OSX/sec/ipc/server_endpoint.m

   1 /*
   2  * Copyright (c) 2017 Apple Inc.  All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <Foundation/Foundation.h>
  25 #import <Foundation/NSXPCConnection.h>
  26 #import <Foundation/NSXPCConnection_Private.h>
  27 #include <xpc/private.h>
  28 #include <xpc/xpc.h>
  29
  30 #include "ipc/securityd_client.h"
  31 #include "ipc/server_security_helpers.h"
  32 #include "ipc/server_entitlement_helpers.h"
  33 #include "ipc/server_endpoint.h"
  34
  35 #include "keychain/securityd/SecItemServer.h"
  36 #include <Security/SecEntitlements.h>
  37
  38 #pragma mark - Securityd Server
  39
  40 @implementation SecuritydXPCServer
  41 @synthesize connection = _connection;
  42
  43 - (instancetype)initWithConnection:(NSXPCConnection *)connection
  44 {
  45     if ((self = [super init])) {
  46         _connection = connection;
  47
  48         if (!fill_security_client(&self->_client, connection.effectiveUserIdentifier, connection.auditToken)) {
  49             return nil;
  50         }
  51     }
  52     return self;
  53 }
  54
  55 - (instancetype)initWithSecurityClient:(SecurityClient*) existingClient
  56 {
  57     if(!existingClient) {
  58         return nil;
  59     }
  60     if((self = [super init])) {
  61         _connection = nil;
  62
  63         self->_client.task                                   = CFRetainSafe(existingClient->task);
  64         self->_client.accessGroups                           = CFRetainSafe(existingClient->accessGroups);
  65         self->_client.allowSystemKeychain                    = existingClient->allowSystemKeychain;
  66         self->_client.allowSyncBubbleKeychain                = existingClient->allowSyncBubbleKeychain;
  67         self->_client.isNetworkExtension                     = existingClient->isNetworkExtension;
  68         self->_client.canAccessNetworkExtensionAccessGroups  = existingClient->canAccessNetworkExtensionAccessGroups;
  69         self->_client.uid                                    = existingClient->uid;
  70         self->_client.musr                                   = CFRetainSafe(existingClient->musr);
  71 #if (TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR) && TARGET_HAS_KEYSTORE
  72         self->_client.keybag                                 = existingClient->keybag;
  73 #endif
  74 #if TARGET_OS_IPHONE
  75         self->_client.inMultiUser                            = existingClient->inMultiUser;
  76         self->_client.activeUser                             = existingClient->activeUser;
  77 #endif
  78     }
  79     return self;
  80 }
  81
  82
  83 - (bool)clientHasBooleanEntitlement: (NSString*) entitlement {
  84     return SecTaskGetBooleanValueForEntitlement(self->_client.task, (__bridge CFStringRef) entitlement);
  85 }
  86
  87 -(void)dealloc {
  88     CFReleaseNull(self->_client.task);
  89     CFReleaseNull(self->_client.accessGroups);
  90     CFReleaseNull(self->_client.musr);
  91 }
  92 @end
  93
  94
  95 // Class to use for local dispatching of securityd xpcs. Adds capability of fake entitlements, because you don't have a real task on the other end.
