acl_codesigning.cpp [plain text]
#include <security_cdsa_utilities/acl_codesigning.h>
#include <security_cdsa_utilities/cssmdata.h>
#include <security_utilities/endian.h>
#include <algorithm>
bool CodeSignatureAclSubject::validate(const AclValidationContext &context) const
{
if (Environment *env = context.environment<Environment>())
return env->verifyCodeSignature(*this, context);
else
return false;
}
CssmList CodeSignatureAclSubject::toList(Allocator &alloc) const
{
assert(path().find('\0') == string::npos); uint32_t type = CSSM_ACL_CODE_SIGNATURE_OSX;
TypedList list(alloc, CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE,
new(alloc) ListElement(type),
new(alloc) ListElement(alloc, CssmData::wrap(legacyHash(), SHA1::digestLength)),
new(alloc) ListElement(alloc, CssmData::wrap(path().c_str(), path().size() + 1)));
if (requirement()) {
CFRef<CFDataRef> reqData;
MacOSError::check(SecRequirementCopyData(requirement(), kSecCSDefaultFlags, &reqData.aref()));
list += new(alloc) ListElement(alloc,
CssmData::wrap(CFDataGetBytePtr(reqData), CFDataGetLength(reqData)));
}
for (AuxMap::const_iterator it = beginAux(); it != endAux(); it++)
list += new(alloc) ListElement(alloc, CssmData(*it->second));
return list;
}
CodeSignatureAclSubject *CodeSignatureAclSubject::Maker::make(const TypedList &list) const
{
unsigned total = list.length(); if (total >= 3 + 1
&& list[1].is(CSSM_LIST_ELEMENT_WORDID) && list[1] == CSSM_ACL_CODE_SIGNATURE_OSX
&& list[2].is(CSSM_LIST_ELEMENT_DATUM) && list[2].data().length() == SHA1::digestLength
&& list[3].is(CSSM_LIST_ELEMENT_DATUM)) {
CodeSignatureAclSubject *subj =
new CodeSignatureAclSubject(list[2].data().interpretedAs<const SHA1::Byte>(),
list[3].data().interpretedAs<const char>());
for (unsigned n = 3 + 1; n < total; n++) {
if (list[n].is(CSSM_LIST_ELEMENT_DATUM)) {
const BlobCore *blob = list[n].data().interpretedAs<const BlobCore>();
if (blob->length() < sizeof(BlobCore)) {
secdebug("csblob", "runt blob (0x%x/%zd) slot %d in CSSM_LIST",
blob->magic(), blob->length(), n);
CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
} else if (blob->length() != list[n].data().length()) {
secdebug("csblob", "badly sized blob (0x%x/%zd) slot %d in CSSM_LIST",
blob->magic(), blob->length(), n);
CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
}
subj->add(blob);
} else
CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
}
return subj;
} else
CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
}
CodeSignatureAclSubject *CodeSignatureAclSubject::Maker::make(Version version,
Reader &pub, Reader &priv) const
{
assert(version == 0);
Endian<uint32> sigType; pub(sigType);
const void *data; size_t length; pub.countedData(data, length);
const void *commentData; size_t commentLength; pub.countedData(commentData, commentLength);
if (sigType == CSSM_ACL_CODE_SIGNATURE_OSX
&& length == SHA1::digestLength) {
return make((const SHA1::Byte *)data, CssmData::wrap(commentData, commentLength));
}
CssmError::throwMe(CSSM_ERRCODE_INVALID_ACL_SUBJECT_VALUE);
}
CodeSignatureAclSubject *CodeSignatureAclSubject::Maker::make(const SHA1::Byte *hash,
const CssmData &commentBag) const
{
using namespace LowLevelMemoryUtilities;
const char *path = commentBag.interpretedAs<const char>();
CodeSignatureAclSubject *subj = new CodeSignatureAclSubject(hash, path);
for (const BlobCore *blob = increment<BlobCore>(commentBag.data(), alignUp(strlen(path) + 1, commentBagAlignment));
blob < commentBag.end();
blob = increment<const BlobCore>(blob, alignUp(blob->length(), commentBagAlignment))) {
size_t leftInBag = difference(commentBag.end(), blob);
if (leftInBag < sizeof(BlobCore) || blob->length() < sizeof(BlobCore) || blob->length() > leftInBag) {
secdebug("csblob", "invalid blob (0x%x/%zd) [%zd in bag] in code signing ACL for %s - stopping scan",
blob->magic(), blob->length(), leftInBag, subj->path().c_str());
break; }
subj->add(blob);
}
return subj;
}
void CodeSignatureAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &priv)
{
using LowLevelMemoryUtilities::alignUp;
assert(path().find('\0') == string::npos); Endian<uint32> sigType = CSSM_ACL_CODE_SIGNATURE_OSX; pub(sigType);
pub.countedData(legacyHash(), SHA1::digestLength);
size_t size = path().size() + 1;
if (requirement()) {
CFRef<CFDataRef> reqData;
MacOSError::check(SecRequirementCopyData(requirement(), kSecCSDefaultFlags, &reqData.aref()));
size = alignUp(size, commentBagAlignment) + CFDataGetLength(reqData);
}
for (AuxMap::const_iterator it = beginAux(); it != endAux(); it++) {
size = alignUp(size, commentBagAlignment) + it->second->length();
}
pub.countedData(NULL, size);
}
void CodeSignatureAclSubject::exportBlob(Writer &pub, Writer &priv)
{
using LowLevelMemoryUtilities::alignUp;
Endian<uint32> sigType = CSSM_ACL_CODE_SIGNATURE_OSX; pub(sigType);
pub.countedData(legacyHash(), SHA1::digestLength);
CssmAutoData commentBag(Allocator::standard(), path().c_str(), path().size() + 1);
static const uint32_t zero = 0;
if (requirement()) {
CFRef<CFDataRef> reqData;
MacOSError::check(SecRequirementCopyData(requirement(), kSecCSDefaultFlags, &reqData.aref()));
commentBag.append(&zero,
alignUp(commentBag.length(), commentBagAlignment) - commentBag.length());
commentBag.append(CFDataGetBytePtr(reqData), CFDataGetLength(reqData));
}
for (AuxMap::const_iterator it = beginAux(); it != endAux(); it++) {
commentBag.append(&zero,
alignUp(commentBag.length(), commentBagAlignment) - commentBag.length());
commentBag.append(CssmData(*it->second));
}
pub.countedData(commentBag);
}
#ifdef DEBUGDUMP
void CodeSignatureAclSubject::debugDump() const
{
Debug::dump("CodeSigning ");
OSXVerifier::dump();
}
#endif //DEBUGDUMP