xnu-7195.81.3.tar.gz

[apple/xnu.git] / bsd / kern / kern_persona.c

/*
 * Copyright (c) 2015-2020 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
#include <sys/kernel.h>
#include <sys/kernel_types.h>
#include <sys/persona.h>
#include <pexpert/pexpert.h>

#if CONFIG_PERSONAS
#include <machine/atomic.h>

#include <kern/assert.h>
#include <kern/simple_lock.h>
#include <kern/task.h>
#include <kern/zalloc.h>
#include <mach/thread_act.h>
#include <kern/thread.h>

#include <sys/param.h>
#include <sys/proc_internal.h>
#include <sys/kauth.h>
#include <sys/proc_info.h>
#include <sys/resourcevar.h>

#include <os/log.h>
#define pna_err(fmt, ...) \
        os_log_error(OS_LOG_DEFAULT, "ERROR: " fmt, ## __VA_ARGS__)

#define MAX_PERSONAS     512

#define TEMP_PERSONA_ID  499

#define FIRST_PERSONA_ID 501
#define PERSONA_ID_STEP   10

#define PERSONA_ALLOC_TOKEN   (0x7a0000ae)
#define PERSONA_INIT_TOKEN    (0x7500005e)
#define PERSONA_MAGIC         (0x0aa55aa0)
#define persona_initialized(p) ((p)->pna_valid == PERSONA_MAGIC || (p)->pna_valid == PERSONA_INIT_TOKEN)
#define persona_valid(p)      ((p)->pna_valid == PERSONA_MAGIC)
#define persona_mkinvalid(p)  ((p)->pna_valid = ~(PERSONA_MAGIC))

static LIST_HEAD(personalist, persona) all_personas;
static uint32_t g_total_personas;
const uint32_t g_max_personas = MAX_PERSONAS;
struct persona *system_persona = NULL;
struct persona *proxy_system_persona = NULL;
#if !defined(XNU_TARGET_OS_OSX)
int unique_persona = 1;
#else
int unique_persona = 0;
#endif

static uid_t g_next_persona_id;

LCK_GRP_DECLARE(persona_lck_grp, "personas");
LCK_MTX_DECLARE(all_personas_lock, &persona_lck_grp);

os_refgrp_decl(static, persona_refgrp, "persona", NULL);

static ZONE_DECLARE(persona_zone, "personas", sizeof(struct persona), ZC_ZFREE_CLEARMEM);

kauth_cred_t g_default_persona_cred;
extern struct auditinfo_addr * const audit_default_aia_p;

#define lock_personas()    lck_mtx_lock(&all_personas_lock)
#define unlock_personas()  lck_mtx_unlock(&all_personas_lock)

extern void mach_kauth_cred_uthread_update(void);

extern kern_return_t bank_get_bank_ledger_thread_group_and_persona(void *voucher,
    void *bankledger, void **banktg, uint32_t *persona_id);
void
ipc_voucher_release(void *voucher);

void
personas_bootstrap(void)
{
        struct posix_cred pcred;
        int unique_persona_bootarg;

        persona_dbg("Initializing persona subsystem");
        LIST_INIT(&all_personas);
        g_total_personas = 0;

        g_next_persona_id = FIRST_PERSONA_ID;

        /*
         * setup the default credentials that a persona temporarily
         * inherits (to work around kauth APIs)
         */
        bzero(&pcred, sizeof(pcred));
        pcred.cr_uid = pcred.cr_ruid = pcred.cr_svuid = TEMP_PERSONA_ID;
        pcred.cr_rgid = pcred.cr_svgid = TEMP_PERSONA_ID;
        pcred.cr_groups[0] = TEMP_PERSONA_ID;
        pcred.cr_ngroups = 1;
        pcred.cr_flags = CRF_NOMEMBERD;
        pcred.cr_gmuid = KAUTH_UID_NONE;

        g_default_persona_cred = posix_cred_create(&pcred);
        if (!g_default_persona_cred) {
                panic("couldn't create default persona credentials!");
        }
#if CONFIG_AUDIT
        /* posix_cred_create() sets this value to NULL */
        g_default_persona_cred->cr_audit.as_aia_p = audit_default_aia_p;
#endif
        if (PE_parse_boot_argn("unique_persona", &unique_persona_bootarg, sizeof(unique_persona_bootarg))) {
                unique_persona = !!unique_persona_bootarg;
        }
}

struct persona *
persona_alloc(uid_t id, const char *login, persona_type_t type, char *path, int *error)
{
        struct persona *persona;
        int err = 0;

        if (!login) {
                pna_err("Must provide a login name for a new persona!");
                if (error) {
                        *error = EINVAL;
                }
                return NULL;
        }

        if (type <= PERSONA_INVALID || type > PERSONA_TYPE_MAX) {
                pna_err("Invalid type: %d", type);
                if (error) {
                        *error = EINVAL;
                }
                return NULL;
        }

        persona = (struct persona *)zalloc(persona_zone);
        if (!persona) {
                if (error) {
                        *error = ENOMEM;
                }
                return NULL;
        }

        bzero(persona, sizeof(*persona));

        if (os_atomic_inc(&g_total_personas, relaxed) > MAX_PERSONAS) {
                /* too many personas! */
                pna_err("too many active personas!");
                err = EBUSY;
                goto out_error;
        }

        strncpy(persona->pna_login, login, sizeof(persona->pna_login) - 1);
        persona_dbg("Starting persona allocation for: '%s'", persona->pna_login);

