libsecurityd/mig/ucsp.defs

   1 //
   2 // Copyright (c) 2001-2007 Apple Inc. All Rights Reserved.
   3 //
   4 // @APPLE_LICENSE_HEADER_START@
   5 //
   6 // This file contains Original Code and/or Modifications of Original Code
   7 // as defined in and that are subject to the Apple Public Source License
   8 // Version 2.0 (the 'License'). You may not use this file except in
   9 // compliance with the License. Please obtain a copy of the License at
  10 // http://www.opensource.apple.com/apsl/ and read it before using this
  11 // file.
  12 //
  13 // The Original Code and all software distributed under the License are
  14 // distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15 // EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16 // INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17 // FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18 // Please see the License for the specific language governing rights and
  19 // limitations under the License.
  20 //
  21 // @APPLE_LICENSE_HEADER_END@
  22 //
  23 // ucsp.defs - Mach RPC interface between SecurityServer and its clients
  24 //
  25 #include <mach/std_types.defs>
  26 #include <mach/mach_types.defs>
  27 #include "ss_types.defs"
  28
  29 subsystem ucsp 1000;
  30 serverprefix ucsp_server_;
  31 userprefix ucsp_client_;
  32
  33 import <securityd_client/ucsp_types.h>;
  34
  35
  36 //
  37 // Common argument profiles
  38 //
  39 #define UCSP_PORTS      requestport sport: mach_port_t; \
  40                                         replyport rport: mach_port_make_send_t; \
  41                     serveraudittoken sourceAudit: audit_token_t; \
  42                                         usersectoken securitydCreds: security_token_t; \
  43                                         out rcode: CSSM_RETURN
  44
  45
  46 //
  47 // Management and administrative functions
  48 //
  49 routine setup(UCSP_PORTS; in tport: mach_port_t; in info: SetupInfo; in FilePath: FilePath);
  50 skip;           // was setupNew - no longer needed
  51 routine setupThread(UCSP_PORTS; in tport: mach_port_t);
  52
  53
  54 //
  55 // Common database functions
  56 //
  57 routine authenticateDb(UCSP_PORTS; in db: IPCDbHandle; in accessType: CSSM_DB_ACCESS_TYPE; in accessCredentials: Data);
  58 routine releaseDb(UCSP_PORTS; in db: IPCDbHandle);
  59 routine getDbName(UCSP_PORTS; in db: IPCDbHandle; out name: FilePathOut);
  60 routine setDbName(UCSP_PORTS; in db: IPCDbHandle; in name: FilePath);
  61
  62
  63 //
  64 // External database interface
  65 //
  66 routine openToken(UCSP_PORTS; in ssid: uint32; in name: FilePath;
  67         in accessCredentials: Data; out db: IPCDbHandle);
  68
  69 routine findFirst(UCSP_PORTS; in db: IPCDbHandle; in query: Data;
  70         in inAttributes : Data; out outAttributes: Data;
  71         in getData: boolean_t; out data: Data; out key: IPCKeyHandle; out search: IPCSearchHandle; out record: IPCRecordHandle);
  72 routine findNext(UCSP_PORTS; in search: IPCSearchHandle;
  73         in inAttributes : Data; out outAttributes: Data;
  74         in getData: boolean_t; out data: Data; out key: IPCKeyHandle; out record: IPCRecordHandle);
  75 routine findRecordHandle(UCSP_PORTS; in record: IPCRecordHandle;
  76         in inAttributes : Data; out outAttributes: Data;
  77         in getData: boolean_t; out data: Data; out key: IPCKeyHandle);
  78 routine insertRecord(UCSP_PORTS; in db: IPCDbHandle; in recordType: CSSM_DB_RECORDTYPE;
  79         in attributes : Data; in data: Data; out record: IPCRecordHandle);
  80 routine deleteRecord(UCSP_PORTS; in db: IPCDbHandle; in record: IPCRecordHandle);
  81 routine modifyRecord(UCSP_PORTS; in db: IPCDbHandle; inout record: IPCRecordHandle; in recordType: CSSM_DB_RECORDTYPE;
