[apple/security.git] / sectask / SecTask.c

/*
 * Copyright (c) 2008,2010-2013 Apple Inc. All Rights Reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this
 * file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_LICENSE_HEADER_END@
 */

#include "SecTask.h"
#include "SecTaskPriv.h"

#include <utilities/debugging.h>

#include <AssertMacros.h>
#include <CoreFoundation/CFRuntime.h>
#include <IOKit/IOKitLib.h>
#include <IOKit/IOCFUnserialize.h>
#include <System/sys/codesign.h>
#include <bsm/libbsm.h>
#include <inttypes.h>
#include <syslog.h>
#include <utilities/SecCFWrappers.h>

#include <sys/sysctl.h>

#if TARGET_OS_OSX
/* These won't exist until we unify codesigning */
#include "SecCode.h"
#include "SecCodePriv.h"
#include "SecRequirement.h"
#endif /* TARGET_OS_OSX */

struct __SecTask {
    CFRuntimeBase base;
    
    audit_token_t token;
    
    /* Track whether we've loaded entitlements independently since after the
     * load, entitlements may legitimately be NULL */
    Boolean entitlementsLoaded;
    CFDictionaryRef entitlements;
	
	/* for debugging only, shown by debugDescription */
	int lastFailure;
};

static bool check_task(SecTaskRef task) {
    return SecTaskGetTypeID() == CFGetTypeID(task);
}

static void SecTaskFinalize(CFTypeRef cfTask)
{
    SecTaskRef task = (SecTaskRef) cfTask;
    CFReleaseNull(task->entitlements);
}


// Define PRIdPID (proper printf format string for pid_t)
#define PRIdPID PRId32

static CFStringRef SecTaskCopyDebugDescription(CFTypeRef cfTask)
{
    SecTaskRef task = (SecTaskRef) cfTask;
    pid_t pid;
    audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);

    const char *task_name;
    int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, pid};
    struct kinfo_proc kp;
    size_t len = sizeof(kp);
    if (sysctl(mib, 4, &kp, &len, NULL, 0) == -1 || len == 0)
        task_name = strerror(errno);
    else
        task_name = kp.kp_proc.p_comm;

    return CFStringCreateWithFormat(CFGetAllocator(task), NULL, CFSTR("%s[%" PRIdPID "]/%d#%d LF=%d"), task_name, pid,
									task->entitlementsLoaded, task->entitlements ? (int)CFDictionaryGetCount(task->entitlements) : -1, task->lastFailure);
}

CFGiblisWithFunctions(SecTask, NULL, NULL, SecTaskFinalize, NULL, NULL, NULL, SecTaskCopyDebugDescription, NULL, NULL, NULL)

static SecTaskRef init_task_ref(CFAllocatorRef allocator)
{
    CFIndex extra = sizeof(struct __SecTask) - sizeof(CFRuntimeBase);
    return (SecTaskRef) _CFRuntimeCreateInstance(allocator, SecTaskGetTypeID(), extra, NULL);
}

SecTaskRef SecTaskCreateFromSelf(CFAllocatorRef allocator)
{
    SecTaskRef task = init_task_ref(allocator);
    if (task != NULL) {

        kern_return_t kr = KERN_FAILURE;
        mach_msg_type_number_t autoken_cnt = TASK_AUDIT_TOKEN_COUNT;
        kr = task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)&task->token, &autoken_cnt);
        if (kr == KERN_SUCCESS) {
            task->entitlementsLoaded = false;
            task->entitlements = NULL;
        } else {
            CFReleaseNull(task);
        }
    }

    return task;
}

SecTaskRef SecTaskCreateWithAuditToken(CFAllocatorRef allocator, audit_token_t token)
{
    SecTaskRef task = init_task_ref(allocator);
    if (task != NULL) {
        
        memcpy(&task->token, &token, sizeof(token));
        task->entitlementsLoaded = false;
        task->entitlements = NULL;
    }
    
    return task;
}

struct csheader {
        uint32_t magic;
        uint32_t length;
};

