]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_codesigning/lib/StaticCode.cpp
projects / apple / security.git / blob
? search:


7458d53b7233da64d398da1f7de0b848ea1e386b
[apple/security.git] / OSX / libsecurity_codesigning / lib / StaticCode.cpp
1 /*
2 * Copyright (c) 2006-2015 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 //
25 // StaticCode - SecStaticCode API objects
26 //
27 #include "StaticCode.h"
28 #include "Code.h"
29 #include "reqmaker.h"
30 #if TARGET_OS_OSX
31 #include "drmaker.h"
32 #include "notarization.h"
33 #endif
34 #include "reqdumper.h"
35 #include "reqparser.h"
36 #include "sigblob.h"
37 #include "resources.h"
38 #include "detachedrep.h"
39 #include "signerutils.h"
40 #if TARGET_OS_OSX
41 #include "csdatabase.h"
42 #endif
43 #include "dirscanner.h"
44 #include <CoreFoundation/CFURLAccess.h>
45 #include <Security/SecPolicyPriv.h>
46 #include <Security/SecTrustPriv.h>
47 #include <Security/SecCertificatePriv.h>
48 #if TARGET_OS_OSX
49 #include <Security/CMSPrivate.h>
50 #endif
51 #import <Security/SecCMS.h>
52 #include <Security/SecCmsContentInfo.h>
53 #include <Security/SecCmsSignerInfo.h>
54 #include <Security/SecCmsSignedData.h>
55 #if TARGET_OS_OSX
56 #include <Security/cssmapplePriv.h>
57 #endif
58 #include <security_utilities/unix++.h>
59 #include <security_utilities/cfmunge.h>
60 #include <security_utilities/casts.h>
61 #include <Security/CMSDecoder.h>
62 #include <security_utilities/logging.h>
63 #include <dirent.h>
64 #include <sys/xattr.h>
65 #include <sstream>
66 #include <IOKit/storage/IOStorageDeviceCharacteristics.h>
67 #include <dispatch/private.h>
68 #include <os/assumes.h>
69 #include <regex.h>
70
71
72 namespace Security {
73 namespace CodeSigning {
74
75 using namespace UnixPlusPlus;
76
77 // A requirement representing a Mac or iOS dev cert, a Mac or iOS distribution cert, or a developer ID
78 static const char WWDRRequirement[] = "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.2] exists";
79 static const char MACWWDRRequirement[] = "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.12] exists";
80 static const char developerID[] = "anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists"
81 " and certificate leaf[field.1.2.840.113635.100.6.1.13] exists";
82 static const char distributionCertificate[] = "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.7] exists";
83 static const char iPhoneDistributionCert[] = "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.4] exists";
84
85 //
86 // Map a component slot number to a suitable error code for a failure
87 //
88 static inline OSStatus errorForSlot(CodeDirectory::SpecialSlot slot)
89 {
90 switch (slot) {
91 case cdInfoSlot:
92 return errSecCSInfoPlistFailed;
93 case cdResourceDirSlot:
94 return errSecCSResourceDirectoryFailed;
95 default:
96 return errSecCSSignatureFailed;
97 }
98 }
99
100
101 //
102 // Construct a SecStaticCode object given a disk representation object
103 //
104 SecStaticCode::SecStaticCode(DiskRep *rep, uint32_t flags)
105 : mCheckfix30814861builder1(NULL),
106 mRep(rep),
107 mValidated(false), mExecutableValidated(false), mResourcesValidated(false), mResourcesValidContext(NULL),
108 mProgressQueue("com.apple.security.validation-progress", false, QOS_CLASS_UNSPECIFIED),
109 mOuterScope(NULL), mResourceScope(NULL),
110 mDesignatedReq(NULL), mGotResourceBase(false), mMonitor(NULL), mLimitedAsync(NULL),
111 mFlags(flags), mNotarizationChecked(false), mStaplingChecked(false), mNotarizationDate(NAN)
112 #if TARGET_OS_OSX
113 , mEvalDetails(NULL)
114 #else
115 , mTrustedSigningCertChain(false)
116 #endif
117
118 {
119 CODESIGN_STATIC_CREATE(this, rep);
120 #if TARGET_OS_OSX
121 checkForSystemSignature();
122 #endif
123 }
124
125
126 //
127 // Clean up a SecStaticCode object
128 //
129 SecStaticCode::~SecStaticCode() throw()
130 try {
131 ::free(const_cast<Requirement *>(mDesignatedReq));
132 delete mResourcesValidContext;
133 delete mLimitedAsync;
134 delete mCheckfix30814861builder1;
135 } catch (...) {
136 return;
137 }
138
139 //
140 // Initialize a nested SecStaticCode object from its parent
141 //
142 void SecStaticCode::initializeFromParent(const SecStaticCode& parent) {
143 mOuterScope = &parent;
144 setMonitor(parent.monitor());
145 if (parent.mLimitedAsync)
146 mLimitedAsync = new LimitedAsync(*parent.mLimitedAsync);
147 }
148
149 //
150 // CF-level comparison of SecStaticCode objects compares CodeDirectory hashes if signed,
151 // and falls back on comparing canonical paths if (both are) not.
152 //
153 bool SecStaticCode::equal(SecCFObject &secOther)
154 {
155 SecStaticCode *other = static_cast<SecStaticCode *>(&secOther);
156 CFDataRef mine = this->cdHash();
157 CFDataRef his = other->cdHash();
158 if (mine || his)
159 return mine && his && CFEqual(mine, his);
160 else
161 return CFEqual(CFRef<CFURLRef>(this->copyCanonicalPath()), CFRef<CFURLRef>(other->copyCanonicalPath()));
162 }
163
164 CFHashCode SecStaticCode::hash()
165 {
166 if (CFDataRef h = this->cdHash())
167 return CFHash(h);
168 else
169 return CFHash(CFRef<CFURLRef>(this->copyCanonicalPath()));
170 }
171
172
173 //
174 // Invoke a stage monitor if registered
175 //
176 CFTypeRef SecStaticCode::reportEvent(CFStringRef stage, CFDictionaryRef info)
177 {
178 if (mMonitor)
179 return mMonitor(this->handle(false), stage, info);
180 else
181 return NULL;
182 }
183
184 void SecStaticCode::prepareProgress(unsigned int workload)
185 {
186 dispatch_sync(mProgressQueue, ^{
187 mCancelPending = false; // not canceled
188 });
189 if (mValidationFlags & kSecCSReportProgress) {
190 mCurrentWork = 0; // nothing done yet
191 mTotalWork = workload; // totally fake - we don't know how many files we'll get to chew
192 }
193 }
194
195 void SecStaticCode::reportProgress(unsigned amount /* = 1 */)
196 {
197 if (mMonitor && (mValidationFlags & kSecCSReportProgress)) {
198 // update progress and report
199 __block bool cancel = false;
200 dispatch_sync(mProgressQueue, ^{
201 if (mCancelPending)
202 cancel = true;
203 mCurrentWork += amount;
204 mMonitor(this->handle(false), CFSTR("progress"), CFTemp<CFDictionaryRef>("{current=%d,total=%d}", mCurrentWork, mTotalWork));
205 });
206 // if cancellation is pending, abort now
207 if (cancel)
208 MacOSError::throwMe(errSecCSCancelled);
209 }
210 }
211
212
213 //
214 // Set validation conditions for fine-tuning legacy tolerance
215 //
216 static void addError(CFTypeRef cfError, void* context)
217 {
218 if (CFGetTypeID(cfError) == CFNumberGetTypeID()) {
219 int64_t error;
220 CFNumberGetValue(CFNumberRef(cfError), kCFNumberSInt64Type, (void*)&error);
221 MacOSErrorSet* errors = (MacOSErrorSet*)context;
222 errors->insert(OSStatus(error));
223 }
224 }
225
226 void SecStaticCode::setValidationModifiers(CFDictionaryRef conditions)
227 {
228 if (conditions) {
229 CFDictionary source(conditions, errSecCSDbCorrupt);
230 mAllowOmissions = source.get<CFArrayRef>("omissions");
231 if (CFArrayRef errors = source.get<CFArrayRef>("errors"))
232 CFArrayApplyFunction(errors, CFRangeMake(0, CFArrayGetCount(errors)), addError, &this->mTolerateErrors);
233 }
234 }
235
236
237 //
238 // Request cancellation of a validation in progress.
239 // We do this by posting an abort flag that is checked periodically.
240 //
241 void SecStaticCode::cancelValidation()
242 {
243 if (!(mValidationFlags & kSecCSReportProgress)) // not using progress reporting; cancel won't make it through
244 MacOSError::throwMe(errSecCSInvalidFlags);
245 dispatch_assert_queue(mProgressQueue);
246 mCancelPending = true;
247 }
248
249
250 //
251 // Attach a detached signature.
252 //
253 void SecStaticCode::detachedSignature(CFDataRef sigData)
254 {
255 if (sigData) {
256 mDetachedSig = sigData;
257 mRep = new DetachedRep(sigData, mRep->base(), "explicit detached");
258 CODESIGN_STATIC_ATTACH_EXPLICIT(this, mRep);
259 } else {
260 mDetachedSig = NULL;
261 mRep = mRep->base();
262 CODESIGN_STATIC_ATTACH_EXPLICIT(this, NULL);
263 }
264 }
265
266
267 //
268 // Consult the system detached signature database to see if it contains
269 // a detached signature for this StaticCode. If it does, fetch and attach it.
270 // We do this only if the code has no signature already attached.
271 //
272 void SecStaticCode::checkForSystemSignature()
273 {
274 #if TARGET_OS_OSX
275 if (!this->isSigned()) {
276 SignatureDatabase db;
277 if (db.isOpen())
278 try {
279 if (RefPointer<DiskRep> dsig = db.findCode(mRep)) {
280 CODESIGN_STATIC_ATTACH_SYSTEM(this, dsig);
281 mRep = dsig;
282 }
283 } catch (...) {
284 }
285 }
286 #else
287 MacOSError::throwMe(errSecUnimplemented);
288 #endif
289 }
290
291
292 //
293 // Return a descriptive string identifying the source of the code signature
294 //
295 string SecStaticCode::signatureSource()
296 {
297 if (!isSigned())
298 return "unsigned";
299 if (DetachedRep *rep = dynamic_cast<DetachedRep *>(mRep.get()))
300 return rep->source();
301 return "embedded";
302 }
303
304
305 //
306 // Do ::required, but convert incoming SecCodeRefs to their SecStaticCodeRefs
307 // (if possible).
308 //
309 SecStaticCode *SecStaticCode::requiredStatic(SecStaticCodeRef ref)
310 {
311 SecCFObject *object = SecCFObject::required(ref, errSecCSInvalidObjectRef);
312 if (SecStaticCode *scode = dynamic_cast<SecStaticCode *>(object))
313 return scode;
314 else if (SecCode *code = dynamic_cast<SecCode *>(object))
315 return code->staticCode();
316 else // neither (a SecSomethingElse)
317 MacOSError::throwMe(errSecCSInvalidObjectRef);
318 }
319
320 SecCode *SecStaticCode::optionalDynamic(SecStaticCodeRef ref)
321 {
322 SecCFObject *object = SecCFObject::required(ref, errSecCSInvalidObjectRef);
323 if (dynamic_cast<SecStaticCode *>(object))
324 return NULL;
325 else if (SecCode *code = dynamic_cast<SecCode *>(object))
326 return code;
327 else // neither (a SecSomethingElse)
328 MacOSError::throwMe(errSecCSInvalidObjectRef);
329 }
330
331
332 //
333 // Void all cached validity data.
334 //
335 // We also throw out cached components, because the new signature data may have
336 // a different idea of what components should be present. We could reconcile the
337 // cached data instead, if performance seems to be impacted.
338 //
339 void SecStaticCode::resetValidity()
340 {
341 CODESIGN_EVAL_STATIC_RESET(this);
342 mValidated = false;
343 mExecutableValidated = mResourcesValidated = false;
344 if (mResourcesValidContext) {
345 delete mResourcesValidContext;
346 mResourcesValidContext = NULL;
347 }
348 mDir = NULL;
349 mCodeDirectories.clear();
350 mSignature = NULL;
351 for (unsigned n = 0; n < cdSlotCount; n++)
352 mCache[n] = NULL;
353 mInfoDict = NULL;
354 mEntitlements = NULL;
355 mResourceDict = NULL;
356 mDesignatedReq = NULL;
357 mCDHash = NULL;
358 mGotResourceBase = false;
359 mTrust = NULL;
360 mCertChain = NULL;
361 #if TARGET_OS_OSX
362 mEvalDetails = NULL;
363 #endif
364 mRep->flush();
365
366 #if TARGET_OS_OSX
367 // we may just have updated the system database, so check again
368 checkForSystemSignature();
369 #endif
370 }
371
372
373 //
374 // Retrieve a sealed component by special slot index.
