cdsa/cdsa_utilities/acl_process.h

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 //
  20 // acl_process - Process-attribute ACL subject type.
  21 //
  22 // NOTE:
  23 // The default Environment provides data about the current process (the one that
  24 // validate() is run in). If this isn't right for you (e.g. because you want to
  25 // validate against a process on the other side of some IPC connection), you must
  26 // make your own version of Environment and pass it to validate().
  27 //
  28 #ifndef _ACL_PROCESS
  29 #define _ACL_PROCESS
  30
  31 #include <Security/cssmacl.h>
  32 #include <string>
  33
  34 #ifdef _CPP_ACL_PROCESS
  35 #pragma export on
  36 #endif
  37
  38 namespace Security
  39 {
  40
  41 class AclProcessSubjectSelector
  42     : public PodWrapper<AclProcessSubjectSelector, CSSM_ACL_PROCESS_SUBJECT_SELECTOR> {
  43 public:
  44     AclProcessSubjectSelector()
  45     { version = CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION; mask = 0; }
  46
  47     bool uses(uint32 m) const { return mask & m; }
  48 };
  49
  50
  51 //
  52 // The ProcessAclSubject matches process attributes securely identified
  53 // by the system across IPC channels.
  54 //
  55 class ProcessAclSubject : public SimpleAclSubject {
  56 public:
  57     bool validate(const AclValidationContext &baseCtx, const TypedList &sample) const;
  58     CssmList toList(CssmAllocator &alloc) const;
  59
  60     ProcessAclSubject(const AclProcessSubjectSelector &selector)
  61     : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROCESS, CSSM_SAMPLE_TYPE_PROCESS),
  62       select(selector) { }
  63
  64     void exportBlob(Writer::Counter &pub, Writer::Counter &priv);
  65     void exportBlob(Writer &pub, Writer &priv);
  66
  67         IFDUMP(void debugDump() const);
  68
  69 public:
  70     class Environment : public virtual AclValidationEnvironment {
  71     public:
  72         virtual uid_t getuid() const;   // retrieve effective userid to match
  73         virtual gid_t getgid() const;   // retrieve effective groupid to match
  74     };
  75
  76 public:
  77     class Maker : public AclSubject::Maker {
  78     public:
  79         Maker() : AclSubject::Maker(CSSM_ACL_SUBJECT_TYPE_PROCESS) { }
  80         ProcessAclSubject *make(const TypedList &list) const;
  81         ProcessAclSubject *make(Version, Reader &pub, Reader &priv) const;
  82     };
  83
  84 private:
  85     AclProcessSubjectSelector select;
  86 };
  87
  88 } // end namespace Security
  89
  90 #ifdef _CPP_ACL_PROCESS
  91 #pragma export off
  92 #endif
  93
  94
  95 #endif //_ACL_PROCESS