OSX/sec/Security/SecAccessControl.m

   1 /*
   2  * Copyright (c) 2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * SecAccessControl.m - CoreFoundation based access control object
  26  */
  27
  28 #include <TargetConditionals.h>
  29 #include <AssertMacros.h>
  30 #include "SecAccessControl.h"
  31 #include "SecAccessControlPriv.h"
  32 #include "SecItem.h"
  33 #include "SecItemPriv.h"
  34 #include <utilities/SecCFWrappers.h>
  35 #include <utilities/SecCFError.h>
  36 #include <utilities/der_plist.h>
  37 #include <libaks_acl_cf_keys.h>
  38 #include <ACMDefs.h>
  39 #include <ACMAclDefs.h>
  40
  41 static CFTypeRef kSecAccessControlKeyProtection = CFSTR("prot");
  42 static CFTypeRef kSecAccessControlKeyBound = CFSTR("bound");
  43
  44 struct __SecAccessControl {
  45     CFRuntimeBase _base;
  46     CFMutableDictionaryRef dict;
  47 };
  48
  49 static SecAccessConstraintRef SecAccessConstraintCreateValueOfKofN(CFAllocatorRef allocator, size_t numRequired, CFArrayRef constraints, CFErrorRef *error);
  50
  51 static void dumpValue(id value, NSMutableString *target, NSString *separator) {
  52     if (value == nil) {
  53         // Do nothing.
  54     } else if (CFGetTypeID((__bridge CFTypeRef)value) == CFBooleanGetTypeID()) {
  55         [target appendString:[value boolValue] ? @"true" : @"false"];
  56     } else if ([value isKindOfClass:NSNumber.class]) {
  57         [target appendString:[value string]];
  58     } else if ([value isKindOfClass:NSString.class]) {
  59         [target appendString:value];
  60     } else if ([value isKindOfClass:NSDictionary.class]) {
  61         [value enumerateKeysAndObjectsUsingBlock:^(id  _Nonnull key, id  _Nonnull obj, BOOL * _Nonnull stop) {
  62             [target appendString:separator];
  63             dumpValue(key, target, @"");
  64             [target appendString:@"("];
  65             dumpValue(obj, target, @"");
  66             [target appendString:@")"];
  67         }];
  68     }
  69 }
  70
  71 static CFStringRef SecAccessControlCopyFormatDescription(CFTypeRef cf, CFDictionaryRef formatOptions) {
  72     SecAccessControlRef access_control = (SecAccessControlRef)cf;
  73     NSDictionary *contents = (__bridge NSDictionary *)access_control->dict;
  74     NSMutableString *dump = [NSMutableString string];
  75     dumpValue(contents[(__bridge id)kSecAccessControlKeyProtection], dump, @"");
  76     dumpValue(contents[(__bridge id)kAKSKeyAcl], dump, @";");
  77     return CFBridgingRetain([NSString stringWithFormat:@"<SecAccessControlRef: %@>", dump]);
  78 }
  79
  80 static Boolean SecAccessControlCompare(CFTypeRef lhs, CFTypeRef rhs) {
  81     SecAccessControlRef laccess_control = (SecAccessControlRef)lhs;
  82     SecAccessControlRef raccess_control = (SecAccessControlRef)rhs;
  83     return (laccess_control == raccess_control) || CFEqual(laccess_control->dict, raccess_control->dict);
  84 }
  85
  86 static void SecAccessControlDestroy(CFTypeRef cf) {
  87     SecAccessControlRef access_control = (SecAccessControlRef)cf;
  88     CFReleaseSafe(access_control->dict);
  89 }
  90
  91 CFGiblisWithCompareFor(SecAccessControl);
  92
  93 static CFMutableDictionaryRef SecAccessControlGetMutableConstraints(SecAccessControlRef access_control) {
  94     CFMutableDictionaryRef constraints = (CFMutableDictionaryRef)CFDictionaryGetValue(access_control->dict, kAKSKeyAcl);
  95
  96     if (!constraints) {
  97         CFMutableDictionaryRef newConstraints = CFDictionaryCreateMutableForCFTypes(CFGetAllocator(access_control));
  98         CFDictionarySetValue(access_control->dict, kAKSKeyAcl, newConstraints);
  99         CFRelease(newConstraints);
 100
 101         constraints = (CFMutableDictionaryRef)CFDictionaryGetValue(access_control->dict, kAKSKeyAcl);
 102     }
 103
 104     return constraints;
 105 }
 106
 107 SecAccessControlRef SecAccessControlCreate(CFAllocatorRef allocator, CFErrorRef *error) {
 108     SecAccessControlRef access_control = CFTypeAllocate(SecAccessControl, struct __SecAccessControl, allocator);
 109         if (!access_control) {
