Security-59306.140.5.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / SecCode.cpp

diff --git a/OSX/libsecurity_codesigning/lib/SecCode.cpp b/OSX/libsecurity_codesigning/lib/SecCode.cpp
index 59587ce7d25aedf193557ba8e082dc128fc98e74..2a494dc7e0b8fb11668339aaf64c786f91126f75 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/SecCode.cpp
+++ b/OSX/libsecurity_codesigning/lib/SecCode.cpp
@@ -46,6 +46,7 @@ const CFStringRef kSecCFErrorResourceSeal =           CFSTR("SecCSResourceSeal");
 const CFStringRef kSecCFErrorResourceAdded =           CFSTR("SecCSResourceAdded");
 const CFStringRef kSecCFErrorResourceAltered = CFSTR("SecCSResourceAltered");
 const CFStringRef kSecCFErrorResourceMissing = CFSTR("SecCSResourceMissing");
+const CFStringRef kSecCFErrorResourceSideband =        CFSTR("SecCSResourceHasSidebandData");
 const CFStringRef kSecCFErrorInfoPlist =                       CFSTR("SecCSInfoPlist");
 const CFStringRef kSecCFErrorGuestAttributes = CFSTR("SecCSGuestAttributes");
 const CFStringRef kSecCFErrorRequirementSyntax = CFSTR("SecRequirementSyntax");
@@ -152,11 +153,13 @@ const CFStringRef kSecGuestAttributeCanonical =           CFSTR("canonical");
 const CFStringRef kSecGuestAttributeHash =                     CFSTR("codedirectory-hash");
 const CFStringRef kSecGuestAttributeMachPort =         CFSTR("mach-port");
 const CFStringRef kSecGuestAttributePid =                      CFSTR("pid");
-const CFStringRef kSecGuestAttributeDynamicCode =               CFSTR("dynamicCode");
-const CFStringRef kSecGuestAttributeDynamicCodeInfoPlist =               CFSTR("dynamicCodeInfoPlist");
+const CFStringRef kSecGuestAttributeAudit =                    CFSTR("audit");
+const CFStringRef kSecGuestAttributeDynamicCode =      CFSTR("dynamicCode");
+const CFStringRef kSecGuestAttributeDynamicCodeInfoPlist = CFSTR("dynamicCodeInfoPlist");
 const CFStringRef kSecGuestAttributeArchitecture =     CFSTR("architecture");
 const CFStringRef kSecGuestAttributeSubarchitecture = CFSTR("subarchitecture");
 
+#if TARGET_OS_OSX
 OSStatus SecCodeCopyGuestWithAttributes(SecCodeRef hostRef,
        CFDictionaryRef attributes,     SecCSFlags flags, SecCodeRef *guestRef)
 {
@@ -176,7 +179,8 @@ OSStatus SecCodeCopyGuestWithAttributes(SecCodeRef hostRef,
 
 
 //
-// Shorthand for getting the SecCodeRef for a UNIX process
+// Deprecated since 10.6, DO NOT USE. This can be raced.
+// Use SecCodeCreateWithAuditToken instead.
 //
 OSStatus SecCodeCreateWithPID(pid_t pid, SecCSFlags flags, SecCodeRef *processRef)
 {
@@ -191,6 +195,26 @@ OSStatus SecCodeCreateWithPID(pid_t pid, SecCSFlags flags, SecCodeRef *processRe
        END_CSAPI
 }
 
+//
+// Shorthand for getting the SecCodeRef for a UNIX process
+//
+OSStatus SecCodeCreateWithAuditToken(const audit_token_t *audit,
+                                                                        SecCSFlags flags, SecCodeRef *processRef)
+{
+       BEGIN_CSAPI
+       
+       checkFlags(flags);
+       CFRef<CFDataRef> auditData = makeCFData(audit, sizeof(audit_token_t));
+       if (SecCode *guest = KernelCode::active()->locateGuest(CFTemp<CFDictionaryRef>("{%O=%O}", kSecGuestAttributeAudit, auditData.get()))) {
+               CodeSigning::Required(processRef) = guest->handle(false);
+       } else {
+               return errSecCSNoSuchCode;
+       }
+       
+       END_CSAPI
+}
+#endif // TARGET_OS_OSX
+
 
