src/AuthorizationRule.cpp

   1 /*
   2  *  Copyright (c) 2003-2004 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  *  @APPLE_LICENSE_HEADER_START@
   5  *
   6  *  This file contains Original Code and/or Modifications of Original Code
   7  *  as defined in and that are subject to the Apple Public Source License
   8  *  Version 2.0 (the 'License'). You may not use this file except in
   9  *  compliance with the License. Please obtain a copy of the License at
  10  *  http://www.opensource.apple.com/apsl/ and read it before using this
  11  *  file.
  12  *
  13  *  The Original Code and all software distributed under the License are
  14  *  distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  *  EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  *  INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  *  FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  *  Please see the License for the specific language governing rights and
  19  *  limitations under the License.
  20  *
  21  *  @APPLE_LICENSE_HEADER_END@
  22  *
  23  *  AuthorizationRule.cpp
  24  *  Security
  25  *
  26  */
  27
  28 #include "AuthorizationRule.h"
  29 #include <Security/AuthorizationTags.h>
  30 #include <Security/AuthorizationTagsPriv.h>
  31 #include <Security/AuthorizationDB.h>
  32 #include <Security/AuthorizationPriv.h>
  33 #include <security_utilities/logging.h>
  34 #include <security_utilities/ccaudit.h>
  35 #include <bsm/audit_uevents.h>
  36 #include "authority.h"
  37 #include "server.h"
  38 #include "process.h"
  39 #include "agentquery.h"
  40 #include "AuthorizationMechEval.h"
  41
  42 #include <pwd.h>
  43 #include <grp.h>
  44 #include <unistd.h>
  45 #include <membership.h>
  46
  47 extern "C" {
  48 #include <membershipPriv.h>
  49 }
  50
  51 //
  52 // Rule class
  53 //
  54 namespace Authorization {
  55
  56 CFStringRef RuleImpl::kUserGroupID = CFSTR(kAuthorizationRuleParameterGroup);
  57 CFStringRef RuleImpl::kTimeoutID = CFSTR(kAuthorizationRuleParameterCredentialTimeout);
  58 CFStringRef RuleImpl::kSharedID = CFSTR(kAuthorizationRuleParameterCredentialShared);
  59 CFStringRef RuleImpl::kAllowRootID = CFSTR(kAuthorizationRuleParameterAllowRoot);
  60 CFStringRef RuleImpl::kMechanismsID = CFSTR(kAuthorizationRuleParameterMechanisms);
  61 CFStringRef RuleImpl::kSessionOwnerID = CFSTR(kAuthorizationRuleParameterCredentialSessionOwner);
  62 CFStringRef RuleImpl::kKofNID = CFSTR(kAuthorizationRuleParameterKofN);
  63 CFStringRef RuleImpl::kPromptID = CFSTR(kAuthorizationRuleParameterDefaultPrompt);
  64 CFStringRef RuleImpl::kTriesID = CFSTR("tries"); // XXX/cs move to AuthorizationTagsPriv.h
  65
  66 CFStringRef RuleImpl::kRuleClassID = CFSTR(kAuthorizationRuleClass);
  67 CFStringRef RuleImpl::kRuleAllowID = CFSTR(kAuthorizationRuleClassAllow);
  68 CFStringRef RuleImpl::kRuleDenyID = CFSTR(kAuthorizationRuleClassDeny);
  69 CFStringRef RuleImpl::kRuleUserID = CFSTR(kAuthorizationRuleClassUser);
  70 CFStringRef RuleImpl::kRuleDelegateID = CFSTR(kAuthorizationRightRule);
  71 CFStringRef RuleImpl::kRuleMechanismsID = CFSTR(kAuthorizationRuleClassMechanisms);
  72 CFStringRef RuleImpl::kRuleAuthenticateUserID = CFSTR(kAuthorizationRuleParameterAuthenticateUser);
  73
  74
  75 string
  76 RuleImpl::Attribute::getString(CFDictionaryRef config, CFStringRef key, bool required = false, char *defaultValue = "")
  77 {
  78         CFTypeRef value = CFDictionaryGetValue(config, key);
  79         if (value && (CFGetTypeID(value) == CFStringGetTypeID()))
  80         {
  81                 CFStringRef stringValue = reinterpret_cast<CFStringRef>(value);
  82                 char buffer[512];
  83                 const char *ptr = CFStringGetCStringPtr(stringValue, kCFStringEncodingUTF8);
  84                 if (ptr == NULL)
  85                 {
  86                         if (CFStringGetCString(stringValue, buffer, sizeof(buffer), kCFStringEncodingUTF8))
  87                                 ptr = buffer;
  88                         else
  89                                 MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
  90                 }
  91
  92                 return string(ptr);
  93         }
  94         else
  95                 if (!required)
  96                         return string(defaultValue);
  97                 else
  98                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
  99 }
 100
 101 double
 102 RuleImpl::Attribute::getDouble(CFDictionaryRef config, CFStringRef key, bool required = false, double defaultValue = 0.0)
 103 {
 104         double doubleValue = 0;
 105
 106         CFTypeRef value = CFDictionaryGetValue(config, key);
 107         if (value && (CFGetTypeID(value) == CFNumberGetTypeID()))
 108         {
 109                 CFNumberGetValue(reinterpret_cast<CFNumberRef>(value), kCFNumberDoubleType, &doubleValue);