static int
csops_task(SecTaskRef task, int ops, void *blob, size_t size)
{
	int rc;
    
    pid_t pid;
    audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
    rc = csops_audittoken(pid, ops, blob, size, &task->token);

	task->lastFailure = (rc == -1) ? errno : 0;
	return rc;
}

CFStringRef
SecTaskCopySigningIdentifier(SecTaskRef task, CFErrorRef *error)
{
        CFStringRef signingId = NULL;
        char *data = NULL;
        struct csheader header;
        uint32_t bufferlen;
        int ret;

        ret = csops_task(task, CS_OPS_IDENTITY, &header, sizeof(header));
        if (ret != -1 || errno != ERANGE)
                return NULL;

        bufferlen = ntohl(header.length);
        /* check for insane values */
        if (bufferlen > 1024 * 1024 || bufferlen < 8) {
                ret = EINVAL;
                goto out;
        }
        data = malloc(bufferlen + 1);
        if (data == NULL) {
                ret = ENOMEM;
                goto out;
        }
        ret = csops_task(task, CS_OPS_IDENTITY, data, bufferlen);
        if (ret) {
                ret = errno;
                goto out;
        }
        data[bufferlen] = '\0';

        signingId = CFStringCreateWithCString(NULL, data + 8, kCFStringEncodingUTF8);

 out:
        if (data)
                free(data);
        if (ret && error)
                *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);

        return signingId;
}

uint32_t
SecTaskGetCodeSignStatus(SecTaskRef task)
{
    uint32_t flags = 0;
    if (csops_task(task, CS_OPS_STATUS, &flags, sizeof(flags)) != 0)
        return 0;
    return flags;
}

static bool SecTaskLoadEntitlements(SecTaskRef task, CFErrorRef *error)
{
    CFMutableDictionaryRef entitlements = NULL;
    struct csheader header;
    uint8_t *buffer = NULL;
    uint32_t bufferlen;
    int ret;

    
    ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, &header, sizeof(header));
    /* Any other combination means no entitlements */
	if (ret == -1) {
		if (errno != ERANGE) {
            int entitlementErrno = errno;

			uint32_t cs_flags = -1;
            if (-1 == csops_task(task, CS_OPS_STATUS, &cs_flags, sizeof(cs_flags))) {
                syslog(LOG_NOTICE, "Failed to get cs_flags, error=%d", errno);
            }

			if (cs_flags != 0) {	// was signed

				pid_t pid;
				audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
	            syslog(LOG_NOTICE, "SecTaskLoadEntitlements failed error=%d cs_flags=%x, pid=%d", entitlementErrno, cs_flags, pid);	// to ease diagnostics

				CFStringRef description = SecTaskCopyDebugDescription(task);
				char *descriptionBuf = NULL;
				CFIndex descriptionSize = CFStringGetLength(description) * 4;
				descriptionBuf = (char *)malloc(descriptionSize);
				if (!CFStringGetCString(description, descriptionBuf, descriptionSize, kCFStringEncodingUTF8)) {
					descriptionBuf[0] = 0;
				}

				syslog(LOG_NOTICE, "SecTaskCopyDebugDescription: %s", descriptionBuf);
				CFReleaseNull(description);
				free(descriptionBuf);
			}
			task->lastFailure = entitlementErrno;	// was overwritten by csops_task(CS_OPS_STATUS) above

			// EINVAL is what the kernel says for unsigned code, so we'll have to let that pass
			if (entitlementErrno == EINVAL) {
				task->entitlementsLoaded = true;
				return true;
			}
			ret = entitlementErrno;	// what really went wrong
			goto out;		// bail out
		}
        bufferlen = ntohl(header.length);
        /* check for insane values */
        if (bufferlen > 1024 * 1024 || bufferlen < 8) {
            ret = E2BIG;
            goto out;
        }
        buffer = malloc(bufferlen);
        if (buffer == NULL) {
            ret = ENOMEM;
            goto out;
        }
        ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, buffer, bufferlen);
        if (ret) {
            ret = errno;
            goto out;
        }

