securityd-55137.5.tar.gz

[apple/securityd.git] / src / authority.cpp

diff --git a/src/authority.cpp b/src/authority.cpp
index 8e328cbd924aaca454171177673ad9cdd92cb682..f3371af3ac581e7a7d6407dd617364db2ce3fced 100644 (file)
--- a/src/authority.cpp
+++ b/src/authority.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2004 Apple Computer, Inc. All Rights Reserved.
+ * Copyright (c) 2000-2004,2008-2009 Apple Inc. All Rights Reserved.
  * 
  * @APPLE_LICENSE_HEADER_START@
  * 
@@ -35,6 +35,8 @@
 
 #include <security_utilities/ccaudit.h>                // AuditToken
 
+#include <sandbox.h>
+
 using Authorization::AuthItemSet;
 using Authorization::AuthItemRef;
 using Authorization::AuthValue;
@@ -54,14 +56,26 @@ Mutex AuthorizationToken::authMapLock; // lock for mAuthorizations (only)
 // Create an authorization token.
 //
 AuthorizationToken::AuthorizationToken(Session &ssn, const CredentialSet &base, 
-const audit_token_t &auditToken)
+const audit_token_t &auditToken, bool operateAsLeastPrivileged)
        : mBaseCreds(base), mTransferCount(INT_MAX), 
-    mCreatorCode(Server::process().clientCode()),
        mCreatorPid(Server::process().pid()), 
-       mCreatorAuditToken(auditToken)
+       mCreatorAuditToken(auditToken),
+       mOperatesAsLeastPrivileged(operateAsLeastPrivileged)
 {
        mCreatorUid = mCreatorAuditToken.euid();
        mCreatorGid = mCreatorAuditToken.egid();
+
+       if (sandbox_check(mCreatorPid, "authorization-right-obtain", SANDBOX_CHECK_NO_REPORT) != 0)
+               mCreatorSandboxed = true;
+       else
+               mCreatorSandboxed = false;
+       
+       {
+               Process &thisProcess = Server::process();
+               StLock<Mutex> _(thisProcess);
+               if (SecCodeRef code = thisProcess.currentGuest())
+                       MacOSError::check(SecCodeCopyStaticCode(code, kSecCSDefaultFlags, &mCreatorCode.aref()));
+       }
                
        // link to session
        referent(ssn);
@@ -74,9 +88,8 @@ const audit_token_t &auditToken)
     authMap[mHandle] = this;
        
     // all ready
-       secdebug("SSauth", "Authorization %p created using %d credentials; owner=%s",
-               this, int(mBaseCreds.size()),
-        mCreatorCode ? mCreatorCode->encode().c_str() : "unknown");
+       secdebug("SSauth", "Authorization %p created using %d credentials; owner=%p",
+               this, int(mBaseCreds.size()), mCreatorCode.get());
 }
 
 AuthorizationToken::~AuthorizationToken()
@@ -94,6 +107,18 @@ Session &AuthorizationToken::session() const
 }
 
 
+std::string AuthorizationToken::creatorPath() const
+{
+       if (mCreatorCode) {
+               StLock<Mutex> _(mLock);
+               CFRef<CFURLRef> path;
+               if (SecCodeCopyPath(mCreatorCode, kSecCSDefaultFlags, &path.aref()) == noErr)
+                       return cfString(path);
+       }
+       return "unknown";
+}
+
+
 //
 // Locate an authorization given its blob.
 //
@@ -234,30 +259,40 @@ AuthorizationToken::infoSet(AuthorizationString tag)
 }
 
 void
-AuthorizationToken::setInfoSet(AuthItemSet &newInfoSet)
+AuthorizationToken::setInfoSet(AuthItemSet &newInfoSet, bool savePassword)
 {
        StLock<Mutex> _(mLock); // consider a separate lock
     secdebug("SSauth", "Authorization %p setting new context", this);
+       
+       AuthItemSet::const_iterator end = mInfoSet.end();
+       for (AuthItemSet::const_iterator it = mInfoSet.begin(); it != end; ++it) {
+               const AuthItemRef &item = *it;
+               if (0 == strcmp(item->name(), "password")) {
+                       mSavedPassword.clear();
+                       mSavedPassword.insert(item);
+               }
+       }
+       
+       if (true == savePassword)
+               newInfoSet.insert(mSavedPassword.begin(), mSavedPassword.end());
+
     mInfoSet = newInfoSet;
 }
 
 // This is destructive (non-merging)
 void
-AuthorizationToken::setCredentialInfo(const Credential &inCred)
+AuthorizationToken::setCredentialInfo(const Credential &inCred, bool savePassword)
 {
     AuthItemSet dstInfoSet;
-    char uid_string[16]; // fit a uid_t(u_int32_t)
-       
-    if (snprintf(uid_string, sizeof(uid_string), "%u", inCred->uid()) >=
-               int(sizeof(uid_string)))
-        uid_string[0] = '\0';
-    AuthItemRef uidHint("uid", AuthValueOverlay(uid_string ? strlen(uid_string) + 1 : 0, uid_string), 0);
+
+    uid_t uid = inCred->uid();
+    AuthItemRef uidHint("uid", AuthValueOverlay(sizeof(uid), &uid));
     dstInfoSet.insert(uidHint);
  
-    AuthItemRef userHint("username", AuthValueOverlay(inCred->username()), 0);
+    AuthItemRef userHint("username", AuthValueOverlay(inCred->name()), 0);
     dstInfoSet.insert(userHint);
  
-       setInfoSet(dstInfoSet);
+       setInfoSet(dstInfoSet, savePassword);
 }
 
 void
@@ -265,11 +300,11 @@ AuthorizationToken::clearInfoSet()
 {
     AuthItemSet dstInfoSet;
     secdebug("SSauth", "Authorization %p clearing context", this);
-    setInfoSet(dstInfoSet);
+    setInfoSet(dstInfoSet, false);
 }
 
 void
-AuthorizationToken::scrubInfoSet()
+AuthorizationToken::scrubInfoSet(bool savePassword)
 {
        AuthItemSet srcInfoSet = infoSet(), dstInfoSet;
        AuthItemSet::const_iterator end = srcInfoSet.end();
@@ -280,5 +315,5 @@ AuthorizationToken::scrubInfoSet()
                        dstInfoSet.insert(item);
        }
     secdebug("SSauth", "Authorization %p scrubbing context", this);
-    setInfoSet(dstInfoSet);
+    setInfoSet(dstInfoSet, savePassword);
 }