Security-59306.61.1.tar.gz

[apple/security.git] / OSX / libsecurity_keychain / lib / ACL.cpp

diff --git a/OSX/libsecurity_keychain/lib/ACL.cpp b/OSX/libsecurity_keychain/lib/ACL.cpp
index 6dfd8f28e97d4335240e34ac029ede37846edb7d..77beb3ada9120f0053a92ae163758993d87d1de7 100644 (file)
--- a/OSX/libsecurity_keychain/lib/ACL.cpp
+++ b/OSX/libsecurity_keychain/lib/ACL.cpp
@@ -31,8 +31,7 @@
 #include <security_cdsa_utilities/walkers.h>
 #include <security_keychain/TrustedApplication.h>
 #include <Security/SecTrustedApplication.h>
 #include <security_cdsa_utilities/walkers.h>
 #include <security_keychain/TrustedApplication.h>
 #include <Security/SecTrustedApplication.h>

-#include <security_utilities/devrandom.h>
-#include <security_cdsa_utilities/uniformrandom.h>
+#include <Security/SecRandom.h>

 #include <memory>
 
 
 #include <memory>
 
 


@@ -108,7 +107,7 @@ ACL::ACL(Allocator &alloc)
        mPromptSelector = defaultSelector;
        
        // randomize the CSSM handle
        mPromptSelector = defaultSelector;
        
        // randomize the CSSM handle

-       UniformRandomBlobs<DevRandomGenerator>().random(mCssmHandle);
+    MacOSError::check(SecRandomCopyBytes(kSecRandomDefault, sizeof(mCssmHandle), (void *)mCssmHandle));

 }
 
 
 }
 
 


@@ -129,7 +128,7 @@ ACL::ACL(string description, const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR &promptSele
        mPromptSelector = promptSelector;
        
        // randomize the CSSM handle
        mPromptSelector = promptSelector;
        
        // randomize the CSSM handle

-       UniformRandomBlobs<DevRandomGenerator>().random(mCssmHandle);
+    MacOSError::check(SecRandomCopyBytes(kSecRandomDefault, sizeof(mCssmHandle), &mCssmHandle));

 }
 
 
 }
 
 


@@ -149,7 +148,7 @@ ACL::ACL(const CssmData &digest, Allocator &alloc)
     //mPromptSelector stays empty
 
     // randomize the CSSM handle
     //mPromptSelector stays empty
 
     // randomize the CSSM handle

-    UniformRandomBlobs<DevRandomGenerator>().random(mCssmHandle);
+    MacOSError::check(SecRandomCopyBytes(kSecRandomDefault, sizeof(mCssmHandle), &mCssmHandle));

 }
 
 
 }
 
 


@@ -185,7 +184,7 @@ bool ACL::authorizesSpecifically(AclAuthorization right)
 
 void ACL::setIntegrity(const CssmData& digest) {
     if(mForm != integrityForm) {
 
 void ACL::setIntegrity(const CssmData& digest) {
     if(mForm != integrityForm) {

-        secdebugfunc("integrity", "acl has incorrect form: %d", mForm);
+        secnotice("integrity", "acl has incorrect form: %d", mForm);

         CssmError::throwMe(CSSMERR_CSP_INVALID_ACL_SUBJECT_VALUE);
     }
 
         CssmError::throwMe(CSSMERR_CSP_INVALID_ACL_SUBJECT_VALUE);
     }
 


@@ -230,7 +229,7 @@ void ACL::modify()
 {
        StLock<Mutex>_(mMutex);
        if (mState == unchanged) {
 {
        StLock<Mutex>_(mMutex);
        if (mState == unchanged) {

-               secdebug("SecAccess", "ACL %p marked modified", this);
+               secinfo("SecAccess", "ACL %p marked modified", this);

                mState = modified;
        }
 }
                mState = modified;
        }
 }


@@ -248,7 +247,7 @@ void ACL::remove()
        StLock<Mutex>_(mMutex);
        mAppList.clear();
        mForm = invalidForm;
        StLock<Mutex>_(mMutex);
        mAppList.clear();
        mForm = invalidForm;

-    secdebug("SecAccess", "ACL %p marked deleted", this);
+    secinfo("SecAccess", "ACL %p marked deleted", this);

        mState = deleted;
 }
 
        mState = deleted;
 }
 


@@ -308,12 +307,12 @@ void ACL::setAccess(AclBearer &target, bool update,
        if (isOwner()) {
                switch (action) {
                case unchanged:
        if (isOwner()) {
                switch (action) {
                case unchanged:

-                       secdebug("SecAccess", "ACL %p owner unchanged", this);
+                       secinfo("SecAccess", "ACL %p owner unchanged", this);

