#include <ipc/ipc_pset.h>
#include <ipc/ipc_right.h>
#include <ipc/ipc_kmsg.h>
-#include <ipc/ipc_labelh.h>
#include <kern/misc_protos.h>
#include <security/mac_mach_internal.h>
-#include <mach/security_server.h>
+#if IMPORTANCE_INHERITANCE
+#include <ipc/ipc_importance.h>
+#endif
/*
* Forward declarations
void mach_port_gst_helper(
ipc_pset_t pset,
- ipc_port_t port,
ipc_entry_num_t maxnames,
mach_port_name_t *names,
ipc_entry_num_t *actualp);
+kern_return_t
+mach_port_guard_exception(
+ mach_port_name_t name,
+ uint64_t inguard,
+ uint64_t portguard,
+ unsigned reason);
+
+/* Needs port locked */
+void mach_port_get_status_helper(
+ ipc_port_t port,
+ mach_port_status_t *status);
+
/* Zeroed template of qos flags */
static mach_port_qos_t qos_template;
/* upper bound on number of names in the space */
bound = space->is_table_size;
- size_needed = round_page(bound * sizeof(mach_port_name_t));
+ size_needed = vm_map_round_page(
+ (bound * sizeof(mach_port_name_t)),
+ VM_MAP_PAGE_MASK(ipc_kernel_map));
if (size_needed <= size)
break;
/* can't fault while we hold locks */
- kr = vm_map_wire(ipc_kernel_map, vm_map_trunc_page(addr1),
- vm_map_round_page(addr1 + size),
- VM_PROT_READ|VM_PROT_WRITE, FALSE);
+ kr = vm_map_wire(
+ ipc_kernel_map,
+ vm_map_trunc_page(addr1,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ vm_map_round_page(addr1 + size,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ VM_PROT_READ|VM_PROT_WRITE,
+ FALSE);
if (kr != KERN_SUCCESS) {
kmem_free(ipc_kernel_map, addr1, size);
kmem_free(ipc_kernel_map, addr2, size);
return KERN_RESOURCE_SHORTAGE;
}
- kr = vm_map_wire(ipc_kernel_map, vm_map_trunc_page(addr2),
- vm_map_round_page(addr2 + size),
- VM_PROT_READ|VM_PROT_WRITE, FALSE);
+ kr = vm_map_wire(
+ ipc_kernel_map,
+ vm_map_trunc_page(addr2,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ vm_map_round_page(addr2 + size,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ VM_PROT_READ|VM_PROT_WRITE,
+ FALSE);
if (kr != KERN_SUCCESS) {
kmem_free(ipc_kernel_map, addr1, size);
kmem_free(ipc_kernel_map, addr2, size);
vm_size_t vm_size_used;
size_used = actual * sizeof(mach_port_name_t);
- vm_size_used = round_page(size_used);
+ vm_size_used =
+ vm_map_round_page(size_used,
+ VM_MAP_PAGE_MASK(ipc_kernel_map));
/*
* Make used memory pageable and get it into
* copied-in form. Free any unused memory.
*/
- kr = vm_map_unwire(ipc_kernel_map, vm_map_trunc_page(addr1),
- vm_map_round_page(addr1 + vm_size_used), FALSE);
+ kr = vm_map_unwire(
+ ipc_kernel_map,
+ vm_map_trunc_page(addr1,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ vm_map_round_page(addr1 + vm_size_used,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ FALSE);
assert(kr == KERN_SUCCESS);
- kr = vm_map_unwire(ipc_kernel_map, vm_map_trunc_page(addr2),
- vm_map_round_page(addr2 + vm_size_used), FALSE);
+ kr = vm_map_unwire(
+ ipc_kernel_map,
+ vm_map_trunc_page(addr2,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ vm_map_round_page(addr2 + vm_size_used,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ FALSE);
assert(kr == KERN_SUCCESS);
kr = vm_map_copyin(ipc_kernel_map, (vm_map_address_t)addr1,
return kr;
/* space is write-locked and active */
- kr = ipc_right_destroy(space, name, entry); /* unlocks space */
+ kr = ipc_right_destroy(space, name, entry, TRUE, 0); /* unlocks space */
return kr;
}
}
+/*
+ * Routine: mach_port_peek [kernel call]
+ * Purpose:
+ * Peek at the message queue for the specified receive
+ * right and return info about a message in the queue.
+ *
+ * On input, seqnop points to a sequence number value
+ * to match the message being peeked. If zero is specified
+ * as the seqno, the first message in the queue will be
+ * peeked.
