keychain/KeychainDataclassOwner/KeychainDataclassOwner.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "KeychainDataclassOwner.h"
  25 #import "NSError+UsefulConstructors.h"
  26 #import "SecCFRelease.h"
  27 #import "SOSCloudCircle.h"
  28 #import "debugging.h"
  29 #import <Accounts/Accounts.h>
  30 #import <Accounts/ACDataclassAction.h>
  31 #import <Accounts/ACConstants.h>
  32 #import <Security/Security.h>
  33 #import <Security/SecItemPriv.h>
  34
  35 @implementation KeychainDataclassOwner
  36
  37 static NSString* const KeychainDataclass = @"KeychainDataclass";
  38
  39 + (NSArray*)dataclasses
  40 {
  41     return @[kAccountDataclassKeychainSync];
  42 }
  43
  44 - (NSArray*)actionsForDeletingAccount:(ACAccount*)account forDataclass:(NSString*)dataclass
  45 {
  46     if (![dataclass isEqual:kAccountDataclassKeychainSync]) {
  47         return nil;
  48     }
  49
  50     ACDataclassAction* cancelAction = [ACDataclassAction actionWithType:ACDataclassActionCancel];
  51     ACDataclassAction* deleteAction = [ACDataclassAction actionWithType:ACDataclassActionDeleteSyncData];
  52     ACDataclassAction* keepAction = [ACDataclassAction actionWithType:ACDataclassActionMergeSyncDataIntoLocalData];
  53
  54     return @[cancelAction, deleteAction, keepAction];
  55 }
  56
  57 - (NSArray*)actionsForDisablingDataclassOnAccount:(ACAccount*)account forDataclass:(NSString*)dataclass
  58 {
  59     return [self actionsForDeletingAccount:account forDataclass:dataclass];
  60 }
  61
  62
  63 - (BOOL)performAction:(ACDataclassAction*)action forAccount:(ACAccount*)account withChildren:(NSArray*)childAccounts forDataclass:(NSString*)dataclass withError:(NSError**)error
  64 {
  65     // if the user asked us to delete their data, do that now
  66     // we should rejigger this implementation to send a new custom message to security with an entitlement specifically for the signout case
  67     // then we can do all the things we need to in securityd without having to entitlement the dataclass owners manager to read keychain items
  68     // <rdar://problem/42436575> redo KeychainDataclassOwner to remove Safari items from DataclassOwnerManager's entitlements
  69     if (action.type == ACDataclassActionDeleteSyncData) {
  70         NSDictionary* baseQuery = @{ (id)kSecAttrSynchronizable : @(YES),
  71                                      (id)kSecAttrAccessGroup : @"com.apple.cfnetwork",
  72                                      (id)kSecUseDataProtectionKeychain : @(YES),
  73                                      (id)kSecAttrTombstone : @(NO),
  74                                      (id)kSecUseTombstones : @(NO) };
  75         NSMutableDictionary* inetQuery = baseQuery.mutableCopy;
  76         inetQuery[(id)kSecClass] = (id)kSecClassInternetPassword;
  77         OSStatus inetResult = SecItemDelete((__bridge CFDictionaryRef)inetQuery);
  78
  79         NSMutableDictionary* genpQuery = baseQuery.mutableCopy;
  80         genpQuery[(id)kSecClass] = (id)kSecClassGenericPassword;
  81         OSStatus genpResult = SecItemDelete((__bridge CFDictionaryRef)genpQuery);
  82
  83         NSMutableDictionary* certQuery = baseQuery.mutableCopy;
  84         certQuery[(id)kSecClass] = (id)kSecClassCertificate;
  85         OSStatus certResult = SecItemDelete((__bridge CFDictionaryRef)certQuery);
  86
  87         NSMutableDictionary* keyQuery = baseQuery.mutableCopy;
  88         keyQuery[(id)kSecClass] = (id)kSecClassKey;
  89         OSStatus keyResult = SecItemDelete((__bridge CFDictionaryRef)keyQuery);
  90
  91         NSMutableDictionary* creditCardsQuery = baseQuery.mutableCopy;
  92         creditCardsQuery[(id)kSecClass] = (id)kSecClassGenericPassword;
  93         creditCardsQuery[(id)kSecAttrAccessGroup] = @"com.apple.safari.credit-cards";
  94         OSStatus creditCardsResult = SecItemDelete((__bridge CFDictionaryRef)creditCardsQuery);
  95
  96         if (inetResult == errSecSuccess) {
  97             secnotice("itemDelete", "deleted synchronizable passwords from table inet");
  98         } else {
  99             secwarning("failed to delete synchronizable passwords from table inet: %d", (int)inetResult);
 100         }
 101         if (genpResult == errSecSuccess) {
 102             secnotice("itemDelete", "deleted synchronizable passwords from table genp");
 103         } else {
 104             secwarning("failed to delete synchronizable passwords from table genp: %d", (int)genpResult);
 105         }
 106         if (certResult == errSecSuccess) {
 107             secnotice("itemDelete", "deleted synchronizable certificates from table cert");
 108         } else {
 109             secwarning("failed to delete synchronizable certificates from table cert: %d", (int)certResult);
 110         }
 111         if (keyResult == errSecSuccess) {
 112             secnotice("itemDelete", "deleted synchronizable keys from table keys");
 113         } else {
 114             secwarning("failed to delete synchronizable keys from table keys: %d", (int)keyResult);
 115         }
 116         if (creditCardsResult == errSecSuccess) {
 117             secnotice("itemDelete", "deleted credit cards from table genp");
 118         } else {
 119             secwarning("failed to delete credit cards from table genp: %d", (int)creditCardsResult);
 120         }
 121     }
 122
 123     return YES;
 124 }
 125
 126 @end