375 // If the CodeDirectory has already been validated, validate against that.
376 // Otherwise, retrieve the component without validation (but cache it). Validation
377 // will go through the cache and validate all cached components.
378 //
379 CFDataRef SecStaticCode::component(CodeDirectory::SpecialSlot slot, OSStatus fail /* = errSecCSSignatureFailed */)
380 {
381 assert(slot <= cdSlotMax);
382
383 CFRef<CFDataRef> &cache = mCache[slot];
384 if (!cache) {
385 if (CFRef<CFDataRef> data = mRep->component(slot)) {
386 if (validated()) { // if the directory has been validated...
387 if (!codeDirectory()->slotIsPresent(-slot))
388 return NULL;
389
390 if (!codeDirectory()->validateSlot(CFDataGetBytePtr(data), // ... and it's no good
391 CFDataGetLength(data), -slot, false))
392 MacOSError::throwMe(errorForSlot(slot)); // ... then bail
393 }
394 cache = data; // it's okay, cache it
395 } else { // absent, mark so
396 if (validated()) // if directory has been validated...
397 if (codeDirectory()->slotIsPresent(-slot)) // ... and the slot is NOT missing
398 MacOSError::throwMe(errorForSlot(slot)); // was supposed to be there
399 cache = CFDataRef(kCFNull); // white lie
400 }
401 }
402 return (cache == CFDataRef(kCFNull)) ? NULL : cache.get();
403 }
404
405
406 //
407 // Get the CodeDirectories.
408 // Throws (if check==true) or returns NULL (check==false) if there are none.
409 // Always throws if the CodeDirectories exist but are invalid.
410 // NEVER validates against the signature.
411 //
412 const SecStaticCode::CodeDirectoryMap *
413 SecStaticCode::codeDirectories(bool check /* = true */) const
414 {
415 if (mCodeDirectories.empty()) {
416 try {
417 loadCodeDirectories(mCodeDirectories);
418 } catch (...) {
419 if (check)
420 throw;
421 // We wanted a NON-checked peek and failed to safely decode the existing CodeDirectories.
422 // Pretend this is unsigned, but make sure we didn't somehow cache an invalid CodeDirectory.
423 if (!mCodeDirectories.empty()) {
424 assert(false);
425 Syslog::warning("code signing internal problem: mCodeDirectories set despite exception exit");
426 MacOSError::throwMe(errSecCSInternalError);
427 }
428 }
429 } else {
430 return &mCodeDirectories;
431 }
432 if (!mCodeDirectories.empty()) {
433 return &mCodeDirectories;
434 }
435 if (check) {
436 MacOSError::throwMe(errSecCSUnsigned);
437 }
438 return NULL;
439 }
440
441 //
442 // Get the CodeDirectory.
443 // Throws (if check==true) or returns NULL (check==false) if there is none.
444 // Always throws if the CodeDirectory exists but is invalid.
445 // NEVER validates against the signature.
446 //
447 const CodeDirectory *SecStaticCode::codeDirectory(bool check /* = true */) const
448 {
449 if (!mDir) {
450 // pick our favorite CodeDirectory from the choices we've got
451 try {
452 CodeDirectoryMap const *candidates = codeDirectories(check);
453 if (candidates != NULL) {
454 CodeDirectory::HashAlgorithm type = CodeDirectory::bestHashOf(mHashAlgorithms);
455 mDir = candidates->at(type); // and the winner is...
456 }
457 } catch (...) {
458 if (check)
459 throw;
460 // We wanted a NON-checked peek and failed to safely decode the existing CodeDirectory.
461 // Pretend this is unsigned, but make sure we didn't somehow cache an invalid CodeDirectory.
462 if (mDir) {
463 assert(false);
464 Syslog::warning("code signing internal problem: mDir set despite exception exit");
465 MacOSError::throwMe(errSecCSInternalError);
466 }
467 }
468 }
469 if (mDir)
470 return reinterpret_cast<const CodeDirectory *>(CFDataGetBytePtr(mDir));
471 if (check)
472 MacOSError::throwMe(errSecCSUnsigned);
473 return NULL;
474 }
475
476
477 //
478 // Fetch an array of all available CodeDirectories.
479 // Returns false if unsigned (no classic CD slot), true otherwise.
480 //
481 bool SecStaticCode::loadCodeDirectories(CodeDirectoryMap& cdMap) const
482 {
483 __block CodeDirectoryMap candidates;
484 __block CodeDirectory::HashAlgorithms hashAlgorithms;
485 __block CFRef<CFDataRef> baseDir;
486 auto add = ^bool (CodeDirectory::SpecialSlot slot){
487 CFRef<CFDataRef> cdData = diskRep()->component(slot);
488 if (!cdData)
489 return false;
490 const CodeDirectory* cd = reinterpret_cast<const CodeDirectory*>(CFDataGetBytePtr(cdData));
491 if (!cd->validateBlob(CFDataGetLength(cdData)))
492 MacOSError::throwMe(errSecCSSignatureFailed); // no recovery - any suspect CD fails
493 cd->checkIntegrity();
494 auto result = candidates.insert(make_pair(cd->hashType, cdData.get()));
495 if (!result.second)
496 MacOSError::throwMe(errSecCSSignatureInvalid); // duplicate hashType, go to heck
497 hashAlgorithms.insert(cd->hashType);
498 if (slot == cdCodeDirectorySlot)
499 baseDir = cdData;
500 return true;
501 };
502 if (!add(cdCodeDirectorySlot))
503 return false; // no classic slot CodeDirectory -> unsigned
504 for (CodeDirectory::SpecialSlot slot = cdAlternateCodeDirectorySlots; slot < cdAlternateCodeDirectoryLimit; slot++)
505 if (!add(slot)) // no CodeDirectory at this slot -> end of alternates
506 break;
507 if (candidates.empty())
508 MacOSError::throwMe(errSecCSSignatureFailed); // no viable CodeDirectory in sight
509 // commit to cached values
510 cdMap.swap(candidates);
511 mHashAlgorithms.swap(hashAlgorithms);
512 mBaseDir = baseDir;
513 return true;
514 }
515
516
517 //
518 // Get the hash of the CodeDirectory.
519 // Returns NULL if there is none.
520 //
521 CFDataRef SecStaticCode::cdHash()
522 {
523 if (!mCDHash) {
524 if (const CodeDirectory *cd = codeDirectory(false)) {
525 mCDHash.take(cd->cdhash());
526 CODESIGN_STATIC_CDHASH(this, CFDataGetBytePtr(mCDHash), (unsigned int)CFDataGetLength(mCDHash));
527 }
528 }
529 return mCDHash;
530 }
531
532
533 //
534 // Get an array of the cdhashes for all digest types in this signature
535 // The array is sorted by cd->hashType.
536 //
537 CFArrayRef SecStaticCode::cdHashes()
538 {
539 if (!mCDHashes) {
540 CFRef<CFMutableArrayRef> cdList = makeCFMutableArray(0);
541 for (auto it = mCodeDirectories.begin(); it != mCodeDirectories.end(); ++it) {
542 const CodeDirectory *cd = (const CodeDirectory *)CFDataGetBytePtr(it->second);
543 if (CFRef<CFDataRef> hash = cd->cdhash())
544 CFArrayAppendValue(cdList, hash);
545 }
546 mCDHashes = cdList.get();
547 }
548 return mCDHashes;
549 }
550
551
552 //
553 // Return the CMS signature blob; NULL if none found.
554 //
555 CFDataRef SecStaticCode::signature()
556 {
557 if (!mSignature)
558 mSignature.take(mRep->signature());
559 if (mSignature)
560 return mSignature;
561 MacOSError::throwMe(errSecCSUnsigned);
562 }
563
564
565 //
566 // Verify the signature on the CodeDirectory.
567 // If this succeeds (doesn't throw), the CodeDirectory is statically trustworthy.
568 // Any outcome (successful or not) is cached for the lifetime of the StaticCode.
569 //
570 void SecStaticCode::validateDirectory()
571 {
572 // echo previous outcome, if any
573 // track revocation separately, as it may not have been checked
574 // during the initial validation
575 if (!validated() || ((mValidationFlags & kSecCSEnforceRevocationChecks) && !revocationChecked()))
576 try {
577 // perform validation (or die trying)
578 CODESIGN_EVAL_STATIC_DIRECTORY(this);
579 mValidationExpired = verifySignature();
580 if (mValidationFlags & kSecCSEnforceRevocationChecks)
581 mRevocationChecked = true;
582
583 for (CodeDirectory::SpecialSlot slot = codeDirectory()->maxSpecialSlot(); slot >= 1; --slot)
584 if (mCache[slot]) // if we already loaded that resource...
585 validateComponent(slot, errorForSlot(slot)); // ... then check it now
586 mValidated = true; // we've done the deed...
587 mValidationResult = errSecSuccess; // ... and it was good
588 } catch (const CommonError &err) {
589 mValidated = true;
590 mValidationResult = err.osStatus();
591 throw;
592 } catch (...) {
593 secinfo("staticCode", "%p validation threw non-common exception", this);
594 mValidated = true;
595 Syslog::notice("code signing internal problem: unknown exception thrown by validation");
596 mValidationResult = errSecCSInternalError;
597 throw;
598 }
599 assert(validated());
600 // XXX: Embedded doesn't have CSSMERR_TP_CERT_EXPIRED so we can't throw it
601 // XXX: This should be implemented for embedded once we implement
602 // XXX: verifySignature and see how we're going to handle expired certs
603 #if TARGET_OS_OSX
604 if (mValidationResult == errSecSuccess) {
605 if (mValidationExpired)
606 if ((mValidationFlags & kSecCSConsiderExpiration)
607 || (codeDirectory()->flags & kSecCodeSignatureForceExpiration))
608 MacOSError::throwMe(CSSMERR_TP_CERT_EXPIRED);
609 } else
610 MacOSError::throwMe(mValidationResult);
611 #endif
612 }
613
614
615 //
616 // Load and validate the CodeDirectory and all components *except* those related to the resource envelope.
617 // Those latter components are checked by validateResources().
618 //
619 void SecStaticCode::validateNonResourceComponents()
620 {
621 this->validateDirectory();
622 for (CodeDirectory::SpecialSlot slot = codeDirectory()->maxSpecialSlot(); slot >= 1; --slot)
623 switch (slot) {
624 case cdResourceDirSlot: // validated by validateResources
625 break;
626 default:
627 this->component(slot); // loads and validates
628 break;
629 }
630 }
631
632
633 //
634 // Check that any "top index" sealed into the signature conforms to what's actually here.
635 //
636 void SecStaticCode::validateTopDirectory()
637 {
638 assert(mDir); // must already have loaded CodeDirectories
639 if (CFDataRef topDirectory = component(cdTopDirectorySlot)) {
640 const auto topData = (const Endian<uint32_t> *)CFDataGetBytePtr(topDirectory);
641 const auto topDataEnd = topData + CFDataGetLength(topDirectory) / sizeof(*topData);
642 std::vector<uint32_t> signedVector(topData, topDataEnd);
643
644 std::vector<uint32_t> foundVector;
645 foundVector.push_back(cdCodeDirectorySlot); // mandatory
646 for (CodeDirectory::Slot slot = 1; slot <= cdSlotMax; ++slot)
647 if (component(slot))
648 foundVector.push_back(slot);
649 int alternateCount = int(mCodeDirectories.size() - 1); // one will go into cdCodeDirectorySlot
650 for (int n = 0; n < alternateCount; n++)
651 foundVector.push_back(cdAlternateCodeDirectorySlots + n);
652 foundVector.push_back(cdSignatureSlot); // mandatory (may be empty)
653
654 if (signedVector != foundVector)
655 MacOSError::throwMe(errSecCSSignatureFailed);
656 }
657 }
658
659
660 //
661 // Get the (signed) signing date from the code signature.
662 // Sadly, we need to validate the signature to get the date (as a side benefit).
663 // This means that you can't get the signing time for invalidly signed code.
664 //
665 // We could run the decoder "almost to" verification to avoid this, but there seems
666 // little practical point to such a duplication of effort.
