SecurityTool/sharedTool/SecurityCommands.h

   1 // This is a preprocessed file to define commands that we provide in Security part of the Sec module.
   2
   3 #include "SecurityTool/sharedTool/security_tool_commands.h"
   4
   5 #if TARGET_OS_IPHONE
   6 #define USE_SECURITY_ITEM "By default the synchronizable keys is not searched/update/deleted, use \"security item\" for that.\n"
   7 #else
   8 #define USE_SECURITY_ITEM
   9 #endif
  10
  11
  12 SECURITY_COMMAND("add-internet-password", keychain_add_internet_password,
  13                  "[-a accountName] [-d securityDomain] [-p path] [-P port] [-r protocol] [-s serverName] [-t authenticationType] [-w passwordData] [keychain]\n"
  14                  "    -a Use \"accountName\".\n"
  15                  "    -d Use \"securityDomain\".\n"
  16                  "    -p Use \"path\".\n"
  17                  "    -P Use \"port\".\n"
  18                  "    -r Use \"protocol\".\n"
  19                  "    -s Use \"serverName\".\n"
  20                  "    -t Use \"authenticationType\".\n"
  21                  "    -w Use passwordData.\n"
  22                  "If no keychains is specified the password is added to the default keychain.",
  23                  "Add an internet password item.")
  24
  25 SECURITY_COMMAND("item", keychain_item,
  26                  "[-v][-a|-D|-u attr=value,...|[-q][-j][-g] attr=value,...] [-d password | -f datafile] [attr=value,...]\n"
  27                  "-q Query for item matching (default). Note: as default query skips items with ACL, you have to define 'u_AuthUI=u_AuthUIA' if you want to query items with ACL\n"
  28                  "-g Get password data\n"
  29                  "-a Add item to keychain\n"
  30                  "-u Update item in keychain (require query to match)\n"
  31                  "-D Delete item from keychain\n"
  32                  "-j When printing results, print JSON\n"
  33                  "Add, query, update or delete items from the keychain.  Extra attr=value pairs after options always apply to the query\n"
  34                  "class=[genp|inet|cert|keys] is required for the query\n"
  35                  "To search the synchronizable items (not searched by default) use sync=1 as an attr=value pair.\n"
  36                  "Security Access Control object can be passed as attribute accc with following syntax:\n"
  37                  "accc=\"<access class>[;operation[:constraint type(constraint parameters)]...]\""
  38                  "\nExample:\naccc=\"ak;od(cpo(DeviceOwnerAuthentication));odel(true);oe(true)\""
  39                  "\naccc=\"ak;od(cpo(DeviceOwnerAuthentication));odel(true);oe(true);prp(true)\""
  40                  "\naccc=\"ak;od(cup(true)pkofn(1)cbio(pbioc(<>)pbioh(<>)));odel(true);oe(true)\""
  41                  "SAC object for deleting item added by default\n",
  42                  "Manipulate keychain items.")
  43
  44 SECURITY_COMMAND("policy-dryrun", policy_dryrun,
  45                  "",
  46                  "Try to evaluate policy old/new.")
  47
  48 SECURITY_COMMAND("keychain-item-digest", keychain_item_digest,
  49                  "itemClass keychainAccessGroup\n"
  50                  "Dump items reported by _SecItemDigest command\n",
  51                  "Show keychain item digest.")
  52
  53 SECURITY_COMMAND_IOS("add-certificates", keychain_add_certificates,
  54                  "[-k keychain] file...\n"
  55                  "If no keychains is specified the certificates are added to the default keychain.\n"
  56                  "\tadd-certificates -t file...\n"
  57                  "Add the specified certificates to the users TrustSettings.sqlite3 database.",
  58                  "Add certificates to the keychain.")
  59
  60 SECURITY_COMMAND_IOS("show-certificates", keychain_show_certificates,
  61                  "[-p][-s][-t] file...\n"
  62                  "[-k][-p][-s][-v][-t][-f][-q attr=value,...] [attr=value,...]\n"
  63                  "    -k Show all certificates in keychain.\n"
  64                  "    -q Query for certificates matching (implies -k)\n"
  65                  "    -p Output cert in PEM format.\n"
  66                  "    -f Show fingerprint (SHA1 digest of octects inside the public key bit string.)\n"
  67                  "    -s Show subject.\n"
  68                  "    -v Show entire certificate in text form.\n"
  69                  "    -t Evaluate trust.",
  70                  "Display certificates in human readable form.")
