1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (C) 1988, 1989, NeXT, Inc.
30 *
31 * File: kern/mach_loader.c
32 * Author: Avadis Tevanian, Jr.
33 *
34 * Mach object file loader (kernel version, for now).
35 *
36 * 21-Jul-88 Avadis Tevanian, Jr. (avie) at NeXT
37 * Started.
38 */
39
40 #include <sys/param.h>
41 #include <sys/vnode_internal.h>
42 #include <sys/uio.h>
43 #include <sys/namei.h>
44 #include <sys/proc_internal.h>
45 #include <sys/kauth.h>
46 #include <sys/stat.h>
47 #include <sys/malloc.h>
48 #include <sys/mount_internal.h>
49 #include <sys/fcntl.h>
50 #include <sys/file_internal.h>
51 #include <sys/ubc_internal.h>
52 #include <sys/imgact.h>
53 #include <sys/codesign.h>
54 #include <sys/proc_uuid_policy.h>
55 #include <sys/reason.h>
56 #include <sys/kdebug.h>
57 #include <sys/spawn_internal.h>
58
59 #include <mach/mach_types.h>
60 #include <mach/vm_map.h> /* vm_allocate() */
61 #include <mach/mach_vm.h> /* mach_vm_allocate() */
62 #include <mach/vm_statistics.h>
63 #include <mach/task.h>
64 #include <mach/thread_act.h>
65
66 #include <machine/vmparam.h>
67 #include <machine/exec.h>
68 #include <machine/pal_routines.h>
69
70 #include <kern/ast.h>
71 #include <kern/kern_types.h>
72 #include <kern/cpu_number.h>
73 #include <kern/mach_loader.h>
74 #include <kern/mach_fat.h>
75 #include <kern/kalloc.h>
76 #include <kern/task.h>
77 #include <kern/thread.h>
78 #include <kern/page_decrypt.h>
79
80 #include <mach-o/fat.h>
81 #include <mach-o/loader.h>
82
83 #include <vm/pmap.h>
84 #include <vm/vm_map.h>
85 #include <vm/vm_kern.h>
86 #include <vm/vm_pager.h>
87 #include <vm/vnode_pager.h>
88 #include <vm/vm_protos.h>
89 #include <vm/vm_shared_region.h>
90 #include <IOKit/IOReturn.h> /* for kIOReturnNotPrivileged */
91 #include <IOKit/IOBSD.h> /* for IOVnodeHasEntitlement */
92
93 #include <os/log.h>
94 #include <os/overflow.h>
95
96 #include "kern_exec_internal.h"
97
98 /* XXX should have prototypes in a shared header file */
99 extern int get_map_nentries(vm_map_t);
100
101 extern kern_return_t memory_object_signed(memory_object_control_t control,
102 boolean_t is_signed);
103
104
105 /* An empty load_result_t */
106 static const load_result_t load_result_null = {
107 .mach_header = MACH_VM_MIN_ADDRESS,
108 .entry_point = MACH_VM_MIN_ADDRESS,
109 .user_stack = MACH_VM_MIN_ADDRESS,
110 .user_stack_size = 0,
111 .user_stack_alloc = MACH_VM_MIN_ADDRESS,
112 .user_stack_alloc_size = 0,
113 .all_image_info_addr = MACH_VM_MIN_ADDRESS,
114 .all_image_info_size = 0,
115 .thread_count = 0,
116 .unixproc = 0,
117 .dynlinker = 0,
118 .needs_dynlinker = 0,
119 .validentry = 0,
120 .using_lcmain = 0,
121 .is_64bit_addr = 0,
122 .is_64bit_data = 0,
123 .custom_stack = 0,
124 .csflags = 0,
125 .has_pagezero = 0,
126 .uuid = { 0 },
127 .min_vm_addr = MACH_VM_MAX_ADDRESS,
128 .max_vm_addr = MACH_VM_MIN_ADDRESS,
129 .cs_end_offset = 0,
130 .threadstate = NULL,
131 .threadstate_sz = 0,
132 .is_cambria = 0,
133 .dynlinker_mach_header = MACH_VM_MIN_ADDRESS,
134 .dynlinker_fd = -1,
135 };
136
137 /*
138 * Prototypes of static functions.
139 */
140 static load_return_t
141 parse_machfile(
142 struct vnode *vp,
143 vm_map_t map,
144 thread_t thread,
145 struct mach_header *header,
146 off_t file_offset,
147 off_t macho_size,
148 int depth,
149 int64_t slide,
150 int64_t dyld_slide,
151 load_result_t *result,
152 load_result_t *binresult,
153 struct image_params *imgp
154 );
155
156 static load_return_t
157 load_segment(
158 struct load_command *lcp,
159 uint32_t filetype,
160 void *control,
161 off_t pager_offset,
162 off_t macho_size,
163 struct vnode *vp,
164 vm_map_t map,
165 int64_t slide,
166 load_result_t *result,
167 struct image_params *imgp
168 );
169
170 static load_return_t
171 load_uuid(
172 struct uuid_command *uulp,
173 char *command_end,
174 load_result_t *result
175 );
176
177 static load_return_t
178 load_version(
179 struct version_min_command *vmc,
180 boolean_t *found_version_cmd,
181 int ip_flags,
182 load_result_t *result
183 );
184
185 static load_return_t
186 load_code_signature(
187 struct linkedit_data_command *lcp,
188 struct vnode *vp,
189 off_t macho_offset,
190 off_t macho_size,
191 cpu_type_t cputype,
192 cpu_subtype_t cpusubtype,
193 load_result_t *result,
194 struct image_params *imgp);
195
196 #if CONFIG_CODE_DECRYPTION
197 static load_return_t
198 set_code_unprotect(
199 struct encryption_info_command *lcp,
200 caddr_t addr,
201 vm_map_t map,
202 int64_t slide,
203 struct vnode *vp,
204 off_t macho_offset,
205 cpu_type_t cputype,
206 cpu_subtype_t cpusubtype);
207 #endif
208
209 static
210 load_return_t
211 load_main(
212 struct entry_point_command *epc,
213 thread_t thread,
214 int64_t slide,
215 load_result_t *result
216 );
217
218 static
219 load_return_t
220 setup_driver_main(
221 thread_t thread,
222 int64_t slide,
223 load_result_t *result
224 );
225
226 static load_return_t
227 load_unixthread(
228 struct thread_command *tcp,
229 thread_t thread,
230 int64_t slide,
231 boolean_t is_x86_64_compat_binary,
232 load_result_t *result
233 );
234
235 static load_return_t
236 load_threadstate(
237 thread_t thread,
238 uint32_t *ts,
239 uint32_t total_size,
240 load_result_t *
241 );
242
243 static load_return_t
244 load_threadstack(
245 thread_t thread,
246 uint32_t *ts,
247 uint32_t total_size,
248 mach_vm_offset_t *user_stack,
249 int *customstack,
250 boolean_t is_x86_64_compat_binary,
251 load_result_t *result
252 );
253
254 static load_return_t
255 load_threadentry(
256 thread_t thread,
257 uint32_t *ts,
258 uint32_t total_size,
259 mach_vm_offset_t *entry_point
260 );
261
262 static load_return_t
263 load_dylinker(
264 struct dylinker_command *lcp,
265 integer_t archbits,
266 vm_map_t map,
267 thread_t thread,
268 int depth,
269 int64_t slide,
270 load_result_t *result,
271 struct image_params *imgp
272 );
273
274
275 #if __x86_64__
276 extern int bootarg_no32exec;
277 static boolean_t
278 check_if_simulator_binary(
279 struct image_params *imgp,
280 off_t file_offset,
281 off_t macho_size);
282 #endif
283
284 struct macho_data;
285
286 static load_return_t
287 get_macho_vnode(
288 const char *path,
289 integer_t archbits,
290 struct mach_header *mach_header,
291 off_t *file_offset,
292 off_t *macho_size,
293 struct macho_data *macho_data,
294 struct vnode **vpp,
295 struct image_params *imgp
296 );
297
298 static inline void
widen_segment_command(const struct segment_command * scp32,struct segment_command_64 * scp)299 widen_segment_command(const struct segment_command *scp32,
300 struct segment_command_64 *scp)
301 {
302 scp->cmd = scp32->cmd;
303 scp->cmdsize = scp32->cmdsize;
304 bcopy(scp32->segname, scp->segname, sizeof(scp->segname));
305 scp->vmaddr = scp32->vmaddr;
306 scp->vmsize = scp32->vmsize;
307 scp->fileoff = scp32->fileoff;
308 scp->filesize = scp32->filesize;
309 scp->maxprot = scp32->maxprot;
310 scp->initprot = scp32->initprot;
311 scp->nsects = scp32->nsects;
312 scp->flags = scp32->flags;
313 }
314
315 static void
note_all_image_info_section(const struct segment_command_64 * scp,boolean_t is64,size_t section_size,const void * sections,int64_t slide,load_result_t * result)316 note_all_image_info_section(const struct segment_command_64 *scp,
317 boolean_t is64, size_t section_size, const void *sections,
318 int64_t slide, load_result_t *result)
319 {
320 const union {
321 struct section s32;
322 struct section_64 s64;
323 } *sectionp;
324 unsigned int i;
325
326
327 if (strncmp(scp->segname, "__DATA_DIRTY", sizeof(scp->segname)) != 0 &&
328 strncmp(scp->segname, "__DATA", sizeof(scp->segname)) != 0) {
329 return;
330 }
331 for (i = 0; i < scp->nsects; ++i) {
332 sectionp = (const void *)
333 ((const char *)sections + section_size * i);
334 if (0 == strncmp(sectionp->s64.sectname, "__all_image_info",
335 sizeof(sectionp->s64.sectname))) {
336 result->all_image_info_addr =
337 is64 ? sectionp->s64.addr : sectionp->s32.addr;
338 result->all_image_info_addr += slide;
339 result->all_image_info_size =
340 is64 ? sectionp->s64.size : sectionp->s32.size;
341 return;
342 }
343 }
344 }
345
346 #if __arm64__
347 /*
348 * Allow bypassing some security rules (hard pagezero, no write+execute)
349 * in exchange for better binary compatibility for legacy apps built
350 * before 16KB-alignment was enforced.
351 */
352 const int fourk_binary_compatibility_unsafe = TRUE;
353 const int fourk_binary_compatibility_allow_wx = FALSE;
354 #endif /* __arm64__ */
355
356 #if __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX
357 /**
358 * Determines whether this is an arm64e process which may host in-process
359 * plugins.
360 */
361 static inline bool
arm64e_plugin_host(struct image_params * imgp,load_result_t * result)362 arm64e_plugin_host(struct image_params *imgp, load_result_t *result)
363 {
364 if (imgp->ip_flags & IMGPF_NOJOP) {
365 return false;
366 }
367
368 if (!result->platform_binary) {
369 return false;
370 }
371
372 struct cs_blob *csblob = csvnode_get_blob(imgp->ip_vp, imgp->ip_arch_offset);
373 const char *identity = csblob_get_identity(csblob);
374 if (!identity) {
375 return false;
376 }
377
378 /* Check if override host plugin entitlement is present and posix spawn attribute to disable A keys is passed */
379 if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, OVERRIDE_PLUGIN_HOST_ENTITLEMENT)) {
380 bool ret = imgp->ip_flags & IMGPF_PLUGIN_HOST_DISABLE_A_KEYS;
381 if (ret) {
382 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
383 set_proc_name(imgp, p);
384 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to posix_spawnattr_disable_ptr_auth_a_keys_np", __func__, p->p_name);
385 }
386 return ret;
387 }
388
389 /* Disabling library validation is a good signal that this process plans to host plugins */
390 const char *const disable_lv_entitlements[] = {
391 "com.apple.security.cs.disable-library-validation",
392 "com.apple.private.cs.automator-plugins",
393 CLEAR_LV_ENTITLEMENT,
394 };
395 for (size_t i = 0; i < ARRAY_COUNT(disable_lv_entitlements); i++) {
396 const char *entitlement = disable_lv_entitlements[i];
397 if (IOVnodeHasEntitlement(imgp->ip_vp, (int64_t)imgp->ip_arch_offset, entitlement)) {
398 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
399 set_proc_name(imgp, p);
400 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to entitlement: %s", __func__, p->p_name, entitlement);
401 return true;
402 }
403 }
404
405 /* From /System/Library/Security/HardeningExceptions.plist */
406 const char *const hardening_exceptions[] = {
407 "com.apple.perl5", /* Scripting engines may load third party code and jit*/
408 "com.apple.perl", /* Scripting engines may load third party code and jit*/
409 "org.python.python", /* Scripting engines may load third party code and jit*/
410 "com.apple.expect", /* Scripting engines may load third party code and jit*/
411 "com.tcltk.wish", /* Scripting engines may load third party code and jit*/
412 "com.tcltk.tclsh", /* Scripting engines may load third party code and jit*/
413 "com.apple.ruby", /* Scripting engines may load third party code and jit*/
414 "com.apple.bash", /* Required for the 'enable' command */
415 "com.apple.zsh", /* Required for the 'zmodload' command */
416 "com.apple.ksh", /* Required for 'builtin' command */
417 };
418 for (size_t i = 0; i < ARRAY_COUNT(hardening_exceptions); i++) {
419 if (strncmp(hardening_exceptions[i], identity, strlen(hardening_exceptions[i])) == 0) {
420 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
421 set_proc_name(imgp, p);
422 os_log(OS_LOG_DEFAULT, "%s: running binary \"%s\" in keys-off mode due to identity: %s", __func__, p->p_name, identity);
423 return true;
424 }
425 }
426
427 return false;
428 }
429 #endif /* __has_feature(ptrauth_calls) && XNU_TARGET_OS_OSX */
430
431 load_return_t
load_machfile(struct image_params * imgp,struct mach_header * header,thread_t thread,vm_map_t * mapp,load_result_t * result)432 load_machfile(
433 struct image_params *imgp,
434 struct mach_header *header,
435 thread_t thread,
436 vm_map_t *mapp,
437 load_result_t *result
438 )
439 {
440 struct vnode *vp = imgp->ip_vp;
441 off_t file_offset = imgp->ip_arch_offset;
442 off_t macho_size = imgp->ip_arch_size;
443 off_t total_size = 0;
444 off_t file_size = imgp->ip_vattr->va_data_size;
445 pmap_t pmap = 0; /* protected by create_map */
446 vm_map_t map;
447 load_result_t myresult;
448 load_return_t lret;
449 boolean_t enforce_hard_pagezero = TRUE;
450 int in_exec = (imgp->ip_flags & IMGPF_EXEC);
451 task_t task = current_task();
452 int64_t aslr_page_offset = 0;
453 int64_t dyld_aslr_page_offset = 0;
454 int64_t aslr_section_size = 0;
455 int64_t aslr_section_offset = 0;
456 kern_return_t kret;
457 unsigned int pmap_flags = 0;
458
459 if (os_add_overflow(file_offset, macho_size, &total_size) ||
460 total_size > file_size) {
461 return LOAD_BADMACHO;
462 }
463
464 result->is_64bit_addr = ((imgp->ip_flags & IMGPF_IS_64BIT_ADDR) == IMGPF_IS_64BIT_ADDR);
465 result->is_64bit_data = ((imgp->ip_flags & IMGPF_IS_64BIT_DATA) == IMGPF_IS_64BIT_DATA);
466 #if defined(HAS_APPLE_PAC)
467 pmap_flags |= (imgp->ip_flags & IMGPF_NOJOP) ? PMAP_CREATE_DISABLE_JOP : 0;
468 #endif /* defined(HAS_APPLE_PAC) */
469 pmap_flags |= result->is_64bit_addr ? PMAP_CREATE_64BIT : 0;
470
471 task_t ledger_task;
472 if (imgp->ip_new_thread) {
473 ledger_task = get_threadtask(imgp->ip_new_thread);
474 } else {
475 ledger_task = task;
476 }
477
478 #if XNU_TARGET_OS_OSX && _POSIX_SPAWN_FORCE_4K_PAGES && PMAP_CREATE_FORCE_4K_PAGES
479 if (imgp->ip_px_sa != NULL) {
480 struct _posix_spawnattr* psa = (struct _posix_spawnattr *) imgp->ip_px_sa;
481 if (psa->psa_flags & _POSIX_SPAWN_FORCE_4K_PAGES) {
482 pmap_flags |= PMAP_CREATE_FORCE_4K_PAGES;
483 }
484 }
485 #endif /* XNU_TARGET_OS_OSX && _POSIX_SPAWN_FORCE_4K_PAGES && PMAP_CREATE_FORCE_4K_PAGE */
486
487 pmap = pmap_create_options(get_task_ledger(ledger_task),
488 (vm_map_size_t) 0,
489 pmap_flags);
490 if (pmap == NULL) {
491 return LOAD_RESOURCE;
492 }
493 map = vm_map_create_options(pmap, 0,
494 vm_compute_max_offset(result->is_64bit_addr),
495 VM_MAP_CREATE_PAGEABLE);
496
497 #if defined(__arm64__)
498 if (result->is_64bit_addr) {
499 /* enforce 16KB alignment of VM map entries */
500 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
501 } else {
502 vm_map_set_page_shift(map, page_shift_user32);
503 }
504 #elif (__ARM_ARCH_7K__ >= 2) && defined(PLATFORM_WatchOS)
505 /* enforce 16KB alignment for watch targets with new ABI */
506 vm_map_set_page_shift(map, SIXTEENK_PAGE_SHIFT);
507 #endif /* __arm64__ */
508
509 #if PMAP_CREATE_FORCE_4K_PAGES
510 if (pmap_flags & PMAP_CREATE_FORCE_4K_PAGES) {
511 DEBUG4K_LIFE("***** launching '%s' as 4k *****\n", vp->v_name);
512 vm_map_set_page_shift(map, FOURK_PAGE_SHIFT);
513 }
514 #endif /* PMAP_CREATE_FORCE_4K_PAGES */
515
516 #ifndef CONFIG_ENFORCE_SIGNED_CODE
517 /* This turns off faulting for executable pages, which allows
518 * to circumvent Code Signing Enforcement. The per process
519 * flag (CS_ENFORCEMENT) is not set yet, but we can use the
520 * global flag.
