OSX/sec/securityd/Regressions/secd-21-transmogrify.m

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * This is to fool os services to not provide the Keychain manager
  26  * interface tht doens't work since we don't have unified headers
  27  * between iOS and OS X. rdar://23405418/
  28  */
  29 #define __KEYCHAINCORE__ 1
  30
  31
  32 #import <Foundation/Foundation.h>
  33 #import <CoreFoundation/CoreFoundation.h>
  34 #import <Security/SecBase.h>
  35 #import <Security/SecItem.h>
  36 #import <Security/SecItemPriv.h>
  37 #import <Security/SecInternal.h>
  38 #import <utilities/SecCFWrappers.h>
  39 #import <utilities/SecFileLocations.h>
  40 #import <securityd/SecItemServer.h>
  41
  42 #import <stdlib.h>
  43
  44 #include "secd_regressions.h"
  45 #include "SecdTestKeychainUtilities.h"
  46
  47 void SecAccessGroupsSetCurrent(CFArrayRef accessGroups);
  48 CFArrayRef SecAccessGroupsGetCurrent(void);
  49
  50 int
  51 secd_21_transmogrify(int argc, char *const *argv)
  52 {
  53     plan_tests(kSecdTestSetupTestCount + 14);
  54
  55 #if TARGET_OS_IOS
  56     CFErrorRef error = NULL;
  57     CFDictionaryRef result = NULL;
  58     OSStatus res;
  59
  60     CFArrayRef currentACL = SecAccessGroupsGetCurrent();
  61
  62     NSMutableArray *newACL = [NSMutableArray arrayWithArray:(__bridge NSArray *)currentACL];
  63     [newACL addObjectsFromArray:@[
  64                                   @"com.apple.private.system-keychain",
  65                                   @"com.apple.private.syncbubble-keychain",
  66                                   @"com.apple.private.migrate-musr-system-keychain",
  67                                   @"com.apple.ProtectedCloudStorage",
  68                                   ]];
  69
  70     SecAccessGroupsSetCurrent((__bridge CFArrayRef)newACL);
  71
  72
  73     secd_test_setup_temp_keychain("secd_21_transmogrify", NULL);
  74
  75     /*
  76      * Add to user keychain
  77      */
  78
  79     res = SecItemAdd((CFDictionaryRef)@{
  80         (id)kSecClass :  (id)kSecClassGenericPassword,
  81         (id)kSecAttrAccount :  @"user-label-me",
  82         (id)kSecValueData : [NSData dataWithBytes:"password" length:8]
  83     }, NULL);
  84     is(res, 0, "SecItemAdd(user)");
  85
  86     SecurityClient client = {
  87         .task = NULL,
  88         .accessGroups = (__bridge CFArrayRef)@[
  89             @"com.apple.ProtectedCloudStorage"
  90         ],
  91         .allowSystemKeychain = true,
  92         .allowSyncBubbleKeychain = true,
  93         .uid = 502,
  94         .inMultiUser = false,
  95         .activeUser = 502,
  96     };
  97
  98     is(_SecServerTransmogrifyToSystemKeychain(&client, &error), true, "_SecServerTransmogrifyToSystemKeychain: %@", error);
  99
 100     CFDataRef musr = SecMUSRCreateActiveUserUUID(502);
 101
 102     client.inMultiUser = true;
 103     client.musr = musr;
 104
 105     SecSecuritySetMusrMode(true, 502, 502);
 106
 107     res = SecItemCopyMatching((CFDictionaryRef)@{
 108         (id)kSecClass :  (id)kSecClassGenericPassword,
 109         (id)kSecAttrAccount :  @"user-label-me",
 110         (id)kSecUseSystemKeychain : (id)kCFBooleanTrue,
 111         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 112         (id)kSecReturnData : @(YES)
 113     }, (CFTypeRef *)&result);
 114     is(res, 0, "SecItemCopyMatching(system)");
 115
 116     ok(isDictionary(result), "found item");
 117     if (isDictionary(result)) {
 118         NSData *data = ((__bridge NSDictionary *)result)[@"musr"];
