mDNSMacOSX/PreferencePane/ConfigurationAuthority.c

   1 /*
   2     File: ConfigurationAuthority.c
   3
   4     Abstract: Interface to system security framework that manages access
   5     to protected resources like system configuration preferences.
   6
   7     Copyright: (c) Copyright 2005 Apple Computer, Inc. All rights reserved.
   8
   9     Disclaimer: IMPORTANT: This Apple software is supplied to you by Apple Computer, Inc.
  10     ("Apple") in consideration of your agreement to the following terms, and your
  11     use, installation, modification or redistribution of this Apple software
  12     constitutes acceptance of these terms.  If you do not agree with these terms,
  13     please do not use, install, modify or redistribute this Apple software.
  14
  15     In consideration of your agreement to abide by the following terms, and subject
  16     to these terms, Apple grants you a personal, non-exclusive license, under Apple's
  17     copyrights in this original Apple software (the "Apple Software"), to use,
  18     reproduce, modify and redistribute the Apple Software, with or without
  19     modifications, in source and/or binary forms; provided that if you redistribute
  20     the Apple Software in its entirety and without modifications, you must retain
  21     this notice and the following text and disclaimers in all such redistributions of
  22     the Apple Software.  Neither the name, trademarks, service marks or logos of
  23     Apple Computer, Inc. may be used to endorse or promote products derived from the
  24     Apple Software without specific prior written permission from Apple.  Except as
  25     expressly stated in this notice, no other rights or licenses, express or implied,
  26     are granted by Apple herein, including but not limited to any patent rights that
  27     may be infringed by your derivative works or by other works in which the Apple
  28     Software may be incorporated.
  29
  30     The Apple Software is provided by Apple on an "AS IS" basis.  APPLE MAKES NO
  31     WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED
  32     WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  33     PURPOSE, REGARDING THE APPLE SOFTWARE OR ITS USE AND OPERATION ALONE OR IN
  34     COMBINATION WITH YOUR PRODUCTS.
  35
  36     IN NO EVENT SHALL APPLE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL OR
  37     CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  38     GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  39     ARISING IN ANY WAY OUT OF THE USE, REPRODUCTION, MODIFICATION AND/OR DISTRIBUTION
  40     OF THE APPLE SOFTWARE, HOWEVER CAUSED AND WHETHER UNDER THEORY OF CONTRACT, TORT
  41     (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN IF APPLE HAS BEEN
  42     ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  43
  44     Change History (most recent first):
  45
  46 $Log: ConfigurationAuthority.c,v $
  47 Revision 1.3  2008/06/26 17:34:18  mkrochma
  48 <rdar://problem/6030630> Pref pane destroying shared "system.preferences" authorization right
  49
  50 Revision 1.2  2005/08/07 22:48:05  mkrochma
  51 <rdar://problem/4204003> Bonjour Pref Pane returns -927 when "system.preferences" is not shared
  52
  53 Revision 1.1  2005/02/05 02:28:22  cheshire
  54 Add Preference Pane to facilitate testing of DDNS & wide-area features
  55
  56 */
  57
  58 #include "ConfigurationAuthority.h"
  59 #include "ConfigurationRights.h"
  60
  61 #include <AssertMacros.h>
  62
  63
  64 static AuthorizationRef gAuthRef = 0;
  65
  66 static AuthorizationItem        gAuthorizations[] = {   { UPDATE_SC_RIGHT, 0, NULL, 0 },
  67                                                                                                         { EDIT_SYS_KEYCHAIN_RIGHT, 0, NULL, 0 }};
  68 static AuthorizationRights      gAuthSet = { sizeof gAuthorizations / sizeof gAuthorizations[0], gAuthorizations };
  69
  70 static CFDictionaryRef  CreateRightsDict( CFStringRef prompt)
  71 /* Create a CFDictionary decribing an auth right. See /etc/authorization for examples. */
  72 /* Specifies that the right requires admin authentication, which persists for 5 minutes. */
  73 {
  74         CFMutableDictionaryRef  dict = NULL, tmpDict;
  75         CFMutableArrayRef               mechanisms;
  76         CFNumberRef                             timeout;
  77         int                                             val;
  78
  79         tmpDict = CFDictionaryCreateMutable( (CFAllocatorRef) NULL, 0, &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
  80         require( tmpDict != NULL, MakeDictFailed);
  81
  82         CFDictionaryAddValue(tmpDict, CFSTR("class"), CFSTR("user"));
  83         CFDictionaryAddValue(tmpDict, CFSTR("comment"), prompt);
  84         CFDictionaryAddValue(tmpDict, CFSTR("group"), CFSTR("admin"));
  85
  86         mechanisms = CFArrayCreateMutable((CFAllocatorRef) NULL, 1, &kCFTypeArrayCallBacks);
  87         require( mechanisms != NULL, MakeArrayFailed);
