1 | /* |
2 | * Copyright (c) 2000-2006 Apple Computer, Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */ |
29 | /*- |
30 | * Copyright (c) 1982, 1986, 1989, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * (c) UNIX System Laboratories, Inc. |
33 | * All or some portions of this file are derived from material licensed |
34 | * to the University of California by American Telephone and Telegraph |
35 | * Co. or Unix System Laboratories, Inc. and are reproduced herein with |
36 | * the permission of UNIX System Laboratories, Inc. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * 1. Redistributions of source code must retain the above copyright |
42 | * notice, this list of conditions and the following disclaimer. |
43 | * 2. Redistributions in binary form must reproduce the above copyright |
44 | * notice, this list of conditions and the following disclaimer in the |
45 | * documentation and/or other materials provided with the distribution. |
46 | * 3. All advertising materials mentioning features or use of this software |
47 | * must display the following acknowledgement: |
48 | * This product includes software developed by the University of |
49 | * California, Berkeley and its contributors. |
50 | * 4. Neither the name of the University nor the names of its contributors |
51 | * may be used to endorse or promote products derived from this software |
52 | * without specific prior written permission. |
53 | * |
54 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
55 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
56 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
57 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
58 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
59 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
60 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
61 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
62 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
63 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
64 | * SUCH DAMAGE. |
65 | * |
66 | * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93 |
67 | */ |
68 | |
69 | #include <machine/reg.h> |
70 | #include <machine/psl.h> |
71 | |
72 | #include <sys/param.h> |
73 | #include <sys/systm.h> |
74 | #include <sys/proc_internal.h> |
75 | #include <sys/kauth.h> |
76 | #include <sys/errno.h> |
77 | #include <sys/ptrace.h> |
78 | #include <sys/uio.h> |
79 | #include <sys/user.h> |
80 | #include <sys/sysctl.h> |
81 | #include <sys/wait.h> |
82 | |
83 | #include <sys/mount_internal.h> |
84 | #include <sys/sysproto.h> |
85 | #include <sys/kdebug.h> |
86 | #include <sys/codesign.h> /* cs_allow_invalid() */ |
87 | |
88 | #include <security/audit/audit.h> |
89 | |
90 | #include <kern/task.h> |
91 | #include <kern/thread.h> |
92 | |
93 | #include <mach/task.h> /* for task_resume() */ |
94 | #include <kern/sched_prim.h> /* for thread_exception_return() */ |
95 | |
96 | #include <pexpert/pexpert.h> |
97 | |
98 | #if CONFIG_MACF |
99 | #include <security/mac_framework.h> |
100 | #endif |
101 | |
102 | /* XXX ken/bsd_kern.c - prototype should be in common header */ |
103 | int get_task_userstop(task_t); |
104 | |
105 | /* Macros to clear/set/test flags. */ |
106 | #define SET(t, f) (t) |= (f) |
107 | #define CLR(t, f) (t) &= ~(f) |
108 | #define ISSET(t, f) ((t) & (f)) |
109 | |
110 | extern thread_t get_firstthread(task_t); |
111 | |
112 | |
113 | /* |