 110         }
 111         else
 112                 if (!required)
 113                         return defaultValue;
 114                 else
 115                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 116
 117         return doubleValue;
 118 }
 119
 120 bool
 121 RuleImpl::Attribute::getBool(CFDictionaryRef config, CFStringRef key, bool required = false, bool defaultValue = false)
 122 {
 123         bool boolValue = false;
 124         CFTypeRef value = CFDictionaryGetValue(config, key);
 125
 126         if (value && (CFGetTypeID(value) == CFBooleanGetTypeID()))
 127         {
 128                 boolValue = CFBooleanGetValue(reinterpret_cast<CFBooleanRef>(value));
 129         }
 130         else
 131                 if (!required)
 132                         return defaultValue;
 133                 else
 134                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 135
 136         return boolValue;
 137 }
 138
 139 vector<string>
 140 RuleImpl::Attribute::getVector(CFDictionaryRef config, CFStringRef key, bool required = false)
 141 {
 142         vector<string> valueArray;
 143
 144         CFTypeRef value = CFDictionaryGetValue(config, key);
 145         if (value && (CFGetTypeID(value) == CFArrayGetTypeID()))
 146         {
 147                 CFArrayRef evalArray = reinterpret_cast<CFArrayRef>(value);
 148
 149                 for (int index=0; index < CFArrayGetCount(evalArray); index++)
 150                 {
 151                         CFTypeRef arrayValue = CFArrayGetValueAtIndex(evalArray, index);
 152                         if (arrayValue && (CFGetTypeID(arrayValue) == CFStringGetTypeID()))
 153                         {
 154                                 CFStringRef stringValue = reinterpret_cast<CFStringRef>(arrayValue);
 155                                 char buffer[512];
 156                                 const char *ptr = CFStringGetCStringPtr(stringValue, kCFStringEncodingUTF8);
 157                                 if (ptr == NULL)
 158                                 {
 159                                         if (CFStringGetCString(stringValue, buffer, sizeof(buffer), kCFStringEncodingUTF8))
 160                                                 ptr = buffer;
 161                                         else
 162                                                 MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 163                                 }
 164                                 valueArray.push_back(string(ptr));
 165                         }
 166                 }
 167         }
 168         else
 169                 if (required)
 170                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 171
 172         return valueArray;
 173 }
 174
 175
 176 bool RuleImpl::Attribute::getLocalizedPrompts(CFDictionaryRef config, map<string,string> &localizedPrompts)
 177 {
 178         CFIndex numberOfPrompts = 0;
 179         CFDictionaryRef promptsDict;
 180         if (CFDictionaryContainsKey(config, kPromptID))
 181         {
 182                 promptsDict = reinterpret_cast<CFDictionaryRef>(CFDictionaryGetValue(config, kPromptID));
 183                 if (promptsDict && (CFGetTypeID(promptsDict) == CFDictionaryGetTypeID()))
 184                         numberOfPrompts = CFDictionaryGetCount(promptsDict);
 185         }
 186         if (numberOfPrompts == 0)
 187                 return false;
 188
 189         const void *keys[numberOfPrompts+1];
 190         const void *values[numberOfPrompts+1];
 191         CFDictionaryGetKeysAndValues(promptsDict, &keys[0], &values[0]);
 192
 193         while (numberOfPrompts-- > 0)
 194         {
 195                 CFStringRef keyRef = reinterpret_cast<CFStringRef>(keys[numberOfPrompts]);
 196                 CFStringRef valueRef = reinterpret_cast<CFStringRef>(values[numberOfPrompts]);
 197                 if (!keyRef || (CFGetTypeID(keyRef) != CFStringGetTypeID()))
 198                         continue;
 199                 if (!valueRef || (CFGetTypeID(valueRef) != CFStringGetTypeID()))
 200                         continue;
 201                 string key = cfString(keyRef);
 202                 string value = cfString(valueRef);
 203                 localizedPrompts[kAuthorizationRuleParameterDescription+key] = value;
 204         }
 205
 206         return true;
 207 }
 208
 209
 210 // default rule
 211 RuleImpl::RuleImpl() :
 212 mType(kUser), mGroupName("admin"), mMaxCredentialAge(300.0), mShared(true), mAllowRoot(false), mSessionOwner(false), mTries(0), mAuthenticateUser(true)
 213 {
 214         // XXX/cs read default descriptions from somewhere
 215         // @@@ Default rule is shared admin group with 5 minute timeout
 216 }
 217
 218 // return rule built from rule definition; throw if invalid.
 219 RuleImpl::RuleImpl(const string &inRightName, CFDictionaryRef cfRight, CFDictionaryRef cfRules) : mRightName(inRightName)
 220 {
 221         // @@@ make sure cfRight is non mutable and never used that way
 222
 223         if (CFGetTypeID(cfRight) != CFDictionaryGetTypeID())
 224                 MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 225
 226         mTries = 0;
 227
 228         string classTag = Attribute::getString(cfRight, kRuleClassID, false, "");
 229
 230         if (classTag.length())
 231         {
 232                 if (classTag == kAuthorizationRuleClassAllow)
 233                 {
 234                         secdebug("authrule", "%s : rule allow", inRightName.c_str());
 235                         mType = kAllow;
 236                 }
 237                 else if (classTag == kAuthorizationRuleClassDeny)
 238                 {
 239                         secdebug("authrule", "%s : rule deny", inRightName.c_str());
 240                         mType = kDeny;
 241                 }
 242                 else if (classTag == kAuthorizationRuleClassUser)
 243                 {
 244                         mType = kUser;
 245                         mGroupName = Attribute::getString(cfRight, kUserGroupID);
 246                         // grab other user-in-group attributes
 247                         mMaxCredentialAge = Attribute::getDouble(cfRight, kTimeoutID, false, DBL_MAX);
 248                         mShared = Attribute::getBool(cfRight, kSharedID);
 249                         mAllowRoot = Attribute::getBool(cfRight, kAllowRootID);
 250                         mSessionOwner = Attribute::getBool(cfRight, kSessionOwnerID);
 251                         // authorization tags can have eval now too
 252                         mEvalDef = Attribute::getVector(cfRight, kMechanismsID);
 253             if (mEvalDef.size() == 0 && cfRules /*only rights default see appserver-admin*/)
 254             {
 255                 CFDictionaryRef cfRuleDef = reinterpret_cast<CFDictionaryRef>(CFDictionaryGetValue(cfRules, CFSTR("authenticate")));
 256                                 if (cfRuleDef && CFGetTypeID(cfRuleDef) == CFDictionaryGetTypeID())
 257                     mEvalDef = Attribute::getVector(cfRuleDef, kMechanismsID);
 258             }
 259                         mTries = int(Attribute::getDouble(cfRight, kTriesID, false, 3.0)); // XXX/cs double(kAuthorizationMaxTries)
 260                         mAuthenticateUser = Attribute::getBool(cfRight, kRuleAuthenticateUserID, false, true);
 261
 262                         secdebug("authrule", "%s : rule user in group \"%s\" timeout %g%s%s",
 263                                 inRightName.c_str(),
 264                                 mGroupName.c_str(), mMaxCredentialAge, mShared ? " shared" : "",
 265                                 mAllowRoot ? " allow-root" : "");
 266
 267                 }
 268                 else if (classTag == kAuthorizationRuleClassMechanisms)
 269                 {
 270                         secdebug("authrule", "%s : rule evaluate mechanisms", inRightName.c_str());
 271                         mType = kEvaluateMechanisms;
 272                         // mechanisms to evaluate
 273                         mEvalDef = Attribute::getVector(cfRight, kMechanismsID, true);
 274                         mTries = int(Attribute::getDouble(cfRight, kTriesID, false, 0.0)); // "forever"
 275                         mShared = Attribute::getBool(cfRight, kSharedID, false, true);
 276                 }
 277                 else if (classTag == kAuthorizationRightRule)
 278                 {
 279             assert(cfRules); // rules can't delegate to other rules
 280                         secdebug("authrule", "%s : rule delegate rule", inRightName.c_str());
 281                         mType = kRuleDelegation;
 282
 283                         // string or
 284                         string ruleDefString = Attribute::getString(cfRight, kRuleDelegateID, false, "");
 285                         if (ruleDefString.length())
 286                         {
 287                                 CFStringRef ruleDefRef = makeCFString(ruleDefString);
 288                                 CFDictionaryRef cfRuleDef = reinterpret_cast<CFDictionaryRef>(CFDictionaryGetValue(cfRules, ruleDefRef));
 289                                 if (ruleDefRef)
 290                                         CFRelease(ruleDefRef);
 291                                 if (!cfRuleDef || CFGetTypeID(cfRuleDef) != CFDictionaryGetTypeID())
 292                                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 293                                 mRuleDef.push_back(Rule(ruleDefString, cfRuleDef, cfRules));
 294                         }
 295                         else // array
 296                         {
 297                                 vector<string> ruleDef = Attribute::getVector(cfRight, kRuleDelegateID, true);
 298                                 for (vector<string>::const_iterator it = ruleDef.begin(); it != ruleDef.end(); it++)
 299                                 {
 300                                         CFStringRef ruleNameRef = makeCFString(*it);
 301                                         CFDictionaryRef cfRuleDef = reinterpret_cast<CFDictionaryRef>(CFDictionaryGetValue(cfRules, ruleNameRef));
 302                                         if (ruleNameRef)
 303                                                 CFRelease(ruleNameRef);
 304                                         if (!cfRuleDef || (CFGetTypeID(cfRuleDef) != CFDictionaryGetTypeID()))
