mirror of
https://github.com/Karmaz95/Snake_Apple.git
synced 2026-05-21 17:06:46 +02:00
This commit is contained in:
Karmaz95
@@ -0,0 +1,399 @@
|
||||
// Extracted from Xcode 15 Beta 7
|
||||
// /Library/Developer/CommandLineTools/SDKs/MacOSX14.0.sdk/System/Library/Frameworks/Security.framework/Versions/A/Headers/CSCommon.h */
|
||||
/*
|
||||
* Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
|
||||
* @APPLE_LICENSE_HEADER_START@
|
||||
*
|
||||
* This file contains Original Code and/or Modifications of Original Code
|
||||
* as defined in and that are subject to the Apple Public Source License
|
||||
* Version 2.0 (the 'License'). You may not use this file except in
|
||||
* compliance with the License. Please obtain a copy of the License at
|
||||
* http://www.opensource.apple.com/apsl/ and read it before using this
|
||||
* file.
|
||||
*
|
||||
* The Original Code and all software distributed under the License are
|
||||
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
|
||||
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
|
||||
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
|
||||
* Please see the License for the specific language governing rights and
|
||||
* limitations under the License.
|
||||
*
|
||||
* @APPLE_LICENSE_HEADER_END@
|
||||
*/
|
||||
/*!
|
||||
@header CSCommon
|
||||
CSCommon is the common header of all Code Signing API headers.
|
||||
It defines types, constants, and error codes.
|
||||
*/
|
||||
#ifndef _H_CSCOMMON
|
||||
#define _H_CSCOMMON
|
||||
|
||||
#include <CoreFoundation/CoreFoundation.h>
|
||||
#include <TargetConditionals.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
/*
|
||||
* Some macOS API's use the old style defined name CSSM_DATA and CSSM_OID.
|
||||
* These are just typedefs for SecAsn* which are available for iOS. We complete
|
||||
* those here in case they're not available for compatibility.
|
||||
*/
|
||||
#if TARGET_OS_IPHONE
|
||||
|
||||
#ifndef CSSM_DATA
|
||||
#define CSSM_DATA SecAsn1Item
|
||||
#endif
|
||||
|
||||
#ifndef CSSM_OID
|
||||
#define CSSM_OID SecAsn1Oid
|
||||
#endif
|
||||
|
||||
#endif /* TARGET_OS_IPHONE */
|
||||
|
||||
CF_ASSUME_NONNULL_BEGIN
|
||||
|
||||
/*
|
||||
Code Signing specific OSStatus codes.
|
||||
[Assigned range 0xFFFE_FAxx].
|
||||
*/
|
||||
CF_ENUM(OSStatus) {
|
||||
errSecCSUnimplemented = -67072, /* unimplemented code signing feature */
|
||||
errSecCSInvalidObjectRef = -67071, /* invalid API object reference */
|
||||
errSecCSInvalidFlags = -67070, /* invalid or inappropriate API flag(s) specified */
|
||||
errSecCSObjectRequired = -67069, /* a required pointer argument was NULL */
|
||||
errSecCSStaticCodeNotFound = -67068, /* cannot find code object on disk */
|
||||
errSecCSUnsupportedGuestAttributes = -67067, /* cannot locate guests using this attribute set */
|
||||
errSecCSInvalidAttributeValues = -67066, /* given attribute values are invalid */
|
||||
errSecCSNoSuchCode = -67065, /* host has no guest with the requested attributes */
|
||||
errSecCSMultipleGuests = -67064, /* ambiguous guest specification (host has multiple guests with these attribute values) */
|
||||
errSecCSGuestInvalid = -67063, /* code identity has been invalidated */
|
||||
errSecCSUnsigned = -67062, /* code object is not signed at all */
|
||||
errSecCSSignatureFailed = -67061, /* invalid signature (code or signature have been modified) */
|
||||
errSecCSSignatureNotVerifiable = -67060, /* the code cannot be read by the verifier (file system permissions etc.) */
|
||||
errSecCSSignatureUnsupported = -67059, /* unsupported type or version of signature */
|
||||
errSecCSBadDictionaryFormat = -67058, /* a required plist file or resource is malformed */
|
||||
errSecCSResourcesNotSealed = -67057, /* resources are present but not sealed by signature */
|
||||
errSecCSResourcesNotFound = -67056, /* code has no resources but signature indicates they must be present */
|
||||
errSecCSResourcesInvalid = -67055, /* the sealed resource directory is invalid */
|
||||
errSecCSBadResource = -67054, /* a sealed resource is missing or invalid */
|
||||
errSecCSResourceRulesInvalid = -67053, /* invalid resource specification rule(s) */
|
||||
errSecCSReqInvalid = -67052, /* invalid or corrupted code requirement(s) */
|
||||
errSecCSReqUnsupported = -67051, /* unsupported type or version of code requirement(s) */
|
||||
errSecCSReqFailed = -67050, /* code failed to satisfy specified code requirement(s) */
|
||||
errSecCSBadObjectFormat = -67049, /* object file format unrecognized, invalid, or unsuitable */
|
||||
errSecCSInternalError = -67048, /* internal error in Code Signing subsystem */
|
||||
errSecCSHostReject = -67047, /* code rejected its host */
|
||||
errSecCSNotAHost = -67046, /* attempt to specify guest of code that is not a host */
|
||||
errSecCSSignatureInvalid = -67045, /* invalid or unsupported format for signature */
|
||||
errSecCSHostProtocolRelativePath = -67044, /* host protocol violation - absolute guest path required */
|
||||
errSecCSHostProtocolContradiction = -67043, /* host protocol violation - contradictory hosting modes */
|
||||
errSecCSHostProtocolDedicationError = -67042, /* host protocol violation - operation not allowed with/for a dedicated guest */
|
||||
errSecCSHostProtocolNotProxy = -67041, /* host protocol violation - proxy hosting not engaged */
|
||||
errSecCSHostProtocolStateError = -67040, /* host protocol violation - invalid guest state change request */
