1 | /* |
2 | * Copyright (c) 2015 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <mach/exception_types.h> |
30 | #include <mach/mach_types.h> |
31 | #include <osfmk/kern/exception.h> |
32 | #include <osfmk/kern/task.h> |
33 | #include <sys/codesign.h> |
34 | #include <sys/param.h> |
35 | #include <sys/user.h> |
36 | #include <sys/proc.h> |
37 | #include <sys/proc_internal.h> |
38 | #include <sys/kauth.h> |
39 | #include <kern/task.h> |
40 | |
41 | #include <security/mac_framework.h> |
42 | #include <security/mac_internal.h> |
43 | #include <security/mac_mach_internal.h> |
44 | |
45 | #if CONFIG_CSR |
46 | #include <sys/csr.h> |
47 | // Panic on internal builds, just log otherwise. |
48 | #define MAC_MACH_UNEXPECTED(fmt...) \ |
49 | if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); } |
50 | #else |
51 | #define MAC_MACH_UNEXPECTED(fmt...) printf(fmt) |
52 | #endif |
53 | |
54 | static struct proc * |
55 | mac_task_get_proc(struct task *task) |
56 | { |
57 | if (task == current_task()) |
58 | return proc_self(); |
59 | |
60 | /* |
61 | * Tasks don't really hold a reference on a proc unless the |
62 | * calling thread belongs to the task in question. |
63 | */ |
64 | int pid = task_pid(task); |
65 | struct proc *p = proc_find(pid); |
66 | |
67 | if (p != NULL) { |
68 | if (proc_task(p) == task) |
69 | return p; |
70 | proc_rele(p); |
71 | } |
72 | return NULL; |
73 | } |
74 | |
75 | int |
76 | mac_task_check_expose_task(struct task *task) |
77 | { |
78 | int error; |
79 | |
80 | struct proc *p = mac_task_get_proc(task); |
81 | if (p == NULL) |
82 | return ESRCH; |
83 | |
84 | struct ucred *cred = kauth_cred_get(); |
85 | MAC_CHECK(proc_check_expose_task, cred, p); |
86 | proc_rele(p); |
87 | return (error); |
88 | } |
89 | |
90 | int |
91 | mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port) |
92 | { |
93 | int error; |
94 | |
95 | struct proc *p = mac_task_get_proc(task); |
96 | if (p == NULL) |
97 | return ESRCH; |
98 | |
99 | kauth_cred_t cred = kauth_cred_proc_ref(p); |
100 | MAC_CHECK(proc_check_set_host_special_port, cred, id, port); |
101 | kauth_cred_unref(&cred); |
102 | proc_rele(p); |
103 | return (error); |
104 | } |
105 | |
106 | int |
107 | mac_task_check_set_host_exception_port(struct task *task, unsigned int exception) |
108 | { |
109 | int error; |
110 | |
111 | struct proc *p = mac_task_get_proc(task); |
112 | if (p == NULL) |
113 | return ESRCH; |
114 | |
115 | kauth_cred_t cred = kauth_cred_proc_ref(p); |
116 | MAC_CHECK(proc_check_set_host_exception_port, cred, exception); |
117 | kauth_cred_unref(&cred); |
118 | proc_rele(p); |
119 | return (error); |
120 | } |
121 | |
122 | int |
123 | mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask) |
124 | { |
125 | int error = 0; |
126 | int exception; |
127 | |
128 | struct proc *p = mac_task_get_proc(task); |
129 | if (p == NULL) |
130 | return ESRCH; |
131 | |
132 | kauth_cred_t cred = kauth_cred_proc_ref(p); |
133 | for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) { |
134 | if (exception_mask & (1 << exception)) { |
135 | MAC_CHECK(proc_check_set_host_exception_port, cred, exception); |
136 | if (error) |
137 | break; |
138 | } |
139 | } |
140 | kauth_cred_unref(&cred); |
141 | proc_rele(p); |
142 | return (error); |
143 | } |
144 | |
145 | void |
146 | mac_thread_userret(struct thread *td) |
147 | { |
148 | |
149 | MAC_PERFORM(thread_userret, td); |
150 | } |
151 | |
152 | void |
153 | mac_proc_notify_exec_complete(struct proc *proc) |
154 | { |
155 | thread_t thread = current_thread(); |
156 | |
157 | /* |
158 | * Since this MAC hook was designed to support upcalls, make sure the hook |
159 | * is called with kernel importance propagation enabled so any daemons |
160 | * can get any appropriate importance donations. |
161 | */ |
162 | thread_enable_send_importance(thread, TRUE); |
163 | MAC_PERFORM(proc_notify_exec_complete, proc); |
164 | thread_enable_send_importance(thread, FALSE); |
165 | } |
166 | |
167 | /**** Exception Policy |
168 | * |