521 */
522 if (!cs_process_global_enforcement() && (header->flags & MH_ALLOW_STACK_EXECUTION)) {
523 vm_map_disable_NX(map);
524 // TODO: Message Trace or log that this is happening
525 }
526 #endif
527
528 /* Forcibly disallow execution from data pages on even if the arch
529 * normally permits it. */
530 if ((header->flags & MH_NO_HEAP_EXECUTION) && !(imgp->ip_flags & IMGPF_ALLOW_DATA_EXEC)) {
531 vm_map_disallow_data_exec(map);
532 }
533
534 /*
535 * Compute a random offset for ASLR, and an independent random offset for dyld.
536 */
537 if (!(imgp->ip_flags & IMGPF_DISABLE_ASLR)) {
538 vm_map_get_max_aslr_slide_section(map, &aslr_section_offset, &aslr_section_size);
539 aslr_section_offset = (random() % aslr_section_offset) * aslr_section_size;
540
541 aslr_page_offset = random();
542 aslr_page_offset = (aslr_page_offset % (vm_map_get_max_aslr_slide_pages(map) - 1)) + 1;
543 aslr_page_offset <<= vm_map_page_shift(map);
544
545 dyld_aslr_page_offset = random();
546 dyld_aslr_page_offset = (dyld_aslr_page_offset %
547 (vm_map_get_max_loader_aslr_slide_pages(map) - 1)) + 1;
548 dyld_aslr_page_offset <<= vm_map_page_shift(map);
549
550 aslr_page_offset += aslr_section_offset;
551 }
552 if (vm_map_page_shift(map) < (int)PAGE_SHIFT) {
553 DEBUG4K_LOAD("slide=0x%llx dyld_slide=0x%llx\n", aslr_page_offset, dyld_aslr_page_offset);
554 }
555
556 if (!result) {
557 result = &myresult;
558 }
559
560 *result = load_result_null;
561
562 /*
563 * re-set the bitness on the load result since we cleared the load result above.
564 */
565 result->is_64bit_addr = ((imgp->ip_flags & IMGPF_IS_64BIT_ADDR) == IMGPF_IS_64BIT_ADDR);
566 result->is_64bit_data = ((imgp->ip_flags & IMGPF_IS_64BIT_DATA) == IMGPF_IS_64BIT_DATA);
567
568 lret = parse_machfile(vp, map, thread, header, file_offset, macho_size,
569 0, aslr_page_offset, dyld_aslr_page_offset, result,
570 NULL, imgp);
571
572 if (lret != LOAD_SUCCESS) {
573 vm_map_deallocate(map); /* will lose pmap reference too */
574 return lret;
575 }
576
577 #if __x86_64__
578 /*
579 * On x86, for compatibility, don't enforce the hard page-zero restriction for 32-bit binaries.
580 */
581 if (!result->is_64bit_addr) {
582 enforce_hard_pagezero = FALSE;
583 }
584
585 /*
586 * For processes with IMGPF_HIGH_BITS_ASLR, add a few random high bits
587 * to the start address for "anywhere" memory allocations.
588 */
589 #define VM_MAP_HIGH_START_BITS_COUNT 8
590 #define VM_MAP_HIGH_START_BITS_SHIFT 27
591 if (result->is_64bit_addr &&
592 (imgp->ip_flags & IMGPF_HIGH_BITS_ASLR)) {
593 int random_bits;
594 vm_map_offset_t high_start;
595
596 random_bits = random();
597 random_bits &= (1 << VM_MAP_HIGH_START_BITS_COUNT) - 1;
598 high_start = (((vm_map_offset_t)random_bits)
599 << VM_MAP_HIGH_START_BITS_SHIFT);
600 vm_map_set_high_start(map, high_start);
601 }
602 #endif /* __x86_64__ */
603
604 /*
605 * Check to see if the page zero is enforced by the map->min_offset.
606 */
607 if (enforce_hard_pagezero &&
608 (vm_map_has_hard_pagezero(map, 0x1000) == FALSE)) {
609 #if __arm64__
610 if (
611 !result->is_64bit_addr && /* not 64-bit address space */
612 !(header->flags & MH_PIE) && /* not PIE */
613 (vm_map_page_shift(map) != FOURK_PAGE_SHIFT ||
614 PAGE_SHIFT != FOURK_PAGE_SHIFT) && /* page size != 4KB */
615 result->has_pagezero && /* has a "soft" page zero */
616 fourk_binary_compatibility_unsafe) {
617 /*
618 * For backwards compatibility of "4K" apps on
619 * a 16K system, do not enforce a hard page zero...
620 */
621 } else
622 #endif /* __arm64__ */
623 {
624 vm_map_deallocate(map); /* will lose pmap reference too */
625 return LOAD_BADMACHO;
626 }
627 }
628
629 #if __arm64__
630 if (enforce_hard_pagezero && result->is_64bit_addr && (header->cputype == CPU_TYPE_ARM64)) {
631 /* 64 bit ARM binary must have "hard page zero" of 4GB to cover the lower 32 bit address space */
632 if (vm_map_has_hard_pagezero(map, 0x100000000) == FALSE) {
633 vm_map_deallocate(map); /* will lose pmap reference too */
634 return LOAD_BADMACHO;
635 }
636 }
637 #endif
638
639 vm_commit_pagezero_status(map);
640
641 /*
642 * If this is an exec, then we are going to destroy the old
643 * task, and it's correct to halt it; if it's spawn, the
644 * task is not yet running, and it makes no sense.
645 */
646 if (in_exec) {
647 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
648 /*
649 * Mark the task as halting and start the other
650 * threads towards terminating themselves. Then
651 * make sure any threads waiting for a process
652 * transition get informed that we are committed to
653 * this transition, and then finally complete the
654 * task halting (wait for threads and then cleanup
655 * task resources).
656 *
657 * NOTE: task_start_halt() makes sure that no new
658 * threads are created in the task during the transition.
659 * We need to mark the workqueue as exiting before we
660 * wait for threads to terminate (at the end of which
661 * we no longer have a prohibition on thread creation).
662 *
663 * Finally, clean up any lingering workqueue data structures
664 * that may have been left behind by the workqueue threads
665 * as they exited (and then clean up the work queue itself).
666 */
667 kret = task_start_halt(task);
668 if (kret != KERN_SUCCESS) {
669 vm_map_deallocate(map); /* will lose pmap reference too */
670 return LOAD_FAILURE;
671 }
672 proc_transcommit(p, 0);
673 workq_mark_exiting(p);
674 task_complete_halt(task);
675 workq_exit(p);
676
677 /*
678 * Roll up accounting info to new task. The roll up is done after
679 * task_complete_halt to make sure the thread accounting info is
680 * rolled up to current_task.
681 */
682 task_rollup_accounting_info(get_threadtask(thread), task);
683 }
684 *mapp = map;
685
686 #if __has_feature(ptrauth_calls) && defined(XNU_TARGET_OS_OSX)
687 /*
688 * arm64e plugin hosts currently run with JOP keys disabled, since they
689 * may need to run arm64 plugins.
690 */
691 if (arm64e_plugin_host(imgp, result)) {
692 imgp->ip_flags |= IMGPF_NOJOP;
693 pmap_disable_user_jop(pmap);
694 }
695 #endif /* __has_feature(ptrauth_calls) && defined(XNU_TARGET_OS_OSX) */
696
697
698 #ifdef CONFIG_32BIT_TELEMETRY
699 if (!result->is_64bit_data) {
700 /*
701 * This may not need to be an AST; we merely need to ensure that
702 * we gather telemetry at the point where all of the information
703 * that we want has been added to the process.
704 */
705 task_set_32bit_log_flag(get_threadtask(thread));
706 act_set_astbsd(thread);
707 }
708 #endif /* CONFIG_32BIT_TELEMETRY */
709
710 return LOAD_SUCCESS;
711 }
712
713 int macho_printf = 0;
714 #define MACHO_PRINTF(args) \
715 do { \
716 if (macho_printf) { \
717 printf args; \
718 } \
719 } while (0)
720
721
722 static boolean_t
pie_required(cpu_type_t exectype,cpu_subtype_t execsubtype)723 pie_required(
724 cpu_type_t exectype,
725 cpu_subtype_t execsubtype)
726 {
727 switch (exectype) {
728 case CPU_TYPE_X86_64:
729 return FALSE;
730 case CPU_TYPE_ARM64:
731 return TRUE;
732 case CPU_TYPE_ARM:
733 switch (execsubtype) {
734 case CPU_SUBTYPE_ARM_V7K:
735 return TRUE;
736 }
737 break;
738 }
739 return FALSE;
740 }
741
742 /*
743 * The file size of a mach-o file is limited to 32 bits; this is because
744 * this is the limit on the kalloc() of enough bytes for a mach_header and
745 * the contents of its sizeofcmds, which is currently constrained to 32
746 * bits in the file format itself. We read into the kernel buffer the
747 * commands section, and then parse it in order to parse the mach-o file
748 * format load_command segment(s). We are only interested in a subset of
749 * the total set of possible commands. If "map"==VM_MAP_NULL or
750 * "thread"==THREAD_NULL, do not make permament VM modifications,
751 * just preflight the parse.
752 */
753 static
754 load_return_t
parse_machfile(struct vnode * vp,vm_map_t map,thread_t thread,struct mach_header * header,off_t file_offset,off_t macho_size,int depth,int64_t aslr_offset,int64_t dyld_aslr_offset,load_result_t * result,load_result_t * binresult,struct image_params * imgp)755 parse_machfile(
756 struct vnode *vp,
757 vm_map_t map,
758 thread_t thread,
759 struct mach_header *header,
760 off_t file_offset,
761 off_t macho_size,
762 int depth,
763 int64_t aslr_offset,
764 int64_t dyld_aslr_offset,
765 load_result_t *result,
766 load_result_t *binresult,
767 struct image_params *imgp
768 )
769 {
770 uint32_t ncmds;
771 struct load_command *lcp;
772 struct dylinker_command *dlp = 0;
773 void * control;
774 load_return_t ret = LOAD_SUCCESS;
775 void * addr;
776 vm_size_t alloc_size, cmds_size;
777 size_t offset;
778 size_t oldoffset; /* for overflow check */
779 int pass;
780 proc_t p = vfs_context_proc(imgp->ip_vfs_context);
781 int error;
782 int resid = 0;
783 int spawn = (imgp->ip_flags & IMGPF_SPAWN);
784 size_t mach_header_sz = sizeof(struct mach_header);
785 boolean_t abi64;
786 boolean_t got_code_signatures = FALSE;
787 boolean_t found_header_segment = FALSE;
788 boolean_t found_xhdr = FALSE;
789 boolean_t found_version_cmd = FALSE;
790 int64_t slide = 0;
791 boolean_t dyld_no_load_addr = FALSE;
792 boolean_t is_dyld = FALSE;
793 vm_map_offset_t effective_page_mask = PAGE_MASK;
794 #if __arm64__
795 uint64_t pagezero_end = 0;
796 uint64_t executable_end = 0;
797 uint64_t writable_start = 0;
798 vm_map_size_t effective_page_size;
799
800 effective_page_mask = vm_map_page_mask(map);
801 effective_page_size = vm_map_page_size(map);
802 #endif /* __arm64__ */
803
804 if (header->magic == MH_MAGIC_64 ||
805 header->magic == MH_CIGAM_64) {
806 mach_header_sz = sizeof(struct mach_header_64);
807 }
808
809 /*
810 * Break infinite recursion
811 */
812 if (depth > 2) {
813 return LOAD_FAILURE;
814 }
815
816 depth++;
817
818 /*
819 * Set CS_NO_UNTRUSTED_HELPERS by default; load_dylinker and load_rosetta
820 * will unset it if necessary.
821 */
822 if (depth == 1) {
823 result->csflags |= CS_NO_UNTRUSTED_HELPERS;
824 }
825
826 /*
827 * Check to see if right machine type.
828 */
829 if (((cpu_type_t)(header->cputype & ~CPU_ARCH_MASK) != (cpu_type() & ~CPU_ARCH_MASK))
830 ) {
831 return LOAD_BADARCH;
832 }
833
834 if (!grade_binary(header->cputype,
835 header->cpusubtype & ~CPU_SUBTYPE_MASK,
836 header->cpusubtype & CPU_SUBTYPE_MASK, TRUE)) {
837 return LOAD_BADARCH;
838 }
839
840 abi64 = ((header->cputype & CPU_ARCH_ABI64) == CPU_ARCH_ABI64);
841
842 switch (header->filetype) {
843 case MH_EXECUTE:
844 if (depth != 1 && depth != 3) {
845 return LOAD_FAILURE;
846 }
847 if (header->flags & MH_DYLDLINK) {
848 /* Check properties of dynamic executables */
849 if (!(header->flags & MH_PIE) && pie_required(header->cputype, header->cpusubtype & ~CPU_SUBTYPE_MASK)) {
850 return LOAD_FAILURE;
851 }
852 result->needs_dynlinker = TRUE;
853 } else if (header->cputype == CPU_TYPE_X86_64) {
854 /* x86_64 static binaries allowed */
855 } else {
856 /* Check properties of static executables (disallowed except for development) */
857 #if !(DEVELOPMENT || DEBUG)
858 return LOAD_FAILURE;
859 #endif
860 }
861 break;
862 case MH_DYLINKER:
863 if (depth != 2) {
864 return LOAD_FAILURE;
865 }
866 is_dyld = TRUE;
867 break;
868
869 default:
870 return LOAD_FAILURE;
871 }
872
873 /*
874 * For PIE and dyld, slide everything by the ASLR offset.
875 */
876 if ((header->flags & MH_PIE) || is_dyld) {
877 slide = aslr_offset;
878 }
879
880 /*
881 * Get the pager for the file.
882 */
883 control = ubc_getobject(vp, UBC_FLAGS_NONE);
884
885 /* ensure header + sizeofcmds falls within the file */
886 if (os_add_overflow(mach_header_sz, header->sizeofcmds, &cmds_size) ||
887 (off_t)cmds_size > macho_size ||
888 round_page_overflow(cmds_size, &alloc_size) ||
889 alloc_size > INT_MAX) {
890 return LOAD_BADMACHO;
891 }
892
893 /*
894 * Map the load commands into kernel memory.
895 */
896 addr = kalloc_data(alloc_size, Z_WAITOK);
897 if (addr == NULL) {
898 return LOAD_NOSPACE;
899 }
900
901 error = vn_rdwr(UIO_READ, vp, addr, (int)alloc_size, file_offset,
902 UIO_SYSSPACE, 0, vfs_context_ucred(imgp->ip_vfs_context), &resid, p);
903 if (error) {
904 kfree_data(addr, alloc_size);
905 return LOAD_IOERROR;
906 }
907
908 if (resid) {
909 {
910 /* We must be able to read in as much as the mach_header indicated */
911 kfree_data(addr, alloc_size);
912 return LOAD_BADMACHO;
913 }
914 }
915
916 /*
917 * Scan through the commands, processing each one as necessary.
