1 | /* |
2 | * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _SYS_CODESIGN_H_ |
30 | #define _SYS_CODESIGN_H_ |
31 | |
32 | #include <kern/cs_blobs.h> |
33 | |
34 | /* MAC flags used by F_ADDFILESIGS_* */ |
35 | #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ |
36 | |
37 | #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" |
38 | #define OVERRIDE_PLUGIN_HOST_ENTITLEMENT "com.apple.private.security.override-plugin-host-detection" |
39 | |
40 | /* csops operations */ |
41 | #define CS_OPS_STATUS 0 /* return status */ |
42 | #define CS_OPS_MARKINVALID 1 /* invalidate process */ |
43 | #define CS_OPS_MARKHARD 2 /* set HARD flag */ |
44 | #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ |
45 | #ifdef KERNEL_PRIVATE |
46 | /* CS_OPS_PIDPATH 4 */ |
47 | #endif |
48 | #define CS_OPS_CDHASH 5 /* get code directory hash */ |
49 | #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ |
50 | #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ |
51 | #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ |
52 | #define CS_OPS_SET_STATUS 9 /* set codesign flags */ |
53 | #define CS_OPS_BLOB 10 /* get codesign blob */ |
54 | #define CS_OPS_IDENTITY 11 /* get codesign identity */ |
55 | #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ |
56 | #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ |
57 | #define CS_OPS_TEAMID 14 /* get team id */ |
58 | #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ |
59 | #define CS_OPS_DER_ENTITLEMENTS_BLOB 16 /* get der entitlements blob */ |
60 | #define CS_OPS_VALIDATION_CATEGORY 17 /* get process validation category */ |
61 | |
62 | #define CS_MAX_TEAMID_LEN 64 |
63 | |
64 | #ifndef KERNEL |
65 | |
66 | #include <sys/types.h> |
67 | #include <mach/message.h> |
68 | |
69 | __BEGIN_DECLS |
70 | /* code sign operations */ |
71 | int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); |
72 | int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); |
73 | __END_DECLS |
74 | |
75 | #else /* !KERNEL */ |
76 | |
77 | #include <mach/machine.h> |
78 | #include <mach/vm_types.h> |
79 | |
80 | #include <sys/cdefs.h> |
81 | #include <sys/_types/_off_t.h> |
82 | |
83 | struct vnode; |
84 | struct cs_blob; |
85 | struct fileglob; |
86 | |
87 | __BEGIN_DECLS |
88 | int cs_valid(struct proc *); |
89 | int cs_process_enforcement(struct proc *); |
90 | int cs_process_global_enforcement(void); |
91 | int cs_system_enforcement(void); |
92 | int cs_vm_supports_4k_translations(void); |
93 | int cs_require_lv(struct proc *); |
94 | int csproc_forced_lv(struct proc* p); |
95 | int cs_system_require_lv(void); |
96 | uint32_t cs_entitlement_flags(struct proc *p); |
97 | int cs_entitlements_blob_get_vnode(struct vnode *, off_t, void **, size_t *); |
98 | int cs_entitlements_dictionary_copy_vnode(struct vnode *, off_t, void **); |
99 | int cs_entitlements_blob_get(struct proc *, void **, size_t *); |
100 | #ifdef KERNEL_PRIVATE |
101 | int cs_entitlements_dictionary_copy(struct proc *, void **); |
102 | #endif |
103 | int cs_restricted(struct proc *); |
104 | uint8_t * cs_get_cdhash(struct proc *); |
105 | cs_launch_type_t launch_constraint_data_get_launch_type(launch_constraint_data_t lcd); |
106 | |
107 | struct cs_blob * csproc_get_blob(struct proc *); |
108 | struct cs_blob * csvnode_get_blob(struct vnode *, off_t); |
109 | void csvnode_print_debug(struct vnode *); |
110 | |
111 | off_t csblob_get_base_offset(struct cs_blob *); |
112 | vm_size_t csblob_get_size(struct cs_blob *); |
113 | vm_address_t csblob_get_addr(struct cs_blob *); |
114 | const char * csblob_get_teamid(struct cs_blob *); |
115 | const char * csblob_get_identity(struct cs_blob *); |
116 | const uint8_t * csblob_get_cdhash(struct cs_blob *); |
117 | const CS_CodeDirectory* csblob_get_code_directory(struct cs_blob *csblob); |
118 | int csblob_get_platform_binary(struct cs_blob *); |
119 | void csblob_invalidate_flags(struct cs_blob *blob); |
120 | void csvnode_invalidate_flags(struct vnode * vp); |
121 | unsigned int csblob_get_flags(struct cs_blob *); |
122 | uint8_t csblob_get_hashtype(struct cs_blob const *); |
123 | unsigned int csblob_get_signer_type(struct cs_blob *); |
124 | #if DEVELOPMENT || DEBUG |
125 | void csproc_clear_platform_binary(struct proc *); |
126 | #endif |
127 | |
128 | #define XNU_CSBLOB_HAS_VALIDATION_CATEGORY 1 |