|
||||
errSecCSHostProtocolUnrelated = -67039, /* host protocol violation - the given guest is not a guest of the given host */
|
||||
/* -67038 obsolete (no longer issued) */
|
||||
errSecCSNotSupported = -67037, /* operation inapplicable or not supported for this type of code */
|
||||
errSecCSCMSTooLarge = -67036, /* signature too large to embed (size limitation of on-disk representation) */
|
||||
errSecCSHostProtocolInvalidHash = -67035, /* host protocol violation - invalid guest hash */
|
||||
errSecCSStaticCodeChanged = -67034, /* the code on disk does not match what is running */
|
||||
errSecCSDBDenied = -67033, /* permission to use a database denied */
|
||||
errSecCSDBAccess = -67032, /* cannot access a database */
|
||||
errSecCSSigDBDenied = -67033, /* permission to use a database denied */
|
||||
errSecCSSigDBAccess = -67032, /* cannot access a database */
|
||||
errSecCSHostProtocolInvalidAttribute = -67031, /* host returned invalid or inconsistent guest attributes */
|
||||
errSecCSInfoPlistFailed = -67030, /* invalid Info.plist (plist or signature have been modified) */
|
||||
errSecCSNoMainExecutable = -67029, /* the code has no main executable file */
|
||||
errSecCSBadBundleFormat = -67028, /* bundle format unrecognized, invalid, or unsuitable */
|
||||
errSecCSNoMatches = -67027, /* no matches for search or update operation */
|
||||
errSecCSFileHardQuarantined = -67026, /* File created by an AppSandbox, exec/open not allowed */
|
||||
errSecCSOutdated = -67025, /* presented data is out of date */
|
||||
errSecCSDbCorrupt = -67024, /* a system database or file is corrupt */
|
||||
errSecCSResourceDirectoryFailed = -67023, /* invalid resource directory (directory or signature have been modified) */
|
||||
errSecCSUnsignedNestedCode = -67022, /* nested code is unsigned */
|
||||
errSecCSBadNestedCode = -67021, /* nested code is modified or invalid */
|
||||
errSecCSBadCallbackValue = -67020, /* monitor callback returned invalid value */
|
||||
errSecCSHelperFailed = -67019, /* the codesign_allocate helper tool cannot be found or used */
|
||||
errSecCSVetoed = -67018,
|
||||
errSecCSBadLVArch = -67017, /* library validation flag cannot be used with an i386 binary */
|
||||
errSecCSResourceNotSupported = -67016, /* unsupported resource found (something not a directory, file or symlink) */
|
||||
errSecCSRegularFile = -67015, /* the main executable or Info.plist must be a regular file (no symlinks, etc.) */
|
||||
errSecCSUnsealedAppRoot = -67014, /* unsealed contents present in the bundle root */
|
||||
errSecCSWeakResourceRules = -67013, /* resource envelope is obsolete (custom omit rules) */
|
||||
errSecCSDSStoreSymlink = -67012, /* .DS_Store files cannot be a symlink */
|
||||
errSecCSAmbiguousBundleFormat = -67011, /* bundle format is ambiguous (could be app or framework) */
|
||||
errSecCSBadMainExecutable = -67010, /* main executable failed strict validation */
|
||||
errSecCSBadFrameworkVersion = -67009, /* embedded framework contains modified or invalid version */
|
||||
errSecCSUnsealedFrameworkRoot = -67008, /* unsealed contents present in the root directory of an embedded framework */
|
||||
errSecCSWeakResourceEnvelope = -67007, /* resource envelope is obsolete (version 1 signature) */
|
||||
errSecCSCancelled = -67006, /* operation was terminated by explicit cancelation */
|
||||
errSecCSInvalidPlatform = -67005, /* invalid platform identifier or platform mismatch */
|
||||
errSecCSTooBig = -67004, /* code is too big for current signing format */
|
||||
errSecCSInvalidSymlink = -67003, /* invalid destination for symbolic link in bundle */
|
||||
errSecCSNotAppLike = -67002, /* the code is valid but does not seem to be an app */
|
||||
errSecCSBadDiskImageFormat = -67001, /* disk image format unrecognized, invalid, or unsuitable */
|
||||
errSecCSUnsupportedDigestAlgorithm = -67000, /* a requested signature digest algorithm is not supported */
|
||||
errSecCSInvalidAssociatedFileData = -66999, /* resource fork, Finder information, or similar detritus not allowed */
|
||||
errSecCSInvalidTeamIdentifier = -66998, /* a Team Identifier string is invalid */
|
||||
errSecCSBadTeamIdentifier = -66997, /* a Team Identifier is wrong or inappropriate */
|
||||
errSecCSSignatureUntrusted = -66996, /* signature is valid but signer is not trusted */
|
||||
errSecMultipleExecSegments = -66995, /* the image contains multiple executable segments */
|
||||
errSecCSInvalidEntitlements = -66994, /* invalid entitlement plist */
|
||||
errSecCSInvalidRuntimeVersion = -66993, /* an invalid runtime version was explicitly set */
|
||||
errSecCSRevokedNotarization = -66992, /* notarization indicates this code has been revoked */
|
||||
errSecCSCMSConstructionFailed = -66991, /* CMS construction failed, see logs for deeper error */
|
||||
errSecCSRemoteSignerFailed = -66990, /* remote signing block did not return a signature */
|
||||
};
|
||||
|
||||
/*
|
||||
* Code Signing specific CFError "user info" keys.
|
||||
* In calls that can return CFErrorRef indications, if a CFErrorRef is actually
|
||||
* returned, its "user info" dictionary may contain some of the following keys
|
||||
* to more closely describe the circumstances of the failure.
|
||||
* Do not rely on the presence of any particular key to categorize a problem;
|
||||
* always use the primary OSStatus return for that. The data contained under
|
||||
* these keys is always supplemental and optional.
