secanomalyd/daemon.cc - third_party/platform2 - Git at Google

 // Copyright 2021 The ChromiumOS Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "secanomalyd/daemon.h"

 #include <sys/types.h>
 #include <sysexits.h>

 #include <memory>
 #include <string>
 #include <string_view>

 #include <absl/strings/match.h>
 #include <base/command_line.h>
 #include <base/files/file_util.h>
 #include <base/files/file_path.h>
 #include <base/logging.h>
 #include <base/rand_util.h>
 #include <base/strings/string_split.h>
 #include <base/strings/string_util.h>
 #include <base/time/time.h>

 #include <brillo/process/process.h>
 #include <brillo/message_loops/message_loop.h>

 #include "secanomalyd/audit_log_reader.h"
 #include "secanomalyd/metrics.h"
 #include "secanomalyd/mount_entry.h"
 #include "secanomalyd/mounts.h"
 #include "secanomalyd/processes.h"
 #include "secanomalyd/reporter.h"
 #include "secanomalyd/system_context.h"

 namespace secanomalyd {

 namespace {

 // Sets the sampling frequency for W+X mount count uploads, such that the
 // systems with more W+X mounts are more likely to send a crash report, in
 // addition to limiting the total number of uploaded reports.
 constexpr int CalculateSampleFrequency(size_t wx_mount_count) {
   if (wx_mount_count <= 5)
     return 15;
   else if (wx_mount_count <= 10)
     return 10;
   else if (wx_mount_count <= 15)
     return 5;
   else
     return 2;
 }
 constexpr int kProcAnomalySampleFrequency = 10000000;  // 10 million

 constexpr base::TimeDelta kScanInterval = base::Seconds(30);
 // Used to limit the total number of UMA reports.
 // Per Platform.DailyUseTime histogram this interval should ensure that enough
 // users run the reporting.
 constexpr base::TimeDelta kUmaReportInterval = base::Hours(2);

 // Generates a unique name for the next element being added to `set`, where the
 // element is a unique instance of a certain path type denoted by a `prefix`.
 // For example, unknown executable paths are recorded as:
 // {"unknown_executable_1", "unknown_executable_2", etc...}
 std::string GetNextUniquePath(const FilePaths& set, const std::string& prefix) {
   int num_common_elements = 0;
   for (base::FilePath element : set) {
     if (absl::StartsWith(element.value(), prefix))
       num_common_elements++;
   }
   return prefix + "_" + std::to_string(num_common_elements);
 }

 bool EmitSeccompCoverageUma(const ProcEntries& proc_entries) {
   size_t total_proc_count = proc_entries.size();
   size_t seccomp_proc_count = 0;
   seccomp_proc_count = std::count_if(
       proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
         return entry.sandbox_status()[ProcEntry::kSecCompBit] == 1;
       });
   unsigned int seccomp_proc_percentage =
       static_cast<unsigned int>(round((static_cast<float>(seccomp_proc_count) /
                                        static_cast<float>(total_proc_count)) *
                                       100));

   VLOG(1) << "Reporting SecComp coverage UMA metric";
   if (!SendSecCompCoverageToUMA(seccomp_proc_percentage)) {
     LOG(WARNING) << "Could not upload SecComp coverage UMA metric";
     return false;
   }
   return true;
 }

 bool EmitNnpProcPercentageUma(const ProcEntries& proc_entries) {
   size_t total_proc_count = proc_entries.size();
   size_t nnp_proc_count = 0;
   nnp_proc_count = std::count_if(
       proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
         return entry.sandbox_status()[ProcEntry::kNoNewPrivsBit] == 1;
       });
   unsigned int nnp_proc_percentage =
       static_cast<unsigned int>(round((static_cast<float>(nnp_proc_count) /
                                        static_cast<float>(total_proc_count)) *
                                       100));

   VLOG(1) << "Reporting no_new_privs process percentage UMA metric";
   if (!SendNnpProcPercentageToUMA(nnp_proc_percentage)) {
     LOG(WARNING)
         << "Could not upload no_new_privs process percentage UMA metric";
     return false;
   }
   return true;
 }

 bool EmitNonRootProcPercentageUma(const ProcEntries& proc_entries) {
   size_t total_proc_count = proc_entries.size();
   size_t nonroot_proc_count = 0;
   nonroot_proc_count = std::count_if(
       proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
         return entry.sandbox_status()[ProcEntry::kNonRootBit] == 1;
       });
   unsigned int nonroot_proc_percentage =
       static_cast<unsigned int>(round((static_cast<float>(nonroot_proc_count) /
                                        static_cast<float>(total_proc_count)) *
                                       100));

   VLOG(1) << "Reporting non-root process percentage UMA metric";
   if (!SendNonRootProcPercentageToUMA(nonroot_proc_percentage)) {
     LOG(WARNING) << "Could not upload non-root process percentage UMA metric";
     return false;
   }
   return true;
 }

 bool EmitUnprivProcPercentageUma(const ProcEntries& proc_entries,
                                  ino_t init_user_ns) {
   size_t total_proc_count = proc_entries.size();
   size_t unpriv_proc_count = 0;
   unpriv_proc_count = std::count_if(
       proc_entries.begin(), proc_entries.end(), [&](const ProcEntry& entry) {
         return entry.sandbox_status()[ProcEntry::kNonRootBit] == 1 &&
                (entry.sandbox_status()[ProcEntry::kNoCapSysAdminBit] == 1 ||
                 entry.userns() != init_user_ns);
       });
   unsigned int unpriv_proc_percentage =
       static_cast<unsigned int>(round((static_cast<float>(unpriv_proc_count) /
                                        static_cast<float>(total_proc_count)) *
                                       100));

