git.saurik.com Git - apple/libsecurity_codesigning.git/blob

1 /*

3 *

4 * @APPLE_LICENSE_HEADER_START@

5 *

6 * This file contains Original Code and/or Modifications of Original Code

7 * as defined in and that are subject to the Apple Public Source License

8 * Version 2.0 (the 'License'). You may not use this file except in

9 * compliance with the License. Please obtain a copy of the License at

10 * http://www.opensource.apple.com/apsl/ and read it before using this

11 * file.

12 *

13 * The Original Code and all software distributed under the License are

14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER

15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,

16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,

17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.

18 * Please see the License for the specific language governing rights and

19 * limitations under the License.

20 *

21 * @APPLE_LICENSE_HEADER_END@

22 */

24 //

25 // SecCode - API frame for SecCode objects.

26 //

27 // Note that some SecCode* functions take SecStaticCodeRef arguments in order to

28 // accept either static or dynamic code references, operating on the respective

29 // StaticCode. Those functions are in SecStaticCode.cpp, not here, despite their name.

30 //

31 #include "cs.h"

32 #include "Code.h"

33 #include "cskernel.h"

34 #include <security_utilities/cfmunge.h>

36 using namespace CodeSigning;

39 //

40 // CFError user info keys

41 //

 const CFStringRef kSecCFErrorArchitecture =             CFSTR("SecCSArchitecture");

 const CFStringRef kSecCFErrorPattern =                  CFSTR("SecCSPattern");

 const CFStringRef kSecCFErrorResourceSeal =             CFSTR("SecCSResourceSeal");

 const CFStringRef kSecCFErrorResourceAdded =            CFSTR("SecCSResourceAdded");

 const CFStringRef kSecCFErrorResourceAltered =  CFSTR("SecCSResourceAltered");

 const CFStringRef kSecCFErrorResourceMissing =  CFSTR("SecCSResourceMissing");

 const CFStringRef kSecCFErrorInfoPlist =                        CFSTR("SecCSInfoPlist");

 const CFStringRef kSecCFErrorGuestAttributes =  CFSTR("SecCSGuestAttributes");

 const CFStringRef kSecCFErrorRequirementSyntax = CFSTR("SecRequirementSyntax");

 const CFStringRef kSecCFErrorPath =                             CFSTR("SecComponentPath");

54 //

55 // CF-standard type code functions

56 //

57 CFTypeID SecCodeGetTypeID(void)

58 {

59 BEGIN_CSAPI

         return gCFObjects().Code.typeID;

61 END_CSAPI1(_kCFRuntimeNotATypeID)

62 }

65 //

66 // Get a reference to the calling code.

67 //

 OSStatus SecCodeCopySelf(SecCSFlags flags, SecCodeRef *selfRef)

69 {

70 BEGIN_CSAPI

72 checkFlags(flags);

         CFRef<CFMutableDictionaryRef> attributes = makeCFMutableDictionary(1,

                 kSecGuestAttributePid, CFTempNumber(getpid()).get());

         CodeSigning::Required(selfRef) = SecCode::autoLocateGuest(attributes, flags)->handle(false);

77 END_CSAPI

78 }

81 //

82 // Get the dynamic status of a code.

83 //

 OSStatus SecCodeGetStatus(SecCodeRef codeRef, SecCSFlags flags, SecCodeStatus *status)

85 {

86 BEGIN_CSAPI

88 checkFlags(flags);

         CodeSigning::Required(status) = SecCode::required(codeRef)->status();

91 END_CSAPI

92 }

95 //

96 // Change the dynamic status of a code

97 //

98 OSStatus SecCodeSetStatus(SecCodeRef codeRef, SecCodeStatusOperation operation,

99 CFDictionaryRef arguments, SecCSFlags flags)

100 {

101 BEGIN_CSAPI

102

103 checkFlags(flags);

         SecCode::required(codeRef)->status(operation, arguments);

105

106 END_CSAPI

107 }

108

109

110 //

111 // Get the StaticCode for an Code

112 //

 OSStatus SecCodeCopyStaticCode(SecCodeRef codeRef, SecCSFlags flags, SecStaticCodeRef *staticCodeRef)

114 {

115 BEGIN_CSAPI

116

117 checkFlags(flags);

         SecPointer<SecStaticCode> staticCode = SecCode::required(codeRef)->staticCode();

         CodeSigning::Required(staticCodeRef) = staticCode ? staticCode->handle() : NULL;

120

121 END_CSAPI

122 }

123

124

125 //

126 // Get the host for an Code

127 //

 OSStatus SecCodeCopyHost(SecCodeRef guestRef, SecCSFlags flags, SecCodeRef *hostRef)

129 {

130 BEGIN_CSAPI

131

132 checkFlags(flags);

         SecPointer<SecCode> host = SecCode::required(guestRef)->host();

         CodeSigning::Required(hostRef) = host ? host->handle() : NULL;

135

136 END_CSAPI

137 }

138

139

140 //

141 // Find a guest by attribute(s)

142 //

 const CFStringRef kSecGuestAttributeCanonical =         CFSTR("canonical");

 const CFStringRef kSecGuestAttributeHash =                      CFSTR("codedirectory-hash");

 const CFStringRef kSecGuestAttributeMachPort =          CFSTR("mach-port");

 const CFStringRef kSecGuestAttributePid =                       CFSTR("pid");

 const CFStringRef kSecGuestAttributeArchitecture =      CFSTR("architecture");

 const CFStringRef kSecGuestAttributeSubarchitecture = CFSTR("subarchitecture");

