1/*
2 * Copyright (c) 2014 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <pexpert/pexpert.h>
30#include <sys/csr.h>
31#include <sys/errno.h>
32#include <sys/sysproto.h>
33#include <sys/systm.h>
34#include <sys/types.h>
35
36#if CONFIG_CSR_FROM_DT
37
38/*
39 * New style CSR for non-x86 platforms, using Per-OS Security Policy
40 * (POSP)
41 */
42
43#include <libkern/section_keywords.h>
44#include <pexpert/device_tree.h>
45
46#if defined(KERNEL_INTEGRITY_KTRR) || defined(KERNEL_INTEGRITY_CTRR)
47#include <arm64/amcc_rorgn.h>
48#endif
49
50static SECURITY_READ_ONLY_LATE(csr_config_t) csr_config = 0;
51
52// WARNING: Used extremely early during boot. See csr_bootstrap().
53static bool
54_csr_get_dt_bool(DTEntry *entry, char const *name, bool *out)
55{
56 const uint32_t *value;
57 unsigned int size;
58
59 if (SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: (const void**)&value, propertySize: &size) != kSuccess) {
60 return false;
61 }
62
63 if (size != sizeof(uint32_t)) {
64 panic("unexpected size %xu for bool property '%s'", size, name);
65 }
66
67 *out = (bool)*value;
68 return true;
69}
70
71// WARNING: Used extremely early during boot. See csr_bootstrap().
72static bool
73_csr_get_dt_uint64(DTEntry *entry, char const *name, uint64_t *out)
74{
75 const uint64_t *value;
76 unsigned int size;
77
78 if (SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: (const void**)&value, propertySize: &size) != kSuccess) {
79 return false;
80 }
81
82 if (size != sizeof(uint64_t)) {
83 panic("unexpected size %xu for uint64 property '%s'", size, name);
84 }
85
86 *out = *value;
87 return true;
88}
89
90// WARNING: Used extremely early during boot. See csr_bootstrap().
91static bool
92_csr_dt_string_is_equal(DTEntry *entry, const char *name, const char *str)
93{
94 const void *value;
95 unsigned size;
96 size_t str_size;
97
98 str_size = strlen(s: str) + 1;
99 return entry != NULL &&
100 SecureDTGetProperty(entry: *entry, propertyName: name, propertyValue: &value, propertySize: &size) == kSuccess &&
101 value != NULL &&
102 size == str_size &&
103 strncmp(s1: str, s2: value, n: str_size) == 0;
104}
105
106static bool
107_csr_is_recovery_environment(void)
108{
109 DTEntry chosen;
110
111 return SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen", foundEntry: &chosen) == kSuccess &&
112 _csr_dt_string_is_equal(entry: &chosen, name: "osenvironment", str: "recoveryos");
113}
114
115static bool
116_csr_is_iuou_or_iuos_device(void)
117{
118 DTEntry entry;
119 bool bool_value;
120
121 return (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen", foundEntry: &entry) == kSuccess &&
122 (_csr_get_dt_bool(entry: &entry, name: "internal-use-only-unit", out: &bool_value) && bool_value)) ||
123 (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen/manifest-properties", foundEntry: &entry) == kSuccess &&
124 (_csr_get_dt_bool(entry: &entry, name: "iuos", out: &bool_value) && bool_value));
125}
126
127static bool
128_csr_should_allow_device_configuration(void)
129{
130 /*
131 * Allow CSR_ALLOW_DEVICE_CONFIGURATION if the device is running in a
132 * restore environment, or if the "csr-allow-device-configuration"
133 * property is set in the device tree.
134 */
135 DTEntry chosen;
136 bool bool_value;
137
138 return _csr_is_recovery_environment() || (
139 SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen", foundEntry: &chosen) == kSuccess &&
140 _csr_get_dt_bool(entry: &chosen, name: "csr-allow-device-configuration", out: &bool_value) && bool_value);
141}
142
143/*
144 * Initialize CSR from the Device Tree.
145 *
146 * WARNING: csr_bootstrap() is called extremely early in the kernel
147 * startup process in kernel_startup_bootstrap(), which happens
148 * before even the vm or pmap layer are initialized.
149 *
150 * It is marked as STARTUP_RANK_FIRST so that it is called before panic_init(),
151 * which runs during STARTUP_RANK_MIDDLE. This is necessary because panic_init()
152 * calls csr_check() to determine whether the device is configured to allow
153 * kernel debugging.
