private void ContinouslyPostAccessReports(SandboxedProcessMacKext process, CancellationToken token, List <ReportInstruction> instructions = null)
{
Analysis.IgnoreResult(
Task.Run(async() =>
{
int count = 0;
while (true)
{
if (token.IsCancellationRequested)
{
break;
}
if (instructions != null && count < instructions.Count)
{
PostAccessReport(instructions[count].Process, instructions[count].Operation,
instructions[count].Stats, instructions[count].Pid,
instructions[count].Path, instructions[count].Allowed);
// Advance the minimum enqueue time
s_connection.MinReportQueueEnqueueTime = instructions[count].Stats.EnqueueTime;
count++;
}
await Task.Delay(100);
}
}, token)
, justification: "Fire and forget"
);
}
private SandboxedProcessMacKext CreateAndStartSandboxedProcess(SandboxedProcessInfo info, bool?measureTime = null)
{
var process = new SandboxedProcessMacKext(info, overrideMeasureTime: measureTime);
process.Start();
return(process);
}
private static Sandbox.AccessReport PostAccessReport(SandboxedProcessMacKext proc, FileOperation operation, Sandbox.AccessReportStatistics stats,
int pid = 1234, string path = "/dummy/path", bool allowed = true)
{
var report = new Sandbox.AccessReport
{
Operation = operation,
Statistics = stats,
Pid = pid,
Path = path,
Status = allowed ? (uint)FileAccessStatus.Allowed : (uint)FileAccessStatus.Denied
};
proc.PostAccessReport(report);
return(report);
}
public bool NotifyKextProcessFinished(long pipId, SandboxedProcessMacKext process)
{
return(true);
}
public bool NotifyKextPipStarted(FileAccessManifest fam, SandboxedProcessMacKext process)
{
return(true);
}
