1 /* 2 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SYS_CODESIGN_H_ 30 #define _SYS_CODESIGN_H_ 31 32 #include <kern/cs_blobs.h> 33 34 /* MAC flags used by F_ADDFILESIGS_* */ 35 #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ 36 37 #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" 38 #define OVERRIDE_PLUGIN_HOST_ENTITLEMENT "com.apple.private.security.override-plugin-host-detection" 39 40 /* csops operations */ 41 #define CS_OPS_STATUS 0 /* return status */ 42 #define CS_OPS_MARKINVALID 1 /* invalidate process */ 43 #define CS_OPS_MARKHARD 2 /* set HARD flag */ 44 #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ 45 #ifdef KERNEL_PRIVATE 46 /* CS_OPS_PIDPATH 4 */ 47 #endif 48 #define CS_OPS_CDHASH 5 /* get code directory hash */ 49 #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ 50 #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ 51 #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ 52 #define CS_OPS_SET_STATUS 9 /* set codesign flags */ 53 #define CS_OPS_BLOB 10 /* get codesign blob */ 54 #define CS_OPS_IDENTITY 11 /* get codesign identity */ 55 #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ 56 #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ 57 #define CS_OPS_TEAMID 14 /* get team id */ 58 #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ 59 #define CS_OPS_DER_ENTITLEMENTS_BLOB 16 /* get der entitlements blob */ 60 #define CS_OPS_VALIDATION_CATEGORY 17 /* get process validation category */ 61 62 #define CS_MAX_TEAMID_LEN 64 63 64 #ifndef KERNEL 65 66 #include <sys/types.h> 67 #include <mach/message.h> 68 69 __BEGIN_DECLS 70 /* code sign operations */ 71 int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); 72 int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); 73 __END_DECLS 74 75 #else /* !KERNEL */ 76 77 #include <mach/machine.h> 78 #include <mach/vm_types.h> 79 80 #include <sys/cdefs.h> 81 #include <sys/_types/_off_t.h> 82 83 struct vnode; 84 struct cs_blob; 85 struct fileglob; 86 87 __BEGIN_DECLS 88 int cs_valid(struct proc *); 89 int cs_process_enforcement(struct proc *); 90 int cs_process_global_enforcement(void); 91 int cs_system_enforcement(void); 92 int cs_vm_supports_4k_translations(void); 93 int cs_require_lv(struct proc *); 94 int csproc_forced_lv(struct proc* p); 95 int cs_system_require_lv(void); 96 uint32_t cs_entitlement_flags(struct proc *p); 97 int cs_entitlements_blob_get_vnode(struct vnode *, off_t, void **, size_t *); 98 int cs_entitlements_dictionary_copy_vnode(struct vnode *, off_t, void **); 99 int cs_entitlements_blob_get(struct proc *, void **, size_t *); 100 #ifdef KERNEL_PRIVATE 101 int cs_entitlements_dictionary_copy(struct proc *, void **); 102 #endif 103 int cs_restricted(struct proc *); 104 uint8_t * cs_get_cdhash(struct proc *); 105 cs_launch_type_t launch_constraint_data_get_launch_type(launch_constraint_data_t lcd); 106 107 struct cs_blob * csproc_get_blob(struct proc *); 108 struct cs_blob * csvnode_get_blob(struct vnode *, off_t); 109 void csvnode_print_debug(struct vnode *); 110 111 off_t csblob_get_base_offset(struct cs_blob *); 112 vm_size_t csblob_get_size(struct cs_blob *); 113 vm_address_t csblob_get_addr(struct cs_blob *); 114 const char * csblob_get_teamid(struct cs_blob *); 115 const char * csblob_get_identity(struct cs_blob *); 116 const uint8_t * csblob_get_cdhash(struct cs_blob *); 117 const CS_CodeDirectory* csblob_get_code_directory(struct cs_blob *csblob); 118 int csblob_get_platform_binary(struct cs_blob *); 119 void csblob_invalidate_flags(struct cs_blob *blob); 120 void csvnode_invalidate_flags(struct vnode * vp); 121 unsigned int csblob_get_flags(struct cs_blob *); 122 uint8_t csblob_get_hashtype(struct cs_blob const *); 123 unsigned int csblob_get_signer_type(struct cs_blob *); 124 #if DEVELOPMENT || DEBUG 125 void csproc_clear_platform_binary(struct proc *); 126 #endif 127 128 #define XNU_CSBLOB_HAS_VALIDATION_CATEGORY 