Security-57031.40.6.tar.gz

diff --git a/CircleJoinRequested/Readme.txt b/CircleJoinRequested/Readme.txt
index 0e237bb1df995a46f4bee104be6447e4c5b5b73d..6f96d1090675749f54b3b69d1fa68f44357cb366 100644 (file)
--- a/CircleJoinRequested/Readme.txt
+++ b/CircleJoinRequested/Readme.txt
@@ -2,5 +2,4 @@ This project is a copy of the normal Foundation command-line tool, and the diffe
 
 It uses the standard Debug and Release configurations. Currently, command-line tools aren't supported in the Simulator.
 
-
 Thanks!

diff --git a/Security/authd/authdb.c b/Security/authd/authdb.c
index c52e61ba24e1b9752df31526f1b170f1a2950b16..ca1416f395f00d3b9f977c56c6f923b9a4f7b5e5 100644 (file)
--- a/Security/authd/authdb.c
+++ b/Security/authd/authdb.c
@@ -203,6 +203,11 @@ static void _db_load_data(authdb_connection_t dbconn, auth_items_t config)
     
     old_ts = auth_items_get_double(config, "data_ts");
 
+       // <rdar://problem/17484375> SEED: BUG: Fast User Switching Not Working
+       // After Mavericks => Yosemite upgrade install, the new Yosemite rule "system.login.fus" was missing.
+       // Somehow (probably during install) ts < old_ts, even though that should never happen.
+       // Solution: always import plist and update db when time stamps don't match.
+       // After a successful import, old_ts = ts below.
     if (ts != old_ts) {
         LOGV("authdb: %s modified old=%f, new=%f", AUTHDB_DATA, old_ts, ts);
         CFURLCreateDataAndPropertiesFromResource(kCFAllocatorDefault, authURL, &data, NULL, NULL, (SInt32*)&rc);

diff --git a/Security/authd/authorization.plist b/Security/authd/authorization.plist
index ca1316968650fcddf9d0a4cde2a0042330011d84..26ae0530a1edad204aa5a3772f13be4edde003e2 100644 (file)
--- a/Security/authd/authorization.plist
+++ b/Security/authd/authorization.plist
@@ -185,7 +185,7 @@ See remaining rules for examples.
                        <key>class</key>
                        <string>user</string>
                        <key>comment</key>
-                       <string>This right is used by Safari to show passwords </string>
+                       <string>This right is used by Safari to show passwords.</string>
                        <key>session-owner</key>
                        <true/>
                        <key>shared</key>
@@ -193,6 +193,19 @@ See remaining rules for examples.
                        <key>timeout</key>
                        <integer>10</integer>
                </dict>
+               <key>com.apple.Safari.install-ephemeral-extensions</key>
+               <dict>
+                       <key>class</key>
+                       <string>user</string>
+                       <key>comment</key>
+                       <string>This is the right used by Safari to install an ephemeral extension without a developer certificate present.</string>
+                       <key>session-owner</key>
+                       <true/>
+                       <key>shared</key>
+                       <false/>
+                       <key>timeout</key>
+                       <integer>0</integer>
+               </dict>
                <key>com.apple.ServiceManagement.blesshelper</key>
                <dict>
                        <key>allow-root</key>
@@ -936,7 +949,9 @@ See remaining rules for examples.
                        <key>group</key>
                        <string>admin</string>
                        <key>shared</key>
-                       <true/>
+            <false/>
+                       <key>version</key>
+                       <integer>1</integer>
                </dict>
                <key>system.preferences.energysaver</key>
                <dict>

diff --git a/Security/libsecurity_apple_x509_tp/lib/tpCredRequest.cpp b/Security/libsecurity_apple_x509_tp/lib/tpCredRequest.cpp
index efd889604b7a60e2c931f2941e7b5a220f5862b7..be25daea4b67980e6c9a69f16af6531348711f38 100644 (file)
--- a/Security/libsecurity_apple_x509_tp/lib/tpCredRequest.cpp
+++ b/Security/libsecurity_apple_x509_tp/lib/tpCredRequest.cpp
@@ -293,9 +293,35 @@ void AppleTPSession::makeCertTemplate(
        CSSM_BOOL               freeRawKey = CSSM_FALSE;
        