 110         SecError(errSecAllocate, error, CFSTR("allocate memory for SecAccessControl"));
 111         return NULL;
 112     }
 113
 114     access_control->dict = CFDictionaryCreateMutableForCFTypes(allocator);
 115     return access_control;
 116 }
 117
 118 static CFDataRef _getEmptyData() {
 119     static CFMutableDataRef emptyData = NULL;
 120     static dispatch_once_t onceToken;
 121
 122     dispatch_once(&onceToken, ^{
 123         emptyData = CFDataCreateMutable(kCFAllocatorDefault, 0);
 124     });
 125
 126     return emptyData;
 127 }
 128
 129 SecAccessControlRef SecAccessControlCreateWithFlags(CFAllocatorRef allocator, CFTypeRef protection,
 130                                                     SecAccessControlCreateFlags flags, CFErrorRef *error) {
 131     SecAccessControlRef access_control = NULL;
 132     CFTypeRef constraint = NULL;
 133     CFMutableArrayRef constraints = NULL;
 134
 135     require_quiet(access_control = SecAccessControlCreate(allocator, error), errOut);
 136
 137     if (!SecAccessControlSetProtection(access_control, protection, error))
 138         goto errOut;
 139
 140     if (flags) {
 141         bool or = (flags & kSecAccessControlOr) ? true : false;
 142         bool and = (flags & kSecAccessControlAnd) ? true : false;
 143
 144         if (or && and) {
 145             SecError(errSecParam, error, CFSTR("only one logical operation can be set"));
 146             goto errOut;
 147         }
 148
 149 #pragma clang diagnostic push
 150 #pragma clang diagnostic ignored "-Wunguarded-availability-new"
 151
 152         SecAccessControlCreateFlags maskedFlags = flags & (kSecAccessControlBiometryAny | kSecAccessControlBiometryCurrentSet);
 153         if (maskedFlags && maskedFlags != kSecAccessControlBiometryAny && maskedFlags != kSecAccessControlBiometryCurrentSet) {
 154             SecError(errSecParam, error, CFSTR("only one bio constraint can be set"));
 155             goto errOut;
 156         }
 157
 158         if (flags & kSecAccessControlUserPresence && flags & ~(kSecAccessControlUserPresence | kSecAccessControlApplicationPassword | kSecAccessControlPrivateKeyUsage)) {
 159             SecError(errSecParam, error, CFSTR("kSecAccessControlUserPresence can be combined only with kSecAccessControlApplicationPassword and kSecAccessControlPrivateKeyUsage"));
 160             goto errOut;
 161         }
 162
 163         constraints = CFArrayCreateMutable(allocator, 0, &kCFTypeArrayCallBacks);
 164
 165         if (flags & kSecAccessControlUserPresence) {
 166             require_quiet(constraint = SecAccessConstraintCreatePolicy(allocator, CFSTR(kACMPolicyDeviceOwnerAuthentication), error), errOut);
 167             CFArrayAppendValue(constraints, constraint);
 168             CFReleaseNull(constraint);
 169         }
 170
 171         if (flags & kSecAccessControlDevicePasscode) {
 172             require_quiet(constraint = SecAccessConstraintCreatePasscode(allocator), errOut);
 173             CFArrayAppendValue(constraints, constraint);
 174             CFReleaseNull(constraint);
 175         }
 176
 177         if (flags & kSecAccessControlBiometryAny) {
 178             require_quiet(constraint = SecAccessConstraintCreateBiometryAny(allocator, _getEmptyData()), errOut);
 179             CFArrayAppendValue(constraints, constraint);
 180             CFReleaseNull(constraint);
 181         }
 182
 183         if (flags & kSecAccessControlBiometryCurrentSet) {
 184             require_quiet(constraint = SecAccessConstraintCreateBiometryCurrentSet(allocator, _getEmptyData(), _getEmptyData()), errOut);
 185             CFArrayAppendValue(constraints, constraint);
 186             CFReleaseNull(constraint);
 187         }
 188
 189 #pragma clang diagnostic pop
 190
 191         if (flags & kSecAccessControlApplicationPassword) {
 192             SecAccessControlSetRequirePassword(access_control, true);
 193         }
 194
 195         CFIndex constraints_count = CFArrayGetCount(constraints);
 196         if (constraints_count > 1) {
 197             require_quiet(constraint = SecAccessConstraintCreateValueOfKofN(allocator, or?1:constraints_count, constraints, error), errOut);