+ *
+ * Only the following trailer types are currently supported:
+ * MACH_RCV_TRAILER_TYPE(MACH_MSG_TRAILER_FORMAT_0)
+ *
+ * or'ed with one of these element types:
+ * MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_NULL)
+ * MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_SEQNO)
+ * MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_SENDER)
+ * MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT)
+ *
+ * On input, the value pointed to by trailer_sizep must be
+ * large enough to hold the requested trailer size.
+ *
+ * The message sequence number, id, size, requested trailer info
+ * and requested trailer size are returned in their respective
+ * output parameters upon success.
+ *
+ * Conditions:
+ * Nothing locked.
+ * Returns:
+ * KERN_SUCCESS Matching message found, out parameters set.
+ * KERN_INVALID_TASK The space is null or dead.
+ * KERN_INVALID_NAME The name doesn't denote a right.
+ * KERN_INVALID_RIGHT Name doesn't denote receive rights.
+ * KERN_INVALID_VALUE The input parameter values are out of bounds.
+ * KERN_FAILURE The requested message was not found.
+ */
+
+kern_return_t
+mach_port_peek(
+ ipc_space_t space,
+ mach_port_name_t name,
+ mach_msg_trailer_type_t trailer_type,
+ mach_port_seqno_t *seqnop,
+ mach_msg_size_t *msg_sizep,
+ mach_msg_id_t *msg_idp,
+ mach_msg_trailer_info_t trailer_infop,
+ mach_msg_type_number_t *trailer_sizep)
+{
+ ipc_port_t port;
+ kern_return_t kr;
+ boolean_t found;
+ mach_msg_max_trailer_t max_trailer;
+
+ if (space == IS_NULL)
+ return KERN_INVALID_TASK;
+
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_RIGHT;
+
+ /*
+ * We don't allow anything greater than the audit trailer - to avoid
+ * leaking the context pointer and to avoid variable-sized context issues.
+ */
+ if (GET_RCV_ELEMENTS(trailer_type) > MACH_RCV_TRAILER_AUDIT ||
+ REQUESTED_TRAILER_SIZE(TRUE, trailer_type) > *trailer_sizep)
+ return KERN_INVALID_VALUE;
+
+ *trailer_sizep = REQUESTED_TRAILER_SIZE(TRUE, trailer_type);
+
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+
+ /* Port locked and active */
+
+ found = ipc_mqueue_peek(&port->ip_messages, seqnop,
+ msg_sizep, msg_idp, &max_trailer);
+ ip_unlock(port);
+
+ if (found != TRUE)
+ return KERN_FAILURE;
+
+ max_trailer.msgh_seqno = *seqnop;
+ memcpy(trailer_infop, &max_trailer, *trailer_sizep);
+
+ return KERN_SUCCESS;
+}
+
/*
* Routine: mach_port_set_mscount [kernel call]
* Purpose:
if (kr != KERN_SUCCESS)
return kr;
- /* port is locked and active */
- *context = port->ip_context;
+ /* Port locked and active */
+
+ /* For strictly guarded ports, return empty context (which acts as guard) */
+ if (port->ip_strict_guard)
+ *context = 0;
+ else
+ *context = port->ip_context;
ip_unlock(port);
return KERN_SUCCESS;
return kr;
/* port is locked and active */
+ if(port->ip_strict_guard) {
+ uint64_t portguard = port->ip_context;
+ ip_unlock(port);
+ /* For strictly guarded ports, disallow overwriting context; Raise Exception */
+ mach_port_guard_exception(name, context, portguard, kGUARD_EXC_SET_CONTEXT);
+ return KERN_INVALID_ARGUMENT;
+ }
+
port->ip_context = context;
ip_unlock(port);
}
-/*
- * Routine: mach_port_gst_helper
- * Conditions:
- * portspace is locked for both the recieve right and pset
- * under observation.
- * Purpose:
- * A helper function for mach_port_get_set_status.
- */
-
-void
-mach_port_gst_helper(
- ipc_pset_t pset,
- ipc_port_t port,
- ipc_entry_num_t maxnames,
- mach_port_name_t *names,
- ipc_entry_num_t *actualp)
-{
- mach_port_name_t name;
-
- assert(port != IP_NULL);
- /*
- * The space lock is held by the calling function,
- * hence it is OK to read name without the port lock.
