1 // Copyright 2024 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef BASE_MAC_CODE_SIGNATURE_H_ 6 #define BASE_MAC_CODE_SIGNATURE_H_ 7 8 #include <Security/Security.h> 9 #include <mach/mach.h> 10 #include <unistd.h> 11 12 #include <string_view> 13 14 #include "base/apple/scoped_cftyperef.h" 15 #include "base/base_export.h" 16 #include "base/types/expected.h" 17 18 namespace base::mac { 19 20 enum class SignatureValidationType { 21 // Verify that the running application has a valid code signature and 22 // that it is unchanged from the copy on disk. 23 DynamicAndStatic, 24 25 // Verify that the running application has a valid code signature. 26 // Do not verify that the application matches the copy on disk. 27 // The contents of the Info.plist of the process must be provided. 28 DynamicOnly, 29 }; 30 31 // Returns whether `process` has a valid code signature that fulfills 32 // `requirement`. 33 BASE_EXPORT 34 OSStatus ProcessIsSignedAndFulfillsRequirement( 35 audit_token_t process, 36 SecRequirementRef requirement, 37 SignatureValidationType validation_type = 38 SignatureValidationType::DynamicAndStatic, 39 std::string_view info_plist_xml = {}); 40 41 // Returns whether the process with PID `pid` has a valid code signature 42 // that fulfills `requirement`. 43 // 44 // DEPRECATED: Do not use this function in new code. Use 45 // `ProcessIsSignedAndFulfillsRequirement` instead. Process IDs do not uniquely 46 // identify a process so it is impossible to make trust decisions based on them. 47 BASE_EXPORT 48 OSStatus ProcessIdIsSignedAndFulfillsRequirement_DoNotUse( 49 pid_t pid, 50 SecRequirementRef requirement, 51 SignatureValidationType validation_type = 52 SignatureValidationType::DynamicAndStatic, 53 std::string_view info_plist_xml = {}); 54 55 // Create a SecRequirementRef from a requirement string. 56 // 57 // Returns a null reference if the requirement string was invalid. 58 BASE_EXPORT 59 base::apple::ScopedCFTypeRef<SecRequirementRef> RequirementFromString( 60 std::string_view requirement_string); 61 62 // Return a SecCodeRef representing the current process. 63 // 64 // Validation performed against this code object will validate the running 65 // process only, and will not verify that the application matches the copy on 66 // disk. 67 BASE_EXPORT 68 base::expected<base::apple::ScopedCFTypeRef<SecCodeRef>, OSStatus> 69 DynamicCodeObjectForCurrentProcess(); 70 71 } // namespace base::mac 72 73 #endif // BASE_MAC_CODE_SIGNATURE_H_ 74