I have created a XPC server and client using C APIs. I want to ensure that I trust the client, so I want to have a codesigning requirement on the server side, something like -
xpc_connection_set_peer_code_signing_requirement(listener, "anchor apple generic and certificate leaf[subject.OU] = \"1234567\"")
This checks if the client code was signed by a code-signing-identity issued by Apple and that the teamID in the leaf certificate is 1234567.
My questions are-
- Is using teamID as a signing requirement enough? What else can I add to this requirement to make it more secure?
- How does
xpc_connection_set_peer_code_signing_requirementwork internally? Does it do any cryptographic operations to verify the clients signature or does it simply do string matching on the teamID? - Is there a way actually verify the clients signature(cryptographically) before establishing a connection with the server? (so we know the client is who he claims to be)
1. Is using teamID as a signing requirement enough?
Probably. You might want to tighten that up depending on your specific security goals. For example, you might want your distribution-signed server to not allow development-side clients.
For more background on this, and specific info on how Apple uses code-signing requirements in general, see TN3127 Inside Code Signing: Requirements.
2. How does xpc_connection_set_peer_code_signing_requirement work internally?
The exact mechanics of this are complex, but you can reasonable think of it as checking the requirement against the calling process. This is a code signing operation. You can prototype it with codesign, using the --verify subcommand. Two hints:
-
A little known fact is that you can get
codesignto operate on a process by supplying a PID as an argument. -
TN3127 shows how to request that
codesigncheck a specific requirement.
You can also do this programmatically with the SecCodeCheckValidity family of routines.
WARNING This is fine for exploration, but don’t use it for a security check. Instead rely on xpc_connection_set_peer_code_signing_requirement. Doing this yourself exposes you to TOC/TOU problems.
3. Is there a way actually verify the clients signature(cryptographically) before establishing a connection with the server?
That’s exactly what xpc_connection_set_peer_code_signing_requirement does.
ps XPC Resources has links to a post where I discuss this in more detail, and a bunch of other useful links as well.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