        LIST_INIT(&persona->pna_members);
        lck_mtx_init(&persona->pna_lock, &persona_lck_grp, LCK_ATTR_NULL);
        os_ref_init(&persona->pna_refcount, &persona_refgrp);

        /*
         * Setup initial (temporary) kauth_cred structure
         * We need to do this here because all kauth calls require
         * an existing cred structure.
         */
        persona->pna_cred = kauth_cred_create(g_default_persona_cred);
        if (!persona->pna_cred) {
                pna_err("could not copy initial credentials!");
                err = EIO;
                goto out_error;
        }

        persona->pna_type = type;
        persona->pna_id = id;
        persona->pna_valid = PERSONA_ALLOC_TOKEN;
        persona->pna_path = path;

        /*
         * NOTE: this persona has not been fully initialized. A subsequent
         * call to persona_init_begin() followed by persona_init_end() will make
         * the persona visible to the rest of the system.
         */
        if (error) {
                *error = 0;
        }
        return persona;

out_error:
        os_atomic_dec(&g_total_personas, relaxed);
        zfree(persona_zone, persona);
        if (error) {
                *error = err;
        }
        return NULL;
}

/**
 * persona_init_begin
 *
 * This function begins initialization of a persona. It first acquires the
 * global persona list lock via lock_personas(), then selects an appropriate
 * persona ID and sets up the persona's credentials. This function *must* be
 * followed by a call to persona_init_end() which will mark the persona
 * structure as valid
 *
 * Conditions:
 *      persona has been allocated via persona_alloc()
 *      nothing locked
 *
 * Returns:
 *      global persona list is locked (even on error)
 */
int
persona_init_begin(struct persona *persona)
{
        struct persona *tmp;
        int err = 0;
        kauth_cred_t tmp_cred;
        gid_t new_group;
        uid_t id;

        if (!persona || (persona->pna_valid != PERSONA_ALLOC_TOKEN)) {
                return EINVAL;
        }

        id = persona->pna_id;

        lock_personas();
try_again:
        if (id == PERSONA_ID_NONE) {
                persona->pna_id = g_next_persona_id;
        }

        persona_dbg("Beginning Initialization of %d:%d (%s)...", id, persona->pna_id, persona->pna_login);

        err = 0;
        LIST_FOREACH(tmp, &all_personas, pna_list) {
                persona_lock(tmp);
                if (id == PERSONA_ID_NONE && tmp->pna_id == persona->pna_id) {
                        persona_unlock(tmp);
                        /*
                         * someone else manually claimed this ID, and we're
                         * trying to allocate an ID for the caller: try again
                         */
                        g_next_persona_id += PERSONA_ID_STEP;
                        goto try_again;
                }
                if (strncmp(tmp->pna_login, persona->pna_login, sizeof(tmp->pna_login)) == 0 ||
                    tmp->pna_id == persona->pna_id) {
                        persona_unlock(tmp);
                        /*
                         * Disallow use of identical login names and re-use
                         * of previously allocated persona IDs
                         */
                        err = EEXIST;
                        break;
                }
                persona_unlock(tmp);
        }
        if (err) {
                goto out;
        }

        /* ensure the cred has proper UID/GID defaults */
        kauth_cred_ref(persona->pna_cred);
        tmp_cred = kauth_cred_setuidgid(persona->pna_cred,
            persona->pna_id,
            persona->pna_id);
        kauth_cred_unref(&persona->pna_cred);
        if (tmp_cred != persona->pna_cred) {
                persona->pna_cred = tmp_cred;
        }

        if (!persona->pna_cred) {
                err = EACCES;
                goto out;
        }

        /* it should be a member of exactly 1 group (equal to its UID) */
        new_group = (gid_t)persona->pna_id;

        kauth_cred_ref(persona->pna_cred);
        /* opt _out_ of memberd as a default */
        tmp_cred = kauth_cred_setgroups(persona->pna_cred,
            &new_group, 1, KAUTH_UID_NONE);
        kauth_cred_unref(&persona->pna_cred);
        if (tmp_cred != persona->pna_cred) {
                persona->pna_cred = tmp_cred;
        }

        if (!persona->pna_cred) {
                err = EACCES;
                goto out;
        }