667 //
668 CFAbsoluteTime SecStaticCode::signingTime()
669 {
670 validateDirectory();
671 return mSigningTime;
672 }
673
674 CFAbsoluteTime SecStaticCode::signingTimestamp()
675 {
676 validateDirectory();
677 return mSigningTimestamp;
678 }
679
680 #if TARGET_OS_OSX
681 #define kSecSHA256HashSize 32
682 // subject:/C=US/ST=California/L=San Jose/O=Adobe Systems Incorporated/OU=Information Systems/OU=Digital ID Class 3 - Microsoft Software Validation v2/CN=Adobe Systems Incorporated
683 // issuer :/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA
684 // Not Before: Dec 15 00:00:00 2010 GMT
685 // Not After : Dec 14 23:59:59 2012 GMT
686 static const unsigned char ASI_CS_12[] = {
687 0x77,0x82,0x9C,0x64,0x33,0x45,0x2E,0x4A,0xD3,0xA8,0xE4,0x6F,0x00,0x6C,0x27,0xEA,
688 0xFB,0xD3,0xF2,0x6D,0x50,0xF3,0x6F,0xE0,0xE9,0x6D,0x06,0x59,0x19,0xB5,0x46,0xFF
689 };
690
691 bool SecStaticCode::checkfix41082220(OSStatus cssmTrustResult)
692 {
693 // only applicable to revoked results
694 if (cssmTrustResult != CSSMERR_TP_CERT_REVOKED) {
695 return false;
696 }
697
698 // only this leaf certificate
699 if (CFArrayGetCount(mCertChain) == 0) {
700 return false;
701 }
702 CFRef<CFDataRef> leafHash(SecCertificateCopySHA256Digest((SecCertificateRef)CFArrayGetValueAtIndex(mCertChain, 0)));
703 if (memcmp(ASI_CS_12, CFDataGetBytePtr(leafHash), kSecSHA256HashSize) != 0) {
704 return false;
705 }
706
707 // detached dmg signature
708 if (!isDetached() || format() != std::string("disk image")) {
709 return false;
710 }
711
712 // sha-1 signed
713 if (hashAlgorithms().size() != 1 || hashAlgorithm() != kSecCodeSignatureHashSHA1) {
714 return false;
715 }
716
717 // not a privileged binary - no TeamID and no entitlements
718 if (component(cdEntitlementSlot) || teamID()) {
719 return false;
720 }
721
722 // no flags and old version
723 if (codeDirectory()->version != 0x20100 || codeDirectory()->flags != 0) {
724 return false;
725 }
726
727 Security::Syslog::warning("CodeSigning: Check-fix enabled for dmg '%s' with identifier '%s' signed with revoked certificates",
728 mainExecutablePath().c_str(), identifier().c_str());
729 return true;
730 }
731 #endif // TARGET_OS_OSX
732
733 //
734 // Verify the CMS signature.
735 // This performs the cryptographic tango. It returns if the signature is valid,
736 // or throws if it is not. As a side effect, a successful return sets up the
737 // cached certificate chain for future use.
738 // Returns true if the signature is expired (the X.509 sense), false if it's not.
739 // Expiration is fatal (throws) if a secure timestamp is included, but not otherwise.
740 //
741 bool SecStaticCode::verifySignature()
742 {
743 // ad-hoc signed code is considered validly signed by definition
744 if (flag(kSecCodeSignatureAdhoc)) {
745 CODESIGN_EVAL_STATIC_SIGNATURE_ADHOC(this);
746 return false;
747 }
748
749 DTRACK(CODESIGN_EVAL_STATIC_SIGNATURE, this, (char*)this->mainExecutablePath().c_str());
750 #if TARGET_OS_OSX
751 // decode CMS and extract SecTrust for verification
752 CFRef<CMSDecoderRef> cms;
753 MacOSError::check(CMSDecoderCreate(&cms.aref())); // create decoder
754 CFDataRef sig = this->signature();
755 MacOSError::check(CMSDecoderUpdateMessage(cms, CFDataGetBytePtr(sig), CFDataGetLength(sig)));
756 this->codeDirectory(); // load CodeDirectory (sets mDir)
757 MacOSError::check(CMSDecoderSetDetachedContent(cms, mBaseDir));
758 MacOSError::check(CMSDecoderFinalizeMessage(cms));
759 MacOSError::check(CMSDecoderSetSearchKeychain(cms, cfEmptyArray()));
760 CFRef<CFArrayRef> vf_policies(createVerificationPolicies());
761 CFRef<CFArrayRef> ts_policies(createTimeStampingAndRevocationPolicies());
762
763 CMSSignerStatus status;
764 MacOSError::check(CMSDecoderCopySignerStatus(cms, 0, vf_policies,
765 false, &status, &mTrust.aref(), NULL));
766
767 if (status != kCMSSignerValid) {
768 const char *reason;
769 switch (status) {
770 case kCMSSignerUnsigned: reason="kCMSSignerUnsigned"; break;
771 case kCMSSignerNeedsDetachedContent: reason="kCMSSignerNeedsDetachedContent"; break;
772 case kCMSSignerInvalidSignature: reason="kCMSSignerInvalidSignature"; break;
773 case kCMSSignerInvalidCert: reason="kCMSSignerInvalidCert"; break;
774 case kCMSSignerInvalidIndex: reason="kCMSSignerInvalidIndex"; break;
775 default: reason="unknown"; break;
776 }
777 Security::Syslog::error("CMSDecoderCopySignerStatus failed with %s error (%d)",
778 reason, (int)status);
779 MacOSError::throwMe(errSecCSSignatureFailed);
780 }
781
782 // retrieve auxiliary v1 data bag and verify against current state
783 CFRef<CFDataRef> hashAgilityV1;
784 switch (OSStatus rc = CMSDecoderCopySignerAppleCodesigningHashAgility(cms, 0, &hashAgilityV1.aref())) {
785 case noErr:
786 if (hashAgilityV1) {
787 CFRef<CFDictionaryRef> hashDict = makeCFDictionaryFrom(hashAgilityV1);
788 CFArrayRef cdList = CFArrayRef(CFDictionaryGetValue(hashDict, CFSTR("cdhashes")));
789 CFArrayRef myCdList = this->cdHashes();
790
791 /* Note that this is not very "agile": There's no way to calculate the exact
792 * list for comparison if it contains hash algorithms we don't know yet... */
793 if (cdList == NULL || !CFEqual(cdList, myCdList))
794 MacOSError::throwMe(errSecCSSignatureFailed);
795 }
796 break;
797 case -1: /* CMS used to return this for "no attribute found", so tolerate it. Now returning noErr/NULL */
798 break;
799 default:
800 MacOSError::throwMe(rc);
801 }
802
803 // retrieve auxiliary v2 data bag and verify against current state
804 CFRef<CFDictionaryRef> hashAgilityV2;
805 switch (OSStatus rc = CMSDecoderCopySignerAppleCodesigningHashAgilityV2(cms, 0, &hashAgilityV2.aref())) {
806 case noErr:
807 if (hashAgilityV2) {
808 /* Require number of code directoris and entries in the hash agility
809 * dict to be the same size (no stripping out code directories).
810 */
811 if (CFDictionaryGetCount(hashAgilityV2) != mCodeDirectories.size()) {
812 MacOSError::throwMe(errSecCSSignatureFailed);
813 }
814
815 /* Require every cdhash of every code directory whose hash
816 * algorithm we know to be in the agility dictionary.
817 *
818 * We check untruncated cdhashes here because we can.
819 */
820 bool foundOurs = false;
821 for (auto& entry : mCodeDirectories) {
822 SECOidTag tag = CodeDirectorySet::SECOidTagForAlgorithm(entry.first);
823
824 if (tag == SEC_OID_UNKNOWN) {
825 // Unknown hash algorithm, ignore.
826 continue;
827 }
828
829 CFRef<CFNumberRef> key = makeCFNumber(int(tag));
830 CFRef<CFDataRef> entryCdhash;
831 entryCdhash = (CFDataRef)CFDictionaryGetValue(hashAgilityV2, (void*)key.get());
832
833 CodeDirectory const *cd = (CodeDirectory const*)CFDataGetBytePtr(entry.second);
834 CFRef<CFDataRef> ourCdhash = cd->cdhash(false); // Untruncated cdhash!
835 if (!CFEqual(entryCdhash, ourCdhash)) {
836 MacOSError::throwMe(errSecCSSignatureFailed);
837 }
838
839 if (entry.first == this->hashAlgorithm()) {
840 foundOurs = true;
841 }
842 }
843
844 /* Require the cdhash of our chosen code directory to be in the dictionary.
845 * In theory, the dictionary could be full of unsupported cdhashes, but we
846 * really want ours, which is bound to be supported, to be covered.
847 */
848 if (!foundOurs) {
849 MacOSError::throwMe(errSecCSSignatureFailed);
850 }
851 }
852 break;
853 case -1: /* CMS used to return this for "no attribute found", so tolerate it. Now returning noErr/NULL */
854 break;
855 default:
856 MacOSError::throwMe(rc);
857 }
858
859 // internal signing time (as specified by the signer; optional)
860 mSigningTime = 0; // "not present" marker (nobody could code sign on Jan 1, 2001 :-)
861 switch (OSStatus rc = CMSDecoderCopySignerSigningTime(cms, 0, &mSigningTime)) {
862 case errSecSuccess:
863 case errSecSigningTimeMissing:
864 break;
865 default:
866 Security::Syslog::error("Could not get signing time (error %d)", (int)rc);
867 MacOSError::throwMe(rc);
868 }
869
870 // certified signing time (as specified by a TSA; optional)
871 mSigningTimestamp = 0;
872 switch (OSStatus rc = CMSDecoderCopySignerTimestampWithPolicy(cms, ts_policies, 0, &mSigningTimestamp)) {
873 case errSecSuccess:
874 case errSecTimestampMissing:
875 break;
876 default:
877 Security::Syslog::error("Could not get timestamp (error %d)", (int)rc);
878 MacOSError::throwMe(rc);
879 }
880
881 // set up the environment for SecTrust
882 if (mValidationFlags & kSecCSNoNetworkAccess) {
883 MacOSError::check(SecTrustSetNetworkFetchAllowed(mTrust,false)); // no network?
884 }
885 MacOSError::check(SecTrustSetKeychainsAllowed(mTrust, false));
886
887 CSSM_APPLE_TP_ACTION_DATA actionData = {
888 CSSM_APPLE_TP_ACTION_VERSION, // version of data structure
889 0 // action flags
890 };
891
892 if (!(mValidationFlags & kSecCSCheckTrustedAnchors)) {
893 /* no need to evaluate anchor trust when building cert chain */
894 MacOSError::check(SecTrustSetAnchorCertificates(mTrust, cfEmptyArray())); // no anchors
895 actionData.ActionFlags |= CSSM_TP_ACTION_IMPLICIT_ANCHORS; // action flags
896 }
897
898 for (;;) { // at most twice
899 MacOSError::check(SecTrustSetParameters(mTrust,
900 CSSM_TP_ACTION_DEFAULT, CFTempData(&actionData, sizeof(actionData))));
901
902 // evaluate trust and extract results
903 SecTrustResultType trustResult;
904 MacOSError::check(SecTrustEvaluate(mTrust, &trustResult));
905 MacOSError::check(SecTrustGetResult(mTrust, &trustResult, &mCertChain.aref(), &mEvalDetails));
906
907 // if this is an Apple developer cert....
908 if (teamID() && SecStaticCode::isAppleDeveloperCert(mCertChain)) {
909 CFRef<CFStringRef> teamIDFromCert;
910 if (CFArrayGetCount(mCertChain) > 0) {
911 /* Note that SecCertificateCopySubjectComponent sets the out parameter to NULL if there is no field present */
912 MacOSError::check(SecCertificateCopySubjectComponent((SecCertificateRef)CFArrayGetValueAtIndex(mCertChain, Requirement::leafCert),
913 &CSSMOID_OrganizationalUnitName,
914 &teamIDFromCert.aref()));
915
916 if (teamIDFromCert) {
917 CFRef<CFStringRef> teamIDFromCD = CFStringCreateWithCString(NULL, teamID(), kCFStringEncodingUTF8);
918 if (!teamIDFromCD) {
919 Security::Syslog::error("Could not get team identifier (%s)", teamID());
920 MacOSError::throwMe(errSecCSInvalidTeamIdentifier);
921 }
922
923 if (CFStringCompare(teamIDFromCert, teamIDFromCD, 0) != kCFCompareEqualTo) {
924 Security::Syslog::error("Team identifier in the signing certificate (%s) does not match the team identifier (%s) in the code directory",
925 cfString(teamIDFromCert).c_str(), teamID());
926 MacOSError::throwMe(errSecCSBadTeamIdentifier);
927 }
928 }
929 }
930 }
931
932 CODESIGN_EVAL_STATIC_SIGNATURE_RESULT(this, trustResult, mCertChain ? (int)CFArrayGetCount(mCertChain) : 0);
933 switch (trustResult) {
934 case kSecTrustResultProceed:
935 case kSecTrustResultUnspecified:
936 break; // success
937 case kSecTrustResultDeny:
938 MacOSError::throwMe(CSSMERR_APPLETP_TRUST_SETTING_DENY); // user reject
939 case kSecTrustResultInvalid:
940 assert(false); // should never happen
941 MacOSError::throwMe(CSSMERR_TP_NOT_TRUSTED);
942 default:
943 {
944 OSStatus result;
945 MacOSError::check(SecTrustGetCssmResultCode(mTrust, &result));
946 // if we have a valid timestamp, CMS validates against (that) signing time and all is well.
