Skip to content

Commit

Permalink
added self healing for auth rights
Browse files Browse the repository at this point in the history
  • Loading branch information
twocanoes committed Sep 29, 2023
1 parent 86256a2 commit 9b43e1c
Show file tree
Hide file tree
Showing 10 changed files with 103 additions and 49 deletions.
27 changes: 19 additions & 8 deletions Shared/AuthRightsHelper.swift
Original file line number Diff line number Diff line change
Expand Up @@ -9,24 +9,22 @@ import Foundation


class AuthRightsHelper: NSObject {
static let rightsArray = [["XCredsLoginPlugin:LoginWindow":"XCredsLoginPlugin:PowerControl,privileged"], ["loginwindow:done":"XCredsLoginPlugin:KeychainAdd,privileged"],["builtin:login-begin":"XCredsLoginPlugin:CreateUser,privileged"],["loginwindow:done":"XCredsLoginPlugin:EnableFDE,privileged"],["loginwindow:done":"XCredsLoginPlugin:LoginDone"]]

static func resetRights() ->Bool {

if AuthorizationDBManager.shared.rightExists(right:"XCredsLoginPlugin:LoginWindow")==true {
TCSLogWithMark("replacing XCredsLoginPlugin:LoginWindow with loginwindow:login")
if AuthorizationDBManager.shared.replace(right: "XCredsLoginPlugin:LoginWindow", withNewRight: "loginwindow:login") == false {
TCSLogErrorWithMark("Error removing XCredsLoginPlugin:LoginWindow. bailing")
return false

}
}
else if AuthorizationDBManager.shared.rightExists(right: "loginwindow:login")==false {
TCSLogErrorWithMark("There was no XCredsLoginPlugin:LoginWindow and no loginwindow:login. Please remove /var/db/auth.db and reboot")
return false
}




for authRight in AuthorizationDBManager.shared.consoleRights() {
if authRight.hasPrefix("XCredsLoginPlugin") {
TCSLogWithMark("Removing \(authRight)")
Expand All @@ -40,24 +38,37 @@ class AuthRightsHelper: NSObject {
return true

}
static func verifyRights() -> Bool {
for right in rightsArray {

if AuthorizationDBManager.shared.rightExists(right: right.values.first!)==false {
return false
}
}
return true
}
static func addRights() ->Bool {

TCSLogWithMark("Adding rights back in")
if AuthorizationDBManager.shared.replace(right: "loginwindow:login", withNewRight: "XCredsLoginPlugin:LoginWindow")==false {
TCSLogWithMark("error adding loginwindow:login after XCredsLoginPlugin:LoginWindow. bailing since this shouldn't happen")

return false

}

for right in [["XCredsLoginPlugin:LoginWindow":"XCredsLoginPlugin:PowerControl,privileged"], ["loginwindow:done":"XCredsLoginPlugin:KeychainAdd,privileged"],["builtin:login-begin":"XCredsLoginPlugin:CreateUser,privileged"],["loginwindow:done":"XCredsLoginPlugin:EnableFDE,privileged"],["loginwindow:done":"XCredsLoginPlugin:LoginDone"]] {
for right in rightsArray {

if AuthorizationDBManager.shared.rightExists(right: right.keys.first!){
if AuthorizationDBManager.shared.rightExists(right:right.values.first!) == false {

if AuthorizationDBManager.shared.insertRight(newRight: right.values.first!, afterRight: right.keys.first!) {
if AuthorizationDBManager.shared.insertRight(newRight: right.values.first!, afterRight: right.keys.first!) {

TCSLogWithMark("adding \(right.values.first!) after \(right.keys.first!)")
}
else {
TCSLogWithMark("right \(right.values.first!) already exists. Skipping")

TCSLogWithMark("adding \(right.values.first!) after \(right.keys.first!)")
}
}

else {
Expand Down
17 changes: 11 additions & 6 deletions XCreds Login Overlay/AppDelegate.swift
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,13 @@ class AppDelegate: NSObject, NSApplicationDelegate {
waitWindow.setFrameOrigin(newPos)
waitWindow.makeKeyAndOrderFront(self)
DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
if AuthorizationDBManager.shared.rightExists(right: "loginwindow:login"){
TCSLogWithMark("setting standard login back to XCreds login")
try? "".write(toFile: "/tmp/xcreds_return", atomically: false, encoding: .utf8)
let _ = AuthorizationDBManager.shared.replace(right:"loginwindow:login", withNewRight: "XCredsLoginPlugin:LoginWindow")
let _ = cliTask("/usr/bin/killall loginwindow")
TCSLogWithMark("setting standard login back to XCreds login")
try? "".write(toFile: "/tmp/xcreds_return", atomically: false, encoding: .utf8)
// let _ = AuthorizationDBManager.shared.replace(right:"loginwindow:login", withNewRight: "XCredsLoginPlugin:LoginWindow")
let _ = AuthRightsHelper.addRights()
let _ = cliTask("/usr/bin/killall loginwindow")


