1  /*
  2   * Copyright (c) 2002-2004,2011-2014 Apple Inc. All Rights Reserved.
  3   * 
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  #include <Security/SecACL.h>
 25  #include <security_keychain/ACL.h>
 26  #include <security_keychain/Access.h>
 27  #include <security_keychain/SecAccessPriv.h>
 28  
 29  #include <os/activity.h>
 30  
 31  #include "SecBridge.h"
 32  
 33  #include "LegacyAPICounts.h"
 34  
 35  // Forward reference
 36  /*!
 37  	@function GetACLAuthorizationTagFromString
 38  	@abstract Get the CSSM ACL item from the CFString
 39      @param aclStr The String name of the ACL
 40  	@result The CSSM ACL value
 41  */
 42  sint32 GetACLAuthorizationTagFromString(CFStringRef aclStr);
 43  
 44  CFStringRef GetAuthStringFromACLAuthorizationTag(sint32 tag);
 45  
 46  //
 47  // Local functions
 48  //
 49  static void setApplications(ACL *acl, CFArrayRef applicationList);
 50  
 51  CFTypeID
 52  SecACLGetTypeID(void)
 53  {
 54  	BEGIN_SECAPI
 55  
 56  	return gTypes().ACL.typeID;
 57  
 58  	END_SECAPI1(_kCFRuntimeNotATypeID)
 59  }
 60  
 61  
 62  /*!
 63   */
 64  OSStatus SecACLCreateFromSimpleContents(SecAccessRef accessRef,
 65  	CFArrayRef applicationList,
 66  	CFStringRef description, const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR *promptSelector,
 67  	SecACLRef *newAcl)
 68  {
 69  	BEGIN_SECAPI
 70      os_activity_t activity = os_activity_create("SecACLCreateFromSimpleContents", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 71      os_activity_scope(activity);
 72      os_release(activity);
 73  	SecPointer<Access> access = Access::required(accessRef);
 74  	SecPointer<ACL> acl = new ACL(cfString(description), *promptSelector);
 75  	if (applicationList) {
 76  		// application-list + prompt
 77  		acl->form(ACL::appListForm);
 78  		setApplications(acl, applicationList);
 79  	} else {
 80  		// allow-any
 81  		acl->form(ACL::allowAllForm);
 82  	}
 83  	access->add(acl.get());
 84  	Required(newAcl) = acl->handle();
 85  	END_SECAPI
 86  }
 87  
 88  OSStatus SecACLCreateWithSimpleContents(SecAccessRef access,
 89  										CFArrayRef applicationList,
 90  										CFStringRef description, 
 91  										SecKeychainPromptSelector promptSelector,
 92  										SecACLRef *newAcl)
 93  {
 94  	COUNTLEGACYAPI
 95  	CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR cdsaPromptSelector;
 96  	cdsaPromptSelector.version = CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION;
 97  	cdsaPromptSelector.flags = promptSelector;
 98  	return SecACLCreateFromSimpleContents(access, applicationList, description, &cdsaPromptSelector, newAcl);
 99  }
100  
101  
102  /*!
103   */
104  OSStatus SecACLRemove(SecACLRef aclRef)
105  {
106  	BEGIN_SECAPI
107      os_activity_t activity = os_activity_create("SecACLRemove", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
108      os_activity_scope(activity);
109      os_release(activity);
110  	ACL::required(aclRef)->remove();
111  	END_SECAPI
112  }
113  
114  
115  static SecTrustedApplicationRef
116  convert(const SecPointer<TrustedApplication> &trustedApplication)
117  {
118  	return *trustedApplication;
119  }
120  
121  /*!
122   */
123  OSStatus SecACLCopySimpleContents(SecACLRef aclRef,
124  	CFArrayRef *applicationList,
125  	CFStringRef *promptDescription, CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR *promptSelector)
126  {
127  	BEGIN_SECAPI
128  	SecPointer<ACL> acl = ACL::required(aclRef);
129  	switch (acl->form()) {
130  	case ACL::allowAllForm:
131  		Required(applicationList) = NULL;
132  		Required(promptDescription) =
133  			acl->promptDescription().empty() ? NULL
134  				: makeCFString(acl->promptDescription());
135  		Required(promptSelector) = acl->promptSelector();
136  		break;
137  	case ACL::appListForm:
138  		Required(applicationList) =
139  			makeCFArrayFrom(convert, acl->applications());
140  		Required(promptDescription) = makeCFString(acl->promptDescription());
141  		Required(promptSelector) = acl->promptSelector();
142  		break;
143      case ACL::integrityForm:
144          Required(applicationList) = NULL;
145          Required(promptDescription) = makeCFString(acl->integrity().toHex());
146  
147          // We don't have a prompt selector. Nullify.