947 // If we don't have one, may validate against *now*, and must be able to tolerate expiration.
948 if (mSigningTimestamp == 0) { // no timestamp available
949 if (((result == CSSMERR_TP_CERT_EXPIRED) || (result == CSSMERR_TP_CERT_NOT_VALID_YET))
950 && !(actionData.ActionFlags & CSSM_TP_ACTION_ALLOW_EXPIRED)) {
951 CODESIGN_EVAL_STATIC_SIGNATURE_EXPIRED(this);
952 actionData.ActionFlags |= CSSM_TP_ACTION_ALLOW_EXPIRED; // (this also allows postdated certs)
953 continue; // retry validation while tolerating expiration
954 }
955 }
956 if (checkfix41082220(result)) {
957 break; // success
958 }
959 Security::Syslog::error("SecStaticCode: verification failed (trust result %d, error %d)", trustResult, (int)result);
960 MacOSError::throwMe(result);
961 }
962 }
963
964 if (mSigningTimestamp) {
965 CFIndex rootix = CFArrayGetCount(mCertChain);
966 if (SecCertificateRef mainRoot = SecCertificateRef(CFArrayGetValueAtIndex(mCertChain, rootix-1)))
967 if (isAppleCA(mainRoot)) {
968 // impose policy: if the signature itself draws to Apple, then so must the timestamp signature
969 CFRef<CFArrayRef> tsCerts;
970 OSStatus result = CMSDecoderCopySignerTimestampCertificates(cms, 0, &tsCerts.aref());
971 if (result) {
972 Security::Syslog::error("SecStaticCode: could not get timestamp certificates (error %d)", (int)result);
973 MacOSError::check(result);
974 }
975 CFIndex tsn = CFArrayGetCount(tsCerts);
976 bool good = tsn > 0 && isAppleCA(SecCertificateRef(CFArrayGetValueAtIndex(tsCerts, tsn-1)));
977 if (!good) {
978 result = CSSMERR_TP_NOT_TRUSTED;
979 Security::Syslog::error("SecStaticCode: timestamp policy verification failed (error %d)", (int)result);
980 MacOSError::throwMe(result);
981 }
982 }
983 }
984
985 return actionData.ActionFlags & CSSM_TP_ACTION_ALLOW_EXPIRED;
986 }
987 #else
988 // Do some pre-verification initialization
989 CFDataRef sig = this->signature();
990 this->codeDirectory(); // load CodeDirectory (sets mDir)
991 mSigningTime = 0; // "not present" marker (nobody could code sign on Jan 1, 2001 :-)
992
993 CFRef<CFDictionaryRef> attrs;
994 CFRef<CFArrayRef> vf_policies(createVerificationPolicies());
995
996 // Verify the CMS signature against mBaseDir (SHA1)
997 MacOSError::check(SecCMSVerifyCopyDataAndAttributes(sig, mBaseDir, vf_policies, &mTrust.aref(), NULL, &attrs.aref()));
998
999 // Copy the signing time
1000 mSigningTime = SecTrustGetVerifyTime(mTrust);
1001
1002 // Validate the cert chain
1003 SecTrustResultType trustResult;
1004 MacOSError::check(SecTrustEvaluate(mTrust, &trustResult));
1005
1006 // retrieve auxiliary data bag and verify against current state
1007 CFRef<CFDataRef> hashBag;
1008 hashBag = CFDataRef(CFDictionaryGetValue(attrs, kSecCMSHashAgility));
1009 if (hashBag) {
1010 CFRef<CFDictionaryRef> hashDict = makeCFDictionaryFrom(hashBag);
1011 CFArrayRef cdList = CFArrayRef(CFDictionaryGetValue(hashDict, CFSTR("cdhashes")));
1012 CFArrayRef myCdList = this->cdHashes();
1013 if (cdList == NULL || !CFEqual(cdList, myCdList))
1014 MacOSError::throwMe(errSecCSSignatureFailed);
1015 }
1016
1017 /*
1018 * Populate mCertChain with the certs. If we failed validation, the
1019 * signer's cert will be checked installed provisioning profiles as an
1020 * alternative to verification against the policy for store-signed binaries
1021 */
1022 SecCertificateRef leafCert = SecTrustGetCertificateAtIndex(mTrust, 0);
1023 if (leafCert != NULL) {
1024 CFIndex count = SecTrustGetCertificateCount(mTrust);
1025
1026 CFMutableArrayRef certs = CFArrayCreateMutable(kCFAllocatorDefault, count,
1027 &kCFTypeArrayCallBacks);
1028
1029 CFArrayAppendValue(certs, leafCert);
1030 for (CFIndex i = 1; i < count; ++i) {
1031 CFArrayAppendValue(certs, SecTrustGetCertificateAtIndex(mTrust, i));
1032 }
1033
1034 mCertChain.take((CFArrayRef)certs);
1035 }
1036
1037 // Did we implicitly trust the signer?
1038 mTrustedSigningCertChain = (trustResult == kSecTrustResultUnspecified || trustResult == kSecTrustResultProceed);
1039
1040 return false; // XXX: Not checking for expired certs
1041 #endif
1042 }
1043
1044 #if TARGET_OS_OSX
1045 //
1046 // Return the TP policy used for signature verification.
1047 // This may be a simple SecPolicyRef or a CFArray of policies.
1048 // The caller owns the return value.
1049 //
1050 static SecPolicyRef makeRevocationPolicy(CFOptionFlags flags)
1051 {
1052 CFRef<SecPolicyRef> policy(SecPolicyCreateRevocation(flags));
1053 return policy.yield();
1054 }
1055 #endif
1056
1057 CFArrayRef SecStaticCode::createVerificationPolicies()
1058 {
1059 if (mValidationFlags & kSecCSUseSoftwareSigningCert) {
1060 CFRef<SecPolicyRef> ssRef = SecPolicyCreateAppleSoftwareSigning();
1061 return makeCFArray(1, ssRef.get());
1062 }
1063 #if TARGET_OS_OSX
1064 CFRef<SecPolicyRef> core;
1065 MacOSError::check(SecPolicyCopy(CSSM_CERT_X_509v3,
1066 &CSSMOID_APPLE_TP_CODE_SIGNING, &core.aref()));
1067 if (mValidationFlags & kSecCSNoNetworkAccess) {
1068 // Skips all revocation since they require network connectivity
1069 // therefore annihilates kSecCSEnforceRevocationChecks if present
1070 CFRef<SecPolicyRef> no_revoc = makeRevocationPolicy(kSecRevocationNetworkAccessDisabled);
1071 return makeCFArray(2, core.get(), no_revoc.get());
1072 }
1073 else if (mValidationFlags & kSecCSEnforceRevocationChecks) {
1074 // Add CRL and OCSP policies
1075 CFRef<SecPolicyRef> revoc = makeRevocationPolicy(kSecRevocationUseAnyAvailableMethod);
1076 return makeCFArray(2, core.get(), revoc.get());
1077 } else {
1078 return makeCFArray(1, core.get());
1079 }
1080 #elif TARGET_OS_TV
1081 CFRef<SecPolicyRef> tvOSRef = SecPolicyCreateAppleTVOSApplicationSigning();
1082 return makeCFArray(1, tvOSRef.get());
1083 #else
1084 CFRef<SecPolicyRef> iOSRef = SecPolicyCreateiPhoneApplicationSigning();
1085 return makeCFArray(1, iOSRef.get());
1086 #endif
1087
1088 }
1089
1090 CFArrayRef SecStaticCode::createTimeStampingAndRevocationPolicies()
1091 {
1092 CFRef<SecPolicyRef> tsPolicy = SecPolicyCreateAppleTimeStamping();
1093 #if TARGET_OS_OSX
1094 if (mValidationFlags & kSecCSNoNetworkAccess) {
1095 // Skips all revocation since they require network connectivity
1096 // therefore annihilates kSecCSEnforceRevocationChecks if present
1097 CFRef<SecPolicyRef> no_revoc = makeRevocationPolicy(kSecRevocationNetworkAccessDisabled);
1098 return makeCFArray(2, tsPolicy.get(), no_revoc.get());
1099 }
1100 else if (mValidationFlags & kSecCSEnforceRevocationChecks) {
1101 // Add CRL and OCSP policies
1102 CFRef<SecPolicyRef> revoc = makeRevocationPolicy(kSecRevocationUseAnyAvailableMethod);
1103 return makeCFArray(2, tsPolicy.get(), revoc.get());
1104 }
1105 else {
1106 return makeCFArray(1, tsPolicy.get());
1107 }
1108 #else
1109 return makeCFArray(1, tsPolicy.get());
1110 #endif
1111
1112 }
1113
1114
1115 //
1116 // Validate a particular sealed, cached resource against its (special) CodeDirectory slot.
1117 // The resource must already have been placed in the cache.
1118 // This does NOT perform basic validation.
1119 //
1120 void SecStaticCode::validateComponent(CodeDirectory::SpecialSlot slot, OSStatus fail /* = errSecCSSignatureFailed */)
1121 {
1122 assert(slot <= cdSlotMax);
1123 CFDataRef data = mCache[slot];
1124 assert(data); // must be cached
1125 if (data == CFDataRef(kCFNull)) {
1126 if (codeDirectory()->slotIsPresent(-slot)) // was supposed to be there...
1127 MacOSError::throwMe(fail); // ... and is missing
1128 } else {
1129 if (!codeDirectory()->validateSlot(CFDataGetBytePtr(data), CFDataGetLength(data), -slot, false))
1130 MacOSError::throwMe(fail);
1131 }
1132 }
1133
1134
1135 //
1136 // Perform static validation of the main executable.
1137 // This reads the main executable from disk and validates it against the
1138 // CodeDirectory code slot array.
1139 // Note that this is NOT an in-memory validation, and is thus potentially
1140 // subject to timing attacks.
1141 //
1142 void SecStaticCode::validateExecutable()
1143 {
1144 if (!validatedExecutable()) {
1145 try {
1146 DTRACK(CODESIGN_EVAL_STATIC_EXECUTABLE, this,
1147 (char*)this->mainExecutablePath().c_str(), codeDirectory()->nCodeSlots);
1148 const CodeDirectory *cd = this->codeDirectory();
1149 if (!cd)
1150 MacOSError::throwMe(errSecCSUnsigned);
1151 AutoFileDesc fd(mainExecutablePath(), O_RDONLY);
1152 fd.fcntl(F_NOCACHE, true); // turn off page caching (one-pass)
1153 if (Universal *fat = mRep->mainExecutableImage())
1154 fd.seek(fat->archOffset());
1155 size_t pageSize = cd->pageSize ? (1 << cd->pageSize) : 0;
1156 size_t remaining = cd->signingLimit();
1157 for (uint32_t slot = 0; slot < cd->nCodeSlots; ++slot) {
1158 size_t thisPage = remaining;
1159 if (pageSize)
1160 thisPage = min(thisPage, pageSize);
1161 __block bool good = true;
1162 CodeDirectory::multipleHashFileData(fd, thisPage, hashAlgorithms(), ^(CodeDirectory::HashAlgorithm type, Security::DynamicHash *hasher) {
1163 const CodeDirectory* cd = (const CodeDirectory*)CFDataGetBytePtr(mCodeDirectories[type]);
1164 if (!hasher->verify(cd->getSlot(slot,
1165 mValidationFlags & kSecCSValidatePEH)))
1166 good = false;
1167 });
1168 if (!good) {
1169 CODESIGN_EVAL_STATIC_EXECUTABLE_FAIL(this, (int)slot);
1170 MacOSError::throwMe(errSecCSSignatureFailed);
1171 }
1172 remaining -= thisPage;
1173 }
1174 assert(remaining == 0);
1175 mExecutableValidated = true;
1176 mExecutableValidResult = errSecSuccess;
1177 } catch (const CommonError &err) {
1178 mExecutableValidated = true;
1179 mExecutableValidResult = err.osStatus();
1180 throw;
1181 } catch (...) {
1182 secinfo("staticCode", "%p executable validation threw non-common exception", this);
1183 mExecutableValidated = true;
1184 mExecutableValidResult = errSecCSInternalError;
1185 Syslog::notice("code signing internal problem: unknown exception thrown by validation");
1186 throw;
1187 }
1188 }
1189 assert(validatedExecutable());
1190 if (mExecutableValidResult != errSecSuccess)
1191 MacOSError::throwMe(mExecutableValidResult);
1192 }
1193
1194
1195 //
1196 // Perform static validation of sealed resources and nested code.