 119         ok([data isEqual:(__bridge id)SecMUSRGetSystemKeychainUUID()], "item is system keychain");
 120
 121         NSData* passwordData = [(__bridge NSDictionary*)result valueForKey:(id)kSecValueData];
 122         ok([passwordData isEqual:[NSData dataWithBytes:"password" length:8]], "no data found in transmogrified item");
 123     } else {
 124         ok(0, "returned item is: %@", result);
 125     }
 126     CFReleaseNull(result);
 127
 128     /*
 129      * Check sync bubble
 130      */
 131
 132     res = _SecItemAdd((__bridge CFDictionaryRef)@{
 133         (id)kSecClass :  (id)kSecClassGenericPassword,
 134         (id)kSecAttrAccessGroup : @"com.apple.ProtectedCloudStorage",
 135         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 136         (id)kSecAttrAccount :  @"pcs-label-me",
 137         (id)kSecValueData : [NSData dataWithBytes:"some data" length:9],
 138     }, &client, NULL, NULL);
 139     is(res, true, "SecItemAdd(user)");
 140
 141     res = _SecItemCopyMatching((__bridge CFDictionaryRef)@{
 142          (id)kSecClass :  (id)kSecClassGenericPassword,
 143          (id)kSecAttrAccount :  @"pcs-label-me",
 144          (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 145          (id)kSecReturnData : @(YES),
 146      }, &client, (CFTypeRef *)&result, &error);
 147     is(res, true, "SecItemCopyMatching(system): %@", error);
 148
 149     ok(isDictionary(result), "result is dictionary");
 150     ok([[(__bridge NSDictionary*)result valueForKey:(__bridge id)kSecValueData] isEqual:[NSData dataWithBytes:"some data" length:9]], "retrieved data matches stored data");
 151
 152     /* Check that data are in 502 active user keychain */
 153     ok (CFEqualSafe(((__bridge CFDataRef)((__bridge NSDictionary *)result)[@"musr"]), musr), "not in msr 502");
 154
 155     CFReleaseNull(result);
 156
 157
 158     ok(_SecServerTransmogrifyToSyncBubble((__bridge CFArrayRef)@[@"com.apple.mailq.sync.xpc" ], client.uid, &client, &error),
 159        "_SecServerTransmogrifyToSyncBubble: %@", error);
 160
 161     CFReleaseNull(error);
 162
 163     /*
 164      * first check normal keychain
 165      */
 166
 167     res = _SecItemCopyMatching((__bridge CFDictionaryRef)@{
 168         (id)kSecClass :  (id)kSecClassGenericPassword,
 169         (id)kSecAttrAccount :  @"pcs-label-me",
 170         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 171     }, &client, (CFTypeRef *)&result, &error);
 172     is(res, true, "SecItemCopyMatching(active): %@", error);
 173
 174     ok(isDictionary(result), "result is dictionary");
 175     CFReleaseNull(result);
 176
 177     SecSecuritySetMusrMode(true, 503, 503);
 178
 179     /*
 180      * then syncbubble keychain
 181      */
 182
 183     res = _SecItemCopyMatching((__bridge CFDictionaryRef)@{
 184         (id)kSecClass :  (id)kSecClassGenericPassword,
 185         (id)kSecAttrAccount :  @"pcs-label-me",
 186         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 187         (id)kSecUseSyncBubbleKeychain : @502,
 188     }, &client, (CFTypeRef *)&result, &error);
 189     is(res, true, "SecItemCopyMatching(syncbubble): %@", error);
 190     ok(isDictionary(result), "result is dictionary");
 191
 192     CFReleaseNull(result);
 193
 194     SecSecuritySetMusrMode(false, 501, -1);
 195
 196     SecAccessGroupsSetCurrent(currentACL);
 197
 198     CFRelease(musr);
 199 #else
 200     plan_skip_all("not support on non TARGET_OS_IOS");
 201 #endif
 202     return 0;
 203 }