1 | /* |
2 | * Copyright (c) 2014 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #include <pexpert/pexpert.h> |
30 | #include <sys/csr.h> |
31 | #include <sys/errno.h> |
32 | #include <sys/sysproto.h> |
33 | #include <sys/systm.h> |
34 | #include <sys/types.h> |
35 | |
36 | #if CONFIG_CSR_FROM_DT |
37 | |
38 | /* |
39 | * New style CSR for non-x86 platforms, using Per-OS Security Policy |
40 | * (POSP) |
41 | */ |
42 | |
43 | #include <libkern/section_keywords.h> |
44 | #include <pexpert/device_tree.h> |
45 | |
46 | #if defined(KERNEL_INTEGRITY_KTRR) || defined(KERNEL_INTEGRITY_CTRR) |
47 | #include <arm64/amcc_rorgn.h> |
48 | #endif |
49 | |
50 | static SECURITY_READ_ONLY_LATE(csr_config_t) csr_config = 0; |
51 | |
52 | // WARNING: Used extremely early during boot. See csr_bootstrap(). |
53 | static bool |
54 | _csr_get_dt_bool(DTEntry *entry, char const *name, bool *out) |
55 | { |
56 | const uint32_t *value; |
57 | unsigned int size; |
58 | |
59 | if (SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: (const void**)&value, propertySize: &size) != kSuccess) { |
60 | return false; |
61 | } |
62 | |
63 | if (size != sizeof(uint32_t)) { |
64 | panic("unexpected size %xu for bool property '%s'" , size, name); |
65 | } |
66 | |
67 | *out = (bool)*value; |
68 | return true; |
69 | } |
70 | |
71 | // WARNING: Used extremely early during boot. See csr_bootstrap(). |
72 | static bool |
73 | _csr_get_dt_uint64(DTEntry *entry, char const *name, uint64_t *out) |
74 | { |
75 | const uint64_t *value; |
76 | unsigned int size; |
77 | |
78 | if (SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: (const void**)&value, propertySize: &size) != kSuccess) { |
79 | return false; |
80 | } |
81 | |
82 | if (size != sizeof(uint64_t)) { |
83 | panic("unexpected size %xu for uint64 property '%s'" , size, name); |
84 | } |
85 | |
86 | *out = *value; |
87 | return true; |
88 | } |
89 | |
90 | // WARNING: Used extremely early during boot. See csr_bootstrap(). |
91 | static bool |
92 | _csr_dt_string_is_equal(DTEntry *entry, const char *name, const char *str) |
93 | { |
94 | const void *value; |
95 | unsigned size; |
96 | size_t str_size; |
97 | |
98 | str_size = strlen(s: str) + 1; |
99 | return entry != NULL && |
100 | SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: &value, propertySize: &size) == kSuccess && |
101 | value != NULL && |
102 | size == str_size && |
103 | strncmp(s1: str, s2: value, n: str_size) == 0; |
104 | } |
105 | |
106 | static bool |
107 | _csr_is_recovery_environment(void) |
108 | { |
109 | DTEntry chosen; |
110 | |
111 | return SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen" , foundEntry: &chosen) == kSuccess && |
112 | _csr_dt_string_is_equal(entry: &chosen, name: "osenvironment" , str: "recoveryos" ); |
113 | } |
114 | |
115 | static bool |
116 | _csr_is_iuou_or_iuos_device(void) |
117 | { |
118 | DTEntry entry; |
119 | bool bool_value; |
120 | |
121 | return (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen" , foundEntry: &entry) == kSuccess && |
122 | (_csr_get_dt_bool(entry: &entry, name: "internal-use-only-unit" , out: &bool_value) && bool_value)) || |
123 | (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen/manifest-properties" , foundEntry: &entry) == kSuccess && |
124 | (_csr_get_dt_bool(entry: &entry, name: "iuos" , out: &bool_value) && bool_value)); |
125 | } |
126 | |
127 | static bool |
128 | _csr_should_allow_device_configuration(void) |
129 | { |
130 | /* |
131 | * Allow CSR_ALLOW_DEVICE_CONFIGURATION if the device is running in a |
132 | * restore environment, or if the "csr-allow-device-configuration" |
133 | * property is set in the device tree. |
134 | */ |
135 | DTEntry chosen; |
136 | bool bool_value; |
137 | |
138 | return _csr_is_recovery_environment() || ( |
139 | SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen" , foundEntry: &chosen) == kSuccess && |
140 | _csr_get_dt_bool(entry: &chosen, name: "csr-allow-device-configuration" , out: &bool_value) && bool_value); |
141 | } |
142 | |
143 | /* |
144 | * Initialize CSR from the Device Tree. |
145 | * |