        /* if the kernel supplied the persona ID, increment for next time */
        if (id == PERSONA_ID_NONE) {
                g_next_persona_id += PERSONA_ID_STEP;
        }

        persona->pna_valid = PERSONA_INIT_TOKEN;

out:
        if (err != 0) {
                persona_dbg("ERROR:%d while initializing %d:%d (%s)...", err, id, persona->pna_id, persona->pna_login);
                /*
                 * mark the persona with an error so that persona_init_end()
                 * will *not* add it to the global list.
                 */
                persona->pna_id = PERSONA_ID_NONE;
        }

        /*
         * leave the global persona list locked: it will be
         * unlocked in a call to persona_init_end()
         */
        return err;
}

/**
 * persona_init_end
 *
 * This function finalizes the persona initialization by marking it valid and
 * adding it to the global list of personas. After unlocking the global list,
 * the persona will be visible to the reset of the system. The function will
 * only mark the persona valid if the input parameter 'error' is 0.
 *
 * Conditions:
 *      persona is initialized via persona_init_begin()
 *      global persona list is locked via lock_personas()
 *
 * Returns:
 *      global persona list is unlocked
 */
void
persona_init_end(struct persona *persona, int error)
{
        if (persona == NULL) {
                return;
        }

        /*
         * If the pna_valid member is set to the INIT_TOKEN value, then it has
         * successfully gone through persona_init_begin(), and we can mark it
         * valid and make it visible to the rest of the system. However, if
         * there was an error either during initialization or otherwise, we
         * need to decrement the global count of personas because this one
         * will be disposed-of by the callers invocation of persona_put().
         */
        if (error != 0 || persona->pna_valid == PERSONA_ALLOC_TOKEN) {
                persona_dbg("ERROR:%d after initialization of %d (%s)", error, persona->pna_id, persona->pna_login);
                /* remove this persona from the global count */
                os_atomic_dec(&g_total_personas, relaxed);
        } else if (error == 0 &&
            persona->pna_valid == PERSONA_INIT_TOKEN) {
                persona->pna_valid = PERSONA_MAGIC;
                LIST_INSERT_HEAD(&all_personas, persona, pna_list);
                persona_dbg("Initialization of %d (%s) Complete.", persona->pna_id, persona->pna_login);
        }

        unlock_personas();
}

/**
 * persona_verify_and_set_uniqueness
 *
 * This function checks the persona, if the one being spawned is of type
 * PERSONA_SYSTEM or PERSONA_SYSTEM_PROXY, is unique.
 *
 * Conditions:
 *      global persona list is locked on entry and return.
 *
 * Returns:
 *      EEXIST: if persona is system/system-proxy and is not unique.
 *      0: Otherwise.
 */
int
persona_verify_and_set_uniqueness(struct persona *persona)
{
        if (persona == NULL) {
                return EINVAL;
        }

        if (!unique_persona) {
                return 0;
        }

        if (persona->pna_type == PERSONA_SYSTEM) {
                if (system_persona != NULL) {
                        return EEXIST;
                }
                system_persona = persona;
                return 0;
        }

        if (persona->pna_type == PERSONA_SYSTEM_PROXY) {
                if (proxy_system_persona != NULL) {
                        return EEXIST;
                }
                proxy_system_persona = persona;
                return 0;
        }
        return 0;
}

/**
 * persona_is_unique
 *
 * This function checks if the persona spawned is unique.
 *
 * Returns:
 *      TRUE: if unique.
 *      FALSE: otherwise.
 */
boolean_t
persona_is_unique(struct persona *persona)
{
        if (persona == NULL) {
                return FALSE;
        }

        if (!unique_persona) {
                return FALSE;
        }

        if (persona->pna_type == PERSONA_SYSTEM ||
            persona->pna_type == PERSONA_SYSTEM_PROXY) {
                return TRUE;
        }

        return FALSE;
}

static struct persona *
persona_get_locked(struct persona *persona)
{
        os_ref_retain_locked(&persona->pna_refcount);
        return persona;
}

struct persona *
persona_get(struct persona *persona)
{
        struct persona *ret;
        if (!persona) {
                return NULL;
        }
        persona_lock(persona);
        ret = persona_get_locked(persona);
        persona_unlock(persona);

        return ret;
}

void
persona_put(struct persona *persona)
{
        int destroy = 0;

        if (!persona) {
                return;
        }

        persona_lock(persona);
        if (os_ref_release_locked(&persona->pna_refcount) == 0) {
                destroy = 1;
        }
        persona_unlock(persona);

        if (!destroy) {
                return;
        }

        persona_dbg("Destroying persona %s", persona_desc(persona, 0));

        /* release our credential reference */
        if (persona->pna_cred) {
                kauth_cred_unref(&persona->pna_cred);
        }

