--- /dev/null
+/*
+ * Copyright (c) 2002-2004,2011-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+#include <SecBase.h>
+#include <Security/SecAccess.h>
+#include <Security/SecAccessPriv.h>
+#include <Security/SecTrustedApplication.h>
+#include <Security/SecTrustedApplicationPriv.h>
+#include <security_keychain/Access.h>
+#include "SecBridge.h"
+#include <sys/param.h>
+
+#undef secdebug
+#include <utilities/SecCFWrappers.h>
+
+
+/* No restrictions. Permission to perform all operations on
+ the resource or available to an ACL owner. */
+
+
+CFTypeRef kSecACLAuthorizationAny = (CFTypeRef)(CFSTR("ACLAuthorizationAny"));
+
+CFTypeRef kSecACLAuthorizationLogin = (CFTypeRef)(CFSTR("ACLAuthorizationLogin"));
+CFTypeRef kSecACLAuthorizationGenKey = (CFTypeRef)(CFSTR("ACLAuthorizationGenKey"));
+CFTypeRef kSecACLAuthorizationDelete = (CFTypeRef)(CFSTR("ACLAuthorizationDelete"));
+CFTypeRef kSecACLAuthorizationExportWrapped = (CFTypeRef)(CFSTR("ACLAuthorizationExportWrapped"));
+CFTypeRef kSecACLAuthorizationExportClear = (CFTypeRef)(CFSTR("ACLAuthorizationExportClear"));
+CFTypeRef kSecACLAuthorizationImportWrapped = (CFTypeRef)(CFSTR("ACLAuthorizationImportWrapped"));
+CFTypeRef kSecACLAuthorizationImportClear = (CFTypeRef)(CFSTR("ACLAuthorizationImportClear"));
+CFTypeRef kSecACLAuthorizationSign = (CFTypeRef)(CFSTR("ACLAuthorizationSign"));
+CFTypeRef kSecACLAuthorizationEncrypt = (CFTypeRef)(CFSTR("ACLAuthorizationEncrypt"));
+CFTypeRef kSecACLAuthorizationDecrypt = (CFTypeRef)(CFSTR("ACLAuthorizationDecrypt"));
+CFTypeRef kSecACLAuthorizationMAC = (CFTypeRef)(CFSTR("ACLAuthorizationMAC"));
+CFTypeRef kSecACLAuthorizationDerive = (CFTypeRef)(CFSTR("ACLAuthorizationDerive"));
+
+/* Defined authorization tag values for Keychain */
+
+
+
+CFTypeRef kSecACLAuthorizationKeychainCreate = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainCreate"));
+CFTypeRef kSecACLAuthorizationKeychainDelete = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainDelete"));
+CFTypeRef kSecACLAuthorizationKeychainItemRead = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainItemRead"));
+CFTypeRef kSecACLAuthorizationKeychainItemInsert = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainItemInsert"));
+CFTypeRef kSecACLAuthorizationKeychainItemModify = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainItemModify"));
+CFTypeRef kSecACLAuthorizationKeychainItemDelete = (CFTypeRef)(CFSTR("ACLAuthorizationKeychainItemDelete"));
+
+CFTypeRef kSecACLAuthorizationChangeACL = (CFTypeRef)(CFSTR("ACLAuthorizationChangeACL"));
+CFTypeRef kSecACLAuthorizationChangeOwner = (CFTypeRef)(CFSTR("ACLAuthorizationChangeOwner"));
+
+
+static CFArrayRef copyTrustedAppListFromBundle(CFStringRef bundlePath, CFStringRef trustedAppListFileName);
+
+static CFStringRef gKeys[] =
+{
+ (CFStringRef)kSecACLAuthorizationAny,
