1 | /* |
2 | * Copyright (c) 2000-2009 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */ |
29 | /* |
30 | * Copyright (c) 1982, 1986, 1989, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * |
33 | * Redistribution and use in source and binary forms, with or without |
34 | * modification, are permitted provided that the following conditions |
35 | * are met: |
36 | * 1. Redistributions of source code must retain the above copyright |
37 | * notice, this list of conditions and the following disclaimer. |
38 | * 2. Redistributions in binary form must reproduce the above copyright |
39 | * notice, this list of conditions and the following disclaimer in the |
40 | * documentation and/or other materials provided with the distribution. |
41 | * 3. All advertising materials mentioning features or use of this software |
42 | * must display the following acknowledgement: |
43 | * This product includes software developed by the University of |
44 | * California, Berkeley and its contributors. |
45 | * 4. Neither the name of the University nor the names of its contributors |
46 | * may be used to endorse or promote products derived from this software |
47 | * without specific prior written permission. |
48 | * |
49 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
50 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
51 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
52 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
53 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
54 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
55 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
56 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
57 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
58 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
59 | * SUCH DAMAGE. |
60 | * |
61 | * @(#)kern_xxx.c 8.2 (Berkeley) 11/14/93 |
62 | */ |
63 | /* |
64 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
65 | * support for mandatory and extensible security protections. This notice |
66 | * is included in support of clause 2.2 (b) of the Apple Public License, |
67 | * Version 2.0. |
68 | */ |
69 | |
70 | #include <sys/param.h> |
71 | #include <sys/systm.h> |
72 | #include <sys/kernel.h> |
73 | #include <sys/proc_internal.h> |
74 | #include <sys/kauth.h> |
75 | #include <sys/reboot.h> |
76 | #include <sys/vm.h> |
77 | #include <sys/sysctl.h> |
78 | #include <sys/buf.h> |
79 | |
80 | #include <security/audit/audit.h> |
81 | |
82 | #include <sys/mount_internal.h> |
83 | #include <sys/sysproto.h> |
84 | #if CONFIG_MACF |
85 | #include <security/mac_framework.h> |
86 | #endif |
87 | #if CONFIG_ATM |
88 | #include <atm/atm_internal.h> |
89 | #endif |
90 | |
91 | #include <kern/kalloc.h> |
92 | #include <kern/ext_paniclog.h> |
93 | |
94 | #include <IOKit/IOBSD.h> |
95 | |
96 | /* Max panic string length */ |
97 | #define kPanicStringMaxLen 1024 |
98 | |
99 | extern int psem_cache_purge_all(void); |
100 | extern int pshm_cache_purge_all(void); |
101 | extern int pshm_cache_purge_uid(uid_t uid); |
102 | extern void reset_osvariant_status(void); |
103 | extern void reset_osreleasetype(void); |
104 | |
105 | int |
106 | reboot(struct proc *p, struct reboot_args *uap, __unused int32_t *retval) |
107 | { |
108 | char *message = NULL; |
109 | int error = 0; |
110 | size_t dummy = 0; |
111 | |
112 | AUDIT_ARG(cmd, uap->opt); |
113 | |
114 | if ((error = suser(cred: kauth_cred_get(), acflag: &p->p_acflag))) { |
115 | #if (DEVELOPMENT || DEBUG) |
116 | if (uap->opt & RB_PANIC) { |
117 | /* clear 'error' to allow non-root users to call panic on dev/debug kernels */ |
118 | error = 0; |
119 | } else { |
120 | return error; |
121 | } |
122 | #else |
123 | return error; |
124 | #endif |
125 | } |
126 | |
127 | if (uap->opt & RB_PANIC && uap->msg != USER_ADDR_NULL) { |
128 | message = (char *)kalloc_data(kPanicStringMaxLen, Z_WAITOK | Z_ZERO); |
129 | if (!message) { |
130 | return ENOMEM; |
131 | } |
132 | int copy_error = copyinstr(uaddr: uap->msg, kaddr: (void *)message, kPanicStringMaxLen, done: (size_t *)&dummy); |
133 | if (copy_error != 0 && copy_error != ENAMETOOLONG) { |
134 | strncpy(message, "user space RB_PANIC message copyin failed" , kPanicStringMaxLen - 1); |
135 | } else { |
136 | message[kPanicStringMaxLen - 1] = '\0'; |
137 | } |
138 | } |
139 | |
140 | #if CONFIG_MACF |
141 | #if (DEVELOPMENT || DEBUG) |
142 | if (uap->opt & RB_PANIC) { |