   VLOG(1) << "Reporting unpriv process percentage UMA metric";
   if (!SendUnprivProcPercentageToUMA(unpriv_proc_percentage)) {
     LOG(WARNING) << "Could not upload unpriv process percentage UMA metric";
     return false;
   }
   return true;
 }

 bool EmitNonInitNsProcPercentageUma(const ProcEntries& proc_entries,
                                     ino_t init_pid_ns,
                                     ino_t init_mnt_ns) {
   size_t total_proc_count = proc_entries.size();
   size_t non_initns_proc_count = 0;
   non_initns_proc_count = std::count_if(
       proc_entries.begin(), proc_entries.end(), [&](const ProcEntry& entry) {
         return entry.pidns() != init_pid_ns && entry.mntns() != init_mnt_ns;
       });
   unsigned int non_initns_proc_percentage = static_cast<unsigned int>(
       round((static_cast<float>(non_initns_proc_count) /
              static_cast<float>(total_proc_count)) *
             100));

   VLOG(1) << "Reporting non-init namespace process percentage UMA metric";
   if (!SendNonInitNsProcPercentageToUMA(non_initns_proc_percentage)) {
     LOG(WARNING)
         << "Could not upload non-init namespace process percentage UMA metric";
     return false;
   }
   return true;
 }

 }  // namespace

 int Daemon::OnInit() {
   // DBusDaemon::OnInit() initializes the D-Bus connection, making sure |bus_|
   // is populated.
   int ret = brillo::DBusDaemon::OnInit();
   if (ret != EX_OK) {
     return ret;
   }

   // Initializes the audit log reader for accessing the audit log file.
   InitAuditLogReader();

   session_manager_proxy_ = std::make_unique<SessionManagerProxy>(bus_);

   // The raw SessionManagerProxy pointer is un-owned by the SystemContext
   // object.
   system_context_ =
       std::make_unique<SystemContext>(session_manager_proxy_.get());

   return EX_OK;
 }

 int Daemon::OnEventLoopStarted() {
   ScanForAnomalies();
   ReportUmaMetrics();

   return EX_OK;
 }

 void Daemon::ScanForAnomalies() {
   VLOG(1) << "Scanning for W+X mounts";
   DoWXMountScan();
   VLOG(1) << "Scanning system processes";
   DoProcScan();
   VLOG(1) << "Scanning for audit log anomalies";
   DoAuditLogScan();

   if (generate_reports_) {
     DoAnomalousSystemReporting();
   }

   brillo::MessageLoop::current()->PostDelayedTask(
       FROM_HERE,
       base::BindOnce(&Daemon::ScanForAnomalies, base::Unretained(this)),
       kScanInterval);
 }

 void Daemon::ReportUmaMetrics() {
   if (!ShouldReport(dev_)) {
     return;
   }

   EmitWXMountCountUma();
   EmitForbiddenIntersectionProcCountUma();
   EmitMemfdExecProcCountUma();
   EmitSandboxingUma();

   brillo::MessageLoop::current()->PostDelayedTask(
       FROM_HERE,
       base::BindOnce(&Daemon::ReportUmaMetrics, base::Unretained(this)),
       kUmaReportInterval);
 }

 void Daemon::DoWXMountScan() {
   all_mounts_ = ReadMounts();
   if (!all_mounts_) {
     LOG(ERROR) << "Failed to read mounts";
     return;
   }

   // Refreshed on every check to have the most up-to-date state.
   system_context_->Refresh();

   for (const auto& e : all_mounts_.value()) {
     if (e.IsWX()) {
       // Have we seen the mount yet?
       if (wx_mounts_.count(e.dest()) == 0) {
         if (e.IsUsbDriveOrArchive()) {
           // Figure out what to log in this case.
           // We could log the fact that the mount exists without logging
           // |src| or |dest|.
           continue;
         }

         if (e.IsNamespaceBindMount() || e.IsKnownMount(*system_context_)) {
           // Namespace mounts happen when a namespace file in /proc/<pid>/ns/
           // gets bind-mounted somewhere else. These mounts can be W+X but are
           // not concerning since they consist of a single file and these files
           // cannot be executed.
           // There are other W+X mounts that are low-risk (e.g. non-persistent
           // mounts) and that we're in the process of fixing. These are
           // considered "known" W+X mounts and are also skipped.
           VLOG(1) << "Not recording W+X mount at '" << e.dest() << "', type "
                   << e.type();
           // In case of a known mount, we need to update the context to remember
           // that this mount was observed, as we might use this information to
           // determine whether it should be ignored again in the future scans.
           system_context_->RecordKnownMountObservation(e.dest());
           continue;
         }

         // We haven't seen the mount, and it's not a type we want to skip, so
         // save it.
         wx_mounts_[e.dest()] = e;
         VLOG(1) << "Found W+X mount at '" << e.dest() << "', type " << e.type();
         VLOG(1) << "|wx_mounts_.size()| = " << wx_mounts_.size();

