| | 1 | /* |
| | 2 | * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. |
| | 3 | * |
| | 4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
| | 5 | * |
| | 6 | * This file contains Original Code and/or Modifications of Original Code |
| | 7 | * as defined in and that are subject to the Apple Public Source License |
| | 8 | * Version 2.0 (the 'License'). You may not use this file except in |
| | 9 | * compliance with the License. The rights granted to you under the License |
| | 10 | * may not be used to create, or enable the creation or redistribution of, |
| | 11 | * unlawful or unlicensed copies of an Apple operating system, or to |
| | 12 | * circumvent, violate, or enable the circumvention or violation of, any |
| | 13 | * terms of an Apple operating system software license agreement. |
| | 14 | * |
| | 15 | * Please obtain a copy of the License at |
| | 16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
| | 17 | * |
| | 18 | * The Original Code and all software distributed under the License are |
| | 19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
| | 20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
| | 21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
| | 22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
| | 23 | * Please see the License for the specific language governing rights and |
| | 24 | * limitations under the License. |
| | 25 | * |
| | 26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
| | 27 | */ |
| | 28 | |
| | 29 | #ifndef _SYS_CODESIGN_H_ |
| | 30 | #define _SYS_CODESIGN_H_ |
| | 31 | |
| | 32 | #if KERNEL |
| | 33 | #include <kern/cs_blobs.h> |
| | 34 | #else |
| | 35 | #include <System/kern/cs_blobs.h> |
| | 36 | #endif |
| | 37 | |
| | 38 | /* MAC flags used by F_ADDFILESIGS_* */ |
| | 39 | #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ |
| | 40 | |
| | 41 | #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" |
| | 42 | |
| | 43 | /* csops operations */ |
| | 44 | #define CS_OPS_STATUS 0 /* return status */ |
| | 45 | #define CS_OPS_MARKINVALID 1 /* invalidate process */ |
| | 46 | #define CS_OPS_MARKHARD 2 /* set HARD flag */ |
| | 47 | #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ |
| | 48 | #ifdef KERNEL_PRIVATE |
| | 49 | /* CS_OPS_PIDPATH 4 */ |
| | 50 | #endif |
| | 51 | #define CS_OPS_CDHASH 5 /* get code directory hash */ |
| | 52 | #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ |
| | 53 | #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ |
| | 54 | #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ |
| | 55 | #define CS_OPS_SET_STATUS 9 /* set codesign flags */ |
| | 56 | #define CS_OPS_BLOB 10 /* get codesign blob */ |
| | 57 | #define CS_OPS_IDENTITY 11 /* get codesign identity */ |
| | 58 | #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ |
| | 59 | #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ |
| | 60 | #define CS_OPS_TEAMID 14 /* get team id */ |
| | 61 | #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ |
| | 62 | |
| | 63 | #define CS_MAX_TEAMID_LEN 64 |
| | 64 | |
| | 65 | #ifndef KERNEL |
| | 66 | |
| | 67 | #include <sys/types.h> |
| | 68 | #include <mach/message.h> |
| | 69 | |
| | 70 | __BEGIN_DECLS |
| | 71 | /* code sign operations */ |
| | 72 | int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); |
| | 73 | int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); |
| | 74 | __END_DECLS |
| | 75 | |
| | 76 | #else /* !KERNEL */ |
| | 77 | |
| | 78 | #include <mach/machine.h> |
| | 79 | #include <mach/vm_types.h> |
| | 80 | |
| | 81 | #include <sys/cdefs.h> |
| | 82 | #include <sys/_types/_off_t.h> |
| | 83 | |
| | 84 | struct vnode; |
| | 85 | struct cs_blob; |
| | 86 | struct fileglob; |
| | 87 | |
| | 88 | __BEGIN_DECLS |
| | 89 | int cs_valid(struct proc *); |
| | 90 | int cs_process_enforcement(struct proc *); |
| | 91 | int cs_process_global_enforcement(void); |
| | 92 | int cs_system_enforcement(void); |
| | 93 | int cs_require_lv(struct proc *); |
| | 94 | int csproc_forced_lv(struct proc* p); |
| | 95 | int cs_system_require_lv(void); |
| | 96 | uint32_t cs_entitlement_flags(struct proc *p); |
