security/mac_mach.c

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <mach/exception_types.h>
  30 #include <mach/mach_types.h>
  31 #include <osfmk/kern/exception.h>
  32 #include <osfmk/kern/task.h>
  33 #include <sys/codesign.h>
  34 #include <sys/param.h>
  35 #include <sys/user.h>
  36 #include <sys/proc.h>
  37 #include <sys/proc_internal.h>
  38 #include <sys/kauth.h>
  39 #include <kern/task.h>
  40
  41 #include <security/mac_framework.h>
  42 #include <security/mac_internal.h>
  43 #include <security/mac_mach_internal.h>
  44
  45 #if CONFIG_CSR
  46 #include <sys/csr.h>
  47 // Panic on internal builds, just log otherwise.
  48 #define MAC_MACH_UNEXPECTED(fmt...) \
  49         if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
  50 #else
  51 #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
  52 #endif
  53
  54 static struct proc *
  55 mac_task_get_proc(struct task *task)
  56 {
  57         if (task == current_task()) {
  58                 return proc_self();
  59         }
  60
  61         /*
  62          * Tasks don't really hold a reference on a proc unless the
  63          * calling thread belongs to the task in question.
  64          */
  65         int pid = task_pid(task);
  66         struct proc *p = proc_find(pid);
  67
  68         if (p != NULL) {
  69                 if (proc_task(p) == task) {
  70                         return p;
  71                 }
  72                 proc_rele(p);
  73         }
  74         return NULL;
  75 }
  76
  77 int
  78 mac_task_check_expose_task(struct task *task)
  79 {
  80         int error;
  81
  82         struct proc *p = mac_task_get_proc(task);
  83         if (p == NULL) {
  84                 return ESRCH;
  85         }
  86
  87         struct ucred *cred = kauth_cred_get();
  88         MAC_CHECK(proc_check_expose_task, cred, p);
  89         proc_rele(p);
  90         return error;
  91 }
  92
  93 int
  94 mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
  95 {
  96         int error;
  97
  98         struct proc *p = mac_task_get_proc(task);
  99         if (p == NULL) {
 100                 return ESRCH;
 101         }
 102
 103         kauth_cred_t cred = kauth_cred_proc_ref(p);
 104         MAC_CHECK(proc_check_set_host_special_port, cred, id, port);
 105         kauth_cred_unref(&cred);
 106         proc_rele(p);
 107         return error;
 108 }
 109
 110 int
 111 mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
 112 {
 113         int error;
 114
 115         struct proc *p = mac_task_get_proc(task);
 116         if (p == NULL) {
 117                 return ESRCH;
 118         }
 119
 120         kauth_cred_t cred = kauth_cred_proc_ref(p);
 121         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 122         kauth_cred_unref(&cred);
 123         proc_rele(p);
 124         return error;
 125 }
 126
 127 int
 128 mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
 129 {
 130         int error = 0;
 131         int exception;
 132
 133         struct proc *p = mac_task_get_proc(task);
 134         if (p == NULL) {
 135                 return ESRCH;
 136         }
 137
 138         kauth_cred_t cred = kauth_cred_proc_ref(p);
 139         for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
 140                 if (exception_mask & (1 << exception)) {
 141                         MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
 142                         if (error) {
 143                                 break;
 144                         }
 145                 }
 146         }
 147         kauth_cred_unref(&cred);
 148         proc_rele(p);
 149         return error;
 150 }
 151
 152 void
 153 mac_thread_userret(struct thread *td)
 154 {
 155         MAC_PERFORM(thread_userret, td);
 156 }
 157
 158 void
 159 mac_proc_notify_exec_complete(struct proc *proc)
 160 {
 161         thread_t thread = current_thread();
 162
 163         /*
 164          * Since this MAC hook was designed to support upcalls, make sure the hook
 165          * is called with kernel importance propagation enabled so any daemons
 166          * can get any appropriate importance donations.
