1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/file_internal.h>
51 #include <sys/ubc_internal.h>
52 #include <sys/imgact.h>
53 #include <sys/codesign.h>
54 #include <sys/proc_uuid_policy.h>
55 #include <sys/reason.h>
56 #include <sys/kdebug.h>
57 #include <sys/spawn_internal.h>
58
59 #include <mach/mach_types.h>
60 #include <mach/vm_map.h> /* vm_allocate() */
61 #include <mach/mach_vm.h> /* mach_vm_allocate() */
62 #include <mach/vm_statistics.h>
63 #include <mach/task.h>
64 #include <mach/thread_act.h>
65
66 #include <machine/vmparam.h>
67 #include <machine/exec.h>
68 #include <machine/pal_routines.h>
69
70 #include <kern/ast.h>
71 #include <kern/kern_types.h>
72 #include <kern/cpu_number.h>
73 #include <kern/mach_loader.h>
74 #include <kern/mach_fat.h>
75 #include <kern/kalloc.h>
76 #include <kern/task.h>
77 #include <kern/thread.h>
78 #include <kern/page_decrypt.h>
79
80 #include <mach-o/fat.h>
81 #include <mach-o/loader.h>
82
83 #include <vm/pmap.h>
84 #include <vm/vm_map.h>
85 #include <vm/vm_kern.h>
86 #include <vm/vm_pager.h>
87 #include <vm/vnode_pager.h>
88 #include <vm/vm_protos.h>
89 #include <vm/vm_shared_region.h>
90 #include <IOKit/IOReturn.h> /* for kIOReturnNotPrivileged */
91 #include <IOKit/IOBSD.h> /* for IOVnodeHasEntitlement */
92
93 #include <os/log.h>
94 #include <os/overflow.h>
95
96 #include "kern_exec_internal.h"
97
98 /* XXX should have prototypes in a shared header file */
99 extern int get_map_nentries(vm_map_t);
100
101 extern kern_return_t memory_object_signed(memory_object_control_t control,
102 boolean_t is_signed);
103
104
105 /* An empty load_result_t */
106 static const load_result_t load_result_null = {
107 .mach_header = MACH_VM_MIN_ADDRESS,
108 .entry_point = MACH_VM_MIN_ADDRESS,
109 .user_stack = MACH_VM_MIN_ADDRESS,
110 .user_stack_size = 0,
111 .user_stack_alloc = MACH_VM_MIN_ADDRESS,
112 .user_stack_alloc_size = 0,
113 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
114 .all_image_info_size = 0,
115 .thread_count = 0,
116 .unixproc = 0,
117 .dynlinker = 0,
118 .needs_dynlinker = 0,
119 .validentry = 0,
120 .using_lcmain = 0,
121 .is_64bit_addr = 0,
122 .is_64bit_data = 0,
123 .custom_stack = 0,
124 .csflags = 0,
125 .has_pagezero = 0,
126 .uuid = { 0 },
127 .min_vm_addr = MACH_VM_MAX_ADDRESS,
128 .max_vm_addr = MACH_VM_MIN_ADDRESS,
129 .cs_end_offset = 0,
130 .threadstate = NULL,
131 .threadstate_sz = 0,
132 .is_cambria = 0,
133 .dynlinker_mach_header = MACH_VM_MIN_ADDRESS,
134 .dynlinker_fd = -1,
135 };
136
137 /*
138 * Prototypes of static functions.
139 */
140 static load_return_t
141 parse_machfile(
142 struct vnode *vp,
143 vm_map_t map,
144 thread_t thread,
145 struct mach_header *header,
146 off_t file_offset,
147 off_t macho_size,
148 int depth,
149 int64_t slide,
150 int64_t dyld_slide,
151 load_result_t *result,
152 load_result_t *binresult,
153 struct image_params *imgp
154 );
155
156 static load_return_t
157 load_segment(
158 struct load_command *lcp,
159 uint32_t filetype,
160 void *control,
161 off_t pager_offset,
162 off_t macho_size,
163 struct vnode *vp,
164 vm_map_t map,
165 int64_t slide,
166 load_result_t *result,
167 struct image_params *imgp
168 );
169
170 static load_return_t
171 load_uuid(
172 struct uuid_command *uulp,
173 char *command_end,
174 load_result_t *result
175 );
176
177 static load_return_t
178 load_version(
179 struct version_min_command *vmc,
180 boolean_t *found_version_cmd,
181 int ip_flags,
182 load_result_t *result
183 );
184
185 static load_return_t
186 load_code_signature(
187 struct linkedit_data_command *lcp,
188 struct vnode *vp,
189 off_t macho_offset,
190 off_t macho_size,
191 cpu_type_t cputype,
192 cpu_subtype_t cpusubtype,
193 load_result_t *result,
194 struct image_params *imgp);
195
196 #if CONFIG_CODE_DECRYPTION
197 static load_return_t
198 set_code_unprotect(
199 struct encryption_info_command *lcp,
200 caddr_t addr,
201 vm_map_t map,
202 int64_t slide,
203 struct vnode *vp,
204 off_t macho_offset,
205 cpu_type_t cputype,
206 cpu_subtype_t cpusubtype);
207 #endif
208
209 static
210 load_return_t
211 load_main(
212 struct entry_point_command *epc,
213 thread_t thread,
214 int64_t slide,
215 load_result_t *result
216 );
217
218 static
219 load_return_t
220 setup_driver_main(
221 thread_t thread,
222 int64_t slide,
223 load_result_t *result
224 );
225
226 static load_return_t
227 load_unixthread(
228 struct thread_command *tcp,
229 thread_t thread,
230 int64_t slide,
231 boolean_t is_x86_64_compat_binary,
232 load_result_t *result
233 );
234
235 static load_return_t
236 load_threadstate(
237 thread_t thread,
238 uint32_t *ts,
239 uint32_t total_size,
240 load_result_t *
241 );
242
243 static load_return_t
244 load_threadstack(
245 thread_t thread,
246 uint32_t *ts,
247 uint32_t total_size,
248 mach_vm_offset_t *user_stack,
249 int *customstack,
250 boolean_t is_x86_64_compat_binary,
251 load_result_t *result
252 );
253
254 static load_return_t
255 load_threadentry(
256 thread_t thread,
257 uint32_t *ts,
258 uint32_t total_size,
259 mach_vm_offset_t *entry_point
260 );
261
262 static load_return_t
263 load_dylinker(
264 struct dylinker_command *lcp,
265 integer_t archbits,
266 vm_map_t map,
267 thread_t thread,
268 int depth,
269 int64_t slide,
270 load_result_t *result,
271 struct image_params *imgp
272 );
273
274
275 #if __x86_64__
276 extern int bootarg_no32exec;
277 static boolean_t
278 check_if_simulator_binary(
279 struct image_params *imgp,
280 off_t file_offset,
281 off_t macho_size);
282 #endif
283
284 struct macho_data;
285
286 static load_return_t
287 get_macho_vnode(
288 const char *path,
289 integer_t archbits,
290 struct mach_header *mach_header,
291 off_t *file_offset,
292 off_t *macho_size,
293 struct macho_data *macho_data,
294 struct vnode **vpp,
295 struct image_params *imgp
296 );
297
298 static inline void
widen_segment_command(const struct segment_command * scp32,struct segment_command_64 * scp)299 widen_segment_command(const struct segment_command *scp32,
300 struct segment_command_64 *scp)
301 {
302 scp->cmd = scp32->cmd;
303 scp->cmdsize = scp32->cmdsize;
304 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
305 scp->vmaddr = scp32->vmaddr;
306 scp->vmsize = scp32->vmsize;
307 scp->fileoff = scp32->fileoff;
308 scp->filesize = scp32->filesize;
309 scp->maxprot = scp32->maxprot;
310 scp->initprot = scp32->initprot;
311 scp->nsects = scp32->nsects;
312 scp->flags = scp32->flags;
313 }
314
315 static void
note_all_image_info_section(const struct segment_command_64 * scp,boolean_t is64,size_t section_size,const void * sections,int64_t slide,load_result_t * result)316 note_all_image_info_section(const struct segment_command_64 *scp,
317 boolean_t is64, size_t section_size, const void *sections,
318 int64_t slide, load_result_t *result)
319 {
320 const union {
321 struct section s32;
322 struct section_64 s64;
323 } *sectionp;
324 unsigned int i;
325
326
327 if (strncmp(scp->segname, "__DATA_DIRTY", sizeof(scp->segname)) != 0 &&
328 strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0) {
329 return;
330 }
331 for (i = 0; i < scp->nsects; ++i) {
332 sectionp = (const void *)
333 ((const char *)sections + section_size * i);
334 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
335 sizeof(sectionp->s64.sectname))) {
336 result->all_image_info_addr =
337 is64 ? sectionp->s64.addr : sectionp->s32.addr;
338 result->all_image_info_addr += slide;
339 result->all_image_info_size =
340 is64 ? sectionp->s64.size : sectionp->s32.size;
341 return;
342 }
343 }
344 }
345
346 #if __arm64__
347 /*
348 * Allow bypassing some security rules (hard pagezero, no write+execute)
349 * in exchange for better binary compatibility for legacy apps built
350 * before 16KB-alignment was enforced.
351 */
352 const int fourk_binary_compatibility_unsafe = TRUE;
353 const int fourk_binary_compatibility_allow_wx = FALSE;
354 #endif /* __arm64__ */
355
356 #if __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX
357 /**
358 * Determines whether this is an arm64e process which may host in-process
359 * plugins.
360 */
361 static inline bool
arm64e_plugin_host(struct image_params * imgp,load_result_t * result)362 arm64e_plugin_host(struct image_params *imgp, load_result_t *result)
363 {
364 if (imgp->ip_flags & IMGPF_NOJOP) {
365 return false;
366 }
367
368 if (!result->platform_binary) {
369 return false;
370 }
371
372 struct cs_blob *csblob = csvnode_get_blob(imgp->ip_vp, imgp->ip_arch_offset);
373 const char *identity = csblob_get_identity(csblob);
374 if (!identity) {
375 return false;
376 }
377
378 /* Check if override host plugin entitlement is present and posix spawn attribute to disable A keys is passed */
379 if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, OVERRIDE_PLUGIN_HOST_ENTITLEMENT)) {
380 bool ret = imgp->ip_flags & IMGPF_PLUGIN_HOST_DISABLE_A_KEYS;
381 if (ret) {
382 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
383 set_proc_name(imgp, p);
384 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to posix_spawnattr_disable_ptr_auth_a_keys_np", __func__, p->p_name);
385 }
386 return ret;
387 }
388
389 /* Disabling library validation is a good signal that this process plans to host plugins */
390 const char *const disable_lv_entitlements[] = {
391 "com.apple.security.cs.disable-library-validation",
392 "com.apple.private.cs.automator-plugins",
393 CLEAR_LV_ENTITLEMENT,
394 };
395 for (size_t i = 0; i < ARRAY_COUNT(disable_lv_entitlements); i++) {
396 const char *entitlement = disable_lv_entitlements[i];
397 if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, entitlement)) {
398 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
399 set_proc_name(imgp, p);
400 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to entitlement: %s", __func__, p->p_name, entitlement);
401 return true;
402 }
403 }
404
405 /* From /System/Library/Security/HardeningExceptions.plist */
406 const char *const hardening_exceptions[] = {
407 "com.apple.perl5", /* Scripting engines may load third party code and jit*/
408 "com.apple.perl", /* Scripting engines may load third party code and jit*/
409 "org.python.python", /* Scripting engines may load third party code and jit*/
410 "com.apple.expect", /* Scripting engines may load third party code and jit*/
411 "com.tcltk.wish", /* Scripting engines may load third party code and jit*/
412 "com.tcltk.tclsh", /* Scripting engines may load third party code and jit*/
413 "com.apple.ruby", /* Scripting engines may load third party code and jit*/
414 "com.apple.bash", /* Required for the 'enable' command */
415 "com.apple.zsh", /* Required for the 'zmodload' command */
416 "com.apple.ksh", /* Required for 'builtin' command */
417 };
418 for (size_t i = 0; i < ARRAY_COUNT(hardening_exceptions); i++) {
419 if (strncmp(hardening_exceptions[i], identity, strlen(hardening_exceptions[i])) == 0) {
420 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
421 set_proc_name(imgp, p);
422 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to identity: %s", __func__, p->p_name, identity);
423 return true;
424 }
425 }
426
427 return false;
428 }
429 #endif /* __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX */
430
431 load_return_t
load_machfile(struct image_params * imgp,struct mach_header * header,thread_t thread,vm_map_t * mapp,load_result_t * result)432 load_machfile(
433 struct image_params *imgp,
434 struct mach_header *header,
435 thread_t thread,
436 vm_map_t *mapp,
437 load_result_t *result
438 )
439 {
440 struct vnode *vp = imgp->ip_vp;
441 off_t file_offset = imgp->ip_arch_offset;
442 off_t macho_size = imgp->ip_arch_size;
443 off_t total_size = 0;
444 off_t file_size = imgp->ip_vattr->va_data_size;
445 pmap_t pmap = 0; /* protected by create_map */
446 vm_map_t map;
447 load_result_t myresult;
448 load_return_t lret;
449 boolean_t enforce_hard_pagezero = TRUE;
450 int in_exec = (imgp->ip_flags & IMGPF_EXEC);
451 task_t task = current_task();
452 int64_t aslr_page_offset = 0;
453 int64_t dyld_aslr_page_offset = 0;
454 int64_t aslr_section_size = 0;
455 int64_t aslr_section_offset = 0;
456 kern_return_t kret;
457 unsigned int pmap_flags = 0;
458
459 if (os_add_overflow(file_offset, macho_size, &total_size) ||
460 total_size > file_size) {
461 return LOAD_BADMACHO;
462 }
463
464 result->is_64bit_addr = ((imgp->ip_flags & IMGPF_IS_64BIT_ADDR) == IMGPF_IS_64BIT_ADDR);
465 result->is_64bit_data = ((imgp->ip_flags & IMGPF_IS_64BIT_DATA) == IMGPF_IS_64BIT_DATA);
466 #if defined(HAS_APPLE_PAC)
467 pmap_flags |= (imgp->ip_flags & IMGPF_NOJOP) ? PMAP_CREATE_DISABLE_JOP : 0;
468 #endif /* defined(HAS_APPLE_PAC) */
469 pmap_flags |= result->is_64bit_addr ? PMAP_CREATE_64BIT : 0;
470
471 task_t ledger_task;
472 if (imgp->ip_new_thread) {
473 ledger_task = get_threadtask(imgp->ip_new_thread);
474 } else {
475 ledger_task = task;
476 }
477
478 #if XNU_TARGET_OS_OSX && _POSIX_SPAWN_FORCE_4K_PAGES && PMAP_CREATE_FORCE_4K_PAGES
479 if (imgp->ip_px_sa != NULL) {
480 struct _posix_spawnattr* psa = (struct _posix_spawnattr *) imgp->ip_px_sa;
481 if (psa->psa_flags & _POSIX_SPAWN_FORCE_4K_PAGES) {
482 pmap_flags |= PMAP_CREATE_FORCE_4K_PAGES;
483 }
484 }
485 #endif /* XNU_TARGET_OS_OSX && _POSIX_SPAWN_FORCE_4K_PAGES && PMAP_CREATE_FORCE_4K_PAGE */
486
487 pmap = pmap_create_options(get_task_ledger(ledger_task),
488 (vm_map_size_t) 0,
489 pmap_flags);
490 if (pmap == NULL) {
491 return LOAD_RESOURCE;
492 }
493 map = vm_map_create(pmap,
494 0,
495 vm_compute_max_offset(result->is_64bit_addr),
496 TRUE);
497
498 #if defined(__arm64__)
499 if (result->is_64bit_addr) {
500 /* enforce 16KB alignment of VM map entries */
501 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
502 } else {
503 vm_map_set_page_shift(map, page_shift_user32);
504 }
505 #elif (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
506 /* enforce 16KB alignment for watch targets with new ABI */
507 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
508 #endif /* __arm64__ */
509
510 #if PMAP_CREATE_FORCE_4K_PAGES
511 if (pmap_flags & PMAP_CREATE_FORCE_4K_PAGES) {
512 DEBUG4K_LIFE("***** launching '%s' as 4k *****\n", vp->v_name);
513 vm_map_set_page_shift(map, FOURK_PAGE_SHIFT);
514 }
515 #endif /* PMAP_CREATE_FORCE_4K_PAGES */
516
517 #ifndef CONFIG_ENFORCE_SIGNED_CODE
518 /* This turns off faulting for executable pages, which allows
519 * to circumvent Code Signing Enforcement. The per process
520 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
521 * global flag.