}
}
}

Expand Down Expand Up @@ -89,6 +89,11 @@ class AppDelegate: NSObject, NSApplicationDelegate {
}
}
func applicationDidFinishLaunching(_ aNotification: Notification) {
if AuthRightsHelper.verifyRights()==false {
let _ = AuthRightsHelper.resetRights()
cloudLoginButtonPressed(self)
return
}
if AuthorizationDBManager.shared.rightExists(right: "loginwindow:login") == true {


Expand Down
8 changes: 4 additions & 4 deletions XCreds Login Overlay/Base.lproj/MainMenu.xib
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="21701" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="22154" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="21701"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="22154"/>
<capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
</dependencies>
<objects>
Expand Down Expand Up @@ -687,7 +687,7 @@
<windowStyleMask key="styleMask" closable="YES" miniaturizable="YES" resizable="YES"/>
<windowPositionMask key="initialPositionMask" leftStrut="YES" rightStrut="YES" topStrut="YES" bottomStrut="YES"/>
<rect key="contentRect" x="25" y="25" width="872" height="109"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="933"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="910"/>
<view key="contentView" id="1nr-Jh-HO9">
<rect key="frame" x="0.0" y="0.0" width="872" height="109"/>
<autoresizingMask key="autoresizingMask"/>
Expand Down Expand Up @@ -729,7 +729,7 @@
<windowStyleMask key="styleMask" closable="YES" miniaturizable="YES" resizable="YES"/>
<windowPositionMask key="initialPositionMask" leftStrut="YES" rightStrut="YES" topStrut="YES" bottomStrut="YES"/>
<rect key="contentRect" x="144" y="174" width="362" height="190"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="933"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="910"/>
<view key="contentView" id="MiV-8U-Ioy">
<rect key="frame" x="0.0" y="0.0" width="362" height="190"/>
<autoresizingMask key="autoresizingMask"/>
Expand Down
1 change: 1 addition & 0 deletions XCreds/PrefKeys.swift
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import Foundation
enum PrefKeys: String {
case clientID, clientSecret, password="xcreds local password",discoveryURL, redirectURI, scopes, accessToken, idToken, refreshToken, tokenEndpoint, expirationDate, invalidToken, refreshRateHours,refreshRateMinutes, showDebug, verifyPassword, shouldShowQuitMenu, shouldShowPreferencesOnStart, shouldSetGoogleAccessTypeToOffline, passwordChangeURL, shouldShowAboutMenu, username, idpHostName, passwordElementID, shouldFindPasswordElement, shouldShowVersionInfo, shouldShowSupportStatus,shouldShowConfigureWifiButton,shouldShowMacLoginButton, loginWindowBackgroundImageURL, shouldShowCloudLoginByDefault, shouldPreferLocalLoginInsteadOfCloudLogin, idpHostNames,autoRefreshLoginTimer, loginWindowWidth, loginWindowHeight, shouldShowRefreshBanner, shouldSwitchToLoginWindowWhenLocked,accounts = "Accounts",
windowSignIn = "WindowSignIn", settingsOverrideScriptPath, localAdminUserName, localAdminPassword, usernamePlaceholder, passwordPlaceholder, shouldShowLocalOnlyCheckbox, shouldShowTokenUpdateStatus, shouldDetectNetworkToDetermineLoginWindow
//, filePathToPreventShowingUI
case ropgClientID
case ropgClientSecret
case shouldVerifyPasswordWithRopg
Expand Down
6 changes: 3 additions & 3 deletions XCreds/PreferencesWindow.xib
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="21701" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="22154" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES" customObjectInstantitationMethod="direct">
<dependencies>
<deployment identifier="macosx"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="21701"/>
<plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="22154"/>
<capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
</dependencies>
<objects>
Expand All @@ -18,7 +18,7 @@
<windowStyleMask key="styleMask" titled="YES" closable="YES"/>
<windowPositionMask key="initialPositionMask" leftStrut="YES" rightStrut="YES" topStrut="YES" bottomStrut="YES"/>
<rect key="contentRect" x="560" y="551" width="494" height="173"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="933"/>
<rect key="screenRect" x="0.0" y="0.0" width="1496" height="910"/>
<view key="contentView" wantsLayer="YES" id="ZbF-tC-vpZ">
<rect key="frame" x="0.0" y="0.0" width="494" height="173"/>
<autoresizingMask key="autoresizingMask"/>
Expand Down
1 change: 0 additions & 1 deletion XCredsLoginPlugIn/LoginWindow/AuthorizationDBManager.swift
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,6 @@ class AuthorizationDBManager: NSObject {
}
func insertRight(newRight:String, afterRight right:String) -> Bool {
var consoleRights = consoleRights()
// TCSLogWithMark("finding right \(right)")

let positionOfRight = consoleRights.firstIndex(of: right)

