| use super::super::CheckStatus; |
| use super::super::DoctorCheck; |
| use super::platform::desktop_check; |
| use std::io; |
| use std::path::Path; |
| use std::process::Output; |
| use std::process::Stdio; |
| use std::time::Duration; |
| use tokio::io::AsyncRead; |
| use tokio::io::AsyncReadExt; |
| use tokio::process::Command; |
| use tokio::time::timeout; |
|
|
| const PROBE_TIMEOUT: Duration = Duration::from_secs(10); |
| const MAX_OUTPUT_BYTES: usize = 256 * 1024; |
| const SECURITY_LOG_PREDICATE: &str = concat!( |
| "(process == 'syspolicyd' OR process == 'AppleSystemPolicy' ", |
| "OR process BEGINSWITH 'XProtect' OR subsystem BEGINSWITH 'com.apple.syspolicy' ", |
| "OR subsystem CONTAINS[c] 'XProtect' ", |
| "OR subsystem == 'com.apple.security.assessment') AND ", |
| "(eventMessage CONTAINS[c] 'codex' OR eventMessage CONTAINS[c] 'chatgpt' ", |
| "OR eventMessage CONTAINS[c] '.plugin-appserver' ", |
| "OR eventMessage CONTAINS[c] '100024' OR eventMessage CONTAINS[c] 'EMFILE' ", |
| "OR eventMessage CONTAINS[c] 'ENFILE' ", |
| "OR eventMessage CONTAINS[c] 'too many open files' ", |
| "OR eventMessage CONTAINS[c] 'Unexpected Xprotect assessment')" |
| ); |
|
|
| #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] |
| enum Evidence { |
| Clear, |
| Audit, |
| Exhausted, |
| Blocked, |
| Malware, |
| Unavailable, |
| } |
|
|
| pub(super) async fn collect(bundle: &Path) -> DoctorCheck { |
| let (gatekeeper, events) = tokio::join!(inspect_gatekeeper(bundle), inspect_security_events()); |
| enforcement_check(gatekeeper, events) |
| } |
|
|
| async fn inspect_gatekeeper(bundle: &Path) -> Evidence { |
| let mut command = Command::new("/usr/sbin/spctl"); |
| command |
| .args(["--assess", "--type", "execute", "--verbose=2"]) |
| .arg(bundle); |
| classify_gatekeeper(run_command(&mut command).await.as_ref()) |
| } |
|
|
| fn classify_gatekeeper(output: Option<&Output>) -> Evidence { |
| let Some(output) = output.filter(|output| !is_truncated(output)) else { |
| return Evidence::Unavailable; |
| }; |
| if output.status.success() { |
| return Evidence::Clear; |
| } |
| let error = String::from_utf8_lossy(&output.stderr).to_ascii_lowercase(); |
| if error.contains("rejected") || error.contains("no usable signature") { |
| Evidence::Blocked |
| } else { |
| Evidence::Unavailable |
| } |
| } |
|
|
| async fn inspect_security_events() -> Evidence { |
| let mut command = Command::new("/usr/bin/log"); |
| command.args([ |
| "show", |
| "--last", |
| "30m", |
| "--info", |
| "--style", |
| "compact", |
| "--predicate", |
| SECURITY_LOG_PREDICATE, |
| ]); |
| let Some(output) = run_command(&mut command) |
| .await |
| .filter(|output| output.status.success()) |
| else { |
| return Evidence::Unavailable; |
| }; |
| let evidence = classify_security_events(&String::from_utf8_lossy(&output.stdout)); |
| if is_truncated(&output) && evidence < Evidence::Exhausted { |
| Evidence::Unavailable |
| } else { |
| evidence |
| } |
| } |
|
|
| fn classify_security_events(output: &str) -> Evidence { |
| let mut evidence = Evidence::Clear; |
| for line in output.lines().map(str::to_ascii_lowercase) { |
| let contains = |values: &[&str]| values.iter().any(|value| line.contains(value)); |
| if !contains(&[ |
| "com.openai.codex", |
| "codex.app", |
| "chatgpt.app", |
| ".plugin-appserver", |
| "codex-command-runner", |
| ]) || contains(&["not blocked", "not denied"]) |
| { |
| continue; |
| } |
| let event = if contains(&["100024", "emfile", "enfile", "too many open files"]) { |
| Evidence::Exhausted |
| } else if contains(&["would block", "would deny"]) { |
| Evidence::Audit |
| } else if contains(&[ |
| "xp_malware_detected", |
| "xp_malware_remediated", |