 //
 // Check validity of an Code
@@ -204,54 +228,21 @@ OSStatus SecCodeCheckValidity(SecCodeRef codeRef, SecCSFlags flags,
 OSStatus SecCodeCheckValidityWithErrors(SecCodeRef codeRef, SecCSFlags flags,
        SecRequirementRef requirementRef, CFErrorRef *errors)
 {
-#if !SECTRUST_OSX
        BEGIN_CSAPI
 
        checkFlags(flags,
                  kSecCSConsiderExpiration
                | kSecCSStrictValidate
-               | kSecCSEnforceRevocationChecks);
+               | kSecCSStrictValidateStructure
+               | kSecCSRestrictSidebandData
+               | kSecCSEnforceRevocationChecks
+       );
        SecPointer<SecCode> code = SecCode::required(codeRef);
        code->checkValidity(flags);
        if (const SecRequirement *req = SecRequirement::optional(requirementRef))
                code->staticCode()->validateRequirement(req->requirement(), errSecCSReqFailed);
 
        END_CSAPI_ERRORS
-#else
-#warning resolve before enabling SECTRUST_OSX: <rdar://21328880>
-       OSStatus result = errSecSuccess;
-       const char *func = "SecCodeCheckValidity";
-       CFErrorRef localErrors = NULL;
-       if (!errors) { errors = &localErrors; }
-       try {
-               checkFlags(flags,
-                               kSecCSConsiderExpiration
-                               | kSecCSEnforceRevocationChecks);
-               SecPointer<SecCode> code = SecCode::required(codeRef);
-               code->checkValidity(flags);
-               if (const SecRequirement *req = SecRequirement::optional(requirementRef))
-                       code->staticCode()->validateRequirement(req->requirement(), errSecCSReqFailed);
-       }
-       catch (...) {
-               // the actual error being thrown is not being caught by any of the
-               // type-specific blocks contained in the END_CSAPI_ERRORS macro,
-               // so we only have the catch-all block here for now.
-               result = errSecCSInternalError;
-       }
-
-       if (errors && *errors) {
-               CFShow(errors);
-               CFRelease(errors);
-               *errors = NULL;
-       }
-       if (result == errSecCSInternalError) {
-       #if !NDEBUG
-               Security::Syslog::error("WARNING: %s ignored error %d", func, (int)result);
-       #endif
-               result = errSecSuccess;
-       }
-       return result;
-#endif
 }
 
 
@@ -288,11 +279,22 @@ const CFStringRef kSecCodeInfoTimestamp =         CFSTR("signing-timestamp");
 const CFStringRef kSecCodeInfoTrust =                  CFSTR("trust");
 const CFStringRef kSecCodeInfoUnique =                 CFSTR("unique");
 const CFStringRef kSecCodeInfoCdHashes =        CFSTR("cdhashes");
-
+const CFStringRef kSecCodeInfoCdHashesFull =   CFSTR("cdhashes-full");
+const CFStringRef kSecCodeInfoRuntimeVersion =         CFSTR("runtime-version");
 
 const CFStringRef kSecCodeInfoCodeDirectory =  CFSTR("CodeDirectory");
 const CFStringRef kSecCodeInfoCodeOffset =             CFSTR("CodeOffset");
+const CFStringRef kSecCodeInfoDiskRepInfo =     CFSTR("DiskRepInfo");
 const CFStringRef kSecCodeInfoResourceDirectory = CFSTR("ResourceDirectory");
+const CFStringRef kSecCodeInfoNotarizationDate = CFSTR("NotarizationDate");
+const CFStringRef kSecCodeInfoCMSDigestHashType = CFSTR("CMSDigestHashType");
+const CFStringRef kSecCodeInfoCMSDigest =        CFSTR("CMSDigest");
+
+/* DiskInfoRepInfo types */
+const CFStringRef kSecCodeInfoDiskRepVersionPlatform =         CFSTR("VersionPlatform");
+const CFStringRef kSecCodeInfoDiskRepVersionMin =              CFSTR("VersionMin");
+const CFStringRef kSecCodeInfoDiskRepVersionSDK =              CFSTR("VersionSDK");
+const CFStringRef kSecCodeInfoDiskRepNoLibraryValidation =     CFSTR("NoLibraryValidation");
 
 
 OSStatus SecCodeCopySigningInformation(SecStaticCodeRef codeRef, SecCSFlags flags,
@@ -305,7 +307,9 @@ OSStatus SecCodeCopySigningInformation(SecStaticCodeRef codeRef, SecCSFlags flag
                | kSecCSSigningInformation
                | kSecCSRequirementInformation
                | kSecCSDynamicInformation
-               | kSecCSContentInformation);
+               | kSecCSContentInformation
+        | kSecCSSkipResourceDirectory
+               | kSecCSCalculateCMSDigest);
 
        SecPointer<SecStaticCode> code = SecStaticCode::requiredStatic(codeRef);
        CFRef<CFDictionaryRef> info = code->signingInformation(flags);