        /* remove it from the global list and decrement the count */
        lock_personas();
        persona_lock(persona);
        if (persona_valid(persona)) {
                LIST_REMOVE(persona, pna_list);
                if (os_atomic_dec_orig(&g_total_personas, relaxed) == 0) {
                        panic("persona count underflow!\n");
                }
                persona_mkinvalid(persona);
        }
        if (persona->pna_path != NULL) {
                zfree(ZV_NAMEI, persona->pna_path);
        }
        persona_unlock(persona);
        unlock_personas();

        assert(LIST_EMPTY(&persona->pna_members));
        memset(persona, 0, sizeof(*persona));
        zfree(persona_zone, persona);
}

uid_t
persona_get_id(struct persona *persona)
{
        if (persona) {
                return persona->pna_id;
        }
        return PERSONA_ID_NONE;
}

struct persona *
persona_lookup(uid_t id)
{
        struct persona *persona, *tmp;

        persona = NULL;

        /*
         * simple, linear lookup for now: there shouldn't be too many
         * of these in memory at any given time.
         */
        lock_personas();
        LIST_FOREACH(tmp, &all_personas, pna_list) {
                persona_lock(tmp);
                if (tmp->pna_id == id && persona_valid(tmp)) {
                        persona = persona_get_locked(tmp);
                        persona_unlock(tmp);
                        break;
                }
                persona_unlock(tmp);
        }
        unlock_personas();

        return persona;
}

struct persona *
persona_lookup_and_invalidate(uid_t id)
{
        struct persona *persona, *entry, *tmp;

        persona = NULL;

        lock_personas();
        LIST_FOREACH_SAFE(entry, &all_personas, pna_list, tmp) {
                persona_lock(entry);
                if (entry->pna_id == id) {
                        if (persona_valid(entry) && !persona_is_unique(entry)) {
                                persona = persona_get_locked(entry);
                                assert(persona != NULL);
                                LIST_REMOVE(persona, pna_list);
                                if (os_atomic_dec_orig(&g_total_personas, relaxed) == 0) {
                                        panic("persona ref count underflow!\n");
                                }
                                persona_mkinvalid(persona);
                        }
                        persona_unlock(entry);
                        break;
                }
                persona_unlock(entry);
        }
        unlock_personas();

        return persona;
}

int
persona_find_by_type(persona_type_t persona_type, struct persona **persona, size_t *plen)
{
        return persona_find_all(NULL, PERSONA_ID_NONE, persona_type, persona, plen);
}

int
persona_find(const char *login, uid_t uid,
    struct persona **persona, size_t *plen)
{
        return persona_find_all(login, uid, PERSONA_INVALID, persona, plen);
}

int
persona_find_all(const char *login, uid_t uid, persona_type_t persona_type,
    struct persona **persona, size_t *plen)
{
        struct persona *tmp;
        int match = 0;
        size_t found = 0;

        if (login) {
                match++;
        }
        if (uid != PERSONA_ID_NONE) {
                match++;
        }
        if ((persona_type > PERSONA_INVALID) && (persona_type <= PERSONA_TYPE_MAX)) {
                match++;
        } else if (persona_type != PERSONA_INVALID) {
                return EINVAL;
        }

        if (match == 0) {
                return EINVAL;
        }

        persona_dbg("Searching with %d parameters (l:\"%s\", u:%d)",
            match, login, uid);

        lock_personas();
        LIST_FOREACH(tmp, &all_personas, pna_list) {
                int m = 0;
                persona_lock(tmp);
                if (login && strncmp(tmp->pna_login, login, sizeof(tmp->pna_login)) == 0) {
                        m++;
                }
                if (uid != PERSONA_ID_NONE && uid == tmp->pna_id) {
                        m++;
                }
                if (persona_type != PERSONA_INVALID && persona_type == tmp->pna_type) {
                        m++;
                }
                if (m == match) {
                        if (persona && *plen > found) {
                                persona[found] = persona_get_locked(tmp);
                        }
                        found++;
                }
#ifdef PERSONA_DEBUG
                if (m > 0) {
                        persona_dbg("ID:%d Matched %d/%d, found:%d, *plen:%d",
                            tmp->pna_id, m, match, (int)found, (int)*plen);
                }
#endif
                persona_unlock(tmp);
        }
        unlock_personas();

        *plen = found;
        if (!found) {
                return ESRCH;
        }
        return 0;
}

struct persona *
persona_proc_get(pid_t pid)
{
        struct persona *persona;
        proc_t p = proc_find(pid);

        if (!p) {
                return NULL;
        }

        proc_lock(p);
        persona = persona_get(p->p_persona);
        proc_unlock(p);

        proc_rele(p);

        return persona;
}

struct persona *
current_persona_get(void)
{
        struct persona *persona = NULL;
        uid_t current_persona_id = PERSONA_ID_NONE;
        ipc_voucher_t voucher;

        thread_get_mach_voucher(current_thread(), 0, &voucher);
        /* returns a voucher ref */
        if (voucher != IPC_VOUCHER_NULL) {
                /*
                 * If the voucher doesn't contain a bank attribute, it uses
                 * the default bank task value to determine the persona id
                 * which is the same as the proc's persona id
                 */
                bank_get_bank_ledger_thread_group_and_persona(voucher, NULL,
                    NULL, &current_persona_id);
                ipc_voucher_release(voucher);
                persona = persona_lookup(current_persona_id);
        } else {
                /* Fallback - get the proc's persona */
                proc_t p = current_proc();
                proc_lock(p);
                persona = persona_get(p->p_persona);
                proc_unlock(p);
        }
        return persona;
}

