#include "authority.h"
#include "server.h"
#include "connection.h"
#include "session.h"
#include "process.h"
AuthorizationToken::AuthMap AuthorizationToken::authMap; Mutex AuthorizationToken::authMapLock;
Authority::Authority(const char *configFile)
: Authorization::Engine(configFile)
{
}
Authority::~Authority()
{
}
AuthorizationToken::AuthorizationToken(Session &ssn, const CredentialSet &base)
: session(ssn), mBaseCreds(base), mTransferCount(INT_MAX),
mCreatorUid(Server::connection().process.uid())
{
Server::active().random(mHandle);
StLock<Mutex> _(authMapLock);
authMap[mHandle] = this;
session.addAuthorization(this);
debug("SSauth", "Authorization %p created using %d credentials",
this, int(mBaseCreds.size()));
}
AuthorizationToken::~AuthorizationToken()
{
assert(mUsingProcesses.empty());
if (session.removeAuthorization(this))
delete &session;
debug("SSauth", "Authorization %p destroyed", this);
}
AuthorizationToken &AuthorizationToken::find(const AuthorizationBlob &blob)
{
StLock<Mutex> _(authMapLock);
AuthMap::iterator it = authMap.find(blob);
if (it == authMap.end())
Authorization::Error::throwMe(errAuthorizationInvalidRef);
return *it->second;
}
AuthorizationToken::Deleter::Deleter(const AuthorizationBlob &blob)
: lock(authMapLock)
{
AuthMap::iterator it = authMap.find(blob);
if (it == authMap.end())
Authorization::Error::throwMe(errAuthorizationInvalidRef);
mAuth = it->second;
}
void AuthorizationToken::Deleter::remove()
{
if (mAuth) {
authMap.erase(mAuth->handle());
delete mAuth;
mAuth = NULL;
}
}
CredentialSet AuthorizationToken::effectiveCreds() const
{
CredentialSet result = session.authCredentials();
for (CredentialSet::const_iterator it = mBaseCreds.begin(); it != mBaseCreds.end(); it++)
if (!(*it)->isShared())
result.insert(*it);
return result;
}
void AuthorizationToken::mergeCredentials(const CredentialSet &add)
{
for (CredentialSet::const_iterator it = add.begin(); it != add.end(); it++) {
mBaseCreds.erase(*it);
mBaseCreds.insert(*it);
}
debug("SSauth", "Authorization %p merged %d new credentials for %d total",
this, int(add.size()), int(mBaseCreds.size()));
}
void AuthorizationToken::addProcess(Process &proc)
{
StLock<Mutex> _(mLock);
mUsingProcesses.insert(&proc);
debug("SSauth", "Authorization %p added process %p(%d)", this, &proc, proc.pid());
}
bool AuthorizationToken::endProcess(Process &proc)
{
StLock<Mutex> _(mLock);
assert(mUsingProcesses.find(&proc) != mUsingProcesses.end());
mUsingProcesses.erase(&proc);
IFDEBUG(debug("SSauth", "Authorization %p removed process %p(%d)%s",
this, &proc, proc.pid(), mUsingProcesses.empty() ? " FINAL" : ""));
return mUsingProcesses.empty();
}
bool AuthorizationToken::mayExternalize(Process &) const
{
return mTransferCount > 0;
}
bool AuthorizationToken::mayInternalize(Process &, bool countIt)
{
StLock<Mutex> _(mLock);
if (mTransferCount > 0) {
if (countIt) {
mTransferCount--;
debug("SSauth", "Authorization %p decrement intcount to %d", this, mTransferCount);
}
return true;
}
return false;
}
uid_t
AuthorizationToken::creatorUid() const
{
return mCreatorUid;
}
OSStatus Authority::authorize(const RightSet &inRights,
const AuthorizationEnvironment *environment,
AuthorizationFlags flags, const CredentialSet *inCredentials, CredentialSet *outCredentials,
MutableRightSet *outRights, const AuthorizationToken &auth)
{
StLock<Mutex> _(mLock);
return Authorization::Engine::authorize(inRights, environment,
flags, inCredentials, outCredentials, outRights, auth);
}