sectask/SecTask.c

   1 /*
   2  * Copyright (c) 2008,2010-2013 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include "SecTask.h"
  25
  26 #include <utilities/debugging.h>
  27
  28 #include <AssertMacros.h>
  29 #include <CoreFoundation/CFRuntime.h>
  30 #include <IOKit/IOKitLib.h>
  31 #include <IOKit/IOCFUnserialize.h>
  32 #include <System/sys/codesign.h>
  33 #include <bsm/libbsm.h>
  34 #include <inttypes.h>
  35 #include <syslog.h>
  36 #include <utilities/SecCFWrappers.h>
  37
  38 #define USE_LIBPROC  0
  39 #if USE_LIBPROC
  40 #include <libproc.h>
  41 #else
  42 #include <sys/sysctl.h>
  43 #endif
  44
  45 struct __SecTask {
  46     CFRuntimeBase base;
  47
  48     pid_t pid_self;
  49     audit_token_t token;
  50
  51     /* Track whether we've loaded entitlements independently since after the
  52      * load, entitlements may legitimately be NULL */
  53     Boolean entitlementsLoaded;
  54     CFDictionaryRef entitlements;
  55 };
  56
  57 static bool check_task(SecTaskRef task) {
  58     return SecTaskGetTypeID() == CFGetTypeID(task);
  59 }
  60
  61 static void SecTaskFinalize(CFTypeRef cfTask)
  62 {
  63     SecTaskRef task = (SecTaskRef) cfTask;
  64
  65     if (task->entitlements != NULL) {
  66         CFRelease(task->entitlements);
  67         task->entitlements = NULL;
  68     }
  69 }
  70
  71
  72 // Define PRIdPID (proper printf format string for pid_t)
  73 #define PRIdPID PRId32
  74
  75 static CFStringRef SecTaskCopyDebugDescription(CFTypeRef cfTask)
  76 {
  77     SecTaskRef task = (SecTaskRef) cfTask;
  78     pid_t pid;
  79     if (task->pid_self==-1) {
  80         audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
  81     } else {
  82         pid = task->pid_self;
  83     }
  84
  85 #if USE_LIBPROC
  86 #define MAX_PROCNAME 32
  87     char task_name[MAX_PROCNAME + 1] = {};
  88     proc_name(pid, task_name, MAX_PROCNAME);
  89 #else
  90     const char *task_name;
  91     int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, pid};
  92     struct kinfo_proc kp;
  93     size_t len = sizeof(kp);
  94     if (sysctl(mib, 4, &kp, &len, NULL, 0) == -1 || len == 0)
  95         task_name = strerror(errno);
  96     else
  97         task_name = kp.kp_proc.p_comm;
  98 #endif
  99
 100     return CFStringCreateWithFormat(CFGetAllocator(task), NULL, CFSTR("%s[%" PRIdPID "]"), task_name, pid);
 101 }
 102
 103 CFGiblisWithFunctions(SecTask, NULL, NULL, SecTaskFinalize, NULL, NULL, NULL, SecTaskCopyDebugDescription, NULL, NULL, NULL)
 104
 105 static SecTaskRef init_task_ref(CFAllocatorRef allocator)
 106 {
 107     CFIndex extra = sizeof(struct __SecTask) - sizeof(CFRuntimeBase);
 108     return (SecTaskRef) _CFRuntimeCreateInstance(allocator, SecTaskGetTypeID(), extra, NULL);
 109 }
 110
 111 SecTaskRef SecTaskCreateFromSelf(CFAllocatorRef allocator)
 112 {
 113     SecTaskRef task = init_task_ref(allocator);
 114     if (task != NULL) {
 115
 116         memset(&task->token, 0, sizeof(task->token));
 117         task->entitlementsLoaded = false;
 118         task->entitlements = NULL;
 119         task->pid_self = getpid();
 120     }
 121
 122     return task;
 123 }
 124
 125 SecTaskRef SecTaskCreateWithAuditToken(CFAllocatorRef allocator, audit_token_t token)
 126 {
 127     SecTaskRef task = init_task_ref(allocator);
 128     if (task != NULL) {
 129
 130         memcpy(&task->token, &token, sizeof(token));
 131         task->entitlementsLoaded = false;
 132         task->entitlements = NULL;
 133         task->pid_self = -1;
 134     }
 135
 136     return task;
 137 }
 138
 139 struct csheader {
 140         uint32_t magic;
 141         uint32_t length;
 142 };
 143
 144 static int
 145 csops_task(SecTaskRef task, int ops, void *blob, size_t size)
 146 {
 147     if (task->pid_self==-1) {
 148         pid_t pid;
 149         audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
 150         return csops_audittoken(pid, ops, blob, size, &task->token);
 151     }
 152     else
 153         return csops(task->pid_self, ops, blob, size);
 154 }
 155
 156 /* This may need to be exported at some point */
 157 CFStringRef
 158 SecTaskCopySigningIdentifier(SecTaskRef task, CFErrorRef *error)
 159 {
 160         CFStringRef signingId = NULL;
 161         char *data = NULL;
 162         struct csheader header;
 163         uint32_t bufferlen;
 164         int ret;
 165
 166         ret = csops_task(task, CS_OPS_IDENTITY, &header, sizeof(header));
 167         if (ret != -1 || errno != ERANGE)
 168                 return NULL;
 169
 170         bufferlen = ntohl(header.length);
 171         /* check for insane values */
 172         if (bufferlen > 1024 * 1024 || bufferlen < 8) {
 173                 ret = EINVAL;
 174                 goto out;
 175         }
 176         data = malloc(bufferlen + 1);
 177         if (data == NULL) {
 178                 ret = ENOMEM;
 179                 goto out;
 180         }
 181         ret = csops_task(task, CS_OPS_IDENTITY, data, bufferlen);
