From 5968d166aac117ec986929b2f8fb9ce7fae2e599 Mon Sep 17 00:00:00 2001 From: Apple Date: Wed, 7 Mar 2012 22:00:52 +0000 Subject: [PATCH] securityd-55126.2.tar.gz --- etc/authorization.merge | 359 +++++++++++++++++++++++++++- etc/authorization.plist | 344 +++++++++++++++++++++++++- securityd.xcodeproj/project.pbxproj | 8 +- src/AuthorizationEngine.cpp | 11 + src/AuthorizationRule.cpp | 84 ++++--- src/authhost.cpp | 21 +- src/authhost.h | 2 + src/authority.cpp | 2 +- src/credential.cpp | 58 ++--- src/credential.h | 26 +- src/server.h | 1 + src/session.cpp | 6 + src/session.h | 2 + 13 files changed, 830 insertions(+), 94 deletions(-) diff --git a/etc/authorization.merge b/etc/authorization.merge index 93e32b4..b7b0367 100644 --- a/etc/authorization.merge +++ b/etc/authorization.merge @@ -569,6 +569,82 @@ timeout 60 + com.apple.Safari.show-passwords + + class + user + comment + This right is used by Safari to show passwords + default-prompt + + ar + يحاول __APPNAME__ إظهار كلمات السر. + ca + __APPNAME__ està intentant mostrar les contrasenyes. + cs + __APPNAME__ se pokouší zobrazit hesla. + da + __APPNAME__ prøver at vise adgangskoder. + de + __APPNAME__ versucht, Kennwörter einzublenden. + el + Η εφαρμογή «__APPNAME__» προσπαθεί να εμφανίσει συνθηματικά. + en + __APPNAME__ is trying to show passwords. + es + __APPNAME__ está intentando mostrar las contraseñas. + fi + __APPNAME__ yrittää näyttää salasanat. + fr + __APPNAME__ essaye d’afficher les mots de passe. + he + __APPNAME__ מנסה להציג סיסמאות. + hr + __APPNAME__ pokušava prikazati lozinke. + hu + A(z) __APPNAME__ megpróbálja megjeleníteni a jelszavakat. + it + __APPNAME__ tenta di mostrare le password. + ja + __APPNAME__ は、パスワードを表示しようとしています。 + ko + __APPNAME__이(가) 암호를 보려고 합니다. + nb + __APPNAME__ prøver å vise passord. + nl + __APPNAME__ probeert wachtwoorden te tonen. + pl + __APPNAME__ próbuje pokazać hasła. + pt + __APPNAME__ está tentando mostrar senhas. + pt-PT + O __APPNAME__ está a tentar mostrar palavras‑passe. + ro + __APPNAME__ încearcă să afișeze parole. + ru + Программа «__APPNAME__» пытается показать пароли. + sk + Aplikácia __APPNAME__ sa pokúša zobraziť heslá. + sv + __APPNAME__ försöker visa lösenord. + th + __APPNAME__ กำลังพยายามแสดงรหัสผ่าน + tr + __APPNAME__ parolaları göstermeye çalışıyor. + uk + __APPNAME__ намагається показати паролі. + zh-Hans + “__APPNAME__” 正在尝试显示密码。 + zh-Hant + “__APPNAME__” 正在嘗試顯示密碼。 + + session-owner + + shared + + timeout + 10 + com.apple.ServiceManagement.blesshelper class @@ -1982,6 +2058,139 @@ shared + com.apple.library-repair + + class + user + default-button + + ar + تصليح + ca + Reparar + cs + Opravit + da + Reparer + de + Reparieren + el + Επισκευή + en + Repair + es + Reparar + fi + Korjaa + fr + Réparer + he + תקן + hr + Popravi + hu + Javítás + it + Ripara + ja + 修復 + ko + 복구 + nb + Reparer + nl + Herstel + pl + Napraw + pt + Reparar + pt-PT + Reparar + ro + Repară + ru + Исправить + sk + Opraviť + sv + Reparera + th + ซ่อมแซม + tr + Onar + uk + Полагодити + zh-Hans + 修复 + zh-Hant + 修復 + + default-prompt + + ar + يحاول __APPNAME__ تصليح مكتبة الصور الخاصة بك. + ca + __APPNAME__ està provant de reparar la vostra fototeca. + cs + __APPNAME__ se pokouší opravit vaši knihovnu fotografií. + da + __APPNAME__ prøver at reparere dit fotobibliotek. + de + __APPNAME__ versucht, Ihre Fotomediathek zu reparieren. + el + Η εφαρμογή __APPNAME__ προσπαθεί να επισκευάσει τη βιβλιοθήκη φωτογραφιών σας. + en + __APPNAME__ is trying to repair your photo library. + es + __APPNAME__ está intentando reparar su fototeca. + fi + __APPNAME__ yrittää korjata kuvakirjastoasi. + fr + __APPNAME__ essaie de réparer votre bibliothèque de photos. + he + __APPNAME__ מנסה לתקן את ספריית התמונות שלך. + hr + __APPNAME__ pokušava popraviti vašu medijateku fotografija. + hu + A(z) __APPNAME__ megpróbálja kijavítani a fotókönyvtárat. + it + __APPNAME__ tenta di riparare la libreria foto. + ja + __APPNAME__ は、フォトライブラリを修復しようとしています。 + ko + __APPNAME__이(가) 사용자의 사진 보관함을 복구하려고 합니다. + nb + _APPNAME_ forsøker å reparere bildebiblioteket. + nl + __APPNAME__ probeert uw fotobibliotheek te herstellen. + pl + __APPNAME__ próbuje naprawić Twoją bibliotekę zdjęć. + pt + __APPNAME__ está tentando reparar a sua fototeca. + pt-PT + __APPNAME__ está a tentar reparar a sua fototeca. + ro + __APPNAME__ încearcă să repare biblioteca dvs. foto. + ru + Программа «__APPNAME__» пытается исправить Вашу медиатеку. + sk + Aplikácia __APPNAME__ sa pokúša opraviť vašu knižnicu fotografií. + sv + __APPNAME__ försöker reparera ditt bildbibliotek. + th + __APPNAME__ กำลังพยายามซ่อมแซมคลังรูปภาพของคุณ + tr + __APPNAME__ fotoğraf arşivinizi onarmaya çalışıyor. + uk + __APPNAME__ намагається полагодити вашу фототеку. + zh-Hans + __APPNAME__ 正在尝试修复您的照片图库。 + zh-Hant + __APPNAME__ 正在嘗試修復您的照片圖庫。 + + group + admin + com.apple.pcastagentconfigd. allow-root @@ -2121,6 +2330,139 @@ shared + com.apple.security.assessment.update + + class + rule + default-button + + ar + تعديل الإعدادات + ca + Modificar la configuració + cs + Změnit nastavení + da + Juster indstillinger + de + Einstellungen ändern + el + Τροποποίηση ρυθμίσεων + en + Modify Settings + es + Modificar ajustes + fi + Muokkaa asetuksia + fr + Modifer les réglages + he + ערוך/י הגדרות + hr + Preinači postavke + hu + Beállítások módosítása + it + Modifica impostazioni + ja + 設定を変更 + ko + 설정 수정 + nb + Endre innstillinger + nl + Wijzig instellingen + pl + Zmień ustawienia + pt + Modificar Ajustes + pt-PT + Modificar definições + ro + Schimbă configurările + ru + Модифицировать настройки + sk + Upraviť nastavenia + sv + Ändra inställningar + th + แก้ไขค่าติดตั้ง + tr + Ayarları Değiştir + uk + Змінити параметри + zh-Hans + 修改设置 + zh-Hant + 修改設定 + + default-prompt + + ar + يحاول __APPNAME__ السماح لعنصر بأن يكون قيد التشغيل دائمًا. + ca + __APPNAME__ està provant d’autoritzar un ítem perquè s’executi sempre. + cs + __APPNAME__ se pokouší nějaké položce povolit, aby byla vždy spuštěna. + da + __APPNAME__ prøver at give et emne lov til at være aktivt hele tiden. + de + __APPNAME__ versucht, einem Objekt die Ausführung immer zu erlauben. + el + Η εφαρμογή «__APPNAME__» προσπαθεί να επιτρέψει σε ένα στοιχείο να εκτελείται πάντα. + en + __APPNAME__ is trying to allow an item to always run. + es + __APPNAME__ está intentando permitir que un ítem se ejecute siempre. + fi + __APPNAME__ yrittää sallia, että kohde on aina käytössä. + fr + __APPNAME__ essaye d’autoriser un élément à s’exécuter en continu. + he + __APPNAME__ מנסה לאפשר לפריט לפעול באופן קבוע. + hr + __APPNAME__ pokušava dozvoliti stavci da uvijek bude pokrenuta. + hu + A(z) __APPNAME__ megpróbál beállítani egy elemet, hogy az mindig fusson. + it + __APPNAME__ tenta di consentire che un elemento venga sempre eseguito. + ja + __APPNAME__ は、項目が常時動作することを許可しようとしています。 + ko + __APPNAME__이(가) 항목이 항상 실행되는 것을 허용하려고 합니다. + nb + __APPNAME__ prøver å tillate at et program alltid kjører. + nl + __APPNAME__ probeert een onderdeel toe te staan dat het altijd wordt uitgevoerd. + pl + __APPNAME__ próbuje zezwolić, aby rzecz była zawsze uruchamiana. + pt + O __APPNAME__ está tentando autorizar um item a ser executado permanentemente. + pt-PT + O __APPNAME__ está a tentar dar autorização a um elemento para permanecer constantemente aberto. + ro + __APPNAME__ încearcă să-i permită unui articol să ruleze întotdeauna. + ru + Программа «__APPNAME__» пытается разрешить объекту постоянно выполнять работу. + sk + Aplikácia __APPNAME__ sa pokúša povoliť spúšťanie položky. + sv + __APPNAME__ försöker tillåta ett objekt att alltid köras. + th + __APPNAME__กำลังพยายามอนุญาตรายการให้ทำงานเสมอ + tr + __APPNAME__, bir öğenin her zaman çalışmasına izin vermeye çalışıyor. + uk + __APPNAME__ намагається дозволити елементу завжди запускатися. + zh-Hans + “__APPNAME__”正在尝试允许一个项目始终运行。 + zh-Hant + “__APPNAME__”正在嘗試允許某個項目持續執行。 + + rule + root-or-entitled-admin-or-authenticate-admin + com.apple.server.admin.streaming allow-root @@ -4267,7 +4609,7 @@ fr __APPNAME__ essaye d’installer un nouveau logiciel. he - ״ __APPNAME__״ מבקש להתקין תוכנות חדשות. + ״__APPNAME__״ מבקש להתקין תוכנות חדשות. hr __APPNAME__ pokušava instalirati novi softver. hu @@ -7635,5 +7977,20 @@ + rules + + root-or-entitled-admin-or-authenticate-admin + + class + rule + k-of-n + 1 + rule + + is-root + entitled-admin-or-authenticate-admin + + + diff --git a/etc/authorization.plist b/etc/authorization.plist index 2343d22..545dd1b 100644 --- a/etc/authorization.plist +++ b/etc/authorization.plist @@ -616,6 +616,82 @@ See remaining rules for examples. timeout 60 + com.apple.Safari.show-passwords + + class + user + comment + This right is used by Safari to show passwords + default-prompt + + ar + يحاول __APPNAME__ إظهار كلمات السر. + ca + __APPNAME__ està intentant mostrar les contrasenyes. + cs + __APPNAME__ se pokouší zobrazit hesla. + da + __APPNAME__ prøver at vise adgangskoder. + de + __APPNAME__ versucht, Kennwörter einzublenden. + el + Η εφαρμογή «__APPNAME__» προσπαθεί να εμφανίσει συνθηματικά. + en + __APPNAME__ is trying to show passwords. + es + __APPNAME__ está intentando mostrar las contraseñas. + fi + __APPNAME__ yrittää näyttää salasanat. + fr + __APPNAME__ essaye d’afficher les mots de passe. + he + __APPNAME__ מנסה להציג סיסמאות. + hr + __APPNAME__ pokušava prikazati lozinke. + hu + A(z) __APPNAME__ megpróbálja megjeleníteni a jelszavakat. + it + __APPNAME__ tenta di mostrare le password. + ja + __APPNAME__ は、パスワードを表示しようとしています。 + ko + __APPNAME__이(가) 암호를 보려고 합니다. + nb + __APPNAME__ prøver å vise passord. + nl + __APPNAME__ probeert wachtwoorden te tonen. + pl + __APPNAME__ próbuje pokazać hasła. + pt + __APPNAME__ está tentando mostrar senhas. + pt-PT + O __APPNAME__ está a tentar mostrar palavras‑passe. + ro + __APPNAME__ încearcă să afișeze parole. + ru + Программа «__APPNAME__» пытается показать пароли. + sk + Aplikácia __APPNAME__ sa pokúša zobraziť heslá. + sv + __APPNAME__ försöker visa lösenord. + th + __APPNAME__ กำลังพยายามแสดงรหัสผ่าน + tr + __APPNAME__ parolaları göstermeye çalışıyor. + uk + __APPNAME__ намагається показати паролі. + zh-Hans + “__APPNAME__” 正在尝试显示密码。 + zh-Hant + “__APPNAME__” 正在嘗試顯示密碼。 + + session-owner + + shared + + timeout + 10 + com.apple.ServiceManagement.blesshelper class @@ -2121,6 +2197,139 @@ See remaining rules for examples. shared + com.apple.library-repair + + class + user + default-button + + ar + تصليح + ca + Reparar + cs + Opravit + da + Reparer + de + Reparieren + el + Επισκευή + en + Repair + es + Reparar + fi + Korjaa + fr + Réparer + he + תקן + hr + Popravi + hu + Javítás + it + Ripara + ja + 修復 + ko + 복구 + nb + Reparer + nl + Herstel + pl + Napraw + pt + Reparar + pt-PT + Reparar + ro + Repară + ru + Исправить + sk + Opraviť + sv + Reparera + th + ซ่อมแซม + tr + Onar + uk + Полагодити + zh-Hans + 修复 + zh-Hant + 修復 + + default-prompt + + ar + يحاول __APPNAME__ تصليح مكتبة الصور الخاصة بك. + ca + __APPNAME__ està provant de reparar la vostra fototeca. + cs + __APPNAME__ se pokouší opravit vaši knihovnu fotografií. + da + __APPNAME__ prøver at reparere dit fotobibliotek. + de + __APPNAME__ versucht, Ihre Fotomediathek zu reparieren. + el + Η εφαρμογή __APPNAME__ προσπαθεί να επισκευάσει τη βιβλιοθήκη φωτογραφιών σας. + en + __APPNAME__ is trying to repair your photo library. + es + __APPNAME__ está intentando reparar su fototeca. + fi + __APPNAME__ yrittää korjata kuvakirjastoasi. + fr + __APPNAME__ essaie de réparer votre bibliothèque de photos. + he + __APPNAME__ מנסה לתקן את ספריית התמונות שלך. + hr + __APPNAME__ pokušava popraviti vašu medijateku fotografija. + hu + A(z) __APPNAME__ megpróbálja kijavítani a fotókönyvtárat. + it + __APPNAME__ tenta di riparare la libreria foto. + ja + __APPNAME__ は、フォトライブラリを修復しようとしています。 + ko + __APPNAME__이(가) 사용자의 사진 보관함을 복구하려고 합니다. + nb + _APPNAME_ forsøker å reparere bildebiblioteket. + nl + __APPNAME__ probeert uw fotobibliotheek te herstellen. + pl + __APPNAME__ próbuje naprawić Twoją bibliotekę zdjęć. + pt + __APPNAME__ está tentando reparar a sua fototeca. + pt-PT + __APPNAME__ está a tentar reparar a sua fototeca. + ro + __APPNAME__ încearcă să repare biblioteca dvs. foto. + ru + Программа «__APPNAME__» пытается исправить Вашу медиатеку. + sk + Aplikácia __APPNAME__ sa pokúša opraviť vašu knižnicu fotografií. + sv + __APPNAME__ försöker reparera ditt bildbibliotek. + th + __APPNAME__ กำลังพยายามซ่อมแซมคลังรูปภาพของคุณ + tr + __APPNAME__ fotoğraf arşivinizi onarmaya çalışıyor. + uk + __APPNAME__ намагається полагодити вашу фототеку. + zh-Hans + __APPNAME__ 正在尝试修复您的照片图库。 + zh-Hant + __APPNAME__ 正在嘗試修復您的照片圖庫。 + + group + admin + com.apple.pcastagentconfigd. allow-root @@ -2260,6 +2469,139 @@ See remaining rules for examples. shared + com.apple.security.assessment.update + + class + rule + default-button + + ar + تعديل الإعدادات + ca + Modificar la configuració + cs + Změnit nastavení + da + Juster indstillinger + de + Einstellungen ändern + el + Τροποποίηση ρυθμίσεων + en + Modify Settings + es + Modificar ajustes + fi + Muokkaa asetuksia + fr + Modifer les réglages + he + ערוך/י הגדרות + hr + Preinači postavke + hu + Beállítások módosítása + it + Modifica impostazioni + ja + 設定を変更 + ko + 설정 수정 + nb + Endre innstillinger + nl + Wijzig instellingen + pl + Zmień ustawienia + pt + Modificar Ajustes + pt-PT + Modificar definições + ro + Schimbă configurările + ru + Модифицировать настройки + sk + Upraviť nastavenia + sv + Ändra inställningar + th + แก้ไขค่าติดตั้ง + tr + Ayarları Değiştir + uk + Змінити параметри + zh-Hans + 修改设置 + zh-Hant + 修改設定 + + default-prompt + + ar + يحاول __APPNAME__ السماح لعنصر بأن يكون قيد التشغيل دائمًا. + ca + __APPNAME__ està provant d’autoritzar un ítem perquè s’executi sempre. + cs + __APPNAME__ se pokouší nějaké položce povolit, aby byla vždy spuštěna. + da + __APPNAME__ prøver at give et emne lov til at være aktivt hele tiden. + de + __APPNAME__ versucht, einem Objekt die Ausführung immer zu erlauben. + el + Η εφαρμογή «__APPNAME__» προσπαθεί να επιτρέψει σε ένα στοιχείο να εκτελείται πάντα. + en + __APPNAME__ is trying to allow an item to always run. + es + __APPNAME__ está intentando permitir que un ítem se ejecute siempre. + fi + __APPNAME__ yrittää sallia, että kohde on aina käytössä. + fr + __APPNAME__ essaye d’autoriser un élément à s’exécuter en continu. + he + __APPNAME__ מנסה לאפשר לפריט לפעול באופן קבוע. + hr + __APPNAME__ pokušava dozvoliti stavci da uvijek bude pokrenuta. + hu + A(z) __APPNAME__ megpróbál beállítani egy elemet, hogy az mindig fusson. + it + __APPNAME__ tenta di consentire che un elemento venga sempre eseguito. + ja + __APPNAME__ は、項目が常時動作することを許可しようとしています。 + ko + __APPNAME__이(가) 항목이 항상 실행되는 것을 허용하려고 합니다. + nb + __APPNAME__ prøver å tillate at et program alltid kjører. + nl + __APPNAME__ probeert een onderdeel toe te staan dat het altijd wordt uitgevoerd. + pl + __APPNAME__ próbuje zezwolić, aby rzecz była zawsze uruchamiana. + pt-PT + O __APPNAME__ está a tentar dar autorização a um elemento para permanecer constantemente aberto. + pt + O __APPNAME__ está tentando autorizar um item a ser executado permanentemente. + ro + __APPNAME__ încearcă să-i permită unui articol să ruleze întotdeauna. + ru + Программа «__APPNAME__» пытается разрешить объекту постоянно выполнять работу. + sk + Aplikácia __APPNAME__ sa pokúša povoliť spúšťanie položky. + sv + __APPNAME__ försöker tillåta ett objekt att alltid köras. + th + __APPNAME__กำลังพยายามอนุญาตรายการให้ทำงานเสมอ + tr + __APPNAME__, bir öğenin her zaman çalışmasına izin vermeye çalışıyor. + uk + __APPNAME__ намагається дозволити елементу завжди запускатися. + zh-Hans + “__APPNAME__”正在尝试允许一个项目始终运行。 + zh-Hant + “__APPNAME__”正在嘗試允許某個項目持續執行。 + + rule + root-or-entitled-admin-or-authenticate-admin + com.apple.server.admin.streaming allow-root @@ -4472,7 +4814,7 @@ See remaining rules for examples. fr __APPNAME__ essaye d’installer un nouveau logiciel. he - ״ __APPNAME__״ מבקש להתקין תוכנות חדשות. + ״__APPNAME__״ מבקש להתקין תוכנות חדשות. hr __APPNAME__ pokušava instalirati novi softver. hu diff --git a/securityd.xcodeproj/project.pbxproj b/securityd.xcodeproj/project.pbxproj index 0f25621..0615462 100644 --- a/securityd.xcodeproj/project.pbxproj +++ b/securityd.xcodeproj/project.pbxproj @@ -991,7 +991,7 @@ BUILD_VARIANTS = debug; COPY_PHASE_STRIP = NO; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55111; + CURRENT_PROJECT_VERSION = 55126.2; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, @@ -1044,7 +1044,7 @@ ); COPY_PHASE_STRIP = "(null)"; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55111; + CURRENT_PROJECT_VERSION = 55126.2; DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, @@ -1095,7 +1095,7 @@ BUILD_VARIANTS = normal; COPY_PHASE_STRIP = NO; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55111; + CURRENT_PROJECT_VERSION = 55126.2; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, @@ -1148,7 +1148,7 @@ ); COPY_PHASE_STRIP = "(null)"; CSSM_HEADERS = ""; - CURRENT_PROJECT_VERSION = 55111; + CURRENT_PROJECT_VERSION = 55126.2; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, diff --git a/src/AuthorizationEngine.cpp b/src/AuthorizationEngine.cpp index c65ce84..01560b0 100644 --- a/src/AuthorizationEngine.cpp +++ b/src/AuthorizationEngine.cpp @@ -222,6 +222,17 @@ Engine::authorize(const AuthItemSet &inRights, const AuthItemSet &environment, break; } } + + // purge all uid credentials from the outCredentials for least privileged mode + if (auth.operatesAsLeastPrivileged()) { + CredentialSet::const_iterator current, it = outCredentials->begin(); + while(it != outCredentials->end()) { + current = it++; + if (!(*current)->isRight()) { + outCredentials->erase(current); + } + } + } if (outCredentials) outCredentials->swap(credentials); diff --git a/src/AuthorizationRule.cpp b/src/AuthorizationRule.cpp index c560076..451618f 100644 --- a/src/AuthorizationRule.cpp +++ b/src/AuthorizationRule.cpp @@ -459,8 +459,8 @@ RuleImpl::evaluateAuthentication(const AuthItemRef &inRight, const Rule &inRule, Credential hintCredential; if (errAuthorizationSuccess == evaluateSessionOwner(inRight, inRule, environmentToClient, now, auth, hintCredential, reason)) { - if (hintCredential->username().length()) - environmentToClient.insert(AuthItemRef(AGENT_HINT_SUGGESTED_USER, AuthValueOverlay(hintCredential->username()))); + if (hintCredential->name().length()) + environmentToClient.insert(AuthItemRef(AGENT_HINT_SUGGESTED_USER, AuthValueOverlay(hintCredential->name()))); if (hintCredential->realname().length()) environmentToClient.insert(AuthItemRef(AGENT_HINT_SUGGESTED_USER_LONG, AuthValueOverlay(hintCredential->realname()))); } @@ -548,12 +548,12 @@ RuleImpl::evaluateAuthentication(const AuthItemRef &inRight, const Rule &inRule, // @@@ we log the uid a process was running under when it created the authref, which is misleading in the case of loginwindow if (newCredential->isValid()) { - Syslog::info("UID %u authenticated as user %s (UID %u) for right '%s'", auth.creatorUid(), newCredential->username().c_str(), newCredential->uid(), rightName); - rightAuthLogger.logSuccess(auth.creatorUid(), newCredential->uid(), newCredential->username().c_str()); + Syslog::info("UID %u authenticated as user %s (UID %u) for right '%s'", auth.creatorUid(), newCredential->name().c_str(), newCredential->uid(), rightName); + rightAuthLogger.logSuccess(auth.creatorUid(), newCredential->uid(), newCredential->name().c_str()); } else { // we can't be sure that the user actually exists so inhibit logging of uid - Syslog::error("UID %u failed to authenticate as user '%s' for right '%s'", auth.creatorUid(), newCredential->username().c_str(), rightName); - rightAuthLogger.logFailure(auth.creatorUid(), newCredential->username().c_str()); + Syslog::error("UID %u failed to authenticate as user '%s' for right '%s'", auth.creatorUid(), newCredential->name().c_str(), rightName); + rightAuthLogger.logFailure(auth.creatorUid(), newCredential->name().c_str()); } if (!newCredential->isValid()) @@ -568,22 +568,22 @@ RuleImpl::evaluateAuthentication(const AuthItemRef &inRight, const Rule &inRule, if (status == errAuthorizationSuccess) { if (auth.operatesAsLeastPrivileged()) { - Credential rightCredential(rightName, newCredential->uid(), mShared); + Credential rightCredential(rightName, mShared); credentials.erase(rightCredential); credentials.insert(rightCredential); if (mShared) - credentials.insert(Credential(rightName, newCredential->uid(), false)); - } else { - // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent - credentials.erase(newCredential); credentials.insert(newCredential); - // just got a new credential - if it's shared also add a non-shared one that to stick in the authorizationref local cache - if (mShared) - credentials.insert(Credential(newCredential->uid(), newCredential->username(), newCredential->realname(), newCredential->groupname(), false)); - } + credentials.insert(Credential(rightName, false)); + } + + // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent + credentials.erase(newCredential); credentials.insert(newCredential); + // just got a new credential - if it's shared also add a non-shared one that to stick in the authorizationref local cache + if (mShared) + credentials.insert(Credential(newCredential->uid(), newCredential->name(), newCredential->realname(), false)); // use valid credential to set context info // XXX/cs keeping this for now, such that the uid is passed back auth.setCredentialInfo(newCredential, savePassword); - secdebug("SSevalMech", "added valid credential for user %s", newCredential->username().c_str()); + secdebug("SSevalMech", "added valid credential for user %s", newCredential->name().c_str()); // set the sessionHasAuthenticated if (newCredential->uid() == auth.session().originatorUid()) { secdebug("AuthEvalMech", "We authenticated as the session owner.\n"); @@ -656,7 +656,7 @@ RuleImpl::makeCredentials(const AuthorizationToken &auth) const if (username.length() && uid) { // credential is valid because mechanism says so - newCredentials.insert(Credential(*uid, username, "", "", mShared)); + newCredentials.insert(Credential(*uid, username, "", mShared)); } } while(0); @@ -682,7 +682,7 @@ RuleImpl::evaluateSessionOwner(const AuthItemRef &inRight, const Rule &inRule, c // Check if username will authorize the request and set username to // be used as a hint to the user if so secdebug("AuthEvalMech", "preflight credential from current user, result follows:"); - sessionCredential = Credential(pw->pw_uid, pw->pw_name, pw->pw_gecos, "", mShared/*ignored*/); + sessionCredential = Credential(pw->pw_uid, pw->pw_name, pw->pw_gecos, mShared/*ignored*/); } //fi endpwent(); } @@ -698,13 +698,21 @@ OSStatus RuleImpl::evaluateCredentialForRight(const AuthorizationToken &auth, const AuthItemRef &inRight, const Rule &inRule, const AuthItemSet &environment, CFAbsoluteTime now, const Credential &credential, bool ignoreShared, SecurityAgent::Reason &reason) const { if (auth.operatesAsLeastPrivileged()) { - if (credential->isRight() && credential->isValid() && (inRight->name() == credential->rightname())) - return errAuthorizationSuccess; - else + if (credential->isRight() && credential->isValid() && (inRight->name() == credential->name())) { + if (!ignoreShared && !mShared && credential->isShared()) + { + // @@@ no proper SA::Reason + reason = SecurityAgent::unknownReason; + secdebug("autheval", "shared credential cannot be used, denying right %s", inRight->name()); + return errAuthorizationDenied; + } else { + return errAuthorizationSuccess; + } + } else { // @@@ no proper SA::Reason reason = SecurityAgent::unknownReason; - return errAuthorizationDenied; + return errAuthorizationDenied; } } else return evaluateUserCredentialForRight(auth, inRight, inRule, environment, now, credential, false, reason); @@ -723,7 +731,7 @@ RuleImpl::evaluateUserCredentialForRight(const AuthorizationToken &auth, const A // everywhere, from RuleImpl::evaluate() on down. // Get the username from the credential - const char *user = credential->username().c_str(); + const char *user = credential->name().c_str(); // If the credential is not valid or its age is