 305                                                 MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 306                                         mRuleDef.push_back(Rule(*it, cfRuleDef, cfRules));
 307                                 }
 308                         }
 309
 310                         mKofN = int(Attribute::getDouble(cfRight, kKofNID, false, 0.0));
 311                         if (mKofN)
 312                                 mType = kKofN;
 313
 314                 }
 315                 else
 316                 {
 317                         secdebug("authrule", "%s : rule class unknown %s.", inRightName.c_str(), classTag.c_str());
 318                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 319                 }
 320         }
 321         else
 322         {
 323                 // no class tag means, this is the abbreviated specification from the API
 324                 // it _must_ have a definition for "rule" which will be used as a delegate
 325                 // it may have a comment (not extracted here)
 326                 // it may have a default prompt, or a whole dictionary of languages (not extracted here)
 327                 mType = kRuleDelegation;
 328                 string ruleName = Attribute::getString(cfRight, kRuleDelegateID, true);
 329                 secdebug("authrule", "%s : rule delegate rule (1): %s", inRightName.c_str(), ruleName.c_str());
 330                 CFStringRef ruleNameRef = makeCFString(ruleName);
 331                 CFDictionaryRef cfRuleDef = reinterpret_cast<CFDictionaryRef>(CFDictionaryGetValue(cfRules, ruleNameRef));
 332                 if (ruleNameRef)
 333                         CFRelease(ruleNameRef);
 334                 if (!cfRuleDef || CFGetTypeID(cfRuleDef) != CFDictionaryGetTypeID())
 335                         MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 336                 mRuleDef.push_back(Rule(ruleName, cfRuleDef, cfRules));
 337         }
 338
 339         Attribute::getLocalizedPrompts(cfRight, mLocalizedPrompts);
 340 }
 341
 342 /*
 343 RuleImpl::~Rule()
 344 {
 345 }
 346 */
 347
 348 void
 349 RuleImpl::setAgentHints(const AuthItemRef &inRight, const Rule &inTopLevelRule, AuthItemSet &environmentToClient, AuthorizationToken &auth) const
 350 {
 351         string authorizeString(inRight->name());
 352     environmentToClient.erase(AuthItemRef(AGENT_HINT_AUTHORIZE_RIGHT));
 353         environmentToClient.insert(AuthItemRef(AGENT_HINT_AUTHORIZE_RIGHT, AuthValueOverlay(authorizeString)));
 354
 355         pid_t creatorPid = auth.creatorPid();
 356     environmentToClient.erase(AuthItemRef(AGENT_HINT_CREATOR_PID));
 357         environmentToClient.insert(AuthItemRef(AGENT_HINT_CREATOR_PID, AuthValueOverlay(sizeof(pid_t), &creatorPid)));
 358
 359         Process &thisProcess = Server::process();
 360         RefPointer<OSXCode> clientCode = auth.creatorCode();
 361         SecurityAgent::RequestorType requestorType = SecurityAgent::unknown;
 362         string bundlePath;
 363
 364         if (clientCode)
 365         {
 366                 string encodedBundle = clientCode->encode();
 367                 char bundleType = (encodedBundle.c_str())[0]; // yay, no accessor
 368                 switch(bundleType)
 369                 {
 370                    case 'b': requestorType = SecurityAgent::bundle; break;
 371                    case 't': requestorType = SecurityAgent::tool; break;
 372                 }
 373                 bundlePath = clientCode->canonicalPath();
 374         }
 375
 376         AuthItemSet processHints = SecurityAgent::Client::clientHints(requestorType, bundlePath, thisProcess.pid(), thisProcess.uid());
 377     environmentToClient.erase(AuthItemRef(AGENT_HINT_CLIENT_TYPE));
 378     environmentToClient.erase(AuthItemRef(AGENT_HINT_CLIENT_PATH));
 379     environmentToClient.erase(AuthItemRef(AGENT_HINT_CLIENT_PID));
 380     environmentToClient.erase(AuthItemRef(AGENT_HINT_CLIENT_UID));
 381     environmentToClient.insert(processHints.begin(), processHints.end());
 382
 383         map<string,string> defaultPrompts = inTopLevelRule->localizedPrompts();
 384
 385         if (defaultPrompts.empty())
 386                 defaultPrompts = localizedPrompts();
 387
 388         if (!defaultPrompts.empty())
 389         {
 390                 map<string,string>::const_iterator it;
 391                 for (it = defaultPrompts.begin(); it != defaultPrompts.end(); it++)
 392                 {
 393                         const string &key = it->first;
 394                         const string &value = it->second;
 395                         environmentToClient.insert(AuthItemRef(key.c_str(), AuthValueOverlay(value)));
 396                 }
 397         }
 398
 399         // add rulename as a hint
 400         string ruleName = name();
 401     environmentToClient.erase(AuthItemRef(AGENT_HINT_AUTHORIZE_RULE));
 402         environmentToClient.insert(AuthItemRef(AGENT_HINT_AUTHORIZE_RULE, AuthValueOverlay(ruleName)));
 403 }
 404
 405 OSStatus
 406 RuleImpl::evaluateAuthorization(const AuthItemRef &inRight, const Rule &inRule,
 407                 AuthItemSet &environmentToClient,
 408         AuthorizationFlags flags, CFAbsoluteTime now,
 409         const CredentialSet *inCredentials,
 410         CredentialSet &credentials, AuthorizationToken &auth) const
 411 {
 412     OSStatus status = errAuthorizationDenied;
 413
 414     string usernamehint;
 415         evaluateSessionOwner(inRight, inRule, environmentToClient, now, auth, usernamehint);
 416     if (usernamehint.length())