522 */
523 if (!cs_process_global_enforcement() && (header->flags & MH_ALLOW_STACK_EXECUTION)) {
524 vm_map_disable_NX(map);
525 // TODO: Message Trace or log that this is happening
526 }
527 #endif
528
529 /* Forcibly disallow execution from data pages on even if the arch
530 * normally permits it. */
531 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC)) {
532 vm_map_disallow_data_exec(map);
533 }
534
535 /*
536 * Compute a random offset for ASLR, and an independent random offset for dyld.
537 */
538 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
539 vm_map_get_max_aslr_slide_section(map, &aslr_section_offset, &aslr_section_size);
540 aslr_section_offset = (random() % aslr_section_offset) * aslr_section_size;
541
542 aslr_page_offset = random();
543 aslr_page_offset = (aslr_page_offset % (vm_map_get_max_aslr_slide_pages(map) - 1)) + 1;
544 aslr_page_offset <<= vm_map_page_shift(map);
545
546 dyld_aslr_page_offset = random();
547 dyld_aslr_page_offset = (dyld_aslr_page_offset %
548 (vm_map_get_max_loader_aslr_slide_pages(map) - 1)) + 1;
549 dyld_aslr_page_offset <<= vm_map_page_shift(map);
550
551 aslr_page_offset += aslr_section_offset;
552 }
553 if (vm_map_page_shift(map) < (int)PAGE_SHIFT) {
554 DEBUG4K_LOAD("slide=0x%llx dyld_slide=0x%llx\n", aslr_page_offset, dyld_aslr_page_offset);
555 }
556
557 if (!result) {
558 result = &myresult;
559 }
560
561 *result = load_result_null;
562
563 /*
564 * re-set the bitness on the load result since we cleared the load result above.
565 */
566 result->is_64bit_addr = ((imgp->ip_flags & IMGPF_IS_64BIT_ADDR) == IMGPF_IS_64BIT_ADDR);
567 result->is_64bit_data = ((imgp->ip_flags & IMGPF_IS_64BIT_DATA) == IMGPF_IS_64BIT_DATA);
568
569 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
570 0, aslr_page_offset, dyld_aslr_page_offset, result,
571 NULL, imgp);
572
573 if (lret != LOAD_SUCCESS) {
574 vm_map_deallocate(map); /* will lose pmap reference too */
575 return lret;
576 }
577
578 #if __x86_64__
579 /*
580 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
581 */
582 if (!result->is_64bit_addr) {
583 enforce_hard_pagezero = FALSE;
584 }
585
586 /*
587 * For processes with IMGPF_HIGH_BITS_ASLR, add a few random high bits
588 * to the start address for "anywhere" memory allocations.
589 */
590 #define VM_MAP_HIGH_START_BITS_COUNT 8
591 #define VM_MAP_HIGH_START_BITS_SHIFT 27
592 if (result->is_64bit_addr &&
593 (imgp->ip_flags & IMGPF_HIGH_BITS_ASLR)) {
594 int random_bits;
595 vm_map_offset_t high_start;
596
597 random_bits = random();
598 random_bits &= (1 << VM_MAP_HIGH_START_BITS_COUNT) - 1;
599 high_start = (((vm_map_offset_t)random_bits)
600 << VM_MAP_HIGH_START_BITS_SHIFT);
601 vm_map_set_high_start(map, high_start);
602 }
603 #endif /* __x86_64__ */
604
605 /*
606 * Check to see if the page zero is enforced by the map->min_offset.
607 */
608 if (enforce_hard_pagezero &&
609 (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
610 #if __arm64__
611 if (
612 !result->is_64bit_addr && /* not 64-bit address space */
613 !(header->flags & MH_PIE) && /* not PIE */
614 (vm_map_page_shift(map) != FOURK_PAGE_SHIFT ||
615 PAGE_SHIFT != FOURK_PAGE_SHIFT) && /* page size != 4KB */
616 result->has_pagezero && /* has a "soft" page zero */
617 fourk_binary_compatibility_unsafe) {
618 /*
619 * For backwards compatibility of "4K" apps on
620 * a 16K system, do not enforce a hard page zero...
621 */
622 } else
623 #endif /* __arm64__ */
624 {
625 vm_map_deallocate(map); /* will lose pmap reference too */
626 return LOAD_BADMACHO;
627 }
628 }
629
630 #if __arm64__
631 if (enforce_hard_pagezero && result->is_64bit_addr && (header->cputype == CPU_TYPE_ARM64)) {
632 /* 64 bit ARM binary must have "hard page zero" of 4GB to cover the lower 32 bit address space */
633 if (vm_map_has_hard_pagezero(map, 0x100000000) == FALSE) {
634 vm_map_deallocate(map); /* will lose pmap reference too */
635 return LOAD_BADMACHO;
636 }
637 }
638 #endif
639
640 vm_commit_pagezero_status(map);
641
642 /*
643 * If this is an exec, then we are going to destroy the old
644 * task, and it's correct to halt it; if it's spawn, the
645 * task is not yet running, and it makes no sense.
646 */
647 if (in_exec) {
648 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
649 /*
650 * Mark the task as halting and start the other
651 * threads towards terminating themselves. Then
652 * make sure any threads waiting for a process
653 * transition get informed that we are committed to
654 * this transition, and then finally complete the
655 * task halting (wait for threads and then cleanup
656 * task resources).
657 *
658 * NOTE: task_start_halt() makes sure that no new
659 * threads are created in the task during the transition.
660 * We need to mark the workqueue as exiting before we
661 * wait for threads to terminate (at the end of which
662 * we no longer have a prohibition on thread creation).
663 *
664 * Finally, clean up any lingering workqueue data structures
665 * that may have been left behind by the workqueue threads
666 * as they exited (and then clean up the work queue itself).
667 */
668 kret = task_start_halt(task);
669 if (kret != KERN_SUCCESS) {
670 vm_map_deallocate(map); /* will lose pmap reference too */
671 return LOAD_FAILURE;
672 }
673 proc_transcommit(p, 0);
674 workq_mark_exiting(p);
675 task_complete_halt(task);
676 workq_exit(p);
677
678 /*
679 * Roll up accounting info to new task. The roll up is done after
680 * task_complete_halt to make sure the thread accounting info is
681 * rolled up to current_task.
682 */
683 task_rollup_accounting_info(get_threadtask(thread), task);
684 }
685 *mapp = map;
686
687 #if __has_feature(ptrauth_calls) && defined(XNU_TARGET_OS_OSX)
688 /*
689 * arm64e plugin hosts currently run with JOP keys disabled, since they
690 * may need to run arm64 plugins.
691 */
692 if (arm64e_plugin_host(imgp, result)) {
693 imgp->ip_flags |= IMGPF_NOJOP;
694 pmap_disable_user_jop(pmap);
695 }
696 #endif /* __has_feature(ptrauth_calls) && defined(XNU_TARGET_OS_OSX) */
697
698
699 #ifdef CONFIG_32BIT_TELEMETRY
700 if (!result->is_64bit_data) {
701 /*
702 * This may not need to be an AST; we merely need to ensure that
703 * we gather telemetry at the point where all of the information
704 * that we want has been added to the process.
705 */
706 task_set_32bit_log_flag(get_threadtask(thread));
707 act_set_astbsd(thread);
708 }
709 #endif /* CONFIG_32BIT_TELEMETRY */
710
711 return LOAD_SUCCESS;
712 }
713
714 int macho_printf = 0;
715 #define MACHO_PRINTF(args) \
716 do { \
717 if (macho_printf) { \
718 printf args; \
719 } \
720 } while (0)
721
722
723 static boolean_t
pie_required(cpu_type_t exectype,cpu_subtype_t execsubtype)724 pie_required(
725 cpu_type_t exectype,
726 cpu_subtype_t execsubtype)
727 {
728 switch (exectype) {
729 case CPU_TYPE_X86_64:
730 return FALSE;
731 case CPU_TYPE_ARM64:
732 return TRUE;
733 case CPU_TYPE_ARM:
734 switch (execsubtype) {
735 case CPU_SUBTYPE_ARM_V7K:
736 return TRUE;
737 }
738 break;
739 }
740 return FALSE;
741 }
742
743 /*
744 * The file size of a mach-o file is limited to 32 bits; this is because
745 * this is the limit on the kalloc() of enough bytes for a mach_header and
746 * the contents of its sizeofcmds, which is currently constrained to 32
747 * bits in the file format itself. We read into the kernel buffer the
748 * commands section, and then parse it in order to parse the mach-o file
749 * format load_command segment(s). We are only interested in a subset of
750 * the total set of possible commands. If "map"==VM_MAP_NULL or
751 * "thread"==THREAD_NULL, do not make permament VM modifications,
752 * just preflight the parse.
753 */
754 static
755 load_return_t
parse_machfile(struct vnode * vp,vm_map_t map,thread_t thread,struct mach_header * header,off_t file_offset,off_t macho_size,int depth,int64_t aslr_offset,int64_t dyld_aslr_offset,load_result_t * result,load_result_t * binresult,struct image_params * imgp)756 parse_machfile(
757 struct vnode *vp,
758 vm_map_t map,
759 thread_t thread,
760 struct mach_header *header,
761 off_t file_offset,
762 off_t macho_size,
763 int depth,
764 int64_t aslr_offset,
765 int64_t dyld_aslr_offset,
766 load_result_t *result,
767 load_result_t *binresult,
768 struct image_params *imgp
769 )
770 {
771 uint32_t ncmds;
772 struct load_command *lcp;
773 struct dylinker_command *dlp = 0;
774 void * control;
775 load_return_t ret = LOAD_SUCCESS;
776 void * addr;
777 vm_size_t alloc_size, cmds_size;
778 size_t offset;
779 size_t oldoffset; /* for overflow check */
780 int pass;
781 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
782 int error;
783 int resid = 0;
784 int spawn = (imgp->ip_flags & IMGPF_SPAWN);
785 size_t mach_header_sz = sizeof(struct mach_header);
786 boolean_t abi64;
787 boolean_t got_code_signatures = FALSE;
788 boolean_t found_header_segment = FALSE;
789 boolean_t found_xhdr = FALSE;
790 boolean_t found_version_cmd = FALSE;
791 int64_t slide = 0;
792 boolean_t dyld_no_load_addr = FALSE;
793 boolean_t is_dyld = FALSE;
794 vm_map_offset_t effective_page_mask = PAGE_MASK;
795 #if __arm64__
796 uint64_t pagezero_end = 0;
797 uint64_t executable_end = 0;
798 uint64_t writable_start = 0;
799 vm_map_size_t effective_page_size;
800
801 effective_page_mask = vm_map_page_mask(map);
802 effective_page_size = vm_map_page_size(map);
803 #endif /* __arm64__ */
804
805 if (header->magic == MH_MAGIC_64 ||
806 header->magic == MH_CIGAM_64) {
807 mach_header_sz = sizeof(struct mach_header_64);
808 }
809
810 /*
811 * Break infinite recursion
812 */
813 if (depth > 2) {
814 return LOAD_FAILURE;
815 }
816
817 depth++;
818
819 /*
820 * Set CS_NO_UNTRUSTED_HELPERS by default; load_dylinker and load_rosetta
821 * will unset it if necessary.
822 */
823 if (depth == 1) {
824 result->csflags |= CS_NO_UNTRUSTED_HELPERS;
825 }
826
827 /*
828 * Check to see if right machine type.
829 */
830 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK))
831 ) {
832 return LOAD_BADARCH;
833 }
834
835 if (!grade_binary(header->cputype,
836 header->cpusubtype & ~CPU_SUBTYPE_MASK,
837 header->cpusubtype & CPU_SUBTYPE_MASK, TRUE)) {
838 return LOAD_BADARCH;
839 }
840
841 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
842
843 switch (header->filetype) {
844 case MH_EXECUTE:
845 if (depth != 1 && depth != 3) {
846 return LOAD_FAILURE;
847 }
848 if (header->flags & MH_DYLDLINK) {
849 /* Check properties of dynamic executables */
850 if (!(header->flags & MH_PIE) && pie_required(header->cputype, header->cpusubtype & ~CPU_SUBTYPE_MASK)) {
851 return LOAD_FAILURE;
852 }
853 result->needs_dynlinker = TRUE;
854 } else if (header->cputype == CPU_TYPE_X86_64) {
855 /* x86_64 static binaries allowed */
856 } else {
857 /* Check properties of static executables (disallowed except for development) */
858 #if !(DEVELOPMENT || DEBUG)
859 return LOAD_FAILURE;
860 #endif
861 }
862 break;
863 case MH_DYLINKER:
864 if (depth != 2) {
865 return LOAD_FAILURE;
866 }
867 is_dyld = TRUE;
868 break;
869
870 default:
871 return LOAD_FAILURE;
872 }
873
874 /*
875 * For PIE and dyld, slide everything by the ASLR offset.
876 */
877 if ((header->flags & MH_PIE) || is_dyld) {
878 slide = aslr_offset;
879 }
880
881 /*
882 * Get the pager for the file.
883 */
884 control = ubc_getobject(vp, UBC_FLAGS_NONE);
885
886 /* ensure header + sizeofcmds falls within the file */
887 if (os_add_overflow(mach_header_sz, header->sizeofcmds, &cmds_size) ||
888 (off_t)cmds_size > macho_size ||
889 round_page_overflow(cmds_size, &alloc_size) ||
890 alloc_size > INT_MAX) {
891 return LOAD_BADMACHO;
892 }
893
894 /*
895 * Map the load commands into kernel memory.
896 */
897 addr = kalloc_data(alloc_size, Z_WAITOK);
898 if (addr == NULL) {
899 return LOAD_NOSPACE;
900 }
901
902 error = vn_rdwr(UIO_READ, vp, addr, (int)alloc_size, file_offset,
903 UIO_SYSSPACE, 0, vfs_context_ucred(imgp->ip_vfs_context), &resid, p);
904 if (error) {
905 kfree_data(addr, alloc_size);
906 return LOAD_IOERROR;
907 }
908
909 if (resid) {
910 {
911 /* We must be able to read in as much as the mach_header indicated */
912 kfree_data(addr, alloc_size);
913 return LOAD_BADMACHO;
914 }
915 }
916
917 /*
918 * Scan through the commands, processing each one as necessary.
