tests/read_inspect.c

   1 #include <darwintest.h>
   2
   3 #include <mach/host_priv.h>
   4 #include <mach/mach.h>
   5 #include <mach/mach_types.h>
   6 #include <mach/mach_vm.h>
   7 #include <mach_debug/ipc_info.h>
   8 #include <mach/processor_set.h>
   9 #include <mach/task.h>
  10 #include <signal.h>
  11 #include <sys/wait.h>
  12 #include <sys/proc.h>
  13 #include <sys/sysctl.h>
  14 #include <unistd.h>
  15 #include <TargetConditionals.h>
  16
  17 #define IKOT_THREAD_CONTROL             1
  18 #define IKOT_THREAD_READ                47
  19 #define IKOT_THREAD_INSPECT             46
  20
  21 #define IKOT_TASK_CONTROL               2
  22 #define IKOT_TASK_READ                  45
  23 #define IKOT_TASK_INSPECT               44
  24 #define IKOT_TASK_NAME                  20
  25
  26
  27 /*
  28  * This test verifies various security properties for task and thread
  29  * read/inspect interfaces. Specifically, it checks and makes sure:
  30  *
  31  * 1. Task/thread can't get higher priv'ed ports from lower ones through
  32  * {task, thread}_get_special_port()
  33  * 2. Correct level of thread ports are returned from task_threads() with
  34  * a given task port flavor
  35  * 3. Correct level of task ports are returned from processor_set_tasks()
  36  * 4. MIG intrans conversion and enforcement for task/thread port does not break.
  37  * 5. task_{, read, inspect, name}_for_pid() works for self and other process
  38  * 6. The new mach_vm_remap_new interface behaves correctly
  39  */
  40
  41 T_GLOBAL_META(
  42         T_META_NAMESPACE("xnu.ipc"),
  43         T_META_RUN_CONCURRENTLY(TRUE));
  44
  45 static void
  46 RESULT_CHECK(
  47         kern_return_t kr,
  48         unsigned int flavor,  /* task_flavor_t or thread_flavor_t */
  49         unsigned int required, /* task_flavor_t or thread_flavor_t */
  50         char *f_name)
  51 {
  52         if (flavor <= required) {
  53                 T_EXPECT_EQ(kr, KERN_SUCCESS, "%s should succeed with task/thread flavor %d, kr: 0x%x", f_name, flavor, kr);
  54         } else {
  55                 T_EXPECT_NE(kr, KERN_SUCCESS, "%s should fail with task/thread flavor %d, kr: 0x%x", f_name, flavor, kr);
  56         }
  57 }
  58
  59 static void
  60 test_task_get_special_port(
  61         task_t  tport,
  62         task_flavor_t flavor)
  63 {
  64         kern_return_t kr;
  65         mach_port_t special_port = MACH_PORT_NULL;
  66         mach_port_t tfp_port = MACH_PORT_NULL;
  67
  68         T_LOG("Testing task_get_special_port() with task flavor %d", flavor);
  69         /* gettable with at least control port */
  70         kr = task_get_special_port(tport, TASK_KERNEL_PORT, &special_port);
  71         RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_KERNEL_PORT)");
  72         mach_port_deallocate(mach_task_self(), special_port);
  73         special_port = MACH_PORT_NULL;
  74
  75         kr = task_get_special_port(tport, TASK_BOOTSTRAP_PORT, &special_port);
  76         RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_BOOTSTRAP_PORT)");
  77         mach_port_deallocate(mach_task_self(), special_port);
  78         special_port = MACH_PORT_NULL;
  79
  80         kr = task_get_special_port(tport, TASK_HOST_PORT, &special_port);
  81         RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_HOST_PORT)");
  82         mach_port_deallocate(mach_task_self(), special_port);
  83         special_port = MACH_PORT_NULL;
  84
  85         /* gettable with at least read port */
  86         kr = task_get_special_port(tport, TASK_READ_PORT, &special_port);
  87         RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "task_get_special_port(TASK_READ_PORT)");
  88         if (KERN_SUCCESS == kr) {
  89                 kr = task_read_for_pid(mach_task_self(), getpid(), &tfp_port);
  90                 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_read_for_pid()");
  91                 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_read_for_pid() should match TASK_READ_PORT");
  92                 mach_port_deallocate(mach_task_self(), tfp_port);
  93         }
  94         mach_port_deallocate(mach_task_self(), special_port);
  95         special_port = MACH_PORT_NULL;
  96
  97         /* gettable with at least inspect port */