1197 //
1198 // This performs a whole-code static resource scan and effectively
1199 // computes a concordance between what's on disk and what's in the ResourceDirectory.
1200 // Any unsanctioned difference causes an error.
1201 //
1202 unsigned SecStaticCode::estimateResourceWorkload()
1203 {
1204 // workload estimate = number of sealed files
1205 CFDictionaryRef sealedResources = resourceDictionary();
1206 CFDictionaryRef files = cfget<CFDictionaryRef>(sealedResources, "files2");
1207 if (files == NULL)
1208 files = cfget<CFDictionaryRef>(sealedResources, "files");
1209 return files ? unsigned(CFDictionaryGetCount(files)) : 0;
1210 }
1211
1212 void SecStaticCode::validateResources(SecCSFlags flags)
1213 {
1214 // do we have a superset of this requested validation cached?
1215 bool doit = true;
1216 if (mResourcesValidated) { // have cached outcome
1217 if (!(flags & kSecCSCheckNestedCode) || mResourcesDeep) // was deep or need no deep scan
1218 doit = false;
1219 }
1220
1221 if (doit) {
1222 if (mLimitedAsync == NULL) {
1223 mLimitedAsync = new LimitedAsync(diskRep()->fd().mediumType() == kIOPropertyMediumTypeSolidStateKey);
1224 }
1225
1226 try {
1227 CFDictionaryRef rules;
1228 CFDictionaryRef files;
1229 uint32_t version;
1230 if (!loadResources(rules, files, version))
1231 return; // validly no resources; nothing to do (ok)
1232
1233 // found resources, and they are sealed
1234 DTRACK(CODESIGN_EVAL_STATIC_RESOURCES, this,
1235 (char*)this->mainExecutablePath().c_str(), 0);
1236
1237 // scan through the resources on disk, checking each against the resourceDirectory
1238 mResourcesValidContext = new CollectingContext(*this); // collect all failures in here
1239
1240 // check for weak resource rules
1241 bool strict = flags & kSecCSStrictValidate;
1242 if (strict) {
1243 if (hasWeakResourceRules(rules, version, mAllowOmissions))
1244 if (mTolerateErrors.find(errSecCSWeakResourceRules) == mTolerateErrors.end())
1245 MacOSError::throwMe(errSecCSWeakResourceRules);
1246 if (version == 1)
1247 if (mTolerateErrors.find(errSecCSWeakResourceEnvelope) == mTolerateErrors.end())
1248 MacOSError::throwMe(errSecCSWeakResourceEnvelope);
1249 }
1250
1251 Dispatch::Group group;
1252 Dispatch::Group &groupRef = group; // (into block)
1253
1254 // scan through the resources on disk, checking each against the resourceDirectory
1255 __block CFRef<CFMutableDictionaryRef> resourceMap = makeCFMutableDictionary(files);
1256 string base = cfString(this->resourceBase());
1257 ResourceBuilder resources(base, base, rules, strict, mTolerateErrors);
1258 this->mResourceScope = &resources;
1259 diskRep()->adjustResources(resources);
1260
1261 resources.scan(^(FTSENT *ent, uint32_t ruleFlags, const string relpath, ResourceBuilder::Rule *rule) {
1262 CFDictionaryRemoveValue(resourceMap, CFTempString(relpath));
1263 bool isSymlink = (ent->fts_info == FTS_SL);
1264
1265 void (^validate)() = ^{
1266 validateResource(files, relpath, isSymlink, *mResourcesValidContext, flags, version);
1267 reportProgress();
1268 };
1269
1270 mLimitedAsync->perform(groupRef, validate);
1271 });
1272 group.wait(); // wait until all async resources have been validated as well
1273
1274 unsigned leftovers = unsigned(CFDictionaryGetCount(resourceMap));
1275 if (leftovers > 0) {
1276 secinfo("staticCode", "%d sealed resource(s) not found in code", int(leftovers));
1277 CFDictionaryApplyFunction(resourceMap, SecStaticCode::checkOptionalResource, mResourcesValidContext);
1278 }
1279
1280 // now check for any errors found in the reporting context
1281 mResourcesValidated = true;
1282 mResourcesDeep = flags & kSecCSCheckNestedCode;
1283 if (mResourcesValidContext->osStatus() != errSecSuccess)
1284 mResourcesValidContext->throwMe();
1285 } catch (const CommonError &err) {
1286 mResourcesValidated = true;
1287 mResourcesDeep = flags & kSecCSCheckNestedCode;
1288 mResourcesValidResult = err.osStatus();
1289 throw;
1290 } catch (...) {
1291 secinfo("staticCode", "%p executable validation threw non-common exception", this);
1292 mResourcesValidated = true;
1293 mResourcesDeep = flags & kSecCSCheckNestedCode;
1294 mResourcesValidResult = errSecCSInternalError;
1295 Syslog::notice("code signing internal problem: unknown exception thrown by validation");
1296 throw;
1297 }
1298 }
1299 assert(validatedResources());
1300 if (mResourcesValidResult)
1301 MacOSError::throwMe(mResourcesValidResult);
1302 if (mResourcesValidContext->osStatus() != errSecSuccess)
1303 mResourcesValidContext->throwMe();
1304 }
1305
1306
1307 bool SecStaticCode::loadResources(CFDictionaryRef& rules, CFDictionaryRef& files, uint32_t& version)
1308 {
1309 // sanity first
1310 CFDictionaryRef sealedResources = resourceDictionary();
1311 if (this->resourceBase()) { // disk has resources
1312 if (sealedResources)
1313 /* go to work below */;
1314 else
1315 MacOSError::throwMe(errSecCSResourcesNotFound);
1316 } else { // disk has no resources
1317 if (sealedResources)
1318 MacOSError::throwMe(errSecCSResourcesNotFound);
1319 else
1320 return false; // no resources, not sealed - fine (no work)
1321 }
1322
1323 // use V2 resource seal if available, otherwise fall back to V1
1324 if (CFDictionaryGetValue(sealedResources, CFSTR("files2"))) { // have V2 signature
1325 rules = cfget<CFDictionaryRef>(sealedResources, "rules2");
1326 files = cfget<CFDictionaryRef>(sealedResources, "files2");
1327 version = 2;
1328 } else { // only V1 available
1329 rules = cfget<CFDictionaryRef>(sealedResources, "rules");
1330 files = cfget<CFDictionaryRef>(sealedResources, "files");
1331 version = 1;
1332 }
1333 if (!rules || !files)
1334 MacOSError::throwMe(errSecCSResourcesInvalid);
1335 return true;
1336 }
1337
1338
1339 void SecStaticCode::checkOptionalResource(CFTypeRef key, CFTypeRef value, void *context)
1340 {
1341 ValidationContext *ctx = static_cast<ValidationContext *>(context);
1342 ResourceSeal seal(value);
1343 if (!seal.optional()) {
1344 if (key && CFGetTypeID(key) == CFStringGetTypeID()) {
1345 CFTempURL tempURL(CFStringRef(key), false, ctx->code.resourceBase());
1346 if (!tempURL.get()) {
1347 ctx->reportProblem(errSecCSBadDictionaryFormat, kSecCFErrorResourceSeal, key);
1348 } else {
1349 ctx->reportProblem(errSecCSBadResource, kSecCFErrorResourceMissing, tempURL);
1350 }
1351 } else {
1352 ctx->reportProblem(errSecCSBadResource, kSecCFErrorResourceSeal, key);
1353 }
1354 }
1355 }
1356
1357
1358 static bool isOmitRule(CFTypeRef value)
1359 {
1360 if (CFGetTypeID(value) == CFBooleanGetTypeID())
1361 return value == kCFBooleanFalse;
1362 CFDictionary rule(value, errSecCSResourceRulesInvalid);
1363 return rule.get<CFBooleanRef>("omit") == kCFBooleanTrue;
1364 }
1365
1366 bool SecStaticCode::hasWeakResourceRules(CFDictionaryRef rulesDict, uint32_t version, CFArrayRef allowedOmissions)
1367 {
1368 // compute allowed omissions
1369 CFRef<CFArrayRef> defaultOmissions = this->diskRep()->allowedResourceOmissions();
1370 if (!defaultOmissions) {
1371 Syslog::notice("code signing internal problem: diskRep returned no allowedResourceOmissions");
1372 MacOSError::throwMe(errSecCSInternalError);
1373 }
1374 CFRef<CFMutableArrayRef> allowed = CFArrayCreateMutableCopy(NULL, 0, defaultOmissions);
1375 if (allowedOmissions)
1376 CFArrayAppendArray(allowed, allowedOmissions, CFRangeMake(0, CFArrayGetCount(allowedOmissions)));
1377 CFRange range = CFRangeMake(0, CFArrayGetCount(allowed));
1378
1379 // check all resource rules for weakness
1380 string catchAllRule = (version == 1) ? "^Resources/" : "^.*";
1381 __block bool coversAll = false;
1382 __block bool forbiddenOmission = false;
1383 CFArrayRef allowedRef = allowed.get(); // (into block)
1384 CFDictionary rules(rulesDict, errSecCSResourceRulesInvalid);
1385 rules.apply(^(CFStringRef key, CFTypeRef value) {
1386 string pattern = cfString(key, errSecCSResourceRulesInvalid);
1387 if (pattern == catchAllRule && value == kCFBooleanTrue) {
1388 coversAll = true;
1389 return;
1390 }
1391 if (isOmitRule(value))
1392 forbiddenOmission |= !CFArrayContainsValue(allowedRef, range, key);
1393 });
1394
1395 return !coversAll || forbiddenOmission;
1396 }
1397
1398
1399 //
1400 // Load, validate, cache, and return CFDictionary forms of sealed resources.
1401 //
1402 CFDictionaryRef SecStaticCode::infoDictionary()
1403 {
1404 if (!mInfoDict) {
1405 mInfoDict.take(getDictionary(cdInfoSlot, errSecCSInfoPlistFailed));
1406 secinfo("staticCode", "%p loaded InfoDict %p", this, mInfoDict.get());
1407 }
1408 return mInfoDict;
1409 }
1410
1411 CFDictionaryRef SecStaticCode::entitlements()
1412 {
1413 if (!mEntitlements) {
1414 validateDirectory();
1415 if (CFDataRef entitlementData = component(cdEntitlementSlot)) {
1416 validateComponent(cdEntitlementSlot);
1417 const EntitlementBlob *blob = reinterpret_cast<const EntitlementBlob *>(CFDataGetBytePtr(entitlementData));
1418 if (blob->validateBlob()) {
1419 mEntitlements.take(blob->entitlements());
1420 secinfo("staticCode", "%p loaded Entitlements %p", this, mEntitlements.get());
1421 }
1422 // we do not consider a different blob type to be an error. We think it's a new format we don't understand
1423 }
1424 }
1425 return mEntitlements;
1426 }
1427
1428 CFDictionaryRef SecStaticCode::resourceDictionary(bool check /* = true */)
1429 {
1430 if (mResourceDict) // cached
1431 return mResourceDict;
1432 if (CFRef<CFDictionaryRef> dict = getDictionary(cdResourceDirSlot, check))
1433 if (cfscan(dict, "{rules=%Dn,files=%Dn}")) {
1434 secinfo("staticCode", "%p loaded ResourceDict %p",
1435 this, mResourceDict.get());
1436 return mResourceDict = dict;
1437 }
1438 // bad format
1439 return NULL;
1440 }
1441
1442
1443 CFDataRef SecStaticCode::copyComponent(CodeDirectory::SpecialSlot slot, CFDataRef hash)
1444 {
1445 const CodeDirectory* cd = this->codeDirectory();
1446 if (CFCopyRef<CFDataRef> component = this->component(slot)) {
1447 if (hash) {
1448 const void *slotHash = cd->getSlot(slot, false);
1449 if (cd->hashSize != CFDataGetLength(hash) || 0 != memcmp(slotHash, CFDataGetBytePtr(hash), cd->hashSize)) {
1450 Syslog::notice("copyComponent hash mismatch slot %d length %d", slot, int(CFDataGetLength(hash)));
1451 return NULL; // mismatch
1452 }
1453 }
1454 return component.yield();
1455 }
1456 return NULL;
1457 }
1458
1459
1460
1461 //
1462 // Load and cache the resource directory base.
1463 // Note that the base is optional for each DiskRep.
