xnu-6153.141.1.tar.gz

[apple/xnu.git] / bsd / kern / policy_check.c

diff --git a/bsd/kern/policy_check.c b/bsd/kern/policy_check.c
index a8acdd2b0d82797d1f9b0b7732685ad1999a8b37..83581807f1397f4816a8a0f8ef542923720eca4f 100644 (file)
--- a/bsd/kern/policy_check.c
+++ b/bsd/kern/policy_check.c
@@ -1,5 +1,5 @@
 #include <sys/param.h>
 #include <sys/param.h>

-#include <sys/systm.h>         /* XXX printf() */
+#include <sys/systm.h>          /* XXX printf() */

 
 #include <sys/types.h>
 #include <sys/fcntl.h>
 
 #include <sys/types.h>
 #include <sys/fcntl.h>


@@ -13,7 +13,8 @@
 #include <security/mac.h>
 #include <security/mac_policy.h>
 
 #include <security/mac.h>
 #include <security/mac_policy.h>
 

-#include <libkern/OSDebug.h>   /* OSBPrintBacktrace */
+#include <libkern/section_keywords.h>
+#include <libkern/OSDebug.h>    /* OSBPrintBacktrace */

 
 
 /* forward declaration; see bsd_init.c */
 
 
 /* forward declaration; see bsd_init.c */


@@ -26,16 +27,16 @@ int get_thread_lock_count(thread_t th);         /* forced forward */
  * Note:       CHECK_POLICY_CHECK is probably not very useful unless you
  *             are kernel debugging and set a breakpoint.
  */
  * Note:       CHECK_POLICY_CHECK is probably not very useful unless you
  *             are kernel debugging and set a breakpoint.
  */

-#define        CHECK_POLICY_CHECK      0x00000001      /* Check on calls */
-#define        CHECK_POLICY_FAIL       0x00000002      /* EPERM on fails */
-#define        CHECK_POLICY_BACKTRACE  0x00000004      /* Show call stack on fails */
-#define        CHECK_POLICY_PANIC      0x00000008      /* Panic on fails */
-#define        CHECK_POLICY_PERIODIC   0x00000010      /* Show fails periodically */
+#define CHECK_POLICY_CHECK      0x00000001      /* Check on calls */
+#define CHECK_POLICY_FAIL       0x00000002      /* EPERM on fails */
+#define CHECK_POLICY_BACKTRACE  0x00000004      /* Show call stack on fails */
+#define CHECK_POLICY_PANIC      0x00000008      /* Panic on fails */
+#define CHECK_POLICY_PERIODIC   0x00000010      /* Show fails periodically */

 
 static int policy_flags = 0;
 
 
 
 static int policy_flags = 0;
 
 

-#define CHECK_SET_HOOK(x)      .mpo_##x = (mpo_##x##_t *)common_hook,
+#define CHECK_SET_HOOK(x)       .mpo_##x = (mpo_##x##_t *)common_hook,

 
 /*
  * Init; currently, we only print our arrival notice.
 
 /*
  * Init; currently, we only print our arrival notice.


@@ -55,8 +56,8 @@ hook_policy_initbsd(struct mac_policy_conf *mpc)
 
 
 /* Implementation */
 
 
 /* Implementation */

-#define        CLASS_PERIOD_LIMIT      10000
-#define        CLASS_PERIOD_MULT       20
+#define CLASS_PERIOD_LIMIT      10000
+#define CLASS_PERIOD_MULT       20

 
 static int policy_check_event = 1;
 static int policy_check_period = 1;
 
 static int policy_check_event = 1;
 static int policy_check_period = 1;


@@ -66,16 +67,17 @@ static int policy_check_next = CLASS_PERIOD_MULT;
 static int
 common_hook(void)
 {
 static int
 common_hook(void)
 {

-       int     i;
-       int     rv = 0;
+       int     i;
+       int     rv = 0;

 
        if ((i = get_thread_lock_count(current_thread())) != 0) {
                /*
                 * fail the MACF check if we hold a lock; this assumes a
                 * a non-void (authorization) MACF hook.
                 */
 
        if ((i = get_thread_lock_count(current_thread())) != 0) {
                /*
                 * fail the MACF check if we hold a lock; this assumes a
                 * a non-void (authorization) MACF hook.
                 */

-               if (policy_flags & CHECK_POLICY_FAIL)
+               if (policy_flags & CHECK_POLICY_FAIL) {

                        rv = EPERM;
                        rv = EPERM;

