1-- 2-- Copyright (c) 2011-2012 Apple Inc. All Rights Reserved. 3-- 4-- @APPLE_LICENSE_HEADER_START@ 5-- 6-- This file contains Original Code and/or Modifications of Original Code 7-- as defined in and that are subject to the Apple Public Source License 8-- Version 2.0 (the 'License'). You may not use this file except in 9-- compliance with the License. Please obtain a copy of the License at 10-- http://www.opensource.apple.com/apsl/ and read it before using this 11-- file. 12-- 13-- The Original Code and all software distributed under the License are 14-- distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15-- EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16-- INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17-- FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18-- Please see the License for the specific language governing rights and 19-- limitations under the License. 20-- 21-- @APPLE_LICENSE_HEADER_END@ 22-- 23-- 24-- System Policy master database - file format and initial contents 25-- 26-- This is currently for sqlite3 27-- 28-- NOTES: 29-- Dates are uniformly in julian form. We use 5000000 as the canonical "never" expiration 30-- value; that's a day in the year 8977. 31-- 32PRAGMA user_version = 1; 33PRAGMA foreign_keys = true; 34PRAGMA legacy_file_format = false; 35PRAGMA recursive_triggers = true; 36 37 38-- 39-- The feature table hold configuration features and options 40-- 41CREATE TABLE feature ( 42 id INTEGER PRIMARY KEY, -- canononical 43 name TEXT NOT NULL UNIQUE, -- name of option 44 value TEXT NULL, -- value of option, if any 45 remarks TEXT NULL -- optional remarks string 46); 47 48 49-- 50-- The primary authority. This table is conceptually scanned 51-- in priority order, with the highest-priority matching enabled record 52-- determining the outcome. 53-- 54CREATE TABLE authority ( 55 id INTEGER PRIMARY KEY AUTOINCREMENT, -- canonical 56 version INTEGER NOT NULL DEFAULT (1) -- semantic version of this rule 57 CHECK (version > 0), 58 type INTEGER NOT NULL, -- operation type 59 requirement TEXT NULL -- code requirement 60 CHECK ((requirement IS NULL) = ((flags & 1) != 0)), 61 allow INTEGER NOT NULL DEFAULT (1) -- allow (1) or deny (0) 62 CHECK (allow = 0 OR allow = 1), 63 disabled INTEGER NOT NULL DEFAULT (0) -- disable count (stacks; enabled if zero) 64 CHECK (disabled >= 0), 65 expires FLOAT NOT NULL DEFAULT (5000000), -- expiration of rule authority (Julian date) 66 priority REAL NOT NULL DEFAULT (0), -- rule priority (full float) 67 label TEXT NULL, -- text label for authority rule 68 filter_unsigned TEXT NULL, -- prescreen for handling unsigned code 69 flags INTEGER NOT NULL DEFAULT (0), -- amalgamated binary flags 70 -- following fields are for documentation only 71 ctime FLOAT NOT NULL DEFAULT (JULIANDAY('now')), -- rule creation time (Julian) 72 mtime FLOAT NOT NULL DEFAULT (JULIANDAY('now')), -- time rule was last changed (Julian) 73 user TEXT NULL, -- user requesting this rule (NULL if unknown) 74 remarks TEXT NULL -- optional remarks string 75); 76 77-- index 78CREATE INDEX authority_type ON authority (type); 79CREATE INDEX authority_priority ON authority (priority); 80CREATE INDEX authority_expires ON authority (expires); 81 82-- update mtime if a record is changed 83CREATE TRIGGER authority_update AFTER UPDATE ON authority 84BEGIN 85 UPDATE authority SET mtime = JULIANDAY('now') WHERE id = old.id; 86END; 87 88-- rules that are actively considered 89CREATE VIEW active_authority AS 90SELECT * from authority 91WHERE disabled = 0 AND JULIANDAY('now') < expires AND (flags & 1) = 0; 92 93-- rules subject to priority scan: active_authority but including disabled rules 94CREATE VIEW scan_authority AS 95SELECT * from authority 96WHERE JULIANDAY('now') < expires AND (flags & 1) = 0; 97 98 99-- 100-- A table to carry (potentially large-ish) filesystem data stored as a bookmark blob. 101-- 102CREATE TABLE bookmarkhints ( 103 id INTEGER PRIMARY KEY AUTOINCREMENT, 104 bookmark BLOB NOT NULL, 105 authority INTEGER NOT NULL 106 REFERENCES authority(id) ON DELETE CASCADE 107); 108 109 110-- 111-- Upgradable features already contained in this baseline. 