919 * We parse in three passes through the headers:
920 * 0: determine if TEXT and DATA boundary can be page-aligned, load platform version
921 * 1: thread state, uuid, code signature
922 * 2: segments
923 * 3: dyld, encryption, check entry point
924 */
925
926 boolean_t slide_realign = FALSE;
927 #if __arm64__
928 if (!abi64) {
929 slide_realign = TRUE;
930 }
931 #endif
932
933 for (pass = 0; pass <= 3; pass++) {
934 if (pass == 1) {
935 #if __arm64__
936 boolean_t is_pie;
937 int64_t adjust;
938
939 is_pie = ((header->flags & MH_PIE) != 0);
940 if (pagezero_end != 0 &&
941 pagezero_end < effective_page_size) {
942 /* need at least 1 page for PAGEZERO */
943 adjust = effective_page_size;
944 MACHO_PRINTF(("pagezero boundary at "
945 "0x%llx; adjust slide from "
946 "0x%llx to 0x%llx%s\n",
947 (uint64_t) pagezero_end,
948 slide,
949 slide + adjust,
950 (is_pie
951 ? ""
952 : " BUT NO PIE ****** :-(")));
953 if (is_pie) {
954 slide += adjust;
955 pagezero_end += adjust;
956 executable_end += adjust;
957 writable_start += adjust;
958 }
959 }
960 if (pagezero_end != 0) {
961 result->has_pagezero = TRUE;
962 }
963 if (executable_end == writable_start &&
964 (executable_end & effective_page_mask) != 0 &&
965 (executable_end & FOURK_PAGE_MASK) == 0) {
966 /*
967 * The TEXT/DATA boundary is 4K-aligned but
968 * not page-aligned. Adjust the slide to make
969 * it page-aligned and avoid having a page
970 * with both write and execute permissions.
971 */
972 adjust =
973 (effective_page_size -
974 (executable_end & effective_page_mask));
975 MACHO_PRINTF(("page-unaligned X-W boundary at "
976 "0x%llx; adjust slide from "
977 "0x%llx to 0x%llx%s\n",
978 (uint64_t) executable_end,
979 slide,
980 slide + adjust,
981 (is_pie
982 ? ""
983 : " BUT NO PIE ****** :-(")));
984 if (is_pie) {
985 slide += adjust;
986 }
987 }
988 #endif /* __arm64__ */
989
990 if (dyld_no_load_addr && binresult) {
991 /*
992 * The dyld Mach-O does not specify a load address. Try to locate
993 * it right after the main binary. If binresult == NULL, load
994 * directly to the given slide.
995 */
996 mach_vm_address_t max_vm_addr = binresult->max_vm_addr;
997 slide = vm_map_round_page(slide + max_vm_addr, effective_page_mask);
998 }
999 }
1000
1001 /*
1002 * Check that the entry point is contained in an executable segment
1003 */
1004 if ((pass == 3) && (thread != THREAD_NULL)) {
1005 if (depth == 1 && imgp && (imgp->ip_flags & IMGPF_DRIVER)) {
1006 /* Driver binaries must have driverkit platform */
1007 if (result->ip_platform == PLATFORM_DRIVERKIT) {
1008 /* Driver binaries have no entry point */
1009 ret = setup_driver_main(thread, slide, result);
1010 } else {
1011 ret = LOAD_FAILURE;
1012 }
1013 } else if (!result->using_lcmain && result->validentry == 0) {
1014 ret = LOAD_FAILURE;
1015 }
1016 if (ret != KERN_SUCCESS) {
1017 thread_state_initialize(thread);
1018 break;
1019 }
1020 }
1021
1022 /*
1023 * Check that some segment maps the start of the mach-o file, which is
1024 * needed by the dynamic loader to read the mach headers, etc.
1025 */
1026 if ((pass == 3) && (found_header_segment == FALSE)) {
1027 ret = LOAD_BADMACHO;
1028 break;
1029 }
1030
1031 /*
1032 * Loop through each of the load_commands indicated by the
1033 * Mach-O header; if an absurd value is provided, we just
1034 * run off the end of the reserved section by incrementing
1035 * the offset too far, so we are implicitly fail-safe.
1036 */
1037 offset = mach_header_sz;
1038 ncmds = header->ncmds;
1039
1040 while (ncmds--) {
1041 /* ensure enough space for a minimal load command */
1042 if (offset + sizeof(struct load_command) > cmds_size) {
1043 ret = LOAD_BADMACHO;
1044 break;
1045 }
1046
1047 /*
1048 * Get a pointer to the command.
1049 */
1050 lcp = (struct load_command *)((uintptr_t)addr + offset);
1051 oldoffset = offset;
1052
1053 /*
1054 * Perform prevalidation of the struct load_command
1055 * before we attempt to use its contents. Invalid
1056 * values are ones which result in an overflow, or
1057 * which can not possibly be valid commands, or which
1058 * straddle or exist past the reserved section at the
1059 * start of the image.
1060 */
1061 if (os_add_overflow(offset, lcp->cmdsize, &offset) ||
1062 lcp->cmdsize < sizeof(struct load_command) ||
1063 offset > cmds_size) {
1064 ret = LOAD_BADMACHO;
1065 break;
1066 }
1067
1068 /*
1069 * Act on struct load_command's for which kernel
1070 * intervention is required.
1071 * Note that each load command implementation is expected to validate
1072 * that lcp->cmdsize is large enough to fit its specific struct type
1073 * before dereferencing fields not covered by struct load_command.
1074 */
1075 switch (lcp->cmd) {
1076 case LC_SEGMENT: {
1077 struct segment_command *scp = (struct segment_command *) lcp;
1078 if (scp->cmdsize < sizeof(*scp)) {
1079 ret = LOAD_BADMACHO;
1080 break;
1081 }
1082 if (pass == 0) {
1083 if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
1084 dyld_no_load_addr = TRUE;
1085 if (!slide_realign) {
1086 /* got what we need, bail early on pass 0 */
1087 continue;
1088 }
1089 }
1090
1091 #if __arm64__
1092 assert(!abi64);
1093
1094 if (scp->initprot == 0 && scp->maxprot == 0 && scp->vmaddr == 0) {
1095 /* PAGEZERO */
1096 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &pagezero_end) || pagezero_end > UINT32_MAX) {
1097 ret = LOAD_BADMACHO;
1098 break;
1099 }
1100 }
1101 if (scp->initprot & VM_PROT_EXECUTE) {
1102 /* TEXT */
1103 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &executable_end) || executable_end > UINT32_MAX) {
1104 ret = LOAD_BADMACHO;
1105 break;
1106 }
1107 }
1108 if (scp->initprot & VM_PROT_WRITE) {
1109 /* DATA */
1110 if (os_add_overflow(scp->vmaddr, slide, &writable_start) || writable_start > UINT32_MAX) {
1111 ret = LOAD_BADMACHO;
1112 break;
1113 }
1114 }
1115 #endif /* __arm64__ */
1116 break;
1117 }
1118
1119 if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
1120 found_xhdr = TRUE;
1121 }
1122
1123 if (pass != 2) {
1124 break;
1125 }
1126
1127 if (abi64) {
1128 /*
1129 * Having an LC_SEGMENT command for the
1130 * wrong ABI is invalid <rdar://problem/11021230>
1131 */
1132 ret = LOAD_BADMACHO;
1133 break;
1134 }
1135
1136 ret = load_segment(lcp,
1137 header->filetype,
1138 control,
1139 file_offset,
1140 macho_size,
1141 vp,
1142 map,
1143 slide,
1144 result,
1145 imgp);
1146 if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
1147 /* Enforce a single segment mapping offset zero, with R+X
1148 * protection. */
1149 if (found_header_segment ||
1150 ((scp->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) != (VM_PROT_READ | VM_PROT_EXECUTE))) {
1151 ret = LOAD_BADMACHO;
1152 break;
1153 }
1154 found_header_segment = TRUE;
1155 }
1156
1157 break;
1158 }
1159 case LC_SEGMENT_64: {
1160 struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
1161 if (scp64->cmdsize < sizeof(*scp64)) {
1162 ret = LOAD_BADMACHO;
1163 break;
1164 }
1165 if (pass == 0) {
1166 if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
1167 dyld_no_load_addr = TRUE;
1168 }
1169 /* got what we need, bail early on pass 0 */
1170 continue;
1171 }
1172
1173 if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
1174 found_xhdr = TRUE;
1175 }
1176
1177 if (pass != 2) {
1178 break;
1179 }
1180
1181 if (!abi64) {
1182 /*
1183 * Having an LC_SEGMENT_64 command for the
1184 * wrong ABI is invalid <rdar://problem/11021230>
1185 */
1186 ret = LOAD_BADMACHO;
1187 break;
1188 }
1189
1190 ret = load_segment(lcp,
1191 header->filetype,
1192 control,
1193 file_offset,
1194 macho_size,
1195 vp,
1196 map,
1197 slide,
1198 result,
1199 imgp);
1200
1201 if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
1202 /* Enforce a single segment mapping offset zero, with R+X
1203 * protection. */
1204 if (found_header_segment ||
1205 ((scp64->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) != (VM_PROT_READ | VM_PROT_EXECUTE))) {
1206 ret = LOAD_BADMACHO;
1207 break;
1208 }
1209 found_header_segment = TRUE;
1210 }
1211
1212 break;
1213 }
1214 case LC_UNIXTHREAD: {
1215 boolean_t is_x86_64_compat_binary = FALSE;
1216 if (pass != 1) {
1217 break;
1218 }
1219 ret = load_unixthread(
1220 (struct thread_command *) lcp,
1221 thread,
1222 slide,
1223 is_x86_64_compat_binary,
1224 result);
1225 break;
1226 }
1227 case LC_MAIN:
1228 if (pass != 1) {
1229 break;
1230 }
1231 if (depth != 1) {
1232 break;
1233 }
1234 ret = load_main(
1235 (struct entry_point_command *) lcp,
1236 thread,
1237 slide,
1238 result);
1239 break;
1240 case LC_LOAD_DYLINKER:
1241 if (pass != 3) {
1242 break;
1243 }
1244 if ((depth == 1) && (dlp == 0)) {
1245 dlp = (struct dylinker_command *)lcp;
1246 } else {
1247 ret = LOAD_FAILURE;
1248 }
1249 break;
1250 case LC_UUID:
1251 if (pass == 1 && depth == 1) {
1252 ret = load_uuid((struct uuid_command *) lcp,
1253 (char *)addr + cmds_size,
1254 result);
1255 }
1256 break;
1257 case LC_CODE_SIGNATURE:
1258 /* CODE SIGNING */
1259 if (pass != 1) {
1260 break;
1261 }
1262
1263 /* pager -> uip ->
1264 * load signatures & store in uip
1265 * set VM object "signed_pages"
1266 */
1267 ret = load_code_signature(
1268 (struct linkedit_data_command *) lcp,
1269 vp,
1270 file_offset,
1271 macho_size,
1272 header->cputype,
1273 header->cpusubtype,
1274 result,
1275 imgp);
1276 if (ret != LOAD_SUCCESS) {
1277 printf("proc %d: load code signature error %d "
1278 "for file \"%s\"\n",
1279 proc_getpid(p), ret, vp->v_name);
1280 /*
1281 * Allow injections to be ignored on devices w/o enforcement enabled
1282 */
1283 if (!cs_process_global_enforcement()) {
1284 ret = LOAD_SUCCESS; /* ignore error */
1285 }
1286 } else {
1287 got_code_signatures = TRUE;
1288 }
1289
1290 if (got_code_signatures) {
1291 unsigned tainted = CS_VALIDATE_TAINTED;
1292 boolean_t valid = FALSE;
1293 vm_size_t off = 0;
1294
1295
1296 if (cs_debug > 10) {
1297 printf("validating initial pages of %s\n", vp->v_name);
1298 }
1299
1300 while (off < alloc_size && ret == LOAD_SUCCESS) {
1301 tainted = CS_VALIDATE_TAINTED;
1302
1303 valid = cs_validate_range(vp,
1304 NULL,
1305 file_offset + off,
1306 (const void *)((uintptr_t)addr + off),
1307 MIN(PAGE_SIZE, cmds_size),
1308 &tainted);
1309 if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
1310 if (cs_debug) {
1311 printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
1312 vp->v_name, proc_getpid(p), (long long)(file_offset + off), valid, tainted, result->csflags);
1313 }
1314 if (cs_process_global_enforcement() ||
1315 (result->csflags & (CS_HARD | CS_KILL | CS_ENFORCEMENT))) {
1316 ret = LOAD_FAILURE;
1317 }
1318 result->csflags &= ~CS_VALID;
1319 }
1320 off += PAGE_SIZE;
1321 }
1322 }
1323
1324 break;
1325 #if CONFIG_CODE_DECRYPTION
1326 case LC_ENCRYPTION_INFO:
1327 case LC_ENCRYPTION_INFO_64:
1328 if (pass != 3) {
1329 break;
1330 }
1331 ret = set_code_unprotect(
1332 (struct encryption_info_command *) lcp,
1333 addr, map, slide, vp, file_offset,
1334 header->cputype, header->cpusubtype);
1335 if (ret != LOAD_SUCCESS) {
1336 os_reason_t load_failure_reason = OS_REASON_NULL;
1337 printf("proc %d: set_code_unprotect() error %d "
1338 "for file \"%s\"\n",
1339 proc_getpid(p), ret, vp->v_name);
1340 /*
1341 * Don't let the app run if it's
1342 * encrypted but we failed to set up the
1343 * decrypter. If the keys are missing it will
1344 * return LOAD_DECRYPTFAIL.
1345 */
1346 if (ret == LOAD_DECRYPTFAIL) {
1347 /* failed to load due to missing FP keys */
1348 proc_lock(p);
1349 p->p_lflag |= P_LTERM_DECRYPTFAIL;
1350 proc_unlock(p);
1351
1352 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1353 proc_getpid(p), OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
1354 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
1355 } else {
1356 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1357 proc_getpid(p), OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
1358 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
1359 }
1360
1361 /*
1362 * Don't signal the process if it was forked and in a partially constructed
1363 * state as part of a spawn -- it will just be torn down when the exec fails.
1364 */
1365 if (!spawn) {
1366 assert(load_failure_reason != OS_REASON_NULL);
1367 {
1368 psignal_with_reason(p, SIGKILL, load_failure_reason);
1369 load_failure_reason = OS_REASON_NULL;
1370 }
1371 } else {
1372 os_reason_free(load_failure_reason);
1373 load_failure_reason = OS_REASON_NULL;
1374 }
1375 }
1376 break;
1377 #endif
1378 case LC_VERSION_MIN_IPHONEOS:
1379 case LC_VERSION_MIN_MACOSX:
1380 case LC_VERSION_MIN_WATCHOS:
1381 case LC_VERSION_MIN_TVOS: {
1382 struct version_min_command *vmc;
1383
1384 if (depth != 1 || pass != 0) {
1385 break;
1386 }
1387 vmc = (struct version_min_command *) lcp;
1388 ret = load_version(vmc, &found_version_cmd, imgp->ip_flags, result);
1389 #if XNU_TARGET_OS_OSX
1390 if (ret == LOAD_SUCCESS) {
1391 if (result->ip_platform == PLATFORM_IOS) {
1392 vm_map_mark_alien(map);
1393 } else {
1394 assert(!vm_map_is_alien(map));
1395 }
1396 }
1397 #endif /* XNU_TARGET_OS_OSX */
1398 break;
1399 }
1400 case LC_BUILD_VERSION: {
1401 if (depth != 1 || pass != 0) {
1402 break;
1403 }
1404 struct build_version_command* bvc = (struct build_version_command*)lcp;
1405 if (bvc->cmdsize < sizeof(*bvc)) {
1406 ret = LOAD_BADMACHO;
1407 break;
1408 }
1409 if (found_version_cmd == TRUE) {
1410 ret = LOAD_BADMACHO;
1411 break;
1412 }
1413 result->ip_platform = bvc->platform;
1414 result->lr_sdk = bvc->sdk;
1415 result->lr_min_sdk = bvc->minos;
1416 found_version_cmd = TRUE;
1417 #if XNU_TARGET_OS_OSX
1418 if (result->ip_platform == PLATFORM_IOS) {
1419 vm_map_mark_alien(map);
1420 } else {
1421 assert(!vm_map_is_alien(map));
1422 }
1423 #endif /* XNU_TARGET_OS_OSX */
1424 break;
1425 }
1426 default:
1427 /* Other commands are ignored by the kernel */
1428 ret = LOAD_SUCCESS;
1429 break;
1430 }
1431 if (ret != LOAD_SUCCESS) {
1432 break;
1433 }
1434 }
1435 if (ret != LOAD_SUCCESS) {
1436 break;
1437 }
1438 }
1439
1440 if (ret == LOAD_SUCCESS) {
1441 if (!got_code_signatures && cs_process_global_enforcement()) {
1442 ret = LOAD_FAILURE;
1443 }
1444
1445 /* Make sure if we need dyld, we got it */
1446 if (result->needs_dynlinker && !dlp) {
1447 ret = LOAD_FAILURE;
1448 }
1449
1450 if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1451 /*
1452 * load the dylinker, and slide it by the independent DYLD ASLR
1453 * offset regardless of the PIE-ness of the main binary.
1454 */
1455 ret = load_dylinker(dlp, header->cputype, map, thread, depth,
1456 dyld_aslr_offset, result, imgp);
1457 }
1458
1459
1460 if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1461 if (result->thread_count == 0) {
1462 ret = LOAD_FAILURE;
1463 }
1464 #if CONFIG_ENFORCE_SIGNED_CODE
1465 if (!(result->csflags & CS_NO_UNTRUSTED_HELPERS)) {
1466 ret = LOAD_FAILURE;
1467 }
1468 #endif
1469 }
1470 }
1471
1472 if (ret == LOAD_BADMACHO && found_xhdr) {
1473 ret = LOAD_BADMACHO_UPX;
1474 }
1475
1476 kfree_data(addr, alloc_size);
1477
1478 return ret;
1479 }
1480
1481 load_return_t
validate_potential_simulator_binary(cpu_type_t exectype __unused,struct image_params * imgp __unused,off_t file_offset __unused,off_t macho_size __unused)1482 validate_potential_simulator_binary(
1483 cpu_type_t exectype __unused,
1484 struct image_params *imgp __unused,
1485 off_t file_offset __unused,
1486 off_t macho_size __unused)
1487 {
1488 #if __x86_64__
1489 /* Allow 32 bit exec only for simulator binaries */
1490 if (bootarg_no32exec && imgp != NULL && exectype == CPU_TYPE_X86) {
1491 if (imgp->ip_simulator_binary == IMGPF_SB_DEFAULT) {
1492 boolean_t simulator_binary = check_if_simulator_binary(imgp, file_offset, macho_size);
1493 imgp->ip_simulator_binary = simulator_binary ? IMGPF_SB_TRUE : IMGPF_SB_FALSE;
1494 }
1495
1496 if (imgp->ip_simulator_binary != IMGPF_SB_TRUE) {
1497 return LOAD_BADARCH;
1498 }
1499 }
1500 #endif
1501 return LOAD_SUCCESS;
1502 }
1503
1504 #if __x86_64__
1505 static boolean_t
check_if_simulator_binary(struct image_params * imgp,off_t file_offset,off_t macho_size)1506 check_if_simulator_binary(
1507 struct image_params *imgp,
1508 off_t file_offset,
1509 off_t macho_size)
1510 {
1511 struct mach_header *header;
1512 char *ip_vdata = NULL;
1513 kauth_cred_t cred = NULL;
1514 uint32_t ncmds;
1515 struct load_command *lcp;
1516 boolean_t simulator_binary = FALSE;
1517 void * addr = NULL;
1518 vm_size_t alloc_size, cmds_size;
1519 size_t offset;
1520 proc_t p = current_proc(); /* XXXX */
1521 int error;
1522 int resid = 0;
1523 size_t mach_header_sz = sizeof(struct mach_header);
1524
1525
1526 cred = kauth_cred_proc_ref(p);
1527
1528 /* Allocate page to copyin mach header */
1529 ip_vdata = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
1530 if (ip_vdata == NULL) {
1531 goto bad;
1532 }
1533
1534 /* Read the Mach-O header */
1535 error = vn_rdwr(UIO_READ, imgp->ip_vp, ip_vdata,
1536 PAGE_SIZE, file_offset,
1537 UIO_SYSSPACE, (IO_UNIT | IO_NODELOCKED),
1538 cred, &resid, p);
1539 if (error) {
1540 goto bad;
1541 }
1542
1543 header = (struct mach_header *)ip_vdata;
1544
1545 if (header->magic == MH_MAGIC_64 ||
1546 header->magic == MH_CIGAM_64) {
1547 mach_header_sz = sizeof(struct mach_header_64);
1548 }
1549
1550 /* ensure header + sizeofcmds falls within the file */
1551 if (os_add_overflow(mach_header_sz, header->sizeofcmds, &cmds_size) ||
1552 (off_t)cmds_size > macho_size ||
1553 round_page_overflow(cmds_size, &alloc_size) ||
1554 alloc_size > INT_MAX) {
1555 goto bad;
1556 }
1557
1558 /*
1559 * Map the load commands into kernel memory.
1560 */
1561 addr = kalloc_data(alloc_size, Z_WAITOK);
1562 if (addr == NULL) {
1563 goto bad;
1564 }
1565
1566 error = vn_rdwr(UIO_READ, imgp->ip_vp, addr, (int)alloc_size, file_offset,
1567 UIO_SYSSPACE, IO_NODELOCKED, cred, &resid, p);
1568 if (error) {
1569 goto bad;
1570 }
1571
1572 if (resid) {
1573 /* We must be able to read in as much as the mach_header indicated */
1574 goto bad;
1575 }
1576
1577 /*
1578 * Loop through each of the load_commands indicated by the
1579 * Mach-O header; if an absurd value is provided, we just
1580 * run off the end of the reserved section by incrementing
1581 * the offset too far, so we are implicitly fail-safe.
1582 */
1583 offset = mach_header_sz;
1584 ncmds = header->ncmds;
1585
1586 while (ncmds--) {
1587 /* ensure enough space for a minimal load command */
1588 if (offset + sizeof(struct load_command) > cmds_size) {
1589 break;
1590 }
1591
1592 /*
1593 * Get a pointer to the command.
1594 */
1595 lcp = (struct load_command *)((uintptr_t)addr + offset);
1596
1597 /*
1598 * Perform prevalidation of the struct load_command
1599 * before we attempt to use its contents. Invalid
1600 * values are ones which result in an overflow, or
1601 * which can not possibly be valid commands, or which
1602 * straddle or exist past the reserved section at the
1603 * start of the image.
1604 */
1605 if (os_add_overflow(offset, lcp->cmdsize, &offset) ||
1606 lcp->cmdsize < sizeof(struct load_command) ||
1607 offset > cmds_size) {
1608 break;
1609 }
1610
1611 /* Check if its a simulator binary. */
1612 switch (lcp->cmd) {
1613 case LC_VERSION_MIN_WATCHOS:
1614 simulator_binary = TRUE;
1615 break;
1616
1617 case LC_BUILD_VERSION: {
1618 struct build_version_command *bvc;
1619
1620 bvc = (struct build_version_command *) lcp;
1621 if (bvc->cmdsize < sizeof(*bvc)) {
1622 /* unsafe to use this command struct if cmdsize
1623 * validated above is too small for it to fit */
1624 break;
1625 }
1626 if (bvc->platform == PLATFORM_IOSSIMULATOR ||
1627 bvc->platform == PLATFORM_WATCHOSSIMULATOR) {
1628 simulator_binary = TRUE;
1629 }
1630
1631 break;
1632 }
1633
1634 case LC_VERSION_MIN_IPHONEOS: {
1635 simulator_binary = TRUE;
1636 break;
1637 }
1638
1639 default:
1640 /* ignore other load commands */
1641 break;
1642 }
1643
1644 if (simulator_binary == TRUE) {
1645 break;
1646 }
1647 }
1648
1649 bad:
1650 if (ip_vdata) {
1651 kfree_data(ip_vdata, PAGE_SIZE);
1652 }
1653
1654 if (cred) {
1655 kauth_cred_unref(&cred);
1656 }
1657
1658 if (addr) {
1659 kfree_data(addr, alloc_size);
1660 }
1661
1662 return simulator_binary;
1663 }
1664 #endif /* __x86_64__ */
1665
1666 #if CONFIG_CODE_DECRYPTION
1667
1668 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * 4096)
1669
1670 static load_return_t
unprotect_dsmos_segment(uint64_t file_off,uint64_t file_size,struct vnode * vp,off_t macho_offset,vm_map_t map,vm_map_offset_t map_addr,vm_map_size_t map_size)1671 unprotect_dsmos_segment(
1672 uint64_t file_off,
1673 uint64_t file_size,
1674 struct vnode *vp,
1675 off_t macho_offset,
1676 vm_map_t map,
1677 vm_map_offset_t map_addr,
1678 vm_map_size_t map_size)
1679 {
1680 kern_return_t kr;
1681 uint64_t slice_off;
1682
1683 /*
1684 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1685 * this part of a Universal binary) are not protected...
1686 * The rest needs to be "transformed".
1687 */
1688 slice_off = file_off - macho_offset;
1689 if (slice_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1690 slice_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1691 /* it's all unprotected, nothing to do... */
1692 kr = KERN_SUCCESS;
1693 } else {
1694 if (slice_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1695 /*
1696 * We start mapping in the unprotected area.
1697 * Skip the unprotected part...
1698 */
1699 uint64_t delta_file;
1700 vm_map_offset_t delta_map;
1701
1702 delta_file = (uint64_t)APPLE_UNPROTECTED_HEADER_SIZE;
1703 delta_file -= slice_off;
1704 if (os_convert_overflow(delta_file, &delta_map)) {
1705 return LOAD_BADMACHO;
1706 }
1707 if (os_add_overflow(map_addr, delta_map, &map_addr)) {
1708 return LOAD_BADMACHO;
1709 }
1710 if (os_sub_overflow(map_size, delta_map, &map_size)) {
1711 return LOAD_BADMACHO;
1712 }
1713 }
1714 /* ... transform the rest of the mapping. */
1715 struct pager_crypt_info crypt_info;
1716 crypt_info.page_decrypt = dsmos_page_transform;
1717 crypt_info.crypt_ops = NULL;
1718 crypt_info.crypt_end = NULL;
1719 #pragma unused(vp, macho_offset)
1720 crypt_info.crypt_ops = (void *)0x2e69cf40;
1721 vm_map_offset_t crypto_backing_offset;
1722 crypto_backing_offset = -1; /* i.e. use map entry's offset */
1723 #if VM_MAP_DEBUG_APPLE_PROTECT
1724 if (vm_map_debug_apple_protect) {
1725 struct proc *p;
1726 p = current_proc();
1727 printf("APPLE_PROTECT: %d[%s] map %p "
1728 "[0x%llx:0x%llx] %s(%s)\n",
1729 proc_getpid(p), p->p_comm, map,
1730 (uint64_t) map_addr,
1731 (uint64_t) (map_addr + map_size),
1732 __FUNCTION__, vp->v_name);
1733 }
1734 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1735
1736 /* The DSMOS pager can only be used by apple signed code */
1737 struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1738 if (blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path) {
1739 return LOAD_FAILURE;
1740 }
1741
1742 kr = vm_map_apple_protected(map,
1743 map_addr,
1744 map_addr + map_size,
1745 crypto_backing_offset,
1746 &crypt_info,
1747 CRYPTID_APP_ENCRYPTION);
1748 }
1749
1750 if (kr != KERN_SUCCESS) {
1751 return LOAD_FAILURE;
1752 }
1753 return LOAD_SUCCESS;
1754 }
1755 #else /* CONFIG_CODE_DECRYPTION */
1756 static load_return_t
unprotect_dsmos_segment(__unused uint64_t file_off,__unused uint64_t file_size,__unused struct vnode * vp,__unused off_t macho_offset,__unused vm_map_t map,__unused vm_map_offset_t map_addr,__unused vm_map_size_t map_size)1757 unprotect_dsmos_segment(
1758 __unused uint64_t file_off,
1759 __unused uint64_t file_size,
1760 __unused struct vnode *vp,
1761 __unused off_t macho_offset,
1762 __unused vm_map_t map,
1763 __unused vm_map_offset_t map_addr,
1764 __unused vm_map_size_t map_size)
1765 {
1766 return LOAD_SUCCESS;
1767 }
1768 #endif /* CONFIG_CODE_DECRYPTION */
1769
1770
1771 /*
1772 * map_segment:
1773 * Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1774 * page size) issues.
1775 *
1776 * The mapping might result in 1, 2 or 3 map entries:
1777 * 1. for the first page, which could be overlap with the previous
1778 * mapping,
1779 * 2. for the center (if applicable),
1780 * 3. for the last page, which could overlap with the next mapping.
1781 *
1782 * For each of those map entries, we might have to interpose a
1783 * "fourk_pager" to deal with mis-alignment wrt the system page size,
1784 * either in the mapping address and/or size or the file offset and/or
1785 * size.
1786 * The "fourk_pager" itself would be mapped with proper alignment
1787 * wrt the system page size and would then be populated with the
1788 * information about the intended mapping, with a "4KB" granularity.
1789 */
1790 static kern_return_t
map_segment(vm_map_t map,vm_map_offset_t vm_start,vm_map_offset_t vm_end,memory_object_control_t control,vm_map_offset_t file_start,vm_map_offset_t file_end,vm_prot_t initprot,vm_prot_t maxprot,load_result_t * result)1791 map_segment(
1792 vm_map_t map,
1793 vm_map_offset_t vm_start,
1794 vm_map_offset_t vm_end,
1795 memory_object_control_t control,
1796 vm_map_offset_t file_start,
1797 vm_map_offset_t file_end,
1798 vm_prot_t initprot,
1799 vm_prot_t maxprot,
1800 load_result_t *result)
1801 {
1802 vm_map_offset_t cur_offset, cur_start, cur_end;
1803 kern_return_t ret;
1804 vm_map_offset_t effective_page_mask;
1805 vm_map_kernel_flags_t vmk_flags, cur_vmk_flags;
1806
1807 if (vm_end < vm_start ||
1808 file_end < file_start) {
1809 return LOAD_BADMACHO;
1810 }
1811 if (vm_end == vm_start ||
1812 file_end == file_start) {
1813 /* nothing to map... */
1814 return LOAD_SUCCESS;
1815 }
1816
1817 effective_page_mask = vm_map_page_mask(map);
1818
1819 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1820 if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1821 vm_map_page_aligned(vm_end, effective_page_mask) &&
1822 vm_map_page_aligned(file_start, effective_page_mask) &&
1823 vm_map_page_aligned(file_end, effective_page_mask)) {
1824 /* all page-aligned and map-aligned: proceed */
1825 } else {
1826 #if __arm64__
1827 /* use an intermediate "4K" pager */
1828 vmk_flags.vmkf_fourk = TRUE;
1829 #else /* __arm64__ */
1830 panic("map_segment: unexpected mis-alignment "
1831 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1832 (uint64_t) vm_start,
1833 (uint64_t) vm_end,
1834 (uint64_t) file_start,
1835 (uint64_t) file_end);
1836 #endif /* __arm64__ */
1837 }
1838
1839 cur_offset = 0;
1840 cur_start = vm_start;
1841 cur_end = vm_start;
1842 #if __arm64__
1843 if (!vm_map_page_aligned(vm_start, effective_page_mask)) {
1844 /* one 4K pager for the 1st page */
1845 cur_end = vm_map_round_page(cur_start, effective_page_mask);
1846 if (cur_end > vm_end) {
1847 cur_end = vm_start + (file_end - file_start);
1848 }
1849 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1850 /* no copy-on-read for mapped binaries */
1851 vmk_flags.vmkf_no_copy_on_read = 1;
1852 ret = vm_map_enter_mem_object_control(
1853 map,
1854 &cur_start,
1855 cur_end - cur_start,
1856 (mach_vm_offset_t)0,
1857 VM_FLAGS_FIXED,
1858 vmk_flags,
1859 VM_KERN_MEMORY_NONE,
1860 control,
1861 file_start + cur_offset,
1862 TRUE, /* copy */
1863 initprot, maxprot,
1864 VM_INHERIT_DEFAULT);
1865 } else {
1866 ret = vm_map_enter_mem_object(
1867 map,
1868 &cur_start,
1869 cur_end - cur_start,
1870 (mach_vm_offset_t)0,
1871 VM_FLAGS_FIXED,
1872 vmk_flags,
1873 VM_KERN_MEMORY_NONE,
1874 IPC_PORT_NULL,
1875 0, /* offset */
1876 TRUE, /* copy */
1877 initprot, maxprot,
1878 VM_INHERIT_DEFAULT);
1879 }
1880 if (ret != KERN_SUCCESS) {
1881 return LOAD_NOSPACE;
1882 }
1883 cur_offset += cur_end - cur_start;
1884 }
1885 #endif /* __arm64__ */
1886 if (cur_end >= vm_start + (file_end - file_start)) {
1887 /* all mapped: done */
1888 goto done;
1889 }
1890 if (vm_map_round_page(cur_end, effective_page_mask) >=
1891 vm_map_trunc_page(vm_start + (file_end - file_start),
1892 effective_page_mask)) {
1893 /* no middle */
1894 } else {
1895 cur_start = cur_end;
1896 if ((vm_start & effective_page_mask) !=
1897 (file_start & effective_page_mask)) {
1898 /* one 4K pager for the middle */
1899 cur_vmk_flags = vmk_flags;
1900 } else {
1901 /* regular mapping for the middle */
1902 cur_vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1903 }
1904
1905 #if !defined(XNU_TARGET_OS_OSX)
1906 (void) result;
1907 #else /* !defined(XNU_TARGET_OS_OSX) */
1908 /*
1909 * This process doesn't have its new csflags (from
1910 * the image being loaded) yet, so tell VM to override the
1911 * current process's CS_ENFORCEMENT for this mapping.
