1  /*
  2   * Copyright (c) 2017 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  #import "SFKeychainControlManager.h"
 25  #import "SecCFError.h"
 26  #import "builtin_commands.h"
 27  #import "debugging.h"
 28  #import <Security/SecItem.h>
 29  #import <Security/SecItemPriv.h>
 30  #import <Foundation/NSXPCConnection_Private.h>
 31  #import <Security/SecXPCHelper.h>
 32  
 33  NSString* kSecEntitlementKeychainControl = @"com.apple.private.keychain.keychaincontrol";
 34  
 35  XPC_RETURNS_RETAINED xpc_endpoint_t SecServerCreateKeychainControlEndpoint(void)
 36  {
 37      return [[SFKeychainControlManager sharedManager] xpcControlEndpoint];
 38  }
 39  
 40  @implementation SFKeychainControlManager {
 41      NSXPCListener* _listener;
 42  }
 43  
 44  + (instancetype)sharedManager
 45  {
 46      static SFKeychainControlManager* manager = nil;
 47      static dispatch_once_t onceToken;
 48      dispatch_once(&onceToken, ^{
 49          manager = [[SFKeychainControlManager alloc] _init];
 50      });
 51  
 52      return manager;
 53  }
 54  
 55  - (instancetype)_init
 56  {
 57      if (self = [super init]) {
 58          _listener = [NSXPCListener anonymousListener];
 59          _listener.delegate = self;
 60          [_listener resume];
 61      }
 62  
 63      return self;
 64  }
 65  
 66  - (xpc_endpoint_t)xpcControlEndpoint
 67  {
 68      return [_listener.endpoint _endpoint];
 69  }
 70  
 71  - (BOOL)listener:(NSXPCListener*)listener shouldAcceptNewConnection:(NSXPCConnection*)newConnection
 72  {
 73      NSNumber* entitlementValue = [newConnection valueForEntitlement:kSecEntitlementKeychainControl];
 74      if (![entitlementValue isKindOfClass:[NSNumber class]] || !entitlementValue.boolValue) {
 75          secerror("SFKeychainControl: Client pid (%d) doesn't have entitlement: %@", newConnection.processIdentifier, kSecEntitlementKeychainControl);
 76          return NO;
 77      }
 78  
 79      NSSet<Class>* errorClasses = [SecXPCHelper safeErrorClasses];
 80  
 81      NSXPCInterface* interface = [NSXPCInterface interfaceWithProtocol:@protocol(SFKeychainControl)];
 82      [interface setClasses:errorClasses forSelector:@selector(rpcFindCorruptedItemsWithReply:) argumentIndex:1 ofReply:YES];
 83      [interface setClasses:errorClasses forSelector:@selector(rpcDeleteCorruptedItemsWithReply:) argumentIndex:1 ofReply:YES];
 84      newConnection.exportedInterface = interface;
 85      newConnection.exportedObject = self;
 86      [newConnection resume];
 87      return YES;
 88  }
 89  
 90  - (NSArray<NSDictionary*>*)findCorruptedItemsWithError:(NSError**)error
 91  {
 92      NSMutableArray<NSDictionary*>* corruptedItems = [[NSMutableArray alloc] init];
 93      NSMutableArray* underlyingErrors = [[NSMutableArray alloc] init];
 94  
 95      CFTypeRef genericPasswords = NULL;
 96      NSDictionary* genericPasswordsQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 97                                               (id)kSecReturnPersistentRef : @(YES),
 98                                               (id)kSecUseDataProtectionKeychain : @(YES),
 99                                               (id)kSecMatchLimit : (id)kSecMatchLimitAll };
100      OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)genericPasswordsQuery, &genericPasswords);
101      CFErrorRef genericPasswordError = NULL;
102      if (status != errSecItemNotFound) {
103          SecError(status, &genericPasswordError, CFSTR("generic password query failed"));
104          if (genericPasswordError) {
105              [underlyingErrors addObject:CFBridgingRelease(genericPasswordError)];
106          }
107      }
108  
109      CFTypeRef internetPasswords = NULL;
110      NSDictionary* internetPasswordsQuery = @{ (id)kSecClass : (id)kSecClassInternetPassword,
111                                                (id)kSecReturnPersistentRef : @(YES),
112                                                (id)kSecUseDataProtectionKeychain : @(YES),
113                                                (id)kSecMatchLimit : (id)kSecMatchLimitAll };
114      status = SecItemCopyMatching((__bridge CFDictionaryRef)internetPasswordsQuery, &internetPasswords);
115      CFErrorRef internetPasswordError = NULL;
116      if (status != errSecItemNotFound) {
117          SecError(status, &internetPasswordError, CFSTR("internet password query failed"));
118          if (internetPasswordError) {
119              [underlyingErrors addObject:CFBridgingRelease(internetPasswordError)];
120          }
121      }
122  
123      CFTypeRef keys = NULL;
124      NSDictionary* keysQuery = @{ (id)kSecClass : (id)kSecClassKey,
125                                   (id)kSecReturnPersistentRef : @(YES),
126                                   (id)kSecUseDataProtectionKeychain : @(YES),