114 | * sys-trace system call. |
115 | */ |
116 | |
117 | int |
118 | ptrace(struct proc *p, struct ptrace_args *uap, int32_t *retval) |
119 | { |
120 | struct proc *t; /* target process */ |
121 | task_t task; |
122 | thread_t th_act = THREAD_NULL; |
123 | struct uthread *ut; |
124 | int tr_sigexc = 0; |
125 | int error = 0; |
126 | int stopped = 0; |
127 | |
128 | AUDIT_ARG(cmd, uap->req); |
129 | AUDIT_ARG(pid, uap->pid); |
130 | AUDIT_ARG(addr, uap->addr); |
131 | AUDIT_ARG(value32, uap->data); |
132 | |
133 | if (uap->req == PT_DENY_ATTACH) { |
134 | #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX) |
135 | if (PE_i_can_has_debugger(NULL)) { |
136 | return 0; |
137 | } |
138 | #endif |
139 | proc_lock(p); |
140 | if (ISSET(p->p_lflag, P_LTRACED)) { |
141 | proc_unlock(p); |
142 | KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_FRCEXIT) | DBG_FUNC_NONE, |
143 | proc_getpid(p), W_EXITCODE(ENOTSUP, 0), 4, 0, 0); |
144 | exit1(p, W_EXITCODE(ENOTSUP, 0), retval); |
145 | |
146 | thread_exception_return(); |
147 | /* NOTREACHED */ |
148 | } |
149 | SET(p->p_lflag, P_LNOATTACH); |
150 | proc_unlock(p); |
151 | |
152 | return 0; |
153 | } |
154 | |
155 | if (uap->req == PT_FORCEQUOTA) { |
156 | if (kauth_cred_issuser(cred: kauth_cred_get())) { |
157 | t = current_proc(); |
158 | OSBitOrAtomic(P_FORCEQUOTA, &t->p_flag); |
159 | return 0; |
160 | } else { |
161 | return EPERM; |
162 | } |
163 | } |
164 | |
165 | /* |
166 | * Intercept and deal with "please trace me" request. |
167 | */ |
168 | if (uap->req == PT_TRACE_ME) { |
169 | retry_trace_me: ; |
170 | proc_t pproc = proc_parent(p); |
171 | if (pproc == NULL) { |
172 | return EINVAL; |
173 | } |
174 | /* holding ref on pproc */ |
175 | |
176 | #if CONFIG_MACF |
177 | /* |
178 | * NB: Cannot call kauth_authorize_process(..., KAUTH_PROCESS_CANTRACE, ...) |
179 | * since that assumes the process being checked is the current process |
180 | * when, in this case, it is the current process's parent. |
181 | * Most of the other checks in cantrace() don't apply either. |
182 | */ |
183 | struct proc_ident p_ident = proc_ident(p); |
184 | struct proc_ident pproc_ident = proc_ident(p: pproc); |
185 | kauth_cred_t pproc_cred = kauth_cred_proc_ref(procp: pproc); |
186 | |
187 | /* Release pproc and find it again after MAC call to avoid deadlock */ |
188 | proc_rele(p: pproc); |
189 | error = mac_proc_check_debug(tracing_ident: &pproc_ident, tracing_cred: pproc_cred, traced_ident: &p_ident); |
190 | kauth_cred_unref(&pproc_cred); |
191 | |
192 | if (error != 0) { |
193 | return error; |
194 | } |
195 | if (proc_find_ident(i: &pproc_ident) == PROC_NULL) { |
196 | return ESRCH; |
197 | } |
198 | /* re-holding ref on pproc */ |
199 | #endif |
200 | proc_lock(p); |
201 | /* Make sure the process wasn't re-parented. */ |
202 | if (p->p_ppid != proc_getpid(pproc)) { |
203 | proc_unlock(p); |
204 | proc_rele(p: pproc); /* pproc ref released */ |
205 | goto retry_trace_me; |
206 | } |
207 | SET(p->p_lflag, P_LTRACED); |
208 | /* Non-attached case, our tracer is our parent. */ |
209 | p->p_oppid = p->p_ppid; |
210 | proc_unlock(p); |
211 | /* Child and parent will have to be able to run modified code. */ |
212 | cs_allow_invalid(p); |
213 | cs_allow_invalid(pproc); |
214 | proc_rele(p: pproc); /* pproc ref released */ |
215 | |
216 | return error; |
217 | } |
218 | if (uap->req == PT_SIGEXC) { |
219 | proc_lock(p); |
220 | if (ISSET(p->p_lflag, P_LTRACED)) { |