more than the allowed maximum age // for a credential, deny. @@ -810,7 +818,6 @@ RuleImpl::evaluateUserCredentialForRight(const AuthorizationToken &auth, const A if (is_member) { - credential->setGroupname(mGroupName); secdebug("autheval", "user %s is a member of group %s, granting right %s", user, groupname, inRight->name()); return errAuthorizationSuccess; @@ -873,10 +880,10 @@ RuleImpl::evaluateUser(const AuthItemRef &inRight, const Rule &inRule, AuthItemS { OSStatus status = evaluateUserCredentialForRight(auth, inRight, inRule, environmentToClient, now, *it, false, reason); if (errAuthorizationSuccess == status) { - Credential rightCredential(inRight->name(), (*it)->uid(), mShared); + Credential rightCredential(inRight->name(), mShared); credentials.erase(rightCredential); credentials.insert(rightCredential); if (mShared) - credentials.insert(Credential(inRight->name(), (*it)->uid(), false)); + credentials.insert(Credential(inRight->name(), false)); return status; } } @@ -973,6 +980,10 @@ RuleImpl::evaluateMechanismOnly(const AuthItemRef &inRight, const Rule &inRule, // (try to) attach the authorizing UID to the least-priv cred if (auth.operatesAsLeastPrivileged()) { + outCredentials.insert(Credential(rightName, mShared)); + if (mShared) + outCredentials.insert(Credential(rightName, false)); + RightAuthenticationLogger logger(auth.creatorAuditToken(), AUE_ssauthint); logger.setRight(rightName); @@ -982,26 +993,23 @@ RuleImpl::evaluateMechanismOnly(const AuthItemRef &inRight, const Rule &inRule, uid_t authorizedUid; memcpy(&authorizedUid, uidItem->value().data, sizeof(authorizedUid)); secdebug("AuthEvalMech", "generating least-privilege cred for '%s' authorized by UID %u", inRight->name(), authorizedUid); - outCredentials.insert(Credential(rightName, authorizedUid, mShared)); logger.logLeastPrivilege(authorizedUid, true); } else // cltUid is better than nothing { secdebug("AuthEvalMech", "generating least-privilege cred for '%s' with process- or auth-UID %u", inRight->name(), cltUid); - outCredentials.insert(Credential(rightName, cltUid, mShared)); logger.logLeastPrivilege(cltUid, false); } } - else { - if (0 == strcmp(rightName, "system.login.console") && NULL == eval.context().find(AGENT_CONTEXT_AUTO_LOGIN)) { - secdebug("AuthEvalMech", "We logged in as the session owner.\n"); - SessionAttributeBits flags = auth.session().attributes(); - flags |= AU_SESSION_FLAG_HAS_AUTHENTICATED; - auth.session().setAttributes(flags); - } - CredentialSet newCredentials = makeCredentials(auth); - outCredentials.insert(newCredentials.begin(), newCredentials.end()); - } + + if (0 == strcmp(rightName, "system.login.console") && NULL == eval.context().find(AGENT_CONTEXT_AUTO_LOGIN)) { + secdebug("AuthEvalMech", "We logged in as the session owner.\n"); + SessionAttributeBits flags = auth.session().attributes(); + flags |= AU_SESSION_FLAG_HAS_AUTHENTICATED; + auth.session().setAttributes(flags); + } + CredentialSet newCredentials = makeCredentials(auth); + outCredentials.insert(newCredentials.begin(), newCredentials.end()); } } diff --git a/src/authhost.cpp b/src/authhost.cpp index 3ca8f54..2f9580d 100644 --- a/src/authhost.cpp +++ b/src/authhost.cpp @@ -74,6 +74,11 @@ Session &AuthHostInstance::session() const return referent(); } +bool AuthHostInstance::inDarkWake() +{ + return this->session().server().inDarkWake(); +} + void AuthHostInstance::childAction() { @@ -154,9 +159,12 @@ AuthHostInstance::lookup(SessionId jobId) /* PR-7483709 const */ uuid_t instanceId = UUID_INITIALIZER_FROM_SESSIONID(jobId); uuid_string_t s; - if ((mHostType == securityAgent) && - !(session().attributes() & sessionHasGraphicAccess)) - CssmError::throwMe(CSSM_ERRCODE_NO_USER_INTERACTION); + if ((mHostType == securityAgent)) { + if (!(session().attributes() & sessionHasGraphicAccess)) + CssmError::throwMe(CSSM_ERRCODE_NO_USER_INTERACTION); + if (inDarkWake()) + CssmError::throwMe(CSSM_ERRCODE_IN_DARK_WAKE); + } if (mHostType == securityAgent) serviceName = SECURITYAGENT_BOOTSTRAP_NAME_BASE; @@ -181,9 +189,12 @@ Port AuthHostInstance::activate() StLock _(*this); if (state() != alive) { - if ((mHostType == securityAgent) && - !(session().attributes() & sessionHasGraphicAccess)) + if ((mHostType == securityAgent)) { + if (!