2 * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
4 * The contents of this file constitute Original Code as defined in and are
5 * subject to the Apple Public Source License Version 1.2 (the 'License').
6 * You may not use this file except in compliance with the License. Please obtain
7 * a copy of the License at http://www.apple.com/publicsource and read it before
10 * This Original Code and all software distributed under the License are
11 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
12 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
13 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
14 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
15 * specific language governing rights and limitations under the License.
20 // process - track a single client process and its belongings
25 #include "securityserver.h"
26 #include "SecurityAgentClient.h"
27 #include <Security/refcount.h>
29 #include "codesigdb.h"
30 #include "notifications.h"
33 using MachPlusPlus::Port
;
34 using MachPlusPlus::TaskPort
;
37 class AuthorizationToken
;
41 // A Process object represents a UNIX process (and associated Mach Task) that has
42 // had contact with us and may have some state associated with it.
44 class Process
: public CodeSignatures::Identity
{
46 Process(Port servicePort
, TaskPort tPort
,
47 const ClientSetupInfo
*info
, const char *identity
,
48 uid_t uid
, gid_t gid
);
51 uid_t
uid() const { return mUid
; }
52 gid_t
gid() const { return mGid
; }
53 pid_t
pid() const { return mPid
; }
54 TaskPort
taskPort() const { return mTaskPort
; }
55 bool byteFlipped() const { return mByteFlipped
; }
57 CodeSigning::OSXCode
*clientCode() const { return (mClientIdent
== unknown
) ? NULL
: mClientCode
; }
59 void addAuthorization(AuthorizationToken
*auth
);
60 void checkAuthorization(AuthorizationToken
*auth
);
61 bool removeAuthorization(AuthorizationToken
*auth
);
63 void beginConnection(Connection
&);
64 bool endConnection(Connection
&);
65 bool kill(bool keepTaskPort
= false);
67 void addDatabase(Database
*database
);
68 void removeDatabase(Database
*database
);
70 void requestNotifications(Port port
, Listener::Domain domain
, Listener::EventMask events
);
71 void stopNotifications(Port port
);
72 void postNotification(Listener::Domain domain
, Listener::Event event
, const CssmData
&data
);
76 // aclSequence is taken to serialize ACL validations to pick up mutual changes
80 std::string
getPath() const;
81 const CssmData
getHash(CodeSigning::OSXSigner
&signer
) const;
84 Mutex mLock
; // object lock
85 uint32 mBusyCount
; // number of Connection references
86 bool mDying
; // process is dead; waiting for Connections to drain
88 // peer state: established during connection startup; fixed thereafter
89 TaskPort mTaskPort
; // task port
90 bool mByteFlipped
; // client's byte order is reverse of ours
91 pid_t mPid
; // process id
92 uid_t mUid
; // UNIX uid credential
93 gid_t mGid
; // primary UNIX gid credential
95 RefPointer
<CodeSigning::OSXCode
> mClientCode
; // code object for client (NULL if unknown)
96 mutable enum { deferred
, known
, unknown
} mClientIdent
; // state of client identity
97 mutable auto_ptr
<CodeSigning::Signature
> mCachedSignature
; // cached signature (if already known)
99 // authorization dictionary
100 typedef multiset
<AuthorizationToken
*> AuthorizationSet
;
101 AuthorizationSet mAuthorizations
; // set of valid authorizations for process
103 // database dictionary
104 typedef set
<Database
*> DatabaseSet
;
105 DatabaseSet mDatabases
; // set of valid database handles