+++ /dev/null
-/*
- * Copyright (c) 2003-2007,2009-2010 Apple Inc. All Rights Reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- *
- * AuthorizationRule.h
- * Security
- *
- */
-
-#ifndef _H_AUTHORIZATIONRULE
-#define _H_AUTHORIZATIONRULE 1
-
-#include <CoreFoundation/CoreFoundation.h>
-#include <security_cdsa_utilities/AuthorizationData.h>
-#include "authority.h"
-#include "agentclient.h"
-
-namespace Authorization
-{
-
-class Rule;
-
-class RuleImpl : public RefCount
-{
-public:
- RuleImpl();
- RuleImpl(const string &inRightName, CFDictionaryRef cfRight, CFDictionaryRef cfRules);
-
- OSStatus evaluate(const AuthItemRef &inRight, const Rule &inRule, AuthItemSet &environmentToClient,
- AuthorizationFlags flags, CFAbsoluteTime now,
- const CredentialSet *inCredentials, CredentialSet &credentials,
- AuthorizationToken &auth, SecurityAgent::Reason &reason, bool savePassword) const;
-
- string name() const { return mRightName; }
- bool extractPassword() const { return mExtractPassword; }
-
-private:
-// internal machinery
-
- // evaluate credential for right
- OSStatus evaluateCredentialForRight(const AuthorizationToken &auth, const AuthItemRef &inRight, const Rule &inRule,
- const AuthItemSet &environment, CFAbsoluteTime now, const Credential &credential, bool ignoreShared, SecurityAgent::Reason &reason) const;
- // evaluate user credential (authentication) for right
- OSStatus evaluateUserCredentialForRight(const AuthorizationToken &auth, const AuthItemRef &inRight, const Rule &inRule, const AuthItemSet &environment, CFAbsoluteTime now, const Credential &credential, bool ignoreShared, SecurityAgent::Reason &reason) const;
-
- OSStatus evaluateRules(const AuthItemRef &inRight, const Rule &inRule,
- AuthItemSet &environmentToClient, AuthorizationFlags flags,
- CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
- AuthorizationToken &auth, SecurityAgent::Reason &reason, bool savePassword) const;
-
- void setAgentHints(const AuthItemRef &inRight, const Rule &inTopLevelRule, AuthItemSet &environmentToClient, AuthorizationToken &auth) const;
-
- // perform authorization based on running specified mechanisms (see evaluateMechanism)
- OSStatus evaluateAuthentication(const AuthItemRef &inRight, const Rule &inRule, AuthItemSet &environmentToClient, AuthorizationFlags flags, CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials, AuthorizationToken &auth, SecurityAgent::Reason &reason, bool savePassword) const;
-
- OSStatus evaluateUser(const AuthItemRef &inRight, const Rule &inRule,
- AuthItemSet &environmentToClient, AuthorizationFlags flags,
- CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
- AuthorizationToken &auth, SecurityAgent::Reason &reason, bool savePassword) const;
-
- OSStatus evaluateMechanismOnly(const AuthItemRef &inRight, const Rule &inRule, AuthItemSet &environmentToClient, AuthorizationToken &auth, CredentialSet &outCredentials, bool savePassword) const;
-
- // find username hint based on session owner
- OSStatus evaluateSessionOwner(const AuthItemRef &inRight, const Rule &inRule, const AuthItemSet &environment, const CFAbsoluteTime now, const AuthorizationToken &auth, Credential &credential, SecurityAgent::Reason &reason) const;
-
- CredentialSet makeCredentials(const AuthorizationToken &auth) const;
-
- map<string,string> localizedPrompts() const { return mLocalizedPrompts; }
- map<string,string> localizedButtons() const { return mLocalizedButtons; }
-
-
-// parsed attributes
-private:
- enum Type
- {
- kDeny,
- kAllow,
- kUser,
- kRuleDelegation,
- kKofN,
- kEvaluateMechanisms,
- } mType;
-
- string mRightName;
- string mGroupName;
- CFTimeInterval mMaxCredentialAge;
- bool mShared;
- bool mAllowRoot;
- vector<string> mEvalDef;
- bool mSessionOwner;
- vector<Rule> mRuleDef;
- uint32_t mKofN;
- mutable uint32_t mTries;
- bool mExtractPassword;
- bool mAuthenticateUser;
- map<string,string> mLocalizedPrompts;
- map<string,string> mLocalizedButtons;
-
-private:
-
- class Attribute
- {
- public:
- static bool getBool(CFDictionaryRef config, CFStringRef key, bool required, bool defaultValue);
- static double getDouble(CFDictionaryRef config, CFStringRef key, bool required, double defaultValue);
- static string getString(CFDictionaryRef config, CFStringRef key, bool required, const char *defaultValue);
- static vector<string> getVector(CFDictionaryRef config, CFStringRef key, bool required);
- static bool getLocalizedText(CFDictionaryRef config, map<string,string> &localizedPrompts, CFStringRef dictKey, const char *descriptionKey);
- };
-
-
-// keys
- static CFStringRef kUserGroupID;
- static CFStringRef kTimeoutID;
- static CFStringRef kSharedID;
- static CFStringRef kAllowRootID;
- static CFStringRef kMechanismsID;
- static CFStringRef kSessionOwnerID;
- static CFStringRef kKofNID;
- static CFStringRef kPromptID;
- static CFStringRef kButtonID;
- static CFStringRef kTriesID;
- static CFStringRef kExtractPasswordID;
-
- static CFStringRef kRuleClassID;
- static CFStringRef kRuleAllowID;
- static CFStringRef kRuleDenyID;
- static CFStringRef kRuleUserID;
- static CFStringRef kRuleDelegateID;
- static CFStringRef kRuleMechanismsID;
- static CFStringRef kRuleAuthenticateUserID;
-};
-
-class Rule : public RefPointer<RuleImpl>
-{
-public:
- Rule();
- Rule(const string &inRightName, CFDictionaryRef cfRight, CFDictionaryRef cfRules);
-};
-
-}; /* namespace Authorization */
-
-#endif /* ! _H_AUTHORIZATIONRULE */
projects / apple / security.git / blobdiff