+
+/*
+ * CODESIGNING
+ * Routines to navigate code signing data structures in the kernel...
+ */
+
+extern int cs_debug;
+
+static boolean_t
+cs_valid_range(
+ const void *start,
+ const void *end,
+ const void *lower_bound,
+ const void *upper_bound)
+{
+ if (upper_bound < lower_bound ||
+ end < start) {
+ return FALSE;
+ }
+
+ if (start < lower_bound ||
+ end > upper_bound) {
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+/*
+ * Magic numbers used by Code Signing
+ */
+enum {
+ CSMAGIC_REQUIREMENT = 0xfade0c00, /* single Requirement blob */
+ CSMAGIC_REQUIREMENTS = 0xfade0c01, /* Requirements vector (internal requirements) */
+ CSMAGIC_CODEDIRECTORY = 0xfade0c02, /* CodeDirectory blob */
+ CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0, /* embedded form of signature data */
+ CSMAGIC_EMBEDDED_SIGNATURE_OLD = 0xfade0b02, /* XXX */
+ CSMAGIC_EMBEDDED_ENTITLEMENTS = 0xfade7171, /* embedded entitlements */
+ CSMAGIC_DETACHED_SIGNATURE = 0xfade0cc1, /* multi-arch collection of embedded signatures */
+
+ CSSLOT_CODEDIRECTORY = 0, /* slot index for CodeDirectory */
+ CSSLOT_ENTITLEMENTS = 5
+};
+
+static const uint32_t supportsScatter = 0x20100; // first version to support scatter option
+
+/*
+ * Structure of an embedded-signature SuperBlob
+ */
+typedef struct __BlobIndex {
+ uint32_t type; /* type of entry */
+ uint32_t offset; /* offset of entry */
+} CS_BlobIndex;
+
+typedef struct __SuperBlob {
+ uint32_t magic; /* magic number */
+ uint32_t length; /* total length of SuperBlob */
+ uint32_t count; /* number of index entries following */
+ CS_BlobIndex index[]; /* (count) entries */
+ /* followed by Blobs in no particular order as indicated by offsets in index */
+} CS_SuperBlob;
+
+typedef struct __GenericBlob {
+ uint32_t magic; /* magic number */
+ uint32_t length; /* total length of blob */
+ char data[];
+} CS_GenericBlob;
+
+struct Scatter {
+ uint32_t count; // number of pages; zero for sentinel (only)
+ uint32_t base; // first page number
+ uint64_t targetOffset; // offset in target
+ uint64_t spare; // reserved
+};
+
+/*
+ * C form of a CodeDirectory.
+ */
+typedef struct __CodeDirectory {
+ uint32_t magic; /* magic number (CSMAGIC_CODEDIRECTORY) */
+ uint32_t length; /* total length of CodeDirectory blob */
+ uint32_t version; /* compatibility version */
+ uint32_t flags; /* setup and mode flags */
+ uint32_t hashOffset; /* offset of hash slot element at index zero */
+ uint32_t identOffset; /* offset of identifier string */
+ uint32_t nSpecialSlots; /* number of special hash slots */
+ uint32_t nCodeSlots; /* number of ordinary (code) hash slots */
+ uint32_t codeLimit; /* limit to main image signature range */
+ uint8_t hashSize; /* size of each hash in bytes */
+ uint8_t hashType; /* type of hash (cdHashType* constants) */
+ uint8_t spare1; /* unused (must be zero) */
+ uint8_t pageSize; /* log2(page size in bytes); 0 => infinite */
+ uint32_t spare2; /* unused (must be zero) */
+ /* Version 0x20100 */
+ uint32_t scatterOffset; /* offset of optional scatter vector */
+ /* followed by dynamic content as located by offset fields above */
+} CS_CodeDirectory;
+
+
+/*
+ * Locate the CodeDirectory from an embedded signature blob
+ */
+static const
+CS_CodeDirectory *findCodeDirectory(
+ const CS_SuperBlob *embedded,
+ char *lower_bound,
+ char *upper_bound)
+{
+ const CS_CodeDirectory *cd = NULL;
+
+ if (embedded &&
+ cs_valid_range(embedded, embedded + 1, lower_bound, upper_bound) &&
+ ntohl(embedded->magic) == CSMAGIC_EMBEDDED_SIGNATURE) {
+ const CS_BlobIndex *limit;
+ const CS_BlobIndex *p;
+
+ limit = &embedded->index[ntohl(embedded->count)];
+ if (!cs_valid_range(&embedded->index[0], limit,
+ lower_bound, upper_bound)) {
+ return NULL;
+ }
+ for (p = embedded->index; p < limit; ++p) {
+ if (ntohl(p->type) == CSSLOT_CODEDIRECTORY) {
+ const unsigned char *base;
+
+ base = (const unsigned char *)embedded;
+ cd = (const CS_CodeDirectory *)(base + ntohl(p->offset));
+ break;
+ }
+ }
+ } else {
+ /*
+ * Detached signatures come as a bare CS_CodeDirectory,
+ * without a blob.
