Security-58286.260.20.tar.gz

[apple/security.git] / securityd / src / session.cpp

diff --git a/securityd/src/session.cpp b/securityd/src/session.cpp
index 788a327775dff8f137a165e639ff3432eae80bb4..75990e12684ea730a7d2d24b2843f83841b084db 100644 (file)
--- a/securityd/src/session.cpp
+++ b/securityd/src/session.cpp
@@ -75,7 +75,7 @@ Session::Session(const AuditInfo &audit, Server &server)
        mSessions[audit.sessionId()] = this;
        
        // log it
-    secnotice("SS", "%p Session %d created, uid:%d sessionId:%d", this, this->sessionId(), mAudit.uid(), mAudit.sessionId());
+    secnotice("SecServer", "%p Session %d created, uid:%d sessionId:%d", this, this->sessionId(), mAudit.uid(), mAudit.sessionId());
        Syslog::notice("Session %d created", this->sessionId());
 }
 
@@ -85,7 +85,7 @@ Session::Session(const AuditInfo &audit, Server &server)
 //
 Session::~Session()
 {
-    secnotice("SS", "%p Session %d destroyed", this, this->sessionId());
+    secnotice("SecServer", "%p Session %d destroyed", this, this->sessionId());
        Syslog::notice("Session %d destroyed", this->sessionId());
 }
 
@@ -101,7 +101,7 @@ Server &Session::server() const
 //
 Session &Session::find(pid_t id, bool create)
 {
-       if (id == callerSecuritySession)
+       if (id == (pid_t)callerSecuritySession)
                return Server::session();
        StLock<Mutex> _(mSessionLock);
        SessionMap::iterator it = mSessions.find(id);
@@ -150,7 +150,7 @@ void Session::destroy(SessionId id)
 void Session::kill()
 {
     StLock<Mutex> _(*this);     // do we need to take this so early?
-    secnotice("SS", "%p killing session %d", this, this->sessionId());
+    secnotice("SecServer", "%p killing session %d", this, this->sessionId());
     invalidateSessionAuthHosts();
        
        // base kill processing
@@ -177,10 +177,18 @@ void Session::updateAudit() const
     mAudit = info;
 }
 
-void Session::verifyKeyStorePassphrase(int32_t retries)
+// Second and third arguments defaults to false
+void Session::verifyKeyStorePassphrase(int32_t retries, bool useForACLFallback, const char *itemname)
 {
     QueryKeybagPassphrase keybagQuery(*this, retries);
     keybagQuery.inferHints(Server::process());
+    
+    // Parasitic takeover to enable user confirmation when ACL validation ends up without a database
+    if (useForACLFallback) {
+        keybagQuery.addHint("acl-fallback", &useForACLFallback, sizeof(useForACLFallback));
+        keybagQuery.addHint("keychain-item-name", itemname, itemname ? (uint32_t)strlen(itemname) : 0, 0);
+    }
+    
     if (keybagQuery.query() != SecurityAgent::noReason) {
         CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED);
     }
@@ -209,7 +217,7 @@ void Session::resetKeyStorePassphrase(const CssmData &passphrase)
 
 service_context_t Session::get_current_service_context()
 {
-    service_context_t context = { sessionId(), originatorUid(), *Server::connection().auditToken() };
+    service_context_t context = { sessionId(), originatorUid(), *Server::connection().auditToken(), 0 };
     return context;
 }