+ (CFStringRef)kSecACLAuthorizationLogin,
+ (CFStringRef)kSecACLAuthorizationGenKey,
+ (CFStringRef)kSecACLAuthorizationDelete,
+ (CFStringRef)kSecACLAuthorizationExportWrapped,
+ (CFStringRef)kSecACLAuthorizationExportClear,
+ (CFStringRef)kSecACLAuthorizationImportWrapped,
+ (CFStringRef)kSecACLAuthorizationImportClear,
+ (CFStringRef)kSecACLAuthorizationSign,
+ (CFStringRef)kSecACLAuthorizationEncrypt,
+ (CFStringRef)kSecACLAuthorizationDecrypt,
+ (CFStringRef)kSecACLAuthorizationMAC,
+ (CFStringRef)kSecACLAuthorizationDerive,
+
+ /* Defined authorization tag values for Keychain */
+ (CFStringRef)kSecACLAuthorizationKeychainCreate,
+ (CFStringRef)kSecACLAuthorizationKeychainDelete,
+ (CFStringRef)kSecACLAuthorizationKeychainItemRead,
+ (CFStringRef)kSecACLAuthorizationKeychainItemInsert,
+ (CFStringRef)kSecACLAuthorizationKeychainItemModify,
+ (CFStringRef)kSecACLAuthorizationKeychainItemDelete,
+
+ (CFStringRef)kSecACLAuthorizationChangeACL,
+ (CFStringRef)kSecACLAuthorizationChangeOwner
+
+};
+
+static sint32 gValues[] =
+{
+ CSSM_ACL_AUTHORIZATION_ANY,
+ CSSM_ACL_AUTHORIZATION_LOGIN,
+ CSSM_ACL_AUTHORIZATION_GENKEY,
+ CSSM_ACL_AUTHORIZATION_DELETE,
+ CSSM_ACL_AUTHORIZATION_EXPORT_WRAPPED,
+ CSSM_ACL_AUTHORIZATION_EXPORT_CLEAR,
+ CSSM_ACL_AUTHORIZATION_IMPORT_WRAPPED,
+ CSSM_ACL_AUTHORIZATION_IMPORT_CLEAR,
+ CSSM_ACL_AUTHORIZATION_SIGN,
+ CSSM_ACL_AUTHORIZATION_ENCRYPT,
+ CSSM_ACL_AUTHORIZATION_DECRYPT,
+ CSSM_ACL_AUTHORIZATION_MAC,
+ CSSM_ACL_AUTHORIZATION_DERIVE,
+ CSSM_ACL_AUTHORIZATION_DBS_CREATE,
+ CSSM_ACL_AUTHORIZATION_DBS_DELETE,
+ CSSM_ACL_AUTHORIZATION_DB_READ,
+ CSSM_ACL_AUTHORIZATION_DB_INSERT,
+ CSSM_ACL_AUTHORIZATION_DB_MODIFY,
+ CSSM_ACL_AUTHORIZATION_DB_DELETE,
+ CSSM_ACL_AUTHORIZATION_CHANGE_ACL,
+ CSSM_ACL_AUTHORIZATION_CHANGE_OWNER
+};
+
+static
+CFDictionaryRef CreateStringToNumDictionary()
+{
+ int numItems = (sizeof(gValues) / sizeof(sint32));
+ CFMutableDictionaryRef tempDict = CFDictionaryCreateMutable(kCFAllocatorDefault, numItems, &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+
+ for (int iCnt = 0; iCnt < numItems; iCnt++)
+ {
+ sint32 aNumber = gValues[iCnt];
+ CFNumberRef aNum = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &aNumber);
+
+ CFStringRef aString = gKeys[iCnt];
+ CFDictionaryAddValue(tempDict, aString, aNum);
+ CFRelease(aNum);
+ }
+
+ CFDictionaryRef result = CFDictionaryCreateCopy(kCFAllocatorDefault, tempDict);
+ CFRelease(tempDict);
+ return result;
+
+}
+
+static
+CFDictionaryRef CreateNumToStringDictionary()
+{
+ int numItems = (sizeof(gValues) / sizeof(sint32));
+
+ CFMutableDictionaryRef tempDict = CFDictionaryCreateMutable(kCFAllocatorDefault, numItems, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+
+ for (int iCnt = 0; iCnt < numItems; iCnt++)
+ {
+ sint32 aNumber = gValues[iCnt];