        rawCert = NULL;
+    
+    /* 
+     * Set Signature Algorithm OID and parameters
+     */
        algId.algorithm = sigOid;
-       algId.parameters.Data = NULL;
-       algId.parameters.Length = 0;
+    
+    /* NULL params - skip for ECDSA */
+    CSSM_ALGORITHMS algorithmType = 0;
+    cssmOidToAlg(&sigOid, &algorithmType);
+    switch(algorithmType) {
+        case CSSM_ALGID_SHA1WithECDSA:
+        case CSSM_ALGID_SHA224WithECDSA:
+        case CSSM_ALGID_SHA256WithECDSA:
+        case CSSM_ALGID_SHA384WithECDSA:
+        case CSSM_ALGID_SHA512WithECDSA:
+        case CSSM_ALGID_ECDSA_SPECIFIED:
+            algId.parameters.Data = NULL;
+            algId.parameters.Length = 0;
+            break;
+        default:
+            static const uint8 encNull[2] = { SEC_ASN1_NULL, 0 };
+            CSSM_DATA encNullData;
+            encNullData.Data = (uint8 *)encNull;
+            encNullData.Length = 2;
+            
+            algId.parameters = encNullData;
+            break;
+    }
+
        
        /*
         * Convert possible ref public key to raw format as required by CL.

diff --git a/Security/libsecurity_asn1/lib/plarena.h b/Security/libsecurity_asn1/lib/plarena.h
index 44eaf27d9aeab4076caf4503d6b5154db016bf56..090ad1077e018792b2b9179f7d884daeea54b50c 100644 (file)
--- a/Security/libsecurity_asn1/lib/plarena.h
+++ b/Security/libsecurity_asn1/lib/plarena.h
@@ -119,12 +119,11 @@ struct PLArenaPool {
 #define PL_ARENA_GROW(p, pool, size, incr) \
     PR_BEGIN_MACRO \
         PLArena *_a = (pool)->current; \
-        typeof((incr)) _incr = PL_ARENA_ALIGN(pool, incr); /* __APPLE__ more to be generic */ \
         PRUword _p = _a->avail; \
-        PRUword _q = _p + _incr; \
+        PRUword _q = (PRUword)p + size + incr;  /*__APPLE__ */ \
         if (_p == (PRUword)(p) + PL_ARENA_ALIGN(pool, size) && \
-             _incr <= _a->limit - _a->avail) { /* __APPLE__ */\
-            _a->avail = _q; \
+            _a->limit >= PL_ARENA_ALIGN(pool,_q)) { /* __APPLE__ */ \
+            _a->avail = PL_ARENA_ALIGN(pool, _q); /*__APPLE__ */ \
             PL_ArenaCountInplaceGrowth(pool, size, incr); \
         } else { \
             p = PL_ArenaGrow(pool, p, size, incr); \

diff --git a/Security/libsecurity_keychain/lib/Trust.cpp b/Security/libsecurity_keychain/lib/Trust.cpp
index 04a27c24fbc781baa63c351eb679b9b8e3f53b58..dad88911ca9f472482891bbdad296f42d353d2bc 100644 (file)
--- a/Security/libsecurity_keychain/lib/Trust.cpp
+++ b/Security/libsecurity_keychain/lib/Trust.cpp
@@ -326,6 +326,12 @@ void Trust::evaluate(bool disableEV)
        else if (mNetworkPolicy == useNetworkDisabled)
                actionDataP->ActionFlags &= ~(CSSM_TP_ACTION_FETCH_CERT_FROM_NET);
 
+       if (policySpecified(mPolicies, CSSMOID_APPLE_TP_ESCROW_SERVICE)) {
+               // ignore expiration dates, per rdar://21943474
+               actionDataP->ActionFlags |= (CSSM_TP_ACTION_ALLOW_EXPIRED |
+                               CSSM_TP_ACTION_ALLOW_EXPIRED_ROOT);
+       }
+
     /*
         * Policies (one at least, please).
         * For revocation policies, see if any have been explicitly specified...

diff --git a/Security/sec/Security/SecPolicy.c b/Security/sec/Security/SecPolicy.c
index 7cf760f5f298af7796004881e2602bc352476841..238238785460f236fe794756a0528da81ba48c9b 100644 (file)
--- a/Security/sec/Security/SecPolicy.c
+++ b/Security/sec/Security/SecPolicy.c
@@ -1785,7 +1785,8 @@ CF_RETURNS_RETAINED SecPolicyRef SecPolicyCreateEscrowServiceSigner(void)
                                                 &kCFTypeDictionaryKeyCallBacks,
                                                 &kCFTypeDictionaryValueCallBacks), errOut);
 
