1 // Copyright (c) 2015 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CHROME_BROWSER_SAFE_BROWSING_SIGNATURE_EVALUATOR_MAC_H_ 6 #define CHROME_BROWSER_SAFE_BROWSING_SIGNATURE_EVALUATOR_MAC_H_ 7 8 #include <Security/Security.h> 9 10 #include <string> 11 12 #include "base/files/file_path.h" 13 #include "base/mac/scoped_cftyperef.h" 14 #include "base/macros.h" 15 #include "base/memory/ref_counted.h" 16 #include "chrome/browser/safe_browsing/incident_reporting/binary_integrity_incident.h" 17 18 namespace safe_browsing { 19 20 // Wraps the OS X SecStaticCode API, to evaluate a given file object 21 // with a given code requirement, and produce a list of incident reports 22 // for files that fail code signature validity checks. 23 class MacSignatureEvaluator { 24 public: 25 explicit MacSignatureEvaluator(const base::FilePath& signed_object_path); 26 27 // The requirement string must be a valid "Code Signing Requirement Language 28 // string, which describes the identity of the signer. 29 MacSignatureEvaluator(const base::FilePath& signed_object_path, 30 const std::string& requirement); 31 32 ~MacSignatureEvaluator(); 33 34 // Creates the static code object and requirement string, and returns 35 // true if the object creation succeeds, else false. 36 bool Initialize(); 37 38 // Evaluate the signature and return a list of any binary integrity incident 39 // reports. Returns true if and only if the signed code object is valid. 40 bool PerformEvaluation( 41 ClientIncidentReport_IncidentData_BinaryIntegrityIncident* incident); 42 43 // Returns relative path component between a parent and a child. 44 // For example, /foo/bar and /foo/bar/y returns y. Note that 45 // this knows nothing about symlinks. Exposed for testing. 46 static bool GetRelativePathComponent(const base::FilePath& parent, 47 const base::FilePath& child, 48 std::string* out); 49 50 private: 51 // The path to the code object on disk. 52 base::FilePath path_; 53 54 // A Code Signing Requirement string. 55 std::string requirement_str_; 56 57 // Records whether or not a requirement string was specified. 58 bool has_requirement_; 59 60 // The static code object constructed from the code object on disk. 61 base::ScopedCFTypeRef<SecStaticCodeRef> code_; 62 63 // The requirement object constructed from the requirement string. 64 base::ScopedCFTypeRef<SecRequirementRef> requirement_; 65 66 DISALLOW_COPY_AND_ASSIGN(MacSignatureEvaluator); 67 }; 68 69 } // namespace safe_browsing 70 71 #endif // CHROME_BROWSER_SAFE_BROWSING_SIGNATURE_EVALUATOR_MAC_H_ 72