/**
 * inherit a persona from parent to child
 */
int
persona_proc_inherit(proc_t child, proc_t parent)
{
        if (child->p_persona != NULL) {
                persona_dbg("proc_inherit: child already in persona: %s",
                    persona_desc(child->p_persona, 0));
                return -1;
        }

        /* no persona to inherit */
        if (parent->p_persona == NULL) {
                return 0;
        }

        return persona_proc_adopt(child, parent->p_persona, parent->p_ucred);
}

int
persona_proc_adopt_id(proc_t p, uid_t id, kauth_cred_t auth_override)
{
        int ret;
        struct persona *persona;

        persona = persona_lookup(id);
        if (!persona) {
                return ESRCH;
        }

        ret = persona_proc_adopt(p, persona, auth_override);

        /* put the reference from the lookup() */
        persona_put(persona);

        return ret;
}


typedef enum e_persona_reset_op {
        PROC_REMOVE_PERSONA = 1,
        PROC_RESET_OLD_PERSONA = 2,
} persona_reset_op_t;

/*
 * internal cleanup routine for proc_set_cred_internal
 *
 */
static struct persona *
proc_reset_persona_internal(proc_t p, persona_reset_op_t op,
    struct persona *old_persona,
    struct persona *new_persona)
{
#if (DEVELOPMENT || DEBUG)
        persona_lock_assert_held(new_persona);
#endif

        switch (op) {
        case PROC_REMOVE_PERSONA:
                old_persona = p->p_persona;
                OS_FALLTHROUGH;
        case PROC_RESET_OLD_PERSONA:
                break;
        default:
                /* invalid arguments */
                return NULL;
        }

        /* unlock the new persona (locked on entry) */
        persona_unlock(new_persona);
        /* lock the old persona and the process */
        assert(old_persona != NULL);
        persona_lock(old_persona);
        proc_lock(p);

        switch (op) {
        case PROC_REMOVE_PERSONA:
                LIST_REMOVE(p, p_persona_list);
                p->p_persona = NULL;
                break;
        case PROC_RESET_OLD_PERSONA:
                p->p_persona = old_persona;
                LIST_INSERT_HEAD(&old_persona->pna_members, p, p_persona_list);
                break;
        }

        proc_unlock(p);
        persona_unlock(old_persona);

        /* re-lock the new persona */
        persona_lock(new_persona);
        return old_persona;
}

/*
 * Assumes persona is locked.
 * On success, takes a reference to 'persona' and returns the
 * previous persona the process had adopted. The caller is
 * responsible to release the reference.
 */
static struct persona *
proc_set_cred_internal(proc_t p, struct persona *persona,
    kauth_cred_t auth_override, int *rlim_error)
{
        struct persona *old_persona = NULL;
        kauth_cred_t my_cred, my_new_cred;
        uid_t old_uid, new_uid;
        size_t count;
        rlim_t nproc = proc_limitgetcur(p, RLIMIT_NPROC, TRUE);

        /*
         * This operation must be done under the proc trans lock
         * by the thread which took the trans lock!
         */
        assert(((p->p_lflag & P_LINTRANSIT) == P_LINTRANSIT) &&
            p->p_transholder == current_thread());
        assert(persona != NULL);

        /* no work to do if we "re-adopt" the same persona */
        if (p->p_persona == persona) {
                return NULL;
        }

        /*
         * If p is in a persona, then we need to remove 'p' from the list of
         * processes in that persona. To do this, we need to drop the lock
         * held on the incoming (new) persona and lock the old one.
         */
        if (p->p_persona) {
                old_persona = proc_reset_persona_internal(p, PROC_REMOVE_PERSONA,
                    NULL, persona);
        }

        if (auth_override) {
                my_new_cred = auth_override;
        } else {
                my_new_cred = persona->pna_cred;
        }

        if (!my_new_cred) {
                panic("NULL credentials (persona:%p)", persona);
        }

        *rlim_error = 0;

        kauth_cred_ref(my_new_cred);

        new_uid = persona->pna_id;

        /*
         * Check to see if we will hit a proc rlimit by moving the process
         * into the persona. If so, we'll bail early before actually moving
         * the process or changing its credentials.
         */
        if (new_uid != 0 &&
            (rlim_t)chgproccnt(new_uid, 0) > nproc) {
                pna_err("PID:%d hit proc rlimit in new persona(%d): %s",
                    p->p_pid, new_uid, persona_desc(persona, 1));
                *rlim_error = EACCES;
                if (old_persona) {
                        (void)proc_reset_persona_internal(p, PROC_RESET_OLD_PERSONA,
                            old_persona, persona);
                }
                kauth_cred_unref(&my_new_cred);
                return NULL;
        }