| "malware detected", |
| "malware blocked", |
| "malware removed", |
| "remediat", |
| ]) { |
| Evidence::Malware |
| } else if contains(&[ |
| "blocked", |
| "denied", |
| "rejected", |
| "notarization failed", |
| "signature invalid", |
| "execution prevented", |
| "unexpected xprotect assessment", |
| "damaged and", |
| ]) { |
| Evidence::Blocked |
| } else if contains(&["audit"]) { |
| Evidence::Audit |
| } else { |
| Evidence::Clear |
| }; |
| evidence = evidence.max(event); |
| } |
| evidence |
| } |
|
|
| fn enforcement_check(gatekeeper: Evidence, events: Evidence) -> DoctorCheck { |
| let id = "desktop.security.enforcement"; |
| let (status, summary, remedy) = if events == Evidence::Malware { |
| ( |
| CheckStatus::Fail, |
| "macos XProtect blocked or remediated the desktop application", |
| "collect the XProtect detection and ask your security administrator to review the official Codex installation", |
| ) |
| } else if gatekeeper == Evidence::Blocked { |
| ( |
| CheckStatus::Fail, |
| "macos gatekeeper rejected the desktop application", |
| "ask your security administrator to review the application policy", |
| ) |
| } else if events == Evidence::Blocked { |
| ( |
| CheckStatus::Fail, |
| "a recent macos security event blocked the desktop application", |
| "ask your security administrator to review the matching prevention event", |
| ) |
| } else if events == Evidence::Exhausted { |
| ( |
| CheckStatus::Warning, |
| "macos system-policy diagnostics indicate file descriptor exhaustion", |
| "restart your Mac, retry Codex once, and contact support if the problem returns", |
| ) |
| } else if events == Evidence::Audit { |
| ( |
| CheckStatus::Warning, |
| "recent desktop security events are audit-only", |
| "ask your security administrator to verify the application policy", |
| ) |
| } else if gatekeeper == Evidence::Unavailable { |
| ( |
| CheckStatus::Warning, |
| "the desktop security assessment was unavailable", |
| "check access to macos gatekeeper diagnostics", |
| ) |
| } else if events == Evidence::Unavailable { |
| ( |
| CheckStatus::Warning, |
| "recent macos security enforcement history was unavailable", |
| "check access to macos unified security logs and rerun codex doctor", |
| ) |
| } else { |
| return desktop_check( |
| id, |
| CheckStatus::Ok, |
| "the desktop application passed available macos security assessments", |
| ) |
| .detail("gatekeeper: accepted"); |
| }; |
| desktop_check(id, status, summary).remediation(remedy) |
| } |
|
|
| fn is_truncated(output: &Output) -> bool { |
| output.stdout.len() > MAX_OUTPUT_BYTES || output.stderr.len() > MAX_OUTPUT_BYTES |
| } |
|
|
| async fn run_command(command: &mut Command) -> Option<Output> { |
| command |
| .stdin(Stdio::null()) |
| .stdout(Stdio::piped()) |
| .stderr(Stdio::piped()) |
| .kill_on_drop(true); |
| let mut child = command.spawn().ok()?; |
| let (stdout, stderr) = (child.stdout.take()?, child.stderr.take()?); |
| timeout(PROBE_TIMEOUT, async { |
| let (stdout, stderr, status) = |
| tokio::join!(read_bounded(stdout), read_bounded(stderr), child.wait()); |
| Some(Output { |
| status: status.ok()?, |
| stdout: stdout.ok()?, |
| stderr: stderr.ok()?, |
| }) |
| }) |
| .await |
| .ok() |
| .flatten() |
| } |
|
|
| async fn read_bounded<R: AsyncRead + Unpin>(mut reader: R) -> io::Result<Vec<u8>> { |
| let mut bytes = Vec::new(); |
| (&mut reader) |
| .take(MAX_OUTPUT_BYTES as u64 + 1) |
| .read_to_end(&mut bytes) |
| .await?; |
| if bytes.len() > MAX_OUTPUT_BYTES { |
| tokio::io::copy(&mut reader, &mut tokio::io::sink()).await?; |
| } |
| Ok(bytes) |
| } |
|
|
| #[cfg(test)] |
| #[path = "macos_security_tests.rs"] |
| mod tests; |
|
|
