diff --git a/Source/common/SNTConfigurator.m b/Source/common/SNTConfigurator.m index caf408b2..d8f7cf7d 100644 --- a/Source/common/SNTConfigurator.m +++ b/Source/common/SNTConfigurator.m @@ -1045,12 +1045,22 @@ - (BOOL)enableForkAndExitLogging { return number ? [number boolValue] : NO; } +// This method returns only the values that are of the expected string type. +// The reasoning is that if a filter is attempted to be set, this method should +// return some subset rather than `nil`. Since `nil` effectively means to log +// everything, returning it would be akin to "failing open" even though some +// filter configuration was attempted. - (NSArray *)telemetry { - NSArray *events = self.configState[kTelemetryKey]; + NSArray *configuredEvents = self.configState[kTelemetryKey]; + if (!configuredEvents) { + return nil; + } - for (id event in events) { - if (![event isKindOfClass:[NSString class]]) { - return nil; + NSMutableArray *events = [[NSMutableArray alloc] initWithCapacity:configuredEvents.count]; + + for (id event in configuredEvents) { + if ([event isKindOfClass:[NSString class]]) { + [events addObject:event]; } } diff --git a/Source/common/TelemetryEventMap.mm b/Source/common/TelemetryEventMap.mm index c62034e7..3a95a6f6 100644 --- a/Source/common/TelemetryEventMap.mm +++ b/Source/common/TelemetryEventMap.mm @@ -64,7 +64,7 @@ TelemetryEvent TelemetryConfigToBitmask(NSArray *telemetry, mask |= EventNameToMask(santa::NSStringToUTF8StringView([event_name lowercaseString])); } } else { - mask = EventNameToMask("everything"); + mask = TelemetryEvent::kEverything; if (enableForkAndExitLogging == false) { mask &= (~TelemetryEvent::kFork & ~TelemetryEvent::kExit); diff --git a/Source/santad/Santad.mm b/Source/santad/Santad.mm index e492c97e..850b1538 100644 --- a/Source/santad/Santad.mm +++ b/Source/santad/Santad.mm @@ -400,31 +400,33 @@ void SantadMain(std::shared_ptr esapi, std::shared_ptr %@", - [oldValue componentsJoinedByString:@","], - [newValue componentsJoinedByString:@","]); - logger->SetTelemetryMask(santa::TelemetryConfigToBitmask( - newValue, configurator.enableForkAndExitLogging)); - }], + LOGI(@"Telemetry changed: %@ -> %@", [oldValue componentsJoinedByString:@","], + [newValue componentsJoinedByString:@","]); + logger->SetTelemetryMask( + santa::TelemetryConfigToBitmask(newValue, configurator.enableForkAndExitLogging)); + }], [[SNTKVOManager alloc] initWithObject:configurator selector:@selector(enableForkAndExitLogging) type:[NSNumber class]