SecurityServer/process.h

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 //
  20 // process - track a single client process and its belongings
  21 //
  22 #ifndef _H_PROCESS
  23 #define _H_PROCESS
  24
  25 #include "securityserver.h"
  26 #include "SecurityAgentClient.h"
  27 #include <Security/refcount.h>
  28 #include "key.h"
  29 #include "codesigdb.h"
  30 #include "notifications.h"
  31 #include <string>
  32
  33 using MachPlusPlus::Port;
  34 using MachPlusPlus::TaskPort;
  35
  36 class Session;
  37 class AuthorizationToken;
  38
  39
  40 //
  41 // A Process object represents a UNIX process (and associated Mach Task) that has
  42 // had contact with us and may have some state associated with it.
  43 //
  44 class Process : public CodeSignatures::Identity {
  45 public:
  46         Process(Port servicePort, TaskPort tPort,
  47                 const ClientSetupInfo *info, const char *identity,
  48                 uid_t uid, gid_t gid);
  49         virtual ~Process();
  50
  51     uid_t uid() const                   { return mUid; }
  52     gid_t gid() const                   { return mGid; }
  53     pid_t pid() const                   { return mPid; }
  54     TaskPort taskPort() const   { return mTaskPort; }
  55         bool byteFlipped() const        { return mByteFlipped; }
  56
  57         CodeSigning::OSXCode *clientCode() const { return (mClientIdent == unknown) ? NULL : mClientCode; }
  58
  59         void addAuthorization(AuthorizationToken *auth);
  60         void checkAuthorization(AuthorizationToken *auth);
  61         bool removeAuthorization(AuthorizationToken *auth);
  62
  63         void beginConnection(Connection &);
  64         bool endConnection(Connection &);
  65         bool kill(bool keepTaskPort = false);
  66
  67     void addDatabase(Database *database);
  68     void removeDatabase(Database *database);
  69
  70     void requestNotifications(Port port, Listener::Domain domain, Listener::EventMask events);
  71     void stopNotifications(Port port);
  72     void postNotification(Listener::Domain domain, Listener::Event event, const CssmData &data);
  73
  74     Session &session;
  75
  76         // aclSequence is taken to serialize ACL validations to pick up mutual changes
  77         Mutex aclSequence;
  78
  79 protected:
  80         std::string getPath() const;
  81         const CssmData getHash(CodeSigning::OSXSigner &signer) const;
  82
  83 private:
  84         Mutex mLock;                                            // object lock
  85         uint32 mBusyCount;                                      // number of Connection references
  86         bool mDying;                                            // process is dead; waiting for Connections to drain
  87
  88         // peer state: established during connection startup; fixed thereafter
  89     TaskPort mTaskPort;                                 // task port
  90         bool mByteFlipped;                                      // client's byte order is reverse of ours
  91     pid_t mPid;                                                 // process id
  92     uid_t mUid;                                                 // UNIX uid credential
  93     gid_t mGid;                                                 // primary UNIX gid credential
  94
  95         RefPointer<CodeSigning::OSXCode> mClientCode; // code object for client (NULL if unknown)
  96         mutable enum { deferred, known, unknown } mClientIdent; // state of client identity
  97         mutable auto_ptr<CodeSigning::Signature> mCachedSignature; // cached signature (if already known)
  98
  99         // authorization dictionary
 100         typedef multiset<AuthorizationToken *> AuthorizationSet;
 101         AuthorizationSet mAuthorizations;       // set of valid authorizations for process
 102
 103     // database dictionary
 104     typedef set<Database *> DatabaseSet;
 105     DatabaseSet mDatabases;                             // set of valid database handles
 106 };
 107
 108
 109 #endif //_H_PROCESS