1  /*
  2   * Copyright (c) 2008-2009,2012,2014 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   *
 23   *  access_utils.c
 24   */
 25  
 26  #include "access_utils.h"
 27  #include "security_tool.h"
 28  #include <stdio.h>
 29  #include <Security/SecKeychainItem.h>
 30  #include <Security/SecAccess.h>
 31  #include <Security/SecACL.h>
 32  
 33  // create_access
 34  //
 35  // This function creates a SecAccessRef with an array of trusted applications.
 36  //
 37  int
 38  create_access(const char *accessName, Boolean allowAny, CFArrayRef trustedApps, SecAccessRef *access)
 39  {
 40  	int result = 0;
 41  	CFArrayRef appList = NULL;
 42  	CFArrayRef aclList = NULL;
 43  	CFStringRef description = NULL;
 44  	const char *descriptionLabel = (accessName) ? accessName : "<unlabeled key>";
 45  	CFStringRef promptDescription = NULL;
 46  	CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR promptSelector;
 47  	SecACLRef aclRef;
 48  	OSStatus status;
 49  
 50  	if (accessName) {
 51  		description = CFStringCreateWithCString(NULL, descriptionLabel, kCFStringEncodingUTF8);
 52  	}
 53  
 54  	status = SecAccessCreate(description, trustedApps, access);
 55  	if (status)
 56  	{
 57  		sec_perror("SecAccessCreate", status);
 58  		result = 1;
 59  		goto cleanup;
 60  	}
 61  
 62  	// get the access control list for decryption operations (this controls access to an item's data)
 63  	status = SecAccessCopySelectedACLList(*access, CSSM_ACL_AUTHORIZATION_DECRYPT, &aclList);
 64  	if (status)
 65  	{
 66  		sec_perror("SecAccessCopySelectedACLList", status);
 67  		result = 1;
 68  		goto cleanup;
 69  	}
 70  
 71  	// get the first entry in the access control list
 72  	aclRef = (SecACLRef)CFArrayGetValueAtIndex(aclList, 0);
 73  	status = SecACLCopySimpleContents(aclRef, &appList, &promptDescription, &promptSelector);
 74  	if (status)
 75  	{
 76  		sec_perror("SecACLCopySimpleContents", status);
 77  		result = 1;
 78  		goto cleanup;
 79  	}
 80  
 81  	if (allowAny) // "allow all applications to access this item"
 82  	{
 83  		// change the decryption ACL to not require the passphrase, and have a nil application list.
 84  		promptSelector.flags &= ~CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE;
 85  		status = SecACLSetSimpleContents(aclRef, NULL, promptDescription, &promptSelector);
 86  	}
 87  	else // "allow access by these applications"
 88  	{
 89  		// modify the application list
 90  		status = SecACLSetSimpleContents(aclRef, trustedApps, promptDescription, &promptSelector);
 91  	}
 92  	if (status)
 93  	{
 94  		sec_perror("SecACLSetSimpleContents", status);
 95  		result = 1;
 96  		goto cleanup;
 97  	}
 98  
 99  cleanup:
100  	if (description)
101  		CFRelease(description);
102  	if (promptDescription)
103  		CFRelease(promptDescription);
104  	if (appList)
105  		CFRelease(appList);
106  	if (aclList)
107  		CFRelease(aclList);
108  
109  	return result;
110  }
111  
112  // merge_access
113  //
114  // This function merges the contents of otherAccess into access.
115  // Simple ACL contents are assumed, and only the standard ACL
116  // for decryption operations is currently processed.
117  //
118  int
119  merge_access(SecAccessRef access, SecAccessRef otherAccess)
120  {
121  	OSStatus status;
122  	CFArrayRef aclList, newAclList;
123  
124  	// get existing access control list for decryption operations (this controls access to an item's data)
125  	status = SecAccessCopySelectedACLList(access, CSSM_ACL_AUTHORIZATION_DECRYPT, &aclList);
126  	if (status) {
127  		return status;
128  	}
129  	// get desired access control list for decryption operations
130  	status = SecAccessCopySelectedACLList(otherAccess, CSSM_ACL_AUTHORIZATION_DECRYPT, &newAclList);
131  	if (status) {
132  		newAclList = nil;
133  	} else {
134  		SecACLRef aclRef=(SecACLRef)CFArrayGetValueAtIndex(aclList, 0);
135  		SecACLRef newAclRef=(SecACLRef)CFArrayGetValueAtIndex(newAclList, 0);
136  		CFArrayRef appList=nil;
137  		CFArrayRef newAppList=nil;
138  		CFMutableArrayRef mergedAppList = nil;
139  		CFStringRef promptDescription=nil;
140  		CFStringRef newPromptDescription=nil;
141  		CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR promptSelector;
142  		CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR newPromptSelector;
143  
144  		status = SecACLCopySimpleContents(aclRef, &appList, &promptDescription, &promptSelector);
145  		if (!status) {
146  			status = SecACLCopySimpleContents(newAclRef, &newAppList, &newPromptDescription, &newPromptSelector);
147  		}
148  		if (!status) {
149  			if (appList) {
150  				mergedAppList = CFArrayCreateMutableCopy(NULL, 0, appList);
151  			}
152  			if (newAppList) {
153  				if (mergedAppList) {
154  					CFArrayAppendArray(mergedAppList, newAppList, CFRangeMake(0, CFArrayGetCount(newAppList)));
155  				} else {
156  					mergedAppList = CFArrayCreateMutableCopy(NULL, 0, newAppList);
157  				}
158  			}
159  			promptSelector.flags = newPromptSelector.flags;
160  			status = SecACLSetSimpleContents(aclRef, mergedAppList, newPromptDescription, &newPromptSelector);
161  		}
162  
163  		if (appList) CFRelease(appList);
164  		if (newAppList) CFRelease(newAppList);
165  		if (mergedAppList) CFRelease(mergedAppList);
166  		if (promptDescription) CFRelease(promptDescription);
167  		if (newPromptDescription) CFRelease(newPromptDescription);
168  	}
169  	if (aclList) CFRelease(aclList);
170  	if (newAclList) CFRelease(newAclList);
171  
172  	return status;
173  }
174  
175  // modify_access
176  //
177  // This function updates the access for an existing item.
178  // The provided access is merged with the item's existing access.
179  //
180  int
181  modify_access(SecKeychainItemRef itemRef, SecAccessRef access)
182  {
183  	OSStatus status;
184  	SecAccessRef curAccess = NULL;
185  	// for historical reasons, we have to modify the item's existing access reference
186  	// (setting the item's access to a freshly created SecAccessRef instance doesn't behave as expected)
187  	status = SecKeychainItemCopyAccess(itemRef, &curAccess);
188  	if (status) {
189  		sec_error("SecKeychainItemCopyAccess: %s", sec_errstr(status));
190  	} else {
191  		status = merge_access(curAccess, access); // make changes to the existing access reference
192  		if (!status) {
193  			status = SecKeychainItemSetAccess(itemRef, curAccess); // will prompt!
194  			if (status) {
195  				sec_error("SecKeychainItemSetAccess: %s", sec_errstr(status));
196  			}
197  		}
198  	}
199  	if (curAccess) {
200  		CFRelease(curAccess);
201  	}
202  	return status;
203  }