149

150 OSStatus SecCodeCopyGuestWithAttributes(SecCodeRef hostRef,

151 CFDictionaryRef attributes, SecCSFlags flags, SecCodeRef *guestRef)

152 {

153 BEGIN_CSAPI

154

155 checkFlags(flags);

156 if (hostRef) {

                 if (SecCode *guest = SecCode::required(hostRef)->locateGuest(attributes))

                         CodeSigning::Required(guestRef) = guest->handle(false);

159 else

160 return errSecCSNoSuchCode;

161 } else

                 CodeSigning::Required(guestRef) = SecCode::autoLocateGuest(attributes, flags)->handle(false);

163

164 END_CSAPI

165 }

166

167

168 //

169 // Shorthand for getting the SecCodeRef for a UNIX process

170 //

 OSStatus SecCodeCreateWithPID(pid_t pid, SecCSFlags flags, SecCodeRef *processRef)

172 {

173 BEGIN_CSAPI

174

175 checkFlags(flags);

         if (SecCode *guest = KernelCode::active()->locateGuest(CFTemp<CFDictionaryRef>("{%O=%d}", kSecGuestAttributePid, pid)))

                 CodeSigning::Required(processRef) = guest->handle(false);

178 else

179 return errSecCSNoSuchCode;

180

181 END_CSAPI

182 }

183

184

185 //

186 // Check validity of an Code

187 //

188 OSStatus SecCodeCheckValidity(SecCodeRef codeRef, SecCSFlags flags,

189 SecRequirementRef requirementRef)

190 {

         return SecCodeCheckValidityWithErrors(codeRef, flags, requirementRef, NULL);

192 }

193

194 OSStatus SecCodeCheckValidityWithErrors(SecCodeRef codeRef, SecCSFlags flags,

195 SecRequirementRef requirementRef, CFErrorRef *errors)

196 {

197 BEGIN_CSAPI

198

199 checkFlags(flags,

200 kSecCSConsiderExpiration

201 | kSecCSEnforceRevocationChecks);

         SecPointer<SecCode> code = SecCode::required(codeRef);

203 code->checkValidity(flags);

         if (const SecRequirement *req = SecRequirement::optional(requirementRef))

                 code->staticCode()->validateRequirement(req->requirement(), errSecCSReqFailed);

206

207 END_CSAPI_ERRORS

208 }

209

210

211 //

212 // Collect suitably laundered information about the code signature of a SecStaticCode

213 // and return it as a CFDictionary.

214 //

215 // This API contracts to return a few pieces of information even for unsigned

216 // code. This means that a SecStaticCodeRef is usable as a basic indentifier

217 // (i.e. handle) for any code out there.

218 //

 const CFStringRef kSecCodeInfoCertificates =    CFSTR("certificates");

 const CFStringRef kSecCodeInfoChangedFiles =    CFSTR("changed-files");

 const CFStringRef kSecCodeInfoCMS =                             CFSTR("cms");

 const CFStringRef kSecCodeInfoDesignatedRequirement = CFSTR("designated-requirement");

 const CFStringRef kSecCodeInfoEntitlements =    CFSTR("entitlements");

 const CFStringRef kSecCodeInfoEntitlementsDict =        CFSTR("entitlements-dict");

 const CFStringRef kSecCodeInfoFormat =                  CFSTR("format");

 const CFStringRef kSecCodeInfoDigestAlgorithm = CFSTR("digest-algorithm");

 const CFStringRef kSecCodeInfoIdentifier =              CFSTR("identifier");

 const CFStringRef kSecCodeInfoImplicitDesignatedRequirement = CFSTR("implicit-requirement");

 const CFStringRef kSecCodeInfoMainExecutable =  CFSTR("main-executable");

 const CFStringRef kSecCodeInfoPList =                   CFSTR("info-plist");

 const CFStringRef kSecCodeInfoRequirements =    CFSTR("requirements");

 const CFStringRef kSecCodeInfoRequirementData = CFSTR("requirement-data");

 const CFStringRef kSecCodeInfoSource =                  CFSTR("source");

 const CFStringRef kSecCodeInfoStatus =                  CFSTR("status");

 const CFStringRef kSecCodeInfoTime =                    CFSTR("signing-time");

 const CFStringRef kSecCodeInfoTimestamp =               CFSTR("signing-timestamp");

 const CFStringRef kSecCodeInfoTrust =                   CFSTR("trust");

 const CFStringRef kSecCodeInfoUnique =                  CFSTR("unique");

239

 const CFStringRef kSecCodeInfoCodeDirectory =   CFSTR("CodeDirectory");

 const CFStringRef kSecCodeInfoCodeOffset =              CFSTR("CodeOffset");

 const CFStringRef kSecCodeInfoResourceDirectory = CFSTR("ResourceDirectory");

243

244

245 OSStatus SecCodeCopySigningInformation(SecStaticCodeRef codeRef, SecCSFlags flags,

246 CFDictionaryRef *infoRef)

247 {

248 BEGIN_CSAPI

249

250 checkFlags(flags,

251 kSecCSInternalInformation

252 | kSecCSSigningInformation

253 | kSecCSRequirementInformation

254 | kSecCSDynamicInformation

255 | kSecCSContentInformation);

256

         SecPointer<SecStaticCode> code = SecStaticCode::requiredStatic(codeRef);

         CFRef<CFDictionaryRef> info = code->signingInformation(flags);

259

260 if (flags & kSecCSDynamicInformation)

                 if (SecPointer<SecCode> dcode = SecStaticCode::optionalDynamic(codeRef))

                         info.take(cfmake<CFDictionaryRef>("{+%O,%O=%u}", info.get(), kSecCodeInfoStatus, dcode->status()));

263

         CodeSigning::Required(infoRef) = info.yield();

265

266 END_CSAPI

267 }

268