-       SecPolicyAddBasicX509Options(options);
+       // X509, ignoring date validity
+       SecPolicyAddBasicCertOptions(options);
 
 
        add_ku(options, kSecKeyUsageKeyEncipherment);

diff --git a/SecurityTests/clxutils/certcrl/testSubjects/anchorAndDb/anchorAndDb.scr b/SecurityTests/clxutils/certcrl/testSubjects/anchorAndDb/anchorAndDb.scr
index 88f929b0b6db95b6493ac24bedb386ff12717ad3..ebc9790bc808e519f17cc33a3a1f2f7f03021b51 100644 (file)
--- a/SecurityTests/clxutils/certcrl/testSubjects/anchorAndDb/anchorAndDb.scr
+++ b/SecurityTests/clxutils/certcrl/testSubjects/anchorAndDb/anchorAndDb.scr
@@ -12,7 +12,7 @@
 # be sure to replace the certs in the corresponding keychain.
 #
 # Note: since the RSA MD2 root which signed the amazon.com certificate has
-# been removed from the System Roots keychain (<rdar://7880748>),
+# been removed from the System Roots keychain in (<rdar://7880748>),
 # we are no longer checking the CSSM_CERT_STATUS_IS_IN_ANCHORS bit for that cert.
 #
 globals

diff --git a/certificates/ota_cert_tool/TestValidator/Readme.txt b/certificates/ota_cert_tool/TestValidator/Readme.txt
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..6f96d1090675749f54b3b69d1fa68f44357cb366 100644 (file)
--- a/certificates/ota_cert_tool/TestValidator/Readme.txt
+++ b/certificates/ota_cert_tool/TestValidator/Readme.txt
@@ -0,0 +1,5 @@
+This project is a copy of the normal Foundation command-line tool, and the differences are summarized below.
+
+It uses the standard Debug and Release configurations. Currently, command-line tools aren't supported in the Simulator.
+
+Thanks!

diff --git a/libsecurity_smime/lib/cmsrecinfo.c b/libsecurity_smime/lib/cmsrecinfo.c
index 5c2b356d6c075fbc0f3885838ff46627397e5e47..77f4814db9bc6f5665e3f71083a457887985b861 100644 (file)
--- a/libsecurity_smime/lib/cmsrecinfo.c
+++ b/libsecurity_smime/lib/cmsrecinfo.c
@@ -288,7 +288,7 @@ loser:
 SecCmsRecipientInfoRef
 SecCmsRecipientInfoCreate(SecCmsEnvelopedDataRef envd, SecCertificateRef cert)
 {
-    /* TODO: we might want to prefer subjkeyid */
+    /* TODO: We might want to prefer subjkeyid */
 #if 0
     SecCmsRecipientInfoRef info = SecCmsRecipientInfoCreateWithSubjKeyIDFromCert(envd, cert);
 

diff --git a/securityd/src/agentquery.cpp b/securityd/src/agentquery.cpp
index aa797acd3b40587dc335496d64190233b97ece2e..9694585b211ac233943c994d3f51fa714aeed4a7 100644 (file)
--- a/securityd/src/agentquery.cpp
+++ b/securityd/src/agentquery.cpp
@@ -35,6 +35,8 @@
 #include <System/sys/fileport.h>
 #include <bsm/audit.h>
 #include <bsm/audit_uevents.h>      // AUE_ssauthint
+#include <membership.h>
+#include <membershipPriv.h>
 #include <security_utilities/logging.h>
 #include <security_utilities/mach++.h>
 #include <stdlib.h>
@@ -1563,12 +1565,32 @@ QueryKeychainAuth::operator () (const char *database, const char *description, A
 Reason 
 QueryKeychainAuth::accept(string &username, string &passphrase)
 {
-    const char *user = username.c_str();
-    const char *passwd = passphrase.c_str();
-    int checkpw_status = checkpw(user, passwd);
-    
-    if (checkpw_status != CHECKPW_SUCCESS)
+       // Note: QueryKeychainAuth currently requires that the
+       // specified user be in the admin group. If this requirement
+       // ever needs to change, the group name should be passed as
+       // a separate argument to this method.
+
+       const char *user = username.c_str();
+       const char *passwd = passphrase.c_str();
+       int checkpw_status = checkpw(user, passwd);
+
+       if (checkpw_status != CHECKPW_SUCCESS) {
                return SecurityAgent::invalidPassphrase;
+       }
+
+       const char *group = "admin";
+       if (group) {
+               int rc, ismember;
+               uuid_t group_uuid, user_uuid;
+               rc = mbr_group_name_to_uuid(group, group_uuid);
+               if (rc) { return SecurityAgent::userNotInGroup; }
+
+               rc = mbr_user_name_to_uuid(user, user_uuid);
+               if (rc) { return SecurityAgent::userNotInGroup; }
+
+               rc = mbr_check_membership(user_uuid, group_uuid, &ismember);
+               if (rc || !ismember) { return SecurityAgent::userNotInGroup; }
+       }
 
        return SecurityAgent::noReason;
 }