1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */
29 /*-
30 * Copyright (c) 1982, 1986, 1991, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)kern_resource.c 8.5 (Berkeley) 1/21/94
67 */
68 /*
69 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/sysctl.h>
78 #include <sys/kernel.h>
79 #include <sys/file_internal.h>
80 #include <sys/resourcevar.h>
81 #include <sys/malloc.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/sysproto.h>
86
87 #include <security/audit/audit.h>
88
89 #include <machine/vmparam.h>
90
91 #include <mach/mach_types.h>
92 #include <mach/time_value.h>
93 #include <mach/task.h>
94 #include <mach/task_info.h>
95 #include <mach/vm_map.h>
96 #include <mach/mach_vm.h>
97 #include <mach/thread_act.h> /* for thread_policy_set( ) */
98 #include <kern/thread.h>
99 #include <kern/policy_internal.h>
100
101 #include <kern/task.h>
102 #include <kern/clock.h> /* for absolutetime_to_microtime() */
103 #include <netinet/in.h> /* for TRAFFIC_MGT_SO_* */
104 #if CONFIG_FREEZE
105 #include <sys/kern_memorystatus_freeze.h> /* for memorystatus_freeze_mark_ui_transition */
106 #endif /* CONFIG_FREEZE */
107 #include <sys/socketvar.h> /* for struct socket */
108 #if NECP
109 #include <net/necp.h>
110 #endif /* NECP */
111
112 #include <vm/vm_map.h>
113
114 #include <kern/assert.h>
115 #include <sys/resource.h>
116 #include <sys/priv.h>
117 #include <IOKit/IOBSD.h>
118
119 #if CONFIG_MACF
120 #include <security/mac_framework.h>
121 #endif
122
123 static void proc_limitblock(proc_t p);
124 static void proc_limitunblock(proc_t p);
125 static void proc_limitupdate(proc_t p, bool unblock,
126 void (^update)(struct plimit *plim));
127
128 static int donice(struct proc *curp, struct proc *chgp, int n);
129 static int dosetrlimit(struct proc *p, u_int which, struct rlimit *limp);
130 static void do_background_socket(struct proc *p, thread_t thread);
131 static int do_background_thread(thread_t thread, int priority);
132 static int do_background_proc(struct proc *curp, struct proc *targetp, int priority);
133 static int set_gpudeny_proc(struct proc *curp, struct proc *targetp, int priority);
134 static int proc_set_darwin_role(proc_t curp, proc_t targetp, int priority);
135 static int proc_get_darwin_role(proc_t curp, proc_t targetp, int *priority);
136 static int get_background_proc(struct proc *curp, struct proc *targetp, int *priority);
137
138 int fill_task_rusage(task_t task, rusage_info_current *ri);
139 void fill_task_billed_usage(task_t task, rusage_info_current *ri);
140 int fill_task_io_rusage(task_t task, rusage_info_current *ri);
141 int fill_task_qos_rusage(task_t task, rusage_info_current *ri);
142 uint64_t get_task_logical_writes(task_t task, boolean_t external);
143 void fill_task_monotonic_rusage(task_t task, rusage_info_current *ri);
144
145 rlim_t maxdmap = MAXDSIZ; /* XXX */
146 rlim_t maxsmap = MAXSSIZ - PAGE_MAX_SIZE; /* XXX */
147
148 /* For plimit reference count */
149 os_refgrp_decl(, rlimit_refgrp, "plimit_refcnt", NULL);
150
151 static KALLOC_TYPE_DEFINE(plimit_zone, struct plimit, KT_DEFAULT);
152
153 /*
154 * Limits on the number of open files per process, and the number
155 * of child processes per process.
156 *
157 * Note: would be in kern/subr_param.c in FreeBSD.
158 */
159 __private_extern__ int maxfilesperproc = OPEN_MAX; /* per-proc open files limit */
160
161 SYSCTL_INT(_kern, KERN_MAXPROCPERUID, maxprocperuid, CTLFLAG_RW | CTLFLAG_LOCKED,
162 &maxprocperuid, 0, "Maximum processes allowed per userid" );
163
164 SYSCTL_INT(_kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW | CTLFLAG_LOCKED,
165 &maxfilesperproc, 0, "Maximum files allowed open per process" );
166
167 /* Args and fn for proc_iteration callback used in setpriority */
168 struct puser_nice_args {
169 proc_t curp;
170 int prio;
171 id_t who;
172 int * foundp;
173 int * errorp;
174 };
175 static int puser_donice_callback(proc_t p, void * arg);
176
177
178 /* Args and fn for proc_iteration callback used in setpriority */
179 struct ppgrp_nice_args {
180 proc_t curp;
181 int prio;
182 int * foundp;
183 int * errorp;
184 };
185 static int ppgrp_donice_callback(proc_t p, void * arg);
186
187 /*
188 * Resource controls and accounting.
189 */
190 int
getpriority(struct proc * curp,struct getpriority_args * uap,int32_t * retval)191 getpriority(struct proc *curp, struct getpriority_args *uap, int32_t *retval)
192 {
193 struct proc *p;
194 int low = PRIO_MAX + 1;
195 kauth_cred_t my_cred;
196 int refheld = 0;
197 int error = 0;
198
199 /* would also test (uap->who < 0), but id_t is unsigned */
200 if (uap->who > 0x7fffffff) {
201 return EINVAL;
202 }
203
204 switch (uap->which) {
205 case PRIO_PROCESS:
206 if (uap->who == 0) {
207 p = curp;
208 low = p->p_nice;
209 } else {
210 p = proc_find(uap->who);
211 if (p == 0) {
212 break;
213 }
214 low = p->p_nice;
215 proc_rele(p);
216 }
217 break;
218
219 case PRIO_PGRP: {
220 struct pgrp *pg = PGRP_NULL;
221
222 if (uap->who == 0) {
223 /* returns the pgrp to ref */
224 pg = proc_pgrp(curp, NULL);
225 } else if ((pg = pgrp_find(uap->who)) == PGRP_NULL) {
226 break;
227 }
228 /* No need for iteration as it is a simple scan */
229 pgrp_lock(pg);
230 PGMEMBERS_FOREACH(pg, p) {
231 if (p->p_nice < low) {
232 low = p->p_nice;
233 }
234 }
235 pgrp_unlock(pg);
236 pgrp_rele(pg);
237 break;
238 }
239
240 case PRIO_USER:
241 if (uap->who == 0) {
242 uap->who = kauth_cred_getuid(kauth_cred_get());
243 }
244
245 proc_list_lock();
246
247 for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
248 my_cred = kauth_cred_proc_ref(p);
249 if (kauth_cred_getuid(my_cred) == uap->who &&
250 p->p_nice < low) {
251 low = p->p_nice;
252 }
253 kauth_cred_unref(&my_cred);
254 }
255
256 proc_list_unlock();
257
258 break;
259
260 case PRIO_DARWIN_THREAD:
261 /* we currently only support the current thread */
262 if (uap->who != 0) {
263 return EINVAL;
264 }
265
266 low = proc_get_thread_policy(current_thread(), TASK_POLICY_INTERNAL, TASK_POLICY_DARWIN_BG);
267
268 break;
269
270 case PRIO_DARWIN_PROCESS:
271 if (uap->who == 0) {
272 p = curp;
273 } else {
274 p = proc_find(uap->who);
275 if (p == PROC_NULL) {
276 break;
277 }
278 refheld = 1;
279 }
280
281 error = get_background_proc(curp, p, &low);
282
283 if (refheld) {
284 proc_rele(p);
285 }
286 if (error) {
287 return error;
288 }
289 break;
290
291 case PRIO_DARWIN_ROLE:
292 if (uap->who == 0) {
293 p = curp;
294 } else {
295 p = proc_find(uap->who);
296 if (p == PROC_NULL) {
297 break;
298 }
299 refheld = 1;
300 }
301
302 error = proc_get_darwin_role(curp, p, &low);
303
304 if (refheld) {
305 proc_rele(p);
306 }
307 if (error) {
308 return error;
309 }
310 break;
311
312 default:
313 return EINVAL;
314 }
315 if (low == PRIO_MAX + 1) {
316 return ESRCH;
317 }
318 *retval = low;
319 return 0;
320 }
321
322 /* call back function used for proc iteration in PRIO_USER */
323 static int
puser_donice_callback(proc_t p,void * arg)324 puser_donice_callback(proc_t p, void * arg)
325 {
326 int error, n;
327 struct puser_nice_args * pun = (struct puser_nice_args *)arg;
328 kauth_cred_t my_cred;
329
330 my_cred = kauth_cred_proc_ref(p);
331 if (kauth_cred_getuid(my_cred) == pun->who) {
332 error = donice(pun->curp, p, pun->prio);
333 if (pun->errorp != NULL) {
334 *pun->errorp = error;
335 }
336 if (pun->foundp != NULL) {
337 n = *pun->foundp;
338 *pun->foundp = n + 1;
339 }
340 }
341 kauth_cred_unref(&my_cred);
342
343 return PROC_RETURNED;
344 }
345
346 /* call back function used for proc iteration in PRIO_PGRP */
347 static int
ppgrp_donice_callback(proc_t p,void * arg)348 ppgrp_donice_callback(proc_t p, void * arg)
349 {
350 int error;
351 struct ppgrp_nice_args * pun = (struct ppgrp_nice_args *)arg;
352 int n;
353
354 error = donice(pun->curp, p, pun->prio);
355 if (pun->errorp != NULL) {
356 *pun->errorp = error;
357 }
358 if (pun->foundp != NULL) {
359 n = *pun->foundp;
360 *pun->foundp = n + 1;
361 }
362
363 return PROC_RETURNED;
364 }
365
366 /*
367 * Returns: 0 Success
368 * EINVAL
369 * ESRCH
370 * donice:EPERM
371 * donice:EACCES
372 */
373 /* ARGSUSED */
374 int
setpriority(struct proc * curp,struct setpriority_args * uap,int32_t * retval)375 setpriority(struct proc *curp, struct setpriority_args *uap, int32_t *retval)
376 {
377 struct proc *p;
378 int found = 0, error = 0;
379 int refheld = 0;
380
381 AUDIT_ARG(cmd, uap->which);
382 AUDIT_ARG(owner, uap->who, 0);
383 AUDIT_ARG(value32, uap->prio);
384
385 /* would also test (uap->who < 0), but id_t is unsigned */
386 if (uap->who > 0x7fffffff) {
387 return EINVAL;
388 }
389
390 switch (uap->which) {
391 case PRIO_PROCESS:
392 if (uap->who == 0) {
393 p = curp;
394 } else {
395 p = proc_find(uap->who);
396 if (p == 0) {
397 break;
398 }
399 refheld = 1;
400 }
401 error = donice(curp, p, uap->prio);
402 found++;
403 if (refheld != 0) {
404 proc_rele(p);
405 }
406 break;
407
408 case PRIO_PGRP: {
409 struct pgrp *pg = PGRP_NULL;
410 struct ppgrp_nice_args ppgrp;
411
412 if (uap->who == 0) {
413 pg = proc_pgrp(curp, NULL);
414 } else if ((pg = pgrp_find(uap->who)) == PGRP_NULL) {
415 break;
416 }
417
418 ppgrp.curp = curp;
419 ppgrp.prio = uap->prio;
420 ppgrp.foundp = &found;
421 ppgrp.errorp = &error;
422
423 pgrp_iterate(pg, ppgrp_donice_callback, (void *)&ppgrp, NULL);
424 pgrp_rele(pg);
425
426 break;
427 }
428
429 case PRIO_USER: {
430 struct puser_nice_args punice;
431
432 if (uap->who == 0) {
433 uap->who = kauth_cred_getuid(kauth_cred_get());
434 }
435
436 punice.curp = curp;
437 punice.prio = uap->prio;
438 punice.who = uap->who;
439 punice.foundp = &found;
440 error = 0;
441 punice.errorp = &error;
442 proc_iterate(PROC_ALLPROCLIST, puser_donice_callback, (void *)&punice, NULL, NULL);
443
444 break;
445 }
446
447 case PRIO_DARWIN_THREAD: {
448 /* we currently only support the current thread */
449 if (uap->who != 0) {
450 return EINVAL;
451 }
452
453 error = do_background_thread(current_thread(), uap->prio);
454 found++;
455 break;
456 }
457
458 case PRIO_DARWIN_PROCESS: {
459 if (uap->who == 0) {
460 p = curp;
461 } else {
462 p = proc_find(uap->who);
463 if (p == 0) {
464 break;
465 }
466 refheld = 1;
467 }
468
469 error = do_background_proc(curp, p, uap->prio);
470
471 found++;
472 if (refheld != 0) {
473 proc_rele(p);
474 }
475 break;
476 }
477
478 case PRIO_DARWIN_GPU: {
479 if (uap->who == 0) {
480 return EINVAL;
481 }
482
483 p = proc_find(uap->who);
484 if (p == PROC_NULL) {
485 break;
486 }
487
488 error = set_gpudeny_proc(curp, p, uap->prio);
489
490 found++;
491 proc_rele(p);
492 break;
493 }
494
495 case PRIO_DARWIN_ROLE: {
496 if (uap->who == 0) {
497 p = curp;
498 } else {
499 p = proc_find(uap->who);
500 if (p == PROC_NULL) {
501 break;
502 }
503 refheld = 1;
504 }
505
506 error = proc_set_darwin_role(curp, p, uap->prio);
507
508 found++;
509 if (refheld != 0) {
510 proc_rele(p);
511 }
512 break;
513 }
514
515 default:
516 return EINVAL;
517 }
518 if (found == 0) {
519 return ESRCH;
520 }
521 if (error == EIDRM) {
522 *retval = -2;
523 error = 0;
524 }
525 return error;
526 }
527
528
529 /*
530 * Returns: 0 Success
531 * EPERM
532 * EACCES
533 * mac_check_proc_sched:???
