1/*
2 * Copyright (c) 2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <mach/exception_types.h>
30#include <mach/mach_types.h>
31#include <osfmk/kern/exception.h>
32#include <osfmk/kern/task.h>
33#include <sys/codesign.h>
34#include <sys/param.h>
35#include <sys/user.h>
36#include <sys/proc.h>
37#include <sys/proc_internal.h>
38#include <sys/kauth.h>
39
40#include <kern/task.h>
41#include <kern/telemetry.h>
42
43#include <security/mac_framework.h>
44#include <security/mac_internal.h>
45#include <security/mac_mach_internal.h>
46
47#if CONFIG_CSR
48#include <sys/csr.h>
49// Panic on internal builds, just log otherwise.
50#define MAC_MACH_UNEXPECTED(fmt...) \
51 if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
52#else
53#define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
54#endif
55
56static struct proc *
57mac_task_get_proc(struct task *task)
58{
59 if (task == current_task()) {
60 return proc_self();
61 }
62
63 /*
64 * Tasks don't really hold a reference on a proc unless the
65 * calling thread belongs to the task in question.
66 */
67 int pid = task_pid(task);
68 struct proc *p = proc_find(pid);
69
70 if (p != NULL) {
71 if (proc_task(p) == task) {
72 return p;
73 }
74 proc_rele(p);
75 }
76 return NULL;
77}
78
79int
80mac_task_check_expose_task(struct task *task, mach_task_flavor_t flavor)
81{
82 int error;
83
84 assert(flavor <= TASK_FLAVOR_NAME);
85
86 struct proc *p = mac_task_get_proc(task);
87 if (p == NULL) {
88 return ESRCH;
89 }
90 struct proc_ident pident = proc_ident(p);
91
92 struct ucred *cred = kauth_cred_get();
93 proc_rele(p);
94
95 MAC_CHECK(proc_check_expose_task_with_flavor, cred, &pident, flavor);
96
97 return error;
98}
99
100int
101mac_task_check_task_id_token_get_task(struct task *task, mach_task_flavor_t flavor)
102{
103 int error;
104 struct proc *target_proc = NULL;
105 struct proc_ident *pidentp = NULL;
106 struct proc_ident pident;
107
108 assert(flavor <= TASK_FLAVOR_NAME);
109
110 if (!task_is_a_corpse(task)) {
111 /* only live task has proc */
112 target_proc = mac_task_get_proc(task);
113 if (target_proc == NULL) {
114 return ESRCH;
115 }
116 pident = proc_ident(p: target_proc);
117 pidentp = &pident;
118 proc_rele(p: target_proc);
119 }
120
121 /* pidentp is NULL for corpse task */
122 MAC_CHECK(proc_check_task_id_token_get_task,
123 current_cached_proc_cred(PROC_NULL), pidentp, flavor);
124
125 return error;
126}
127
128int
129mac_task_check_get_movable_control_port(void)
130{
131 int error;
132
133 MAC_CHECK(proc_check_get_movable_control_port,
134 current_cached_proc_cred(PROC_NULL));
135
136 return error;
137}
138
139int
140mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
141{
142#pragma unused(task)
143 int error;
144
145 assert(task == current_task());
146 MAC_CHECK(proc_check_set_host_special_port,
147 current_cached_proc_cred(PROC_NULL), id, port);
148
149 return error;
150}
151
152int
153mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
154{
155#pragma unused(task)
156 int error;
157
158 assert(task == current_task());
159 MAC_CHECK(proc_check_set_host_exception_port,
160 current_cached_proc_cred(PROC_NULL), exception);
161
162 return error;
163}
164
165int
166mac_task_check_get_task_special_port(struct task *task, struct task *target, int which)
167{
168#pragma unused(task)
169 int error;
170 struct proc *target_proc = NULL;
171 struct proc_ident *pidentp = NULL;
172 struct proc_ident pident;
173
174 assert(task == current_task());
175
176 if (!task_is_a_corpse(task: target)) {
177 /* only live task has proc */
178 target_proc = mac_task_get_proc(task: target);
179 if (target_proc == NULL) {
180 return ESRCH;
181 }
182 pident = proc_ident(p: target_proc);
183 pidentp = &pident;
184 proc_rele(p: target_proc);
185 }
186
187 /* pidentp is NULL for corpse task */
188 MAC_CHECK(proc_check_get_task_special_port,
189 current_cached_proc_cred(PROC_NULL), pidentp, which);
190
191 return error;
192}
193
194int
195mac_task_check_set_task_special_port(struct task *task, struct task *target, int which, struct ipc_port *port)
196{
197#pragma unused(task)
198 int error;
199
200 assert(task == current_task());
201
202 /*
203 * task_set_special_port() is a CONTROL level interface, so we are guaranteed
204 * by MIG intrans that target is not a corpse.