        CFDataRef data = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, buffer+8, bufferlen-8, kCFAllocatorNull);
        entitlements = (CFMutableDictionaryRef) CFPropertyListCreateWithData(kCFAllocatorDefault, data, kCFPropertyListMutableContainers, NULL, error);
        CFReleaseNull(data);

        if((entitlements==NULL) || (CFGetTypeID(entitlements)!=CFDictionaryGetTypeID())){
            ret = EDOM;	// don't use EINVAL here; it conflates problems with syscall error returns
            goto out;
        }
    }

    task->entitlements = entitlements ? CFRetain(entitlements) : NULL;
    task->entitlementsLoaded = true;

out:
    CFReleaseNull(entitlements);
    if(buffer)
        free(buffer);
    if (ret && error && *error==NULL)
        *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
    return ret == 0;
}


CFTypeRef SecTaskCopyValueForEntitlement(SecTaskRef task, CFStringRef entitlement, CFErrorRef *error)
{
    CFTypeRef value = NULL;
    require(check_task(task), out);

    /* Load entitlements if necessary */
    if (task->entitlementsLoaded == false) {
        require_quiet(SecTaskLoadEntitlements(task, error), out);
    }

    if (task->entitlements != NULL) {
        value = CFDictionaryGetValue(task->entitlements, entitlement);
        
        /* Return something the caller must release */
        if (value != NULL) {
            CFRetain(value);
        }
    }
out:
    return value;
}

CFDictionaryRef SecTaskCopyValuesForEntitlements(SecTaskRef task, CFArrayRef entitlements, CFErrorRef *error)
{
    CFMutableDictionaryRef values = NULL;
    require(check_task(task), out);

    /* Load entitlements if necessary */
    if (task->entitlementsLoaded == false) {
        SecTaskLoadEntitlements(task, error);
    }
    
    /* Iterate over the passed in entitlements, populating the dictionary
     * If entitlements were loaded but none were present, return an empty
     * dictionary */
    if (task->entitlementsLoaded == true) {
        
        CFIndex i, count = CFArrayGetCount(entitlements);
        values = CFDictionaryCreateMutable(CFGetAllocator(task), count, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
        if (task->entitlements != NULL) {
            for (i = 0; i < count; i++) {
                CFStringRef entitlement = CFArrayGetValueAtIndex(entitlements, i);
                CFTypeRef value = CFDictionaryGetValue(task->entitlements, entitlement);
                if (value != NULL) {
                    CFDictionarySetValue(values, entitlement, value);
                }
            }
        }
    }
out:
    return values;
}

#if TARGET_OS_OSX
/*
 * Determine if the given task meets a specified requirement.
 */
OSStatus
SecTaskValidateForRequirement(SecTaskRef task, CFStringRef requirement)
{
    OSStatus status;
    SecCodeRef code = NULL;
    SecRequirementRef req = NULL;

    CFMutableDictionaryRef codeDict = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
    CFDataRef auditData = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&task->token, sizeof(audit_token_t));
    CFDictionarySetValue(codeDict, kSecGuestAttributeAudit, auditData);
    status = SecCodeCopyGuestWithAttributes(NULL, codeDict, kSecCSDefaultFlags, &code);
    CFReleaseNull(codeDict);
    CFReleaseNull(auditData);

    if (!status) {
        status = SecRequirementCreateWithString(requirement,
                                                kSecCSDefaultFlags, &req);
    }
    if (!status) {
        status = SecCodeCheckValidity(code, kSecCSDefaultFlags, req);
    }