1464 //
1465 CFURLRef SecStaticCode::resourceBase()
1466 {
1467 if (!mGotResourceBase) {
1468 string base = mRep->resourcesRootPath();
1469 if (!base.empty())
1470 mResourceBase.take(makeCFURL(base, true));
1471 mGotResourceBase = true;
1472 }
1473 return mResourceBase;
1474 }
1475
1476
1477 //
1478 // Load a component, validate it, convert it to a CFDictionary, and return that.
1479 // This will force load and validation, which means that it will perform basic
1480 // validation if it hasn't been done yet.
1481 //
1482 CFDictionaryRef SecStaticCode::getDictionary(CodeDirectory::SpecialSlot slot, bool check /* = true */)
1483 {
1484 if (check)
1485 validateDirectory();
1486 if (CFDataRef infoData = component(slot)) {
1487 validateComponent(slot);
1488 if (CFDictionaryRef dict = makeCFDictionaryFrom(infoData))
1489 return dict;
1490 else
1491 MacOSError::throwMe(errSecCSBadDictionaryFormat);
1492 }
1493 return NULL;
1494 }
1495
1496 //
1497 //
1498 //
1499 CFDictionaryRef SecStaticCode::diskRepInformation()
1500 {
1501 return mRep->diskRepInformation();
1502 }
1503
1504 bool SecStaticCode::checkfix30814861(string path, bool addition) {
1505 // <rdar://problem/30814861> v2 resource rules don't match v1 resource rules
1506
1507 //// Condition 1: Is the app an iOS app that was built with an SDK lower than 9.0?
1508
1509 // We started signing correctly in 2014, 9.0 was first seeded mid-2016.
1510
1511 CFRef<CFDictionaryRef> inf = diskRepInformation();
1512 try {
1513 CFDictionary info(diskRepInformation(), errSecCSNotSupported);
1514 uint32_t platform =
1515 cfNumber(info.get<CFNumberRef>(kSecCodeInfoDiskRepVersionPlatform, errSecCSNotSupported), 0);
1516 uint32_t sdkVersion =
1517 cfNumber(info.get<CFNumberRef>(kSecCodeInfoDiskRepVersionSDK, errSecCSNotSupported), 0);
1518
1519 if (platform != PLATFORM_IOS || sdkVersion >= 0x00090000) {
1520 return false;
1521 }
1522 } catch (const MacOSError &error) {
1523 return false;
1524 }
1525
1526 //// Condition 2: Is it a .sinf/.supf/.supp file at the right location?
1527
1528 static regex_t pathre_sinf;
1529 static regex_t pathre_supp_supf;
1530 static dispatch_once_t once;
1531
1532 dispatch_once(&once, ^{
1533 os_assert_zero(regcomp(&pathre_sinf,
1534 "^(Frameworks/[^/]+\\.framework/|PlugIns/[^/]+\\.appex/|())SC_Info/[^/]+\\.sinf$",
1535 REG_EXTENDED | REG_NOSUB));
1536 os_assert_zero(regcomp(&pathre_supp_supf,
1537 "^(Frameworks/[^/]+\\.framework/|PlugIns/[^/]+\\.appex/|())SC_Info/[^/]+\\.(supf|supp)$",
1538 REG_EXTENDED | REG_NOSUB));
1539 });
1540
1541 // .sinf is added, .supf/.supp are modified.
1542 const regex_t &pathre = addition ? pathre_sinf : pathre_supp_supf;
1543
1544 const int result = regexec(&pathre, path.c_str(), 0, NULL, 0);
1545
1546 if (result == REG_NOMATCH) {
1547 return false;
1548 } else if (result != 0) {
1549 // Huh?
1550 secerror("unexpected regexec result %d for path '%s'", result, path.c_str());
1551 return false;
1552 }
1553
1554 //// Condition 3: Do the v1 rules actually exclude the file?
1555
1556 dispatch_once(&mCheckfix30814861builder1_once, ^{
1557 // Create the v1 resource builder lazily.
1558 CFDictionaryRef rules1 = cfget<CFDictionaryRef>(resourceDictionary(), "rules");
1559 const string base = cfString(resourceBase());
1560
1561 mCheckfix30814861builder1 = new ResourceBuilder(base, base, rules1, false, mTolerateErrors);
1562 });
1563
1564 ResourceBuilder::Rule const * const matchingRule = mCheckfix30814861builder1->findRule(path);
1565
1566 if (matchingRule == NULL || !(matchingRule->flags & ResourceBuilder::omitted)) {
1567 return false;
1568 }
1569
1570 //// All matched, this file is a check-fixed sinf/supf/supp.
1571
1572 return true;
1573
1574 }
1575
1576 void SecStaticCode::validateResource(CFDictionaryRef files, string path, bool isSymlink, ValidationContext &ctx, SecCSFlags flags, uint32_t version)
1577 {
1578 if (!resourceBase()) // no resources in DiskRep
1579 MacOSError::throwMe(errSecCSResourcesNotFound);
1580 CFRef<CFURLRef> fullpath = makeCFURL(path, false, resourceBase());
1581 if (version > 1 && ((flags & (kSecCSStrictValidate|kSecCSRestrictSidebandData)) == (kSecCSStrictValidate|kSecCSRestrictSidebandData))) {
1582 AutoFileDesc fd(cfString(fullpath));
1583 if (fd.hasExtendedAttribute(XATTR_RESOURCEFORK_NAME) || fd.hasExtendedAttribute(XATTR_FINDERINFO_NAME))
1584 ctx.reportProblem(errSecCSInvalidAssociatedFileData, kSecCFErrorResourceSideband, fullpath);
1585 }
1586 if (CFTypeRef file = CFDictionaryGetValue(files, CFTempString(path))) {
1587 ResourceSeal seal(file);
1588 const ResourceSeal& rseal = seal;
1589 if (seal.nested()) {
1590 if (isSymlink)
1591 return ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, fullpath); // changed type
1592 string suffix = ".framework";
1593 bool isFramework = (path.length() > suffix.length())
1594 && (path.compare(path.length()-suffix.length(), suffix.length(), suffix) == 0);
1595 validateNestedCode(fullpath, seal, flags, isFramework);
1596 } else if (seal.link()) {
1597 if (!isSymlink)
1598 return ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, fullpath); // changed type
1599 validateSymlinkResource(cfString(fullpath), cfString(seal.link()), ctx, flags);
1600 } else if (seal.hash(hashAlgorithm())) { // genuine file
1601 if (isSymlink)
1602 return ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, fullpath); // changed type
1603 AutoFileDesc fd(cfString(fullpath), O_RDONLY, FileDesc::modeMissingOk); // open optional file
1604 if (fd) {
1605 __block bool good = true;
1606 CodeDirectory::multipleHashFileData(fd, 0, hashAlgorithms(), ^(CodeDirectory::HashAlgorithm type, Security::DynamicHash *hasher) {
1607 if (!hasher->verify(rseal.hash(type)))
1608 good = false;
1609 });
1610 if (!good) {
1611 if (version == 2 && checkfix30814861(path, false)) {
1612 secinfo("validateResource", "%s check-fixed (altered).", path.c_str());
1613 } else {
1614 ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, fullpath); // altered
1615 }
1616 }
1617 } else {
1618 if (!seal.optional())
1619 ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceMissing, fullpath); // was sealed but is now missing
1620 else
1621 return; // validly missing
1622 }
1623 } else
1624 ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, fullpath); // changed type
1625 return;
1626 }
1627 if (version == 1) { // version 1 ignores symlinks altogether
1628 char target[PATH_MAX];
1629 if (::readlink(cfString(fullpath).c_str(), target, sizeof(target)) > 0)
1630 return;
1631 }
1632 if (version == 2 && checkfix30814861(path, true)) {
1633 secinfo("validateResource", "%s check-fixed (added).", path.c_str());
1634 } else {
1635 ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAdded, CFTempURL(path, false, resourceBase()));
1636 }
1637 }
1638
1639 void SecStaticCode::validatePlainMemoryResource(string path, CFDataRef fileData, SecCSFlags flags)
1640 {
1641 CFDictionaryRef rules;
1642 CFDictionaryRef files;
1643 uint32_t version;
1644 if (!loadResources(rules, files, version))
1645 MacOSError::throwMe(errSecCSResourcesNotFound); // no resources sealed; this can't be right
1646 if (CFTypeRef file = CFDictionaryGetValue(files, CFTempString(path))) {
1647 ResourceSeal seal(file);
1648 const Byte *sealHash = seal.hash(hashAlgorithm());
1649 if (sealHash) {
1650 if (codeDirectory()->verifyMemoryContent(fileData, sealHash))
1651 return; // success
1652 }
1653 }
1654 MacOSError::throwMe(errSecCSBadResource);
1655 }
1656
1657 void SecStaticCode::validateSymlinkResource(std::string fullpath, std::string seal, ValidationContext &ctx, SecCSFlags flags)
1658 {
1659 static const char* const allowedDestinations[] = {
1660 "/System/",
1661 "/Library/",
1662 NULL
1663 };
1664 char target[PATH_MAX];
1665 ssize_t len = ::readlink(fullpath.c_str(), target, sizeof(target)-1);
1666 if (len < 0)
1667 UnixError::check(-1);
1668 target[len] = '\0';
1669 std::string fulltarget = target;
1670 if (target[0] != '/') {
1671 size_t lastSlash = fullpath.rfind('/');
1672 fulltarget = fullpath.substr(0, lastSlash) + '/' + target;
1673 }
1674 if (seal != target) {
1675 ctx.reportProblem(errSecCSBadResource, kSecCFErrorResourceAltered, CFTempString(fullpath));
1676 return;
1677 }
1678 if ((mValidationFlags & (kSecCSStrictValidate|kSecCSRestrictSymlinks)) == (kSecCSStrictValidate|kSecCSRestrictSymlinks)) {
1679 char resolved[PATH_MAX];
1680 if (realpath(fulltarget.c_str(), resolved)) {
1681 assert(resolved[0] == '/');
1682 size_t rlen = strlen(resolved);
1683 if (target[0] == '/') {
1684 // absolute symlink; only allow absolute links to system locations
1685 for (const char* const* pathp = allowedDestinations; *pathp; pathp++) {
1686 size_t dlen = strlen(*pathp);
1687 if (rlen > dlen && strncmp(resolved, *pathp, dlen) == 0)
1688 return; // target inside /System, deemed okay
1689 }
1690 } else {
1691 // everything else must be inside the bundle(s)
1692 for (const SecStaticCode* code = this; code; code = code->mOuterScope) {
1693 string root = code->mResourceScope->root();
1694 if (strncmp(resolved, root.c_str(), root.size()) == 0) {
1695 if (code->mResourceScope->includes(resolved + root.length() + 1))
1696 return; // located in resource stack && included in envelope
1697 else
1698 break; // located but excluded from envelope (deny)
1699 }
1700 }
1701 }
1702 }
1703 // if we fell through, flag a symlink error
1704 if (mTolerateErrors.find(errSecCSInvalidSymlink) == mTolerateErrors.end())
1705 ctx.reportProblem(errSecCSInvalidSymlink, kSecCFErrorResourceAltered, CFTempString(fullpath));
1706 }
1707 }
1708
1709 void SecStaticCode::validateNestedCode(CFURLRef path, const ResourceSeal &seal, SecCSFlags flags, bool isFramework)
1710 {
1711 CFRef<SecRequirementRef> req;
1712 if (SecRequirementCreateWithString(seal.requirement(), kSecCSDefaultFlags, &req.aref()))
1713 MacOSError::throwMe(errSecCSResourcesInvalid);
1714
1715 // recursively verify this nested code
1716 try {
1717 if (!(flags & kSecCSCheckNestedCode))
1718 flags |= kSecCSBasicValidateOnly | kSecCSQuickCheck;
1719 SecPointer<SecStaticCode> code = new SecStaticCode(DiskRep::bestGuess(cfString(path)));
1720 code->initializeFromParent(*this);
1721 code->staticValidate(flags & (~kSecCSRestrictToAppLike), SecRequirement::required(req));
1722
1723 if (isFramework && (flags & kSecCSStrictValidate))
1724 try {
1725 validateOtherVersions(path, flags & (~kSecCSRestrictToAppLike), req, code);
1726 } catch (const CSError &err) {
1727 MacOSError::throwMe(errSecCSBadFrameworkVersion);
1728 } catch (const MacOSError &err) {
1729 MacOSError::throwMe(errSecCSBadFrameworkVersion);
1730 }
1731
1732 } catch (CSError &err) {
1733 if (err.error == errSecCSReqFailed) {
1734 mResourcesValidContext->reportProblem(errSecCSBadNestedCode, kSecCFErrorResourceAltered, path);
1735 return;
1736 }
1737 err.augment(kSecCFErrorPath, path);
1738 throw;
1739 } catch (const MacOSError &err) {
1740 if (err.error == errSecCSReqFailed) {
1741 mResourcesValidContext->reportProblem(errSecCSBadNestedCode, kSecCFErrorResourceAltered, path);
1742 return;
1743 }
1744 CSError::throwMe(err.error, kSecCFErrorPath, path);
1745 }
1746 }
1747
1748 void SecStaticCode::validateOtherVersions(CFURLRef path, SecCSFlags flags, SecRequirementRef req, SecStaticCode *code)
1749 {
1750 // Find out what current points to and do not revalidate
1751 std::string mainPath = cfStringRelease(code->diskRep()->copyCanonicalPath());
1752
1753 char main_path[PATH_MAX];
1754 bool foundTarget = false;
1755
1756 /* If it failed to get the target of the symlink, do not fail. It is a performance loss,
1757 not a security hole */
1758 if (realpath(mainPath.c_str(), main_path) != NULL)
1759 foundTarget = true;
1760
1761 std::ostringstream versionsPath;
1762 versionsPath << cfString(path) << "/Versions/";
1763
1764 DirScanner scanner(versionsPath.str());
1765
1766 if (scanner.initialized()) {
1767 struct dirent *entry = NULL;
1768 while ((entry = scanner.getNext()) != NULL) {
1769 std::ostringstream fullPath;
1770
1771 if (entry->d_type != DT_DIR || strcmp(entry->d_name, "Current") == 0)
1772 continue;
1773
1774 fullPath << versionsPath.str() << entry->d_name;
1775
1776 char real_full_path[PATH_MAX];
1777 if (realpath(fullPath.str().c_str(), real_full_path) == NULL)
1778 UnixError::check(-1);
1779
1780 // Do case insensitive comparions because realpath() was called for both paths
1781 if (foundTarget && strcmp(main_path, real_full_path) == 0)
1782 continue;
1783
1784 SecPointer<SecStaticCode> frameworkVersion = new SecStaticCode(DiskRep::bestGuess(real_full_path));
1785 frameworkVersion->initializeFromParent(*this);
1786 frameworkVersion->staticValidate(flags, SecRequirement::required(req));
1787 }
1788 }
1789 }
1790
1791
1792 //
1793 // Test a CodeDirectory flag.
