improved handling of code signing changes

objective-see#580

LuLu/App/AlertWindowController.h

@@ -105,13 +105,8 @@
 
 /* METHODS */
 
-//automatically invoked when user clicks process ancestry button
-// ->depending on state, show/populate the popup, or close it
--(IBAction)vtButtonHandler:(id)sender;
-
-//invoked when user clicks process ancestry button
-// ->depending on state, show/populate the popup, or close it
--(IBAction)ancestryButtonHandler:(id)sender;
+//open signing info popover
+-(void)openSigningInfoPopover;
 
 //button handler
 // ->block/allow, and then close

LuLu/App/AlertWindowController.m

@@ -327,26 +327,15 @@ -(void)setSigningIcon
 // depending on state, show/populate the popup, or close it
 -(IBAction)signingInfoButtonHandler:(id)sender
 {
-    //view controller
-    SigningInfoViewController* popover = nil;
-
-    //open popover
-    if(NSControlStateValueOn == self.signingInfoButton.state)
+    //not open?
+    // show popover
+    if(YES != self.signingInfoPopover.isShown)
     {
-        //grab delegate
-        popover = (SigningInfoViewController*)self.signingInfoPopover.delegate;
-
-        //set icon image
-        popover.icon.image = self.signingInfoButton.image;
-
-        //set alert info
-        popover.alert = self.alert;
-
-        //show popover
-        [self.signingInfoPopover showRelativeToRect:[self.signingInfoButton bounds] ofView:self.signingInfoButton preferredEdge:NSMaxYEdge];
+        //open
+        [self openSigningInfoPopover];
     }
 
-    //close popover
+    //otherwise close it
     else
     {
         //close
@@ -356,6 +345,30 @@ -(IBAction)signingInfoButtonHandler:(id)sender
     return;
 }
 
+//open signing info popover
+-(void)openSigningInfoPopover
+{
+    //view controller
+    SigningInfoViewController* popoverDelegate = nil;
+
+    //set button state
+    self.signingInfoButton.state = NSControlStateValueOn;
+
+    //grab delegate
+    popoverDelegate = (SigningInfoViewController*)self.signingInfoPopover.delegate;
+
+    //set icon image
+    popoverDelegate.icon.image = self.signingInfoButton.image;
+
+    //set alert info
+    popoverDelegate.alert = self.alert;
+
+    //show popover
+    [self.signingInfoPopover showRelativeToRect:[self.signingInfoButton bounds] ofView:self.signingInfoButton preferredEdge:NSMaxYEdge];
+
+    return;
+}
+
 //automatically invoked when user clicks process vt button
 // depending on state, show/populate the popup, or close it
 -(IBAction)vtButtonHandler:(id)sender

LuLu/App/SigningInfoViewController.h

@@ -36,7 +36,10 @@
 //details
 @property (weak) IBOutlet NSTextField* details;
 
+//signing id
+@property (weak) IBOutlet NSTextField* signingID;
+
 //no signing auths
-@property (weak) IBOutlet NSTextField *noSigningAuths;
+@property (weak) IBOutlet NSTextField* noSigningAuths;
 
 @end

LuLu/App/SigningInfoViewController.m

@@ -46,9 +46,12 @@ -(void)popoverWillShow:(NSNotification *)notification;
         //append to summary
         [summary appendFormat:@" is not validly signed"];
 
-        //set details
+        //details: n/a
         self.details.stringValue = @"not applicable";
 
+        //signing id: n/a
+        self.signingID.stringValue = @"not applicable";
+
         //bail
         goto bail;
     }
@@ -123,6 +126,13 @@ -(void)popoverWillShow:(NSNotification *)notification;
                 }
             }
 
+            //set signing id
+            if(nil != signingInfo[KEY_CS_ID])
+            {
+                //set
+                self.signingID.stringValue = signingInfo[KEY_CS_ID];
+            }
+
             break;
 
         //unsigned
@@ -131,9 +141,12 @@ -(void)popoverWillShow:(NSNotification *)notification;
             //append to summary
             [summary appendFormat:@" is not signed"];
 
-            //set details
+            //details: n/a
             self.details.stringValue = @"not applicable";
 
+            //signing id: n/a
+            self.signingID.stringValue = @"not applicable";
+
             break;
 
         //everything else
@@ -146,6 +159,13 @@ -(void)popoverWillShow:(NSNotification *)notification;
             //set details
             self.details.stringValue = [NSMutableString stringWithFormat:@"signing error: %#lx", (long)[signingInfo[KEY_CS_STATUS] integerValue]];
 
+            //set signing id
+            if(nil != signingInfo[KEY_CS_ID])
+            {
+                //set
+                self.signingID.stringValue = signingInfo[KEY_CS_ID];
+            }
+
             break;
     }
 