         // Report metrics on the mount, if not running in dev mode.
         if (ShouldReport(dev_)) {
           // Report /usr/local mounts separately because those can indicate
           // systems where |cros_debug == 0| but the system is still a dev
           // system.
           SecurityAnomaly mount_anomaly =
               e.IsDestInUsrLocal()
                   ? SecurityAnomaly::kMount_InitNs_WxInUsrLocal
                   : SecurityAnomaly::kMount_InitNs_WxNotInUsrLocal;
           if (!SendSecurityAnomalyToUMA(mount_anomaly)) {
             LOG(WARNING) << "Could not upload metrics";
           }
         }
       }
     }
   }
 }

 void Daemon::DoProcScan() {
   all_procs_ = ReadProcesses(ProcessFilter::kAll);
   if (!all_procs_) {
     return;
   }
   if (!init_proc_) {
     init_proc_ = GetInitProcEntry(all_procs_.value());
   }
   if (!init_proc_) {
     return;
   }

   ProcEntries procs;
   FilterKernelProcesses(all_procs_.value(), procs);

   ProcEntries flagged_procs;
   std::copy_if(procs.begin(), procs.end(), std::back_inserter(flagged_procs),
                [&](const ProcEntry& e) {
                  return IsProcInForbiddenIntersection(e, init_proc_.value());
                });

   forbidden_intersection_procs_ = MaybeProcEntries(flagged_procs);
   if (forbidden_intersection_procs_) {
     VLOG(1) << "|forbidden_intersection_procs_.size()| = "
             << forbidden_intersection_procs_->size();
   }
 }

 void Daemon::DoAnomalousSystemReporting() {
   // Skip reporting if for all anomaly types either the daemon has previously
   // attempted to send a report or the anomaly does not exist.
   if ((has_attempted_wx_mount_report_ || wx_mounts_.empty()) &&
       (has_attempted_forbidden_intersection_report_ ||
        forbidden_intersection_procs_.value().empty()) &&
       (has_attempted_memfd_exec_report_ ||
        executables_attempting_memfd_exec_.empty())) {
     return;
   }

   // Makes checking for this anomaly type easier.
   ProcEntries anomalous_procs = forbidden_intersection_procs_
                                     ? forbidden_intersection_procs_.value()
                                     : ProcEntries();

   // Stop subsequent reporting attempts for each discovered anomaly type.
   if (!wx_mounts_.empty()) {
     has_attempted_wx_mount_report_ = true;
   }
   if (!anomalous_procs.empty()) {
     has_attempted_forbidden_intersection_report_ = true;
   }
   if (!executables_attempting_memfd_exec_.empty()) {
     has_attempted_memfd_exec_report_ = true;
   }

   if (!ShouldReport(dev_)) {
     VLOG(1) << "Not reporting anomalous system due to dev mode";
     return;
   }
   VLOG(1) << "Attempting to report anomalous system";

   int range = 0;
   int weight = 1;
   // If |dev_| is set or there are memfd execution attempts, always send the
   // report (memfd execution attempts are exceedingly rare so we can afford to
   // upload them all). Otherwise, if W+X anomalies exist, send one in every
   // |CalculateSampleFrequency(wx_mounts_.size())| reports. Finally, if only
   // forbidden intersection violations exist, send one in every
   // |kProcAnomalySampleFrequency| reports.
   if (dev_ || !executables_attempting_memfd_exec_.empty()) {
     range = 1;
   } else if (!wx_mounts_.empty()) {
     range = CalculateSampleFrequency(wx_mounts_.size());
     weight = range;
   } else if (!anomalous_procs.empty() && forbidden_intersection_only_reports_) {
     range = kProcAnomalySampleFrequency;
   }

   // |base::RandInt(min, max)| returns a random int between [min, max], which in
   // this case gives the report one in |range| chance of being sent.
   if (range < 1 || base::RandInt(1, range) > 1) {
     return;
   }

   bool success = ReportAnomalousSystem(wx_mounts_, anomalous_procs,
                                        executables_attempting_memfd_exec_,
                                        all_mounts_, all_procs_, weight, dev_);
   if (!success) {
     // Reporting is best-effort so on failure we just print a warning.
     LOG(WARNING) << "Failed to report anomalous system";
   }

   // Report whether uploading the anomalous system report succeeded.
   if (!SendAnomalyUploadResultToUMA(success)) {
     LOG(WARNING) << "Could not upload metrics";
   }
 }

 void Daemon::InitAuditLogReader() {
   audit_log_reader_ = std::make_unique<AuditLogReader>(kAuditLogPath);
 }

 void Daemon::DoAuditLogScan() {
   if (!audit_log_reader_)
     return;

   std::string log_message;
   LogRecord log_record;

