]> git.saurik.com Git - apple/xnu.git/blob - security/mac_mach.c
xnu-7195.101.1.tar.gz
[apple/xnu.git] / security / mac_mach.c
1 /*
2 * Copyright (c) 2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <mach/exception_types.h>
30 #include <mach/mach_types.h>
31 #include <osfmk/kern/exception.h>
32 #include <osfmk/kern/task.h>
33 #include <sys/codesign.h>
34 #include <sys/param.h>
35 #include <sys/user.h>
36 #include <sys/proc.h>
37 #include <sys/proc_internal.h>
38 #include <sys/kauth.h>
39 #include <kern/task.h>
40
41 #include <security/mac_framework.h>
42 #include <security/mac_internal.h>
43 #include <security/mac_mach_internal.h>
44
45 #if CONFIG_CSR
46 #include <sys/csr.h>
47 // Panic on internal builds, just log otherwise.
48 #define MAC_MACH_UNEXPECTED(fmt...) \
49 if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
50 #else
51 #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
52 #endif
53
54 static struct proc *
55 mac_task_get_proc(struct task *task)
56 {
57 if (task == current_task()) {
58 return proc_self();
59 }
60
61 /*
62 * Tasks don't really hold a reference on a proc unless the
63 * calling thread belongs to the task in question.
64 */
65 int pid = task_pid(task);
66 struct proc *p = proc_find(pid);
67
68 if (p != NULL) {
69 if (proc_task(p) == task) {
70 return p;
71 }
72 proc_rele(p);
73 }
74 return NULL;
75 }
76
77 int
78 mac_task_check_expose_task(struct task *task, mach_task_flavor_t flavor)
79 {
80 int error;
81
82 assert(flavor <= TASK_FLAVOR_NAME);
83
84 struct proc *p = mac_task_get_proc(task);
85 if (p == NULL) {
86 return ESRCH;
87 }
88 struct proc_ident pident = proc_ident(p);
89
90 struct ucred *cred = kauth_cred_get();
91 proc_rele(p);
92
93 /* Also call the old hook for compatability, deprecating in rdar://66356944. */
94 if (flavor == TASK_FLAVOR_CONTROL) {
95 MAC_CHECK(proc_check_expose_task, cred, &pident);
96 if (error) {
97 return error;
98 }
99 }
100
101 MAC_CHECK(proc_check_expose_task_with_flavor, cred, &pident, flavor);
102
103 return error;
104 }
105
106 int
107 mac_task_check_task_id_token_get_task(struct task *task, mach_task_flavor_t flavor)
108 {
109 int error;
110
111 assert(flavor <= TASK_FLAVOR_NAME);
112
113 struct proc *p = mac_task_get_proc(task);
114 if (p == NULL) {
115 return ESRCH;
116 }
117 struct proc_ident pident = proc_ident(p);
118
119 proc_rele(p);
120
121 p = current_proc();
122 kauth_cred_t cred = kauth_cred_proc_ref(p);
123 MAC_CHECK(proc_check_task_id_token_get_task, cred, &pident, flavor);
124 kauth_cred_unref(&cred);
125 return error;
126 }
127
128 int
129 mac_task_check_get_movable_control_port(void)
130 {
131 int error;
132 struct proc *p = current_proc();
133
134 kauth_cred_t cred = kauth_cred_proc_ref(p);
135 MAC_CHECK(proc_check_get_movable_control_port, cred);
136 kauth_cred_unref(&cred);
137 return error;
138 }
139
140 int
141 mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
142 {
143 int error;
144
145 struct proc *p = mac_task_get_proc(task);
146 if (p == NULL) {
147 return ESRCH;
148 }
149
150 kauth_cred_t cred = kauth_cred_proc_ref(p);
151 MAC_CHECK(proc_check_set_host_special_port, cred, id, port);
152 kauth_cred_unref(&cred);
153 proc_rele(p);
154 return error;
155 }
156
157 int
158 mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
159 {
160 int error;
161
162 struct proc *p = mac_task_get_proc(task);
163 if (p == NULL) {
164 return ESRCH;
165 }
166
167 kauth_cred_t cred = kauth_cred_proc_ref(p);
168 MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
169 kauth_cred_unref(&cred);
170 proc_rele(p);
171 return error;
172 }
173
174 int
175 mac_task_check_dyld_process_info_notify_register(void)
176 {
177 int error;
178 struct proc *p = current_proc();
179
180 kauth_cred_t cred = kauth_cred_proc_ref(p);
181 MAC_CHECK(proc_check_dyld_process_info_notify_register, cred);
182 kauth_cred_unref(&cred);
183 return error;
184 }
185
186 int
187 mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
188 {
189 int error = 0;
190 int exception;
191
192 struct proc *p = mac_task_get_proc(task);
193 if (p == NULL) {
194 return ESRCH;
195 }
196
197 kauth_cred_t cred = kauth_cred_proc_ref(p);
198 for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
199 if (exception_mask & (1 << exception)) {
200 MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
201 if (error) {
202 break;
203 }
204 }
205 }
206 kauth_cred_unref(&cred);
207 proc_rele(p);
208 return error;
209 }
210
211 void
212 mac_thread_userret(struct thread *td)
213 {
214 MAC_PERFORM(thread_userret, td);
215 }
216
217 void
218 mac_proc_notify_exec_complete(struct proc *proc)
219 {
220 thread_t thread = current_thread();
221
222 /*
223 * Since this MAC hook was designed to support upcalls, make sure the hook
224 * is called with kernel importance propagation enabled so any daemons
225 * can get any appropriate importance donations.