143 | /* on dev/debug kernels: allow anyone to call panic */ |
144 | goto skip_cred_check; |
145 | } |
146 | #endif |
147 | |
148 | error = mac_system_check_reboot(cred: current_cached_proc_cred(p), howto: uap->opt); |
149 | #if (DEVELOPMENT || DEBUG) |
150 | skip_cred_check: |
151 | #endif |
152 | #endif |
153 | if (!error) { |
154 | OSBitOrAtomic(P_REBOOT, &p->p_flag); /* No more signals for this proc */ |
155 | error = reboot_kernel(uap->opt, message); |
156 | } |
157 | |
158 | kfree_data(message, kPanicStringMaxLen); |
159 | return error; |
160 | } |
161 | |
162 | int |
163 | sys_panic_with_data(struct proc *p, |
164 | struct panic_with_data_args *uap, |
165 | __unused int32_t *retval) |
166 | { |
167 | char *message = NULL; |
168 | void *data = NULL; |
169 | int copy_len = 0; |
170 | size_t dummy = 0; |
171 | uuid_t uuid = {0}; |
172 | |
173 | AUDIT_ARG(addr, uap->addr); |
174 | AUDIT_ARG(value32, uap->len); |
175 | AUDIT_ARG(addr, uap->uuid); |
176 | |
177 | if (!IOCurrentTaskHasEntitlement(EXTPANICLOG_ENTITLEMENT)) { |
178 | return EPERM; |
179 | } |
180 | |
181 | char *proc_name = proc_best_name(p); |
182 | |
183 | if (uap->msg != USER_ADDR_NULL) { |
184 | message = (char *)kalloc_data(kPanicStringMaxLen, Z_WAITOK | Z_ZERO); |
185 | if (!message) { |
186 | goto finish; |
187 | } |
188 | int copy_error = copyinstr(uaddr: uap->msg, kaddr: (void *)message, kPanicStringMaxLen, done: (size_t *)&dummy); |
189 | if (copy_error != 0 && copy_error != ENAMETOOLONG) { |
190 | strlcpy(dst: message, src: "user space panic_with_data message copyin failed" , kPanicStringMaxLen - 1); |
191 | } else { |
192 | message[kPanicStringMaxLen - 1] = '\0'; |
193 | } |
194 | } |
195 | |
196 | if (uap->addr != USER_ADDR_NULL) { |
197 | copy_len = MIN(uap->len, PANIC_WITH_DATA_MAX_LEN); |
198 | |
199 | data = kalloc_data(copy_len, Z_WAITOK | Z_ZERO); |
200 | if (!data) { |
201 | goto finish; |
202 | } |
203 | |
204 | int copy_error = copyin(uap->addr, data, copy_len); |
205 | if (copy_error != 0) { |
206 | kfree_data(data, copy_len); |
207 | data = NULL; |
208 | } |
209 | } |
210 | |
211 | if (uap->uuid != USER_ADDR_NULL) { |
212 | int copyerror = copyin(uap->uuid, &uuid[0], sizeof(uuid_t)); |
213 | if (copyerror != 0) { |
214 | goto finish; |
215 | } |
216 | } |
217 | |
218 | finish: |
219 | panic_with_data(uuid, addr: data, len: copy_len, |
220 | format: "Panic called from Process: %s Message: %s" , proc_name, message); |
221 | } |
222 | |
223 | extern void OSKextResetAfterUserspaceReboot(void); |
224 | extern void zone_gc_drain(void); |
225 | extern uint64_t pmap_release_pages_fast(void); |
226 | |
227 | static int |
228 | usrctl_full(void) |
229 | { |
230 | reset_osvariant_status(); |
231 | reset_osreleasetype(); |
232 | |
233 | #if CONFIG_ATM |
234 | atm_reset(); |
235 | #endif |
236 | |
237 | #if CONFIG_EXT_RESOLVER |
238 | /* |
239 | * We're doing a user space reboot. We are guaranteed that the |
240 | * external identity resolver is gone, so ensure that everything |
241 | * comes back up as with fresh-boot just in case it didn't go |
242 | * down cleanly. |
243 | */ |
244 | kauth_resolver_identity_reset(); |
245 | #endif /* CONFIG_EXT_RESOLVER */ |
246 | |
247 | OSKextResetAfterUserspaceReboot(); |
248 | int shm_error = pshm_cache_purge_all(); |
249 | int sem_error = psem_cache_purge_all(); |
250 | |
251 | zone_gc_drain(); |
252 | pmap_release_pages_fast(); |
253 | |
254 | return shm_error != 0 ? shm_error : sem_error; |
255 | } |
256 | |
257 | static int |
258 | usrctl_logout(uid_t uid) |
259 | { |
260 | int shm_error = pshm_cache_purge_uid(uid); |
261 | /* |
262 | * Currently there is a requirement to purge some root-owned semaphores, |
263 | * and no use-case for preserving any. Just purge all of them. |
264 | */ |
265 | int sem_error = psem_cache_purge_all(); |
266 | |
267 | /* |
268 | * Until rdar://78965143, kern.willuserspacereboot is set when logout begins |
269 | * so its effects need to be reset here, when logout completes. |
270 | */ |
271 | OSKextResetAfterUserspaceReboot(); |
272 | |
273 | return shm_error != 0 ? shm_error : sem_error; |
274 | } |
275 | |
276 | int |
277 | usrctl(struct proc *p, struct usrctl_args *uap, __unused int32_t *retval) |
278 | { |
279 | if (p != initproc) { |
280 | return EPERM; |
281 | } |
282 | |
283 | if (uap->flags == 0) { |
284 | return usrctl_full(); |
285 | } else { |
286 | return usrctl_logout(uid: (uid_t)uap->flags); |
287 | } |
288 | } |
289 | |