   while (audit_log_reader_->GetNextEntry(&log_record)) {
     // This detects a successful memfd_create syscall and reports it to UMA to
     // be used as the baseline metric for memfd execution attempts. The check
     // will not be performed again, once the metric is successfully emitted.
     if (!has_emitted_memfd_baseline_uma_ &&
         log_record.tag == kSyscallRecordTag &&
         secanomalyd::IsMemfdCreate(log_record.message)) {
       // Report baseline condition to UMA if not in dev mode.
       if (ShouldReport(dev_)) {
         if (!SendSecurityAnomalyToUMA(
                 SecurityAnomaly::kSuccessfulMemfdCreateSyscall)) {
           LOG(WARNING) << "Could not upload metrics";
         } else {
           has_emitted_memfd_baseline_uma_ = true;
         }
       }
     }
     std::string exe_path;
     if (log_record.tag == kAVCRecordTag &&
         secanomalyd::IsMemfdExecutionAttempt(log_record.message, exe_path)) {
       if (exe_path == secanomalyd::kUnknownExePath) {
         exe_path = GetNextUniquePath(executables_attempting_memfd_exec_,
                                      secanomalyd::kUnknownExePath);
       }
       // Record the anomaly by adding the offending executable path to
       // |executables_attempting_memfd_exec_| set.
       executables_attempting_memfd_exec_.insert(base::FilePath(exe_path));
       VLOG(1) << log_record.message;
       VLOG(1) << "|executables_attempting_memfd_exec_.size()| = "
               << executables_attempting_memfd_exec_.size();
       // Report anomalous condition to UMA if not in dev mode.
       if (ShouldReport(dev_)) {
         if (!SendSecurityAnomalyToUMA(
                 SecurityAnomaly::kBlockedMemoryFileExecAttempt))
           LOG(WARNING) << "Could not upload metrics";
       }
     }
   }
 }

 void Daemon::EmitWXMountCountUma() {
   VLOG(1) << "Reporting W+X mount count UMA metric";
   if (SendWXMountCountToUMA(wx_mounts_.size())) {
     // After successfully reporting W+X mount count, clear the map.
     // If mounts still exist they'll be re-added on the next scan.
     wx_mounts_.clear();
   } else {
     LOG(WARNING) << "Could not upload W+X mount count UMA metric";
   }
 }

 void Daemon::EmitForbiddenIntersectionProcCountUma() {
   // Skip if already emitted or |forbidden_intersection_procs_| has not yet been
   // populated.
   if (has_emitted_forbidden_intersection_uma_ ||
       !forbidden_intersection_procs_) {
     return;
   }
   // Only report forbidden intersection process count in the logged-in state.
   system_context_->Refresh(/*skip_known_mount_refresh=*/true);
   if (!system_context_->IsUserLoggedIn()) {
     return;
   }
   VLOG(1) << "Reporting forbidden intersection process count UMA metric";
   if (!SendForbiddenIntersectionProcCountToUMA(
           forbidden_intersection_procs_->size())) {
     LOG(WARNING)
         << "Could not upload forbidden intersection process count UMA metric";
   }
 }

 void Daemon::EmitMemfdExecProcCountUma() {
   VLOG(1) << "Reporting memfd exec process count UMA metric";
   if (SendAttemptedMemfdExecProcCountToUMA(
           executables_attempting_memfd_exec_.size())) {
     // After successfully reporting process count, clear the set. If the same
     // processes attempt memfd executions again, they will be re-added to the
     // set.
     executables_attempting_memfd_exec_.clear();
   } else {
     LOG(WARNING) << "Could not upload memfd exec process count UMA metric";
   }
 }

 void Daemon::EmitSandboxingUma() {
   if (!has_emitted_landlock_status_uma_) {
     VLOG(1) << "Reporting Landlock status UMA metric";
     // If landlock is in any other state than enabled, such as not supported or
     // an unknown state, we consider it disabled.
     if (!SendLandlockStatusToUMA(system_context_->GetLandlockState() ==
                                  LandlockState::kEnabled)) {
       LOG(WARNING) << "Could not upload Landlock status UMA metric";
     } else {
       has_emitted_landlock_status_uma_ = true;
     }
   }

   // Refresh the login state.
   system_context_->Refresh(/*skip_known_mount_refresh=*/true);

   if ((!has_emitted_seccomp_coverage_uma_ ||
        !has_emitted_nonroot_proc_percentage_uma_ ||
        !has_emitted_unpriv_proc_percentage_uma_) &&
       system_context_->IsUserLoggedIn()) {
     MaybeProcEntries maybe_proc_entries =
         ReadProcesses(ProcessFilter::kNoKernelTasks);
     if (!maybe_proc_entries.has_value() ||
         maybe_proc_entries.value().size() == 0) {
       return;
     }

     if (!has_emitted_seccomp_coverage_uma_) {
       has_emitted_seccomp_coverage_uma_ =
           EmitSeccompCoverageUma(maybe_proc_entries.value());
     }

     if (!has_emitted_nnp_proc_percentage_uma_) {
       has_emitted_nnp_proc_percentage_uma_ =
           EmitNnpProcPercentageUma(maybe_proc_entries.value());
     }

     if (!has_emitted_nonroot_proc_percentage_uma_) {
       has_emitted_nonroot_proc_percentage_uma_ =
           EmitNonRootProcPercentageUma(maybe_proc_entries.value());
     }

     // For the rest of the metrics, we need to have the init process entry.
     if (!init_proc_) {
       return;
     }

     if (!has_emitted_unpriv_proc_percentage_uma_) {
       has_emitted_unpriv_proc_percentage_uma_ = EmitUnprivProcPercentageUma(
           maybe_proc_entries.value(), init_proc_.value().userns());
     }

     if (!has_emitted_non_initns_proc_percentage_uma_) {
       has_emitted_non_initns_proc_percentage_uma_ =
           EmitNonInitNsProcPercentageUma(maybe_proc_entries.value(),
                                          init_proc_.value().pidns(),
                                          init_proc_.value().mntns());
     }
   }
 }