1794 // Returns false if there is no CodeDirectory.
1795 // May throw if the CodeDirectory is present but somehow invalid.
1796 //
1797 bool SecStaticCode::flag(uint32_t tested)
1798 {
1799 if (const CodeDirectory *cd = this->codeDirectory(false))
1800 return cd->flags & tested;
1801 else
1802 return false;
1803 }
1804
1805
1806 //
1807 // Retrieve the full SuperBlob containing all internal requirements.
1808 //
1809 const Requirements *SecStaticCode::internalRequirements()
1810 {
1811 if (CFDataRef reqData = component(cdRequirementsSlot)) {
1812 const Requirements *req = (const Requirements *)CFDataGetBytePtr(reqData);
1813 if (!req->validateBlob())
1814 MacOSError::throwMe(errSecCSReqInvalid);
1815 return req;
1816 } else
1817 return NULL;
1818 }
1819
1820
1821 //
1822 // Retrieve a particular internal requirement by type.
1823 //
1824 const Requirement *SecStaticCode::internalRequirement(SecRequirementType type)
1825 {
1826 if (const Requirements *reqs = internalRequirements())
1827 return reqs->find<Requirement>(type);
1828 else
1829 return NULL;
1830 }
1831
1832
1833 //
1834 // Return the Designated Requirement (DR). This can be either explicit in the
1835 // Internal Requirements component, or implicitly generated on demand here.
1836 // Note that an explicit DR may have been implicitly generated at signing time;
1837 // we don't distinguish this case.
1838 //
1839 const Requirement *SecStaticCode::designatedRequirement()
1840 {
1841 if (const Requirement *req = internalRequirement(kSecDesignatedRequirementType)) {
1842 return req; // explicit in signing data
1843 } else {
1844 if (!mDesignatedReq)
1845 mDesignatedReq = defaultDesignatedRequirement();
1846 return mDesignatedReq;
1847 }
1848 }
1849
1850
1851 //
1852 // Generate the default Designated Requirement (DR) for this StaticCode.
1853 // Ignore any explicit DR it may contain.
1854 //
1855 const Requirement *SecStaticCode::defaultDesignatedRequirement()
1856 {
1857 if (flag(kSecCodeSignatureAdhoc)) {
1858 // adhoc signature: return a cdhash requirement for all architectures
1859 __block Requirement::Maker maker;
1860 Requirement::Maker::Chain chain(maker, opOr);
1861
1862 // insert cdhash requirement for all architectures
1863 __block CFRef<CFMutableArrayRef> allHashes = CFArrayCreateMutableCopy(NULL, 0, this->cdHashes());
1864 handleOtherArchitectures(^(SecStaticCode *other) {
1865 CFArrayRef hashes = other->cdHashes();
1866 CFArrayAppendArray(allHashes, hashes, CFRangeMake(0, CFArrayGetCount(hashes)));
1867 });
1868 CFIndex count = CFArrayGetCount(allHashes);
1869 for (CFIndex n = 0; n < count; ++n) {
1870 chain.add();
1871 maker.cdhash(CFDataRef(CFArrayGetValueAtIndex(allHashes, n)));
1872 }
1873 return maker.make();
1874 } else {
1875 #if TARGET_OS_OSX
1876 // full signature: Gin up full context and let DRMaker do its thing
1877 validateDirectory(); // need the cert chain
1878 Requirement::Context context(this->certificates(),
1879 this->infoDictionary(),
1880 this->entitlements(),
1881 this->identifier(),
1882 this->codeDirectory(),
1883 NULL,
1884 kSecCodeSignatureNoHash,
1885 false
1886 );
1887 return DRMaker(context).make();
1888 #else
1889 MacOSError::throwMe(errSecCSUnimplemented);
1890 #endif
1891 }
1892 }
1893
1894
1895 //
1896 // Validate a SecStaticCode against the internal requirement of a particular type.
1897 //
1898 void SecStaticCode::validateRequirements(SecRequirementType type, SecStaticCode *target,
1899 OSStatus nullError /* = errSecSuccess */)
1900 {
1901 DTRACK(CODESIGN_EVAL_STATIC_INTREQ, this, type, target, nullError);
1902 if (const Requirement *req = internalRequirement(type))
1903 target->validateRequirement(req, nullError ? nullError : errSecCSReqFailed);
1904 else if (nullError)
1905 MacOSError::throwMe(nullError);
1906 else
1907 /* accept it */;
1908 }
1909
1910 //
1911 // Validate this StaticCode against an external Requirement
1912 //
1913 bool SecStaticCode::satisfiesRequirement(const Requirement *req, OSStatus failure)
1914 {
1915 bool result = false;
1916 assert(req);
1917 validateDirectory();
1918 result = req->validates(Requirement::Context(mCertChain, infoDictionary(), entitlements(), codeDirectory()->identifier(), codeDirectory(), NULL, kSecCodeSignatureNoHash, mRep->appleInternalForcePlatform()), failure);
1919 return result;
1920 }
1921
1922 void SecStaticCode::validateRequirement(const Requirement *req, OSStatus failure)
1923 {
1924 if (!this->satisfiesRequirement(req, failure))
1925 MacOSError::throwMe(failure);
1926 }
1927
1928 //
1929 // Retrieve one certificate from the cert chain.
1930 // Positive and negative indices can be used:
1931 // [ leaf, intermed-1, ..., intermed-n, anchor ]
1932 // 0 1 ... -2 -1
1933 // Returns NULL if unavailable for any reason.
1934 //
1935 SecCertificateRef SecStaticCode::cert(int ix)
1936 {
1937 validateDirectory(); // need cert chain
1938 if (mCertChain) {
1939 CFIndex length = CFArrayGetCount(mCertChain);
1940 if (ix < 0)
1941 ix += length;
1942 if (ix >= 0 && ix < length)
1943 return SecCertificateRef(CFArrayGetValueAtIndex(mCertChain, ix));
1944 }
1945 return NULL;
1946 }
1947
1948 CFArrayRef SecStaticCode::certificates()
1949 {
1950 validateDirectory(); // need cert chain
1951 return mCertChain;
1952 }
1953
1954
1955 //
1956 // Gather (mostly) API-official information about this StaticCode.
1957 //
1958 // This method lives in the twilight between the API and internal layers,
1959 // since it generates API objects (Sec*Refs) for return.
1960 //
1961 CFDictionaryRef SecStaticCode::signingInformation(SecCSFlags flags)
1962 {
1963 //
1964 // Start with the pieces that we return even for unsigned code.
1965 // This makes Sec[Static]CodeRefs useful as API-level replacements
1966 // of our internal OSXCode objects.
1967 //
1968 CFRef<CFMutableDictionaryRef> dict = makeCFMutableDictionary(1,
1969 kSecCodeInfoMainExecutable, CFTempURL(this->mainExecutablePath()).get()
1970 );
1971
1972 //
1973 // If we're not signed, this is all you get
1974 //
1975 if (!this->isSigned())
1976 return dict.yield();
1977
1978 //
1979 // Add the generic attributes that we always include
1980 //
1981 CFDictionaryAddValue(dict, kSecCodeInfoIdentifier, CFTempString(this->identifier()));
1982 CFDictionaryAddValue(dict, kSecCodeInfoFlags, CFTempNumber(this->codeDirectory(false)->flags.get()));
1983 CFDictionaryAddValue(dict, kSecCodeInfoFormat, CFTempString(this->format()));
1984 CFDictionaryAddValue(dict, kSecCodeInfoSource, CFTempString(this->signatureSource()));
1985 CFDictionaryAddValue(dict, kSecCodeInfoUnique, this->cdHash());
1986 CFDictionaryAddValue(dict, kSecCodeInfoCdHashes, this->cdHashes());
1987 const CodeDirectory* cd = this->codeDirectory(false);
1988 CFDictionaryAddValue(dict, kSecCodeInfoDigestAlgorithm, CFTempNumber(cd->hashType));
1989 CFRef<CFArrayRef> digests = makeCFArrayFrom(^CFTypeRef(CodeDirectory::HashAlgorithm type) { return CFTempNumber(type); }, hashAlgorithms());
1990 CFDictionaryAddValue(dict, kSecCodeInfoDigestAlgorithms, digests);
1991 if (cd->platform)
1992 CFDictionaryAddValue(dict, kSecCodeInfoPlatformIdentifier, CFTempNumber(cd->platform));
1993 if (cd->runtimeVersion()) {
1994 CFDictionaryAddValue(dict, kSecCodeInfoRuntimeVersion, CFTempNumber(cd->runtimeVersion()));
1995 }
1996
1997 //
1998 // Deliver any Info.plist only if it looks intact
1999 //
2000 try {
2001 if (CFDictionaryRef info = this->infoDictionary())
2002 CFDictionaryAddValue(dict, kSecCodeInfoPList, info);
2003 } catch (...) { } // don't deliver Info.plist if questionable
2004
2005 //
2006 // kSecCSSigningInformation adds information about signing certificates and chains
2007 //
2008 if (flags & kSecCSSigningInformation)
2009 try {
2010 if (CFDataRef sig = this->signature())
2011 CFDictionaryAddValue(dict, kSecCodeInfoCMS, sig);
2012 if (const char *teamID = this->teamID())
2013 CFDictionaryAddValue(dict, kSecCodeInfoTeamIdentifier, CFTempString(teamID));
2014 if (mTrust)
2015 CFDictionaryAddValue(dict, kSecCodeInfoTrust, mTrust);
2016 if (CFArrayRef certs = this->certificates())
2017 CFDictionaryAddValue(dict, kSecCodeInfoCertificates, certs);
2018 if (CFAbsoluteTime time = this->signingTime())
2019 if (CFRef<CFDateRef> date = CFDateCreate(NULL, time))
2020 CFDictionaryAddValue(dict, kSecCodeInfoTime, date);
2021 if (CFAbsoluteTime time = this->signingTimestamp())
2022 if (CFRef<CFDateRef> date = CFDateCreate(NULL, time))
2023 CFDictionaryAddValue(dict, kSecCodeInfoTimestamp, date);
2024 } catch (...) { }
2025
2026 //
2027 // kSecCSRequirementInformation adds information on requirements
2028 //
2029 if (flags & kSecCSRequirementInformation)
2030
2031 //DR not currently supported on iOS
2032 #if TARGET_OS_OSX
2033 try {
2034 if (const Requirements *reqs = this->internalRequirements()) {
2035 CFDictionaryAddValue(dict, kSecCodeInfoRequirements,
2036 CFTempString(Dumper::dump(reqs)));
2037 CFDictionaryAddValue(dict, kSecCodeInfoRequirementData, CFTempData(*reqs));
2038 }
2039
2040 const Requirement *dreq = this->designatedRequirement();
2041 CFRef<SecRequirementRef> dreqRef = (new SecRequirement(dreq))->handle();
2042 CFDictionaryAddValue(dict, kSecCodeInfoDesignatedRequirement, dreqRef);
2043 if (this->internalRequirement(kSecDesignatedRequirementType)) { // explicit
2044 CFRef<SecRequirementRef> ddreqRef = (new SecRequirement(this->defaultDesignatedRequirement(), true))->handle();
2045 CFDictionaryAddValue(dict, kSecCodeInfoImplicitDesignatedRequirement, ddreqRef);
2046 } else { // implicit
2047 CFDictionaryAddValue(dict, kSecCodeInfoImplicitDesignatedRequirement, dreqRef);
2048 }
2049 } catch (...) { }
2050 #endif
2051
2052 try {
2053 if (CFDataRef ent = this->component(cdEntitlementSlot)) {
2054 CFDictionaryAddValue(dict, kSecCodeInfoEntitlements, ent);
2055 if (CFDictionaryRef entdict = this->entitlements())
2056 CFDictionaryAddValue(dict, kSecCodeInfoEntitlementsDict, entdict);
2057 }
2058 } catch (...) { }
2059
2060 //
2061 // kSecCSInternalInformation adds internal information meant to be for Apple internal
2062 // use (SPI), and not guaranteed to be stable. Primarily, this is data we want
2063 // to reliably transmit through the API wall so that code outside the Security.framework
2064 // can use it without having to play nasty tricks to get it.