 198             if (flags & kSecAccessControlPrivateKeyUsage) {
 199                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpSign, constraint, error), errOut);
 200                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpComputeKey, constraint, error), errOut);
 201                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpAttest, kCFBooleanTrue, error), errOut);
 202             }
 203             else {
 204                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDecrypt, constraint, error), errOut);
 205                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpEncrypt, kCFBooleanTrue, error), errOut);
 206             }
 207             require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDelete, kCFBooleanTrue, error), errOut);
 208             CFReleaseNull(constraint);
 209         } else if (constraints_count == 1) {
 210             if (flags & kSecAccessControlPrivateKeyUsage) {
 211                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpSign, CFArrayGetValueAtIndex(constraints, 0), error), errOut);
 212                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpComputeKey, CFArrayGetValueAtIndex(constraints, 0), error), errOut);
 213                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpAttest, kCFBooleanTrue, error), errOut);
 214             }
 215             else {
 216                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDecrypt, CFArrayGetValueAtIndex(constraints, 0), error), errOut);
 217                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpEncrypt, kCFBooleanTrue, error), errOut);
 218             }
 219             require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDelete, kCFBooleanTrue, error), errOut);
 220         } else {
 221             if (flags & kSecAccessControlPrivateKeyUsage) {
 222                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpSign, kCFBooleanTrue, error), errOut);
 223                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpComputeKey, kCFBooleanTrue, error), errOut);
 224                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpAttest, kCFBooleanTrue, error), errOut);
 225                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDelete, kCFBooleanTrue, error), errOut);
 226             }
 227             else {
 228                 require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDefaultAcl, kCFBooleanTrue, error), errOut);
 229             }
 230         }
 231
 232         CFReleaseNull(constraints);
 233     }
 234     else {
 235         require_quiet(SecAccessControlAddConstraintForOperation(access_control, kAKSKeyOpDefaultAcl, kCFBooleanTrue, error), errOut);
 236     }
 237
 238     return access_control;
 239
 240 errOut:
 241     CFReleaseSafe(access_control);
 242     CFReleaseSafe(constraints);
 243     CFReleaseSafe(constraint);
 244     return NULL;
 245 }
 246
 247 CFTypeRef SecAccessControlGetProtection(SecAccessControlRef access_control) {
 248     return CFDictionaryGetValue(access_control->dict, kSecAccessControlKeyProtection);
 249 }
 250
 251 static bool checkItemInArray(CFTypeRef item, const CFTypeRef *values, CFIndex count, CFStringRef errMessage, CFErrorRef *error) {
 252     for (CFIndex i = 0; i < count; i++) {
 253         if (CFEqualSafe(item, values[i])) {
 254             return true;
 255         }
 256     }
 257     return SecError(errSecParam, error, CFSTR("%@: %@"), errMessage, item);
 258 }
 259
 260 #define CheckItemInArray(item, values, msg) \
 261 { \
 262     const CFTypeRef vals[] = values; \
 263     if (!checkItemInArray(item, vals, sizeof(vals)/sizeof(*vals), msg, error)) { \
 264         return false; \
 265     } \
 266 }
 267
 268 #define ItemArray(...) { __VA_ARGS__ }
 269
 270
 271 bool SecAccessControlSetProtection(SecAccessControlRef access_control, CFTypeRef protection, CFErrorRef *error) {
 272     if (!protection || CFGetTypeID(protection) != CFDictionaryGetTypeID()) {
 273         // Verify protection type.
