sectask/SecTask.c

   1 /*
   2  * Copyright (c) 2008,2010-2013 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include "SecTask.h"
  25
  26 #include <utilities/debugging.h>
  27
  28 #include <AssertMacros.h>
  29 #include <CoreFoundation/CFRuntime.h>
  30 #include <IOKit/IOKitLib.h>
  31 #include <IOKit/IOCFUnserialize.h>
  32 #include <System/sys/codesign.h>
  33 #include <bsm/libbsm.h>
  34 #include <inttypes.h>
  35 #include <syslog.h>
  36 #include <utilities/SecCFWrappers.h>
  37
  38 #define USE_LIBPROC  0
  39 #if USE_LIBPROC
  40 #include <libproc.h>
  41 #else
  42 #include <sys/sysctl.h>
  43 #endif
  44
  45 struct __SecTask {
  46     CFRuntimeBase base;
  47
  48     pid_t pid_self;
  49     audit_token_t token;
  50
  51     /* Track whether we've loaded entitlements independently since after the
  52      * load, entitlements may legitimately be NULL */
  53     Boolean entitlementsLoaded;
  54     CFDictionaryRef entitlements;
  55
  56         /* for debugging only, shown by debugDescription */
  57         int lastFailure;
  58 };
  59
  60 static bool check_task(SecTaskRef task) {
  61     return SecTaskGetTypeID() == CFGetTypeID(task);
  62 }
  63
  64 static void SecTaskFinalize(CFTypeRef cfTask)
  65 {
  66     SecTaskRef task = (SecTaskRef) cfTask;
  67
  68     if (task->entitlements != NULL) {
  69         CFRelease(task->entitlements);
  70         task->entitlements = NULL;
  71     }
  72 }
  73
  74
  75 // Define PRIdPID (proper printf format string for pid_t)
  76 #define PRIdPID PRId32
  77
  78 static CFStringRef SecTaskCopyDebugDescription(CFTypeRef cfTask)
  79 {
  80     SecTaskRef task = (SecTaskRef) cfTask;
  81     pid_t pid;
  82     if (task->pid_self==-1) {
  83         audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
  84     } else {
  85         pid = task->pid_self;
  86     }
  87
  88 #if USE_LIBPROC
  89 #define MAX_PROCNAME 32
  90     char task_name[MAX_PROCNAME + 1] = {};
  91     proc_name(pid, task_name, MAX_PROCNAME);
  92 #else
  93     const char *task_name;
  94     int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_PID, pid};
  95     struct kinfo_proc kp;
  96     size_t len = sizeof(kp);
  97     if (sysctl(mib, 4, &kp, &len, NULL, 0) == -1 || len == 0)
  98         task_name = strerror(errno);
  99     else
 100         task_name = kp.kp_proc.p_comm;
 101 #endif
 102
 103     return CFStringCreateWithFormat(CFGetAllocator(task), NULL, CFSTR("%s[%" PRIdPID "]/%d#%d LF=%d"), task_name, pid,
 104                                                                         task->entitlementsLoaded, task->entitlements ? (int)CFDictionaryGetCount(task->entitlements) : -1, task->lastFailure);
 105 }
 106
 107 CFGiblisWithFunctions(SecTask, NULL, NULL, SecTaskFinalize, NULL, NULL, NULL, SecTaskCopyDebugDescription, NULL, NULL, NULL)
 108
 109 static SecTaskRef init_task_ref(CFAllocatorRef allocator)
 110 {
 111     CFIndex extra = sizeof(struct __SecTask) - sizeof(CFRuntimeBase);
 112     return (SecTaskRef) _CFRuntimeCreateInstance(allocator, SecTaskGetTypeID(), extra, NULL);
 113 }
 114
 115 SecTaskRef SecTaskCreateFromSelf(CFAllocatorRef allocator)
 116 {
 117     SecTaskRef task = init_task_ref(allocator);
 118     if (task != NULL) {
 119
 120         memset(&task->token, 0, sizeof(task->token));
 121         task->entitlementsLoaded = false;
 122         task->entitlements = NULL;
 123         task->pid_self = getpid();
 124     }
 125
 126     return task;
 127 }
 128
 129 SecTaskRef SecTaskCreateWithAuditToken(CFAllocatorRef allocator, audit_token_t token)
 130 {
 131     SecTaskRef task = init_task_ref(allocator);
 132     if (task != NULL) {
 133
 134         memcpy(&task->token, &token, sizeof(token));
 135         task->entitlementsLoaded = false;
 136         task->entitlements = NULL;
 137         task->pid_self = -1;
 138     }
 139
 140     return task;
 141 }
 142
 143 struct csheader {
 144         uint32_t magic;
 145         uint32_t length;
 146 };
 147
 148 static int