918 * We parse in three passes through the headers:
919 * 0: determine if TEXT and DATA boundary can be page-aligned, load platform version
920 * 1: thread state, uuid, code signature
921 * 2: segments
922 * 3: dyld, encryption, check entry point
923 */
924
925 boolean_t slide_realign = FALSE;
926 #if __arm64__
927 if (!abi64) {
928 slide_realign = TRUE;
929 }
930 #endif
931
932 for (pass = 0; pass <= 3; pass++) {
933 if (pass == 1) {
934 #if __arm64__
935 boolean_t is_pie;
936 int64_t adjust;
937
938 is_pie = ((header->flags & MH_PIE) != 0);
939 if (pagezero_end != 0 &&
940 pagezero_end < effective_page_size) {
941 /* need at least 1 page for PAGEZERO */
942 adjust = effective_page_size;
943 MACHO_PRINTF(("pagezero boundary at "
944 "0x%llx; adjust slide from "
945 "0x%llx to 0x%llx%s\n",
946 (uint64_t) pagezero_end,
947 slide,
948 slide + adjust,
949 (is_pie
950 ? ""
951 : " BUT NO PIE ****** :-(")));
952 if (is_pie) {
953 slide += adjust;
954 pagezero_end += adjust;
955 executable_end += adjust;
956 writable_start += adjust;
957 }
958 }
959 if (pagezero_end != 0) {
960 result->has_pagezero = TRUE;
961 }
962 if (executable_end == writable_start &&
963 (executable_end & effective_page_mask) != 0 &&
964 (executable_end & FOURK_PAGE_MASK) == 0) {
965 /*
966 * The TEXT/DATA boundary is 4K-aligned but
967 * not page-aligned. Adjust the slide to make
968 * it page-aligned and avoid having a page
969 * with both write and execute permissions.
970 */
971 adjust =
972 (effective_page_size -
973 (executable_end & effective_page_mask));
974 MACHO_PRINTF(("page-unaligned X-W boundary at "
975 "0x%llx; adjust slide from "
976 "0x%llx to 0x%llx%s\n",
977 (uint64_t) executable_end,
978 slide,
979 slide + adjust,
980 (is_pie
981 ? ""
982 : " BUT NO PIE ****** :-(")));
983 if (is_pie) {
984 slide += adjust;
985 }
986 }
987 #endif /* __arm64__ */
988
989 if (dyld_no_load_addr && binresult) {
990 /*
991 * The dyld Mach-O does not specify a load address. Try to locate
992 * it right after the main binary. If binresult == NULL, load
993 * directly to the given slide.
994 */
995 mach_vm_address_t max_vm_addr = binresult->max_vm_addr;
996 slide = vm_map_round_page(slide + max_vm_addr, effective_page_mask);
997 }
998 }
999
1000 /*
1001 * Check that the entry point is contained in an executable segment
1002 */
1003 if ((pass == 3) && (thread != THREAD_NULL)) {
1004 if (depth == 1 && imgp && (imgp->ip_flags & IMGPF_DRIVER)) {
1005 /* Driver binaries must have driverkit platform */
1006 if (result->ip_platform == PLATFORM_DRIVERKIT) {
1007 /* Driver binaries have no entry point */
1008 ret = setup_driver_main(thread, slide, result);
1009 } else {
1010 ret = LOAD_FAILURE;
1011 }
1012 } else if (!result->using_lcmain && result->validentry == 0) {
1013 ret = LOAD_FAILURE;
1014 }
1015 if (ret != KERN_SUCCESS) {
1016 thread_state_initialize(thread);
1017 break;
1018 }
1019 }
1020
1021 /*
1022 * Check that some segment maps the start of the mach-o file, which is
1023 * needed by the dynamic loader to read the mach headers, etc.
1024 */
1025 if ((pass == 3) && (found_header_segment == FALSE)) {
1026 ret = LOAD_BADMACHO;
1027 break;
1028 }
1029
1030 /*
1031 * Loop through each of the load_commands indicated by the
1032 * Mach-O header; if an absurd value is provided, we just
1033 * run off the end of the reserved section by incrementing
1034 * the offset too far, so we are implicitly fail-safe.
1035 */
1036 offset = mach_header_sz;
1037 ncmds = header->ncmds;
1038
1039 while (ncmds--) {
1040 /* ensure enough space for a minimal load command */
1041 if (offset + sizeof(struct load_command) > cmds_size) {
1042 ret = LOAD_BADMACHO;
1043 break;
1044 }
1045
1046 /*
1047 * Get a pointer to the command.
1048 */
1049 lcp = (struct load_command *)((uintptr_t)addr + offset);
1050 oldoffset = offset;
1051
1052 /*
1053 * Perform prevalidation of the struct load_command
1054 * before we attempt to use its contents. Invalid
1055 * values are ones which result in an overflow, or
1056 * which can not possibly be valid commands, or which
1057 * straddle or exist past the reserved section at the
1058 * start of the image.
1059 */
1060 if (os_add_overflow(offset, lcp->cmdsize, &offset) ||
1061 lcp->cmdsize < sizeof(struct load_command) ||
1062 offset > cmds_size) {
1063 ret = LOAD_BADMACHO;
1064 break;
1065 }
1066
1067 /*
1068 * Act on struct load_command's for which kernel
1069 * intervention is required.
1070 * Note that each load command implementation is expected to validate
1071 * that lcp->cmdsize is large enough to fit its specific struct type
1072 * before dereferencing fields not covered by struct load_command.
1073 */
1074 switch (lcp->cmd) {
1075 case LC_SEGMENT: {
1076 struct segment_command *scp = (struct segment_command *) lcp;
1077 if (scp->cmdsize < sizeof(*scp)) {
1078 ret = LOAD_BADMACHO;
1079 break;
1080 }
1081 if (pass == 0) {
1082 if (is_dyld && scp->vmaddr == 0 && scp->fileoff == 0) {
1083 dyld_no_load_addr = TRUE;
1084 if (!slide_realign) {
1085 /* got what we need, bail early on pass 0 */
1086 continue;
1087 }
1088 }
1089
1090 #if __arm64__
1091 assert(!abi64);
1092
1093 if (scp->initprot == 0 && scp->maxprot == 0 && scp->vmaddr == 0) {
1094 /* PAGEZERO */
1095 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &pagezero_end) || pagezero_end > UINT32_MAX) {
1096 ret = LOAD_BADMACHO;
1097 break;
1098 }
1099 }
1100 if (scp->initprot & VM_PROT_EXECUTE) {
1101 /* TEXT */
1102 if (os_add3_overflow(scp->vmaddr, scp->vmsize, slide, &executable_end) || executable_end > UINT32_MAX) {
1103 ret = LOAD_BADMACHO;
1104 break;
1105 }
1106 }
1107 if (scp->initprot & VM_PROT_WRITE) {
1108 /* DATA */
1109 if (os_add_overflow(scp->vmaddr, slide, &writable_start) || writable_start > UINT32_MAX) {
1110 ret = LOAD_BADMACHO;
1111 break;
1112 }
1113 }
1114 #endif /* __arm64__ */
1115 break;
1116 }
1117
1118 if (pass == 1 && !strncmp(scp->segname, "__XHDR", sizeof(scp->segname))) {
1119 found_xhdr = TRUE;
1120 }
1121
1122 if (pass != 2) {
1123 break;
1124 }
1125
1126 if (abi64) {
1127 /*
1128 * Having an LC_SEGMENT command for the
1129 * wrong ABI is invalid <rdar://problem/11021230>
1130 */
1131 ret = LOAD_BADMACHO;
1132 break;
1133 }
1134
1135 ret = load_segment(lcp,
1136 header->filetype,
1137 control,
1138 file_offset,
1139 macho_size,
1140 vp,
1141 map,
1142 slide,
1143 result,
1144 imgp);
1145 if (ret == LOAD_SUCCESS && scp->fileoff == 0 && scp->filesize > 0) {
1146 /* Enforce a single segment mapping offset zero, with R+X
1147 * protection. */
1148 if (found_header_segment ||
1149 ((scp->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) != (VM_PROT_READ | VM_PROT_EXECUTE))) {
1150 ret = LOAD_BADMACHO;
1151 break;
1152 }
1153 found_header_segment = TRUE;
1154 }
1155
1156 break;
1157 }
1158 case LC_SEGMENT_64: {
1159 struct segment_command_64 *scp64 = (struct segment_command_64 *) lcp;
1160 if (scp64->cmdsize < sizeof(*scp64)) {
1161 ret = LOAD_BADMACHO;
1162 break;
1163 }
1164 if (pass == 0) {
1165 if (is_dyld && scp64->vmaddr == 0 && scp64->fileoff == 0) {
1166 dyld_no_load_addr = TRUE;
1167 }
1168 /* got what we need, bail early on pass 0 */
1169 continue;
1170 }
1171
1172 if (pass == 1 && !strncmp(scp64->segname, "__XHDR", sizeof(scp64->segname))) {
1173 found_xhdr = TRUE;
1174 }
1175
1176 if (pass != 2) {
1177 break;
1178 }
1179
1180 if (!abi64) {
1181 /*
1182 * Having an LC_SEGMENT_64 command for the
1183 * wrong ABI is invalid <rdar://problem/11021230>
1184 */
1185 ret = LOAD_BADMACHO;
1186 break;
1187 }
1188
1189 ret = load_segment(lcp,
1190 header->filetype,
1191 control,
1192 file_offset,
1193 macho_size,
1194 vp,
1195 map,
1196 slide,
1197 result,
1198 imgp);
1199
1200 if (ret == LOAD_SUCCESS && scp64->fileoff == 0 && scp64->filesize > 0) {
1201 /* Enforce a single segment mapping offset zero, with R+X
1202 * protection. */
1203 if (found_header_segment ||
1204 ((scp64->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) != (VM_PROT_READ | VM_PROT_EXECUTE))) {
1205 ret = LOAD_BADMACHO;
1206 break;
1207 }
1208 found_header_segment = TRUE;
1209 }
1210
1211 break;
1212 }
1213 case LC_UNIXTHREAD: {
1214 boolean_t is_x86_64_compat_binary = FALSE;
1215 if (pass != 1) {
1216 break;
1217 }
1218 ret = load_unixthread(
1219 (struct thread_command *) lcp,
1220 thread,
1221 slide,
1222 is_x86_64_compat_binary,
1223 result);
1224 break;
1225 }
1226 case LC_MAIN:
1227 if (pass != 1) {
1228 break;
1229 }
1230 if (depth != 1) {
1231 break;
1232 }
1233 ret = load_main(
1234 (struct entry_point_command *) lcp,
1235 thread,
1236 slide,
1237 result);
1238 break;
1239 case LC_LOAD_DYLINKER:
1240 if (pass != 3) {
1241 break;
1242 }
1243 if ((depth == 1) && (dlp == 0)) {
1244 dlp = (struct dylinker_command *)lcp;
1245 } else {
1246 ret = LOAD_FAILURE;
1247 }
1248 break;
1249 case LC_UUID:
1250 if (pass == 1 && depth == 1) {
1251 ret = load_uuid((struct uuid_command *) lcp,
1252 (char *)addr + cmds_size,
1253 result);
1254 }
1255 break;
1256 case LC_CODE_SIGNATURE:
1257 /* CODE SIGNING */
1258 if (pass != 1) {
1259 break;
1260 }
1261
1262 /* pager -> uip ->
1263 * load signatures & store in uip
1264 * set VM object "signed_pages"
1265 */
1266 ret = load_code_signature(
1267 (struct linkedit_data_command *) lcp,
1268 vp,
1269 file_offset,
1270 macho_size,
1271 header->cputype,
1272 header->cpusubtype,
1273 result,
1274 imgp);
1275 if (ret != LOAD_SUCCESS) {
1276 printf("proc %d: load code signature error %d "
1277 "for file \"%s\"\n",
1278 proc_getpid(p), ret, vp->v_name);
1279 /*
1280 * Allow injections to be ignored on devices w/o enforcement enabled
1281 */
1282 if (!cs_process_global_enforcement()) {
1283 ret = LOAD_SUCCESS; /* ignore error */
1284 }
1285 } else {
1286 got_code_signatures = TRUE;
1287 }
1288
1289 if (got_code_signatures) {
1290 unsigned tainted = CS_VALIDATE_TAINTED;
1291 boolean_t valid = FALSE;
1292 vm_size_t off = 0;
1293
1294
1295 if (cs_debug > 10) {
1296 printf("validating initial pages of %s\n", vp->v_name);
1297 }
1298
1299 while (off < alloc_size && ret == LOAD_SUCCESS) {
1300 tainted = CS_VALIDATE_TAINTED;
1301
1302 valid = cs_validate_range(vp,
1303 NULL,
1304 file_offset + off,
1305 (const void *)((uintptr_t)addr + off),
1306 MIN(PAGE_SIZE, cmds_size),
1307 &tainted);
1308 if (!valid || (tainted & CS_VALIDATE_TAINTED)) {
1309 if (cs_debug) {
1310 printf("CODE SIGNING: %s[%d]: invalid initial page at offset %lld validated:%d tainted:%d csflags:0x%x\n",
1311 vp->v_name, proc_getpid(p), (long long)(file_offset + off), valid, tainted, result->csflags);
1312 }
1313 if (cs_process_global_enforcement() ||
1314 (result->csflags & (CS_HARD | CS_KILL | CS_ENFORCEMENT))) {
1315 ret = LOAD_FAILURE;
1316 }
1317 result->csflags &= ~CS_VALID;
1318 }
1319 off += PAGE_SIZE;
1320 }
1321 }
1322
1323 break;
1324 #if CONFIG_CODE_DECRYPTION
1325 case LC_ENCRYPTION_INFO:
1326 case LC_ENCRYPTION_INFO_64:
1327 if (pass != 3) {
1328 break;
1329 }
1330 ret = set_code_unprotect(
1331 (struct encryption_info_command *) lcp,
1332 addr, map, slide, vp, file_offset,
1333 header->cputype, header->cpusubtype);
1334 if (ret != LOAD_SUCCESS) {
1335 os_reason_t load_failure_reason = OS_REASON_NULL;
1336 printf("proc %d: set_code_unprotect() error %d "
1337 "for file \"%s\"\n",
1338 proc_getpid(p), ret, vp->v_name);
1339 /*
1340 * Don't let the app run if it's
1341 * encrypted but we failed to set up the
1342 * decrypter. If the keys are missing it will
1343 * return LOAD_DECRYPTFAIL.
1344 */
1345 if (ret == LOAD_DECRYPTFAIL) {
1346 /* failed to load due to missing FP keys */
1347 proc_lock(p);
1348 p->p_lflag |= P_LTERM_DECRYPTFAIL;
1349 proc_unlock(p);
1350
1351 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1352 proc_getpid(p), OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT, 0, 0);
1353 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_FAIRPLAY_DECRYPT);
1354 } else {
1355 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_EXITREASON_CREATE) | DBG_FUNC_NONE,
1356 proc_getpid(p), OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT, 0, 0);
1357 load_failure_reason = os_reason_create(OS_REASON_EXEC, EXEC_EXIT_REASON_DECRYPT);
1358 }
1359
1360 /*
1361 * Don't signal the process if it was forked and in a partially constructed
1362 * state as part of a spawn -- it will just be torn down when the exec fails.
1363 */
1364 if (!spawn) {
1365 assert(load_failure_reason != OS_REASON_NULL);
1366 {
1367 psignal_with_reason(p, SIGKILL, load_failure_reason);
1368 load_failure_reason = OS_REASON_NULL;
1369 }
1370 } else {
1371 os_reason_free(load_failure_reason);
1372 load_failure_reason = OS_REASON_NULL;
1373 }
1374 }
1375 break;
1376 #endif
1377 case LC_VERSION_MIN_IPHONEOS:
1378 case LC_VERSION_MIN_MACOSX:
1379 case LC_VERSION_MIN_WATCHOS:
1380 case LC_VERSION_MIN_TVOS: {
1381 struct version_min_command *vmc;
1382
1383 if (depth != 1 || pass != 0) {
1384 break;
1385 }
1386 vmc = (struct version_min_command *) lcp;
1387 ret = load_version(vmc, &found_version_cmd, imgp->ip_flags, result);
1388 #if XNU_TARGET_OS_OSX
1389 if (ret == LOAD_SUCCESS) {
1390 if (result->ip_platform == PLATFORM_IOS) {
1391 vm_map_mark_alien(map);
1392 } else {
1393 assert(!vm_map_is_alien(map));
1394 }
1395 }
1396 #endif /* XNU_TARGET_OS_OSX */
1397 break;
1398 }
1399 case LC_BUILD_VERSION: {
1400 if (depth != 1 || pass != 0) {
1401 break;
1402 }
1403 struct build_version_command* bvc = (struct build_version_command*)lcp;
1404 if (bvc->cmdsize < sizeof(*bvc)) {
1405 ret = LOAD_BADMACHO;
1406 break;
1407 }
1408 if (found_version_cmd == TRUE) {
1409 ret = LOAD_BADMACHO;
1410 break;
1411 }
1412 result->ip_platform = bvc->platform;
1413 result->lr_sdk = bvc->sdk;
1414 result->lr_min_sdk = bvc->minos;
1415 found_version_cmd = TRUE;
1416 #if XNU_TARGET_OS_OSX
1417 if (result->ip_platform == PLATFORM_IOS) {
1418 vm_map_mark_alien(map);
1419 } else {
1420 assert(!vm_map_is_alien(map));
1421 }
1422 #endif /* XNU_TARGET_OS_OSX */
1423 break;
1424 }
1425 default:
1426 /* Other commands are ignored by the kernel */
1427 ret = LOAD_SUCCESS;
1428 break;
1429 }
1430 if (ret != LOAD_SUCCESS) {
1431 break;
1432 }
1433 }
1434 if (ret != LOAD_SUCCESS) {
1435 break;
1436 }
1437 }
1438
1439 if (ret == LOAD_SUCCESS) {
1440 if (!got_code_signatures && cs_process_global_enforcement()) {
1441 ret = LOAD_FAILURE;
1442 }
1443
1444 /* Make sure if we need dyld, we got it */
1445 if (result->needs_dynlinker && !dlp) {
1446 ret = LOAD_FAILURE;
1447 }
1448
1449 if ((ret == LOAD_SUCCESS) && (dlp != 0)) {
1450 /*
1451 * load the dylinker, and slide it by the independent DYLD ASLR
1452 * offset regardless of the PIE-ness of the main binary.