+ */
+ cd = (const CS_CodeDirectory *) embedded;
+ }
+
+ if (cd &&
+ cs_valid_range(cd, cd + 1, lower_bound, upper_bound) &&
+ cs_valid_range(cd, (const char *) cd + ntohl(cd->length),
+ lower_bound, upper_bound) &&
+ cs_valid_range(cd, (const char *) cd + ntohl(cd->hashOffset),
+ lower_bound, upper_bound) &&
+ cs_valid_range(cd, (const char *) cd +
+ ntohl(cd->hashOffset) +
+ (ntohl(cd->nCodeSlots) * SHA1_RESULTLEN),
+ lower_bound, upper_bound) &&
+
+ ntohl(cd->magic) == CSMAGIC_CODEDIRECTORY) {
+ return cd;
+ }
+
+ // not found or not a valid code directory
+ return NULL;
+}
+
+
+/*
+ * Locating a page hash
+ */
+static const unsigned char *
+hashes(
+ const CS_CodeDirectory *cd,
+ unsigned page,
+ char *lower_bound,
+ char *upper_bound)
+{
+ const unsigned char *base, *top, *hash;
+ uint32_t nCodeSlots = ntohl(cd->nCodeSlots);
+
+ assert(cs_valid_range(cd, cd + 1, lower_bound, upper_bound));
+
+ if((ntohl(cd->version) >= supportsScatter) && (ntohl(cd->scatterOffset))) {
+ /* Get first scatter struct */
+ const struct Scatter *scatter = (const struct Scatter*)
+ ((const char*)cd + ntohl(cd->scatterOffset));
+ uint32_t hashindex=0, scount, sbase=0;
+ /* iterate all scatter structs */
+ do {
+ if((const char*)scatter > (const char*)cd + ntohl(cd->length)) {
+ if(cs_debug) {
+ printf("CODE SIGNING: Scatter extends past Code Directory\n");
+ }
+ return NULL;
+ }
+
+ scount = ntohl(scatter->count);
+ uint32_t new_base = ntohl(scatter->base);
+
+ /* last scatter? */
+ if (scount == 0) {
+ return NULL;
+ }
+
+ if((hashindex > 0) && (new_base <= sbase)) {
+ if(cs_debug) {
+ printf("CODE SIGNING: unordered Scatter, prev base %d, cur base %d\n",
+ sbase, new_base);
+ }
+ return NULL; /* unordered scatter array */
+ }
+ sbase = new_base;
+
+ /* this scatter beyond page we're looking for? */
+ if (sbase > page) {
+ return NULL;
+ }
+
+ if (sbase+scount >= page) {
+ /* Found the scatter struct that is
+ * referencing our page */
+
+ /* base = address of first hash covered by scatter */
+ base = (const unsigned char *)cd + ntohl(cd->hashOffset) +
+ hashindex * SHA1_RESULTLEN;
+ /* top = address of first hash after this scatter */
+ top = base + scount * SHA1_RESULTLEN;
+ if (!cs_valid_range(base, top, lower_bound,
+ upper_bound) ||
+ hashindex > nCodeSlots) {
+ return NULL;
+ }
+
+ break;
+ }
+
+ /* this scatter struct is before the page we're looking
+ * for. Iterate. */
+ hashindex+=scount;
+ scatter++;
+ } while(1);
+
+ hash = base + (page - sbase) * SHA1_RESULTLEN;
+ } else {
+ base = (const unsigned char *)cd + ntohl(cd->hashOffset);
+ top = base + nCodeSlots * SHA1_RESULTLEN;
+ if (!cs_valid_range(base, top, lower_bound, upper_bound) ||
+ page > nCodeSlots) {
+ return NULL;
+ }
+ assert(page < nCodeSlots);
+
+ hash = base + page * SHA1_RESULTLEN;
+ }
+
+ if (!cs_valid_range(hash, hash + SHA1_RESULTLEN,
+ lower_bound, upper_bound)) {
+ hash = NULL;
+ }
+
+ return hash;
+}
+/*
+ * CODESIGNING
+ * End of routines to navigate code signing data structures in the kernel.
