bsd/kern/mach_process.c

   1 /*
   2  * Copyright (c) 2000-2006 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
  29 /*-
  30  * Copyright (c) 1982, 1986, 1989, 1993
  31  *      The Regents of the University of California.  All rights reserved.
  32  * (c) UNIX System Laboratories, Inc.
  33  * All or some portions of this file are derived from material licensed
  34  * to the University of California by American Telephone and Telegraph
  35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
  36  * the permission of UNIX System Laboratories, Inc.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  * 1. Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  * 2. Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in the
  45  *    documentation and/or other materials provided with the distribution.
  46  * 3. All advertising materials mentioning features or use of this software
  47  *    must display the following acknowledgement:
  48  *      This product includes software developed by the University of
  49  *      California, Berkeley and its contributors.
  50  * 4. Neither the name of the University nor the names of its contributors
  51  *    may be used to endorse or promote products derived from this software
  52  *    without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  55  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  56  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  57  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  58  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  59  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  60  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  62  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  63  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  64  * SUCH DAMAGE.
  65  *
  66  *      from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93
  67  */
  68
  69 #include <machine/reg.h>
  70 #include <machine/psl.h>
  71
  72 #include <sys/param.h>
  73 #include <sys/systm.h>
  74 #include <sys/proc_internal.h>
  75 #include <sys/kauth.h>
  76 #include <sys/errno.h>
  77 #include <sys/ptrace.h>
  78 #include <sys/uio.h>
  79 #include <sys/user.h>
  80 #include <sys/sysctl.h>
  81 #include <sys/wait.h>
  82
  83 #include <sys/mount_internal.h>
  84 #include <sys/sysproto.h>
  85 #include <sys/kdebug.h>
  86 #include <sys/codesign.h>               /* cs_allow_invalid() */
  87
  88 #include <security/audit/audit.h>
  89
  90 #include <kern/task.h>
  91 #include <kern/thread.h>
  92
  93 #include <mach/task.h>                  /* for task_resume() */
  94 #include <kern/sched_prim.h>            /* for thread_exception_return() */
  95
  96 #include <pexpert/pexpert.h>
  97
  98 #if CONFIG_MACF
  99 #include <security/mac_framework.h>
 100 #endif
 101
 102 /* XXX ken/bsd_kern.c - prototype should be in common header */
 103 int get_task_userstop(task_t);
 104
 105 /* Macros to clear/set/test flags. */
 106 #define SET(t, f)       (t) |= (f)
 107 #define CLR(t, f)       (t) &= ~(f)
 108 #define ISSET(t, f)     ((t) & (f))
 109
 110 extern thread_t get_firstthread(task_t);
 111
 112
 113 /*
 114  * sys-trace system call.
 115  */
 116
 117 int
 118 ptrace(struct proc *p, struct ptrace_args *uap, int32_t *retval)
 119 {
 120         struct proc     *t; /* target process */
 121         task_t          task;
 122         thread_t        th_act;
 123         struct uthread  *ut;
 124         int tr_sigexc = 0;
 125         int error = 0;
 126         int stopped = 0;
 127
 128         AUDIT_ARG(cmd, uap->req);
 129         AUDIT_ARG(pid, uap->pid);
 130         AUDIT_ARG(addr, uap->addr);
 131         AUDIT_ARG(value32, uap->data);
 132
 133         if (uap->req == PT_DENY_ATTACH) {
 134 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
 135                 if (PE_i_can_has_debugger(NULL)) {
 136                         return 0;
 137                 }
 138 #endif
 139                 proc_lock(p);
 140                 if (ISSET(p->p_lflag, P_LTRACED)) {
 141                         proc_unlock(p);
 142                         KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_FRCEXIT) | DBG_FUNC_NONE,
 143                             p->p_pid, W_EXITCODE(ENOTSUP, 0), 4, 0, 0);
 144                         exit1(p, W_EXITCODE(ENOTSUP, 0), retval);
 145
 146                         thread_exception_return();
 147                         /* NOTREACHED */
 148                 }
 149                 SET(p->p_lflag, P_LNOATTACH);
 150                 proc_unlock(p);
 151
 152                 return 0;
 153         }
 154
 155         if (uap->req == PT_FORCEQUOTA) {
 156                 if (kauth_cred_issuser(kauth_cred_get())) {
 157                         t = current_proc();
 158                         OSBitOrAtomic(P_FORCEQUOTA, &t->p_flag);
 159                         return 0;
 160                 } else {
 161                         return EPERM;
 162                 }
 163         }
 164
 165         /*
 166          *      Intercept and deal with "please trace me" request.