1912 */
1913 if (result->csflags & CS_ENFORCEMENT) {
1914 cur_vmk_flags.vmkf_cs_enforcement = TRUE;
1915 } else {
1916 cur_vmk_flags.vmkf_cs_enforcement = FALSE;
1917 }
1918 cur_vmk_flags.vmkf_cs_enforcement_override = TRUE;
1919 #endif /* !defined(XNU_TARGET_OS_OSX) */
1920
1921 if (result->is_cambria && (initprot & VM_PROT_EXECUTE) == VM_PROT_EXECUTE) {
1922 cur_vmk_flags.vmkf_translated_allow_execute = TRUE;
1923 }
1924
1925 cur_end = vm_map_trunc_page(vm_start + (file_end -
1926 file_start),
1927 effective_page_mask);
1928 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1929 /* no copy-on-read for mapped binaries */
1930 cur_vmk_flags.vmkf_no_copy_on_read = 1;
1931 ret = vm_map_enter_mem_object_control(
1932 map,
1933 &cur_start,
1934 cur_end - cur_start,
1935 (mach_vm_offset_t)0,
1936 VM_FLAGS_FIXED,
1937 cur_vmk_flags,
1938 VM_KERN_MEMORY_NONE,
1939 control,
1940 file_start + cur_offset,
1941 TRUE, /* copy */
1942 initprot, maxprot,
1943 VM_INHERIT_DEFAULT);
1944 } else {
1945 ret = vm_map_enter_mem_object(
1946 map,
1947 &cur_start,
1948 cur_end - cur_start,
1949 (mach_vm_offset_t)0,
1950 VM_FLAGS_FIXED,
1951 cur_vmk_flags,
1952 VM_KERN_MEMORY_NONE,
1953 IPC_PORT_NULL,
1954 0, /* offset */
1955 TRUE, /* copy */
1956 initprot, maxprot,
1957 VM_INHERIT_DEFAULT);
1958 }
1959 if (ret != KERN_SUCCESS) {
1960 return LOAD_NOSPACE;
1961 }
1962 cur_offset += cur_end - cur_start;
1963 }
1964 if (cur_end >= vm_start + (file_end - file_start)) {
1965 /* all mapped: done */
1966 goto done;
1967 }
1968 cur_start = cur_end;
1969 #if __arm64__
1970 if (!vm_map_page_aligned(vm_start + (file_end - file_start),
1971 effective_page_mask)) {
1972 /* one 4K pager for the last page */
1973 cur_end = vm_start + (file_end - file_start);
1974 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1975 /* no copy-on-read for mapped binaries */
1976 vmk_flags.vmkf_no_copy_on_read = 1;
1977 ret = vm_map_enter_mem_object_control(
1978 map,
1979 &cur_start,
1980 cur_end - cur_start,
1981 (mach_vm_offset_t)0,
1982 VM_FLAGS_FIXED,
1983 vmk_flags,
1984 VM_KERN_MEMORY_NONE,
1985 control,
1986 file_start + cur_offset,
1987 TRUE, /* copy */
1988 initprot, maxprot,
1989 VM_INHERIT_DEFAULT);
1990 } else {
1991 ret = vm_map_enter_mem_object(
1992 map,
1993 &cur_start,
1994 cur_end - cur_start,
1995 (mach_vm_offset_t)0,
1996 VM_FLAGS_FIXED,
1997 vmk_flags,
1998 VM_KERN_MEMORY_NONE,
1999 IPC_PORT_NULL,
2000 0, /* offset */
2001 TRUE, /* copy */
2002 initprot, maxprot,
2003 VM_INHERIT_DEFAULT);
2004 }
2005 if (ret != KERN_SUCCESS) {
2006 return LOAD_NOSPACE;
2007 }
2008 cur_offset += cur_end - cur_start;
2009 }
2010 #endif /* __arm64__ */
2011 done:
2012 assert(cur_end >= vm_start + (file_end - file_start));
2013 return LOAD_SUCCESS;
2014 }
2015
2016 static
2017 load_return_t
load_segment(struct load_command * lcp,uint32_t filetype,void * control,off_t pager_offset,off_t macho_size,struct vnode * vp,vm_map_t map,int64_t slide,load_result_t * result,struct image_params * imgp)2018 load_segment(
2019 struct load_command *lcp,
2020 uint32_t filetype,
2021 void * control,
2022 off_t pager_offset,
2023 off_t macho_size,
2024 struct vnode *vp,
2025 vm_map_t map,
2026 int64_t slide,
2027 load_result_t *result,
2028 struct image_params *imgp)
2029 {
2030 struct segment_command_64 segment_command, *scp;
2031 kern_return_t ret;
2032 vm_map_size_t delta_size;
2033 vm_prot_t initprot;
2034 vm_prot_t maxprot;
2035 size_t segment_command_size, total_section_size,
2036 single_section_size;
2037 uint64_t file_offset, file_size;
2038 vm_map_offset_t vm_offset;
2039 size_t vm_size;
2040 vm_map_offset_t vm_start, vm_end, vm_end_aligned;
2041 vm_map_offset_t file_start, file_end;
2042 kern_return_t kr;
2043 boolean_t verbose;
2044 vm_map_size_t effective_page_size;
2045 vm_map_offset_t effective_page_mask;
2046 #if __arm64__
2047 vm_map_kernel_flags_t vmk_flags;
2048 boolean_t fourk_align;
2049 #endif /* __arm64__ */
2050
2051 (void)imgp;
2052
2053 effective_page_size = vm_map_page_size(map);
2054 effective_page_mask = vm_map_page_mask(map);
2055
2056 verbose = FALSE;
2057 if (LC_SEGMENT_64 == lcp->cmd) {
2058 segment_command_size = sizeof(struct segment_command_64);
2059 single_section_size = sizeof(struct section_64);
2060 #if __arm64__
2061 /* 64-bit binary: should already be 16K-aligned */
2062 fourk_align = FALSE;
2063
2064 if (vm_map_page_shift(map) == FOURK_PAGE_SHIFT &&
2065 PAGE_SHIFT != FOURK_PAGE_SHIFT) {
2066 fourk_align = TRUE;
2067 verbose = TRUE;
2068 }
2069 #endif /* __arm64__ */
2070 } else {
2071 segment_command_size = sizeof(struct segment_command);
2072 single_section_size = sizeof(struct section);
2073 #if __arm64__
2074 /* 32-bit binary: might need 4K-alignment */
2075 if (effective_page_size != FOURK_PAGE_SIZE) {
2076 /* not using 4K page size: need fourk_pager */
2077 fourk_align = TRUE;
2078 verbose = TRUE;
2079 } else {
2080 /* using 4K page size: no need for re-alignment */
2081 fourk_align = FALSE;
2082 }
2083 #endif /* __arm64__ */
2084 }
2085 if (lcp->cmdsize < segment_command_size) {
2086 DEBUG4K_ERROR("LOAD_BADMACHO cmdsize %d < %zu\n", lcp->cmdsize, segment_command_size);
2087 return LOAD_BADMACHO;
2088 }
2089 total_section_size = lcp->cmdsize - segment_command_size;
2090
2091 if (LC_SEGMENT_64 == lcp->cmd) {
2092 scp = (struct segment_command_64 *)lcp;
2093 } else {
2094 scp = &segment_command;
2095 widen_segment_command((struct segment_command *)lcp, scp);
2096 }
2097
2098 if (verbose) {
2099 MACHO_PRINTF(("+++ load_segment %s "
2100 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
2101 "prot %d/%d flags 0x%x\n",
2102 scp->segname,
2103 (uint64_t)(slide + scp->vmaddr),
2104 (uint64_t)(slide + scp->vmaddr + scp->vmsize),
2105 pager_offset + scp->fileoff,
2106 pager_offset + scp->fileoff + scp->filesize,
2107 scp->initprot,
2108 scp->maxprot,
2109 scp->flags));
2110 }
2111
2112 /*
2113 * Make sure what we get from the file is really ours (as specified
2114 * by macho_size).
2115 */
2116 if (scp->fileoff + scp->filesize < scp->fileoff ||
2117 scp->fileoff + scp->filesize > (uint64_t)macho_size) {
2118 DEBUG4K_ERROR("LOAD_BADMACHO fileoff 0x%llx filesize 0x%llx macho_size 0x%llx\n", scp->fileoff, scp->filesize, (uint64_t)macho_size);
2119 return LOAD_BADMACHO;
2120 }
2121 /*
2122 * Ensure that the number of sections specified would fit
2123 * within the load command size.
2124 */
2125 if (total_section_size / single_section_size < scp->nsects) {
2126 DEBUG4K_ERROR("LOAD_BADMACHO 0x%zx 0x%zx %d\n", total_section_size, single_section_size, scp->nsects);
2127 return LOAD_BADMACHO;
2128 }
2129 /*
2130 * Make sure the segment is page-aligned in the file.
2131 */
2132 if (os_add_overflow(pager_offset, scp->fileoff, &file_offset)) {
2133 DEBUG4K_ERROR("LOAD_BADMACHO file_offset: 0x%llx + 0x%llx\n", pager_offset, scp->fileoff);
2134 return LOAD_BADMACHO;
2135 }
2136 file_size = scp->filesize;
2137 #if __arm64__
2138 if (fourk_align) {
2139 if ((file_offset & FOURK_PAGE_MASK) != 0) {
2140 /*
2141 * we can't mmap() it if it's not at least 4KB-aligned
2142 * in the file
2143 */
2144 DEBUG4K_ERROR("LOAD_BADMACHO file_offset 0x%llx\n", file_offset);
2145 return LOAD_BADMACHO;
2146 }
2147 } else
2148 #endif /* __arm64__ */
2149 if ((file_offset & PAGE_MASK_64) != 0 ||
2150 /* we can't mmap() it if it's not page-aligned in the file */
2151 (file_offset & vm_map_page_mask(map)) != 0) {
2152 /*
2153 * The 1st test would have failed if the system's page size
2154 * was what this process believe is the page size, so let's
2155 * fail here too for the sake of consistency.
2156 */
2157 DEBUG4K_ERROR("LOAD_BADMACHO file_offset 0x%llx\n", file_offset);
2158 return LOAD_BADMACHO;
2159 }
2160
2161 /*
2162 * If we have a code signature attached for this slice
2163 * require that the segments are within the signed part
2164 * of the file.
2165 */
2166 if (result->cs_end_offset &&
2167 result->cs_end_offset < (off_t)scp->fileoff &&
2168 result->cs_end_offset - scp->fileoff < scp->filesize) {
2169 if (cs_debug) {
2170 printf("section outside code signature\n");
2171 }
2172 DEBUG4K_ERROR("LOAD_BADMACHO end_offset 0x%llx fileoff 0x%llx filesize 0x%llx\n", result->cs_end_offset, scp->fileoff, scp->filesize);
2173 return LOAD_BADMACHO;
2174 }
2175
2176 if (os_add_overflow(scp->vmaddr, slide, &vm_offset)) {
2177 if (cs_debug) {
2178 printf("vmaddr too large\n");
2179 }
2180 DEBUG4K_ERROR("LOAD_BADMACHO vmaddr 0x%llx slide 0x%llx vm_offset 0x%llx\n", scp->vmaddr, slide, (uint64_t)vm_offset);
2181 return LOAD_BADMACHO;
2182 }
2183
2184 if (scp->vmsize > SIZE_MAX) {
2185 DEBUG4K_ERROR("LOAD_BADMACHO vmsize 0x%llx\n", scp->vmsize);
2186 return LOAD_BADMACHO;
2187 }
2188
2189 vm_size = (size_t)scp->vmsize;
2190
2191 if (vm_size == 0) {
2192 return LOAD_SUCCESS;
2193 }
2194 if (scp->vmaddr == 0 &&
2195 file_size == 0 &&
2196 vm_size != 0 &&
2197 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
2198 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
2199 if (map == VM_MAP_NULL) {
2200 return LOAD_SUCCESS;
2201 }
2202
2203 /*
2204 * For PIE, extend page zero rather than moving it. Extending
2205 * page zero keeps early allocations from falling predictably
2206 * between the end of page zero and the beginning of the first
2207 * slid segment.
2208 */
2209 /*
2210 * This is a "page zero" segment: it starts at address 0,
2211 * is not mapped from the binary file and is not accessible.
2212 * User-space should never be able to access that memory, so
2213 * make it completely off limits by raising the VM map's
2214 * minimum offset.