 }  // namespace secanomalyd
	// Copyright 2021 The ChromiumOS Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "secanomalyd/daemon.h"

	#include <sys/types.h>
	#include <sysexits.h>

	#include <memory>
	#include <string>
	#include <string_view>

	#include <absl/strings/match.h>
	#include <base/command_line.h>
	#include <base/files/file_util.h>
	#include <base/files/file_path.h>
	#include <base/logging.h>
	#include <base/rand_util.h>
	#include <base/strings/string_split.h>
	#include <base/strings/string_util.h>
	#include <base/time/time.h>

	#include <brillo/process/process.h>
	#include <brillo/message_loops/message_loop.h>

	#include "secanomalyd/audit_log_reader.h"
	#include "secanomalyd/metrics.h"
	#include "secanomalyd/mount_entry.h"
	#include "secanomalyd/mounts.h"
	#include "secanomalyd/processes.h"
	#include "secanomalyd/reporter.h"
	#include "secanomalyd/system_context.h"

	namespace secanomalyd {

	namespace {

	// Sets the sampling frequency for W+X mount count uploads, such that the
	// systems with more W+X mounts are more likely to send a crash report, in
	// addition to limiting the total number of uploaded reports.
	constexpr int CalculateSampleFrequency(size_t wx_mount_count) {
	if (wx_mount_count <= 5)
	return 15;
	else if (wx_mount_count <= 10)
	return 10;
	else if (wx_mount_count <= 15)
	return 5;
	else
	return 2;
	}
	constexpr int kProcAnomalySampleFrequency = 10000000; // 10 million

	constexpr base::TimeDelta kScanInterval = base::Seconds(30);
	// Used to limit the total number of UMA reports.
	// Per Platform.DailyUseTime histogram this interval should ensure that enough
	// users run the reporting.
	constexpr base::TimeDelta kUmaReportInterval = base::Hours(2);

	// Generates a unique name for the next element being added to `set`, where the
	// element is a unique instance of a certain path type denoted by a `prefix`.
	// For example, unknown executable paths are recorded as:
	// {"unknown_executable_1", "unknown_executable_2", etc...}
	std::string GetNextUniquePath(const FilePaths& set, const std::string& prefix) {
	int num_common_elements = 0;
	for (base::FilePath element : set) {
	if (absl::StartsWith(element.value(), prefix))
	num_common_elements++;
	}
	return prefix + "_" + std::to_string(num_common_elements);
	}

	bool EmitSeccompCoverageUma(const ProcEntries& proc_entries) {
	size_t total_proc_count = proc_entries.size();
	size_t seccomp_proc_count = 0;
	seccomp_proc_count = std::count_if(
	proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
	return entry.sandbox_status()[ProcEntry::kSecCompBit] == 1;
	});
	unsigned int seccomp_proc_percentage =
	static_cast<unsigned int>(round((static_cast<float>(seccomp_proc_count) /
	static_cast<float>(total_proc_count)) *
	100));

	VLOG(1) << "Reporting SecComp coverage UMA metric";
	if (!SendSecCompCoverageToUMA(seccomp_proc_percentage)) {
	LOG(WARNING) << "Could not upload SecComp coverage UMA metric";
	return false;
	}
	return true;
	}

	bool EmitNnpProcPercentageUma(const ProcEntries& proc_entries) {
	size_t total_proc_count = proc_entries.size();
	size_t nnp_proc_count = 0;
	nnp_proc_count = std::count_if(
	proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
	return entry.sandbox_status()[ProcEntry::kNoNewPrivsBit] == 1;
	});
	unsigned int nnp_proc_percentage =
	static_cast<unsigned int>(round((static_cast<float>(nnp_proc_count) /
	static_cast<float>(total_proc_count)) *
	100));

	VLOG(1) << "Reporting no_new_privs process percentage UMA metric";
	if (!SendNnpProcPercentageToUMA(nnp_proc_percentage)) {
	LOG(WARNING)
	<< "Could not upload no_new_privs process percentage UMA metric";
	return false;
	}
	return true;
	}

	bool EmitNonRootProcPercentageUma(const ProcEntries& proc_entries) {
	size_t total_proc_count = proc_entries.size();
	size_t nonroot_proc_count = 0;
	nonroot_proc_count = std::count_if(
	proc_entries.begin(), proc_entries.end(), [](const ProcEntry& entry) {
	return entry.sandbox_status()[ProcEntry::kNonRootBit] == 1;
	});
	unsigned int nonroot_proc_percentage =
	static_cast<unsigned int>(round((static_cast<float>(nonroot_proc_count) /
	static_cast<float>(total_proc_count)) *
	100));

	VLOG(1) << "Reporting non-root process percentage UMA metric";
	if (!SendNonRootProcPercentageToUMA(nonroot_proc_percentage)) {
	LOG(WARNING) << "Could not upload non-root process percentage UMA metric";
	return false;
	}
	return true;
	}

	bool EmitUnprivProcPercentageUma(const ProcEntries& proc_entries,
	ino_t init_user_ns) {
	size_t total_proc_count = proc_entries.size();
	size_t unpriv_proc_count = 0;
	unpriv_proc_count = std::count_if(
	proc_entries.begin(), proc_entries.end(), [&](const ProcEntry& entry) {
	return entry.sandbox_status()[ProcEntry::kNonRootBit] == 1 &&
	(entry.sandbox_status()[ProcEntry::kNoCapSysAdminBit] == 1 \|\|
	entry.userns() != init_user_ns);
	});
	unsigned int unpriv_proc_percentage =
	static_cast<unsigned int>(round((static_cast<float>(unpriv_proc_count) /
	static_cast<float>(total_proc_count)) *
	100));