                        return;
                case inserted:          // means modify the initial owner
                case modified:
                        {
                        return;
                case inserted:          // means modify the initial owner
                case modified:
                        {

-                               secdebug("SecAccess", "ACL %p owner modified", this);
+                               secinfo("SecAccess", "ACL %p owner modified", this);

                                makeSubject();
                                assert(mSubjectForm);
                                AclOwnerPrototype proto(*mSubjectForm, mDelegate);
                                makeSubject();
                                assert(mSubjectForm);
                                AclOwnerPrototype proto(*mSubjectForm, mDelegate);


@@ -329,10 +328,10 @@ void ACL::setAccess(AclBearer &target, bool update,
        // simple cases
        switch (action) {
        case unchanged: // ignore
        // simple cases
        switch (action) {
        case unchanged: // ignore

-               secdebug("SecAccess", "ACL %p handle 0x%lx unchanged", this, entryHandle());
+               secinfo("SecAccess", "ACL %p handle 0x%lx unchanged", this, entryHandle());

                return;
        case deleted:   // delete
                return;
        case deleted:   // delete

-               secdebug("SecAccess", "ACL %p handle 0x%lx deleted", this, entryHandle());
+               secinfo("SecAccess", "ACL %p handle 0x%lx deleted", this, entryHandle());

                target.deleteAcl(entryHandle(), cred);
                return;
        default:
                target.deleteAcl(entryHandle(), cred);
                return;
        default:


@@ -349,12 +348,12 @@ void ACL::setAccess(AclBearer &target, bool update,
        AclEntryInput input(proto);
        switch (action) {
        case inserted:  // insert
        AclEntryInput input(proto);
        switch (action) {
        case inserted:  // insert

-               secdebug("SecAccess", "ACL %p inserted", this);
+               secinfo("SecAccess", "ACL %p inserted", this);

                target.addAcl(input, cred);
         mState = unchanged;
                break;
        case modified:  // update
                target.addAcl(input, cred);
         mState = unchanged;
                break;
        case modified:  // update

-               secdebug("SecAccess", "ACL %p handle 0x%lx modified", this, entryHandle());
+               secinfo("SecAccess", "ACL %p handle 0x%lx modified", this, entryHandle());

                target.changeAcl(entryHandle(), input, cred);
         mState = unchanged;
                break;
                target.changeAcl(entryHandle(), input, cred);
         mState = unchanged;
                break;


@@ -376,13 +375,13 @@ void ACL::parse(const TypedList &subject)
                case CSSM_ACL_SUBJECT_TYPE_ANY:
                        // subsume an "any" as a standard form
                        mForm = allowAllForm;
                case CSSM_ACL_SUBJECT_TYPE_ANY:
                        // subsume an "any" as a standard form
                        mForm = allowAllForm;

-            secdebug("SecAccess", "parsed an allowAllForm (%d) (%d)", subject.type(), mForm);
+            secinfo("SecAccess", "parsed an allowAllForm (%d) (%d)", subject.type(), mForm);

                        return;
                case CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT:
                        // pure keychain prompt - interpret as applist form with no apps
                        parsePrompt(subject);
                        mForm = appListForm;
                        return;
                case CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT:
                        // pure keychain prompt - interpret as applist form with no apps
                        parsePrompt(subject);
                        mForm = appListForm;

-            secdebug("SecAccess", "parsed a Keychain Prompt (%d) as an appListForm (%d)", subject.type(), mForm);
+            secinfo("SecAccess", "parsed a Keychain Prompt (%d) as an appListForm (%d)", subject.type(), mForm);

                        return;
                case CSSM_ACL_SUBJECT_TYPE_THRESHOLD:
                        {
                        return;
                case CSSM_ACL_SUBJECT_TYPE_THRESHOLD:
                        {


@@ -401,32 +400,32 @@ void ACL::parse(const TypedList &subject)
                                TypedList &first = subject[3];
                                if (first.type() == CSSM_ACL_SUBJECT_TYPE_ANY) {
                                        mForm = allowAllForm;
                                TypedList &first = subject[3];
                                if (first.type() == CSSM_ACL_SUBJECT_TYPE_ANY) {
                                        mForm = allowAllForm;

-                    secdebug("SecAccess", "parsed a Threshhold (%d) as an allowAllForm (%d)", subject.type(), mForm);
+                    secinfo("SecAccess", "parsed a Threshhold (%d) as an allowAllForm (%d)", subject.type(), mForm);

                                        return;
                                }
                                
                                // parse other (code signing) elements
                 for (uint32 n = 0; n < count - 1; n++) {
                     mAppList.push_back(new TrustedApplication(TypedList(subject[n + 3].list())));
                                        return;
                                }
                                