- */
- assert(ip_active(port));
- name = port->ip_receiver_name;
- assert(name != MACH_PORT_NULL);
-
- if (ipc_pset_member(pset, port)) {
- ipc_entry_num_t actual = *actualp;
-
- if (actual < maxnames)
- names[actual] = name;
-
- *actualp = actual+1;
- }
-}
-
/*
* Routine: mach_port_get_set_status [kernel call]
* Purpose:
if (!MACH_PORT_VALID(name))
return KERN_INVALID_RIGHT;
- size = PAGE_SIZE; /* initial guess */
+ size = VM_MAP_PAGE_SIZE(ipc_kernel_map); /* initial guess */
for (;;) {
- ipc_entry_t entry, table;
- ipc_entry_num_t tsize;
- mach_port_index_t index;
mach_port_name_t *names;
+ ipc_object_t psobj;
ipc_pset_t pset;
kr = vm_allocate(ipc_kernel_map, &addr, size, VM_FLAGS_ANYWHERE);
VM_PROT_READ|VM_PROT_WRITE, FALSE);
assert(kr == KERN_SUCCESS);
- kr = ipc_right_lookup_read(space, name, &entry);
+ kr = ipc_object_translate(space, name, MACH_PORT_RIGHT_PORT_SET, &psobj);
if (kr != KERN_SUCCESS) {
kmem_free(ipc_kernel_map, addr, size);
return kr;
}
- /* space is read-locked and active */
-
- if (IE_BITS_TYPE(entry->ie_bits) != MACH_PORT_TYPE_PORT_SET) {
- is_read_unlock(space);
- kmem_free(ipc_kernel_map, addr, size);
- return KERN_INVALID_RIGHT;
- }
- pset = (ipc_pset_t) entry->ie_object;
- assert(pset != IPS_NULL);
- /* the port set must be active */
+ /* just use a portset reference from here on out */
+ pset = (ipc_pset_t) psobj;
+ ips_reference(pset);
+ ips_unlock(pset);
names = (mach_port_name_t *) addr;
maxnames = (ipc_entry_num_t)(size / sizeof(mach_port_name_t));
- actual = 0;
-
- table = space->is_table;
- tsize = space->is_table_size;
- for (index = 0; index < tsize; index++) {
- ipc_entry_t ientry = &table[index];
-
- if (ientry->ie_bits & MACH_PORT_TYPE_RECEIVE) {
- ipc_port_t port =
- (ipc_port_t) ientry->ie_object;
-
- mach_port_gst_helper(pset, port,
- maxnames, names, &actual);
- }
- }
+ ipc_mqueue_set_gather_member_names(&pset->ips_messages, maxnames, names, &actual);
- is_read_unlock(space);
+ /* release the portset reference */
+ ips_release(pset);
if (actual <= maxnames)
break;
/* didn't have enough memory; allocate more */
-
kmem_free(ipc_kernel_map, addr, size);
- size = round_page(actual * sizeof(mach_port_name_t)) + PAGE_SIZE;
+ size = vm_map_round_page(
+ (actual * sizeof(mach_port_name_t)),
+ VM_MAP_PAGE_MASK(ipc_kernel_map)) +
+ VM_MAP_PAGE_SIZE(ipc_kernel_map);
}
if (actual == 0) {
vm_size_t vm_size_used;
size_used = actual * sizeof(mach_port_name_t);
- vm_size_used = round_page(size_used);
+ vm_size_used = vm_map_round_page(
+ size_used,
+ VM_MAP_PAGE_MASK(ipc_kernel_map));
/*
* Make used memory pageable and get it into
* copied-in form. Free any unused memory.
*/
- kr = vm_map_unwire(ipc_kernel_map, vm_map_trunc_page(addr),
- vm_map_round_page(addr + vm_size_used), FALSE);
+ kr = vm_map_unwire(
+ ipc_kernel_map,
+ vm_map_trunc_page(addr,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ vm_map_round_page(addr + vm_size_used,
+ VM_MAP_PAGE_MASK(ipc_kernel_map)),
+ FALSE);
assert(kr == KERN_SUCCESS);
kr = vm_map_copyin(ipc_kernel_map, (vm_map_address_t)addr,
return kr;
}
+/*
+ * Routine: mach_port_get_status_helper [helper]
+ * Purpose:
+ * Populates a mach_port_status_t structure with
+ * port information.
+ * Conditions:
+ * Port needs to be locked
+ * Returns:
+ * None.