|
||||
*/
|
||||
extern const CFStringRef kSecCFErrorArchitecture; /* CFStringRef: name of architecture causing the problem */
|
||||
extern const CFStringRef kSecCFErrorPattern; /* CFStringRef: invalid resource selection pattern encountered */
|
||||
extern const CFStringRef kSecCFErrorResourceSeal; /* CFTypeRef: invalid component in resource seal (CodeResources) */
|
||||
extern const CFStringRef kSecCFErrorResourceAdded; /* CFURLRef: unsealed resource found */
|
||||
extern const CFStringRef kSecCFErrorResourceAltered; /* CFURLRef: modified resource found */
|
||||
extern const CFStringRef kSecCFErrorResourceMissing; /* CFURLRef: sealed (non-optional) resource missing */
|
||||
extern const CFStringRef kSecCFErrorResourceSideband; /* CFURLRef: sealed resource has invalid sideband data (resource fork, etc.) */
|
||||
extern const CFStringRef kSecCFErrorResourceRecursive; /* CFURLRef: resource is main executable, resulting in infinite recursion */
|
||||
extern const CFStringRef kSecCFErrorInfoPlist; /* CFTypeRef: Info.plist dictionary or component thereof found invalid */
|
||||
extern const CFStringRef kSecCFErrorGuestAttributes; /* CFTypeRef: Guest attribute set of element not accepted */
|
||||
extern const CFStringRef kSecCFErrorRequirementSyntax; /* CFStringRef: compilation error for Requirement source */
|
||||
extern const CFStringRef kSecCFErrorPath; /* CFURLRef: subcomponent containing the error */
|
||||
|
||||
/*!
|
||||
@typedef SecCodeRef
|
||||
This is the type of a reference to running code.
|
||||
|
||||
In many (but not all) calls, this can be passed to a SecStaticCodeRef
|
||||
argument, which performs an implicit SecCodeCopyStaticCode call and
|
||||
operates on the result.
|
||||
*/
|
||||
typedef struct CF_BRIDGED_TYPE(id) __SecCode *SecCodeRef; /* running code */
|
||||
|
||||
/*!
|
||||
@typedef SecStaticCodeRef
|
||||
This is the type of a reference to static code on disk.
|
||||
*/
|
||||
typedef struct CF_BRIDGED_TYPE(id) __SecCode const *SecStaticCodeRef; /* code on disk */
|
||||
|
||||
/*!
|
||||
@typedef SecRequirementRef
|
||||
This is the type of a reference to a code requirement.
|
||||
*/
|
||||
typedef struct CF_BRIDGED_TYPE(id) __SecRequirement *SecRequirementRef; /* code requirement */
|
||||
|
||||
|
||||
/*!
|
||||
@typedef SecGuestRef
|
||||
An abstract handle to identify a particular Guest in the context of its Host.
|
||||
|
||||
Guest handles are assigned by the host at will, with kSecNoGuest (zero) being
|
||||
reserved as the null value. They can be reused for new children if desired.
|
||||
*/
|
||||
typedef u_int32_t SecGuestRef;
|
||||
|
||||
CF_ENUM(SecGuestRef) {
|
||||
kSecNoGuest = 0, /* not a valid SecGuestRef */
|
||||
};
|
||||
|
||||
|
||||
/*!
|
||||
@typedef SecCSFlags
|
||||
This is the type of flags arguments to Code Signing API calls.
|
||||
It provides a bit mask of request and option flags. All of the bits in these
|
||||
masks are reserved to Apple; if you set any bits not defined in these headers,
|
||||
the behavior is generally undefined.
|
||||
|
||||
This list describes the flags that are shared among several Code Signing API calls.
|
||||
Flags that only apply to one call are defined and documented with that call.
|
||||
Global flags are assigned from high order down (31 -> 0); call-specific flags
|
||||
are assigned from the bottom up (0 -> 31).
|
||||
|
||||
@constant kSecCSDefaultFlags
|
||||
When passed to a flags argument throughout, indicates that default behavior
|
||||
is desired. Do not mix with other flags values.
|
||||
@constant kSecCSConsiderExpiration
|
||||
When passed to a call that performs code validation, requests that code signatures
|
||||
made by expired certificates be rejected. By default, expiration of participating
|
||||
certificates is not automatic grounds for rejection.
|
||||
@constant kSecCSNoNetworkAccess
|
||||
When passed to a call that performs code validation, configures the validation to
|
||||
not perform any work that requires the network. Using this flag disables security features
|
||||
like online certificate revocation and notarization checks by removing potentially
|
||||
slow network requests that can delay evaluations. This flag has always been usable for
|
||||
SecStaticCode objects and is usable with SecCode objects starting with macOS 11.3.
|
||||
*/
|
||||
typedef CF_OPTIONS(uint32_t, SecCSFlags) {
|
||||
kSecCSDefaultFlags = 0, /* no particular flags (default behavior) */
|
||||
|
||||
kSecCSConsiderExpiration = 1U << 31, /* consider expired certificates invalid */
|
||||
kSecCSEnforceRevocationChecks = 1 << 30, /* force revocation checks regardless of preference settings */
|
||||
kSecCSNoNetworkAccess = 1 << 29, /* do not use the network, cancels "kSecCSEnforceRevocationChecks" */
|
||||
kSecCSReportProgress = 1 << 28, /* make progress report call-backs when configured */
|
||||
kSecCSCheckTrustedAnchors = 1 << 27, /* build certificate chain to system trust anchors, not to any self-signed certificate */
|
||||
kSecCSQuickCheck = 1 << 26, /* (internal) */
|
||||
kSecCSApplyEmbeddedPolicy = 1 << 25, /* Apply Embedded (iPhone) policy regardless of the platform we're running on */
|
||||
kSecCSStripDisallowedXattrs = 1 << 24, /* Strip disallowed xattrs, such as com.apple.FinderInfo and com.apple.ResourceFork */
|
||||
};
|
||||
|
||||
|
||||
/*!
|
||||
@typedef SecCodeSignatureFlags
|
||||
This is the type of option flags that can be embedded in a code signature
|
||||
during signing, and that govern the use of the signature thereafter.
|
||||
Some of these flags can be set through the codesign(1) command's --options
|
||||
argument; some are set implicitly based on signing circumstances; and all
|
||||
can be set with the kSecCodeSignerFlags item of a signing information dictionary.
|
||||
|
||||
@constant kSecCodeSignatureHost
|
||||
Indicates that the code may act as a host that controls and supervises guest
|
||||
code. If this flag is not set in a code signature, the code is never considered
|
||||
eligible to be a host, and any attempt to act like one will be ignored or rejected.
|
||||
@constant kSecCodeSignatureAdhoc
|
||||
The code has been sealed without a signing identity. No identity may be retrieved
|
||||
from it, and any code requirement placing restrictions on the signing identity
|
||||
will fail. This flag is set by the code signing API and cannot be set explicitly.