221 | SET(p->p_lflag, P_LSIGEXC); |
222 | proc_unlock(p); |
223 | return 0; |
224 | } else { |
225 | proc_unlock(p); |
226 | return EINVAL; |
227 | } |
228 | } |
229 | |
230 | /* |
231 | * We do not want ptrace to do anything with kernel or launchd |
232 | */ |
233 | if (uap->pid < 2) { |
234 | return EPERM; |
235 | } |
236 | |
237 | retry_proc_find: |
238 | /* |
239 | * Locate victim, and make sure it is traceable. |
240 | */ |
241 | if ((t = proc_find(pid: uap->pid)) == NULL) { |
242 | return ESRCH; |
243 | } |
244 | |
245 | /* Check if the proc has trace wait flag set */ |
246 | if (t->p_lflag & P_LTRACE_WAIT) { |
247 | proc_rele(p: t); |
248 | delay(usec: 1); |
249 | goto retry_proc_find; |
250 | } |
251 | |
252 | AUDIT_ARG(process, t); |
253 | |
254 | task = proc_task(t); |
255 | if (uap->req == PT_ATTACHEXC) { |
256 | #pragma clang diagnostic push |
257 | #pragma clang diagnostic ignored "-Wdeprecated-declarations" |
258 | uap->req = PT_ATTACH; |
259 | tr_sigexc = 1; |
260 | } |
261 | if (uap->req == PT_ATTACH) { |
262 | #pragma clang diagnostic pop |
263 | int err, cb_err; |
264 | |
265 | #if !defined(XNU_TARGET_OS_OSX) |
266 | if (tr_sigexc == 0) { |
267 | error = ENOTSUP; |
268 | goto out; |
269 | } |
270 | #endif |
271 | |
272 | err = kauth_authorize_process(credential: kauth_cred_get(), KAUTH_PROCESS_CANTRACE, |
273 | process: t, arg1: (uintptr_t)&cb_err, arg2: 0, arg3: 0); |
274 | |
275 | if (err == 0) { |
276 | /* it's OK to attach */ |
277 | proc_lock(t); |
278 | SET(t->p_lflag, P_LTRACED); |
279 | if (tr_sigexc) { |
280 | SET(t->p_lflag, P_LSIGEXC); |
281 | } |
282 | |
283 | t->p_oppid = t->p_ppid; |
284 | /* Check whether child and parent are allowed to run modified |
285 | * code (they'll have to) */ |
286 | proc_unlock(t); |
287 | cs_allow_invalid(t); |
288 | cs_allow_invalid(p); |
289 | if (t->p_pptr != p) { |
290 | proc_reparentlocked(child: t, newparent: p, cansignal: 1, locked: 0); |
291 | } |
292 | |
293 | proc_lock(t); |
294 | if (get_task_userstop(task) > 0) { |
295 | stopped = 1; |
296 | } |
297 | t->p_xstat = 0; |
298 | proc_unlock(t); |
299 | psignal(p: t, SIGSTOP); |
300 | /* |
301 | * If the process was stopped, wake up and run through |
302 | * issignal() again to properly connect to the tracing |
303 | * process. |
304 | */ |
305 | if (stopped) { |
306 | task_resume(target_task: task); |
307 | } |
308 | error = 0; |
309 | goto out; |
310 | } else { |
311 | error = cb_err; |
312 | if (error == ESRCH) { |
313 | /* |
314 | * The target 't' is not valid anymore as it |
315 | * could not be found after the MAC check. |
316 | */ |
317 | return error; |
318 | } |
319 | /* not allowed to attach, proper error code returned by kauth_authorize_process */ |
320 | if (ISSET(t->p_lflag, P_LNOATTACH)) { |
321 | psignal(p, SIGSEGV); |
322 | } |
323 | goto out; |
324 | } |
325 | } |
326 | |
327 | /* |
328 | * You can't do what you want to the process if: |
329 | * (1) It's not being traced at all, |
330 | */ |
331 | proc_lock(t); |
332 | if (!ISSET(t->p_lflag, P_LTRACED)) { |
333 | proc_unlock(t); |
334 | error = EPERM; |
335 | goto out; |
336 | } |
337 | |
338 | /* |
339 | * (2) it's not being traced by _you_, or |
340 | */ |
341 | if (t->p_pptr != p) { |
342 | proc_unlock(t); |
343 | error = EBUSY; |
344 | goto out; |
345 | } |
346 | |
347 | /* |
348 | * (3) it's not currently stopped. |
349 | */ |
350 | if (t->p_stat != SSTOP) { |
351 | proc_unlock(t); |