 149 csops_task(SecTaskRef task, int ops, void *blob, size_t size)
 150 {
 151         int rc;
 152     if (task->pid_self==-1) {
 153         pid_t pid;
 154         audit_token_to_au32(task->token, NULL, NULL, NULL, NULL, NULL, &pid, NULL, NULL);
 155         rc = csops_audittoken(pid, ops, blob, size, &task->token);
 156     }
 157     else
 158         rc = csops(task->pid_self, ops, blob, size);
 159         task->lastFailure = (rc == -1) ? errno : 0;
 160         return rc;
 161 }
 162
 163 CFStringRef
 164 SecTaskCopySigningIdentifier(SecTaskRef task, CFErrorRef *error)
 165 {
 166         CFStringRef signingId = NULL;
 167         char *data = NULL;
 168         struct csheader header;
 169         uint32_t bufferlen;
 170         int ret;
 171
 172         ret = csops_task(task, CS_OPS_IDENTITY, &header, sizeof(header));
 173         if (ret != -1 || errno != ERANGE)
 174                 return NULL;
 175
 176         bufferlen = ntohl(header.length);
 177         /* check for insane values */
 178         if (bufferlen > 1024 * 1024 || bufferlen < 8) {
 179                 ret = EINVAL;
 180                 goto out;
 181         }
 182         data = malloc(bufferlen + 1);
 183         if (data == NULL) {
 184                 ret = ENOMEM;
 185                 goto out;
 186         }
 187         ret = csops_task(task, CS_OPS_IDENTITY, data, bufferlen);
 188         if (ret) {
 189                 ret = errno;
 190                 goto out;
 191         }
 192         data[bufferlen] = '\0';
 193
 194         signingId = CFStringCreateWithCString(NULL, data + 8, kCFStringEncodingUTF8);
 195
 196  out:
 197         if (data)
 198                 free(data);
 199         if (ret && error)
 200                 *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
 201
 202         return signingId;
 203 }
 204
 205 uint32_t
 206 SecTaskGetCodeSignStatus(SecTaskRef task)
 207 {
 208     uint32_t flags = 0;
 209     if (csops_task(task, CS_OPS_STATUS, &flags, sizeof(flags)) != 0)
 210         return 0;
 211     return flags;
 212 }
 213
 214 static bool SecTaskLoadEntitlements(SecTaskRef task, CFErrorRef *error)
 215 {
 216     CFMutableDictionaryRef entitlements = NULL;
 217     struct csheader header;
 218     uint8_t *buffer = NULL;
 219     uint32_t bufferlen;
 220     int ret;
 221
 222
 223     ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, &header, sizeof(header));
 224     /* Any other combination means no entitlements */
 225         if (ret == -1) {
 226                 if (errno != ERANGE) {
 227             int entitlementErrno = errno;
 228
 229                         uint32_t cs_flags = -1;
 230             if (-1 == csops_task(task, CS_OPS_STATUS, &cs_flags, sizeof(cs_flags))) {
 231                 syslog(LOG_NOTICE, "Failed to get cs_flags, error=%d", errno);
 232             }
 233
 234                         if (cs_flags != 0) {    // was signed
 235                     syslog(LOG_NOTICE, "SecTaskLoadEntitlements failed error=%d cs_flags=%x, task->pid_self=%d", entitlementErrno, cs_flags, task->pid_self);   // to ease diagnostics
 236
 237                                 CFStringRef description = SecTaskCopyDebugDescription(task);
 238                                 char *descriptionBuf = NULL;
 239                                 CFIndex descriptionSize = CFStringGetLength(description) * 4;
 240                                 descriptionBuf = (char *)malloc(descriptionSize);
 241                                 if (!CFStringGetCString(description, descriptionBuf, descriptionSize, kCFStringEncodingUTF8)) {
 242                                         descriptionBuf[0] = 0;
 243                                 }
 244
 245                                 syslog(LOG_NOTICE, "SecTaskCopyDebugDescription: %s", descriptionBuf);
 246                                 CFRelease(description);
 247                                 free(descriptionBuf);
 248                         }
 249                         task->lastFailure = entitlementErrno;   // was overwritten by csops_task(CS_OPS_STATUS) above
