X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/fe8ab488e9161c46dd9885d58fc52996dc0249ff..eb6b6ca394357805f2bdba989abae309f718b4d8:/bsd/kern/policy_check.c diff --git a/bsd/kern/policy_check.c b/bsd/kern/policy_check.c index a8acdd2b0..83581807f 100644 --- a/bsd/kern/policy_check.c +++ b/bsd/kern/policy_check.c @@ -1,5 +1,5 @@ #include -#include /* XXX printf() */ +#include /* XXX printf() */ #include #include @@ -13,7 +13,8 @@ #include #include -#include /* OSBPrintBacktrace */ +#include +#include /* OSBPrintBacktrace */ /* forward declaration; see bsd_init.c */ @@ -26,16 +27,16 @@ int get_thread_lock_count(thread_t th); /* forced forward */ * Note: CHECK_POLICY_CHECK is probably not very useful unless you * are kernel debugging and set a breakpoint. */ -#define CHECK_POLICY_CHECK 0x00000001 /* Check on calls */ -#define CHECK_POLICY_FAIL 0x00000002 /* EPERM on fails */ -#define CHECK_POLICY_BACKTRACE 0x00000004 /* Show call stack on fails */ -#define CHECK_POLICY_PANIC 0x00000008 /* Panic on fails */ -#define CHECK_POLICY_PERIODIC 0x00000010 /* Show fails periodically */ +#define CHECK_POLICY_CHECK 0x00000001 /* Check on calls */ +#define CHECK_POLICY_FAIL 0x00000002 /* EPERM on fails */ +#define CHECK_POLICY_BACKTRACE 0x00000004 /* Show call stack on fails */ +#define CHECK_POLICY_PANIC 0x00000008 /* Panic on fails */ +#define CHECK_POLICY_PERIODIC 0x00000010 /* Show fails periodically */ static int policy_flags = 0; -#define CHECK_SET_HOOK(x) .mpo_##x = (mpo_##x##_t *)common_hook, +#define CHECK_SET_HOOK(x) .mpo_##x = (mpo_##x##_t *)common_hook, /* * Init; currently, we only print our arrival notice. @@ -55,8 +56,8 @@ hook_policy_initbsd(struct mac_policy_conf *mpc) /* Implementation */ -#define CLASS_PERIOD_LIMIT 10000 -#define CLASS_PERIOD_MULT 20 +#define CLASS_PERIOD_LIMIT 10000 +#define CLASS_PERIOD_MULT 20 static int policy_check_event = 1; static int policy_check_period = 1; @@ -66,16 +67,17 @@ static int policy_check_next = CLASS_PERIOD_MULT; static int common_hook(void) { - int i; - int rv = 0; + int i; + int rv = 0; if ((i = get_thread_lock_count(current_thread())) != 0) { /* * fail the MACF check if we hold a lock; this assumes a * a non-void (authorization) MACF hook. */ - if (policy_flags & CHECK_POLICY_FAIL) + if (policy_flags & CHECK_POLICY_FAIL) { rv = EPERM; + } /* * display a backtrace if we hold a lock and we are not @@ -83,24 +85,24 @@ common_hook(void) */ if ((policy_flags & (CHECK_POLICY_BACKTRACE | CHECK_POLICY_PANIC)) == CHECK_POLICY_BACKTRACE) { if (policy_flags & CHECK_POLICY_PERIODIC) { - /* at exponentially increasing intervals */ - if (!(policy_check_event % policy_check_period)) { - if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) { - /* - * According to Derek, we could - * technically get a symbolicated name - * here, if we refactered some code - * and set the "keepsyms=1" boot - * argument... - */ - OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event); - } - } else { - if (policy_check_period < CLASS_PERIOD_LIMIT) { - policy_check_next *= CLASS_PERIOD_MULT; - policy_check_period *= CLASS_PERIOD_MULT; + /* at exponentially increasing intervals */ + if (!(policy_check_event % policy_check_period)) { + if (policy_check_event <= policy_check_next || policy_check_period == CLASS_PERIOD_LIMIT) { + /* + * According to Derek, we could + * technically get a symbolicated name + * here, if we refactered some code + * and set the "keepsyms=1" boot + * argument... + */ + OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event); + } + } else { + if (policy_check_period < CLASS_PERIOD_LIMIT) { + policy_check_next *= CLASS_PERIOD_MULT; + policy_check_period *= CLASS_PERIOD_MULT; + } } - } } else { /* always */ OSReportWithBacktrace("calling MACF hook with mutex count %d (event %d) ", i, policy_check_event); @@ -108,8 +110,9 @@ common_hook(void) } /* Panic */ - if (policy_flags & CHECK_POLICY_PANIC) + if (policy_flags & CHECK_POLICY_PANIC) { panic("calling MACF hook with mutex count %d\n", i); + } /* count for non-fatal tracing */ policy_check_event++; @@ -118,7 +121,7 @@ common_hook(void) return rv; } -#if (MAC_POLICY_OPS_VERSION != 31) +#if (MAC_POLICY_OPS_VERSION != 62) # error "struct mac_policy_ops doesn't match definition in mac_policy.h" #endif /* @@ -127,7 +130,7 @@ common_hook(void) * Please note that this struct initialization should be kept in sync with * security/mac_policy.h (mac_policy_ops struct definition). */ -static struct mac_policy_ops policy_ops = { +const static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(audit_check_postselect) CHECK_SET_HOOK(audit_check_preselect) @@ -201,15 +204,16 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(ipq_label_init) CHECK_SET_HOOK(ipq_label_update) - CHECK_SET_HOOK(lctx_check_label_update) - CHECK_SET_HOOK(lctx_label_destroy) - CHECK_SET_HOOK(lctx_label_externalize) - CHECK_SET_HOOK(lctx_label_init) - CHECK_SET_HOOK(lctx_label_internalize) - CHECK_SET_HOOK(lctx_label_update) - CHECK_SET_HOOK(lctx_notify_create) - CHECK_SET_HOOK(lctx_notify_join) - CHECK_SET_HOOK(lctx_notify_leave) + CHECK_SET_HOOK(file_check_library_validation) + + CHECK_SET_HOOK(vnode_notify_setacl) + CHECK_SET_HOOK(vnode_notify_setattrlist) + CHECK_SET_HOOK(vnode_notify_setextattr) + CHECK_SET_HOOK(vnode_notify_setflags) + CHECK_SET_HOOK(vnode_notify_setmode) + CHECK_SET_HOOK(vnode_notify_setowner) + CHECK_SET_HOOK(vnode_notify_setutimes) + CHECK_SET_HOOK(vnode_notify_truncate) CHECK_SET_HOOK(mbuf_label_associate_bpfdesc) CHECK_SET_HOOK(mbuf_label_associate_ifnet) @@ -265,25 +269,26 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(system_check_sysctlbyname) CHECK_SET_HOOK(proc_check_inherit_ipc_ports) CHECK_SET_HOOK(vnode_check_rename) + CHECK_SET_HOOK(kext_check_query) + CHECK_SET_HOOK(proc_notify_exec_complete) .mpo_reserved4 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved6 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved7 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved8 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved9 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved10 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved11 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved12 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved13 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved14 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved15 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved16 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved17 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved18 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved19 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved20 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved21 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved22 = (mpo_reserved_hook_t *)common_hook, + CHECK_SET_HOOK(proc_check_syscall_unix) + CHECK_SET_HOOK(proc_check_expose_task) + CHECK_SET_HOOK(proc_check_set_host_special_port) + CHECK_SET_HOOK(proc_check_set_host_exception_port) + CHECK_SET_HOOK(exc_action_check_exception_send) + CHECK_SET_HOOK(exc_action_label_associate) + CHECK_SET_HOOK(exc_action_label_populate) + CHECK_SET_HOOK(exc_action_label_destroy) + CHECK_SET_HOOK(exc_action_label_init) + CHECK_SET_HOOK(exc_action_label_update) + + CHECK_SET_HOOK(vnode_check_trigger_resolve) + CHECK_SET_HOOK(mount_check_mount_late) + CHECK_SET_HOOK(mount_check_snapshot_mount) + .mpo_reserved2 = (mpo_reserved_hook_t *)common_hook, + CHECK_SET_HOOK(skywalk_flow_check_connect) + CHECK_SET_HOOK(skywalk_flow_check_listen) CHECK_SET_HOOK(posixsem_check_create) CHECK_SET_HOOK(posixsem_check_open) @@ -317,8 +322,9 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(proc_check_setlcid) CHECK_SET_HOOK(proc_check_signal) CHECK_SET_HOOK(proc_check_wait) - CHECK_SET_HOOK(proc_label_destroy) - CHECK_SET_HOOK(proc_label_init) + CHECK_SET_HOOK(proc_check_dump_core) + + .mpo_reserved5 = (mpo_reserved_hook_t *)common_hook, CHECK_SET_HOOK(socket_check_accept) CHECK_SET_HOOK(socket_check_accepted) @@ -361,7 +367,7 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(system_check_settime) CHECK_SET_HOOK(system_check_swapoff) CHECK_SET_HOOK(system_check_swapon) - .mpo_reserved31 = (mpo_reserved_hook_t *)common_hook, + CHECK_SET_HOOK(socket_check_ioctl) CHECK_SET_HOOK(sysvmsg_label_associate) CHECK_SET_HOOK(sysvmsg_label_destroy) @@ -394,14 +400,14 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(sysvshm_label_init) CHECK_SET_HOOK(sysvshm_label_recycle) - .mpo_reserved23 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved24 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved25 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved26 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved27 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved28 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved29 = (mpo_reserved_hook_t *)common_hook, - .mpo_reserved30 = (mpo_reserved_hook_t *)common_hook, + CHECK_SET_HOOK(proc_notify_exit) + CHECK_SET_HOOK(mount_check_snapshot_revert) + CHECK_SET_HOOK(vnode_check_getattr) + CHECK_SET_HOOK(mount_check_snapshot_create) + CHECK_SET_HOOK(mount_check_snapshot_delete) + CHECK_SET_HOOK(vnode_check_clone) + CHECK_SET_HOOK(proc_check_get_cs_info) + CHECK_SET_HOOK(proc_check_set_cs_info) CHECK_SET_HOOK(iokit_check_hid_control) @@ -461,15 +467,14 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(vnode_check_uipc_bind) CHECK_SET_HOOK(vnode_check_uipc_connect) - /* CHECK_SET_HOOK(proc_check_run_cs_invalid) */ - .mpo_proc_check_run_cs_invalid = (mac_proc_check_run_cs_invalid_t *)common_hook, + CHECK_SET_HOOK(proc_check_run_cs_invalid) CHECK_SET_HOOK(proc_check_suspend_resume) CHECK_SET_HOOK(thread_userret) CHECK_SET_HOOK(iokit_check_set_properties) - CHECK_SET_HOOK(system_check_chud) + .mpo_reserved3 = (mpo_reserved_hook_t *)common_hook, CHECK_SET_HOOK(vnode_check_searchfs) @@ -486,12 +491,13 @@ static struct mac_policy_ops policy_ops = { CHECK_SET_HOOK(vnode_notify_rename) - CHECK_SET_HOOK(thread_label_init) - CHECK_SET_HOOK(thread_label_destroy) + CHECK_SET_HOOK(vnode_check_setacl) + + CHECK_SET_HOOK(vnode_notify_deleteextattr) CHECK_SET_HOOK(system_check_kas_info) - CHECK_SET_HOOK(proc_check_cpumon) + CHECK_SET_HOOK(vnode_check_lookup_preflight) CHECK_SET_HOOK(vnode_notify_open) @@ -517,18 +523,18 @@ static struct mac_policy_ops policy_ops = { /* * Policy definition */ -static struct mac_policy_conf policy_conf = { +static SECURITY_READ_ONLY_LATE(struct mac_policy_conf) policy_conf = { .mpc_name = "CHECK", .mpc_fullname = "Check Assumptions Policy", - .mpc_field_off = NULL, /* no label slot */ - .mpc_labelnames = NULL, /* no policy label names */ - .mpc_labelname_count = 0, /* count of label names is 0 */ - .mpc_ops = &policy_ops, /* policy operations */ + .mpc_field_off = NULL, /* no label slot */ + .mpc_labelnames = NULL, /* no policy label names */ + .mpc_labelname_count = 0, /* count of label names is 0 */ + .mpc_ops = &policy_ops, /* policy operations */ .mpc_loadtime_flags = 0, .mpc_runtime_flags = 0, }; -static mac_policy_handle_t policy_handle; +static SECURITY_READ_ONLY_LATE(mac_policy_handle_t) policy_handle; /* * Init routine; for a loadable policy, this would be called during the KEXT @@ -539,8 +545,9 @@ errno_t check_policy_init(int flags) { /* Only instantiate the module if we have been asked to do checking */ - if (!flags) + if (!flags) { return 0; + } policy_flags = flags;