sectask/SecEntitlements.h

   1 /*
   2  * Copyright (c) 2008-2010,2012,2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 /* This file contains the names of all known entitlements currently
  26    in use on the system. */
  27
  28 #ifndef _SECURITY_SECENTITLEMENTS_H_
  29 #define _SECURITY_SECENTITLEMENTS_H_
  30
  31 #include <CoreFoundation/CFString.h>
  32
  33 __BEGIN_DECLS
  34
  35 /* Allow other tasks to get this task's name port. This is needed so the app
  36    can be debugged. */
  37 #define kSecEntitlementGetTaskAllow CFSTR("get-task-allow")
  38
  39 /* The identifier of this application, typically the same as the
  40  CFBundleIdentifier. On iOS, the identifier is prefixed with the team-id and
  41  for some uses, the same applies to macOS.
  42
  43  This is used as the default access group for any keychain items this
  44  application creates and accesses unless there is a
  45  keychain-access-group-entitlement.
  46
  47  Note that iOS and macOS uses different value for the same constant.
  48  */
  49
  50 #if TARGET_OS_IPHONE
  51 #define kSecEntitlementApplicationIdentifier CFSTR("application-identifier")
  52 #else
  53 #define kSecEntitlementAppleApplicationIdentifier CFSTR("com.apple.application-identifier")
  54 #define kSecEntitlementApplicationIdentifier kSecEntitlementAppleApplicationIdentifier
  55 #endif
  56
  57 /* The value should be an array of strings.  Each string is the name of an
  58    access group that the application has access to.  The
  59    application-identifier is implicitly added to this list.   When creating
  60    a new keychain item use the kSecAttrAccessGroup attribute (defined in
  61    <Security/SecItem.h>) to specify its access group.  If omitted, the
  62    access group defaults to the first access group in this list or the
  63    application-identifier if there is no keychain-access-groups entitlement. */
  64 #define kSecEntitlementKeychainAccessGroups CFSTR("keychain-access-groups")
  65
  66 /* The value should be an array of strings.  Each string is the name of an
  67    access group that the application has access to.  The first of
  68    kSecEntitlementKeychainAccessGroups,
  69    kSecEntitlementApplicationIdentifier or
  70    kSecEntitlementAppleSecurityApplicationGroups to have a value becomes the default
  71    application group for keychain clients that don't specify an explicit one. */
  72 #define kSecEntitlementAppleSecurityApplicationGroups CFSTR("com.apple.security.application-groups")
  73
  74 #define kSecEntitlementNetworkExtensionAccessGroups CFSTR("com.apple.networkextension.keychain")
  75
  76 /* Boolean entitlement, if present the application with the entitlement is
  77    allowed to modify the which certificates are trusted as anchors using
  78    the SecTrustStoreSetTrustSettings() and SecTrustStoreRemoveCertificate()
  79    SPIs. */
  80 #define kSecEntitlementModifyAnchorCertificates CFSTR("modify-anchor-certificates")
  81
  82 #define kSecEntitlementDebugApplications CFSTR("com.apple.springboard.debugapplications")
  83
  84 #define kSecEntitlementOpenSensitiveURL CFSTR("com.apple.springboard.opensensitiveurl")
  85
  86 /* Boolean entitlement, if present allows the application to wipe the keychain
  87    and truststore. */
  88 #define kSecEntitlementWipeDevice CFSTR("com.apple.springboard.wipedevice")
  89
  90 #define kSecEntitlementRemoteNotificationConfigure CFSTR("com.apple.remotenotification.configure")
  91
  92 #define kSecEntitlementMigrateKeychain CFSTR("migrate-keychain")
  93
  94 #define kSecEntitlementRestoreKeychain CFSTR("restore-keychain")
  95
  96 /* Entitlement needed to call SecKeychainSyncUpdate SPI. */
  97 #define kSecEntitlementKeychainSyncUpdates CFSTR("keychain-sync-updates")
  98
  99 /* Boolean entitlement, if present you get access to the SPIs for keychain sync circle manipulation */
