Keychain/ACL.h

   1 /*
   2  * Copyright (c) 2002 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18 //
  19 // ACL.h - ACL control wrappers
  20 //
  21 #ifndef _SECURITY_ACL_H_
  22 #define _SECURITY_ACL_H_
  23
  24 #include <Security/SecRuntime.h>
  25 #include <Security/cssmaclpod.h>
  26 #include <Security/aclclient.h>
  27 #include <Security/cssmdata.h>
  28 #include <vector>
  29
  30 namespace Security {
  31 namespace KeychainCore {
  32
  33 using CssmClient::AclBearer;
  34
  35 class Access;
  36 class TrustedApplication;
  37
  38
  39 //
  40 // An ACL Entry for an Access object
  41 //
  42 class ACL : public SecCFObject {
  43         NOCOPY(ACL)
  44 public:
  45         // create from CSSM layer ACL entry
  46         ACL(Access &acc, const AclEntryInfo &info,
  47                 CssmAllocator &alloc = CssmAllocator::standard());
  48         // create from CSSM layer owner prototype
  49         ACL(Access &acc, const AclOwnerPrototype &owner,
  50                 CssmAllocator &alloc = CssmAllocator::standard());
  51         // create an "any" ACL
  52         ACL(Access &acc, CssmAllocator &alloc = CssmAllocator::standard());
  53         // create from "standard form" arguments (with empty application list)
  54         ACL(Access &acc, string description, const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR &promptSelector,
  55                 CssmAllocator &alloc = CssmAllocator::standard());
  56     virtual ~ACL();
  57
  58         CssmAllocator &allocator;
  59
  60         enum State {
  61                 unchanged,                                      // unchanged from source
  62                 inserted,                                       // new
  63                 modified,                                       // was changed (replace)
  64                 deleted                                         // was deleted (now invalid)
  65         };
  66         State state() const { return mState; }
  67
  68         enum Form {
  69                 invalidForm,                            // invalid
  70                 customForm,                                     // not a recognized format (but valid)
  71                 allowAllForm,                           // indiscriminate
  72                 appListForm                                     // list of apps + prompt confirm
  73         };
  74         Form form() const { return mForm; }
  75         void form(Form f) { mForm = f; }
  76
  77         Access &access;                                 // we belong to this Access
  78
  79 public:
  80         AclAuthorizationSet &authorizations()   { return mAuthorizations; }
  81         bool authorizes(AclAuthorization right) const;
  82         void setAuthorization(CSSM_ACL_AUTHORIZATION_TAG auth)
  83         { mAuthorizations.clear(); mAuthorizations.insert(auth); }
  84
  85         typedef vector< RefPointer<TrustedApplication> > ApplicationList;
  86         ApplicationList &applications()
  87         { assert(form() == appListForm); return mAppList; }
  88         void addApplication(TrustedApplication *app);
  89
  90         CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR &promptSelector()
  91         { assert(form() == appListForm); return mPromptSelector; }
  92         string &promptDescription()
  93         { assert(form() == appListForm); return mPromptDescription; }
  94
  95         CSSM_ACL_HANDLE entryHandle() const     { return mCssmHandle; }
  96
  97         static const CSSM_ACL_HANDLE ownerHandle = 0xff0e2743;  // pseudo-handle for owner ACL
  98         bool isOwner() const                    { return mCssmHandle == ownerHandle; }
  99         void makeOwner()                                { mCssmHandle = ownerHandle; }
 100
 101         void modify();
 102         void remove();
 103
 104 public:
 105         void setAccess(AclBearer &target, bool update = false,
 106                 const AccessCredentials *cred = NULL);
 107
 108 public:
 109         struct ParseError { };
 110
 111 public:
 112         static const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR defaultSelector;
 113
 114 private:
 115         void parse(const TypedList &subject);
 116         void parsePrompt(const TypedList &subject);
 117         void makeSubject();
 118         void clearSubjects(Form newForm);
 119
 120 private:
 121         State mState;                                   // change state
 122         Form mForm;                                             // format type
 123
 124         // AclEntryPrototype fields (minus subject, which is virtually constructed)
 125         CSSM_ACL_HANDLE mCssmHandle;    // CSSM entry handle (for updates)
 126         string mEntryTag;                               // CSSM entry tag (64 bytes or so, they say)
 127         bool mDelegate;                                 // CSSM delegate flag
 128         AclAuthorizationSet mAuthorizations; // rights for this ACL entry
 129
 130         // composite AclEntryPrototype (constructed when needed)
 131         TypedList *mSubjectForm;
 132
 133         // following values valid only if form() == appListForm
 134         ApplicationList mAppList;               // list of trusted applications
 135         CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR mPromptSelector; // selector field of PROMPT subject
 136         string mPromptDescription;              // description field of PROMPT subject
 137 };
 138
 139
 140 } // end namespace KeychainCore
 141 } // end namespace Security
 142
 143 #endif // !_SECURITY_ACL_H_