- status = eval.run(AuthValueVector(), environmentToClient, auth);
-
- if ((status == errAuthorizationSuccess) ||
- (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
- {
- secdebug("AuthEvalMech", "storing new context for authorization");
- auth.setInfoSet(eval.context());
- }
-
- // successfully ran mechanisms to obtain credential
- if (status == errAuthorizationSuccess)
- {
- // deny is the default
- status = errAuthorizationDenied;
-
- CredentialSet newCredentials = makeCredentials(auth);
- // clear context after extracting credentials
- auth.scrubInfoSet();
-
- CommonCriteria::AuditRecord auditrec(auth.creatorAuditToken());
- for (CredentialSet::const_iterator it = newCredentials.begin(); it != newCredentials.end(); ++it)
- {
- const Credential& newCredential = *it;
-
- // @@@ we log the uid a process was running under when it created the authref, which is misleading in the case of loginwindow
- if (newCredential->isValid()) {
- Syslog::info("uid %lu succeeded authenticating as user %s (uid %lu) for right %s.", auth.creatorUid(), newCredential->name().c_str(), newCredential->uid(), inRight->name());
- auditrec.submit(AUE_ssauthint, CommonCriteria::errNone, inRight->name());
- } else {
- // we can't be sure that the user actually exists so inhibit logging of uid
- Syslog::error("uid %lu failed to authenticate as user %s for right %s.", auth.creatorUid(), newCredential->name().c_str(), inRight->name());
- auditrec.submit(AUE_ssauthint, CommonCriteria::errInvalidCredential, inRight->name());
- }
-
- if (!newCredential->isValid())
- {
- reason = SecurityAgent::invalidPassphrase; //invalidPassphrase;
- continue;
- }
-
- // verify that this credential authorizes right
- status = evaluateUserCredentialForRight(auth, inRight, inRule, environmentToClient, now, newCredential, true);
-
- if (status == errAuthorizationSuccess)
- {
- if (auth.operatesAsLeastPrivileged()) {
- Credential rightCredential(inRight->name(), mShared);
- credentials.erase(rightCredential); credentials.insert(rightCredential);
- if (mShared)
- credentials.insert(Credential(inRight->name(), false));
- } else {
- // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent
- credentials.erase(newCredential); credentials.insert(newCredential);
- // just got a new credential - if it's shared also add a non-shared one that to stick in the authorizationref local cache
- if (mShared)
- credentials.insert(Credential(newCredential->uid(), newCredential->name(), newCredential->realname(), false));
- }
-
- // use valid credential to set context info
- // XXX/cs keeping this for now, such that the uid is passed back
- auth.setCredentialInfo(newCredential);
- secdebug("SSevalMech", "added valid credential for user %s", newCredential->name().c_str());
- status = errAuthorizationSuccess;
- break;
- }
- else
- reason = SecurityAgent::userNotInGroup; //unacceptableUser; // userNotInGroup
- }
+ status = eval.run(authValueVector, environmentToClient, auth);
+
+ if ((status == errAuthorizationSuccess) ||
+ (status == errAuthorizationCanceled)) // @@@ can only pass back sideband through context
+ {
+ secdebug("AuthEvalMech", "storing new context for authorization");
+ auth.setInfoSet(eval.context(), savePassword);
+ }
+
+ // successfully ran mechanisms to obtain credential
+ if (status == errAuthorizationSuccess)
+ {
+ // deny is the default
+ status = errAuthorizationDenied;
+
+ CredentialSet newCredentials = makeCredentials(auth);
+ // clear context after extracting credentials
+ auth.scrubInfoSet(savePassword);
+
+ for (CredentialSet::const_iterator it = newCredentials.begin(); it != newCredentials.end(); ++it)
+ {
+ const Credential& newCredential = *it;
+
+ // @@@ we log the uid a process was running under when it created the authref, which is misleading in the case of loginwindow
+ if (newCredential->isValid()) {
+ Syslog::info("UID %u authenticated as user %s (UID %u) for right '%s'", auth.creatorUid(), newCredential->name().c_str(), newCredential->uid(), rightName);
+ rightAuthLogger.logSuccess(auth.creatorUid(), newCredential->uid(), newCredential->name().c_str());
+ } else {
+ // we can't be sure that the user actually exists so inhibit logging of uid
+ Syslog::error("UID %u failed to authenticate as user '%s' for right '%s'", auth.creatorUid(), newCredential->name().c_str(), rightName);
+ rightAuthLogger.logFailure(auth.creatorUid(), newCredential->name().c_str());
+ }
+
+ if (!newCredential->isValid())
+ {
+ reason = SecurityAgent::invalidPassphrase;
+ continue;
+ }
+
+ // verify that this credential authorizes right
+ status = evaluateUserCredentialForRight(auth, inRight, inRule, environmentToClient, now, newCredential, true, reason);
+
+ if (status == errAuthorizationSuccess)
+ {
+ if (auth.operatesAsLeastPrivileged()) {
+ Credential rightCredential(rightName, mShared);
+ credentials.erase(rightCredential); credentials.insert(rightCredential);
+ if (mShared)
+ credentials.insert(Credential(rightName, false));
+ }
+
+ // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent
+ credentials.erase(newCredential); credentials.insert(newCredential);
+ // just got a new credential - if it's shared also add a non-shared one that to stick in the authorizationref local cache
+ if (mShared)
+ credentials.insert(Credential(newCredential->uid(), newCredential->name(), newCredential->realname(), false));
+
+ // use valid credential to set context info
+ // XXX/cs keeping this for now, such that the uid is passed back
+ auth.setCredentialInfo(newCredential, savePassword);
+ secdebug("SSevalMech", "added valid credential for user %s", newCredential->name().c_str());
+ // set the sessionHasAuthenticated
+ if (newCredential->uid() == auth.session().originatorUid()) {
+ secdebug("AuthEvalMech", "We authenticated as the session owner.\n");
+ SessionAttributeBits flags = auth.session().attributes();
+ flags |= AU_SESSION_FLAG_HAS_AUTHENTICATED;
+ auth.session().setAttributes(flags);
+ }
+
+ status = errAuthorizationSuccess;
+ break;
+ }
+ }
projects / apple / securityd.git / blobdiff