 100 #define kSecEntitlementKeychainCloudCircle CFSTR("keychain-cloud-circle")
 101
 102 /* Boolean entitlement, if present you get access to the SPIs for keychain initial sync */
 103 #define kSecEntitlementKeychainInitialSync CFSTR("com.apple.private.security.initial-sync")
 104
 105 /* Associated Domains entitlement (contains array of fully-qualified domain names) */
 106 #define kSecEntitlementAssociatedDomains CFSTR("com.apple.developer.associated-domains")
 107
 108 /* Entitlement needed to call swcd and swcagent processes. */
 109 #define kSecEntitlementPrivateAssociatedDomains CFSTR("com.apple.private.associated-domains")
 110
 111 /* Entitlement to control usage of system keychain */
 112 #define kSecEntitlementPrivateSystemKeychain CFSTR("com.apple.private.system-keychain")
 113
 114 /* Entitlement to control usage of syncbubble keychain migration */
 115 #define kSecEntitlementPrivateKeychainSyncBubble CFSTR("com.apple.private.syncbubble-keychain")
 116
 117 /* Entitlement to control usage of system keychain migration */
 118 #define kSecEntitlementPrivateKeychainMigrateSystemKeychain CFSTR("com.apple.private.migrate-musr-system-keychain")
 119
 120 /* Entitlement to control usage of system keychain migration */
 121 #define kSecEntitlementPrivateNetworkExtension CFSTR("com.apple.developer.networking.networkextension")
 122
 123 /* Entitlement to control usage of deletion of keychain items on app uninstallation */
 124 #define kSecEntitlementPrivateUninstallDeletion CFSTR("com.apple.private.uninstall.deletion")
 125
 126 /* Entitlement to control usage of deletion of keychain items wholesale */
 127 #define kSecEntitlementPrivateDeleteAll CFSTR("com.apple.private.security.delete.all")
 128
 129 /* Entitlement to allow access to circle joining APIs in SOSCC */
 130 #define kSecEntitlementCircleJoin CFSTR("com.apple.private.keychain.circle.join")
 131
 132 /* Entitlement to deny use of keychain APIs, only effective on iOS keychain */
 133 #define kSecEntitlementKeychainDeny CFSTR("com.apple.private.keychain.deny")
 134
 135 /* Entitlement to control use of keychain certificate fetching functions */
 136 #define kSecEntitlementPrivateCertificateAllAccess CFSTR("com.apple.private.keychain.certificates")
 137
 138 /* Entitlement to control use of CKKS */
 139 #define kSecEntitlementPrivateCKKS CFSTR("com.apple.private.ckks")
 140
 141 /* Entitlement to allow manipulation of backup keybags in keychain table */
 142 #define kSecEntitlementBackupTableOperations CFSTR("com.apple.private.keychain.backuptableops")
 143
 144 /* Entitlement to allow use of CKKS plaintext fields */
 145 #define kSecEntitlementPrivateCKKSPlaintextFields CFSTR("com.apple.private.ckks.plaintextfields")
 146
 147 /* Entitlement to allow use of CKKS 'current item' changing SPI */
 148 #define kSecEntitlementPrivateCKKSWriteCurrentItemPointers CFSTR("com.apple.private.ckks.currentitempointers_write")
 149
 150 /* Entitlement to allow use of CKKS 'current item' reading SPI */
 151 #define kSecEntitlementPrivateCKKSReadCurrentItemPointers CFSTR("com.apple.private.ckks.currentitempointers_read")
 152
 153 /* Entitlement to allow use of sysbound field */
 154 #define kSecEntitlementPrivateSysBound CFSTR("com.apple.private.keychain.sysbound")
 155
 156 #define kSecEntitlementBackupTableOperationsDeleteAll CFSTR("com.apple.private.keychain.backuptableops.deleteall")
 157
 158 /* Entitlement to allow executing keychain control actions */
 159 #define kSecEntitlementKeychainControl CFSTR("com.apple.private.keychain.keychaincontrol")
 160
 161 #if __OBJC__
 162 /* Entitlement to control use of OT */
 163 #define kSecEntitlementPrivateOctagon @"com.apple.private.octagon"
 164 #endif
 165
 166 __END_DECLS
 167
 168 #endif /* !_SECURITY_SECENTITLEMENTS_H_ */