X-Git-Url: https://git.saurik.com/apple/security.git/blobdiff_plain/79b9da22a1f4b26279940d285c1bc28ce4e99252..7e6b461318c8a779d91381531435a68ee4e8b6ed:/OSX/libsecurity_codesigning/lib/bundlediskrep.cpp?ds=inline

diff --git a/OSX/libsecurity_codesigning/lib/bundlediskrep.cpp b/OSX/libsecurity_codesigning/lib/bundlediskrep.cpp
index b6178581..7c490970 100644
--- a/OSX/libsecurity_codesigning/lib/bundlediskrep.cpp
+++ b/OSX/libsecurity_codesigning/lib/bundlediskrep.cpp
@@ -363,6 +363,45 @@ CFDataRef BundleDiskRep::component(CodeDirectory::SpecialSlot slot)
 	}
 }
 
+BundleDiskRep::RawComponentMap BundleDiskRep::createRawComponents()
+{
+	RawComponentMap map;
+
+	/* Those are the slots known to BundleDiskReps.
+	 * Unlike e.g. MachOReps, we cannot handle unknown slots,
+	 * as we won't know their slot <-> filename mapping.
+	 */
+	int const slots[] = {
+		cdCodeDirectorySlot, cdSignatureSlot, cdResourceDirSlot,
+		cdTopDirectorySlot, cdEntitlementSlot, cdEntitlementDERSlot,
+		cdRepSpecificSlot};
+	
+	for (int slot = 0; slot < (int)(sizeof(slots)/sizeof(slots[0])); ++slot) {
+		/* Here, we only handle metaData slots, i.e. slots that
+		 * are explicit files in the _CodeSignature directory.
+		 * Main executable slots (if the main executable is a
+		 * EditableDiskRep) are handled when editing the
+		 * main executable's rep explicitly.
+		 * There is also an Info.plist slot, which is not a
+		 * real part of the code signature.
+		 */
+		CFRef<CFDataRef> data = metaData(slot);
+		
+		if (data) {
+			map[slot] = data;
+		}
+	}
+	
+	for (CodeDirectory::Slot slot = cdAlternateCodeDirectorySlots; slot < cdAlternateCodeDirectoryLimit; ++slot) {
+		CFRef<CFDataRef> data = metaData(slot);
+		
+		if (data) {
+			map[slot] = data;
+		}
+	}
+	
+	return map;
+}
 
 // Check that all components of this BundleDiskRep come from either the main
 // executable or the _CodeSignature directory (not mix-and-match).
@@ -678,6 +717,14 @@ size_t BundleDiskRep::pageSize(const SigningContext &ctx)
 // Takes an array of CFNumbers of errors to tolerate.
 //
 void BundleDiskRep::strictValidate(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags)
+{
+	strictValidateStructure(cd, tolerated, flags);
+	
+	// now strict-check the main executable (which won't be an app-like object)
+	mExecRep->strictValidate(cd, tolerated, flags & ~kSecCSRestrictToAppLike);
+}
+
+void BundleDiskRep::strictValidateStructure(const CodeDirectory* cd, const ToleratedErrors& tolerated, SecCSFlags flags)
 {
 	// scan our metadirectory (_CodeSignature) for unwanted guests
 	if (!(flags & kSecCSQuickCheck))
@@ -697,9 +744,6 @@ void BundleDiskRep::strictValidate(const CodeDirectory* cd, const ToleratedError
 		if (!mAppLike)
 			if (tolerated.find(kSecCSRestrictToAppLike) == tolerated.end())
 				MacOSError::throwMe(errSecCSNotAppLike);
-	
-	// now strict-check the main executable (which won't be an app-like object)
-	mExecRep->strictValidate(cd, tolerated, flags & ~kSecCSRestrictToAppLike);
 }
 
 void BundleDiskRep::recordStrictError(OSStatus error)