 274         CheckItemInArray(protection, ItemArray(kSecAttrAccessibleAlwaysPrivate, kSecAttrAccessibleAfterFirstUnlock,
 275                                                kSecAttrAccessibleWhenUnlocked, kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate,
 276                                                kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
 277                                                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
 278                                                kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
 279                                                kSecAttrAccessibleUntilReboot),
 280                          CFSTR("SecAccessControl: invalid protection"));
 281     }
 282
 283     // Protection valid, use it.
 284     CFDictionarySetValue(access_control->dict, kSecAccessControlKeyProtection, protection);
 285     return true;
 286 }
 287
 288 SecAccessConstraintRef SecAccessConstraintCreatePolicy(CFAllocatorRef allocator, CFTypeRef policy, CFErrorRef *error) {
 289     return CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclConstraintPolicy), policy, NULL);
 290 }
 291
 292 SecAccessConstraintRef SecAccessConstraintCreatePasscode(CFAllocatorRef allocator) {
 293     return CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclConstraintUserPasscode), kCFBooleanTrue, NULL);
 294 }
 295
 296 SecAccessConstraintRef SecAccessConstraintCreateBiometryAny(CFAllocatorRef allocator, CFDataRef catacombUUID) {
 297     CFMutableDictionaryRef bioDict = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclParamBioCatacombUUID), catacombUUID, NULL);
 298     SecAccessConstraintRef constraint = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclConstraintBio), bioDict, NULL);
 299     CFReleaseSafe(bioDict);
 300     return constraint;
 301 }
 302
 303 SecAccessConstraintRef SecAccessConstraintCreateTouchIDAny(CFAllocatorRef allocator, CFDataRef catacombUUID) {
 304     return SecAccessConstraintCreateBiometryAny(allocator, catacombUUID);
 305 }
 306
 307 SecAccessConstraintRef SecAccessConstraintCreateBiometryCurrentSet(CFAllocatorRef allocator, CFDataRef catacombUUID, CFDataRef bioDbHash) {
 308     CFMutableDictionaryRef bioDict = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclParamBioCatacombUUID), catacombUUID, NULL);
 309     CFDictionarySetValue(bioDict, CFSTR(kACMKeyAclParamBioDatabaseHash), bioDbHash);
 310     SecAccessConstraintRef constraint = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclConstraintBio), bioDict, NULL);
 311     CFReleaseSafe(bioDict);
 312     return constraint;
 313 }
 314
 315 SecAccessConstraintRef SecAccessConstraintCreateTouchIDCurrentSet(CFAllocatorRef allocator, CFDataRef catacombUUID, CFDataRef bioDbHash) {
 316     return SecAccessConstraintCreateBiometryCurrentSet(allocator, catacombUUID, bioDbHash);
 317 }
 318
 319 static SecAccessConstraintRef SecAccessConstraintCreateValueOfKofN(CFAllocatorRef allocator, size_t numRequired, CFArrayRef constraints, CFErrorRef *error) {
 320     CFNumberRef k = CFNumberCreateWithCFIndex(allocator, numRequired);
 321     CFMutableDictionaryRef kofn = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclParamKofN), k, NULL);
 322     CFRelease(k);
 323
 324     /* Populate kofn dictionary with constraint keys from the array. note that for now we just ignore any additional
 325        constraint parameters, but we might err-out if some parameter is found, since we cannot propagate parameteres
 326        into k-of-n dictionary. */
 327     const CFTypeRef keysToCopy[] = { CFSTR(kACMKeyAclConstraintBio), CFSTR(kACMKeyAclConstraintPolicy),
 328         CFSTR(kACMKeyAclConstraintUserPasscode) };
 329     SecAccessConstraintRef constraint;
 330     CFArrayForEachC(constraints, constraint) {
 331         require_quiet(isDictionary(constraint), errOut);
 332         bool found = false;
 333         for (CFIndex i = 0; i < (CFIndex)(sizeof(keysToCopy) / sizeof(keysToCopy[0])); i++) {
 334             CFTypeRef value = CFDictionaryGetValue(constraint, keysToCopy[i]);
 335             if (value) {
 336                 CFDictionarySetValue(kofn, keysToCopy[i], value);
 337                 found = true;
 338                 break;
 339             }
 340         }
 341         require_quiet(found, errOut);
 342     }
 343
 344     return kofn;
 345
 346 errOut:
 347     SecError(errSecParam, error, CFSTR("SecAccessControl: invalid constraint for k-of-n"));
 348     CFReleaseSafe(kofn);
 349     return NULL;
 350 }
 351
 352 SecAccessConstraintRef SecAccessConstraintCreateKofN(CFAllocatorRef allocator, size_t numRequired, CFArrayRef constraints, CFErrorRef *error) {
 353     SecAccessConstraintRef valueOfKofN =  SecAccessConstraintCreateValueOfKofN(allocator, numRequired, constraints, error);
 354     require_quiet(valueOfKofN, errOut);
 355
 356     SecAccessConstraintRef constraint = CFDictionaryCreateMutableForCFTypesWith(allocator, CFSTR(kACMKeyAclConstraintKofN), valueOfKofN, NULL);
 357     CFReleaseSafe(valueOfKofN);
 358     return constraint;
 359
 360 errOut:
 361     return NULL;
 362 }
 363
 364 bool SecAccessControlAddConstraintForOperation(SecAccessControlRef access_control, CFTypeRef operation, CFTypeRef constraint, CFErrorRef *error) {
 365     if (!isDictionary(constraint) && !CFEqual(constraint, kCFBooleanTrue) && !CFEqual(constraint, kCFBooleanFalse) ) {
 366         return SecError(errSecParam, error, CFSTR("invalid constraint"));
 367     }
 368
 369     CFMutableDictionaryRef constraints = SecAccessControlGetMutableConstraints(access_control);
 370     CFDictionarySetValue(constraints, operation, constraint);
 371     return true;
 372 }
 373
 374 SecAccessConstraintRef SecAccessControlGetConstraint(SecAccessControlRef access_control, CFTypeRef operation) {
 375     CFMutableDictionaryRef ops = (CFMutableDictionaryRef)CFDictionaryGetValue(access_control->dict, kAKSKeyAcl);
 376     if (!ops || CFDictionaryGetCount(ops) == 0)
 377         // No ACL is present, this means that everything is allowed.
