Security-58286.20.16.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / Code.cpp

diff --git a/OSX/libsecurity_codesigning/lib/Code.cpp b/OSX/libsecurity_codesigning/lib/Code.cpp
index 643c4f58d9e424113aa5e5541ef0d5f4e63d4370..d5de3047c3f453b74e003eeb480f6585d72278c5 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/Code.cpp
+++ b/OSX/libsecurity_codesigning/lib/Code.cpp
@@ -205,7 +205,9 @@ void SecCode::checkValidity(SecCSFlags flags)
        SecStaticCode *hostDisk = this->host()->staticCode();
 
        // check my static state
        SecStaticCode *hostDisk = this->host()->staticCode();
 
        // check my static state

-       myDisk->validateDirectory();
+       myDisk->validateNonResourceComponents();        // also validates the CodeDirectory
+       if (flags & kSecCSStrictValidate)
+               myDisk->diskRep()->strictValidate(myDisk->codeDirectory(), DiskRep::ToleratedErrors(), flags);

 
        // check my own dynamic state
        if (!(this->host()->getGuestStatus(this) & kSecCodeStatusValid))
 
        // check my own dynamic state
        if (!(this->host()->getGuestStatus(this) & kSecCodeStatusValid))


@@ -257,9 +259,9 @@ SecCode *SecCode::autoLocateGuest(CFDictionaryRef attributes, SecCSFlags flags)
        if (CFDictionaryGetCount(attributes) == 0)
                return KernelCode::active()->retain();
        
        if (CFDictionaryGetCount(attributes) == 0)
                return KernelCode::active()->retain();
        

-       // main logic: we need a pid, and we'll take a canonical guest id as an option
-       int pid = 0;
-       if (!cfscan(attributes, "{%O=%d}", kSecGuestAttributePid, &pid))
+       // main logic: we need a pid or audit trailer; everything else goes to the guests
+       if (CFDictionaryGetValue(attributes, kSecGuestAttributePid) == NULL
+               && CFDictionaryGetValue(attributes, kSecGuestAttributeAudit) == NULL)

                CSError::throwMe(errSecCSUnsupportedGuestAttributes, kSecCFErrorGuestAttributes, attributes);
        if (SecCode *process =
                        KernelCode::active()->locateGuest(attributes)) {
                CSError::throwMe(errSecCSUnsupportedGuestAttributes, kSecCFErrorGuestAttributes, attributes);
        if (SecCode *process =
                        KernelCode::active()->locateGuest(attributes)) {


@@ -269,6 +271,7 @@ SecCode *SecCode::autoLocateGuest(CFDictionaryRef attributes, SecCSFlags flags)
                        // might be a code host. Let's find out
                        CFRef<CFMutableDictionaryRef> rest = makeCFMutableDictionary(attributes);
                        CFDictionaryRemoveValue(rest, kSecGuestAttributePid);
                        // might be a code host. Let's find out
                        CFRef<CFMutableDictionaryRef> rest = makeCFMutableDictionary(attributes);
                        CFDictionaryRemoveValue(rest, kSecGuestAttributePid);

+                       CFDictionaryRemoveValue(rest, kSecGuestAttributeAudit);

                        if (SecCode *guest = code->locateGuest(rest))
                                return guest;
                }
                        if (SecCode *guest = code->locateGuest(rest))
                                return guest;
                }