534 */
535 static int
donice(struct proc * curp,struct proc * chgp,int n)536 donice(struct proc *curp, struct proc *chgp, int n)
537 {
538 int error = 0;
539 kauth_cred_t ucred;
540 kauth_cred_t my_cred;
541
542 ucred = kauth_cred_proc_ref(curp);
543 my_cred = kauth_cred_proc_ref(chgp);
544
545 if (suser(ucred, NULL) && kauth_cred_getruid(ucred) &&
546 kauth_cred_getuid(ucred) != kauth_cred_getuid(my_cred) &&
547 kauth_cred_getruid(ucred) != kauth_cred_getuid(my_cred)) {
548 error = EPERM;
549 goto out;
550 }
551 if (n > PRIO_MAX) {
552 n = PRIO_MAX;
553 }
554 if (n < PRIO_MIN) {
555 n = PRIO_MIN;
556 }
557 if (n < chgp->p_nice && suser(ucred, &curp->p_acflag)) {
558 error = EACCES;
559 goto out;
560 }
561 #if CONFIG_MACF
562 error = mac_proc_check_sched(curp, chgp);
563 if (error) {
564 goto out;
565 }
566 #endif
567 proc_lock(chgp);
568 chgp->p_nice = (char)n;
569 proc_unlock(chgp);
570 (void)resetpriority(chgp);
571 out:
572 kauth_cred_unref(&ucred);
573 kauth_cred_unref(&my_cred);
574 return error;
575 }
576
577 static int
set_gpudeny_proc(struct proc * curp,struct proc * targetp,int priority)578 set_gpudeny_proc(struct proc *curp, struct proc *targetp, int priority)
579 {
580 int error = 0;
581 kauth_cred_t ucred;
582 kauth_cred_t target_cred;
583
584 ucred = kauth_cred_get();
585 target_cred = kauth_cred_proc_ref(targetp);
586
587 /* TODO: Entitlement instead of uid check */
588
589 if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
590 kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
591 kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
592 error = EPERM;
593 goto out;
594 }
595
596 if (curp == targetp) {
597 error = EPERM;
598 goto out;
599 }
600
601 #if CONFIG_MACF
602 error = mac_proc_check_sched(curp, targetp);
603 if (error) {
604 goto out;
605 }
606 #endif
607
608 switch (priority) {
609 case PRIO_DARWIN_GPU_DENY:
610 task_set_gpu_denied(proc_task(targetp), TRUE);
611 break;
612 case PRIO_DARWIN_GPU_ALLOW:
613 task_set_gpu_denied(proc_task(targetp), FALSE);
614 break;
615 default:
616 error = EINVAL;
617 goto out;
618 }
619
620 out:
621 kauth_cred_unref(&target_cred);
622 return error;
623 }
624
625 static int
proc_set_darwin_role(proc_t curp,proc_t targetp,int priority)626 proc_set_darwin_role(proc_t curp, proc_t targetp, int priority)
627 {
628 int error = 0;
629 uint32_t flagsp = 0;
630
631 kauth_cred_t ucred, target_cred;
632
633 ucred = kauth_cred_get();
634 target_cred = kauth_cred_proc_ref(targetp);
635
636 if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
637 kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
638 kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
639 if (priv_check_cred(ucred, PRIV_SETPRIORITY_DARWIN_ROLE, 0) != 0) {
640 error = EPERM;
641 goto out;
642 }
643 }
644
645 if (curp != targetp) {
646 #if CONFIG_MACF
647 if ((error = mac_proc_check_sched(curp, targetp))) {
648 goto out;
649 }
650 #endif
651 }
652
653 proc_get_darwinbgstate(proc_task(targetp), &flagsp);
654 if ((flagsp & PROC_FLAG_APPLICATION) != PROC_FLAG_APPLICATION) {
655 error = ENOTSUP;
656 goto out;
657 }
658
659 task_role_t role = TASK_UNSPECIFIED;
660
661 if ((error = proc_darwin_role_to_task_role(priority, &role))) {
662 goto out;
663 }
664
665 proc_set_task_policy(proc_task(targetp), TASK_POLICY_ATTRIBUTE,
666 TASK_POLICY_ROLE, role);
667
668 #if CONFIG_FREEZE
669 if (priority == PRIO_DARWIN_ROLE_UI_FOCAL || priority == PRIO_DARWIN_ROLE_UI || priority == PRIO_DARWIN_ROLE_UI_NON_FOCAL) {
670 memorystatus_freezer_mark_ui_transition(targetp);
671 }
672 #endif /* CONFIG_FREEZE */
673
674 out:
675 kauth_cred_unref(&target_cred);
676 return error;
677 }
678
679 static int
proc_get_darwin_role(proc_t curp,proc_t targetp,int * priority)680 proc_get_darwin_role(proc_t curp, proc_t targetp, int *priority)
681 {
682 int error = 0;
683 int role = 0;
684
685 kauth_cred_t ucred, target_cred;
686
687 ucred = kauth_cred_get();
688 target_cred = kauth_cred_proc_ref(targetp);
689
690 if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
691 kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
692 kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
693 error = EPERM;
694 goto out;
695 }
696
697 if (curp != targetp) {
698 #if CONFIG_MACF
699 if ((error = mac_proc_check_sched(curp, targetp))) {
700 goto out;
701 }
702 #endif
703 }
704
705 role = proc_get_task_policy(proc_task(targetp), TASK_POLICY_ATTRIBUTE, TASK_POLICY_ROLE);
706
707 *priority = proc_task_role_to_darwin_role(role);
708
709 out:
710 kauth_cred_unref(&target_cred);
711 return error;
712 }
713
714
715 static int
get_background_proc(struct proc * curp,struct proc * targetp,int * priority)716 get_background_proc(struct proc *curp, struct proc *targetp, int *priority)
717 {
718 int external = 0;
719 int error = 0;
720 kauth_cred_t ucred, target_cred;
721
722 ucred = kauth_cred_get();
723 target_cred = kauth_cred_proc_ref(targetp);
724
725 if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
726 kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
727 kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
728 error = EPERM;
729 goto out;
730 }
731
732 external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
733
734 *priority = proc_get_task_policy(current_task(), external, TASK_POLICY_DARWIN_BG);
735
736 out:
737 kauth_cred_unref(&target_cred);
738 return error;
739 }
740
741 static int
do_background_proc(struct proc * curp,struct proc * targetp,int priority)742 do_background_proc(struct proc *curp, struct proc *targetp, int priority)
743 {
744 #if !CONFIG_MACF
745 #pragma unused(curp)
746 #endif
747 int error = 0;
748 kauth_cred_t ucred;
749 kauth_cred_t target_cred;
750 int external;
751 int enable;
752
753 ucred = kauth_cred_get();
754 target_cred = kauth_cred_proc_ref(targetp);
755
756 if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
757 kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
758 kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
759 error = EPERM;
760 goto out;
761 }
762
763 #if CONFIG_MACF
764 error = mac_proc_check_sched(curp, targetp);
765 if (error) {
766 goto out;
767 }
768 #endif
769
770 external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
771
772 switch (priority) {
773 case PRIO_DARWIN_BG:
774 enable = TASK_POLICY_ENABLE;
775 break;
776 case PRIO_DARWIN_NONUI:
777 /* ignored for compatibility */
778 goto out;
779 default:
780 /* TODO: EINVAL if priority != 0 */
781 enable = TASK_POLICY_DISABLE;
782 break;
783 }
784
785 proc_set_task_policy(proc_task(targetp), external, TASK_POLICY_DARWIN_BG, enable);
786
787 out:
788 kauth_cred_unref(&target_cred);
789 return error;
790 }
791
792 static void
do_background_socket(struct proc * p,thread_t thread)793 do_background_socket(struct proc *p, thread_t thread)
794 {
795 #if SOCKETS
796 struct fileproc *fp;
797 int background = false;
798 #if NECP
799 int update_necp = false;
800 #endif /* NECP */
801
802 if (thread != THREAD_NULL &&
803 get_threadtask(thread) != proc_task(p)) {
804 return;
805 }
806
807 proc_fdlock(p);
808
809 if (thread != THREAD_NULL) {
810 background = proc_get_effective_thread_policy(thread, TASK_POLICY_ALL_SOCKETS_BG);
811 } else {
812 background = proc_get_effective_task_policy(proc_task(p), TASK_POLICY_ALL_SOCKETS_BG);
813 }
814
815 if (background) {
816 /*
817 * For PRIO_DARWIN_PROCESS (thread is NULL), simply mark
818 * the sockets with the background flag. There's nothing
819 * to do here for the PRIO_DARWIN_THREAD case.
820 */
821 if (thread == THREAD_NULL) {
822 fdt_foreach(fp, p) {
823 if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_SOCKET) {
824 struct socket *sockp = (struct socket *)fp_get_data(fp);
825 socket_set_traffic_mgt_flags(sockp, TRAFFIC_MGT_SO_BACKGROUND);
826 sockp->so_background_thread = NULL;
827 }
828 #if NECP
829 else if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_NETPOLICY) {
830 if (necp_set_client_as_background(p, fp, background)) {
831 update_necp = true;
832 }
833 }
834 #endif /* NECP */
835 }
836 }
837 } else {
838 /* disable networking IO throttle.