 378         return kCFBooleanTrue;
 379
 380     SecAccessConstraintRef constraint = CFDictionaryGetValue(ops, operation);
 381     if (!constraint) {
 382         constraint = CFDictionaryGetValue(ops, kAKSKeyOpDefaultAcl);
 383     }
 384     return constraint;
 385 }
 386
 387 CFDataRef SecAccessControlCopyConstraintData(SecAccessControlRef access_control, CFTypeRef operation) {
 388     SecAccessConstraintRef constraint = SecAccessControlGetConstraint(access_control, operation);
 389
 390     size_t len = der_sizeof_plist(constraint, NULL);
 391     CFMutableDataRef encoded = CFDataCreateMutable(0, len);
 392     CFDataSetLength(encoded, len);
 393     uint8_t *der_end = CFDataGetMutableBytePtr(encoded);
 394     const uint8_t *der = der_end;
 395     der_end += len;
 396     der_end = der_encode_plist(constraint, NULL, der, der_end);
 397     if (!der_end) {
 398         CFReleaseNull(encoded);
 399     }
 400     return encoded;
 401 }
 402
 403 CFDictionaryRef SecAccessControlGetConstraints(SecAccessControlRef access_control) {
 404     return CFDictionaryGetValue(access_control->dict, kAKSKeyAcl);
 405 }
 406
 407 void SecAccessControlSetConstraints(SecAccessControlRef access_control, CFDictionaryRef constraints) {
 408     CFMutableDictionaryRef mutableConstraints = CFDictionaryCreateMutableCopy(CFGetAllocator(access_control), 0, constraints);
 409     CFDictionarySetValue(access_control->dict, kAKSKeyAcl, mutableConstraints);
 410     CFReleaseSafe(mutableConstraints);
 411 }
 412
 413 void SecAccessControlSetRequirePassword(SecAccessControlRef access_control, bool require) {
 414     CFMutableDictionaryRef constraints = SecAccessControlGetMutableConstraints(access_control);
 415     CFDictionarySetValue(constraints, kAKSKeyAclParamRequirePasscode, require?kCFBooleanTrue:kCFBooleanFalse);
 416 }
 417
 418 bool SecAccessControlGetRequirePassword(SecAccessControlRef access_control) {
 419     CFMutableDictionaryRef acl = (CFMutableDictionaryRef)CFDictionaryGetValue(access_control->dict, kAKSKeyAcl);
 420     if (acl) {
 421         return CFEqualSafe(CFDictionaryGetValue(acl, kAKSKeyAclParamRequirePasscode), kCFBooleanTrue);
 422     }
 423
 424     return false;
 425 }
 426
 427 void SecAccessControlSetBound(SecAccessControlRef access_control, bool bound) {
 428     CFDictionarySetValue(access_control->dict, kSecAccessControlKeyBound, bound ? kCFBooleanTrue : kCFBooleanFalse);
 429 }
 430
 431 bool SecAccessControlIsBound(SecAccessControlRef access_control) {
 432     CFTypeRef bound = CFDictionaryGetValue(access_control->dict, kSecAccessControlKeyBound);
 433     return bound != NULL && CFEqualSafe(bound, kCFBooleanTrue);
 434 }
 435
 436 CFDataRef SecAccessControlCopyData(SecAccessControlRef access_control) {
 437     size_t len = der_sizeof_plist(access_control->dict, NULL);
 438     CFMutableDataRef encoded = CFDataCreateMutable(0, len);
 439     CFDataSetLength(encoded, len);
 440     uint8_t *der_end = CFDataGetMutableBytePtr(encoded);
 441     const uint8_t *der = der_end;
 442     der_end += len;
 443     der_end = der_encode_plist(access_control->dict, NULL, der, der_end);
 444     if (!der_end) {
 445         CFReleaseNull(encoded);
 446     }
 447     return encoded;
 448 }
 449
 450 SecAccessControlRef SecAccessControlCreateFromData(CFAllocatorRef allocator, CFDataRef data, CFErrorRef *error) {
 451     SecAccessControlRef access_control;
 452     require_quiet(access_control = SecAccessControlCreate(allocator, error), errOut);
 453
 454     CFPropertyListRef plist;
 455     const uint8_t *der = CFDataGetBytePtr(data);
 456     const uint8_t *der_end = der + CFDataGetLength(data);
 457     require_quiet(der = der_decode_plist(0, kCFPropertyListMutableContainers, &plist, error, der, der_end), errOut);
 458     if (der != der_end) {
 459         SecError(errSecDecode, error, CFSTR("trailing garbage at end of SecAccessControl data"));
 460         goto errOut;
 461     }
 462
 463     CFReleaseSafe(access_control->dict);
 464     access_control->dict = (CFMutableDictionaryRef)plist;
 465     return access_control;
 466
 467 errOut:
 468     CFReleaseSafe(access_control);
 469     return NULL;
 470 }