1/*
2 * Copyright (c) 2011-2013 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23#ifndef _H_POLICYDB
24#define _H_POLICYDB
25
26#include "SecAssessment.h"
27#include <security_utilities/globalizer.h>
28#include <security_utilities/hashing.h>
29#include <security_utilities/sqlite++.h>
30#include <CoreFoundation/CoreFoundation.h>
31
32namespace Security {
33namespace CodeSigning {
34
35
36namespace SQLite = SQLite3;
37
38
39static const char defaultDatabase[] = "/var/db/SystemPolicy";
40static const char visibleSecurityFlagFile[] = "/var/db/.sp_visible"; /* old duchess/emir style configration */
41static const char prefsFile[] = "/var/db/SystemPolicy-prefs.plist";
42static const char lastRejectFile[] = "/var/db/.LastGKReject";
43static const char lastApprovedFile[] = "/var/db/.LastGKApp";
44static const char rearmTimerFile[] = "/var/db/.GKRearmTimer";
45
46static const char gkeAuthFile[] = "/var/db/gke.auth";
47static const char gkeSigsFile[] = "/var/db/gke.sigs";
48static const unsigned int gkeCheckInterval = 60;	// seconds
49
50
51//
52// We use Julian dates in the database, because SQLite understands them well and they convert easily to/from CFAbsoluteTime
53//
54static const double never = 5000000;	// canonical "never" julian date (an arbitrary point in the year 8977)
55static const double julianBase = 2451910.5;	// julian date of CFAbsoluteTime epoch
56
57static inline double dateToJulian(CFDateRef time)
58{ return CFDateGetAbsoluteTime(time) / 86400.0 + julianBase; }
59
60static inline CFDateRef julianToDate(double julian)
61{ return CFDateCreate(NULL, (julian - julianBase) * 86400); }
62
63
64typedef SHA1::SDigest ObjectHash;
65
66
67typedef uint AuthorityType;
68enum {
69	kAuthorityInvalid = 0,				// not a valid authority type
70	kAuthorityExecute = 1,				// authorizes launch and execution
71	kAuthorityInstall = 2,				// authorizes installation
72	kAuthorityOpenDoc = 3,				// authorizes opening of documents
73};
74
75
76//
77// Defined flags for authority flags column
78//
79enum {
80	kAuthorityFlagVirtual =	0x0001,	// virtual rule (anchoring object records)
81	kAuthorityFlagDefault =	0x0002,	// rule is part of the original default set
82	kAuthorityFlagInhibitCache = 0x0004, // never cache outcome of this rule
83	kAuthorityFlagWhitelist = 0x1000,	// whitelist override
84	kAuthorityFlagWhitelistV2 = 0x2000, // apply "deep" signature to this record
85};
86
87
88//
89// Mapping/translation to/from API space
90//
91AuthorityType typeFor(CFDictionaryRef context, AuthorityType type = kAuthorityInvalid);
92CFStringRef typeNameFor(AuthorityType type)
93    CF_RETURNS_RETAINED;
94
95
96//
97// An open policy database.
98// Usually read-only, but can be opened for write by privileged callers.
99// This is a translucent wrapper around SQLite::Database; the caller
100// is expected to work with statement rows.
101//
102class PolicyDatabase : public SQLite::Database {
103public:
104	PolicyDatabase(const char *path = NULL,	int flags = SQLITE_OPEN_READONLY);
105	virtual ~PolicyDatabase();
106
107public:
108	bool checkCache(CFURLRef path, AuthorityType type, SecAssessmentFlags flags, CFMutableDictionaryRef result);
109
110public:
111	void purgeAuthority();
112	void purgeObjects();
113	void purgeObjects(double priority);//
114
115	void upgradeDatabase();
116	std::string featureLevel(const char *feature);
117	bool hasFeature(const char *feature) { return !featureLevel(feature).empty(); }
118	void addFeature(const char *feature, const char *value, const char *remarks);
119	void simpleFeature(const char *feature, const char *sql);
120	void simpleFeature(const char *feature, void (^perform)());
121
122	void installExplicitSet(const char *auth, const char *sigs);
123
124private:
125	time_t mLastExplicitCheck;
126};
127
128
129//
130// Check the system-wide overriding flag file
131//
132bool overrideAssessment(SecAssessmentFlags flags = 0);
133void setAssessment(bool masterSwitch);
134
135
136//
137// Reset or query the automatic rearm timer
138//
139void resetRearmTimer(const char *event);
140bool queryRearmTimer(CFTimeInterval &delta);
141
142} // end namespace CodeSigning
143} // end namespace Security
144
145#endif //_H_POLICYDB
146