security/mac_mach.c

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <mach/exception_types.h>
  30 #include <mach/mach_types.h>
  31 #include <osfmk/kern/exception.h>
  32 #include <osfmk/kern/task.h>
  33 #include <sys/codesign.h>
  34 #include <sys/param.h>
  35 #include <sys/user.h>
  36 #include <sys/proc.h>
  37 #include <sys/proc_internal.h>
  38 #include <sys/kauth.h>
  39 #include <kern/task.h>
  40
  41 #include <security/mac_framework.h>
  42 #include <security/mac_internal.h>
  43 #include <security/mac_mach_internal.h>
  44
  45 #if CONFIG_CSR
  46 #include <sys/csr.h>
  47 // Panic on internal builds, just log otherwise.
  48 #define MAC_MACH_UNEXPECTED(fmt...) \
  49         if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
  50 #else
  51 #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
  52 #endif
  53
  54 static struct proc *
  55 mac_task_get_proc(struct task *task)
  56 {
  57         if (task == current_task()) {
  58                 return proc_self();
  59         }
  60
  61         /*
  62          * Tasks don't really hold a reference on a proc unless the
  63          * calling thread belongs to the task in question.
  64          */
  65         int pid = task_pid(task);
  66         struct proc *p = proc_find(pid);
  67
  68         if (p != NULL) {
  69                 if (proc_task(p) == task) {
  70                         return p;
  71                 }
  72                 proc_rele(p);
  73         }
  74         return NULL;
  75 }
  76
  77 int
  78 mac_task_check_expose_task(struct task *task)
  79 {
  80         int error;
  81
  82         struct proc *p = mac_task_get_proc(task);
  83         if (p == NULL) {
  84                 return ESRCH;
  85         }
  86         struct proc_ident pident = proc_ident(p);
  87
  88         struct ucred *cred = kauth_cred_get();
  89         proc_rele(p);
  90         MAC_CHECK(proc_check_expose_task, cred, &pident);
  91         return error;
  92 }
  93
  94 int
  95 mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
  96 {
  97         int error;
  98
  99         struct proc *p = mac_task_get_proc(task);
 100         if (p == NULL) {
 101                 return ESRCH;
 102         }
 103
 104         kauth_cred_t cred = kauth_cred_proc_ref(p);
 105         MAC_CHECK(proc_check_set_host_special_port, cred, id, port);
 106         kauth_cred_unref(&cred);
 107         proc_rele(p);
 108         return error;
 109 }
 110
 111 int
 112 mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
 113 {
 114         int error;
 115
 116         struct proc *p = mac_task_get_proc(task);
 117         if (p == NULL) {
 118                 return ESRCH;
 119         }
 120
 121         kauth_cred_t cred = kauth_cred_proc_ref(p);
 122         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 123         kauth_cred_unref(&cred);
 124         proc_rele(p);
 125         return error;
 126 }
 127
 128 int
 129 mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
 130 {
 131         int error = 0;
 132         int exception;
 133
 134         struct proc *p = mac_task_get_proc(task);
 135         if (p == NULL) {
 136                 return ESRCH;
 137         }
 138
 139         kauth_cred_t cred = kauth_cred_proc_ref(p);
 140         for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
 141                 if (exception_mask & (1 << exception)) {
 142                         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 143                         if (error) {
 144                                 break;
 145                         }
 146                 }
 147         }
 148         kauth_cred_unref(&cred);
 149         proc_rele(p);
 150         return error;
 151 }
 152
 153 void
 154 mac_thread_userret(struct thread *td)
 155 {
 156         MAC_PERFORM(thread_userret, td);
 157 }
 158
 159 void
 160 mac_proc_notify_exec_complete(struct proc *proc)
 161 {
 162         thread_t thread = current_thread();
 163
 164         /*
 165          * Since this MAC hook was designed to support upcalls, make sure the hook
 166          * is called with kernel importance propagation enabled so any daemons
 167          * can get any appropriate importance donations.
