1 | /* |
2 | * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _SYS_CODESIGN_H_ |
30 | #define _SYS_CODESIGN_H_ |
31 | |
32 | #if KERNEL |
33 | #include <kern/cs_blobs.h> |
34 | #else |
35 | #include <System/kern/cs_blobs.h> |
36 | #endif |
37 | |
38 | /* MAC flags used by F_ADDFILESIGS_* */ |
39 | #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ |
40 | |
41 | /* csops operations */ |
42 | #define CS_OPS_STATUS 0 /* return status */ |
43 | #define CS_OPS_MARKINVALID 1 /* invalidate process */ |
44 | #define CS_OPS_MARKHARD 2 /* set HARD flag */ |
45 | #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ |
46 | #ifdef KERNEL_PRIVATE |
47 | /* CS_OPS_PIDPATH 4 */ |
48 | #endif |
49 | #define CS_OPS_CDHASH 5 /* get code directory hash */ |
50 | #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ |
51 | #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ |
52 | #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ |
53 | #define CS_OPS_SET_STATUS 9 /* set codesign flags */ |
54 | #define CS_OPS_BLOB 10 /* get codesign blob */ |
55 | #define CS_OPS_IDENTITY 11 /* get codesign identity */ |
56 | #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ |
57 | #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ |
58 | #define CS_OPS_TEAMID 14 /* get team id */ |
59 | |
60 | #define CS_MAX_TEAMID_LEN 64 |
61 | |
62 | #ifndef KERNEL |
63 | |
64 | #include <sys/types.h> |
65 | #include <mach/message.h> |
66 | |
67 | __BEGIN_DECLS |
68 | /* code sign operations */ |
69 | int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); |
70 | int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); |
71 | __END_DECLS |
72 | |
73 | #else /* !KERNEL */ |
74 | |
75 | #include <mach/machine.h> |
76 | #include <mach/vm_types.h> |
77 | |
78 | #include <sys/cdefs.h> |
79 | #include <sys/_types/_off_t.h> |
80 | |
81 | struct vnode; |
82 | struct cs_blob; |
83 | struct fileglob; |
84 | |
85 | __BEGIN_DECLS |
86 | int cs_valid(struct proc *); |
87 | int cs_process_enforcement(struct proc *); |
88 | int cs_process_global_enforcement(void); |
89 | int cs_system_enforcement(void); |
90 | int cs_require_lv(struct proc *); |
91 | int csproc_forced_lv(struct proc* p); |
92 | int cs_system_require_lv(void); |
93 | uint32_t cs_entitlement_flags(struct proc *p); |
94 | int cs_entitlements_blob_get(struct proc *, void **, size_t *); |
95 | int cs_restricted(struct proc *); |
96 | uint8_t * cs_get_cdhash(struct proc *); |
97 | |
98 | struct cs_blob * csproc_get_blob(struct proc *); |
99 | struct cs_blob * csvnode_get_blob(struct vnode *, off_t); |
100 | void csvnode_print_debug(struct vnode *); |
101 | |
102 | off_t csblob_get_base_offset(struct cs_blob *); |
103 | vm_size_t csblob_get_size(struct cs_blob *); |
104 | vm_address_t csblob_get_addr(struct cs_blob *); |
105 | const char * csblob_get_teamid(struct cs_blob *); |
106 | const char * csblob_get_identity(struct cs_blob *); |
107 | const uint8_t * csblob_get_cdhash(struct cs_blob *); |
108 | int csblob_get_platform_binary(struct cs_blob *); |
109 | unsigned int csblob_get_flags(struct cs_blob *); |
110 | uint8_t csblob_get_hashtype(struct cs_blob const *); |
111 | unsigned int csblob_get_signer_type(struct cs_blob *); |
112 | #if DEVELOPMENT || DEBUG |
113 | void csproc_clear_platform_binary(struct proc *); |
114 | #endif |
115 | |
116 | void csproc_disable_enforcement(struct proc* p); |
117 | void csproc_mark_invalid_allowed(struct proc* p); |
118 | int csproc_check_invalid_allowed(struct proc* p); |
119 | int csproc_hardened_runtime(struct proc* p); |
120 | |
121 | int csblob_get_entitlements(struct cs_blob *, void **, size_t *); |
122 | |
123 | const CS_GenericBlob * |
124 | csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); |
125 | const CS_GenericBlob * |
126 | csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); |
127 | void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); |
128 | void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); |
129 | |
130 | /* |
131 | * Mostly convenience functions below |
132 | */ |
133 | |
134 | const char * csproc_get_teamid(struct proc *); |
135 | const char * csvnode_get_teamid(struct vnode *, off_t); |
136 | int csproc_get_platform_binary(struct proc *); |
137 | int csproc_get_prod_signed(struct proc *); |
138 | const char * csfg_get_teamid(struct fileglob *); |
139 | int csfg_get_path(struct fileglob *, char *, int *); |
140 | int csfg_get_platform_binary(struct fileglob *); |
141 | uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); |
142 | int csfg_get_prod_signed(struct fileglob *); |
143 | unsigned int csfg_get_signer_type(struct fileglob *); |
144 | const char *csfg_get_identity(struct fileglob *fg, off_t offset); |
145 | unsigned int csproc_get_signer_type(struct proc *); |
146 | |
147 | uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); |
148 | uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); |
149 | uint8_t csproc_get_platform_identifier(struct proc *); |
150 | |
151 | extern int cs_debug; |
152 | extern int cs_debug_fail_on_unsigned_code; |
153 | extern unsigned int cs_debug_unsigned_exec_failures; |
154 | extern unsigned int cs_debug_unsigned_mmap_failures; |
155 | |
156 | int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, |
157 | struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); |
158 | |
159 | void cs_blob_free(struct cs_blob *blob); |
160 | |
161 | #ifdef XNU_KERNEL_PRIVATE |
162 | |
163 | void cs_init(void); |
164 | int cs_allow_invalid(struct proc *); |
165 | int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); |
166 | int csproc_get_platform_path(struct proc *); |
167 | |
168 | #if !SECURE_KERNEL |
169 | extern int cs_enforcement_panic; |
170 | #endif |
171 | |
172 | #endif /* XNU_KERNEL_PRIVATE */ |
173 | |
174 | |
175 | __END_DECLS |
176 | |
177 | |
178 | |
179 | #endif /* KERNEL */ |
180 | |
181 | #endif /* _SYS_CODESIGN_H_ */ |
182 | |