2065 //
2066 if (flags & kSecCSInternalInformation) {
2067 try {
2068 if (mDir)
2069 CFDictionaryAddValue(dict, kSecCodeInfoCodeDirectory, mDir);
2070 CFDictionaryAddValue(dict, kSecCodeInfoCodeOffset, CFTempNumber(mRep->signingBase()));
2071 if (!(flags & kSecCSSkipResourceDirectory)) {
2072 if (CFRef<CFDictionaryRef> rdict = getDictionary(cdResourceDirSlot, false)) // suppress validation
2073 CFDictionaryAddValue(dict, kSecCodeInfoResourceDirectory, rdict);
2074 }
2075 if (CFRef<CFDictionaryRef> ddict = diskRepInformation())
2076 CFDictionaryAddValue(dict, kSecCodeInfoDiskRepInfo, ddict);
2077 } catch (...) { }
2078 if (mNotarizationChecked && !isnan(mNotarizationDate)) {
2079 CFRef<CFDateRef> date = CFDateCreate(NULL, mNotarizationDate);
2080 if (date) {
2081 CFDictionaryAddValue(dict, kSecCodeInfoNotarizationDate, date.get());
2082 } else {
2083 secerror("Error creating date from timestamp: %f", mNotarizationDate);
2084 }
2085 }
2086 }
2087
2088
2089 //
2090 // kSecCSContentInformation adds more information about the physical layout
2091 // of the signed code. This is (only) useful for packaging or patching-oriented
2092 // applications.
2093 //
2094 if (flags & kSecCSContentInformation && !(flags & kSecCSSkipResourceDirectory))
2095 if (CFRef<CFArrayRef> files = mRep->modifiedFiles())
2096 CFDictionaryAddValue(dict, kSecCodeInfoChangedFiles, files);
2097
2098 return dict.yield();
2099 }
2100
2101
2102 //
2103 // Resource validation contexts.
2104 // The default context simply throws a CSError, rudely terminating the operation.
2105 //
2106 SecStaticCode::ValidationContext::~ValidationContext()
2107 { /* virtual */ }
2108
2109 void SecStaticCode::ValidationContext::reportProblem(OSStatus rc, CFStringRef type, CFTypeRef value)
2110 {
2111 CSError::throwMe(rc, type, value);
2112 }
2113
2114 void SecStaticCode::CollectingContext::reportProblem(OSStatus rc, CFStringRef type, CFTypeRef value)
2115 {
2116 StLock<Mutex> _(mLock);
2117 if (mStatus == errSecSuccess)
2118 mStatus = rc; // record first failure for eventual error return
2119 if (type) {
2120 if (!mCollection)
2121 mCollection.take(makeCFMutableDictionary());
2122 CFMutableArrayRef element = CFMutableArrayRef(CFDictionaryGetValue(mCollection, type));
2123 if (!element) {
2124 element = makeCFMutableArray(0);
2125 if (!element)
2126 CFError::throwMe();
2127 CFDictionaryAddValue(mCollection, type, element);
2128 CFRelease(element);
2129 }
2130 CFArrayAppendValue(element, value);
2131 }
2132 }
2133
2134 void SecStaticCode::CollectingContext::throwMe()
2135 {
2136 assert(mStatus != errSecSuccess);
2137 throw CSError(mStatus, mCollection.retain());
2138 }
2139
2140
2141 //
2142 // Master validation driver.
2143 // This is the static validation (only) driver for the API.
2144 //
2145 // SecStaticCode exposes an a la carte menu of topical validators applying
2146 // to a given object. The static validation API pulls them together reliably,
2147 // but it also adds three matrix dimensions: architecture (for "fat" Mach-O binaries),
2148 // nested code, and multiple digests. This function will crawl a suitable cross-section of this
2149 // validation matrix based on which options it is given, creating temporary
2150 // SecStaticCode objects on the fly to complete the task.
2151 // (The point, of course, is to do as little duplicate work as possible.)
2152 //
2153 void SecStaticCode::staticValidate(SecCSFlags flags, const SecRequirement *req)
2154 {
2155 setValidationFlags(flags);
2156
2157 #if TARGET_OS_OSX
2158 if (!mStaplingChecked) {
2159 mRep->registerStapledTicket();
2160 mStaplingChecked = true;
2161 }
2162
2163 if (mFlags & kSecCSForceOnlineNotarizationCheck) {
2164 if (!mNotarizationChecked) {
2165 if (this->cdHash()) {
2166 bool is_revoked = checkNotarizationServiceForRevocation(this->cdHash(), (SecCSDigestAlgorithm)this->hashAlgorithm(), &mNotarizationDate);
2167 if (is_revoked) {
2168 MacOSError::throwMe(errSecCSRevokedNotarization);
2169 }
2170 }
2171 mNotarizationChecked = true;
2172 }
2173 }
2174 #endif // TARGET_OS_OSX
2175
2176 // initialize progress/cancellation state
2177 if (flags & kSecCSReportProgress)
2178 prepareProgress(estimateResourceWorkload() + 2); // +1 head, +1 tail
2179
2180
2181 // core components: once per architecture (if any)
2182 this->staticValidateCore(flags, req);
2183 if (flags & kSecCSCheckAllArchitectures)
2184 handleOtherArchitectures(^(SecStaticCode* subcode) {
2185 if (flags & kSecCSCheckGatekeeperArchitectures) {
2186 Universal *fat = subcode->diskRep()->mainExecutableImage();
2187 assert(fat && fat->narrowed()); // handleOtherArchitectures gave us a focused architecture slice
2188 Architecture arch = fat->bestNativeArch(); // actually, the ONLY one
2189 if ((arch.cpuType() & ~CPU_ARCH_MASK) == CPU_TYPE_POWERPC)
2190 return; // irrelevant to Gatekeeper
2191 }
2192 subcode->detachedSignature(this->mDetachedSig); // carry over explicit (but not implicit) detached signature
2193 subcode->staticValidateCore(flags, req);
2194 });
2195 reportProgress();
2196
2197 // allow monitor intervention in source validation phase
2198 reportEvent(CFSTR("prepared"), NULL);
2199
2200 // resources: once for all architectures
2201 if (!(flags & kSecCSDoNotValidateResources))
2202 this->validateResources(flags);
2203
2204 // perform strict validation if desired
2205 if (flags & kSecCSStrictValidate)
2206 mRep->strictValidate(codeDirectory(), mTolerateErrors, mValidationFlags);
2207 reportProgress();
2208
2209 // allow monitor intervention
2210 if (CFRef<CFTypeRef> veto = reportEvent(CFSTR("validated"), NULL)) {
2211 if (CFGetTypeID(veto) == CFNumberGetTypeID())
2212 MacOSError::throwMe(cfNumber<OSStatus>(veto.as<CFNumberRef>()));
2213 else
2214 MacOSError::throwMe(errSecCSBadCallbackValue);
2215 }
2216 }
2217
2218 void SecStaticCode::staticValidateCore(SecCSFlags flags, const SecRequirement *req)
2219 {
2220 try {
2221 this->validateNonResourceComponents(); // also validates the CodeDirectory
2222 this->validateTopDirectory();
2223 if (!(flags & kSecCSDoNotValidateExecutable))
2224 this->validateExecutable();
2225 if (req)
2226 this->validateRequirement(req->requirement(), errSecCSReqFailed);
2227 } catch (CSError &err) {
2228 if (Universal *fat = this->diskRep()->mainExecutableImage()) // Mach-O
2229 if (MachO *mach = fat->architecture()) {
2230 err.augment(kSecCFErrorArchitecture, CFTempString(mach->architecture().displayName()));
2231 delete mach;
2232 }
2233 throw;
2234 } catch (const MacOSError &err) {
2235 // add architecture information if we can get it
2236 if (Universal *fat = this->diskRep()->mainExecutableImage())
2237 if (MachO *mach = fat->architecture()) {
2238 CFTempString arch(mach->architecture().displayName());
2239 delete mach;
2240 CSError::throwMe(err.error, kSecCFErrorArchitecture, arch);
2241 }
2242 throw;
2243 }
2244 }
2245
2246
2247 //
2248 // A helper that generates SecStaticCode objects for all but the primary architecture
2249 // of a fat binary and calls a block on them.
2250 // If there's only one architecture (or this is an architecture-agnostic code),
2251 // nothing happens quickly.
2252 //
2253 void SecStaticCode::handleOtherArchitectures(void (^handle)(SecStaticCode* other))
2254 {
2255 if (Universal *fat = this->diskRep()->mainExecutableImage()) {
2256 Universal::Architectures architectures;
2257 fat->architectures(architectures);
2258 if (architectures.size() > 1) {
2259 DiskRep::Context ctx;
2260 off_t activeOffset = fat->archOffset();
2261 for (Universal::Architectures::const_iterator arch = architectures.begin(); arch != architectures.end(); ++arch) {
2262 try {
2263 ctx.offset = int_cast<size_t, off_t>(fat->archOffset(*arch));
2264 ctx.size = fat->lengthOfSlice(int_cast<off_t,size_t>(ctx.offset));
2265 if (ctx.offset != activeOffset) { // inactive architecture; check it
2266 SecPointer<SecStaticCode> subcode = new SecStaticCode(DiskRep::bestGuess(this->mainExecutablePath(), &ctx));
2267 subcode->detachedSignature(this->mDetachedSig); // carry over explicit (but not implicit) detached signature
2268 if (this->teamID() == NULL || subcode->teamID() == NULL) {
2269 if (this->teamID() != subcode->teamID())
2270 MacOSError::throwMe(errSecCSSignatureInvalid);
2271 } else if (strcmp(this->teamID(), subcode->teamID()) != 0)
2272 MacOSError::throwMe(errSecCSSignatureInvalid);
2273 handle(subcode);
2274 }
2275 } catch(std::out_of_range e) {
2276 // some of our int_casts fell over.
2277 MacOSError::throwMe(errSecCSBadObjectFormat);
2278 }
2279 }
2280 }
2281 }
2282 }
2283
2284 //
2285 // A method that takes a certificate chain (certs) and evaluates
2286 // if it is a Mac or IPhone developer cert, an app store distribution cert,
2287 // or a developer ID
2288 //
2289 bool SecStaticCode::isAppleDeveloperCert(CFArrayRef certs)
2290 {
2291 static const std::string appleDeveloperRequirement = "(" + std::string(WWDRRequirement) + ") or (" + MACWWDRRequirement + ") or (" + developerID + ") or (" + distributionCertificate + ") or (" + iPhoneDistributionCert + ")";
2292 SecPointer<SecRequirement> req = new SecRequirement(parseRequirement(appleDeveloperRequirement), true);
2293 Requirement::Context ctx(certs, NULL, NULL, "", NULL, NULL, kSecCodeSignatureNoHash, false);
2294
2295 return req->requirement()->validates(ctx);
2296 }
2297
2298 } // end namespace CodeSigning
2299 } // end namespace Security
mirror of Security