X-Git-Url: https://git.saurik.com/apple/security.git/blobdiff_plain/5c19dc3ae3bd8e40a9c028b0deddd50ff337692c..ee5f17c73ddf6cea151be3383378b7972c71f538:/OSX/libsecurity_codesigning/lib/diskrep.h

diff --git a/OSX/libsecurity_codesigning/lib/diskrep.h b/OSX/libsecurity_codesigning/lib/diskrep.h
index b9219521..1f1a10c5 100644
--- a/OSX/libsecurity_codesigning/lib/diskrep.h
+++ b/OSX/libsecurity_codesigning/lib/diskrep.h
@@ -41,6 +41,7 @@ namespace Security {
 namespace CodeSigning {
 
 class ResourceBuilder;
+class SecCodeSigner;
 
 
 //
@@ -65,13 +66,23 @@ public:
 	virtual CFURLRef copyCanonicalPath() = 0;					// path to whole code
 	virtual std::string resourcesRootPath();				// resource directory if any [none]
 	virtual void adjustResources(ResourceBuilder &builder);	// adjust resource rule set [no change]
+	virtual void prepareForSigning(SigningContext& context); // pre-adjust signing defaults before argument preparation [none]
 	virtual Universal *mainExecutableImage();				// Mach-O image if Mach-O based [null]
 	virtual size_t signingBase();							// start offset of signed area in main executable [zero]
 	virtual size_t signingLimit() = 0;						// size of signed area in main executable
+
+	// The executable segment, if present, denotes which part of the image can be mapped
+	// into a virtual address space as executable. Not all platforms check this.
+	virtual size_t execSegBase(const Architecture *arch);			// start offset of executable segment in main executable [zero]
+	virtual size_t execSegLimit(const Architecture *arch) = 0;		// size of executable segment in main executable
+
 	virtual std::string format() = 0;						// human-readable type string
 	virtual CFArrayRef modifiedFiles();						// list of files modified by signing [main execcutable only]
 	virtual UnixPlusPlus::FileDesc &fd() = 0;				// a cached file descriptor for main executable file
 	virtual void flush();									// flush caches (refetch as needed)
+    virtual CFDictionaryRef diskRepInformation();           // information from diskrep
+
+	virtual void registerStapledTicket();
 
 	// default values for signing operations
 	virtual std::string recommendedIdentifier(const SigningContext &ctx) = 0; // default identifier
@@ -80,13 +91,15 @@ public:
 		const SigningContext &ctx);							// default internal requirements [none]
 	virtual size_t pageSize(const SigningContext &ctx);		// default main executable page size [infinite, i.e. no paging]
 
-	virtual void strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated); // perform strict validation
+	virtual void strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags); // perform strict validation
+	virtual void strictValidateStructure(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags) { }; // perform structural strict validation
 	virtual CFArrayRef allowedResourceOmissions();			// allowed (default) resource omission rules
 
+	virtual bool appleInternalForcePlatform() const {return false;};
+
 	bool mainExecutableIsMachO() { return mainExecutableImage() != NULL; }
 
 	// shorthands
-	CFDataRef codeDirectory()	{ return component(cdCodeDirectorySlot); }
 	CFDataRef signature()		{ return component(cdSignatureSlot); }
 
 public:
@@ -125,6 +138,16 @@ public:
 		virtual std::string sdkPath(const std::string &path) const = 0;
 		virtual bool isAdhoc() const = 0;
 		virtual SecCSFlags signingFlags() const = 0;
+
+		virtual const CodeDirectory::HashAlgorithms &digestAlgorithms() const = 0;
+		virtual void setDigestAlgorithms(CodeDirectory::HashAlgorithms types) = 0;
+		
+		void setDigestAlgorithm(CodeDirectory::HashAlgorithm type)
+		{
+			CodeDirectory::HashAlgorithms types;
+			types.insert(type);
+			setDigestAlgorithms(types);
+		}
 	};
 
 protected:
@@ -136,6 +159,27 @@ public:
 	static const size_t monolithicPageSize = 0;		// default page size for non-Mach-O executables
 };
 
+/*
+ * Editable Disk Reps allow editing of their existing code signature.
+ * Specifically, they allow for individual components to be replaced,
+ * while preserving all other components.
+ * Lots of restrictions apply, e.g. machO signatures' superblobs may
+ * not change in size, and components covered by the code directory
+ * cannot be replaced without adjusting the code directory.
+ * Replacing or adding CMS blobs (having reserved enough size in the
+ * superblob beforehand) is the original reason this trait exists.
+ */
+class EditableDiskRep {
+public:
+	typedef std::map<CodeDirectory::Slot, CFCopyRef<CFDataRef>> RawComponentMap;
+	
+	/* Return all components in raw form.
+	 * Signature editing will add all the components obtained hereby
+	 * back to their specific slots, though some of them may have
+	 * been replaced in the map.
+	 */
+	virtual RawComponentMap createRawComponents() = 0;
+};
 
 //
 // Write-access objects.
@@ -166,12 +210,20 @@ public:
 	bool attribute(uint32_t attr) const		{ return mAttributes & attr; }
 	
 	void signature(CFDataRef data)			{ component(cdSignatureSlot, data); }
-	void codeDirectory(const CodeDirectory *cd)
-		{ component(cdCodeDirectorySlot, CFTempData(cd->data(), cd->length())); }
-	
+	void codeDirectory(const CodeDirectory *cd, CodeDirectory::SpecialSlot slot)
+		{ component(slot, CFTempData(cd->data(), cd->length())); }
+
+#if TARGET_OS_OSX
+	bool getPreserveAFSC()					{ return mPreserveAFSC; }
+	void setPreserveAFSC(bool flag)			{ mPreserveAFSC = flag; }
+#endif
+
 private:
 	Architecture mArch;
 	uint32_t mAttributes;
+#if TARGET_OS_OSX
+	bool mPreserveAFSC = false; // preserve AFSC compression
+#endif
 };
 
 //
@@ -207,6 +259,8 @@ public:
 	Universal *mainExecutableImage()		{ return mOriginal->mainExecutableImage(); }
 	size_t signingBase()					{ return mOriginal->signingBase(); }
 	size_t signingLimit()					{ return mOriginal->signingLimit(); }
+	size_t execSegBase(const Architecture *arch)					{ return mOriginal->execSegBase(arch); }
+	size_t execSegLimit(const Architecture *arch)					{ return mOriginal->execSegLimit(arch); }
 	std::string format()					{ return mOriginal->format(); }
 	CFArrayRef modifiedFiles()				{ return mOriginal->modifiedFiles(); }
 	UnixPlusPlus::FileDesc &fd()			{ return mOriginal->fd(); }
@@ -220,7 +274,8 @@ public:
 		{ return mOriginal->defaultRequirements(arch, ctx); }
 	size_t pageSize(const SigningContext &ctx) { return mOriginal->pageSize(ctx); }
 
-	void strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated) { mOriginal->strictValidate(cd, tolerated); }
+	void strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags) { mOriginal->strictValidate(cd, tolerated, flags); }
+	void strictValidateStructure(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags) { mOriginal->strictValidateStructure(cd, tolerated, flags); }
 	CFArrayRef allowedResourceOmissions() { return mOriginal->allowedResourceOmissions(); }
 
 private: