SecurityServer/Authorization/AuthorizationEngine.cpp

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 /*
  20  *  AuthorizationEngine.cpp
  21  *  Authorization
  22  *
  23  *  Created by Michael Brouwer on Thu Oct 12 2000.
  24  *  Copyright (c) 2000 Apple Computer Inc. All rights reserved.
  25  *
  26  */
  27 #include "AuthorizationEngine.h"
  28 #include <Security/AuthorizationWalkers.h>
  29
  30 #include "server.h"
  31 #include "authority.h"
  32
  33 #include <Security/AuthorizationTags.h>
  34 #include <Security/logging.h>
  35 #include <Security/cfutilities.h>
  36 #include <Security/debugging.h>
  37 #include "session.h"
  38
  39 #include <CoreFoundation/CFData.h>
  40 #include <CoreFoundation/CFNumber.h>
  41 #include <CoreFoundation/CFPropertyList.h>
  42
  43 #include <errno.h>
  44 #include <fcntl.h>
  45 #include <float.h>
  46 #include <unistd.h>
  47 #include <grp.h>
  48 #include <pwd.h>
  49 #include <Security/checkpw.h>
  50
  51 // checkpw() that uses provided struct passwd
  52 extern "C"
  53 {
  54 int checkpw_internal( const char* userName, const char* password, const struct passwd *pw );
  55 }
  56
  57 namespace Authorization {
  58
  59
  60 //
  61 // Errors to be thrown
  62 //
  63 Error::Error(int err) : error(err)
  64 {
  65 }
  66
  67 const char *Error::what() const throw()
  68 { return "Authorization error"; }
  69
  70 CSSM_RETURN Error::cssmError() const throw()
  71 { return error; }       // @@@ eventually...
  72
  73 OSStatus Error::osStatus() const throw()
  74 { return error; }
  75
  76 void Error::throwMe(int err) { throw Error(err); }
  77
  78
  79 //
  80 // CredentialImpl class
  81 //
  82
  83 // only for testing whether this credential is usable
  84 CredentialImpl::CredentialImpl(const string &username, const uid_t uid, const gid_t gid, bool shared) :
  85 mUsername(username), mShared(shared), mUid(uid), mGid(gid), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(true)
  86 {
  87 }
  88
  89 // credential with validity based on username/password combination.
  90 CredentialImpl::CredentialImpl(const string &username, const string &password, bool shared) :
  91 mShared(shared), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(false)
  92 {
  93         // try short name first
  94         const char *user = username.c_str();
  95         struct passwd *pw = getpwnam(user);
  96
  97     do {
  98
  99         if (!pw)
 100         {
 101             debug("autheval", "user %s not found, creating invalid credential", user);
 102             break;
 103         }
 104
 105         const char *passwd = password.c_str();
 106         int checkpw_status = checkpw_internal(user, passwd, pw);
 107
 108         if (checkpw_status != CHECKPW_SUCCESS)
 109         {
 110                                 debug("autheval", "checkpw() for user %s failed with error %d, creating invalid credential", user, checkpw_status);
 111                                 break;
 112         }
 113
 114                 debug("autheval", "checkpw() for user %s succeeded, creating%s credential",
 115                         user, mShared ? " shared" : "");
 116
 117                 mUsername = string ( pw->pw_name );
 118                 mUid = pw->pw_uid;
 119                 mGid = pw->pw_gid;
 120                 mValid = true;
 121
 122         endpwent();
 123     }
 124         while (0);
 125 }
 126
 127
 128 CredentialImpl::~CredentialImpl()
 129 {
 130 }
 131
 132 bool
 133 CredentialImpl::operator < (const CredentialImpl &other) const
 134 {
 135         if (!mShared && other.mShared)
 136                 return true;
 137         if (!other.mShared && mShared)
 138                 return false;
 139
 140         return mUsername < other.mUsername;
 141 }
 142
 143 // Returns true if this CredentialImpl should be shared.
 144 bool
 145 CredentialImpl::isShared() const
 146 {
 147         return mShared;
 148 }
 149
 150 // Merge with other
 151 void
 152 CredentialImpl::merge(const CredentialImpl &other)
 153 {
 154         assert(mUsername == other.mUsername);
 155
 156         if (other.mValid && (!mValid || mCreationTime < other.mCreationTime))
 157         {
 158                 mCreationTime = other.mCreationTime;
 159                 mUid = other.mUid;
 160                 mGid = other.mGid;
 161                 mValid = true;
 162         }
 163 }
 164
 165 // The time at which this credential was obtained.
 166 CFAbsoluteTime
 167 CredentialImpl::creationTime() const
 168 {
 169         return mCreationTime;
 170 }
 171
 172 // Return true iff this credential is valid.
