Changeset 74767 in vbox for trunk/src/VBox/Runtime/tools

Timestamp:

Oct 11, 2018 12:16:21 PM (6 years ago)

Author:

vboxsync

Message:

RTSignTool,SUPR3: Implemented dev id / kext checks for verify-exe. bugref:9232

File:

• trunk/src/VBox/Runtime/tools/RTSignTool.cpp (modified) (7 diffs)

trunk/src/VBox/Runtime/tools/RTSignTool.cpp

@@ -46 +46 @@
 # include <iprt/formats/pecoff.h>
 #endif
+#include <iprt/crypto/applecodesign.h>
 #include <iprt/crypto/digest.h>
 #include <iprt/crypto/x509.h>
@@ -1312 +1313 @@
     {
         /*
-         * If kernel signing, a valid certificate path must be anchored by the
-         * microsoft kernel signing root certificate.  The only alternative is
-         * test signing.
+         * If windows kernel signing, a valid certificate path must be anchored
+         * by the microsoft kernel signing root certificate.  The only
+         * alternative is test signing.
          */
-        if (pState->fKernel && hCertPaths != NIL_RTCRX509CERTPATHS)
+        if (   pState->fKernel
+            && hCertPaths != NIL_RTCRX509CERTPATHS
+            && pState->enmSignType == VERIFYEXESTATE::kSignType_Windows)
         {
             uint32_t cFound = 0;
@@ -1362 +1365 @@
                 RTMsgWarning("%u valid paths, expected 2", cValid);
         }
+        /*
+         * For Mac OS X signing, check for special developer ID attributes.
+         */
+        else if (pState->enmSignType == VERIFYEXESTATE::kSignType_OSX)
+        {
+            uint32_t cDevIdApp  = 0;
+            uint32_t cDevIdKext = 0;
+            for (uint32_t i = 0; i < pCert->TbsCertificate.T3.Extensions.cItems; i++)
+            {
+                PCRTCRX509EXTENSION pExt = pCert->TbsCertificate.T3.Extensions.papItems[i];
+                if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_APPLICATION_OID) == 0)
+                {
+                    cDevIdApp++;
+                    if (!pExt->Critical.fValue)
+                        rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                           "Dev ID Application certificate extension is not flagged critical");
+                }
+                else if (RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCR_APPLE_CS_DEVID_KEXT_OID) == 0)
+                {
+                    cDevIdKext++;
+                    if (!pExt->Critical.fValue)
+                        rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                           "Dev ID kext certificate extension is not flagged critical");
+                }
+            }
+            if (cDevIdApp == 0)
+                rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                   "Certificate is missing the 'Dev ID Application' extension");
+            if (cDevIdKext == 0 && pState->fKernel)
+                rc = RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
+                                   "Certificate is missing the 'Dev ID kext' extension");
+        }
     }
 
@@ -1418 +1453 @@
 }
 
-/** Worker for HandleVerifyExe. */
+/**
+ * Worker for HandleVerifyExe.
+ */
 static RTEXITCODE HandleVerifyExeWorker(VERIFYEXESTATE *pState, const char *pszFilename, PRTERRINFOSTATIC pStaticErrInfo)
 {
@@ -1546 +1583 @@
      * Populate the certificate stores according to the signing type.
      */
-#ifdef VBOX
+# ifdef VBOX
     unsigned          cSets = 0;
     struct STSTORESET aSets[6];
-#endif
-
     switch (State.enmSignType)
     {
         case VERIFYEXESTATE::kSignType_Windows:
-#ifdef VBOX
             aSets[cSets].hStore  = State.hRootStore;
             aSets[cSets].paTAs   = g_aSUPTimestampTAs;
@@ -1571 +1605 @@
             aSets[cSets].cTAs    = g_cSUPNtKernelRootTAs;
             cSets++;
-#endif
             break;
 
         case VERIFYEXESTATE::kSignType_OSX:
-            return RTMsgErrorExit(RTEXITCODE_FAILURE, "Mac OS X executable signing is not implemented.");
-    }
-
-#ifdef VBOX
+            aSets[cSets].hStore  = State.hRootStore;
+            aSets[cSets].paTAs   = g_aSUPAppleRootTAs;
+            aSets[cSets].cTAs    = g_cSUPAppleRootTAs;
+            cSets++;
+            break;
+    }
     for (unsigned i = 0; i < cSets; i++)
         for (unsigned j = 0; j < aSets[i].cTAs; j++)
@@ -1588 +1623 @@
                                       i, j, StaticErrInfo.szMsg);
         }
-#endif
+# endif /* VBOX */
 
     /*