  82         in attributes : Data; in setData: boolean_t; in data: Data;
  83         in modifyMode: CSSM_DB_MODIFY_MODE);
  84 routine releaseSearch(UCSP_PORTS; in search: IPCSearchHandle);
  85 routine releaseRecord(UCSP_PORTS; in record: IPCRecordHandle);
  86
  87
  88
  89 //
  90 // Internal database interface
  91 //
  92 routine createDb(UCSP_PORTS; out db: IPCDbHandle; in ident: Data;
  93     in accessCredentials: Data; in aclEntryPrototype: Data;
  94     in params: DBParameters);
  95 skip;
  96 #if 0
  97 // should move here from below, next time we break compatibility for another reason
  98 routine commitDbForSync(UCSP_PORTS; in srcDb: IPCDbHandle; in cloneDb: IPCDbHandle;
  99     out blob: DbBlob);
 100 #endif
 101 routine decodeDb(UCSP_PORTS; out db: IPCDbHandle; in ident: Data;
 102     in accessCredentials: Data; in blob: DbBlob);
 103 routine encodeDb(UCSP_PORTS; in db: IPCDbHandle; out blob: DbBlob);
 104 routine setDbParameters(UCSP_PORTS; in db: IPCDbHandle; in params: DBParameters);
 105 routine getDbParameters(UCSP_PORTS; in db: IPCDbHandle; out params: DBParameters);
 106 routine changePassphrase(UCSP_PORTS; in db: IPCDbHandle;
 107         in accessCredentials: Data);
 108 routine lockAll(UCSP_PORTS; in forSleep: boolean_t);
 109 routine unlockDb(UCSP_PORTS; in db: IPCDbHandle);
 110 routine unlockDbWithPassphrase(UCSP_PORTS; in db: IPCDbHandle; in passPhrase: Data);
 111 routine isLocked(UCSP_PORTS; in db: IPCDbHandle; out locked: boolean_t);
 112
 113
 114 //
 115 // Key management
 116 //
 117 routine encodeKey(UCSP_PORTS; in key: IPCKeyHandle; out blob: KeyBlob;
 118     in wantUid: boolean_t; out uid: Data);
 119 routine decodeKey(UCSP_PORTS; out key: IPCKeyHandle; out header: Data;
 120     in db: IPCDbHandle; in blob: KeyBlob);
 121 // keychain synchronization
 122 routine recodeKey(UCSP_PORTS; in oldDb: IPCDbHandle; in key: IPCKeyHandle;
 123     in newDb: IPCDbHandle; out newBlob: KeyBlob);
 124 routine releaseKey(UCSP_PORTS; in key: IPCKeyHandle);
 125
 126 routine queryKeySizeInBits(UCSP_PORTS; in key: IPCKeyHandle; out length: CSSM_KEY_SIZE);
 127 routine getOutputSize(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 128     in inputSize: uint32; in encrypt: boolean_t; out outputSize: uint32);
 129
 130 routine getKeyDigest(UCSP_PORTS; in key: IPCKeyHandle; out digest: Data);
 131
 132
 133 //
 134 // Cryptographic operations
 135 //
 136 routine generateSignature(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 137     in signOnlyAlgorithm: CSSM_ALGORITHMS; in data: Data; out signature: Data);
 138 routine verifySignature(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 139         in signOnlyAlgorithm: CSSM_ALGORITHMS; in data: Data; in signature: Data);
 140 routine generateMac(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 141         in data: Data; out signature: Data);
 142 routine verifyMac(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 143         in data: Data; in signature: Data);
 144
 145 routine encrypt(UCSP_PORTS; in context: Data; in key: IPCKeyHandle; in clear: Data; out cipher: Data);
 146 routine decrypt(UCSP_PORTS; in context: Data; in key: IPCKeyHandle; in cipher: Data; out clear: Data);
 147
 148 routine generateKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data;
 149         in accessCredentials: Data; in aclEntryPrototype: Data;
 150         in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);
 151 routine generateKeyPair(UCSP_PORTS; in db: IPCDbHandle; in context: Data;
 152         in accessCredentials: Data; in aclEntryPrototype: Data;
 153         in pubUsage: uint32; in pubAttrs: uint32; in privUsage: uint32; in privAttrs: uint32;
 154         out pubKey: IPCKeyHandle; out pubHeader: Data;