    CFReleaseNull(req);
    CFReleaseNull(code);

    return status;
}
#endif /* TARGET_OS_OSX */

Boolean SecTaskEntitlementsValidated(SecTaskRef task) {
    // TODO: Cache the result
    uint32_t csflags = 0;
    const uint32_t mask = CS_VALID | CS_KILL | CS_ENTITLEMENTS_VALIDATED;
    int rc = csops_task(task, CS_OPS_STATUS, &csflags, sizeof(csflags));
    return rc != -1 && ((csflags & mask) == mask);
}
Commit	Line	Data
d8f41ccd A	1	/*
	2	* Copyright (c) 2008,2010-2013 Apple Inc. All Rights Reserved.
	3	*
	4	* @APPLE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. Please obtain a copy of the License at
	10	* http://www.opensource.apple.com/apsl/ and read it before using this
	11	* file.
	12	*
	13	* The Original Code and all software distributed under the License are
	14	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	15	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	16	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	17	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	18	* Please see the License for the specific language governing rights and
	19	* limitations under the License.
	20	*
	21	* @APPLE_LICENSE_HEADER_END@
	22	*/
	23
	24	#include "SecTask.h"
866f8763	25	#include "SecTaskPriv.h"
d8f41ccd A	26
	27	#include <utilities/debugging.h>
	28
	29	#include <AssertMacros.h>
	30	#include <CoreFoundation/CFRuntime.h>
	31	#include <IOKit/IOKitLib.h>
	32	#include <IOKit/IOCFUnserialize.h>
	33	#include <System/sys/codesign.h>
	34	#include <bsm/libbsm.h>
	35	#include <inttypes.h>
5c19dc3a	36	#include <syslog.h>
d8f41ccd A	37	#include <utilities/SecCFWrappers.h>
d8f41ccd A	38
d8f41ccd	39	#include <sys/sysctl.h>
866f8763 A	40
	41	#if TARGET_OS_OSX
	42	/* These won't exist until we unify codesigning */
	43	#include "SecCode.h"
	44	#include "SecCodePriv.h"
	45	#include "SecRequirement.h"
	46	#endif /* TARGET_OS_OSX */
d8f41ccd A	47
	48	struct __SecTask {
	49	CFRuntimeBase base;
	50
d8f41ccd A	51	audit_token_t token;
	52
	53	/* Track whether we've loaded entitlements independently since after the
	54	* load, entitlements may legitimately be NULL */
	55	Boolean entitlementsLoaded;
	56	CFDictionaryRef entitlements;
fa7225c8 A	57
	58	/* for debugging only, shown by debugDescription */
	59	int lastFailure;
d8f41ccd A	60	};
	61
	62	static bool check_task(SecTaskRef task) {
	63	return SecTaskGetTypeID() == CFGetTypeID(task);
	64	}
	65
	66	static void SecTaskFinalize(CFTypeRef cfTask)
	67	{
	68	SecTaskRef task = (SecTaskRef) cfTask;
866f8763	69	CFReleaseNull(task->entitlements);
d8f41ccd A	70	}
	71
	72
	73	// Define PRIdPID (proper printf format string for pid_t)
	74	#define PRIdPID PRId32
	75
	76	static CFStringRef SecTaskCopyDebugDescription(CFTypeRef cfTask)
	77	{
	78	SecTaskRef task = (SecTaskRef) cfTask;
	79	pid_t pid;
866f8763	80	audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
d8f41ccd	81
d8f41ccd A	82	const char *task_name;
	83	int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, pid};
	84	struct kinfo_proc kp;
	85	size_t len = sizeof(kp);
	86	if (sysctl(mib, 4, &kp, &len, NULL, 0) == -1 \|\| len == 0)
	87	task_name = strerror(errno);
	88	else
	89	task_name = kp.kp_proc.p_comm;
d8f41ccd	90
fa7225c8 A	91	return CFStringCreateWithFormat(CFGetAllocator(task), NULL, CFSTR("%s[%" PRIdPID "]/%d#%d LF=%d"), task_name, pid,
