1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <unistd.h>
4 #include <darwintest.h>
5 #include <mach/mach.h>
6 #include <mach/mach_vm.h>
7 #include <sys/sysctl.h>
8 #include <spawn.h>
9 #include <signal.h>
10 #include <TargetConditionals.h>
11 #include "excserver_protect.h"
12
13 #define MAX_ARGV 3
14 #define EXC_CODE_SHIFT 32
15 #define EXC_GUARD_TYPE_SHIFT 29
16 #define MAX_TEST_NUM 21
17
18 #define TASK_EXC_GUARD_MP_DELIVER 0x10
19
20 extern char **environ;
21 static uint64_t exception_code = 0;
22 static exception_type_t exception_taken = 0;
23
24 #ifndef kGUARD_EXC_INVALID_OPTIONS
25 #define kGUARD_EXC_INVALID_OPTIONS 3
26 #endif
27
28 /*
29 * This test verifies behaviors of immovable/pinned task/thread ports.
30 *
31 * 1. Compare and verifies port names of mach_{task, thread}_self(),
32 * {TASK, THREAD}_KERNEL_PORT, and ports returned from task_threads()
33 * and processor_set_tasks().
34 * 2. Make sure correct exceptions are raised resulting from moving immovable
35 * task/thread control, read and inspect ports.
36 * 3. Make sure correct exceptions are raised resulting from deallocating pinned
37 * task/thread control ports.
38 * 4. Make sure immovable ports cannot be stashed:
39 * rdar://70585367 (Disallow immovable port stashing with *_set_special_port() and mach_port_register())
40 */
41 T_GLOBAL_META(
42 T_META_NAMESPACE("xnu.ipc"),
43 T_META_RADAR_COMPONENT_NAME("xnu"),
44 T_META_RADAR_COMPONENT_VERSION("IPC"),
45 T_META_RUN_CONCURRENTLY(TRUE));
46
47 static uint64_t soft_exception_code[] = {
48 EXC_GUARD, // Soft crash delivered as EXC_CORPSE_NOTIFY
49 EXC_GUARD,
50 EXC_GUARD,
51 EXC_GUARD,
52 EXC_GUARD,
53 EXC_GUARD,
54 EXC_GUARD,
55
56 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
57 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
58 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
59 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
60 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
61 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
62 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
63 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
64 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
65 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
66
67 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
68 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
69 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
70 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
71 };
72
73 static uint64_t hard_exception_code[] = {
74 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
75 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
76 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
77 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
78 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
79 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
80 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_MOD_REFS,
81
82 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
83 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
84 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
85 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
86 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
87 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
88 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
89 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
90 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
91 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_IMMOVABLE,
92
93 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
94 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
95 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
96 (GUARD_TYPE_MACH_PORT << EXC_GUARD_TYPE_SHIFT) | kGUARD_EXC_INVALID_OPTIONS,
97 };
98
99 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)100 catch_mach_exception_raise_state(mach_port_t exception_port,
101 exception_type_t exception,
102 const mach_exception_data_t code,
103 mach_msg_type_number_t code_count,
104 int * flavor,
105 const thread_state_t old_state,
106 mach_msg_type_number_t old_state_count,
107 thread_state_t new_state,
108 mach_msg_type_number_t * new_state_count)
109 {
110 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
