src/acl_keychain.cpp

   1 /*
   2  * Copyright (c) 2000-2004,2007-2008 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 // acl_keychain - a subject type for the protected-path
  27 //                                keychain prompt interaction model.
  28 //
  29 // Arguments in CSSM_LIST form:
  30 //      list[1] = CssmData: CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR structure
  31 //      list[2] = CssmData: Descriptive String (presented to user in protected dialogs)
  32 // For legacy compatibility, we accept a single-entry form
  33 //      list[1] = CssmData: Descriptive String
  34 // which defaults to a particular CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR structure value.
  35 // This is never produced by current code, and is considered purely a legacy feature.
  36 //
  37 // On-disk (flattened) representation:
  38 // In order to accommodate legacy formats nicely, we use the binary-versioning feature
  39 // of the ACL machinery. Version 0 is the legacy format (storing only the description
  40 // string), while Version 1 contains both selector and description. We are now always
  41 // writing version-1 data, but will continue to recognize version-0 data indefinitely
  42 // for really, really old keychain items.
  43 //
  44 #include "acl_keychain.h"
  45 #include "agentquery.h"
  46 #include "acls.h"
  47 #include "connection.h"
  48 #include "database.h"
  49 #include "server.h"
  50 #include <security_utilities/debugging.h>
  51 #include <security_utilities/logging.h>
  52 #include <security_cdsa_utilities/osxverifier.h>
  53 #include <algorithm>
  54
  55
  56 #define ACCEPT_LEGACY_FORM 1
  57
  58
  59 //
  60 // The default for the selector structure.
  61 //
  62 CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR KeychainPromptAclSubject::defaultSelector = {
  63         CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION,       // version
  64         0                                                                                       // flags
  65 };
  66
  67
  68 //
  69 // Validate a credential set against this subject.
  70 //
  71 bool KeychainPromptAclSubject::validate(const AclValidationContext &context,
  72     const TypedList &sample) const
  73 {
  74     if (SecurityServerEnvironment *env = context.environment<SecurityServerEnvironment>()) {
  75                 Process &process = Server::process();
  76                 secdebug("kcacl", "Keychain query for process %d (UID %d)", process.pid(), process.uid());
  77
  78                 // assemble the effective validity mode mask
  79                 uint32_t mode = Maker::defaultMode;
  80                 const uint16_t &flags = selector.flags;
  81                 if (flags & CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED_ACT)
  82                         mode = (mode & ~CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED) | (flags & CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED);
  83                 if (flags & CSSM_ACL_KEYCHAIN_PROMPT_INVALID_ACT)
  84                         mode = (mode & ~CSSM_ACL_KEYCHAIN_PROMPT_INVALID) | (flags & CSSM_ACL_KEYCHAIN_PROMPT_INVALID);
  85
  86                 // determine signed/validity status of client, without reference to any particular Code Requirement
  87                 SecCodeRef clientCode = NULL;
  88                 OSStatus validation = errSecCSStaticCodeNotFound;
  89                 {
  90                         StLock<Mutex> _(process);
  91                         Server::active().longTermActivity();
  92                         clientCode = process.currentGuest();
  93                         if (clientCode)
  94                                 validation = SecCodeCheckValidity(clientCode, kSecCSDefaultFlags, NULL);
  95                         switch (validation) {
  96                         case noErr:                                                     // client is signed and valid
  97                                 secdebug("kcacl", "client is valid, proceeding");
  98                                 break;
  99                         case errSecCSUnsigned:                          // client is not signed
 100                                 if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED)) {
 101                                         secdebug("kcacl", "client is unsigned, suppressing prompt");
 102                                         return false;
 103                                 }
 104                                 break;
 105                         case errSecCSSignatureFailed:           // client signed but signature is broken
 106                         case errSecCSGuestInvalid:                      // client signed but dynamically invalid
 107                         case errSecCSStaticCodeNotFound:        // client not on disk (or unreadable)
 108                                 if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_INVALID)) {
 109                                         secdebug("kcacl", "client is invalid, suppressing prompt");
 110                                         Syslog::info("suppressing keychain prompt for invalidly signed client %s(%d)",
 111                                                 process.getPath().c_str(), process.pid());
 112                                         return false;
 113                                 }
 114                                 Syslog::info("attempting keychain prompt for invalidly signed client %s(%d)",
 115                                         process.getPath().c_str(), process.pid());
 116                                 break;
 117                         default:                                                        // something else went wrong
 118                                 secdebug("kcacl", "client validation failed rc=%d, suppressing prompt", int32_t(validation));
 119                                 return false;
 120                         }
 121                 }
 122
 123                 // At this point, we're committed to try to Pop The Question. Now, how?
 124
 125                 // does the user need to type in the passphrase?