Expand Down
32 changes: 11 additions & 21 deletions XCredsLoginPlugIn/Mechanisms/XCredsLoginMechanism.swift
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,14 @@ import Network
TCSLogWithMark()
let discoveryURL=DefaultsOverride.standardOverride.value(forKey: PrefKeys.discoveryURL.rawValue)
let preferLocalLogin = DefaultsOverride.standardOverride.bool(forKey: PrefKeys.shouldPreferLocalLoginInsteadOfCloudLogin.rawValue)

// let preventUIPath = DefaultsOverride.standardOverride.string(forKey: PrefKeys.filePathToPreventShowingUI.rawValue)
//
// if let preventUIPath = preventUIPath,
// FileManager.default.fileExists(atPath: preventUIPath) {
// TCSLogWithMark("file exists at \(preventUIPath). Skipping showing XCreds login window")
//
// return
// }
let shouldDetectNetwork = DefaultsOverride.standardOverride.bool(forKey: PrefKeys.shouldDetectNetworkToDetermineLoginWindow.rawValue)
TCSLogWithMark("checking if local login")
if preferLocalLogin == false,
Expand All @@ -162,9 +169,7 @@ import Network
}
else {
TCSLogWithMark("preferring showing local")

showLoginWindowType(loginWindowType: .usernamePassword)

}
}
func startNetworkMonitoring(){
Expand Down Expand Up @@ -213,14 +218,13 @@ import Network
allowLogin()
return
}


selectAndShowLoginWindow()

let isReturning = FileManager.default.fileExists(atPath: "/tmp/xcreds_return")
TCSLogWithMark("Verifying if we should show cloud login.")

if isReturning == false, DefaultsOverride.standardOverride.bool(forKey: PrefKeys.shouldShowCloudLoginByDefault.rawValue) == false {
if isReturning == false,
DefaultsOverride.standardOverride.bool(forKey: PrefKeys.shouldShowCloudLoginByDefault.rawValue) == false {
setContextString(type: kAuthorizationEnvironmentUsername, value: SpecialUsers.standardLoginWindow.rawValue)
TCSLogWithMark("marking to show standard login window")

Expand All @@ -238,7 +242,7 @@ import Network

if let errorMessage = getContextString(type: "ErrorMessage"){
TCSLogWithMark("Sticky error message = \(errorMessage)")

let alert = NSAlert()
alert.addButton(withTitle: "OK")
alert.messageText=errorMessage
Expand All @@ -251,24 +255,10 @@ import Network

}

// loginWindowControlsWindowController = LoginWindowControlsWindowController(windowNibName: NSNib.Name("LoginWindowControls"))
//
// guard loginWindowControlsWindowController.window != nil else {
// TCSLogWithMark("could not create loginWindowControlsWindowController window")
// return
// }
// loginWindowControlsWindowController.delegate=self
// loginWindowControlsWindowController.window?.backgroundColor = .darkGray
// loginWindowControlsWindowController.window?.alphaValue=0.7
}
override func allowLogin() {
stopNetworkMonitoring()
TCSLogWithMark("Allowing Login")
// if loginWindowControlsWindowController != nil {
// TCSLogWithMark("Dismissing controller")
//
// loginWindowControlsWindowController.dismiss()
// }

