- if ((status == errAuthorizationSuccess) ||
- (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
- {
- secdebug("AuthEvalMech", "storing new context for authorization");
- auth.setInfoSet(eval.context());
- if (status == errAuthorizationSuccess)
- {
- outCredentials = makeCredentials(eval.context());
- }
- }
-
- tries++;
- }
- while ((status == errAuthorizationDenied) // only if we have an expected failure we continue
- && ((mTries == 0) // mTries == 0 means we try forever
- || ((mTries > 0) // mTries > 0 means we try up to mTries times
- && (tries < mTries))));
- }
-
- if (name() == "system.login.console")
- {
- QueryInvokeMechanism query(cltUid, cltProc.session());
- query.terminateAgent();
- }
+ status = eval.run(authValueVector, environmentToClient, auth);
+ if ((status == errAuthorizationSuccess) ||
+ (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
+ {
+ secdebug("AuthEvalMech", "storing new context for authorization");
+ auth.setInfoSet(eval.context(), savePassword);
+ if (status == errAuthorizationSuccess)
+ {
+ // (try to) attach the authorizing UID to the least-priv cred
+ if (auth.operatesAsLeastPrivileged())
+ {
+ outCredentials.insert(Credential(rightName, mShared));
+ if (mShared)
+ outCredentials.insert(Credential(rightName, false));
+
+ RightAuthenticationLogger logger(auth.creatorAuditToken(), AUE_ssauthint);
+ logger.setRight(rightName);
+
+ AuthItem *uidItem = eval.context().find(AGENT_CONTEXT_UID);
+ if (uidItem)
+ {
+ uid_t authorizedUid;
+ memcpy(&authorizedUid, uidItem->value().data, sizeof(authorizedUid));
+ secdebug("AuthEvalMech", "generating least-privilege cred for '%s' authorized by UID %u", inRight->name(), authorizedUid);
+ logger.logLeastPrivilege(authorizedUid, true);
+ }
+ else // cltUid is better than nothing
+ {
+ secdebug("AuthEvalMech", "generating least-privilege cred for '%s' with process- or auth-UID %u", inRight->name(), cltUid);
+ logger.logLeastPrivilege(cltUid, false);
+ }
+ }
+
+ if (0 == strcmp(rightName, "system.login.console") && NULL == eval.context().find(AGENT_CONTEXT_AUTO_LOGIN)) {
+ secdebug("AuthEvalMech", "We logged in as the session owner.\n");
+ SessionAttributeBits flags = auth.session().attributes();
+ flags |= AU_SESSION_FLAG_HAS_AUTHENTICATED;
+ auth.session().setAttributes(flags);
+ }
+ CredentialSet newCredentials = makeCredentials(auth);
+ outCredentials.insert(newCredentials.begin(), newCredentials.end());
+ }
+ }
+
+ tries++;
+ }
+ while ((status == errAuthorizationDenied) // only if we have an expected failure we continue
+ && ((mTries == 0) // mTries == 0 means we try forever
+ || ((mTries > 0) // mTries > 0 means we try up to mTries times
+ && (tries < mTries))));
+ }
+
+ // HACK kill all hosts to free pages for low memory systems
+ // (XXX/gh there should be a #define for this right)
+ if (name() == "system.login.done")
+ {
+ // one case where we don't want to mark the agents as "busy"
+ QueryInvokeMechanism query(securityAgent, auth.session());
+ query.terminateAgent();
+ QueryInvokeMechanism query2(privilegedAuthHost, auth.session());
+ query2.terminateAgent();
+ }
projects / apple / securityd.git / blobdiff