 173 bool
 174 CredentialImpl::isValid() const
 175 {
 176         return mValid;
 177 }
 178
 179 void
 180 CredentialImpl::invalidate()
 181 {
 182         mValid = false;
 183 }
 184
 185 //
 186 // Credential class
 187 //
 188 Credential::Credential() :
 189 RefPointer<CredentialImpl>(NULL)
 190 {
 191 }
 192
 193 Credential::Credential(CredentialImpl *impl) :
 194 RefPointer<CredentialImpl>(impl)
 195 {
 196 }
 197
 198 Credential::Credential(const string &username, const uid_t uid, const gid_t gid, bool shared) :
 199 RefPointer<CredentialImpl>(new CredentialImpl(username, uid, gid, shared))
 200 {
 201 }
 202
 203 Credential::Credential(const string &username, const string &password, bool shared) :
 204 RefPointer<CredentialImpl>(new CredentialImpl(username, password, shared))
 205 {
 206 }
 207
 208 Credential::~Credential()
 209 {
 210 }
 211
 212 bool
 213 Credential::operator < (const Credential &other) const
 214 {
 215         if (!*this)
 216                 return other;
 217
 218         if (!other)
 219                 return false;
 220
 221         return (**this) < (*other);
 222 }
 223
 224
 225 //
 226 // Rule class
 227 //
 228 CFStringRef Rule::kUserInGroupID = CFSTR("group");
 229 CFStringRef Rule::kTimeoutID = CFSTR("timeout");
 230 CFStringRef Rule::kSharedID = CFSTR("shared");
 231 CFStringRef Rule::kAllowRootID = CFSTR("allow-root");
 232 CFStringRef Rule::kDenyID = CFSTR("deny");
 233 CFStringRef Rule::kAllowID = CFSTR("allow");
 234 CFStringRef Rule::kEvalMechID = CFSTR("eval");
 235
 236
 237 Rule::Rule() :
 238 mType(kUserInGroup), mGroupName("admin"), mMaxCredentialAge(300.0), mShared(true), mAllowRoot(false)
 239 {
 240         // @@@ Default rule is shared admin group with 5 minute timeout
 241 }
 242
 243 Rule::Rule(CFTypeRef cfRule)
 244 {
 245         // @@@ This code is ugly.  Serves me right for using CF.
 246         if (CFGetTypeID(cfRule) == CFStringGetTypeID())
 247         {
 248                 CFStringRef tag = reinterpret_cast<CFStringRef>(cfRule);
 249                 if (CFEqual(kAllowID, tag))
 250                 {
 251                         debug("authrule", "rule always allow");
 252                         mType = kAllow;
 253                 }
 254                 else if (CFEqual(kDenyID, tag))
 255                 {
 256                         debug("authrule", "rule always deny");
 257                         mType = kDeny;
 258                 }
 259                 else
 260                         Error::throwMe();
 261         }
 262         else if (CFGetTypeID(cfRule) == CFDictionaryGetTypeID())
 263         {
 264                 CFDictionaryRef dict = reinterpret_cast<CFDictionaryRef>(cfRule);
 265                 CFTypeRef groupTag = CFDictionaryGetValue(dict, kUserInGroupID);
 266
 267         // Probably a user in group rule
 268         if (groupTag)
 269         {
 270             if (CFGetTypeID(groupTag) != CFStringGetTypeID())
 271                 Error::throwMe();
 272
 273             mType = kUserInGroup;
 274
 275             CFStringRef group = reinterpret_cast<CFStringRef>(groupTag);
 276             char buffer[512];
 277             const char *ptr = CFStringGetCStringPtr(group, kCFStringEncodingUTF8);
 278             if (ptr == NULL)
 279             {
 280                 if (CFStringGetCString(group, buffer, 512, kCFStringEncodingUTF8))
 281                     ptr = buffer;
 282                 else
 283                     Error::throwMe();
 284             }
 285
 286             mGroupName = string(ptr);
 287
 288             mMaxCredentialAge = DBL_MAX;
 289             CFTypeRef timeoutTag = CFDictionaryGetValue(dict, kTimeoutID);
 290             if (timeoutTag)
 291             {
 292                 if (CFGetTypeID(timeoutTag) != CFNumberGetTypeID())
 293                     Error::throwMe();
 294                 CFNumberGetValue(reinterpret_cast<CFNumberRef>(timeoutTag), kCFNumberDoubleType, &mMaxCredentialAge);
 295             }
 296
 297             CFTypeRef sharedTag = CFDictionaryGetValue(dict, kSharedID);
 298             mShared = false;
 299             if (sharedTag)
 300             {
 301                 if (CFGetTypeID(sharedTag) != CFBooleanGetTypeID())
 302                     Error::throwMe();
 303                 mShared = CFBooleanGetValue(reinterpret_cast<CFBooleanRef>(sharedTag));
 304             }
 305
 306             CFTypeRef allowRootTag = CFDictionaryGetValue(dict, kAllowRootID);
 307             mAllowRoot = false;
 308             if (allowRootTag)
 309             {
 310                 if (CFGetTypeID(allowRootTag) != CFBooleanGetTypeID())
 311                     Error::throwMe();
 312                 mAllowRoot = CFBooleanGetValue(reinterpret_cast<CFBooleanRef>(allowRootTag));
 313             }
 314             debug("authrule", "rule user in group \"%s\" timeout %g%s%s",
 315                 mGroupName.c_str(), mMaxCredentialAge, mShared ? " shared" : "",
 316                 mAllowRoot ? " allow-root" : "");
 317         }
 318         else
 319         {
 320             CFTypeRef mechTag = CFDictionaryGetValue(dict, kEvalMechID);
 321             if (mechTag)
 322             {
 323                 if (CFGetTypeID(mechTag) != CFStringGetTypeID())
 324                     Error::throwMe();
 325
 326                 mType = kEvalMech;
 327
 328                 CFStringRef eval = reinterpret_cast<CFStringRef>(mechTag);
 329                 char buffer[512];
 330                 const char *ptr = CFStringGetCStringPtr(eval, kCFStringEncodingUTF8);
 331                 if (ptr == NULL)
 332                 {
 333                     if (CFStringGetCString(eval, buffer, 512, kCFStringEncodingUTF8))
 334                         ptr = buffer;
 335                     else
 336                         Error::throwMe();
 337                 }
 338                 mEvalDef = string(ptr);
 339             }
 340             else
 341                 Error::throwMe();
 342         }
 343
 344         }
 345 }
 346
 347 Rule::Rule(const Rule &other) :
 348 mType(other.mType),
 349 mGroupName(other.mGroupName),
 350 mMaxCredentialAge(other.mMaxCredentialAge),
 351 mShared(other.mShared),
 352 mAllowRoot(other.mAllowRoot),
 353 mEvalDef(other.mEvalDef)
 354 {
 355 }
 356
 357 Rule &
 358 Rule::operator = (const Rule &other)
 359 {
 360         mType = other.mType;
 361         mGroupName = other.mGroupName;
 362         mMaxCredentialAge = other.mMaxCredentialAge;
 363         mShared = other.mShared;
 364         mAllowRoot = other.mAllowRoot;
 365         mEvalDef = other.mEvalDef;
