+#if __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX
+/**
+ * Determines whether this is an arm64e process which may host in-process
+ * plugins.
+ */
+static inline bool
+arm64e_plugin_host(struct image_params *imgp, load_result_t *result)
+{
+ if (imgp->ip_flags & IMGPF_NOJOP) {
+ return false;
+ }
+
+ if (!result->platform_binary) {
+ return false;
+ }
+
+ struct cs_blob *csblob = csvnode_get_blob(imgp->ip_vp, imgp->ip_arch_offset);
+ const char *identity = csblob_get_identity(csblob);
+ if (!identity) {
+ return false;
+ }
+
+ /* Check if override host plugin entitlement is present and posix spawn attribute to disable A keys is passed */
+ if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, OVERRIDE_PLUGIN_HOST_ENTITLEMENT)) {
+ return imgp->ip_flags & IMGPF_PLUGIN_HOST_DISABLE_A_KEYS;
+ }
+
+ /* Disabling library validation is a good signal that this process plans to host plugins */
+ const char *const disable_lv_entitlements[] = {
+ "com.apple.security.cs.disable-library-validation",
+ "com.apple.private.cs.automator-plugins",
+ CLEAR_LV_ENTITLEMENT,
+ };
+ for (size_t i = 0; i < ARRAY_COUNT(disable_lv_entitlements); i++) {
+ if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, disable_lv_entitlements[i])) {
+ return true;
+ }
+ }
+
+ /* From /System/Library/Security/HardeningExceptions.plist */
+ const char *const hardening_exceptions[] = {
+ "com.apple.perl5", /* Scripting engines may load third party code and jit*/
+ "com.apple.perl", /* Scripting engines may load third party code and jit*/
+ "org.python.python", /* Scripting engines may load third party code and jit*/
+ "com.apple.expect", /* Scripting engines may load third party code and jit*/
+ "com.tcltk.wish", /* Scripting engines may load third party code and jit*/
+ "com.tcltk.tclsh", /* Scripting engines may load third party code and jit*/
+ "com.apple.ruby", /* Scripting engines may load third party code and jit*/
+ "com.apple.bash", /* Required for the 'enable' command */
+ "com.apple.zsh", /* Required for the 'zmodload' command */
+ "com.apple.ksh", /* Required for 'builtin' command */
+ };
+ for (size_t i = 0; i < ARRAY_COUNT(hardening_exceptions); i++) {
+ if (strncmp(hardening_exceptions[i], identity, strlen(hardening_exceptions[i])) == 0) {
+ return true;
+ }
+ }
+
+ return false;
+}
+#endif /* __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX */
+
projects / apple / xnu.git / blobdiff