|
||||
@constant kSecCodeSignatureForceHard
|
||||
Implicitly set the "hard" status bit for the code when it starts running.
|
||||
This bit indicates that the code prefers to be denied access to a resource
|
||||
if gaining such access would cause its invalidation. Since the hard bit is
|
||||
sticky, setting this option bit guarantees that the code will always have
|
||||
it set.
|
||||
@constant kSecCodeSignatureForceKill
|
||||
Implicitly set the "kill" status bit for the code when it starts running.
|
||||
This bit indicates that the code wishes to be terminated with prejudice if
|
||||
it is ever invalidated. Since the kill bit is sticky, setting this option bit
|
||||
guarantees that the code will always be dynamically valid, since it will die
|
||||
immediately if it becomes invalid.
|
||||
@constant kSecCodeSignatureForceExpiration
|
||||
Forces the kSecCSConsiderExpiration flag on all validations of the code.
|
||||
@constant kSecCodeSignatureRuntime
|
||||
Instructs the kernel to apply runtime hardening policies as required by the
|
||||
hardened runtime version
|
||||
@constant kSecCodeSignatureLinkerSigned
|
||||
The code was automatically signed by the linker. This signature should be
|
||||
ignored in any new signing operation.
|
||||
*/
|
||||
typedef CF_OPTIONS(uint32_t, SecCodeSignatureFlags) {
|
||||
kSecCodeSignatureHost = 0x0001, /* may host guest code */
|
||||
kSecCodeSignatureAdhoc = 0x0002, /* must be used without signer */
|
||||
kSecCodeSignatureForceHard = 0x0100, /* always set HARD mode on launch */
|
||||
kSecCodeSignatureForceKill = 0x0200, /* always set KILL mode on launch */
|
||||
kSecCodeSignatureForceExpiration = 0x0400, /* force certificate expiration checks */
|
||||
kSecCodeSignatureRestrict = 0x0800, /* restrict dyld loading */
|
||||
kSecCodeSignatureEnforcement = 0x1000, /* enforce code signing */
|
||||
kSecCodeSignatureLibraryValidation = 0x2000, /* library validation required */
|
||||
kSecCodeSignatureRuntime = 0x10000, /* apply runtime hardening policies */
|
||||
kSecCodeSignatureLinkerSigned = 0x20000, /* identify that the signature was auto-generated by the linker*/
|
||||
};
|
||||
|
||||
/*!
|
||||
@typedef SecCodeStatus
|
||||
The code signing system attaches a set of status flags to each running code.
|
||||
These flags are maintained by the code's host, and can be read by anyone.
|
||||
A code may change its own flags, a host may change its guests' flags,
|
||||
and root may change anyone's flags. However, these flags are sticky in that
|
||||
each can change in only one direction (and never back, for the lifetime of the code).
|
||||
Not even root can violate this restriction.
|
||||
|
||||
There are other flags in SecCodeStatus that are not publicly documented.
|
||||
Do not rely on them, and do not ever attempt to explicitly set them.
|
||||
|
||||
@constant kSecCodeStatusValid
|
||||
Indicates that the code is dynamically valid, i.e. it started correctly
|
||||
and has not been invalidated since then. The valid bit can only be cleared.
|
||||
|
||||
Warning: This bit is not your one-stop shortcut to determining the validity of code.
|
||||
It represents the dynamic component of the full validity function; if this
|
||||
bit is unset, the code is definitely invalid, but the converse is not always true.
|
||||
In fact, code hosts may represent the outcome of some delayed static validation work in this bit,
|
||||
and thus it strictly represents a blend of (all of) dynamic and (some of) static validity,
|
||||
depending on the implementation of the particular host managing the code. You can (only)
|
||||
rely that (1) dynamic invalidation will clear this bit; and (2) the combination
|
||||
of static validation and dynamic validity (as performed by the SecCodeCheckValidity* APIs)
|
||||
will give a correct answer.
|
||||
|
||||
@constant kSecCodeStatusHard
|
||||
Indicates that the code prefers to be denied access to resources if gaining access
|
||||
would invalidate it. This bit can only be set.
|
||||
It is undefined whether code that is marked hard and is already invalid will still
|
||||
be denied access to a resource that would invalidate it if it were still valid. That is,
|
||||
the code may or may not get access to such a resource while being invalid, and that choice
|
||||
may appear random.
|
||||
|
||||
@constant kSecCodeStatusKill
|
||||
Indicates that the code wants to be killed (terminated) if it ever loses its validity.
|
||||
This bit can only be set. Code that has the kill flag set will never be dynamically invalid
|
||||
(and live). Note however that a change in static validity does not necessarily trigger instant
|
||||
death.
|
||||
|
||||
@constant kSecCodeStatusDebugged
|
||||
Indicated that code has been debugged by another process that was allowed to do so. The debugger
|
||||
causes this to be set when it attachs.
|
||||
|
||||
@constant kSecCodeStatusPlatform
|
||||
Indicates the code is platform code, shipping with the operating system and signed by Apple.
|
||||
*/
|
||||
typedef CF_OPTIONS(uint32_t, SecCodeStatus) {
|
||||
kSecCodeStatusValid = 0x00000001,
|
||||
kSecCodeStatusHard = 0x00000100,
|
||||
kSecCodeStatusKill = 0x00000200,
|
||||
kSecCodeStatusDebugged = 0x10000000,
|
||||
kSecCodeStatusPlatform = 0x04000000,
|
||||
};
|
||||
|
||||
|
||||
/*!
|
||||
@typedef SecRequirementType
|
||||
An enumeration indicating different types of internal requirements for code.
|
||||
*/
|
||||
typedef CF_ENUM(uint32_t, SecRequirementType) {
|
||||
kSecHostRequirementType = 1, /* what hosts may run us */
|
||||
kSecGuestRequirementType = 2, /* what guests we may run */
|
||||
kSecDesignatedRequirementType = 3, /* designated requirement */
|
||||
kSecLibraryRequirementType = 4, /* what libraries we may link against */
|
||||
kSecPluginRequirementType = 5, /* what plug-ins we may load */
|
||||
kSecInvalidRequirementType, /* invalid type of Requirement (must be last) */
|
||||
kSecRequirementTypeCount = kSecInvalidRequirementType /* number of valid requirement types */
|
||||
};
|
||||
|
||||
|
||||
/*!
