security/mac_mach.c

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <mach/exception_types.h>
  30 #include <mach/mach_types.h>
  31 #include <osfmk/kern/exception.h>
  32 #include <osfmk/kern/task.h>
  33 #include <sys/codesign.h>
  34 #include <sys/param.h>
  35 #include <sys/user.h>
  36 #include <sys/proc.h>
  37 #include <sys/proc_internal.h>
  38 #include <sys/kauth.h>
  39 #include <kern/task.h>
  40
  41 #include <security/mac_framework.h>
  42 #include <security/mac_internal.h>
  43 #include <security/mac_mach_internal.h>
  44
  45 #if CONFIG_CSR
  46 #include <sys/csr.h>
  47 // Panic on internal builds, just log otherwise.
  48 #define MAC_MACH_UNEXPECTED(fmt...) \
  49         if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
  50 #else
  51 #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
  52 #endif
  53
  54 static struct proc *
  55 mac_task_get_proc(struct task *task)
  56 {
  57         if (task == current_task())
  58                 return proc_self();
  59
  60         /*
  61          * Tasks don't really hold a reference on a proc unless the
  62          * calling thread belongs to the task in question.
  63          */
  64         int pid = task_pid(task);
  65         struct proc *p = proc_find(pid);
  66
  67         if (p != NULL) {
  68                 if (proc_task(p) == task)
  69                         return p;
  70                 proc_rele(p);
  71         }
  72         return NULL;
  73 }
  74
  75 int
  76 mac_task_check_expose_task(struct task *task)
  77 {
  78         int error;
  79
  80         struct proc *p = mac_task_get_proc(task);
  81         if (p == NULL)
  82                 return ESRCH;
  83
  84         struct ucred *cred = kauth_cred_get();
  85         MAC_CHECK(proc_check_expose_task, cred, p);
  86         proc_rele(p);
  87         return (error);
  88 }
  89
  90 int
  91 mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
  92 {
  93         int error;
  94
  95         struct proc *p = mac_task_get_proc(task);
  96         if (p == NULL)
  97                 return ESRCH;
  98
  99         kauth_cred_t cred = kauth_cred_proc_ref(p);
 100         MAC_CHECK(proc_check_set_host_special_port, cred, id, port);
 101         kauth_cred_unref(&cred);
 102         proc_rele(p);
 103         return (error);
 104 }
 105
 106 int
 107 mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
 108 {
 109         int error;
 110
 111         struct proc *p = mac_task_get_proc(task);
 112         if (p == NULL)
 113                 return ESRCH;
 114
 115         kauth_cred_t cred = kauth_cred_proc_ref(p);
 116         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 117         kauth_cred_unref(&cred);
 118         proc_rele(p);
 119         return (error);
 120 }
 121
 122 int
 123 mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
 124 {
 125         int error = 0;
 126         int exception;
 127
 128         struct proc *p = mac_task_get_proc(task);
 129         if (p == NULL)
 130                 return ESRCH;
 131
 132         kauth_cred_t cred = kauth_cred_proc_ref(p);
 133         for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
 134                 if (exception_mask & (1 << exception)) {
 135                         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 136                         if (error)
 137                                 break;
 138                 }
 139         }
 140         kauth_cred_unref(&cred);
 141         proc_rele(p);
 142         return (error);
 143 }
 144
 145 void
 146 mac_thread_userret(struct thread *td)
 147 {
 148
 149         MAC_PERFORM(thread_userret, td);
 150 }
 151
 152 static struct label *
 153 mac_exc_action_label_alloc(void)
 154 {
 155         struct label *label = mac_labelzone_alloc(MAC_WAITOK);
 156
 157         MAC_PERFORM(exc_action_label_init, label);
 158         return label;
 159 }
 160
 161 static void
 162 mac_exc_action_label_free(struct label *label)
 163 {
 164         MAC_PERFORM(exc_action_label_destroy, label);
 165         mac_labelzone_free(label);
 166 }
 167
 168 void
 169 mac_exc_action_label_init(struct exception_action *action)
 170 {
 171         action->label = mac_exc_action_label_alloc();
 172         MAC_PERFORM(exc_action_label_associate, action, action->label);
 173 }
 174
 175 void
 176 mac_exc_action_label_inherit(struct exception_action *parent, struct exception_action *child)
 177 {
 178         mac_exc_action_label_init(child);
 179         MAC_PERFORM(exc_action_label_copy, parent->label, child->label);
 180 }
 181
 182 void
 183 mac_exc_action_label_destroy(struct exception_action *action)
 184 {
 185         struct label *label = action->label;
 186         action->label = NULL;
 187         mac_exc_action_label_free(label);
 188 }
 189
 190 int mac_exc_action_label_update(struct task *task, struct exception_action *action) {
 191         if (task == kernel_task) {
 192                 // The kernel may set exception ports without any check.
 193                 return 0;
 194         }
 195
 196         struct proc *p = mac_task_get_proc(task);
 197         if (p == NULL)
 198                 return ESRCH;
 199
 200         MAC_PERFORM(exc_action_label_update, p, action->label);
 201         proc_rele(p);
 202         return 0;
 203 }
 204
 205 void mac_exc_action_label_reset(struct exception_action *action) {
 206         struct label *old_label = action->label;
 207         mac_exc_action_label_init(action);
 208         mac_exc_action_label_free(old_label);
 209 }
 210
 211 void mac_exc_action_label_task_update(struct task *task, struct proc *proc) {
 212         if (get_task_crash_label(task) != NULL) {
 213                 MAC_MACH_UNEXPECTED("task already has a crash_label attached to it");
 214                 return;
 215         }
 216
 217         struct label *label = mac_exc_action_label_alloc();
 218         MAC_PERFORM(exc_action_label_update, proc, label);
 219         set_task_crash_label(task, label);
 220 }
 221
 222 void mac_exc_action_label_task_destroy(struct task *task) {
 223         mac_exc_action_label_free(get_task_crash_label(task));
 224         set_task_crash_label(task, NULL);
 225 }
 226
 227 int
 228 mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
 229 {
 230         int error = 0;
 231
 232         struct proc *p = get_bsdtask_info(victim_task);
 233         struct label *bsd_label = NULL;
 234         struct label *label = NULL;
 235
 236         if (p != NULL) {
 237                 // Create a label from the still existing bsd process...
 238                 label = bsd_label = mac_exc_action_label_alloc();
 239                 MAC_PERFORM(exc_action_label_update, p, bsd_label);
 240         } else {
 241                 // ... otherwise use the crash label on the task.
 242                 label = get_task_crash_label(victim_task);
 243         }
 244
 245         if (label == NULL) {
 246                 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for proc %p", p);
 247                 return EPERM;
 248         }
 249
 250         MAC_CHECK(exc_action_check_exception_send, label, action, action->label);
 251
 252         if (bsd_label != NULL) {
 253                 mac_exc_action_label_free(bsd_label);
 254         }
 255
 256         return (error);
 257 }