1453 */
1454 ret = load_dylinker(dlp, header->cputype, map, thread, depth,
1455 dyld_aslr_offset, result, imgp);
1456 }
1457
1458
1459 if ((ret == LOAD_SUCCESS) && (depth == 1)) {
1460 if (result->thread_count == 0) {
1461 ret = LOAD_FAILURE;
1462 }
1463 #if CONFIG_ENFORCE_SIGNED_CODE
1464 if (!(result->csflags & CS_NO_UNTRUSTED_HELPERS)) {
1465 ret = LOAD_FAILURE;
1466 }
1467 #endif
1468 }
1469 }
1470
1471 if (ret == LOAD_BADMACHO && found_xhdr) {
1472 ret = LOAD_BADMACHO_UPX;
1473 }
1474
1475 kfree_data(addr, alloc_size);
1476
1477 return ret;
1478 }
1479
1480 load_return_t
validate_potential_simulator_binary(cpu_type_t exectype __unused,struct image_params * imgp __unused,off_t file_offset __unused,off_t macho_size __unused)1481 validate_potential_simulator_binary(
1482 cpu_type_t exectype __unused,
1483 struct image_params *imgp __unused,
1484 off_t file_offset __unused,
1485 off_t macho_size __unused)
1486 {
1487 #if __x86_64__
1488 /* Allow 32 bit exec only for simulator binaries */
1489 if (bootarg_no32exec && imgp != NULL && exectype == CPU_TYPE_X86) {
1490 if (imgp->ip_simulator_binary == IMGPF_SB_DEFAULT) {
1491 boolean_t simulator_binary = check_if_simulator_binary(imgp, file_offset, macho_size);
1492 imgp->ip_simulator_binary = simulator_binary ? IMGPF_SB_TRUE : IMGPF_SB_FALSE;
1493 }
1494
1495 if (imgp->ip_simulator_binary != IMGPF_SB_TRUE) {
1496 return LOAD_BADARCH;
1497 }
1498 }
1499 #endif
1500 return LOAD_SUCCESS;
1501 }
1502
1503 #if __x86_64__
1504 static boolean_t
check_if_simulator_binary(struct image_params * imgp,off_t file_offset,off_t macho_size)1505 check_if_simulator_binary(
1506 struct image_params *imgp,
1507 off_t file_offset,
1508 off_t macho_size)
1509 {
1510 struct mach_header *header;
1511 char *ip_vdata = NULL;
1512 kauth_cred_t cred = NULL;
1513 uint32_t ncmds;
1514 struct load_command *lcp;
1515 boolean_t simulator_binary = FALSE;
1516 void * addr = NULL;
1517 vm_size_t alloc_size, cmds_size;
1518 size_t offset;
1519 proc_t p = current_proc(); /* XXXX */
1520 int error;
1521 int resid = 0;
1522 size_t mach_header_sz = sizeof(struct mach_header);
1523
1524
1525 cred = kauth_cred_proc_ref(p);
1526
1527 /* Allocate page to copyin mach header */
1528 ip_vdata = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
1529 if (ip_vdata == NULL) {
1530 goto bad;
1531 }
1532
1533 /* Read the Mach-O header */
1534 error = vn_rdwr(UIO_READ, imgp->ip_vp, ip_vdata,
1535 PAGE_SIZE, file_offset,
1536 UIO_SYSSPACE, (IO_UNIT | IO_NODELOCKED),
1537 cred, &resid, p);
1538 if (error) {
1539 goto bad;
1540 }
1541
1542 header = (struct mach_header *)ip_vdata;
1543
1544 if (header->magic == MH_MAGIC_64 ||
1545 header->magic == MH_CIGAM_64) {
1546 mach_header_sz = sizeof(struct mach_header_64);
1547 }
1548
1549 /* ensure header + sizeofcmds falls within the file */
1550 if (os_add_overflow(mach_header_sz, header->sizeofcmds, &cmds_size) ||
1551 (off_t)cmds_size > macho_size ||
1552 round_page_overflow(cmds_size, &alloc_size) ||
1553 alloc_size > INT_MAX) {
1554 goto bad;
1555 }
1556
1557 /*
1558 * Map the load commands into kernel memory.
1559 */
1560 addr = kalloc_data(alloc_size, Z_WAITOK);
1561 if (addr == NULL) {
1562 goto bad;
1563 }
1564
1565 error = vn_rdwr(UIO_READ, imgp->ip_vp, addr, (int)alloc_size, file_offset,
1566 UIO_SYSSPACE, IO_NODELOCKED, cred, &resid, p);
1567 if (error) {
1568 goto bad;
1569 }
1570
1571 if (resid) {
1572 /* We must be able to read in as much as the mach_header indicated */
1573 goto bad;
1574 }
1575
1576 /*
1577 * Loop through each of the load_commands indicated by the
1578 * Mach-O header; if an absurd value is provided, we just
1579 * run off the end of the reserved section by incrementing
1580 * the offset too far, so we are implicitly fail-safe.
1581 */
1582 offset = mach_header_sz;
1583 ncmds = header->ncmds;
1584
1585 while (ncmds--) {
1586 /* ensure enough space for a minimal load command */
1587 if (offset + sizeof(struct load_command) > cmds_size) {
1588 break;
1589 }
1590
1591 /*
1592 * Get a pointer to the command.
1593 */
1594 lcp = (struct load_command *)((uintptr_t)addr + offset);
1595
1596 /*
1597 * Perform prevalidation of the struct load_command
1598 * before we attempt to use its contents. Invalid
1599 * values are ones which result in an overflow, or
1600 * which can not possibly be valid commands, or which
1601 * straddle or exist past the reserved section at the
1602 * start of the image.
1603 */
1604 if (os_add_overflow(offset, lcp->cmdsize, &offset) ||
1605 lcp->cmdsize < sizeof(struct load_command) ||
1606 offset > cmds_size) {
1607 break;
1608 }
1609
1610 /* Check if its a simulator binary. */
1611 switch (lcp->cmd) {
1612 case LC_VERSION_MIN_WATCHOS:
1613 simulator_binary = TRUE;
1614 break;
1615
1616 case LC_BUILD_VERSION: {
1617 struct build_version_command *bvc;
1618
1619 bvc = (struct build_version_command *) lcp;
1620 if (bvc->cmdsize < sizeof(*bvc)) {
1621 /* unsafe to use this command struct if cmdsize
1622 * validated above is too small for it to fit */
1623 break;
1624 }
1625 if (bvc->platform == PLATFORM_IOSSIMULATOR ||
1626 bvc->platform == PLATFORM_WATCHOSSIMULATOR) {
1627 simulator_binary = TRUE;
1628 }
1629
1630 break;
1631 }
1632
1633 case LC_VERSION_MIN_IPHONEOS: {
1634 simulator_binary = TRUE;
1635 break;
1636 }
1637
1638 default:
1639 /* ignore other load commands */
1640 break;
1641 }
1642
1643 if (simulator_binary == TRUE) {
1644 break;
1645 }
1646 }
1647
1648 bad:
1649 if (ip_vdata) {
1650 kfree_data(ip_vdata, PAGE_SIZE);
1651 }
1652
1653 if (cred) {
1654 kauth_cred_unref(&cred);
1655 }
1656
1657 if (addr) {
1658 kfree_data(addr, alloc_size);
1659 }
1660
1661 return simulator_binary;
1662 }
1663 #endif /* __x86_64__ */
1664
1665 #if CONFIG_CODE_DECRYPTION
1666
1667 #define APPLE_UNPROTECTED_HEADER_SIZE (3 * 4096)
1668
1669 static load_return_t
unprotect_dsmos_segment(uint64_t file_off,uint64_t file_size,struct vnode * vp,off_t macho_offset,vm_map_t map,vm_map_offset_t map_addr,vm_map_size_t map_size)1670 unprotect_dsmos_segment(
1671 uint64_t file_off,
1672 uint64_t file_size,
1673 struct vnode *vp,
1674 off_t macho_offset,
1675 vm_map_t map,
1676 vm_map_offset_t map_addr,
1677 vm_map_size_t map_size)
1678 {
1679 kern_return_t kr;
1680 uint64_t slice_off;
1681
1682 /*
1683 * The first APPLE_UNPROTECTED_HEADER_SIZE bytes (from offset 0 of
1684 * this part of a Universal binary) are not protected...
1685 * The rest needs to be "transformed".
1686 */
1687 slice_off = file_off - macho_offset;
1688 if (slice_off <= APPLE_UNPROTECTED_HEADER_SIZE &&
1689 slice_off + file_size <= APPLE_UNPROTECTED_HEADER_SIZE) {
1690 /* it's all unprotected, nothing to do... */
1691 kr = KERN_SUCCESS;
1692 } else {
1693 if (slice_off <= APPLE_UNPROTECTED_HEADER_SIZE) {
1694 /*
1695 * We start mapping in the unprotected area.
1696 * Skip the unprotected part...
1697 */
1698 uint64_t delta_file;
1699 vm_map_offset_t delta_map;
1700
1701 delta_file = (uint64_t)APPLE_UNPROTECTED_HEADER_SIZE;
1702 delta_file -= slice_off;
1703 if (os_convert_overflow(delta_file, &delta_map)) {
1704 return LOAD_BADMACHO;
1705 }
1706 if (os_add_overflow(map_addr, delta_map, &map_addr)) {
1707 return LOAD_BADMACHO;
1708 }
1709 if (os_sub_overflow(map_size, delta_map, &map_size)) {
1710 return LOAD_BADMACHO;
1711 }
1712 }
1713 /* ... transform the rest of the mapping. */
1714 struct pager_crypt_info crypt_info;
1715 crypt_info.page_decrypt = dsmos_page_transform;
1716 crypt_info.crypt_ops = NULL;
1717 crypt_info.crypt_end = NULL;
1718 #pragma unused(vp, macho_offset)
1719 crypt_info.crypt_ops = (void *)0x2e69cf40;
1720 vm_map_offset_t crypto_backing_offset;
1721 crypto_backing_offset = -1; /* i.e. use map entry's offset */
1722 #if VM_MAP_DEBUG_APPLE_PROTECT
1723 if (vm_map_debug_apple_protect) {
1724 struct proc *p;
1725 p = current_proc();
1726 printf("APPLE_PROTECT: %d[%s] map %p "
1727 "[0x%llx:0x%llx] %s(%s)\n",
1728 proc_getpid(p), p->p_comm, map,
1729 (uint64_t) map_addr,
1730 (uint64_t) (map_addr + map_size),
1731 __FUNCTION__, vp->v_name);
1732 }
1733 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
1734
1735 /* The DSMOS pager can only be used by apple signed code */
1736 struct cs_blob * blob = csvnode_get_blob(vp, file_off);
1737 if (blob == NULL || !blob->csb_platform_binary || blob->csb_platform_path) {
1738 return LOAD_FAILURE;
1739 }
1740
1741 kr = vm_map_apple_protected(map,
1742 map_addr,
1743 map_addr + map_size,
1744 crypto_backing_offset,
1745 &crypt_info,
1746 CRYPTID_APP_ENCRYPTION);
1747 }
1748
1749 if (kr != KERN_SUCCESS) {
1750 return LOAD_FAILURE;
1751 }
1752 return LOAD_SUCCESS;
1753 }
1754 #else /* CONFIG_CODE_DECRYPTION */
1755 static load_return_t
unprotect_dsmos_segment(__unused uint64_t file_off,__unused uint64_t file_size,__unused struct vnode * vp,__unused off_t macho_offset,__unused vm_map_t map,__unused vm_map_offset_t map_addr,__unused vm_map_size_t map_size)1756 unprotect_dsmos_segment(
1757 __unused uint64_t file_off,
1758 __unused uint64_t file_size,
1759 __unused struct vnode *vp,
1760 __unused off_t macho_offset,
1761 __unused vm_map_t map,
1762 __unused vm_map_offset_t map_addr,
1763 __unused vm_map_size_t map_size)
1764 {
1765 return LOAD_SUCCESS;
1766 }
1767 #endif /* CONFIG_CODE_DECRYPTION */
1768
1769
1770 /*
1771 * map_segment:
1772 * Maps a Mach-O segment, taking care of mis-alignment (wrt the system
1773 * page size) issues.
1774 *
1775 * The mapping might result in 1, 2 or 3 map entries:
1776 * 1. for the first page, which could be overlap with the previous
1777 * mapping,
1778 * 2. for the center (if applicable),
1779 * 3. for the last page, which could overlap with the next mapping.
1780 *
1781 * For each of those map entries, we might have to interpose a
1782 * "fourk_pager" to deal with mis-alignment wrt the system page size,
1783 * either in the mapping address and/or size or the file offset and/or
1784 * size.
1785 * The "fourk_pager" itself would be mapped with proper alignment
1786 * wrt the system page size and would then be populated with the
1787 * information about the intended mapping, with a "4KB" granularity.