fa7225c8 A	92	task->entitlementsLoaded, task->entitlements ? (int)CFDictionaryGetCount(task->entitlements) : -1, task->lastFailure);
d8f41ccd A	93	}
	94
	95	CFGiblisWithFunctions(SecTask, NULL, NULL, SecTaskFinalize, NULL, NULL, NULL, SecTaskCopyDebugDescription, NULL, NULL, NULL)
	96
	97	static SecTaskRef init_task_ref(CFAllocatorRef allocator)
	98	{
	99	CFIndex extra = sizeof(struct __SecTask) - sizeof(CFRuntimeBase);
	100	return (SecTaskRef) _CFRuntimeCreateInstance(allocator, SecTaskGetTypeID(), extra, NULL);
	101	}
	102
	103	SecTaskRef SecTaskCreateFromSelf(CFAllocatorRef allocator)
	104	{
	105	SecTaskRef task = init_task_ref(allocator);
	106	if (task != NULL) {
	107
866f8763 A	108	kern_return_t kr = KERN_FAILURE;
	109	mach_msg_type_number_t autoken_cnt = TASK_AUDIT_TOKEN_COUNT;
	110	kr = task_info(mach_task_self(), TASK_AUDIT_TOKEN, (task_info_t)&task->token, &autoken_cnt);
	111	if (kr == KERN_SUCCESS) {
	112	task->entitlementsLoaded = false;
	113	task->entitlements = NULL;
	114	} else {
	115	CFReleaseNull(task);
	116	}
d8f41ccd A	117	}
	118
	119	return task;
	120	}
	121
	122	SecTaskRef SecTaskCreateWithAuditToken(CFAllocatorRef allocator, audit_token_t token)
	123	{
	124	SecTaskRef task = init_task_ref(allocator);
	125	if (task != NULL) {
	126
	127	memcpy(&task->token, &token, sizeof(token));
	128	task->entitlementsLoaded = false;
	129	task->entitlements = NULL;
d8f41ccd A	130	}
	131
	132	return task;
	133	}
	134
	135	struct csheader {
	136	uint32_t magic;
	137	uint32_t length;
	138	};
	139
	140	static int
	141	csops_task(SecTaskRef task, int ops, void *blob, size_t size)
	142	{
fa7225c8	143	int rc;
866f8763 A	144
	145	pid_t pid;
	146	audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
	147	rc = csops_audittoken(pid, ops, blob, size, &task->token);
	148
fa7225c8 A	149	task->lastFailure = (rc == -1) ? errno : 0;
fa7225c8 A	150	return rc;
d8f41ccd A	151	}
d8f41ccd A	152
d8f41ccd A	153	CFStringRef
	154	SecTaskCopySigningIdentifier(SecTaskRef task, CFErrorRef *error)
	155	{
	156	CFStringRef signingId = NULL;
	157	char *data = NULL;
	158	struct csheader header;
	159	uint32_t bufferlen;
	160	int ret;
	161
	162	ret = csops_task(task, CS_OPS_IDENTITY, &header, sizeof(header));
	163	if (ret != -1 \|\| errno != ERANGE)
	164	return NULL;
	165
	166	bufferlen = ntohl(header.length);
	167	/* check for insane values */
	168	if (bufferlen > 1024 * 1024 \|\| bufferlen < 8) {
	169	ret = EINVAL;
	170	goto out;
	171	}
	172	data = malloc(bufferlen + 1);
	173	if (data == NULL) {
	174	ret = ENOMEM;
	175	goto out;
	176	}
	177	ret = csops_task(task, CS_OPS_IDENTITY, data, bufferlen);
	178	if (ret) {
	179	ret = errno;
	180	goto out;
	181	}
	182	data[bufferlen] = '\0';
	183
	184	signingId = CFStringCreateWithCString(NULL, data + 8, kCFStringEncodingUTF8);
	185
	186	out:
	187	if (data)
	188	free(data);
	189	if (ret && error)
	190	*error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
	191
	192	return signingId;
	193	}
	194
fa7225c8 A	195	uint32_t
	196	SecTaskGetCodeSignStatus(SecTaskRef task)
	197	{
	198	uint32_t flags = 0;
	199	if (csops_task(task, CS_OPS_STATUS, &flags, sizeof(flags)) != 0)
	200	return 0;
	201	return flags;
	202	}
