securityd/src/clientid.h

   1 /*
   2  * Copyright (c) 2000-2004,2006-2007,2012 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23 //
  24 // clientid - track and manage identity of securityd clients
  25 //
  26 #ifndef _H_CLIENTID
  27 #define _H_CLIENTID
  28
  29 #include "codesigdb.h"
  30 #include <Security/SecCode.h>
  31 #include <security_utilities/cfutilities.h>
  32 #include <string>
  33
  34
  35 //
  36 // A ClientIdentification object is a mix-in class that tracks
  37 // the identity of associated client processes and their sub-entities
  38 // (aka Code Signing Guest objects).
  39 //
  40 class ClientIdentification : public CodeSignatures::Identity {
  41 public:
  42         ClientIdentification();
  43
  44         SecCodeRef processCode() const;
  45         SecCodeRef currentGuest() const;
  46
  47         std::string partitionId() const;
  48
  49         // CodeSignatures::Identity personality
  50         string getPath() const;
  51         const CssmData getHash() const;
  52     const bool checkAppleSigned() const;
  53         bool hasEntitlement(const char *name) const;
  54
  55
  56 protected:
  57         void setup(pid_t pid);
  58
  59 public:
  60         IFDUMP(void dump());
  61
  62 private:
  63         CFRef<SecCodeRef> mClientProcess;       // process-level client object
  64
  65         mutable Mutex mLock;                            // protects everything below
  66
  67         struct GuestState {
  68                 GuestState() : gotHash(false) { }
  69                 CFRef<SecCodeRef> code;
  70                 mutable bool gotHash;
  71                 mutable SHA1::Digest legacyHash;
  72         mutable bool checkedSignature;
  73         mutable bool appleSigned;
  74         };
  75         typedef std::map<SecGuestRef, GuestState> GuestMap;
  76         mutable GuestMap mGuests;
  77
  78         mutable std::string mClientPartitionId;
  79         mutable bool mGotPartitionId;
  80
  81         GuestState *current() const;
  82         static std::string partitionIdForProcess(SecStaticCodeRef code);
  83 };
  84
  85
  86 //
  87 // Bonus function
  88 //
  89 std::string codePath(SecStaticCodeRef code);
  90
  91
  92 #endif //_H_CLIENTID