2 * Copyright (c) 2015 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 #include <mach/exception_types.h>
30 #include <mach/mach_types.h>
31 #include <osfmk/kern/exception.h>
32 #include <osfmk/kern/task.h>
33 #include <sys/codesign.h>
34 #include <sys/param.h>
37 #include <sys/proc_internal.h>
38 #include <sys/kauth.h>
39 #include <kern/task.h>
41 #include <security/mac_framework.h>
42 #include <security/mac_internal.h>
43 #include <security/mac_mach_internal.h>
47 // Panic on internal builds, just log otherwise.
48 #define MAC_MACH_UNEXPECTED(fmt...) \
49 if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
51 #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
55 mac_task_get_proc(struct task
*task
)
57 if (task
== current_task()) {
62 * Tasks don't really hold a reference on a proc unless the
63 * calling thread belongs to the task in question.
65 int pid
= task_pid(task
);
66 struct proc
*p
= proc_find(pid
);
69 if (proc_task(p
) == task
) {
78 mac_task_check_expose_task(struct task
*task
, mach_task_flavor_t flavor
)
82 assert(flavor
<= TASK_FLAVOR_NAME
);
84 struct proc
*p
= mac_task_get_proc(task
);
88 struct proc_ident pident
= proc_ident(p
);
90 struct ucred
*cred
= kauth_cred_get();
93 /* Also call the old hook for compatability, deprecating in rdar://66356944. */
94 if (flavor
== TASK_FLAVOR_CONTROL
) {
95 MAC_CHECK(proc_check_expose_task
, cred
, &pident
);
101 MAC_CHECK(proc_check_expose_task_with_flavor
, cred
, &pident
, flavor
);
107 mac_task_check_task_id_token_get_task(struct task
*task
, mach_task_flavor_t flavor
)
111 assert(flavor
<= TASK_FLAVOR_NAME
);
113 struct proc
*p
= mac_task_get_proc(task
);
117 struct proc_ident pident
= proc_ident(p
);
122 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
123 MAC_CHECK(proc_check_task_id_token_get_task
, cred
, &pident
, flavor
);
124 kauth_cred_unref(&cred
);
129 mac_task_check_get_movable_control_port(void)
132 struct proc
*p
= current_proc();
134 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
135 MAC_CHECK(proc_check_get_movable_control_port
, cred
);
136 kauth_cred_unref(&cred
);
141 mac_task_check_set_host_special_port(struct task
*task
, int id
, struct ipc_port
*port
)
145 struct proc
*p
= mac_task_get_proc(task
);
150 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
151 MAC_CHECK(proc_check_set_host_special_port
, cred
, id
, port
);
152 kauth_cred_unref(&cred
);
158 mac_task_check_set_host_exception_port(struct task
*task
, unsigned int exception
)
162 struct proc
*p
= mac_task_get_proc(task
);
167 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
168 MAC_CHECK(proc_check_set_host_exception_port
, cred
, exception
);
169 kauth_cred_unref(&cred
);
175 mac_task_check_dyld_process_info_notify_register(void)
178 struct proc
*p
= current_proc();
180 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
181 MAC_CHECK(proc_check_dyld_process_info_notify_register
, cred
);
182 kauth_cred_unref(&cred
);
187 mac_task_check_set_host_exception_ports(struct task
*task
, unsigned int exception_mask
)
192 struct proc
*p
= mac_task_get_proc(task
);
197 kauth_cred_t cred
= kauth_cred_proc_ref(p
);
198 for (exception
= FIRST_EXCEPTION
; exception
< EXC_TYPES_COUNT
; exception
++) {
199 if (exception_mask
& (1 << exception
)) {
200 MAC_CHECK(proc_check_set_host_exception_port
, cred
, exception
);
206 kauth_cred_unref(&cred
);
212 mac_thread_userret(struct thread
*td
)
214 MAC_PERFORM(thread_userret
, td
);
218 mac_proc_notify_exec_complete(struct proc
*proc
)
220 thread_t thread
= current_thread();
223 * Since this MAC hook was designed to support upcalls, make sure the hook
224 * is called with kernel importance propagation enabled so any daemons
225 * can get any appropriate importance donations.
227 thread_enable_send_importance(thread
, TRUE
);
228 MAC_PERFORM(proc_notify_exec_complete
, proc
);
229 thread_enable_send_importance(thread
, FALSE
);
232 /**** Exception Policy
234 * Note that the functions below do not fully follow the usual convention for mac policy functions
235 * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
236 * policy function names, we diverge because the exception policy is somewhat special:
237 * It is used in places where allocation and association must be separate, and its labels do not
238 * only belong to one type of object as usual, but to two (on exception actions and on tasks as
242 // Label allocation and deallocation, may sleep.
245 mac_exc_create_label(void)
247 struct label
*label
= mac_labelzone_alloc(MAC_WAITOK
);
253 // Policy initialization of the label, typically performs allocations as well.
254 // (Unless the policy's full data really fits into a pointer size.)
255 MAC_PERFORM(exc_action_label_init
, label
);
261 mac_exc_free_label(struct label
*label
)
263 MAC_PERFORM(exc_action_label_destroy
, label
);
264 mac_labelzone_free(label
);
267 // Action label initialization and teardown, may sleep.
270 mac_exc_associate_action_label(struct exception_action
*action
, struct label
*label
)
272 action
->label
= label
;
273 MAC_PERFORM(exc_action_label_associate
, action
, action
->label
);
277 mac_exc_free_action_label(struct exception_action
*action
)
279 mac_exc_free_label(action
->label
);
280 action
->label
= NULL
;
283 // Action label update and inheritance, may NOT sleep and must be quick.
286 mac_exc_update_action_label(struct exception_action
*action
,
287 struct label
*newlabel
)
291 MAC_CHECK(exc_action_label_update
, action
, action
->label
, newlabel
);
297 mac_exc_inherit_action_label(struct exception_action
*parent
,
298 struct exception_action
*child
)
300 return mac_exc_update_action_label(child
, parent
->label
);
304 mac_exc_update_task_crash_label(struct task
*task
, struct label
*label
)
308 assert(task
!= kernel_task
);
310 struct label
*crash_label
= get_task_crash_label(task
);
312 MAC_CHECK(exc_action_label_update
, NULL
, crash_label
, label
);
317 // Process label creation, may sleep.
320 mac_exc_create_label_for_proc(struct proc
*proc
)
322 struct label
*label
= mac_exc_create_label();
323 MAC_PERFORM(exc_action_label_populate
, label
, proc
);
328 mac_exc_create_label_for_current_proc(void)
330 return mac_exc_create_label_for_proc(current_proc());
333 // Exception handler policy checking, may sleep.
336 mac_exc_action_check_exception_send(struct task
*victim_task
, struct exception_action
*action
)
340 struct proc
*p
= get_bsdtask_info(victim_task
);
341 struct label
*bsd_label
= NULL
;
342 struct label
*label
= NULL
;
345 // Create a label from the still existing bsd process...
346 label
= bsd_label
= mac_exc_create_label_for_proc(p
);
348 // ... otherwise use the crash label on the task.
349 label
= get_task_crash_label(victim_task
);
353 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
357 MAC_CHECK(exc_action_check_exception_send
, label
, action
, action
->label
);
359 if (bsd_label
!= NULL
) {
360 mac_exc_free_label(bsd_label
);