1788 */
1789 static kern_return_t
map_segment(vm_map_t map,vm_map_offset_t vm_start,vm_map_offset_t vm_end,memory_object_control_t control,vm_map_offset_t file_start,vm_map_offset_t file_end,vm_prot_t initprot,vm_prot_t maxprot,load_result_t * result)1790 map_segment(
1791 vm_map_t map,
1792 vm_map_offset_t vm_start,
1793 vm_map_offset_t vm_end,
1794 memory_object_control_t control,
1795 vm_map_offset_t file_start,
1796 vm_map_offset_t file_end,
1797 vm_prot_t initprot,
1798 vm_prot_t maxprot,
1799 load_result_t *result)
1800 {
1801 vm_map_offset_t cur_offset, cur_start, cur_end;
1802 kern_return_t ret;
1803 vm_map_offset_t effective_page_mask;
1804 vm_map_kernel_flags_t vmk_flags, cur_vmk_flags;
1805
1806 if (vm_end < vm_start ||
1807 file_end < file_start) {
1808 return LOAD_BADMACHO;
1809 }
1810 if (vm_end == vm_start ||
1811 file_end == file_start) {
1812 /* nothing to map... */
1813 return LOAD_SUCCESS;
1814 }
1815
1816 effective_page_mask = vm_map_page_mask(map);
1817
1818 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1819 if (vm_map_page_aligned(vm_start, effective_page_mask) &&
1820 vm_map_page_aligned(vm_end, effective_page_mask) &&
1821 vm_map_page_aligned(file_start, effective_page_mask) &&
1822 vm_map_page_aligned(file_end, effective_page_mask)) {
1823 /* all page-aligned and map-aligned: proceed */
1824 } else {
1825 #if __arm64__
1826 /* use an intermediate "4K" pager */
1827 vmk_flags.vmkf_fourk = TRUE;
1828 #else /* __arm64__ */
1829 panic("map_segment: unexpected mis-alignment "
1830 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx]\n",
1831 (uint64_t) vm_start,
1832 (uint64_t) vm_end,
1833 (uint64_t) file_start,
1834 (uint64_t) file_end);
1835 #endif /* __arm64__ */
1836 }
1837
1838 cur_offset = 0;
1839 cur_start = vm_start;
1840 cur_end = vm_start;
1841 #if __arm64__
1842 if (!vm_map_page_aligned(vm_start, effective_page_mask)) {
1843 /* one 4K pager for the 1st page */
1844 cur_end = vm_map_round_page(cur_start, effective_page_mask);
1845 if (cur_end > vm_end) {
1846 cur_end = vm_start + (file_end - file_start);
1847 }
1848 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1849 /* no copy-on-read for mapped binaries */
1850 vmk_flags.vmkf_no_copy_on_read = 1;
1851 ret = vm_map_enter_mem_object_control(
1852 map,
1853 &cur_start,
1854 cur_end - cur_start,
1855 (mach_vm_offset_t)0,
1856 VM_FLAGS_FIXED,
1857 vmk_flags,
1858 VM_KERN_MEMORY_NONE,
1859 control,
1860 file_start + cur_offset,
1861 TRUE, /* copy */
1862 initprot, maxprot,
1863 VM_INHERIT_DEFAULT);
1864 } else {
1865 ret = vm_map_enter_mem_object(
1866 map,
1867 &cur_start,
1868 cur_end - cur_start,
1869 (mach_vm_offset_t)0,
1870 VM_FLAGS_FIXED,
1871 vmk_flags,
1872 VM_KERN_MEMORY_NONE,
1873 IPC_PORT_NULL,
1874 0, /* offset */
1875 TRUE, /* copy */
1876 initprot, maxprot,
1877 VM_INHERIT_DEFAULT);
1878 }
1879 if (ret != KERN_SUCCESS) {
1880 return LOAD_NOSPACE;
1881 }
1882 cur_offset += cur_end - cur_start;
1883 }
1884 #endif /* __arm64__ */
1885 if (cur_end >= vm_start + (file_end - file_start)) {
1886 /* all mapped: done */
1887 goto done;
1888 }
1889 if (vm_map_round_page(cur_end, effective_page_mask) >=
1890 vm_map_trunc_page(vm_start + (file_end - file_start),
1891 effective_page_mask)) {
1892 /* no middle */
1893 } else {
1894 cur_start = cur_end;
1895 if ((vm_start & effective_page_mask) !=
1896 (file_start & effective_page_mask)) {
1897 /* one 4K pager for the middle */
1898 cur_vmk_flags = vmk_flags;
1899 } else {
1900 /* regular mapping for the middle */
1901 cur_vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1902 }
1903
1904 #if !defined(XNU_TARGET_OS_OSX)
1905 (void) result;
1906 #else /* !defined(XNU_TARGET_OS_OSX) */
1907 /*
1908 * This process doesn't have its new csflags (from
1909 * the image being loaded) yet, so tell VM to override the
1910 * current process's CS_ENFORCEMENT for this mapping.
1911 */
1912 if (result->csflags & CS_ENFORCEMENT) {
1913 cur_vmk_flags.vmkf_cs_enforcement = TRUE;
1914 } else {
1915 cur_vmk_flags.vmkf_cs_enforcement = FALSE;
1916 }
1917 cur_vmk_flags.vmkf_cs_enforcement_override = TRUE;
1918 #endif /* !defined(XNU_TARGET_OS_OSX) */
1919
1920 if (result->is_cambria && (initprot & VM_PROT_EXECUTE) == VM_PROT_EXECUTE) {
1921 cur_vmk_flags.vmkf_translated_allow_execute = TRUE;
1922 }
1923
1924 cur_end = vm_map_trunc_page(vm_start + (file_end -
1925 file_start),
1926 effective_page_mask);
1927 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1928 /* no copy-on-read for mapped binaries */
1929 cur_vmk_flags.vmkf_no_copy_on_read = 1;
1930 ret = vm_map_enter_mem_object_control(
1931 map,
1932 &cur_start,
1933 cur_end - cur_start,
1934 (mach_vm_offset_t)0,
1935 VM_FLAGS_FIXED,
1936 cur_vmk_flags,
1937 VM_KERN_MEMORY_NONE,
1938 control,
1939 file_start + cur_offset,
1940 TRUE, /* copy */
1941 initprot, maxprot,
1942 VM_INHERIT_DEFAULT);
1943 } else {
1944 ret = vm_map_enter_mem_object(
1945 map,
1946 &cur_start,
1947 cur_end - cur_start,
1948 (mach_vm_offset_t)0,
1949 VM_FLAGS_FIXED,
1950 cur_vmk_flags,
1951 VM_KERN_MEMORY_NONE,
1952 IPC_PORT_NULL,
1953 0, /* offset */
1954 TRUE, /* copy */
1955 initprot, maxprot,
1956 VM_INHERIT_DEFAULT);
1957 }
1958 if (ret != KERN_SUCCESS) {
1959 return LOAD_NOSPACE;
1960 }
1961 cur_offset += cur_end - cur_start;
1962 }
1963 if (cur_end >= vm_start + (file_end - file_start)) {
1964 /* all mapped: done */
1965 goto done;
1966 }
1967 cur_start = cur_end;
1968 #if __arm64__
1969 if (!vm_map_page_aligned(vm_start + (file_end - file_start),
1970 effective_page_mask)) {
1971 /* one 4K pager for the last page */
1972 cur_end = vm_start + (file_end - file_start);
1973 if (control != MEMORY_OBJECT_CONTROL_NULL) {
1974 /* no copy-on-read for mapped binaries */
1975 vmk_flags.vmkf_no_copy_on_read = 1;
1976 ret = vm_map_enter_mem_object_control(
1977 map,
1978 &cur_start,
1979 cur_end - cur_start,
1980 (mach_vm_offset_t)0,
1981 VM_FLAGS_FIXED,
1982 vmk_flags,
1983 VM_KERN_MEMORY_NONE,
1984 control,
1985 file_start + cur_offset,
1986 TRUE, /* copy */
1987 initprot, maxprot,
1988 VM_INHERIT_DEFAULT);
1989 } else {
1990 ret = vm_map_enter_mem_object(
1991 map,
1992 &cur_start,
1993 cur_end - cur_start,
1994 (mach_vm_offset_t)0,
1995 VM_FLAGS_FIXED,
1996 vmk_flags,
1997 VM_KERN_MEMORY_NONE,
1998 IPC_PORT_NULL,
1999 0, /* offset */
2000 TRUE, /* copy */
2001 initprot, maxprot,
2002 VM_INHERIT_DEFAULT);
2003 }
2004 if (ret != KERN_SUCCESS) {
2005 return LOAD_NOSPACE;
2006 }
2007 cur_offset += cur_end - cur_start;
2008 }
2009 #endif /* __arm64__ */
2010 done:
2011 assert(cur_end >= vm_start + (file_end - file_start));
2012 return LOAD_SUCCESS;
2013 }
2014
2015 static
2016 load_return_t
load_segment(struct load_command * lcp,uint32_t filetype,void * control,off_t pager_offset,off_t macho_size,struct vnode * vp,vm_map_t map,int64_t slide,load_result_t * result,struct image_params * imgp)2017 load_segment(
2018 struct load_command *lcp,
2019 uint32_t filetype,
2020 void * control,
2021 off_t pager_offset,
2022 off_t macho_size,
2023 struct vnode *vp,
2024 vm_map_t map,
2025 int64_t slide,
2026 load_result_t *result,
2027 struct image_params *imgp)
2028 {
2029 struct segment_command_64 segment_command, *scp;
2030 kern_return_t ret;
2031 vm_map_size_t delta_size;
2032 vm_prot_t initprot;
2033 vm_prot_t maxprot;
2034 size_t segment_command_size, total_section_size,
2035 single_section_size;
2036 uint64_t file_offset, file_size;
2037 vm_map_offset_t vm_offset;
2038 size_t vm_size;
2039 vm_map_offset_t vm_start, vm_end, vm_end_aligned;
2040 vm_map_offset_t file_start, file_end;
2041 kern_return_t kr;
2042 boolean_t verbose;
2043 vm_map_size_t effective_page_size;
2044 vm_map_offset_t effective_page_mask;
2045 #if __arm64__
2046 vm_map_kernel_flags_t vmk_flags;
2047 boolean_t fourk_align;
2048 #endif /* __arm64__ */
2049
2050 (void)imgp;
2051
2052 effective_page_size = vm_map_page_size(map);
2053 effective_page_mask = vm_map_page_mask(map);
2054
2055 verbose = FALSE;
2056 if (LC_SEGMENT_64 == lcp->cmd) {
2057 segment_command_size = sizeof(struct segment_command_64);
2058 single_section_size = sizeof(struct section_64);
2059 #if __arm64__
2060 /* 64-bit binary: should already be 16K-aligned */
2061 fourk_align = FALSE;
2062
2063 if (vm_map_page_shift(map) == FOURK_PAGE_SHIFT &&
2064 PAGE_SHIFT != FOURK_PAGE_SHIFT) {
2065 fourk_align = TRUE;
2066 verbose = TRUE;
2067 }
2068 #endif /* __arm64__ */
2069 } else {
2070 segment_command_size = sizeof(struct segment_command);
2071 single_section_size = sizeof(struct section);
2072 #if __arm64__
2073 /* 32-bit binary: might need 4K-alignment */
2074 if (effective_page_size != FOURK_PAGE_SIZE) {
2075 /* not using 4K page size: need fourk_pager */
2076 fourk_align = TRUE;
2077 verbose = TRUE;
2078 } else {
2079 /* using 4K page size: no need for re-alignment */
2080 fourk_align = FALSE;
2081 }
2082 #endif /* __arm64__ */
2083 }
2084 if (lcp->cmdsize < segment_command_size) {
2085 DEBUG4K_ERROR("LOAD_BADMACHO cmdsize %d < %zu\n", lcp->cmdsize, segment_command_size);
2086 return LOAD_BADMACHO;
2087 }
2088 total_section_size = lcp->cmdsize - segment_command_size;
2089
2090 if (LC_SEGMENT_64 == lcp->cmd) {
2091 scp = (struct segment_command_64 *)lcp;
2092 } else {
2093 scp = &segment_command;
2094 widen_segment_command((struct segment_command *)lcp, scp);
2095 }
2096
2097 if (verbose) {
2098 MACHO_PRINTF(("+++ load_segment %s "
2099 "vm[0x%llx:0x%llx] file[0x%llx:0x%llx] "
2100 "prot %d/%d flags 0x%x\n",
2101 scp->segname,
2102 (uint64_t)(slide + scp->vmaddr),
2103 (uint64_t)(slide + scp->vmaddr + scp->vmsize),
2104 pager_offset + scp->fileoff,
2105 pager_offset + scp->fileoff + scp->filesize,
2106 scp->initprot,
2107 scp->maxprot,
2108 scp->flags));
2109 }
2110
2111 /*
2112 * Make sure what we get from the file is really ours (as specified
2113 * by macho_size).
2114 */
2115 if (scp->fileoff + scp->filesize < scp->fileoff ||
2116 scp->fileoff + scp->filesize > (uint64_t)macho_size) {
2117 DEBUG4K_ERROR("LOAD_BADMACHO fileoff 0x%llx filesize 0x%llx macho_size 0x%llx\n", scp->fileoff, scp->filesize, (uint64_t)macho_size);
2118 return LOAD_BADMACHO;
2119 }
2120 /*
2121 * Ensure that the number of sections specified would fit
2122 * within the load command size.
2123 */
2124 if (total_section_size / single_section_size < scp->nsects) {
2125 DEBUG4K_ERROR("LOAD_BADMACHO 0x%zx 0x%zx %d\n", total_section_size, single_section_size, scp->nsects);
2126 return LOAD_BADMACHO;
2127 }
2128 /*
2129 * Make sure the segment is page-aligned in the file.
2130 */
2131 if (os_add_overflow(pager_offset, scp->fileoff, &file_offset)) {
2132 DEBUG4K_ERROR("LOAD_BADMACHO file_offset: 0x%llx + 0x%llx\n", pager_offset, scp->fileoff);
2133 return LOAD_BADMACHO;
2134 }
2135 file_size = scp->filesize;
2136 #if __arm64__
2137 if (fourk_align) {
2138 if ((file_offset & FOURK_PAGE_MASK) != 0) {
2139 /*
2140 * we can't mmap() it if it's not at least 4KB-aligned
2141 * in the file
2142 */
2143 DEBUG4K_ERROR("LOAD_BADMACHO file_offset 0x%llx\n", file_offset);
2144 return LOAD_BADMACHO;
2145 }
2146 } else
2147 #endif /* __arm64__ */
2148 if ((file_offset & PAGE_MASK_64) != 0 ||
2149 /* we can't mmap() it if it's not page-aligned in the file */
2150 (file_offset & vm_map_page_mask(map)) != 0) {
2151 /*
2152 * The 1st test would have failed if the system's page size
2153 * was what this process believe is the page size, so let's
2154 * fail here too for the sake of consistency.
2155 */
2156 DEBUG4K_ERROR("LOAD_BADMACHO file_offset 0x%llx\n", file_offset);
2157 return LOAD_BADMACHO;
2158 }
2159
2160 /*
2161 * If we have a code signature attached for this slice
2162 * require that the segments are within the signed part
2163 * of the file.
2164 */
2165 if (result->cs_end_offset &&
2166 result->cs_end_offset < (off_t)scp->fileoff &&
2167 result->cs_end_offset - scp->fileoff < scp->filesize) {
2168 if (cs_debug) {
2169 printf("section outside code signature\n");
2170 }
2171 DEBUG4K_ERROR("LOAD_BADMACHO end_offset 0x%llx fileoff 0x%llx filesize 0x%llx\n", result->cs_end_offset, scp->fileoff, scp->filesize);
2172 return LOAD_BADMACHO;
2173 }
2174
2175 if (os_add_overflow(scp->vmaddr, slide, &vm_offset)) {
2176 if (cs_debug) {
2177 printf("vmaddr too large\n");
2178 }
2179 DEBUG4K_ERROR("LOAD_BADMACHO vmaddr 0x%llx slide 0x%llx vm_offset 0x%llx\n", scp->vmaddr, slide, (uint64_t)vm_offset);
2180 return LOAD_BADMACHO;
2181 }
2182
2183 if (scp->vmsize > SIZE_MAX) {
2184 DEBUG4K_ERROR("LOAD_BADMACHO vmsize 0x%llx\n", scp->vmsize);
2185 return LOAD_BADMACHO;
2186 }
2187
2188 vm_size = (size_t)scp->vmsize;
2189
2190 if (vm_size == 0) {
2191 return LOAD_SUCCESS;
2192 }
2193 if (scp->vmaddr == 0 &&
2194 file_size == 0 &&
2195 vm_size != 0 &&
2196 (scp->initprot & VM_PROT_ALL) == VM_PROT_NONE &&
2197 (scp->maxprot & VM_PROT_ALL) == VM_PROT_NONE) {
2198 if (map == VM_MAP_NULL) {
2199 return LOAD_SUCCESS;
2200 }
2201
2202 /*
2203 * For PIE, extend page zero rather than moving it. Extending
2204 * page zero keeps early allocations from falling predictably
2205 * between the end of page zero and the beginning of the first
2206 * slid segment.
2207 */
2208 /*
2209 * This is a "page zero" segment: it starts at address 0,
2210 * is not mapped from the binary file and is not accessible.
2211 * User-space should never be able to access that memory, so
2212 * make it completely off limits by raising the VM map's
2213 * minimum offset.