352 | error = EBUSY; |
353 | goto out; |
354 | } |
355 | |
356 | /* |
357 | * Mach version of ptrace executes request directly here, |
358 | * thus simplifying the interaction of ptrace and signals. |
359 | */ |
360 | /* proc lock is held here */ |
361 | switch (uap->req) { |
362 | case PT_DETACH: |
363 | if (t->p_oppid != t->p_ppid) { |
364 | struct proc *pp; |
365 | |
366 | proc_unlock(t); |
367 | pp = proc_find(pid: t->p_oppid); |
368 | if (pp != PROC_NULL) { |
369 | proc_reparentlocked(child: t, newparent: pp, cansignal: 1, locked: 0); |
370 | proc_rele(p: pp); |
371 | } else { |
372 | /* original parent exited while traced */ |
373 | proc_list_lock(); |
374 | t->p_listflag |= P_LIST_DEADPARENT; |
375 | proc_list_unlock(); |
376 | proc_reparentlocked(child: t, newparent: initproc, cansignal: 1, locked: 0); |
377 | } |
378 | proc_lock(t); |
379 | } |
380 | |
381 | t->p_oppid = 0; |
382 | CLR(t->p_lflag, P_LTRACED); |
383 | CLR(t->p_lflag, P_LSIGEXC); |
384 | proc_unlock(t); |
385 | goto resume; |
386 | |
387 | case PT_KILL: |
388 | /* |
389 | * Tell child process to kill itself after it |
390 | * is resumed by adding NSIG to p_cursig. [see issig] |
391 | */ |
392 | proc_unlock(t); |
393 | #if CONFIG_MACF |
394 | error = mac_proc_check_signal(proc1: p, proc2: t, SIGKILL); |
395 | if (0 != error) { |
396 | goto resume; |
397 | } |
398 | #endif |
399 | psignal(p: t, SIGKILL); |
400 | goto resume; |
401 | |
402 | case PT_STEP: /* single step the child */ |
403 | case PT_CONTINUE: /* continue the child */ |
404 | proc_unlock(t); |
405 | th_act = (thread_t)get_firstthread(task); |
406 | if (th_act == THREAD_NULL) { |
407 | error = EINVAL; |
408 | goto out; |
409 | } |
410 | |
411 | /* force use of Mach SPIs (and task_for_pid security checks) to adjust PC */ |
412 | if (uap->addr != (user_addr_t)1) { |
413 | error = ENOTSUP; |
414 | goto out; |
415 | } |
416 | |
417 | if ((unsigned)uap->data >= NSIG) { |
418 | error = EINVAL; |
419 | goto out; |
420 | } |
421 | |
422 | if (uap->data != 0) { |
423 | #if CONFIG_MACF |
424 | error = mac_proc_check_signal(proc1: p, proc2: t, signum: uap->data); |
425 | if (0 != error) { |
426 | goto out; |
427 | } |
428 | #endif |
429 | psignal(p: t, sig: uap->data); |
430 | } |
431 | |
432 | if (uap->req == PT_STEP) { |
433 | /* |
434 | * set trace bit |
435 | * we use sending SIGSTOP as a comparable security check. |
436 | */ |
437 | #if CONFIG_MACF |
438 | error = mac_proc_check_signal(proc1: p, proc2: t, SIGSTOP); |
439 | if (0 != error) { |
440 | goto out; |
441 | } |
442 | #endif |
443 | if (thread_setsinglestep(thread: th_act, on: 1) != KERN_SUCCESS) { |
444 | error = ENOTSUP; |
445 | goto out; |
446 | } |
447 | } else { |
448 | /* |
449 | * clear trace bit if on |
450 | * we use sending SIGCONT as a comparable security check. |
451 | */ |
452 | #if CONFIG_MACF |
453 | error = mac_proc_check_signal(proc1: p, proc2: t, SIGCONT); |
454 | if (0 != error) { |
455 | goto out; |
456 | } |
457 | #endif |
458 | if (thread_setsinglestep(thread: th_act, on: 0) != KERN_SUCCESS) { |
459 | error = ENOTSUP; |
460 | goto out; |
461 | } |
462 | } |
463 | resume: |
464 | proc_lock(t); |
465 | t->p_xstat = uap->data; |
466 | t->p_stat = SRUN; |
467 | if (t->sigwait) { |
468 | wakeup(chan: (caddr_t)&(t->sigwait)); |
469 | proc_unlock(t); |
470 | if ((t->p_lflag & P_LSIGEXC) == 0) { |
471 | task_resume(target_task: task); |
472 | } |
473 | } else { |
474 | proc_unlock(t); |