 167          */
 168         thread_enable_send_importance(thread, TRUE);
 169         MAC_PERFORM(proc_notify_exec_complete, proc);
 170         thread_enable_send_importance(thread, FALSE);
 171 }
 172
 173 /**** Exception Policy
 174  *
 175  * Note that the functions below do not fully follow the usual convention for mac policy functions
 176  * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
 177  * policy function names, we diverge because the exception policy is somewhat special:
 178  * It is used in places where allocation and association must be separate, and its labels do not
 179  * only belong to one type of object as usual, but to two (on exception actions and on tasks as
 180  * crash labels).
 181  */
 182
 183 // Label allocation and deallocation, may sleep.
 184
 185 struct label *
 186 mac_exc_create_label(void)
 187 {
 188         struct label *label = mac_labelzone_alloc(MAC_WAITOK);
 189
 190         if (label == NULL) {
 191                 return NULL;
 192         }
 193
 194         // Policy initialization of the label, typically performs allocations as well.
 195         // (Unless the policy's full data really fits into a pointer size.)
 196         MAC_PERFORM(exc_action_label_init, label);
 197
 198         return label;
 199 }
 200
 201 void
 202 mac_exc_free_label(struct label *label)
 203 {
 204         MAC_PERFORM(exc_action_label_destroy, label);
 205         mac_labelzone_free(label);
 206 }
 207
 208 // Action label initialization and teardown, may sleep.
 209
 210 void
 211 mac_exc_associate_action_label(struct exception_action *action, struct label *label)
 212 {
 213         action->label = label;
 214         MAC_PERFORM(exc_action_label_associate, action, action->label);
 215 }
 216
 217 void
 218 mac_exc_free_action_label(struct exception_action *action)
 219 {
 220         mac_exc_free_label(action->label);
 221         action->label = NULL;
 222 }
 223
 224 // Action label update and inheritance, may NOT sleep and must be quick.
 225
 226 int
 227 mac_exc_update_action_label(struct exception_action *action,
 228     struct label *newlabel)
 229 {
 230         int error;
 231
 232         MAC_CHECK(exc_action_label_update, action, action->label, newlabel);
 233
 234         return error;
 235 }
 236
 237 int
 238 mac_exc_inherit_action_label(struct exception_action *parent,
 239     struct exception_action *child)
 240 {
 241         return mac_exc_update_action_label(child, parent->label);
 242 }
 243
 244 int
 245 mac_exc_update_task_crash_label(struct task *task, struct label *label)
 246 {
 247         int error;
 248
 249         assert(task != kernel_task);
 250
 251         struct label *crash_label = get_task_crash_label(task);
 252
 253         MAC_CHECK(exc_action_label_update, NULL, crash_label, label);
 254
 255         return error;
 256 }
 257
 258 // Process label creation, may sleep.
 259
 260 struct label *
 261 mac_exc_create_label_for_proc(struct proc *proc)
 262 {
 263         struct label *label = mac_exc_create_label();
 264         MAC_PERFORM(exc_action_label_populate, label, proc);
 265         return label;
 266 }
 267
 268 struct label *
 269 mac_exc_create_label_for_current_proc(void)
 270 {
 271         return mac_exc_create_label_for_proc(current_proc());
 272 }
 273
 274 // Exception handler policy checking, may sleep.
 275
 276 int
 277 mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
 278 {
 279         int error = 0;
 280
 281         struct proc *p = get_bsdtask_info(victim_task);
 282         struct label *bsd_label = NULL;
 283         struct label *label = NULL;
 284
 285         if (p != NULL) {
 286                 // Create a label from the still existing bsd process...
 287                 label = bsd_label = mac_exc_create_label_for_proc(p);
 288         } else {
 289                 // ... otherwise use the crash label on the task.
 290                 label = get_task_crash_label(victim_task);
 291         }
 292
 293         if (label == NULL) {
 294                 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
 295                 return EPERM;
 296         }
 297
 298         MAC_CHECK(exc_action_check_exception_send, label, action, action->label);
 299
 300         if (bsd_label != NULL) {
 301                 mac_exc_free_label(bsd_label);
 302         }
 303
 304         return error;
 305 }