205 */
206 assert(!task_is_a_corpse(target));
207
208 struct proc *targetp = mac_task_get_proc(task: target);
209 if (targetp == NULL) {
210 return ESRCH;
211 }
212
213 struct proc_ident pident = proc_ident(p: targetp);
214 proc_rele(p: targetp);
215
216 MAC_CHECK(proc_check_set_task_special_port,
217 current_cached_proc_cred(PROC_NULL), &pident, which, port);
218
219 return error;
220}
221
222int
223mac_task_check_dyld_process_info_notify_register(void)
224{
225 int error;
226
227 MAC_CHECK(proc_check_dyld_process_info_notify_register,
228 current_cached_proc_cred(PROC_NULL));
229
230 return error;
231}
232
233int
234mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
235{
236#pragma unused(task)
237 int error = 0;
238 int exception;
239 kauth_cred_t cred = current_cached_proc_cred(PROC_NULL);
240
241 assert(task == current_task());
242
243 for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
244 if (exception_mask & (1 << exception)) {
245 MAC_CHECK(proc_check_set_host_exception_port,
246 cred, exception);
247 if (error) {
248 break;
249 }
250 }
251 }
252
253 return error;
254}
255
256void
257mac_thread_userret(struct thread *td)
258{
259 MAC_PERFORM(thread_userret, td);
260}
261
262void
263mac_thread_telemetry(struct thread *t, int err, void *data, size_t length)
264{
265 MAC_PERFORM(thread_telemetry, t, err, data, length);
266}
267
268void
269mac_proc_notify_exec_complete(struct proc *proc)
270{
271 thread_t thread = current_thread();
272
273 /*
274 * Since this MAC hook was designed to support upcalls, make sure the hook
275 * is called with kernel importance propagation enabled so any daemons
276 * can get any appropriate importance donations.
277 */
278 thread_enable_send_importance(thread, TRUE);
279 MAC_PERFORM(proc_notify_exec_complete, proc);
280 thread_enable_send_importance(thread, FALSE);
281}
282
283/**** Exception Policy
284 *
285 * Note that the functions below do not fully follow the usual convention for mac policy functions
286 * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
287 * policy function names, we diverge because the exception policy is somewhat special:
288 * It is used in places where allocation and association must be separate, and its labels do not
289 * only belong to one type of object as usual, but to two (on exception actions and on tasks as
290 * crash labels).
291 */
292
293struct label *
294mac_exc_label(struct exception_action *action)
295{
296 return mac_label_verify(labelp: &action->label);
297}
298
299void
300mac_exc_set_label(struct exception_action *action, struct label *label)
301{
302 action->label = label;
303}
304
305// Label allocation and deallocation, may sleep.
306
307struct label *
308mac_exc_create_label(struct exception_action *action)
309{
310 return mac_labelzone_alloc_for_owner(labelp: action ? &action->label : NULL, MAC_WAITOK, extra_setup: ^(struct label *label) {
311 // Policy initialization of the label, typically performs allocations as well.
312 // (Unless the policy's full data really fits into a pointer size.)
313 MAC_PERFORM(exc_action_label_init, label);
314 });
315}
316
317void
318mac_exc_free_label(struct label *label)
319{
320 MAC_PERFORM(exc_action_label_destroy, label);
321 mac_labelzone_free(l: label);
322}
323
324// Action label initialization and teardown, may sleep.
325
326void
327mac_exc_associate_action_label(struct exception_action *action, struct label *label)
328{
329 mac_exc_set_label(action, label);
330 MAC_PERFORM(exc_action_label_associate, action, mac_exc_label(action));
331}
332
333void
334mac_exc_free_action_label(struct exception_action *action)
335{
336 mac_exc_free_label(label: mac_exc_label(action));
337 mac_exc_set_label(action, NULL);
338}
339
340// Action label update and inheritance, may NOT sleep and must be quick.
341
342int
343mac_exc_update_action_label(struct exception_action *action,
344 struct label *newlabel)
345{
346 int error;
347
348 MAC_CHECK(exc_action_label_update, action, mac_exc_label(action), newlabel);
349
350 return error;
351}
352
353int
354mac_exc_inherit_action_label(struct exception_action *parent,
355 struct exception_action *child)
356{
357 return mac_exc_update_action_label(action: child, newlabel: mac_exc_label(action: parent));
358}
359
360int
361mac_exc_update_task_crash_label(struct task *task, struct label *label)
362{
363 int error;
364
365 assert(task != kernel_task);
366
367 struct label *crash_label = get_task_crash_label(task);
368
369 MAC_CHECK(exc_action_label_update, NULL, crash_label, label);
370
371 return error;
372}
373
374// Process label creation, may sleep.
375
376struct label *
377mac_exc_create_label_for_proc(struct proc *proc)
378{
379 struct label *label = mac_exc_create_label(NULL);
380 MAC_PERFORM(exc_action_label_populate, label, proc);
381 return label;
382}
383
384struct label *
385mac_exc_create_label_for_current_proc(void)
386{
387 return mac_exc_create_label_for_proc(proc: current_proc());
388}
389
390// Exception handler policy checking, may sleep.
391
392int
393mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
394{
395 int error = 0;
396
397 struct proc *p = get_bsdtask_info(victim_task);
398 struct label *bsd_label = NULL;
399 struct label *label = NULL;
400
401 if (p != NULL) {
402 // Create a label from the still existing bsd process...
403 label = bsd_label = mac_exc_create_label_for_proc(proc: p);
404 } else {
405 // ... otherwise use the crash label on the task.
406 label = get_task_crash_label(task: victim_task);
407 }
408
409 if (label == NULL) {
410 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
411 return EPERM;
412 }
413
414 MAC_CHECK(exc_action_check_exception_send, label, action, mac_exc_label(action));
415
416 if (bsd_label != NULL) {
417 mac_exc_free_label(label: bsd_label);
418 }
419
420 return error;
421}
422
423int
424mac_schedule_telemetry(void)
425{
426 return telemetry_macf_mark_curthread();
427}
428