 167          */
 168         if (uap->req == PT_TRACE_ME) {
 169 retry_trace_me: ;
 170                 proc_t pproc = proc_parent(p);
 171                 if (pproc == NULL) {
 172                         return EINVAL;
 173                 }
 174 #if CONFIG_MACF
 175                 /*
 176                  * NB: Cannot call kauth_authorize_process(..., KAUTH_PROCESS_CANTRACE, ...)
 177                  *     since that assumes the process being checked is the current process
 178                  *     when, in this case, it is the current process's parent.
 179                  *     Most of the other checks in cantrace() don't apply either.
 180                  */
 181                 struct proc_ident p_ident = proc_ident(p);
 182                 struct proc_ident pproc_ident = proc_ident(pproc);
 183                 kauth_cred_t pproc_cred = kauth_cred_proc_ref(pproc);
 184
 185                 proc_rele(pproc);
 186                 error = mac_proc_check_debug(&pproc_ident, pproc_cred, &p_ident);
 187                 kauth_cred_unref(&pproc_cred);
 188
 189                 if (error != 0) {
 190                         return error;
 191                 }
 192                 if (proc_find_ident(&pproc_ident) == PROC_NULL) {
 193                         return ESRCH;
 194                 }
 195 #endif
 196                 proc_lock(p);
 197                 /* Make sure the process wasn't re-parented. */
 198                 if (p->p_ppid != pproc->p_pid) {
 199                         proc_unlock(p);
 200                         proc_rele(pproc);
 201                         goto retry_trace_me;
 202                 }
 203                 SET(p->p_lflag, P_LTRACED);
 204                 /* Non-attached case, our tracer is our parent. */
 205                 p->p_oppid = p->p_ppid;
 206                 proc_unlock(p);
 207                 /* Child and parent will have to be able to run modified code. */
 208                 cs_allow_invalid(p);
 209                 cs_allow_invalid(pproc);
 210                 proc_rele(pproc);
 211
 212                 return error;
 213         }
 214         if (uap->req == PT_SIGEXC) {
 215                 proc_lock(p);
 216                 if (ISSET(p->p_lflag, P_LTRACED)) {
 217                         SET(p->p_lflag, P_LSIGEXC);
 218                         proc_unlock(p);
 219                         return 0;
 220                 } else {
 221                         proc_unlock(p);
 222                         return EINVAL;
 223                 }
 224         }
 225
 226         /*
 227          * We do not want ptrace to do anything with kernel or launchd
 228          */
 229         if (uap->pid < 2) {
 230                 return EPERM;
 231         }
 232
 233         /*
 234          *      Locate victim, and make sure it is traceable.
 235          */
 236         if ((t = proc_find(uap->pid)) == NULL) {
 237                 return ESRCH;
 238         }
 239
 240         AUDIT_ARG(process, t);
 241
 242         task = t->task;
 243         if (uap->req == PT_ATTACHEXC) {
 244 #pragma clang diagnostic push
 245 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 246                 uap->req = PT_ATTACH;
 247                 tr_sigexc = 1;
 248         }
 249         if (uap->req == PT_ATTACH) {
 250 #pragma clang diagnostic pop
 251                 int             err;
 252
 253 #if !defined(XNU_TARGET_OS_OSX)
 254                 if (tr_sigexc == 0) {
 255                         error = ENOTSUP;
 256                         goto out;
 257                 }
 258 #endif
 259
 260                 if (kauth_authorize_process(proc_ucred(p), KAUTH_PROCESS_CANTRACE,
 261                     t, (uintptr_t)&err, 0, 0) == 0) {
 262                         /* it's OK to attach */
 263                         proc_lock(t);
 264                         SET(t->p_lflag, P_LTRACED);
 265                         if (tr_sigexc) {
 266                                 SET(t->p_lflag, P_LSIGEXC);
 267                         }
 268
 269                         t->p_oppid = t->p_ppid;
 270                         /* Check whether child and parent are allowed to run modified
 271                          * code (they'll have to) */
 272                         proc_unlock(t);
 273                         cs_allow_invalid(t);
 274                         cs_allow_invalid(p);
 275                         if (t->p_pptr != p) {
 276                                 proc_reparentlocked(t, p, 1, 0);
 277                         }
 278
 279                         proc_lock(t);
 280                         if (get_task_userstop(task) > 0) {
 281                                 stopped = 1;
 282                         }
 283                         t->p_xstat = 0;
 284                         proc_unlock(t);
 285                         psignal(t, SIGSTOP);
 286                         /*
 287                          * If the process was stopped, wake up and run through
 288                          * issignal() again to properly connect to the tracing
 289                          * process.
