]> git.saurik.com Git - apple/security.git/blob - SecurityServer/process.h
Security-177.tar.gz
[apple/security.git] / SecurityServer / process.h
1 /*
2 * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
3 *
4 * The contents of this file constitute Original Code as defined in and are
5 * subject to the Apple Public Source License Version 1.2 (the 'License').
6 * You may not use this file except in compliance with the License. Please obtain
7 * a copy of the License at http://www.apple.com/publicsource and read it before
8 * using this file.
9 *
10 * This Original Code and all software distributed under the License are
11 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
12 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
13 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
14 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
15 * specific language governing rights and limitations under the License.
16 */
17
18
19 //
20 // process - track a single client process and its belongings
21 //
22 #ifndef _H_PROCESS
23 #define _H_PROCESS
24
25 #include "securityserver.h"
26 #include "SecurityAgentClient.h"
27 #include <Security/refcount.h>
28 #include "key.h"
29 #include "codesigdb.h"
30 #include "notifications.h"
31 #include <string>
32
33 using MachPlusPlus::Port;
34 using MachPlusPlus::TaskPort;
35
36 class Session;
37 class AuthorizationToken;
38
39
40 //
41 // A Process object represents a UNIX process (and associated Mach Task) that has
42 // had contact with us and may have some state associated with it.
43 //
44 class Process : public CodeSignatures::Identity {
45 public:
46 Process(Port servicePort, TaskPort tPort,
47 const ClientSetupInfo *info, const char *identity,
48 uid_t uid, gid_t gid);
49 virtual ~Process();
50
51 uid_t uid() const { return mUid; }
52 gid_t gid() const { return mGid; }
53 pid_t pid() const { return mPid; }
54 TaskPort taskPort() const { return mTaskPort; }
55 bool byteFlipped() const { return mByteFlipped; }
56
57 CodeSigning::OSXCode *clientCode() const { return (mClientIdent == unknown) ? NULL : mClientCode; }
58
59 void addAuthorization(AuthorizationToken *auth);
60 void checkAuthorization(AuthorizationToken *auth);
61 bool removeAuthorization(AuthorizationToken *auth);
62
63 void beginConnection(Connection &);
64 bool endConnection(Connection &);
65 bool kill(bool keepTaskPort = false);
66
67 void addDatabase(Database *database);
68 void removeDatabase(Database *database);
69
70 void requestNotifications(Port port, Listener::Domain domain, Listener::EventMask events);
71 void stopNotifications(Port port);
72 void postNotification(Listener::Domain domain, Listener::Event event, const CssmData &data);
73
74 Session &session;
75
76 // aclSequence is taken to serialize ACL validations to pick up mutual changes
77 Mutex aclSequence;
78
79 protected:
80 std::string getPath() const;
81 const CssmData getHash(CodeSigning::OSXSigner &signer) const;
82
83 private:
84 Mutex mLock; // object lock
85 uint32 mBusyCount; // number of Connection references
86 bool mDying; // process is dead; waiting for Connections to drain
87
88 // peer state: established during connection startup; fixed thereafter
89 TaskPort mTaskPort; // task port
90 bool mByteFlipped; // client's byte order is reverse of ours
91 pid_t mPid; // process id
92 uid_t mUid; // UNIX uid credential
93 gid_t mGid; // primary UNIX gid credential
94
95 RefPointer<CodeSigning::OSXCode> mClientCode; // code object for client (NULL if unknown)
96 mutable enum { deferred, known, unknown } mClientIdent; // state of client identity
97 mutable auto_ptr<CodeSigning::Signature> mCachedSignature; // cached signature (if already known)
98
99 // authorization dictionary
100 typedef multiset<AuthorizationToken *> AuthorizationSet;
101 AuthorizationSet mAuthorizations; // set of valid authorizations for process
102
103 // database dictionary
104 typedef set<Database *> DatabaseSet;
105 DatabaseSet mDatabases; // set of valid database handles
106 };
107
108
109 #endif //_H_PROCESS