xnu-7195.101.1.tar.gz

[apple/xnu.git] / security / mac_process.c

diff --git a/security/mac_process.c b/security/mac_process.c
index 31d539af2a02b457c1fa3f34252a991bef32ba27..09aa47db290788a46c3d56279695ee15c28dc9d7 100644 (file)
--- a/security/mac_process.c
+++ b/security/mac_process.c
@@ -75,6 +75,8 @@
 #include <mach/mach_types.h>
 #include <kern/task.h>
 
 #include <mach/mach_types.h>
 #include <kern/task.h>
 

+#include <os/hash.h>
+

 #include <security/mac_internal.h>
 #include <security/mac_mach_internal.h>
 
 #include <security/mac_internal.h>
 #include <security/mac_mach_internal.h>
 


@@ -106,10 +108,38 @@ mac_cred_label_free(struct label *label)
        mac_labelzone_free(label);
 }
 
        mac_labelzone_free(label);
 }
 

-int
-mac_cred_label_compare(struct label *a, struct label *b)
+bool
+mac_cred_label_is_equal(const struct label *a, const struct label *b)

 {
 {

-       return bcmp(a, b, sizeof(*a)) == 0;
+       if (a->l_flags != b->l_flags) {
+               return false;
+       }
+       for (int slot = 0; slot < MAC_MAX_SLOTS; slot++) {
+               const void *pa = a->l_perpolicy[slot].l_ptr;
+               const void *pb = b->l_perpolicy[slot].l_ptr;
+
+               if (pa != pb) {
+                       return false;
+               }
+       }
+       return true;
+}
+
+uint32_t
+mac_cred_label_hash_update(const struct label *a, uint32_t hash)
+{
+       hash = os_hash_jenkins_update(&a->l_flags,
+           sizeof(a->l_flags), hash);
+#if __has_feature(ptrauth_calls)
+       for (int slot = 0; slot < MAC_MAX_SLOTS; slot++) {
+               const void *ptr = a->l_perpolicy[slot].l_ptr;
+               hash = os_hash_jenkins_update(&ptr, sizeof(ptr), hash);
+       }
+#else
+       hash = os_hash_jenkins_update(&a->l_perpolicy,
+           sizeof(a->l_perpolicy), hash);
+#endif
+       return hash;

 }
 
 int
 }
 
 int


@@ -305,10 +335,11 @@ mac_cred_check_visible(kauth_cred_t u1, kauth_cred_t u2)
 }
 
 int
 }
 
 int

-mac_proc_check_debug(proc_t curp, struct proc *proc)
+mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident)

 {
 {

-       kauth_cred_t cred;

        int error;
        int error;

+       bool enforce;
+       proc_t tracingp;

 
 #if SECURITY_MAC_CHECK_ENFORCE
        /* 21167099 - only check if we allow write */
 
 #if SECURITY_MAC_CHECK_ENFORCE
        /* 21167099 - only check if we allow write */


@@ -316,13 +347,20 @@ mac_proc_check_debug(proc_t curp, struct proc *proc)
                return 0;
        }
 #endif
                return 0;
        }
 #endif

-       if (!mac_proc_check_enforce(curp)) {
-               return 0;
+       /*
+        * Once all mac hooks adopt proc_ident_t, finding proc_t and releasing
+        * it below should go to mac_proc_check_enforce().
+        */
+       if ((tracingp = proc_find_ident(tracing_ident)) == PROC_NULL) {
+               return ESRCH;

        }
        }

+       enforce = mac_proc_check_enforce(tracingp);
+       proc_rele(tracingp);

 
 

-       cred = kauth_cred_proc_ref(curp);
-       MAC_CHECK(proc_check_debug, cred, proc);
-       kauth_cred_unref(&cred);
+       if (!enforce) {
+               return 0;
+       }
+       MAC_CHECK(proc_check_debug, tracing_cred, traced_ident);

 
        return error;
 }
 
        return error;
 }


@@ -348,8 +386,10 @@ mac_proc_check_dump_core(struct proc *proc)
 }
 
 int
 }
 
 int

-mac_proc_check_fork(proc_t curp)
+mac_proc_check_remote_thread_create(struct task *task, int flavor, thread_state_t new_state, mach_msg_type_number_t new_state_count)

 {
 {

+       proc_t curp = current_proc();
+       proc_t proc;

        kauth_cred_t cred;
        int error;
 
        kauth_cred_t cred;
        int error;
 


@@ -363,39 +403,85 @@ mac_proc_check_fork(proc_t curp)
                return 0;
        }
 
                return 0;
        }
 

+       proc = proc_find(task_pid(task));
+       if (proc == PROC_NULL) {
+               return ESRCH;
+       }
+

        cred = kauth_cred_proc_ref(curp);
        cred = kauth_cred_proc_ref(curp);