|
||||
Types of cryptographic digests (hashes) used to hold code signatures
|
||||
together.
|
||||
|
||||
Each combination of type, length, and other parameters is a separate
|
||||
hash type; we don't understand "families" here.
|
||||
|
||||
These type codes govern the digest links that connect a CodeDirectory
|
||||
to its subordinate data structures (code pages, resources, etc.)
|
||||
They do not directly control other uses of hashes (such as those used
|
||||
within X.509 certificates and CMS blobs).
|
||||
*/
|
||||
typedef CF_ENUM(uint32_t, SecCSDigestAlgorithm) {
|
||||
kSecCodeSignatureNoHash = 0, /* null value */
|
||||
kSecCodeSignatureHashSHA1 = 1, /* SHA-1 */
|
||||
kSecCodeSignatureHashSHA256 = 2, /* SHA-256 */
|
||||
kSecCodeSignatureHashSHA256Truncated = 3, /* SHA-256 truncated to first 20 bytes */
|
||||
kSecCodeSignatureHashSHA384 = 4, /* SHA-384 */
|
||||
kSecCodeSignatureHashSHA512 = 5, /* SHA-512 */
|
||||
};
|
||||
|
||||
CF_ASSUME_NONNULL_END
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif //_H_CSCOMMON
|
||||
@@ -0,0 +1,317 @@
|
||||
// Extracted from Xcode 15 Beta 7
|
||||
// /Library/Developer/CommandLineTools/SDKs/MacOSX14.0.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/kern/cs_blobs.h
|
||||
/*
|
||||
* Copyright (c) 2017 Apple Computer, Inc. All rights reserved.
|
||||
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
|
||||
*
|
||||
* This file contains Original Code and/or Modifications of Original Code
|
||||
* as defined in and that are subject to the Apple Public Source License
|
||||
* Version 2.0 (the 'License'). You may not use this file except in
|
||||
* compliance with the License. The rights granted to you under the License
|
||||
* may not be used to create, or enable the creation or redistribution of,
|
||||
* unlawful or unlicensed copies of an Apple operating system, or to
|
||||
* circumvent, violate, or enable the circumvention or violation of, any
|
||||
* terms of an Apple operating system software license agreement.
|
||||
*
|
||||
* Please obtain a copy of the License at
|
||||
* http://www.opensource.apple.com/apsl/ and read it before using this file.
|
||||
*
|
||||
* The Original Code and all software distributed under the License are
|
||||
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
|
||||
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
|
||||
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
|
||||
* Please see the License for the specific language governing rights and
|
||||
* limitations under the License.
|
||||
*
|
||||
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
|
||||
*/
|
||||
#ifndef _KERN_CODESIGN_H_
|
||||
#define _KERN_CODESIGN_H_
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
/* code signing attributes of a process */
|
||||
#define CS_VALID 0x00000001 /* dynamically valid */
|
||||
#define CS_ADHOC 0x00000002 /* ad hoc signed */
|
||||
#define CS_GET_TASK_ALLOW 0x00000004 /* has get-task-allow entitlement */
|
||||
#define CS_INSTALLER 0x00000008 /* has installer entitlement */
|
||||
|
||||
#define CS_FORCED_LV 0x00000010 /* Library Validation required by Hardened System Policy */
|
||||
#define CS_INVALID_ALLOWED 0x00000020 /* (macOS Only) Page invalidation allowed by task port policy */
|
||||
|
||||
#define CS_HARD 0x00000100 /* don't load invalid pages */
|
||||
#define CS_KILL 0x00000200 /* kill process if it becomes invalid */
|
||||
#define CS_CHECK_EXPIRATION 0x00000400 /* force expiration checking */
|
||||
#define CS_RESTRICT 0x00000800 /* tell dyld to treat restricted */
|
||||
|
||||
#define CS_ENFORCEMENT 0x00001000 /* require enforcement */
|
||||
#define CS_REQUIRE_LV 0x00002000 /* require library validation */
|
||||
#define CS_ENTITLEMENTS_VALIDATED 0x00004000 /* code signature permits restricted entitlements */
|
||||
#define CS_NVRAM_UNRESTRICTED 0x00008000 /* has com.apple.rootless.restricted-nvram-variables.heritable entitlement */
|
||||
|
||||
#define CS_RUNTIME 0x00010000 /* Apply hardened runtime policies */
|
||||
#define CS_LINKER_SIGNED 0x00020000 /* Automatically signed by the linker */
|
||||
|
||||
#define CS_ALLOWED_MACHO (CS_ADHOC | CS_HARD | CS_KILL | CS_CHECK_EXPIRATION | \
|
||||
CS_RESTRICT | CS_ENFORCEMENT | CS_REQUIRE_LV | CS_RUNTIME | CS_LINKER_SIGNED)
|
||||
|
||||
#define CS_EXEC_SET_HARD 0x00100000 /* set CS_HARD on any exec'ed process */
|
||||
#define CS_EXEC_SET_KILL 0x00200000 /* set CS_KILL on any exec'ed process */
|
||||
#define CS_EXEC_SET_ENFORCEMENT 0x00400000 /* set CS_ENFORCEMENT on any exec'ed process */