  98         kr = task_get_special_port(tport, TASK_INSPECT_PORT, &special_port);
  99         RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_special_port(TASK_INSPECT_PORT)");
 100         if (KERN_SUCCESS == kr) {
 101                 kr = task_inspect_for_pid(mach_task_self(), getpid(), &tfp_port);
 102                 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_inspect_for_pid()");
 103                 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_inspect_for_pid() should match TASK_INSPECT_PORT");
 104                 mach_port_deallocate(mach_task_self(), tfp_port);
 105         }
 106         mach_port_deallocate(mach_task_self(), special_port);
 107         special_port = MACH_PORT_NULL;
 108
 109         /* gettable with at least name port */
 110         kr = task_get_special_port(tport, TASK_NAME_PORT, &special_port);
 111         RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_special_port(TASK_NAME_PORT)");
 112         if (KERN_SUCCESS == kr) {
 113                 kr = task_name_for_pid(mach_task_self(), getpid(), &tfp_port);
 114                 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_name_for_pid()");
 115                 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_name_for_pid() should match TASK_NAME_PORT");
 116                 mach_port_deallocate(mach_task_self(), tfp_port);
 117         }
 118         mach_port_deallocate(mach_task_self(), special_port);
 119         special_port = MACH_PORT_NULL;
 120 }
 121
 122 static void
 123 test_thread_get_special_port(
 124         thread_t  tport,
 125         thread_flavor_t flavor)
 126 {
 127         kern_return_t kr;
 128         mach_port_t special_port = MACH_PORT_NULL;
 129
 130         T_LOG("Testing thread_get_special_port() with thread flavor %d", flavor);
 131         /* gettable with at least control port */
 132         kr = thread_get_special_port(tport, THREAD_KERNEL_PORT, &special_port);
 133         RESULT_CHECK(kr, flavor, THREAD_FLAVOR_CONTROL, "thread_get_special_port(THREAD_KERNEL_PORT)");
 134         mach_port_deallocate(mach_task_self(), special_port);
 135         special_port = MACH_PORT_NULL;
 136
 137         /* gettable with at least read port */
 138         kr = thread_get_special_port(tport, THREAD_READ_PORT, &special_port);
 139         RESULT_CHECK(kr, flavor, THREAD_FLAVOR_READ, "thread_get_special_port(THREAD_READ_PORT)");
 140         mach_port_deallocate(mach_task_self(), special_port);
 141         special_port = MACH_PORT_NULL;
 142
 143         /* gettable with at least inspect port */
 144         kr = thread_get_special_port(tport, THREAD_INSPECT_PORT, &special_port);
 145         RESULT_CHECK(kr, flavor, THREAD_FLAVOR_INSPECT, "thread_get_special_port(THREAD_INSPECT_PORT)");
 146         mach_port_deallocate(mach_task_self(), special_port);
 147         special_port = MACH_PORT_NULL;
 148 }
 149
 150 static void
 151 test_task_threads(
 152         task_t  tport,
 153         task_flavor_t flavor)
 154 {
 155         kern_return_t kr;
 156         thread_array_t threadList;
 157         mach_msg_type_number_t threadCount = 0;
 158
 159         unsigned int kotype;
 160         unsigned int kaddr;
 161
 162         T_LOG("Testing task_threads() with task flavor %d", flavor);
 163
 164         kr = task_threads(tport, &threadList, &threadCount);
 165         RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_threads");
 166
 167         if (kr) {
 168                 T_LOG("task_threads failed, skipping test_task_threads()");
 169                 return;
 170         }
 171
 172         T_QUIET; T_ASSERT_GE(threadCount, 1, "threadCount should be at least 1");
 173
 174         /*
 175          * TASK_FLAVOR_CONTROL -> THREAD_FLAVOR_CONTROL
 176          * TASK_FLAVOR_READ    -> THREAD_FLAVOR_READ
 177          * TASK_FLAVOR_INSPECT -> THREAD_FLAVOR_INSPECT
 178          * TASK_FLAOVR_NAME    -> KERN_FAILURE
 179          */
 180         for (size_t i = 0; i < threadCount; i++) {
 181                 kr = mach_port_kernel_object(mach_task_self(), threadList[i], &kotype, &kaddr);
 182                 if (kr == KERN_INVALID_RIGHT) {
 183                         /* thread port is inactive */
 184                         T_LOG("thread port name 0x%x is inactive", threadList[i]);