148          Required(promptSelector).version = CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION;
149          Required(promptSelector).flags = 0;
150          break;
151  	default:
152  		return errSecACLNotSimple;		// custom or unknown
153  	}
154  	END_SECAPI
155  }
156  
157  OSStatus SecACLCopyContents(SecACLRef acl,
158  							CFArrayRef *applicationList,
159  							CFStringRef *description, 
160  							SecKeychainPromptSelector *promptSelector)
161  {
162  	COUNTLEGACYAPI
163  	CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR cdsaPromptSelector;
164  	memset(&cdsaPromptSelector, 0, sizeof(cdsaPromptSelector));
165  	OSStatus err = errSecSuccess;
166  	
167  	err = SecACLCopySimpleContents(acl, applicationList, description, &cdsaPromptSelector);
168  	*promptSelector = cdsaPromptSelector.flags;
169  	return err;	
170  }
171  
172  OSStatus SecACLSetSimpleContents(SecACLRef aclRef,
173  	CFArrayRef applicationList,
174  	CFStringRef description, const CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR *promptSelector)
175  {
176  	BEGIN_SECAPI
177      os_activity_t activity = os_activity_create("SecACLSetSimpleContents", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
178      os_activity_scope(activity);
179      os_release(activity);
180  	SecPointer<ACL> acl = ACL::required(aclRef);
181      if(acl->form() == ACL::integrityForm) {
182          // If this is an integrity ACL, route the (unhexified) promptDescription into the right place
183          string hex = cfString(description);
184          if(hex.length() %2 == 0) {
185              // might be a valid hex string, try to set
186              CssmAutoData data(Allocator::standard());
187              data.malloc(hex.length() / 2);
188              data.get().fromHex(hex.c_str());
189              acl->setIntegrity(data);
190          }
191      } else {
192          // Otherwise, put it in the promptDescription where it belongs
193          acl->promptDescription() = description ? cfString(description) : "";
194      }
195  	acl->promptSelector() = promptSelector ? *promptSelector : ACL::defaultSelector;
196      if(acl->form() !=  ACL::integrityForm) {
197          if (applicationList) {
198              // application-list + prompt
199              acl->form(ACL::appListForm);
200              setApplications(acl, applicationList);
201          } else {
202              // allow-any
203              acl->form(ACL::allowAllForm);
204          }
205  	}
206  	acl->modify();
207  	END_SECAPI
208  }
209  
210  OSStatus SecACLSetContents(SecACLRef acl,
211  						   CFArrayRef applicationList,
212  						   CFStringRef description, 
213  						   SecKeychainPromptSelector promptSelector)
214  {
215  	COUNTLEGACYAPI
216  	CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR cdsaPromptSelector;
217  	cdsaPromptSelector.version = CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION;
218  	cdsaPromptSelector.flags = promptSelector;
219  	return SecACLSetSimpleContents(acl, applicationList, description, &cdsaPromptSelector);	
220  }
221  
222  //
223  // Stuff a CFArray-of-SecTrustedApplications into an ACL object
224  //
225  static void setApplications(ACL *acl, CFArrayRef applicationList)
226  {
227  	ACL::ApplicationList &appList = acl->applications();
228  	appList.clear();
229  	//@@@ should really use STL iterator overlay on CFArray. By hand...