	VLOG(1) << "Reporting unpriv process percentage UMA metric";
	if (!SendUnprivProcPercentageToUMA(unpriv_proc_percentage)) {
	LOG(WARNING) << "Could not upload unpriv process percentage UMA metric";
	return false;
	}
	return true;
	}

	bool EmitNonInitNsProcPercentageUma(const ProcEntries& proc_entries,
	ino_t init_pid_ns,
	ino_t init_mnt_ns) {
	size_t total_proc_count = proc_entries.size();
	size_t non_initns_proc_count = 0;
	non_initns_proc_count = std::count_if(
	proc_entries.begin(), proc_entries.end(), [&](const ProcEntry& entry) {
	return entry.pidns() != init_pid_ns && entry.mntns() != init_mnt_ns;
	});
	unsigned int non_initns_proc_percentage = static_cast<unsigned int>(
	round((static_cast<float>(non_initns_proc_count) /
	static_cast<float>(total_proc_count)) *
	100));

	VLOG(1) << "Reporting non-init namespace process percentage UMA metric";
	if (!SendNonInitNsProcPercentageToUMA(non_initns_proc_percentage)) {
	LOG(WARNING)
	<< "Could not upload non-init namespace process percentage UMA metric";
	return false;
	}
	return true;
	}

	} // namespace

	int Daemon::OnInit() {
	// DBusDaemon::OnInit() initializes the D-Bus connection, making sure \|bus_\|
	// is populated.
	int ret = brillo::DBusDaemon::OnInit();
	if (ret != EX_OK) {
	return ret;
	}

	// Initializes the audit log reader for accessing the audit log file.
	InitAuditLogReader();

	session_manager_proxy_ = std::make_unique<SessionManagerProxy>(bus_);

	// The raw SessionManagerProxy pointer is un-owned by the SystemContext
	// object.
	system_context_ =
	std::make_unique<SystemContext>(session_manager_proxy_.get());

	return EX_OK;
	}

	int Daemon::OnEventLoopStarted() {
	ScanForAnomalies();
	ReportUmaMetrics();

	return EX_OK;
	}

	void Daemon::ScanForAnomalies() {
	VLOG(1) << "Scanning for W+X mounts";
	DoWXMountScan();
	VLOG(1) << "Scanning system processes";
	DoProcScan();
	VLOG(1) << "Scanning for audit log anomalies";
	DoAuditLogScan();

	if (generate_reports_) {
	DoAnomalousSystemReporting();
	}

	brillo::MessageLoop::current()->PostDelayedTask(
	FROM_HERE,
	base::BindOnce(&Daemon::ScanForAnomalies, base::Unretained(this)),
	kScanInterval);
	}

	void Daemon::ReportUmaMetrics() {
	if (!ShouldReport(dev_)) {
	return;
	}

	EmitWXMountCountUma();
	EmitForbiddenIntersectionProcCountUma();
	EmitMemfdExecProcCountUma();
	EmitSandboxingUma();

	brillo::MessageLoop::current()->PostDelayedTask(
	FROM_HERE,
	base::BindOnce(&Daemon::ReportUmaMetrics, base::Unretained(this)),
	kUmaReportInterval);
	}

	void Daemon::DoWXMountScan() {
	all_mounts_ = ReadMounts();
	if (!all_mounts_) {
	LOG(ERROR) << "Failed to read mounts";
	return;
	}

	// Refreshed on every check to have the most up-to-date state.
	system_context_->Refresh();

	for (const auto& e : all_mounts_.value()) {
	if (e.IsWX()) {
	// Have we seen the mount yet?
	if (wx_mounts_.count(e.dest()) == 0) {
	if (e.IsUsbDriveOrArchive()) {
	// Figure out what to log in this case.
	// We could log the fact that the mount exists without logging
	// \|src\| or \|dest\|.
	continue;
	}

	if (e.IsNamespaceBindMount() \|\| e.IsKnownMount(*system_context_)) {
	// Namespace mounts happen when a namespace file in /proc/<pid>/ns/
	// gets bind-mounted somewhere else. These mounts can be W+X but are
	// not concerning since they consist of a single file and these files
	// cannot be executed.
	// There are other W+X mounts that are low-risk (e.g. non-persistent
	// mounts) and that we're in the process of fixing. These are
	// considered "known" W+X mounts and are also skipped.
	VLOG(1) << "Not recording W+X mount at '" << e.dest() << "', type "
	<< e.type();
	// In case of a known mount, we need to update the context to remember
	// that this mount was observed, as we might use this information to
	// determine whether it should be ignored again in the future scans.
	system_context_->RecordKnownMountObservation(e.dest());
	continue;
	}

	// We haven't seen the mount, and it's not a type we want to skip, so
	// save it.
	wx_mounts_[e.dest()] = e;
	VLOG(1) << "Found W+X mount at '" << e.dest() << "', type " << e.type();
	VLOG(1) << "\|wx_mounts_.size()\| = " << wx_mounts_.size();