226 */
227 thread_enable_send_importance(thread, TRUE);
228 MAC_PERFORM(proc_notify_exec_complete, proc);
229 thread_enable_send_importance(thread, FALSE);
230 }
231
232 /**** Exception Policy
233 *
234 * Note that the functions below do not fully follow the usual convention for mac policy functions
235 * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
236 * policy function names, we diverge because the exception policy is somewhat special:
237 * It is used in places where allocation and association must be separate, and its labels do not
238 * only belong to one type of object as usual, but to two (on exception actions and on tasks as
239 * crash labels).
240 */
241
242 // Label allocation and deallocation, may sleep.
243
244 struct label *
245 mac_exc_create_label(void)
246 {
247 struct label *label = mac_labelzone_alloc(MAC_WAITOK);
248
249 if (label == NULL) {
250 return NULL;
251 }
252
253 // Policy initialization of the label, typically performs allocations as well.
254 // (Unless the policy's full data really fits into a pointer size.)
255 MAC_PERFORM(exc_action_label_init, label);
256
257 return label;
258 }
259
260 void
261 mac_exc_free_label(struct label *label)
262 {
263 MAC_PERFORM(exc_action_label_destroy, label);
264 mac_labelzone_free(label);
265 }
266
267 // Action label initialization and teardown, may sleep.
268
269 void
270 mac_exc_associate_action_label(struct exception_action *action, struct label *label)
271 {
272 action->label = label;
273 MAC_PERFORM(exc_action_label_associate, action, action->label);
274 }
275
276 void
277 mac_exc_free_action_label(struct exception_action *action)
278 {
279 mac_exc_free_label(action->label);
280 action->label = NULL;
281 }
282
283 // Action label update and inheritance, may NOT sleep and must be quick.
284
285 int
286 mac_exc_update_action_label(struct exception_action *action,
287 struct label *newlabel)
288 {
289 int error;
290
291 MAC_CHECK(exc_action_label_update, action, action->label, newlabel);
292
293 return error;
294 }
295
296 int
297 mac_exc_inherit_action_label(struct exception_action *parent,
298 struct exception_action *child)
299 {
300 return mac_exc_update_action_label(child, parent->label);
301 }
302
303 int
304 mac_exc_update_task_crash_label(struct task *task, struct label *label)
305 {
306 int error;
307
308 assert(task != kernel_task);
309
310 struct label *crash_label = get_task_crash_label(task);
311
312 MAC_CHECK(exc_action_label_update, NULL, crash_label, label);
313
314 return error;
315 }
316
317 // Process label creation, may sleep.
318
319 struct label *
320 mac_exc_create_label_for_proc(struct proc *proc)
321 {
322 struct label *label = mac_exc_create_label();
323 MAC_PERFORM(exc_action_label_populate, label, proc);
324 return label;
325 }
326
327 struct label *
328 mac_exc_create_label_for_current_proc(void)
329 {
330 return mac_exc_create_label_for_proc(current_proc());
331 }
332
333 // Exception handler policy checking, may sleep.
334
335 int
336 mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
337 {
338 int error = 0;
339
340 struct proc *p = get_bsdtask_info(victim_task);
341 struct label *bsd_label = NULL;
342 struct label *label = NULL;
343
344 if (p != NULL) {
345 // Create a label from the still existing bsd process...
346 label = bsd_label = mac_exc_create_label_for_proc(p);
347 } else {
348 // ... otherwise use the crash label on the task.
349 label = get_task_crash_label(victim_task);
350 }
351
352 if (label == NULL) {
353 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
354 return EPERM;
355 }
356
357 MAC_CHECK(exc_action_check_exception_send, label, action, action->label);
358
359 if (bsd_label != NULL) {
360 mac_exc_free_label(bsd_label);
361 }
362
363 return error;
364 }