xnu-3248.40.184.tar.gz

[apple/xnu.git] / bsd / sys / codesign.h

diff --git a/bsd/sys/codesign.h b/bsd/sys/codesign.h
index 1a23c3d0a4fbb4e5d4173877d488c79f0dc5f381..5f78699a4e48a52b798a323ebd8b759dac4cb0dc 100644 (file)
--- a/bsd/sys/codesign.h
+++ b/bsd/sys/codesign.h
@@ -52,6 +52,9 @@
 
 #define CS_KILLED              0x1000000       /* was killed by kernel for invalidity */
 #define CS_DYLD_PLATFORM       0x2000000       /* dyld used to load this is a platform binary */
+#define CS_PLATFORM_BINARY     0x4000000       /* this is a platform binary */
+#define CS_PLATFORM_PATH       0x8000000       /* platform binary by the fact of path (osx only) */
+#define CS_DEBUGGED            0x10000000  /* process is currently or has previously been debugged and allowed to run with invalid pages */
 
 #define CS_ENTITLEMENT_FLAGS   (CS_GET_TASK_ALLOW | CS_INSTALLER)
 
@@ -74,18 +77,6 @@
 #define CS_OPS_BLOB            10      /* get codesign blob */
 #define CS_OPS_IDENTITY                11      /* get codesign identity */
 
-/* SigPUP */
-#define CS_OPS_SIGPUP_INSTALL  20
-#define CS_OPS_SIGPUP_DROP     21
-#define CS_OPS_SIGPUP_VALIDATE 22
-
-struct sigpup_install_table {
-       uint64_t data;
-       uint64_t length;
-       uint64_t path;
-};
-
-
 /*
  * Magic numbers used by Code Signing
  */
@@ -109,16 +100,30 @@ enum {
        CSSLOT_APPLICATION = 4,
        CSSLOT_ENTITLEMENTS = 5,
 
+       CSSLOT_ALTERNATE_CODEDIRECTORIES = 0x1000, /* first alternate CodeDirectory, if any */
+       CSSLOT_ALTERNATE_CODEDIRECTORY_MAX = 5,         /* max number of alternate CD slots */
+       CSSLOT_ALTERNATE_CODEDIRECTORY_LIMIT = CSSLOT_ALTERNATE_CODEDIRECTORIES + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX, /* one past the last */
+
        CSSLOT_SIGNATURESLOT = 0x10000,                 /* CMS Signature */
 
        CSTYPE_INDEX_REQUIREMENTS = 0x00000002,         /* compat with amfi */
        CSTYPE_INDEX_ENTITLEMENTS = 0x00000005,         /* compat with amfi */
 
-       CS_HASHTYPE_SHA1 = 1
+       CS_HASHTYPE_SHA1 = 1,
+       CS_HASHTYPE_SHA256 = 2,
+       CS_HASHTYPE_SHA256_TRUNCATED = 3,
+       CS_HASHTYPE_SHA384 = 4,
+
+       CS_SHA1_LEN = 20,
+       CS_SHA256_TRUNCATED_LEN = 20,
+
+       CS_CDHASH_LEN = 20,                                             /* always - larger hashes are truncated */
+       CS_HASH_MAX_SIZE = 48, /* max size of the hash we'll support */
 };
 
 
 #define KERNEL_HAVE_CS_CODEDIRECTORY 1
+#define KERNEL_CS_CODEDIRECTORY_HAVE_PLATFORM 1
 
 /*
  * C form of a CodeDirectory.
@@ -135,7 +140,7 @@ typedef struct __CodeDirectory {
        uint32_t codeLimit;                             /* limit to main image signature range */
        uint8_t hashSize;                               /* size of each hash in bytes */
        uint8_t hashType;                               /* type of hash (cdHashType* constants) */
-       uint8_t spare1;                                 /* unused (must be zero) */
+       uint8_t platform;                               /* platform identifier; zero if not platform binary */
        uint8_t pageSize;                               /* log2(page size in bytes); 0 => infinite */
        uint32_t spare2;                                /* unused (must be zero) */
        /* Version 0x20100 */
@@ -162,6 +167,7 @@ typedef struct __SC_SuperBlob {
        /* followed by Blobs in no particular order as indicated by offsets in index */
 } CS_SuperBlob;
 
+#define KERNEL_HAVE_CS_GENERICBLOB 1
 typedef struct __SC_GenericBlob {
        uint32_t magic;                         /* magic number */
        uint32_t length;                        /* total length of blob */
@@ -196,50 +202,61 @@ struct vnode;
 struct cs_blob;
 struct fileglob;
 
-struct cscsr_functions  {
-       int             csr_version;
-#define CSCSR_VERSION 1
-       int             (*csr_validate_header)(const uint8_t *, size_t);
-       const void*     (*csr_find_file_codedirectory)(struct vnode *, const uint8_t *, size_t, size_t *);
-};
-
 __BEGIN_DECLS
 int    cs_enforcement(struct proc *);
 int    cs_require_lv(struct proc *);
 uint32_t cs_entitlement_flags(struct proc *p);
 int    cs_entitlements_blob_get(struct proc *, void **, size_t *);
+int    cs_restricted(struct proc *);
 uint8_t * cs_get_cdhash(struct proc *);
-void   cs_register_cscsr(struct cscsr_functions *);
 
-const  CS_GenericBlob *
-       cs_find_blob(struct cs_blob *, uint32_t, uint32_t);
+struct cs_blob * csproc_get_blob(struct proc *);
+struct cs_blob * csvnode_get_blob(struct vnode *, off_t);
+void            csvnode_print_debug(struct vnode *);
+
+const char *   csblob_get_teamid(struct cs_blob *);
+const char *   csblob_get_identity(struct cs_blob *);
+const uint8_t *        csblob_get_cdhash(struct cs_blob *);
+int            csblob_get_platform_binary(struct cs_blob *);
+unsigned int   csblob_get_flags(struct cs_blob *blob);
+int            csblob_get_entitlements(struct cs_blob *, void **, size_t *);
+const CS_GenericBlob *
+               csblob_find_blob(struct cs_blob *, uint32_t, uint32_t);
+const CS_GenericBlob *
+               csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t);
+
+/*
+ * Mostly convenience functions below
+ */
 
-const  char * csblob_get_teamid(struct cs_blob *);
 const  char * csproc_get_teamid(struct proc *);
 const  char * csvnode_get_teamid(struct vnode *, off_t);
 int    csproc_get_platform_binary(struct proc *);
 const  char * csfg_get_teamid(struct fileglob *);
 int    csfg_get_path(struct fileglob *, char *, int *);
 int    csfg_get_platform_binary(struct fileglob *);
+uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *);
 
-__END_DECLS
+extern int cs_debug;
 
 #ifdef XNU_KERNEL_PRIVATE
 
 void   cs_init(void);
 int    cs_allow_invalid(struct proc *);
 int    cs_invalid_page(addr64_t);
-int    sigpup_install(user_addr_t);
-int    sigpup_drop(void);
+int    csproc_get_platform_path(struct proc *);
 
-extern int cs_debug;
-extern int cs_validation;
 #if !SECURE_KERNEL
 extern int cs_enforcement_panic;
 #endif
 
 #endif /* XNU_KERNEL_PRIVATE */
 
+
+__END_DECLS
+
+
+
 #endif /* KERNEL */
 
 #endif /* _SYS_CODESIGN_H_ */