839 * NOTE - It is a known limitation of the current design that we
840 * could potentially clear TRAFFIC_MGT_SO_BACKGROUND bit for
841 * sockets created by other threads within this process.
842 */
843 fdt_foreach(fp, p) {
844 struct socket *sockp;
845
846 if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_SOCKET) {
847 sockp = (struct socket *)fp_get_data(fp);
848 /* skip if only clearing this thread's sockets */
849 if ((thread) && (sockp->so_background_thread != thread)) {
850 continue;
851 }
852 socket_clear_traffic_mgt_flags(sockp, TRAFFIC_MGT_SO_BACKGROUND);
853 sockp->so_background_thread = NULL;
854 }
855 #if NECP
856 else if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_NETPOLICY) {
857 if (necp_set_client_as_background(p, fp, background)) {
858 update_necp = true;
859 }
860 }
861 #endif /* NECP */
862 }
863 }
864
865 proc_fdunlock(p);
866
867 #if NECP
868 if (update_necp) {
869 necp_update_all_clients();
870 }
871 #endif /* NECP */
872 #else
873 #pragma unused(p, thread)
874 #endif
875 }
876
877
878 /*
879 * do_background_thread
880 *
881 * Requires: thread reference
882 *
883 * Returns: 0 Success
884 * EPERM Tried to background while in vfork
885 * XXX - todo - does this need a MACF hook?
886 */
887 static int
do_background_thread(thread_t thread,int priority)888 do_background_thread(thread_t thread, int priority)
889 {
890 int enable, external;
891 int rv = 0;
892
893 /* Backgrounding is unsupported for workq threads */
894 if (thread_is_static_param(thread)) {
895 return EPERM;
896 }
897
898 /* Not allowed to combine QoS and DARWIN_BG, doing so strips the QoS */
899 if (thread_has_qos_policy(thread)) {
900 thread_remove_qos_policy(thread);
901 rv = EIDRM;
902 }
903
904 /* TODO: Fail if someone passes something besides 0 or PRIO_DARWIN_BG */
905 enable = (priority == PRIO_DARWIN_BG) ? TASK_POLICY_ENABLE : TASK_POLICY_DISABLE;
906 external = (current_thread() == thread) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
907
908 proc_set_thread_policy(thread, external, TASK_POLICY_DARWIN_BG, enable);
909
910 return rv;
911 }
912
913
914 /*
915 * Returns: 0 Success
916 * copyin:EFAULT
917 * dosetrlimit:
918 */
919 /* ARGSUSED */
920 int
setrlimit(struct proc * p,struct setrlimit_args * uap,__unused int32_t * retval)921 setrlimit(struct proc *p, struct setrlimit_args *uap, __unused int32_t *retval)
922 {
923 struct rlimit alim;
924 int error;
925
926 if ((error = copyin(uap->rlp, (caddr_t)&alim,
927 sizeof(struct rlimit)))) {
928 return error;
929 }
930
931 return dosetrlimit(p, uap->which, &alim);
932 }
933
934 /*
935 * Returns: 0 Success
936 * EINVAL
937 * suser:EPERM
938 *
939 * Notes: EINVAL is returned both for invalid arguments, and in the
940 * case that the current usage (e.g. RLIMIT_STACK) is already
941 * in excess of the requested limit.
942 */
943 static int
dosetrlimit(struct proc * p,u_int which,struct rlimit * newrlim)944 dosetrlimit(struct proc *p, u_int which, struct rlimit *newrlim)
945 {
946 struct rlimit rlim, stack_rlim = {.rlim_cur = 0, .rlim_max = 0};
947 int error;
948 kern_return_t kr;
949
950 /* Mask out POSIX flag, saved above */
951 which &= ~_RLIMIT_POSIX_FLAG;
952
953 /* Unknown resource */
954 if (which >= RLIM_NLIMITS) {
955 return EINVAL;
956 }
957
958 proc_lock(p);
959
960 /* Only one thread is able to change the current process's rlimit values */
961 proc_limitblock(p);
962
963 /*
964 * Take a snapshot of the current rlimit values and read this throughout
965 * this routine. This minimizes the critical sections and allow other
966 * processes in the system to access the plimit while we are in the
967 * middle of this setrlimit call.
968 */
969 rlim = hazard_ptr_serialized_load(&p->p_limit)->pl_rlimit[which];
970
971 proc_unlock(p);
972
973 error = 0;
974 /* Sanity check: new soft limit cannot exceed new hard limit */
975 if (newrlim->rlim_cur > newrlim->rlim_max) {
976 error = EINVAL;
977 }
978 /*
979 * Sanity check: only super-user may raise the hard limit.
980 * newrlim->rlim_cur > rlim.rlim_max implies that the call
981 * is increasing the hard limit as well.
982 */
983 else if (newrlim->rlim_cur > rlim.rlim_max || newrlim->rlim_max > rlim.rlim_max) {
984 /* suser() returns 0 if the calling thread is super user. */
985 error = suser(kauth_cred_get(), &p->p_acflag);
986 }
987
988 if (error) {
989 /* Invalid setrlimit request: EINVAL or EPERM */
990 goto out;
991 }
992
993 /* We have the reader lock of the process's plimit so it's safe to read the rlimit values */
994 switch (which) {
995 case RLIMIT_CPU:
996 if (newrlim->rlim_cur == RLIM_INFINITY) {
997 task_vtimer_clear(p->task, TASK_VTIMER_RLIM);
998 timerclear(&p->p_rlim_cpu);
999 } else {
1000 task_absolutetime_info_data_t tinfo;
1001 mach_msg_type_number_t count;
1002 struct timeval ttv, tv;
1003 clock_sec_t tv_sec;
1004 clock_usec_t tv_usec;
1005
1006 count = TASK_ABSOLUTETIME_INFO_COUNT;
1007 task_info(p->task, TASK_ABSOLUTETIME_INFO, (task_info_t)&tinfo, &count);
1008 absolutetime_to_microtime(tinfo.total_user + tinfo.total_system, &tv_sec, &tv_usec);
1009 ttv.tv_sec = tv_sec;
1010 ttv.tv_usec = tv_usec;
1011
1012 tv.tv_sec = (newrlim->rlim_cur > __INT_MAX__ ? __INT_MAX__ : (__darwin_time_t)newrlim->rlim_cur);
1013 tv.tv_usec = 0;
1014 timersub(&tv, &ttv, &p->p_rlim_cpu);
1015
1016 timerclear(&tv);
1017 if (timercmp(&p->p_rlim_cpu, &tv, >)) {
1018 task_vtimer_set(p->task, TASK_VTIMER_RLIM);
1019 } else {
1020 task_vtimer_clear(p->task, TASK_VTIMER_RLIM);
1021
1022 timerclear(&p->p_rlim_cpu);
1023
1024 psignal(p, SIGXCPU);
1025 }
1026 }
1027 break;
1028
1029 case RLIMIT_DATA:
1030 #if 00
1031 if (newrlim->rlim_cur > maxdmap) {
1032 newrlim->rlim_cur = maxdmap;
1033 }
1034 if (newrlim->rlim_max > maxdmap) {
1035 newrlim->rlim_max = maxdmap;
1036 }
1037 #endif
1038
1039 /* Over to Mach VM to validate the new data limit */
1040 if (vm_map_set_data_limit(current_map(), newrlim->rlim_cur) != KERN_SUCCESS) {
1041 /* The limit specified cannot be lowered because current usage is already higher than the limit. */
1042 error = EINVAL;
1043 goto out;
1044 }
1045 break;
1046
1047 case RLIMIT_STACK:
1048 if (p->p_lflag & P_LCUSTOM_STACK) {
1049 /* Process has a custom stack set - rlimit cannot be used to change it */
1050 error = EINVAL;
1051 goto out;
1052 }
1053
1054 /*
1055 * Note: the real stack size limit is enforced by maxsmap, not a process's RLIMIT_STACK.
1056 *
1057 * The kernel uses maxsmap to control the actual stack size limit. While we allow
1058 * processes to set RLIMIT_STACK to RLIM_INFINITY (UNIX 03), accessing memory
1059 * beyond the maxsmap will still trigger an exception.
1060 *
1061 * stack_rlim is used to store the user-defined RLIMIT_STACK values while we adjust
1062 * the stack size using kernel limit (i.e. maxsmap).
1063 */
1064 if (newrlim->rlim_cur > maxsmap ||
1065 newrlim->rlim_max > maxsmap) {
1066 if (newrlim->rlim_cur > maxsmap) {
1067 stack_rlim.rlim_cur = newrlim->rlim_cur;
1068 newrlim->rlim_cur = maxsmap;
1069 }
1070 if (newrlim->rlim_max > maxsmap) {
1071 stack_rlim.rlim_max = newrlim->rlim_max;
1072 newrlim->rlim_max = maxsmap;
1073 }
1074 }
1075
1076 /*
1077 * Stack is allocated to the max at exec time with only
1078 * "rlim_cur" bytes accessible. If stack limit is going
1079 * up make more accessible, if going down make inaccessible.
1080 */
1081 if (newrlim->rlim_cur > rlim.rlim_cur) {
1082 mach_vm_offset_t addr;
1083 mach_vm_size_t size;
1084
1085 /* grow stack */
1086 size = round_page_64(newrlim->rlim_cur);
1087 size -= round_page_64(rlim.rlim_cur);
1088
1089 addr = (mach_vm_offset_t)(p->user_stack - round_page_64(newrlim->rlim_cur));
1090 kr = mach_vm_protect(current_map(), addr, size, FALSE, VM_PROT_DEFAULT);
1091 if (kr != KERN_SUCCESS) {
1092 error = EINVAL;
1093 goto out;
1094 }
1095 } else if (newrlim->rlim_cur < rlim.rlim_cur) {
1096 mach_vm_offset_t addr;
1097 mach_vm_size_t size;
1098 uint64_t cur_sp;
1099
1100 /* shrink stack */
1101
1102 /*
1103 * First check if new stack limit would agree
1104 * with current stack usage.
1105 * Get the current thread's stack pointer...
1106 */
1107 cur_sp = thread_adjuserstack(current_thread(), 0);
1108 if (cur_sp <= p->user_stack &&
1109 cur_sp > (p->user_stack - round_page_64(rlim.rlim_cur))) {
1110 /* stack pointer is in main stack */
1111 if (cur_sp <= (p->user_stack - round_page_64(newrlim->rlim_cur))) {
1112 /*
1113 * New limit would cause current usage to be invalid:
1114 * reject new limit.
1115 */
1116 error = EINVAL;
1117 goto out;
1118 }
1119 } else {
1120 /* not on the main stack: reject */
1121 error = EINVAL;
1122 goto out;
1123 }
1124
1125 size = round_page_64(rlim.rlim_cur);
1126 size -= round_page_64(rlim.rlim_cur);
1127
1128 addr = (mach_vm_offset_t)(p->user_stack - round_page_64(rlim.rlim_cur));
1129
1130 kr = mach_vm_protect(current_map(), addr, size, FALSE, VM_PROT_NONE);
1131 if (kr != KERN_SUCCESS) {
1132 error = EINVAL;
1133 goto out;
1134 }
1135 } else {
1136 /* no change ... */
1137 }
1138
1139 /*
1140 * We've adjusted the process's stack region. If the user-defined limit is greater
1141 * than maxsmap, we need to reflect this change in rlimit interface.