 366         return *this;
 367 }
 368
 369 Rule::~Rule()
 370 {
 371 }
 372
 373
 374 OSStatus
 375 Rule::evaluateMechanism(const AuthorizationEnvironment *environment, AuthorizationToken &auth, CredentialSet &outCredentials)
 376 {
 377         assert(mType == kEvalMech);
 378
 379     if (mEvalDef.length() == 0) // no definition
 380         return kAuthorizationResultAllow;
 381
 382     // mechanisms are split by commas
 383     vector<string> mechanismNames;
 384     {
 385         string::size_type cursor = 0, comma = 0;
 386         string token = "";
 387
 388         while (cursor < mEvalDef.length())
 389         {
 390             comma = mEvalDef.find(',', cursor);
 391             if (comma == string::npos)
 392                     comma = mEvalDef.length();
 393
 394             token = mEvalDef.substr(cursor, comma - cursor);
 395
 396             // skip empty tokens
 397             if (token.length() > 0)
 398                 mechanismNames.push_back(token);
 399
 400             cursor = comma + 1;
 401         }
 402     }
 403
 404     // @@@ configuration does not support arguments
 405     const AuthorizationValueVector arguments = { 0, NULL };
 406     MutableAuthItemSet *context = NULL;
 407     AuthItemSet *hints = NULL;
 408     AuthorizationItemSet *outHints = NULL, *outContext = NULL;
 409     bool userInteraction = true;
 410
 411     CssmAllocator& alloc = CssmAllocator::standard();
 412
 413     AuthorizationResult result = kAuthorizationResultAllow;
 414     vector<string>::iterator currentMechanism = mechanismNames.begin();
 415
 416     while ( (result == kAuthorizationResultAllow)  &&
 417             (currentMechanism != mechanismNames.end()) ) // iterate mechanisms
 418     {
 419         AuthorizationItemSet *inHints, *inContext;
 420
 421         // release after invocation, ignored for first pass
 422         if (outContext)
 423         {
 424             inContext = outContext;
 425             debug("SSevalMech", "set up context %p as input", inContext);
 426             delete context;
 427             context = new MutableAuthItemSet(inContext);
 428         }
 429         else
 430         {
 431             inContext = &auth.infoSet(); // returns deep copy
 432             debug("SSevalMech", "set up stored context %p as input", inContext);
 433             delete context;
 434             context = new MutableAuthItemSet(inContext);
 435         }
 436
 437         if (outHints)
 438         {
 439             inHints = outHints;
 440             debug("SSevalMech", "set up hints %p as input", inHints);
 441             delete hints;
 442             hints = new AuthItemSet(outHints);
 443         }
 444         else
 445         {
 446             inHints = NULL;
 447             debug("SSevalMech", "set up environment hints %p as input", environment);
 448             delete hints;
 449             hints = new AuthItemSet(environment);
 450         }
 451
 452         string::size_type extPlugin = currentMechanism->find(':');
 453         if (extPlugin != string::npos)
 454         {
 455             // no whitespace removal
 456             string pluginIn(currentMechanism->substr(0, extPlugin));
 457             string mechanismIn(currentMechanism->substr(extPlugin + 1));
 458             debug("SSevalMech", "external mech %s:%s", pluginIn.c_str(), mechanismIn.c_str());
 459
 460             bool mechExecOk = false; // successfully ran a mechanism
 461
 462             try
 463             {
 464                 Process &cltProc = Server::active().connection().process;
 465                 // Authorization preserves creator's UID in setuid processes
 466                 uid_t cltUid = (cltProc.uid() != 0) ? cltProc.uid() : auth.creatorUid();
 467                 debug("SSevalMech", "Mechanism invocation by process %d (UID %d)", cltProc.pid(), cltUid);
 468                 QueryInvokeMechanism client(cltUid, auth);
 469
 470                 mechExecOk = client(pluginIn, mechanismIn, &arguments, *hints, *context, &result, outHints, outContext);
 471                 debug("SSevalMech", "new context %p, new hints %p", outContext, outHints);
 472             }
 473             catch (...) {
 474                 debug("SSevalMech", "exception from mech eval or client death");
 475                 // various server problems, but only if it really failed
 476                 if (mechExecOk != true)
 477                     result = kAuthorizationResultUndefined;
 478             }
 479
 480             debug("SSevalMech", "evaluate(plugin: %s, mechanism: %s) %s, result: %lu.", pluginIn.c_str(), mechanismIn.c_str(), (mechExecOk == true) ? "succeeded" : "failed", result);
 481             debug("SSevalMech", "mech eval okay");
 482
 483             // Things worked and there is new context, so get rid of old
 484             if (mechExecOk)
 485             {
 486                 if (inContext)
 487                 {
 488                     debug("SSevalMech", "release input context %p", inContext);
 489                     alloc.free(inContext);
 490                 }
 491                 if (inHints)
 492                 {
 493                     debug("SSevalMech", "release input hints %p", inHints);
 494                     alloc.free(inHints);
 495                 }
 496             }
 497             else
 498             {
 499                 // reset previous context and hints
 500                 debug("SSevalMech", "resetting previous input context %p and hints %p", inContext, inHints);
 501                 outContext = inContext;
 502                 outHints = inHints;
 503             }
 504         }
 505         else
 506         {
 507             // internal mechanisms - no glue
 508             if (*currentMechanism == "authinternal")
 509             {
 510                 debug("SSevalMech", "evaluate authinternal");
 511                 result = kAuthorizationResultDeny;
 512                 do {
 513                     MutableAuthItemSet::iterator found = find_if(context->begin(), context->end(), FindAuthItemByRightName(kAuthorizationEnvironmentUsername) );
 514                     if (found == context->end())
 515                         break;
 516                     string username(static_cast<const char *>(found->argument()), found->argumentLength());
 517                     debug("SSevalMech", "found username");
 518                     found = find_if(context->begin(), context->end(), FindAuthItemByRightName(kAuthorizationEnvironmentPassword) );
 519                     if (found == context->end())