+ CFNumberRef aNum = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &aNumber);
+
+ CFStringRef aString = gKeys[iCnt];
+ CFDictionaryAddValue(tempDict, aNum, aString);
+ CFRelease(aNum);
+
+ }
+
+ CFDictionaryRef result = CFDictionaryCreateCopy(kCFAllocatorDefault, tempDict);
+ CFRelease(tempDict);
+ return result;
+}
+
+
+/* TODO: This should be in some header */
+sint32 GetACLAuthorizationTagFromString(CFStringRef aclStr);
+sint32 GetACLAuthorizationTagFromString(CFStringRef aclStr)
+{
+ if (NULL == aclStr)
+ {
+#ifndef NDEBUG
+ CFShow(CFSTR("GetACLAuthorizationTagFromString aclStr is NULL"));
+#endif
+ return 0;
+ }
+
+ static CFDictionaryRef gACLMapping = NULL;
+
+ if (NULL == gACLMapping)
+ {
+ gACLMapping = CreateStringToNumDictionary();
+ }
+
+ sint32 result = 0;
+ CFNumberRef valueResult = (CFNumberRef)CFDictionaryGetValue(gACLMapping, aclStr);
+ if (NULL != valueResult)
+ {
+ if (!CFNumberGetValue(valueResult, kCFNumberSInt32Type, &result))
+ {
+ return 0;
+ }
+
+ }
+ else
+ {
+ return 0;
+ }
+
+ return result;
+
+}
+
+/* TODO: This should be in some header */
+CFStringRef GetAuthStringFromACLAuthorizationTag(sint32 tag);
+CFStringRef GetAuthStringFromACLAuthorizationTag(sint32 tag)
+{
+ static CFDictionaryRef gTagMapping = NULL;
+ CFNumberRef aNum = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &tag);
+
+ if (NULL == gTagMapping)
+ {
+ gTagMapping = CreateNumToStringDictionary();
+ }
+
+ CFStringRef result = (CFStringRef)kSecACLAuthorizationAny;
+
+ if (NULL != gTagMapping && CFDictionaryContainsKey(gTagMapping, aNum))
+ {
+ result = (CFStringRef)CFDictionaryGetValue(gTagMapping, aNum);
+ }
+ return result;
+}
+
+//
+// CF boilerplate
+//
+CFTypeID SecAccessGetTypeID(void)
+{
+ BEGIN_SECAPI
+ return gTypes().Access.typeID;
+ END_SECAPI1(_kCFRuntimeNotATypeID)
+}
+
+
+//
+// API bridge calls
+//
+/*!
+ * Create a new SecAccessRef that is set to the default configuration
+ * of a (newly created) security object.
+ */
+OSStatus SecAccessCreate(CFStringRef descriptor, CFArrayRef trustedList, SecAccessRef *accessRef)
+{
+ BEGIN_SECAPI
+ Required(descriptor);
+ SecPointer<Access> access;
+ if (trustedList) {
+ CFIndex length = CFArrayGetCount(trustedList);
+ ACL::ApplicationList trusted;
+ for (CFIndex n = 0; n < length; n++)
+ trusted.push_back(TrustedApplication::required(
+ SecTrustedApplicationRef(CFArrayGetValueAtIndex(trustedList, n))));
+ access = new Access(cfString(descriptor), trusted);
+ } else {
+ access = new Access(cfString(descriptor));
+ }
+ Required(accessRef) = access->handle();
+ END_SECAPI
+}
+
+
+/*!
+ */
+OSStatus SecAccessCreateFromOwnerAndACL(const CSSM_ACL_OWNER_PROTOTYPE *owner,
+ uint32 aclCount, const CSSM_ACL_ENTRY_INFO *acls,
+ SecAccessRef *accessRef)
+{
+ BEGIN_SECAPI
+ Required(accessRef); // preflight
