secdxctests/KeychainAppClipTests.m

   1 /*
   2  * Copyright (c) 2020 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <Security/Security.h>
  25 #import <Security/SecItemPriv.h>
  26 #include <Security/SecEntitlements.h>
  27 #include <ipc/server_security_helpers.h>
  28
  29 #import "KeychainXCTest.h"
  30
  31 #if USE_KEYSTORE
  32 @interface KeychainAppClipTests : KeychainXCTest
  33 @end
  34
  35 @implementation KeychainAppClipTests {
  36     // App Clips are only permitted to store items with agrp == appID, so we set and track it
  37     NSString* _applicationIdentifier;
  38 }
  39
  40 + (void)setUp {
  41     [super setUp];
  42 }
  43
  44 - (void)setUp {
  45     [super setUp];
  46     SecSecurityClientAppClipToRegular();
  47     _applicationIdentifier = @"com.apple.security.appcliptests";
  48     SecSecurityClientSetApplicationIdentifier((__bridge CFStringRef)_applicationIdentifier);
  49 }
  50
  51 + (void)tearDown {
  52     SecSecurityClientAppClipToRegular();
  53     SecSecurityClientSetApplicationIdentifier(NULL);
  54     [super tearDown];
  55 }
  56
  57 # pragma mark - Test App Clip API Restrictions (SecItemAdd)
  58
  59 - (void)testAppclipCanAddItem {
  60     SecSecurityClientRegularToAppClip();
  61     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
  62     NSDictionary* query = @{
  63         (id)kSecClass : (id)kSecClassGenericPassword,
  64         (id)kSecAttrService : @"AppClipTestService",
  65         (id)kSecUseDataProtectionKeychain : @YES,
  66         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
  67     };
  68     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
  69     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
  70 }
  71
  72 - (void)testAppClipAddNoSyncAllowed {
  73     SecSecurityClientRegularToAppClip();
  74     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
  75     NSDictionary* query = @{
  76         (id)kSecClass : (id)kSecClassGenericPassword,
  77         (id)kSecAttrService : @"AppClipTestService",
  78         (id)kSecUseDataProtectionKeychain : @YES,
  79         (id)kSecAttrSynchronizable : @YES,
  80         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
  81     };
  82     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecRestrictedAPI);
  83     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
  84 }
  85
  86 - (void)testAppClipAddNoAgrpAllowed {
  87     SecSecurityClientRegularToAppClip();
  88     // By not explicitly setting entitlements we get the default set which is not permitted for an app clip
  89     NSDictionary* query = @{
  90         (id)kSecClass : (id)kSecClassGenericPassword,
  91         (id)kSecUseDataProtectionKeychain : @YES,
  92         (id)kSecAttrService : @"AppClipTestService",
  93         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
  94     };
  95     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecRestrictedAPI);
  96
  97     SecSecurityClientAppClipToRegular();
  98     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
  99 }
 100
 101 # pragma mark - Test App Clip API Restrictions (SecItemUpdate)
 102
 103 - (void)testAppClipCanUpdateItem {
 104     SecSecurityClientRegularToAppClip();
 105     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 106     NSMutableDictionary* query = [@{
 107         (id)kSecClass : (id)kSecClassGenericPassword,
 108         (id)kSecAttrService : @"AppClipTestService",
 109         (id)kSecUseDataProtectionKeychain : @YES,
 110         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 111     } mutableCopy];
 112     SecItemAdd((__bridge CFDictionaryRef)query, NULL);
 113
 114     NSDictionary* update = @{
 115         (id)kSecValueData : [@"different" dataUsingEncoding:NSUTF8StringEncoding],
 116         (id)kSecAttrService : @"DifferentAppClipTestService",