 185                         continue;
 186                 } else if (kr) {
 187                         T_FAIL("mach_port_kernel_object() failed with kr: 0x%x", kr);
 188                 }
 189                 switch (flavor) {
 190                 case TASK_FLAVOR_CONTROL:
 191                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_CONTROL, "Task control port should yield thread control port");
 192                         break;
 193                 case TASK_FLAVOR_READ:
 194                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_READ, "Task read port should yield thread read port");
 195                         break;
 196                 case TASK_FLAVOR_INSPECT:
 197                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_INSPECT, "Task inspect port should yield thread inspect port");
 198                         break;
 199                 default:
 200                         T_FAIL("task_threads() returned thread ports with task name port??");
 201                         break;
 202                 }
 203         }
 204
 205         for (size_t i = 0; i < threadCount; i++) {
 206                 mach_port_deallocate(mach_task_self(), threadList[i]);
 207         }
 208 }
 209
 210 static void
 211 test_processor_set_tasks(
 212         task_flavor_t flavor)
 213 {
 214         kern_return_t kr;
 215         processor_set_name_array_t psets;
 216         processor_set_t        pset_priv;
 217         task_array_t taskList;
 218         mach_msg_type_number_t pcnt = 0, tcnt = 0;
 219         mach_port_t host = mach_host_self();
 220
 221         unsigned int kotype;
 222         unsigned int kaddr;
 223
 224         T_LOG("Testing processor_set_tasks() with task flavor %d", flavor);
 225
 226         kr = host_processor_sets(host, &psets, &pcnt);
 227         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_sets");
 228         T_QUIET; T_ASSERT_GE(pcnt, 1, "should have at least 1 processor set");
 229
 230         kr = host_processor_set_priv(host, psets[0], &pset_priv);
 231         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_set_priv");
 232         for (size_t i = 0; i < pcnt; i++) {
 233                 mach_port_deallocate(mach_task_self(), psets[i]);
 234         }
 235         mach_port_deallocate(mach_task_self(), host);
 236
 237         kr = processor_set_tasks_with_flavor(pset_priv, flavor, &taskList, &tcnt);
 238         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "processor_set_tasks_with_flavor");
 239         T_QUIET; T_ASSERT_GE(tcnt, 1, "should have at least 1 task");
 240         mach_port_deallocate(mach_task_self(), pset_priv);
 241
 242         for (size_t i = 0; i < tcnt; i++) {
 243                 kr = mach_port_kernel_object(mach_task_self(), taskList[i], &kotype, &kaddr);
 244                 if (kr == KERN_INVALID_RIGHT) {
 245                         /* task port is inactive */
 246                         T_LOG("task port name 0x%x is inactive", taskList[i]);
 247                         continue;
 248                 } else if (kr) {
 249                         T_FAIL("mach_port_kernel_object() failed with kr: 0x%x", kr);
 250                 }
 251                 switch (flavor) {
 252                 case TASK_FLAVOR_CONTROL:
 253                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_CONTROL, "TASK_FLAVOR_CONTROL should yield control ports");
 254                         break;
 255                 case TASK_FLAVOR_READ:
 256                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_READ, "TASK_FLAVOR_READ should yield read ports");
 257                         break;
 258                 case TASK_FLAVOR_INSPECT:
 259                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_INSPECT, "TASK_FLAVOR_INSPECT should yield inspect ports");
 260                         break;
 261                 case TASK_FLAVOR_NAME:
 262                         T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_NAME, "TASK_FLAVOR_NAME should yield name ports");
 263                         break;
 264                 default:
 265                         T_FAIL("strange flavor");
 266                         break;
 267                 }
 268         }
 269
