git.saurik.com Git - apple/libsecurity_codesigning.git/blob

1 /*

3 *

4 * @APPLE_LICENSE_HEADER_START@

5 *

6 * This file contains Original Code and/or Modifications of Original Code

7 * as defined in and that are subject to the Apple Public Source License

8 * Version 2.0 (the 'License'). You may not use this file except in

9 * compliance with the License. Please obtain a copy of the License at

10 * http://www.opensource.apple.com/apsl/ and read it before using this

11 * file.

12 *

13 * The Original Code and all software distributed under the License are

14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER

15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,

16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,

17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.

18 * Please see the License for the specific language governing rights and

19 * limitations under the License.

20 *

21 * @APPLE_LICENSE_HEADER_END@

22 */

23 #include "cs.h"

24 #include "policydb.h"

25 #include "policyengine.h"

26 #include <Security/CodeSigning.h>

27 #include <security_utilities/cfutilities.h>

28 #include <security_utilities/cfmunge.h>

29 #include <security_utilities/blob.h>

30 #include <security_utilities/logging.h>

31 #include <security_utilities/simpleprefs.h>

32 #include <security_utilities/logging.h>

33 #include "csdatabase.h"

35 #include <dispatch/dispatch.h>

36 #include <sys/types.h>

37 #include <sys/stat.h>

38 #include <notify.h>

40 namespace Security {

41 namespace CodeSigning {

44 using namespace SQLite;

47 //

48 // Determine the database path

49 //

50 static const char *dbPath()

51 {

         if (const char *s = getenv("SYSPOLICYDATABASE"))

53 return s;

54 return defaultDatabase;

55 }

58 //

59 // Help mapping API-ish CFString keys to more convenient internal enumerations

60 //

61 typedef struct {

62 const CFStringRef &cstring;

63 uint enumeration;

64 } StringMap;

 static uint mapEnum(CFDictionaryRef context, CFStringRef attr, const StringMap *map, uint value = 0)

67 {

68 if (context)

                 if (CFTypeRef value = CFDictionaryGetValue(context, attr))

                         for (const StringMap *mp = map; mp->cstring; ++mp)

                                 if (CFEqual(mp->cstring, value))

72 return mp->enumeration;

73 return value;

74 }

76 static const StringMap mapType[] = {

77 { kSecAssessmentOperationTypeExecute, kAuthorityExecute },

78 { kSecAssessmentOperationTypeInstall, kAuthorityInstall },

79 { kSecAssessmentOperationTypeOpenDocument, kAuthorityOpenDoc },

80 { NULL }

81 };

 AuthorityType typeFor(CFDictionaryRef context, AuthorityType type /* = kAuthorityInvalid */)

84 {

         return mapEnum(context, kSecAssessmentContextKeyOperation, mapType, type);

86 }

88 CFStringRef typeNameFor(AuthorityType type)

89 {

         for (const StringMap *mp = mapType; mp->cstring; ++mp)

                 if (type == mp->enumeration)

92 return mp->cstring;

         return CFStringCreateWithFormat(NULL, NULL, CFSTR("type %d"), type);

94 }

97 //

98 // Open the database

99 //

 PolicyDatabase::PolicyDatabase(const char *path, int flags)

         : SQLite::Database(path ? path : dbPath(), flags),

102 mLastExplicitCheck(0)

103 {

104 // sqlite3 doesn't do foreign key support by default, have to turn this on per connection

         SQLite::Statement foreign(*this, "PRAGMA foreign_keys = true");

106 foreign.execute();

107

108 // Try upgrade processing if we may be open for write.

109 // Ignore any errors (we may have been downgraded to read-only)

110 // and try again later.

         if (openFlags() & SQLITE_OPEN_READWRITE)

112 try {

113 upgradeDatabase();

114 installExplicitSet(gkeAuthFile, gkeSigsFile);

115 } catch(...) {

116 }

117 }

118

119 PolicyDatabase::~PolicyDatabase()

120 { /* virtual */ }

121

122

123 //

124 // Quick-check the cache for a match.