 417                 environmentToClient.insert(AuthItemRef(AGENT_HINT_SUGGESTED_USER, AuthValueOverlay(usernamehint)));
 418
 419     if ((mType == kUser) && (mGroupName.length()))
 420         environmentToClient.insert(AuthItemRef(AGENT_HINT_REQUIRE_USER_IN_GROUP, AuthValueOverlay(mGroupName)));
 421
 422     uint32 tries;
 423     SecurityAgent::Reason reason = SecurityAgent::noReason;
 424
 425         Process &cltProc = Server::process();
 426     // Authorization preserves creator's UID in setuid processes
 427     uid_t cltUid = (cltProc.uid() != 0) ? cltProc.uid() : auth.creatorUid();
 428     secdebug("AuthEvalMech", "Mechanism invocation by process %d (UID %d)", cltProc.pid(), cltUid);
 429
 430     AgentMechanismEvaluator eval(cltUid, auth.session(), mEvalDef);
 431
 432     for (tries = 0; tries < mTries; tries++)
 433     {
 434                 AuthItemRef retryHint(AGENT_HINT_RETRY_REASON, AuthValueOverlay(sizeof(reason), &reason));
 435                 environmentToClient.erase(retryHint); environmentToClient.insert(retryHint); // replace
 436                 AuthItemRef triesHint(AGENT_HINT_TRIES, AuthValueOverlay(sizeof(tries), &tries));
 437                 environmentToClient.erase(triesHint); environmentToClient.insert(triesHint); // replace
 438
 439         status = eval.run(AuthValueVector(), environmentToClient, auth);
 440
 441         if ((status == errAuthorizationSuccess) ||
 442             (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
 443         {
 444             secdebug("AuthEvalMech", "storing new context for authorization");
 445             auth.setInfoSet(eval.context());
 446         }
 447
 448         // successfully ran mechanisms to obtain credential
 449         if (status == errAuthorizationSuccess)
 450         {
 451             // deny is the default
 452             status = errAuthorizationDenied;
 453
 454             CredentialSet newCredentials = makeCredentials(auth);
 455             // clear context after extracting credentials
 456             auth.scrubInfoSet();
 457
 458             for (CredentialSet::const_iterator it = newCredentials.begin(); it != newCredentials.end(); ++it)
 459             {
 460                 const Credential& newCredential = *it;
 461
 462                                 // @@@ we log the uid a process was running under when it created the authref, which is misleading in the case of loginwindow
 463                                 if (newCredential->isValid())
 464                                         Syslog::info("uid %lu succeeded authenticating as user %s (uid %lu) for right %s.", auth.creatorUid(), newCredential->username().c_str(), newCredential->uid(), inRight->name());
 465                                 else
 466                                         // we can't be sure that the user actually exists so inhibit logging of uid
 467                                         Syslog::error("uid %lu failed to authenticate as user %s for right %s.", auth.creatorUid(), newCredential->username().c_str(), inRight->name());
 468
 469                 if (!newCredential->isValid())
 470                 {
 471                     reason = SecurityAgent::invalidPassphrase; //invalidPassphrase;
 472                     continue;
 473                 }
 474
 475                 // verify that this credential authorizes right
 476                 status = evaluateCredentialForRight(auth, inRight, inRule, environmentToClient, now, newCredential, true);
 477
 478                 if (status == errAuthorizationSuccess)
 479                 {
 480                                         // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent
 481                     credentials.erase(newCredential); credentials.insert(newCredential);
 482                     // use valid credential to set context info
 483                                         // XXX/cs keeping this for now, such that the uid is passed back
 484                     auth.setCredentialInfo(newCredential);
 485                     secdebug("SSevalMech", "added valid credential for user %s", newCredential->username().c_str());
 486                     status = errAuthorizationSuccess;
 487                     break;
 488                 }
 489                 else
 490                     reason = SecurityAgent::userNotInGroup; //unacceptableUser; // userNotInGroup
 491             }
 492
 493             if (status == errAuthorizationSuccess)
 494                 break;
 495         }
 496         else
 497             if ((status == errAuthorizationCanceled) ||
 498                 (status == errAuthorizationInternal))
 499                 {
 500                     auth.scrubInfoSet();
 501                     break;
 502                 }
 503             else // last mechanism is now authentication - fail
 504                 if (status == errAuthorizationDenied)
 505                     reason = SecurityAgent::invalidPassphrase;
 506
 507     }
 508
 509     // If we fell out of the loop because of too many tries, notify user
 510     if (tries == mTries)
 511     {
 512         reason = SecurityAgent::tooManyTries;
 513                 AuthItemRef retryHint (AGENT_HINT_RETRY_REASON, AuthValueOverlay(sizeof(reason), &reason));
 514                 environmentToClient.erase(retryHint); environmentToClient.insert(retryHint); // replace
 515                 AuthItemRef triesHint(AGENT_HINT_TRIES, AuthValueOverlay(sizeof(tries), &tries));
 516                 environmentToClient.erase(triesHint); environmentToClient.insert(triesHint); // replace
 517         eval.run(AuthValueVector(), environmentToClient, auth);
 518         // XXX/cs is this still necessary?