                                // parse other (code signing) elements
                 for (uint32 n = 0; n < count - 1; n++) {
                     mAppList.push_back(new TrustedApplication(TypedList(subject[n + 3].list())));

-                    secdebug("SecAccess", "found an application: %s", mAppList.back()->path());
+                    secinfo("SecAccess", "found an application: %s", mAppList.back()->path());

                 }
                        }
                        mForm = appListForm;
                 }
                        }
                        mForm = appListForm;

-            secdebug("SecAccess", "parsed a Threshhold (%d) as an appListForm (%d)", subject.type(), mForm);
+            secinfo("SecAccess", "parsed a Threshhold (%d) as an appListForm (%d)", subject.type(), mForm);

                        return;
         case CSSM_ACL_SUBJECT_TYPE_PARTITION:
             mForm = integrityForm;
             mIntegrity.copy(subject.last()->data());
                        return;
         case CSSM_ACL_SUBJECT_TYPE_PARTITION:
             mForm = integrityForm;
             mIntegrity.copy(subject.last()->data());

-            secdebug("SecAccess", "parsed a Partition (%d) as an integrityForm (%d)", subject.type(), mForm);
+            secinfo("SecAccess", "parsed a Partition (%d) as an integrityForm (%d)", subject.type(), mForm);

             return;
         default:
             return;
         default:

-            secdebug("SecAccess", "didn't find a type for %d, marking custom (%d)", subject.type(), mForm);
+            secinfo("SecAccess", "didn't find a type for %d, marking custom (%d)", subject.type(), mForm);

                        mForm = customForm;
                        mSubjectForm = chunkCopy(&subject);
                        return;
                }
        } catch (const ParseError &) {
                        mForm = customForm;
                        mSubjectForm = chunkCopy(&subject);
                        return;
                }
        } catch (const ParseError &) {

-               secdebug("SecAccess", "acl compile failed for type (%d); marking custom", subject.type());
+               secinfo("SecAccess", "acl compile failed for type (%d); marking custom", subject.type());

                mForm = customForm;
                mSubjectForm = chunkCopy(&subject);
                mAppList.clear();
                mForm = customForm;
                mSubjectForm = chunkCopy(&subject);
                mAppList.clear();


@@ -466,7 +465,7 @@ void ACL::makeSubject()
                                new(allocator) ListElement(allocator, mPromptDescription));
                        *mSubjectForm += new(allocator) ListElement(prompt);
                }
                                new(allocator) ListElement(allocator, mPromptDescription));
                        *mSubjectForm += new(allocator) ListElement(prompt);
                }

-        secdebug("SecAccess", "made an allowAllForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());
+        secinfo("SecAccess", "made an allowAllForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());

                return;
        case appListForm: {
                // threshold(1 of n+1) of { app1, ..., appn, PROMPT }
                return;
        case appListForm: {
                // threshold(1 of n+1) of { app1, ..., appn, PROMPT }


@@ -483,17 +482,17 @@ void ACL::makeSubject()
                        new(allocator) ListElement(allocator, mPromptDescription));
                *mSubjectForm += new(allocator) ListElement(prompt);
                }
                        new(allocator) ListElement(allocator, mPromptDescription));
                *mSubjectForm += new(allocator) ListElement(prompt);
                }

-        secdebug("SecAccess", "made an appListForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());
+        secinfo("SecAccess", "made an appListForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());

                return;
     case integrityForm:
         chunkFree(mSubjectForm, allocator);
         mSubjectForm = new(allocator) TypedList(allocator, CSSM_ACL_SUBJECT_TYPE_PARTITION,
                                                  new(allocator) ListElement(allocator, mIntegrity));
                return;
     case integrityForm:
         chunkFree(mSubjectForm, allocator);
         mSubjectForm = new(allocator) TypedList(allocator, CSSM_ACL_SUBJECT_TYPE_PARTITION,
                                                  new(allocator) ListElement(allocator, mIntegrity));

-        secdebug("SecAccess", "made an integrityForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());
+        secinfo("SecAccess", "made an integrityForm (%d) into a subjectForm (%d)", mForm, mSubjectForm->type());

         return;
        case customForm:
                assert(mSubjectForm);   // already set; keep it
         return;
        case customForm:
                assert(mSubjectForm);   // already set; keep it

-        secdebug("SecAccess", "have a customForm (%d), already have a subjectForm (%d)", mForm, mSubjectForm->type());
+        secinfo("SecAccess", "have a customForm (%d), already have a subjectForm (%d)", mForm, mSubjectForm->type());

                return;
 
        default:
                return;
 
        default: