1/*
2 * Copyright (c) 2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29#include <mach/exception_types.h>
30#include <mach/mach_types.h>
31#include <osfmk/kern/exception.h>
32#include <osfmk/kern/task.h>
33#include <sys/codesign.h>
34#include <sys/param.h>
35#include <sys/user.h>
36#include <sys/proc.h>
37#include <sys/proc_internal.h>
38#include <sys/kauth.h>
39#include <kern/task.h>
40
41#include <security/mac_framework.h>
42#include <security/mac_internal.h>
43#include <security/mac_mach_internal.h>
44
45#if CONFIG_CSR
46#include <sys/csr.h>
47// Panic on internal builds, just log otherwise.
48#define MAC_MACH_UNEXPECTED(fmt...) \
49 if (csr_check(CSR_ALLOW_APPLE_INTERNAL) == 0) { panic(fmt); } else { printf(fmt); }
50#else
51#define MAC_MACH_UNEXPECTED(fmt...) printf(fmt)
52#endif
53
54static struct proc *
55mac_task_get_proc(struct task *task)
56{
57 if (task == current_task())
58 return proc_self();
59
60 /*
61 * Tasks don't really hold a reference on a proc unless the
62 * calling thread belongs to the task in question.
63 */
64 int pid = task_pid(task);
65 struct proc *p = proc_find(pid);
66
67 if (p != NULL) {
68 if (proc_task(p) == task)
69 return p;
70 proc_rele(p);
71 }
72 return NULL;
73}
74
75int
76mac_task_check_expose_task(struct task *task)
77{
78 int error;
79
80 struct proc *p = mac_task_get_proc(task);
81 if (p == NULL)
82 return ESRCH;
83
84 struct ucred *cred = kauth_cred_get();
85 MAC_CHECK(proc_check_expose_task, cred, p);
86 proc_rele(p);
87 return (error);
88}
89
90int
91mac_task_check_set_host_special_port(struct task *task, int id, struct ipc_port *port)
92{
93 int error;
94
95 struct proc *p = mac_task_get_proc(task);
96 if (p == NULL)
97 return ESRCH;
98
99 kauth_cred_t cred = kauth_cred_proc_ref(p);
100 MAC_CHECK(proc_check_set_host_special_port, cred, id, port);
101 kauth_cred_unref(&cred);
102 proc_rele(p);
103 return (error);
104}
105
106int
107mac_task_check_set_host_exception_port(struct task *task, unsigned int exception)
108{
109 int error;
110
111 struct proc *p = mac_task_get_proc(task);
112 if (p == NULL)
113 return ESRCH;
114
115 kauth_cred_t cred = kauth_cred_proc_ref(p);
116 MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
117 kauth_cred_unref(&cred);
118 proc_rele(p);
119 return (error);
120}
121
122int
123mac_task_check_set_host_exception_ports(struct task *task, unsigned int exception_mask)
124{
125 int error = 0;
126 int exception;
127
128 struct proc *p = mac_task_get_proc(task);
129 if (p == NULL)
130 return ESRCH;
131
132 kauth_cred_t cred = kauth_cred_proc_ref(p);
133 for (exception = FIRST_EXCEPTION; exception < EXC_TYPES_COUNT; exception++) {
134 if (exception_mask & (1 << exception)) {
135 MAC_CHECK(proc_check_set_host_exception_port, cred, exception);
136 if (error)
137 break;
138 }
139 }
140 kauth_cred_unref(&cred);
141 proc_rele(p);
142 return (error);
143}
144
145void
146mac_thread_userret(struct thread *td)
147{
148
149 MAC_PERFORM(thread_userret, td);
150}
151
152void
153mac_proc_notify_exec_complete(struct proc *proc)
154{
155 thread_t thread = current_thread();
156
157 /*
158 * Since this MAC hook was designed to support upcalls, make sure the hook
159 * is called with kernel importance propagation enabled so any daemons
160 * can get any appropriate importance donations.