 155     out privKey: IPCKeyHandle; out privHeader: Data);
 156
 157 routine wrapKey(UCSP_PORTS; in context: Data; in key: IPCKeyHandle;
 158     in accessCredentials: Data; in keyToBeWrapped: IPCKeyHandle;
 159         in descriptiveData: Data; out wrappedKey: Data);
 160 routine unwrapKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in key: IPCKeyHandle;
 161         in accessCredentials: Data; in aclEntryPrototype: Data;
 162         in publicKey: IPCKeyHandle; in wrappedKey: Data;
 163         in usage: uint32; in attributes: uint32; out data: Data;
 164     out resultKey: IPCKeyHandle; out header: Data);
 165
 166 routine deriveKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in baseKey: IPCKeyHandle;
 167         in accessCredentials: Data; in aclEntryPrototype: Data;
 168     in paramInput: Data; out paramOutput: Data;
 169         in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);
 170
 171 routine generateRandom(UCSP_PORTS; in ssid: uint32; in context: Data; out data: Data);
 172
 173
 174 //
 175 // ACL management
 176 //
 177 routine getOwner(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
 178         out proto: Data);
 179 routine setOwner(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
 180         in accessCredentials: Data; in aclOwnerPrototype: Data);
 181 routine getAcl(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
 182         in haveTag: boolean_t; in tag: CssmString;
 183         out count: uint32; out acls: Data);
 184 routine changeAcl(UCSP_PORTS; in kind: AclKind; in key: IPCGenericHandle;
 185         in accessCredentials: Data;
 186         in mode: CSSM_ACL_EDIT_MODE; in handle: IPCGenericHandle;
 187         in aclEntryInput: Data);
 188
 189 routine login(UCSP_PORTS; in accessCredentials: Data; in name: Data);
 190 routine logout(UCSP_PORTS);
 191
 192
 193 //
 194 // Miscellanea
 195 //
 196 routine getStatistics(UCSP_PORTS; in ssid: uint32; out statistics: CSSM_CSP_OPERATIONAL_STATISTICS);
 197 routine getTime(UCSP_PORTS; in ssid: uint32; in algorithm: CSSM_ALGORITHMS; out data: Data);
 198 routine getCounter(UCSP_PORTS; in ssid: uint32; out data: Data);
 199 routine selfVerify(UCSP_PORTS; in ssid: uint32);
 200
 201 routine cspPassThrough(UCSP_PORTS; in ssid: uint32; in id: uint32; in context: Data; in hKey: IPCKeyHandle;
 202         in inData: Data; out outData: Data);
 203 routine dlPassThrough(UCSP_PORTS; in ssid: uint32; in id: uint32; in inData: Data; out outData: Data);
 204
 205
 206 //
 207 // Authorization subsystem
 208 //
 209 routine authorizationCreate(UCSP_PORTS;
 210         in rights: Data;
 211         in flags: uint32;
 212         in environment: Data;
 213         out authorization: AuthorizationBlob);
 214
 215 routine authorizationRelease(UCSP_PORTS; in authorization: AuthorizationBlob;
 216         in flags: uint32);
 217
 218 routine authorizationCopyRights(UCSP_PORTS; in authorization: AuthorizationBlob;
 219         in rights: Data;
 220         in flags: uint32;
 221         in environment: Data;
 222         out result: Data);
 223
 224 routine authorizationCopyInfo(UCSP_PORTS; in authorization: AuthorizationBlob;
 225         in tag: AuthorizationString;
 226         out info: Data);
 227
 228 routine authorizationExternalize(UCSP_PORTS; in authorization: AuthorizationBlob;
 229         out form: AuthorizationExternalForm);
 230
 231 routine authorizationInternalize(UCSP_PORTS; in form: AuthorizationExternalForm;
 232         out authorization: AuthorizationBlob);
 233
 234
 235 //
 236 // Session management subsystem
 237 //
 238 skip;   // was getSessionInfo -- now kept by the kernel
 239 skip;   // was setupSession -- now kept by the kernel
 240 skip;   // was setSessionDistinguishedUid -- now kept by the kernel