+               }

 
                /*
                 * display a backtrace if we hold a lock and we are not
 
                /*
                 * display a backtrace if we hold a lock and we are not


@@ -83,24 +85,24 @@ common_hook(void)
                 */
                if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
                        if (policy_flags & CHECK_POLICY_PERIODIC) {
                 */
                if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) {
                        if (policy_flags & CHECK_POLICY_PERIODIC) {

-                           /* at exponentially increasing intervals */
-                           if (!(policy_check_event % policy_check_period)) {
-                               if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
-                                       /*
-                                        * According to Derek, we could
-                                        * technically get a symbolicated name
-                                        * here, if we refactered some code
-                                        * and set the "keepsyms=1" boot
-                                        * argument...
-                                        */
-                                       OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
-                               }
-                           } else {
-                               if (policy_check_period < CLASS_PERIOD_LIMIT) {
-                                       policy_check_next *= CLASS_PERIOD_MULT;
-                                       policy_check_period *= CLASS_PERIOD_MULT;
+                               /* at exponentially increasing intervals */
+                               if (!(policy_check_event % policy_check_period)) {
+                                       if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) {
+                                               /*
+                                                * According to Derek, we could
+                                                * technically get a symbolicated name
+                                                * here, if we refactered some code
+                                                * and set the "keepsyms=1" boot
+                                                * argument...
+                                                */
+                                               OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
+                                       }
+                               } else {
+                                       if (policy_check_period < CLASS_PERIOD_LIMIT) {
+                                               policy_check_next *= CLASS_PERIOD_MULT;
+                                               policy_check_period *= CLASS_PERIOD_MULT;
+                                       }

                                }
                                }

-                           }

                        } else {
                                /* always */
                                OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);
                        } else {
                                /* always */
                                OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event);


@@ -108,8 +110,9 @@ common_hook(void)
                }
 
                /* Panic */
                }
 
                /* Panic */

-               if (policy_flags & CHECK_POLICY_PANIC)
+               if (policy_flags & CHECK_POLICY_PANIC) {

                        panic("calling MACF hook with mutex count %d\n", i);
                        panic("calling MACF hook with mutex count %d\n", i);

+               }

 
                /* count for non-fatal tracing */
                policy_check_event++;
 
                /* count for non-fatal tracing */
                policy_check_event++;


@@ -118,7 +121,7 @@ common_hook(void)
        return rv;
 }
 
        return rv;
 }
 

-#if (MAC_POLICY_OPS_VERSION != 31)
+#if (MAC_POLICY_OPS_VERSION != 62)

 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*
 # error "struct mac_policy_ops doesn't match definition in mac_policy.h"
 #endif
 /*


@@ -127,7 +130,7 @@ common_hook(void)
  * Please note that this struct initialization should be kept in sync with
  * security/mac_policy.h (mac_policy_ops struct definition).
  */
  * Please note that this struct initialization should be kept in sync with
  * security/mac_policy.h (mac_policy_ops struct definition).
  */

-static struct mac_policy_ops policy_ops = {
+const static struct mac_policy_ops policy_ops = {

        CHECK_SET_HOOK(audit_check_postselect)
        CHECK_SET_HOOK(audit_check_preselect)
 
        CHECK_SET_HOOK(audit_check_postselect)
        CHECK_SET_HOOK(audit_check_preselect)
 


@@ -201,15 +204,16 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(ipq_label_init)
        CHECK_SET_HOOK(ipq_label_update)
 
        CHECK_SET_HOOK(ipq_label_init)
        CHECK_SET_HOOK(ipq_label_update)
 

-       CHECK_SET_HOOK(lctx_check_label_update)
-       CHECK_SET_HOOK(lctx_label_destroy)
-       CHECK_SET_HOOK(lctx_label_externalize)
-       CHECK_SET_HOOK(lctx_label_init)
-       CHECK_SET_HOOK(lctx_label_internalize)
-       CHECK_SET_HOOK(lctx_label_update)
-       CHECK_SET_HOOK(lctx_notify_create)
-       CHECK_SET_HOOK(lctx_notify_join)
-       CHECK_SET_HOOK(lctx_notify_leave)
+       CHECK_SET_HOOK(file_check_library_validation)
+
+       CHECK_SET_HOOK(vnode_notify_setacl)
+       CHECK_SET_HOOK(vnode_notify_setattrlist)
+       CHECK_SET_HOOK(vnode_notify_setextattr)
+       CHECK_SET_HOOK(vnode_notify_setflags)
+       CHECK_SET_HOOK(vnode_notify_setmode)
+       CHECK_SET_HOOK(vnode_notify_setowner)
+       CHECK_SET_HOOK(vnode_notify_setutimes)
+       CHECK_SET_HOOK(vnode_notify_truncate)