1142 */
1143 if (stack_rlim.rlim_cur != 0) {
1144 newrlim->rlim_cur = stack_rlim.rlim_cur;
1145 }
1146 if (stack_rlim.rlim_max != 0) {
1147 newrlim->rlim_max = stack_rlim.rlim_max;
1148 }
1149 break;
1150
1151 case RLIMIT_NOFILE:
1152 /*
1153 * Nothing to be done here as we already performed the sanity checks before entering the switch code block.
1154 * The real NOFILE limits enforced by the kernel is capped at MIN(RLIMIT_NOFILE, maxfilesperproc)
1155 */
1156 break;
1157
1158 case RLIMIT_AS:
1159 /* Over to Mach VM to validate the new address space limit */
1160 if (vm_map_set_size_limit(current_map(), newrlim->rlim_cur) != KERN_SUCCESS) {
1161 /* The limit specified cannot be lowered because current usage is already higher than the limit. */
1162 error = EINVAL;
1163 goto out;
1164 }
1165 break;
1166
1167 case RLIMIT_NPROC:
1168 /*
1169 * Only root can set to the maxproc limits, as it is
1170 * systemwide resource; all others are limited to
1171 * maxprocperuid (presumably less than maxproc).
1172 */
1173 if (kauth_cred_issuser(kauth_cred_get())) {
1174 if (newrlim->rlim_cur > (rlim_t)maxproc) {
1175 newrlim->rlim_cur = maxproc;
1176 }
1177 if (newrlim->rlim_max > (rlim_t)maxproc) {
1178 newrlim->rlim_max = maxproc;
1179 }
1180 } else {
1181 if (newrlim->rlim_cur > (rlim_t)maxprocperuid) {
1182 newrlim->rlim_cur = maxprocperuid;
1183 }
1184 if (newrlim->rlim_max > (rlim_t)maxprocperuid) {
1185 newrlim->rlim_max = maxprocperuid;
1186 }
1187 }
1188 break;
1189
1190 case RLIMIT_MEMLOCK:
1191 /*
1192 * Tell the Mach VM layer about the new limit value.
1193 */
1194 newrlim->rlim_cur = (vm_size_t)newrlim->rlim_cur;
1195 vm_map_set_user_wire_limit(current_map(), (vm_size_t)newrlim->rlim_cur);
1196 break;
1197 } /* switch... */
1198
1199 /* Everything checks out and we are now ready to update the rlimit */
1200 error = 0;
1201
1202 out:
1203
1204 if (error == 0) {
1205 /*
1206 * COW the current plimit if it's shared, otherwise update it in place.
1207 * Finally unblock other threads wishing to change plimit.
1208 */
1209 proc_limitupdate(p, true, ^(struct plimit *plim) {
1210 plim->pl_rlimit[which] = *newrlim;
1211 });
1212 } else {
1213 /*
1214 * This setrlimit has failed, just leave the plimit as is and unblock other
1215 * threads wishing to change plimit.
1216 */
1217 proc_lock(p);
1218 proc_limitunblock(p);
1219 proc_unlock(p);
1220 }
1221
1222 return error;
1223 }
1224
1225 /* ARGSUSED */
1226 int
getrlimit(struct proc * p,struct getrlimit_args * uap,__unused int32_t * retval)1227 getrlimit(struct proc *p, struct getrlimit_args *uap, __unused int32_t *retval)
1228 {
1229 struct rlimit lim = {};
1230
1231 /*
1232 * Take out flag now in case we need to use it to trigger variant
1233 * behaviour later.
1234 */
1235 uap->which &= ~_RLIMIT_POSIX_FLAG;
1236
1237 if (uap->which >= RLIM_NLIMITS) {
1238 return EINVAL;
1239 }
1240 lim = proc_limitget(p, uap->which);
1241 return copyout((caddr_t)&lim,
1242 uap->rlp, sizeof(struct rlimit));
1243 }
1244
1245 /*
1246 * Transform the running time and tick information in proc p into user,
1247 * system, and interrupt time usage.
1248 */
1249 /* No lock on proc is held for this.. */
1250 void
calcru(struct proc * p,struct timeval * up,struct timeval * sp,struct timeval * ip)1251 calcru(struct proc *p, struct timeval *up, struct timeval *sp, struct timeval *ip)
1252 {
1253 task_t task;
1254
1255 timerclear(up);
1256 timerclear(sp);
1257 if (ip != NULL) {
1258 timerclear(ip);
1259 }
1260
1261 task = p->task;
1262 if (task) {
1263 mach_task_basic_info_data_t tinfo;
1264 task_thread_times_info_data_t ttimesinfo;
1265 task_events_info_data_t teventsinfo;
1266 mach_msg_type_number_t task_info_count, task_ttimes_count;
1267 mach_msg_type_number_t task_events_count;
1268 struct timeval ut, st;
1269
1270 task_info_count = MACH_TASK_BASIC_INFO_COUNT;
1271 task_info(task, MACH_TASK_BASIC_INFO,
1272 (task_info_t)&tinfo, &task_info_count);
1273 ut.tv_sec = tinfo.user_time.seconds;
1274 ut.tv_usec = tinfo.user_time.microseconds;
1275 st.tv_sec = tinfo.system_time.seconds;
1276 st.tv_usec = tinfo.system_time.microseconds;
1277 timeradd(&ut, up, up);
1278 timeradd(&st, sp, sp);
1279
1280 task_ttimes_count = TASK_THREAD_TIMES_INFO_COUNT;
1281 task_info(task, TASK_THREAD_TIMES_INFO,
1282 (task_info_t)&ttimesinfo, &task_ttimes_count);
1283
1284 ut.tv_sec = ttimesinfo.user_time.seconds;
1285 ut.tv_usec = ttimesinfo.user_time.microseconds;
1286 st.tv_sec = ttimesinfo.system_time.seconds;
1287 st.tv_usec = ttimesinfo.system_time.microseconds;
1288 timeradd(&ut, up, up);
1289 timeradd(&st, sp, sp);
1290
1291 task_events_count = TASK_EVENTS_INFO_COUNT;
1292 task_info(task, TASK_EVENTS_INFO,
1293 (task_info_t)&teventsinfo, &task_events_count);
1294
1295 /*
1296 * No need to lock "p": this does not need to be
1297 * completely consistent, right ?
1298 */
1299 p->p_stats->p_ru.ru_minflt = (teventsinfo.faults -
1300 teventsinfo.pageins);
1301 p->p_stats->p_ru.ru_majflt = teventsinfo.pageins;
1302 p->p_stats->p_ru.ru_nivcsw = (teventsinfo.csw -
1303 p->p_stats->p_ru.ru_nvcsw);
1304 if (p->p_stats->p_ru.ru_nivcsw < 0) {
1305 p->p_stats->p_ru.ru_nivcsw = 0;
1306 }
1307
1308 p->p_stats->p_ru.ru_maxrss = (long)tinfo.resident_size_max;
1309 }
1310 }
1311
1312 __private_extern__ void munge_user64_rusage(struct rusage *a_rusage_p, struct user64_rusage *a_user_rusage_p);
1313 __private_extern__ void munge_user32_rusage(struct rusage *a_rusage_p, struct user32_rusage *a_user_rusage_p);
1314
1315 /* ARGSUSED */
1316 int
getrusage(struct proc * p,struct getrusage_args * uap,__unused int32_t * retval)1317 getrusage(struct proc *p, struct getrusage_args *uap, __unused int32_t *retval)
1318 {
1319 struct rusage *rup, rubuf;
1320 struct user64_rusage rubuf64 = {};
1321 struct user32_rusage rubuf32 = {};
1322 size_t retsize = sizeof(rubuf); /* default: 32 bits */
1323 caddr_t retbuf = (caddr_t)&rubuf; /* default: 32 bits */
1324 struct timeval utime;
1325 struct timeval stime;
1326
1327
1328 switch (uap->who) {
1329 case RUSAGE_SELF:
1330 calcru(p, &utime, &stime, NULL);
1331 proc_lock(p);
1332 rup = &p->p_stats->p_ru;
1333 rup->ru_utime = utime;
1334 rup->ru_stime = stime;
1335
1336 rubuf = *rup;
1337 proc_unlock(p);
1338
1339 break;
1340
1341 case RUSAGE_CHILDREN:
1342 proc_lock(p);
1343 rup = &p->p_stats->p_cru;
1344 rubuf = *rup;
1345 proc_unlock(p);
1346 break;
1347
1348 default:
1349 return EINVAL;
1350 }
1351 if (IS_64BIT_PROCESS(p)) {
1352 retsize = sizeof(rubuf64);
1353 retbuf = (caddr_t)&rubuf64;
1354 munge_user64_rusage(&rubuf, &rubuf64);
1355 } else {
1356 retsize = sizeof(rubuf32);
1357 retbuf = (caddr_t)&rubuf32;
1358 munge_user32_rusage(&rubuf, &rubuf32);
1359 }
1360
1361 return copyout(retbuf, uap->rusage, retsize);
1362 }
1363
1364 void
ruadd(struct rusage * ru,struct rusage * ru2)1365 ruadd(struct rusage *ru, struct rusage *ru2)
1366 {
1367 long *ip, *ip2;
1368 long i;
1369
1370 timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
1371 timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
1372 if (ru->ru_maxrss < ru2->ru_maxrss) {
1373 ru->ru_maxrss = ru2->ru_maxrss;
1374 }
1375 ip = &ru->ru_first; ip2 = &ru2->ru_first;
1376 for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--) {
1377 *ip++ += *ip2++;
1378 }
1379 }
1380
1381 /*
1382 * Add the rusage stats of child in parent.
1383 *
1384 * It adds rusage statistics of child process and statistics of all its
1385 * children to its parent.
1386 *
1387 * Note: proc lock of parent should be held while calling this function.
1388 */
1389 void
update_rusage_info_child(struct rusage_info_child * ri,rusage_info_current * ri_current)1390 update_rusage_info_child(struct rusage_info_child *ri, rusage_info_current *ri_current)
1391 {
1392 ri->ri_child_user_time += (ri_current->ri_user_time +
1393 ri_current->ri_child_user_time);
1394 ri->ri_child_system_time += (ri_current->ri_system_time +
1395 ri_current->ri_child_system_time);
1396 ri->ri_child_pkg_idle_wkups += (ri_current->ri_pkg_idle_wkups +
1397 ri_current->ri_child_pkg_idle_wkups);
1398 ri->ri_child_interrupt_wkups += (ri_current->ri_interrupt_wkups +
1399 ri_current->ri_child_interrupt_wkups);
1400 ri->ri_child_pageins += (ri_current->ri_pageins +
1401 ri_current->ri_child_pageins);
1402 ri->ri_child_elapsed_abstime += ((ri_current->ri_proc_exit_abstime -
1403 ri_current->ri_proc_start_abstime) + ri_current->ri_child_elapsed_abstime);
1404 }
1405
1406 static void
proc_limit_free(void * plimit)1407 proc_limit_free(void *plimit)
1408 {
1409 zfree(plimit_zone, plimit);
1410 }
1411
1412 static void
proc_limit_release(struct plimit * plimit)1413 proc_limit_release(struct plimit *plimit)
1414 {
1415 if (os_ref_release(&plimit->pl_refcnt) == 0) {
1416 hazard_retire(plimit, sizeof(*plimit), proc_limit_free);
1417 }
1418 }
1419
1420 /*
1421 * Reading soft limit from specified resource.
1422 */
1423 rlim_t
proc_limitgetcur(proc_t p,int which)1424 proc_limitgetcur(proc_t p, int which)
1425 {
1426 hazard_guard_t guard;
1427 rlim_t rlim_cur;
1428
1429 assert(p);
1430 assert(which < RLIM_NLIMITS);
1431
1432 guard = hazard_guard_get(0);
1433 rlim_cur = hazard_guard_acquire(guard, &p->p_limit)->pl_rlimit[which].rlim_cur;
1434 hazard_guard_put(guard);
1435
1436 return rlim_cur;
1437 }
1438
1439 /*
1440 * Handle commonly asked limit that needs to be clamped with maxfilesperproc.
1441 */
1442 int
proc_limitgetcur_nofile(struct proc * p)1443 proc_limitgetcur_nofile(struct proc *p)
1444 {
1445 rlim_t lim = proc_limitgetcur(p, RLIMIT_NOFILE);
1446
1447 return (int)MIN(lim, maxfilesperproc);
1448 }
1449
1450 /*
1451 * Writing soft limit to specified resource. This is an internal function
1452 * used only by proc_exit to update RLIMIT_FSIZE in
1453 * place without invoking setrlimit.
1454 */
1455 void
proc_limitsetcur_fsize(proc_t p,rlim_t value)1456 proc_limitsetcur_fsize(proc_t p, rlim_t value)
1457 {
1458 proc_limitupdate(p, false, ^(struct plimit *plimit) {
1459 plimit->pl_rlimit[RLIMIT_FSIZE].rlim_cur = value;
1460 });
1461 }
1462
1463 struct rlimit
proc_limitget(proc_t p,int which)1464 proc_limitget(proc_t p, int which)
1465 {
1466 hazard_guard_t guard;
1467 struct rlimit lim;
1468
1469 assert(which < RLIM_NLIMITS);
1470
1471 guard = hazard_guard_get(0);
1472 lim = hazard_guard_acquire(guard, &p->p_limit)->pl_rlimit[which];
1473 hazard_guard_put(guard);
1474
1475 return lim;
1476 }
1477
1478 void
proc_limitfork(proc_t parent,proc_t child)1479 proc_limitfork(proc_t parent, proc_t child)
1480 {
1481 hazard_guard_t guard;
1482 struct plimit *plim;
1483
1484 guard = hazard_guard_get(0);
1485 plim = hazard_guard_acquire(guard, &parent->p_limit);
1486 os_ref_retain(&plim->pl_refcnt);
1487 hazard_guard_put(guard);
1488
1489 hazard_ptr_init(&child->p_limit, plim);
1490 }
1491
1492 void
proc_limitdrop(proc_t p)1493 proc_limitdrop(proc_t p)
1494 {
1495 struct plimit *plimit = NULL;
1496
1497 proc_lock(p);
1498 plimit = hazard_ptr_serialized_load(&p->p_limit);
1499 hazard_ptr_clear(&p->p_limit);
1500 proc_unlock(p);
1501
1502 proc_limit_release(plimit);
1503 }
1504
1505 /*
1506 * proc_limitblock/unblock are used to serialize access to plimit
1507 * from concurrent threads within the same process.
1508 * Callers must be holding the proc lock to enter, return with
1509 * the proc lock locked
1510 */
1511 static void
proc_limitblock(proc_t p)1512 proc_limitblock(proc_t p)
1513 {
1514 lck_mtx_assert(&p->p_mlock, LCK_MTX_ASSERT_OWNED);
1515
1516 while (p->p_lflag & P_LLIMCHANGE) {
1517 p->p_lflag |= P_LLIMWAIT;
1518 msleep(&p->p_limit, &p->p_mlock, 0, "proc_limitblock", NULL);
1519 }
1520 p->p_lflag |= P_LLIMCHANGE;
1521 }
1522
1523 /*
1524 * Callers must be holding the proc lock to enter, return with
1525 * the proc lock locked
1526 */
1527 static void
proc_limitunblock(proc_t p)1528 proc_limitunblock(proc_t p)
1529 {
1530 lck_mtx_assert(&p->p_mlock, LCK_MTX_ASSERT_OWNED);
1531
1532 p->p_lflag &= ~P_LLIMCHANGE;
1533 if (p->p_lflag & P_LLIMWAIT) {
1534 p->p_lflag &= ~P_LLIMWAIT;
1535 wakeup(&p->p_limit);
1536 }
1537 }
1538
1539 /*
1540 * Perform an rlimit update (as defined by the arbitrary `update` function).
1541 *
1542 * Because plimits are accessed without holding any locks,
1543 * with only a hazard reference, the struct plimit is always
1544 * copied, updated, and replaced, to implement a const value type.
1545 */
1546 static void
1547 proc_limitupdate(proc_t p, bool unblock, void (^update)(struct plimit *))
1548 {
1549 struct plimit *cur_plim;
1550 struct plimit *copy_plim;
1551
1552 copy_plim = zalloc_flags(plimit_zone, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1553
1554 proc_lock(p);
1555
1556 cur_plim = hazard_ptr_serialized_load(&p->p_limit);
1557
1558 os_ref_init_count(©_plim->pl_refcnt, &rlimit_refgrp, 1);
1559 bcopy(cur_plim->pl_rlimit, copy_plim->pl_rlimit,
1560 sizeof(struct rlimit) * RLIM_NLIMITS);
1561
1562 update(copy_plim);
1563
1564 hazard_ptr_serialized_store(&p->p_limit, copy_plim);
1565
1566 if (unblock) {
1567 proc_limitunblock(p);
1568 }
1569 proc_unlock(p);
1570
1571 proc_limit_release(cur_plim);
1572 }
1573
1574 static int
1575 iopolicysys_disk(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1576 static int
1577 iopolicysys_vfs_hfs_case_sensitivity(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1578 static int
1579 iopolicysys_vfs_atime_updates(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1580 static int
1581 iopolicysys_vfs_materialize_dataless_files(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1582 static int
1583 iopolicysys_vfs_statfs_no_data_volume(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1584 static int
1585 iopolicysys_vfs_trigger_resolve(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1586 static int
1587 iopolicysys_vfs_ignore_content_protection(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1588 static int
1589 iopolicysys_vfs_ignore_node_permissions(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *ipo_param);
1590 static int
1591 iopolicysys_vfs_skip_mtime_update(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1592 static int
1593 iopolicysys_vfs_allow_lowspace_writes(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1594
1595 /*
1596 * iopolicysys
1597 *
1598 * Description: System call MUX for use in manipulating I/O policy attributes of the current process or thread
1599 *
1600 * Parameters: cmd Policy command
1601 * arg Pointer to policy arguments
1602 *
1603 * Returns: 0 Success
1604 * EINVAL Invalid command or invalid policy arguments
1605 *
1606 */
1607 int
iopolicysys(struct proc * p,struct iopolicysys_args * uap,int32_t * retval)1608 iopolicysys(struct proc *p, struct iopolicysys_args *uap, int32_t *retval)
1609 {
1610 int error = 0;
1611 struct _iopol_param_t iop_param;
1612
1613 if ((error = copyin(uap->arg, &iop_param, sizeof(iop_param))) != 0) {
1614 goto out;
1615 }
1616
1617 switch (iop_param.iop_iotype) {
1618 case IOPOL_TYPE_DISK:
1619 error = iopolicysys_disk(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1620 if (error == EIDRM) {
1621 *retval = -2;
1622 error = 0;
1623 }
1624 if (error) {
1625 goto out;
1626 }
1627 break;
1628 case IOPOL_TYPE_VFS_HFS_CASE_SENSITIVITY:
1629 error = iopolicysys_vfs_hfs_case_sensitivity(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1630 if (error) {
1631 goto out;
1632 }
1633 break;
1634 case IOPOL_TYPE_VFS_ATIME_UPDATES:
1635 error = iopolicysys_vfs_atime_updates(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1636 if (error) {
1637 goto out;
1638 }
1639 break;
1640 case IOPOL_TYPE_VFS_MATERIALIZE_DATALESS_FILES:
1641 error = iopolicysys_vfs_materialize_dataless_files(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1642 if (error) {
1643 goto out;
1644 }
1645 break;
1646 case IOPOL_TYPE_VFS_STATFS_NO_DATA_VOLUME:
1647 error = iopolicysys_vfs_statfs_no_data_volume(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1648 if (error) {
1649 goto out;
1650 }
1651 break;
1652 case IOPOL_TYPE_VFS_TRIGGER_RESOLVE:
1653 error = iopolicysys_vfs_trigger_resolve(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1654 if (error) {
1655 goto out;
1656 }
1657 break;
1658 case IOPOL_TYPE_VFS_IGNORE_CONTENT_PROTECTION:
1659 error = iopolicysys_vfs_ignore_content_protection(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1660 if (error) {
1661 goto out;
1662 }
1663 break;
1664 case IOPOL_TYPE_VFS_IGNORE_PERMISSIONS:
1665 error = iopolicysys_vfs_ignore_node_permissions(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1666 if (error) {
1667 goto out;
1668 }
1669 break;
1670 case IOPOL_TYPE_VFS_SKIP_MTIME_UPDATE:
1671 error = iopolicysys_vfs_skip_mtime_update(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1672 if (error) {
1673 goto out;
1674 }
1675 break;
1676 case IOPOL_TYPE_VFS_ALLOW_LOW_SPACE_WRITES:
1677 error = iopolicysys_vfs_allow_lowspace_writes(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1678 if (error) {
1679 goto out;
1680 }
1681 break;
1682 default:
1683 error = EINVAL;
1684 goto out;
1685 }
1686
1687 /* Individual iotype handlers are expected to update iop_param, if requested with a GET command */
1688 if (uap->cmd == IOPOL_CMD_GET) {
1689 error = copyout((caddr_t)&iop_param, uap->arg, sizeof(iop_param));
1690 if (error) {
1691 goto out;
1692 }
1693 }
1694
1695 out:
1696 return error;
1697 }
1698
1699 static int
iopolicysys_disk(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)1700 iopolicysys_disk(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
1701 {
1702 int error = 0;
1703 thread_t thread;
1704 int policy_flavor;
1705
1706 /* Validate scope */
1707 switch (scope) {
1708 case IOPOL_SCOPE_PROCESS:
1709 thread = THREAD_NULL;
1710 policy_flavor = TASK_POLICY_IOPOL;
1711 break;
1712
1713 case IOPOL_SCOPE_THREAD:
1714 thread = current_thread();
1715 policy_flavor = TASK_POLICY_IOPOL;
1716
1717 /* Not allowed to combine QoS and (non-PASSIVE) IO policy, doing so strips the QoS */
1718 if (cmd == IOPOL_CMD_SET && thread_has_qos_policy(thread)) {
1719 switch (policy) {
1720 case IOPOL_DEFAULT:
1721 case IOPOL_PASSIVE:
1722 break;
1723 case IOPOL_UTILITY:
1724 case IOPOL_THROTTLE:
1725 case IOPOL_IMPORTANT:
1726 case IOPOL_STANDARD:
1727 if (!thread_is_static_param(thread)) {
1728 thread_remove_qos_policy(thread);
1729 /*
1730 * This is not an error case, this is to return a marker to user-space that
1731 * we stripped the thread of its QoS class.
1732 */
1733 error = EIDRM;
1734 break;
1735 }
1736 OS_FALLTHROUGH;
1737 default:
1738 error = EINVAL;
1739 goto out;
1740 }
1741 }
1742 break;
1743
1744 case IOPOL_SCOPE_DARWIN_BG:
1745 #if !defined(XNU_TARGET_OS_OSX)
1746 /* We don't want this on platforms outside of macOS as BG is always IOPOL_THROTTLE */
1747 error = ENOTSUP;
1748 goto out;
1749 #else /* !defined(XNU_TARGET_OS_OSX) */
1750 thread = THREAD_NULL;
1751 policy_flavor = TASK_POLICY_DARWIN_BG_IOPOL;
1752 break;
1753 #endif /* !defined(XNU_TARGET_OS_OSX) */
1754
1755 default:
1756 error = EINVAL;
1757 goto out;
1758 }
1759
1760 /* Validate policy */
1761 if (cmd == IOPOL_CMD_SET) {
1762 switch (policy) {
1763 case IOPOL_DEFAULT:
1764 if (scope == IOPOL_SCOPE_DARWIN_BG) {
1765 /* the current default BG throttle level is UTILITY */
1766 policy = IOPOL_UTILITY;
1767 } else {
1768 policy = IOPOL_IMPORTANT;
1769 }
1770 break;
1771 case IOPOL_UTILITY:
1772 /* fall-through */
1773 case IOPOL_THROTTLE:
1774 /* These levels are OK */
1775 break;
1776 case IOPOL_IMPORTANT:
1777 /* fall-through */
1778 case IOPOL_STANDARD:
1779 /* fall-through */
1780 case IOPOL_PASSIVE:
1781 if (scope == IOPOL_SCOPE_DARWIN_BG) {
1782 /* These levels are invalid for BG */
1783 error = EINVAL;
1784 goto out;
1785 } else {
1786 /* OK for other scopes */
1787 }
1788 break;
1789 default:
1790 error = EINVAL;
1791 goto out;
1792 }
1793 }
1794
1795 /* Perform command */
1796 switch (cmd) {
1797 case IOPOL_CMD_SET:
1798 if (thread != THREAD_NULL) {
1799 proc_set_thread_policy(thread, TASK_POLICY_INTERNAL, policy_flavor, policy);
1800 } else {
1801 proc_set_task_policy(current_task(), TASK_POLICY_INTERNAL, policy_flavor, policy);
1802 }
1803 break;
1804 case IOPOL_CMD_GET:
1805 if (thread != THREAD_NULL) {
1806 policy = proc_get_thread_policy(thread, TASK_POLICY_INTERNAL, policy_flavor);
1807 } else {
1808 policy = proc_get_task_policy(current_task(), TASK_POLICY_INTERNAL, policy_flavor);
1809 }
1810 iop_param->iop_policy = policy;
1811 break;
1812 default:
1813 error = EINVAL; /* unknown command */
1814 break;
1815 }
1816
1817 out:
1818 return error;
1819 }
1820
1821 static int
iopolicysys_vfs_hfs_case_sensitivity(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)1822 iopolicysys_vfs_hfs_case_sensitivity(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
1823 {
1824 int error = 0;
1825
1826 /* Validate scope */
1827 switch (scope) {
1828 case IOPOL_SCOPE_PROCESS:
1829 /* Only process OK */
1830 break;
1831 default:
1832 error = EINVAL;
1833 goto out;
1834 }
1835
1836 /* Validate policy */
1837 if (cmd == IOPOL_CMD_SET) {
1838 switch (policy) {
1839 case IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT:
1840 /* fall-through */
1841 case IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE:
1842 /* These policies are OK */
1843 break;
1844 default:
1845 error = EINVAL;
1846 goto out;
1847 }
1848 }
1849
1850 /* Perform command */
1851 switch (cmd) {
1852 case IOPOL_CMD_SET:
1853 if (0 == kauth_cred_issuser(kauth_cred_get())) {
1854 /* If it's a non-root process, it needs to have the entitlement to set the policy */
1855 boolean_t entitled = FALSE;
1856 entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
1857 if (!entitled) {
1858 error = EPERM;
1859 goto out;
1860 }
1861 }
1862
1863 switch (policy) {
1864 case IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT:
1865 OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY), &p->p_vfs_iopolicy);
1866 break;
1867 case IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE:
1868 OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY, &p->p_vfs_iopolicy);
1869 break;
1870 default:
1871 error = EINVAL;
1872 goto out;
1873 }
1874
1875 break;
1876 case IOPOL_CMD_GET:
1877 iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY)
1878 ? IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE
1879 : IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT;
1880 break;
1881 default:
1882 error = EINVAL; /* unknown command */
1883 break;
1884 }
1885
1886 out:
1887 return error;
1888 }
1889
1890 static inline int
get_thread_atime_policy(struct uthread * ut)1891 get_thread_atime_policy(struct uthread *ut)
1892 {
1893 return (ut->uu_flag & UT_ATIME_UPDATE) ? IOPOL_ATIME_UPDATES_OFF : IOPOL_ATIME_UPDATES_DEFAULT;
1894 }
1895
1896 static inline void
set_thread_atime_policy(struct uthread * ut,int policy)1897 set_thread_atime_policy(struct uthread *ut, int policy)
1898 {
1899 if (policy == IOPOL_ATIME_UPDATES_OFF) {
1900 ut->uu_flag |= UT_ATIME_UPDATE;
1901 } else {
1902 ut->uu_flag &= ~UT_ATIME_UPDATE;
1903 }
1904 }
1905
1906 static inline void
set_task_atime_policy(struct proc * p,int policy)1907 set_task_atime_policy(struct proc *p, int policy)
1908 {
1909 if (policy == IOPOL_ATIME_UPDATES_OFF) {
1910 OSBitOrAtomic16((uint16_t)P_VFS_IOPOLICY_ATIME_UPDATES, &p->p_vfs_iopolicy);
1911 } else {
1912 OSBitAndAtomic16(~((uint16_t)P_VFS_IOPOLICY_ATIME_UPDATES), &p->p_vfs_iopolicy);
1913 }
1914 }
1915
1916 static inline int
get_task_atime_policy(struct proc * p)1917 get_task_atime_policy(struct proc *p)
1918 {
1919 return (p->p_vfs_iopolicy & P_VFS_IOPOLICY_ATIME_UPDATES) ? IOPOL_ATIME_UPDATES_OFF : IOPOL_ATIME_UPDATES_DEFAULT;
1920 }
1921
1922 static int
iopolicysys_vfs_atime_updates(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)1923 iopolicysys_vfs_atime_updates(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
1924 {
1925 int error = 0;
1926 thread_t thread;
1927
1928 /* Validate scope */
1929 switch (scope) {
1930 case IOPOL_SCOPE_THREAD:
1931 thread = current_thread();
1932 break;
1933 case IOPOL_SCOPE_PROCESS:
1934 thread = THREAD_NULL;
1935 break;
1936 default:
1937 error = EINVAL;
1938 goto out;
1939 }
1940
1941 /* Validate policy */
1942 if (cmd == IOPOL_CMD_SET) {
1943 switch (policy) {
1944 case IOPOL_ATIME_UPDATES_DEFAULT:
1945 case IOPOL_ATIME_UPDATES_OFF:
1946 break;
1947 default:
1948 error = EINVAL;
1949 goto out;
1950 }
1951 }
1952
1953 /* Perform command */
1954 switch (cmd) {
1955 case IOPOL_CMD_SET:
1956 if (thread != THREAD_NULL) {
1957 set_thread_atime_policy(get_bsdthread_info(thread), policy);
1958 } else {
1959 set_task_atime_policy(p, policy);
1960 }
1961 break;
1962 case IOPOL_CMD_GET:
1963 if (thread != THREAD_NULL) {
1964 policy = get_thread_atime_policy(get_bsdthread_info(thread));
1965 } else {
1966 policy = get_task_atime_policy(p);
1967 }
1968 iop_param->iop_policy = policy;
1969 break;
1970 default:
1971 error = EINVAL; /* unknown command */
1972 break;
1973 }
1974
1975 out:
1976 return error;
1977 }
1978
1979 static inline int
get_thread_materialize_policy(struct uthread * ut)1980 get_thread_materialize_policy(struct uthread *ut)
1981 {
1982 if (ut->uu_flag & UT_NSPACE_NODATALESSFAULTS) {
1983 return IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
1984 } else if (ut->uu_flag & UT_NSPACE_FORCEDATALESSFAULTS) {
1985 return IOPOL_MATERIALIZE_DATALESS_FILES_ON;
1986 }
1987 /* Default thread behavior is "inherit process behavior". */
1988 return IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT;
1989 }
1990
1991 static inline void
set_thread_materialize_policy(struct uthread * ut,int policy)1992 set_thread_materialize_policy(struct uthread *ut, int policy)
1993 {
1994 if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_OFF) {
1995 ut->uu_flag &= ~UT_NSPACE_FORCEDATALESSFAULTS;
1996 ut->uu_flag |= UT_NSPACE_NODATALESSFAULTS;
1997 } else if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_ON) {
1998 ut->uu_flag &= ~UT_NSPACE_NODATALESSFAULTS;
1999 ut->uu_flag |= UT_NSPACE_FORCEDATALESSFAULTS;
2000 } else {
2001 ut->uu_flag &= ~(UT_NSPACE_NODATALESSFAULTS | UT_NSPACE_FORCEDATALESSFAULTS);
2002 }
2003 }
2004
2005 static inline void
set_proc_materialize_policy(struct proc * p,int policy)2006 set_proc_materialize_policy(struct proc *p, int policy)
2007 {
2008 if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT) {
2009 /*
2010 * Caller has specified "use the default policy".
2011 * The default policy is to NOT materialize dataless
2012 * files.