  71
  72 SECURITY_COMMAND("find-internet-password", keychain_find_internet_password,
  73                  "[-a accountName] [-d securityDomain] [-g] [-p path] [-P port] [-r protocol] [-s serverName] [-t authenticationType] [keychain...]\n"
  74                  "    -a Match on \"accountName\" when searching.\n"
  75                  "    -d Match on \"securityDomain\" when searching.\n"
  76                  "    -g Display the password for the item found.\n"
  77                  "    -p Match on \"path\" when searching.\n"
  78                  "    -P Match on \"port\" when searching.\n"
  79                  "    -r Match on \"protocol\" when searching.\n"
  80                  "    -s Match on \"serverName\" when searching.\n"
  81                  "    -t Match on \"authenticationType\" when searching.\n"
  82                  USE_SECURITY_ITEM
  83                  "If no keychains are specified the default search list is used.",
  84                  "Find an internet password item.")
  85
  86 SECURITY_COMMAND("find-generic-password", keychain_find_generic_password,
  87                  "[-a accountName] [-s serviceName] [keychain...]\n"
  88                  "    -a Match on \"accountName\" when searching.\n"
  89                  "    -g Display the password for the item found.\n"
  90                  "    -s Match on \"serviceName\" when searching.\n"
  91                  "If no keychains are specified the default search list is used.",
  92                  "Find a generic password item.")
  93
  94 SECURITY_COMMAND("delete-internet-password", keychain_delete_internet_password,
  95                  "[-a accountName] [-d securityDomain] [-g] [-p path] [-P port] [-r protocol] [-s serverName] [-t authenticationType] [keychain...]\n"
  96                  "    -a Match on \"accountName\" when searching.\n"
  97                  "    -d Match on \"securityDomain\" when searching.\n"
  98                  "    -g Display the password for the item found.\n"
  99                  "    -p Match on \"path\" when searching.\n"
 100                  "    -P Match on \"port\" when searching.\n"
 101                  "    -r Match on \"protocol\" when searching.\n"
 102                  "    -s Match on \"serverName\" when searching.\n"
 103                  "    -t Match on \"authenticationType\" when searching.\n"
 104                  USE_SECURITY_ITEM
 105                  "If no keychains are specified the default search list is used.",
 106                  "Delete one or more internet password items.")
 107
 108 SECURITY_COMMAND("delete-generic-password", keychain_delete_generic_password,
 109                  "[-a accountName] [-s serviceName] [keychain...]\n"
 110                  "    -a Match on \"accountName\" when searching.\n"
 111                  "    -g Display the password for the item found.\n"
 112                  "    -s Match on \"serviceName\" when searching.\n"
 113                  USE_SECURITY_ITEM
 114                  "If no keychains are specified the default search list is used.",
 115                  "Delete one or more generic password items.")
 116
 117 SECURITY_COMMAND_IOS("keychain-export", keychain_export,
 118                  "-k <keybag> [-p password ] <plist>\n"
 119                  "    <keybag>   keybag file name. (Can be created with keystorectl)\n"
 120                  "    <password> backup password (optional)\n"
 121                  "    <plist>    backup plist file\n",
 122                  "Export keychain to a plist file.")
 123
 124 SECURITY_COMMAND_IOS("keychain-import", keychain_import,
 125                  "-k <keybag> [-p <password> ] <plist>\n"
 126                  "    <keybag>   keybag file name. (Can be created with keystorectl)\n"
 127                  "    <password> backup password (optional)\n"
 128                  "    <plist>    backup plist file\n",
 129                  "Import keychain from a plist file.")
 130
 131 SECURITY_COMMAND_IOS("pkcs12", pkcs12_util,
 132                  "[options] -p <password> file\n"
 133                  "  -d           delete identity\n",
 134                  "Manipulate pkcs12 blobs.")
 135
 136 SECURITY_COMMAND_IOS("scep", command_scep,
 137                  "[options] <url>\n"
 138                  "   -b keysize      Keysize in bits.\n"
 139                  "   -u usage        Key usage bitmask in decimal (Digital Signature = 1, Key Encipherment = 4).\n"
 140                  "   -c challenge    Challenge password.\n"
 141                  "   -n name         Service instance name (required for MS SCEP).\n"
 142                  "   -v              Verbose.\n"
 143                  "   -x              Turn cert validation off.\n"
 144                  "   -s subject      Subject to request (O=Apple,CN=iPhone).\n"
 145                  "   -h subjaltname  SubjectAlternateName (foo.com).\n"
 146                  "   -o capabilities Override capabilities GetCACaps returns (POSTPKIOperation,SHA-1,DES3)\n",
 147                  "Certify a public key using a SCEP server")
 148
 149 SECURITY_COMMAND_IOS("codesign", codesign_util,
 150                  "[options] <file>\n",
 151                  "Verify code signature blob in binary.")