 168          */
 169         thread_enable_send_importance(thread, TRUE);
 170         MAC_PERFORM(proc_notify_exec_complete, proc);
 171         thread_enable_send_importance(thread, FALSE);
 172 }
 173
 174 /**** Exception Policy
 175  *
 176  * Note that the functions below do not fully follow the usual convention for mac policy functions
 177  * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
 178  * policy function names, we diverge because the exception policy is somewhat special:
 179  * It is used in places where allocation and association must be separate, and its labels do not
 180  * only belong to one type of object as usual, but to two (on exception actions and on tasks as
 181  * crash labels).
 182  */
 183
 184 // Label allocation and deallocation, may sleep.
 185
 186 struct label *
 187 mac_exc_create_label(void)
 188 {
 189         struct label *label = mac_labelzone_alloc(MAC_WAITOK);
 190
 191         if (label == NULL) {
 192                 return NULL;
 193         }
 194
 195         // Policy initialization of the label, typically performs allocations as well.
 196         // (Unless the policy's full data really fits into a pointer size.)
 197         MAC_PERFORM(exc_action_label_init, label);
 198
 199         return label;
 200 }
 201
 202 void
 203 mac_exc_free_label(struct label *label)
 204 {
 205         MAC_PERFORM(exc_action_label_destroy, label);
 206         mac_labelzone_free(label);
 207 }
 208
 209 // Action label initialization and teardown, may sleep.
 210
 211 void
 212 mac_exc_associate_action_label(struct exception_action *action, struct label *label)
 213 {
 214         action->label = label;
 215         MAC_PERFORM(exc_action_label_associate, action, action->label);
 216 }
 217
 218 void
 219 mac_exc_free_action_label(struct exception_action *action)
 220 {
 221         mac_exc_free_label(action->label);
 222         action->label = NULL;
 223 }
 224
 225 // Action label update and inheritance, may NOT sleep and must be quick.
 226
 227 int
 228 mac_exc_update_action_label(struct exception_action *action,
 229     struct label *newlabel)
 230 {
 231         int error;
 232
 233         MAC_CHECK(exc_action_label_update, action, action->label, newlabel);
 234
 235         return error;
 236 }
 237
 238 int
 239 mac_exc_inherit_action_label(struct exception_action *parent,
 240     struct exception_action *child)
 241 {
 242         return mac_exc_update_action_label(child, parent->label);
 243 }
 244
 245 int
 246 mac_exc_update_task_crash_label(struct task *task, struct label *label)
 247 {
 248         int error;
 249
 250         assert(task != kernel_task);
 251
 252         struct label *crash_label = get_task_crash_label(task);
 253
 254         MAC_CHECK(exc_action_label_update, NULL, crash_label, label);
 255
 256         return error;
 257 }
 258
 259 // Process label creation, may sleep.
 260
 261 struct label *
 262 mac_exc_create_label_for_proc(struct proc *proc)
 263 {
 264         struct label *label = mac_exc_create_label();
 265         MAC_PERFORM(exc_action_label_populate, label, proc);
 266         return label;
 267 }
 268
 269 struct label *
 270 mac_exc_create_label_for_current_proc(void)
 271 {
 272         return mac_exc_create_label_for_proc(current_proc());
 273 }
 274
 275 // Exception handler policy checking, may sleep.
 276
 277 int
 278 mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
 279 {
 280         int error = 0;
 281
 282         struct proc *p = get_bsdtask_info(victim_task);
 283         struct label *bsd_label = NULL;
 284         struct label *label = NULL;
 285
 286         if (p != NULL) {
 287                 // Create a label from the still existing bsd process...
 288                 label = bsd_label = mac_exc_create_label_for_proc(p);
 289         } else {
 290                 // ... otherwise use the crash label on the task.
 291                 label = get_task_crash_label(victim_task);
 292         }
 293
 294         if (label == NULL) {
 295                 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
 296                 return EPERM;
 297         }
 298
 299         MAC_CHECK(exc_action_check_exception_send, label, action, action->label);
 300
 301         if (bsd_label != NULL) {
 302                 mac_exc_free_label(bsd_label);
 303         }
 304
 305         return error;
 306 }