        /*
         * Set the new credentials on the proc
         */
set_proc_cred:
        my_cred = kauth_cred_proc_ref(p);
        persona_dbg("proc_adopt PID:%d, %s -> %s",
            p->p_pid,
            persona_desc(old_persona, 1),
            persona_desc(persona, 1));

        old_uid = kauth_cred_getruid(my_cred);

        if (my_cred != my_new_cred) {
                kauth_cred_t old_cred = my_cred;

                proc_ucred_lock(p);
                /*
                 * We need to protect against a race where another thread
                 * also changed the credential after we took our
                 * reference.  If p_ucred has changed then we should
                 * restart this again with the new cred.
                 */
                if (p->p_ucred != my_cred) {
                        proc_ucred_unlock(p);
                        kauth_cred_unref(&my_cred);
                        /* try again */
                        goto set_proc_cred;
                }

                /* update the credential and take a ref for the proc */
                kauth_cred_ref(my_new_cred);
                p->p_ucred = my_new_cred;

                /* update cred on proc (and current thread) */
                mach_kauth_cred_uthread_update();
                PROC_UPDATE_CREDS_ONPROC(p);

                /* drop the proc's old ref on the credential */
                kauth_cred_unref(&old_cred);
                proc_ucred_unlock(p);
        }

        /* drop this function's reference to the old cred */
        kauth_cred_unref(&my_cred);

        /*
         * Update the proc count.
         * If the UIDs are the same, then there is no work to do.
         */
        if (old_persona) {
                old_uid = old_persona->pna_id;
        }

        if (new_uid != old_uid) {
                count = chgproccnt(old_uid, -1);
                persona_dbg("Decrement %s:%d proc_count to: %lu",
                    old_persona ? "Persona" : "UID", old_uid, count);

                /*
                 * Increment the proc count on the UID associated with
                 * the new persona. Enforce the resource limit just
                 * as in fork1()
                 */
                count = chgproccnt(new_uid, 1);
                persona_dbg("Increment Persona:%d (UID:%d) proc_count to: %lu",
                    new_uid, kauth_cred_getuid(my_new_cred), count);
        }

        OSBitOrAtomic(P_ADOPTPERSONA, &p->p_flag);

        proc_lock(p);
        p->p_persona = persona_get_locked(persona);
        LIST_INSERT_HEAD(&persona->pna_members, p, p_persona_list);
        proc_unlock(p);

        kauth_cred_unref(&my_new_cred);

        return old_persona;
}

int
persona_proc_adopt(proc_t p, struct persona *persona, kauth_cred_t auth_override)
{
        int error;
        struct persona *old_persona;

        if (!persona) {
                return EINVAL;
        }

        persona_dbg("%d adopting Persona %d (%s)", proc_pid(p),
            persona->pna_id, persona_desc(persona, 0));

        persona_lock(persona);
        if (!persona->pna_cred || !persona_valid(persona)) {
                persona_dbg("Invalid persona (%s): NULL credentials!", persona_desc(persona, 1));
                persona_unlock(persona);
                return EINVAL;
        }

        /* the persona credentials can no longer be adjusted */
        persona->pna_cred_locked = 1;

        /*
         * assume the persona: this may drop and re-acquire the persona lock!
         */
        error = 0;
        old_persona = proc_set_cred_internal(p, persona, auth_override, &error);

        /* join the process group associated with the persona */
        if (persona->pna_pgid) {
                uid_t uid = kauth_cred_getuid(persona->pna_cred);
                persona_dbg(" PID:%d, pgid:%d%s",
                    p->p_pid, persona->pna_pgid,
                    persona->pna_pgid == uid ? ", new_session" : ".");
                enterpgrp(p, persona->pna_pgid, persona->pna_pgid == uid);
        }

        /* Only Multiuser Mode needs to update the session login name to the persona name */
#if (TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR)
        volatile uint32_t *multiuser_flag_address = (volatile uint32_t *)(uintptr_t)(_COMM_PAGE_MULTIUSER_CONFIG);
        uint32_t multiuser_flags = *multiuser_flag_address;
        /* set the login name of the session */
        if (multiuser_flags) {
                struct session * sessp = proc_session(p);
                if (sessp != SESSION_NULL) {
                        session_lock(sessp);
                        bcopy(persona->pna_login, sessp->s_login, MAXLOGNAME);
                        session_unlock(sessp);
                        session_rele(sessp);
                }
        }
#endif
        persona_unlock(persona);

        set_security_token(p);

