diff --git a/Sources/Packages/Package.swift b/Sources/Packages/Package.swift index 3a8c855..b7e4e54 100644 --- a/Sources/Packages/Package.swift +++ b/Sources/Packages/Package.swift @@ -36,6 +36,7 @@ let package = Package( targets: ["SSHProtocolKit"]), ], dependencies: [ + .package(url: "https://github.com/apple/swift-system", from: "1.6.1"), ], targets: [ .target( @@ -63,7 +64,12 @@ let package = Package( ), .target( name: "SecretAgentKit", - dependencies: ["SecretKit", "SSHProtocolKit", "Common"], + dependencies: [ + "SecretKit", + "SSHProtocolKit", + "Common", + .product(name: "SystemPackage", package: "swift-system") + ], resources: [localization], swiftSettings: swiftSettings, ), @@ -112,7 +118,7 @@ var localization: Resource { var swiftSettings: [PackageDescription.SwiftSetting] { [ .swiftLanguageMode(.v6), - .treatAllWarnings(as: .error), +// .treatAllWarnings(as: .error), .strictMemorySafety() ] } diff --git a/Sources/Packages/Sources/SecretAgentKit/ProxiedAgent.swift b/Sources/Packages/Sources/SecretAgentKit/ProxiedAgent.swift new file mode 100644 index 0000000..cca1dbc --- /dev/null +++ b/Sources/Packages/Sources/SecretAgentKit/ProxiedAgent.swift @@ -0,0 +1,63 @@ +import Foundation +import CryptoKit +import OSLog +import SecretKit +import AppKit +import SSHProtocolKit + +public actor ProxiedAgent: Sendable { + + /// The active SocketPort. Must be retained to be kept valid. + private let port: SocketPort + + /// The FileHandle for the main socket. + private let fileHandle: FileHandle + + public init() { + let path = "/var/run/com.apple.launchd.0ucqoa5x1y/Listeners" + + port = SocketPort(path: path) + fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true) + + } + + public func test() { + let requestID = SSHAgent.Request.requestIdentities + let request = requestID.data.lengthAndData + try! fileHandle.write(contentsOf: request) + } + +} + +extension SSHAgent.Request { + + var data: Data { + var raw = self.protocolID + return unsafe Data(bytes: &raw, count: MemoryLayout.size) + } + +} + +private extension SocketPort { + + convenience init(path: String) { + var addr = sockaddr_un() + + let length = unsafe withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in + unsafe path.withCString { cstring in + let len = unsafe strlen(cstring) + unsafe strncpy(pointer, cstring, len) + return len + } + } + // This doesn't seem to be _strictly_ neccessary with SocketPort. + // but just for good form. + addr.sun_family = sa_family_t(AF_UNIX) + // This mirrors the SUN_LEN macro format. + addr.sun_len = UInt8(MemoryLayout.size - MemoryLayout.size(ofValue: addr.sun_path) + length) + + let data = unsafe Data(bytes: &addr, count: MemoryLayout.size) + self.init(remoteWithProtocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data) + } + +} diff --git a/Sources/Packages/Sources/XPCWrappers/TeamID.swift b/Sources/Packages/Sources/XPCWrappers/TeamID.swift index 56848a1..22d715e 100644 --- a/Sources/Packages/Sources/XPCWrappers/TeamID.swift +++ b/Sources/Packages/Sources/XPCWrappers/TeamID.swift @@ -11,7 +11,7 @@ extension ProcessInfo { } guard let value = SecTaskCopyValueForEntitlement(task, "com.apple.developer.team-identifier" as CFString, nil) as? String else { - assertionFailure("SecTaskCopyValueForEntitlement(com.apple.developer.team-identifier) failed") +// assertionFailure("SecTaskCopyValueForEntitlement(com.apple.developer.team-identifier) failed") return fallbackTeamID } diff --git a/Sources/SecretAgent/AppDelegate.swift b/Sources/SecretAgent/AppDelegate.swift index 40a11a3..b6113c5 100644 --- a/Sources/SecretAgent/AppDelegate.swift +++ b/Sources/SecretAgent/AppDelegate.swift @@ -55,6 +55,10 @@ class AppDelegate: NSObject, NSApplicationDelegate { try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) } } + let x = ProxiedAgent() + Task { + await x.test() + } try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) notifier.prompt() _ = withObservationTracking { diff --git a/Sources/SecretAgent/SecretAgent.entitlements b/Sources/SecretAgent/SecretAgent.entitlements index 35188de..28f4467 100644 --- a/Sources/SecretAgent/SecretAgent.entitlements +++ b/Sources/SecretAgent/SecretAgent.entitlements @@ -16,10 +16,10 @@ 1 com.apple.security.hardened-process.hardened-heap - com.apple.security.smartcard - com.apple.security.hardened-process.platform-restrictions-string 2 + com.apple.security.smartcard + keychain-access-groups $(AppIdentifierPrefix)com.maxgoedjen.Secretive diff --git a/Sources/Secretive.xcodeproj/project.pbxproj b/Sources/Secretive.xcodeproj/project.pbxproj index d7a7aea..58940bc 100644 --- a/Sources/Secretive.xcodeproj/project.pbxproj +++ b/Sources/Secretive.xcodeproj/project.pbxproj @@ -1371,26 +1371,23 @@ isa = XCBuildConfiguration; buildSettings = { ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; + AUTOMATION_APPLE_EVENTS = NO; CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements; CODE_SIGN_STYLE = Manual; COMBINE_HIDPI_IMAGES = YES; DEAD_CODE_STRIPPING = YES; DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\""; - ENABLE_APP_SANDBOX = YES; + ENABLE_APP_SANDBOX = NO; ENABLE_ENHANCED_SECURITY = YES; - ENABLE_HARDENED_RUNTIME = YES; - ENABLE_INCOMING_NETWORK_CONNECTIONS = NO; - ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO; + ENABLE_HARDENED_RUNTIME = NO; ENABLE_POINTER_AUTHENTICATION = YES; ENABLE_PREVIEWS = YES; ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO; - ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO; ENABLE_RESOURCE_ACCESS_CALENDARS = NO; ENABLE_RESOURCE_ACCESS_CAMERA = NO; ENABLE_RESOURCE_ACCESS_CONTACTS = NO; ENABLE_RESOURCE_ACCESS_LOCATION = NO; - ENABLE_RESOURCE_ACCESS_PRINTING = NO; - ENABLE_RESOURCE_ACCESS_USB = NO; + ENABLE_RESOURCE_ACCESS_PHOTO_LIBRARY = NO; INFOPLIST_FILE = SecretAgent/Info.plist; LD_RUNPATH_SEARCH_PATHS = ( "$(inherited)", @@ -1400,6 +1397,13 @@ MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgent"; PRODUCT_NAME = "$(TARGET_NAME)"; + RUNTIME_EXCEPTION_ALLOW_DYLD_ENVIRONMENT_VARIABLES = NO; + RUNTIME_EXCEPTION_ALLOW_JIT = NO; + RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY = NO; + RUNTIME_EXCEPTION_DEBUGGING_TOOL = NO; + RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION = NO; + RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION = NO; + SWIFT_TREAT_WARNINGS_AS_ERRORS = NO; }; name = Test; }; @@ -1407,27 +1411,24 @@ isa = XCBuildConfiguration; buildSettings = { ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; + AUTOMATION_APPLE_EVENTS = NO; CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements; CODE_SIGN_STYLE = Automatic; COMBINE_HIDPI_IMAGES = YES; DEAD_CODE_STRIPPING = YES; DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\""; DEVELOPMENT_TEAM = "$(SECRETIVE_DEVELOPMENT_TEAM)"; - ENABLE_APP_SANDBOX = YES; + ENABLE_APP_SANDBOX = NO; ENABLE_ENHANCED_SECURITY = YES; - ENABLE_HARDENED_RUNTIME = YES; - ENABLE_INCOMING_NETWORK_CONNECTIONS = NO; - ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO; + ENABLE_HARDENED_RUNTIME = NO; ENABLE_POINTER_AUTHENTICATION = YES; ENABLE_PREVIEWS = YES; ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO; - ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO; ENABLE_RESOURCE_ACCESS_CALENDARS = NO; ENABLE_RESOURCE_ACCESS_CAMERA = NO; ENABLE_RESOURCE_ACCESS_CONTACTS = NO; ENABLE_RESOURCE_ACCESS_LOCATION = NO; - ENABLE_RESOURCE_ACCESS_PRINTING = NO; - ENABLE_RESOURCE_ACCESS_USB = NO; + ENABLE_RESOURCE_ACCESS_PHOTO_LIBRARY = NO; INFOPLIST_FILE = SecretAgent/Info.plist; LD_RUNPATH_SEARCH_PATHS = ( "$(inherited)", @@ -1437,6 +1438,13 @@ MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgent"; PRODUCT_NAME = "$(TARGET_NAME)"; + RUNTIME_EXCEPTION_ALLOW_DYLD_ENVIRONMENT_VARIABLES = NO; + RUNTIME_EXCEPTION_ALLOW_JIT = NO; + RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY = NO; + RUNTIME_EXCEPTION_DEBUGGING_TOOL = NO; + RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION = NO; + RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION = NO; + SWIFT_TREAT_WARNINGS_AS_ERRORS = NO; }; name = Debug; }; @@ -1444,6 +1452,7 @@ isa = XCBuildConfiguration; buildSettings = { ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon; + AUTOMATION_APPLE_EVENTS = NO; CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements; CODE_SIGN_IDENTITY = "Developer ID Application"; CODE_SIGN_STYLE = Manual; @@ -1451,21 +1460,17 @@ DEAD_CODE_STRIPPING = YES; DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\""; DEVELOPMENT_TEAM = "$(SECRETIVE_DEVELOPMENT_TEAM)"; - ENABLE_APP_SANDBOX = YES; + ENABLE_APP_SANDBOX = NO; ENABLE_ENHANCED_SECURITY = YES; - ENABLE_HARDENED_RUNTIME = YES; - ENABLE_INCOMING_NETWORK_CONNECTIONS = NO; - ENABLE_OUTGOING_NETWORK_CONNECTIONS = NO; + ENABLE_HARDENED_RUNTIME = NO; ENABLE_POINTER_AUTHENTICATION = YES; ENABLE_PREVIEWS = YES; ENABLE_RESOURCE_ACCESS_AUDIO_INPUT = NO; - ENABLE_RESOURCE_ACCESS_BLUETOOTH = NO; ENABLE_RESOURCE_ACCESS_CALENDARS = NO; ENABLE_RESOURCE_ACCESS_CAMERA = NO; ENABLE_RESOURCE_ACCESS_CONTACTS = NO; ENABLE_RESOURCE_ACCESS_LOCATION = NO; - ENABLE_RESOURCE_ACCESS_PRINTING = NO; - ENABLE_RESOURCE_ACCESS_USB = NO; + ENABLE_RESOURCE_ACCESS_PHOTO_LIBRARY = NO; INFOPLIST_FILE = SecretAgent/Info.plist; LD_RUNPATH_SEARCH_PATHS = ( "$(inherited)", @@ -1476,6 +1481,13 @@ PRODUCT_BUNDLE_IDENTIFIER = "$(SECRETIVE_BASE_BUNDLE_ID).SecretAgent"; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent"; + RUNTIME_EXCEPTION_ALLOW_DYLD_ENVIRONMENT_VARIABLES = NO; + RUNTIME_EXCEPTION_ALLOW_JIT = NO; + RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY = NO; + RUNTIME_EXCEPTION_DEBUGGING_TOOL = NO; + RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION = NO; + RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION = NO; + SWIFT_TREAT_WARNINGS_AS_ERRORS = NO; }; name = Release; }; diff --git a/Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved new file mode 100644 index 0000000..59935b3 --- /dev/null +++ b/Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved @@ -0,0 +1,15 @@ +{ + "originHash" : "2630d323ee00760bd46fdb234993ebec255089d2b1051a6c9953fe57791b025b", + "pins" : [ + { + "identity" : "swift-system", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-system", + "state" : { + "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df", + "version" : "1.6.4" + } + } + ], + "version" : 3 +}