	// Report metrics on the mount, if not running in dev mode.
	if (ShouldReport(dev_)) {
	// Report /usr/local mounts separately because those can indicate
	// systems where \|cros_debug == 0\| but the system is still a dev
	// system.
	SecurityAnomaly mount_anomaly =
	e.IsDestInUsrLocal()
	? SecurityAnomaly::kMount_InitNs_WxInUsrLocal
	: SecurityAnomaly::kMount_InitNs_WxNotInUsrLocal;
	if (!SendSecurityAnomalyToUMA(mount_anomaly)) {
	LOG(WARNING) << "Could not upload metrics";
	}
	}
	}
	}
	}
	}

	void Daemon::DoProcScan() {
	all_procs_ = ReadProcesses(ProcessFilter::kAll);
	if (!all_procs_) {
	return;
	}
	if (!init_proc_) {
	init_proc_ = GetInitProcEntry(all_procs_.value());
	}
	if (!init_proc_) {
	return;
	}

	ProcEntries procs;
	FilterKernelProcesses(all_procs_.value(), procs);

	ProcEntries flagged_procs;
	std::copy_if(procs.begin(), procs.end(), std::back_inserter(flagged_procs),
	[&](const ProcEntry& e) {
	return IsProcInForbiddenIntersection(e, init_proc_.value());
	});

	forbidden_intersection_procs_ = MaybeProcEntries(flagged_procs);
	if (forbidden_intersection_procs_) {
	VLOG(1) << "\|forbidden_intersection_procs_.size()\| = "
	<< forbidden_intersection_procs_->size();
	}
	}

	void Daemon::DoAnomalousSystemReporting() {
	// Skip reporting if for all anomaly types either the daemon has previously
	// attempted to send a report or the anomaly does not exist.
	if ((has_attempted_wx_mount_report_ \|\| wx_mounts_.empty()) &&
	(has_attempted_forbidden_intersection_report_ \|\|
	forbidden_intersection_procs_.value().empty()) &&
	(has_attempted_memfd_exec_report_ \|\|
	executables_attempting_memfd_exec_.empty())) {
	return;
	}

	// Makes checking for this anomaly type easier.
	ProcEntries anomalous_procs = forbidden_intersection_procs_
	? forbidden_intersection_procs_.value()
	: ProcEntries();

	// Stop subsequent reporting attempts for each discovered anomaly type.
	if (!wx_mounts_.empty()) {
	has_attempted_wx_mount_report_ = true;
	}
	if (!anomalous_procs.empty()) {
	has_attempted_forbidden_intersection_report_ = true;
	}
	if (!executables_attempting_memfd_exec_.empty()) {
	has_attempted_memfd_exec_report_ = true;
	}

	if (!ShouldReport(dev_)) {
	VLOG(1) << "Not reporting anomalous system due to dev mode";
	return;
	}
	VLOG(1) << "Attempting to report anomalous system";

	int range = 0;
	int weight = 1;
	// If \|dev_\| is set or there are memfd execution attempts, always send the
	// report (memfd execution attempts are exceedingly rare so we can afford to
	// upload them all). Otherwise, if W+X anomalies exist, send one in every
	// \|CalculateSampleFrequency(wx_mounts_.size())\| reports. Finally, if only
	// forbidden intersection violations exist, send one in every
	// \|kProcAnomalySampleFrequency\| reports.
	if (dev_ \|\| !executables_attempting_memfd_exec_.empty()) {
	range = 1;
	} else if (!wx_mounts_.empty()) {
	range = CalculateSampleFrequency(wx_mounts_.size());
	weight = range;
	} else if (!anomalous_procs.empty() && forbidden_intersection_only_reports_) {
	range = kProcAnomalySampleFrequency;
	}

	// \|base::RandInt(min, max)\| returns a random int between [min, max], which in
	// this case gives the report one in \|range\| chance of being sent.
	if (range < 1 \|\| base::RandInt(1, range) > 1) {
	return;
	}

	bool success = ReportAnomalousSystem(wx_mounts_, anomalous_procs,
	executables_attempting_memfd_exec_,
	all_mounts_, all_procs_, weight, dev_);
	if (!success) {
	// Reporting is best-effort so on failure we just print a warning.
	LOG(WARNING) << "Failed to report anomalous system";
	}

	// Report whether uploading the anomalous system report succeeded.
	if (!SendAnomalyUploadResultToUMA(success)) {
	LOG(WARNING) << "Could not upload metrics";
	}
	}

	void Daemon::InitAuditLogReader() {
	audit_log_reader_ = std::make_unique<AuditLogReader>(kAuditLogPath);
	}

	void Daemon::DoAuditLogScan() {
	if (!audit_log_reader_)
	return;

	std::string log_message;
	LogRecord log_record;