+ SecPointer<Access> access = new Access(Required(owner), aclCount, &Required(acls));
+ *accessRef = access->handle();
+ END_SECAPI
+}
+
+SecAccessRef SecAccessCreateWithOwnerAndACL(uid_t userId, gid_t groupId, SecAccessOwnerType ownerType, CFArrayRef acls, CFErrorRef *error)
+{
+ SecAccessRef result = NULL;
+
+ CSSM_ACL_PROCESS_SUBJECT_SELECTOR selector =
+ {
+ CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION, // selector version
+ ownerType,
+ userId,
+ groupId
+ };
+
+ CSSM_LIST_ELEMENT subject2 = { NULL, 0 };
+ subject2.Element.Word.Data = (UInt8 *)&selector;
+ subject2.Element.Word.Length = sizeof(selector);
+ CSSM_LIST_ELEMENT subject1 =
+ {
+ &subject2, CSSM_ACL_SUBJECT_TYPE_PROCESS, CSSM_LIST_ELEMENT_WORDID
+ };
+
+ CFIndex numAcls = 0;
+
+ if (NULL != acls)
+ {
+ numAcls = CFArrayGetCount(acls);
+ }
+
+#ifndef NDEBUG
+ CFStringRef debugStr = CFStringCreateWithFormat(kCFAllocatorDefault, NULL,
+ CFSTR("SecAccessCreateWithOwnerAndACL: processing %d acls"), (int)numAcls);
+ CFShow(debugStr);
+ CFRelease(debugStr);
+#endif
+
+ CSSM_ACL_AUTHORIZATION_TAG rights[numAcls];
+ memset(rights, 0, sizeof(rights));
+
+ for (CFIndex iCnt = 0; iCnt < numAcls; iCnt++)
+ {
+ CFStringRef aclStr = (CFStringRef)CFArrayGetValueAtIndex(acls, iCnt);
+
+#ifndef NDEBUG
+ debugStr = CFStringCreateWithFormat(kCFAllocatorDefault, NULL,
+ CFSTR("SecAccessCreateWithOwnerAndACL: acls[%d] = %@"), (int)iCnt, aclStr);
+
+ CFShow(debugStr);
+ CFRelease(debugStr);
+#endif
+
+ CSSM_ACL_AUTHORIZATION_TAG aTag = GetACLAuthorizationTagFromString(aclStr);
+
+#ifndef NDEBUG
+ debugStr = CFStringCreateWithFormat(kCFAllocatorDefault, NULL,
+ CFSTR("SecAccessCreateWithOwnerAndACL: rights[%d] = %d"), (int)iCnt, aTag);
+
+ CFShow(debugStr);
+ CFRelease(debugStr);
+#endif
+
+ rights[iCnt] = aTag;
+ }
+
+
+ for (CFIndex iCnt = 0; iCnt < numAcls; iCnt++)
+ {
+#ifndef NDEBUG
+ debugStr = CFStringCreateWithFormat(kCFAllocatorDefault, NULL,
+ CFSTR("SecAccessCreateWithOwnerAndACL: rights[%d] = %d"), (int)iCnt, rights[iCnt]);
+
+ CFShow(debugStr);
+ CFRelease(debugStr);
+#endif
+
+
+ }
+
+ CSSM_ACL_OWNER_PROTOTYPE owner =
+ {
+ // TypedSubject
+ { CSSM_LIST_TYPE_UNKNOWN, &subject1, &subject2 },
+ // Delegate
+ false
+ };
+
+
+ // ACL entries (any number, just one here)
+ CSSM_ACL_ENTRY_INFO acl_rights[] =
+ {
+ {
+ // prototype
+ {
+ // TypedSubject
+ { CSSM_LIST_TYPE_UNKNOWN, &subject1, &subject2 },
+ false, // Delegate
+ // rights for this entry
+ { (uint32)(sizeof(rights) / sizeof(rights[0])), rights },
+ // rest is defaulted
+ }
+ }
+ };
+
+ OSStatus err = SecAccessCreateFromOwnerAndACL(&owner,
+ sizeof(acl_rights) / sizeof(acl_rights[0]), acl_rights, &result);
+
+ if (errSecSuccess != err)
+ {
+ result = NULL;
+ if (NULL != error)
+ {
+ *error = CFErrorCreate(kCFAllocatorDefault, CFSTR("FIX ME"), err, NULL);
+ }
+ }
+ return result;
+}
+
+
+/*!
