From a4c2b42a1d48559c73e7dd3ba50aee71b0c6d123 Mon Sep 17 00:00:00 2001 From: Apple Date: Thu, 12 Jul 2012 22:14:41 +0000 Subject: [PATCH] securityd-55126.5.tar.gz --- etc/authorization.merge | 378 ++++++++++++++++++++++++++++ securityd.xcodeproj/project.pbxproj | 8 +- src/session.cpp | 9 +- 3 files changed, 390 insertions(+), 5 deletions(-) diff --git a/etc/authorization.merge b/etc/authorization.merge index b7b0367..8d59456 100644 --- a/etc/authorization.merge +++ b/etc/authorization.merge @@ -7979,6 +7979,371 @@ rules + admin + + class + user + group + admin + shared + + + allow + + class + allow + comment + Allow anyone. + + appserver-admin + + class + user + group + appserveradm + + appserver-user + + class + user + group + appserverusr + + authenticate + + class + evaluate-mechanisms + mechanisms + + builtin:authenticate + builtin:reset-password,privileged + builtin:authenticate,privileged + PKINITMechanism:auth,privileged + + + authenticate-admin + + class + user + comment + Authenticate as an administrator. + group + admin + shared + + timeout + 0 + + authenticate-admin-30 + + class + user + comment + Like the default rule, but + credentials remain valid for only 30 seconds after they've + been obtained. An acquired credential is shared by all clients. + + group + admin + shared + + timeout + 30 + + authenticate-appstore-30 + + class + user + group + _appstore + shared + + timeout + 30 + + authenticate-developer + + class + user + comment + Authenticate as a developer. + group + _developer + shared + + timeout + 36000 + + authenticate-session-owner + + class + user + comment + Authenticate as the session owner. + session-owner + + + authenticate-session-owner-or-admin + + allow-root + + class + user + comment + Authenticate either as the owner or as an administrator. + group + admin + session-owner + + shared + + + authenticate-session-user + + class + user + comment + Same as authenticate-session-owner. + session-owner + + + default + + class + user + comment + Default rule. + Credentials remain valid for 5 minutes after they've been obtained. + An acquired credential is shared by all clients. + + group + admin + shared + + timeout + 300 + + entitled + + class + evaluate-mechanisms + mechanisms + + builtin:entitled,privileged + + tries + 1 + + entitled-admin + + class + rule + k-of-n + 2 + rule + + is-admin + entitled + + + entitled-admin-or-authenticate-admin + + class + rule + k-of-n + 1 + rule + + entitled-admin + authenticate-admin-30 + + + entitled-appstore + + class + rule + k-of-n + 2 + rule + + is-appstore + entitled + + + entitled-appstore-or-entitled-authenticate-appstore + + class + rule + k-of-n + 1 + rule + + entitled-appstore + entitled-authenticate-appstore + + + entitled-authenticate-admin + + class + rule + k-of-n + 2 + rule + + entitled + authenticate-admin-30 + + + entitled-authenticate-appstore + + class + rule + k-of-n + 2 + rule + + entitled + authenticate-appstore-30 + + + entitled-session-owner + + class + rule + k-of-n + 2 + rule + + is-session-owner + entitled + + + entitled-session-owner-or-authenticate-session-owner + + class + rule + k-of-n + 1 + rule + + entitled-session-owner + authenticate-session-owner + + + is-admin + + authenticate-user + + class + user + comment + Verify that the user asking for authorization is an administrator. + group + admin + shared + true + + is-appstore + + authenticate-user + + class + user + group + _appstore + shared + true + + is-developer + + authenticate-user + + class + user + comment + Verify that the user asking for authorization is a developer. + group + _developer + + is-lpadmin + + authenticate-user + + class + user + group + _lpadmin + + is-root + + allow-root + + authenticate-user + + class + user + comment + Verify that the process that created this AuthorizationRef is running as root. + + is-session-owner + + allow-root + + authenticate-user + + class + user + comment + Verify that the requesting process is running as the session owner. + session-owner + + + lpadmin + + class + user + group + _lpadmin + shared + + + on-console + + class + evaluate-mechanisms + mechanisms + + builtin:on-console + + tries + 1 + + root-or-admin-or-authenticate-admin + + class + rule + k-of-n + 1 + rule + + is-root + is-admin + authenticate-admin-30 + + + root-or-entitled-admin-or-admin + + class + rule + k-of-n + 1 + rule + + is-root + entitled-admin + admin + + root-or-entitled-admin-or-authenticate-admin class @@ -7991,6 +8356,19 @@ entitled-admin-or-authenticate-admin + root-or-lpadmin + + class + rule + k-of-n + 1 + rule + + is-root + is-lpadmin + lpadmin + + diff --git a/securityd.xcodeproj/project.pbxproj b/securityd.xcodeproj/project.pbxproj index 0615462..77e908b 100644 --- a/securityd.xcodeproj/project.pbxproj +++ b/securityd.xcodeproj/project.pbxproj @@ -991,7 +991,7 @@ BUILD_VARIANTS = debug; COPY_PHASE_STRIP = NO; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55126.2; + CURRENT_PROJECT_VERSION = 55126.5; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, @@ -1044,7 +1044,7 @@ ); COPY_PHASE_STRIP = "(null)"; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55126.2; + CURRENT_PROJECT_VERSION = 55126.5; DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, @@ -1095,7 +1095,7 @@ BUILD_VARIANTS = normal; COPY_PHASE_STRIP = NO; CSSM_HEADERS = "$(BUILT_PRODUCTS_DIR)/Security.framework/Headers:$(SYSTEM_LIBRARY_DIR)/Frameworks/Security.framework/Headers"; - CURRENT_PROJECT_VERSION = 55126.2; + CURRENT_PROJECT_VERSION = 55126.5; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, @@ -1148,7 +1148,7 @@ ); COPY_PHASE_STRIP = "(null)"; CSSM_HEADERS = ""; - CURRENT_PROJECT_VERSION = 55126.2; + CURRENT_PROJECT_VERSION = 55126.5; FRAMEWORK_SEARCH_PATHS = ( /usr/local/SecurityPieces/Frameworks, /usr/local/SecurityPieces/Components/securityd, diff --git a/src/session.cpp b/src/session.cpp index 42d51c4..08127db 100644 --- a/src/session.cpp +++ b/src/session.cpp @@ -172,7 +172,14 @@ void Session::kill() // void Session::updateAudit() const { - mAudit.get(mAudit.sessionId()); + CommonCriteria::AuditInfo info; + StLock _(mSessionLock); + try { + info.get(mAudit.sessionId()); + } catch (...) { + return; + } + mAudit = info; } -- 2.45.2