154 *
155 * Only do things here that don't require any dynamic memory (other
156 * than the stack). Parsing boot-args, walking the device tree and
157 * setting global variables is fine, most other things are not. Defer
158 * those other things with global variables, if necessary.
159 *
160 */
161__startup_func
162static void
163csr_bootstrap(void)
164{
165 DTEntry entry;
166 uint64_t uint64_value;
167 bool config_active = false;
168 bool bool_value;
169
170 csr_config = 0; // start out fully restrictive
171
172 if (SecureDTLookupEntry(searchPoint: 0, pathName: "/chosen/asmb", foundEntry: &entry) == kSuccess &&
173 _csr_get_dt_uint64(entry: &entry, name: "lp-sip0", out: &uint64_value)) {
174 csr_config = (uint32_t)uint64_value; // Currently only 32 bits used.
175 config_active = true;
176 }
177
178 /*
179 * If the device is an Internal Use Only Unit (IUOU) or if it is running a
180 * build that is signed with the Internal Use Only Software (IUOS) tag, then
181 * allow the preservation of the CSR_ALLOW_APPLE_INTERNAL bit. Otherwise,
182 * forcefully remove the bit on boot.
183 */
184 if (!_csr_is_iuou_or_iuos_device()) {
185 csr_config &= ~CSR_ALLOW_APPLE_INTERNAL;
186 } else if (!config_active) {
187 // If there is no custom configuration present, infer the AppleInternal
188 // bit on IUOU or IUOS devices.
189 csr_config |= CSR_ALLOW_APPLE_INTERNAL;
190 }
191
192 // Unrestrict filesystem access in recovery.
193 // This is required so the MSU stack can mount/unmount the update volume
194 // during paired recovery.
195 if (_csr_is_recovery_environment()) {
196 csr_config |= CSR_ALLOW_UNRESTRICTED_FS;
197 }
198
199 if (_csr_should_allow_device_configuration()) {
200 csr_config |= CSR_ALLOW_DEVICE_CONFIGURATION;
201 }
202
203 // The CSR_ALLOW_UNAUTHENTICATED_ROOT flag must be synthesized from sip1
204 // in the local boot policy.
205 if (_csr_get_dt_bool(entry: &entry, name: "lp-sip1", out: &bool_value) && bool_value) {
206 csr_config |= CSR_ALLOW_UNAUTHENTICATED_ROOT;
207 } else {
208 csr_config &= ~CSR_ALLOW_UNAUTHENTICATED_ROOT;
209 }
210
211#if defined(KERNEL_INTEGRITY_KTRR) || defined(KERNEL_INTEGRITY_CTRR)
212 // Check whether we have to disable CTRR.
213 // lp-sip2 in the local boot policy is the bit driving this,
214 // which csrutil also sets implicitly when e.g. requesting kernel debugging.
215 csr_unsafe_kernel_text = _csr_get_dt_bool(&entry, "lp-sip2", &bool_value) && bool_value;
216#endif
217}
218STARTUP(TUNABLES, STARTUP_RANK_FIRST, csr_bootstrap);
219
220int
221csr_get_active_config(csr_config_t * config)
222{
223 *config = (csr_config & CSR_VALID_FLAGS);
224
225 return 0;
226}
227
228int
229csr_check(csr_config_t mask)
230{
231 csr_config_t config;
232 int ret = csr_get_active_config(config: &config);
233
234 if (ret != 0) {
235 return ret;
236 }
237
238 // CSR_ALLOW_KERNEL_DEBUGGER needs to be allowed when SIP is disabled
239 // to allow 3rd-party developers to debug their kexts. Use
240 // CSR_ALLOW_UNTRUSTED_KEXTS as a proxy for "SIP is disabled" on the
241 // grounds that you can do the same damage with a kernel debugger as
242 // you can with an untrusted kext.
243 if ((config & (CSR_ALLOW_UNTRUSTED_KEXTS | CSR_ALLOW_APPLE_INTERNAL)) != 0) {
244 config |= CSR_ALLOW_KERNEL_DEBUGGER;
245 }
246
247 return ((config & mask) == mask) ? 0 : EPERM;
248}
249
250#else
251
252/*
253 * Old style CSR for x86 platforms, using NVRAM values
254 */
255
256#include <libkern/section_keywords.h>
257
258/* enable enforcement by default */
259static SECURITY_READ_ONLY_LATE(int) csr_allow_all = 0;
260
261/*
262 * Initialize csr_allow_all from device boot state.