  96 @interface LocalSecuritydXPCServer : SecuritydXPCServer
  97 @property NSMutableDictionary<NSString*, id>* fakeEntitlements;
  98 - (instancetype)initWithSecurityClient:(SecurityClient*) existingClient fakeEntitlements:(NSDictionary<NSString*, id>*)fakeEntitlements;
  99 @end
 100
 101 @implementation LocalSecuritydXPCServer
 102 - (instancetype)initWithSecurityClient:(SecurityClient*) existingClient fakeEntitlements:(NSDictionary<NSString*, id>*)fakeEntitlements {
 103     if((self = [super initWithSecurityClient: existingClient])) {
 104         _fakeEntitlements = [fakeEntitlements mutableCopy];
 105     }
 106     return self;
 107 }
 108
 109 - (bool)clientHasBooleanEntitlement: (NSString*) entitlement {
 110     if(self.fakeEntitlements) {
 111         return [self.fakeEntitlements[entitlement] isEqual: @YES];
 112     } else {
 113         return false;
 114     }
 115 }
 116 @end
 117
 118
 119 #pragma mark - SecuritydXPCServerListener
 120
 121 // Responsible for bringing up new SecuritydXPCServer objects, and configuring them with their remote connection
 122 @interface SecuritydXPCServerListener : NSObject <NSXPCListenerDelegate>
 123 @property (retain,nonnull) NSXPCListener *listener;
 124 @end
 125
 126 @implementation SecuritydXPCServerListener
 127 -(instancetype)init
 128 {
 129     if((self = [super init])){
 130         self.listener = [[NSXPCListener alloc] initWithMachServiceName:@(kSecuritydGeneralServiceName)];
 131         self.listener.delegate = self;
 132         [self.listener resume];
 133     }
 134     return self;
 135 }
 136
 137 - (BOOL)listener:(__unused NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection
 138 {
 139     // Anyone is allowed to get a connection to securityd, except if you have kSecEntitlementKeychainDeny entitlement
 140     // The SecuritydClient class _must_ check for required entitlements in each XPC handler.
 141
 142     if([newConnection valueForEntitlement: (__bridge NSString*) kSecEntitlementKeychainDeny]) {
 143         return NO;
 144     }
 145
 146     newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(SecuritydXPCProtocol)];
 147     // Configure the interface on the server side, too
 148     [SecuritydXPCClient configureSecuritydXPCProtocol: newConnection.exportedInterface];
 149
 150     newConnection.exportedObject = [[SecuritydXPCServer alloc] initWithConnection:newConnection];
 151     [newConnection resume];
 152
 153     return YES;
 154 }
 155 @end
 156
 157 void
 158 SecCreateSecuritydXPCServer(void)
 159 {
 160     static SecuritydXPCServerListener* listener = NULL;
 161     static dispatch_once_t onceToken;
 162     dispatch_once(&onceToken, ^{
 163         @autoreleasepool {
 164             listener = [[SecuritydXPCServerListener alloc] init];
 165         }
 166     });
 167 }
 168
 169 id<SecuritydXPCProtocol> SecCreateLocalSecuritydXPCServer(void) {
 170     // Create a fake securitydxpcserver using the access groups of securityd and some number of fake entitlements
 171     SecurityClient* client = SecSecurityClientGet();
 172
 173     // We know that SecuritydXPCServerListener will comply with SecuritydXPCProtocol via category, so help the compiler out
 174     return (id<SecuritydXPCProtocol>) [[LocalSecuritydXPCServer alloc] initWithSecurityClient: client fakeEntitlements: @{}];
 175 }
 176
 177 CFTypeRef SecCreateLocalCFSecuritydXPCServer(void) {
 178     return CFBridgingRetain(SecCreateLocalSecuritydXPCServer());
 179 }
 180
 181 void SecResetLocalSecuritydXPCFakeEntitlements(void) {
 182     if([(__bridge id) gSecurityd->secd_xpc_server isKindOfClass: [LocalSecuritydXPCServer class]]) {
 183         LocalSecuritydXPCServer* server = (__bridge LocalSecuritydXPCServer*)gSecurityd->secd_xpc_server;
 184         server.fakeEntitlements = [[NSMutableDictionary alloc] init];
 185     }
 186 }
 187
 188 void SecAddLocalSecuritydXPCFakeEntitlement(CFStringRef entitlement, CFTypeRef value) {
 189     if([(__bridge id) gSecurityd->secd_xpc_server isKindOfClass: [LocalSecuritydXPCServer class]]) {
 190         LocalSecuritydXPCServer* server = (__bridge LocalSecuritydXPCServer*)gSecurityd->secd_xpc_server;
 191         server.fakeEntitlements[(__bridge NSString*)entitlement] = (__bridge id)value;
 192     }
 193 }