127                                   (id)kSecMatchLimit : (id)kSecMatchLimitAll };
128      status = SecItemCopyMatching((__bridge CFDictionaryRef)keysQuery, &keys);
129      CFErrorRef keyError = NULL;
130      if (status != errSecItemNotFound) {
131          if (keyError) {
132              [underlyingErrors addObject:CFBridgingRelease(keyError)];
133          }
134      }
135  
136      CFTypeRef certificates = NULL;
137      NSDictionary* certificateQuery = @{ (id)kSecClass : (id)kSecClassCertificate,
138                                          (id)kSecReturnPersistentRef : @(YES),
139                                          (id)kSecUseDataProtectionKeychain : @(YES),
140                                          (id)kSecMatchLimit : (id)kSecMatchLimitAll };
141      status = SecItemCopyMatching((__bridge CFDictionaryRef)certificateQuery, &certificates);
142      CFErrorRef certificateError = NULL;
143      if (status != errSecItemNotFound) {
144          SecError(status, &certificateError, CFSTR("certificate query failed"));
145          if (certificateError) {
146              [underlyingErrors addObject:CFBridgingRelease(certificateError)];
147          }
148      }
149  
150      void (^scanArrayForCorruptedItem)(CFTypeRef, NSString*) = ^(CFTypeRef items, NSString* class) {
151          if ([(__bridge NSArray*)items isKindOfClass:[NSArray class]]) {
152              NSLog(@"scanning %d %@", (int)CFArrayGetCount(items), class);
153              for (NSData* persistentRef in (__bridge NSArray*)items) {
154                  NSDictionary* itemQuery = @{ (id)kSecClass : class,
155                                               (id)kSecValuePersistentRef : persistentRef,
156                                               (id)kSecReturnAttributes : @(YES),
157                                               (id)kSecUseDataProtectionKeychain : @(YES) };
158                  CFTypeRef itemAttributes = NULL;
159                  OSStatus copyStatus = SecItemCopyMatching((__bridge CFDictionaryRef)itemQuery, &itemAttributes);
160                  if (copyStatus != errSecSuccess && status != errSecInteractionNotAllowed) {
161                      [corruptedItems addObject:itemQuery];
162                  }
163              }
164          }
165      };
166  
167      scanArrayForCorruptedItem(genericPasswords, (id)kSecClassGenericPassword);
168      scanArrayForCorruptedItem(internetPasswords, (id)kSecClassInternetPassword);
169      scanArrayForCorruptedItem(keys, (id)kSecClassKey);
170      scanArrayForCorruptedItem(certificates, (id)kSecClassCertificate);
171  
172      if (underlyingErrors.count > 0 && error) {
173          *error = [NSError errorWithDomain:@"com.apple.security.keychainhealth" code:1 userInfo:@{ NSLocalizedDescriptionKey : [NSString stringWithFormat:@"encountered %d errors searching for corrupted items", (int)underlyingErrors.count], NSUnderlyingErrorKey : underlyingErrors.firstObject, @"searchingErrorCount" : @(underlyingErrors.count) }];
174      }
175  
176      return corruptedItems;
177  }
178  
179  - (bool)deleteCorruptedItemsWithError:(NSError**)error
180  {
181      NSError* findError = nil;
182      NSArray* corruptedItems = [self findCorruptedItemsWithError:&findError];
183      bool success = findError == nil;
184  
185      NSMutableArray* deleteErrors = [[NSMutableArray alloc] init];
186      for (NSDictionary* corruptedItem in corruptedItems) {
187          OSStatus status = SecItemDelete((__bridge CFDictionaryRef)corruptedItem);
188          if (status != errSecSuccess) {
189              success = false;
190              CFErrorRef deleteError = NULL;
191              SecError(status, &deleteError, CFSTR("failed to delete corrupted item"));
192              [deleteErrors addObject:CFBridgingRelease(deleteError)];
193          }
194      }
195  
196      if (error && (findError || deleteErrors.count > 0)) {
197          *error = [NSError errorWithDomain:@"com.apple.security.keychainhealth" code:2 userInfo:@{ NSLocalizedDescriptionKey : [NSString stringWithFormat:@"encountered %@ errors searching for corrupted items and %d errors attempting to delete corrupted items", findError.userInfo[@"searchingErrorCount"], (int)deleteErrors.count]}];
198      }
199  
200      return success;
201  }
202  
203  - (void)rpcFindCorruptedItemsWithReply:(void (^)(NSArray* corruptedItems, NSError* error))reply
204  {
205      NSError* error = nil;
206      NSArray* corruptedItems = [self findCorruptedItemsWithError:&error];
207      reply(corruptedItems, error);
208  }
209  
210  - (void)rpcDeleteCorruptedItemsWithReply:(void (^)(bool success, NSError* error))reply
211  {
212      NSError* error = nil;
213      bool success = [self deleteCorruptedItemsWithError:&error];
214      reply(success, error);
215  }
216  
217  @end