2214 */
2215 vm_end = (vm_map_offset_t)(vm_offset + vm_size);
2216 if (vm_end < vm_offset) {
2217 DEBUG4K_ERROR("LOAD_BADMACHO vm_end 0x%llx vm_offset 0x%llx vm_size 0x%llx\n", (uint64_t)vm_end, (uint64_t)vm_offset, (uint64_t)vm_size);
2218 return LOAD_BADMACHO;
2219 }
2220
2221 if (verbose) {
2222 MACHO_PRINTF(("++++++ load_segment: "
2223 "page_zero up to 0x%llx\n",
2224 (uint64_t) vm_end));
2225 }
2226 #if __arm64__
2227 if (fourk_align) {
2228 /* raise min_offset as much as page-alignment allows */
2229 vm_end_aligned = vm_map_trunc_page(vm_end,
2230 effective_page_mask);
2231 } else
2232 #endif /* __arm64__ */
2233 {
2234 vm_end = vm_map_round_page(vm_end,
2235 PAGE_MASK_64);
2236 vm_end_aligned = vm_end;
2237 }
2238 ret = vm_map_raise_min_offset(map,
2239 vm_end_aligned);
2240 #if __arm64__
2241 if (ret == 0 &&
2242 vm_end > vm_end_aligned) {
2243 /* use fourk_pager to map the rest of pagezero */
2244 assert(fourk_align);
2245 vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
2246 vmk_flags.vmkf_fourk = TRUE;
2247 ret = vm_map_enter_mem_object(
2248 map,
2249 &vm_end_aligned,
2250 vm_end - vm_end_aligned,
2251 (mach_vm_offset_t) 0, /* mask */
2252 VM_FLAGS_FIXED,
2253 vmk_flags,
2254 VM_KERN_MEMORY_NONE,
2255 IPC_PORT_NULL,
2256 0,
2257 FALSE, /* copy */
2258 (scp->initprot & VM_PROT_ALL),
2259 (scp->maxprot & VM_PROT_ALL),
2260 VM_INHERIT_DEFAULT);
2261 }
2262 #endif /* __arm64__ */
2263
2264 if (ret != KERN_SUCCESS) {
2265 DEBUG4K_ERROR("LOAD_FAILURE ret 0x%x\n", ret);
2266 return LOAD_FAILURE;
2267 }
2268 return LOAD_SUCCESS;
2269 } else {
2270 #if !defined(XNU_TARGET_OS_OSX)
2271 /* not PAGEZERO: should not be mapped at address 0 */
2272 if (filetype != MH_DYLINKER && scp->vmaddr == 0) {
2273 DEBUG4K_ERROR("LOAD_BADMACHO filetype %d vmaddr 0x%llx\n", filetype, scp->vmaddr);
2274 return LOAD_BADMACHO;
2275 }
2276 #endif /* !defined(XNU_TARGET_OS_OSX) */
2277 }
2278
2279 #if __arm64__
2280 if (fourk_align) {
2281 /* 4K-align */
2282 file_start = vm_map_trunc_page(file_offset,
2283 FOURK_PAGE_MASK);
2284 file_end = vm_map_round_page(file_offset + file_size,
2285 FOURK_PAGE_MASK);
2286 vm_start = vm_map_trunc_page(vm_offset,
2287 FOURK_PAGE_MASK);
2288 vm_end = vm_map_round_page(vm_offset + vm_size,
2289 FOURK_PAGE_MASK);
2290
2291 if (file_offset - file_start > FOURK_PAGE_MASK ||
2292 file_end - file_offset - file_size > FOURK_PAGE_MASK) {
2293 DEBUG4K_ERROR("LOAD_BADMACHO file_start / file_size wrap "
2294 "[0x%llx:0x%llx] -> [0x%llx:0x%llx]\n",
2295 file_offset,
2296 file_offset + file_size,
2297 (uint64_t) file_start,
2298 (uint64_t) file_end);
2299 return LOAD_BADMACHO;
2300 }
2301
2302 if (!strncmp(scp->segname, "__LINKEDIT", 11) &&
2303 page_aligned(file_start) &&
2304 vm_map_page_aligned(file_start, vm_map_page_mask(map)) &&
2305 page_aligned(vm_start) &&
2306 vm_map_page_aligned(vm_start, vm_map_page_mask(map))) {
2307 /* XXX last segment: ignore mis-aligned tail */
2308 file_end = vm_map_round_page(file_end,
2309 effective_page_mask);
2310 vm_end = vm_map_round_page(vm_end,
2311 effective_page_mask);
2312 }
2313 } else
2314 #endif /* __arm64__ */
2315 {
2316 file_start = vm_map_trunc_page(file_offset,
2317 effective_page_mask);
2318 file_end = vm_map_round_page(file_offset + file_size,
2319 effective_page_mask);
2320 vm_start = vm_map_trunc_page(vm_offset,
2321 effective_page_mask);
2322 vm_end = vm_map_round_page(vm_offset + vm_size,
2323 effective_page_mask);
2324
2325 if (file_offset - file_start > effective_page_mask ||
2326 file_end - file_offset - file_size > effective_page_mask) {
2327 DEBUG4K_ERROR("LOAD_BADMACHO file_start / file_size wrap "
2328 "[0x%llx:0x%llx] -> [0x%llx:0x%llx]\n",
2329 file_offset,
2330 file_offset + file_size,
2331 (uint64_t) file_start,
2332 (uint64_t) file_end);
2333 return LOAD_BADMACHO;
2334 }
2335 }
2336
2337 if (vm_start < result->min_vm_addr) {
2338 result->min_vm_addr = vm_start;
2339 }
2340 if (vm_end > result->max_vm_addr) {
2341 result->max_vm_addr = vm_end;
2342 }
2343
2344 if (map == VM_MAP_NULL) {
2345 return LOAD_SUCCESS;
2346 }
2347
2348 if (vm_size > 0) {
2349 initprot = (scp->initprot) & VM_PROT_ALL;
2350 maxprot = (scp->maxprot) & VM_PROT_ALL;
2351 /*
2352 * Map a copy of the file into the address space.
2353 */
2354 if (verbose) {
2355 MACHO_PRINTF(("++++++ load_segment: "
2356 "mapping at vm [0x%llx:0x%llx] of "
2357 "file [0x%llx:0x%llx]\n",
2358 (uint64_t) vm_start,
2359 (uint64_t) vm_end,
2360 (uint64_t) file_start,
2361 (uint64_t) file_end));
2362 }
2363 ret = map_segment(map,
2364 vm_start,
2365 vm_end,
2366 control,
2367 file_start,
2368 file_end,
2369 initprot,
2370 maxprot,
2371 result);
2372 if (ret) {
2373 DEBUG4K_ERROR("LOAD_NOSPACE start 0x%llx end 0x%llx ret 0x%x\n", (uint64_t)vm_start, (uint64_t)vm_end, ret);
2374 return LOAD_NOSPACE;
2375 }
2376
2377 #if FIXME
2378 /*
2379 * If the file didn't end on a page boundary,
2380 * we need to zero the leftover.
2381 */
2382 delta_size = map_size - scp->filesize;
2383 if (delta_size > 0) {
2384 void *tmp = kalloc_data(delta_size, Z_WAITOK | Z_ZERO);
2385 int rc;
2386
2387 if (tmp == NULL) {
2388 DEBUG4K_ERROR("LOAD_RESOURCE delta_size 0x%llx ret 0x%x\n", delta_size, ret);
2389 return LOAD_RESOURCE;
2390 }
2391
2392 rc = copyout(tmp, map_addr + scp->filesize, delta_size);
2393 kfree_data(tmp, delta_size);
2394
2395 if (rc) {
2396 DEBUG4K_ERROR("LOAD_FAILURE copyout 0x%llx 0x%llx\n", map_addr + scp->filesize, delta_size);
2397 return LOAD_FAILURE;
2398 }
2399 }
2400 #endif /* FIXME */
2401 }
2402
2403 /*
2404 * If the virtual size of the segment is greater
2405 * than the size from the file, we need to allocate
2406 * zero fill memory for the rest.
2407 */
2408 if ((vm_end - vm_start) > (file_end - file_start)) {
2409 delta_size = (vm_end - vm_start) - (file_end - file_start);
2410 } else {
2411 delta_size = 0;
2412 }
2413 if (delta_size > 0) {
2414 vm_map_offset_t tmp_start;
2415 vm_map_offset_t tmp_end;
2416
2417 if (os_add_overflow(vm_start, file_end - file_start, &tmp_start)) {
2418 DEBUG4K_ERROR("LOAD_NOSPACE tmp_start: 0x%llx + 0x%llx\n", (uint64_t)vm_start, (uint64_t)(file_end - file_start));
2419 return LOAD_NOSPACE;
2420 }
2421
2422 if (os_add_overflow(tmp_start, delta_size, &tmp_end)) {
2423 DEBUG4K_ERROR("LOAD_NOSPACE tmp_end: 0x%llx + 0x%llx\n", (uint64_t)tmp_start, (uint64_t)delta_size);
2424 return LOAD_NOSPACE;
2425 }
2426
2427 if (verbose) {
2428 MACHO_PRINTF(("++++++ load_segment: "
2429 "delta mapping vm [0x%llx:0x%llx]\n",
2430 (uint64_t) tmp_start,
2431 (uint64_t) tmp_end));
2432 }
2433 kr = map_segment(map,
2434 tmp_start,
2435 tmp_end,
2436 MEMORY_OBJECT_CONTROL_NULL,
2437 0,
2438 delta_size,
2439 scp->initprot,
2440 scp->maxprot,
2441 result);
2442 if (kr != KERN_SUCCESS) {
2443 DEBUG4K_ERROR("LOAD_NOSPACE 0x%llx 0x%llx kr 0x%x\n", (unsigned long long)tmp_start, (uint64_t)delta_size, kr);
2444 return LOAD_NOSPACE;
2445 }
2446 }
2447
2448 if ((scp->fileoff == 0) && (scp->filesize != 0)) {
2449 result->mach_header = vm_offset;
2450 }
2451
2452 if (scp->flags & SG_PROTECTED_VERSION_1) {
2453 ret = unprotect_dsmos_segment(file_start,
2454 file_end - file_start,
2455 vp,
2456 pager_offset,
2457 map,
2458 vm_start,
2459 vm_end - vm_start);
2460 if (ret != LOAD_SUCCESS) {
2461 DEBUG4K_ERROR("unprotect 0x%llx 0x%llx ret %d \n", (uint64_t)vm_start, (uint64_t)vm_end, ret);
2462 return ret;
2463 }
2464 } else {
2465 ret = LOAD_SUCCESS;
2466 }
2467
2468 if (LOAD_SUCCESS == ret &&
2469 filetype == MH_DYLINKER &&
2470 result->all_image_info_addr == MACH_VM_MIN_ADDRESS) {
2471 note_all_image_info_section(scp,
2472 LC_SEGMENT_64 == lcp->cmd,
2473 single_section_size,
2474 ((const char *)lcp +
2475 segment_command_size),
2476 slide,
2477 result);
2478 }
2479
2480 if (result->entry_point != MACH_VM_MIN_ADDRESS) {
2481 if ((result->entry_point >= vm_offset) && (result->entry_point < (vm_offset + vm_size))) {
2482 if ((scp->initprot & (VM_PROT_READ | VM_PROT_EXECUTE)) == (VM_PROT_READ | VM_PROT_EXECUTE)) {
2483 result->validentry = 1;
2484 } else {
2485 /* right range but wrong protections, unset if previously validated */
2486 result->validentry = 0;
2487 }
2488 }
2489 }
2490
2491 if (ret != LOAD_SUCCESS && verbose) {
2492 DEBUG4K_ERROR("ret %d\n", ret);
2493 }
2494 return ret;
2495 }
2496
2497 static
2498 load_return_t
load_uuid(struct uuid_command * uulp,char * command_end,load_result_t * result)2499 load_uuid(
2500 struct uuid_command *uulp,
2501 char *command_end,
2502 load_result_t *result
2503 )
2504 {
2505 /*
2506 * We need to check the following for this command:
2507 * - The command size should be atleast the size of struct uuid_command
2508 * - The UUID part of the command should be completely within the mach-o header
2509 */
2510
2511 if ((uulp->cmdsize < sizeof(struct uuid_command)) ||
2512 (((char *)uulp + sizeof(struct uuid_command)) > command_end)) {
2513 return LOAD_BADMACHO;
2514 }
2515
2516 memcpy(&result->uuid[0], &uulp->uuid[0], sizeof(result->uuid));
2517 return LOAD_SUCCESS;
2518 }
2519
2520 static
2521 load_return_t
load_version(struct version_min_command * vmc,boolean_t * found_version_cmd,int ip_flags __unused,load_result_t * result)2522 load_version(
2523 struct version_min_command *vmc,
2524 boolean_t *found_version_cmd,
2525 int ip_flags __unused,
2526 load_result_t *result
2527 )
2528 {
2529 uint32_t platform = 0;
2530 uint32_t sdk;
2531 uint32_t min_sdk;
2532
2533 if (vmc->cmdsize < sizeof(*vmc)) {
2534 return LOAD_BADMACHO;
2535 }
2536 if (*found_version_cmd == TRUE) {
2537 return LOAD_BADMACHO;
2538 }
2539 *found_version_cmd = TRUE;
2540 sdk = vmc->sdk;
2541 min_sdk = vmc->version;
2542 switch (vmc->cmd) {
2543 case LC_VERSION_MIN_MACOSX:
2544 platform = PLATFORM_MACOS;
2545 break;
2546 #if __x86_64__ /* __x86_64__ */
2547 case LC_VERSION_MIN_IPHONEOS:
2548 platform = PLATFORM_IOSSIMULATOR;
2549 break;
2550 case LC_VERSION_MIN_WATCHOS:
2551 platform = PLATFORM_WATCHOSSIMULATOR;
2552 break;
2553 case LC_VERSION_MIN_TVOS:
2554 platform = PLATFORM_TVOSSIMULATOR;
2555 break;
2556 #else
2557 case LC_VERSION_MIN_IPHONEOS: {
2558 #if __arm64__
2559 if (vmc->sdk < (12 << 16)) {
2560 /* app built with a pre-iOS12 SDK: apply legacy footprint mitigation */
2561 result->legacy_footprint = TRUE;
2562 }
2563 #endif /* __arm64__ */
2564 platform = PLATFORM_IOS;
2565 break;
2566 }
2567 case LC_VERSION_MIN_WATCHOS:
2568 platform = PLATFORM_WATCHOS;
2569 break;
2570 case LC_VERSION_MIN_TVOS:
2571 platform = PLATFORM_TVOS;
2572 break;
2573 #endif /* __x86_64__ */
2574 /* All LC_VERSION_MIN_* load commands are legacy and we will not be adding any more */
2575 default:
2576 sdk = (uint32_t)-1;
2577 min_sdk = (uint32_t)-1;
2578 __builtin_unreachable();
2579 }
2580 result->ip_platform = platform;
2581 result->lr_min_sdk = min_sdk;
2582 result->lr_sdk = sdk;
2583 return LOAD_SUCCESS;
2584 }
2585
2586 static
2587 load_return_t
load_main(struct entry_point_command * epc,thread_t thread,int64_t slide,load_result_t * result)2588 load_main(
2589 struct entry_point_command *epc,
2590 thread_t thread,
2591 int64_t slide,
2592 load_result_t *result
2593 )
2594 {
2595 mach_vm_offset_t addr;
2596 kern_return_t ret;
2597
2598 if (epc->cmdsize < sizeof(*epc)) {
2599 return LOAD_BADMACHO;
2600 }
2601 if (result->thread_count != 0) {
2602 return LOAD_FAILURE;
2603 }
2604
2605 if (thread == THREAD_NULL) {
2606 return LOAD_SUCCESS;
2607 }
2608
2609 /*
2610 * LC_MAIN specifies stack size but not location.
2611 * Add guard page to allocation size (MAXSSIZ includes guard page).
