xnu-4570.31.3.tar.gz

[apple/xnu.git] / bsd / kern / kern_cs.c

diff --git a/bsd/kern/kern_cs.c b/bsd/kern/kern_cs.c
index 214b041b7ac4784bae5ed2ba9ded39676ecbcc11..7a3d22baf6907ed3d9a90f4a87ca2aa2aed17373 100644 (file)
--- a/bsd/kern/kern_cs.c
+++ b/bsd/kern/kern_cs.c
@@ -84,6 +84,7 @@ const int cs_enforcement_enable = 1;
 const int cs_library_val_enable = 1;
 #else /* !SECURE_KERNEL */
 int cs_enforcement_panic=0;
+int cs_relax_platform_task_ports = 0;
 
 #if CONFIG_ENFORCE_SIGNED_CODE
 #define DEFAULT_CS_ENFORCEMENT_ENABLE 1
@@ -120,6 +121,7 @@ SYSCTL_INT(_vm, OID_AUTO, cs_library_validation, CTLFLAG_RW | CTLFLAG_LOCKED, &c
 #endif /* !SECURE_KERNEL */
 
 int panic_on_cs_killed = 0;
+
 void
 cs_init(void)
 {
@@ -140,6 +142,10 @@ cs_init(void)
                cs_enforcement_panic = (panic != 0);
        }
 
+       PE_parse_boot_argn("cs_relax_platform_task_ports",
+                       &cs_relax_platform_task_ports,
+                       sizeof(cs_relax_platform_task_ports));
+
        PE_parse_boot_argn("cs_debug", &cs_debug, sizeof (cs_debug));
 
 #if !CONFIG_ENFORCE_LIBRARY_VALIDATION
@@ -180,7 +186,9 @@ cs_allow_invalid(struct proc *p)
        {
                p->p_csflags |= CS_DEBUGGED;
        }
+       
        proc_unlock(p);
+       
        vm_map_switch_protect(get_task_map(p->task), FALSE);
 #endif
        return (p->p_csflags & (CS_KILL | CS_HARD)) == 0;
@@ -378,6 +386,18 @@ csblob_get_flags(struct cs_blob *blob)
     return blob->csb_flags;
 }
 
+/*
+ * Function: csblob_get_hashtype
+ *
+ * Description: This function returns the hash type for a given blob
+*/
+
+uint8_t
+csblob_get_hashtype(struct cs_blob const * const blob)
+{
+    return blob->csb_hashtype != NULL ? cs_hash_type(blob->csb_hashtype) : 0;
+}
+
 /*
  * Function: csproc_get_blob
  *
@@ -453,6 +473,18 @@ csblob_get_cdhash(struct cs_blob *csblob)
        return csblob->csb_cdhash;
 }
 
+/*
+ * Function: csblob_get_signer_type
+ *
+ * Description: This function returns the signer type
+ *             as an integer
+ */
+unsigned int
+csblob_get_signer_type(struct cs_blob *csblob)
+{
+       return csblob->csb_signer_type;
+}
+
 void *
 csblob_entitlements_dictionary_copy(struct cs_blob *csblob)
 {
@@ -487,6 +519,24 @@ csproc_get_teamid(struct proc *p)
        return csblob_get_teamid(csblob);
 }
 
+/*
+ * Function: csproc_get_signer_type 
+ *
+ * Description: This function returns the signer type
+ *             of the process p
+*/
+unsigned int
+csproc_get_signer_type(struct proc *p)
+{
+       struct cs_blob *csblob;
+
+       csblob = csproc_get_blob(p);
+       if (csblob == NULL)
+           return CS_SIGNER_TYPE_UNKNOWN;
+
+       return csblob_get_signer_type(csblob);
+}
+
 /*
  * Function: csvnode_get_teamid 
  *
@@ -534,6 +584,26 @@ csproc_get_platform_path(struct proc *p)
        return (csblob == NULL) ? 0 : csblob->csb_platform_path;
 }
 
+#if DEVELOPMENT || DEBUG
+void
+csproc_clear_platform_binary(struct proc *p)
+{
+       struct cs_blob *csblob = csproc_get_blob(p);
+
+       if (csblob == NULL) {
+               return;
+       }
+
+       if (cs_debug) {
+               printf("clearing platform binary on proc/task: pid = %d\n", p->p_pid);
+       }
+
+       csblob->csb_platform_binary = 0;
+       csblob->csb_platform_path = 0;
+       task_set_platform_binary(proc_task(p), FALSE);
+}
+#endif
+
 /*
  * Function: csproc_get_prod_signed
  *
@@ -611,6 +681,46 @@ csfg_get_cdhash(struct fileglob *fg, uint64_t offset, size_t *cdhash_size)
        return csblob->csb_cdhash;
 }
 
+/*
+ * Function: csfg_get_signer_type
+ *
+ * Description: This returns the signer type
+ *             for the fileglob fg
+ */
+unsigned int
+csfg_get_signer_type(struct fileglob *fg)
+{
+       struct ubc_info *uip;
+       unsigned int signer_type = CS_SIGNER_TYPE_UNKNOWN;
+       vnode_t vp;
+
+       if (FILEGLOB_DTYPE(fg) != DTYPE_VNODE)
+               return CS_SIGNER_TYPE_UNKNOWN;
+       
+       vp = (struct vnode *)fg->fg_data;
+       if (vp == NULL)
+               return CS_SIGNER_TYPE_UNKNOWN;
+
+       vnode_lock(vp);
+       if (!UBCINFOEXISTS(vp))
+               goto out;
+       
+       uip = vp->v_ubcinfo;
+       if (uip == NULL)
+               goto out;
+       
+       if (uip->cs_blobs == NULL)
+               goto out;
+
+       /* It is OK to extract the signer type from the first blob,
+          because all blobs of a vnode must have the same signer type. */      
+       signer_type = uip->cs_blobs->csb_signer_type;
+out:
+       vnode_unlock(vp);
+
+       return signer_type;
+}
+
 /*
  * Function: csfg_get_teamid
  *
@@ -666,11 +776,11 @@ csfg_get_prod_signed(struct fileglob *fg)
        int prod_signed = 0;
 
        if (FILEGLOB_DTYPE(fg) != DTYPE_VNODE)
-               return NULL;
+               return 0;
        
        vp = (struct vnode *)fg->fg_data;
        if (vp == NULL)
-               return NULL;
+               return 0;
 
        vnode_lock(vp);
        if (!UBCINFOEXISTS(vp))