+ */
+void mach_port_get_status_helper(
+ ipc_port_t port,
+ mach_port_status_t *statusp)
+{
+ spl_t s;
+ statusp->mps_pset = port->ip_pset_count;
+
+ s = splsched();
+ imq_lock(&port->ip_messages);
+ statusp->mps_seqno = port->ip_messages.imq_seqno;
+ statusp->mps_qlimit = port->ip_messages.imq_qlimit;
+ statusp->mps_msgcount = port->ip_messages.imq_msgcount;
+ imq_unlock(&port->ip_messages);
+ splx(s);
+
+ statusp->mps_mscount = port->ip_mscount;
+ statusp->mps_sorights = port->ip_sorights;
+ statusp->mps_srights = port->ip_srights > 0;
+ statusp->mps_pdrequest = port->ip_pdrequest != IP_NULL;
+ statusp->mps_nsrequest = port->ip_nsrequest != IP_NULL;
+ statusp->mps_flags = 0;
+ if (port->ip_impdonation) {
+ statusp->mps_flags |= MACH_PORT_STATUS_FLAG_IMP_DONATION;
+ if (port->ip_tempowner) {
+ statusp->mps_flags |= MACH_PORT_STATUS_FLAG_TEMPOWNER;
+ if (IIT_NULL != port->ip_imp_task) {
+ statusp->mps_flags |= MACH_PORT_STATUS_FLAG_TASKPTR;
+ }
+ }
+ }
+ if (port->ip_guarded) {
+ statusp->mps_flags |= MACH_PORT_STATUS_FLAG_GUARDED;
+ if (port->ip_strict_guard) {
+ statusp->mps_flags |= MACH_PORT_STATUS_FLAG_STRICT_GUARD;
+ }
+ }
+ return;
+}
+
+
kern_return_t
mach_port_get_attributes(
}
case MACH_PORT_RECEIVE_STATUS: {
- mach_port_status_t *statusp = (mach_port_status_t *)info;
- spl_t s;
-
- if (*count < MACH_PORT_RECEIVE_STATUS_COUNT)
- return KERN_FAILURE;
-
+ mach_port_status_t *statusp = (mach_port_status_t *)info;
+
+ if (*count < MACH_PORT_RECEIVE_STATUS_COUNT)
+ return KERN_FAILURE;
+
if (!MACH_PORT_VALID(name))
return KERN_INVALID_RIGHT;
- kr = ipc_port_translate_receive(space, name, &port);
- if (kr != KERN_SUCCESS)
- return kr;
- /* port is locked and active */
-
- statusp->mps_pset = port->ip_pset_count;
-
- s = splsched();
- imq_lock(&port->ip_messages);
- statusp->mps_seqno = port->ip_messages.imq_seqno;
- statusp->mps_qlimit = port->ip_messages.imq_qlimit;
- statusp->mps_msgcount = port->ip_messages.imq_msgcount;
- imq_unlock(&port->ip_messages);
- splx(s);
-
- statusp->mps_mscount = port->ip_mscount;
- statusp->mps_sorights = port->ip_sorights;
- statusp->mps_srights = port->ip_srights > 0;
- statusp->mps_pdrequest = port->ip_pdrequest != IP_NULL;
- statusp->mps_nsrequest = port->ip_nsrequest != IP_NULL;
- statusp->mps_flags = 0;
-
- *count = MACH_PORT_RECEIVE_STATUS_COUNT;
- ip_unlock(port);
- break;
- }
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+ /* port is locked and active */
+ mach_port_get_status_helper(port, statusp);
+ *count = MACH_PORT_RECEIVE_STATUS_COUNT;
+ ip_unlock(port);
+ break;
+ }
case MACH_PORT_DNREQUESTS_SIZE: {
ipc_port_request_t table;
break;
}
+ case MACH_PORT_INFO_EXT: {
+ mach_port_info_ext_t *mp_info = (mach_port_info_ext_t *)info;
+ if (*count < MACH_PORT_INFO_EXT_COUNT)
+ return KERN_FAILURE;
+
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_RIGHT;
+
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+ /* port is locked and active */
+ mach_port_get_status_helper(port, &mp_info->mpie_status);
+ mp_info->mpie_boost_cnt = port->ip_impcount;
+ *count = MACH_PORT_INFO_EXT_COUNT;
+ ip_unlock(port);
+ break;
+ }
+
default:
return KERN_INVALID_ARGUMENT;
/*NOTREACHED*/
return kr;
break;
}
+ case MACH_PORT_TEMPOWNER:
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_RIGHT;
+
+ ipc_importance_task_t release_imp_task = IIT_NULL;
+ natural_t assertcnt = 0;
+
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+ /* port is locked and active */
+
+ /*
+ * don't allow temp-owner importance donation if user
+ * associated it with a kobject already (timer, host_notify target).