  88         CFArrayAppendValue( mechanisms, CFSTR("builtin:authenticate"));
  89         CFDictionaryAddValue( tmpDict, CFSTR("mechanisms"), mechanisms);
  90
  91         val = 300;      // seconds
  92         timeout = CFNumberCreate((CFAllocatorRef) NULL, kCFNumberIntType, &val);
  93         require( timeout != NULL, MakeIntFailed);
  94         CFDictionaryAddValue( tmpDict, CFSTR("timeout"), timeout);
  95         CFDictionaryAddValue( tmpDict, CFSTR("shared"), kCFBooleanTrue);
  96
  97         dict = tmpDict;
  98         tmpDict = NULL;
  99
 100         CFRelease( timeout);
 101 MakeIntFailed:
 102         CFRelease( mechanisms);
 103 MakeArrayFailed:
 104         if ( tmpDict)
 105                 CFRelease( tmpDict);
 106 MakeDictFailed:
 107         return dict;
 108 }
 109
 110 OSStatus InitConfigAuthority(void)
 111 /* Initialize the authorization record-keeping */
 112 {
 113         OSStatus        err;
 114         CFDictionaryRef dict;
 115         CFStringRef             rightInfo;
 116
 117         err = AuthorizationCreate((AuthorizationRights*) NULL, (AuthorizationEnvironment*) NULL,
 118                                                                 (AuthorizationFlags) 0, &gAuthRef);
 119         require_noerr( err, NewAuthFailed);
 120
 121         err = AuthorizationRightGet( UPDATE_SC_RIGHT, (CFDictionaryRef*) NULL);
 122         if( err == errAuthorizationDenied)
 123         {
 124                 rightInfo = CFCopyLocalizedString(CFSTR("Authentication required to set Dynamic DNS preferences."),
 125                                                 CFSTR("Describes operation that requires user authorization"));
 126                 require_action( rightInfo != NULL, GetStrFailed, err=coreFoundationUnknownErr;);
 127                 dict = CreateRightsDict(rightInfo);
 128                 require_action( dict != NULL, GetStrFailed, err=coreFoundationUnknownErr;);
 129
 130                 err = AuthorizationRightSet(gAuthRef, UPDATE_SC_RIGHT, dict, (CFStringRef) NULL,
 131                                                                         (CFBundleRef) NULL, (CFStringRef) NULL);
 132                 CFRelease(rightInfo);
 133                 CFRelease(dict);
 134         }
 135         require_noerr( err, AuthSetFailed);
 136
 137         err = AuthorizationRightGet( EDIT_SYS_KEYCHAIN_RIGHT, (CFDictionaryRef*) NULL);
 138         if( err == errAuthorizationDenied)
 139         {
 140                 rightInfo = CFCopyLocalizedString( CFSTR("Authentication required to edit System Keychain."),
 141                                                 CFSTR("Describes operation that requires user authorization"));
 142                 require_action( rightInfo != NULL, GetStrFailed, err=coreFoundationUnknownErr;);
 143                 dict = CreateRightsDict( rightInfo);
 144                 require_action( dict != NULL, GetStrFailed, err=coreFoundationUnknownErr;);
 145
 146                 err = AuthorizationRightSet(gAuthRef, EDIT_SYS_KEYCHAIN_RIGHT, dict, (CFStringRef) NULL,
 147                                                                         (CFBundleRef) NULL, (CFStringRef) NULL);
 148                 CFRelease( rightInfo);
 149                 CFRelease( dict);
 150         }
 151         require_noerr( err, AuthSetFailed);
 152
 153 AuthSetFailed:
 154 GetStrFailed:
 155 NewAuthFailed:
 156         return err;
 157 }
 158
 159 OSStatus        AttemptAcquireAuthority( Boolean allowUI)
 160 /* Try to get permission for privileged ops, either implicitly or by asking the user for */
 161 /* authority to perform operations (if necessary) */
 162 {
 163         AuthorizationFlags      allowFlag = allowUI ? kAuthorizationFlagInteractionAllowed : 0;
 164         OSStatus                        err;
 165
 166         err = AuthorizationCopyRights( gAuthRef, &gAuthSet, (AuthorizationEnvironment*) NULL,
 167                                                                         kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize |
 168                                                                         allowFlag,
 169                                                                         (AuthorizationRights**) NULL);
 170         return err;
 171 }
 172
 173 OSStatus ReleaseAuthority(void)
 174 /* Discard authority to perform operations */
 175 {
 176         (void) AuthorizationFree( gAuthRef, kAuthorizationFlagDefaults);
 177         gAuthRef = 0;
 178         return AuthorizationCreate( (AuthorizationRights*) NULL, (AuthorizationEnvironment*) NULL,
 179                                                                 (AuthorizationFlags) 0, &gAuthRef);
 180 }
 181
 182 Boolean CurrentlyAuthorized(void)
 183 {
 184         OSStatus err = AttemptAcquireAuthority(true);
 185         return err == noErr;
 186 }
 187
 188
 189 OSStatus ExternalizeAuthority(AuthorizationExternalForm *pAuth)
 190 /* Package up current authorizations for transfer to another process */
 191 {
 192         return AuthorizationMakeExternalForm(gAuthRef, pAuth);
 193 }