cdsa/cdsa_client/aclclient.cpp

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 //
  20 // keyclient
  21 //
  22 #include <Security/aclclient.h>
  23 #include <Security/keychainacl.h>
  24 #include <Security/cssmwalkers.h>
  25 #include <Security/cssmdata.h>
  26
  27
  28 namespace Security {
  29 namespace CssmClient {
  30
  31
  32 //
  33 // AclBearer methods (trivial)
  34 //
  35 AclBearer::~AclBearer()
  36 { }
  37
  38
  39 //
  40 // Delete an ACL by handle
  41 //
  42 void AclBearer::addAcl(const AclEntryInput &input, const CSSM_ACCESS_CREDENTIALS *cred)
  43 {
  44         changeAcl(AclEdit(input), cred);
  45 }
  46
  47 void AclBearer::changeAcl(CSSM_ACL_HANDLE handle, const AclEntryInput &input,
  48         const CSSM_ACCESS_CREDENTIALS *cred)
  49 {
  50         changeAcl(AclEdit(handle, input), cred);
  51 }
  52
  53 void AclBearer::deleteAcl(CSSM_ACL_HANDLE handle, const CSSM_ACCESS_CREDENTIALS *cred)
  54 {
  55         changeAcl(AclEdit(handle), cred);
  56 }
  57
  58 void AclBearer::deleteAcl(const char *tag, const CSSM_ACCESS_CREDENTIALS *cred)
  59 {
  60         AutoAclEntryInfoList entries;
  61         getAcl(entries, tag);
  62         for (uint32 n = 0; n < entries.count(); n++)
  63                 deleteAcl(entries[n].handle(), cred);
  64 }
  65
  66
  67 //
  68 // A single global structure containing pseudo-static data
  69 //
  70 struct Statics {
  71         Statics();
  72         CssmAllocator &alloc;
  73
  74         AutoCredentials nullCred;
  75         AutoCredentials promptCred;
  76         AutoCredentials unlockCred;
  77 };
  78
  79 namespace {
  80         ModuleNexus<Statics> statics;
  81 }
  82
  83
  84 //
  85 // Make pseudo-statics.
  86 // Note: This is an eternal object. It is not currently destroyed
  87 // if the containing code is unloaded. But then, the containing
  88 // code is Security.framework, which never unloads anyway.
  89 //
  90 Statics::Statics()
  91         : alloc(CssmAllocator::standard()),
  92           nullCred(alloc, 1),
  93           promptCred(alloc, 2),
  94           unlockCred(alloc, 1)
  95 {
  96         // nullCred: nothing at all
  97         // contains:
  98         //  an empty THRESHOLD sample to match threshold subjects with "free" subjects
  99         nullCred.sample(0) = TypedList(alloc, CSSM_SAMPLE_TYPE_THRESHOLD);
 100
 101         // promptCred: a credential permitting user prompt confirmations
 102         // contains:
 103         //  a KEYCHAIN_PROMPT sample, both by itself and in a THRESHOLD
 104         promptCred.sample(0) = TypedList(alloc, CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT);
 105         promptCred.sample(1) = TypedList(alloc, CSSM_SAMPLE_TYPE_THRESHOLD,
 106                 new(alloc) ListElement(TypedList(alloc, CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT)));
 107
 108         // unlockCred: ???
 109         unlockCred.sample(0) = TypedList(alloc, CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK,
 110                 new(alloc) ListElement(CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT));
 111 }
 112
 113
 114 //
 115 // Make and break AclFactories
 116 //
 117 AclFactory::AclFactory()
 118 { }
 119
 120 AclFactory::~AclFactory()
 121 { }
 122
 123
 124 //
 125 // Return basic pseudo-static values
 126 //
 127 const AccessCredentials *AclFactory::nullCred() const
 128 { return &statics().nullCred; }
 129
 130 const AccessCredentials *AclFactory::promptCred() const
 131 { return &statics().promptCred; }
 132
 133 const AccessCredentials *AclFactory::unlockCred() const
 134 { return &statics().unlockCred; }
 135
 136
 137 //
 138 // Manage the (pseudo) credentials used to explicitly provide a passphrase to a keychain.
 139 // Use the eternal unlockCred() for normal (protected prompt) unlocking.
 140 //
 141 AclFactory::KeychainCredentials::~KeychainCredentials ()
 142 {
 143     DataWalkers::chunkFree (mCredentials, allocator);
 144 }
 145
 146 AclFactory::PassphraseUnlockCredentials::PassphraseUnlockCredentials (const CssmData& password,
 147         CssmAllocator& allocator) : KeychainCredentials(allocator)
 148 {
 149     mCredentials->sample(0) = TypedList(allocator, CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK,
 150                 new (allocator) ListElement (CSSM_SAMPLE_TYPE_PASSWORD),
 151                 new (allocator) ListElement (CssmAutoData(allocator, password).release()));
 152 }
 153
 154
 155 //
 156 // Manage the (pseudo) credentials used to explicitly change a keychain's passphrase
 157 //
 158 AclFactory::PasswordChangeCredentials::PasswordChangeCredentials (const CssmData& password,
 159         CssmAllocator& allocator) : KeychainCredentials(allocator)
 160 {
 161     mCredentials->sample(0) = TypedList(allocator, CSSM_SAMPLE_TYPE_KEYCHAIN_CHANGE_LOCK,
 162                 new (allocator) ListElement (CSSM_SAMPLE_TYPE_PASSWORD),
 163                 new (allocator) ListElement (CssmAutoData(allocator, password).release()));
 164 }
 165
 166
 167 //
 168 // Create an ANY style AclEntryInput.
 169 // This can be used to explicitly request wide-open authorization on a new CSSM object.
 170 //
 171 AclFactory::AnyResourceContext::AnyResourceContext(const CSSM_ACCESS_CREDENTIALS *cred)
 172         : mAny(CSSM_ACL_SUBJECT_TYPE_ANY), mTag(CSSM_ACL_AUTHORIZATION_ANY)
 173 {
 174         // set up an ANY/EVERYTHING AclEntryInput
 175         input().proto().subject() += &mAny;
 176         AuthorizationGroup &authGroup = input().proto().authorization();
 177         authGroup.NumberOfAuthTags = 1;
 178         authGroup.AuthTags = &mTag;
 179
 180         // install the cred (not copied)
 181         credentials(cred);
 182 }
 183
 184
 185 } // end namespace CssmClient
 186 } // end namespace Security