+ */
+ if (is_ipc_kobject(ip_kotype(port))) {
+ ip_unlock(port);
+ return KERN_INVALID_ARGUMENT;
+ }
+
+ if (port->ip_tempowner != 0) {
+ if (IIT_NULL != port->ip_imp_task) {
+ release_imp_task = port->ip_imp_task;
+ port->ip_imp_task = IIT_NULL;
+ assertcnt = port->ip_impcount;
+ }
+ } else {
+ assertcnt = port->ip_impcount;
+ }
+
+ port->ip_impdonation = 1;
+ port->ip_tempowner = 1;
+ ip_unlock(port);
+
+#if IMPORTANCE_INHERITANCE
+ /* drop assertions from previous destination task */
+ if (release_imp_task != IIT_NULL) {
+ assert(ipc_importance_task_is_any_receiver_type(release_imp_task));
+ if (assertcnt > 0)
+ ipc_importance_task_drop_internal_assertion(release_imp_task, assertcnt);
+ ipc_importance_task_release(release_imp_task);
+ } else if (assertcnt > 0) {
+ release_imp_task = current_task()->task_imp_base;
+ if (release_imp_task != IIT_NULL &&
+ ipc_importance_task_is_any_receiver_type(release_imp_task)) {
+ ipc_importance_task_drop_internal_assertion(release_imp_task, assertcnt);
+ }
+ }
+#else
+ if (release_imp_task != IIT_NULL)
+ ipc_importance_task_release(release_imp_task);
+#endif /* IMPORTANCE_INHERITANCE */
+
+ break;
+
+#if IMPORTANCE_INHERITANCE
+ case MACH_PORT_DENAP_RECEIVER:
+ case MACH_PORT_IMPORTANCE_RECEIVER:
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_RIGHT;
+
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+
+ /*
+ * don't allow importance donation if user associated
+ * it with a kobject already (timer, host_notify target).
+ */
+ if (is_ipc_kobject(ip_kotype(port))) {
+ ip_unlock(port);
+ return KERN_INVALID_ARGUMENT;
+ }
+
+ /* port is locked and active */
+ port->ip_impdonation = 1;
+ ip_unlock(port);
+
+ break;
+#endif /* IMPORTANCE_INHERITANCE */
+
default:
return KERN_INVALID_ARGUMENT;
/*NOTREACHED*/
}
/*
- * Get a (new) label handle representing the given port's port label.
+ * Routine: mach_port_guard_locked [helper routine]
+ * Purpose:
+ * Sets a new guard for a locked port.
+ * Conditions:
+ * Port Locked.
+ * Returns:
+ * KERN_SUCCESS Port Guarded.
+ * KERN_INVALID_ARGUMENT Port already contains a context/guard.
*/
-#if CONFIG_MACF_MACH
-kern_return_t
-mach_get_label(
- ipc_space_t space,
- mach_port_name_t name,
- mach_port_name_t *outlabel)
+static kern_return_t
+mach_port_guard_locked(
+ ipc_port_t port,
+ uint64_t guard,
+ boolean_t strict)
{
- ipc_entry_t entry;
- ipc_port_t port;
- struct label outl;
- kern_return_t kr;
- int dead;
-
- if (!MACH_PORT_VALID(name))
- return KERN_INVALID_NAME;
+ if (port->ip_context)
+ return KERN_INVALID_ARGUMENT;
- /* Lookup the port name in the task's space. */
- kr = ipc_right_lookup_write(space, name, &entry);
- if (kr != KERN_SUCCESS)
- return kr;
+ port->ip_context = guard;
+ port->ip_guarded = 1;
+ port->ip_strict_guard = (strict)?1:0;
+ return KERN_SUCCESS;
+}
- port = (ipc_port_t) entry->ie_object;
- dead = ipc_right_check(space, port, name, entry);
- if (dead) {
- is_write_unlock(space);
- ip_release(port);
- return KERN_INVALID_RIGHT;
+/*
+ * Routine: mach_port_unguard_locked [helper routine]
+ * Purpose:
+ * Removes guard for a locked port.
+ * Conditions:
+ * Port Locked.
+ * Returns:
+ * KERN_SUCCESS Port Unguarded.
+ * KERN_INVALID_ARGUMENT Port is either unguarded already or guard mismatch.
+ * This also raises a EXC_GUARD exception.