 270         for (size_t i = 0; i < tcnt; i++) {
 271                 mach_port_deallocate(mach_task_self(), taskList[i]);
 272         }
 273 }
 274
 275 static void
 276 test_task_port_mig_intrans(
 277         task_t  tport,
 278         task_flavor_t   flavor)
 279 {
 280         kern_return_t kr;
 281
 282         T_LOG("Testing various MIG/manual intrans task interfaces with task flavor %d", flavor);
 283
 284         {
 285                 /* 1. Test some control port interfaces */
 286                 int data = 0x41;
 287                 int new_value = 0x42;
 288                 kr = mach_vm_write(tport,
 289                     (mach_vm_address_t)&data,
 290                     (vm_offset_t)&new_value,
 291                     (mach_msg_type_number_t)sizeof(int));
 292                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "mach_vm_write");
 293
 294                 /* mach_vm_remap_new with max_protection VM_PROT_WRITE | VM_PROT_READ */
 295                 int *localAddress = 0;
 296                 mach_vm_address_t localMachVMAddress = 0;
 297                 vm_prot_t cur_protection = VM_PROT_WRITE | VM_PROT_READ;
 298                 vm_prot_t max_protection = VM_PROT_WRITE | VM_PROT_READ;
 299                 /* rdar://67706101 (mach_vm_remap flag that allows restricting protection of remapped region) */
 300                 kr = mach_vm_remap_new(mach_task_self(),
 301                     &localMachVMAddress,
 302                     sizeof(int),
 303                     0,
 304                     VM_FLAGS_ANYWHERE,
 305                     tport, /* remote task, use self task port */
 306                     (mach_vm_address_t)&data,
 307                     false,
 308                     &cur_protection,
 309                     &max_protection,
 310                     VM_INHERIT_NONE);
 311                 localAddress = (int *)(uintptr_t)localMachVMAddress;
 312
 313                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "mach_vm_remap_new - VM_PROT_WRITE");
 314                 if (KERN_SUCCESS == kr) {
 315                         T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
 316                         T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
 317                         T_QUIET; T_EXPECT_EQ(*localAddress, data, NULL); /* read */
 318                         *localAddress = 0; /* write */
 319                 }
 320
 321                 exception_mask_t masks[EXC_TYPES_COUNT] = {};
 322                 mach_msg_type_number_t nmasks = 0;
 323                 exception_port_t ports[EXC_TYPES_COUNT] = {};
 324                 exception_behavior_t behaviors[EXC_TYPES_COUNT] = {};
 325                 thread_state_flavor_t flavors[EXC_TYPES_COUNT] = {};
 326                 kr = task_get_exception_ports(tport, EXC_MASK_ALL,
 327                     masks, &nmasks, ports, behaviors, flavors);
 328                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_exception_ports");
 329                 for (size_t i = 0; i < EXC_TYPES_COUNT; i++) {
 330                         mach_port_deallocate(mach_task_self(), ports[i]);
 331                 }
 332         }
 333
 334         {
 335                 /* 2. Test some read port interfaces */
 336                 vm_offset_t read_value = 0;
 337                 mach_msg_type_number_t read_cnt = 0;
 338                 int data = 0x41;
 339                 kr = mach_vm_read(tport,
 340                     (mach_vm_address_t)&data,
 341                     (mach_msg_type_number_t)sizeof(int),
 342                     &read_value,
 343                     &read_cnt);
 344                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_read");
 345
 346                 /* mach_vm_remap_new with max_protection VM_PROT_READ */
 347                 int *localAddress = 0;
 348                 mach_vm_address_t localMachVMAddress = 0;
 349                 vm_prot_t cur_protection = VM_PROT_READ;
 350                 vm_prot_t max_protection = VM_PROT_READ;
 351                 /* rdar://67706101 (mach_vm_remap flag that allows restricting protection of remapped region) */
 352                 kr = mach_vm_remap_new(mach_task_self(),
 353                     &localMachVMAddress,
 354                     sizeof(int),
