Security-59754.80.3.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / CSCommon.h

diff --git a/OSX/libsecurity_codesigning/lib/CSCommon.h b/OSX/libsecurity_codesigning/lib/CSCommon.h
index 22129bcb342bc567a324e5b2fb81528b80f7af8d..b39fbe6fa487908474220041a825783ca80d5033 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/CSCommon.h
+++ b/OSX/libsecurity_codesigning/lib/CSCommon.h
@@ -119,12 +119,13 @@ CF_ENUM(OSStatus) {
        errSecCSBadDiskImageFormat =            -67001, /* disk image format unrecognized, invalid, or unsuitable */
        errSecCSUnsupportedDigestAlgorithm = -67000, /* a requested signature digest algorithm is not supported */
        errSecCSInvalidAssociatedFileData =     -66999, /* resource fork, Finder information, or similar detritus not allowed */
        errSecCSBadDiskImageFormat =            -67001, /* disk image format unrecognized, invalid, or unsuitable */
        errSecCSUnsupportedDigestAlgorithm = -67000, /* a requested signature digest algorithm is not supported */
        errSecCSInvalidAssociatedFileData =     -66999, /* resource fork, Finder information, or similar detritus not allowed */

-    errSecCSInvalidTeamIdentifier =     -66998, /* a Team Identifier string is invalid */
-    errSecCSBadTeamIdentifier =         -66997, /* a Team Identifier is wrong or inappropriate */
-    errSecCSSignatureUntrusted =        -66996, /* signature is valid but signer is not trusted */
+       errSecCSInvalidTeamIdentifier =         -66998, /* a Team Identifier string is invalid */
+       errSecCSBadTeamIdentifier =             -66997, /* a Team Identifier is wrong or inappropriate */
+       errSecCSSignatureUntrusted =            -66996, /* signature is valid but signer is not trusted */

        errSecMultipleExecSegments =            -66995, /* the image contains multiple executable segments */
        errSecCSInvalidEntitlements =           -66994, /* invalid entitlement plist */
        errSecMultipleExecSegments =            -66995, /* the image contains multiple executable segments */
        errSecCSInvalidEntitlements =           -66994, /* invalid entitlement plist */

-       errSecCSInvalidRuntimeVersion =     -66993, /* an invalid runtime version was explicitly set */
+       errSecCSInvalidRuntimeVersion =         -66993, /* an invalid runtime version was explicitly set */
+       errSecCSRevokedNotarization =           -66992, /* notarization indicates this code has been revoked */

 };
 
 /*
 };
 
 /*


@@ -214,6 +215,7 @@ typedef CF_OPTIONS(uint32_t, SecCSFlags) {
        kSecCSReportProgress = 1 << 28,                 /* make progress report call-backs when configured */
     kSecCSCheckTrustedAnchors = 1 << 27, /* build certificate chain to system trust anchors, not to any self-signed certificate */
        kSecCSQuickCheck = 1 << 26,             /* (internal) */
        kSecCSReportProgress = 1 << 28,                 /* make progress report call-backs when configured */
     kSecCSCheckTrustedAnchors = 1 << 27, /* build certificate chain to system trust anchors, not to any self-signed certificate */
        kSecCSQuickCheck = 1 << 26,             /* (internal) */

+    kSecCSApplyEmbeddedPolicy = 1 << 25, /* Apply Embedded (iPhone) policy regardless of the platform we're running on */

 };
 
 
 };
 
 


@@ -250,6 +252,9 @@ typedef CF_OPTIONS(uint32_t, SecCSFlags) {
        @constant kSecCodeSignatureRuntime
        Instructs the kernel to apply runtime hardening policies as required by the
        hardened runtime version
        @constant kSecCodeSignatureRuntime
        Instructs the kernel to apply runtime hardening policies as required by the
        hardened runtime version

+       @constant kSecCodeSignatureLinkerSigned
+       The code was automatically signed by the linker. This signature should be
+       ignored in any new signing operation.

  */
 typedef CF_OPTIONS(uint32_t, SecCodeSignatureFlags) {
        kSecCodeSignatureHost = 0x0001,                 /* may host guest code */
  */
 typedef CF_OPTIONS(uint32_t, SecCodeSignatureFlags) {
        kSecCodeSignatureHost = 0x0001,                 /* may host guest code */


@@ -261,6 +266,7 @@ typedef CF_OPTIONS(uint32_t, SecCodeSignatureFlags) {
        kSecCodeSignatureEnforcement = 0x1000, /* enforce code signing */
        kSecCodeSignatureLibraryValidation = 0x2000, /* library validation required */
        kSecCodeSignatureRuntime = 0x10000, /* apply runtime hardening policies */
        kSecCodeSignatureEnforcement = 0x1000, /* enforce code signing */
        kSecCodeSignatureLibraryValidation = 0x2000, /* library validation required */
        kSecCodeSignatureRuntime = 0x10000, /* apply runtime hardening policies */

+       kSecCodeSignatureLinkerSigned = 0x20000, /* identify that the signature was auto-generated by the linker*/

 };
 
 /*!
 };
 
 /*!


@@ -302,11 +308,20 @@ typedef CF_OPTIONS(uint32_t, SecCodeSignatureFlags) {
        This bit can only be set. Code that has the kill flag set will never be dynamically invalid
        (and live). Note however that a change in static validity does not necessarily trigger instant
        death.
        This bit can only be set. Code that has the kill flag set will never be dynamically invalid
        (and live). Note however that a change in static validity does not necessarily trigger instant
        death.

+
+       @constant kSecCodeStatusDebugged
+       Indicated that code has been debugged by another process that was allowed to do so. The debugger
+       causes this to be set when it attachs.
+
+       @constant kSecCodeStatusPlatform
+       Indicates the code is platform code, shipping with the operating system and signed by Apple.

 */
 typedef CF_OPTIONS(uint32_t, SecCodeStatus) {
 */
 typedef CF_OPTIONS(uint32_t, SecCodeStatus) {

-       kSecCodeStatusValid =   0x0001,
-       kSecCodeStatusHard =    0x0100,
-       kSecCodeStatusKill =    0x0200,
+       kSecCodeStatusValid     = 0x00000001,
+       kSecCodeStatusHard      = 0x00000100,
+       kSecCodeStatusKill      = 0x00000200,
+       kSecCodeStatusDebugged  = 0x10000000,
+       kSecCodeStatusPlatform  = 0x04000000,

 };
 
 
 };
 
 


@@ -343,6 +358,7 @@ typedef CF_ENUM(uint32_t, SecCSDigestAlgorithm) {
        kSecCodeSignatureHashSHA256                                             =  2,   /* SHA-256 */
        kSecCodeSignatureHashSHA256Truncated                    =  3,   /* SHA-256 truncated to first 20 bytes */
        kSecCodeSignatureHashSHA384                                             =  4,   /* SHA-384 */
        kSecCodeSignatureHashSHA256                                             =  2,   /* SHA-256 */
        kSecCodeSignatureHashSHA256Truncated                    =  3,   /* SHA-256 truncated to first 20 bytes */
        kSecCodeSignatureHashSHA384                                             =  4,   /* SHA-384 */

+    kSecCodeSignatureHashSHA512                     =  5,   /* SHA-512 */

 };
 
 CF_ASSUME_NONNULL_END
 };
 
 CF_ASSUME_NONNULL_END