File indexing completed on 2024-04-28 03:52:38

 /*
     SPDX-FileCopyrightText: 2008 Nicola Gigante <nicola.gigante@gmail.com>
     SPDX-FileCopyrightText: 2014, 2016 René Bertin <rjvbertin@gmail.com>
 
     SPDX-License-Identifier: LGPL-2.1-or-later
 */
 
 #include "AuthServicesBackend.h"
 
 #include <qplugin.h>
 
 #include <QDebug>
 #include <QLoggingCategory>
 
 Q_DECLARE_LOGGING_CATEGORY(KAUTH_OSX)
 // logging category for this backend, default: log stuff >= warning
 Q_LOGGING_CATEGORY(KAUTH_OSX, "kf.auth.apple", QtWarningMsg)
 
 namespace KAuth
 {
 static AuthorizationRef s_authRef = NULL;
 
 AuthorizationRef authRef()
 {
     if (!s_authRef) {
         AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &s_authRef);
     }
 
     return s_authRef;
 }
 
 // GetActionRights return codes:
 //     errAuthorizationSuccess                 = 0,
 //     errAuthorizationInvalidSet              = -60001, /* The authorization rights are invalid. */
 //     errAuthorizationInvalidRef              = -60002, /* The authorization reference is invalid. */
 //     errAuthorizationInvalidTag              = -60003, /* The authorization tag is invalid. */
 //     errAuthorizationInvalidPointer          = -60004, /* The returned authorization is invalid. */
 //     errAuthorizationDenied                  = -60005, /* The authorization was denied. */
 //     errAuthorizationCanceled                = -60006, /* The authorization was cancelled by the user. */
 //     errAuthorizationInteractionNotAllowed   = -60007, /* The authorization was denied since no user interaction was possible. */
 //     errAuthorizationInternal                = -60008, /* Unable to obtain authorization for this operation. */
 //     errAuthorizationExternalizeNotAllowed    = -60009, /* The authorization is not allowed to be converted to an external format. */
 //     errAuthorizationInternalizeNotAllowed    = -60010, /* The authorization is not allowed to be created from an external format. */
 //     errAuthorizationInvalidFlags            = -60011, /* The provided option flag(s) are invalid for this authorization operation. */
 //     errAuthorizationToolExecuteFailure      = -60031, /* The specified program could not be executed. */
 //     errAuthorizationToolEnvironmentError    = -60032, /* An invalid status was returned during execution of a privileged tool. */
 //     errAuthorizationBadAddress              = -60033, /* The requested socket address is invalid (must be 0-1023 inclusive). */
 static OSStatus GetActionRights(const QString &action, AuthorizationFlags flags, AuthorizationRef auth)
 {
     AuthorizationItem item;
     item.name = action.toUtf8().constData();
     item.valueLength = 0;
     item.value = NULL;
     item.flags = 0;
 
     AuthorizationRights rights;
     rights.count = 1;
     rights.items = &item;
 
     OSStatus result = AuthorizationCopyRights(auth, &rights, kAuthorizationEmptyEnvironment, flags, NULL);
     return result;
 }
 
 // On OS X we avoid using a helper but grab privilege from here, the client.
 AuthServicesBackend::AuthServicesBackend()
     : AuthBackend()
 {
     setCapabilities(AuthorizeFromClientCapability);
 }
 
 AuthServicesBackend::~AuthServicesBackend()
 {
     if (s_authRef) {
         OSStatus err = AuthorizationFree(s_authRef, kAuthorizationFlagDefaults);
         qCDebug(KAUTH_OSX) << "AuthorizationFree(" << s_authRef << ") returned" << err;
         s_authRef = NULL;
     }
 }
 
 void AuthServicesBackend::setupAction(const QString &)
 {
     // Nothing to do here...
 }
 
 Action::AuthStatus AuthServicesBackend::authorizeAction(const QString &action)
 {
     Action::AuthStatus retval;
     OSStatus result = GetActionRights(action, kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed, authRef());
     qCDebug(KAUTH_OSX) << "AuthServicesBackend::authorizeAction(" << action << ") AuthorizationCopyRights returned" << result;
     switch (result) {
     case errAuthorizationSuccess:
         retval = Action::AuthorizedStatus;
         break;
     case errAuthorizationCanceled:
         retval = Action::UserCancelledStatus;
         break;
     case errAuthorizationInteractionNotAllowed:
     case errAuthorizationDenied:
         retval = Action::DeniedStatus;
         break;
     case errAuthorizationInternal:
         // does this make sense?
         retval = Action::AuthRequiredStatus;
         break;
     case errAuthorizationExternalizeNotAllowed:
     case errAuthorizationInternalizeNotAllowed:
     case errAuthorizationToolExecuteFailure:
     case errAuthorizationToolEnvironmentError:
     case errAuthorizationBadAddress:
         retval = Action::ErrorStatus;
         break;
     default:
         retval = Action::InvalidStatus;
         break;
     }
     return retval;
 }
 
 Action::AuthStatus AuthServicesBackend::actionStatus(const QString &action)
 {
     Action::AuthStatus retval;
     OSStatus result = GetActionRights(action, kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize, authRef());
     qCDebug(KAUTH_OSX) << "AuthServicesBackend::actionStatus(" << action << ") AuthorizationCopyRights returned" << result;
     // this function has a simpler return code parser:
     switch (result) {
     case errAuthorizationSuccess:
         retval = Action::AuthorizedStatus;
         break;
     case errAuthorizationCanceled:
         retval = Action::UserCancelledStatus;
         break;
     case errAuthorizationInteractionNotAllowed:
         retval = Action::AuthRequiredStatus;
         break;
     default:
         retval = Action::DeniedStatus;
         break;
     }
     return retval;
 }
 
 QByteArray AuthServicesBackend::callerID() const
 {
     AuthorizationExternalForm ext;
     AuthorizationMakeExternalForm(authRef(), &ext);
     QByteArray id((const char *)&ext, sizeof(ext));
 
     return id;
 }
 
 bool AuthServicesBackend::isCallerAuthorized(const QString &action, const QByteArray &callerID, const QVariantMap &details)
 {
     Q_UNUSED(details);
 
     AuthorizationExternalForm ext;
     memcpy(&ext, callerID.data(), sizeof(ext));
 
     AuthorizationRef auth;
 
     if (AuthorizationCreateFromExternalForm(&ext, &auth) != noErr) {
         qCWarning(KAUTH_OSX()) << "AuthorizationCreateFromExternalForm(" << action << "," << callerID.constData() << ") failed";
         return false;
     }
 
     OSStatus result = GetActionRights(action, kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed, auth);
 
     AuthorizationFree(auth, kAuthorizationFlagDefaults);
     qCDebug(KAUTH_OSX) << "AuthServicesBackend::isCallerAuthorized(" << action << "," << callerID.constData() << ") AuthorizationCopyRights returned" << result;
 
     return result == errAuthorizationSuccess;
 }
 
 }; // namespace KAuth
 
 #include "moc_AuthServicesBackend.cpp"