 519         auth.scrubInfoSet();
 520
 521                 CommonCriteria::AuditRecord auditrec(auth.creatorAuditToken());
 522                 auditrec.submit(AUE_ssauthorize, CommonCriteria::errTooManyTries, inRight->name());
 523     }
 524
 525     return status;
 526 }
 527
 528 // create externally verified credentials on the basis of
 529 // mechanism-provided information
 530 CredentialSet
 531 RuleImpl::makeCredentials(const AuthorizationToken &auth) const
 532 {
 533     // fetch context and construct a credential to be tested
 534     const AuthItemSet &context = const_cast<AuthorizationToken &>(auth).infoSet();
 535     CredentialSet newCredentials;
 536
 537     do {
 538         AuthItemSet::const_iterator found = find_if(context.begin(), context.end(), FindAuthItemByRightName(kAuthorizationEnvironmentUsername) );
 539         if (found == context.end())
 540             break;
 541         string username = (**found).stringValue();
 542         secdebug("AuthEvalMech", "found username");
 543
 544         const uid_t *uid = NULL;
 545         found = find_if(context.begin(), context.end(), FindAuthItemByRightName("uid") );
 546         if (found != context.end())
 547         {
 548             uid = static_cast<const uid_t *>((**found).value().data);
 549             secdebug("AuthEvalMech", "found uid");
 550         }
 551
 552         const gid_t *gid = NULL;
 553         found = find_if(context.begin(), context.end(), FindAuthItemByRightName("gid") );
 554         if (found != context.end())
 555         {
 556             gid = static_cast<const gid_t *>((**found).value().data);
 557             secdebug("AuthEvalMech", "found gid");
 558         }
 559
 560         if (username.length() && uid && gid)
 561         {
 562             // credential is valid because mechanism says so
 563             newCredentials.insert(Credential(username, *uid, *gid, mShared));
 564         }
 565         else
 566         {
 567             found = find_if(context.begin(), context.end(), FindAuthItemByRightName(kAuthorizationEnvironmentPassword) );
 568             if (found != context.end())
 569             {
 570                 secdebug("AuthEvalMech", "found password");
 571                 string password = (**found).stringValue();
 572                 secdebug("AuthEvalMech", "falling back on username/password credential if valid");
 573                                 Credential newCred(username, password, mShared);
 574                 newCredentials.insert(newCred);
 575                                 CommonCriteria::AuditRecord auditrec(auth.creatorAuditToken());
 576                                 if (newCred->isValid())
 577                                         auditrec.submit(AUE_ssauthorize, CommonCriteria::errNone, name().c_str());
 578                                 else
 579                                         auditrec.submit(AUE_ssauthorize, CommonCriteria::errInvalidCredential, name().c_str());
 580             }
 581         }
 582     } while(0);
 583
 584     return newCredentials;
 585 }
 586
 587 // evaluate whether a good credential of the current session owner would authorize a right
 588 OSStatus
 589 RuleImpl::evaluateSessionOwner(const AuthItemRef &inRight, const Rule &inRule,
 590                            const AuthItemSet &environment,
 591                            const CFAbsoluteTime now,
 592                            const AuthorizationToken &auth,
 593                            string& usernamehint) const
 594 {
 595     // username hint is taken from the user who created the authorization, unless it's clearly ineligible
 596         OSStatus status = noErr;
 597         // @@@ we have no access to current requester uid here and the process uid is only taken when the authorization is created
 598         // meaning that a process like loginwindow that drops privs later is screwed.
 599
 600         uid_t uid;
 601         Session &session = auth.session();
 602
 603         if (session.haveOriginatorUid())
 604                 uid = session.originatorUid();
 605         else
 606                 uid = auth.creatorUid();
 607
 608         Server::active().longTermActivity();
 609         struct passwd *pw = getpwuid(uid);
 610         if (pw != NULL)
 611         {
 612                 // avoid hinting a locked account
 613                 if ( (pw->pw_passwd == NULL) ||
 614                                 strcmp(pw->pw_passwd, "*") ) {
 615                         // Check if username will authorize the request and set username to
 616                         // be used as a hint to the user if so
 617                         secdebug("AuthEvalMech", "preflight credential from current user, result follows:");
 618                         status = evaluateCredentialForRight(auth, inRight, inRule, environment, now, Credential(pw->pw_name, pw->pw_uid, pw->pw_gid, mShared), true);
 619
 620                         if (status == errAuthorizationSuccess)
 621                                 usernamehint = pw->pw_name;
 622                 } //fi
 623                 endpwent();
 624         }
 625         return status;
 626 }
 627
 628
 629
 630 // Return errAuthorizationSuccess if this rule allows access based on the specified credential,
 631 // return errAuthorizationDenied otherwise.
 632 OSStatus
 633 RuleImpl::evaluateCredentialForRight(const AuthorizationToken &auth, const AuthItemRef &inRight, const Rule &inRule, const AuthItemSet &environment, CFAbsoluteTime now, const Credential &credential, bool ignoreShared) const
 634 {
 635         assert(mType == kUser);
 636
 637         // Get the username from the credential
 638         const char *user = credential->username().c_str();
 639
 640         // If the credential is not valid or it's age is more than the allowed maximum age
 641         // for a credential, deny.