2612 */
2613 if (epc->stacksize) {
2614 if (os_add_overflow(epc->stacksize, 4 * PAGE_SIZE, &result->user_stack_size)) {
2615 /*
2616 * We are going to immediately throw away this result, but we want
2617 * to make sure we aren't loading a dangerously close to
2618 * overflowing value, since this will have a guard page added to it
2619 * and be rounded to page boundaries
2620 */
2621 return LOAD_BADMACHO;
2622 }
2623 result->user_stack_size = epc->stacksize;
2624 if (os_add_overflow(epc->stacksize, PAGE_SIZE, &result->user_stack_alloc_size)) {
2625 return LOAD_BADMACHO;
2626 }
2627 result->custom_stack = TRUE;
2628 } else {
2629 result->user_stack_alloc_size = MAXSSIZ;
2630 }
2631
2632 /* use default location for stack */
2633 ret = thread_userstackdefault(&addr, result->is_64bit_addr);
2634 if (ret != KERN_SUCCESS) {
2635 return LOAD_FAILURE;
2636 }
2637
2638 /* The stack slides down from the default location */
2639 result->user_stack = (user_addr_t)mach_vm_trunc_page((user_addr_t)addr - slide);
2640
2641 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2642 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2643 return LOAD_FAILURE;
2644 }
2645
2646 /* kernel does *not* use entryoff from LC_MAIN. Dyld uses it. */
2647 result->needs_dynlinker = TRUE;
2648 result->using_lcmain = TRUE;
2649
2650 ret = thread_state_initialize( thread );
2651 if (ret != KERN_SUCCESS) {
2652 return LOAD_FAILURE;
2653 }
2654
2655 result->unixproc = TRUE;
2656 result->thread_count++;
2657
2658 return LOAD_SUCCESS;
2659 }
2660
2661 static
2662 load_return_t
setup_driver_main(thread_t thread,int64_t slide,load_result_t * result)2663 setup_driver_main(
2664 thread_t thread,
2665 int64_t slide,
2666 load_result_t *result
2667 )
2668 {
2669 mach_vm_offset_t addr;
2670 kern_return_t ret;
2671
2672 /* Driver binaries have no LC_MAIN, use defaults */
2673
2674 if (thread == THREAD_NULL) {
2675 return LOAD_SUCCESS;
2676 }
2677
2678 result->user_stack_alloc_size = MAXSSIZ;
2679
2680 /* use default location for stack */
2681 ret = thread_userstackdefault(&addr, result->is_64bit_addr);
2682 if (ret != KERN_SUCCESS) {
2683 return LOAD_FAILURE;
2684 }
2685
2686 /* The stack slides down from the default location */
2687 result->user_stack = (user_addr_t)addr;
2688 result->user_stack -= slide;
2689
2690 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2691 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2692 return LOAD_FAILURE;
2693 }
2694
2695 result->needs_dynlinker = TRUE;
2696
2697 ret = thread_state_initialize( thread );
2698 if (ret != KERN_SUCCESS) {
2699 return LOAD_FAILURE;
2700 }
2701
2702 result->unixproc = TRUE;
2703 result->thread_count++;
2704
2705 return LOAD_SUCCESS;
2706 }
2707
2708 static
2709 load_return_t
load_unixthread(struct thread_command * tcp,thread_t thread,int64_t slide,boolean_t is_x86_64_compat_binary,load_result_t * result)2710 load_unixthread(
2711 struct thread_command *tcp,
2712 thread_t thread,
2713 int64_t slide,
2714 boolean_t is_x86_64_compat_binary,
2715 load_result_t *result
2716 )
2717 {
2718 load_return_t ret;
2719 int customstack = 0;
2720 mach_vm_offset_t addr;
2721 if (tcp->cmdsize < sizeof(*tcp)) {
2722 return LOAD_BADMACHO;
2723 }
2724 if (result->thread_count != 0) {
2725 return LOAD_FAILURE;
2726 }
2727
2728 if (thread == THREAD_NULL) {
2729 return LOAD_SUCCESS;
2730 }
2731
2732 ret = load_threadstack(thread,
2733 (uint32_t *)(((vm_offset_t)tcp) +
2734 sizeof(struct thread_command)),
2735 tcp->cmdsize - sizeof(struct thread_command),
2736 &addr, &customstack, is_x86_64_compat_binary, result);
2737 if (ret != LOAD_SUCCESS) {
2738 return ret;
2739 }
2740
2741 /* LC_UNIXTHREAD optionally specifies stack size and location */
2742
2743 if (customstack) {
2744 result->custom_stack = TRUE;
2745 } else {
2746 result->user_stack_alloc_size = MAXSSIZ;
2747 }
2748
2749 /* The stack slides down from the default location */
2750 result->user_stack = (user_addr_t)mach_vm_trunc_page((user_addr_t)addr - slide);
2751
2752 {
2753 ret = load_threadentry(thread,
2754 (uint32_t *)(((vm_offset_t)tcp) +
2755 sizeof(struct thread_command)),
2756 tcp->cmdsize - sizeof(struct thread_command),
2757 &addr);
2758 if (ret != LOAD_SUCCESS) {
2759 return ret;
2760 }
2761
2762 if (result->using_lcmain || result->entry_point != MACH_VM_MIN_ADDRESS) {
2763 /* Already processed LC_MAIN or LC_UNIXTHREAD */
2764 return LOAD_FAILURE;
2765 }
2766
2767 result->entry_point = (user_addr_t)addr;
2768 result->entry_point += slide;
2769
2770 ret = load_threadstate(thread,
2771 (uint32_t *)(((vm_offset_t)tcp) + sizeof(struct thread_command)),
2772 tcp->cmdsize - sizeof(struct thread_command),
2773 result);
2774 if (ret != LOAD_SUCCESS) {
2775 return ret;
2776 }
2777 }
2778
2779 result->unixproc = TRUE;
2780 result->thread_count++;
2781
2782 return LOAD_SUCCESS;
2783 }
2784
2785 static
2786 load_return_t
load_threadstate(thread_t thread,uint32_t * ts,uint32_t total_size,load_result_t * result)2787 load_threadstate(
2788 thread_t thread,
2789 uint32_t *ts,
2790 uint32_t total_size,
2791 load_result_t *result
2792 )
2793 {
2794 uint32_t size;
2795 int flavor;
2796 uint32_t thread_size;
2797 uint32_t *local_ts = NULL;
2798 uint32_t local_ts_size = 0;
2799 int ret;
2800
2801 (void)thread;
2802
2803 if (total_size > 0) {
2804 local_ts_size = total_size;
2805 local_ts = (uint32_t *)kalloc_data(local_ts_size, Z_WAITOK);
2806 if (local_ts == NULL) {
2807 return LOAD_FAILURE;
2808 }
2809 memcpy(local_ts, ts, local_ts_size);
2810 ts = local_ts;
2811 }
2812
2813 /*
2814 * Validate the new thread state; iterate through the state flavors in
2815 * the Mach-O file.
2816 * XXX: we should validate the machine state here, to avoid failing at
2817 * activation time where we can't bail out cleanly.
2818 */
2819 while (total_size > 0) {
2820 if (total_size < 2 * sizeof(uint32_t)) {
2821 return LOAD_BADMACHO;
2822 }
2823
2824 flavor = *ts++;
2825 size = *ts++;
2826
2827 if (os_add_and_mul_overflow(size, 2, sizeof(uint32_t), &thread_size) ||
2828 os_sub_overflow(total_size, thread_size, &total_size)) {
2829 ret = LOAD_BADMACHO;
2830 goto bad;
2831 }
2832
2833 ts += size; /* ts is a (uint32_t *) */
2834 }
2835
2836 result->threadstate = local_ts;
2837 result->threadstate_sz = local_ts_size;
2838 return LOAD_SUCCESS;
2839
2840 bad:
2841 if (local_ts) {
2842 kfree_data(local_ts, local_ts_size);
2843 }
2844 return ret;
2845 }
2846
2847
2848 static
2849 load_return_t
load_threadstack(thread_t thread,uint32_t * ts,uint32_t total_size,mach_vm_offset_t * user_stack,int * customstack,__unused boolean_t is_x86_64_compat_binary,load_result_t * result)2850 load_threadstack(
2851 thread_t thread,
2852 uint32_t *ts,
2853 uint32_t total_size,
2854 mach_vm_offset_t *user_stack,
2855 int *customstack,
2856 __unused boolean_t is_x86_64_compat_binary,
2857 load_result_t *result
2858 )
2859 {
2860 kern_return_t ret;
2861 uint32_t size;
2862 int flavor;
2863 uint32_t stack_size;
2864
2865 if (total_size == 0) {
2866 return LOAD_BADMACHO;
2867 }
2868
2869 while (total_size > 0) {
2870 if (total_size < 2 * sizeof(uint32_t)) {
2871 return LOAD_BADMACHO;
2872 }
2873
2874 flavor = *ts++;
2875 size = *ts++;
2876 if (UINT32_MAX - 2 < size ||
2877 UINT32_MAX / sizeof(uint32_t) < size + 2) {
2878 return LOAD_BADMACHO;
2879 }
2880 stack_size = (size + 2) * sizeof(uint32_t);
2881 if (stack_size > total_size) {
2882 return LOAD_BADMACHO;
2883 }
2884 total_size -= stack_size;
2885
2886 /*
2887 * Third argument is a kernel space pointer; it gets cast
2888 * to the appropriate type in thread_userstack() based on
2889 * the value of flavor.
2890 */
2891 {
2892 ret = thread_userstack(thread, flavor, (thread_state_t)ts, size, user_stack, customstack, result->is_64bit_data);
2893 if (ret != KERN_SUCCESS) {
2894 return LOAD_FAILURE;
2895 }
2896 }
2897
2898 ts += size; /* ts is a (uint32_t *) */
2899 }
2900 return LOAD_SUCCESS;
2901 }
2902
2903 static
2904 load_return_t
load_threadentry(thread_t thread,uint32_t * ts,uint32_t total_size,mach_vm_offset_t * entry_point)2905 load_threadentry(
2906 thread_t thread,
2907 uint32_t *ts,
2908 uint32_t total_size,
2909 mach_vm_offset_t *entry_point
2910 )
2911 {
2912 kern_return_t ret;
2913 uint32_t size;
2914 int flavor;
2915 uint32_t entry_size;
2916
2917 /*
2918 * Set the thread state.
2919 */
2920 *entry_point = MACH_VM_MIN_ADDRESS;
2921 while (total_size > 0) {
2922 if (total_size < 2 * sizeof(uint32_t)) {
2923 return LOAD_BADMACHO;
2924 }
2925
2926 flavor = *ts++;
2927 size = *ts++;
2928 if (UINT32_MAX - 2 < size ||
2929 UINT32_MAX / sizeof(uint32_t) < size + 2) {
2930 return LOAD_BADMACHO;
2931 }
2932 entry_size = (size + 2) * sizeof(uint32_t);
2933 if (entry_size > total_size) {
2934 return LOAD_BADMACHO;
2935 }
2936 total_size -= entry_size;
2937 /*
2938 * Third argument is a kernel space pointer; it gets cast
2939 * to the appropriate type in thread_entrypoint() based on
2940 * the value of flavor.
2941 */
2942 ret = thread_entrypoint(thread, flavor, (thread_state_t)ts, size, entry_point);
2943 if (ret != KERN_SUCCESS) {
2944 return LOAD_FAILURE;
2945 }
2946 ts += size; /* ts is a (uint32_t *) */
2947 }
2948 return LOAD_SUCCESS;
2949 }
2950
2951 struct macho_data {
2952 struct nameidata __nid;
2953 union macho_vnode_header {
2954 struct mach_header mach_header;
2955 struct fat_header fat_header;
2956 char __pad[512];
2957 } __header;
2958 };
2959
2960 #define DEFAULT_DYLD_PATH "/usr/lib/dyld"
2961
2962 #if (DEVELOPMENT || DEBUG)
2963 extern char dyld_alt_path[];
2964 extern int use_alt_dyld;
2965 #endif
2966
2967 static load_return_t
load_dylinker(struct dylinker_command * lcp,cpu_type_t cputype,vm_map_t map,thread_t thread,int depth,int64_t slide,load_result_t * result,struct image_params * imgp)2968 load_dylinker(
2969 struct dylinker_command *lcp,
2970 cpu_type_t cputype,
2971 vm_map_t map,
2972 thread_t thread,
2973 int depth,
2974 int64_t slide,
2975 load_result_t *result,
2976 struct image_params *imgp
2977 )
2978 {
2979 const char *name;
2980 struct vnode *vp = NULLVP; /* set by get_macho_vnode() */
2981 struct mach_header *header;
2982 off_t file_offset = 0; /* set by get_macho_vnode() */
2983 off_t macho_size = 0; /* set by get_macho_vnode() */
2984 load_result_t *myresult;
2985 kern_return_t ret;
2986 struct macho_data *macho_data;
2987 struct {
2988 struct mach_header __header;
2989 load_result_t __myresult;
2990 struct macho_data __macho_data;
2991 } *dyld_data;
2992
2993 if (lcp->cmdsize < sizeof(*lcp) || lcp->name.offset >= lcp->cmdsize) {
2994 return LOAD_BADMACHO;
2995 }
2996
2997 name = (const char *)lcp + lcp->name.offset;
2998
2999 /* Check for a proper null terminated string. */
3000 size_t maxsz = lcp->cmdsize - lcp->name.offset;
3001 size_t namelen = strnlen(name, maxsz);
3002 if (namelen >= maxsz) {
3003 return LOAD_BADMACHO;
3004 }
3005
3006 #if (DEVELOPMENT || DEBUG)
3007
3008 /*
3009 * rdar://23680808
3010 * If an alternate dyld has been specified via boot args, check
3011 * to see if PROC_UUID_ALT_DYLD_POLICY has been set on this
3012 * executable and redirect the kernel to load that linker.
3013 */
3014
3015 if (use_alt_dyld) {
3016 int policy_error;
3017 uint32_t policy_flags = 0;
3018 int32_t policy_gencount = 0;
3019
3020 policy_error = proc_uuid_policy_lookup(result->uuid, &policy_flags, &policy_gencount);
3021 if (policy_error == 0) {
3022 if (policy_flags & PROC_UUID_ALT_DYLD_POLICY) {
3023 name = dyld_alt_path;
3024 }
3025 }
3026 }
3027 #endif
3028
3029 #if !(DEVELOPMENT || DEBUG)
3030 if (0 != strcmp(name, DEFAULT_DYLD_PATH)) {
3031 return LOAD_BADMACHO;
3032 }
3033 #endif
3034
3035 /* Allocate wad-of-data from heap to reduce excessively deep stacks */
3036
3037 dyld_data = kalloc_type(typeof(*dyld_data), Z_WAITOK);
3038 header = &dyld_data->__header;
3039 myresult = &dyld_data->__myresult;
3040 macho_data = &dyld_data->__macho_data;
3041
3042 {
3043 cputype = (cputype & CPU_ARCH_MASK) | (cpu_type() & ~CPU_ARCH_MASK);
3044 }
3045
3046 ret = get_macho_vnode(name, cputype, header,
3047 &file_offset, &macho_size, macho_data, &vp, imgp);
3048 if (ret) {
3049 goto novp_out;
3050 }
3051
3052 *myresult = load_result_null;
3053 myresult->is_64bit_addr = result->is_64bit_addr;
3054 myresult->is_64bit_data = result->is_64bit_data;
3055
3056 ret = parse_machfile(vp, map, thread, header, file_offset,
3057 macho_size, depth, slide, 0, myresult, result, imgp);
3058
3059 if (ret == LOAD_SUCCESS) {
3060 if (result->threadstate) {
3061 /* don't use the app's threadstate if we have a dyld */
3062 kfree_data(result->threadstate, result->threadstate_sz);
3063 }
3064 result->threadstate = myresult->threadstate;
3065 result->threadstate_sz = myresult->threadstate_sz;
3066
3067 result->dynlinker = TRUE;
3068 result->entry_point = myresult->entry_point;
3069 result->validentry = myresult->validentry;
3070 result->all_image_info_addr = myresult->all_image_info_addr;
3071 result->all_image_info_size = myresult->all_image_info_size;
3072 if (!myresult->platform_binary) {
3073 result->csflags &= ~CS_NO_UNTRUSTED_HELPERS;
3074 }
3075
3076 }
3077
3078 struct vnode_attr *va;
3079 va = kalloc_type(struct vnode_attr, Z_WAITOK | Z_ZERO);
3080 VATTR_INIT(va);
3081 VATTR_WANTED(va, va_fsid64);
3082 VATTR_WANTED(va, va_fsid);
3083 VATTR_WANTED(va, va_fileid);
3084 int error = vnode_getattr(vp, va, imgp->ip_vfs_context);
3085 if (error == 0) {
3086 imgp->ip_dyld_fsid = vnode_get_va_fsid(va);
3087 imgp->ip_dyld_fsobjid = va->va_fileid;
3088 }
3089
3090 vnode_put(vp);
3091 kfree_type(struct vnode_attr, va);
3092 novp_out:
3093 kfree_type(typeof(*dyld_data), dyld_data);
3094 return ret;
3095 }
3096
3097
3098 static load_return_t
load_code_signature(struct linkedit_data_command * lcp,struct vnode * vp,off_t macho_offset,off_t macho_size,cpu_type_t cputype,cpu_subtype_t cpusubtype,load_result_t * result,struct image_params * imgp)3099 load_code_signature(
3100 struct linkedit_data_command *lcp,
3101 struct vnode *vp,
3102 off_t macho_offset,
3103 off_t macho_size,
3104 cpu_type_t cputype,
3105 cpu_subtype_t cpusubtype,
3106 load_result_t *result,
3107 struct image_params *imgp)
3108 {
3109 int ret;
3110 kern_return_t kr;
3111 vm_offset_t addr;
3112 int resid;
3113 struct cs_blob *blob;
3114 int error;
3115 vm_size_t blob_size;
3116 uint32_t sum;
3117 boolean_t anyCPU;
3118
3119 addr = 0;
3120 blob = NULL;
3121
3122 cpusubtype &= ~CPU_SUBTYPE_MASK;
3123
3124 if (lcp->cmdsize != sizeof(struct linkedit_data_command)) {
3125 ret = LOAD_BADMACHO;
3126 goto out;
3127 }
3128
3129 sum = 0;
3130 if (os_add_overflow(lcp->dataoff, lcp->datasize, &sum) || sum > macho_size) {
3131 ret = LOAD_BADMACHO;
3132 goto out;
3133 }
3134
3135 blob = ubc_cs_blob_get(vp, cputype, cpusubtype, macho_offset);
3136
3137 if (blob != NULL) {
3138 /* we already have a blob for this vnode and cpu(sub)type */
3139 anyCPU = blob->csb_cpu_type == -1;
3140 if ((blob->csb_cpu_type != cputype &&
3141 blob->csb_cpu_subtype != cpusubtype && !anyCPU) ||
3142 blob->csb_base_offset != macho_offset) {
3143 /* the blob has changed for this vnode: fail ! */
3144 ret = LOAD_BADMACHO;
3145 goto out;
3146 }
3147
3148 /* It matches the blob we want here, let's verify the version */
3149 if (!anyCPU && ubc_cs_generation_check(vp) == 0) {
3150 /* No need to revalidate, we're good! */
3151 ret = LOAD_SUCCESS;
3152 goto out;
3153 }
3154
3155 /* That blob may be stale, let's revalidate. */
3156 error = ubc_cs_blob_revalidate(vp, blob, imgp, 0, result->ip_platform);
3157 if (error == 0) {
3158 /* Revalidation succeeded, we're good! */
3159 /* If we were revaliding a CS blob with any CPU arch we adjust it */
3160 if (anyCPU) {
3161 vnode_lock_spin(vp);
3162 struct cs_cpu_info cpu_info = {
3163 .csb_cpu_type = cputype,
3164 .csb_cpu_subtype = cpusubtype
3165 };
3166 zalloc_ro_update_field(ZONE_ID_CS_BLOB, blob, csb_cpu_info, &cpu_info);
3167 vnode_unlock(vp);
3168 }
3169 ret = LOAD_SUCCESS;
3170 goto out;
3171 }
3172
3173 if (error != EAGAIN) {
3174 printf("load_code_signature: revalidation failed: %d\n", error);
3175 ret = LOAD_FAILURE;
3176 goto out;
3177 }
3178
3179 assert(error == EAGAIN);
3180
3181 /*
3182 * Revalidation was not possible for this blob. We just continue as if there was no blob,
3183 * rereading the signature, and ubc_cs_blob_add will do the right thing.