+ */
+static kern_return_t
+mach_port_unguard_locked(
+ ipc_port_t port,
+ mach_port_name_t name,
+ uint64_t guard)
+{
+ /* Port locked and active */
+ if (!port->ip_guarded) {
+ /* Port already unguarded; Raise exception */
+ mach_port_guard_exception(name, guard, 0, kGUARD_EXC_UNGUARDED);
+ return KERN_INVALID_ARGUMENT;
}
- /* port is now locked */
- is_write_unlock(space);
- /* Make sure we are not dealing with a label handle. */
- if (ip_kotype(port) == IKOT_LABELH) {
- /* already is a label handle! */
- ip_unlock(port);
+ if (port->ip_context != guard) {
+ /* Incorrect guard; Raise exception */
+ mach_port_guard_exception(name, guard, port->ip_context, kGUARD_EXC_INCORRECT_GUARD);
return KERN_INVALID_ARGUMENT;
}
- /* Copy the port label and stash it in a new label handle. */
- mac_port_label_init(&outl);
- mac_port_label_copy(&port->ip_label, &outl);
- kr = labelh_new_user(space, &outl, outlabel);
- ip_unlock(port);
-
+ port->ip_context = 0;
+ port->ip_guarded = port->ip_strict_guard = 0;
return KERN_SUCCESS;
}
-#else
+
+
+/*
+ * Routine: mach_port_guard_exception [helper routine]
+ * Purpose:
+ * Marks the thread with AST_GUARD for mach port guard violation.
+ * Also saves exception info in thread structure.
+ * Conditions:
+ * None.
+ * Returns:
+ * KERN_FAILURE Thread marked with AST_GUARD.
+ */
kern_return_t
-mach_get_label(
- __unused ipc_space_t space,
- __unused mach_port_name_t name,
- __unused mach_port_name_t *outlabel)
+mach_port_guard_exception(
+ mach_port_name_t name,
+ uint64_t inguard,
+ uint64_t portguard,
+ unsigned reason)
{
- return KERN_INVALID_ARGUMENT;
+ thread_t t = current_thread();
+ uint64_t code, subcode;
+
+ /* Log exception info to syslog */
+ printf( "Mach Port Guard Exception - "
+ "Thread: 0x%x, "
+ "Port Name: 0x%x, "
+ "Expected Guard: 0x%x, "
+ "Received Guard: 0x%x\n",
+ (unsigned)t,
+ (unsigned)name,
+ (unsigned)portguard,
+ (unsigned)inguard);
+
+ /*
+ * EXC_GUARD namespace for mach ports
+ *
+ *
+ * Mach Port guards use the exception codes like
+ *
+ * code:
+ * +----------------------------------------------------------------+
+ * |[63:61] GUARD_TYPE_MACH_PORT | [60:32] flavor | [31:0] port name|
+ * +----------------------------------------------------------------+
+ *
+ * subcode:
+ * +----------------------------------------------------------------+
+ * | [63:0] guard value |
+ * +----------------------------------------------------------------+
+ */
+
+ code = (((uint64_t)GUARD_TYPE_MACH_PORT) << 61) |
+ (((uint64_t)reason) << 32) |
+ ((uint64_t)name);
+ subcode = (uint64_t)(portguard);
+
+ t->guard_exc_info.code = code;
+ t->guard_exc_info.subcode = subcode;
+
+ /* Mark thread with AST_GUARD */
+ thread_guard_violation(t, GUARD_TYPE_MACH_PORT);
+ return KERN_FAILURE;
+}
+
+
+/*
+ * Routine: mach_port_guard_ast
+ * Purpose:
+ * Raises an exception for mach port guard violation.
+ * Conditions:
+ * None.
+ * Returns:
+ * None.
+ */
+
+void
+mach_port_guard_ast(thread_t t)
+{
+ mach_exception_data_type_t code[EXCEPTION_CODE_MAX];
+
+ code[0] = t->guard_exc_info.code;
+ code[1] = t->guard_exc_info.subcode;
+
+ /* Raise an EXC_GUARD exception */
+ exception_triage(EXC_GUARD, code, EXCEPTION_CODE_MAX);
+
+ /* Terminate task which caused the exception */
+ (void) task_terminate_internal(current_task());
+ return;
}
-#endif
/*
- * also works on label handles
+ * Routine: mach_port_construct [kernel call]
+ * Purpose:
+ * Constructs a mach port with the provided set of options.
+ * Conditions:
+ * None.
+ * Returns:
+ * KERN_SUCCESS The right is allocated.
+ * KERN_INVALID_TASK The space is null.
+ * KERN_INVALID_TASK The space is dead.
+ * KERN_RESOURCE_SHORTAGE Couldn't allocate memory.
+ * KERN_NO_SPACE No room in space for another right.