 117     };
 118
 119     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)update), errSecSuccess);
 120     query[(id)kSecAttrService] = @"DifferentAppClipTestService";
 121     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 122 }
 123
 124 - (void)testAppClipUpdateNoSyncAllowed {
 125     SecSecurityClientRegularToAppClip();
 126     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 127     NSMutableDictionary* query = [@{
 128         (id)kSecClass : (id)kSecClassGenericPassword,
 129         (id)kSecAttrService : @"AppClipTestService",
 130         (id)kSecUseDataProtectionKeychain : @YES,
 131         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 132     } mutableCopy];
 133     SecItemAdd((__bridge CFDictionaryRef)query, NULL);
 134
 135     NSDictionary* update = @{
 136         (id)kSecValueData : [@"different" dataUsingEncoding:NSUTF8StringEncoding],
 137         (id)kSecAttrSynchronizable : @YES,
 138     };
 139
 140     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)update), errSecRestrictedAPI);
 141     query[(id)kSecAttrSynchronizable] = @YES;
 142     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
 143 }
 144
 145 - (void)testAppClipUpdateNoAgrpAllowed {
 146     SecSecurityClientRegularToAppClip();
 147     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 148     NSMutableDictionary* query = [@{
 149         (id)kSecClass : (id)kSecClassGenericPassword,
 150         (id)kSecAttrService : @"AppClipTestService",
 151         (id)kSecUseDataProtectionKeychain : @YES,
 152         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 153     } mutableCopy];
 154     SecItemAdd((__bridge CFDictionaryRef)query, NULL);
 155
 156     NSDictionary* update = @{
 157         (id)kSecValueData : [@"different" dataUsingEncoding:NSUTF8StringEncoding],
 158         (id)kSecAttrAccessGroup : @"someotheraccessgroup",
 159     };
 160
 161     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)update), errSecMissingEntitlement);
 162     query[(id)kSecAttrAccessGroup] = @"someotheraccessgroup";
 163     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecMissingEntitlement);
 164 }
 165
 166 # pragma mark - Test App Clip API Restrictions (SecItemCopyMatching)
 167 // For now SICM doesn't care about sync, because there shouldn't be any items where (clip == 1 && sync == 1)
 168
 169 - (void)testAppClipCopyMatchingNoAgrpsAllowed {
 170     SecSecurityClientRegularToAppClip();
 171
 172     NSDictionary* query = @{
 173         (id)kSecClass : (id)kSecClassGenericPassword,
 174         (id)kSecAttrService : @"AppClipTestService",
 175         (id)kSecUseDataProtectionKeychain : @YES,
 176         (id)kSecReturnAttributes : @YES,
 177     };
 178
 179     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecRestrictedAPI);
 180     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 181     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
 182 }
 183
 184 # pragma mark - Test App Clip API Restrictions (SecItemDelete)
 185
 186 - (void)testAppClipDeleteNoAgrpsAllowed {
 187     NSDictionary* query = @{
 188         (id)kSecClass : (id)kSecClassGenericPassword,
 189         (id)kSecAttrService : @"AppClipTestService",
 190         (id)kSecUseDataProtectionKeychain : @YES,
 191     };
 192
 193     XCTAssertEqual(SecItemDelete((__bridge CFDictionaryRef)query), errSecItemNotFound);
 194     SecSecurityClientRegularToAppClip();
 195     XCTAssertEqual(SecItemDelete((__bridge CFDictionaryRef)query), errSecRestrictedAPI);
 196 }
 197
 198 # pragma mark - Test App Clip API Restrictions (Misc)
 199
 200 - (void)testAppClipNoSecItemUpdateTokenItemsAllowed {
 201     SecSecurityClientRegularToAppClip();
 202     // Don't bother setting it up, app clips aren't even welcome at the door.
