Security-58286.260.20.tar.gz

[apple/security.git] / securityd / src / session.cpp

diff --git a/securityd/src/session.cpp b/securityd/src/session.cpp
index da54bbe0b267a2c454517fd1784717a0b2fe5205..75990e12684ea730a7d2d24b2843f83841b084db 100644 (file)
--- a/securityd/src/session.cpp
+++ b/securityd/src/session.cpp
@@ -75,7 +75,7 @@ Session::Session(const AuditInfo &audit, Server &server)
        mSessions[audit.sessionId()] = this;
        
        // log it
-    secnotice("SS", "%p Session %d created, uid:%d sessionId:%d", this, this->sessionId(), mAudit.uid(), mAudit.sessionId());
+    secnotice("SecServer", "%p Session %d created, uid:%d sessionId:%d", this, this->sessionId(), mAudit.uid(), mAudit.sessionId());
        Syslog::notice("Session %d created", this->sessionId());
 }
 
@@ -85,7 +85,7 @@ Session::Session(const AuditInfo &audit, Server &server)
 //
 Session::~Session()
 {
-    secnotice("SS", "%p Session %d destroyed", this, this->sessionId());
+    secnotice("SecServer", "%p Session %d destroyed", this, this->sessionId());
        Syslog::notice("Session %d destroyed", this->sessionId());
 }
 
@@ -150,7 +150,7 @@ void Session::destroy(SessionId id)
 void Session::kill()
 {
     StLock<Mutex> _(*this);     // do we need to take this so early?
-    secnotice("SS", "%p killing session %d", this, this->sessionId());
+    secnotice("SecServer", "%p killing session %d", this, this->sessionId());
     invalidateSessionAuthHosts();
        
        // base kill processing
@@ -177,10 +177,18 @@ void Session::updateAudit() const
     mAudit = info;
 }
 
-void Session::verifyKeyStorePassphrase(int32_t retries)
+// Second and third arguments defaults to false
+void Session::verifyKeyStorePassphrase(int32_t retries, bool useForACLFallback, const char *itemname)
 {
     QueryKeybagPassphrase keybagQuery(*this, retries);
     keybagQuery.inferHints(Server::process());
+    
+    // Parasitic takeover to enable user confirmation when ACL validation ends up without a database
+    if (useForACLFallback) {
+        keybagQuery.addHint("acl-fallback", &useForACLFallback, sizeof(useForACLFallback));
+        keybagQuery.addHint("keychain-item-name", itemname, itemname ? (uint32_t)strlen(itemname) : 0, 0);
+    }
+    
     if (keybagQuery.query() != SecurityAgent::noReason) {
         CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED);
     }
@@ -209,7 +217,7 @@ void Session::resetKeyStorePassphrase(const CssmData &passphrase)
 
 service_context_t Session::get_current_service_context()
 {
-    service_context_t context = { sessionId(), originatorUid(), *Server::connection().auditToken() };
+    service_context_t context = { sessionId(), originatorUid(), *Server::connection().auditToken(), 0 };
     return context;
 }