2215 */
2216 vm_end = (vm_map_offset_t)(vm_offset + vm_size);
2217 if (vm_end < vm_offset) {
2218 DEBUG4K_ERROR("LOAD_BADMACHO vm_end 0x%llx vm_offset 0x%llx vm_size 0x%llx\n", (uint64_t)vm_end, (uint64_t)vm_offset, (uint64_t)vm_size);
2219 return LOAD_BADMACHO;
2220 }
2221
2222 if (verbose) {
2223 MACHO_PRINTF(("++++++ load_segment: "
2224 "page_zero up to 0x%llx\n",
2225 (uint64_t) vm_end));
2226 }
2227 #if __arm64__
2228 if (fourk_align) {
2229 /* raise min_offset as much as page-alignment allows */
2230 vm_end_aligned = vm_map_trunc_page(vm_end,
2231 effective_page_mask);
2232 } else
2233 #endif /* __arm64__ */
2234 {
2235 vm_end = vm_map_round_page(vm_end,
2236 PAGE_MASK_64);
2237 vm_end_aligned = vm_end;
2238 }
2239 ret = vm_map_raise_min_offset(map,
2240 vm_end_aligned);
2241 #if __arm64__
2242 if (ret == 0 &&
2243 vm_end > vm_end_aligned) {
2244 /* use fourk_pager to map the rest of pagezero */
2245 assert(fourk_align);
2246 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
2247 vmk_flags.vmkf_fourk = TRUE;
2248 ret = vm_map_enter_mem_object(
2249 map,
2250 &vm_end_aligned,
2251 vm_end - vm_end_aligned,
2252 (mach_vm_offset_t) 0, /* mask */
2253 VM_FLAGS_FIXED,
2254 vmk_flags,
2255 VM_KERN_MEMORY_NONE,
2256 IPC_PORT_NULL,
2257 0,
2258 FALSE, /* copy */
2259 (scp->initprot & VM_PROT_ALL),
2260 (scp->maxprot & VM_PROT_ALL),
2261 VM_INHERIT_DEFAULT);
2262 }
2263 #endif /* __arm64__ */
2264
2265 if (ret != KERN_SUCCESS) {
2266 DEBUG4K_ERROR("LOAD_FAILURE ret 0x%x\n", ret);
2267 return LOAD_FAILURE;
2268 }
2269 return LOAD_SUCCESS;
2270 } else {
2271 #if !defined(XNU_TARGET_OS_OSX)
2272 /* not PAGEZERO: should not be mapped at address 0 */
2273 if (filetype != MH_DYLINKER && scp->vmaddr == 0) {
2274 DEBUG4K_ERROR("LOAD_BADMACHO filetype %d vmaddr 0x%llx\n", filetype, scp->vmaddr);
2275 return LOAD_BADMACHO;
2276 }
2277 #endif /* !defined(XNU_TARGET_OS_OSX) */
2278 }
2279
2280 #if __arm64__
2281 if (fourk_align) {
2282 /* 4K-align */
2283 file_start = vm_map_trunc_page(file_offset,
2284 FOURK_PAGE_MASK);
2285 file_end = vm_map_round_page(file_offset + file_size,
2286 FOURK_PAGE_MASK);
2287 vm_start = vm_map_trunc_page(vm_offset,
2288 FOURK_PAGE_MASK);
2289 vm_end = vm_map_round_page(vm_offset + vm_size,
2290 FOURK_PAGE_MASK);
2291
2292 if (file_offset - file_start > FOURK_PAGE_MASK ||
2293 file_end - file_offset - file_size > FOURK_PAGE_MASK) {
2294 DEBUG4K_ERROR("LOAD_BADMACHO file_start / file_size wrap "
2295 "[0x%llx:0x%llx] -> [0x%llx:0x%llx]\n",
2296 file_offset,
2297 file_offset + file_size,
2298 (uint64_t) file_start,
2299 (uint64_t) file_end);
2300 return LOAD_BADMACHO;
2301 }
2302
2303 if (!strncmp(scp->segname, "__LINKEDIT", 11) &&
2304 page_aligned(file_start) &&
2305 vm_map_page_aligned(file_start, vm_map_page_mask(map)) &&
2306 page_aligned(vm_start) &&
2307 vm_map_page_aligned(vm_start, vm_map_page_mask(map))) {
2308 /* XXX last segment: ignore mis-aligned tail */
2309 file_end = vm_map_round_page(file_end,
2310 effective_page_mask);
2311 vm_end = vm_map_round_page(vm_end,
2312 effective_page_mask);
2313 }
2314 } else
2315 #endif /* __arm64__ */
2316 {
2317 file_start = vm_map_trunc_page(file_offset,
2318 effective_page_mask);
2319 file_end = vm_map_round_page(file_offset + file_size,
2320 effective_page_mask);
2321 vm_start = vm_map_trunc_page(vm_offset,
2322 effective_page_mask);
2323 vm_end = vm_map_round_page(vm_offset + vm_size,
2324 effective_page_mask);
2325
2326 if (file_offset - file_start > effective_page_mask ||
2327 file_end - file_offset - file_size > effective_page_mask) {
2328 DEBUG4K_ERROR("LOAD_BADMACHO file_start / file_size wrap "
2329 "[0x%llx:0x%llx] -> [0x%llx:0x%llx]\n",
2330 file_offset,
2331 file_offset + file_size,
2332 (uint64_t) file_start,
2333 (uint64_t) file_end);
2334 return LOAD_BADMACHO;
2335 }
2336 }
2337
2338 if (vm_start < result->min_vm_addr) {
2339 result->min_vm_addr = vm_start;
2340 }
2341 if (vm_end > result->max_vm_addr) {
2342 result->max_vm_addr = vm_end;
2343 }
2344
2345 if (map == VM_MAP_NULL) {
2346 return LOAD_SUCCESS;
2347 }
2348
2349 if (vm_size > 0) {
2350 initprot = (scp->initprot) & VM_PROT_ALL;
2351 maxprot = (scp->maxprot) & VM_PROT_ALL;
2352 /*
2353 * Map a copy of the file into the address space.
2354 */
2355 if (verbose) {
2356 MACHO_PRINTF(("++++++ load_segment: "
2357 "mapping at vm [0x%llx:0x%llx] of "
2358 "file [0x%llx:0x%llx]\n",
2359 (uint64_t) vm_start,
2360 (uint64_t) vm_end,
2361 (uint64_t) file_start,
2362 (uint64_t) file_end));
2363 }
2364 ret = map_segment(map,
2365 vm_start,
2366 vm_end,
2367 control,
2368 file_start,
2369 file_end,
2370 initprot,
2371 maxprot,
2372 result);
2373 if (ret) {
2374 DEBUG4K_ERROR("LOAD_NOSPACE start 0x%llx end 0x%llx ret 0x%x\n", (uint64_t)vm_start, (uint64_t)vm_end, ret);
2375 return LOAD_NOSPACE;
2376 }
2377
2378 #if FIXME
2379 /*
2380 * If the file didn't end on a page boundary,
2381 * we need to zero the leftover.
2382 */
2383 delta_size = map_size - scp->filesize;
2384 if (delta_size > 0) {
2385 mach_vm_offset_t tmp;
2386
2387 ret = mach_vm_allocate_kernel(kernel_map, &tmp, delta_size, VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_BSD);
2388 if (ret != KERN_SUCCESS) {
2389 DEBUG4K_ERROR("LOAD_RESOURCE delta_size 0x%llx ret 0x%x\n", delta_size, ret);
2390 return LOAD_RESOURCE;
2391 }
2392
2393 if (copyout(tmp, map_addr + scp->filesize,
2394 delta_size)) {
2395 (void) mach_vm_deallocate(
2396 kernel_map, tmp, delta_size);
2397 DEBUG4K_ERROR("LOAD_FAILURE copyout 0x%llx 0x%llx\n", map_addr + scp->filesize, delta_size);
2398 return LOAD_FAILURE;
2399 }
2400
2401 (void) mach_vm_deallocate(kernel_map, tmp, delta_size);
2402 }
2403 #endif /* FIXME */
2404 }
2405
2406 /*
2407 * If the virtual size of the segment is greater
2408 * than the size from the file, we need to allocate
2409 * zero fill memory for the rest.
2410 */
2411 if ((vm_end - vm_start) > (file_end - file_start)) {
2412 delta_size = (vm_end - vm_start) - (file_end - file_start);
2413 } else {
2414 delta_size = 0;
2415 }
2416 if (delta_size > 0) {
2417 vm_map_offset_t tmp_start;
2418 vm_map_offset_t tmp_end;
2419
2420 if (os_add_overflow(vm_start, file_end - file_start, &tmp_start)) {
2421 DEBUG4K_ERROR("LOAD_NOSPACE tmp_start: 0x%llx + 0x%llx\n", (uint64_t)vm_start, (uint64_t)(file_end - file_start));
2422 return LOAD_NOSPACE;
2423 }
2424
2425 if (os_add_overflow(tmp_start, delta_size, &tmp_end)) {
2426 DEBUG4K_ERROR("LOAD_NOSPACE tmp_end: 0x%llx + 0x%llx\n", (uint64_t)tmp_start, (uint64_t)delta_size);
2427 return LOAD_NOSPACE;
2428 }
2429
2430 if (verbose) {
2431 MACHO_PRINTF(("++++++ load_segment: "
2432 "delta mapping vm [0x%llx:0x%llx]\n",
2433 (uint64_t) tmp_start,
2434 (uint64_t) tmp_end));
2435 }
2436 kr = map_segment(map,
2437 tmp_start,
2438 tmp_end,
2439 MEMORY_OBJECT_CONTROL_NULL,
2440 0,
2441 delta_size,
2442 scp->initprot,
2443 scp->maxprot,
2444 result);
2445 if (kr != KERN_SUCCESS) {
2446 DEBUG4K_ERROR("LOAD_NOSPACE 0x%llx 0x%llx kr 0x%x\n", (unsigned long long)tmp_start, (uint64_t)delta_size, kr);
2447 return LOAD_NOSPACE;
2448 }
2449 }
2450
2451 if ((scp->fileoff == 0) && (scp->filesize != 0)) {
2452 result->mach_header = vm_offset;
2453 }
2454
2455 if (scp->flags & SG_PROTECTED_VERSION_1) {
2456 ret = unprotect_dsmos_segment(file_start,
2457 file_end - file_start,
2458 vp,
2459 pager_offset,
2460 map,
2461 vm_start,
2462 vm_end - vm_start);
2463 if (ret != LOAD_SUCCESS) {
2464 DEBUG4K_ERROR("unprotect 0x%llx 0x%llx ret %d \n", (uint64_t)vm_start, (uint64_t)vm_end, ret);
2465 return ret;
2466 }
2467 } else {
2468 ret = LOAD_SUCCESS;
2469 }
2470
2471 if (LOAD_SUCCESS == ret &&
2472 filetype == MH_DYLINKER &&
2473 result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
2474 note_all_image_info_section(scp,
2475 LC_SEGMENT_64 == lcp->cmd,
2476 single_section_size,
2477 ((const char *)lcp +
2478 segment_command_size),
2479 slide,
2480 result);
2481 }
2482
2483 if (result->entry_point != MACH_VM_MIN_ADDRESS) {
2484 if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
2485 if ((scp->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) == (VM_PROT_READ | VM_PROT_EXECUTE)) {
2486 result->validentry = 1;
2487 } else {
2488 /* right range but wrong protections, unset if previously validated */
2489 result->validentry = 0;
2490 }
2491 }
2492 }
2493
2494 if (ret != LOAD_SUCCESS && verbose) {
2495 DEBUG4K_ERROR("ret %d\n", ret);
2496 }
2497 return ret;
2498 }
2499
2500 static
2501 load_return_t
load_uuid(struct uuid_command * uulp,char * command_end,load_result_t * result)2502 load_uuid(
2503 struct uuid_command *uulp,
2504 char *command_end,
2505 load_result_t *result
2506 )
2507 {
2508 /*
2509 * We need to check the following for this command:
2510 * - The command size should be atleast the size of struct uuid_command
2511 * - The UUID part of the command should be completely within the mach-o header
2512 */
2513
2514 if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
2515 (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
2516 return LOAD_BADMACHO;
2517 }
2518
2519 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
2520 return LOAD_SUCCESS;
2521 }
2522
2523 static
2524 load_return_t
load_version(struct version_min_command * vmc,boolean_t * found_version_cmd,int ip_flags __unused,load_result_t * result)2525 load_version(
2526 struct version_min_command *vmc,
2527 boolean_t *found_version_cmd,
2528 int ip_flags __unused,
2529 load_result_t *result
2530 )
2531 {
2532 uint32_t platform = 0;
2533 uint32_t sdk;
2534 uint32_t min_sdk;
2535
2536 if (vmc->cmdsize < sizeof(*vmc)) {
2537 return LOAD_BADMACHO;
2538 }
2539 if (*found_version_cmd == TRUE) {
2540 return LOAD_BADMACHO;
2541 }
2542 *found_version_cmd = TRUE;
2543 sdk = vmc->sdk;
2544 min_sdk = vmc->version;
2545 switch (vmc->cmd) {
2546 case LC_VERSION_MIN_MACOSX:
2547 platform = PLATFORM_MACOS;
2548 break;
2549 #if __x86_64__ /* __x86_64__ */
2550 case LC_VERSION_MIN_IPHONEOS:
2551 platform = PLATFORM_IOSSIMULATOR;
2552 break;
2553 case LC_VERSION_MIN_WATCHOS:
2554 platform = PLATFORM_WATCHOSSIMULATOR;
2555 break;
2556 case LC_VERSION_MIN_TVOS:
2557 platform = PLATFORM_TVOSSIMULATOR;
2558 break;
2559 #else
2560 case LC_VERSION_MIN_IPHONEOS: {
2561 #if __arm64__
2562 if (vmc->sdk < (12 << 16)) {
2563 /* app built with a pre-iOS12 SDK: apply legacy footprint mitigation */
2564 result->legacy_footprint = TRUE;
2565 }
2566 #endif /* __arm64__ */
2567 platform = PLATFORM_IOS;
2568 break;
2569 }
2570 case LC_VERSION_MIN_WATCHOS:
2571 platform = PLATFORM_WATCHOS;
2572 break;
2573 case LC_VERSION_MIN_TVOS:
2574 platform = PLATFORM_TVOS;
2575 break;
2576 #endif /* __x86_64__ */
2577 /* All LC_VERSION_MIN_* load commands are legacy and we will not be adding any more */
2578 default:
2579 sdk = (uint32_t)-1;
2580 min_sdk = (uint32_t)-1;
2581 __builtin_unreachable();
2582 }
2583 result->ip_platform = platform;
2584 result->lr_min_sdk = min_sdk;
2585 result->lr_sdk = sdk;
2586 return LOAD_SUCCESS;
2587 }
2588
2589 static
2590 load_return_t
load_main(struct entry_point_command * epc,thread_t thread,int64_t slide,load_result_t * result)2591 load_main(
2592 struct entry_point_command *epc,
2593 thread_t thread,
2594 int64_t slide,
2595 load_result_t *result
2596 )
2597 {
2598 mach_vm_offset_t addr;
2599 kern_return_t ret;
2600
2601 if (epc->cmdsize < sizeof(*epc)) {
2602 return LOAD_BADMACHO;
2603 }
2604 if (result->thread_count != 0) {
2605 return LOAD_FAILURE;
2606 }
2607
2608 if (thread == THREAD_NULL) {
2609 return LOAD_SUCCESS;
2610 }
2611
2612 /*
2613 * LC_MAIN specifies stack size but not location.
2614 * Add guard page to allocation size (MAXSSIZ includes guard page).