+ */
+OSStatus SecAccessGetOwnerAndACL(SecAccessRef accessRef,
+ CSSM_ACL_OWNER_PROTOTYPE_PTR *owner,
+ uint32 *aclCount, CSSM_ACL_ENTRY_INFO_PTR *acls)
+{
+ BEGIN_SECAPI
+ Access::required(accessRef)->copyOwnerAndAcl(
+ Required(owner), Required(aclCount), Required(acls));
+ END_SECAPI
+}
+
+OSStatus SecAccessCopyOwnerAndACL(SecAccessRef accessRef, uid_t* userId, gid_t* groupId, SecAccessOwnerType* ownerType, CFArrayRef* aclList)
+{
+ CSSM_ACL_OWNER_PROTOTYPE_PTR owner = NULL;
+ CSSM_ACL_ENTRY_INFO_PTR acls = NULL;
+ uint32 aclCount = 0;
+ OSStatus result = SecAccessGetOwnerAndACL(accessRef, &owner, &aclCount, &acls);
+ if (errSecSuccess != result )
+ {
+ return result;
+ }
+
+ if (NULL != owner)
+ {
+ CSSM_LIST_ELEMENT_PTR listHead = owner->TypedSubject.Head;
+ if (listHead != NULL && listHead->ElementType == CSSM_LIST_ELEMENT_WORDID)
+ {
+ CSSM_LIST_ELEMENT_PTR nextElement = listHead->NextElement;
+ if (listHead->WordID == CSSM_ACL_SUBJECT_TYPE_PROCESS && listHead->ElementType == CSSM_LIST_ELEMENT_WORDID)
+ {
+ // nextElement contains the required data
+ CSSM_ACL_PROCESS_SUBJECT_SELECTOR* selectorPtr = (CSSM_ACL_PROCESS_SUBJECT_SELECTOR*)nextElement->Element.Word.Data;
+ if (NULL != selectorPtr)
+ {
+ if (NULL != userId)
+ {
+ *userId = (uid_t)selectorPtr->uid;
+ }
+
+ if (NULL != groupId)
+ {
+ *groupId = (gid_t)selectorPtr->gid;
+ }
+
+ if (NULL != ownerType)
+ {
+ *ownerType = (SecAccessOwnerType)selectorPtr->mask;
+ }
+ }
+ }
+
+ }
+
+ }
+
+ if (NULL != aclList)
+ {
+#ifndef NDEBUG
+ CFShow(CFSTR("SecAccessCopyOwnerAndACL: processing the ACL list"));
+#endif
+
+ CFMutableArrayRef stringArray = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+ CSSM_ACL_OWNER_PROTOTYPE_PTR protoPtr = NULL;
+ uint32 numAcls = 0L;
+ CSSM_ACL_ENTRY_INFO_PTR aclEntry = NULL;
+
+ result = SecAccessGetOwnerAndACL(accessRef, &protoPtr, &numAcls, &aclEntry);
+ if (errSecSuccess == result)
+ {
+#ifndef NDEBUG
+ CFStringRef tempStr = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("SecAccessCopyOwnerAndACL: numAcls = %d"), numAcls);
+ CFShow(tempStr);
+ CFRelease(tempStr);
+#endif
+
+ for (uint32 iCnt = 0; iCnt < numAcls; iCnt++)
+ {
+ CSSM_ACL_ENTRY_PROTOTYPE prototype = aclEntry[iCnt].EntryPublicInfo;
+ CSSM_AUTHORIZATIONGROUP authGroup = prototype.Authorization;
+ int numAuthTags = (int)authGroup.NumberOfAuthTags;
+
+ for (int jCnt = 0; jCnt < numAuthTags; jCnt++)
+ {
+
+ sint32 aTag = authGroup.AuthTags[jCnt];
+ CFStringRef aString = GetAuthStringFromACLAuthorizationTag(aTag);
+
+ CFArrayAppendValue(stringArray, aString);
+ }
+ }
+ }
+
+ if (NULL != stringArray)
+ {
+ if (0 < CFArrayGetCount(stringArray))
+ {
+ *aclList = CFArrayCreateCopy(kCFAllocatorDefault, stringArray);
+ }
+ CFRelease(stringArray);
+ }
+ }
+
+ return result;
+}
+
+/*!
+ */
+OSStatus SecAccessCopyACLList(SecAccessRef accessRef,
+ CFArrayRef *aclList)
+{
+ BEGIN_SECAPI
+ Required(aclList) = Access::required(accessRef)->copySecACLs();
+ END_SECAPI
+}
+
+
+/*!
