csdatabase.cpp
1 /* 2 * Copyright (c) 2006-2007,2011-2013 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 */ 23 24 // 25 // csdb - system-supported Code Signing related database interfaces 26 // 27 #include "csdatabase.h" 28 #include "detachedrep.h" 29 30 namespace Security { 31 namespace CodeSigning { 32 33 using namespace SQLite; 34 35 36 // 37 // The one and only SignatureDatabase object. 38 // It auto-adapts to readonly vs. writable use. 39 // 40 ModuleNexus<SignatureDatabase> signatureDatabase; 41 ModuleNexus<SignatureDatabaseWriter> signatureDatabaseWriter; 42 43 44 // 45 // Default path to the signature database. 46 // 47 const char SignatureDatabase::defaultPath[] = "/var/db/DetachedSignatures"; 48 49 50 // 51 // Creation commands to initialize the system database. 52 // 53 const char schema[] = "\ 54 create table if not exists code ( \n\ 55 id integer primary key on conflict replace autoincrement not null, \n\ 56 global integer null references global (id), \n\ 57 identifier text not null, \n\ 58 architecture integer, \n\ 59 identification blob not null unique on conflict replace, \n\ 60 signature blob not null, \n\ 61 created text default current_timestamp \n\ 62 ); \n\ 63 create index if not exists identifier_index on code (identifier); \n\ 64 create index if not exists architecture_index on code (architecture); \n\ 65 create index if not exists id_index on code (identification); \n\ 66 \n\ 67 create table if not exists global ( \n\ 68 id integer primary key on conflict replace autoincrement not null, \n\ 69 sign_location text not null, \n\ 70 signature blob null \n\ 71 ); \n\ 72 create index if not exists location_index on global (sign_location); \n\ 73 "; 74 75 76 77 // 78 // Open the database (creating it if necessary and possible). 79 // Note that this isn't creating the schema; we do that on first write. 80 // 81 SignatureDatabase::SignatureDatabase(const char *path, int flags) 82 : SQLite::Database(path, flags, true) // lenient open 83 { 84 } 85 86 SignatureDatabase::~SignatureDatabase() 87 { /* virtual */ } 88 89 90 // 91 // Consult the database to find code by identification blob. 92 // Return the signature and (optional) global data blobs. 93 // 94 FilterRep *SignatureDatabase::findCode(DiskRep *rep) 95 { 96 if (CFRef<CFDataRef> identification = rep->identification()) 97 if (!this->empty()) { 98 SQLite::Statement query(*this, 99 "select code.signature, global.signature from code, global \ 100 where code.identification = ?1 and code.global = global.id;"); 101 query.bind(1) = identification.get(); 102 if (query.nextRow()) { 103 CFRef<CFDataRef> sig = query[0].data(); 104 CFRef<CFDataRef> gsig = query[1].data(); 105 return new DetachedRep(sig, gsig, rep, "system"); 106 } 107 } 108 109 // no joy 110 return NULL; 111 } 112 113 114 // 115 // Given a unified detached signature blob, store its data in the database. 116 // This writes exactly one Global record, plus one Code record per architecture 117 // (where non-architectural code is treated as single-architecture). 118 // 119 void SignatureDatabaseWriter::storeCode(const BlobCore *sig, const char *location) 120 { 121 if (!this->isOpen()) // failed database open or creation 122 MacOSError::throwMe(errSecCSDBAccess); 123 Transaction xa(*this, Transaction::exclusive); // lock out everyone 124 if (this->empty()) 125 this->execute(schema); // initialize schema 126 if (const EmbeddedSignatureBlob *esig = EmbeddedSignatureBlob::specific(sig)) { // architecture-less 127 int64 globid = insertGlobal(location, NULL); 128 insertCode(globid, 0, esig); 129 xa.commit(); 130 return; 131 } else if (const DetachedSignatureBlob *dsblob = DetachedSignatureBlob::specific(sig)) { 132 int64 globid = insertGlobal(location, dsblob->find(0)); 133 unsigned count = dsblob->count(); 134 for (unsigned n = 0; n < count; n++) 135 if (uint32_t arch = dsblob->type(n)) 136 insertCode(globid, arch, EmbeddedSignatureBlob::specific(dsblob->blob(n))); 137 xa.commit(); 138 return; 139 } 140 141 MacOSError::throwMe(errSecCSSignatureInvalid); 142 143 } 144 145 int64 SignatureDatabaseWriter::insertGlobal(const char *location, const BlobCore *blob) 146 { 147 Statement insert(*this, "insert into global (sign_location, signature) values (?1, ?2);"); 148 insert.bind(1) = location; 149 if (blob) 150 insert.bind(2).blob(blob, blob->length(), true); 151 insert(); 152 return lastInsert(); 153 } 154 155 void SignatureDatabaseWriter::insertCode(int64 globid, int arch, const EmbeddedSignatureBlob *sig) 156 { 157 // retrieve binary identifier (was added by signer) 158 const BlobWrapper *ident = BlobWrapper::specific(sig->find(cdIdentificationSlot)); 159 assert(ident); 160 161 // extract CodeDirectory to get some information from it 162 const CodeDirectory *cd = CodeDirectory::specific(sig->find(cdCodeDirectorySlot)); 163 assert(cd); 164 165 // write the record 166 Statement insert(*this, 167 "insert into code (global, identifier, architecture, identification, signature) values (?1, ?2, ?3, ?4, ?5);"); 168 insert.bind(1) = globid; 169 insert.bind(2) = cd->identifier(); 170 if (arch) 171 insert.bind(3) = arch; 172 insert.bind(4).blob(ident->data(), ident->length(), true); 173 insert.bind(5).blob(sig, sig->length(), true); 174 insert(); 175 } 176 177 178 179 } // end namespace CodeSigning 180 } // end namespace Security