2013 */
2014 policy = IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
2015 }
2016 if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_ON) {
2017 OSBitOrAtomic16((uint16_t)P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES, &p->p_vfs_iopolicy);
2018 } else {
2019 OSBitAndAtomic16(~((uint16_t)P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES), &p->p_vfs_iopolicy);
2020 }
2021 }
2022
2023 static int
get_proc_materialize_policy(struct proc * p)2024 get_proc_materialize_policy(struct proc *p)
2025 {
2026 return (p->p_vfs_iopolicy & P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES) ? IOPOL_MATERIALIZE_DATALESS_FILES_ON : IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
2027 }
2028
2029 static int
iopolicysys_vfs_materialize_dataless_files(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2030 iopolicysys_vfs_materialize_dataless_files(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
2031 {
2032 int error = 0;
2033 thread_t thread;
2034
2035 /* Validate scope */
2036 switch (scope) {
2037 case IOPOL_SCOPE_THREAD:
2038 thread = current_thread();
2039 break;
2040 case IOPOL_SCOPE_PROCESS:
2041 thread = THREAD_NULL;
2042 break;
2043 default:
2044 error = EINVAL;
2045 goto out;
2046 }
2047
2048 /* Validate policy */
2049 if (cmd == IOPOL_CMD_SET) {
2050 switch (policy) {
2051 case IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT:
2052 case IOPOL_MATERIALIZE_DATALESS_FILES_OFF:
2053 case IOPOL_MATERIALIZE_DATALESS_FILES_ON:
2054 break;
2055 default:
2056 error = EINVAL;
2057 goto out;
2058 }
2059 }
2060
2061 /* Perform command */
2062 switch (cmd) {
2063 case IOPOL_CMD_SET:
2064 if (thread != THREAD_NULL) {
2065 set_thread_materialize_policy(get_bsdthread_info(thread), policy);
2066 } else {
2067 set_proc_materialize_policy(p, policy);
2068 }
2069 break;
2070 case IOPOL_CMD_GET:
2071 if (thread != THREAD_NULL) {
2072 policy = get_thread_materialize_policy(get_bsdthread_info(thread));
2073 } else {
2074 policy = get_proc_materialize_policy(p);
2075 }
2076 iop_param->iop_policy = policy;
2077 break;
2078 default:
2079 error = EINVAL; /* unknown command */
2080 break;
2081 }
2082
2083 out:
2084 return error;
2085 }
2086
2087 static int
iopolicysys_vfs_statfs_no_data_volume(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2088 iopolicysys_vfs_statfs_no_data_volume(struct proc *p __unused, int cmd,
2089 int scope, int policy, struct _iopol_param_t *iop_param)
2090 {
2091 int error = 0;
2092
2093 /* Validate scope */
2094 switch (scope) {
2095 case IOPOL_SCOPE_PROCESS:
2096 /* Only process OK */
2097 break;
2098 default:
2099 error = EINVAL;
2100 goto out;
2101 }
2102
2103 /* Validate policy */
2104 if (cmd == IOPOL_CMD_SET) {
2105 switch (policy) {
2106 case IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT:
2107 /* fall-through */
2108 case IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME:
2109 /* These policies are OK */
2110 break;
2111 default:
2112 error = EINVAL;
2113 goto out;
2114 }
2115 }
2116
2117 /* Perform command */
2118 switch (cmd) {
2119 case IOPOL_CMD_SET:
2120 if (0 == kauth_cred_issuser(kauth_cred_get())) {
2121 /* If it's a non-root process, it needs to have the entitlement to set the policy */
2122 boolean_t entitled = FALSE;
2123 entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
2124 if (!entitled) {
2125 error = EPERM;
2126 goto out;
2127 }
2128 }
2129
2130 switch (policy) {
2131 case IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT:
2132 OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME), &p->p_vfs_iopolicy);
2133 break;
2134 case IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME:
2135 OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME, &p->p_vfs_iopolicy);
2136 break;
2137 default:
2138 error = EINVAL;
2139 goto out;
2140 }
2141
2142 break;
2143 case IOPOL_CMD_GET:
2144 iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME)
2145 ? IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME
2146 : IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT;
2147 break;
2148 default:
2149 error = EINVAL; /* unknown command */
2150 break;
2151 }
2152
2153 out:
2154 return error;
2155 }
2156
2157 static int
iopolicysys_vfs_trigger_resolve(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2158 iopolicysys_vfs_trigger_resolve(struct proc *p __unused, int cmd,
2159 int scope, int policy, struct _iopol_param_t *iop_param)
2160 {
2161 int error = 0;
2162
2163 /* Validate scope */
2164 switch (scope) {
2165 case IOPOL_SCOPE_PROCESS:
2166 /* Only process OK */
2167 break;
2168 default:
2169 error = EINVAL;
2170 goto out;
2171 }
2172
2173 /* Validate policy */
2174 if (cmd == IOPOL_CMD_SET) {
2175 switch (policy) {
2176 case IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT:
2177 /* fall-through */
2178 case IOPOL_VFS_TRIGGER_RESOLVE_OFF:
2179 /* These policies are OK */
2180 break;
2181 default:
2182 error = EINVAL;
2183 goto out;
2184 }
2185 }
2186
2187 /* Perform command */
2188 switch (cmd) {
2189 case IOPOL_CMD_SET:
2190 switch (policy) {
2191 case IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT:
2192 OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE), &p->p_vfs_iopolicy);
2193 break;
2194 case IOPOL_VFS_TRIGGER_RESOLVE_OFF:
2195 OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE, &p->p_vfs_iopolicy);
2196 break;
2197 default:
2198 error = EINVAL;
2199 goto out;
2200 }
2201
2202 break;
2203 case IOPOL_CMD_GET:
2204 iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE)
2205 ? IOPOL_VFS_TRIGGER_RESOLVE_OFF
2206 : IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT;
2207 break;
2208 default:
2209 error = EINVAL; /* unknown command */
2210 break;
2211 }
2212
2213 out:
2214 return error;
2215 }
2216
2217 static int
iopolicysys_vfs_ignore_content_protection(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2218 iopolicysys_vfs_ignore_content_protection(struct proc *p, int cmd, int scope,
2219 int policy, struct _iopol_param_t *iop_param)
2220 {
2221 int error = 0;
2222
2223 /* Validate scope */
2224 switch (scope) {
2225 case IOPOL_SCOPE_PROCESS:
2226 /* Only process OK */
2227 break;
2228 default:
2229 error = EINVAL;
2230 goto out;
2231 }
2232
2233 /* Validate policy */
2234 if (cmd == IOPOL_CMD_SET) {
2235 switch (policy) {
2236 case IOPOL_VFS_CONTENT_PROTECTION_DEFAULT:
2237 OS_FALLTHROUGH;
2238 case IOPOL_VFS_CONTENT_PROTECTION_IGNORE:
2239 /* These policies are OK */
2240 break;
2241 default:
2242 error = EINVAL;
2243 goto out;
2244 }
2245 }
2246
2247 /* Perform command */
2248 switch (cmd) {
2249 case IOPOL_CMD_SET:
2250 if (0 == kauth_cred_issuser(kauth_cred_get())) {
2251 /* If it's a non-root process, it needs to have the entitlement to set the policy */
2252 boolean_t entitled = FALSE;
2253 entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
2254 if (!entitled) {
2255 error = EPERM;
2256 goto out;
2257 }
2258 }
2259
2260 switch (policy) {
2261 case IOPOL_VFS_CONTENT_PROTECTION_DEFAULT:
2262 os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION, relaxed);
2263 break;
2264 case IOPOL_VFS_CONTENT_PROTECTION_IGNORE:
2265 os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION, relaxed);
2266 break;
2267 default:
2268 error = EINVAL;
2269 goto out;
2270 }
2271
2272 break;
2273 case IOPOL_CMD_GET:
2274 iop_param->iop_policy = (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION)
2275 ? IOPOL_VFS_CONTENT_PROTECTION_IGNORE
2276 : IOPOL_VFS_CONTENT_PROTECTION_DEFAULT;
2277 break;
2278 default:
2279 error = EINVAL; /* unknown command */
2280 break;
2281 }
2282
2283 out:
2284 return error;
2285 }
2286
2287 #define AUTHORIZED_ACCESS_ENTITLEMENT \
2288 "com.apple.private.vfs.authorized-access"
2289 int
iopolicysys_vfs_ignore_node_permissions(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2290 iopolicysys_vfs_ignore_node_permissions(struct proc *p, int cmd, int scope,
2291 int policy, __unused struct _iopol_param_t *iop_param)
2292 {
2293 int error = EINVAL;
2294
2295 switch (scope) {
2296 case IOPOL_SCOPE_PROCESS:
2297 break;
2298 default:
2299 goto out;
2300 }
2301
2302 switch (cmd) {
2303 case IOPOL_CMD_GET:
2304 policy = os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS ?
2305 IOPOL_VFS_IGNORE_PERMISSIONS_ON : IOPOL_VFS_IGNORE_PERMISSIONS_OFF;
2306 iop_param->iop_policy = policy;
2307 goto out_ok;
2308 case IOPOL_CMD_SET:
2309 /* SET is handled after the switch */
2310 break;
2311 default:
2312 goto out;
2313 }
2314
2315 if (!IOCurrentTaskHasEntitlement(AUTHORIZED_ACCESS_ENTITLEMENT)) {
2316 error = EPERM;
2317 goto out;
2318 }
2319
2320 switch (policy) {
2321 case IOPOL_VFS_IGNORE_PERMISSIONS_OFF:
2322 os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS, relaxed);
2323 break;
2324 case IOPOL_VFS_IGNORE_PERMISSIONS_ON:
2325 os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS, relaxed);
2326 break;
2327 default:
2328 break;
2329 }
2330
2331 out_ok:
2332 error = 0;
2333 out:
2334 return error;
2335 }
2336
2337 #define SKIP_MTIME_UPDATE_ENTITLEMENT \
2338 "com.apple.private.vfs.skip-mtime-updates"
2339 int
iopolicysys_vfs_skip_mtime_update(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2340 iopolicysys_vfs_skip_mtime_update(struct proc *p, int cmd, int scope,
2341 int policy, __unused struct _iopol_param_t *iop_param)
2342 {
2343 int error = EINVAL;
2344
2345 switch (scope) {
2346 case IOPOL_SCOPE_PROCESS:
2347 break;
2348 default:
2349 goto out;
2350 }
2351
2352 switch (cmd) {
2353 case IOPOL_CMD_GET:
2354 policy = os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_SKIP_MTIME_UPDATE ?
2355 IOPOL_VFS_SKIP_MTIME_UPDATE_ON : IOPOL_VFS_SKIP_MTIME_UPDATE_OFF;
2356 iop_param->iop_policy = policy;
2357 goto out_ok;
2358 case IOPOL_CMD_SET:
2359 break;
2360 default:
2361 break;
2362 }
2363
2364 if (!IOCurrentTaskHasEntitlement(SKIP_MTIME_UPDATE_ENTITLEMENT)) {
2365 error = EPERM;
2366 goto out;
2367 }
2368
2369 switch (policy) {
2370 case IOPOL_VFS_SKIP_MTIME_UPDATE_OFF:
2371 os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SKIP_MTIME_UPDATE, relaxed);
2372 break;
2373 case IOPOL_VFS_SKIP_MTIME_UPDATE_ON:
2374 os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SKIP_MTIME_UPDATE, relaxed);
2375 break;
2376 default:
2377 break;
2378 }
2379
2380 out_ok:
2381 error = 0;
2382 out:
2383 return error;
2384 }
2385
2386 #define ALLOW_LOW_SPACE_WRITES_ENTITLEMENT \
2387 "com.apple.private.vfs.allow-low-space-writes"
2388 static int
iopolicysys_vfs_allow_lowspace_writes(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2389 iopolicysys_vfs_allow_lowspace_writes(struct proc *p, int cmd, int scope,
2390 int policy, __unused struct _iopol_param_t *iop_param)
2391 {
2392 int error = EINVAL;
2393
2394 switch (scope) {
2395 case IOPOL_SCOPE_PROCESS:
2396 break;
2397 default:
2398 goto out;
2399 }
2400
2401 switch (cmd) {
2402 case IOPOL_CMD_GET:
2403 policy = os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES ?
2404 IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_ON : IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_OFF;
2405 iop_param->iop_policy = policy;
2406 goto out_ok;
2407 case IOPOL_CMD_SET:
2408 break;
2409 default:
2410 break;
2411 }
2412
2413 if (!IOCurrentTaskHasEntitlement(ALLOW_LOW_SPACE_WRITES_ENTITLEMENT)) {
2414 error = EPERM;
2415 goto out;
2416 }
2417
2418 switch (policy) {
2419 case IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_OFF:
2420 os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES, relaxed);
2421 break;
2422 case IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_ON:
2423 os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES, relaxed);
2424 break;
2425 default:
2426 break;
2427 }
2428
2429 out_ok:
2430 error = 0;
2431 out:
2432 return error;
2433 }
2434
2435
2436 /* BSD call back function for task_policy networking changes */
2437 void
proc_apply_task_networkbg(int pid,thread_t thread)2438 proc_apply_task_networkbg(int pid, thread_t thread)
2439 {
2440 proc_t p = proc_find(pid);
2441
2442 if (p != PROC_NULL) {
2443 do_background_socket(p, thread);
2444 proc_rele(p);
2445 }
2446 }
2447
2448 void
gather_rusage_info(proc_t p,rusage_info_current * ru,int flavor)2449 gather_rusage_info(proc_t p, rusage_info_current *ru, int flavor)
2450 {
2451 struct rusage_info_child *ri_child;
2452
2453 assert(p->p_stats != NULL);
2454 memset(ru, 0, sizeof(*ru));
2455 switch (flavor) {
2456 case RUSAGE_INFO_V5:
2457 #if __has_feature(ptrauth_calls)
2458 if (vm_shared_region_is_reslide(p->task)) {
2459 ru->ri_flags |= RU_PROC_RUNS_RESLIDE;
2460 }
2461 #endif /* __has_feature(ptrauth_calls) */
2462 OS_FALLTHROUGH;
2463 case RUSAGE_INFO_V4:
2464 ru->ri_logical_writes = get_task_logical_writes(p->task, FALSE);
2465 ru->ri_lifetime_max_phys_footprint = get_task_phys_footprint_lifetime_max(p->task);
2466 #if CONFIG_LEDGER_INTERVAL_MAX
2467 ru->ri_interval_max_phys_footprint = get_task_phys_footprint_interval_max(p->task, FALSE);
2468 #endif
2469 fill_task_monotonic_rusage(p->task, ru);
2470 OS_FALLTHROUGH;
2471
2472 case RUSAGE_INFO_V3:
2473 fill_task_qos_rusage(p->task, ru);
2474 fill_task_billed_usage(p->task, ru);
2475 OS_FALLTHROUGH;
2476
2477 case RUSAGE_INFO_V2:
2478 fill_task_io_rusage(p->task, ru);
2479 OS_FALLTHROUGH;
2480
2481 case RUSAGE_INFO_V1:
2482 /*
2483 * p->p_stats->ri_child statistics are protected under proc lock.
2484 */
2485 proc_lock(p);
2486
2487 ri_child = &(p->p_stats->ri_child);
2488 ru->ri_child_user_time = ri_child->ri_child_user_time;
2489 ru->ri_child_system_time = ri_child->ri_child_system_time;
2490 ru->ri_child_pkg_idle_wkups = ri_child->ri_child_pkg_idle_wkups;
2491 ru->ri_child_interrupt_wkups = ri_child->ri_child_interrupt_wkups;
2492 ru->ri_child_pageins = ri_child->ri_child_pageins;
2493 ru->ri_child_elapsed_abstime = ri_child->ri_child_elapsed_abstime;
2494
2495 proc_unlock(p);
2496 OS_FALLTHROUGH;
2497
2498 case RUSAGE_INFO_V0:
2499 proc_getexecutableuuid(p, (unsigned char *)&ru->ri_uuid, sizeof(ru->ri_uuid));
2500 fill_task_rusage(p->task, ru);
2501 ru->ri_proc_start_abstime = p->p_stats->ps_start;
2502 }
2503 }
2504
2505 int
proc_get_rusage(proc_t p,int flavor,user_addr_t buffer,__unused int is_zombie)2506 proc_get_rusage(proc_t p, int flavor, user_addr_t buffer, __unused int is_zombie)
2507 {
2508 rusage_info_current ri_current = {};
2509
2510 int error = 0;
2511 size_t size = 0;
2512
2513 switch (flavor) {
2514 case RUSAGE_INFO_V0:
2515 size = sizeof(struct rusage_info_v0);
2516 break;
2517
2518 case RUSAGE_INFO_V1:
2519 size = sizeof(struct rusage_info_v1);
2520 break;
2521
2522 case RUSAGE_INFO_V2:
2523 size = sizeof(struct rusage_info_v2);
2524 break;
2525
2526 case RUSAGE_INFO_V3:
2527 size = sizeof(struct rusage_info_v3);
2528 break;
2529
2530 case RUSAGE_INFO_V4:
2531 size = sizeof(struct rusage_info_v4);
2532 break;
2533
2534 case RUSAGE_INFO_V5:
2535 size = sizeof(struct rusage_info_v5);
2536 break;
2537 default:
2538 return EINVAL;
2539 }
2540
2541 if (size == 0) {
2542 return EINVAL;
2543 }
2544
2545 /*
2546 * If task is still alive, collect info from the live task itself.
2547 * Otherwise, look to the cached info in the zombie proc.
2548 */
2549 if (p->p_ru == NULL) {
2550 gather_rusage_info(p, &ri_current, flavor);
2551 ri_current.ri_proc_exit_abstime = 0;
2552 error = copyout(&ri_current, buffer, size);
2553 } else {
2554 ri_current = p->p_ru->ri;
2555 error = copyout(&p->p_ru->ri, buffer, size);
2556 }
2557
2558 return error;
2559 }
2560
2561 static int
mach_to_bsd_rv(int mach_rv)2562 mach_to_bsd_rv(int mach_rv)
2563 {
2564 int bsd_rv = 0;
2565
2566 switch (mach_rv) {
2567 case KERN_SUCCESS:
2568 bsd_rv = 0;
2569 break;
2570 case KERN_INVALID_ARGUMENT:
2571 bsd_rv = EINVAL;
2572 break;
2573 default:
2574 panic("unknown error %#x", mach_rv);
2575 }
2576
2577 return bsd_rv;
2578 }
2579
2580 /*
2581 * Resource limit controls
2582 *
2583 * uap->flavor available flavors:
2584 *
2585 * RLIMIT_WAKEUPS_MONITOR
2586 * RLIMIT_CPU_USAGE_MONITOR
2587 * RLIMIT_THREAD_CPULIMITS
2588 * RLIMIT_FOOTPRINT_INTERVAL
2589 */
2590 int
proc_rlimit_control(__unused struct proc * p,struct proc_rlimit_control_args * uap,__unused int32_t * retval)2591 proc_rlimit_control(__unused struct proc *p, struct proc_rlimit_control_args *uap, __unused int32_t *retval)
2592 {
2593 proc_t targetp;
2594 int error = 0;
2595 struct proc_rlimit_control_wakeupmon wakeupmon_args;
2596 uint32_t cpumon_flags;
2597 uint32_t cpulimits_flags;
2598 kauth_cred_t my_cred, target_cred;
2599 #if CONFIG_LEDGER_INTERVAL_MAX
2600 uint32_t footprint_interval_flags;
2601 uint64_t interval_max_footprint;
2602 #endif /* CONFIG_LEDGER_INTERVAL_MAX */
2603
2604 /* -1 implicitly means our own process (perhaps even the current thread for per-thread attributes) */
2605 if (uap->pid == -1) {
2606 targetp = proc_self();
2607 } else {
2608 targetp = proc_find(uap->pid);
2609 }
2610
2611 /* proc_self() can return NULL for an exiting process */
2612 if (targetp == PROC_NULL) {
2613 return ESRCH;
2614 }
2615
2616 my_cred = kauth_cred_get();
2617 target_cred = kauth_cred_proc_ref(targetp);
2618
2619 if (!kauth_cred_issuser(my_cred) && kauth_cred_getruid(my_cred) &&
2620 kauth_cred_getuid(my_cred) != kauth_cred_getuid(target_cred) &&
2621 kauth_cred_getruid(my_cred) != kauth_cred_getuid(target_cred)) {
2622 proc_rele(targetp);
2623 kauth_cred_unref(&target_cred);
2624 return EACCES;
2625 }
2626
2627 switch (uap->flavor) {
2628 case RLIMIT_WAKEUPS_MONITOR:
2629 if ((error = copyin(uap->arg, &wakeupmon_args, sizeof(wakeupmon_args))) != 0) {
2630 break;
2631 }
2632 if ((error = mach_to_bsd_rv(task_wakeups_monitor_ctl(targetp->task, &wakeupmon_args.wm_flags,
2633 &wakeupmon_args.wm_rate))) != 0) {
2634 break;
2635 }
2636 error = copyout(&wakeupmon_args, uap->arg, sizeof(wakeupmon_args));
2637 break;
2638 case RLIMIT_CPU_USAGE_MONITOR:
2639 cpumon_flags = (uint32_t)uap->arg; // XXX temporarily stashing flags in argp (12592127)
2640 error = mach_to_bsd_rv(task_cpu_usage_monitor_ctl(targetp->task, &cpumon_flags));
2641 break;
2642 case RLIMIT_THREAD_CPULIMITS:
2643 cpulimits_flags = (uint32_t)uap->arg; // only need a limited set of bits, pass in void * argument
2644
2645 if (uap->pid != -1) {
2646 error = EINVAL;
2647 break;
2648 }
2649
2650 uint8_t percent = 0;
2651 uint32_t ms_refill = 0;
2652 uint64_t ns_refill;
2653
2654 percent = (uint8_t)(cpulimits_flags & 0xffU); /* low 8 bits for percent */
2655 ms_refill = (cpulimits_flags >> 8) & 0xffffff; /* next 24 bits represent ms refill value */
2656 if (percent >= 100) {
2657 error = EINVAL;
2658 break;
2659 }
2660
2661 ns_refill = ((uint64_t)ms_refill) * NSEC_PER_MSEC;
2662
2663 error = mach_to_bsd_rv(thread_set_cpulimit(THREAD_CPULIMIT_BLOCK, percent, ns_refill));
2664 break;
2665
2666 #if CONFIG_LEDGER_INTERVAL_MAX
2667 case RLIMIT_FOOTPRINT_INTERVAL:
2668 footprint_interval_flags = (uint32_t)uap->arg; // XXX temporarily stashing flags in argp (12592127)
2669 /*
2670 * There is currently only one option for this flavor.
2671 */
2672 if ((footprint_interval_flags & FOOTPRINT_INTERVAL_RESET) == 0) {
2673 error = EINVAL;
2674 break;
2675 }
2676 interval_max_footprint = get_task_phys_footprint_interval_max(targetp->task, TRUE);
2677 break;
2678 #endif /* CONFIG_LEDGER_INTERVAL_MAX */
2679 default:
2680 error = EINVAL;
2681 break;
2682 }
2683
2684 proc_rele(targetp);
2685 kauth_cred_unref(&target_cred);
2686
2687 /*
2688 * Return value from this function becomes errno to userland caller.
2689 */
2690 return error;
2691 }
2692
2693 /*
2694 * Return the current amount of CPU consumed by this thread (in either user or kernel mode)
2695 */
2696 int
thread_selfusage(struct proc * p __unused,struct thread_selfusage_args * uap __unused,uint64_t * retval)2697 thread_selfusage(struct proc *p __unused, struct thread_selfusage_args *uap __unused, uint64_t *retval)
2698 {
2699 uint64_t runtime;
2700
2701 runtime = thread_get_runtime_self();
2702 *retval = runtime;
2703
2704 return 0;
2705 }
2706
2707 #if !MONOTONIC
2708 int
thread_selfcounts(__unused struct proc * p,__unused struct thread_selfcounts_args * uap,__unused int * ret_out)2709 thread_selfcounts(__unused struct proc *p, __unused struct thread_selfcounts_args *uap, __unused int *ret_out)
2710 {
2711 return ENOTSUP;
2712 }
2713 #endif /* !MONOTONIC */
2714