endpoint_sec/event/
event_authorization_petition.rs

1//! [`EventAuthorizationPetition`]
2
3use std::ffi::OsStr;
4
5use endpoint_sec_sys::{es_event_authorization_petition_t, es_string_token_t};
6
7use crate::{AuditToken, Process};
8
9/// Notification that a process petitioned for certain authorization rights
10#[doc(alias = "es_event_authorization_petition_t")]
11pub struct EventAuthorizationPetition<'a> {
12    /// The raw reference.
13    pub(crate) raw: &'a es_event_authorization_petition_t,
14    /// The version of the message.
15    pub(crate) version: u32,
16}
17
18impl<'a> EventAuthorizationPetition<'a> {
19    /// Process that submitted the petition (XPC caller)
20    #[inline(always)]
21    pub fn instigator(&self) -> Option<Process<'a>> {
22        // Safety: 'a tied to self, object obtained through ES
23        let process = unsafe { self.raw.instigator()? };
24        Some(Process::new(process, self.version))
25    }
26
27    /// Audit token of the process that instigated this event.
28    pub fn instigator_token(&self) -> AuditToken {
29        #[cfg(feature = "macos_15_0_0")]
30        if self.version >= 8 {
31            return AuditToken(self.raw.instigator_token);
32        }
33
34        // On old versions, the process was always non-null, and we can get
35        // its token easily.
36        self.instigator().unwrap().audit_token()
37    }
38
39    /// Process that created the petition
40    #[inline(always)]
41    pub fn petitioner(&self) -> Option<Process<'a>> {
42        Some(Process::new(
43            // Safety: 'a tied to self, object obtained through ES
44            unsafe { self.raw.petitioner.as_ref()? },
45            self.version,
46        ))
47    }
48
49    /// Audit token of the process that created the petition.
50    pub fn petitioner_token(&self) -> AuditToken {
51        #[cfg(feature = "macos_15_0_0")]
52        if self.version >= 8 {
53            return AuditToken(self.raw.petitioner_token);
54        }
55
56        // On old versions, the process was always non-null, and we can get
57        // its token easily.
58        self.petitioner().unwrap().audit_token()
59    }
60
61    /// Flags associated with the petition. Defined in Security framework "Authorization/Authorization.h"
62    #[inline(always)]
63    pub fn flags(&self) -> u32 {
64        self.raw.flags
65    }
66
67    /// Number of rights being requested.
68    #[inline(always)]
69    pub fn right_count(&self) -> usize {
70        self.raw.right_count
71    }
72
73    /// Iterator over the rights
74    #[inline(always)]
75    pub fn rights<'event>(&'event self) -> AuthorizationPetitionRights<'event, 'a> {
76        AuthorizationPetitionRights::new(self)
77    }
78}
79
80// Safety: safe to send across threads: does not contain any interior mutability nor depend on current thread state
81unsafe impl Send for EventAuthorizationPetition<'_> {}
82// Safety: safe to share across threads: does not contain any interior mutability nor depend on current thread state
83unsafe impl Sync for EventAuthorizationPetition<'_> {}
84
85impl_debug_eq_hash_with_functions!(EventAuthorizationPetition<'a> with version; instigator, instigator_token, petitioner, petitioner_token, flags, right_count);
86
87/// Read the `idx` right of `raw`
88///
89/// # Safety
90///
91/// Must be called with a valid event for which `idx` is in range `0..raw.right_count`
92unsafe fn read_nth_right(raw: &es_event_authorization_petition_t, idx: usize) -> es_string_token_t {
93    // SAFETY:
94    //  * upheld by the caller for the index;
95    //  * `raw.rights` is given to us by ES, so adding to it preserves alignment;
96    unsafe { std::ptr::read(raw.rights.add(idx)) }
97}
98
99make_event_data_iterator!(
100    EventAuthorizationPetition;
101    /// Iterator over the rights of an [`EventAuthorizationPetition`]
102    AuthorizationPetitionRights with right_count (usize);
103    &'raw OsStr;
104    read_nth_right,
105    super::as_os_str,
106);
endpoint_sec/event/event_authorization_petition.rs

endpoint_sec/event/
event_authorization_petition.rs