d8f41ccd A	203
	204	static bool SecTaskLoadEntitlements(SecTaskRef task, CFErrorRef *error)
	205	{
	206	CFMutableDictionaryRef entitlements = NULL;
	207	struct csheader header;
	208	uint8_t *buffer = NULL;
	209	uint32_t bufferlen;
	210	int ret;
	211
	212
	213	ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, &header, sizeof(header));
	214	/* Any other combination means no entitlements */
5c19dc3a A	215	if (ret == -1) {
5c19dc3a A	216	if (errno != ERANGE) {
e0e0d90e A	217	int entitlementErrno = errno;
	218
	219	uint32_t cs_flags = -1;
	220	if (-1 == csops_task(task, CS_OPS_STATUS, &cs_flags, sizeof(cs_flags))) {
	221	syslog(LOG_NOTICE, "Failed to get cs_flags, error=%d", errno);
	222	}
	223
fa7225c8	224	if (cs_flags != 0) { // was signed
866f8763 A	225
	226	pid_t pid;
	227	audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
	228	syslog(LOG_NOTICE, "SecTaskLoadEntitlements failed error=%d cs_flags=%x, pid=%d", entitlementErrno, cs_flags, pid); // to ease diagnostics
e0e0d90e	229
fa7225c8 A	230	CFStringRef description = SecTaskCopyDebugDescription(task);
	231	char *descriptionBuf = NULL;
	232	CFIndex descriptionSize = CFStringGetLength(description) * 4;
	233	descriptionBuf = (char *)malloc(descriptionSize);
	234	if (!CFStringGetCString(description, descriptionBuf, descriptionSize, kCFStringEncodingUTF8)) {
	235	descriptionBuf[0] = 0;
	236	}
e0e0d90e	237
fa7225c8	238	syslog(LOG_NOTICE, "SecTaskCopyDebugDescription: %s", descriptionBuf);
866f8763	239	CFReleaseNull(description);
fa7225c8 A	240	free(descriptionBuf);
	241	}
	242	task->lastFailure = entitlementErrno; // was overwritten by csops_task(CS_OPS_STATUS) above
e0e0d90e	243
5c19dc3a	244	// EINVAL is what the kernel says for unsigned code, so we'll have to let that pass
e0e0d90e	245	if (entitlementErrno == EINVAL) {
5c19dc3a A	246	task->entitlementsLoaded = true;
	247	return true;
	248	}
e0e0d90e	249	ret = entitlementErrno; // what really went wrong
5c19dc3a A	250	goto out; // bail out
5c19dc3a A	251	}
d8f41ccd A	252	bufferlen = ntohl(header.length);
	253	/* check for insane values */
	254	if (bufferlen > 1024 * 1024 \|\| bufferlen < 8) {
fa7225c8	255	ret = E2BIG;
d8f41ccd A	256	goto out;
	257	}
	258	buffer = malloc(bufferlen);
	259	if (buffer == NULL) {
	260	ret = ENOMEM;
	261	goto out;
	262	}
	263	ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, buffer, bufferlen);
	264	if (ret) {
	265	ret = errno;
	266	goto out;
	267	}
	268
	269	CFDataRef data = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, buffer+8, bufferlen-8, kCFAllocatorNull);
	270	entitlements = (CFMutableDictionaryRef) CFPropertyListCreateWithData(kCFAllocatorDefault, data, kCFPropertyListMutableContainers, NULL, error);
866f8763	271	CFReleaseNull(data);
d8f41ccd A	272
d8f41ccd A	273	if((entitlements==NULL) \|\| (CFGetTypeID(entitlements)!=CFDictionaryGetTypeID())){
fa7225c8	274	ret = EDOM; // don't use EINVAL here; it conflates problems with syscall error returns
d8f41ccd A	275	goto out;
	276	}
	277	}
	278
	279	task->entitlements = entitlements ? CFRetain(entitlements) : NULL;
	280	task->entitlementsLoaded = true;
	281
	282	out:
866f8763	283	CFReleaseNull(entitlements);
d8f41ccd A	284	if(buffer)
	285	free(buffer);
	286	if (ret && error && *error==NULL)
