Security-55471.14.18.tar.gz

[apple/security.git] / libsecurityd / mig / ucsp.defs

//
// Copyright (c) 2001-2007 Apple Inc. All Rights Reserved.
//
// @APPLE_LICENSE_HEADER_START@
// 
// This file contains Original Code and/or Modifications of Original Code
// as defined in and that are subject to the Apple Public Source License
// Version 2.0 (the 'License'). You may not use this file except in
// compliance with the License. Please obtain a copy of the License at
// http://www.opensource.apple.com/apsl/ and read it before using this
// file.
// 
// The Original Code and all software distributed under the License are
// distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
// EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
// INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
// Please see the License for the specific language governing rights and
// limitations under the License.
// 
// @APPLE_LICENSE_HEADER_END@
//
// ucsp.defs - Mach RPC interface between SecurityServer and its clients
//
#include <mach/std_types.defs>
#include <mach/mach_types.defs>
#include "ss_types.defs"

subsystem ucsp 1000;
serverprefix ucsp_server_;
userprefix ucsp_client_;

import <securityd_client/ucsp_types.h>;


//
// Common argument profiles
//
#define UCSP_PORTS	requestport sport: mach_port_t; \
					replyport rport: mach_port_make_send_t; \
                    serveraudittoken sourceAudit: audit_token_t; \
					usersectoken securitydCreds: security_token_t; \
					out rcode: CSSM_RETURN


//
// Management and administrative functions
//
routine setup(UCSP_PORTS; in tport: mach_port_t; in info: SetupInfo; in FilePath: FilePath);
skip;		// was setupNew - no longer needed
routine setupThread(UCSP_PORTS; in tport: mach_port_t);


//
// Common database functions
//
routine authenticateDb(UCSP_PORTS; in db: IPCDbHandle; in accessType: CSSM_DB_ACCESS_TYPE; in accessCredentials: Data);
routine releaseDb(UCSP_PORTS; in db: IPCDbHandle);
routine getDbName(UCSP_PORTS; in db: IPCDbHandle; out name: FilePathOut);
routine setDbName(UCSP_PORTS; in db: IPCDbHandle; in name: FilePath);


//
// External database interface
//
routine openToken(UCSP_PORTS; in ssid: uint32; in name: FilePath;
	in accessCredentials: Data; out db: IPCDbHandle);
	
routine findFirst(UCSP_PORTS; in db: IPCDbHandle; in query: Data;
	in inAttributes : Data; out outAttributes: Data;
	in getData: boolean_t; out data: Data; out key: IPCKeyHandle; out search: IPCSearchHandle; out record: IPCRecordHandle);
routine findNext(UCSP_PORTS; in search: IPCSearchHandle;
	in inAttributes : Data; out outAttributes: Data;
	in getData: boolean_t; out data: Data; out key: IPCKeyHandle; out record: IPCRecordHandle);
routine findRecordHandle(UCSP_PORTS; in record: IPCRecordHandle;
	in inAttributes : Data; out outAttributes: Data;
	in getData: boolean_t; out data: Data; out key: IPCKeyHandle);
routine insertRecord(UCSP_PORTS; in db: IPCDbHandle; in recordType: CSSM_DB_RECORDTYPE;
	in attributes : Data; in data: Data; out record: IPCRecordHandle);
routine deleteRecord(UCSP_PORTS; in db: IPCDbHandle; in record: IPCRecordHandle);
routine modifyRecord(UCSP_PORTS; in db: IPCDbHandle; inout record: IPCRecordHandle; in recordType: CSSM_DB_RECORDTYPE;
	in attributes : Data; in setData: boolean_t; in data: Data;
	in modifyMode: CSSM_DB_MODIFY_MODE);
routine releaseSearch(UCSP_PORTS; in search: IPCSearchHandle);
routine releaseRecord(UCSP_PORTS; in record: IPCRecordHandle);



//
// Internal database interface
//
routine createDb(UCSP_PORTS; out db: IPCDbHandle; in ident: Data;
    in accessCredentials: Data; in aclEntryPrototype: Data;
    in params: DBParameters);
skip;
#if 0
// should move here from below, next time we break compatibility for another reason
routine commitDbForSync(UCSP_PORTS; in srcDb: IPCDbHandle; in cloneDb: IPCDbHandle;
    out blob: DbBlob);
#endif
routine decodeDb(UCSP_PORTS; out db: IPCDbHandle; in ident: Data;
    in accessCredentials: Data; in blob: DbBlob);
routine encodeDb(UCSP_PORTS; in db: IPCDbHandle; out blob: DbBlob);
routine setDbParameters(UCSP_PORTS; in db: IPCDbHandle; in params: DBParameters);
routine getDbParameters(UCSP_PORTS; in db: IPCDbHandle; out params: DBParameters);
routine changePassphrase(UCSP_PORTS; in db: IPCDbHandle; 
	in accessCredentials: Data);
routine lockAll(UCSP_PORTS; in forSleep: boolean_t);
routine unlockDb(UCSP_PORTS; in db: IPCDbHandle);
routine unlockDbWithPassphrase(UCSP_PORTS; in db: IPCDbHandle; in passPhrase: Data);
routine isLocked(UCSP_PORTS; in db: IPCDbHandle; out locked: boolean_t);
	