 126         const Database *db = env->database;
 127         bool needPassphrase = db && (selector.flags & CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE);
 128
 129                 // an application (i.e. Keychain Access.app :-) can force this option
 130                 if (clientCode && validation == noErr) {
 131                         StLock<Mutex> _(process);
 132                         CFRef<CFDictionaryRef> dict;
 133                         if (SecCodeCopySigningInformation(clientCode, kSecCSDefaultFlags, &dict.aref()) == noErr)
 134                                 if (CFDictionaryRef info = CFDictionaryRef(CFDictionaryGetValue(dict, kSecCodeInfoPList)))
 135                                         needPassphrase |=
 136                                                 (CFDictionaryGetValue(info, CFSTR("SecForcePassphrasePrompt")) != NULL);
 137                 }
 138
 139                 // pop The Question
 140                 if (db && db->belongsToSystem() && !hasAuthorizedForSystemKeychain()) {
 141                         QueryKeychainAuth query;
 142                         query.inferHints(Server::process());
 143                         if (query(db ? db->dbName() : NULL, description.c_str(), context.authorization(), NULL) != SecurityAgent::noReason)
 144                                 return false;
 145                         return true;
 146                 } else {
 147                         QueryKeychainUse query(needPassphrase, db);
 148                         query.inferHints(Server::process());
 149                         query.addHint(AGENT_HINT_CLIENT_VALIDITY, &validation, sizeof(validation));
 150                         if (query.queryUser(db ? db->dbName() : NULL,
 151                                 description.c_str(), context.authorization()) != SecurityAgent::noReason)
 152                                 return false;
 153
 154                         // process an "always allow..." response
 155                         if (query.remember && clientCode) {
 156                                 StLock<Mutex> _(process);
 157                                 RefPointer<OSXCode> clientXCode = new OSXCodeWrap(clientCode);
 158                                 RefPointer<AclSubject> subject = new CodeSignatureAclSubject(OSXVerifier(clientXCode));
 159                                 SecurityServerAcl::addToStandardACL(context, subject);
 160                         }
 161
 162                         // finally, return the actual user response
 163                         return query.allow;
 164                 }
 165     }
 166         return false;        // default to deny without prejudice
 167 }
 168
 169
 170 //
 171 // Make a copy of this subject in CSSM_LIST form
 172 //
 173 CssmList KeychainPromptAclSubject::toList(Allocator &alloc) const
 174 {
 175         // always issue new (non-legacy) form
 176         return TypedList(alloc, CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT,
 177                 new(alloc) ListElement(alloc, CssmData::wrap(selector)),
 178         new(alloc) ListElement(alloc, description));
 179 }
 180
 181 //
 182 // Has the caller recently authorized in such a way as to render unnecessary
 183 // the usual QueryKeychainAuth dialog?  (The right is specific to Keychain
 184 // Access' way of editing a system keychain.)
 185 //
 186 bool KeychainPromptAclSubject::hasAuthorizedForSystemKeychain() const
 187 {
 188     string rightString = "system.keychain.modify";
 189     return Server::session().isRightAuthorized(rightString, Server::connection(), false/*no UI*/);
 190 }
 191
 192
 193
 194 //
 195 // Create a KeychainPromptAclSubject
 196 //
 197 uint32_t KeychainPromptAclSubject::Maker::defaultMode;
 198
 199 KeychainPromptAclSubject *KeychainPromptAclSubject::Maker::make(const TypedList &list) const
 200 {
 201         switch (list.length()) {
 202 #if ACCEPT_LEGACY_FORM
 203         case 2: // legacy case: just description
 204                 {
 205                         ListElement *params[1];
 206                         crack(list, 1, params, CSSM_LIST_ELEMENT_DATUM);
 207                         return new KeychainPromptAclSubject(*params[0], defaultSelector);
 208                 }
 209 #endif //ACCEPT_LEGACY_FORM
 210         case 3: // standard case: selector + description
 211                 {
 212                         ListElement *params[2];
 213                         crack(list, 2, params, CSSM_LIST_ELEMENT_DATUM, CSSM_LIST_ELEMENT_DATUM);
 214                         return new KeychainPromptAclSubject(*params[1],
 215                                 *params[0]->data().interpretedAs<CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR>(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE));
 216                 }
 217         default:
 218                 CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
 219         }
 220 }
 221
 222 KeychainPromptAclSubject *KeychainPromptAclSubject::Maker::make(Version version,
 223         Reader &pub, Reader &) const
 224 {
 225         CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR selector;
 226         const char *description;
 227         switch (version) {
 228         case pumaVersion:
 229                 selector = defaultSelector;
 230                 pub(description);
 231                 break;
 232         case jaguarVersion:
 233                 pub(selector);
 234                 selector.version = n2h(selector.version);
 235                 selector.flags = n2h(selector.flags);
 236                 pub(description);
 237                 break;
 238         default:
 239                 CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
 240         }
 241         return new KeychainPromptAclSubject(description, selector);
 242 }
 243
 244 KeychainPromptAclSubject::KeychainPromptAclSubject(string descr,
 245         const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR &sel)
 246         : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT),
 247         selector(sel), description(descr)
 248 {
 249         // check selector version
 250         if (selector.version != CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION)
 251                 CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
 252
 253         // always use the latest binary version
 254         version(currentVersion);
 255 }
 256
 257
 258 //
 259 // Export the subject to a memory blob
 260 //
 261 void KeychainPromptAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &priv)
 262 {
 263         if (version() != 0) {
 264                 selector.version = h2n (selector.version);
 265                 selector.flags = h2n (selector.flags);
 266                 pub(selector);
 267         }
 268
 269     pub.insert(description.size() + 1);
 270 }
 271
 272 void KeychainPromptAclSubject::exportBlob(Writer &pub, Writer &priv)
 273 {
 274         if (version() != 0) {
 275                 selector.version = h2n (selector.version);
 276                 selector.flags = h2n (selector.flags);
 277                 pub(selector);
 278         }
 279     pub(description.c_str());
 280 }
 281
 282
 283 #ifdef DEBUGDUMP
 284
 285 void KeychainPromptAclSubject::debugDump() const
 286 {
 287         Debug::dump("KeychainPrompt:%s(%s)",
 288                 description.c_str(),
 289                 (selector.flags & CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE) ? "passphrase" : "standard");
 290 }
 291
 292 #endif //DEBUGDUMP