+ * KERN_FAILURE Illegal option values requested.
*/
-#if CONFIG_MACF_MACH
+
kern_return_t
-mach_get_label_text(
+mach_port_construct(
ipc_space_t space,
- mach_port_name_t name,
- labelstr_t policies,
- labelstr_t outlabel)
+ mach_port_options_t *options,
+ uint64_t context,
+ mach_port_name_t *name)
{
- ipc_entry_t entry;
- ipc_port_t port;
- kern_return_t kr;
- struct label *l;
- int dead;
-
- if (space == IS_NULL || space->is_task == NULL)
- return KERN_INVALID_TASK;
+ kern_return_t kr;
+ ipc_port_t port;
- if (!MACH_PORT_VALID(name))
- return KERN_INVALID_NAME;
+ if (space == IS_NULL)
+ return (KERN_INVALID_TASK);
- kr = ipc_right_lookup_write(space, name, &entry);
+ /* Allocate a new port in the IPC space */
+ kr = ipc_port_alloc(space, name, &port);
if (kr != KERN_SUCCESS)
return kr;
+
+ /* Port locked and active */
+ if (options->flags & MPO_CONTEXT_AS_GUARD) {
+ kr = mach_port_guard_locked(port, (uint64_t) context, (options->flags & MPO_STRICT));
+ /* A newly allocated and locked port should always be guarded successfully */
+ assert(kr == KERN_SUCCESS);
+ } else {
+ port->ip_context = context;
+ }
+
+ /* Unlock port */
+ ip_unlock(port);
- port = (ipc_port_t)entry->ie_object;
- dead = ipc_right_check(space, port, name, entry);
- if (dead) {
- is_write_unlock(space);
- ip_release(port);
- return KERN_INVALID_RIGHT;
+ /* Set port attributes as requested */
+
+ if (options->flags & MPO_QLIMIT) {
+ kr = mach_port_set_attributes(space, *name, MACH_PORT_LIMITS_INFO,
+ (mach_port_info_t)&options->mpl, sizeof(options->mpl)/sizeof(int));
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
+ }
+
+ if (options->flags & MPO_TEMPOWNER) {
+ kr = mach_port_set_attributes(space, *name, MACH_PORT_TEMPOWNER, NULL, 0);
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
}
- /* object (port) is now locked */
- is_write_unlock (space);
- l = io_getlabel(entry->ie_object);
+ if (options->flags & MPO_IMPORTANCE_RECEIVER) {
+ kr = mach_port_set_attributes(space, *name, MACH_PORT_IMPORTANCE_RECEIVER, NULL, 0);
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
+ }
- mac_port_label_externalize(l, policies, outlabel, 512, 0);
+ if (options->flags & MPO_DENAP_RECEIVER) {
+ kr = mach_port_set_attributes(space, *name, MACH_PORT_DENAP_RECEIVER, NULL, 0);
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
+ }
+
+ if (options->flags & MPO_INSERT_SEND_RIGHT) {
+ kr = ipc_object_copyin(space, *name, MACH_MSG_TYPE_MAKE_SEND, (ipc_object_t *)&port);
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
+
+ kr = mach_port_insert_right(space, *name, port, MACH_MSG_TYPE_PORT_SEND);
+ if (kr != KERN_SUCCESS)
+ goto cleanup;
+ }
- io_unlocklabel(entry->ie_object);
- io_unlock(entry->ie_object);
return KERN_SUCCESS;
+
+cleanup:
+ /* Attempt to destroy port. If its already destroyed by some other thread, we're done */
+ (void) mach_port_destruct(space, *name, 0, context);
+ return kr;
}
-#else
-kern_return_t
-mach_get_label_text(
- __unused ipc_space_t space,
- __unused mach_port_name_t name,
- __unused labelstr_t policies,
- __unused labelstr_t outlabel)
-{
- return KERN_INVALID_ARGUMENT;
-}
-#endif
+/*
+ * Routine: mach_port_destruct [kernel call]
+ * Purpose:
+ * Destroys a mach port with appropriate guard
+ * Conditions:
+ * None.
+ * Returns:
+ * KERN_SUCCESS The name is destroyed.
+ * KERN_INVALID_TASK The space is null.
+ * KERN_INVALID_TASK The space is dead.
+ * KERN_INVALID_NAME The name doesn't denote a right.
+ * KERN_INVALID_RIGHT The right isn't correct.
+ * KERN_INVALID_VALUE The delta for send right is incorrect.
+ * KERN_INVALID_ARGUMENT Port is either unguarded already or guard mismatch.