//
// Key management
//
routine encodeKey(UCSP_PORTS; in key: IPCKeyHandle; out blob: KeyBlob;
    in wantUid: boolean_t; out uid: Data);
routine decodeKey(UCSP_PORTS; out key: IPCKeyHandle; out header: Data;
    in db: IPCDbHandle; in blob: KeyBlob);
// keychain synchronization
routine recodeKey(UCSP_PORTS; in oldDb: IPCDbHandle; in key: IPCKeyHandle; 
    in newDb: IPCDbHandle; out newBlob: KeyBlob);
routine releaseKey(UCSP_PORTS; in key: IPCKeyHandle);

routine queryKeySizeInBits(UCSP_PORTS; in key: IPCKeyHandle; out length: CSSM_KEY_SIZE);
routine getOutputSize(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
    in inputSize: uint32; in encrypt: boolean_t; out outputSize: uint32);

routine getKeyDigest(UCSP_PORTS; in key: IPCKeyHandle; out digest: Data);


//
// Cryptographic operations
//
routine generateSignature(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
    in signOnlyAlgorithm: CSSM_ALGORITHMS; in data: Data; out signature: Data);
routine verifySignature(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
	in signOnlyAlgorithm: CSSM_ALGORITHMS; in data: Data; in signature: Data);
routine generateMac(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
	in data: Data; out signature: Data);
routine verifyMac(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
	in data: Data; in signature: Data);

routine encrypt(UCSP_PORTS; in context: Data; in key: IPCKeyHandle; in clear: Data; out cipher: Data);
routine decrypt(UCSP_PORTS; in context: Data; in key: IPCKeyHandle; in cipher: Data; out clear: Data);

routine generateKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data;
	in accessCredentials: Data; in aclEntryPrototype: Data;
	in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);
routine generateKeyPair(UCSP_PORTS; in db: IPCDbHandle; in context: Data;
	in accessCredentials: Data; in aclEntryPrototype: Data;
	in pubUsage: uint32; in pubAttrs: uint32; in privUsage: uint32; in privAttrs: uint32;
	out pubKey: IPCKeyHandle; out pubHeader: Data;
    out privKey: IPCKeyHandle; out privHeader: Data);

routine wrapKey(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
    in accessCredentials: Data; in keyToBeWrapped: IPCKeyHandle;
	in descriptiveData: Data; out wrappedKey: Data);
routine unwrapKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in key: IPCKeyHandle;
	in accessCredentials: Data; in aclEntryPrototype: Data;
	in publicKey: IPCKeyHandle; in wrappedKey: Data;
	in usage: uint32; in attributes: uint32; out data: Data; 
    out resultKey: IPCKeyHandle; out header: Data);

routine deriveKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in baseKey: IPCKeyHandle;
	in accessCredentials: Data; in aclEntryPrototype: Data;
    in paramInput: Data; out paramOutput: Data;
	in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);

routine generateRandom(UCSP_PORTS; in ssid: uint32; in context: Data; out data: Data);


//
// ACL management
//
routine getOwner(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
	out proto: Data);
routine setOwner(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
	in accessCredentials: Data; in aclOwnerPrototype: Data);
routine getAcl(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
	in haveTag: boolean_t; in tag: CssmString;
	out count: uint32; out acls: Data);
routine changeAcl(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
	in accessCredentials: Data;
	in mode: CSSM_ACL_EDIT_MODE; in handle: IPCGenericHandle;
	in aclEntryInput: Data);

routine login(UCSP_PORTS; in accessCredentials: Data; in name: Data);
routine logout(UCSP_PORTS);


//
// Miscellanea
//
routine getStatistics(UCSP_PORTS; in ssid: uint32; out statistics: CSSM_CSP_OPERATIONAL_STATISTICS);
routine getTime(UCSP_PORTS; in ssid: uint32; in algorithm: CSSM_ALGORITHMS; out data: Data);
routine getCounter(UCSP_PORTS; in ssid: uint32; out data: Data);
routine selfVerify(UCSP_PORTS; in ssid: uint32);

routine cspPassThrough(UCSP_PORTS; in ssid: uint32; in id: uint32; in context: Data; in hKey: IPCKeyHandle;
	in inData: Data; out outData: Data);
routine dlPassThrough(UCSP_PORTS; in ssid: uint32; in id: uint32; in inData: Data; out outData: Data);