 520                         break;
 521                     string password(static_cast<const char *>(found->argument()), found->argumentLength());
 522                     debug("SSevalMech", "found password");
 523                     Credential newCredential(username, password, true); // create a new shared credential
 524                     if (newCredential->isValid())
 525                     {
 526                         outCredentials.clear(); // only keep last one
 527                         debug("SSevalMech", "inserting new credential");
 528                         outCredentials.insert(newCredential);
 529                         result = kAuthorizationResultAllow;
 530                     } else
 531                         result = kAuthorizationResultDeny;
 532                 } while (0);
 533             }
 534             else
 535             if (*currentMechanism == "push_hints_to_context")
 536             {
 537                 debug("SSevalMech", "evaluate push_hints_to_context");
 538                 userInteraction = false; // we can't talk to the user
 539                 result = kAuthorizationResultAllow; // snarfcredential doesn't block evaluation, ever, it may restart
 540                 // clean up current context
 541                 if (inContext)
 542                 {
 543                     debug("SSevalMech", "release input context %p", inContext);
 544                     alloc.free(inContext);
 545                 }
 546                 // create out context from input hints, no merge
 547                 // @@@ global copy template not being invoked...
 548                 outContext = Copier<AuthorizationItemSet>(*hints).keep();
 549             }
 550             else
 551             if (*currentMechanism == "switch_to_user")
 552             {
 553                 try {
 554                     Process &cltProc = Server::active().connection().process;
 555                     // Authorization preserves creator's UID in setuid processes
 556                     uid_t cltUid = (cltProc.uid() != 0) ? cltProc.uid() : auth.creatorUid();
 557                     debug("SSevalMech", "terminating agent at request of process %d (UID %d)\n", cltProc.pid(), cltUid);
 558                     QueryTerminateAgent client(cltUid, auth);
 559                     client();
 560                 } catch (...) {
 561                     // Not our agent
 562                 }
 563                 result = kAuthorizationResultAllow;
 564             }
 565
 566
 567
 568         }
 569
 570
 571         // we own outHints and outContext
 572         switch(result)
 573         {
 574             case kAuthorizationResultAllow:
 575                 debug("SSevalMech", "result allow");
 576                 currentMechanism++;
 577                 break;
 578             case kAuthorizationResultDeny:
 579                 debug("SSevalMech", "result deny");
 580                 if (inContext)
 581                 {
 582                     debug("SSevalMech", "abort eval, release input context %p", inContext);
 583                     alloc.free(inContext);
 584                 }
 585                 if (inHints)
 586                 {
 587                     debug("SSevalMech", "abort eval, release input hints %p", inHints);
 588                     alloc.free(inHints);
 589                 }
 590                 outContext = outHints = NULL; // making sure things get reset
 591                 if (userInteraction)
 592                 {
 593                     currentMechanism = mechanismNames.begin();
 594                     result = kAuthorizationResultAllow; // stay in loop
 595                 }
 596                 break;
 597             case kAuthorizationResultUndefined:
 598                 debug("SSevalMech", "result undefined");
 599                 break; // abort evaluation
 600             case kAuthorizationResultUserCanceled:
 601                 debug("SSevalMech", "result canceled");
 602                 break; // stop evaluation, return some sideband
 603             default:
 604                 break; // abort evaluation
 605         }
 606     }
 607
 608     // End of evaluation, if last step produced meaningful data, incorporate
 609     if ((result == kAuthorizationResultAllow) ||
 610         (result == kAuthorizationResultUserCanceled)) // @@@ can only pass back sideband through context
 611     {
 612         debug("SSevalMech", "make new context %p available", outContext);
 613         auth.setInfoSet(*outContext);
 614         outContext = NULL;
 615     }
 616
 617     // clean up last outContext and outHints, if any
 618     if (outContext)
 619     {
 620         debug("SSevalMech", "release output context %p", outContext);
 621         alloc.free(outContext);
 622     }
 623     if (outHints)
 624     {
 625         debug("SSevalMech", "release output hints %p", outHints);
 626         alloc.free(outHints);
 627     }
 628
 629     // deny on user cancel
 630     switch(result)
 631     {
 632         case kAuthorizationResultUndefined:
 633             return errAuthorizationDenied;
 634         case kAuthorizationResultDeny:
 635             return errAuthorizationDenied;
 636         default:
 637             return errAuthorizationSuccess; // @@@ cancel should return cancelled
 638     }
 639 }
 640
 641 OSStatus
 642 Rule::evaluate(const Right &inRight,
 643     const AuthorizationEnvironment *environment, AuthorizationFlags flags,
 644         CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
 645         AuthorizationToken &auth)
 646 {
 647         switch (mType)
 648         {
 649         case kAllow:
 650                 debug("autheval", "rule is always allow");
 651                 return errAuthorizationSuccess;
 652         case kDeny:
 653                 debug("autheval", "rule is always deny");
 654                 return errAuthorizationDenied;
 655         case kUserInGroup:
 656                 debug("autheval", "rule is user in group");
 657                 break;
 658     case kEvalMech:
 659         debug("autheval", "rule evalutes mechanisms");
 660         return evaluateMechanism(environment, auth, credentials);
 661     default:
 662                 Error::throwMe();
 663         }
 664
 665         // If we got here, this is a kUserInGroup type rule, let's start looking for a
 666         // credential that is satisfactory
 667
 668         // Zeroth -- Here is an extra special saucy ugly hack to allow authorizations
 669         // created by a proccess running as root to automatically get a right.