 203     XCTAssertEqual(SecItemUpdateTokenItemsForAccessGroups(NULL, (__bridge CFArrayRef)@[(id)kSecAttrAccessGroupToken], NULL), errSecRestrictedAPI);
 204 }
 205
 206 - (void)testAppClipCanPassAppIDAccessGroup {
 207     SecSecurityClientRegularToAppClip();
 208     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 209
 210     NSMutableDictionary* query = [@{
 211         (id)kSecClass : (id)kSecClassGenericPassword,
 212         (id)kSecAttrService : @"AppClipTestService",
 213         (id)kSecUseDataProtectionKeychain : @YES,
 214         (id)kSecReturnAttributes : @YES,
 215         (id)kSecAttrAccessGroup : _applicationIdentifier,
 216         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 217     } mutableCopy];
 218
 219     NSDictionary* update = @{
 220         (id)kSecValueData : [@"betterpassword" dataUsingEncoding:NSUTF8StringEncoding],
 221     };
 222
 223     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 224     query[(id)kSecValueData] = nil;
 225     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 226     query[(id)kSecReturnAttributes] = nil;
 227     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)update), errSecSuccess);
 228     XCTAssertEqual(SecItemDelete((__bridge CFDictionaryRef)query), errSecSuccess);
 229 }
 230
 231 # pragma mark - Test Item Deletion SPI
 232
 233 - (void)testDeletionSPINoEntitlement {
 234     XCTAssertEqual(SecItemDeleteKeychainItemsForAppClip((__bridge CFStringRef)@"nonexistent"), errSecMissingEntitlement);
 235 }
 236
 237 - (void)testDeletionSPINoItems {
 238     SecAddLocalSecuritydXPCFakeEntitlement(kSecEntitlementPrivateAppClipDeletion, kCFBooleanTrue);
 239     XCTAssertEqual(SecItemDeleteKeychainItemsForAppClip((__bridge CFStringRef)@"nonexistent"), errSecSuccess);
 240 }
 241
 242 - (void)testDeletionSPIDeleteAppClipItem {
 243     // The SPI does not check if app clip, and the API does not check private entitlement
 244     SecSecurityClientRegularToAppClip();
 245     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 246     SecAddLocalSecuritydXPCFakeEntitlement(kSecEntitlementPrivateAppClipDeletion, kCFBooleanTrue);
 247
 248     NSDictionary* query = @{
 249         (id)kSecClass : (id)kSecClassGenericPassword,
 250         (id)kSecUseDataProtectionKeychain : @YES,
 251         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 252         (id)kSecReturnAttributes : @YES,
 253     };
 254
 255     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 256     XCTAssertEqual(SecItemDeleteKeychainItemsForAppClip((__bridge CFStringRef)_applicationIdentifier), errSecSuccess);
 257     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
 258 }
 259
 260 - (void)testDeletionSPILeaveRegularItemsAlone {
 261     SecAddLocalSecuritydXPCFakeEntitlement(kSecEntitlementPrivateAppClipDeletion, kCFBooleanTrue);
 262     NSString* agrp = @"com.apple.keychain.test.notanappclip";
 263     [self setEntitlements:@{ @"keychain-access-groups": @[agrp] } validated:YES];
 264
 265     NSDictionary* query = @{
 266         (id)kSecClass : (id)kSecClassGenericPassword,
 267         (id)kSecUseDataProtectionKeychain : @YES,
 268         (id)kSecAttrAccessGroup : agrp,
 269         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding]
 270     };
 271
 272     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 273     XCTAssertEqual(SecItemDeleteKeychainItemsForAppClip((__bridge CFStringRef)agrp), errSecSuccess);
 274     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 275 }
 276
 277 - (void)testDeletionSPILeaveOtherAppClipItemsAlone {
 278     SecSecurityClientRegularToAppClip();
 279     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 280     NSString* otherAppID = @"not-the-same-application-identifier";
 281     SecAddLocalSecuritydXPCFakeEntitlement(kSecEntitlementPrivateAppClipDeletion, kCFBooleanTrue);
 282
 283     NSDictionary* query = @{
 284         (id)kSecClass : (id)kSecClassGenericPassword,
 285         (id)kSecUseDataProtectionKeychain : @YES,
 286         (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 287         (id)kSecReturnAttributes : @YES,
 288     };
 289     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 290
 291     [self setEntitlements:@{@"com.apple.application-identifier" : otherAppID} validated:YES];
 292     SecSecurityClientSetApplicationIdentifier((__bridge CFStringRef)otherAppID);
 293     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 294
 295     XCTAssertEqual(SecItemDeleteKeychainItemsForAppClip((__bridge CFStringRef)_applicationIdentifier), errSecSuccess);
 296     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecSuccess);
 297
 298     [self setEntitlements:@{@"com.apple.application-identifier" : _applicationIdentifier} validated:YES];
 299     SecSecurityClientSetApplicationIdentifier((__bridge CFStringRef)_applicationIdentifier);
 300     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)query, NULL), errSecItemNotFound);
 301 }
 302
 303 @end
 304 #endif