OSX/sec/Security/SecAccessControlPriv.h

   1 /*
   2  * Copyright (c) 2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25  @header SecAccessControlPriv
  26  SecAccessControl defines access rights for items.
  27  */
  28
  29 #ifndef _SECURITY_SECACCESSCONTROLPRIV_H_
  30 #define _SECURITY_SECACCESSCONTROLPRIV_H_
  31
  32 #include <Security/SecBase.h>
  33 #include <CoreFoundation/CFError.h>
  34 #include <CoreFoundation/CFData.h>
  35 #include <CoreFoundation/CFDictionary.h>
  36
  37 __BEGIN_DECLS
  38
  39 /*! Creates new empty access control object. */
  40 SecAccessControlRef SecAccessControlCreate(CFAllocatorRef allocator, CFErrorRef *error);
  41
  42 // Protection, currently only kSecAttrAccessible* constants are allowed.  In future, another probable protection type might be CTK key object ID.
  43 CFTypeRef SecAccessControlGetProtection(SecAccessControlRef access_control);
  44 bool SecAccessControlSetProtection(SecAccessControlRef access_control, CFTypeRef protection, CFErrorRef *error);
  45
  46 /*! Represents constraint of the operation. */
  47 typedef CFTypeRef SecAccessConstraintRef;
  48
  49 /*! Creates constraint based on specified policy.
  50     @param policy Identification of policy to be used.
  51  */
  52 SecAccessConstraintRef SecAccessConstraintCreatePolicy(CFAllocatorRef allocator, CFTypeRef policy, CFErrorRef *error);
  53
  54 /*! Creates constraint which requires passcode verification. */
  55 SecAccessConstraintRef SecAccessConstraintCreatePasscode(CFAllocatorRef allocator);
  56
  57 /*! Creates constraint which requires Touch ID or Face ID verification.*/
  58 SecAccessConstraintRef SecAccessConstraintCreateBiometryAny(CFAllocatorRef allocator, CFDataRef catacombUUID);
  59
  60 /*! Creates constraint which requires Touch ID verification.*/
  61 SecAccessConstraintRef SecAccessConstraintCreateTouchIDAny(CFAllocatorRef allocator, CFDataRef catacombUUID)
  62 API_DEPRECATED_WITH_REPLACEMENT("SecAccessConstraintCreateBiometryAny", macos(10.12.1, 10.13.4), ios(9.0, 11.3));
  63
  64 /*! Creates constraint which requires Touch ID or Face ID verification.*/
  65 SecAccessConstraintRef SecAccessConstraintCreateBiometryCurrentSet(CFAllocatorRef allocator, CFDataRef catacombUUID, CFDataRef bioDbHash);
  66
  67 /*! Creates constraint which requires Touch ID verification.*/
  68 SecAccessConstraintRef SecAccessConstraintCreateTouchIDCurrentSet(CFAllocatorRef allocator, CFDataRef catacombUUID, CFDataRef bioDbHash)
  69 API_DEPRECATED_WITH_REPLACEMENT("SecAccessConstraintCreateBiometryCurrentSet", macos(10.12.1, 10.13.4), ios(9.0, 11.3));
  70
  71 /*! Creates constraint composed of other constraints.
  72     @param numRequired Number of constraints required to be satisfied in order to consider overal constraint satisfied.
  73     @param constraints Array of constraints to be chosen from.
  74  */
  75 SecAccessConstraintRef SecAccessConstraintCreateKofN(CFAllocatorRef allocator, size_t numRequired, CFArrayRef constraints, CFErrorRef *error);
  76
  77 /*! Adds new constraint for specified operation.
  78     @param access_control Instance of access control object to add constraint to.
  79     @param operation Operation type.
  80     @param constraint Constraint object, created by one of SecAccessControlConstraintCreate() functions or kCFBooleanTrue
  81                       meaning that operation will be always allowed.
  82  */
  83 bool SecAccessControlAddConstraintForOperation(SecAccessControlRef access_control, CFTypeRef operation,
  84                                                SecAccessConstraintRef constraint, CFErrorRef *error);
  85
  86 /*! Retrieves dictionary with constraint applicable for specified operation.
  87     @param access_control Instance of access control object to query.
  88     @param operation Operation type.
  89     @return Dictionary or kCFBooleanTrue representing constraint applied for requested operation.  If the operation
  90             is not allowed at all, NULL is returned.
  91  */
  92 SecAccessConstraintRef SecAccessControlGetConstraint(SecAccessControlRef access_control, CFTypeRef operation);
  93
  94 /*! Serializes constraint applicable for specified operation into binary data form.
  95  @param access_control Instance of access control object to query.
  96  @param operation Operation type.
  97  @return Binary data representing constraint applied for requested operation
  98  */
  99 CFDataRef SecAccessControlCopyConstraintData(SecAccessControlRef access_control, CFTypeRef operation);
 100
 101 /*! Retrieves dictionary with constraints keyed by operations (i.e. the ACL part of access control object).
 102     @return Dictionary with all constraints keyed by operation types.  Returns NULL if no operations are constrained.
 103  */
 104 CFDictionaryRef SecAccessControlGetConstraints(SecAccessControlRef access_control);
 105
 106 /*! Sets dictionary with constraints for access control object.
 107  @param access_control Instance of access control object to set default access group to.
 108  @param constraints Constraint with all constraints.
 109  */
 110 void SecAccessControlSetConstraints(SecAccessControlRef access_control, CFDictionaryRef constraints);
 111
 112 /*! Sets if application passwor is required.
 113 @param require Indicate if password is required or not.
 114 */
 115 void SecAccessControlSetRequirePassword(SecAccessControlRef access_control, bool require);
 116
 117 /*! Gets boolean value if application password is required.*/
 118 bool SecAccessControlGetRequirePassword(SecAccessControlRef access_control);
 119
 120 /*! Sets if acl is bound.
 121  @param bound Indicate if password is bound or not.
 122  */
 123 void SecAccessControlSetBound(SecAccessControlRef access_control, bool bound);
 124
 125 /*! Gets boolean value if acl is bound.*/
 126 bool SecAccessControlIsBound(SecAccessControlRef access_control);
 127
 128 /*! Creates Access control instance from data serialized by SecAccessControlCopyData(). */
 129 SecAccessControlRef SecAccessControlCreateFromData(CFAllocatorRef allocator, CFDataRef data, CFErrorRef *error);
 130
 131 /*! Serializes all access control object into binary data form. */
 132 CFDataRef SecAccessControlCopyData(SecAccessControlRef access_control);
 133
 134 __END_DECLS
 135
 136 #endif // _SECURITY_SECACCESSCONTROLPRIV_H_