 152
 153 SECURITY_COMMAND_IOS("enroll-secure-profile", command_spc,
 154                  "[options] <file>\n",
 155                  "Enroll in secure profile service.")
 156
 157 SECURITY_COMMAND_IOS("keys-need-update", keychain_roll_keys,
 158                      "[options]\n"
 159                      "   -f   attempt an update.\n",
 160                      "Rotate keys.")
 161
 162 SECURITY_COMMAND("log", log_control,
 163                  "[options] [scope_list]\n"
 164                  "   -l              list current settings.\n"
 165                  "   -s scope_list   set log scopes to scope_list.\n"
 166                  "   -c scope_list   set log scopes to scope_list for all devices in circle.\n",
 167                  "control logging settings")
 168
 169 SECURITY_COMMAND_IOS("verify-cert", verify_cert,
 170                  "[options]\n"
 171                  "   -c certFile     Certificate to verify. Can be specified multiple times.\n"
 172                  "   -r rootCertFile Root Certificate. Can be specified multiple times.\n"
 173                  "   -p policy       Verify policy (basic, ssl, smime, eap, IPSec, appleID,\n"
 174                  "                   codeSign, timestamp, revocation).\n"
 175                  "   -C              Set client policy to true. Default is server policy. (ssl, IPSec, eap)\n"
 176                  "   -d date         Set date and time to use when verifying certificate,\n"
 177                  "                   provided in the form of YYYY-MM-DD-hh:mm:ss (time optional) in GMT.\n"
 178                  "                   e.g: 2016-04-25-15:59:59 for April 25, 2016 at 3:59:59 pm in GMT\n"
 179                  "   -L              Local certs only.\n"
 180                  "   -n name         Name to be verified. (ssl, IPSec, smime)\n"
 181                  "   -q              Quiet.\n"
 182                  "   -R revOption    Perform revocation checking with one of the following options:\n"
 183                  "                       ocsp     Check revocation status using OCSP method.\n"
 184                  "                       require  Require a positive response for successful verification.\n"
 185                  "                       offline  Consult cached responses only (no network requests).\n"
 186                  "                   Can be specified multiple times; e.g. to check revocation via OCSP\n"
 187                  "                   and require a positive response, use \"-R ocsp -R require\".\n",
 188                  "Verify certificate(s).")
 189
 190 SECURITY_COMMAND_IOS("trust-store", trust_store_show_certificates,
 191                  "[-p][-f][-s][-v][-t][-k]\n"
 192                  "    -p Output cert in PEM format.\n"
 193                  "    -f Show fingerprint (SHA1 digest certificate.)\n"
 194                  "    -s Show subject.\n"
 195                  "    -v Show entire certificate in text form.\n"
 196                  "    -t Show trust settings for certificates.\n"
 197                  "    -k Show keyid (SHA1 digest of public key)",
 198                  "Display user trust store certificates and trust settings.")
 199
 200 SECURITY_COMMAND("check-trust-update", check_trust_update,
 201                  "[-s][-e]\n"
 202                  "    -s Check for Supplementals (Pinning DB and Trusted CT Logs) update\n"
 203                  "    -e Check for SecExperiment update\n",
 204                  "Check for data updates for trust and return current version.")
 205
 206 SECURITY_COMMAND("add-ct-exceptions", add_ct_exceptions,
 207                  "[options]\n"
 208                  "   -d domain  Domain to add. Can be specified multiple times.\n"
 209                  "   -c cert    Cert to add. Can be specified multiple times.\n"
 210                  "   -p plist   plist with exceptions to set (resetting existing).\n"
 211                  "                 Overrides -d and -c\n"
 212                  "                 For detailed specification, see SecTrustSettingsPriv.h.\n"
 213                  "   -r which   Reset exceptions for \"domain\", \"cert\", or \"all\".\n"
 214                  "                 Overrides -d, -c, and -p\n",
 215                  "Set exceptions for Certificate Transparency enforcement")
 216
 217 SECURITY_COMMAND("show-ct-exceptions", show_ct_exceptions,
 218                  "[options]\n"
 219                  "   -a             Output all combined CT exceptions.\n"
 220                  "   -i identifier  Output CT exceptions for specified identifier.\n"
 221                  "                      Default is exceptions for this tool. Overridden by -a.\n"
 222                  "   -d             Output domain exceptions. Default is both domains and certs.\n"
 223                  "   -c             Output certificate exceptions (as SPKI hash).\n"
 224                  "                      Default is both domains and certs.\n",
 225                  "Display exceptions for Certificate Transparency enforcement in json.")