|
||||
#define CS_EXEC_INHERIT_SIP 0x00800000 /* set CS_INSTALLER on any exec'ed process */
|
||||
|
||||
#define CS_KILLED 0x01000000 /* was killed by kernel for invalidity */
|
||||
#define CS_NO_UNTRUSTED_HELPERS 0x02000000 /* kernel did not load a non-platform-binary dyld or Rosetta runtime */
|
||||
#define CS_DYLD_PLATFORM CS_NO_UNTRUSTED_HELPERS /* old name */
|
||||
#define CS_PLATFORM_BINARY 0x04000000 /* this is a platform binary */
|
||||
#define CS_PLATFORM_PATH 0x08000000 /* platform binary by the fact of path (osx only) */
|
||||
|
||||
#define CS_DEBUGGED 0x10000000 /* process is currently or has previously been debugged and allowed to run with invalid pages */
|
||||
#define CS_SIGNED 0x20000000 /* process has a signature (may have gone invalid) */
|
||||
#define CS_DEV_CODE 0x40000000 /* code is dev signed, cannot be loaded into prod signed code (will go away with rdar://problem/28322552) */
|
||||
#define CS_DATAVAULT_CONTROLLER 0x80000000 /* has Data Vault controller entitlement */
|
||||
|
||||
#define CS_ENTITLEMENT_FLAGS (CS_GET_TASK_ALLOW | CS_INSTALLER | CS_DATAVAULT_CONTROLLER | CS_NVRAM_UNRESTRICTED)
|
||||
|
||||
/* executable segment flags */
|
||||
|
||||
#define CS_EXECSEG_MAIN_BINARY 0x1 /* executable segment denotes main binary */
|
||||
#define CS_EXECSEG_ALLOW_UNSIGNED 0x10 /* allow unsigned pages (for debugging) */
|
||||
#define CS_EXECSEG_DEBUGGER 0x20 /* main binary is debugger */
|
||||
#define CS_EXECSEG_JIT 0x40 /* JIT enabled */
|
||||
#define CS_EXECSEG_SKIP_LV 0x80 /* OBSOLETE: skip library validation */
|
||||
#define CS_EXECSEG_CAN_LOAD_CDHASH 0x100 /* can bless cdhash for execution */
|
||||
#define CS_EXECSEG_CAN_EXEC_CDHASH 0x200 /* can execute blessed cdhash */
|
||||
|
||||
/*
|
||||
* Magic numbers used by Code Signing
|
||||
*/
|
||||
enum {
|
||||
CSMAGIC_REQUIREMENT = 0xfade0c00, /* single Requirement blob */
|
||||
CSMAGIC_REQUIREMENTS = 0xfade0c01, /* Requirements vector (internal requirements) */
|
||||
CSMAGIC_CODEDIRECTORY = 0xfade0c02, /* CodeDirectory blob */
|
||||
CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0, /* embedded form of signature data */
|
||||
CSMAGIC_EMBEDDED_SIGNATURE_OLD = 0xfade0b02, /* XXX */
|
||||
CSMAGIC_EMBEDDED_ENTITLEMENTS = 0xfade7171, /* embedded entitlements */
|
||||
CSMAGIC_EMBEDDED_DER_ENTITLEMENTS = 0xfade7172, /* embedded DER encoded entitlements */
|
||||
CSMAGIC_DETACHED_SIGNATURE = 0xfade0cc1, /* multi-arch collection of embedded signatures */
|
||||
CSMAGIC_BLOBWRAPPER = 0xfade0b01, /* CMS Signature, among other things */
|
||||
CSMAGIC_EMBEDDED_LAUNCH_CONSTRAINT = 0xfade8181, /* Light weight code requirement */
|
||||
|
||||
CS_SUPPORTSSCATTER = 0x20100,
|
||||
CS_SUPPORTSTEAMID = 0x20200,
|
||||
CS_SUPPORTSCODELIMIT64 = 0x20300,
|
||||
CS_SUPPORTSEXECSEG = 0x20400,
|
||||
CS_SUPPORTSRUNTIME = 0x20500,
|
||||
CS_SUPPORTSLINKAGE = 0x20600,
|
||||
|
||||
CSSLOT_CODEDIRECTORY = 0, /* slot index for CodeDirectory */
|
||||
CSSLOT_INFOSLOT = 1,
|
||||
CSSLOT_REQUIREMENTS = 2,
|
||||
CSSLOT_RESOURCEDIR = 3,
|
||||
CSSLOT_APPLICATION = 4,
|
||||
CSSLOT_ENTITLEMENTS = 5,
|
||||
CSSLOT_DER_ENTITLEMENTS = 7,
|
||||
CSSLOT_LAUNCH_CONSTRAINT_SELF = 8,
|
||||
CSSLOT_LAUNCH_CONSTRAINT_PARENT = 9,
|
||||
CSSLOT_LAUNCH_CONSTRAINT_RESPONSIBLE = 10,
|
||||
CSSLOT_LIBRARY_CONSTRAINT = 11,
|
||||
|
||||
CSSLOT_ALTERNATE_CODEDIRECTORIES = 0x1000, /* first alternate CodeDirectory, if any */
|
||||
CSSLOT_ALTERNATE_CODEDIRECTORY_MAX = 5, /* max number of alternate CD slots */
|
||||
CSSLOT_ALTERNATE_CODEDIRECTORY_LIMIT = CSSLOT_ALTERNATE_CODEDIRECTORIES + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX, /* one past the last */
|
||||
|
||||
CSSLOT_SIGNATURESLOT = 0x10000, /* CMS Signature */
|
||||
CSSLOT_IDENTIFICATIONSLOT = 0x10001,
|
||||
CSSLOT_TICKETSLOT = 0x10002,
|
||||
|
||||
CSTYPE_INDEX_REQUIREMENTS = 0x00000002, /* compat with amfi */
|
||||
CSTYPE_INDEX_ENTITLEMENTS = 0x00000005, /* compat with amfi */
|
||||
|
||||
CS_HASHTYPE_SHA1 = 1,
|
||||
CS_HASHTYPE_SHA256 = 2,
|
||||
CS_HASHTYPE_SHA256_TRUNCATED = 3,
|
||||
CS_HASHTYPE_SHA384 = 4,
|
||||
|
||||
CS_SHA1_LEN = 20,
|
||||
CS_SHA256_LEN = 32,
|
||||
CS_SHA256_TRUNCATED_LEN = 20,
|
||||
|
||||
CS_CDHASH_LEN = 20, /* always - larger hashes are truncated */
|
||||
CS_HASH_MAX_SIZE = 48, /* max size of the hash we'll support */
|
||||
|
||||
/*
|
||||
* Currently only to support Legacy VPN plugins, and Mac App Store
|
||||
* but intended to replace all the various platform code, dev code etc. bits.
