X-Git-Url: https://git.saurik.com/apple/securityd.git/blobdiff_plain/eeadf2e6470f45ea0275a6019635573f2a7b5a2c..4cd1cad0dea00daa03e1b54fdf2797a02373ad5b:/src/AuthorizationMechEval.cpp?ds=sidebyside diff --git a/src/AuthorizationMechEval.cpp b/src/AuthorizationMechEval.cpp index 5f7a793..0080eb3 100644 --- a/src/AuthorizationMechEval.cpp +++ b/src/AuthorizationMechEval.cpp @@ -1,10 +1,8 @@ /* - * Copyright (c) 2003-2004 Apple Computer, Inc. All Rights Reserved. + * Copyright (c) 2003-2004,2008-2009 Apple Inc. All Rights Reserved. * * @APPLE_LICENSE_HEADER_START@ * - * Copyright (c) 1999-2003 Apple Computer, Inc. All Rights Reserved. - * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in @@ -26,27 +24,45 @@ * securityd * */ - #include "AuthorizationMechEval.h" +#include +#include +#include "ccaudit_extensions.h" namespace Authorization { -AgentMechanismRef::AgentMechanismRef(uid_t clientUID, const Session &session) : - RefPointer(new QueryInvokeMechanism(clientUID, session)) {} +using namespace CommonCriteria::Securityd; -AgentMechanismRef::AgentMechanismRef() : - RefPointer(new QueryInvokeMechanism()) {} +AgentMechanismRef::AgentMechanismRef(const AuthHostType type, Session &session) : + RefPointer(new QueryInvokeMechanism(type, session)) {} // we need the vector of mechanisms -AgentMechanismEvaluator::AgentMechanismEvaluator(uid_t uid, const Session& session, const vector& inMechanisms) : +AgentMechanismEvaluator::AgentMechanismEvaluator(uid_t uid, Session& session, const vector& inMechanisms) : mMechanisms(inMechanisms), mClientUid(uid), mSession(session) { //set up environment } OSStatus -AgentMechanismEvaluator::run(const AuthValueVector &inArguments, const AuthItemSet &inHints, const AuthItemSet &inContext) +AgentMechanismEvaluator::run(const AuthValueVector &inArguments, const AuthItemSet &inHints, const AuthorizationToken &auth) { + AuthMechLogger logger(auth.creatorAuditToken(), AUE_ssauthmech); + string rightName = ""; // for syslog + + // as of 10.6, the first item in inArguments should be the name of the + // requested right, for auditing + try + { + AuthorizationValue val = inArguments.at(0)->value(); + string tmpstr(static_cast(val.data), val.length); + logger.setRight(tmpstr); + rightName.clear(); + rightName = tmpstr; + } + catch (...) { } + + const AuthItemSet &inContext = const_cast(auth).infoSet(); + // add process specifics to context? vector::const_iterator currentMechanism = mMechanisms.begin(); @@ -55,10 +71,18 @@ AgentMechanismEvaluator::run(const AuthValueVector &inArguments, const AuthItemS AuthItemSet hints = inHints; AuthItemSet context = inContext; - + // add saved-off sticky context values to context for evaluation + context.insert(mStickyContext.begin(), mStickyContext.end()); + while ( (result == kAuthorizationResultAllow) && (currentMechanism != mMechanisms.end()) ) // iterate mechanisms { + SECURITYD_AUTH_MECH(&auth, (char *)(*currentMechanism).c_str()); + + // set up the audit message + logger.setCurrentMechanism(*currentMechanism); + + // do the real work ClientMap::iterator iter = mClients.find(*currentMechanism); if (iter == mClients.end()) { @@ -67,79 +91,162 @@ AgentMechanismEvaluator::run(const AuthValueVector &inArguments, const AuthItemS { // no whitespace removal string pluginIn(currentMechanism->substr(0, extPlugin)); - string mechanismIn(currentMechanism->substr(extPlugin + 1)); - secdebug("AuthEvalMech", "external mech %s:%s", pluginIn.c_str(), mechanismIn.c_str()); + string mechanismIn, authhostIn; + + string::size_type extMechanism = currentMechanism->rfind(','); + AuthHostType hostType = securityAgent; + + if (extMechanism != string::npos) + { + if (extMechanism < extPlugin) + { + string auditMsg = "badly formed mechanism name; ending rule evaluation"; + Syslog::alert("Right '%s', mech '%s': %s", rightName.c_str(), (*currentMechanism).c_str(), auditMsg.c_str()); + logger.logFailure(auditMsg); + return errAuthorizationInternal; + } + + mechanismIn = currentMechanism->substr(extPlugin + 1, extMechanism - extPlugin - 1); + authhostIn = currentMechanism->substr(extMechanism + 1); + if (authhostIn == "privileged") + hostType = privilegedAuthHost; + } + else + mechanismIn = currentMechanism->substr(extPlugin + 1); + + secdebug("AuthEvalMech", "external mechanism %s:%s", pluginIn.c_str(), mechanismIn.c_str()); - AgentMechanismRef client(mClientUid, mSession); - client->initialize(pluginIn, mechanismIn); -// XXX/cs client->inferHints(Server::process()); - mClients[*currentMechanism] = client; + AgentMechanismRef client(hostType, mSession); + client->initialize(pluginIn, mechanismIn, inArguments); + mClients.insert(ClientMap::value_type(*currentMechanism, client)); } else if (*currentMechanism == "authinternal") { secdebug("AuthEvalMech", "performing authentication"); result = authinternal(context); + + if (kAuthorizationResultAllow == result) + { + logger.logSuccess(); + } + else // kAuthorizationResultDeny + { + logger.logFailure(); + } } else if (*currentMechanism == "push_hints_to_context") { secdebug("AuthEvalMech", "evaluate push_hints_to_context"); - result = kAuthorizationResultAllow; // snarfcredential doesn't block evaluation, ever, it may restart - // create out context from input hints, no merge - // @@@ global copy template not being invoked... + logger.logSuccess(); + // doesn't