125 // Return true on a cache hit, false on failure to confirm a hit for any reason.

126 //

 bool PolicyDatabase::checkCache(CFURLRef path, AuthorityType type, CFMutableDictionaryRef result)

128 {

129 // we currently don't use the cache for anything but execution rules

130 if (type != kAuthorityExecute)

131 return false;

132

133 CFRef<SecStaticCodeRef> code;

         MacOSError::check(SecStaticCodeCreateWithPath(path, kSecCSDefaultFlags, &code.aref()));

         if (SecStaticCodeCheckValidity(code, kSecCSBasicValidateOnly, NULL) != noErr)

136 return false; // quick pass - any error is a cache miss

137 CFRef<CFDictionaryRef> info;

         MacOSError::check(SecCodeCopySigningInformation(code, kSecCSDefaultFlags, &info.aref()));

         CFDataRef cdHash = CFDataRef(CFDictionaryGetValue(info, kSecCodeInfoUnique));

140

141 // check the cache table for a fast match

         SQLite::Statement cached(*this, "SELECT object.allow, authority.label, authority FROM object, authority"

143 " WHERE object.authority = authority.id AND object.type = :type AND object.hash = :hash AND authority.disabled = 0"

144 " AND JULIANDAY('now') < object.expires;");

         cached.bind(":type").integer(type);

         cached.bind(":hash") = cdHash;

         if (cached.nextRow()) {

                 bool allow = int(cached[0]);

                 const char *label = cached[1];

                 SQLite::int64 auth = cached[2];

151 SYSPOLICY_ASSESS_CACHE_HIT();

152

153 // If its allowed, lets do a full validation unless if

154 // we are overriding the assessement, since that force

155 // the verdict to 'pass' at the end

156

                 if (allow && !overrideAssessment())

                     MacOSError::check(SecStaticCodeCheckValidity(code, kSecCSDefaultFlags, NULL));

159

                 cfadd(result, "{%O=%B}", kSecAssessmentAssessmentVerdict, allow);

                 PolicyEngine::addAuthority(result, label, auth, kCFBooleanTrue);

162 return true;

163 }

164 return false;

165 }

166

167

168 //

169 // Purge the object cache of all expired entries.

170 // These are meant to run within the caller's transaction.

171 //

 void PolicyDatabase::purgeAuthority()

173 {

         SQLite::Statement cleaner(*this,

175 "DELETE FROM authority WHERE expires <= JULIANDAY('now');");

176 cleaner.execute();

177 }

178

 void PolicyDatabase::purgeObjects()

180 {

         SQLite::Statement cleaner(*this,

182 "DELETE FROM object WHERE expires <= JULIANDAY('now');");

183 cleaner.execute();

184 }

185

 void PolicyDatabase::purgeObjects(double priority)

187 {

         SQLite::Statement cleaner(*this,

189 "DELETE FROM object WHERE expires <= JULIANDAY('now') OR (SELECT priority FROM authority WHERE id = object.authority) <= :priority;");

         cleaner.bind(":priority") = priority;

191 cleaner.execute();

192 }

193

194

195 //

196 // Database migration

197 //

 std::string PolicyDatabase::featureLevel(const char *name)

199 {

         SQLite::Statement feature(*this, "SELECT value FROM feature WHERE name=:name");

         feature.bind(":name") = name;

         if (feature.nextRow())

                 return feature[0].string();

204 else

205 return ""; // new feature (no level)

206 }

207

 void PolicyDatabase::addFeature(const char *name, const char *value, const char *remarks)

209 {

         SQLite::Statement feature(*this, "INSERT OR REPLACE INTO feature (name,value,remarks) VALUES(:name, :value, :remarks)");

         feature.bind(":name") = name;

         feature.bind(":value") = value;

         feature.bind(":remarks") = remarks;

214 feature.execute();

215 }

216

 void PolicyDatabase::simpleFeature(const char *feature, void (^perform)())

