bsd/kern/kern_csr.c

   1 /*
   2  * Copyright (c) 2014 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <pexpert/pexpert.h>
  30 #include <sys/csr.h>
  31 #include <sys/errno.h>
  32 #include <sys/sysproto.h>
  33 #include <sys/systm.h>
  34 #include <sys/types.h>
  35
  36 /* enable enforcement by default */
  37 static int csr_allow_all = 0;
  38
  39 void
  40 csr_init(void)
  41 {
  42         boot_args *args = (boot_args *)PE_state.bootArgs;
  43         if (args->flags & kBootArgsFlagCSRBoot) {
  44                 /* special booter; allow everything */
  45                 csr_allow_all = 1;
  46         }
  47 }
  48
  49 int
  50 csr_get_active_config(csr_config_t *config)
  51 {
  52         boot_args *args = (boot_args *)PE_state.bootArgs;
  53         if (args->flags & kBootArgsFlagCSRActiveConfig) {
  54                 *config = args->csrActiveConfig & CSR_VALID_FLAGS;
  55         } else {
  56                 *config = 0;
  57         }
  58
  59         return 0;
  60 }
  61
  62 int
  63 csr_check(csr_config_t mask)
  64 {
  65         boot_args *args = (boot_args *)PE_state.bootArgs;
  66         if (mask & CSR_ALLOW_DEVICE_CONFIGURATION) {
  67                 return (args->flags & kBootArgsFlagCSRConfigMode) ? 0 : EPERM;
  68         }
  69
  70         csr_config_t config;
  71         int ret = csr_get_active_config(&config);
  72         if (ret) {
  73                 return ret;
  74         }
  75
  76         // CSR_ALLOW_KERNEL_DEBUGGER needs to be allowed when SIP is disabled
  77         // to allow 3rd-party developers to debug their kexts.  Use
  78         // CSR_ALLOW_UNTRUSTED_KEXTS as a proxy for "SIP is disabled" on the
  79         // grounds that you can do the same damage with a kernel debugger as
  80         // you can with an untrusted kext.
  81         if ((config & (CSR_ALLOW_UNTRUSTED_KEXTS | CSR_ALLOW_APPLE_INTERNAL)) != 0) {
  82                 config |= CSR_ALLOW_KERNEL_DEBUGGER;
  83         }
  84
  85         ret = ((config & mask) == mask) ? 0 : EPERM;
  86         if (ret == EPERM) {
  87                 // Override the return value if booted from the BaseSystem and the mask does not contain any flag that should always be enforced.
  88                 if (csr_allow_all && (mask & CSR_ALWAYS_ENFORCED_FLAGS) == 0) {
  89                         ret = 0;
  90                 }
  91         }
  92
  93         return ret;
  94 }
  95
  96 /*
  97  * Syscall stubs
  98  */
  99
 100 int syscall_csr_check(struct csrctl_args *args);
 101 int syscall_csr_get_active_config(struct csrctl_args *args);
 102
 103
 104 int
 105 syscall_csr_check(struct csrctl_args *args)
 106 {
 107         csr_config_t mask = 0;
 108         int error = 0;
 109
 110         if (args->useraddr == 0 || args->usersize != sizeof(mask)) {
 111                 return EINVAL;
 112         }
 113
 114         error = copyin(args->useraddr, &mask, sizeof(mask));
 115         if (error) {
 116                 return error;
 117         }
 118
 119         return csr_check(mask);
 120 }
 121
 122 int
 123 syscall_csr_get_active_config(struct csrctl_args *args)
 124 {
 125         csr_config_t config = 0;
 126         int error = 0;
 127
 128         if (args->useraddr == 0 || args->usersize != sizeof(config)) {
 129                 return EINVAL;
 130         }
 131
 132         error = csr_get_active_config(&config);
 133         if (error) {
 134                 return error;
 135         }
 136
 137         return copyout(&config, args->useraddr, sizeof(config));
 138 }
 139
 140 /*
 141  * Syscall entrypoint
 142  */
 143
 144 int
 145 csrctl(__unused proc_t p, struct csrctl_args *args, __unused int32_t *retval)
 146 {
 147         switch (args->op) {
 148         case CSR_SYSCALL_CHECK:
 149                 return syscall_csr_check(args);
 150         case CSR_SYSCALL_GET_ACTIVE_CONFIG:
 151                 return syscall_csr_get_active_config(args);
 152         default:
 153                 return ENOSYS;
 154         }
 155 }