cdsa/cdsa_utilities/acl_process.h

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 //
  20 // acl_process - Process-attribute ACL subject type.
  21 //
  22 // NOTE:
  23 // The default Environment provides data about the current process (the one that
  24 // validate() is run in). If this isn't right for you (e.g. because you want to
  25 // validate against a process on the other side of some IPC connection), you must
  26 // make your own version of Environment and pass it to validate().
  27 //
  28 #ifndef _ACL_PROCESS
  29 #define _ACL_PROCESS
  30
  31 #include <Security/cssmacl.h>
  32 #include <string>
  33
  34 namespace Security
  35 {
  36
  37 class AclProcessSubjectSelector
  38     : public PodWrapper<AclProcessSubjectSelector, CSSM_ACL_PROCESS_SUBJECT_SELECTOR> {
  39 public:
  40     AclProcessSubjectSelector()
  41     { version = CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION; mask = 0; }
  42
  43     bool uses(uint32 m) const { return mask & m; }
  44 };
  45
  46
  47 //
  48 // The ProcessAclSubject matches process attributes securely identified
  49 // by the system across IPC channels.
  50 //
  51 class ProcessAclSubject : public AclSubject {
  52 public:
  53     bool validate(const AclValidationContext &baseCtx) const;
  54     CssmList toList(CssmAllocator &alloc) const;
  55
  56     ProcessAclSubject(const AclProcessSubjectSelector &selector)
  57     : AclSubject(CSSM_ACL_SUBJECT_TYPE_PROCESS),
  58       select(selector) { }
  59
  60     void exportBlob(Writer::Counter &pub, Writer::Counter &priv);
  61     void exportBlob(Writer &pub, Writer &priv);
  62
  63         IFDUMP(void debugDump() const);
  64
  65 public:
  66     class Environment : public virtual AclValidationEnvironment {
  67     public:
  68         virtual uid_t getuid() const;   // retrieve effective userid to match
  69         virtual gid_t getgid() const;   // retrieve effective groupid to match
  70     };
  71
  72 public:
  73     class Maker : public AclSubject::Maker {
  74     public:
  75         Maker() : AclSubject::Maker(CSSM_ACL_SUBJECT_TYPE_PROCESS) { }
  76         ProcessAclSubject *make(const TypedList &list) const;
  77         ProcessAclSubject *make(Version, Reader &pub, Reader &priv) const;
  78     };
  79
  80 private:
  81     AclProcessSubjectSelector select;
  82 };
  83
  84 } // end namespace Security
  85
  86
  87 #endif //_ACL_PROCESS