 642         if (!credential->isValid())
 643         {
 644                 secdebug("autheval", "credential for user %s is invalid, denying right %s", user, inRight->name());
 645                 return errAuthorizationDenied;
 646         }
 647
 648         if (now - credential->creationTime() > mMaxCredentialAge)
 649         {
 650                 secdebug("autheval", "credential for user %s has expired, denying right %s", user, inRight->name());
 651                 return errAuthorizationDenied;
 652         }
 653
 654         if (!ignoreShared && !mShared && credential->isShared())
 655         {
 656                 secdebug("autheval", "shared credential for user %s cannot be used, denying right %s", user, inRight->name());
 657                 return errAuthorizationDenied;
 658         }
 659
 660         // A root (uid == 0) user can do anything
 661         if (credential->uid() == 0)
 662         {
 663                 secdebug("autheval", "user %s has uid 0, granting right %s", user, inRight->name());
 664                 return errAuthorizationSuccess;
 665         }
 666
 667     if (mSessionOwner)
 668     {
 669                 Session &session = auth.session();
 670                 if (session.haveOriginatorUid())
 671                 {
 672                         uid_t console_user = session.originatorUid();
 673
 674             if (credential->uid() == console_user)
 675             {
 676                 secdebug("autheval", "user %s is session-owner(uid: %d), granting right %s", user, console_user, inRight->name());
 677                 return errAuthorizationSuccess;
 678             }
 679         }
 680         else
 681             secdebug("autheval", "session-owner check failed.");
 682     }
 683
 684         if (mGroupName.length())
 685         {
 686                 const char *groupname = mGroupName.c_str();
 687                 Server::active().longTermActivity();
 688
 689                 if (!groupname)
 690                         return errAuthorizationDenied;
 691
 692                 do
 693                 {
 694                         uuid_t group_uuid, user_uuid;
 695                         int is_member;
 696
 697                         if (mbr_group_name_to_uuid(groupname, group_uuid))
 698                                 break;
 699
 700                         if (mbr_uid_to_uuid(credential->uid(), user_uuid))
 701                                 break;
 702
 703                         if (mbr_check_membership(user_uuid, group_uuid, &is_member))
 704                                 break;
 705
 706                         if (is_member)
 707                         {
 708                                 secdebug("autheval", "user %s is a member of group %s, granting right %s",
 709                                         user, groupname, inRight->name());
 710                                 return errAuthorizationSuccess;
 711                         }
 712
 713                 }
 714                 while (0);
 715
 716                 secdebug("autheval", "user %s is not a member of group %s, denying right %s",
 717                         user, groupname, inRight->name());
 718         }
 719
 720         return errAuthorizationDenied;
 721 }
 722
 723
 724
 725 OSStatus
 726 RuleImpl::evaluateUser(const AuthItemRef &inRight, const Rule &inRule,
 727     AuthItemSet &environmentToClient, AuthorizationFlags flags,
 728         CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
 729         AuthorizationToken &auth) const
 730 {
 731         // If we got here, this is a kUser type rule, let's start looking for a
 732         // credential that is satisfactory
 733
 734         // Zeroth -- Here is an extra special saucy ugly hack to allow authorizations
 735         // created by a proccess running as root to automatically get a right.
 736         if (mAllowRoot && auth.creatorUid() == 0)
 737         {
 738                 secdebug("autheval", "creator of authorization has uid == 0 granting right %s",
 739                         inRight->name());
 740                 return errAuthorizationSuccess;
 741         }
 742
 743         // if we're not supposed to authenticate evaluate the session-owner against the group
 744         if (!mAuthenticateUser)
 745         {
 746                 string username;
 747                 OSStatus status = evaluateSessionOwner(inRight, inRule, environmentToClient, now, auth, username);
 748
 749                 if (!status)
 750                         return errAuthorizationSuccess;
 751
 752                 return errAuthorizationDenied;
 753         }
 754
 755         // First -- go though the credentials we either already used or obtained during this authorize operation.
 756         for (CredentialSet::const_iterator it = credentials.begin(); it != credentials.end(); ++it)
 757         {
 758                 OSStatus status = evaluateCredentialForRight(auth, inRight, inRule, environmentToClient, now, *it, true);
 759                 if (status != errAuthorizationDenied)
 760                 {
 761                         // add credential to authinfo
 762                         auth.setCredentialInfo(*it);
 763                         return status;
 764                 }
 765         }
 766
 767         // Second -- go though the credentials passed in to this authorize operation by the state management layer.
 768         if (inCredentials)
 769         {
 770                 for (CredentialSet::const_iterator it = inCredentials->begin(); it != inCredentials->end(); ++it)
 771                 {
 772                         OSStatus status = evaluateCredentialForRight(auth, inRight, inRule, environmentToClient, now, *it, false);
 773                         if (status == errAuthorizationSuccess)
 774                         {
 775                                 // Add the credential we used to the output set.
 776                                 // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent
 777                                 credentials.erase(*it); credentials.insert(*it);
 778                 // add credential to authinfo
 779                 auth.setCredentialInfo(*it);
 780
 781                                 return status;
 782                         }
 783                         else if (status != errAuthorizationDenied)
 784                                 return status;
 785                 }
 786         }
 787
 788         // Finally -- We didn't find the credential in our passed in credential lists.  Obtain a new credential if
 789         // our flags let us do so.