(session().attributes() & sessionHasGraphicAccess)) CssmError::throwMe(CSSM_ERRCODE_NO_USER_INTERACTION); + if (inDarkWake()) + CssmError::throwMe(CSSM_ERRCODE_IN_DARK_WAKE); + } fork(); switch (ServerChild::state()) { diff --git a/src/authhost.h b/src/authhost.h index 5e41533..b1fc2c2 100644 --- a/src/authhost.h +++ b/src/authhost.h @@ -50,6 +50,8 @@ protected: private: AuthHostType mHostType; + + bool inDarkWake(); }; #endif /* _H_AUTHHOST */ diff --git a/src/authority.cpp b/src/authority.cpp index 5577188..e9685b2 100644 --- a/src/authority.cpp +++ b/src/authority.cpp @@ -273,7 +273,7 @@ AuthorizationToken::setCredentialInfo(const Credential &inCred, bool savePasswor AuthItemRef uidHint("uid", AuthValueOverlay(sizeof(uid), &uid)); dstInfoSet.insert(uidHint); - AuthItemRef userHint("username", AuthValueOverlay(inCred->username()), 0); + AuthItemRef userHint("username", AuthValueOverlay(inCred->name()), 0); dstInfoSet.insert(userHint); setInfoSet(dstInfoSet, savePassword); diff --git a/src/credential.cpp b/src/credential.cpp index 5eaa6a1..dcb38c2 100644 --- a/src/credential.cpp +++ b/src/credential.cpp @@ -32,16 +32,16 @@ extern "C" int checkpw_internal( const struct passwd *pw, const char* password ) namespace Authorization { // default credential: invalid for everything, needed as a default session credential -CredentialImpl::CredentialImpl() : mShared(false), mRight(false), mRightName(""), mGroupName(""), mUid(0), mUserName(""), mRealName(""), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(false) +CredentialImpl::CredentialImpl() : mShared(false), mRight(false), mUid(0), mName(""), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(false) { } // only for testing whether this credential is usable -CredentialImpl::CredentialImpl(const uid_t uid, const string &username, const string &realname, const string &groupname, bool shared) : mShared(shared), mRight(false), mRightName(""), mGroupName(groupname), mUid(uid), mUserName(username), mRealName(realname), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(true) +CredentialImpl::CredentialImpl(const uid_t uid, const string &username, const string &realname, bool shared) : mShared(shared), mRight(false), mUid(uid), mName(username), mRealName(realname), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(true) { } -CredentialImpl::CredentialImpl(const string &username, const string &password, bool shared) : mShared(shared), mRight(false), mRightName(""), mGroupName(""), mUserName(username), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(false) +CredentialImpl::CredentialImpl(const string &username, const string &password, bool shared) : mShared(shared), mRight(false), mName(username), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(false) { Server::active().longTermActivity(); const char *user = username.c_str(); @@ -54,7 +54,7 @@ CredentialImpl::CredentialImpl(const string &username, const string &password, b } mUid = pw->pw_uid; - mUserName = pw->pw_name; + mName = pw->pw_name; mRealName = pw->pw_gecos; const char *passwd = password.c_str(); @@ -76,7 +76,7 @@ CredentialImpl::CredentialImpl(const string &username, const string &password, b // least-privilege // @@@ arguably we don't care about the UID any more and should not // require it in this ctor -CredentialImpl::CredentialImpl(const string &right, const uid_t uid, bool shared) : mShared(shared), mRight(true), mRightName(right), mGroupName(""), mUid(uid), mUserName(""), mRealName(""), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(true) +CredentialImpl::CredentialImpl(const string &right, bool shared) : mShared(shared), mRight(true), mUid(-2), mName(right), mRealName(""), mCreationTime(CFAbsoluteTimeGetCurrent()), mValid(true) { } @@ -87,32 +87,36 @@ CredentialImpl::~CredentialImpl() bool CredentialImpl::operator < (const CredentialImpl &other) const { - // Desired ordering characteristics: + // all shared creds are placed into mSessionCreds + // all non shared creds are placed into AuthorizationToken // - // - unshared before shared - // - least privilege before non-least privilege - // - for least privilege credentials with the same sharing characteristics, - // order on the basis of right strings - // - orthographic order of group names - // - // UID used to be the primary distinguishing element, but it can't be - // trusted--it's gathered as a side effect, potentially by an external - // process. - // - // Nothing is sacred about this ordering; we just had to pick something. + // There are 2 types of credentials UID and Right + // UID = Authenticated Identity + // Right = Rights which were previously authenticated by a uid credential + // Right Credentials are only used during kAuthorizationFlagLeastPrivileged + // operations and should not have a valid uid set + + // this allows shared and none shared co-exist in the same container + // used when processing multiple rights shared vs non-shared during evaluation if (!mShared && other.mShared) return true; if (!other.mShared && mShared) return false; + + // this allows uids and rights co-exist in the same container + // used when holding onto Rights inside of the AuthorizationToken if (mRight && !other.mRight) return true; if (!mRight && other.mRight) return false; - if (mRight && other.mRight) - return mRightName < other.mRightName; - else - return mGroupName < other.mGroupName; + + // this is the actual comparision + if (mRight) { + return mName < other.mName; + } else { + return mUid < other.mUid; + } } // Returns true if this CredentialImpl should be shared. @@ -129,9 +133,9 @@ CredentialImpl::merge(const CredentialImpl &other) // try to ensure that the credentials are the same type assert(mRight == other.mRight); if (mRight) - assert(mRightName == other.mRightName); - else - assert(mGroupName == other.mGroupName); + assert(mName == other.mName); + else + assert(mUid == other.mUid); if (other.mValid && (!mValid || mCreationTime < other.mCreationTime)) { @@ -173,8 +177,8 @@ RefPointer(impl) { } -Credential::Credential(const uid_t uid, const string &username, const string &realname, const string &groupname, bool shared) : -RefPointer(new CredentialImpl(uid, username, realname, groupname, shared)) +Credential::Credential(const uid_t uid, const string &username, const string &realname, bool shared) : +RefPointer(new CredentialImpl(uid, username, realname, shared)) { } @@ -182,7 +186,7 @@ Credential::Credential(const string &username, const string &password, bool shar { } -Credential::Credential(const string &right, const uid_t uid, bool shared) : RefPointer(new CredentialImpl(right, uid, shared)) +Credential::Credential(const string &right, bool shared) : RefPointer(new CredentialImpl(right, shared)) { } diff --git a/src/credential.h b/src/credential.h index 7b5dba6..d96b511 100644 --- a/src/credential.h +++ b/src/credential.h @@ -39,9 +39,9 @@ class CredentialImpl : public RefCount { public: CredentialImpl(); - CredentialImpl(const uid_t uid, const string &username, const string &realname, const string &groupname, bool shared); + CredentialImpl(const uid_t uid, const string &username, const string &realname, bool shared); CredentialImpl(const string &username, const string &password, bool shared); - CredentialImpl(const string &right, const uid_t uid, bool shared); + CredentialImpl(const string &right, bool shared); ~CredentialImpl(); bool operator < (const CredentialImpl &other) const; @@ -63,28 +63,20 @@ public: // We could make Rule a friend but instead we just expose this for now inline const uid_t uid() const { return mUid; } - inline const string& username() const { return mUserName; } + inline const string& name() const { return mName; } inline const string& realname() const { return mRealName; } - inline const bool isRight() const { return mRight; } - inline const string &rightname() const { return mRightName; } - inline const string &groupname() const { return mGroupName; } - - // sometimes the Credential exists before we've validated it, so we need - // a setter for group name - inline void setGroupname(const string &group) { mGroupName = group; } + inline const bool isRight() const { return mRight; } private: bool mShared; // credential is shared - bool mRight; // is least-privilege credential - string mRightName; // least-privilege name - string mGroupName; // if it's not least-priv, it boils down to - // user-in-group + bool mRight; // is least-privilege credential + // Fields below are not used by less-than operator // The user that provided his password. uid_t mUid; - string mUserName; + string mName; string mRealName; CFAbsoluteTime mCreationTime; @@ -97,9 +89,9 @@ class Credential : public RefPointer public: Credential(); Credential(CredentialImpl *impl); - Credential(const uid_t uid, const string &username, const string &realname, const string &groupname, bool shared); + Credential(const uid_t uid, const string &username, const string &realname, bool shared); Credential(const string &username, const string &password, bool shared); - Credential(const string &right, const uid_t uid, bool shared); + Credential(const string &right, bool shared); ~Credential(); bool operator < (const Credential &other) const; diff --git a/src/server.h b/src/server.h index 2c534b0..c526bd3 100644 --- a/src/server.h +++ b/src/server.h @@ -192,6 +192,7 @@ public: void beginShutdown(); // start delayed shutdown if configured bool shuttingDown() const { return mShuttingDown; } void shutdownSnitch(); // report lingering clients + bool inDarkWake() { return sleepWatcher.inDarkWake(); } private: // mach bootstrap registration name diff --git a/src/session.cpp b/src/session.cpp index d7cecbf..42d51c4 100644 --- a/src/session.cpp +++ b/src/session.cpp @@ -89,6 +89,12 @@ Session::~Session() } +Server &Session::server() const +{ + return parent(); +} + + // // Locate a session object by session identifier // diff --git a/src/session.h b/src/session.h index fd7111c..cccaf24 100644 --- a/src/session.h +++ b/src/session.h @@ -61,6 +61,8 @@ public: Session(const CommonCriteria::AuditInfo &audit, Server &server); virtual ~Session(); + Server &server() const; + SessionId sessionId() const { return mAudit.sessionId(); } CommonCriteria::AuditInfo &auditInfo() { return mAudit; } -- 2.45.2