwrap() |
| }); |
|
|
| let (_, [name, pid_str, capability]) = re.captures(msg)?.extract(); |
| let pid = pid_str.trim().parse::<i32>().ok()?; |
| Some((pid, name.to_string(), capability.to_string())) |
| } |
|
|