 790         if (!(flags & kAuthorizationFlagExtendRights))
 791                 return errAuthorizationDenied;
 792
 793         // authorizations that timeout immediately cannot be preauthorized
 794         if ((flags & kAuthorizationFlagPreAuthorize) &&
 795                 (mMaxCredentialAge == 0.0))
 796         {
 797                 inRight->setFlags(inRight->flags() | kAuthorizationFlagCanNotPreAuthorize);
 798                 return errAuthorizationSuccess;
 799         }
 800
 801         if (!(flags & kAuthorizationFlagInteractionAllowed))
 802                 return errAuthorizationInteractionNotAllowed;
 803
 804         setAgentHints(inRight, inRule, environmentToClient, auth);
 805
 806     // If a different evaluation is prescribed,
 807     // we'll run that and validate the credentials from there
 808     // we fall back on a default configuration
 809         return evaluateAuthorization(inRight, inRule, environmentToClient, flags, now, inCredentials, credentials, auth);
 810 }
 811
 812 OSStatus
 813 RuleImpl::evaluateMechanismOnly(const AuthItemRef &inRight, const Rule &inRule, AuthItemSet &environmentToClient, AuthorizationToken &auth, CredentialSet &outCredentials) const
 814 {
 815         uint32 tries = 0;
 816         OSStatus status;
 817
 818         Process &cltProc = Server::process();
 819     // Authorization preserves creator's UID in setuid processes
 820     uid_t cltUid = (cltProc.uid() != 0) ? cltProc.uid() : auth.creatorUid();
 821     secdebug("AuthEvalMech", "Mechanism invocation by process %d (UID %d)", cltProc.pid(), cltUid);
 822
 823     {
 824         AgentMechanismEvaluator eval(cltUid, auth.session(), mEvalDef);
 825
 826         do
 827         {
 828             setAgentHints(inRight, inRule, environmentToClient, auth);
 829             AuthItemRef triesHint(AGENT_HINT_TRIES, AuthValueOverlay(sizeof(tries), &tries));
 830             environmentToClient.erase(triesHint); environmentToClient.insert(triesHint); // replace
 831
 832             status = eval.run(AuthValueVector(), environmentToClient, auth);
 833
 834             if ((status == errAuthorizationSuccess) ||
 835                 (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
 836             {
 837                 secdebug("AuthEvalMech", "storing new context for authorization");
 838                 auth.setInfoSet(eval.context());
 839                 if (status == errAuthorizationSuccess)
 840                 {
 841                     outCredentials = makeCredentials(auth);
 842                 }
 843             }
 844
 845             tries++;
 846         }
 847         while ((status == errAuthorizationDenied) // only if we have an expected failure we continue
 848                     && ((mTries == 0)                           // mTries == 0 means we try forever
 849                         || ((mTries > 0)                        // mTries > 0 means we try up to mTries times
 850                             && (tries < mTries))));
 851     }
 852
 853     // HACK kill all hosts to free pages for low memory systems
 854         if (name() == "system.login.console")
 855         {
 856                 QueryInvokeMechanism query(securityAgent, auth.session());
 857                 query.terminateAgent();
 858                 QueryInvokeMechanism query2(privilegedAuthHost, auth.session());
 859                 query2.terminateAgent();
 860         }
 861
 862         return status;
 863 }
 864
 865 OSStatus
 866 RuleImpl::evaluateRules(const AuthItemRef &inRight, const Rule &inRule,
 867     AuthItemSet &environmentToClient, AuthorizationFlags flags,
 868         CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
 869         AuthorizationToken &auth) const
 870 {
 871         // line up the rules to try
 872         if (!mRuleDef.size())
 873                 return errAuthorizationSuccess;
 874
 875         uint32_t count = 0;
 876         OSStatus status = errAuthorizationSuccess;
 877         vector<Rule>::const_iterator it;
 878
 879         for (it = mRuleDef.begin();it != mRuleDef.end(); it++)
 880         {
 881                 // are we at k yet?
 882                 if ((mType == kKofN) && (count == mKofN))
 883                         return errAuthorizationSuccess;
 884
 885                 // get a rule and try it
 886                 status = (*it)->evaluate(inRight, inRule, environmentToClient, flags, now, inCredentials, credentials, auth);
 887
 888                 // if status is cancel/internal error abort
 889                 if ((status == errAuthorizationCanceled) || (status == errAuthorizationInternal))
 890                         return status;
 891
 892                 if (status != errAuthorizationSuccess)
 893                 {
 894                         // continue if we're only looking for k of n
 895                         if (mType == kKofN)
 896                                 continue;
 897
 898                         break;
 899                 }
 900                 else
 901                         count++;
 902         }
 903
 904         return status; // return the last failure
 905 }
 906
 907
 908 OSStatus
 909 RuleImpl::evaluate(const AuthItemRef &inRight, const Rule &inRule,
 910     AuthItemSet &environmentToClient, AuthorizationFlags flags,
 911         CFAbsoluteTime now, const CredentialSet *inCredentials, CredentialSet &credentials,
 912         AuthorizationToken &auth) const
 913 {
 914         switch (mType)
 915         {
 916         case kAllow:
 917                 secdebug("autheval", "rule is always allow");
 918                 return errAuthorizationSuccess;
 919         case kDeny:
 920                 secdebug("autheval", "rule is always deny");
 921                 return errAuthorizationDenied;
 922         case kUser:
 923                 secdebug("autheval", "rule is user");
 924                 return evaluateUser(inRight, inRule, environmentToClient, flags, now, inCredentials, credentials, auth);
 925         case kRuleDelegation:
 926         secdebug("autheval", "rule evaluates rules");
 927                 return evaluateRules(inRight, inRule, environmentToClient, flags, now, inCredentials, credentials, auth);
 928         case kKofN:
 929         secdebug("autheval", "rule evaluates k-of-n rules");
 930                 return evaluateRules(inRight, inRule, environmentToClient, flags, now, inCredentials, credentials, auth);
 931     case kEvaluateMechanisms:
 932         secdebug("autheval", "rule evaluates mechanisms");
 933         return evaluateMechanismOnly(inRight, inRule, environmentToClient, auth, credentials);
 934     default:
 935                 MacOSError::throwMe(errAuthorizationInternal); // XXX/cs invalid rule
 936         }
 937 }
 938
 939 Rule::Rule() : RefPointer<RuleImpl>(new RuleImpl()) {}
 940 Rule::Rule(const string &inRightName, CFDictionaryRef cfRight, CFDictionaryRef cfRules) : RefPointer<RuleImpl>(new RuleImpl(inRightName, cfRight, cfRules)) {}
 941
 942
 943
 944 } // end namespace Authorization