Implement anonymous, opt-in, collection of OS X binary integrity incidents.

chrome/common/safe_browsing/csd.proto

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Client side phishing and malware detection request and response
 // protocol buffers.  Those protocol messages should be kept in sync
 // with the server implementation.
 //
 // If you want to change this protocol definition or you have questions
 // regarding its format please contact chrome-anti-phishing@googlegroups.com.
@@ skipping 190 matching lines @@
   message CertificateChain {
     // A single link in the chain.
     message Element {
       // DER-encoded X.509 representation of the certificate.
       optional bytes certificate = 1;
       // Fields 2 - 7 are only used on the server.
     }
     repeated Element element = 1;
   }
 
+  message ExtendedAttr {
+    // This is the name of the extended attribute.
+    required string key = 1;
+    // This is the value of the extended attribute.
+    optional bytes value = 2;
+  }
+
   message SignatureInfo {
     // All certificate chains for each of the binary's signers.  Multiple chains
     // may be present if the binary or any certificate has multiple signers.
     // Absence of certificate chains does not imply that the binary is not
     // signed (in that case, SignedData blobs extracted from the binary may be
     // preset), but does mean that trust has not been verified.
     repeated CertificateChain certificate_chain = 1;
 
     // True if the signature was trusted on the client.
     optional bool trusted = 2;
 
     // On Windows, PKCS#7 SignedData blobs extracted from a portable executable
     // image's attribute certificate table. The presence of these does not imply
     // that the signatures were deemed trusted by the client.
     // On Mac, this is the code signature blob referenced by the
     // LC_CODE_SIGNATURE load command.
     repeated bytes signed_data = 3;
+
+    // On OS X, code signing data can be contained in the extended attributes of
+    // a file. As GateKeeper respects this signature, we look for it and collect
+    // it.
+    repeated ExtendedAttr xattr = 4;
   }
 
   // This field will only be set if the binary is signed.
   optional SignatureInfo signature = 5;
 
   // True if the download was user initiated.
   optional bool user_initiated = 6;
 
   // Fields 7 and 8 are only used on the server.
 
@@ skipping 176 matching lines @@
         WEAK_LEGACY_OBSOLETE = 2;
         CHANGED = 3;
         UNTRUSTED_UNKNOWN_VALUE = 4;
       }
 
       optional string path = 1;
       optional string atomic_value = 2;
       repeated string split_key = 3;
       optional ValueState value_state = 4;
     }
+
     message BinaryIntegrityIncident {
       optional string file_basename = 1;
       optional ClientDownloadRequest.SignatureInfo signature = 2;
+      optional ClientDownloadRequest.ImageHeaders image_headers = 3;
     }
+
+    message OSXBinaryIntegrityIncident {
+      optional string file_basename = 1;
+      optional int32 sec_error = 2;
+      repeated BinaryIntegrityIncident sub_incident = 3;
+    }
+
     message BlacklistLoadIncident {
       optional string path = 1;
       optional ClientDownloadRequest.Digests digest = 2;
       optional string version = 3;
       optional bool blacklist_initialized = 4;
       optional ClientDownloadRequest.SignatureInfo signature = 5;
       optional ClientDownloadRequest.ImageHeaders image_headers = 6;
     }
     message VariationsSeedSignatureIncident {
       optional string variations_seed_signature = 1;
     }
     message ResourceRequestIncident {
       enum Type {
         UNKNOWN = 0;
         TYPE_SCRIPT = 1;
         TYPE_DOMAIN = 2;
       }
       optional bytes digest = 1;
       optional string origin = 2;
       optional Type type = 3 [default = UNKNOWN];
     }
     optional int64 incident_time_msec = 1;
     optional TrackedPreferenceIncident tracked_preference = 2;
     optional BinaryIntegrityIncident binary_integrity = 3;
     optional BlacklistLoadIncident blacklist_load = 4;
     // Note: skip tag 5 because it was previously used.
     optional VariationsSeedSignatureIncident variations_seed_signature = 6;
     optional ResourceRequestIncident resource_request = 7;
+    optional OSXBinaryIntegrityIncident osx_incident = 8;
   }
 
   repeated IncidentData incident = 1;
 
   message DownloadDetails {
     optional bytes token = 1;
     optional ClientDownloadRequest download = 2;
     optional int64 download_time_msec = 3;
     optional int64 open_time_msec = 4;
   }
@@ skipping 97 matching lines @@
   message EnvironmentRequest { optional int32 dll_index = 1; }
 
   repeated EnvironmentRequest environment_requests = 3;
 }
 
 message DownloadMetadata {
   optional uint32 download_id = 1;
 
   optional ClientIncidentReport.DownloadDetails download = 2;
 }