 241 skip;   // was getSessionDistinguishedUid -- now kept by the kernel
 242 routine setSessionUserPrefs(UCSP_PORTS; in sessionId: SecuritySessionId; in userPrefs: Data);
 243
 244 //
 245 // Notification subsystem
 246 //
 247 routine postNotification(UCSP_PORTS; in domain: uint32; in event: uint32; in data: Data;
 248         in sequence: uint32);
 249
 250
 251 //
 252 // Database key management
 253 //
 254 routine extractMasterKey(UCSP_PORTS; in db: IPCDbHandle; in context: Data; in sourceDb: IPCDbHandle;
 255         in accessCredentials: Data; in aclEntryPrototype: Data;
 256         in keyUsage: uint32; in keyAttrs: uint32; out key: IPCKeyHandle; out header: Data);
 257
 258
 259 //
 260 // AuthorizationDB operations
 261 //
 262 routine authorizationdbGet(UCSP_PORTS; in rightname: AuthorizationString; out rightdefinition: Data);
 263 routine authorizationdbSet(UCSP_PORTS; in authorization: AuthorizationBlob; in rightname: AuthorizationString; in rightDefinition: Data);
 264 routine authorizationdbRemove(UCSP_PORTS; in authorization: AuthorizationBlob; in rightname: AuthorizationString);
 265
 266
 267 //
 268 // Miscellaneous administrative calls
 269 //
 270 routine addCodeEquivalence(UCSP_PORTS; in oldCode: Data; in newCode: Data; in name: FilePath;
 271         in forSystem: boolean_t);
 272 routine removeCodeEquivalence(UCSP_PORTS; in code: Data; in name: FilePath;
 273         in forSystem: boolean_t);
 274 routine setAlternateSystemRoot(UCSP_PORTS; in path: FilePath);
 275
 276
 277 //
 278 // Subsidiary process (child) management.
 279 // This call does NOT cause securityd-client activation.
 280 //
 281 simpleroutine childCheckIn(requestport sport: mach_port_t;
 282         in servicePort: mach_port_make_send_t; in task_port: mach_port_t);
 283
 284 #if 1
 285 // This should move up to be with its buddies (see #if 0 above), but it won't move
 286 // until we need to force an incompatible change for some other reason.
 287 routine commitDbForSync(UCSP_PORTS; in srcDb: IPCDbHandle; in cloneDb: IPCDbHandle;
 288     out blob: DbBlob);
 289 #endif
 290
 291
 292 //
 293 // Code Signing Hosting protocol part 1: registration services.
 294 //
 295 routine registerHosting(UCSP_PORTS;
 296         in hostingPort: mach_port_make_send_t; in flags: uint32);
 297 routine hostingPort(UCSP_PORTS;
 298         in hostPid: pid_t; out hostingPort: mach_port_make_send_t);
 299 routine setGuest(UCSP_PORTS; in guest: SecGuestRef; in flags: uint32);
 300
 301 //
 302 // Code Signing Hosting protocol part 2: proxy services.
 303 //
 304 routine createGuest(UCSP_PORTS; in host: SecGuestRef; in status: uint32_t;
 305         in path: FilePath; in cdhash: HashData; in attributes: Data; in flags: uint32; out guest: SecGuestRef);
 306 routine setGuestStatus(UCSP_PORTS; in guest: SecGuestRef;
 307         in status: uint32_t; in attributes: Data);
 308 routine removeGuest(UCSP_PORTS; in host: SecGuestRef; in guest: SecGuestRef);
 309
 310 //
 311 // Code Signing support calls
 312 //
 313 routine helpCheckLoad(UCSP_PORTS; in path: FilePath; in addType: uint32_t);
 314
 315 //
 316 // Keychain Syncing setup support calls
 317 //
 318 routine recodeDbForSync(UCSP_PORTS; in dbToClone: IPCDbHandle;
 319     in srcDb: IPCDbHandle; out newDb: IPCDbHandle);
 320 routine authenticateDbsForSync(UCSP_PORTS; in ipcDbHandleArray: Data;
 321     in agentData: Data; out newDb: IPCDbHandle);
 322
 323 //
 324 // Allows the client to verify that the server really is root.
 325 //
 326 routine verifyPrivileged(UCSP_PORTS);
 327
 328 //
 329 // The original verifyPrivileged is subject to a Mach service in the middle attack (6986198).
 330 //
 331 routine verifyPrivileged2(UCSP_PORTS; out originPort: mach_port_make_send_t);