From 34cce8371d0e9a8c1a76ff79eb31c9acc47f94c8 Mon Sep 17 00:00:00 2001 From: Apple Date: Tue, 4 Oct 2005 18:02:03 +0000 Subject: [PATCH] securityd-25481.tar.gz --- etc/authorization.plist | 10 ++++++++++ securityd.xcode/project.pbxproj | 2 +- src/AuthorizationDBPlist.cpp | 9 ++++++--- src/acls.cpp | 1 + src/agentquery.cpp | 4 ++-- src/kcdatabase.cpp | 8 ++++---- src/main.cpp | 3 +-- src/pcscmonitor.cpp | 19 ++++++++++++++++--- src/pcscmonitor.h | 8 +++++--- src/tokenacl.cpp | 1 + 10 files changed, 47 insertions(+), 18 deletions(-) diff --git a/etc/authorization.plist b/etc/authorization.plist index 1b1efc1..0dc7382 100644 --- a/etc/authorization.plist +++ b/etc/authorization.plist @@ -83,6 +83,16 @@ See remaining rules for examples. comment wildcard right for deleting system rights. + com.apple. + + rule + default + + system. + + rule + default + sys.openfile. class diff --git a/securityd.xcode/project.pbxproj b/securityd.xcode/project.pbxproj index d4df89e..a84ae96 100644 --- a/securityd.xcode/project.pbxproj +++ b/securityd.xcode/project.pbxproj @@ -838,7 +838,7 @@ ); buildSettings = { BUILD_VARIANTS = "normal debug"; - CURRENT_PROJECT_VERSION = 67; + CURRENT_PROJECT_VERSION = 25481; FRAMEWORK_SEARCH_PATHS = "/usr/local/SecurityPieces/Frameworks /usr/local/SecurityPieces/Components/securityd $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks"; INSTALL_PATH = /usr/sbin; OPT_CPPXFLAGS = "$(OPT_CXFLAGS) -fno-enforce-eh-specs -fno-implement-inlines -fcoalesce-templates"; diff --git a/src/AuthorizationDBPlist.cpp b/src/AuthorizationDBPlist.cpp index ed48c32..29ae2cb 100644 --- a/src/AuthorizationDBPlist.cpp +++ b/src/AuthorizationDBPlist.cpp @@ -311,10 +311,13 @@ AuthorizationDBPlist::getRuleDefinition(string &key) bool AuthorizationDBPlist::existRule(string &ruleName) const { - map::const_iterator rule = mRules.find(ruleName); - if (rule != mRules.end()) + AuthItemRef candidateRule(ruleName.c_str()); + string ruleForCandidate = getRule(candidateRule)->name(); + // same name or covered by wildcard right -> modification. + if ( (ruleName == ruleForCandidate) || + (*(ruleForCandidate.rbegin()) == '.') ) return true; - + return false; } diff --git a/src/acls.cpp b/src/acls.cpp index e2be78f..f820d00 100644 --- a/src/acls.cpp +++ b/src/acls.cpp @@ -150,6 +150,7 @@ bool SecurityServerEnvironment::getSecret(CssmOwnedData &secret, const CssmData //@@@ ignoring prompt - not used right now if (database) { QueryPIN query(*database); + query.inferHints(Server::process()); if (!query()) { // success secret = query.pin(); return true; diff --git a/src/agentquery.cpp b/src/agentquery.cpp index c8118ef..1876642 100644 --- a/src/agentquery.cpp +++ b/src/agentquery.cpp @@ -72,6 +72,8 @@ using namespace Authorization; SecurityAgentQuery::SecurityAgentQuery(const AuthHostType type, Session &session) : mAuthHostType(type), mHostInstance(session.authhost(mAuthHostType)), mConnection(&Server::connection()) { + // this may take a while + Server::active().longTermActivity(); secdebug("SecurityAgentQuery", "new SecurityAgentQuery(%p)", this); } @@ -94,8 +96,6 @@ SecurityAgentQuery::~SecurityAgentQuery() void SecurityAgentQuery::activate() { - // this may take a while - Server::active().longTermActivity(); mConnection->useAgent(this); try { diff --git a/src/kcdatabase.cpp b/src/kcdatabase.cpp index 4f1b490..8f723c5 100644 --- a/src/kcdatabase.cpp +++ b/src/kcdatabase.cpp @@ -570,9 +570,9 @@ void KeychainDatabase::establishOldSecrets(const AccessCredentials *creds) case CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT: { secdebug("KCdb", "%p attempting interactive unlock", this); + QueryUnlock query(*this); // Holding DB common lock during UI will deadlock securityd StSyncLock uisync(common().uiLock(), common()); - QueryUnlock query(*this); query.inferHints(Server::process()); if (query() == SecurityAgent::noReason) return; @@ -622,9 +622,9 @@ void KeychainDatabase::establishOldSecrets(const AccessCredentials *creds) return; } + QueryUnlock query(*this); // attempt interactive unlock StSyncLock uisync(common().uiLock(), common()); - QueryUnlock query(*this); query.inferHints(Server::process()); if (query() == SecurityAgent::noReason) return; @@ -650,8 +650,8 @@ void