whitelist.py

"""
whitelist.py - Whitelist Management Module
==========================================
Manages the list of trusted/safe processes that should not be flagged
as suspicious. Supports loading, saving, and modifying the whitelist
stored in a JSON file.
"""

import json
import os
from pathlib import Path
from typing import Set, List


# ─── Default whitelist of known-safe processes ─────────────────────────────
DEFAULT_WHITELIST: List[str] = [
    # Windows system processes
    "system", "system idle process", "registry", "smss.exe", "csrss.exe",
    "wininit.exe", "winlogon.exe", "services.exe", "lsass.exe", "svchost.exe",
    "dwm.exe", "explorer.exe", "taskhost.exe", "taskhostw.exe", "sihost.exe",
    "ctfmon.exe", "dllhost.exe", "conhost.exe", "runtimebroker.exe",
    "securityhealthservice.exe", "spoolsv.exe", "wuauclt.exe",
    "fontdrvhost.exe", "audiodg.exe", "msdtc.exe", "searchindexer.exe",
    "searchhost.exe", "startmenuexperiencehost.exe", "shellexperiencehost.exe",
    "applicationframehost.exe", "textinputhost.exe", "useroobebroker.exe",
    "wmiprvse.exe", "unsecapp.exe", "wmiapsrv.exe", "wlanext.exe",
    "dashost.exe", "sgrmbroker.exe", "microsoftedgeupdate.exe",
    # Web browsers
    "chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe",
    "brave.exe", "opera.exe", "vivaldi.exe", "chromium.exe",
    "safari.exe",
    # Development tools
    "python.exe", "python3.exe", "pythonw.exe", "py.exe",
    "node.exe", "npm.exe", "npx.exe",
    "code.exe", "code - insiders.exe", "vscodium.exe",
    "devenv.exe", "idea64.exe", "pycharm64.exe", "webstorm64.exe",
    "git.exe", "git-bash.exe", "bash.exe", "zsh", "fish",
    "cmd.exe", "powershell.exe", "pwsh.exe", "wt.exe",
    "windowsterminal.exe", "mintty.exe", "conemu.exe", "conemu64.exe",
    # Linux / macOS common processes
    "bash", "zsh", "fish", "sh", "dash", "ksh",
    "systemd", "init", "kernel", "kthreadd", "ksoftirqd",
    "kworker", "kswapd", "migration", "rcu_sched",
    "dbus-daemon", "networkmanager", "wpa_supplicant",
    "pulseaudio", "pipewire", "pipewire-pulse",
    "gnome-shell", "xorg", "wayland", "plasmashell",
    "nautilus", "dolphin", "thunar",
    "python3", "python", "pip", "pip3",
    "apt", "apt-get", "dpkg", "snap", "flatpak", "pacman", "yum", "dnf",
    "ssh", "sshd", "scp", "sftp",
    "cron", "crond", "atd",
    "rsyslog", "journald", "systemd-journald",
    "nginx", "apache2", "httpd", "mysqld", "postgres", "redis-server",
    # Office and productivity
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "onenote.exe", "teams.exe", "slack.exe", "zoom.exe",
    "discord.exe", "telegram.exe", "signal.exe",
    "libreoffice.exe", "soffice.exe",
    # Security and antivirus
    "msmpeng.exe", "nissrv.exe", "msseces.exe", "avgsvc.exe",
    "avgui.exe", "avguix.exe", "avastui.exe", "avastsvc.exe",
    "mbam.exe", "mbamservice.exe", "mbamtray.exe",
    # System utilities
    "taskmgr.exe", "mmc.exe", "regedit.exe", "regsvr32.exe",
    "msiexec.exe", "wusa.exe", "wevtutil.exe", "eventvwr.exe",
    "perfmon.exe", "resmon.exe", "compmgmt.exe", "devmgmt.exe",
    "diskmgmt.exe", "dfrgui.exe", "chkdsk.exe", "sfc.exe",
    "notepad.exe", "calc.exe", "mspaint.exe", "wordpad.exe",
    "snippingtool.exe", "screensketch.exe",
    # Media
    "vlc.exe", "wmplayer.exe", "groove.exe", "spotify.exe",
    "itunes.exe", "musicbee.exe",
]


# ─── File path for persisting the whitelist ────────────────────────────────
WHITELIST_FILE = Path(__file__).parent / "whitelist.json"


class WhitelistManager:
    """
    Manages the process whitelist. Loads from JSON on startup,
    allows additions/removals at runtime, and saves back to disk.
    """

    def __init__(self, filepath: Path = WHITELIST_FILE):
        self.filepath = filepath
        self._whitelist: Set[str] = set()
        self.load()

    # ── Internal helpers ───────────────────────────────────────────────────

    def _normalize(self, name: str) -> str:
        """Convert a process name to lowercase for case-insensitive matching."""
        return name.strip().lower()

    # ── Public API ────────────────────────────────────────────────────────

    def load(self) -> None:
        """
        Load the whitelist from the JSON file.
        If the file does not exist, populate it with the default list.
        """
        if self.filepath.exists():
            try:
                with open(self.filepath, "r", encoding="utf-8") as f:
                    data = json.load(f)
                self._whitelist = {self._normalize(p) for p in data.get("whitelist", [])}
                print(f"[INFO] Whitelist loaded: {len(self._whitelist)} entries from {self.filepath}")
            except (json.JSONDecodeError, IOError) as exc:
                print(f"[WARNING] Could not read whitelist file ({exc}). Using defaults.")
                self._whitelist = {self._normalize(p) for p in DEFAULT_WHITELIST}
                self.save()
        else:
            print("[INFO] No whitelist file found. Creating default whitelist.")
            self._whitelist = {self._normalize(p) for p in DEFAULT_WHITELIST}
            self.save()

    def save(self) -> None:
        """Persist the current whitelist to the JSON file."""
        try:
            data = {"whitelist": sorted(self._whitelist)}
            with open(self.filepath, "w", encoding="utf-8") as f:
                json.dump(data, f, indent=2)
        except IOError as exc:
            print(f"[ERROR] Could not save whitelist: {exc}")

    def is_safe(self, process_name: str) -> bool:
        """Return True if the process name is in the whitelist."""
        return self._normalize(process_name) in self._whitelist

    def add(self, process_name: str) -> bool:
        """
        Add a process to the whitelist.
        Returns True if newly added, False if it was already present.
        """
        key = self._normalize(process_name)
        if key in self._whitelist:
            print(f"[INFO] '{process_name}' is already in the whitelist.")
            return False
        self._whitelist.add(key)
        self.save()
        print(f"[INFO] '{process_name}' added to whitelist.")
        return True

    def remove(self, process_name: str) -> bool:
        """
        Remove a process from the whitelist.
        Returns True if removed, False if it was not found.
        """
        key = self._normalize(process_name)
        if key not in self._whitelist:
            print(f"[WARNING] '{process_name}' not found in whitelist.")
            return False
        self._whitelist.discard(key)
        self.save()
        print(f"[INFO] '{process_name}' removed from whitelist.")
        return True

    def list_all(self) -> List[str]:
        """Return a sorted list of all whitelisted process names."""
        return sorted(self._whitelist)

    def __len__(self) -> int:
        return len(self._whitelist)

    def __contains__(self, process_name: str) -> bool:
        return self.is_safe(process_name)