Mathieu Virbel
9d5d852860
Replace fs_usage (reports Mach thread IDs, requiring process name matching with false positives) with eslogger (Endpoint Security framework, reports real Unix PIDs via audit_token.pid plus fork events for process tree tracking). Key changes: - Daemon starts eslogger instead of fs_usage, with early-exit detection and clear Full Disk Access error messaging - New two-pass eslogger JSON parser: pass 1 builds PID tree from fork events, pass 2 filters filesystem events by PID set - Remove runtime PID polling (StartPIDTracking, pollDescendantPIDs) — process tree is now built post-hoc from the eslogger log - Platform-specific generateLearnedTemplatePlatform() for darwin/linux/stub - Refactor TraceResult and GenerateLearnedTemplate to be platform-agnostic
43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
//go:build darwin
|
|
|
|
package sandbox
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
// generateLearnedTemplatePlatform stops the daemon eslogger session,
|
|
// parses the eslogger log with PID-based process tree filtering,
|
|
// and generates a template (macOS).
|
|
func (m *Manager) generateLearnedTemplatePlatform(cmdName string) (string, error) {
|
|
if m.learningLog == "" {
|
|
return "", fmt.Errorf("no eslogger log available (was learning mode enabled?)")
|
|
}
|
|
|
|
// Stop daemon learning session
|
|
if m.daemonClient != nil && m.learningID != "" {
|
|
if err := m.daemonClient.StopLearning(m.learningID); err != nil {
|
|
m.logDebug("Warning: failed to stop learning session: %v", err)
|
|
}
|
|
}
|
|
|
|
// Parse eslogger log with root PID for process tree tracking
|
|
result, err := ParseEsloggerLog(m.learningLog, m.learningRootPID, m.debug)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to parse eslogger log: %w", err)
|
|
}
|
|
|
|
templatePath, err := GenerateLearnedTemplate(result, cmdName, m.debug)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
// Clean up eslogger log
|
|
_ = os.Remove(m.learningLog)
|
|
m.learningLog = ""
|
|
m.learningID = ""
|
|
|
|
return templatePath, nil
|
|
}
|