1 129 int csblob_set_validation_category(struct cs_blob *, unsigned int); 130 unsigned int csblob_get_validation_category(struct cs_blob *); 131 132 #include <uuid/uuid.h> 133 134 int csblob_register_profile(struct cs_blob *, void*, vm_size_t); 135 136 #define XNU_SUPPORTS_PROVISIONING_PROFILE_UUID 1 137 int csblob_register_profile_uuid(struct cs_blob *, const uuid_t, void*, vm_size_t); 138 139 void csproc_disable_enforcement(struct proc* p); 140 void csproc_mark_invalid_allowed(struct proc* p); 141 int csproc_check_invalid_allowed(struct proc* p); 142 int csproc_hardened_runtime(struct proc* p); 143 144 int csblob_get_entitlements(struct cs_blob *, void **, size_t *); 145 int csblob_get_der_entitlements(struct cs_blob *, const CS_GenericBlob **, size_t *); 146 #define XNU_HAS_GET_DER_ENTITLEMENTS_UNSAFE 1 147 const CS_GenericBlob* csblob_get_der_entitlements_unsafe(struct cs_blob *); 148 149 const CS_GenericBlob * 150 csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); 151 const CS_GenericBlob * 152 csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); 153 void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); 154 void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); 155 156 // New APIs 157 void csblob_os_entitlements_set(struct cs_blob *csblob, void * entitlements); 158 void * csblob_os_entitlements_copy(struct cs_blob *csblob); 159 void * csblob_os_entitlements_get(struct cs_blob *csblob); 160 void * csblob_get_storage_addr(struct cs_blob *csblob); 161 /* 162 * Mostly convenience functions below 163 */ 164 165 const char * csproc_get_teamid(struct proc *); 166 const char * csproc_get_identity(struct proc *); 167 const char * csvnode_get_teamid(struct vnode *, off_t); 168 int csproc_get_platform_binary(struct proc *); 169 int csproc_get_prod_signed(struct proc *); 170 const char * csfg_get_teamid(struct fileglob *); 171 const char * csfg_get_supplement_teamid(struct fileglob *); 172 int csfg_get_path(struct fileglob *, char *, int *); 173 int csfg_get_platform_binary(struct fileglob *); 174 int csfg_get_supplement_platform_binary(struct fileglob *); 175 uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); 176 uint8_t * csfg_get_supplement_cdhash(struct fileglob *, uint64_t, size_t *); 177 const uint8_t * csfg_get_supplement_linkage_cdhash(struct fileglob *, uint64_t, size_t *); 178 int csfg_get_prod_signed(struct fileglob *); 179 int csfg_get_supplement_prod_signed(struct fileglob *fg); 180 unsigned int csfg_get_signer_type(struct fileglob *); 181 unsigned int csfg_get_supplement_signer_type(struct fileglob *); 182 const char *csfg_get_identity(struct fileglob *fg, off_t offset); 183 unsigned int csproc_get_signer_type(struct proc *); 184 185 uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); 186 uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); 187 uint8_t csproc_get_platform_identifier(struct proc *); 188 189 struct cs_blob* csfg_get_csblob(struct fileglob*, uint64_t); 190 struct cs_blob* csfg_get_supplement_csblob(struct fileglob*, uint64_t); 191 192 extern int cs_debug; 193 extern int cs_debug_fail_on_unsigned_code; 194 extern unsigned int cs_debug_unsigned_exec_failures; 195 extern unsigned int cs_debug_unsigned_mmap_failures; 196 197 int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, 198 struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); 199 200 void cs_blob_free(struct cs_blob *blob); 201 202 #ifdef XNU_KERNEL_PRIVATE 203 204 int cs_allow_invalid(struct proc *); 205 int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); 206 void cs_process_invalidated(struct proc *); 207 int csproc_get_platform_path(struct proc *); 208 int csproc_get_validation_category(struct proc *, unsigned int *); 209 210 #if !SECURE_KERNEL 211 extern int cs_enforcement_panic; 212 #endif 213 214 #endif /* XNU_KERNEL_PRIVATE */ 215 216 __END_DECLS 217 218 #endif /* KERNEL */ 219 220 #endif /* _SYS_CODESIGN_H_ */ 221