|
||||
*/
|
||||
CS_SIGNER_TYPE_UNKNOWN = 0,
|
||||
CS_SIGNER_TYPE_LEGACYVPN = 5,
|
||||
CS_SIGNER_TYPE_MAC_APP_STORE = 6,
|
||||
|
||||
CS_SUPPL_SIGNER_TYPE_UNKNOWN = 0,
|
||||
CS_SUPPL_SIGNER_TYPE_TRUSTCACHE = 7,
|
||||
CS_SUPPL_SIGNER_TYPE_LOCAL = 8,
|
||||
|
||||
CS_SIGNER_TYPE_OOPJIT = 9,
|
||||
|
||||
/* Validation categories used for trusted launch environment */
|
||||
CS_VALIDATION_CATEGORY_INVALID = 0,
|
||||
CS_VALIDATION_CATEGORY_PLATFORM = 1,
|
||||
CS_VALIDATION_CATEGORY_TESTFLIGHT = 2,
|
||||
CS_VALIDATION_CATEGORY_DEVELOPMENT = 3,
|
||||
CS_VALIDATION_CATEGORY_APP_STORE = 4,
|
||||
CS_VALIDATION_CATEGORY_ENTERPRISE = 5,
|
||||
CS_VALIDATION_CATEGORY_DEVELOPER_ID = 6,
|
||||
CS_VALIDATION_CATEGORY_LOCAL_SIGNING = 7,
|
||||
CS_VALIDATION_CATEGORY_ROSETTA = 8,
|
||||
CS_VALIDATION_CATEGORY_OOPJIT = 9,
|
||||
CS_VALIDATION_CATEGORY_NONE = 10,
|
||||
};
|
||||
|
||||
/* The set of application types we support for linkage signatures */
|
||||
enum {
|
||||
CS_LINKAGE_APPLICATION_INVALID = 0,
|
||||
CS_LINKAGE_APPLICATION_ROSETTA = 1,
|
||||
|
||||
/* XOJIT has been renamed to OOP-JIT */
|
||||
CS_LINKAGE_APPLICATION_XOJIT = 2,
|
||||
CS_LINKAGE_APPLICATION_OOPJIT = 2,
|
||||
};
|
||||
|
||||
/* The set of application sub-types we support for linkage signatures */
|
||||
enum {
|
||||
/*
|
||||
* For backwards compatibility with older signatures, the AOT sub-type is kept
|
||||
* as 0.
|
||||
*/
|
||||
CS_LINKAGE_APPLICATION_ROSETTA_AOT = 0,
|
||||
|
||||
/* OOP-JIT sub-types -- XOJIT type kept for external dependencies */
|
||||
CS_LINKAGE_APPLICATION_XOJIT_PREVIEWS = 1,
|
||||
CS_LINKAGE_APPLICATION_OOPJIT_INVALID = 0,
|
||||
CS_LINKAGE_APPLICATION_OOPJIT_PREVIEWS = 1,
|
||||
CS_LINKAGE_APPLICATION_OOPJIT_MLCOMPILER = 2,
|
||||
CS_LINKAGE_APPLICATION_OOPJIT_TOTAL,
|
||||
};
|
||||
|
||||
/* Integer to string conversion of OOP-JIT types */
|
||||
static const char *oop_jit_conversion[CS_LINKAGE_APPLICATION_OOPJIT_TOTAL] = {
|
||||
[CS_LINKAGE_APPLICATION_OOPJIT_INVALID] = NULL,
|
||||
[CS_LINKAGE_APPLICATION_OOPJIT_PREVIEWS] = "previews",
|
||||
[CS_LINKAGE_APPLICATION_OOPJIT_MLCOMPILER] = "ml-compiler",
|
||||
};
|
||||
|
||||
#define KERNEL_HAVE_CS_CODEDIRECTORY 1
|
||||
#define KERNEL_CS_CODEDIRECTORY_HAVE_PLATFORM 1
|
||||
|
||||
/*
|
||||
* C form of a CodeDirectory.
|
||||
*/
|
||||
typedef struct __CodeDirectory {
|
||||
uint32_t magic; /* magic number (CSMAGIC_CODEDIRECTORY) */
|
||||
uint32_t length; /* total length of CodeDirectory blob */
|
||||
uint32_t version; /* compatibility version */
|
||||
uint32_t flags; /* setup and mode flags */
|
||||
uint32_t hashOffset; /* offset of hash slot element at index zero */
|
||||
uint32_t identOffset; /* offset of identifier string */
|
||||
uint32_t nSpecialSlots; /* number of special hash slots */
|
||||
uint32_t nCodeSlots; /* number of ordinary (code) hash slots */
|
||||
uint32_t codeLimit; /* limit to main image signature range */
|
||||
uint8_t hashSize; /* size of each hash in bytes */
|
||||
uint8_t hashType; /* type of hash (cdHashType* constants) */
|
||||
uint8_t platform; /* platform identifier; zero if not platform binary */
|
||||
uint8_t pageSize; /* log2(page size in bytes); 0 => infinite */
|
||||
uint32_t spare2; /* unused (must be zero) */
|
||||
|
||||
char end_earliest[0];
|
||||
|
||||
/* Version 0x20100 */
|
||||
uint32_t scatterOffset; /* offset of optional scatter vector */
|
||||
char end_withScatter[0];
|
||||
|
||||
/* Version 0x20200 */
|
||||
uint32_t teamOffset; /* offset of optional team identifier */
|
||||
char end_withTeam[0];
|
||||
|
||||
/* Version 0x20300 */
|
||||
uint32_t spare3; /* unused (must be zero) */
|
||||
uint64_t codeLimit64; /* limit to main image signature range, 64 bits */
|
||||
char end_withCodeLimit64[0];
|
||||
|
||||
/* Version 0x20400 */
|
||||
uint64_t execSegBase; /* offset of executable segment */
|
||||
uint64_t execSegLimit; /* limit of executable segment */
|
||||
uint64_t execSegFlags; /* executable segment flags */
|
||||
char end_withExecSeg[0];
|
||||
|
||||
/* Version 0x20500 */
|
||||
uint32_t runtime;
|
||||
uint32_t preEncryptOffset;
|
||||
char end_withPreEncryptOffset[0];
|
||||
|
||||
/* Version 0x20600 */
|
||||
uint8_t linkageHashType;
|
||||
uint8_t linkageApplicationType;
|
||||
uint16_t linkageApplicationSubType;
|
||||
uint32_t linkageOffset;
|
||||
uint32_t linkageSize;
|
||||
char end_withLinkage[0];
|
||||
|
||||
/* followed by dynamic content as located by offset fields above */
|
||||
} CS_CodeDirectory
|
||||
__attribute__ ((aligned(1)));
|
||||
|
||||
/*
|
||||
* Structure of an embedded-signature SuperBlob
|
||||
*/
|
||||
|
||||
typedef struct __BlobIndex {
|
||||
uint32_t type; /* type of entry */
|
||||
uint32_t offset; /* offset of entry */
|
||||
} CS_BlobIndex
|
||||
__attribute__ ((aligned(1)));
|
||||
|
||||