 355                     0,
 356                     VM_FLAGS_ANYWHERE,
 357                     tport, /* remote task, use self task port */
 358                     (mach_vm_address_t)&data,
 359                     false,
 360                     &cur_protection,
 361                     &max_protection,
 362                     VM_INHERIT_NONE);
 363                 localAddress = (int *)(uintptr_t)localMachVMAddress;
 364
 365                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_remap_new - VM_PROT_READ");
 366                 if (KERN_SUCCESS == kr) {
 367                         T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ, NULL);
 368                         T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ, NULL);
 369                         T_QUIET; T_EXPECT_EQ(*localAddress, data, NULL); /* read */
 370                 }
 371
 372                 /* mach_vm_remap_new with copy == TRUE */
 373                 int data2 = 0x42;
 374                 localAddress = 0;
 375                 localMachVMAddress = 0;
 376                 cur_protection = VM_PROT_WRITE | VM_PROT_READ;
 377                 max_protection = VM_PROT_WRITE | VM_PROT_READ;
 378
 379                 kr = mach_vm_remap_new(mach_task_self(),
 380                     &localMachVMAddress,
 381                     sizeof(int),
 382                     0,
 383                     VM_FLAGS_ANYWHERE,
 384                     tport, /* remote task, use self task port */
 385                     (mach_vm_address_t)&data2,
 386                     true,
 387                     &cur_protection,
 388                     &max_protection,
 389                     VM_INHERIT_NONE);
 390                 localAddress = (int *)(uintptr_t)localMachVMAddress;
 391
 392                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_remap_new - copy==TRUE");
 393                 if (KERN_SUCCESS == kr) {
 394                         T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
 395                         T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
 396                         /* Following is causing bus error tracked by rdar://71616700 (Unexpected BUS ERROR in mach_vm_remap_new()) */
 397                         // T_QUIET; T_EXPECT_EQ(*localAddress, data2, NULL); /* read */
 398                         // *localAddress = 0; /* write */
 399                 }
 400
 401                 /* */
 402                 mach_port_t voucher = MACH_PORT_NULL;
 403                 kr = task_get_mach_voucher(tport, 0, &voucher);
 404                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "task_get_mach_voucher");
 405                 mach_port_deallocate(mach_task_self(), voucher);
 406
 407                 /* */
 408                 ipc_info_space_t space_info;
 409                 ipc_info_name_array_t table;
 410                 mach_msg_type_number_t tableCount;
 411                 ipc_info_tree_name_array_t tree; /* unused */
 412                 mach_msg_type_number_t treeCount; /* unused */
 413                 kr = mach_port_space_info(tport, &space_info, &table, &tableCount, &tree, &treeCount);
 414                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_port_space_info");
 415         }
 416
 417         {
 418                 /* 3. Test some inspect port interfaces */
 419                 task_exc_guard_behavior_t exc_behavior;
 420                 kr = task_get_exc_guard_behavior(tport, &exc_behavior);
 421                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_exc_guard_behavior");
 422         }
 423
 424         {
 425                 /* 4. Test some name port interfaces */
 426                 struct task_basic_info info;
 427                 mach_msg_type_number_t size = sizeof(info);
 428                 kr = task_info(tport,
 429                     TASK_BASIC_INFO,
 430                     (task_info_t)&info,
 431                     &size);
 432                 RESULT_CHECK(kr, flavor, TASK_FLAVOR_NAME, "task_info");
 433         }
 434 }
 435
 436 static void
 437 test_thread_port_mig_intrans(
 438         thread_t  tport,
 439         thread_flavor_t   flavor)
 440 {
 441         kern_return_t kr;
 442