+ */
+OSStatus SecAccessCopySelectedACLList(SecAccessRef accessRef,
+ CSSM_ACL_AUTHORIZATION_TAG action,
+ CFArrayRef *aclList)
+{
+ BEGIN_SECAPI
+ Required(aclList) = Access::required(accessRef)->copySecACLs(action);
+ END_SECAPI
+}
+
+CFArrayRef SecAccessCopyMatchingACLList(SecAccessRef accessRef, CFTypeRef authorizationTag)
+{
+ CFArrayRef result = NULL;
+ CSSM_ACL_AUTHORIZATION_TAG tag = GetACLAuthorizationTagFromString((CFStringRef)authorizationTag);
+ OSStatus err = SecAccessCopySelectedACLList(accessRef, tag, &result);
+ if (errSecSuccess != err)
+ {
+ result = NULL;
+ }
+ return result;
+}
+
+CFArrayRef copyTrustedAppListFromBundle(CFStringRef bundlePath, CFStringRef trustedAppListFileName)
+{
+ CFStringRef errorString = nil;
+ CFURLRef bundleURL,trustedAppsURL = NULL;
+ CFBundleRef secBundle = NULL;
+ CFPropertyListRef trustedAppsPlist = NULL;
+ CFDataRef xmlDataRef = NULL;
+ SInt32 errorCode;
+ CFArrayRef trustedAppList = NULL;
+ CFMutableStringRef trustedAppListFileNameWithoutExtension = NULL;
+
+ // Make a CFURLRef from the CFString representation of the bundleÕs path.
+ bundleURL = CFURLCreateWithFileSystemPath(
+ kCFAllocatorDefault,bundlePath,kCFURLPOSIXPathStyle,true);
+
+ CFRange wholeStrRange;
+
+ if (!bundleURL)
+ goto xit;
+
+ // Make a bundle instance using the URLRef.
+ secBundle = CFBundleCreate(kCFAllocatorDefault,bundleURL);
+ if (!secBundle)
+ goto xit;
+
+ trustedAppListFileNameWithoutExtension =
+ CFStringCreateMutableCopy(NULL,CFStringGetLength(trustedAppListFileName),trustedAppListFileName);
+ wholeStrRange = CFStringFind(trustedAppListFileName,CFSTR(".plist"),0);
+
+ CFStringDelete(trustedAppListFileNameWithoutExtension,wholeStrRange);
+
+ // Look for a resource in the bundle by name and type
+ trustedAppsURL = CFBundleCopyResourceURL(secBundle,trustedAppListFileNameWithoutExtension,CFSTR("plist"),NULL);
+ if (!trustedAppsURL)
+ goto xit;
+
+ if ( trustedAppListFileNameWithoutExtension )
+ CFRelease(trustedAppListFileNameWithoutExtension);
+
+ if (!CFURLCreateDataAndPropertiesFromResource(kCFAllocatorDefault,trustedAppsURL,&xmlDataRef,NULL,NULL,&errorCode))
+ goto xit;
+
+ trustedAppsPlist = CFPropertyListCreateFromXMLData(kCFAllocatorDefault,xmlDataRef,kCFPropertyListImmutable,&errorString);
+ trustedAppList = (CFArrayRef)trustedAppsPlist;
+
+xit:
+ if (bundleURL)
+ CFRelease(bundleURL);
+ if (secBundle)
+ CFRelease(secBundle);
+ if (trustedAppsURL)
+ CFRelease(trustedAppsURL);
+ if (xmlDataRef)
+ CFRelease(xmlDataRef);
+ if (errorString)
+ CFRelease(errorString);
+
+ return trustedAppList;
+}
+
+OSStatus SecAccessCreateWithTrustedApplications(CFStringRef trustedApplicationsPListPath, CFStringRef accessLabel, Boolean allowAny, SecAccessRef* returnedAccess)
+{
+ OSStatus err = errSecSuccess;
+ SecAccessRef accessToReturn=nil;
+ CFMutableArrayRef trustedApplications=nil;
+
+ if (!allowAny) // use default access ("confirm access")
+ {
+ // make an exception list of applications you want to trust,
+ // which are allowed to access the item without requiring user confirmation
+ SecTrustedApplicationRef myself=NULL, someOther=NULL;
+ CFArrayRef trustedAppListFromBundle=NULL;
+
+ trustedApplications=CFArrayCreateMutable(kCFAllocatorDefault,0,&kCFTypeArrayCallBacks);
+ err = SecTrustedApplicationCreateFromPath(NULL, &myself);
+ if (!err)
+ CFArrayAppendValue(trustedApplications,myself);