        /*
         * Drop the reference to the old persona.
         */
        if (old_persona) {
                persona_put(old_persona);
        }

        persona_dbg("%s", error == 0 ? "SUCCESS" : "FAILED");
        return error;
}

int
persona_proc_drop(proc_t p)
{
        struct persona *persona = NULL;

        persona_dbg("PID:%d, %s -> <none>", p->p_pid, persona_desc(p->p_persona, 0));

        /*
         * There are really no other credentials for us to assume,
         * so we'll just continue running with the credentials
         * we got from the persona.
         */

        /*
         * the locks must be taken in reverse order here, so
         * we have to be careful not to cause deadlock
         */
try_again:
        proc_lock(p);
        if (p->p_persona) {
                uid_t puid, ruid;
                if (!persona_try_lock(p->p_persona)) {
                        proc_unlock(p);
                        mutex_pause(0); /* back-off time */
                        goto try_again;
                }
                persona = p->p_persona;
                LIST_REMOVE(p, p_persona_list);
                p->p_persona = NULL;

                ruid = kauth_cred_getruid(p->p_ucred);
                puid = kauth_cred_getuid(persona->pna_cred);
                proc_unlock(p);
                (void)chgproccnt(ruid, 1);
                (void)chgproccnt(puid, -1);
        } else {
                proc_unlock(p);
        }

        /*
         * if the proc had a persona, then it is still locked here
         * (preserving proper lock ordering)
         */

        if (persona) {
                persona_unlock(persona);
                persona_put(persona);
        }

        return 0;
}

int
persona_get_type(struct persona *persona)
{
        int type;

        if (!persona) {
                return PERSONA_INVALID;
        }

        persona_lock(persona);
        if (!persona_valid(persona)) {
                persona_unlock(persona);
                return PERSONA_INVALID;
        }
        type = persona->pna_type;
        persona_unlock(persona);

        return type;
}

int
persona_set_cred(struct persona *persona, kauth_cred_t cred)
{
        int ret = 0;
        kauth_cred_t my_cred;
        if (!persona || !cred) {
                return EINVAL;
        }

        persona_lock(persona);
        if (!persona_initialized(persona)) {
                ret = EINVAL;
                goto out_unlock;
        }
        if (persona->pna_cred_locked) {
                ret = EPERM;
                goto out_unlock;
        }

        /* create a new cred from the passed-in cred */
        my_cred = kauth_cred_create(cred);

        /* ensure that the UID matches the persona ID */
        my_cred = kauth_cred_setresuid(my_cred, persona->pna_id,
            persona->pna_id, persona->pna_id,
            KAUTH_UID_NONE);

        /* TODO: clear the saved GID?! */

        /* replace the persona's cred with the new one */
        if (persona->pna_cred) {
                kauth_cred_unref(&persona->pna_cred);
        }
        persona->pna_cred = my_cred;

out_unlock:
        persona_unlock(persona);
        return ret;
}

int
persona_set_cred_from_proc(struct persona *persona, proc_t proc)
{
        int ret = 0;
        kauth_cred_t parent_cred, my_cred;
        if (!persona || !proc) {
                return EINVAL;
        }

        persona_lock(persona);
        if (!persona_initialized(persona)) {
                ret = EINVAL;
                goto out_unlock;
        }
        if (persona->pna_cred_locked) {
                ret = EPERM;
                goto out_unlock;
        }

        parent_cred = kauth_cred_proc_ref(proc);

        /* TODO: clear the saved UID/GID! */

        /* create a new cred from the proc's cred */
        my_cred = kauth_cred_create(parent_cred);

        /* ensure that the UID matches the persona ID */
        my_cred = kauth_cred_setresuid(my_cred, persona->pna_id,
            persona->pna_id, persona->pna_id,
            KAUTH_UID_NONE);

        /* replace the persona's cred with the new one */
        if (persona->pna_cred) {
                kauth_cred_unref(&persona->pna_cred);
        }
        persona->pna_cred = my_cred;

        kauth_cred_unref(&parent_cred);

out_unlock:
        persona_unlock(persona);
        return ret;
}

kauth_cred_t
persona_get_cred(struct persona *persona)
{
        kauth_cred_t cred = NULL;

        if (!persona) {
                return NULL;
        }

        persona_lock(persona);
        if (!persona_valid(persona)) {
                goto out_unlock;
        }

        if (persona->pna_cred) {
                kauth_cred_ref(persona->pna_cred);
                cred = persona->pna_cred;
        }

out_unlock:
        persona_unlock(persona);

        return cred;
}

uid_t
persona_get_uid(struct persona *persona)
{
        uid_t uid = UID_MAX;

        if (!persona || !persona->pna_cred) {
                return UID_MAX;
        }

        persona_lock(persona);
        if (persona_valid(persona)) {
                uid = kauth_cred_getuid(persona->pna_cred);
                assert(uid == persona->pna_id);
        }
        persona_unlock(persona);

        return uid;
}

int
persona_set_gid(struct persona *persona, gid_t gid)
{
        int ret = 0;
        kauth_cred_t my_cred, new_cred;

