KeychainSyncAccountNotification/KeychainSyncAccountNotification.m

   1 //
   2 //  KeychainSyncAccountNotification.m
   3 //  Security
   4 //
   5
   6 #import "KeychainSyncAccountNotification.h"
   7 #import <Accounts/Accounts.h>
   8 #import <Accounts/Accounts_Private.h>
   9 #import <AppleAccount/ACAccount+AppleAccount.h>
  10 #import <AccountsDaemon/ACDAccountStore.h>
  11 #import <Security/SecureObjectSync/SOSCloudCircle.h>
  12 #import <AuthKit/AuthKit.h>
  13 #import <AuthKit/AuthKit_Private.h>
  14 #if OCTAGON
  15 #import <keychain/ot/OTControl.h>
  16 #include <utilities/SecCFRelease.h>
  17 #endif
  18 #import "utilities/debugging.h"
  19 #import "OT.h"
  20
  21 @implementation KeychainSyncAccountNotification
  22
  23 - (bool)accountIsPrimary:(ACAccount *)account
  24 {
  25     return [account aa_isAccountClass:AAAccountClassPrimary];
  26 }
  27
  28 // this is where we initialize SOS and OT for account sign-in
  29 // in the future we may bring this logic over to KeychainDataclassOwner and delete KeychainSyncAccountNotification, but accounts people say that's a change that today would require coordination across multiple teams
  30 // was asked to file this radar for accounts: <rdar://problem/40176124> Invoke DataclassOwner when enabling or signing into an account
  31 - (void)account:(ACAccount *)account didChangeWithType:(ACAccountChangeType)changeType inStore:(ACDAccountStore *)store oldAccount:(ACAccount *)oldAccount {
  32
  33     if((changeType == kACAccountChangeTypeAdded || changeType == kACAccountChangeTypeModified) &&
  34        [account.accountType.identifier isEqualToString: ACAccountTypeIdentifierAppleAccount] &&
  35        [self accountIsPrimary:account]) {
  36
  37 #if OCTAGON
  38         if(OctagonIsEnabled()){
  39             NSString* altDSID =  [account aa_altDSID];
  40             secnotice("octagon-account", "Received an primary Apple account modification (altDSID %@)", altDSID);
  41
  42             __block NSError* error = nil;
  43
  44             // Use asynchronous XPC here for speed and just hope it works
  45             OTControl* otcontrol = [OTControl controlObject:false error:&error];
  46
  47             if (nil == otcontrol) {
  48                 secerror("octagon-account: Failed to get OTControl: %@", error.localizedDescription);
  49             } else {
  50                 [otcontrol signIn:altDSID container:nil context:OTDefaultContext reply:^(NSError * _Nullable signedInError) {
  51                     // take a retain on otcontrol so it won't invalidate the connection
  52                     (void)otcontrol;
  53
  54                     if(signedInError) {
  55                         secerror("octagon-account: error signing in: %s", [[signedInError description] UTF8String]);
  56                     } else {
  57                         secnotice("octagon-account", "account now signed in for octagon operation");
  58                     }
  59                 }];
  60             }
  61         }else{
  62             secerror("Octagon not enabled; not signing in");
  63         }
  64 #endif
  65     }
  66
  67     // If there is any change to any AuthKit account's security level, notify octagon
  68
  69 #if OCTAGON
  70     if([account.accountType.identifier isEqualToString: ACAccountTypeIdentifierIDMS]) {
  71         NSString* altDSID = [account aa_altDSID];;
  72         secnotice("octagon-authkit", "Received an IDMS account modification (altDSID: %@)", altDSID);
  73
  74         AKAccountManager *manager = [AKAccountManager sharedInstance];
  75
  76         AKAppleIDSecurityLevel oldSecurityLevel = [manager securityLevelForAccount:oldAccount];
  77         AKAppleIDSecurityLevel newSecurityLevel = [manager securityLevelForAccount:account];
  78
  79         if(oldSecurityLevel != newSecurityLevel) {
  80             secnotice("octagon-authkit", "IDMS security level has now moved to %ld for altDSID %@", (unsigned long)newSecurityLevel, altDSID);
  81
  82             __block NSError* error = nil;
  83             // Use an asynchronous otcontrol for Speed But Not Necessarily Correctness
  84             OTControl* otcontrol = [OTControl controlObject:false error:&error];
  85             if(!otcontrol || error) {
  86                 secerror("octagon-authkit: Failed to get OTControl: %@", error);
  87             } else {
  88                  [otcontrol notifyIDMSTrustLevelChangeForContainer:nil context:OTDefaultContext reply:^(NSError * _Nullable idmsError) {
  89                      // take a retain on otcontrol so it won't invalidate the connection
  90                      (void)otcontrol;
  91
  92                      if(idmsError) {
  93                          secerror("octagon-authkit: error with idms trust level change in: %s", [[idmsError description] UTF8String]);
  94                      } else {
  95                          secnotice("octagon-authkit", "informed octagon of IDMS trust level change");
  96                      }
  97                 }];
  98             }
  99
 100         } else {
 101             secnotice("octagon-authkit", "No change to IDMS security level (%lu) for altDSID %@", (unsigned long)newSecurityLevel, altDSID);
 102         }
 103     }
 104 #endif
 105
 106     if ((changeType == kACAccountChangeTypeDeleted) && [oldAccount.accountType.identifier isEqualToString:ACAccountTypeIdentifierAppleAccount]) {
 107         NSString* altDSID =  [oldAccount aa_altDSID];
 108         secnotice("octagon-account", "Received an Apple account deletion (altDSID %@)", altDSID);
 109
 110         NSString *accountIdentifier = oldAccount.identifier;
 111         NSString *username = oldAccount.username;
 112
 113         if(accountIdentifier != NULL && username !=NULL) {
 114             if ([self accountIsPrimary:oldAccount]) {
 115                 CFErrorRef removalError = NULL;
 116
 117                 secinfo("accounts", "Performing SOS circle credential removal for account %@: %@", accountIdentifier, username);
 118
 119                 if (!SOSCCLoggedOutOfAccount(&removalError)) {
 120                     secerror("Account %@ could not leave the SOS circle: %@", accountIdentifier, removalError);
 121                 }
 122
 123 #if OCTAGON
 124                 if(OctagonIsEnabled()){
 125                     __block NSError* error = nil;
 126
 127                     // Use an asynchronous control for Speed
 128                     OTControl* otcontrol = [OTControl controlObject:false error:&error];
 129
 130                     if (nil == otcontrol) {
 131                         secerror("octagon-account: Failed to get OTControl: %@", error.localizedDescription);
 132                     } else {
 133                         [otcontrol signOut:nil context:OTDefaultContext reply:^(NSError * _Nullable signedInError) {
 134                             // take a retain on otcontrol so it won't invalidate the connection
 135                             (void)otcontrol;
 136
 137                             if(signedInError) {
 138                                 secerror("octagon-account: error signing out: %s", [[signedInError description] UTF8String]);
 139                             } else {
 140                                 secnotice("octagon-account", "signed out of octagon trust");
 141                             }
 142                         }];
 143                     }
 144                 } else {
 145                     secerror("Octagon not enabled; not signing out");
 146                 }
 147 #endif
 148             }
 149         }
 150     }
 151 }
 152
 153 @end