KeychainDatabase::establishNewSecrets(const AccessCredentials *creds, Secur case CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT: { secdebug("KCdb", "%p specified interactive passphrase", this); - StSyncLock uisync(common().uiLock(), common()); QueryNewPassphrase query(*this, reason); + StSyncLock uisync(common().uiLock(), common()); query.inferHints(Server::process()); CssmAutoData passphrase(Allocator::standard(Allocator::sensitive)); if (query(passphrase) == SecurityAgent::noReason) { @@ -690,8 +690,8 @@ void KeychainDatabase::establishNewSecrets(const AccessCredentials *creds, Secur } } else { // default action -- interactive (only) - StSyncLock uisync(common().uiLock(), common()); QueryNewPassphrase query(*this, reason); + StSyncLock uisync(common().uiLock(), common()); query.inferHints(Server::process()); CssmAutoData passphrase(Allocator::standard(Allocator::sensitive)); if (query(passphrase) == SecurityAgent::noReason) { diff --git a/src/main.cpp b/src/main.cpp index ef34365..2208882 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -251,10 +251,9 @@ int main(int argc, char *argv[]) if (const char *s = getenv("TOKENCACHE")) tokenCacheDir = s; #endif //NDEBUG - TokenCache tokenCache(tokenCacheDir); // create a smartcard monitor to manage external token devices - PCSCMonitor secureCards(server, tokenCache, scOptions(smartCardOptions)); + PCSCMonitor secureCards(server, tokenCacheDir, scOptions(smartCardOptions)); // create the RootSession object (if -d, give it graphics and tty attributes) RootSession rootSession(server, diff --git a/src/pcscmonitor.cpp b/src/pcscmonitor.cpp index 9fe6a13..63fa12b 100644 --- a/src/pcscmonitor.cpp +++ b/src/pcscmonitor.cpp @@ -57,10 +57,12 @@ static const Time::Interval PCSCD_IDLE_SHUTDOWN(120); // kill daemon if no devi // In fact, you should push all the hard work into a timer, so as not to hold up the // general startup process. // -PCSCMonitor::PCSCMonitor(Server &srv, TokenCache &tc, ServiceLevel level) +PCSCMonitor::PCSCMonitor(Server &server, const char* pathToCache, ServiceLevel level) : Listener(kNotificationDomainPCSC, SecurityServer::kNotificationAllEvents), MachServer::Timer(true), // "heavy" timer task - server(srv), cache(tc), + server(server), + cache (NULL), + cachePath (pathToCache), mServiceLevel(level), mTimerAction(&PCSCMonitor::initialSetup), mGoingToSleep(false) @@ -125,7 +127,7 @@ void PCSCMonitor::pollReaders() // accounted for this reader current.erase(reader); } else { - RefPointer newReader = new Reader(cache, state); + RefPointer newReader = new Reader(getTokenCache (), state); mReaders.insert(make_pair(state.name(), newReader)); Syslog::notice("Token reader %s inserted into system", state.name()); newReader->update(state); // initial state setup @@ -142,6 +144,17 @@ void PCSCMonitor::pollReaders() } +TokenCache& PCSCMonitor::getTokenCache () +{ + if (cache == NULL) { + cache = new TokenCache(cachePath.c_str ()); + } + + return *cache; +} + + + void PCSCMonitor::launchPcscd() { // launch pcscd diff --git a/src/pcscmonitor.h b/src/pcscmonitor.h index 4163ceb..4e48d5e 100644 --- a/src/pcscmonitor.h +++ b/src/pcscmonitor.h @@ -61,14 +61,16 @@ public: externalDaemon // use externally launched daemon if present (do not manage pcscd) }; - PCSCMonitor(Server &server, TokenCache &cache, ServiceLevel level = conservative); + PCSCMonitor(Server &server, const char* pathToCache, ServiceLevel level = conservative); protected: void pollReaders(); Server &server; - TokenCache &cache; - + TokenCache *cache; + std::string cachePath; + TokenCache& getTokenCache (); + protected: // Listener void notifyMe(SecurityServer::NotificationDomain domain, diff --git a/src/tokenacl.cpp b/src/tokenacl.cpp index efaf36a..e6a1d00 100644 --- a/src/tokenacl.cpp +++ b/src/tokenacl.cpp @@ -182,6 +182,7 @@ SecurityAgent::Reason QueryNewPin::accept(CssmManagedData &passphrase, CssmData void TokenAcl::pinChange(unsigned int pin, CSSM_ACL_HANDLE handle, TokenDatabase &database) { QueryNewPin query(pin, handle, database, SecurityAgent::changePassphrase); + query.inferHints(Server::process()); CssmAutoData newPin(Allocator::standard(Allocator::sensitive)); switch (query(newPin)) { case SecurityAgent::noReason: // worked -- 2.45.2