        if (!persona || !persona->pna_cred) {
                return EINVAL;
        }

        persona_lock(persona);
        if (!persona_initialized(persona)) {
                ret = EINVAL;
                goto out_unlock;
        }
        if (persona->pna_cred_locked) {
                ret = EPERM;
                goto out_unlock;
        }

        my_cred = persona->pna_cred;
        kauth_cred_ref(my_cred);
        new_cred = kauth_cred_setresgid(my_cred, gid, gid, gid);
        if (new_cred != my_cred) {
                persona->pna_cred = new_cred;
        }
        kauth_cred_unref(&my_cred);

out_unlock:
        persona_unlock(persona);
        return ret;
}

gid_t
persona_get_gid(struct persona *persona)
{
        gid_t gid = GID_MAX;

        if (!persona || !persona->pna_cred) {
                return GID_MAX;
        }

        persona_lock(persona);
        if (persona_valid(persona)) {
                gid = kauth_cred_getgid(persona->pna_cred);
        }
        persona_unlock(persona);

        return gid;
}

int
persona_set_groups(struct persona *persona, gid_t *groups, size_t ngroups, uid_t gmuid)
{
        int ret = 0;
        kauth_cred_t my_cred, new_cred;

        if (!persona || !persona->pna_cred) {
                return EINVAL;
        }
        if (ngroups > NGROUPS_MAX) {
                return EINVAL;
        }

        persona_lock(persona);
        if (!persona_initialized(persona)) {
                ret = EINVAL;
                goto out_unlock;
        }
        if (persona->pna_cred_locked) {
                ret = EPERM;
                goto out_unlock;
        }

        my_cred = persona->pna_cred;
        kauth_cred_ref(my_cred);
        new_cred = kauth_cred_setgroups(my_cred, groups, ngroups, gmuid);
        if (new_cred != my_cred) {
                persona->pna_cred = new_cred;
        }
        kauth_cred_unref(&my_cred);

out_unlock:
        persona_unlock(persona);
        return ret;
}

int
persona_get_groups(struct persona *persona, size_t *ngroups, gid_t *groups, size_t groups_sz)
{
        int ret = EINVAL;
        if (!persona || !persona->pna_cred || !groups || !ngroups || groups_sz > NGROUPS) {
                return EINVAL;
        }

        *ngroups = groups_sz;

        persona_lock(persona);
        if (persona_valid(persona)) {
                size_t kauth_ngroups = groups_sz;
                kauth_cred_getgroups(persona->pna_cred, groups, &kauth_ngroups);
                *ngroups = (uint32_t)kauth_ngroups;
                ret = 0;
        }
        persona_unlock(persona);

        return ret;
}

uid_t
persona_get_gmuid(struct persona *persona)
{
        uid_t gmuid = KAUTH_UID_NONE;

        if (!persona || !persona->pna_cred) {
                return gmuid;
        }

        persona_lock(persona);
        if (!persona_valid(persona)) {
                goto out_unlock;
        }

        posix_cred_t pcred = posix_cred_get(persona->pna_cred);
        gmuid = pcred->cr_gmuid;

out_unlock:
        persona_unlock(persona);
        return gmuid;
}

int
persona_get_login(struct persona *persona, char login[MAXLOGNAME + 1])
{
        int ret = EINVAL;
        if (!persona || !persona->pna_cred) {
                return EINVAL;
        }

        persona_lock(persona);
        if (!persona_valid(persona)) {
                goto out_unlock;
        }

        strlcpy(login, persona->pna_login, MAXLOGNAME);
        ret = 0;

out_unlock:
        persona_unlock(persona);
        return ret;
}

#else /* !CONFIG_PERSONAS */

/*
 * symbol exports for kext compatibility
 */

struct persona *system_persona = NULL;
struct persona *proxy_system_persona = NULL;
int unique_persona = 0;

uid_t
persona_get_id(__unused struct persona *persona)
{
        return PERSONA_ID_NONE;
}

int
persona_get_type(__unused struct persona *persona)
{
        return PERSONA_INVALID;
}

kauth_cred_t
persona_get_cred(__unused struct persona *persona)
{
        return NULL;
}

struct persona *
persona_lookup(__unused uid_t id)
{
        return NULL;
}

int
persona_find(__unused const char *login,
    __unused uid_t uid,
    __unused struct persona **persona,
    __unused size_t *plen)
{
        return ENOTSUP;
}

int
persona_find_by_type(__unused int persona_type,
    __unused struct persona **persona,
    __unused size_t *plen)
{
        return ENOTSUP;
}

struct persona *
persona_proc_get(__unused pid_t pid)
{
        return NULL;
}

struct persona *
current_persona_get(void)
{
        return NULL;
}

struct persona *
persona_get(struct persona *persona)
{
        return persona;
}

void
persona_put(__unused struct persona *persona)
{
        return;
}
#endif