218 {

         if (!hasFeature(feature)) {

                 SQLite::Transaction update(*this);

                 addFeature(feature, "upgraded", "upgraded");

222 perform();

223 update.commit();

224 }

225 }

226

 void PolicyDatabase::simpleFeature(const char *feature, const char *sql)

228 {

         if (!hasFeature(feature)) {

                 SQLite::Transaction update(*this);

                 addFeature(feature, "upgraded", "upgraded");

                 SQLite::Statement perform(*this, sql);

233 perform.execute();

234 update.commit();

235 }

236 }

237

238

 void PolicyDatabase::upgradeDatabase()

240 {

241 simpleFeature("bookmarkhints",

242 "CREATE TABLE bookmarkhints ("

243 " id INTEGER PRIMARY KEY AUTOINCREMENT, "

244 " bookmark BLOB,"

245 " authority INTEGER NOT NULL"

246 " REFERENCES authority(id) ON DELETE CASCADE"

247 ")");

248

         if (!hasFeature("codesignedpackages")) {

                 SQLite::Transaction update(*this);

                 addFeature("codesignedpackages", "upgraded", "upgraded");

                 SQLite::Statement updates(*this,

253 "UPDATE authority"

254 " SET requirement = 'anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and "

255 "(certificate leaf[field.1.2.840.113635.100.6.1.14] or certificate leaf[field.1.2.840.113635.100.6.1.13])'"

256 " WHERE type = 2 and label = 'Developer ID' and flags & :flag");

                 updates.bind(":flag") = kAuthorityFlagDefault;

258 updates.execute();

259 update.commit();

260 }

261 }

262

263

264 //

265 // Install Gatekeeper override (GKE) data.

266 // The arguments are paths to the authority and signature files.

267 //

 void PolicyDatabase::installExplicitSet(const char *authfile, const char *sigfile)

269 {

270 // only try this every gkeCheckInterval seconds

         time_t now = time(NULL);

         if (mLastExplicitCheck + gkeCheckInterval > now)

273 return;

274 mLastExplicitCheck = now;

275

276 try {

                 if (CFRef<CFDataRef> authData = cfLoadFile(authfile)) {

                         CFDictionary auth(CFRef<CFDictionaryRef>(makeCFDictionaryFrom(authData)), errSecCSDbCorrupt);

                         CFDictionaryRef content = auth.get<CFDictionaryRef>(CFSTR("authority"));

                         std::string authUUID = cfString(auth.get<CFStringRef>(CFSTR("uuid")));

                         if (authUUID.empty()) {

                                 secdebug("gkupgrade", "no uuid in auth file; ignoring gke.auth");

283 return;

284 }

285 std::string dbUUID;

                         SQLite::Statement uuidQuery(*this, "SELECT value FROM feature WHERE name='gke'");

                         if (uuidQuery.nextRow())

                                 dbUUID = (const char *)uuidQuery[0];

289 if (dbUUID == authUUID) {

                                 secdebug("gkupgrade", "gke.auth already present, ignoring");

291 return;

292 }

                         Syslog::notice("loading GKE %s (replacing %s)", authUUID.c_str(), dbUUID.empty() ? "nothing" : dbUUID.c_str());

294

295 // first, load code signatures. This is pretty much idempotent

296 if (sigfile)

                                 if (FILE *sigs = fopen(sigfile, "r")) {

298 unsigned count = 0;

                                         while (const BlobCore *blob = BlobCore::readBlob(sigs)) {

                                                 signatureDatabaseWriter().storeCode(blob, "<remote>");

301 count++;

302 }

                                         secdebug("gkupgrade", "%d detached signature(s) loaded from override data", count);

304 fclose(sigs);

305 }

306

307 // start transaction (atomic from here on out)

                         SQLite::Transaction loadAuth(*this, SQLite::Transaction::exclusive, "GKE_Upgrade");