+ */
+
+/*
+ * ENTITLEMENTS
+ * Routines to navigate entitlements in the kernel.
+ */
+
+/* Retrieve the entitlements blob for a process.
+ * Returns:
+ * EINVAL no text vnode associated with the process
+ * EBADEXEC invalid code signing data
+ * ENOMEM you should reboot
+ * 0 no error occurred
+ *
+ * On success, out_start and out_length will point to the
+ * entitlements blob if found; or will be set to NULL/zero
+ * if there were no entitlements.
+ */
+int
+cs_entitlements_blob_get(proc_t p, void **out_start, size_t *out_length)
+{
+ SHA1_CTX context; /* XXX hash agility */
+ int error = 0;
+ struct cs_blob *blob_list_entry;
+ CS_SuperBlob *super_blob;
+ CS_BlobIndex *blob_index;
+ CS_GenericBlob *blob;
+ CS_CodeDirectory *code_dir;
+ unsigned char *computed_hash = NULL;
+ unsigned char *embedded_hash = NULL;
+ void *start = NULL;
+ size_t length = 0;
+ size_t hash_size = 0;
+ unsigned int i, count;
+
+ if (NULL == p->p_textvp) {
+ error = EINVAL;
+ goto out;
+ }
+ if (NULL == (blob_list_entry = ubc_cs_blob_get(p->p_textvp, -1,
+ p->p_textoff)))
+ goto out;
+ super_blob = (void *)blob_list_entry->csb_mem_kaddr;
+ if (CSMAGIC_EMBEDDED_SIGNATURE != ntohl(super_blob->magic)) {
+ error = EBADEXEC;
+ goto out;
+ }
+ count = ntohl(super_blob->count);
+ for (i = 0; i < count; ++i) {
+ blob_index = &super_blob->index[i];
+ blob = (void *)((char *)super_blob + ntohl(blob_index->offset));
+ switch (ntohl(blob_index->type)) {
+ case CSSLOT_CODEDIRECTORY:
+ if (CSMAGIC_CODEDIRECTORY != ntohl(blob->magic))
+ break;
+ code_dir = (void *)blob;
+ hash_size = code_dir->hashSize;
+ if (CSSLOT_ENTITLEMENTS <=
+ ntohl(code_dir->nSpecialSlots)) {
+ embedded_hash = (void *)((char *)code_dir +
+ ntohl(code_dir->hashOffset) -
+ (hash_size * CSSLOT_ENTITLEMENTS));
+ }
+ break;
+ case CSSLOT_ENTITLEMENTS:
+ if (CSMAGIC_EMBEDDED_ENTITLEMENTS != ntohl(blob->magic))
+ break;
+ start = (void *)blob;
+ length = ntohl(blob->length);
+ break;
+ default:
+ break;
+ }
+ }
+ if (NULL == start && NULL == embedded_hash) {
+ error = 0;
+ goto out;
+ } else if (NULL == start || NULL == embedded_hash) {
+ error = EBADEXEC;
+ goto out;
+ }
+ if (NULL == (computed_hash = kalloc(hash_size))) {
+ error = ENOMEM;
+ goto out;
+ }
+ SHA1Init(&context);
+ SHA1Update(&context, start, length);
+ SHA1Final(computed_hash, &context);
+ if (0 != memcmp(computed_hash, embedded_hash, hash_size)) {
+ error = EBADEXEC;
+ goto out;
+ }
+ error = 0;
+out:
+ if (NULL != computed_hash)
+ kfree(computed_hash, hash_size);
+ if (0 == error) {
+ *out_start = start;
+ *out_length = length;
+ }
+ return error;
+}
+
+/*
+ * ENTITLEMENTS
+ * End of routines to navigate entitlements in the kernel.
+ */
+
+
+
projects / apple / xnu.git / blobdiff