+ * This also raises a EXC_GUARD exception.
+ */
-#if CONFIG_MACF_MACH
kern_return_t
-mach_set_port_label(
+mach_port_destruct(
ipc_space_t space,
mach_port_name_t name,
- labelstr_t labelstr)
+ mach_port_delta_t srdelta,
+ uint64_t guard)
{
- ipc_entry_t entry;
- kern_return_t kr;
- struct label inl;
- ipc_port_t port;
- int rc;
+ kern_return_t kr;
+ ipc_entry_t entry;
- if (space == IS_NULL || space->is_task == NULL)
+ if (space == IS_NULL)
return KERN_INVALID_TASK;
if (!MACH_PORT_VALID(name))
return KERN_INVALID_NAME;
- mac_port_label_init(&inl);
- rc = mac_port_label_internalize(&inl, labelstr);
- if (rc)
- return KERN_INVALID_ARGUMENT;
-
+ /* Remove reference for receive right */
kr = ipc_right_lookup_write(space, name, &entry);
if (kr != KERN_SUCCESS)
return kr;
+ /* space is write-locked and active */
+ kr = ipc_right_destruct(space, name, entry, srdelta, guard); /* unlocks */
- if (io_otype(entMACry->ie_object) != IOT_PORT) {
- is_write_unlock(space);
- return KERN_INVALID_RIGHT;
- }
+ return kr;
+}
- port = (ipc_port_t) entry->ie_object;
- ip_lock(port);
+/*
+ * Routine: mach_port_guard [kernel call]
+ * Purpose:
+ * Guard a mach port with specified guard value.
+ * The context field of the port is used as the guard.
+ * Conditions:
+ * None.
+ * Returns:
+ * KERN_SUCCESS The name is destroyed.
+ * KERN_INVALID_TASK The space is null.
+ * KERN_INVALID_TASK The space is dead.
+ * KERN_INVALID_NAME The name doesn't denote a right.
+ * KERN_INVALID_RIGHT The right isn't correct.
+ * KERN_INVALID_ARGUMENT Port already contains a context/guard.
+ */
+kern_return_t
+mach_port_guard(
+ ipc_space_t space,
+ mach_port_name_t name,
+ uint64_t guard,
+ boolean_t strict)
+{
+ kern_return_t kr;
+ ipc_port_t port;
- tasklabel_lock(space->is_task);
- rc = mac_port_check_label_update(&space->is_task->maclabel,
- &port->ip_label, &inl);
- tasklabel_unlock(space->is_task);
- if (rc)
- kr = KERN_NO_ACCESS;
- else
- mac_port_label_copy(&inl, &port->ip_label);
+ if (space == IS_NULL)
+ return KERN_INVALID_TASK;
+
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_NAME;
+
+ /* Guard can be applied only to receive rights */
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+ /* Port locked and active */
+ kr = mach_port_guard_locked(port, guard, strict);
ip_unlock(port);
- is_write_unlock(space);
+
return kr;
+
}
-#else
+
+/*
+ * Routine: mach_port_unguard [kernel call]
+ * Purpose:
+ * Unguard a mach port with specified guard value.
+ * Conditions:
+ * None.
+ * Returns:
+ * KERN_SUCCESS The name is destroyed.
+ * KERN_INVALID_TASK The space is null.
+ * KERN_INVALID_TASK The space is dead.
+ * KERN_INVALID_NAME The name doesn't denote a right.
+ * KERN_INVALID_RIGHT The right isn't correct.
+ * KERN_INVALID_ARGUMENT Port is either unguarded already or guard mismatch.
+ * This also raises a EXC_GUARD exception.
+ */
kern_return_t
-mach_set_port_label(
- ipc_space_t space __unused,
- mach_port_name_t name __unused,
- labelstr_t labelstr __unused)
+mach_port_unguard(
+ ipc_space_t space,
+ mach_port_name_t name,
+ uint64_t guard)
{
- return KERN_INVALID_ARGUMENT;
+
+ kern_return_t kr;
+ ipc_port_t port;
+
+ if (space == IS_NULL)
+ return KERN_INVALID_TASK;
+
+ if (!MACH_PORT_VALID(name))
+ return KERN_INVALID_NAME;
+
+ kr = ipc_port_translate_receive(space, name, &port);
+ if (kr != KERN_SUCCESS)
+ return kr;
+
+ /* Port locked and active */
+ kr = mach_port_unguard_locked(port, name, guard);
+ ip_unlock(port);
+ return kr;
}
-#endif
+
projects / apple / xnu.git / blobdiff