169 | * Note that the functions below do not fully follow the usual convention for mac policy functions |
170 | * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual |
171 | * policy function names, we diverge because the exception policy is somewhat special: |
172 | * It is used in places where allocation and association must be separate, and its labels do not |
173 | * only belong to one type of object as usual, but to two (on exception actions and on tasks as |
174 | * crash labels). |
175 | */ |
176 | |
177 | // Label allocation and deallocation, may sleep. |
178 | |
179 | struct label * |
180 | mac_exc_create_label(void) |
181 | { |
182 | struct label *label = mac_labelzone_alloc(MAC_WAITOK); |
183 | |
184 | if (label == NULL) { |
185 | return NULL; |
186 | } |
187 | |
188 | // Policy initialization of the label, typically performs allocations as well. |
189 | // (Unless the policy's full data really fits into a pointer size.) |
190 | MAC_PERFORM(exc_action_label_init, label); |
191 | |
192 | return label; |
193 | } |
194 | |
195 | void |
196 | mac_exc_free_label(struct label *label) |
197 | { |
198 | MAC_PERFORM(exc_action_label_destroy, label); |
199 | mac_labelzone_free(label); |
200 | } |
201 | |
202 | // Action label initialization and teardown, may sleep. |
203 | |
204 | void |
205 | mac_exc_associate_action_label(struct exception_action *action, struct label *label) |
206 | { |
207 | action->label = label; |
208 | MAC_PERFORM(exc_action_label_associate, action, action->label); |
209 | } |
210 | |
211 | void |
212 | mac_exc_free_action_label(struct exception_action *action) |
213 | { |
214 | mac_exc_free_label(action->label); |
215 | action->label = NULL; |
216 | } |
217 | |
218 | // Action label update and inheritance, may NOT sleep and must be quick. |
219 | |
220 | int |
221 | mac_exc_update_action_label(struct exception_action *action, |
222 | struct label *newlabel) { |
223 | int error; |
224 | |
225 | MAC_CHECK(exc_action_label_update, action, action->label, newlabel); |
226 | |
227 | return (error); |
228 | } |
229 | |
230 | int |
231 | mac_exc_inherit_action_label(struct exception_action *parent, |
232 | struct exception_action *child) { |
233 | return mac_exc_update_action_label(child, parent->label); |
234 | } |
235 | |
236 | int mac_exc_update_task_crash_label(struct task *task, struct label *label) { |
237 | int error; |
238 | |
239 | assert(task != kernel_task); |
240 | |
241 | struct label *crash_label = get_task_crash_label(task); |
242 | |
243 | MAC_CHECK(exc_action_label_update, NULL, crash_label, label); |
244 | |
245 | return (error); |
246 | } |
247 | |
248 | // Process label creation, may sleep. |
249 | |
250 | struct label * |
251 | mac_exc_create_label_for_proc(struct proc *proc) |
252 | { |
253 | struct label *label = mac_exc_create_label(); |
254 | MAC_PERFORM(exc_action_label_populate, label, proc); |
255 | return label; |
256 | } |
257 | |
258 | struct label * |
259 | mac_exc_create_label_for_current_proc(void) |
260 | { |
261 | return mac_exc_create_label_for_proc(current_proc()); |
262 | } |
263 | |
264 | // Exception handler policy checking, may sleep. |
265 | |
266 | int |
267 | mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action) |
268 | { |
269 | int error = 0; |
270 | |
271 | struct proc *p = get_bsdtask_info(victim_task); |
272 | struct label *bsd_label = NULL; |
273 | struct label *label = NULL; |
274 | |
275 | if (p != NULL) { |
276 | // Create a label from the still existing bsd process... |
277 | label = bsd_label = mac_exc_create_label_for_proc(p); |
278 | } else { |
279 | // ... otherwise use the crash label on the task. |
280 | label = get_task_crash_label(victim_task); |
281 | } |
282 | |
283 | if (label == NULL) { |
284 | MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process" ); |
285 | return EPERM; |
286 | } |
287 | |
288 | MAC_CHECK(exc_action_check_exception_send, label, action, action->label); |
289 | |
290 | if (bsd_label != NULL) { |
291 | mac_exc_free_label(bsd_label); |
292 | } |
293 | |
294 | return (error); |
295 | } |
296 | |