 443         T_LOG("Testing various MIG/manual intrans thread interfaces with thread flavor %d", flavor);
 444
 445         {
 446                 /* 1. Test some control port interfaces */
 447                 exception_mask_t masks[EXC_TYPES_COUNT] = {};
 448                 mach_msg_type_number_t nmasks = 0;
 449                 exception_port_t ports[EXC_TYPES_COUNT] = {};
 450                 exception_behavior_t behaviors[EXC_TYPES_COUNT] = {};;
 451                 thread_state_flavor_t flavors[EXC_TYPES_COUNT] = {};;
 452                 kr = thread_get_exception_ports(tport, EXC_MASK_ALL,
 453                     masks, &nmasks, ports, behaviors, flavors);
 454                 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_CONTROL, "thread_get_exception_ports");
 455                 for (size_t i = 0; i < EXC_TYPES_COUNT; i++) {
 456                         mach_port_deallocate(mach_task_self(), ports[i]);
 457                 }
 458         }
 459
 460         {
 461                 /* 2. Test some read port interfaces */
 462                 mach_voucher_t voucher = MACH_PORT_NULL;
 463                 kr = thread_get_mach_voucher(tport, 0, &voucher);
 464                 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_READ, "thread_get_mach_voucher");
 465                 mach_port_deallocate(mach_task_self(), voucher);
 466         }
 467
 468         {
 469                 /* 3. Test some inspect port interfaces */
 470                 processor_set_name_t name = MACH_PORT_NULL;
 471                 kr = thread_get_assignment(tport, &name);
 472                 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_INSPECT, "thread_get_assignment");
 473                 mach_port_deallocate(mach_task_self(), name);
 474         }
 475 }
 476
 477 static void
 478 test_get_child_task_port(void)
 479 {
 480         pid_t child_pid;
 481         kern_return_t kr;
 482         mach_port_name_t tr, ti, tp, tn;
 483
 484         child_pid = fork();
 485
 486         T_LOG("Testing get child task ports");
 487
 488         if (child_pid < 0) {
 489                 T_FAIL("fork failed in test_get_child_port.");
 490         }
 491
 492         if (child_pid == 0) {
 493                 /* hang the child */
 494                 while (1) {
 495                         sleep(10);
 496                 }
 497         }
 498
 499         kr = task_for_pid(mach_task_self(), child_pid, &tp);
 500         T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_for_pid for child %u", child_pid);
 501
 502         kr = task_read_for_pid(mach_task_self(), child_pid, &tr);
 503         T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_read_for_pid for child %u", child_pid);
 504
 505         kr = task_inspect_for_pid(mach_task_self(), child_pid, &ti);
 506         T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_inspect_for_pid for child %u", child_pid);
 507
 508         kr = task_name_for_pid(mach_task_self(), child_pid, &tn);
 509         T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_name_for_pid for child %u", child_pid);
 510
 511         mach_port_deallocate(mach_task_self(), tp);
 512         mach_port_deallocate(mach_task_self(), tr);
 513         mach_port_deallocate(mach_task_self(), ti);
 514         mach_port_deallocate(mach_task_self(), tn);
 515
 516         kill(child_pid, SIGKILL);
 517         int status;
 518         wait(&status);
 519 }
 520
 521 T_DECL(read_inspect, "Test critical read and inspect port interfaces")
 522 {
 523         mach_port_t control_port, movable_port, read_port, inspect_port, name_port;
 524         mach_port_t th_control_port, th_movable_port, th_read_port, th_inspect_port;
 525 #define TASK_PORT_COUNT 5
 526 #define THREAD_PORT_COUNT 4
 527         mach_port_t task_ports[TASK_PORT_COUNT];
 528         task_flavor_t task_flavors[TASK_PORT_COUNT];
 529         mach_port_t thread_ports[THREAD_PORT_COUNT];
 530         thread_flavor_t thread_flavors[THREAD_PORT_COUNT];
 531         kern_return_t kr;
 532
 533         /* first, try getting all flavors of task port for self */
 534         kr = task_for_pid(mach_task_self(), getpid(), &control_port);
 535         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_for_pid()");
 536         task_ports[0] = control_port;
 537         task_flavors[0] = TASK_FLAVOR_CONTROL;