	while (audit_log_reader_->GetNextEntry(&log_record)) {
	// This detects a successful memfd_create syscall and reports it to UMA to
	// be used as the baseline metric for memfd execution attempts. The check
	// will not be performed again, once the metric is successfully emitted.
	if (!has_emitted_memfd_baseline_uma_ &&
	log_record.tag == kSyscallRecordTag &&
	secanomalyd::IsMemfdCreate(log_record.message)) {
	// Report baseline condition to UMA if not in dev mode.
	if (ShouldReport(dev_)) {
	if (!SendSecurityAnomalyToUMA(
	SecurityAnomaly::kSuccessfulMemfdCreateSyscall)) {
	LOG(WARNING) << "Could not upload metrics";
	} else {
	has_emitted_memfd_baseline_uma_ = true;
	}
	}
	}
	std::string exe_path;
	if (log_record.tag == kAVCRecordTag &&
	secanomalyd::IsMemfdExecutionAttempt(log_record.message, exe_path)) {
	if (exe_path == secanomalyd::kUnknownExePath) {
	exe_path = GetNextUniquePath(executables_attempting_memfd_exec_,
	secanomalyd::kUnknownExePath);
	}
	// Record the anomaly by adding the offending executable path to
	// \|executables_attempting_memfd_exec_\| set.
	executables_attempting_memfd_exec_.insert(base::FilePath(exe_path));
	VLOG(1) << log_record.message;
	VLOG(1) << "\|executables_attempting_memfd_exec_.size()\| = "
	<< executables_attempting_memfd_exec_.size();
	// Report anomalous condition to UMA if not in dev mode.
	if (ShouldReport(dev_)) {
	if (!SendSecurityAnomalyToUMA(
	SecurityAnomaly::kBlockedMemoryFileExecAttempt))
	LOG(WARNING) << "Could not upload metrics";
	}
	}
	}
	}

	void Daemon::EmitWXMountCountUma() {
	VLOG(1) << "Reporting W+X mount count UMA metric";
	if (SendWXMountCountToUMA(wx_mounts_.size())) {
	// After successfully reporting W+X mount count, clear the map.
	// If mounts still exist they'll be re-added on the next scan.
	wx_mounts_.clear();
	} else {
	LOG(WARNING) << "Could not upload W+X mount count UMA metric";
	}
	}

	void Daemon::EmitForbiddenIntersectionProcCountUma() {
	// Skip if already emitted or \|forbidden_intersection_procs_\| has not yet been
	// populated.
	if (has_emitted_forbidden_intersection_uma_ \|\|
	!forbidden_intersection_procs_) {
	return;
	}
	// Only report forbidden intersection process count in the logged-in state.
	system_context_->Refresh(/skip_known_mount_refresh=/true);
	if (!system_context_->IsUserLoggedIn()) {
	return;
	}
	VLOG(1) << "Reporting forbidden intersection process count UMA metric";
	if (!SendForbiddenIntersectionProcCountToUMA(
	forbidden_intersection_procs_->size())) {
	LOG(WARNING)
	<< "Could not upload forbidden intersection process count UMA metric";
	}
	}

	void Daemon::EmitMemfdExecProcCountUma() {
	VLOG(1) << "Reporting memfd exec process count UMA metric";
	if (SendAttemptedMemfdExecProcCountToUMA(
	executables_attempting_memfd_exec_.size())) {
	// After successfully reporting process count, clear the set. If the same
	// processes attempt memfd executions again, they will be re-added to the
	// set.
	executables_attempting_memfd_exec_.clear();
	} else {
	LOG(WARNING) << "Could not upload memfd exec process count UMA metric";
	}
	}

	void Daemon::EmitSandboxingUma() {
	if (!has_emitted_landlock_status_uma_) {
	VLOG(1) << "Reporting Landlock status UMA metric";
	// If landlock is in any other state than enabled, such as not supported or
	// an unknown state, we consider it disabled.
	if (!SendLandlockStatusToUMA(system_context_->GetLandlockState() ==
	LandlockState::kEnabled)) {
	LOG(WARNING) << "Could not upload Landlock status UMA metric";
	} else {
	has_emitted_landlock_status_uma_ = true;
	}
	}

	// Refresh the login state.
	system_context_->Refresh(/skip_known_mount_refresh=/true);

	if ((!has_emitted_seccomp_coverage_uma_ \|\|
	!has_emitted_nonroot_proc_percentage_uma_ \|\|
	!has_emitted_unpriv_proc_percentage_uma_) &&
	system_context_->IsUserLoggedIn()) {
	MaybeProcEntries maybe_proc_entries =
	ReadProcesses(ProcessFilter::kNoKernelTasks);
	if (!maybe_proc_entries.has_value() \|\|
	maybe_proc_entries.value().size() == 0) {
	return;
	}

	if (!has_emitted_seccomp_coverage_uma_) {
	has_emitted_seccomp_coverage_uma_ =
	EmitSeccompCoverageUma(maybe_proc_entries.value());
	}

	if (!has_emitted_nnp_proc_percentage_uma_) {
	has_emitted_nnp_proc_percentage_uma_ =
	EmitNnpProcPercentageUma(maybe_proc_entries.value());
	}

	if (!has_emitted_nonroot_proc_percentage_uma_) {
	has_emitted_nonroot_proc_percentage_uma_ =
	EmitNonRootProcPercentageUma(maybe_proc_entries.value());
	}

	// For the rest of the metrics, we need to have the init process entry.
	if (!init_proc_) {
	return;
	}

	if (!has_emitted_unpriv_proc_percentage_uma_) {
	has_emitted_unpriv_proc_percentage_uma_ = EmitUnprivProcPercentageUma(
	maybe_proc_entries.value(), init_proc_.value().userns());
	}

	if (!has_emitted_non_initns_proc_percentage_uma_) {
	has_emitted_non_initns_proc_percentage_uma_ =
	EmitNonInitNsProcPercentageUma(maybe_proc_entries.value(),
	init_proc_.value().pidns(),
	init_proc_.value().mntns());
	}
	}
	}

	} // namespace secanomalyd