OSX/libsecurity_codesigning/lib/SecTask.c

   1 /*
   2  * Copyright (c) 2009-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <CoreFoundation/CoreFoundation.h>
  25 #include <CoreFoundation/CFRuntime.h>
  26 #include <IOKit/IOKitLib.h>
  27 #include <IOKit/IOCFUnserialize.h>
  28 #include <System/sys/codesign.h>
  29 #include <bsm/libbsm.h>
  30 #include <inttypes.h>
  31 #include <pthread.h>
  32 #include <syslog.h>
  33 #include <sys/sysctl.h>
  34
  35 #include "SecCode.h"
  36 #include "SecCodePriv.h"
  37 #include "SecRequirement.h"
  38
  39 #include "SecTask.h"
  40 #include "SecTaskPriv.h"
  41
  42
  43 struct __SecTask {
  44         CFRuntimeBase base;
  45
  46         pid_t pid;
  47
  48         audit_token_t *token;
  49         audit_token_t token_storage;
  50
  51         /* Track whether we've loaded entitlements independently since after the
  52          * load, entitlements may legitimately be NULL */
  53         Boolean entitlementsLoaded;
  54         CFDictionaryRef entitlements;
  55 };
  56
  57 enum {
  58         kSecCodeMagicEntitlement = 0xfade7171,          /* entitlement blob */
  59 };
  60
  61
  62 CFTypeID _kSecTaskTypeID = _kCFRuntimeNotATypeID;
  63
  64 static void SecTaskFinalize(CFTypeRef cfTask)
  65 {
  66         SecTaskRef task = (SecTaskRef) cfTask;
  67
  68         if (task->entitlements != NULL) {
  69                 CFRelease(task->entitlements);
  70                 task->entitlements = NULL;
  71         }
  72 }
  73
  74
  75 // Define PRIdPID (proper printf format string for pid_t)
  76 #define PRIdPID PRId32
  77
  78 static CFStringRef SecTaskCopyDebugDescription(CFTypeRef cfTask)
  79 {
  80     SecTaskRef task = (SecTaskRef) cfTask;
  81     const char *task_name;
  82     int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, task->pid};
  83     struct kinfo_proc kp;
  84     size_t len = sizeof(kp);
  85     if (sysctl(mib, 4, &kp, &len, NULL, 0) == -1 || len == 0)
  86         task_name = strerror(errno);
  87     else
  88         task_name = kp.kp_proc.p_comm;
  89
  90     return CFStringCreateWithFormat(CFGetAllocator(task), NULL, CFSTR("%s[%" PRIdPID "]"), task_name, task->pid);
  91 }
  92
  93 static void SecTaskRegisterClass(void)
  94 {
  95         static const CFRuntimeClass SecTaskClass = {
  96                 .version = 0,
  97                 .className = "SecTask",
  98                 .init = NULL,
  99                 .copy = NULL,
 100                 .finalize = SecTaskFinalize,
 101                 .equal = NULL,
 102                 .hash = NULL,
 103                 .copyFormattingDesc = NULL,
 104                 .copyDebugDesc = SecTaskCopyDebugDescription,
 105         };
 106
 107         _kSecTaskTypeID = _CFRuntimeRegisterClass(&SecTaskClass);
 108 }
 109
 110 CFTypeID SecTaskGetTypeID(void)
 111 {
 112         static pthread_once_t secTaskRegisterClassOnce = PTHREAD_ONCE_INIT;
 113
 114         /* Register the class with the CF runtime the first time through */
 115         pthread_once(&secTaskRegisterClassOnce, SecTaskRegisterClass);
 116
 117         return _kSecTaskTypeID;
 118 }
 119
 120 static SecTaskRef SecTaskCreateWithPID(CFAllocatorRef allocator, pid_t pid)
 121 {
 122         CFIndex extra = sizeof(struct __SecTask) - sizeof(CFRuntimeBase);
 123         SecTaskRef task = (SecTaskRef) _CFRuntimeCreateInstance(allocator, SecTaskGetTypeID(), extra, NULL);
 124         if (task != NULL) {
 125                 task->pid = pid;
 126                 task->entitlementsLoaded = false;
 127                 task->entitlements = NULL;
 128         }
 129
 130         return task;
 131 }
 132
 133 SecTaskRef SecTaskCreateWithAuditToken(CFAllocatorRef allocator, audit_token_t token)
 134 {
 135         SecTaskRef task;
 136
 137         task = SecTaskCreateWithPID(allocator, audit_token_to_pid(token));
 138         if (task != NULL) {
 139 #if 0
 140                 task->token_storage = token;
 141                 task->token = &task->token_storage;
 142 #endif
 143         }
 144
 145         return task;
 146 }
 147
 148 SecTaskRef SecTaskCreateFromSelf(CFAllocatorRef allocator)
 149 {
 150         return SecTaskCreateWithPID(allocator, getpid());
 151 }
 152
 153 /*
 154  * Determine if the given task meets a specified requirement.