 670         if (mAllowRoot && auth.creatorUid() == 0)
 671         {
 672                 debug("autheval", "creator of authorization has uid == 0 granting right %s",
 673                         inRight.rightName());
 674                 return errAuthorizationSuccess;
 675         }
 676
 677         // First -- go though the credentials we either already used or obtained during this authorize operation.
 678         for (CredentialSet::const_iterator it = credentials.begin(); it != credentials.end(); ++it)
 679         {
 680                 OSStatus status = evaluate(inRight, environment, now, *it, true);
 681                 if (status != errAuthorizationDenied)
 682                 {
 683                         // add credential to authinfo
 684                         auth.setCredentialInfo(*it);
 685                         return status;
 686                 }
 687         }
 688
 689         // Second -- go though the credentials passed in to this authorize operation by the state management layer.
 690         if (inCredentials)
 691         {
 692                 for (CredentialSet::const_iterator it = inCredentials->begin(); it != inCredentials->end(); ++it)
 693                 {
 694                         OSStatus status = evaluate(inRight, environment, now, *it, false);
 695                         if (status == errAuthorizationSuccess)
 696                         {
 697                                 // Add the credential we used to the output set.
 698                                 // @@@ Deal with potential credential merges.
 699                                 credentials.insert(*it);
 700                 // add credential to authinfo
 701                 auth.setCredentialInfo(*it);
 702
 703                                 return status;
 704                         }
 705                         else if (status != errAuthorizationDenied)
 706                                 return status;
 707                 }
 708         }
 709
 710         // Finally -- We didn't find the credential in our passed in credential lists.  Obtain a new credential if
 711         // our flags let us do so.
 712         if (!(flags & kAuthorizationFlagExtendRights))
 713                 return errAuthorizationDenied;
 714
 715         if (!(flags & kAuthorizationFlagInteractionAllowed))
 716                 return errAuthorizationInteractionNotAllowed;
 717
 718         Process &cltProc = Server::active().connection().process;
 719         // Authorization preserves creator's UID in setuid processes
 720         uid_t cltUid = (cltProc.uid() != 0) ? cltProc.uid() : auth.creatorUid();
 721         IFDEBUG(debug("autheval", "Auth query from process %d (UID %d)", cltProc.pid(), cltUid));
 722         QueryAuthorizeByGroup query(cltUid, auth);
 723
 724         string usernamehint;
 725     // username hint is taken from the user who created the authorization, unless it's clearly ineligible
 726         if (uid_t uid = auth.creatorUid()) {
 727                 struct passwd *pw = getpwuid(uid);
 728                 if (pw != NULL)
 729                 {
 730                         // avoid hinting a locked account (ie. root)
 731                         if ( (pw->pw_passwd == NULL) ||
 732                                  strcmp(pw->pw_passwd, "*") ) {
 733                                 // Check if username will authorize the request and set username to
 734                                 // be used as a hint to the user if so
 735                                 if (evaluate(inRight, environment, now, Credential(pw->pw_name, pw->pw_uid, pw->pw_gid, mShared), true) == errAuthorizationSuccess) {
 736
 737                                                 // user long name as hint
 738                                                 usernamehint = string( pw->pw_gecos );
 739 #if 0
 740                                                 // minus other gecos crud
 741                                                 size_t comma = usernamehint.find(',');
 742                                                 if (comma)
 743                                                         usernamehint = usernamehint.substr(0, comma);
 744                                                 // or fallback to short username
 745 #endif
 746                     if (usernamehint.size() == 0)
 747                                                         usernamehint = string( pw->pw_name );
 748                                 } //fi
 749                         } //fi
 750                         endpwent();
 751                 }
 752         }
 753
 754         Credential newCredential;
 755         // @@@ Keep the default reason the same, so the agent only gets userNotInGroup or invalidPassphrase
 756         SecurityAgent::Reason reason = SecurityAgent::userNotInGroup;
 757         // @@@ Hardcoded 3 tries to avoid infinite loops.
 758         for (int tryCount = 0; tryCount < 3; ++tryCount)
 759         {
 760                 // Obtain a new credential.  Anything but success is considered an error.
 761                 OSStatus status = obtainCredential(query, inRight, environment, usernamehint.c_str(), newCredential, reason);
 762                 if (status)
 763             return status;
 764
 765                 // Now we have successfully obtained a credential we need to make sure it authorizes the requested right
 766                 if (!newCredential->isValid())
 767                         reason = SecurityAgent::invalidPassphrase;
 768                 else {
 769                         status = evaluate(inRight, environment, now, newCredential, true);
 770                         if (status == errAuthorizationSuccess)
 771                         {
 772                                 // Add the new credential we obtained to the output set.
 773                                 // @@@ Deal with potential credential merges.
 774                                 credentials.insert(newCredential);
 775                                 query.done();
 776
 777                                 // add credential to authinfo
 778                                 auth.setCredentialInfo(newCredential);
 779
 780                                 return errAuthorizationSuccess;
 781                         }
 782                         else if (status != errAuthorizationDenied)
 783                                 return status;
 784                         reason = SecurityAgent::userNotInGroup;
 785                 }
 786         }
 787
 788         query.cancel(SecurityAgent::tooManyTries);
 789         return errAuthorizationDenied;
 790 }
 791
 792 // Return errAuthorizationSuccess if this rule allows access based on the specified credential,
 793 // return errAuthorizationDenied otherwise.
 794 OSStatus
 795 Rule::evaluate(const Right &inRight, const AuthorizationEnvironment *environment, CFAbsoluteTime now,
 796         const Credential &credential, bool ignoreShared)
 797 {
 798         assert(mType == kUserInGroup);
 799
 800         // Get the username from the credential
 801         const char *user = credential->username().c_str();
 802
 803         // If the credential is not valid or it's age is more than the allowed maximum age
 804         // for a credential, deny.
 805         if (!credential->isValid())
 806         {
 807                 debug("autheval", "credential for user %s is invalid, denying right %s", user, inRight.rightName());
 808                 return errAuthorizationDenied;
 809         }
 810
 811         if (now - credential->creationTime() > mMaxCredentialAge)
 812         {
 813                 debug("autheval", "credential for user %s has expired, denying right %s", user, inRight.rightName());
 814                 return errAuthorizationDenied;
 815         }
 816
 817         if (!ignoreShared && !mShared && credential->isShared())
 818         {
 819                 debug("autheval", "shared credential for user %s cannot be used, denying right %s", user, inRight.rightName());
 820                 return errAuthorizationDenied;
 821         }
 822
 823         // A root (uid == 0) user can do anything
 824         if (credential->uid() == 0)
 825         {
 826                 debug("autheval", "user %s has uid 0, granting right %s", user, inRight.rightName());
 827                 return errAuthorizationSuccess;
 828         }
 829
 830         const char *groupname = mGroupName.c_str();
 831         struct group *gr = getgrnam(groupname);
 832         if (!gr)
 833                 return errAuthorizationDenied;
 834
 835         // Is this the default group of this user?
 836         // PR-2875126 <grp.h> declares gr_gid int, as opposed to advertised (getgrent(3)) gid_t
 837         // When this is fixed this warning should go away.
 838         if (credential->gid() == gr->gr_gid)
 839         {
 840                 debug("autheval", "user %s has group %s(%d) as default group, granting right %s",
 841                         user, groupname, gr->gr_gid, inRight.rightName());
 842                 endgrent();
 843                 return errAuthorizationSuccess;
 844         }
 845
 846         for (char **group = gr->gr_mem; *group; ++group)
 847         {
 848                 if (!strcmp(*group, user))
 849                 {
 850                         debug("autheval", "user %s is a member of group %s, granting right %s",
 851                                 user, groupname, inRight.rightName());
 852                         endgrent();
 853                         return errAuthorizationSuccess;
 854                 }
 855         }
 856
 857         debug("autheval", "user %s is not a member of group %s, denying right %s",
 858                 user, groupname, inRight.rightName());
 859         endgrent();
 860         return errAuthorizationDenied;
 861 }
 862
 863 OSStatus
 864 Rule::obtainCredential(QueryAuthorizeByGroup &query, const Right &inRight,
 865     const AuthorizationEnvironment *environment, const char *usernameHint, Credential &outCredential, SecurityAgent::Reason reason)
 866 {
 867         char nameBuffer[SecurityAgent::maxUsernameLength];
 868         char passphraseBuffer[SecurityAgent::maxPassphraseLength];
 869         OSStatus status = errAuthorizationDenied;
 870
 871         try {
 872         if (query(mGroupName.c_str(), usernameHint, nameBuffer, passphraseBuffer, reason))
 873             status = noErr;
 874         } catch (const CssmCommonError &err) {
 875                 status = err.osStatus();
 876         } catch (...) {
 877                 status = errAuthorizationInternal;
 878         }
 879         if (status == CSSM_ERRCODE_USER_CANCELED)
 880         {
 881                 debug("auth", "canceled obtaining credential for user in group %s", mGroupName.c_str());
 882                 return errAuthorizationCanceled;
 883         }
 884         if (status == CSSM_ERRCODE_NO_USER_INTERACTION)
 885         {
 886                 debug("auth", "user interaction not possible obtaining credential for user in group %s", mGroupName.c_str());
 887                 return errAuthorizationInteractionNotAllowed;
 888         }
 889
 890         if (status != noErr)
 891         {
 892                 debug("auth", "failed obtaining credential for user in group %s", mGroupName.c_str());
 893                 return status;
 894         }
 895
 896         debug("auth", "obtained credential for user %s", nameBuffer);
 897
 898         string username(nameBuffer);
 899         string password(passphraseBuffer);
 900         outCredential = Credential(username, password, mShared);
 901         return errAuthorizationSuccess;
 902 }
 903
 904
 905 //
 906 // Engine class
 907 //
 908 Engine::Engine(const char *configFile) :
 909 mLastChecked(DBL_MIN)
 910 {
 911         mRulesFileName = new char[strlen(configFile) + 1];
 912         strcpy(mRulesFileName, configFile);
 913         memset(&mRulesFileMtimespec, 0, sizeof(mRulesFileMtimespec));
 914 }
 915
 916 Engine::~Engine()
 917 {
 918         delete[] mRulesFileName;
 919 }
 920
 921 void
 922 Engine::updateRules(CFAbsoluteTime now)
 923 {
 924     StLock<Mutex> _(mLock);
 925     if (mRules.empty())
 926                 readRules();
 927         else
 928         {
 929                 // Don't do anything if we checked the timestamp less than 5 seconds ago
 930                 if (mLastChecked > now - 5.0)
 931                         return;
 932
 933                 struct stat st;
 934                 if (stat(mRulesFileName, &st))
 935                 {
 936                         Syslog::error("Stating rules file \"%s\": %s", mRulesFileName, strerror(errno));
 937                         /* @@@ No rules file found, use defaults: admin group for everything. */
 938                         //UnixError::throwMe(errno);
 939                 }
 940                 else
 941                 {
 942                         // @@@ Make sure this is the right way to compare 2 struct timespec thingies
 943                         // Technically we should check st_dev and st_ino as well since if either of those change
 944                         // we are looking at a different file too.
 945                         if (memcmp(&st.st_mtimespec, &mRulesFileMtimespec, sizeof(mRulesFileMtimespec)))
 946                                 readRules();
 947                 }
 948         }
 949
 950         mLastChecked = now;
 951 }
 952
 953 void
 954 Engine::readRules()
 955 {
 956         // Make an entry in the mRules map that matches every right to the default Rule.
 957         mRules.clear();
 958         mRules.insert(RuleMap::value_type(string(), Rule()));
 959
 960         int fd = open(mRulesFileName, O_RDONLY, 0);
 961         if (fd == -1)
 962         {
 963                 Syslog::error("Opening rules file \"%s\": %s", mRulesFileName, strerror(errno));
 964                 return;
 965         }
 966
 967         try
 968         {
 969                 struct stat st;
 970                 if (fstat(fd, &st))
 971                         UnixError::throwMe(errno);
 972
 973                 mRulesFileMtimespec = st.st_mtimespec;
 974
 975                 off_t fileSize = st.st_size;
 976
 977         CFRef<CFMutableDataRef> xmlData(CFDataCreateMutable(NULL, fileSize));
 978         CFDataSetLength(xmlData, fileSize);
 979                 void *buffer = CFDataGetMutableBytePtr(xmlData);
 980                 size_t bytesRead = read(fd, buffer, fileSize);
 981                 if (bytesRead != fileSize)
 982                 {
 983                         if (bytesRead == static_cast<size_t>(-1))
 984                         {
 985                                 Syslog::error("Reading rules file \"%s\": %s", mRulesFileName, strerror(errno));
 986                                 return;
 987                         }
 988
 989                         Syslog::error("Could only read %ul out of %ul bytes from rules file \"%s\"",
 990                                                   bytesRead, fileSize, mRulesFileName);
 991                         return;
 992                 }
 993
 994                 CFStringRef errorString;
 995         CFRef<CFDictionaryRef> newRoot(reinterpret_cast<CFDictionaryRef>
 996                         (CFPropertyListCreateFromXMLData(NULL, xmlData, kCFPropertyListImmutable, &errorString)));
 997                 if (!newRoot)
 998                 {
 999                         char buffer[512];
1000                         const char *error = CFStringGetCStringPtr(errorString, kCFStringEncodingUTF8);
1001                         if (error == NULL)
1002                         {
1003                                 if (CFStringGetCString(errorString, buffer, 512, kCFStringEncodingUTF8))
1004                                         error = buffer;
1005                         }
1006
1007                         Syslog::error("Parsing rules file \"%s\": %s", mRulesFileName, error);
1008                         return;
1009                 }
1010
1011                 if (CFGetTypeID(newRoot) != CFDictionaryGetTypeID())
1012                 {
1013                         Syslog::error("Rules file \"%s\": is not a dictionary", mRulesFileName);
1014                         return;
1015                 }
1016
1017                 parseRules(newRoot);
1018         }
1019         catch(...)
1020         {
1021                 close(fd);
1022         }
1023
1024         close(fd);
1025 }
1026
1027 void
1028 Engine::parseRules(CFDictionaryRef rules)
1029 {
1030         CFDictionaryApplyFunction(rules, parseRuleCallback, this);
1031 }
1032
1033 void
1034 Engine::parseRuleCallback(const void *key, const void *value, void *context)
1035 {
1036         Engine *engine = reinterpret_cast<Engine *>(context);
1037         if (CFGetTypeID(key) != CFStringGetTypeID())
1038                 return;
1039
1040         CFStringRef right = reinterpret_cast<CFStringRef>(key);
1041         engine->parseRule(right, reinterpret_cast<CFTypeRef>(value));
1042 }
1043
1044 void
1045 Engine::parseRule(CFStringRef cfRight, CFTypeRef cfRule)
1046 {
1047         char buffer[512];
1048         const char *ptr = CFStringGetCStringPtr(cfRight, kCFStringEncodingUTF8);
1049         if (ptr == NULL)
1050         {
1051                 if (CFStringGetCString(cfRight, buffer, 512, kCFStringEncodingUTF8))
1052                         ptr = buffer;
1053         }
1054
1055         string right(ptr);
1056         try
1057         {
1058                 mRules[right] = Rule(cfRule);
1059                 debug("authrule", "added rule for right \"%s\"", right.c_str());
1060         }
1061         catch (...)
1062         {
1063                 Syslog::error("Rules file \"%s\" right \"%s\": rule is invalid", mRulesFileName, ptr);
1064         }
1065 }
1066
1067
1068 /*!
1069         @function AuthorizationEngine::getRule
1070
1071         Look up the Rule for a given right.
1072
1073         @param inRight (input) the right for which we want a rule.
1074
1075         @results The Rule for right
1076 */
1077 Rule
1078 Engine::getRule(const Right &inRight) const
1079 {
1080         string key(inRight.rightName());
1081     // Lock the rulemap
1082     StLock<Mutex> _(mLock);
1083         for (;;)
1084         {
1085                 RuleMap::const_iterator it = mRules.find(key);
1086                 if (it != mRules.end())
1087                 {
1088                         debug("authrule", "right \"%s\" using right expression \"%s\"", inRight.rightName(), key.c_str());
1089                         return it->second;
1090                 }
1091
1092                 // no default rule
1093                 assert (key.size());
1094
1095                 // any reduction of a combination of two chars is futile
1096                 if (key.size() > 2) {
1097                         // find last dot with exception of possible dot at end
1098                         string::size_type index = key.rfind('.', key.size() - 2);
1099                         // cut right after found dot, or make it match default rule
1100                         key = key.substr(0, index == string::npos ? 0 : index + 1);
1101                 } else
1102                         key.erase();
1103         }
1104 }
1105
1106 /*!
1107         @function AuthorizationEngine::authorize
1108
1109         @@@.
1110
1111         @param inRights (input) List of rights being requested for authorization.
1112         @param environment (optional/input) Environment containing information to be used during evaluation.
1113         @param flags (input) Optional flags @@@ see AuthorizationCreate for a description.
1114         @param inCredentials (input) Credentials already held by the caller.
1115         @param outCredentials (output/optional) Credentials obtained, used or refreshed during this call to authorize the requested rights.
1116         @param outRights (output/optional) Subset of inRights which were actually authorized.
1117
1118         @results Returns errAuthorizationSuccess if all rights requested are authorized, or if the kAuthorizationFlagPartialRights flag was specified.  Might return other status values like errAuthorizationDenied, errAuthorizationCanceled or errAuthorizationInteractionNotAllowed
1119 */
1120 OSStatus
1121 Engine::authorize(const RightSet &inRights, const AuthorizationEnvironment *environment,
1122         AuthorizationFlags flags, const CredentialSet *inCredentials, CredentialSet *outCredentials,
1123         MutableRightSet *outRights, AuthorizationToken &auth)
1124 {
1125         CredentialSet credentials;
1126         MutableRightSet rights;
1127         OSStatus status = errAuthorizationSuccess;
1128
1129         // Get current time of day.
1130         CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
1131
1132         // Update rules from database if needed
1133         updateRules(now);
1134
1135         // Check if a credential was passed into the environment and we were asked to extend the rights
1136         if (environment && (flags & kAuthorizationFlagExtendRights))
1137         {
1138                 const AuthorizationItem *username = NULL, *password = NULL;
1139                 bool shared = false;
1140                 for (UInt32 ix = 0; ix < environment->count; ++ix)
1141                 {
1142                         const AuthorizationItem &item = environment->items[ix];
1143                         if (!strcmp(item.name, kAuthorizationEnvironmentUsername))
1144                                 username = &item;
1145                         if (!strcmp(item.name, kAuthorizationEnvironmentPassword))
1146                                 password = &item;
1147                         if (!strcmp(item.name, kAuthorizationEnvironmentShared))
1148                                 shared = true;
1149                 }
1150
1151                 if (username && password)
1152                 {
1153                         // Let's create a credential from the passed in username and password.
1154                         Credential newCredential(string(reinterpret_cast<const char *>(username->value), username->valueLength),
1155                                 string(reinterpret_cast<const char *>(password->value), password->valueLength), shared);
1156                         // If it's valid insert it into the credentials list.  Normally this is
1157                         // only done if it actually authorizes a requested right, but for this
1158                         // special case (environment) we do it even when no rights are being requested.
1159                         if (newCredential->isValid())
1160                                 credentials.insert(newCredential);
1161                 }
1162         }
1163
1164         RightSet::const_iterator end = inRights.end();
1165         for (RightSet::const_iterator it = inRights.begin(); it != end; ++it)
1166         {
1167                 // Get the rule for each right we are trying to obtain.
1168                 OSStatus result = getRule(*it).evaluate(*it, environment, flags, now,
1169             inCredentials, credentials, auth);
1170                 if (result == errAuthorizationSuccess)
1171                         rights.push_back(*it);
1172                 else if (result == errAuthorizationDenied || result == errAuthorizationInteractionNotAllowed)
1173                 {
1174                         if (!(flags & kAuthorizationFlagPartialRights))
1175                         {
1176                                 status = result;
1177                                 break;
1178                         }
1179                 }
1180         else if (result == errAuthorizationCanceled)
1181         {
1182             status = result;
1183             break;
1184         }
1185                 else
1186                 {
1187                         Syslog::error("Engine::authorize: Rule::evaluate returned %ld returning errAuthorizationInternal", result);
1188                         status = errAuthorizationInternal;
1189                         break;
1190                 }
1191         }
1192
1193         if (outCredentials)
1194                 outCredentials->swap(credentials);
1195         if (outRights)
1196                 outRights->swap(rights);
1197
1198         return status;
1199 }
1200
1201 }       // end namespace Authorization