3184 */
3185 blob = NULL;
3186 }
3187
3188 blob_size = lcp->datasize;
3189 kr = ubc_cs_blob_allocate(&addr, &blob_size);
3190 if (kr != KERN_SUCCESS) {
3191 ret = LOAD_NOSPACE;
3192 goto out;
3193 }
3194
3195 resid = 0;
3196 error = vn_rdwr(UIO_READ,
3197 vp,
3198 (caddr_t) addr,
3199 lcp->datasize,
3200 macho_offset + lcp->dataoff,
3201 UIO_SYSSPACE,
3202 0,
3203 kauth_cred_get(),
3204 &resid,
3205 current_proc());
3206 if (error || resid != 0) {
3207 ret = LOAD_IOERROR;
3208 goto out;
3209 }
3210
3211 if (ubc_cs_blob_add(vp,
3212 result->ip_platform,
3213 cputype,
3214 cpusubtype,
3215 macho_offset,
3216 &addr,
3217 lcp->datasize,
3218 imgp,
3219 0,
3220 &blob)) {
3221 if (addr) {
3222 ubc_cs_blob_deallocate(addr, blob_size);
3223 addr = 0;
3224 }
3225 ret = LOAD_FAILURE;
3226 goto out;
3227 } else {
3228 /* ubc_cs_blob_add() has consumed "addr" */
3229 addr = 0;
3230 }
3231
3232 #if CHECK_CS_VALIDATION_BITMAP
3233 ubc_cs_validation_bitmap_allocate( vp );
3234 #endif
3235
3236 ret = LOAD_SUCCESS;
3237 out:
3238 if (ret == LOAD_SUCCESS) {
3239 if (blob == NULL) {
3240 panic("success, but no blob!");
3241 }
3242
3243 result->csflags |= blob->csb_flags;
3244 result->platform_binary = blob->csb_platform_binary;
3245 result->cs_end_offset = blob->csb_end_offset;
3246 }
3247 if (addr != 0) {
3248 ubc_cs_blob_deallocate(addr, blob_size);
3249 addr = 0;
3250 }
3251
3252 return ret;
3253 }
3254
3255
3256 #if CONFIG_CODE_DECRYPTION
3257
3258 static load_return_t
set_code_unprotect(struct encryption_info_command * eip,caddr_t addr,vm_map_t map,int64_t slide,struct vnode * vp,off_t macho_offset,cpu_type_t cputype,cpu_subtype_t cpusubtype)3259 set_code_unprotect(
3260 struct encryption_info_command *eip,
3261 caddr_t addr,
3262 vm_map_t map,
3263 int64_t slide,
3264 struct vnode *vp,
3265 off_t macho_offset,
3266 cpu_type_t cputype,
3267 cpu_subtype_t cpusubtype)
3268 {
3269 int error, len;
3270 pager_crypt_info_t crypt_info;
3271 const char * cryptname = 0;
3272 char *vpath;
3273
3274 size_t offset;
3275 struct segment_command_64 *seg64;
3276 struct segment_command *seg32;
3277 vm_map_offset_t map_offset, map_size;
3278 vm_object_offset_t crypto_backing_offset;
3279 kern_return_t kr;
3280
3281 if (eip->cmdsize < sizeof(*eip)) {
3282 return LOAD_BADMACHO;
3283 }
3284
3285 switch (eip->cryptid) {
3286 case 0:
3287 /* not encrypted, just an empty load command */
3288 return LOAD_SUCCESS;
3289 case 1:
3290 cryptname = "com.apple.unfree";
3291 break;
3292 case 0x10:
3293 /* some random cryptid that you could manually put into
3294 * your binary if you want NULL */
3295 cryptname = "com.apple.null";
3296 break;
3297 default:
3298 return LOAD_BADMACHO;
3299 }
3300
3301 if (map == VM_MAP_NULL) {
3302 return LOAD_SUCCESS;
3303 }
3304 if (NULL == text_crypter_create) {
3305 return LOAD_FAILURE;
3306 }
3307
3308 vpath = zalloc(ZV_NAMEI);
3309
3310 len = MAXPATHLEN;
3311 error = vn_getpath(vp, vpath, &len);
3312 if (error) {
3313 zfree(ZV_NAMEI, vpath);
3314 return LOAD_FAILURE;
3315 }
3316
3317 if (eip->cryptsize == 0) {
3318 printf("%s:%d '%s': cryptoff 0x%llx cryptsize 0x%llx cryptid 0x%x ignored\n", __FUNCTION__, __LINE__, vpath, (uint64_t)eip->cryptoff, (uint64_t)eip->cryptsize, eip->cryptid);
3319 zfree(ZV_NAMEI, vpath);
3320 return LOAD_SUCCESS;
3321 }
3322
3323 /* set up decrypter first */
3324 crypt_file_data_t crypt_data = {
3325 .filename = vpath,
3326 .cputype = cputype,
3327 .cpusubtype = cpusubtype
3328 };
3329 kr = text_crypter_create(&crypt_info, cryptname, (void*)&crypt_data);
3330 #if VM_MAP_DEBUG_APPLE_PROTECT
3331 if (vm_map_debug_apple_protect) {
3332 struct proc *p;
3333 p = current_proc();
3334 printf("APPLE_PROTECT: %d[%s] map %p %s(%s) -> 0x%x\n",
3335 proc_getpid(p), p->p_comm, map, __FUNCTION__, vpath, kr);
3336 }
3337 #endif /* VM_MAP_DEBUG_APPLE_PROTECT */
3338 zfree(ZV_NAMEI, vpath);
3339
3340 if (kr) {
3341 printf("set_code_unprotect: unable to create decrypter %s, kr=%d\n",
3342 cryptname, kr);
3343 if (kr == kIOReturnNotPrivileged) {
3344 /* text encryption returned decryption failure */
3345 return LOAD_DECRYPTFAIL;
3346 } else {
3347 return LOAD_RESOURCE;
3348 }
3349 }
3350
3351 /* this is terrible, but we have to rescan the load commands to find the
3352 * virtual address of this encrypted stuff. This code is gonna look like
3353 * the dyld source one day... */
3354 struct mach_header *header = (struct mach_header *)addr;
3355 size_t mach_header_sz = sizeof(struct mach_header);
3356 if (header->magic == MH_MAGIC_64 ||
3357 header->magic == MH_CIGAM_64) {
3358 mach_header_sz = sizeof(struct mach_header_64);
3359 }
3360 offset = mach_header_sz;
3361 uint32_t ncmds = header->ncmds;
3362 while (ncmds--) {
3363 /*
3364 * Get a pointer to the command.
3365 */
3366 struct load_command *lcp = (struct load_command *)(addr + offset);
3367 offset += lcp->cmdsize;
3368
3369 switch (lcp->cmd) {
3370 case LC_SEGMENT_64:
3371 seg64 = (struct segment_command_64 *)lcp;
3372 if ((seg64->fileoff <= eip->cryptoff) &&
3373 (seg64->fileoff + seg64->filesize >=
3374 eip->cryptoff + eip->cryptsize)) {
3375 map_offset = (vm_map_offset_t)(seg64->vmaddr + eip->cryptoff - seg64->fileoff + slide);
3376 map_size = eip->cryptsize;
3377 crypto_backing_offset = macho_offset + eip->cryptoff;
3378 goto remap_now;
3379 }
3380 break;
3381 case LC_SEGMENT:
3382 seg32 = (struct segment_command *)lcp;
3383 if ((seg32->fileoff <= eip->cryptoff) &&
3384 (seg32->fileoff + seg32->filesize >=
3385 eip->cryptoff + eip->cryptsize)) {
3386 map_offset = (vm_map_offset_t)(seg32->vmaddr + eip->cryptoff - seg32->fileoff + slide);
3387 map_size = eip->cryptsize;
3388 crypto_backing_offset = macho_offset + eip->cryptoff;
3389 goto remap_now;
3390 }
3391 break;
3392 }
3393 }
3394
3395 /* if we get here, did not find anything */
3396 return LOAD_BADMACHO;
3397
3398 remap_now:
3399 /* now remap using the decrypter */
3400 MACHO_PRINTF(("+++ set_code_unprotect: vm[0x%llx:0x%llx]\n",
3401 (uint64_t) map_offset,
3402 (uint64_t) (map_offset + map_size)));
3403 kr = vm_map_apple_protected(map,
3404 map_offset,
3405 map_offset + map_size,
3406 crypto_backing_offset,
3407 &crypt_info,
3408 CRYPTID_APP_ENCRYPTION);
3409 if (kr) {
3410 printf("set_code_unprotect(): mapping failed with %x\n", kr);
3411 return LOAD_PROTECT;
3412 }
3413
3414 return LOAD_SUCCESS;
3415 }
3416
3417 #endif
3418
3419 /*
3420 * This routine exists to support the load_dylinker().
3421 *
3422 * This routine has its own, separate, understanding of the FAT file format,
3423 * which is terrifically unfortunate.
3424 */
3425 static
3426 load_return_t
get_macho_vnode(const char * path,cpu_type_t cputype,struct mach_header * mach_header,off_t * file_offset,off_t * macho_size,struct macho_data * data,struct vnode ** vpp,struct image_params * imgp)3427 get_macho_vnode(
3428 const char *path,
3429 cpu_type_t cputype,
3430 struct mach_header *mach_header,
3431 off_t *file_offset,
3432 off_t *macho_size,
3433 struct macho_data *data,
3434 struct vnode **vpp,
3435 struct image_params *imgp
3436 )
3437 {
3438 struct vnode *vp;
3439 vfs_context_t ctx = vfs_context_current();
3440 proc_t p = vfs_context_proc(ctx);
3441 kauth_cred_t kerncred;
3442 struct nameidata *ndp = &data->__nid;
3443 boolean_t is_fat;
3444 struct fat_arch fat_arch;
3445 int error;
3446 int resid;
3447 union macho_vnode_header *header = &data->__header;
3448 off_t fsize = (off_t)0;
3449
3450 /*
3451 * Capture the kernel credential for use in the actual read of the
3452 * file, since the user doing the execution may have execute rights
3453 * but not read rights, but to exec something, we have to either map
3454 * or read it into the new process address space, which requires
3455 * read rights. This is to deal with lack of common credential
3456 * serialization code which would treat NOCRED as "serialize 'root'".
3457 */
3458 kerncred = vfs_context_ucred(vfs_context_kernel());
3459
3460 /* init the namei data to point the file user's program name */
3461 NDINIT(ndp, LOOKUP, OP_OPEN, FOLLOW | LOCKLEAF, UIO_SYSSPACE, CAST_USER_ADDR_T(path), ctx);
3462
3463 if ((error = namei(ndp)) != 0) {
3464 if (error == ENOENT) {
3465 error = LOAD_ENOENT;
3466 } else {
3467 error = LOAD_FAILURE;
3468 }
3469 return error;
3470 }
3471 nameidone(ndp);
3472 vp = ndp->ni_vp;
3473
3474 /* check for regular file */
3475 if (vp->v_type != VREG) {
3476 error = LOAD_PROTECT;
3477 goto bad1;
3478 }
3479
3480 /* get size */
3481 if ((error = vnode_size(vp, &fsize, ctx)) != 0) {
3482 error = LOAD_FAILURE;
3483 goto bad1;
3484 }
3485
3486 /* Check mount point */
3487 if (vp->v_mount->mnt_flag & MNT_NOEXEC) {
3488 error = LOAD_PROTECT;
3489 goto bad1;
3490 }
3491
3492 /* check access */
3493 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_EXECUTE | KAUTH_VNODE_READ_DATA, ctx)) != 0) {
3494 error = LOAD_PROTECT;
3495 goto bad1;
3496 }
3497
3498 /* try to open it */
3499 if ((error = VNOP_OPEN(vp, FREAD, ctx)) != 0) {
3500 error = LOAD_PROTECT;
3501 goto bad1;
3502 }
3503
3504 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)header, sizeof(*header), 0,
3505 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p)) != 0) {
3506 error = LOAD_IOERROR;
3507 goto bad2;
3508 }
3509
3510 if (resid) {
3511 error = LOAD_BADMACHO;
3512 goto bad2;
3513 }
3514
3515 if (header->mach_header.magic == MH_MAGIC ||
3516 header->mach_header.magic == MH_MAGIC_64) {
3517 is_fat = FALSE;
3518 } else if (OSSwapBigToHostInt32(header->fat_header.magic) == FAT_MAGIC) {
3519 is_fat = TRUE;
3520 } else {
3521 error = LOAD_BADMACHO;
3522 goto bad2;
3523 }
3524
3525 if (is_fat) {
3526 error = fatfile_validate_fatarches((vm_offset_t)(&header->fat_header),
3527 sizeof(*header), fsize);
3528 if (error != LOAD_SUCCESS) {
3529 goto bad2;
3530 }
3531
3532 /* Look up our architecture in the fat file. */
3533 error = fatfile_getbestarch_for_cputype(cputype, CPU_SUBTYPE_ANY,
3534 (vm_offset_t)(&header->fat_header), sizeof(*header), imgp, &fat_arch);
3535 if (error != LOAD_SUCCESS) {
3536 goto bad2;
3537 }
3538
3539 /* Read the Mach-O header out of it */
3540 error = vn_rdwr(UIO_READ, vp, (caddr_t)&header->mach_header,
3541 sizeof(header->mach_header), fat_arch.offset,
3542 UIO_SYSSPACE, IO_NODELOCKED, kerncred, &resid, p);
3543 if (error) {
3544 error = LOAD_IOERROR;
3545 goto bad2;
3546 }
3547
3548 if (resid) {
3549 error = LOAD_BADMACHO;
3550 goto bad2;
3551 }
3552
3553 /* Is this really a Mach-O? */
3554 if (header->mach_header.magic != MH_MAGIC &&
3555 header->mach_header.magic != MH_MAGIC_64) {
3556 error = LOAD_BADMACHO;
3557 goto bad2;
3558 }
3559
3560 *file_offset = fat_arch.offset;
3561 *macho_size = fat_arch.size;
3562 } else {
3563 /*
3564 * Force get_macho_vnode() to fail if the architecture bits
3565 * do not match the expected architecture bits. This in
3566 * turn causes load_dylinker() to fail for the same reason,
3567 * so it ensures the dynamic linker and the binary are in
3568 * lock-step. This is potentially bad, if we ever add to
3569 * the CPU_ARCH_* bits any bits that are desirable but not
3570 * required, since the dynamic linker might work, but we will
3571 * refuse to load it because of this check.
3572 */
3573 if ((cpu_type_t)header->mach_header.cputype != cputype) {
3574 error = LOAD_BADARCH;
3575 goto bad2;
3576 }
3577
3578 *file_offset = 0;
3579 *macho_size = fsize;
3580 }
3581
3582 *mach_header = header->mach_header;
3583 *vpp = vp;
3584
3585 ubc_setsize(vp, fsize);
3586 return error;
3587
3588 bad2:
3589 (void) VNOP_CLOSE(vp, FREAD, ctx);
3590 bad1:
3591 vnode_put(vp);
3592 return error;
3593 }
3594