-       MAC_CHECK(proc_check_fork, cred, curp);
+       MAC_CHECK(proc_check_remote_thread_create, cred, proc, flavor, new_state, new_state_count);

        kauth_cred_unref(&cred);
        kauth_cred_unref(&cred);

+       proc_rele(proc);

 
        return error;
 }
 
 int
 
        return error;
 }
 
 int

-mac_proc_check_get_task_name(struct ucred *cred, struct proc *p)
+mac_proc_check_fork(proc_t curp)

 {
 {

+       kauth_cred_t cred;

        int error;
 
        int error;
 

-       MAC_CHECK(proc_check_get_task_name, cred, p);
+#if SECURITY_MAC_CHECK_ENFORCE
+       /* 21167099 - only check if we allow write */
+       if (!mac_proc_enforce) {
+               return 0;
+       }
+#endif
+       if (!mac_proc_check_enforce(curp)) {
+               return 0;
+       }
+
+       cred = kauth_cred_proc_ref(curp);
+       MAC_CHECK(proc_check_fork, cred, curp);
+       kauth_cred_unref(&cred);

 
        return error;
 }
 
 int
 
        return error;
 }
 
 int

-mac_proc_check_get_task(struct ucred *cred, struct proc *p)
+mac_proc_check_get_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)

 {
        int error;
 
 {
        int error;
 

-       MAC_CHECK(proc_check_get_task, cred, p);
+       assert(flavor <= TASK_FLAVOR_NAME);
+
+       /* Also call the old hook for compatability, deprecating in rdar://66356944. */
+       if (flavor == TASK_FLAVOR_CONTROL) {
+               MAC_CHECK(proc_check_get_task, cred, pident);
+               if (error) {
+                       return error;
+               }
+       }
+
+       if (flavor == TASK_FLAVOR_NAME) {
+               MAC_CHECK(proc_check_get_task_name, cred, pident);
+               if (error) {
+                       return error;
+               }
+       }
+
+       MAC_CHECK(proc_check_get_task_with_flavor, cred, pident, flavor);

 
        return error;
 }
 
 int
 
        return error;
 }
 
 int

-mac_proc_check_expose_task(struct ucred *cred, struct proc *p)
+mac_proc_check_expose_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)

 {
        int error;
 
 {
        int error;
 

-       MAC_CHECK(proc_check_expose_task, cred, p);
+       assert(flavor <= TASK_FLAVOR_NAME);
+
+       /* Also call the old hook for compatability, deprecating in rdar://66356944. */
+       if (flavor == TASK_FLAVOR_CONTROL) {
+               MAC_CHECK(proc_check_expose_task, cred, pident);
+               if (error) {
+                       return error;
+               }
+       }
+
+       MAC_CHECK(proc_check_expose_task_with_flavor, cred, pident, flavor);

 
        return error;
 }
 
        return error;
 }


@@ -480,6 +566,12 @@ mac_proc_check_run_cs_invalid(proc_t proc)
        return error;
 }
 
        return error;
 }
 

+void
+mac_proc_notify_cs_invalidated(proc_t proc)
+{
+       MAC_PERFORM(proc_notify_cs_invalidated, proc);
+}
+

 int
 mac_proc_check_sched(proc_t curp, struct proc *proc)
 {
 int
 mac_proc_check_sched(proc_t curp, struct proc *proc)
 {


@@ -576,7 +668,7 @@ mac_proc_notify_exit(struct proc *proc)
 }
 
 int
 }
 
 int

-mac_proc_check_suspend_resume(proc_t curp, int sr)
+mac_proc_check_suspend_resume(proc_t proc, int sr)

 {
        kauth_cred_t cred;
        int error;
 {
        kauth_cred_t cred;
        int error;


@@ -587,12 +679,12 @@ mac_proc_check_suspend_resume(proc_t curp, int sr)
                return 0;
        }
 #endif
                return 0;
        }
 #endif

-       if (!mac_proc_check_enforce(curp)) {
+       if (!mac_proc_check_enforce(current_proc())) {

                return 0;
        }
 
                return 0;
        }
 

-       cred = kauth_cred_proc_ref(curp);
-       MAC_CHECK(proc_check_suspend_resume, cred, curp, sr);
+       cred = kauth_cred_proc_ref(current_proc());
+       MAC_CHECK(proc_check_suspend_resume, cred, proc, sr);

        kauth_cred_unref(&cred);
 
        return error;
        kauth_cred_unref(&cred);
 
        return error;