//
// Authorization subsystem
//
routine authorizationCreate(UCSP_PORTS; 
	in rights: Data;
	in flags: uint32;
	in environment: Data;
	out authorization: AuthorizationBlob);

routine authorizationRelease(UCSP_PORTS; in authorization: AuthorizationBlob;
	in flags: uint32);

routine authorizationCopyRights(UCSP_PORTS; in authorization: AuthorizationBlob;
	in rights: Data;
	in flags: uint32;
	in environment: Data;
	out result: Data);

routine authorizationCopyInfo(UCSP_PORTS; in authorization: AuthorizationBlob;
	in tag: AuthorizationString;
	out info: Data);

routine authorizationExternalize(UCSP_PORTS; in authorization: AuthorizationBlob;
	out form: AuthorizationExternalForm);

routine authorizationInternalize(UCSP_PORTS; in form: AuthorizationExternalForm;
	out authorization: AuthorizationBlob);


//
// Session management subsystem
//
skip;	// was getSessionInfo -- now kept by the kernel
skip;	// was setupSession -- now kept by the kernel
skip;	// was setSessionDistinguishedUid -- now kept by the kernel
skip;	// was getSessionDistinguishedUid -- now kept by the kernel
routine setSessionUserPrefs(UCSP_PORTS; in sessionId: SecuritySessionId; in userPrefs: Data);

//
// Notification subsystem
//
routine postNotification(UCSP_PORTS; in domain: uint32; in event: uint32; in data: Data;
	in sequence: uint32);


//
// Database key management
//
routine extractMasterKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in sourceDb: IPCDbHandle;
	in accessCredentials: Data; in aclEntryPrototype: Data;
	in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);


//
// AuthorizationDB operations
//
routine authorizationdbGet(UCSP_PORTS; in rightname: AuthorizationString; out rightdefinition: Data);
routine authorizationdbSet(UCSP_PORTS; in authorization: AuthorizationBlob; in rightname: AuthorizationString; in rightDefinition: Data);
routine authorizationdbRemove(UCSP_PORTS; in authorization: AuthorizationBlob; in rightname: AuthorizationString);


//
// Miscellaneous administrative calls
//
routine addCodeEquivalence(UCSP_PORTS; in oldCode: Data; in newCode: Data; in name: FilePath;
	in forSystem: boolean_t);
routine removeCodeEquivalence(UCSP_PORTS; in code: Data; in name: FilePath;
	in forSystem: boolean_t);
routine setAlternateSystemRoot(UCSP_PORTS; in path: FilePath);


//
// Subsidiary process (child) management.
// This call does NOT cause securityd-client activation.
//
simpleroutine childCheckIn(requestport sport: mach_port_t;
	in servicePort: mach_port_make_send_t; in task_port: mach_port_t);

#if 1
// This should move up to be with its buddies (see #if 0 above), but it won't move
// until we need to force an incompatible change for some other reason.
routine commitDbForSync(UCSP_PORTS; in srcDb: IPCDbHandle; in cloneDb: IPCDbHandle;
    out blob: DbBlob);
#endif


//
// Code Signing Hosting protocol part 1: registration services.
//
routine registerHosting(UCSP_PORTS;
	in hostingPort: mach_port_make_send_t; in flags: uint32);
routine hostingPort(UCSP_PORTS;
	in hostPid: pid_t; out hostingPort: mach_port_make_send_t);
routine setGuest(UCSP_PORTS; in guest: SecGuestRef; in flags: uint32);

//
// Code Signing Hosting protocol part 2: proxy services.
//
routine createGuest(UCSP_PORTS; in host: SecGuestRef; in status: uint32_t;
	in path: FilePath; in cdhash: HashData; in attributes: Data; in flags: uint32; out guest: SecGuestRef);
routine setGuestStatus(UCSP_PORTS; in guest: SecGuestRef;
	in status: uint32_t; in attributes: Data);
routine removeGuest(UCSP_PORTS; in host: SecGuestRef; in guest: SecGuestRef);

//
// Code Signing support calls
//
routine helpCheckLoad(UCSP_PORTS; in path: FilePath; in addType: uint32_t);

//
// Keychain Syncing setup support calls
//
routine recodeDbForSync(UCSP_PORTS; in dbToClone: IPCDbHandle; 
    in srcDb: IPCDbHandle; out newDb: IPCDbHandle);
routine authenticateDbsForSync(UCSP_PORTS; in ipcDbHandleArray: Data;
    in agentData: Data; out newDb: IPCDbHandle);

//
// Allows the client to verify that the server really is root.
//
routine verifyPrivileged(UCSP_PORTS);

//
// The original verifyPrivileged is subject to a Mach service in the middle attack (6986198).
//
routine verifyPrivileged2(UCSP_PORTS; out originPort: mach_port_make_send_t);

// Internal Database call additions
routine stashDb(UCSP_PORTS; in db: IPCDbHandle);
routine stashDbCheck(UCSP_PORTS; in db: IPCDbHandle);

routine verifyKeyStorePassphrase(UCSP_PORTS; in retries: uint32_t);
routine resetKeyStorePassphrase(UCSP_PORTS; in passPhrase: Data);
routine changeKeyStorePassphrase(UCSP_PORTS);