securityd-55199.3.tar.gz

[apple/securityd.git] / src / acls.cpp

diff --git a/src/acls.cpp b/src/acls.cpp
index e2be78fe74f314eff942bfdc4927c0d8857def72..2c2cb5b395fa17328eca8ac113df77deeb4da2c0 100644 (file)
--- a/src/acls.cpp
+++ b/src/acls.cpp
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (c) 2000-2004 Apple Computer, Inc. All Rights Reserved.
+ * Copyright (c) 2000-2008 Apple Inc. All Rights Reserved.

  * 
  * @APPLE_LICENSE_HEADER_START@
  * 
  * 
  * @APPLE_LICENSE_HEADER_START@
  * 


@@ -30,12 +30,15 @@
 #include "server.h"
 #include "agentquery.h"
 #include "tokendatabase.h"
 #include "server.h"
 #include "agentquery.h"
 #include "tokendatabase.h"

+#include "acl_keychain.h"

 
 // ACL subjects whose Environments we implement
 #include <security_cdsa_utilities/acl_any.h>
 #include <security_cdsa_utilities/acl_password.h>
 #include <security_cdsa_utilities/acl_threshold.h>
 
 
 // ACL subjects whose Environments we implement
 #include <security_cdsa_utilities/acl_any.h>
 #include <security_cdsa_utilities/acl_password.h>
 #include <security_cdsa_utilities/acl_threshold.h>
 

+#include <sys/sysctl.h>
+#include <security_utilities/logging.h>

 
 //
 // SecurityServerAcl is virtual
 
 //
 // SecurityServerAcl is virtual


@@ -53,17 +56,20 @@ SecurityServerAcl::~SecurityServerAcl()
 //
 void SecurityServerAcl::getOwner(AclOwnerPrototype &owner)
 {
 //
 void SecurityServerAcl::getOwner(AclOwnerPrototype &owner)
 {

+       StLock<Mutex> _(aclSequence);

        ObjectAcl::cssmGetOwner(owner);
 }
 
 void SecurityServerAcl::getAcl(const char *tag, uint32 &count, AclEntryInfo *&acls)
 {
        ObjectAcl::cssmGetOwner(owner);
 }
 
 void SecurityServerAcl::getAcl(const char *tag, uint32 &count, AclEntryInfo *&acls)
 {

+       StLock<Mutex> _(aclSequence);

        ObjectAcl::cssmGetAcl(tag, count, acls);
 }
 
 void SecurityServerAcl::changeAcl(const AclEdit &edit, const AccessCredentials *cred,
        Database *db)
 {
        ObjectAcl::cssmGetAcl(tag, count, acls);
 }
 
 void SecurityServerAcl::changeAcl(const AclEdit &edit, const AccessCredentials *cred,
        Database *db)
 {

+       StLock<Mutex> _(aclSequence);

        SecurityServerEnvironment env(*this, db);
        ObjectAcl::cssmChangeAcl(edit, cred, &env);
 }
        SecurityServerEnvironment env(*this, db);
        ObjectAcl::cssmChangeAcl(edit, cred, &env);
 }


@@ -71,6 +77,7 @@ void SecurityServerAcl::changeAcl(const AclEdit &edit, const AccessCredentials *
 void SecurityServerAcl::changeOwner(const AclOwnerPrototype &newOwner,
        const AccessCredentials *cred, Database *db)
 {
 void SecurityServerAcl::changeOwner(const AclOwnerPrototype &newOwner,
        const AccessCredentials *cred, Database *db)
 {

+       StLock<Mutex> _(aclSequence);

        SecurityServerEnvironment env(*this, db);
        ObjectAcl::cssmChangeOwner(newOwner, cred, &env);
 }
        SecurityServerEnvironment env(*this, db);
        ObjectAcl::cssmChangeOwner(newOwner, cred, &env);
 }


@@ -82,6 +89,7 @@ void SecurityServerAcl::changeOwner(const AclOwnerPrototype &newOwner,
 void SecurityServerAcl::validate(AclAuthorization auth, const AccessCredentials *cred, Database *db)
 {
     SecurityServerEnvironment env(*this, db);
 void SecurityServerAcl::validate(AclAuthorization auth, const AccessCredentials *cred, Database *db)
 {
     SecurityServerEnvironment env(*this, db);

+       

        StLock<Mutex> objectSequence(aclSequence);
        StLock<Mutex> processSequence(Server::process().aclSequence);
     ObjectAcl::validate(auth, cred, &env);
        StLock<Mutex> objectSequence(aclSequence);
        StLock<Mutex> processSequence(Server::process().aclSequence);
     ObjectAcl::validate(auth, cred, &env);


@@ -94,6 +102,91 @@ void SecurityServerAcl::validate(AclAuthorization auth, const Context &context,
 }
 
 
 }
 
 