typedef struct __SC_SuperBlob {
|
||||
uint32_t magic; /* magic number */
|
||||
uint32_t length; /* total length of SuperBlob */
|
||||
uint32_t count; /* number of index entries following */
|
||||
CS_BlobIndex index[]; /* (count) entries */
|
||||
/* followed by Blobs in no particular order as indicated by offsets in index */
|
||||
} CS_SuperBlob
|
||||
__attribute__ ((aligned(1)));
|
||||
|
||||
#define KERNEL_HAVE_CS_GENERICBLOB 1
|
||||
typedef struct __SC_GenericBlob {
|
||||
uint32_t magic; /* magic number */
|
||||
uint32_t length; /* total length of blob */
|
||||
char data[];
|
||||
} CS_GenericBlob
|
||||
__attribute__ ((aligned(1)));
|
||||
|
||||
typedef struct __SC_Scatter {
|
||||
uint32_t count; // number of pages; zero for sentinel (only)
|
||||
uint32_t base; // first page number
|
||||
uint64_t targetOffset; // offset in target
|
||||
uint64_t spare; // reserved
|
||||
} SC_Scatter
|
||||
__attribute__ ((aligned(1)));
|
||||
|
||||
|
||||
/*
|
||||
* Defined launch types
|
||||
*/
|
||||
__enum_decl(cs_launch_type_t, uint8_t, {
|
||||
CS_LAUNCH_TYPE_NONE = 0,
|
||||
CS_LAUNCH_TYPE_SYSTEM_SERVICE = 1,
|
||||
CS_LAUNCH_TYPE_SYSDIAGNOSE = 2,
|
||||
CS_LAUNCH_TYPE_APPLICATION = 3,
|
||||
});
|
||||
|
||||
struct launch_constraint_data {
|
||||
cs_launch_type_t launch_type;
|
||||
};
|
||||
typedef struct launch_constraint_data* launch_constraint_data_t;
|
||||
|
||||
#endif /* _KERN_CODESIGN_H */
|
||||
@@ -0,0 +1,85 @@
|
||||
// Extracted from Xcode 15 Beta 7
|
||||
// /Library/Developer/CommandLineTools/SDKs/MacOSX14.0.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/kern/trustcache.h */
|
||||
/*
|
||||
* Copyright (c) 2018 Apple Computer, Inc. All rights reserved.
|
||||
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
|
||||
*
|
||||
* This file contains Original Code and/or Modifications of Original Code
|
||||
* as defined in and that are subject to the Apple Public Source License
|
||||
* Version 2.0 (the 'License'). You may not use this file except in
|
||||
* compliance with the License. The rights granted to you under the License
|
||||
* may not be used to create, or enable the creation or redistribution of,
|
||||
* unlawful or unlicensed copies of an Apple operating system, or to
|
||||
* circumvent, violate, or enable the circumvention or violation of, any
|
||||
* terms of an Apple operating system software license agreement.
|
||||
*
|
||||
* Please obtain a copy of the License at
|
||||
* http://www.opensource.apple.com/apsl/ and read it before using this file.
|
||||
*
|
||||
* The Original Code and all software distributed under the License are
|
||||
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
|
||||
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
|
||||
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
|
||||
* Please see the License for the specific language governing rights and
|
||||
* limitations under the License.
|
||||
*
|
||||
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
|
||||
*/
|
||||
|
||||
#ifndef _KERN_TRUSTCACHE_H_
|
||||
#define _KERN_TRUSTCACHE_H_
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#include <kern/cs_blobs.h>
|
||||
|
||||
#include <uuid/uuid.h>
|
||||
|
||||
|
||||
|
||||
/* Version 1 trust caches: Always sorted by cdhash, added hash type and flags field.
|
||||
* Suitable for all trust caches. */
|
||||
|
||||
struct trust_cache_entry1 {
|
||||
uint8_t cdhash[CS_CDHASH_LEN];
|
||||
uint8_t hash_type;
|
||||
uint8_t flags;
|
||||
} __attribute__((__packed__));
|
||||
|
||||
struct trust_cache_module1 {
|
||||
uint32_t version;
|
||||
uuid_t uuid;
|
||||
uint32_t num_entries;
|
||||
struct trust_cache_entry1 entries[];
|
||||
} __attribute__((__packed__));
|
||||
|
||||
// Trust Cache Entry Flags
|
||||
#define CS_TRUST_CACHE_AMFID 0x1 // valid cdhash for amfid
|
||||
|
||||
/* Trust Cache lookup functions return their result as a 32bit value
|
||||
* comprised of subfields, for straightforward passing through layers.
|
||||
*
|
||||
* Format:
|
||||
*
|
||||
* 0xXXCCBBAA
|
||||
*
|
||||
* AA: 0-7: lookup result
|
||||
* bit 0: TC_LOOKUP_FOUND: set if any entry found
|
||||
* bit 1: (obsolete) TC_LOOKUP_FALLBACK: set if found in legacy static trust cache
|
||||
* bit 2-7: reserved
|
||||
* BB: 8-15: entry flags pass-through, see "Trust Cache Entry Flags" above
|
||||
* CC: 16-23: code directory hash type of entry, see CS_HASHTYPE_* in cs_blobs.h
|
||||
* XX: 24-31: reserved
|
||||
*/
|
||||
|
||||
#define TC_LOOKUP_HASH_TYPE_SHIFT 16
|
||||
#define TC_LOOKUP_HASH_TYPE_MASK 0xff0000L;
|
||||
#define TC_LOOKUP_FLAGS_SHIFT 8
|
||||
#define TC_LOOKUP_FLAGS_MASK 0xff00L
|
||||
#define TC_LOOKUP_RESULT_SHIFT 0
|
||||
#define TC_LOOKUP_RESULT_MASK 0xffL
|
||||
|
||||
#define TC_LOOKUP_FOUND 1
|
||||
|
||||
#endif /* _KERN_TRUSTCACHE_H */
|
||||
Reference in New Issue
Block a user