111 T_FAIL("Unsupported catch_mach_exception_raise_state");
112 return KERN_NOT_SUPPORTED;
113 }
114
115 kern_return_t
catch_mach_exception_raise_identity_protected(mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt)116 catch_mach_exception_raise_identity_protected(
117 mach_port_t exception_port,
118 uint64_t thread_id,
119 mach_port_t task_id_token,
120 exception_type_t exception,
121 mach_exception_data_t codes,
122 mach_msg_type_number_t codeCnt)
123 {
124 #pragma unused(exception_port, codeCnt)
125 task_t task;
126 pid_t pid;
127 kern_return_t kr = task_identity_token_get_task_port(task_id_token, TASK_FLAVOR_READ, &task);
128 T_ASSERT_MACH_SUCCESS(kr, "task_identity_token_get_task_port");
129 kr = pid_for_task(task, &pid);
130 T_ASSERT_MACH_SUCCESS(kr, "pid_for_task");
131 T_LOG("Crashing child pid: %d, continuing...\n", pid);
132
133 kr = mach_port_deallocate(mach_task_self(), task);
134 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_port_deallocate");
135
136 T_ASSERT_GT_UINT(codeCnt, 0, "CodeCnt");
137 T_LOG("Caught exception type: %d code: 0x%llx", exception, (uint64_t)codes[0]);
138 if (exception == EXC_GUARD || exception == EXC_CORPSE_NOTIFY) {
139 exception_taken = exception;
140 exception_code = (uint64_t)codes[0];
141 } else {
142 T_FAIL("Unexpected exception");
143 }
144 return KERN_SUCCESS;
145 }
146
147 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)148 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
149 mach_port_t thread,
150 mach_port_t task,
151 exception_type_t exception,
152 mach_exception_data_t code,
153 mach_msg_type_number_t code_count,
154 int * flavor,
155 thread_state_t old_state,
156 mach_msg_type_number_t old_state_count,
157 thread_state_t new_state,
158 mach_msg_type_number_t * new_state_count)
159 {
160 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
161 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
162 return KERN_NOT_SUPPORTED;
163 }
164
165 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)166 catch_mach_exception_raise(mach_port_t exception_port,
167 mach_port_t thread,
168 mach_port_t task,
169 exception_type_t exception,
170 mach_exception_data_t code,
171 mach_msg_type_number_t code_count)
172 {
173 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
174 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
175 return KERN_NOT_SUPPORTED;
176 }
177
178 static void *
exception_server_thread(void * arg)179 exception_server_thread(void *arg)
180 {
181 kern_return_t kr;
182 mach_port_t exc_port = *(mach_port_t *)arg;
183
184 /* Handle exceptions on exc_port */
185 kr = mach_msg_server_once(mach_exc_server, 4096, exc_port, 0);
186 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server_once");
187
188 return NULL;
189 }
190
191 static mach_port_t
alloc_exception_port(void)192 alloc_exception_port(void)
193 {
194 kern_return_t kret;
195 mach_port_t exc_port = MACH_PORT_NULL;
196 mach_port_t task = mach_task_self();
197
198 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
199 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
200
201 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
202 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
203
204 return exc_port;
205 }
206
207 static void
test_immovable_port_stashing(void)208 test_immovable_port_stashing(void)
209 {
210 kern_return_t kr;
211 mach_port_t port;
212
213 kr = task_set_special_port(mach_task_self(), TASK_BOOTSTRAP_PORT, mach_task_self());
214 T_EXPECT_EQ(kr, KERN_INVALID_RIGHT, "should disallow task_set_special_port() with immovable port");
215
216 kr = thread_set_special_port(mach_thread_self(), THREAD_KERNEL_PORT, mach_thread_self());
217 T_EXPECT_EQ(kr, KERN_INVALID_RIGHT, "should disallow task_set_special_port() with immovable port");
218
219 mach_port_t stash[1] = {mach_task_self()};
220 kr = mach_ports_register(mach_task_self(), stash, 1);
221 T_EXPECT_EQ(kr, KERN_INVALID_RIGHT, "should disallow mach_ports_register() with immovable port");
222
223 T_QUIET; T_ASSERT_MACH_SUCCESS(mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &port), "mach_port_allocate");
224 T_QUIET; T_ASSERT_MACH_SUCCESS(mach_port_insert_right(mach_task_self(), port, port, MACH_MSG_TYPE_MAKE_SEND), "mach_port_insert_right");