146 | * WARNING: csr_bootstrap() is called extremely early in the kernel |
147 | * startup process in kernel_startup_bootstrap(), which happens |
148 | * before even the vm or pmap layer are initialized. |
149 | * |
150 | * It is marked as STARTUP_RANK_FIRST so that it is called before panic_init(), |
151 | * which runs during STARTUP_RANK_MIDDLE. This is necessary because panic_init() |
152 | * calls csr_check() to determine whether the device is configured to allow |
153 | * kernel debugging. |
154 | * |
155 | * Only do things here that don't require any dynamic memory (other |
156 | * than the stack). Parsing boot-args, walking the device tree and |
157 | * setting global variables is fine, most other things are not. Defer |
158 | * those other things with global variables, if necessary. |
159 | * |
160 | */ |
161 | __startup_func |
162 | static void |
163 | csr_bootstrap(void) |
164 | { |
165 | DTEntry entry; |
166 | uint64_t uint64_value; |
167 | bool config_active = false; |
168 | bool bool_value; |
169 | |
170 | csr_config = 0; // start out fully restrictive |
171 | |
172 | if (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen/asmb" , foundEntry: &entry) == kSuccess && |
173 | _csr_get_dt_uint64(entry: &entry, name: "lp-sip0" , out: &uint64_value)) { |
174 | csr_config = (uint32_t)uint64_value; // Currently only 32 bits used. |
175 | config_active = true; |
176 | } |
177 | |
178 | /* |
179 | * If the device is an Internal Use Only Unit (IUOU) or if it is running a |
180 | * build that is signed with the Internal Use Only Software (IUOS) tag, then |
181 | * allow the preservation of the CSR_ALLOW_APPLE_INTERNAL bit. Otherwise, |
182 | * forcefully remove the bit on boot. |
183 | */ |
184 | if (!_csr_is_iuou_or_iuos_device()) { |
185 | csr_config &= ~CSR_ALLOW_APPLE_INTERNAL; |
186 | } else if (!config_active) { |
187 | // If there is no custom configuration present, infer the AppleInternal |
188 | // bit on IUOU or IUOS devices. |
189 | csr_config |= CSR_ALLOW_APPLE_INTERNAL; |
190 | } |
191 | |
192 | // Unrestrict filesystem access in recovery. |
193 | // This is required so the MSU stack can mount/unmount the update volume |
194 | // during paired recovery. |
195 | if (_csr_is_recovery_environment()) { |
196 | csr_config |= CSR_ALLOW_UNRESTRICTED_FS; |
197 | } |
198 | |
199 | if (_csr_should_allow_device_configuration()) { |
200 | csr_config |= CSR_ALLOW_DEVICE_CONFIGURATION; |
201 | } |
202 | |
203 | // The CSR_ALLOW_UNAUTHENTICATED_ROOT flag must be synthesized from sip1 |
204 | // in the local boot policy. |
205 | if (_csr_get_dt_bool(entry: &entry, name: "lp-sip1" , out: &bool_value) && bool_value) { |
206 | csr_config |= CSR_ALLOW_UNAUTHENTICATED_ROOT; |
207 | } else { |
208 | csr_config &= ~CSR_ALLOW_UNAUTHENTICATED_ROOT; |
209 | } |
210 | |
211 | #if defined(KERNEL_INTEGRITY_KTRR) || defined(KERNEL_INTEGRITY_CTRR) |
212 | // Check whether we have to disable CTRR. |
213 | // lp-sip2 in the local boot policy is the bit driving this, |
214 | // which csrutil also sets implicitly when e.g. requesting kernel debugging. |
215 | csr_unsafe_kernel_text = _csr_get_dt_bool(&entry, "lp-sip2" , &bool_value) && bool_value; |
216 | #endif |
217 | } |
218 | STARTUP(TUNABLES, STARTUP_RANK_FIRST, csr_bootstrap); |
219 | |
220 | int |
221 | csr_get_active_config(csr_config_t * config) |
222 | { |
223 | *config = (csr_config & CSR_VALID_FLAGS); |
224 | |
225 | return 0; |
226 | } |
227 | |
228 | int |
229 | csr_check(csr_config_t mask) |
230 | { |
231 | csr_config_t config; |
232 | int ret = csr_get_active_config(config: &config); |
233 | |
234 | if (ret != 0) { |
235 | return ret; |
236 | } |
237 | |
238 | // CSR_ALLOW_KERNEL_DEBUGGER needs to be allowed when SIP is disabled |
239 | // to allow 3rd-party developers to debug their kexts. Use |
240 | // CSR_ALLOW_UNTRUSTED_KEXTS as a proxy for "SIP is disabled" on the |
241 | // grounds that you can do the same damage with a kernel debugger as |
242 | // you can with an untrusted kext. |
243 | if ((config & (CSR_ALLOW_UNTRUSTED_KEXTS | CSR_ALLOW_APPLE_INTERNAL)) != 0) { |
244 | config |= CSR_ALLOW_KERNEL_DEBUGGER; |