 182         if (ret) {
 183                 ret = errno;
 184                 goto out;
 185         }
 186         data[bufferlen] = '\0';
 187
 188         signingId = CFStringCreateWithCString(NULL, data + 8, kCFStringEncodingUTF8);
 189
 190  out:
 191         if (data)
 192                 free(data);
 193         if (ret && error)
 194                 *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
 195
 196         return signingId;
 197 }
 198
 199
 200 static bool SecTaskLoadEntitlements(SecTaskRef task, CFErrorRef *error)
 201 {
 202     CFMutableDictionaryRef entitlements = NULL;
 203     struct csheader header;
 204     uint8_t *buffer = NULL;
 205     uint32_t bufferlen;
 206     int ret;
 207
 208
 209     ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, &header, sizeof(header));
 210     /* Any other combination means no entitlements */
 211         if (ret == -1) {
 212                 if (errno != ERANGE) {
 213                         syslog(LOG_NOTICE, "SecTaskLoadEntitlements failed error=%d", errno);   // to ease diagnostics
 214                         // EINVAL is what the kernel says for unsigned code, so we'll have to let that pass
 215                         if (errno == EINVAL) {
 216                                 task->entitlementsLoaded = true;
 217                                 return true;
 218                         }
 219                         ret = errno;    // what really went wrong
 220                         goto out;               // bail out
 221                 }
 222         bufferlen = ntohl(header.length);
 223         /* check for insane values */
 224         if (bufferlen > 1024 * 1024 || bufferlen < 8) {
 225             ret = EINVAL;
 226             goto out;
 227         }
 228         buffer = malloc(bufferlen);
 229         if (buffer == NULL) {
 230             ret = ENOMEM;
 231             goto out;
 232         }
 233         ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, buffer, bufferlen);
 234         if (ret) {
 235             ret = errno;
 236             goto out;
 237         }
 238
 239         CFDataRef data = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, buffer+8, bufferlen-8, kCFAllocatorNull);
 240         entitlements = (CFMutableDictionaryRef) CFPropertyListCreateWithData(kCFAllocatorDefault, data, kCFPropertyListMutableContainers, NULL, error);
 241         CFRelease(data);
 242
 243         if((entitlements==NULL) || (CFGetTypeID(entitlements)!=CFDictionaryGetTypeID())){
 244             ret = EINVAL;
 245             goto out;
 246         }
 247     }
 248
 249     task->entitlements = entitlements ? CFRetain(entitlements) : NULL;
 250     task->entitlementsLoaded = true;
 251
 252 out:
 253     if(entitlements)
 254         CFRelease(entitlements);
 255     if(buffer)
 256         free(buffer);
 257     if (ret && error && *error==NULL)
 258         *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
 259     return ret == 0;
 260 }
 261
 262
 263 CFTypeRef SecTaskCopyValueForEntitlement(SecTaskRef task, CFStringRef entitlement, CFErrorRef *error)
 264 {
 265     CFTypeRef value = NULL;
 266     require(check_task(task), out);
 267
 268     /* Load entitlements if necessary */
 269     if (task->entitlementsLoaded == false) {
 270         require_quiet(SecTaskLoadEntitlements(task, error), out);
 271     }
 272
 273     if (task->entitlements != NULL) {
 274         value = CFDictionaryGetValue(task->entitlements, entitlement);
 275
 276         /* Return something the caller must release */
 277         if (value != NULL) {
 278             CFRetain(value);
 279         }
 280     }
 281 out:
 282     return value;
 283 }
 284
 285 CFDictionaryRef SecTaskCopyValuesForEntitlements(SecTaskRef task, CFArrayRef entitlements, CFErrorRef *error)
 286 {
 287     CFMutableDictionaryRef values = NULL;
 288     require(check_task(task), out);
 289
 290     /* Load entitlements if necessary */
 291     if (task->entitlementsLoaded == false) {
 292         SecTaskLoadEntitlements(task, error);
 293     }
 294
 295     /* Iterate over the passed in entitlements, populating the dictionary
 296      * If entitlements were loaded but none were present, return an empty
 297      * dictionary */
 298     if (task->entitlementsLoaded == true) {
 299
 300         CFIndex i, count = CFArrayGetCount(entitlements);
 301         values = CFDictionaryCreateMutable(CFGetAllocator(task), count, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 302         if (task->entitlements != NULL) {
 303             for (i = 0; i < count; i++) {
 304                 CFStringRef entitlement = CFArrayGetValueAtIndex(entitlements, i);
 305                 CFTypeRef value = CFDictionaryGetValue(task->entitlements, entitlement);
 306                 if (value != NULL) {
 307                     CFDictionarySetValue(values, entitlement, value);
 308                 }
 309             }
 310         }
 311     }
 312 out:
 313     return values;
 314 }