225
226 stash[0] = port;
227 kr = mach_ports_register(mach_task_self(), stash, 1);
228 T_EXPECT_MACH_SUCCESS(kr, "mach_ports_register() should succeed with movable port");
229 }
230
231 static void
test_task_thread_port_values(void)232 test_task_thread_port_values(void)
233 {
234 T_LOG("Compare various task/thread control port values\n");
235 kern_return_t kr;
236 mach_port_t port, th_self;
237 thread_array_t threadList;
238 mach_msg_type_number_t threadCount = 0;
239 boolean_t found_self = false;
240 processor_set_name_array_t psets;
241 processor_set_t pset_priv;
242 task_array_t taskList;
243 mach_msg_type_number_t pcnt = 0, tcnt = 0;
244 mach_port_t host = mach_host_self();
245
246 /* Compare with task/thread_get_special_port() */
247 kr = task_get_special_port(mach_task_self(), TASK_KERNEL_PORT, &port);
248 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_get_special_port() - TASK_KERNEL_PORT");
249 T_EXPECT_NE(port, mach_task_self(), "TASK_KERNEL_PORT should not match mach_task_self()");
250 mach_port_deallocate(mach_task_self(), port);
251
252 kr = task_for_pid(mach_task_self(), getpid(), &port);
253 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_for_pid()");
254 T_EXPECT_EQ(port, mach_task_self(), "task_for_pid(self) should match mach_task_self()");
255 mach_port_deallocate(mach_task_self(), port);
256
257 th_self = mach_thread_self();
258 kr = thread_get_special_port(th_self, THREAD_KERNEL_PORT, &port);
259 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port() - THREAD_KERNEL_PORT");
260 T_EXPECT_NE(port, th_self, "THREAD_KERNEL_PORT should not match mach_thread_self()");
261 mach_port_deallocate(mach_task_self(), port);
262
263 /* Make sure task_threads() return immovable thread ports */
264 kr = task_threads(mach_task_self(), &threadList, &threadCount);
265 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_threads()");
266 T_QUIET; T_ASSERT_GE(threadCount, 1, "should have at least 1 thread");
267
268 for (size_t i = 0; i < threadCount; i++) {
269 if (th_self == threadList[i]) { /* th_self is immovable */
270 found_self = true;
271 break;
272 }
273 }
274
275 T_EXPECT_TRUE(found_self, "task_threads() should return immovable thread self");
276
277 for (size_t i = 0; i < threadCount; i++) {
278 mach_port_deallocate(mach_task_self(), threadList[i]);
279 }
280
281 if (threadCount > 0) {
282 mach_vm_deallocate(mach_task_self(),
283 (mach_vm_address_t)threadList,
284 threadCount * sizeof(mach_port_t));
285 }
286
287 mach_port_deallocate(mach_task_self(), th_self);
288
289 /* Make sure processor_set_tasks() return immovable task self */
290 kr = host_processor_sets(host, &psets, &pcnt);
291 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_sets");
292 T_QUIET; T_ASSERT_GE(pcnt, 1, "should have at least 1 processor set");
293
294 kr = host_processor_set_priv(host, psets[0], &pset_priv);
295 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_set_priv");
296 for (size_t i = 0; i < pcnt; i++) {
297 mach_port_deallocate(mach_task_self(), psets[i]);
298 }
299 mach_port_deallocate(mach_task_self(), host);
300 vm_deallocate(mach_task_self(), (vm_address_t)psets, (vm_size_t)pcnt * sizeof(mach_port_t));
301
302 kr = processor_set_tasks_with_flavor(pset_priv, TASK_FLAVOR_CONTROL, &taskList, &tcnt);
303 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "processor_set_tasks_with_flavor");
304 T_QUIET; T_ASSERT_GE(tcnt, 1, "should have at least 1 task");
305 mach_port_deallocate(mach_task_self(), pset_priv);
306
307 found_self = false;
308 for (size_t i = 0; i < tcnt; i++) {
309 if (taskList[i] == mach_task_self()) {
310 found_self = true;
311 break;
312 }
313 }
314
315 T_EXPECT_TRUE(found_self, " processor_set_tasks() should return immovable task self");
316
317 for (size_t i = 0; i < tcnt; i++) {
318 mach_port_deallocate(mach_task_self(), taskList[i]);
319 }
320
321 if (tcnt > 0) {
322 mach_vm_deallocate(mach_task_self(),
323 (mach_vm_address_t)taskList,
324 tcnt * sizeof(mach_port_t));
325 }
326 }
327
328 static void
test_imm_pinned_control_port(const char * test_prog_name)329 test_imm_pinned_control_port(const char *test_prog_name)
330 {
331 uint32_t task_exc_guard = 0;
332 size_t te_size = sizeof(&task_exc_guard);