 290                          */
 291                         if (stopped) {
 292                                 task_resume(task);
 293                         }
 294                         error = 0;
 295                         goto out;
 296                 } else {
 297                         error = err;
 298                         if (error == ESRCH) {
 299                                 /*
 300                                  * The target 't' is not valid anymore as it
 301                                  * could not be found after the MAC check.
 302                                  */
 303                                 return error;
 304                         }
 305                         /* not allowed to attach, proper error code returned by kauth_authorize_process */
 306                         if (ISSET(t->p_lflag, P_LNOATTACH)) {
 307                                 psignal(p, SIGSEGV);
 308                         }
 309                         goto out;
 310                 }
 311         }
 312
 313         /*
 314          * You can't do what you want to the process if:
 315          *      (1) It's not being traced at all,
 316          */
 317         proc_lock(t);
 318         if (!ISSET(t->p_lflag, P_LTRACED)) {
 319                 proc_unlock(t);
 320                 error = EPERM;
 321                 goto out;
 322         }
 323
 324         /*
 325          *      (2) it's not being traced by _you_, or
 326          */
 327         if (t->p_pptr != p) {
 328                 proc_unlock(t);
 329                 error = EBUSY;
 330                 goto out;
 331         }
 332
 333         /*
 334          *      (3) it's not currently stopped.
 335          */
 336         if (t->p_stat != SSTOP) {
 337                 proc_unlock(t);
 338                 error = EBUSY;
 339                 goto out;
 340         }
 341
 342         /*
 343          *      Mach version of ptrace executes request directly here,
 344          *      thus simplifying the interaction of ptrace and signals.
 345          */
 346         /* proc lock is held here */
 347         switch (uap->req) {
 348         case PT_DETACH:
 349                 if (t->p_oppid != t->p_ppid) {
 350                         struct proc *pp;
 351
 352                         proc_unlock(t);
 353                         pp = proc_find(t->p_oppid);
 354                         if (pp != PROC_NULL) {
 355                                 proc_reparentlocked(t, pp, 1, 0);
 356                                 proc_rele(pp);
 357                         } else {
 358                                 /* original parent exited while traced */
 359                                 proc_list_lock();
 360                                 t->p_listflag |= P_LIST_DEADPARENT;
 361                                 proc_list_unlock();
 362                                 proc_reparentlocked(t, initproc, 1, 0);
 363                         }
 364                         proc_lock(t);
 365                 }
 366
 367                 t->p_oppid = 0;
 368                 CLR(t->p_lflag, P_LTRACED);
 369                 CLR(t->p_lflag, P_LSIGEXC);
 370                 proc_unlock(t);
 371                 goto resume;
 372
 373         case PT_KILL:
 374                 /*
 375                  *      Tell child process to kill itself after it
 376                  *      is resumed by adding NSIG to p_cursig. [see issig]
 377                  */
 378                 proc_unlock(t);
 379 #if CONFIG_MACF
 380                 error = mac_proc_check_signal(p, t, SIGKILL);
 381                 if (0 != error) {
 382                         goto resume;
 383                 }
 384 #endif
 385                 psignal(t, SIGKILL);
 386                 goto resume;
 387
 388         case PT_STEP:                   /* single step the child */
 389         case PT_CONTINUE:               /* continue the child */
 390                 proc_unlock(t);
 391                 th_act = (thread_t)get_firstthread(task);
 392                 if (th_act == THREAD_NULL) {
 393                         error = EINVAL;
 394                         goto out;
 395                 }
 396
 397                 /* force use of Mach SPIs (and task_for_pid security checks) to adjust PC */
 398                 if (uap->addr != (user_addr_t)1) {
 399                         error = ENOTSUP;
 400                         goto out;
 401                 }
 402
 403                 if ((unsigned)uap->data >= NSIG) {
 404                         error = EINVAL;
 405                         goto out;
 406                 }
 407
 408                 if (uap->data != 0) {
 409 #if CONFIG_MACF
 410                         error = mac_proc_check_signal(p, t, uap->data);
 411                         if (0 != error) {
 412                                 goto out;
 413                         }
 414 #endif
 415                         psignal(t, uap->data);
 416                 }
 417
 418                 if (uap->req == PT_STEP) {
 419                         /*
 420                          * set trace bit
 421                          * we use sending SIGSTOP as a comparable security check.
 422                          */
 423 #if CONFIG_MACF
 424                         error = mac_proc_check_signal(p, t, SIGSTOP);
 425                         if (0 != error) {
 426                                 goto out;
 427                         }
 428 #endif
 429                         if (thread_setsinglestep(th_act, 1) != KERN_SUCCESS) {
 430                                 error = ENOTSUP;
 431                                 goto out;
 432                         }
 433                 } else {
 434                         /*
 435                          * clear trace bit if on
 436                          * we use sending SIGCONT as a comparable security check.