112-- See policydatabase.cpp for upgrade code. 113-- 114INSERT INTO feature (name, value, remarks) 115 VALUES ('bookmarkhints', 'present', 'builtin'); 116INSERT INTO feature (name, value, remarks) 117 VALUES ('codesignedpackages', 'present', 'builtin'); 118INSERT INTO feature (name, value, remarks) 119 VALUES ('filter_unsigned', 'present', 'builtin'); 120 121 122-- 123-- Initial canonical contents of a fresh database 124-- 125 126-- virtual rule anchoring negative cache entries (no rule found) 127insert into authority (type, allow, priority, flags, label) 128 values (1, 0, -1.0E100, 1, 'No Matching Rule'); 129 130-- any "genuine Apple-signed" installers 131insert into authority (type, allow, priority, flags, label, requirement) 132 values (2, 1, -1, 2, 'Apple Installer', 'anchor apple generic and certificate 1[subject.CN] = "Apple Software Update Certification Authority"'); 133 134-- Apple code signing 135insert into authority (type, allow, flags, label, requirement) 136 values (1, 1, 2, 'Apple System', 'anchor apple'); 137 138-- Mac App Store code signing 139insert into authority (type, allow, flags, label, requirement) 140 values (1, 1, 2, 'Mac App Store', 'anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] exists'); 141 142-- Mac App Store installer signing 143insert into authority (type, allow, flags, label, requirement) 144 values (2, 1, 2, 'Mac App Store', 'anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.10] exists'); 145 146-- Caspian code and archive signing 147insert into authority (type, allow, flags, label, requirement) 148 values (1, 1, 2, 'Developer ID', 'anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists'); 149insert into authority (type, allow, flags, label, requirement) 150 values (2, 1, 2, 'Developer ID', 'anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and (certificate leaf[field.1.2.840.113635.100.6.1.14] or certificate leaf[field.1.2.840.113635.100.6.1.13])'); 151 152 153-- 154-- The cache table lists previously determined outcomes 155-- for individual objects (by object hash). Entries come from 156-- full evaluations of authority records, or by explicitly inserting 157-- override rules that preempt the normal authority. 158-- EACH object record must have a parent authority record from which it is derived; 159-- this may be a normal authority rule or an override rule. If the parent rule is deleted, 160-- all objects created from it are automatically removed (by sqlite itself). 161-- 162CREATE TABLE object ( 163 id INTEGER PRIMARY KEY, -- canonical 164 type INTEGER NOT NULL, -- operation type 165 hash CDHASH NOT NULL, -- canonical hash of object 166 allow INTEGER NOT NULL, -- allow (1) or deny (0) 167 expires FLOAT NOT NULL DEFAULT (5000000), -- expiration of object entry 168 authority INTEGER NOT NULL -- governing authority rule 169 REFERENCES authority(id) ON DELETE CASCADE, 170 -- following fields are for documentation only 171 path TEXT NULL, -- path of object at record creation time 172 ctime FLOAT NOT NULL DEFAULT (JULIANDAY('now')), -- record creation time 173 mtime FLOAT NOT NULL DEFAULT (JULIANDAY('now')), -- record modification time 174 remarks TEXT NULL -- optional remarks string 175); 176 177-- index 178CREATE INDEX object_type ON object (type); 179CREATE INDEX object_expires ON object (expires); 180CREATE UNIQUE INDEX object_hash ON object (hash); 181 182-- update mtime if a record is changed 183CREATE TRIGGER object_update AFTER UPDATE ON object 184BEGIN 185 UPDATE object SET mtime = JULIANDAY('now') WHERE id = old.id; 186END; 187 188 189-- 190-- Some useful views on objects. These are for administration; they are not used by the assessor. 191-- 192CREATE VIEW object_state AS 193SELECT object.id, object.type, object.allow, 194 CASE object.expires WHEN 5000000 THEN NULL ELSE STRFTIME('%Y-%m-%d %H:%M:%f', object.expires, 'localtime') END AS expiration, 195 (object.expires - JULIANDAY('now')) * 86400 as remaining, 196 authority.label, 197 object.authority, 198 object.path, 199 object.ctime, 200 authority.requirement, 201 authority.disabled, 202 object.remarks 203FROM object, authority 204WHERE object.authority = authority.id; 205