LuLu/App/XPCUser.m

@@ -75,6 +75,24 @@ -(void)alertShow:(NSDictionary*)alert reply:(void (^)(NSDictionary*))reply
             //make window front
             [NSApp activateIgnoringOtherApps:YES];
 
+            //code sign change?
+            // show code signing popover
+            if(YES == [alert[KEY_CS_CHANGE] boolValue])
+            {
+                //dbg msg
+                os_log_debug(logHandle, "code signing information changed, will show (modal) alert to user");
+
+                //invoke handler to open
+                [alertWindow openSigningInfoPopover];
+
+                //show (modal) alert
+                dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (0.1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
+
+                    //alert
+                    showAlert([NSString stringWithFormat:@"%@'s code signing information has changed", alert[KEY_PROCESS_NAME]], @"", @[@"OK"]);
+
+                });
+            }
         });
 
     });

LuLu/Extension/FilterDataProvider.m

@@ -225,6 +225,9 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
     //process obj
     Process* process = nil;
 
+    //flag
+    BOOL csChange = NO;
+
     //matching rule obj
     Rule* matchingRule = nil;
 
@@ -334,8 +337,9 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
     // check for existing rule
 
     //existing rule for process?
-    matchingRule = [rules find:process flow:(NEFilterSocketFlow*)flow];
-    if(nil != matchingRule)
+    matchingRule = [rules find:process flow:(NEFilterSocketFlow*)flow csChange:&csChange];
+    if( (YES != csChange) &&
+        (nil != matchingRule) )
     {
         //dbg msg
         os_log_debug(logHandle, "found matching rule for %d/%{public}@: %{public}@", process.pid, process.binary.name, matchingRule);
@@ -356,12 +360,28 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
         //all set
         goto bail;
     }
-    
+
     /* NO MATCHING RULE FOUND */
 
-    //dbg msg
-    os_log_debug(logHandle, "no (saved) rule found for %d/%{public}@", process.pid, process.binary.name);
+    //cs change?
+    // update rule with new code signing info
+    // note: user will be alerted, if/when alert is delivered
+    if(YES == csChange)
+    {
+        //dbg msg
+        os_log_debug(logHandle, "found matching rule for %d/%{public}@: %{public}@, but code signing info has changed", process.pid, process.binary.name, matchingRule);
+
+        //update cs info
+        [rules updateCSInfo:matchingRule];
+    }
 
+    //no matching rule found?
+    else
+    {
+        //dbg msg
+        os_log_debug(logHandle, "no (saved) rule found for %d/%{public}@", process.pid, process.binary.name);
+    }
+
     //no client?
 
     //CHECK:
@@ -455,7 +475,7 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
                 verdict = [NEFilterNewFlowVerdict pauseVerdict];
 
                 //create/deliver alert
-                [self alert:(NEFilterSocketFlow*)flow process:process];
+                [self alert:(NEFilterSocketFlow*)flow process:process csChange:NO];
             }
 
             //all set
@@ -470,9 +490,10 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
         os_log_debug(logHandle, "'Allow Apple' preference not set, so skipped 'Is Apple' check");
     }
 
-    //if it's a prev installed 3rd-party process and that preference is set; allow!
+    //if it's a prev installed 3rd-party process (w/ no CS change) and that preference is set; allow!
     if( (YES == [preferences.preferences[PREF_ALLOW_INSTALLED] boolValue]) &&
-        (Apple != [process.csInfo[KEY_CS_SIGNER] intValue]))
+        (Apple != [process.csInfo[KEY_CS_SIGNER] intValue]) &&
+        (YES != csChange) )
     {
         //app date
         NSDate* date = nil;
@@ -602,8 +623,8 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
 
     //create/deliver alert
     // note: handles response + next/any related flow
-    [self alert:(NEFilterSocketFlow*)flow process:process];
-        
+    [self alert:(NEFilterSocketFlow*)flow process:process csChange:csChange];
+
 bail:
 
 
@@ -614,14 +635,17 @@ -(NEFilterNewFlowVerdict*)processEvent:(NEFilterFlow*)flow
 
 //1. create and deliver alert
 //2. handle response (and process other shown alerts, etc.)
--(void)alert:(NEFilterSocketFlow*)flow process:(Process*)process
+-(void)alert:(NEFilterSocketFlow*)flow process:(Process*)process csChange:(BOOL)csChange
 {
     //alert
     NSMutableDictionary* alert = nil;
 
     //create alert
     alert = [alerts create:(NEFilterSocketFlow*)flow process:process];
 
+    //add cs change
+    alert[KEY_CS_CHANGE] = [NSNumber numberWithBool:csChange];
+
     //dbg msg
     os_log_debug(logHandle, "created alert...");