 
        CHECK_SET_HOOK(mbuf_label_associate_bpfdesc)
        CHECK_SET_HOOK(mbuf_label_associate_ifnet)
 
        CHECK_SET_HOOK(mbuf_label_associate_bpfdesc)
        CHECK_SET_HOOK(mbuf_label_associate_ifnet)


@@ -265,25 +269,26 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(system_check_sysctlbyname)
        CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
        CHECK_SET_HOOK(vnode_check_rename)
        CHECK_SET_HOOK(system_check_sysctlbyname)
        CHECK_SET_HOOK(proc_check_inherit_ipc_ports)
        CHECK_SET_HOOK(vnode_check_rename)

+       CHECK_SET_HOOK(kext_check_query)
+       CHECK_SET_HOOK(proc_notify_exec_complete)

        .mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,
        .mpo_reserved4 = (mpo_reserved_hook_t *)common_hook,

-       .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved7 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved8 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved9 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved10 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved11 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved12 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved13 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved14 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved15 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved16 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved17 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved18 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved19 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved20 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved21 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved22 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(proc_check_syscall_unix)
+       CHECK_SET_HOOK(proc_check_expose_task)
+       CHECK_SET_HOOK(proc_check_set_host_special_port)
+       CHECK_SET_HOOK(proc_check_set_host_exception_port)
+       CHECK_SET_HOOK(exc_action_check_exception_send)
+       CHECK_SET_HOOK(exc_action_label_associate)
+       CHECK_SET_HOOK(exc_action_label_populate)
+       CHECK_SET_HOOK(exc_action_label_destroy)
+       CHECK_SET_HOOK(exc_action_label_init)
+       CHECK_SET_HOOK(exc_action_label_update)
+
+       CHECK_SET_HOOK(vnode_check_trigger_resolve)
+       CHECK_SET_HOOK(mount_check_mount_late)
+       CHECK_SET_HOOK(mount_check_snapshot_mount)
+       .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(skywalk_flow_check_connect)
+       CHECK_SET_HOOK(skywalk_flow_check_listen)

 
        CHECK_SET_HOOK(posixsem_check_create)
        CHECK_SET_HOOK(posixsem_check_open)
 
        CHECK_SET_HOOK(posixsem_check_create)
        CHECK_SET_HOOK(posixsem_check_open)


@@ -317,8 +322,9 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(proc_check_setlcid)
        CHECK_SET_HOOK(proc_check_signal)
        CHECK_SET_HOOK(proc_check_wait)
        CHECK_SET_HOOK(proc_check_setlcid)
        CHECK_SET_HOOK(proc_check_signal)
        CHECK_SET_HOOK(proc_check_wait)

-       CHECK_SET_HOOK(proc_label_destroy)
-       CHECK_SET_HOOK(proc_label_init)
+       CHECK_SET_HOOK(proc_check_dump_core)
+
+       .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook,

 
        CHECK_SET_HOOK(socket_check_accept)
        CHECK_SET_HOOK(socket_check_accepted)
 
        CHECK_SET_HOOK(socket_check_accept)
        CHECK_SET_HOOK(socket_check_accepted)


@@ -361,7 +367,7 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(system_check_settime)
        CHECK_SET_HOOK(system_check_swapoff)
        CHECK_SET_HOOK(system_check_swapon)
        CHECK_SET_HOOK(system_check_settime)
        CHECK_SET_HOOK(system_check_swapoff)
        CHECK_SET_HOOK(system_check_swapon)

-       .mpo_reserved31 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(socket_check_ioctl)

 
        CHECK_SET_HOOK(sysvmsg_label_associate)
        CHECK_SET_HOOK(sysvmsg_label_destroy)
 
        CHECK_SET_HOOK(sysvmsg_label_associate)
        CHECK_SET_HOOK(sysvmsg_label_destroy)


@@ -394,14 +400,14 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(sysvshm_label_init)
        CHECK_SET_HOOK(sysvshm_label_recycle)
 
        CHECK_SET_HOOK(sysvshm_label_init)
        CHECK_SET_HOOK(sysvshm_label_recycle)
 

-       .mpo_reserved23 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved24 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved25 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved26 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved27 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved28 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved29 = (mpo_reserved_hook_t *)common_hook,
-       .mpo_reserved30 = (mpo_reserved_hook_t *)common_hook,
+       CHECK_SET_HOOK(proc_notify_exit)
+       CHECK_SET_HOOK(mount_check_snapshot_revert)
+       CHECK_SET_HOOK(vnode_check_getattr)
+       CHECK_SET_HOOK(mount_check_snapshot_create)
+       CHECK_SET_HOOK(mount_check_snapshot_delete)
+       CHECK_SET_HOOK(vnode_check_clone)
+       CHECK_SET_HOOK(proc_check_get_cs_info)
+       CHECK_SET_HOOK(proc_check_set_cs_info)