129 | int csblob_set_validation_category(struct cs_blob *, unsigned int); |
130 | unsigned int csblob_get_validation_category(struct cs_blob *); |
131 | |
132 | #include <uuid/uuid.h> |
133 | #define XNU_SUPPORTS_PROVISIONING_PROFILE_UUID 1 |
134 | int csblob_register_profile_uuid(struct cs_blob *, const uuid_t, void*, vm_size_t); |
135 | |
136 | void csproc_disable_enforcement(struct proc* p); |
137 | void csproc_mark_invalid_allowed(struct proc* p); |
138 | int csproc_check_invalid_allowed(struct proc* p); |
139 | int csproc_hardened_runtime(struct proc* p); |
140 | |
141 | int csblob_get_entitlements(struct cs_blob *, void **, size_t *); |
142 | int csblob_get_der_entitlements(struct cs_blob *, const CS_GenericBlob **, size_t *); |
143 | #define XNU_HAS_GET_DER_ENTITLEMENTS_UNSAFE 1 |
144 | const CS_GenericBlob* csblob_get_der_entitlements_unsafe(struct cs_blob *); |
145 | |
146 | const CS_GenericBlob * |
147 | csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); |
148 | const CS_GenericBlob * |
149 | csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); |
150 | void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); |
151 | void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); |
152 | |
153 | // New APIs |
154 | void csblob_os_entitlements_set(struct cs_blob *csblob, void * entitlements); |
155 | void * csblob_os_entitlements_copy(struct cs_blob *csblob); |
156 | void * csblob_os_entitlements_get(struct cs_blob *csblob); |
157 | void * csblob_get_storage_addr(struct cs_blob *csblob); |
158 | /* |
159 | * Mostly convenience functions below |
160 | */ |
161 | |
162 | const char * csproc_get_teamid(struct proc *); |
163 | const char * csproc_get_identity(struct proc *); |
164 | const char * csvnode_get_teamid(struct vnode *, off_t); |
165 | int csproc_get_platform_binary(struct proc *); |
166 | int csproc_get_prod_signed(struct proc *); |
167 | const char * csfg_get_teamid(struct fileglob *); |
168 | const char * csfg_get_supplement_teamid(struct fileglob *); |
169 | int csfg_get_path(struct fileglob *, char *, int *); |
170 | int csfg_get_platform_binary(struct fileglob *); |
171 | int csfg_get_supplement_platform_binary(struct fileglob *); |
172 | uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); |
173 | uint8_t * csfg_get_supplement_cdhash(struct fileglob *, uint64_t, size_t *); |
174 | const uint8_t * csfg_get_supplement_linkage_cdhash(struct fileglob *, uint64_t, size_t *); |
175 | int csfg_get_prod_signed(struct fileglob *); |
176 | int csfg_get_supplement_prod_signed(struct fileglob *fg); |
177 | unsigned int csfg_get_signer_type(struct fileglob *); |
178 | unsigned int csfg_get_supplement_signer_type(struct fileglob *); |
179 | unsigned int csfg_get_validation_category(struct fileglob *fg, uint64_t offset); |
180 | unsigned int csfg_get_supplement_validation_category(struct fileglob *fg, uint64_t offset); |
181 | const char *csfg_get_identity(struct fileglob *fg, off_t offset); |
182 | unsigned int csproc_get_signer_type(struct proc *); |
183 | |
184 | uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); |
185 | uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); |
186 | uint8_t csproc_get_platform_identifier(struct proc *); |
187 | |
188 | struct cs_blob* csfg_get_csblob(struct fileglob*, uint64_t); |
189 | struct cs_blob* csfg_get_supplement_csblob(struct fileglob*, uint64_t); |
190 | |
191 | extern int cs_debug; |
192 | extern int cs_debug_fail_on_unsigned_code; |
193 | extern unsigned int cs_debug_unsigned_exec_failures; |
194 | extern unsigned int cs_debug_unsigned_mmap_failures; |
195 | |
196 | int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, |
197 | struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); |
198 | |
199 | void cs_blob_free(struct cs_blob *blob); |
200 | |
201 | #ifdef XNU_KERNEL_PRIVATE |
202 | |
203 | int cs_allow_invalid(struct proc *); |
204 | int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); |
205 | void cs_process_invalidated(struct proc *); |
206 | int csproc_get_platform_path(struct proc *); |
207 | int csproc_get_validation_category(struct proc *, unsigned int *); |
208 | |
209 | #if !SECURE_KERNEL |
210 | extern int cs_enforcement_panic; |
211 | #endif |
212 | |
213 | #endif /* XNU_KERNEL_PRIVATE */ |
214 | |
215 | __END_DECLS |
216 | |
217 | #endif /* KERNEL */ |
218 | |
219 | #endif /* _SYS_CODESIGN_H_ */ |
220 | |