230  	CFIndex count = CFArrayGetCount(applicationList);
231  	for (CFIndex n = 0; n < count; n++)
232  		appList.push_back(TrustedApplication::required(
233  			SecTrustedApplicationRef(CFArrayGetValueAtIndex(applicationList, n))));
234  }
235  
236  
237  //
238  // Set and get the authorization tags of an ACL entry
239  //
240  OSStatus SecACLGetAuthorizations(SecACLRef acl,
241  	CSSM_ACL_AUTHORIZATION_TAG *tags, uint32 *tagCount)
242  {
243  	BEGIN_SECAPI
244  	AclAuthorizationSet auths = ACL::required(acl)->authorizations();
245  	if (Required(tagCount) < auths.size()) {	// overflow
246  		*tagCount = (uint32)auths.size();				// report size required
247  		CssmError::throwMe(errSecParam);
248  	}
249  	*tagCount = (uint32)auths.size();
250  	copy(auths.begin(), auths.end(), tags);
251  	END_SECAPI
252  }
253  
254  CFArrayRef SecACLCopyAuthorizations(SecACLRef acl)
255  {
256  	COUNTLEGACYAPI
257  	CFArrayRef result = NULL;
258  	if (NULL == acl)
259  	{
260  		return result;
261  	}
262  	
263  	AclAuthorizationSet auths = ACL::required(acl)->authorizations();
264  	uint32 numAuths = (uint32)auths.size();				
265  	
266      CSSM_ACL_AUTHORIZATION_TAG* tags = new CSSM_ACL_AUTHORIZATION_TAG[numAuths];
267      int i;
268      for (i = 0; i < numAuths; ++i)
269      {
270          tags[i] = NULL;
271      }
272  	
273  	OSStatus err = SecACLGetAuthorizations(acl, tags, &numAuths);
274  	if (errSecSuccess != err)
275  	{
276  		
277  		return result;
278  	}
279  	
280  	CFTypeRef* strings = new CFTypeRef[numAuths];
281      for (i = 0; i < numAuths; ++i)
282      {
283          strings[i] = NULL;
284      }
285      
286  	for (size_t iCnt = 0; iCnt < numAuths; iCnt++)
287  	{
288  		strings[iCnt] = (CFTypeRef)GetAuthStringFromACLAuthorizationTag(tags[iCnt]);
289  	}
290  
291  	result = CFArrayCreate(kCFAllocatorDefault, (const void **)strings, numAuths, &kCFTypeArrayCallBacks);
292  
293  	delete[] strings;
294      delete[] tags;
295  
296  	return result;
297  	
298  }
299  
300  OSStatus SecACLSetAuthorizations(SecACLRef aclRef,
301  	CSSM_ACL_AUTHORIZATION_TAG *tags, uint32 tagCount)
302  {
303  	BEGIN_SECAPI
304      os_activity_t activity = os_activity_create("SecACLSetAuthorizations", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
305      os_activity_scope(activity);
306      os_release(activity);
307  	SecPointer<ACL> acl = ACL::required(aclRef);
308  	if (acl->isOwner())		// can't change rights of the owner ACL
309  		MacOSError::throwMe(errSecInvalidOwnerEdit);
310  	AclAuthorizationSet &auths = acl->authorizations();
311  	auths.clear();
312  	copy(tags, tags + tagCount, insert_iterator<AclAuthorizationSet>(auths, auths.begin()));
313  	acl->modify();
314  	END_SECAPI
315  }
316  
317  OSStatus SecACLUpdateAuthorizations(SecACLRef acl, CFArrayRef authorizations)
318  {
319  	COUNTLEGACYAPI
320  	if (NULL == acl || NULL == authorizations)
321  	{
322  		return errSecParam;
323  	}
324  	uint32 tagCount = (uint32)CFArrayGetCount(authorizations);
325  	
326  	size_t tagSize = (tagCount * sizeof(CSSM_ACL_AUTHORIZATION_TAG));
327  	
328  	CSSM_ACL_AUTHORIZATION_TAG* tags = (CSSM_ACL_AUTHORIZATION_TAG*)malloc(tagSize);
329  	memset(tags, 0, tagSize);
330  	for (uint32 iCnt = 0; iCnt < tagCount; iCnt++)
331  	{
332  		tags[iCnt] = GetACLAuthorizationTagFromString((CFStringRef)CFArrayGetValueAtIndex(authorizations, iCnt));
333  	}
334  	
335  	OSStatus result = SecACLSetAuthorizations(acl, tags, tagCount);
336  	free(tags);
337  	return result;
338  }