 538
 539         kr = task_get_special_port(mach_task_self(), TASK_KERNEL_PORT, &movable_port);
 540         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_get_special_port(..TASK_KERNEL_PORT..)");
 541         task_ports[1] = movable_port;
 542         task_flavors[1] = TASK_FLAVOR_CONTROL;
 543
 544         kr = task_read_for_pid(mach_task_self(), getpid(), &read_port);
 545         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_read_for_pid()");
 546         task_ports[2] = read_port;
 547         task_flavors[2] = TASK_FLAVOR_READ;
 548
 549         kr = task_inspect_for_pid(mach_task_self(), getpid(), &inspect_port);
 550         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_inspect_for_pid()");
 551         task_ports[3] = inspect_port;
 552         task_flavors[3] = TASK_FLAVOR_INSPECT;
 553
 554         kr = task_name_for_pid(mach_task_self(), getpid(), &name_port);
 555         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_name_for_pid()");
 556         task_ports[4] = name_port;
 557         task_flavors[4] = TASK_FLAVOR_NAME;
 558
 559
 560         for (size_t i = 0; i < TASK_PORT_COUNT; i++) {
 561                 /*
 562                  * 1. Make sure can't get higher priv'ed ports from lower ones through
 563                  * task_get_special_port()
 564                  */
 565                 test_task_get_special_port(task_ports[i], task_flavors[i]);
 566
 567                 /*
 568                  * 2. Make sure correct level of thread ports are returned from task_threads
 569                  */
 570                 test_task_threads(task_ports[i], task_flavors[i]);
 571
 572                 /*
 573                  * 3. Make sure correct level of task ports are returned from processor_set_tasks
 574                  */
 575                 if (i >= 1) {
 576                         test_processor_set_tasks(task_flavors[i]);
 577                 }
 578
 579                 /*
 580                  * 4. Make sure our MIG intrans enforcement for tasks does not break.
 581                  */
 582                 test_task_port_mig_intrans(task_ports[i], task_flavors[i]);
 583         }
 584
 585
 586         for (size_t i = 0; i < TASK_PORT_COUNT; i++) {
 587                 mach_port_deallocate(mach_task_self(), task_ports[i]);
 588         }
 589
 590         /* 4. Try spawning a child an get its task ports */
 591         test_get_child_task_port();
 592
 593         /* Now, test thread read/inspect ports */
 594         th_control_port = mach_thread_self();
 595         thread_ports[0] = th_control_port;
 596         thread_flavors[0] = THREAD_FLAVOR_CONTROL;
 597
 598         kr = thread_get_special_port(th_control_port, THREAD_KERNEL_PORT, &th_movable_port);
 599         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_KERNEL_PORT..)");
 600         thread_ports[1] = th_movable_port;
 601         thread_flavors[1] = THREAD_FLAVOR_CONTROL;
 602
 603         kr = thread_get_special_port(th_control_port, THREAD_READ_PORT, &th_read_port);
 604         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_READ_PORT..)");
 605         thread_ports[2] = th_read_port;
 606         thread_flavors[2] = THREAD_FLAVOR_READ;
 607
 608         kr = thread_get_special_port(th_control_port, THREAD_INSPECT_PORT, &th_inspect_port);
 609         T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_INSPECT_PORT..)");
 610         thread_ports[3] = th_inspect_port;
 611         thread_flavors[3] = THREAD_FLAVOR_INSPECT;
 612
 613
 614         for (size_t i = 0; i < THREAD_PORT_COUNT; i++) {
 615                 /*
 616                  * 1. Make sure can't get higher priv'ed ports from lower ones through
 617                  * thread_get_special_port()
 618                  */
 619                 test_thread_get_special_port(thread_ports[i], thread_flavors[i]);
 620
 621                 /*
 622                  * 2. Make sure our MIG intrans enforcement for threads does not break.
 623                  */
 624                 test_thread_port_mig_intrans(thread_ports[i], thread_flavors[i]);
 625         }
 626
 627         for (size_t i = 0; i < THREAD_PORT_COUNT; i++) {
 628                 mach_port_deallocate(mach_task_self(), thread_ports[i]);
 629         }
 630 }