263 *
264 * Needs to be run before panic_init() since panic_init()
265 * calls into csr_check() and runs during STARTUP_RANK_MIDDLE.
266 */
267__startup_func
268static void
269csr_bootstrap(void)
270{
271 boot_args *args = (boot_args *)PE_state.bootArgs;
272 if (args->flags & kBootArgsFlagCSRBoot) {
273 /* special booter; allow everything */
274 csr_allow_all = 1;
275 }
276}
277STARTUP(TUNABLES, STARTUP_RANK_FIRST, csr_bootstrap);
278
279
280int
281csr_get_active_config(csr_config_t *config)
282{
283 boot_args *args = (boot_args *)PE_state.bootArgs;
284 if (args->flags & kBootArgsFlagCSRActiveConfig) {
285 *config = args->csrActiveConfig & CSR_VALID_FLAGS;
286 } else {
287 *config = 0;
288 }
289
290 return 0;
291}
292
293int
294csr_check(csr_config_t mask)
295{
296 boot_args *args = (boot_args *)PE_state.bootArgs;
297 if (mask & CSR_ALLOW_DEVICE_CONFIGURATION) {
298 return (args->flags & kBootArgsFlagCSRConfigMode) ? 0 : EPERM;
299 }
300
301 csr_config_t config;
302 int ret = csr_get_active_config(&config);
303 if (ret) {
304 return ret;
305 }
306
307 // CSR_ALLOW_KERNEL_DEBUGGER needs to be allowed when SIP is disabled
308 // to allow 3rd-party developers to debug their kexts. Use
309 // CSR_ALLOW_UNTRUSTED_KEXTS as a proxy for "SIP is disabled" on the
310 // grounds that you can do the same damage with a kernel debugger as
311 // you can with an untrusted kext.
312 if ((config & (CSR_ALLOW_UNTRUSTED_KEXTS | CSR_ALLOW_APPLE_INTERNAL)) != 0) {
313 config |= CSR_ALLOW_KERNEL_DEBUGGER;
314 }
315
316 ret = ((config & mask) == mask) ? 0 : EPERM;
317 if (ret == EPERM) {
318 // Override the return value if booted from the BaseSystem and the mask does not contain any flag that should always be enforced.
319 if (csr_allow_all && (mask & CSR_ALWAYS_ENFORCED_FLAGS) == 0) {
320 ret = 0;
321 }
322 }
323
324 return ret;
325}
326
327#endif /* CONFIG_CSR_FROM_DT */
328
329/*
330 * Syscall stubs
331 */
332
333int syscall_csr_check(struct csrctl_args *args);
334int syscall_csr_get_active_config(struct csrctl_args *args);
335
336
337int
338syscall_csr_check(struct csrctl_args *args)
339{
340 csr_config_t mask = 0;
341 int error = 0;
342
343 if (args->useraddr == 0 || args->usersize != sizeof(mask)) {
344 return EINVAL;
345 }
346
347 error = copyin(args->useraddr, &mask, sizeof(mask));
348 if (error) {
349 return error;
350 }
351
352 return csr_check(mask);
353}
354
355int
356syscall_csr_get_active_config(struct csrctl_args *args)
357{
358 csr_config_t config = 0;
359 int error = 0;
360
361 if (args->useraddr == 0 || args->usersize != sizeof(config)) {
362 return EINVAL;
363 }
364
365 error = csr_get_active_config(config: &config);
366 if (error) {
367 return error;
368 }
369
370 return copyout(&config, args->useraddr, sizeof(config));
371}
372
373/*
374 * Syscall entrypoint
375 */
376
377int
378csrctl(__unused proc_t p, struct csrctl_args *args, __unused int32_t *retval)
379{
380 switch (args->op) {
381 case CSR_SYSCALL_CHECK:
382 return syscall_csr_check(args);
383 case CSR_SYSCALL_GET_ACTIVE_CONFIG:
384 return syscall_csr_get_active_config(args);
385 default:
386 return ENOSYS;
387 }
388}
389