if loginWebViewWindowController != nil {
TCSLogWithMark("Dismissing loginWindowWindowController")
Expand Down
14 changes: 8 additions & 6 deletions xCreds.xcodeproj/project.pbxproj
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@
76786F6B2A27C79100AA8DB9 /* NSFileManager+TCSRealHomeFolder.m in Sources */ = {isa = PBXBuildFile; fileRef = 76D7ADFC284EB18600332EBC /* NSFileManager+TCSRealHomeFolder.m */; };
767B939C2A28279E0038935E /* View+Shake.swift in Sources */ = {isa = PBXBuildFile; fileRef = 767B939B2A28279E0038935E /* View+Shake.swift */; };
767B939D2A28289E0038935E /* View+Shake.swift in Sources */ = {isa = PBXBuildFile; fileRef = 767B939B2A28279E0038935E /* View+Shake.swift */; };
767C42842AC6645700542099 /* AuthRightsHelper.swift in Sources */ = {isa = PBXBuildFile; fileRef = 76786F4E2A27C31400AA8DB9 /* AuthRightsHelper.swift */; };
7681FEC52A4C8B9000F91CD1 /* AboutWindowController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7681FEC42A4C8B9000F91CD1 /* AboutWindowController.swift */; };
7681FEC72A4C8BC800F91CD1 /* AboutWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = 7681FEC62A4C8BC800F91CD1 /* AboutWindow.xib */; };
7681FEC92A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist in Resources */ = {isa = PBXBuildFile; fileRef = 7681FEC82A4CFEA200F91CD1 /* com.twocanoes.xcreds.plist */; };
Expand Down Expand Up @@ -1097,6 +1098,7 @@
76DC0A8428838375007C42B2 /* AuthorizationDBManager.swift in Sources */,
76DC0A8628838656007C42B2 /* TCSUnifiedLogger.m in Sources */,
76DC0A7E288376BC007C42B2 /* TCSXCredsLoginOverlayWindow.swift in Sources */,
767C42842AC6645700542099 /* AuthRightsHelper.swift in Sources */,
76DC0A87288386FA007C42B2 /* NSTaskWrapper.swift in Sources */,
76DC0A6828836EB1007C42B2 /* AppDelegate.swift in Sources */,
);
Expand Down Expand Up @@ -1229,7 +1231,7 @@
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEFINES_MODULE = YES;
DEVELOPMENT_TEAM = UXP6YEHSPW;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1267,7 +1269,7 @@
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEFINES_MODULE = YES;
DEVELOPMENT_TEAM = UXP6YEHSPW;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1387,7 +1389,7 @@
CODE_SIGN_ENTITLEMENTS = "XCreds Login Overlay/XCreds_Login_Overlay.entitlements";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1424,7 +1426,7 @@
CODE_SIGN_ENTITLEMENTS = "XCreds Login Overlay/XCreds_Login_Overlay.entitlements";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1574,7 +1576,7 @@
CODE_SIGN_ENTITLEMENTS = XCreds/xCreds.entitlements;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down Expand Up @@ -1611,7 +1613,7 @@
CODE_SIGN_ENTITLEMENTS = XCreds/xCreds.entitlements;
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
CURRENT_PROJECT_VERSION = 5183;
CURRENT_PROJECT_VERSION = 5190;
DEVELOPMENT_TEAM = UXP6YEHSPW;
ENABLE_HARDENED_RUNTIME = YES;
FRAMEWORK_SEARCH_PATHS = (
Expand Down
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,21 @@
endingLineNumber = "75"
offsetFromSymbolStart = "3016">
</Location>
<Location
uuid = "6CB75E61-53AF-4FF3-9B84-135ADF290282 - 813eac0a5c27346d"
shouldBeEnabled = "Yes"
ignoreCount = "0"
continueAfterRunningActions = "No"
symbolName = "XCreds.cliTask(_: Swift.String, arguments: Swift.Optional&lt;Swift.Array&lt;Swift.String&gt;&gt;, waitForTermination: Swift.Bool) -&gt; Swift.String"
moduleName = "XCreds"
usesParentBreakpointCondition = "Yes"
urlString = "file:///Users/tperfitt/Documents/Projects/xcreds/XCredsLoginPlugIn/NSTaskWrapper.swift"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "75"
endingLineNumber = "75"
offsetFromSymbolStart = "2980">
</Location>
</Locations>
</BreakpointContent>
</BreakpointProxy>
Expand Down Expand Up @@ -97,8 +112,39 @@
endingLineNumber = "66"
offsetFromSymbolStart = "2488">
</Location>
<Location
uuid = "166D82A6-A704-44DC-97E2-7339415A5DDE - 813eac0a5c273702"
shouldBeEnabled = "Yes"
ignoreCount = "0"
continueAfterRunningActions = "No"
symbolName = "XCreds.cliTask(_: Swift.String, arguments: Swift.Optional&lt;Swift.Array&lt;Swift.String&gt;&gt;, waitForTermination: Swift.Bool) -&gt; Swift.String"
moduleName = "XCreds"
usesParentBreakpointCondition = "Yes"
urlString = "file:///Users/tperfitt/Documents/Projects/xcreds/XCredsLoginPlugIn/NSTaskWrapper.swift"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "66"
endingLineNumber = "66"
offsetFromSymbolStart = "2460">
</Location>
</Locations>
</BreakpointContent>
</BreakpointProxy>
<BreakpointProxy
BreakpointExtensionID = "Xcode.Breakpoint.FileBreakpoint">
<BreakpointContent
uuid = "FCF6243A-E3F8-4CDF-8098-480FF0A95D30"
shouldBeEnabled = "Yes"
ignoreCount = "0"
continueAfterRunningActions = "No"
filePath = "XCredsLoginPlugIn/Mechanisms/XCredsLoginMechanism.swift"
startingColumnNumber = "9223372036854775807"
endingColumnNumber = "9223372036854775807"
startingLineNumber = "146"
endingLineNumber = "146"
landmarkName = "selectAndShowLoginWindow()"
landmarkType = "7">
</BreakpointContent>
</BreakpointProxy>
</Breakpoints>
</Bucket>

0 comments on commit 9b43e1c

Please sign in to comment.