 250
 251                         // EINVAL is what the kernel says for unsigned code, so we'll have to let that pass
 252                         if (entitlementErrno == EINVAL) {
 253                                 task->entitlementsLoaded = true;
 254                                 return true;
 255                         }
 256                         ret = entitlementErrno; // what really went wrong
 257                         goto out;               // bail out
 258                 }
 259         bufferlen = ntohl(header.length);
 260         /* check for insane values */
 261         if (bufferlen > 1024 * 1024 || bufferlen < 8) {
 262             ret = E2BIG;
 263             goto out;
 264         }
 265         buffer = malloc(bufferlen);
 266         if (buffer == NULL) {
 267             ret = ENOMEM;
 268             goto out;
 269         }
 270         ret = csops_task(task, CS_OPS_ENTITLEMENTS_BLOB, buffer, bufferlen);
 271         if (ret) {
 272             ret = errno;
 273             goto out;
 274         }
 275
 276         CFDataRef data = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, buffer+8, bufferlen-8, kCFAllocatorNull);
 277         entitlements = (CFMutableDictionaryRef) CFPropertyListCreateWithData(kCFAllocatorDefault, data, kCFPropertyListMutableContainers, NULL, error);
 278         CFRelease(data);
 279
 280         if((entitlements==NULL) || (CFGetTypeID(entitlements)!=CFDictionaryGetTypeID())){
 281             ret = EDOM; // don't use EINVAL here; it conflates problems with syscall error returns
 282             goto out;
 283         }
 284     }
 285
 286     task->entitlements = entitlements ? CFRetain(entitlements) : NULL;
 287     task->entitlementsLoaded = true;
 288
 289 out:
 290     if(entitlements)
 291         CFRelease(entitlements);
 292     if(buffer)
 293         free(buffer);
 294     if (ret && error && *error==NULL)
 295         *error = CFErrorCreate(NULL, kCFErrorDomainPOSIX, ret, NULL);
 296     return ret == 0;
 297 }
 298
 299
 300 CFTypeRef SecTaskCopyValueForEntitlement(SecTaskRef task, CFStringRef entitlement, CFErrorRef *error)
 301 {
 302     CFTypeRef value = NULL;
 303     require(check_task(task), out);
 304
 305     /* Load entitlements if necessary */
 306     if (task->entitlementsLoaded == false) {
 307         require_quiet(SecTaskLoadEntitlements(task, error), out);
 308     }
 309
 310     if (task->entitlements != NULL) {
 311         value = CFDictionaryGetValue(task->entitlements, entitlement);
 312
 313         /* Return something the caller must release */
 314         if (value != NULL) {
 315             CFRetain(value);
 316         }
 317     }
 318 out:
 319     return value;
 320 }
 321
 322 CFDictionaryRef SecTaskCopyValuesForEntitlements(SecTaskRef task, CFArrayRef entitlements, CFErrorRef *error)
 323 {
 324     CFMutableDictionaryRef values = NULL;
 325     require(check_task(task), out);
 326
 327     /* Load entitlements if necessary */
 328     if (task->entitlementsLoaded == false) {
 329         SecTaskLoadEntitlements(task, error);
 330     }
 331
 332     /* Iterate over the passed in entitlements, populating the dictionary
 333      * If entitlements were loaded but none were present, return an empty
 334      * dictionary */
 335     if (task->entitlementsLoaded == true) {
 336
 337         CFIndex i, count = CFArrayGetCount(entitlements);
 338         values = CFDictionaryCreateMutable(CFGetAllocator(task), count, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 339         if (task->entitlements != NULL) {
 340             for (i = 0; i < count; i++) {
 341                 CFStringRef entitlement = CFArrayGetValueAtIndex(entitlements, i);
 342                 CFTypeRef value = CFDictionaryGetValue(task->entitlements, entitlement);
 343                 if (value != NULL) {
 344                     CFDictionarySetValue(values, entitlement, value);
 345                 }
 346             }
 347         }
 348     }
 349 out:
 350     return values;
 351 }