309

310 // purge prior authority data

                         SQLite::Statement purge(*this, "DELETE FROM authority WHERE flags & :flag");

                         purge.bind(":flag") = kAuthorityFlagWhitelist;

313 purge();

314

315 // load new data

316 CFIndex count = CFDictionaryGetCount(content);

317 CFStringRef keys[count];

318 CFDictionaryRef values[count];

                         CFDictionaryGetKeysAndValues(content, (const void **)keys, (const void **)values);

320

                         SQLite::Statement insert(*this, "INSERT INTO authority (type, allow, requirement, label, flags, remarks)"

322 " VALUES (:type, 1, :requirement, 'GKE', :flags, :path)");

                         for (CFIndex n = 0; n < count; n++) {

                                 CFDictionary info(values[n], errSecCSDbCorrupt);

325 insert.reset();

                                 insert.bind(":type") = cfString(info.get<CFStringRef>(CFSTR("type")));

                                 insert.bind(":path") = cfString(info.get<CFStringRef>(CFSTR("path")));

                                 insert.bind(":requirement") = "cdhash H\"" + cfString(info.get<CFStringRef>(CFSTR("cdhash"))) + "\"";

                                 insert.bind(":flags") = kAuthorityFlagWhitelist;

330 insert();

331 }

332

333 // update version and commit

                         addFeature("gke", authUUID.c_str(), "gke loaded");

335 loadAuth.commit();

336 }

337 } catch (...) {

                 secdebug("gkupgrade", "exception during GKE upgrade");

339 }

340 }

341

342

343 //

344 // Check the override-enable master flag

345 //

346 #define SP_ENABLE_KEY CFSTR("enabled")

347 #define SP_ENABLED CFSTR("yes")

348 #define SP_DISABLED CFSTR("no")

349

350 bool overrideAssessment()

351 {

352 static bool enabled = false;

353 static dispatch_once_t once;

354 static int token = -1;

355 static int have_token = 0;

356 static dispatch_queue_t queue;

357 int check;

358

         if (have_token && notify_check(token, &check) == NOTIFY_STATUS_OK && !check)

360 return !enabled;

361

362 dispatch_once(&once, ^{

                 if (notify_register_check(kNotifySecAssessmentMasterSwitch, &token) == NOTIFY_STATUS_OK)

364 have_token = 1;

                 queue = dispatch_queue_create("com.apple.SecAssessment.assessment", NULL);

366 });

367

368 dispatch_sync(queue, ^{

369 /* upgrade configuration from emir, ignore all error since we might not be able to write to */

                 if (::access(visibleSecurityFlagFile, F_OK) == 0) {

371 try {

372 setAssessment(true);

373 ::unlink(visibleSecurityFlagFile);

374 } catch (...) {

375 }

376 enabled = true;

377 return;

378 }

379

380 try {

                         Dictionary * prefsDict = Dictionary::CreateDictionary(prefsFile);

382 if (prefsDict == NULL)

383 return;

384

                         CFStringRef value = prefsDict->getStringValue(SP_ENABLE_KEY);

                         if (value && CFStringCompare(value, SP_DISABLED, 0) == 0)

387 enabled = false;

388 else

389 enabled = true;

390 delete prefsDict;

391 } catch(...) {

392 }

393 });

394

395 return !enabled;

396 }

397

 void setAssessment(bool masterSwitch)

399 {

         MutableDictionary *prefsDict = MutableDictionary::CreateMutableDictionary(prefsFile);

401 if (prefsDict == NULL)

                 prefsDict = new MutableDictionary::MutableDictionary();

         prefsDict->setValue(SP_ENABLE_KEY, masterSwitch ? SP_ENABLED : SP_DISABLED);

404 prefsDict->writePlistToFile(prefsFile);

405 delete prefsDict;

406

407 /* make sure permissions is right */

         ::chmod(prefsFile, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);

409

410 notify_post(kNotifySecAssessmentMasterSwitch);

411 }

412

413

414 } // end namespace CodeSigning

415 } // end namespace Security