+
+ CFURLRef url = CFURLCreateWithFileSystemPath(NULL, trustedApplicationsPListPath, kCFURLPOSIXPathStyle, 0);
+ CFStringRef leafStr = NULL;
+ leafStr = CFURLCopyLastPathComponent(url);
+
+ CFURLRef bndlPathURL = NULL;
+ bndlPathURL = CFURLCreateCopyDeletingLastPathComponent(NULL, url);
+ CFStringRef bndlPath = NULL;
+ bndlPath = CFURLCopyFileSystemPath(bndlPathURL, kCFURLPOSIXPathStyle);
+ trustedAppListFromBundle=copyTrustedAppListFromBundle(bndlPath, leafStr);
+ if ( leafStr )
+ CFRelease(leafStr);
+ if ( bndlPath )
+ CFRelease(bndlPath);
+ if ( url )
+ CFRelease(url);
+ if ( bndlPathURL )
+ CFRelease(bndlPathURL);
+ if (trustedAppListFromBundle)
+ {
+ CFIndex ix,top;
+ char buffer[MAXPATHLEN];
+ top = CFArrayGetCount(trustedAppListFromBundle);
+ for (ix=0;ix<top;ix++)
+ {
+ CFStringRef filename = (CFStringRef)CFArrayGetValueAtIndex(trustedAppListFromBundle,ix);
+ CFIndex stringLength = CFStringGetLength(filename);
+ CFIndex usedBufLen;
+
+ if (stringLength != CFStringGetBytes(filename,CFRangeMake(0,stringLength),kCFStringEncodingUTF8,0,
+ false,(UInt8 *)&buffer,MAXPATHLEN, &usedBufLen))
+ break;
+ buffer[usedBufLen] = 0;
+ //
+ // Support specification of trusted applications by either
+ // a full pathname or a code requirement string.
+ //
+ if (buffer[0]=='/')
+ {
+ err = SecTrustedApplicationCreateFromPath(buffer,&someOther);
+ }
+ else
+ {
+ char *buf = NULL;
+ CFStringRef reqStr = filename;
+ CFArrayRef descArray = CFStringCreateArrayBySeparatingStrings(NULL, reqStr, CFSTR("\""));
+ if (descArray && (CFArrayGetCount(descArray) > 1))
+ {
+ CFStringRef descStr = (CFStringRef) CFArrayGetValueAtIndex(descArray, 1);
+ if (descStr)
+ buf = CFStringToCString(descStr);
+ }
+ SecRequirementRef reqRef = NULL;
+ err = SecRequirementCreateWithString(reqStr, kSecCSDefaultFlags, &reqRef);
+ if (!err)
+ err = SecTrustedApplicationCreateFromRequirement((const char *)buf, reqRef, &someOther);
+ if (buf)
+ free(buf);
+ CFReleaseSafe(reqRef);
+ CFReleaseSafe(descArray);
+ }
+ if (!err)
+ CFArrayAppendValue(trustedApplications,someOther);
+
+ if (someOther)
+ CFReleaseNull(someOther);
+ }
+ CFRelease(trustedAppListFromBundle);
+ }
+ }
+
+ err = SecAccessCreate((CFStringRef)accessLabel, (CFArrayRef)trustedApplications, &accessToReturn);
+ if (!err)
+ {
+ if (allowAny) // change access to be wide-open for decryption ("always allow access")
+ {
+ // get the access control list for decryption operations
+ CFArrayRef aclList=nil;
+ err = SecAccessCopySelectedACLList(accessToReturn, CSSM_ACL_AUTHORIZATION_DECRYPT, &aclList);
+ if (!err)
+ {
+ // get the first entry in the access control list
+ SecACLRef aclRef=(SecACLRef)CFArrayGetValueAtIndex(aclList, 0);
+ CFArrayRef appList=nil;
+ CFStringRef promptDescription=nil;
+ CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR promptSelector;
+ err = SecACLCopySimpleContents(aclRef, &appList, &promptDescription, &promptSelector);
+
+ // modify the default ACL to not require the passphrase, and have a nil application list
+ promptSelector.flags &= ~CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE;
+ err = SecACLSetSimpleContents(aclRef, NULL, promptDescription, &promptSelector);
+
+ if (appList) CFRelease(appList);
+ if (promptDescription) CFRelease(promptDescription);
+ }
+ }
+ }
+ *returnedAccess = accessToReturn;
+ return err;
+}
projects / apple / security.git / blobdiff