475 | } |
476 | |
477 | break; |
478 | |
479 | case PT_THUPDATE: { |
480 | proc_unlock(t); |
481 | if ((unsigned)uap->data >= NSIG) { |
482 | error = EINVAL; |
483 | goto out; |
484 | } |
485 | th_act = port_name_to_thread(CAST_MACH_PORT_TO_NAME(uap->addr), |
486 | options: PORT_INTRANS_OPTIONS_NONE); |
487 | if (th_act == THREAD_NULL) { |
488 | error = ESRCH; |
489 | goto out; |
490 | } |
491 | ut = (uthread_t)get_bsdthread_info(th_act); |
492 | if (uap->data) { |
493 | ut->uu_siglist |= sigmask(uap->data); |
494 | } |
495 | proc_lock(t); |
496 | t->p_xstat = uap->data; |
497 | t->p_stat = SRUN; |
498 | proc_unlock(t); |
499 | error = 0; |
500 | } |
501 | break; |
502 | default: |
503 | proc_unlock(t); |
504 | error = EINVAL; |
505 | goto out; |
506 | } |
507 | |
508 | error = 0; |
509 | out: |
510 | proc_rele(p: t); |
511 | if (th_act) { |
512 | thread_deallocate(thread: th_act); |
513 | } |
514 | return error; |
515 | } |
516 | |
517 | |
518 | /* |
519 | * determine if one process (cur_procp) can trace another process (traced_procp). |
520 | */ |
521 | |
522 | int |
523 | cantrace(proc_t cur_procp, kauth_cred_t creds, proc_t traced_procp, int *errp) |
524 | { |
525 | int my_err; |
526 | /* |
527 | * You can't trace a process if: |
528 | * (1) it's the process that's doing the tracing, |
529 | */ |
530 | if (proc_getpid(traced_procp) == proc_getpid(cur_procp)) { |
531 | *errp = EINVAL; |
532 | return 0; |
533 | } |
534 | |
535 | /* |
536 | * (2) it's already being traced, or |
537 | */ |
538 | if (ISSET(traced_procp->p_lflag, P_LTRACED)) { |
539 | *errp = EBUSY; |
540 | return 0; |
541 | } |
542 | |
543 | if (!proc_is_third_party_debuggable_driver(p: traced_procp)) { |
544 | kauth_cred_t traced_cred; |
545 | |
546 | /* |
547 | * (3) it's not owned by you, or is set-id on exec |
548 | * (unless you're root). |
549 | */ |
550 | traced_cred = kauth_cred_proc_ref(procp: traced_procp); |
551 | if ((kauth_cred_getruid(cred: creds) != kauth_cred_getruid(cred: traced_cred) || |
552 | ISSET(traced_procp->p_flag, P_SUGID)) && |
553 | (my_err = suser(cred: creds, acflag: &cur_procp->p_acflag)) != 0) { |
554 | kauth_cred_unref(&traced_cred); |
555 | *errp = my_err; |
556 | return 0; |
557 | } |
558 | kauth_cred_unref(&traced_cred); |
559 | } |
560 | |
561 | if ((cur_procp->p_lflag & P_LTRACED) && isinferior(cur_procp, traced_procp)) { |
562 | *errp = EPERM; |
563 | return 0; |
564 | } |
565 | |
566 | if (ISSET(traced_procp->p_lflag, P_LNOATTACH)) { |
567 | *errp = EBUSY; |
568 | return 0; |
569 | } |
570 | |
571 | #if CONFIG_MACF |
572 | struct proc_ident cur_ident = proc_ident(p: cur_procp); |
573 | struct proc_ident traced_ident = proc_ident(p: traced_procp); |
574 | kauth_cred_t cur_cred = kauth_cred_proc_ref(procp: cur_procp); |
575 | |
576 | /* |
577 | * Drop the proc reference to avoid a deadlock during an upcall and find |
578 | * (reference) the proc again so our caller can keep using it. |
579 | */ |
580 | proc_rele(p: traced_procp); |
581 | my_err = mac_proc_check_debug(tracing_ident: &cur_ident, tracing_cred: cur_cred, traced_ident: &traced_ident); |
582 | kauth_cred_unref(&cur_cred); |
583 | |
584 | if (proc_find_ident(i: &traced_ident) == PROC_NULL) { |
585 | *errp = ESRCH; |
586 | return 0; |
587 | } |
588 | /* restored ref on traced_procp */ |
589 | if (my_err != 0) { |
590 | *errp = my_err; |
591 | return 0; |
592 | } |
593 | #endif |
594 | return 1; |
595 | } |
596 | |