2615 */
2616 if (epc->stacksize) {
2617 if (os_add_overflow(epc->stacksize, 4 * PAGE_SIZE, &result->user_stack_size)) {
2618 /*
2619 * We are going to immediately throw away this result, but we want
2620 * to make sure we aren't loading a dangerously close to
2621 * overflowing value, since this will have a guard page added to it
2622 * and be rounded to page boundaries
2623 */
2624 return LOAD_BADMACHO;
2625 }
2626 result->user_stack_size = epc->stacksize;
2627 if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
2628 return LOAD_BADMACHO;
2629 }
2630 result->custom_stack = TRUE;
2631 } else {
2632 result->user_stack_alloc_size = MAXSSIZ;
2633 }
2634
2635 /* use default location for stack */
2636 ret = thread_userstackdefault(&addr, result->is_64bit_addr);
2637 if (ret != KERN_SUCCESS) {
2638 return LOAD_FAILURE;
2639 }
2640
2641 /* The stack slides down from the default location */
2642 result->user_stack = (user_addr_t)mach_vm_trunc_page((user_addr_t)addr - slide);
2643
2644 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2645 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2646 return LOAD_FAILURE;
2647 }
2648
2649 /* kernel does *not* use entryoff from LC_MAIN. Dyld uses it. */
2650 result->needs_dynlinker = TRUE;
2651 result->using_lcmain = TRUE;
2652
2653 ret = thread_state_initialize( thread );
2654 if (ret != KERN_SUCCESS) {
2655 return LOAD_FAILURE;
2656 }
2657
2658 result->unixproc = TRUE;
2659 result->thread_count++;
2660
2661 return LOAD_SUCCESS;
2662 }
2663
2664 static
2665 load_return_t
setup_driver_main(thread_t thread,int64_t slide,load_result_t * result)2666 setup_driver_main(
2667 thread_t thread,
2668 int64_t slide,
2669 load_result_t *result
2670 )
2671 {
2672 mach_vm_offset_t addr;
2673 kern_return_t ret;
2674
2675 /* Driver binaries have no LC_MAIN, use defaults */
2676
2677 if (thread == THREAD_NULL) {
2678 return LOAD_SUCCESS;
2679 }
2680
2681 result->user_stack_alloc_size = MAXSSIZ;
2682
2683 /* use default location for stack */
2684 ret = thread_userstackdefault(&addr, result->is_64bit_addr);
2685 if (ret != KERN_SUCCESS) {
2686 return LOAD_FAILURE;
2687 }
2688
2689 /* The stack slides down from the default location */
2690 result->user_stack = (user_addr_t)addr;
2691 result->user_stack -= slide;
2692
2693 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2694 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2695 return LOAD_FAILURE;
2696 }
2697
2698 result->needs_dynlinker = TRUE;
2699
2700 ret = thread_state_initialize( thread );
2701 if (ret != KERN_SUCCESS) {
2702 return LOAD_FAILURE;
2703 }
2704
2705 result->unixproc = TRUE;
2706 result->thread_count++;
2707
2708 return LOAD_SUCCESS;
2709 }
2710
2711 static
2712 load_return_t
load_unixthread(struct thread_command * tcp,thread_t thread,int64_t slide,boolean_t is_x86_64_compat_binary,load_result_t * result)2713 load_unixthread(
2714 struct thread_command *tcp,
2715 thread_t thread,
2716 int64_t slide,
2717 boolean_t is_x86_64_compat_binary,
2718 load_result_t *result
2719 )
2720 {
2721 load_return_t ret;
2722 int customstack = 0;
2723 mach_vm_offset_t addr;
2724 if (tcp->cmdsize < sizeof(*tcp)) {
2725 return LOAD_BADMACHO;
2726 }
2727 if (result->thread_count != 0) {
2728 return LOAD_FAILURE;
2729 }
2730
2731 if (thread == THREAD_NULL) {
2732 return LOAD_SUCCESS;
2733 }
2734
2735 ret = load_threadstack(thread,
2736 (uint32_t *)(((vm_offset_t)tcp) +
2737 sizeof(struct thread_command)),
2738 tcp->cmdsize - sizeof(struct thread_command),
2739 &addr, &customstack, is_x86_64_compat_binary, result);
2740 if (ret != LOAD_SUCCESS) {
2741 return ret;
2742 }
2743
2744 /* LC_UNIXTHREAD optionally specifies stack size and location */
2745
2746 if (customstack) {
2747 result->custom_stack = TRUE;
2748 } else {
2749 result->user_stack_alloc_size = MAXSSIZ;
2750 }
2751
2752 /* The stack slides down from the default location */
2753 result->user_stack = (user_addr_t)mach_vm_trunc_page((user_addr_t)addr - slide);
2754
2755 {
2756 ret = load_threadentry(thread,
2757 (uint32_t *)(((vm_offset_t)tcp) +
2758 sizeof(struct thread_command)),
2759 tcp->cmdsize - sizeof(struct thread_command),
2760 &addr);
2761 if (ret != LOAD_SUCCESS) {
2762 return ret;
2763 }
2764
2765 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2766 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2767 return LOAD_FAILURE;
2768 }
2769
2770 result->entry_point = (user_addr_t)addr;
2771 result->entry_point += slide;
2772
2773 ret = load_threadstate(thread,
2774 (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
2775 tcp->cmdsize - sizeof(struct thread_command),
2776 result);
2777 if (ret != LOAD_SUCCESS) {
2778 return ret;
2779 }
2780 }
2781
2782 result->unixproc = TRUE;
2783 result->thread_count++;
2784
2785 return LOAD_SUCCESS;
2786 }
2787
2788 static
2789 load_return_t
load_threadstate(thread_t thread,uint32_t * ts,uint32_t total_size,load_result_t * result)2790 load_threadstate(
2791 thread_t thread,
2792 uint32_t *ts,
2793 uint32_t total_size,
2794 load_result_t *result
2795 )
2796 {
2797 uint32_t size;
2798 int flavor;
2799 uint32_t thread_size;
2800 uint32_t *local_ts = NULL;
2801 uint32_t local_ts_size = 0;
2802 int ret;
2803
2804 (void)thread;
2805
2806 if (total_size > 0) {
2807 local_ts_size = total_size;
2808 local_ts = (uint32_t *)kalloc_data(local_ts_size, Z_WAITOK);
2809 if (local_ts == NULL) {
2810 return LOAD_FAILURE;
2811 }
2812 memcpy(local_ts, ts, local_ts_size);
2813 ts = local_ts;
2814 }
2815
2816 /*
2817 * Validate the new thread state; iterate through the state flavors in
2818 * the Mach-O file.
2819 * XXX: we should validate the machine state here, to avoid failing at
2820 * activation time where we can't bail out cleanly.
2821 */
2822 while (total_size > 0) {
2823 if (total_size < 2 * sizeof(uint32_t)) {
2824 return LOAD_BADMACHO;
2825 }
2826
2827 flavor = *ts++;
2828 size = *ts++;
2829
2830 if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
2831 os_sub_overflow(total_size, thread_size, &total_size)) {
2832 ret = LOAD_BADMACHO;
2833 goto bad;
2834 }
2835
2836 ts += size; /* ts is a (uint32_t *) */
2837 }
2838
2839 result->threadstate = local_ts;
2840 result->threadstate_sz = local_ts_size;
2841 return LOAD_SUCCESS;
2842
2843 bad:
2844 if (local_ts) {
2845 kfree_data(local_ts, local_ts_size);
2846 }
2847 return ret;
2848 }
2849
2850
2851 static
2852 load_return_t
load_threadstack(thread_t thread,uint32_t * ts,uint32_t total_size,mach_vm_offset_t * user_stack,int * customstack,__unused boolean_t is_x86_64_compat_binary,load_result_t * result)2853 load_threadstack(
2854 thread_t thread,
2855 uint32_t *ts,
2856 uint32_t total_size,
2857 mach_vm_offset_t *user_stack,
2858 int *customstack,
2859 __unused boolean_t is_x86_64_compat_binary,
2860 load_result_t *result
2861 )
2862 {
2863 kern_return_t ret;
2864 uint32_t size;
2865 int flavor;
2866 uint32_t stack_size;
2867
2868 if (total_size == 0) {
2869 return LOAD_BADMACHO;
2870 }
2871
2872 while (total_size > 0) {
2873 if (total_size < 2 * sizeof(uint32_t)) {
2874 return LOAD_BADMACHO;
2875 }
2876
2877 flavor = *ts++;
2878 size = *ts++;
2879 if (UINT32_MAX - 2 < size ||
2880 UINT32_MAX / sizeof(uint32_t) < size + 2) {
2881 return LOAD_BADMACHO;
2882 }
2883 stack_size = (size + 2) * sizeof(uint32_t);
2884 if (stack_size > total_size) {
2885 return LOAD_BADMACHO;
2886 }
2887 total_size -= stack_size;
2888
2889 /*
2890 * Third argument is a kernel space pointer; it gets cast
2891 * to the appropriate type in thread_userstack() based on
2892 * the value of flavor.
2893 */
2894 {
2895 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is_64bit_data);
2896 if (ret != KERN_SUCCESS) {
2897 return LOAD_FAILURE;
2898 }
2899 }
2900
2901 ts += size; /* ts is a (uint32_t *) */
2902 }
2903 return LOAD_SUCCESS;
2904 }
2905
2906 static
2907 load_return_t
load_threadentry(thread_t thread,uint32_t * ts,uint32_t total_size,mach_vm_offset_t * entry_point)2908 load_threadentry(
2909 thread_t thread,
2910 uint32_t *ts,
2911 uint32_t total_size,
2912 mach_vm_offset_t *entry_point
2913 )
2914 {
2915 kern_return_t ret;
2916 uint32_t size;
2917 int flavor;
2918 uint32_t entry_size;
2919
2920 /*
2921 * Set the thread state.
2922 */
2923 *entry_point = MACH_VM_MIN_ADDRESS;
2924 while (total_size > 0) {
2925 if (total_size < 2 * sizeof(uint32_t)) {
2926 return LOAD_BADMACHO;
2927 }
2928
2929 flavor = *ts++;
2930 size = *ts++;
2931 if (UINT32_MAX - 2 < size ||
2932 UINT32_MAX / sizeof(uint32_t) < size + 2) {
2933 return LOAD_BADMACHO;
2934 }
2935 entry_size = (size + 2) * sizeof(uint32_t);
2936 if (entry_size > total_size) {
2937 return LOAD_BADMACHO;
2938 }
2939 total_size -= entry_size;
2940 /*
2941 * Third argument is a kernel space pointer; it gets cast
2942 * to the appropriate type in thread_entrypoint() based on
2943 * the value of flavor.
2944 */
2945 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
2946 if (ret != KERN_SUCCESS) {
2947 return LOAD_FAILURE;
2948 }
2949 ts += size; /* ts is a (uint32_t *) */
2950 }
2951 return LOAD_SUCCESS;
2952 }
2953
2954 struct macho_data {
2955 struct nameidata __nid;
2956 union macho_vnode_header {
2957 struct mach_header mach_header;
2958 struct fat_header fat_header;
2959 char __pad[512];
2960 } __header;
2961 };
2962
2963 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
2964
2965 #if (DEVELOPMENT || DEBUG)
2966 extern char dyld_alt_path[];
2967 extern int use_alt_dyld;
2968 #endif
2969
2970 static load_return_t
load_dylinker(struct dylinker_command * lcp,cpu_type_t cputype,vm_map_t map,thread_t thread,int depth,int64_t slide,load_result_t * result,struct image_params * imgp)2971 load_dylinker(
2972 struct dylinker_command *lcp,
2973 cpu_type_t cputype,
2974 vm_map_t map,
2975 thread_t thread,
2976 int depth,
2977 int64_t slide,
2978 load_result_t *result,
2979 struct image_params *imgp
2980 )
2981 {
2982 const char *name;
2983 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
2984 struct mach_header *header;
2985 off_t file_offset = 0; /* set by get_macho_vnode() */
2986 off_t macho_size = 0; /* set by get_macho_vnode() */
2987 load_result_t *myresult;
2988 kern_return_t ret;
2989 struct macho_data *macho_data;
2990 struct {
2991 struct mach_header __header;
2992 load_result_t __myresult;
2993 struct macho_data __macho_data;
2994 } *dyld_data;
2995
2996 if (lcp->cmdsize < sizeof(*lcp) || lcp->name.offset >= lcp->cmdsize) {
2997 return LOAD_BADMACHO;
2998 }
2999
3000 name = (const char *)lcp + lcp->name.offset;
3001
3002 /* Check for a proper null terminated string. */
3003 size_t maxsz = lcp->cmdsize - lcp->name.offset;
3004 size_t namelen = strnlen(name, maxsz);
3005 if (namelen >= maxsz) {
3006 return LOAD_BADMACHO;
3007 }
3008
3009 #if (DEVELOPMENT || DEBUG)
3010
3011 /*
3012 * rdar://23680808
3013 * If an alternate dyld has been specified via boot args, check
3014 * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
3015 * executable and redirect the kernel to load that linker.
3016 */
3017
3018 if (use_alt_dyld) {
3019 int policy_error;
3020 uint32_t policy_flags = 0;
3021 int32_t policy_gencount = 0;
3022
3023 policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
3024 if (policy_error == 0) {
3025 if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
3026 name = dyld_alt_path;
3027 }
3028 }
3029 }
3030 #endif
3031
3032 #if !(DEVELOPMENT || DEBUG)
3033 if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
3034 return LOAD_BADMACHO;
3035 }
3036 #endif
3037
3038 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
3039
3040 dyld_data = kalloc_type(typeof(*dyld_data), Z_WAITOK);
3041 header = &dyld_data->__header;
3042 myresult = &dyld_data->__myresult;
3043 macho_data = &dyld_data->__macho_data;
3044
3045 {
3046 cputype = (cputype & CPU_ARCH_MASK) | (cpu_type() & ~CPU_ARCH_MASK);
3047 }
3048
3049 ret = get_macho_vnode(name, cputype, header,
3050 &file_offset, &macho_size, macho_data, &vp, imgp);
3051 if (ret) {
3052 goto novp_out;
3053 }
3054
3055 *myresult = load_result_null;
3056 myresult->is_64bit_addr = result->is_64bit_addr;
3057 myresult->is_64bit_data = result->is_64bit_data;
3058
3059 ret = parse_machfile(vp, map, thread, header, file_offset,
3060 macho_size, depth, slide, 0, myresult, result, imgp);
3061
3062 if (ret == LOAD_SUCCESS) {
3063 if (result->threadstate) {
3064 /* don't use the app's threadstate if we have a dyld */
3065 kfree_data(result->threadstate, result->threadstate_sz);
3066 }
3067 result->threadstate = myresult->threadstate;
3068 result->threadstate_sz = myresult->threadstate_sz;
3069
3070 result->dynlinker = TRUE;
3071 result->entry_point = myresult->entry_point;
3072 result->validentry = myresult->validentry;
3073 result->all_image_info_addr = myresult->all_image_info_addr;
3074 result->all_image_info_size = myresult->all_image_info_size;
3075 if (!myresult->platform_binary) {
3076 result->csflags &= ~CS_NO_UNTRUSTED_HELPERS;
3077 }
3078
3079 }
3080
3081 struct vnode_attr *va;
3082 va = kalloc_type(struct vnode_attr, Z_WAITOK | Z_ZERO);
3083 VATTR_INIT(va);
3084 VATTR_WANTED(va, va_fsid64);
3085 VATTR_WANTED(va, va_fsid);
3086 VATTR_WANTED(va, va_fileid);
3087 int error = vnode_getattr(vp, va, imgp->ip_vfs_context);
3088 if (error == 0) {
3089 imgp->ip_dyld_fsid = vnode_get_va_fsid(va);
3090 imgp->ip_dyld_fsobjid = va->va_fileid;
3091 }
3092
3093 vnode_put(vp);
3094 kfree_type(struct vnode_attr, va);
3095 novp_out:
3096 kfree_type(typeof(*dyld_data), dyld_data);
3097 return ret;
3098 }
3099
3100
3101 static load_return_t
load_code_signature(struct linkedit_data_command * lcp,struct vnode * vp,off_t macho_offset,off_t macho_size,cpu_type_t cputype,cpu_subtype_t cpusubtype,load_result_t * result,struct image_params * imgp)3102 load_code_signature(
3103 struct linkedit_data_command *lcp,
3104 struct vnode *vp,
3105 off_t macho_offset,
3106 off_t macho_size,
3107 cpu_type_t cputype,
3108 cpu_subtype_t cpusubtype,
3109 load_result_t *result,
3110 struct image_params *imgp)
3111 {
3112 int ret;
3113 kern_return_t kr;
3114 vm_offset_t addr;
3115 int resid;
3116 struct cs_blob *blob;
3117 int error;
3118 vm_size_t blob_size;
3119 uint32_t sum;
3120 boolean_t anyCPU;
3121
3122 addr = 0;
3123 blob = NULL;
3124
3125 cpusubtype &= ~CPU_SUBTYPE_MASK;
3126
3127 if (lcp->cmdsize != sizeof(struct linkedit_data_command)) {
3128 ret = LOAD_BADMACHO;
3129 goto out;
3130 }
3131
3132 sum = 0;
3133 if (os_add_overflow(lcp->dataoff, lcp->datasize, &sum) || sum > macho_size) {
3134 ret = LOAD_BADMACHO;
3135 goto out;
3136 }
3137
3138 blob = ubc_cs_blob_get(vp, cputype, cpusubtype, macho_offset);
3139
3140 if (blob != NULL) {
3141 /* we already have a blob for this vnode and cpu(sub)type */
3142 anyCPU = blob->csb_cpu_type == -1;
3143 if ((blob->csb_cpu_type != cputype &&
3144 blob->csb_cpu_subtype != cpusubtype && !anyCPU) ||
3145 blob->csb_base_offset != macho_offset) {
3146 /* the blob has changed for this vnode: fail ! */
3147 ret = LOAD_BADMACHO;
3148 goto out;
3149 }
3150
3151 /* It matches the blob we want here, let's verify the version */
3152 if (!anyCPU && ubc_cs_generation_check(vp) == 0) {
3153 /* No need to revalidate, we're good! */
3154 ret = LOAD_SUCCESS;
3155 goto out;
3156 }
3157
3158 /* That blob may be stale, let's revalidate. */
3159 error = ubc_cs_blob_revalidate(vp, blob, imgp, 0, result->ip_platform);
3160 if (error == 0) {
3161 /* Revalidation succeeded, we're good! */
3162 /* If we were revaliding a CS blob with any CPU arch we adjust it */
3163 if (anyCPU) {
3164 vnode_lock_spin(vp);
3165 struct cs_cpu_info cpu_info = {
3166 .csb_cpu_type = cputype,
3167 .csb_cpu_subtype = cpusubtype
3168 };
3169 zalloc_ro_update_field(ZONE_ID_CS_BLOB, blob, csb_cpu_info, &cpu_info);
3170 vnode_unlock(vp);
3171 }
3172 ret = LOAD_SUCCESS;
3173 goto out;
3174 }
3175
3176 if (error != EAGAIN) {
3177 printf("load_code_signature: revalidation failed: %d\n", error);
3178 ret = LOAD_FAILURE;
3179 goto out;
3180 }
3181
3182 assert(error == EAGAIN);
3183
3184 /*
3185 * Revalidation was not possible for this blob. We just continue as if there was no blob,
3186 * rereading the signature, and ubc_cs_blob_add will do the right thing.
3187 */
3188 blob = NULL;
3189 }
3190
3191 blob_size = lcp->datasize;
3192 kr = ubc_cs_blob_allocate(&addr, &blob_size);
3193 if (kr != KERN_SUCCESS) {
3194 ret = LOAD_NOSPACE;
3195 goto out;
3196 }
3197
3198 resid = 0;
3199 error = vn_rdwr(UIO_READ,
3200 vp,
3201 (caddr_t) addr,
3202 lcp->datasize,
3203 macho_offset + lcp->dataoff,
3204 UIO_SYSSPACE,
3205 0,
3206 kauth_cred_get(),
3207 &resid,
3208 current_proc());
3209 if (error || resid != 0) {
3210 ret = LOAD_IOERROR;
3211 goto out;
3212 }
3213
3214 if (ubc_cs_blob_add(vp,
3215 result->ip_platform,
3216 cputype,
3217 cpusubtype,
3218 macho_offset,
3219 &addr,
3220 lcp->datasize,
3221 imgp,
3222 0,
3223 &blob)) {
3224 if (addr) {
3225 ubc_cs_blob_deallocate(addr, blob_size);
3226 addr = 0;
3227 }
3228 ret = LOAD_FAILURE;
3229 goto out;
3230 } else {
3231 /* ubc_cs_blob_add() has consumed "addr" */
3232 addr = 0;
3233 }
3234
3235 #if CHECK_CS_VALIDATION_BITMAP
3236 ubc_cs_validation_bitmap_allocate( vp );
3237 #endif
3238
3239 ret = LOAD_SUCCESS;
3240 out:
3241 if (ret == LOAD_SUCCESS) {
3242 if (blob == NULL) {
3243 panic("success, but no blob!");
3244 }
3245
3246 result->csflags |= blob->csb_flags;
3247 result->platform_binary = blob->csb_platform_binary;
3248 result->cs_end_offset = blob->csb_end_offset;
3249 }
3250 if (addr != 0) {
3251 ubc_cs_blob_deallocate(addr, blob_size);
3252 addr = 0;
3253 }
3254
3255 return ret;
3256 }
3257
3258
3259 #if CONFIG_CODE_DECRYPTION
3260
3261 static load_return_t
set_code_unprotect(struct encryption_info_command * eip,caddr_t addr,vm_map_t map,int64_t slide,struct vnode * vp,off_t macho_offset,cpu_type_t cputype,cpu_subtype_t cpusubtype)3262 set_code_unprotect(
3263 struct encryption_info_command *eip,
3264 caddr_t addr,
3265 vm_map_t map,
3266 int64_t slide,
3267 struct vnode *vp,
3268 off_t macho_offset,
3269 cpu_type_t cputype,
3270 cpu_subtype_t cpusubtype)
3271 {
3272 int error, len;
3273 pager_crypt_info_t crypt_info;
3274 const char * cryptname = 0;
3275 char *vpath;
3276
3277 size_t offset;
3278 struct segment_command_64 *seg64;
3279 struct segment_command *seg32;
3280 vm_map_offset_t map_offset, map_size;
3281 vm_object_offset_t crypto_backing_offset;
3282 kern_return_t kr;
3283
3284 if (eip->cmdsize < sizeof(*eip)) {
3285 return LOAD_BADMACHO;
3286 }
3287
3288 switch (eip->cryptid) {
3289 case 0:
3290 /* not encrypted, just an empty load command */
3291 return LOAD_SUCCESS;
3292 case 1:
3293 cryptname = "com.apple.unfree";
3294 break;
3295 case 0x10:
3296 /* some random cryptid that you could manually put into
3297 * your binary if you want NULL */
3298 cryptname = "com.apple.null";
3299 break;
3300 default:
3301 return LOAD_BADMACHO;
3302 }
3303
3304 if (map == VM_MAP_NULL) {
3305 return LOAD_SUCCESS;
3306 }
3307 if (NULL == text_crypter_create) {
3308 return LOAD_FAILURE;
3309 }
3310
3311 vpath = zalloc(ZV_NAMEI);
3312
3313 len = MAXPATHLEN;
3314 error = vn_getpath(vp, vpath, &len);
3315 if (error) {
3316 zfree(ZV_NAMEI, vpath);
3317 return LOAD_FAILURE;
3318 }
3319
3320 if (eip->cryptsize == 0) {
3321 printf("%s:%d '%s': cryptoff 0x%llx cryptsize 0x%llx cryptid 0x%x ignored\n", __FUNCTION__, __LINE__, vpath, (uint64_t)eip->cryptoff, (uint64_t)eip->cryptsize, eip->cryptid);
3322 zfree(ZV_NAMEI, vpath);
3323 return LOAD_SUCCESS;
3324 }
3325
3326 /* set up decrypter first */
3327 crypt_file_data_t crypt_data = {
3328 .filename = vpath,
3329 .cputype = cputype,
3330 .cpusubtype = cpusubtype
3331 };
3332 kr = text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
3333 #if VM_MAP_DEBUG_APPLE_PROTECT
3334 if (vm_map_debug_apple_protect) {
3335 struct proc *p;
3336 p = current_proc();
3337 printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
3338 proc_getpid(p), p->p_comm, map, __FUNCTION__, vpath, kr);
3339 }
3340 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
3341 zfree(ZV_NAMEI, vpath);
3342
3343 if (kr) {
3344 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
3345 cryptname, kr);
3346 if (kr == kIOReturnNotPrivileged) {
3347 /* text encryption returned decryption failure */
3348 return LOAD_DECRYPTFAIL;
3349 } else {
3350 return LOAD_RESOURCE;
3351 }
3352 }
3353
3354 /* this is terrible, but we have to rescan the load commands to find the
3355 * virtual address of this encrypted stuff. This code is gonna look like
3356 * the dyld source one day... */
3357 struct mach_header *header = (struct mach_header *)addr;
3358 size_t mach_header_sz = sizeof(struct mach_header);
3359 if (header->magic == MH_MAGIC_64 ||
3360 header->magic == MH_CIGAM_64) {
3361 mach_header_sz = sizeof(struct mach_header_64);
3362 }
3363 offset = mach_header_sz;
3364 uint32_t ncmds = header->ncmds;
3365 while (ncmds--) {
3366 /*
3367 * Get a pointer to the command.
3368 */
3369 struct load_command *lcp = (struct load_command *)(addr + offset);
3370 offset += lcp->cmdsize;
3371
3372 switch (lcp->cmd) {
3373 case LC_SEGMENT_64:
3374 seg64 = (struct segment_command_64 *)lcp;
3375 if ((seg64->fileoff <= eip->cryptoff) &&
3376 (seg64->fileoff + seg64->filesize >=
3377 eip->cryptoff + eip->cryptsize)) {
3378 map_offset = (vm_map_offset_t)(seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide);
3379 map_size = eip->cryptsize;
3380 crypto_backing_offset = macho_offset + eip->cryptoff;
3381 goto remap_now;
3382 }
3383 break;
3384 case LC_SEGMENT:
3385 seg32 = (struct segment_command *)lcp;
3386 if ((seg32->fileoff <= eip->cryptoff) &&
3387 (seg32->fileoff + seg32->filesize >=
3388 eip->cryptoff + eip->cryptsize)) {
3389 map_offset = (vm_map_offset_t)(seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide);
3390 map_size = eip->cryptsize;
3391 crypto_backing_offset = macho_offset + eip->cryptoff;
3392 goto remap_now;
3393 }
3394 break;
3395 }
3396 }
3397
3398 /* if we get here, did not find anything */
3399 return LOAD_BADMACHO;
3400
3401 remap_now:
3402 /* now remap using the decrypter */
3403 MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
3404 (uint64_t) map_offset,
3405 (uint64_t) (map_offset + map_size)));
3406 kr = vm_map_apple_protected(map,
3407 map_offset,
3408 map_offset + map_size,
3409 crypto_backing_offset,
3410 &crypt_info,
3411 CRYPTID_APP_ENCRYPTION);
3412 if (kr) {
3413 printf("set_code_unprotect(): mapping failed with %x\n", kr);
3414 return LOAD_PROTECT;
3415 }
3416
3417 return LOAD_SUCCESS;
3418 }
3419
3420 #endif
3421
3422 /*
3423 * This routine exists to support the load_dylinker().
3424 *
3425 * This routine has its own, separate, understanding of the FAT file format,
3426 * which is terrifically unfortunate.
3427 */
3428 static
3429 load_return_t
get_macho_vnode(const char * path,cpu_type_t cputype,struct mach_header * mach_header,off_t * file_offset,off_t * macho_size,struct macho_data * data,struct vnode ** vpp,struct image_params * imgp)3430 get_macho_vnode(
3431 const char *path,
3432 cpu_type_t cputype,
3433 struct mach_header *mach_header,
3434 off_t *file_offset,
3435 off_t *macho_size,
3436 struct macho_data *data,
3437 struct vnode **vpp,
3438 struct image_params *imgp
3439 )
3440 {
3441 struct vnode *vp;
3442 vfs_context_t ctx = vfs_context_current();
3443 proc_t p = vfs_context_proc(ctx);
3444 kauth_cred_t kerncred;
3445 struct nameidata *ndp = &data->__nid;
3446 boolean_t is_fat;
3447 struct fat_arch fat_arch;
3448 int error;
3449 int resid;
3450 union macho_vnode_header *header = &data->__header;
3451 off_t fsize = (off_t)0;
3452
3453 /*
3454 * Capture the kernel credential for use in the actual read of the
3455 * file, since the user doing the execution may have execute rights
3456 * but not read rights, but to exec something, we have to either map
3457 * or read it into the new process address space, which requires
3458 * read rights. This is to deal with lack of common credential
3459 * serialization code which would treat NOCRED as "serialize 'root'".
3460 */
3461 kerncred = vfs_context_ucred(vfs_context_kernel());
3462
3463 /* init the namei data to point the file user's program name */
3464 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
3465
3466 if ((error = namei(ndp)) != 0) {
3467 if (error == ENOENT) {
3468 error = LOAD_ENOENT;
3469 } else {
3470 error = LOAD_FAILURE;
3471 }
3472 return error;
3473 }
3474 nameidone(ndp);
3475 vp = ndp->ni_vp;
3476
3477 /* check for regular file */
3478 if (vp->v_type != VREG) {
3479 error = LOAD_PROTECT;
3480 goto bad1;
3481 }
3482
3483 /* get size */
3484 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
3485 error = LOAD_FAILURE;
3486 goto bad1;
3487 }
3488
3489 /* Check mount point */
3490 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
3491 error = LOAD_PROTECT;
3492 goto bad1;
3493 }
3494
3495 /* check access */
3496 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
3497 error = LOAD_PROTECT;
3498 goto bad1;
3499 }
3500
3501 /* try to open it */
3502 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
3503 error = LOAD_PROTECT;
3504 goto bad1;
3505 }
3506
3507 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof(*header), 0,
3508 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
3509 error = LOAD_IOERROR;
3510 goto bad2;
3511 }
3512
3513 if (resid) {
3514 error = LOAD_BADMACHO;
3515 goto bad2;
3516 }
3517
3518 if (header->mach_header.magic == MH_MAGIC ||
3519 header->mach_header.magic == MH_MAGIC_64) {
3520 is_fat = FALSE;
3521 } else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
3522 is_fat = TRUE;
3523 } else {
3524 error = LOAD_BADMACHO;
3525 goto bad2;
3526 }
3527
3528 if (is_fat) {
3529 error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
3530 sizeof(*header));
3531 if (error != LOAD_SUCCESS) {
3532 goto bad2;
3533 }
3534
3535 /* Look up our architecture in the fat file. */
3536 error = fatfile_getbestarch_for_cputype(cputype, CPU_SUBTYPE_ANY,
3537 (vm_offset_t)(&header->fat_header), sizeof(*header), imgp, &fat_arch);
3538 if (error != LOAD_SUCCESS) {
3539 goto bad2;
3540 }
3541
3542 /* Read the Mach-O header out of it */
3543 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
3544 sizeof(header->mach_header), fat_arch.offset,
3545 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
3546 if (error) {
3547 error = LOAD_IOERROR;
3548 goto bad2;
3549 }
3550
3551 if (resid) {
3552 error = LOAD_BADMACHO;
3553 goto bad2;
3554 }
3555
3556 /* Is this really a Mach-O? */
3557 if (header->mach_header.magic != MH_MAGIC &&
3558 header->mach_header.magic != MH_MAGIC_64) {
3559 error = LOAD_BADMACHO;
3560 goto bad2;
3561 }
3562
3563 *file_offset = fat_arch.offset;
3564 *macho_size = fat_arch.size;
3565 } else {
3566 /*
3567 * Force get_macho_vnode() to fail if the architecture bits
3568 * do not match the expected architecture bits. This in
3569 * turn causes load_dylinker() to fail for the same reason,
3570 * so it ensures the dynamic linker and the binary are in
3571 * lock-step. This is potentially bad, if we ever add to
3572 * the CPU_ARCH_* bits any bits that are desirable but not
3573 * required, since the dynamic linker might work, but we will
3574 * refuse to load it because of this check.
3575 */
3576 if ((cpu_type_t)header->mach_header.cputype != cputype) {
3577 error = LOAD_BADARCH;
3578 goto bad2;
3579 }
3580
3581 *file_offset = 0;
3582 *macho_size = fsize;
3583 }
3584
3585 *mach_header = header->mach_header;
3586 *vpp = vp;
3587
3588 ubc_setsize(vp, fsize);
3589 return error;
3590
3591 bad2:
3592 (void) VNOP_CLOSE(vp, FREAD, ctx);
3593 bad1:
3594 vnode_put(vp);
3595 return error;
3596 }
3597