 
        CHECK_SET_HOOK(iokit_check_hid_control)
 
 
        CHECK_SET_HOOK(iokit_check_hid_control)
 


@@ -461,15 +467,14 @@ static struct mac_policy_ops policy_ops = {
        CHECK_SET_HOOK(vnode_check_uipc_bind)
        CHECK_SET_HOOK(vnode_check_uipc_connect)
 
        CHECK_SET_HOOK(vnode_check_uipc_bind)
        CHECK_SET_HOOK(vnode_check_uipc_connect)
 

-       /* CHECK_SET_HOOK(proc_check_run_cs_invalid) */
-       .mpo_proc_check_run_cs_invalid = (mac_proc_check_run_cs_invalid_t *)common_hook,
+       CHECK_SET_HOOK(proc_check_run_cs_invalid)

        CHECK_SET_HOOK(proc_check_suspend_resume)
 
        CHECK_SET_HOOK(thread_userret)
 
        CHECK_SET_HOOK(iokit_check_set_properties)
 
        CHECK_SET_HOOK(proc_check_suspend_resume)
 
        CHECK_SET_HOOK(thread_userret)
 
        CHECK_SET_HOOK(iokit_check_set_properties)
 

-       CHECK_SET_HOOK(system_check_chud)
+       .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook,

 
        CHECK_SET_HOOK(vnode_check_searchfs)
 
 
        CHECK_SET_HOOK(vnode_check_searchfs)
 


@@ -486,12 +491,13 @@ static struct mac_policy_ops policy_ops = {
 
        CHECK_SET_HOOK(vnode_notify_rename)
 
 
        CHECK_SET_HOOK(vnode_notify_rename)
 

-       CHECK_SET_HOOK(thread_label_init)
-       CHECK_SET_HOOK(thread_label_destroy)
+       CHECK_SET_HOOK(vnode_check_setacl)
+
+       CHECK_SET_HOOK(vnode_notify_deleteextattr)

 
        CHECK_SET_HOOK(system_check_kas_info)
 
 
        CHECK_SET_HOOK(system_check_kas_info)
 

-       CHECK_SET_HOOK(proc_check_cpumon)
+       CHECK_SET_HOOK(vnode_check_lookup_preflight)

 
        CHECK_SET_HOOK(vnode_notify_open)
 
 
        CHECK_SET_HOOK(vnode_notify_open)
 


@@ -517,18 +523,18 @@ static struct mac_policy_ops policy_ops = {
 /*
  * Policy definition
  */
 /*
  * Policy definition
  */

-static struct mac_policy_conf policy_conf = {
+static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = {

        .mpc_name               = "CHECK",
        .mpc_fullname           = "Check Assumptions Policy",
        .mpc_name               = "CHECK",
        .mpc_fullname           = "Check Assumptions Policy",

-       .mpc_field_off          = NULL,         /* no label slot */
-       .mpc_labelnames         = NULL,         /* no policy label names */
-       .mpc_labelname_count    = 0,            /* count of label names is 0 */
-       .mpc_ops                = &policy_ops,  /* policy operations */
+       .mpc_field_off          = NULL,         /* no label slot */
+       .mpc_labelnames         = NULL,         /* no policy label names */
+       .mpc_labelname_count    = 0,            /* count of label names is 0 */
+       .mpc_ops                = &policy_ops,  /* policy operations */

        .mpc_loadtime_flags     = 0,
        .mpc_runtime_flags      = 0,
 };
 
        .mpc_loadtime_flags     = 0,
        .mpc_runtime_flags      = 0,
 };
 

-static mac_policy_handle_t policy_handle;
+static SECURITY_READ_ONLY_LATE(mac_policy_handle_t) policy_handle;

 
 /*
  * Init routine; for a loadable policy, this would be called during the KEXT
 
 /*
  * Init routine; for a loadable policy, this would be called during the KEXT


@@ -539,8 +545,9 @@ errno_t
 check_policy_init(int flags)
 {
        /* Only instantiate the module if we have been asked to do checking */
 check_policy_init(int flags)
 {
        /* Only instantiate the module if we have been asked to do checking */

-       if (!flags)
+       if (!flags) {

                return 0;
                return 0;

+       }

 
        policy_flags = flags;
 
 
        policy_flags = flags;