src/clientid.cpp

   1 /*
   2  * Copyright (c) 2006-2007 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23 //
  24 // clientid - track and manage identity of securityd clients
  25 //
  26 #include "clientid.h"
  27 #include "server.h"
  28 #include <Security/SecCodePriv.h>
  29
  30
  31 //
  32 // Constructing a ClientIdentification doesn't do much.
  33 // We're waiting for setup(), which should be called by the child class's
  34 // constructor.
  35 //
  36 ClientIdentification::ClientIdentification()
  37 {
  38 }
  39
  40
  41 //
  42 // Initialize the ClientIdentification.
  43 // This creates a process-level code object for the client.
  44 //
  45 void ClientIdentification::setup(pid_t pid)
  46 {
  47         StLock<Mutex> _(mLock);
  48         if (OSStatus rc = SecCodeCreateWithPID(pid, kSecCSDefaultFlags,
  49                         &mClientProcess.aref()))
  50                 secdebug("clientid", "could not get code for process %d: OSStatus=%d",
  51                         pid, int32_t(rc));
  52         mGuests.erase(mGuests.begin(), mGuests.end());
  53 }
  54
  55
  56 //
  57 // Return a SecCodeRef for the client process itself, regardless of
  58 // which guest within it is currently active.
  59 // Think twice before using this.
  60 //
  61 SecCodeRef ClientIdentification::processCode() const
  62 {
  63         return mClientProcess;
  64 }
  65
  66
  67 //
  68 // Return a SecCodeRef for the currently active guest within the client
  69 // process.
  70 //
  71 // We make a fair effort to cache client guest identities without over-growing
  72 // the cache. Note that there's currently no protocol for being notified of
  73 // a guest's death or disappearance (independent from the host process's death),
  74 // so we couldn't track guests live even if we tried.
  75 //
  76 // Note that this consults Server::connection for the currently serviced
  77 // Connection object, so this is not entirely a function of ClientIdentification state.
  78 //
  79 SecCodeRef ClientIdentification::currentGuest() const
  80 {
  81         if (GuestState *guest = current())
  82                 return guest->code;
  83         else
  84                 return mClientProcess;
  85 }
  86
  87 ClientIdentification::GuestState *ClientIdentification::current() const
  88 {
  89         // if we have no client identification, we can't find a current guest either
  90         if (!processCode())
  91                 return NULL;
  92
  93         SecGuestRef guestRef = Server::connection().guestRef();
  94
  95         // try to deliver an already-cached entry
  96         {
  97                 StLock<Mutex> _(mLock);
  98                 GuestMap::iterator it = mGuests.find(guestRef);
  99                 if (it != mGuests.end())
 100                         return &it->second;
 101         }
 102
 103         // okay, make a new one (this may take a while)
 104         CFRef<CFDictionaryRef> attributes = (guestRef == kSecNoGuest)
 105                 ? NULL
 106                 : makeCFDictionary(1, kSecGuestAttributeCanonical, CFTempNumber(guestRef).get());
 107         Server::active().longTermActivity();
 108         CFRef<SecCodeRef> code;
 109         switch (OSStatus rc = SecCodeCopyGuestWithAttributes(processCode(),
 110                 attributes, kSecCSDefaultFlags, &code.aref())) {
 111         case noErr:
 112                 break;
 113         case errSecCSUnsigned:                  // not signed; clearly not a host
 114         case errSecCSNotAHost:                  // signed but not marked as a (potential) host
 115                 code = mClientProcess;
 116                 break;
 117         case errSecCSNoSuchCode:                // potential host, but...
 118                 if (guestRef == kSecNoGuest) {  //  ... no guests (yet), so return the process
 119                         code = mClientProcess;
 120                         break;
 121                 }
 122                 // else fall through            //  ... the guest we expected to be there isn't
 123         default:
 124                 MacOSError::throwMe(rc);
 125         }
 126         StLock<Mutex> _(mLock);
 127         GuestState &slot = mGuests[guestRef];
 128         if (!slot.code) // if another thread didn't get here first...
 129                 slot.code = code;
 130         return &slot;
 131 }
 132
 133
 134 //
 135 // Support for the legacy hash identification mechanism.
 136 // The legacy machinery deals exclusively in terms of processes.
 137 // It knows nothing about guests and their identities.
 138 //
 139 string ClientIdentification::getPath() const
 140 {
 141         assert(mClientProcess);
 142         return codePath(currentGuest());
 143 }
 144
 145 const CssmData ClientIdentification::getHash() const
 146 {
 147         if (GuestState *guest = current()) {
 148                 if (!guest->gotHash) {
 149                         RefPointer<OSXCode> clientCode = new OSXCodeWrap(guest->code);
 150                         OSXVerifier::makeLegacyHash(clientCode, guest->legacyHash);
 151                         guest->gotHash = true;
 152                 }
 153                 return CssmData::wrap(guest->legacyHash, SHA1::digestLength);
 154         } else
 155                 return CssmData();
 156 }
 157
 158
 159 //
 160 // Bonus function: get the path out of a SecCodeRef
 161 //
 162 std::string codePath(SecStaticCodeRef code)
 163 {
 164         CFRef<CFURLRef> path;
 165         MacOSError::check(SecCodeCopyPath(code, kSecCSDefaultFlags, &path.aref()));
 166         return cfString(path);
 167 }
 168
 169
 170 //
 171 // Debug dump support
 172 //
 173 #if defined(DEBUGDUMP)
 174
 175 static void dumpCode(SecCodeRef code)
 176 {
 177         CFRef<CFURLRef> path;
 178         if (OSStatus rc = SecCodeCopyPath(code, kSecCSDefaultFlags, &path.aref()))
 179                 Debug::dump("unknown(rc=%d)", int32_t(rc));
 180         else
 181                 Debug::dump("%s", cfString(path).c_str());
 182 }
 183
 184 void ClientIdentification::dump()
 185 {
 186         Debug::dump(" client=");
 187         dumpCode(mClientProcess);
 188         for (GuestMap::const_iterator it = mGuests.begin(); it != mGuests.end(); ++it) {
 189                 Debug::dump(" guest(0x%x)=", it->first);
 190                 dumpCode(it->second.code);
 191                 if (it->second.gotHash)
 192                         Debug::dump(" [got hash]");
 193         }
 194 }
 195
 196 #endif //DEBUGDUMP