X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/fe8ab488e9161c46dd9885d58fc52996dc0249ff..c3c9b80d004dbbfdf763edeb97968c6997e3b45b:/bsd/dev/dtrace/dtrace_subr.c diff --git a/bsd/dev/dtrace/dtrace_subr.c b/bsd/dev/dtrace/dtrace_subr.c index aa8fb6c1a..cdc074485 100644 --- a/bsd/dev/dtrace/dtrace_subr.c +++ b/bsd/dev/dtrace/dtrace_subr.c @@ -24,10 +24,6 @@ * Use is subject to license terms. */ -/* - * #pragma ident "@(#)dtrace_subr.c 1.8 07/06/05 SMI" - */ - #include #include #include @@ -35,6 +31,7 @@ #include #include #include +#include #include #include #include @@ -42,6 +39,10 @@ #if CONFIG_CSR #include #include + +#if defined(KERNEL_INTEGRITY_KTRR) || defined(KERNEL_INTEGRITY_CTRR) +extern bool csr_unsafe_kernel_text; +#endif #endif /* @@ -107,7 +108,7 @@ dtrace_fasttrap_fork(proc_t *p, proc_t *cp) * duty to resume the task. */ -lck_mtx_t dtrace_procwaitfor_lock; +LCK_MTX_DECLARE_ATTR(dtrace_procwaitfor_lock, &dtrace_lck_grp, &dtrace_lck_attr); typedef struct dtrace_proc_awaited_entry { struct dtrace_procdesc *pdesc; @@ -119,9 +120,40 @@ LIST_HEAD(listhead, dtrace_proc_awaited_entry) dtrace_proc_awaited_head void (*dtrace_proc_waitfor_exec_ptr)(proc_t*) = NULL; +static int +dtrace_proc_get_execpath(proc_t *p, char *buffer, int *maxlen) +{ + int err = 0, vid = 0; + vnode_t tvp = NULLVP, nvp = NULLVP; + + ASSERT(p); + ASSERT(buffer); + ASSERT(maxlen); + + if ((tvp = p->p_textvp) == NULLVP) + return ESRCH; + + vid = vnode_vid(tvp); + if ((err = vnode_getwithvid(tvp, vid)) != 0) + return err; + + if ((err = vn_getpath_fsenter(tvp, buffer, maxlen)) != 0) + return err; + vnode_put(tvp); + + if ((err = vnode_lookup(buffer, 0, &nvp, vfs_context_current())) != 0) + return err; + if (nvp != NULLVP) + vnode_put(nvp); + + return 0; +} + + static void dtrace_proc_exec_notification(proc_t *p) { dtrace_proc_awaited_entry_t *entry, *tmp; + static char execpath[MAXPATHLEN]; ASSERT(p); ASSERT(p->p_pid != -1); @@ -129,16 +161,31 @@ dtrace_proc_exec_notification(proc_t *p) { lck_mtx_lock(&dtrace_procwaitfor_lock); - /* - * For each entry, if it has not been matched with a process yet we - * try to match it with the newly created process. If they match, the - * entry is initialized with the process id and the process task is - * suspended. Finally, we wake up the client's waiting thread. - */ LIST_FOREACH_SAFE(entry, &dtrace_proc_awaited_head, entries, tmp) { - if ((entry->pdesc->p_pid == -1) - && !strncmp(entry->pdesc->p_comm, &p->p_comm[0], sizeof(p->p_comm))) - { + /* By default consider we're using p_comm. */ + char *pname = p->p_comm; + + /* Already matched with another process. */ + if ((entry->pdesc->p_pid != -1)) + continue; + + /* p_comm is too short, use the execpath. */ + if (entry->pdesc->p_name_length >= MAXCOMLEN) { + /* + * Retrieve the executable path. After the call, length contains + * the length of the string + 1. + */ + int length = sizeof(execpath); + if (dtrace_proc_get_execpath(p, execpath, &length) != 0) + continue; + /* Move the cursor to the position after the last / */ + pname = &execpath[length - 1]; + while (pname != execpath && *pname != '/') + pname--; + pname = (*pname == '/') ? pname + 1 : pname; + } + + if (!strcmp(entry->pdesc->p_name, pname)) { entry->pdesc->p_pid = p->p_pid; task_pidsuspend(p->task); wakeup(entry); @@ -154,7 +201,15 @@ dtrace_proc_waitfor(dtrace_procdesc_t* pdesc) { int res; ASSERT(pdesc); - ASSERT(pdesc->p_comm); + ASSERT(pdesc->p_name); + + /* + * Never trust user input, compute the length of the process name and ensure the + * string is null terminated. + */ + pdesc->p_name_length = (int) strnlen(pdesc->p_name, sizeof(pdesc->p_name)); + if (pdesc->p_name_length >= (int) sizeof(pdesc->p_name)) + return -1; lck_mtx_lock(&dtrace_procwaitfor_lock); @@ -240,6 +295,132 @@ dtrace_invop_remove(int (*func)(uintptr_t, uintptr_t *, uintptr_t)) kmem_free(hdlr, sizeof (dtrace_invop_hdlr_t)); } +void* +dtrace_ptrauth_strip(void *ptr, uint64_t key) +{ +#pragma unused(key) +#if __has_feature(ptrauth_calls) + /* + * The key argument to ptrauth_strip needs to be a compile-time + * constant + */ + switch (key) { + case ptrauth_key_asia: + return ptrauth_strip(ptr, ptrauth_key_asia); + case ptrauth_key_asib: + return ptrauth_strip(ptr, ptrauth_key_asib); + case ptrauth_key_asda: + return ptrauth_strip(ptr, ptrauth_key_asda); + case ptrauth_key_asdb: + return ptrauth_strip(ptr, ptrauth_key_asdb); + default: + return ptr; + } +#else + return ptr; +#endif // __has_feature(ptrauth_calls) +} + +int +dtrace_is_valid_ptrauth_key(uint64_t key) +{ +#pragma unused(key) +#if __has_feature(ptrauth_calls) + return (key == ptrauth_key_asia) || (key == ptrauth_key_asib) || + (key == ptrauth_key_asda) || (key == ptrauth_key_asdb); +#else + return (0); +#endif /* __has_feature(ptrauth_calls) */ +} + +uint64_t +dtrace_physmem_read(uint64_t addr, size_t size) +{ + switch (size) { + case 1: + return (uint64_t)ml_phys_read_byte_64((addr64_t)addr); + case 2: + return (uint64_t)ml_phys_read_half_64((addr64_t)addr); + case 4: + return (uint64_t)ml_phys_read_64((addr64_t)addr); + case 8: + return (uint64_t)ml_phys_read_double_64((addr64_t)addr); + } + DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP); + + return (0); +} + +void +dtrace_physmem_write(uint64_t addr, uint64_t data, size_t size) +{ + switch (size) { + case 1: + ml_phys_write_byte_64((addr64_t)addr, (unsigned int)data); + break; + case 2: + ml_phys_write_half_64((addr64_t)addr, (unsigned int)data); + break; + case 4: + ml_phys_write_64((addr64_t)addr, (unsigned int)data); + break; + case 8: + ml_phys_write_double_64((addr64_t)addr, (unsigned long long)data); + break; + default: + DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP); + } +} + +static minor_t next_minor = 0; +static dtrace_state_t* dtrace_clients[DTRACE_NCLIENTS] = {NULL}; + + +minor_t +dtrace_state_reserve(void) +{ + for (int i = 0; i < DTRACE_NCLIENTS; i++) { + minor_t minor = os_atomic_inc_orig(&next_minor, relaxed) % DTRACE_NCLIENTS; + if (dtrace_clients[minor] == NULL) + return minor; + } + return 0; +} + +dtrace_state_t* +dtrace_state_get(minor_t minor) +{ + ASSERT(minor < DTRACE_NCLIENTS); + return dtrace_clients[minor]; +} + +dtrace_state_t* +dtrace_state_allocate(minor_t minor) +{ + dtrace_state_t *state = _MALLOC(sizeof(dtrace_state_t), M_TEMP, M_ZERO | M_WAITOK); + if (dtrace_casptr(&dtrace_clients[minor], NULL, state) != NULL) { + // We have been raced by another client for this number, abort + _FREE(state, M_TEMP); + return NULL; + } + return state; +} + +void +dtrace_state_free(minor_t minor) +{ + dtrace_state_t *state = dtrace_clients[minor]; + dtrace_clients[minor] = NULL; + _FREE(state, M_TEMP); +} + + + +void +dtrace_restriction_policy_load(void) +{ +} + /* * Check if DTrace has been restricted by the current security policy. */ @@ -254,6 +435,36 @@ dtrace_is_restricted(void) return FALSE; } +boolean_t +dtrace_are_restrictions_relaxed(void) +{ +#if CONFIG_CSR + if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) + return TRUE; +#endif + + return FALSE; +} + +boolean_t +dtrace_fbt_probes_restricted(void) +{ + +#if CONFIG_CSR + if (dtrace_is_restricted() && !dtrace_are_restrictions_relaxed()) + return TRUE; +#endif + + return FALSE; +} + +boolean_t +dtrace_sdt_probes_restricted(void) +{ + + return FALSE; +} + /* * Check if the process can be attached. */ @@ -264,7 +475,7 @@ dtrace_can_attach_to_proc(proc_t *proc) ASSERT(proc != NULL); #if CONFIG_CSR - if ((cs_entitlement_flags(proc) & CS_GET_TASK_ALLOW) == 0) + if (cs_restricted(proc)) return FALSE; #endif