 437                          */
 438 #if CONFIG_MACF
 439                         error = mac_proc_check_signal(p, t, SIGCONT);
 440                         if (0 != error) {
 441                                 goto out;
 442                         }
 443 #endif
 444                         if (thread_setsinglestep(th_act, 0) != KERN_SUCCESS) {
 445                                 error = ENOTSUP;
 446                                 goto out;
 447                         }
 448                 }
 449 resume:
 450                 proc_lock(t);
 451                 t->p_xstat = uap->data;
 452                 t->p_stat = SRUN;
 453                 if (t->sigwait) {
 454                         wakeup((caddr_t)&(t->sigwait));
 455                         proc_unlock(t);
 456                         if ((t->p_lflag & P_LSIGEXC) == 0) {
 457                                 task_resume(task);
 458                         }
 459                 } else {
 460                         proc_unlock(t);
 461                 }
 462
 463                 break;
 464
 465         case PT_THUPDATE:  {
 466                 proc_unlock(t);
 467                 if ((unsigned)uap->data >= NSIG) {
 468                         error = EINVAL;
 469                         goto out;
 470                 }
 471                 th_act = port_name_to_thread(CAST_MACH_PORT_TO_NAME(uap->addr),
 472                     PORT_TO_THREAD_NONE);
 473                 if (th_act == THREAD_NULL) {
 474                         error = ESRCH;
 475                         goto out;
 476                 }
 477                 ut = (uthread_t)get_bsdthread_info(th_act);
 478                 if (uap->data) {
 479                         ut->uu_siglist |= sigmask(uap->data);
 480                 }
 481                 proc_lock(t);
 482                 t->p_xstat = uap->data;
 483                 t->p_stat = SRUN;
 484                 proc_unlock(t);
 485                 thread_deallocate(th_act);
 486                 error = 0;
 487         }
 488         break;
 489         default:
 490                 proc_unlock(t);
 491                 error = EINVAL;
 492                 goto out;
 493         }
 494
 495         error = 0;
 496 out:
 497         proc_rele(t);
 498         return error;
 499 }
 500
 501
 502 /*
 503  * determine if one process (cur_procp) can trace another process (traced_procp).
 504  */
 505
 506 int
 507 cantrace(proc_t cur_procp, kauth_cred_t creds, proc_t traced_procp, int *errp)
 508 {
 509         int             my_err;
 510         /*
 511          * You can't trace a process if:
 512          *      (1) it's the process that's doing the tracing,
 513          */
 514         if (traced_procp->p_pid == cur_procp->p_pid) {
 515                 *errp = EINVAL;
 516                 return 0;
 517         }
 518
 519         /*
 520          *      (2) it's already being traced, or
 521          */
 522         if (ISSET(traced_procp->p_lflag, P_LTRACED)) {
 523                 *errp = EBUSY;
 524                 return 0;
 525         }
 526
 527         /*
 528          *      (3) it's not owned by you, or is set-id on exec
 529          *          (unless you're root).
 530          */
 531         if ((kauth_cred_getruid(creds) != kauth_cred_getruid(proc_ucred(traced_procp)) ||
 532             ISSET(traced_procp->p_flag, P_SUGID)) &&
 533             (my_err = suser(creds, &cur_procp->p_acflag)) != 0) {
 534                 *errp = my_err;
 535                 return 0;
 536         }
 537
 538         if ((cur_procp->p_lflag & P_LTRACED) && isinferior(cur_procp, traced_procp)) {
 539                 *errp = EPERM;
 540                 return 0;
 541         }
 542
 543         if (ISSET(traced_procp->p_lflag, P_LNOATTACH)) {
 544                 *errp = EBUSY;
 545                 return 0;
 546         }
 547
 548 #if CONFIG_MACF
 549         struct proc_ident cur_ident = proc_ident(cur_procp);
 550         struct proc_ident traced_ident = proc_ident(traced_procp);
 551         kauth_cred_t cur_cred = kauth_cred_proc_ref(cur_procp);
 552
 553         /*
 554          * Drop the proc reference to avoid a deadlock during an upcall and find
 555          * (reference) the proc again so our caller can keep using it.
 556          */
 557         proc_rele(traced_procp);
 558         my_err = mac_proc_check_debug(&cur_ident, cur_cred, &traced_ident);
 559         kauth_cred_unref(&cur_cred);
 560
 561         if (proc_find_ident(&traced_ident) == PROC_NULL) {
 562                 *errp = ESRCH;
 563                 return 0;
 564         }
 565         if (my_err != 0) {
 566                 *errp = my_err;
 567                 return 0;
 568         }
 569 #endif
 570         return 1;
 571 }