+//
+// This helper tries to add the (new) subject given to the ACL
+// whose validation is currently proceeding through context.
+// This will succeed if the ACL is in standard form, which means
+// a ThresholdAclSubject.
+// The new subject will be added at the front (so it is checked first
+// from now on), and as a side effect we'll notify the client side to
+// re-encode the object.
+// Returns true if the edit could be done, or false if the ACL wasn't
+// standard enough. May throw if the ACL is malformed or otherwise messed up.
+//
+// This is a self-contained helper that is here merely because it's "about"
+// ACLs and has no better home.
+//
+bool SecurityServerAcl::addToStandardACL(const AclValidationContext &context, AclSubject *subject)
+{
+       if (SecurityServerEnvironment *env = context.environment<SecurityServerEnvironment>())
+               if (ThresholdAclSubject *threshold = env->standardSubject(context)) {
+                       unsigned size = threshold->count();
+                       if (dynamic_cast<KeychainPromptAclSubject *>(threshold->subject(size-1))) {
+                               // looks standard enough
+                               secdebug("acl", "adding new subject %p to from of threshold ACL", subject);
+                               threshold->add(subject, 0);
+                               
+                               // tell the ACL it's been modified
+                               context.acl()->changedAcl();
+
+                               // trigger a special notification code on (otherwise successful) return
+                               Server::connection().overrideReturn(CSSMERR_CSP_APPLE_ADD_APPLICATION_ACL_SUBJECT);
+                               return true;
+                       }
+               }
+       secdebug("acl", "ACL is not standard form; cannot edit");
+       return false;
+}
+
+
+//
+// Look at the ACL whose validation is currently proceeding through context.
+// If it LOOKS like a plausible version of a legacy "dot mac item" ACL.
+// We don't have access to the database attributes of the item up here in the
+// securityd sky, so we have to apply a heuristic based on which applications (by path)
+// are given access to the item.
+// So this is strictly a heuristic. The potential downside is that we may inadvertently
+// give access to new .Mac authorized Apple (only) applications when the user only intended
+// a limited set of extremely popular Apple (only) applications that just happen to all be
+// .Mac authorized today. We can live with that.
+//
+bool SecurityServerAcl::looksLikeLegacyDotMac(const AclValidationContext &context)
+{
+       static const char * const prototypicalDotMacPath[] = {
+               "/Applications/Mail.app",
+               "/Applications/Safari.app",
+               "/Applications/iSync.app",
+               "/Applications/System Preferences.app",
+               "/Applications/iCal.app",
+               "/Applications/iChat.app",
+               "/Applications/iTunes.app",
+               "/Applications/Address Book.app",
+               "/Applications/iSync.app",
+               NULL    // sentinel
+       };
+       
+       static const unsigned threshold = 6;
+       
+       if (SecurityServerEnvironment *env = context.environment<SecurityServerEnvironment>()) {
+               if (ThresholdAclSubject *list = env->standardSubject(context)) {
+                       unsigned count = list->count();
+                       unsigned matches = 0;
+                       for (unsigned n = 0; n < count; ++n) {
+                               if (CodeSignatureAclSubject *app = dynamic_cast<CodeSignatureAclSubject *>(list->subject(n))) {
+                                       for (const char * const *p = prototypicalDotMacPath; *p; p++)
+                                               if (app->path() == *p)
+                                                       matches++;
+                               }
+                       }
+                       secdebug("codesign", "matched %d of %zd candididates (threshold=%d)",
+                               matches, sizeof(prototypicalDotMacPath) / sizeof(char *) - 1, threshold);
+                       return matches >= threshold;
+               }
+       }
+       return false;
+}
+
+

 //
 // External storage interface
 //
 //
 // External storage interface
 //


@@ -135,10 +228,10 @@ pid_t SecurityServerEnvironment::getpid() const
 //
 // CodeSignatureAclSubject personality: take code signature from active Process object
 //
 //
 // CodeSignatureAclSubject personality: take code signature from active Process object
 //

-bool SecurityServerEnvironment::verifyCodeSignature(const CodeSigning::Signature *signature,
-       const CssmData *comment)
+bool SecurityServerEnvironment::verifyCodeSignature(const OSXVerifier &verifier,
+       const AclValidationContext &context)

 {
 {

-       return Server::codeSignatures().verify(Server::process(), signature, comment);
+       return Server::codeSignatures().verify(Server::process(), verifier, context);

 }
 
 
 }
 
 


@@ -150,6 +243,7 @@ bool SecurityServerEnvironment::getSecret(CssmOwnedData &secret, const CssmData
        //@@@ ignoring prompt - not used right now
        if (database) {
                QueryPIN query(*database);
        //@@@ ignoring prompt - not used right now
        if (database) {
                QueryPIN query(*database);

+               query.inferHints(Server::process());

                if (!query()) { // success
                        secret = query.pin();
                        return true;
                if (!query()) { // success
                        secret = query.pin();
                        return true;


@@ -183,9 +277,21 @@ ObjectAcl *SecurityServerEnvironment::preAuthSource()
 }
 
 
 }
 
 

+//
+// Autonomous ACL editing support
+//
+ThresholdAclSubject *SecurityServerEnvironment::standardSubject(const AclValidationContext &context)
+{
+       return dynamic_cast<ThresholdAclSubject *>(context.subject());
+}
+
+

 //
 // The default AclSource denies having an ACL at all
 //
 //
 // The default AclSource denies having an ACL at all
 //

+AclSource::~AclSource()
+{ /* virtual */ }
+

 SecurityServerAcl &AclSource::acl()
 {
        CssmError::throwMe(CSSM_ERRCODE_OBJECT_ACL_NOT_SUPPORTED);
 SecurityServerAcl &AclSource::acl()
 {
        CssmError::throwMe(CSSM_ERRCODE_OBJECT_ACL_NOT_SUPPORTED);