git.saurik.com Git - apple/security.git/blame_incremental - OSX/libsecurity

... / ...

Commit	Line	Data
	1	/*
	2	* Copyright (c) 2006-2012,2014 Apple Inc. All Rights Reserved.
	3	*
	4	* @APPLE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. Please obtain a copy of the License at
	10	* http://www.opensource.apple.com/apsl/ and read it before using this
	11	* file.
	12	*
	13	* The Original Code and all software distributed under the License are
	14	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	15	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	16	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	17	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	18	* Please see the License for the specific language governing rights and
	19	* limitations under the License.
	20	*
	21	* @APPLE_LICENSE_HEADER_END@
	22	*/
	23
	24	//
	25	// signer - Signing operation supervisor and controller
	26	//
	27	#ifndef _H_SIGNER
	28	#define _H_SIGNER
	29
	30	#include "CodeSigner.h"
	31	#include "cdbuilder.h"
	32	#include "signerutils.h"
	33	#include "StaticCode.h"
	34	#include <security_utilities/utilities.h>
	35
	36	namespace Security {
	37	namespace CodeSigning {
	38
	39
	40	//
	41	// The signer driver class.
	42	// This is a workflow object, containing all the data needed for the various
	43	// signing stages to cooperate. It is not meant to be API visible; that is
	44	// SecCodeSigner's job.
	45	//
	46	class SecCodeSigner::Signer : public DiskRep::SigningContext {
	47	public:
	48	Signer(SecCodeSigner &s, SecStaticCode *c) : state(s), code(c), requirements(NULL)
	49	{ strict = signingFlags() & kSecCSSignStrictPreflight; }
	50	~Signer() { ::free((Requirements *)requirements); }
	51
	52	void sign(SecCSFlags flags);
	53	void remove(SecCSFlags flags);
	54
	55	SecCodeSigner &state;
	56	SecStaticCode * const code;
	57
	58	const CodeDirectory::HashAlgorithms& digestAlgorithms() const { return hashAlgorithms; }
	59	void setDigestAlgorithms(CodeDirectory::HashAlgorithms types) { hashAlgorithms = types; }
	60
	61	std::string path() const { return cfStringRelease(rep->copyCanonicalPath()); }
	62	SecIdentityRef signingIdentity() const { return state.mSigner; }
	63	std::string signingIdentifier() const { return identifier; }
	64
	65	protected:
	66	void prepare(SecCSFlags flags); // set up signing parameters
	67	void signMachO(Universal *fat, const Requirement::Context &context); // sign a Mach-O binary
	68	void signArchitectureAgnostic(const Requirement::Context &context); // sign anything else
	69
	70	void populate(DiskRep::Writer &writer); // global
	71	void populate(CodeDirectory::Builder &builder, DiskRep::Writer &writer,
	72	InternalRequirements &ireqs,
	73	size_t offset, size_t length,
	74	bool mainBinary, size_t execSegBase, size_t execSegLimit,
	75	unsigned alternateDigestCount); // per-architecture
	76	CFDataRef signCodeDirectory(const CodeDirectory *cd, CFDataRef hashBag);
	77
	78	uint32_t cdTextFlags(std::string text); // convert text CodeDirectory flags
	79	std::string uniqueName() const; // derive unique string from rep
	80
	81	protected:
	82	std::string sdkPath(const std::string &path) const;
	83	bool isAdhoc() const;
	84	SecCSFlags signingFlags() const;
	85
	86	private:
	87	void considerTeamID(const PreSigningContext& context);
	88	std::vector<Endian<uint32_t> > topSlots(CodeDirectory::Builder &builder) const;
	89
	90	static bool booleanEntitlement(CFDictionaryRef entDict, CFStringRef key);
	91	static uint64_t entitlementsToExecSegFlags(CFDataRef entitlements);
	92
	93	protected:
	94	void buildResources(std::string root, std::string relBase, CFDictionaryRef rules);
	95	CFMutableDictionaryRef signNested(const std::string &path, const std::string &relpath);
	96	CFDataRef hashFile(const char *path, CodeDirectory::HashAlgorithm type);
	97	CFDictionaryRef hashFile(const char *path, CodeDirectory::HashAlgorithms types);
	98
	99	private:
	100	RefPointer<DiskRep> rep; // DiskRep of Code being signed
	101	CFRef<CFDictionaryRef> resourceDirectory; // resource directory
	102	CFRef<CFDataRef> resourceDictData; // XML form of resourceDirectory
	103	CodeDirectory::HashAlgorithms hashAlgorithms; // hash algorithm(s) to use
	104	std::string identifier; // signing identifier
	105	std::string teamID; // team identifier
	106	CFRef<CFDataRef> entitlements; // entitlements
	107	uint32_t cdFlags; // CodeDirectory flags
	108	const Requirements *requirements; // internal requirements ready-to-use
	109	size_t pagesize; // size of main executable pages
	110	CFAbsoluteTime signingTime; // signing time for CMS signature (0 => now)
	111	bool emitSigningTime; // emit signing time as a signed CMS attribute
	112	bool strict; // strict validation
	113
	114	private:
	115	Mutex resourceLock;
	116	};
	117
	118
	119	} // end namespace CodeSigning
	120	} // end namespace Security
	121
	122	#endif // !_H_CODESIGNER