333 posix_spawnattr_t attrs;
334 char *child_args[MAX_ARGV];
335 pid_t client_pid = 0;
336 uint32_t opts = 0;
337 uint64_t *test_exception_code;
338 size_t size = sizeof(&opts);
339 mach_port_t exc_port;
340 pthread_t s_exc_thread;
341 uint64_t exc_id;
342
343 T_LOG("Check if task_exc_guard exception has been enabled\n");
344 int ret = sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
345 T_ASSERT_EQ(ret, 0, "sysctlbyname");
346
347 if (!(task_exc_guard & TASK_EXC_GUARD_MP_DELIVER)) {
348 T_SKIP("task_exc_guard exception is not enabled");
349 }
350
351 T_LOG("Check if immovable control port has been enabled\n");
352 ret = sysctlbyname("kern.ipc_control_port_options", &opts, &size, NULL, 0);
353
354 if (!ret && (opts & 0x8) != 0x8) {
355 T_SKIP("hard immovable control port isn't enabled");
356 }
357
358 if (!ret && (opts & 0x2)) {
359 T_LOG("Hard pinning enforcement is on.");
360 test_exception_code = hard_exception_code;
361 } else {
362 T_LOG("Hard pinning enforcement is off.");
363 test_exception_code = soft_exception_code;
364 }
365
366
367 /* first, try out comparing various task/thread ports */
368 test_task_thread_port_values();
369
370 /* try stashing immovable ports: rdar://70585367 */
371 test_immovable_port_stashing();
372
373 /* spawn a child and see if EXC_GUARD are correctly generated */
374 for (int i = 0; i < MAX_TEST_NUM; i++) {
375 /* Create the exception port for the child */
376 exc_port = alloc_exception_port();
377 T_QUIET; T_ASSERT_NE(exc_port, MACH_PORT_NULL, "Create a new exception port");
378
379 /* Create exception serving thread */
380 ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
381 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
382
383 /* Initialize posix_spawn attributes */
384 posix_spawnattr_init(&attrs);
385
386 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD | EXC_MASK_CORPSE_NOTIFY, exc_port,
387 (exception_behavior_t) (EXCEPTION_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES), 0);
388 T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
389
390 child_args[0] = test_prog_name;
391 char test_num[10];
392 sprintf(test_num, "%d", i);
393 child_args[1] = test_num;
394 child_args[2] = NULL;
395
396 T_LOG("========== Spawning new child ==========");
397 err = posix_spawn(&client_pid, child_args[0], NULL, &attrs, &child_args[0], environ);
398 T_ASSERT_POSIX_SUCCESS(err, "posix_spawn control_port_options_client = %d test_num = %d", client_pid, i);
399
400 /* try extracting child task port: rdar://71744817
401 * Moved to tests/extract_right_soft_fail.c
402 */
403 // test_extract_immovable_task_port(client_pid);
404
405 int child_status;
406 /* Wait for child and check for exception */
407 if (-1 == waitpid(-1, &child_status, 0)) {
408 T_FAIL("waitpid: child mia");
409 }
410
411 if (WIFEXITED(child_status)) {
412 if (WEXITSTATUS(child_status)) {
413 T_FAIL("Child exited with status = %x", child_status); T_END;
414 } else {
415 /* Skipping test because CS_OPS_CLEARPLATFORM is not supported in the current BATS container */
416 T_SKIP("Failed to remove platform binary");
417 }
418 }
419
420 sleep(1);
421 kill(1, SIGKILL);
422
423 ret = pthread_join(s_exc_thread, NULL);
424 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_join");
425
426 if (exception_taken == EXC_GUARD) {
427 exc_id = exception_code >> EXC_CODE_SHIFT;
428 } else {
429 exc_id = exception_code;
430 }
431
432 T_LOG("Exception code: Received code = 0x%llx Expected code = 0x%llx", exc_id, test_exception_code[i]);
433 T_EXPECT_EQ(exc_id, test_exception_code[i], "Exception code: Received == Expected");
434 }
435 }
436
437 T_DECL(imm_pinned_control_port_hardened, "Test pinned & immovable task and thread control ports for platform restrictions binary",
438 T_META_IGNORECRASHES(".*pinned_rights_child.*"),
439 T_META_CHECK_LEAKS(false))
440 {
441 test_imm_pinned_control_port("imm_pinned_control_port_crasher_3P_hardened");
442 }
443
444 T_DECL(imm_pinned_control_port, "Test pinned & immovable task and thread control ports for first party binary",
445 T_META_IGNORECRASHES(".*pinned_rights_child.*"),
446 T_META_CHECK_LEAKS(false),
447 T_META_TAG_VM_PREFERRED)
448 {
449 test_imm_pinned_control_port("imm_pinned_control_port_crasher");
450 }
451