161 */
162 thread_enable_send_importance(thread, TRUE);
163 MAC_PERFORM(proc_notify_exec_complete, proc);
164 thread_enable_send_importance(thread, FALSE);
165}
166
167/**** Exception Policy
168 *
169 * Note that the functions below do not fully follow the usual convention for mac policy functions
170 * in the kernel. Besides avoiding confusion in how the mac function names are mixed with the actual
171 * policy function names, we diverge because the exception policy is somewhat special:
172 * It is used in places where allocation and association must be separate, and its labels do not
173 * only belong to one type of object as usual, but to two (on exception actions and on tasks as
174 * crash labels).
175 */
176
177// Label allocation and deallocation, may sleep.
178
179struct label *
180mac_exc_create_label(void)
181{
182 struct label *label = mac_labelzone_alloc(MAC_WAITOK);
183
184 if (label == NULL) {
185 return NULL;
186 }
187
188 // Policy initialization of the label, typically performs allocations as well.
189 // (Unless the policy's full data really fits into a pointer size.)
190 MAC_PERFORM(exc_action_label_init, label);
191
192 return label;
193}
194
195void
196mac_exc_free_label(struct label *label)
197{
198 MAC_PERFORM(exc_action_label_destroy, label);
199 mac_labelzone_free(label);
200}
201
202// Action label initialization and teardown, may sleep.
203
204void
205mac_exc_associate_action_label(struct exception_action *action, struct label *label)
206{
207 action->label = label;
208 MAC_PERFORM(exc_action_label_associate, action, action->label);
209}
210
211void
212mac_exc_free_action_label(struct exception_action *action)
213{
214 mac_exc_free_label(action->label);
215 action->label = NULL;
216}
217
218// Action label update and inheritance, may NOT sleep and must be quick.
219
220int
221mac_exc_update_action_label(struct exception_action *action,
222 struct label *newlabel) {
223 int error;
224
225 MAC_CHECK(exc_action_label_update, action, action->label, newlabel);
226
227 return (error);
228}
229
230int
231mac_exc_inherit_action_label(struct exception_action *parent,
232 struct exception_action *child) {
233 return mac_exc_update_action_label(child, parent->label);
234}
235
236int mac_exc_update_task_crash_label(struct task *task, struct label *label) {
237 int error;
238
239 assert(task != kernel_task);
240
241 struct label *crash_label = get_task_crash_label(task);
242
243 MAC_CHECK(exc_action_label_update, NULL, crash_label, label);
244
245 return (error);
246}
247
248// Process label creation, may sleep.
249
250struct label *
251mac_exc_create_label_for_proc(struct proc *proc)
252{
253 struct label *label = mac_exc_create_label();
254 MAC_PERFORM(exc_action_label_populate, label, proc);
255 return label;
256}
257
258struct label *
259mac_exc_create_label_for_current_proc(void)
260{
261 return mac_exc_create_label_for_proc(current_proc());
262}
263
264// Exception handler policy checking, may sleep.
265
266int
267mac_exc_action_check_exception_send(struct task *victim_task, struct exception_action *action)
268{
269 int error = 0;
270
271 struct proc *p = get_bsdtask_info(victim_task);
272 struct label *bsd_label = NULL;
273 struct label *label = NULL;
274
275 if (p != NULL) {
276 // Create a label from the still existing bsd process...
277 label = bsd_label = mac_exc_create_label_for_proc(p);
278 } else {
279 // ... otherwise use the crash label on the task.
280 label = get_task_crash_label(victim_task);
281 }
282
283 if (label == NULL) {
284 MAC_MACH_UNEXPECTED("mac_exc_action_check_exception_send: no exc_action label for process");
285 return EPERM;
286 }
287
288 MAC_CHECK(exc_action_check_exception_send, label, action, action->label);
289
290 if (bsd_label != NULL) {
291 mac_exc_free_label(bsd_label);
292 }
293
294 return (error);
295}
296