Repository navigation
soc: apple: sep: list the enclave's Touch ID identities per user (GetIdentitiesList 0x6e) - #1158
Draft
RyanTheTide wants to merge 1 commit into
Draft
RyanTheTide wants to merge 1 commit into
RyanTheTide wants to merge 1 commit into
Conversation
macOS reconciles its users' Touch ID identities with GetIdentitiesList (0x6e): a four-byte user filter, -1 for every user, answered by 20-byte records of the owning user and the identity's UUID, at most 600 bytes. It is read-only, and it is the first step towards more than one Linux user: it tells which enclave identities belong to whom, where the existing LIST_IDENTITIES only lists the device view. Add the request and a strict reply parser, and after a restore log how many identities the enclave holds for the Touch ID user and for other users of the shared enclave (another OS's users). Counts only; identity UUIDs are never logged. Signed-off-by: Ryan Murray <81541646+RyanTheTide@users.noreply.github.com> Assisted-by: LLM
Contributor
Author
|
TID10 scope note: real multi-user needs one enclave user per Unix account, each with its own key bag. That is #921's design and is not started; #921 is a design draft. 0x3c RemoveUserData then comes on account removal, behind an explicit root-only admin request with these guards: a fresh 0x6e inventory, no live capture, backups, catacomb saves, a re-list, and only then the host cleanup. This PR is step 1, the read-only inventory. The Neo powered off at 02:06 (thermal trip in another lane's trial), so the boot inventory runs on the short-clock test build once Ryan powers it on. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first multi-user step, read-only. macOS reconciles its users' Touch ID identities with GetIdentitiesList (0x6e).
N * 20bytes, each record the owning user plus the identity UUID, at most 600 bytes (30 records). Empty is a user with no identities. Layout and bounds are from Daybreak t-5618 and our own macOS 11-04 user-removal capture.This PR adds the request, a strict parser (it rejects a partial record or more than 600 bytes), and a boot-time inventory after the restore: how many identities the enclave holds for the Touch ID user and how many belong to other users of the shared enclave (macOS's users). It logs counts only; UUIDs are never logged.
Not in this PR: whole-user removal (RemoveUserData, 0x3c). It is destructive and needs an explicit admin path, a fresh 0x6e inventory, no live capture, backups and catacomb save handling, so it waits for a design review.
Stacked on #1145. It is independent of #1145's code, but touches the same file.
Testing
identities_list_replies_parse: empty reply, two records, a partial record, the 600-byte bound, 30 records.🤖 Generated with Claude Code