block evaluation, ever + result = kAuthorizationResultAllow; context = hints; } -#if 0 - else if (*currentMechanism == "switch_to_user") - { - AgentMechanismRef client(mClientUid, mSession); - client->terminate(); - } -#endif else + { + string auditMsg = "unknown mechanism; ending rule evaluation"; + Syslog::alert("Right '%s', mech '%s': %s", rightName.c_str(), (*currentMechanism).c_str(), auditMsg.c_str()); + logger.logFailure(auditMsg); return errAuthorizationInternal; + } } iter = mClients.find(*currentMechanism); - if (iter != mClients.end()) { try { - iter->second->run(inArguments, hints, context, &result); - secdebug("AuthEvalMech", "evaluate(%s) succeeded with result: %lu.", (iter->first).c_str(), result); + AgentMechanismRef &client = iter->second; + client->run(inArguments, hints, context, &result); + + bool interrupted = false; + while (client->state() == client->current) + { + // check for interruption + vector::const_iterator checkMechanism = mMechanisms.begin(); + while (*checkMechanism != *currentMechanism) { + ClientMap::iterator iter2 = mClients.find(*checkMechanism); + if (iter2->second->state() == iter2->second->interrupting) + { + client->deactivate(); + // nothing can happen until the client mechanism returns control to us + while (client->state() == client->deactivating) + client->receive(); + + string auditMsg = "evaluation interrupted by "; + auditMsg += (iter2->first).c_str(); + auditMsg += "; restarting evaluation there"; + secdebug("AuthEvalMech", "%s", auditMsg.c_str()); + logger.logInterrupt(auditMsg); + + interrupted = true; + hints = iter2->second->inHints(); + context = iter2->second->inContext(); + currentMechanism = checkMechanism; + break; + } + else + checkMechanism++; + } + if (client->state() == client->current) + client->receive(); + } + + if (interrupted) + { + // clear reason for restart from interrupt + uint32_t reason = SecurityAgent::worldChanged; + AuthItemRef retryHint(AGENT_HINT_RETRY_REASON, AuthValueOverlay(sizeof(reason), &reason)); + hints.erase(retryHint); hints.insert(retryHint); // replace + + result = kAuthorizationResultAllow; + continue; + } + else + secdebug("AuthEvalMech", "evaluate(%s) with result: %u.", (iter->first).c_str(), (uint32_t)result); } catch (...) { - secdebug("AuthEvalMech", "exception from mech eval or client death"); + string auditMsg = "exception during evaluation of "; + auditMsg += (iter->first).c_str(); + secdebug("AuthEvalMech", "%s", auditMsg.c_str()); + logger.logFailure(auditMsg); result = kAuthorizationResultUndefined; } } - // we own outHints and outContext - switch(result) + if (result == kAuthorizationResultAllow) { - case kAuthorizationResultAllow: - secdebug("AuthEvalMech", "result allow"); - currentMechanism++; - break; - case kAuthorizationResultDeny: - secdebug("AuthEvalMech", "result deny"); - break; - case kAuthorizationResultUndefined: - secdebug("AuthEvalMech", "result undefined"); - break; // abort evaluation - case kAuthorizationResultUserCanceled: - secdebug("AuthEvalMech", "result canceled"); - break; // stop evaluation, return some sideband - default: - break; // abort evaluation + logger.logSuccess(); + currentMechanism++; } } - + if ((result == kAuthorizationResultUserCanceled) || (result == kAuthorizationResultAllow)) { mHints = hints; - mContext = context; + mContext.clear(); + // only make non-sticky context values available externally + AuthItemSet::const_iterator end = context.end(); + for (AuthItemSet::const_iterator it = context.begin(); it != end; ++it) { + const AuthItemRef &item = *it; + if (item->flags() != kAuthorizationContextFlagSticky) + mContext.insert(item); + } + if (result == kAuthorizationResultUserCanceled) + logger.logFailure(NULL, errAuthorizationCanceled); + } + else if (result == kAuthorizationResultDeny) + { + // save off sticky values in context + mStickyContext.clear(); + AuthItemSet::const_iterator end = context.end(); + for (AuthItemSet::const_iterator it = context.begin(); it != end; ++it) { + const AuthItemRef &item = *it; + if (item->flags() == kAuthorizationContextFlagSticky) + mStickyContext.insert(item); + } + logger.logFailure(); } // convert AuthorizationResult to OSStatus @@ -151,8 +258,14 @@ AgentMechanismEvaluator::run(const AuthValueVector &inArguments, const AuthItemS return errAuthorizationCanceled; case kAuthorizationResultAllow: return errAuthorizationSuccess; + case kAuthorizationResultUndefined: + return errAuthorizationInternal; default: + { + Syslog::alert("Right '%s': unexpected error result (%u)", rightName.c_str(), result); + logger.logFailure("unexpected error result", result); return errAuthorizationInternal; + } } } @@ -170,15 +283,10 @@ AuthorizationResult AgentMechanismEvaluator::authinternal(AuthItemSet &context) break; string password(static_cast((*found)->value().data), (*found)->value().length); secdebug("AuthEvalMech", "found password"); + Credential newCredential(username, password, true); // create a new shared credential - if (newCredential->isValid()) - { - Syslog::info("authinternal authenticated user %s (uid %lu).", newCredential->username().c_str(), newCredential->uid()); return kAuthorizationResultAllow; - } - - Syslog::error("authinternal failed to authenticate user %s.", newCredential->username().c_str()); } while (0);