245 | } |
246 | |
247 | return ((config & mask) == mask) ? 0 : EPERM; |
248 | } |
249 | |
250 | #else |
251 | |
252 | /* |
253 | * Old style CSR for x86 platforms, using NVRAM values |
254 | */ |
255 | |
256 | #include <libkern/section_keywords.h> |
257 | |
258 | /* enable enforcement by default */ |
259 | static SECURITY_READ_ONLY_LATE(int) csr_allow_all = 0; |
260 | |
261 | /* |
262 | * Initialize csr_allow_all from device boot state. |
263 | * |
264 | * Needs to be run before panic_init() since panic_init() |
265 | * calls into csr_check() and runs during STARTUP_RANK_MIDDLE. |
266 | */ |
267 | __startup_func |
268 | static void |
269 | csr_bootstrap(void) |
270 | { |
271 | boot_args *args = (boot_args *)PE_state.bootArgs; |
272 | if (args->flags & kBootArgsFlagCSRBoot) { |
273 | /* special booter; allow everything */ |
274 | csr_allow_all = 1; |
275 | } |
276 | } |
277 | STARTUP(TUNABLES, STARTUP_RANK_FIRST, csr_bootstrap); |
278 | |
279 | |
280 | int |
281 | csr_get_active_config(csr_config_t *config) |
282 | { |
283 | boot_args *args = (boot_args *)PE_state.bootArgs; |
284 | if (args->flags & kBootArgsFlagCSRActiveConfig) { |
285 | *config = args->csrActiveConfig & CSR_VALID_FLAGS; |
286 | } else { |
287 | *config = 0; |
288 | } |
289 | |
290 | return 0; |
291 | } |
292 | |
293 | int |
294 | csr_check(csr_config_t mask) |
295 | { |
296 | boot_args *args = (boot_args *)PE_state.bootArgs; |
297 | if (mask & CSR_ALLOW_DEVICE_CONFIGURATION) { |
298 | return (args->flags & kBootArgsFlagCSRConfigMode) ? 0 : EPERM; |
299 | } |
300 | |
301 | csr_config_t config; |
302 | int ret = csr_get_active_config(&config); |
303 | if (ret) { |
304 | return ret; |
305 | } |
306 | |
307 | // CSR_ALLOW_KERNEL_DEBUGGER needs to be allowed when SIP is disabled |
308 | // to allow 3rd-party developers to debug their kexts. Use |
309 | // CSR_ALLOW_UNTRUSTED_KEXTS as a proxy for "SIP is disabled" on the |
310 | // grounds that you can do the same damage with a kernel debugger as |
311 | // you can with an untrusted kext. |
312 | if ((config & (CSR_ALLOW_UNTRUSTED_KEXTS | CSR_ALLOW_APPLE_INTERNAL)) != 0) { |
313 | config |= CSR_ALLOW_KERNEL_DEBUGGER; |
314 | } |
315 | |
316 | ret = ((config & mask) == mask) ? 0 : EPERM; |
317 | if (ret == EPERM) { |
318 | // Override the return value if booted from the BaseSystem and the mask does not contain any flag that should always be enforced. |
319 | if (csr_allow_all && (mask & CSR_ALWAYS_ENFORCED_FLAGS) == 0) { |
320 | ret = 0; |
321 | } |
322 | } |
323 | |
324 | return ret; |
325 | } |
326 | |
327 | #endif /* CONFIG_CSR_FROM_DT */ |
328 | |
329 | /* |
330 | * Syscall stubs |
331 | */ |
332 | |
333 | int syscall_csr_check(struct csrctl_args *args); |
334 | int syscall_csr_get_active_config(struct csrctl_args *args); |
335 | |
336 | |
337 | int |
338 | syscall_csr_check(struct csrctl_args *args) |
339 | { |
340 | csr_config_t mask = 0; |
341 | int error = 0; |
342 | |
343 | if (args->useraddr == 0 || args->usersize != sizeof(mask)) { |
344 | return EINVAL; |
345 | } |
346 | |
347 | error = copyin(args->useraddr, &mask, sizeof(mask)); |
348 | if (error) { |
349 | return error; |
350 | } |
351 | |
352 | return csr_check(mask); |
353 | } |
354 | |
355 | int |
356 | syscall_csr_get_active_config(struct csrctl_args *args) |
357 | { |
358 | csr_config_t config = 0; |
359 | int error = 0; |
360 | |
361 | if (args->useraddr == 0 || args->usersize != sizeof(config)) { |
362 | return EINVAL; |
363 | } |
364 | |
365 | error = csr_get_active_config(config: &config); |
366 | if (error) { |
367 | return error; |
368 | } |
369 | |
370 | return copyout(&config, args->useraddr, sizeof(config)); |
371 | } |
372 | |
373 | /* |
374 | * Syscall entrypoint |
375 | */ |
376 | |
377 | int |
378 | csrctl(__unused proc_t p, struct csrctl_args *args, __unused int32_t *retval) |
379 | { |
380 | switch (args->op) { |
381 | case CSR_SYSCALL_CHECK: |
382 | return syscall_csr_check(args); |
383 | case CSR_SYSCALL_GET_ACTIVE_CONFIG: |
384 | return syscall_csr_get_active_config(args); |
385 | default: |
386 | return ENOSYS; |
387 | } |
388 | } |
389 | |