| | 97 | int cs_entitlements_blob_get(struct proc *, void **, size_t *); |
| | 98 | #ifdef KERNEL_PRIVATE |
| | 99 | int cs_entitlements_dictionary_copy(struct proc *, void **); |
| | 100 | #endif |
| | 101 | int cs_restricted(struct proc *); |
| | 102 | uint8_t * cs_get_cdhash(struct proc *); |
| | 103 | |
| | 104 | struct cs_blob * csproc_get_blob(struct proc *); |
| | 105 | struct cs_blob * csvnode_get_blob(struct vnode *, off_t); |
| | 106 | void csvnode_print_debug(struct vnode *); |
| | 107 | |
| | 108 | off_t csblob_get_base_offset(struct cs_blob *); |
| | 109 | vm_size_t csblob_get_size(struct cs_blob *); |
| | 110 | vm_address_t csblob_get_addr(struct cs_blob *); |
| | 111 | const char * csblob_get_teamid(struct cs_blob *); |
| | 112 | const char * csblob_get_identity(struct cs_blob *); |
| | 113 | const uint8_t * csblob_get_cdhash(struct cs_blob *); |
| | 114 | int csblob_get_platform_binary(struct cs_blob *); |
| | 115 | unsigned int csblob_get_flags(struct cs_blob *); |
| | 116 | uint8_t csblob_get_hashtype(struct cs_blob const *); |
| | 117 | unsigned int csblob_get_signer_type(struct cs_blob *); |
| | 118 | #if DEVELOPMENT || DEBUG |
| | 119 | void csproc_clear_platform_binary(struct proc *); |
| | 120 | #endif |
| | 121 | |
| | 122 | void csproc_disable_enforcement(struct proc* p); |
| | 123 | void csproc_mark_invalid_allowed(struct proc* p); |
| | 124 | int csproc_check_invalid_allowed(struct proc* p); |
| | 125 | int csproc_hardened_runtime(struct proc* p); |
| | 126 | |
| | 127 | int csblob_get_entitlements(struct cs_blob *, void **, size_t *); |
| | 128 | |
| | 129 | const CS_GenericBlob * |
| | 130 | csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); |
| | 131 | const CS_GenericBlob * |
| | 132 | csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); |
| | 133 | void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); |
| | 134 | void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); |
| | 135 | |
| | 136 | /* |
| | 137 | * Mostly convenience functions below |
| | 138 | */ |
| | 139 | |
| | 140 | const char * csproc_get_teamid(struct proc *); |
| | 141 | const char * csvnode_get_teamid(struct vnode *, off_t); |
| | 142 | int csproc_get_platform_binary(struct proc *); |
| | 143 | int csproc_get_prod_signed(struct proc *); |
| | 144 | const char * csfg_get_teamid(struct fileglob *); |
| | 145 | int csfg_get_path(struct fileglob *, char *, int *); |
| | 146 | int csfg_get_platform_binary(struct fileglob *); |
| | 147 | uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); |
| | 148 | int csfg_get_prod_signed(struct fileglob *); |
| | 149 | unsigned int csfg_get_signer_type(struct fileglob *); |
| | 150 | const char *csfg_get_identity(struct fileglob *fg, off_t offset); |
| | 151 | unsigned int csproc_get_signer_type(struct proc *); |
| | 152 | |
| | 153 | uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); |
| | 154 | uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); |
| | 155 | uint8_t csproc_get_platform_identifier(struct proc *); |
| | 156 | |
| | 157 | extern int cs_debug; |
| | 158 | extern int cs_debug_fail_on_unsigned_code; |
| | 159 | extern unsigned int cs_debug_unsigned_exec_failures; |
| | 160 | extern unsigned int cs_debug_unsigned_mmap_failures; |
| | 161 | |
| | 162 | int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, |
| | 163 | struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); |
| | 164 | |
| | 165 | void cs_blob_free(struct cs_blob *blob); |
| | 166 | |
| | 167 | #ifdef XNU_KERNEL_PRIVATE |
| | 168 | |
| | 169 | void cs_init(void); |
| | 170 | int cs_allow_invalid(struct proc *); |
| | 171 | int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); |
| | 172 | int csproc_get_platform_path(struct proc *); |
| | 173 | |
| | 174 | #if !SECURE_KERNEL |
| | 175 | extern int cs_enforcement_panic; |
| | 176 | #endif |
| | 177 | |
| | 178 | #endif /* XNU_KERNEL_PRIVATE */ |
| | 179 | |
| | 180 | |
| | 181 | __END_DECLS |
| | 182 | |
| | 183 | |
| | 184 | |
| | 185 | #endif /* KERNEL */ |
| | 186 | |
| | 187 | #endif /* _SYS_CODESIGN_H_ */ |
projects / apple / xnu.git / blame_incremental