keychain/KeychainDataclassOwner/KeychainDataclassOwner.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "KeychainDataclassOwner.h"
  25 #import "NSError+UsefulConstructors.h"
  26 #import "OTControl.h"
  27 #import "SecCFRelease.h"
  28 #import "SOSCloudCircle.h"
  29 #import "debugging.h"
  30 #import "OT.h"
  31 #import <Accounts/Accounts.h>
  32 #import <Accounts/ACDataclassAction.h>
  33 #import <Accounts/ACConstants.h>
  34 #import <Security/Security.h>
  35 #import <Security/SecItemPriv.h>
  36
  37 @implementation KeychainDataclassOwner
  38
  39 static NSString* const KeychainDataclass = @"KeychainDataclass";
  40
  41 + (NSArray*)dataclasses
  42 {
  43     return @[kAccountDataclassKeychainSync];
  44 }
  45
  46 - (NSArray*)actionsForDeletingAccount:(ACAccount*)account forDataclass:(NSString*)dataclass
  47 {
  48     if (![dataclass isEqual:kAccountDataclassKeychainSync]) {
  49         return nil;
  50     }
  51
  52     ACDataclassAction* cancelAction = [ACDataclassAction actionWithType:ACDataclassActionCancel];
  53     ACDataclassAction* deleteAction = [ACDataclassAction actionWithType:ACDataclassActionDeleteSyncData];
  54     ACDataclassAction* keepAction = [ACDataclassAction actionWithType:ACDataclassActionMergeSyncDataIntoLocalData];
  55
  56     return @[cancelAction, deleteAction, keepAction];
  57 }
  58
  59 - (NSArray*)actionsForDisablingDataclassOnAccount:(ACAccount*)account forDataclass:(NSString*)dataclass
  60 {
  61     return [self actionsForDeletingAccount:account forDataclass:dataclass];
  62 }
  63
  64
  65 - (BOOL)performAction:(ACDataclassAction*)action forAccount:(ACAccount*)account withChildren:(NSArray*)childAccounts forDataclass:(NSString*)dataclass withError:(NSError**)error
  66 {
  67     // if the user asked us to delete their data, do that now
  68     // we should rejigger this implementation to send a new custom message to security with an entitlement specifically for the signout case
  69     // then we can do all the things we need to in securityd without having to entitlement the dataclass owners manager to read keychain items
  70     // <rdar://problem/42436575> redo KeychainDataclassOwner to remove Safari items from DataclassOwnerManager's entitlements
  71     if (action.type == ACDataclassActionDeleteSyncData) {
  72         NSDictionary* baseQuery = @{ (id)kSecAttrSynchronizable : @(YES),
  73                                      (id)kSecAttrAccessGroup : @"com.apple.cfnetwork",
  74                                      (id)kSecAttrNoLegacy : @(YES),
  75                                      (id)kSecAttrTombstone : @(NO),
  76                                      (id)kSecUseTombstones : @(NO) };
  77         NSMutableDictionary* inetQuery = baseQuery.mutableCopy;
  78         inetQuery[(id)kSecClass] = (id)kSecClassInternetPassword;
  79         OSStatus inetResult = SecItemDelete((__bridge CFDictionaryRef)inetQuery);
  80
  81         NSMutableDictionary* genpQuery = baseQuery.mutableCopy;
  82         genpQuery[(id)kSecClass] = (id)kSecClassGenericPassword;
  83         OSStatus genpResult = SecItemDelete((__bridge CFDictionaryRef)genpQuery);
  84
  85         NSMutableDictionary* certQuery = baseQuery.mutableCopy;
  86         certQuery[(id)kSecClass] = (id)kSecClassCertificate;
  87         OSStatus certResult = SecItemDelete((__bridge CFDictionaryRef)certQuery);
  88
  89         NSMutableDictionary* keyQuery = baseQuery.mutableCopy;
  90         keyQuery[(id)kSecClass] = (id)kSecClassKey;
  91         OSStatus keyResult = SecItemDelete((__bridge CFDictionaryRef)keyQuery);
  92
  93         NSMutableDictionary* creditCardsQuery = baseQuery.mutableCopy;
  94         creditCardsQuery[(id)kSecClass] = (id)kSecClassGenericPassword;
  95         creditCardsQuery[(id)kSecAttrAccessGroup] = @"com.apple.safari.credit-cards";
  96         OSStatus creditCardsResult = SecItemDelete((__bridge CFDictionaryRef)creditCardsQuery);
  97
  98         if (inetResult != errSecSuccess) {
  99             secwarning("failed to delete synchronizable passwords from table inet: %d", (int)inetResult);
 100         }
 101         if (genpResult != errSecSuccess) {
 102             secwarning("failed to delete synchronizable passwords from table genp: %d", (int)genpResult);
 103         }
 104         if (certResult != errSecSuccess) {
 105             secwarning("failed to delete synchronizable passwords from table cert: %d", (int)certResult);
 106         }
 107         if (keyResult != errSecSuccess) {
 108             secwarning("failed to delete synchronizable passwords from table keys: %d", (int)keyResult);
 109         }
 110         if (creditCardsResult != errSecSuccess) {
 111             secwarning("failed to delete credit cards from table genp: %d", (int)creditCardsResult);
 112         }
 113     }
 114
 115     return YES;
 116 }
 117
 118 @end