 155  */
 156 OSStatus
 157 SecTaskValidateForRequirement(SecTaskRef task, CFStringRef requirement)
 158 {
 159     OSStatus status;
 160     SecCodeRef code = NULL;
 161     SecRequirementRef req = NULL;
 162     pid_t pid = task->pid;
 163     if (pid <= 0) {
 164         return errSecParam;
 165     }
 166     status = SecCodeCreateWithPID(pid, kSecCSDefaultFlags, &code);
 167     //syslog(LOG_NOTICE, "SecTaskValidateForRequirement: SecCodeCreateWithPID=%d", status);
 168     if (!status) {
 169         status = SecRequirementCreateWithString(requirement,
 170                                                 kSecCSDefaultFlags, &req);
 171         //syslog(LOG_NOTICE, "SecTaskValidateForRequirement: SecRequirementCreateWithString=%d", status);
 172     }
 173     if (!status) {
 174         status = SecCodeCheckValidity(code, kSecCSDefaultFlags, req);
 175         //syslog(LOG_NOTICE, "SecTaskValidateForRequirement: SecCodeCheckValidity=%d", status);
 176     }
 177     if (req)
 178         CFRelease(req);
 179     if (code)
 180         CFRelease(code);
 181
 182     return status;
 183 }
 184
 185 static CFRange myMakeRange(CFIndex loc, CFIndex len) {
 186         CFRange r = {.location = loc, .length = len };
 187         return r;
 188 }
 189 struct csheader {
 190         uint32_t magic;
 191         uint32_t length;
 192 };
 193
 194 static int
 195 csops_task(SecTaskRef task, int ops, void *blob, size_t size)
 196 {
 197 #if 0
 198         if (task->token)
 199                 return csops_audittoken(task->pid, ops, blob, size, task->token);
 200         else
 201 #endif
 202                 return csops(task->pid, ops, blob, size);
 203 }
 204
 205 static int SecTaskLoadEntitlements(SecTaskRef task, CFErrorRef *error)
 206 {
 207         CFMutableDataRef data = NULL;
 208         struct csheader header;
 209         uint32_t bufferlen;
 210         int ret;
 211
 212         ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, &header, sizeof(header));
 213         if (ret == 0) {
 214                 // we only gave a header's worth of buffer. If this succeeded, we have no entitlements
 215                 task->entitlementsLoaded = true;
 216                 return 0;
 217         }
 218         if (errno != ERANGE) {
 219                 // ERANGE means "your buffer is too small, it now tells you how much you need
 220                 // Everything else is a real error, so yell
 221                 syslog(LOG_NOTICE, "SecTaskLoadEntitlements failed error=%d", errno);   // to ease diagnostics
 222                 // EINVAL is what the kernel says for unsigned code, so we'll have to let that pass
 223                 if (errno == EINVAL) {
 224                         task->entitlementsLoaded = true;
 225                         return 0;
 226                 }
 227                 ret = errno;
 228                 goto out;
 229         }
 230         // kernel told us the needed buffer size in header.length; proceed
 231
 232         bufferlen = ntohl(header.length);
 233         /* check for insane values */
 234         if (bufferlen > 1024 * 1024 || bufferlen < 8) {
 235                 ret = EINVAL;
 236                 goto out;
 237         }
 238         data = CFDataCreateMutable(NULL, bufferlen);
 239         if (data == NULL) {
 240                 ret = ENOMEM;
 241                 goto out;
 242         }
 243         CFDataSetLength(data, bufferlen);
 244         ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, CFDataGetMutableBytePtr(data), bufferlen);
 245         if (ret) {
 246                 ret = errno;
 247                 goto out;
 248         }
 249         CFDataDeleteBytes(data, myMakeRange(0, 8));
 250         task->entitlements = CFPropertyListCreateWithData(NULL, data, 0, NULL, error);
 251         task->entitlementsLoaded = true;
 252  out:
 253         if (data)
 254                 CFRelease(data);
 255         if (ret && error)
 256                 *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
 257
 258         return ret;
 259 }
 260
 261 CFTypeRef SecTaskCopyValueForEntitlement(SecTaskRef task, CFStringRef entitlement, CFErrorRef *error)
 262 {
 263         /* Load entitlements if necessary */
 264         if (task->entitlementsLoaded == false) {
 265                 SecTaskLoadEntitlements(task, error);
 266         }
 267
 268         CFTypeRef value = NULL;
 269         if (task->entitlements != NULL) {
 270                 value = CFDictionaryGetValue(task->entitlements, entitlement);
 271
 272                 /* Return something the caller must release */
 273                 if (value != NULL) {
 274                         CFRetain(value);
 275                 }
 276         }
 277
 278         return value;
 279 }
 280
 281 CFDictionaryRef SecTaskCopyValuesForEntitlements(SecTaskRef task, CFArrayRef entitlements, CFErrorRef *error)
 282 {
 283         /* Load entitlements if necessary */
 284         if (task->entitlementsLoaded == false) {
 285                 SecTaskLoadEntitlements(task, error);
 286         }
 287
 288         /* Iterate over the passed in entitlements, populating the dictionary
 289          * If entitlements were loaded but none were present, return an empty
 290          * dictionary */
 291         CFMutableDictionaryRef values = NULL;
 292         if (task->entitlementsLoaded == true) {
 293
 294                 CFIndex i, count = CFArrayGetCount(entitlements);
 295                 values = CFDictionaryCreateMutable(CFGetAllocator(task), count, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 296                 if (task->entitlements != NULL) {
 297                         for (i = 0; i < count; i++) {
 298                                 CFStringRef entitlement = CFArrayGetValueAtIndex(entitlements, i);
 299                                 CFTypeRef value = CFDictionaryGetValue(task->entitlements, entitlement);
 300                                 if (value != NULL) {
 301                                         CFDictionarySetValue(values, entitlement, value);
 302                                 }
 303                         }
 304                 }
 305         }
 306
 307         return values;
 308 }
 309
 310 Boolean SecTaskEntitlementsValidated(SecTaskRef task) {
 311     // TODO: Cache the result
 312     uint32_t csflags = 0;
 313     const uint32_t mask = CS_VALID | CS_KILL | CS_ENTITLEMENTS_VALIDATED;
 314     int rc = csops_task(task, CS_OPS_STATUS, &csflags, sizeof(csflags));
 315     return rc != -1 && ((csflags & mask) == mask);
 316 }