	287	*error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
	288	return ret == 0;
	289	}
	290
	291
	292	CFTypeRef SecTaskCopyValueForEntitlement(SecTaskRef task, CFStringRef entitlement, CFErrorRef *error)
	293	{
	294	CFTypeRef value = NULL;
	295	require(check_task(task), out);
	296
	297	/* Load entitlements if necessary */
	298	if (task->entitlementsLoaded == false) {
	299	require_quiet(SecTaskLoadEntitlements(task, error), out);
	300	}
	301
	302	if (task->entitlements != NULL) {
	303	value = CFDictionaryGetValue(task->entitlements, entitlement);
	304
	305	/* Return something the caller must release */
	306	if (value != NULL) {
	307	CFRetain(value);
	308	}
	309	}
	310	out:
	311	return value;
	312	}
	313
	314	CFDictionaryRef SecTaskCopyValuesForEntitlements(SecTaskRef task, CFArrayRef entitlements, CFErrorRef *error)
	315	{
	316	CFMutableDictionaryRef values = NULL;
	317	require(check_task(task), out);
	318
	319	/* Load entitlements if necessary */
	320	if (task->entitlementsLoaded == false) {
	321	SecTaskLoadEntitlements(task, error);
	322	}
	323
	324	/* Iterate over the passed in entitlements, populating the dictionary
	325	* If entitlements were loaded but none were present, return an empty
	326	* dictionary */
	327	if (task->entitlementsLoaded == true) {
	328
	329	CFIndex i, count = CFArrayGetCount(entitlements);
	330	values = CFDictionaryCreateMutable(CFGetAllocator(task), count, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
	331	if (task->entitlements != NULL) {
	332	for (i = 0; i < count; i++) {
	333	CFStringRef entitlement = CFArrayGetValueAtIndex(entitlements, i);
	334	CFTypeRef value = CFDictionaryGetValue(task->entitlements, entitlement);
	335	if (value != NULL) {
	336	CFDictionarySetValue(values, entitlement, value);
	337	}
	338	}
	339	}
	340	}
	341	out:
	342	return values;
	343	}
866f8763 A	344
	345	#if TARGET_OS_OSX
	346	/*
	347	* Determine if the given task meets a specified requirement.
	348	*/
	349	OSStatus
	350	SecTaskValidateForRequirement(SecTaskRef task, CFStringRef requirement)
	351	{
	352	OSStatus status;
	353	SecCodeRef code = NULL;
	354	SecRequirementRef req = NULL;
	355
	356	CFMutableDictionaryRef codeDict = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
	357	CFDataRef auditData = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&task->token, sizeof(audit_token_t));
	358	CFDictionarySetValue(codeDict, kSecGuestAttributeAudit, auditData);
	359	status = SecCodeCopyGuestWithAttributes(NULL, codeDict, kSecCSDefaultFlags, &code);
	360	CFReleaseNull(codeDict);
	361	CFReleaseNull(auditData);
	362
	363	if (!status) {
	364	status = SecRequirementCreateWithString(requirement,
	365	kSecCSDefaultFlags, &req);
	366	}
	367	if (!status) {
	368	status = SecCodeCheckValidity(code, kSecCSDefaultFlags, req);
	369	}
	370
	371	CFReleaseNull(req);
	372	CFReleaseNull(code);
	373
	374	return status;
	375	}
	376	#endif /* TARGET_OS_OSX */
	377
	378	Boolean SecTaskEntitlementsValidated(SecTaskRef task) {
	379	// TODO: Cache the result
	380	uint32_t csflags = 0;
	381	const uint32_t mask = CS_VALID \| CS_KILL \| CS_ENTITLEMENTS_VALIDATED;
	382	int rc = csops_task(task, CS_OPS_STATUS, &csflags, sizeof(csflags));
	383	return rc != -1 && ((csflags & mask) == mask);
	384	}
	385