1 /*
2 * Copyright (c) 2000-2006 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*-
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93
67 */
68
69 #include <machine/reg.h>
70 #include <machine/psl.h>
71
72 #include <sys/param.h>
73 #include <sys/systm.h>
74 #include <sys/proc_internal.h>
75 #include <sys/kauth.h>
76 #include <sys/errno.h>
77 #include <sys/ptrace.h>
78 #include <sys/uio.h>
79 #include <sys/user.h>
80 #include <sys/sysctl.h>
81 #include <sys/wait.h>
82
83 #include <sys/mount_internal.h>
84 #include <sys/sysproto.h>
85 #include <sys/kdebug.h>
86 #include <sys/codesign.h> /* cs_allow_invalid() */
87
88 #include <security/audit/audit.h>
89
90 #include <kern/task.h>
91 #include <kern/thread.h>
92
93 #include <mach/task.h> /* for task_resume() */
94 #include <kern/sched_prim.h> /* for thread_exception_return() */
95
96 #include <pexpert/pexpert.h>
97
98 #if CONFIG_MACF
99 #include <security/mac_framework.h>
100 #endif
101
102 /* XXX ken/bsd_kern.c - prototype should be in common header */
103 int get_task_userstop(task_t);
104
105 /* Macros to clear/set/test flags. */
106 #define SET(t, f) (t) |= (f)
107 #define CLR(t, f) (t) &= ~(f)
108 #define ISSET(t, f) ((t) & (f))
109
110 extern thread_t get_firstthread(task_t);
111
112
113 /*
114 * sys-trace system call.
115 */
116
117 int
ptrace(struct proc * p,struct ptrace_args * uap,int32_t * retval)118 ptrace(struct proc *p, struct ptrace_args *uap, int32_t *retval)
119 {
120 struct proc *t; /* target process */
121 struct proc_ident tident; /* target ident */
122 task_t task;
123 thread_t th_act = THREAD_NULL;
124 struct uthread *ut;
125 int tr_sigexc = 0;
126 int error = 0;
127 int stopped = 0;
128
129 AUDIT_ARG(cmd, uap->req);
130 AUDIT_ARG(pid, uap->pid);
131 AUDIT_ARG(addr, uap->addr);
132 AUDIT_ARG(value32, uap->data);
133
134 if (uap->req == PT_DENY_ATTACH) {
135 #if (DEVELOPMENT || DEBUG) && !defined(XNU_TARGET_OS_OSX)
136 if (PE_i_can_has_debugger(NULL)) {
137 return 0;
138 }
139 #endif
140 proc_lock(p);
141 if (ISSET(p->p_lflag, P_LTRACED)) {
142 proc_unlock(p);
143 KERNEL_DEBUG_CONSTANT(BSDDBG_CODE(DBG_BSD_PROC, BSD_PROC_FRCEXIT) | DBG_FUNC_NONE,
144 proc_getpid(p), W_EXITCODE(ENOTSUP, 0), 4, 0, 0);
145 exit1(p, W_EXITCODE(ENOTSUP, 0), retval);
146
147 thread_exception_return();
148 /* NOTREACHED */
149 }
150 SET(p->p_lflag, P_LNOATTACH);
151 proc_unlock(p);
152
153 return 0;
154 }
155
156 if (uap->req == PT_FORCEQUOTA) {
157 if (kauth_cred_issuser(kauth_cred_get())) {
158 t = current_proc();
159 OSBitOrAtomic(P_FORCEQUOTA, &t->p_flag);
160 return 0;
161 } else {
162 return EPERM;
163 }
164 }
165
166 /*
167 * Intercept and deal with "please trace me" request.
168 */
169 if (uap->req == PT_TRACE_ME) {
170 retry_trace_me: ;
171 proc_t pproc = proc_parent(p);
172 if (pproc == NULL) {
173 return EINVAL;
174 }
175 /* holding ref on pproc */
176
177 #if CONFIG_MACF
178 /*
179 * NB: Cannot call kauth_authorize_process(..., KAUTH_PROCESS_CANTRACE, ...)
180 * since that assumes the process being checked is the current process
181 * when, in this case, it is the current process's parent.
182 * Most of the other checks in cantrace() don't apply either.
183 */
184 struct proc_ident p_ident = proc_ident_with_policy(p, IDENT_VALIDATION_PROC_EXACT);
185 struct proc_ident pproc_ident = proc_ident_with_policy(pproc, IDENT_VALIDATION_PROC_EXACT);
186 kauth_cred_t pproc_cred = kauth_cred_proc_ref(pproc);
187
188 /* Release pproc and find it again after MAC call to avoid deadlock */
189 proc_rele(pproc);
190 error = mac_proc_check_debug(&pproc_ident, pproc_cred, &p_ident);
191 kauth_cred_unref(&pproc_cred);
192
193 if (error != 0) {
194 return error;
195 }
196 if (proc_find_ident(&pproc_ident) == PROC_NULL) {
197 return ESRCH;
198 }
199 /* re-holding ref on pproc */
200 #endif
201 proc_lock(p);
202 /* Make sure the process wasn't re-parented. */
203 if (p->p_ppid != proc_getpid(pproc)) {
204 proc_unlock(p);
205 proc_rele(pproc); /* pproc ref released */
206 goto retry_trace_me;
207 }
208 SET(p->p_lflag, P_LTRACED);
209 proc_disable_sec_soft_mode_locked(p);
210 /* Non-attached case, our tracer is our parent. */
211 p->p_oppid = p->p_ppid;
212 proc_unlock(p);
213 /* Child and parent will have to be able to run modified code. */
214 cs_allow_invalid(p);
215 cs_allow_invalid(pproc);
216 proc_rele(pproc); /* pproc ref released */
217
218 return error;
219 }
220 if (uap->req == PT_SIGEXC) {
221 proc_lock(p);
222 if (ISSET(p->p_lflag, P_LTRACED)) {
223 SET(p->p_lflag, P_LSIGEXC);
224 proc_unlock(p);
225 return 0;
226 } else {
227 proc_unlock(p);
228 return EINVAL;
229 }
230 }
231
232 /*
233 * We do not want ptrace to do anything with kernel or launchd
234 */
235 if (uap->pid < 2) {
236 return EPERM;
237 }
238
239 retry_proc_find:
240 /*
241 * Locate victim, and make sure it is traceable.
242 */
243 if ((t = proc_find(uap->pid)) == NULL) {
244 return ESRCH;
245 }
246
247 /* Check if the proc has trace wait flag set */
248 if (t->p_lflag & P_LTRACE_WAIT) {
249 proc_rele(t);
250 delay(1);
251 goto retry_proc_find;
252 }
253
254 AUDIT_ARG(process, t);
255
256 task = proc_task(t);
257 tident = proc_ident_with_policy(t, IDENT_VALIDATION_PROC_EXACT);
258 if (uap->req == PT_ATTACHEXC) {
259 #pragma clang diagnostic push
260 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
261 uap->req = PT_ATTACH;
262 tr_sigexc = 1;
263 }
264 if (uap->req == PT_ATTACH) {
265 #pragma clang diagnostic pop
266 int err, cb_err;
267
268 #if !defined(XNU_TARGET_OS_OSX)
269 if (tr_sigexc == 0) {
270 error = ENOTSUP;
271 goto out;
272 }
273 #endif
274
275 err = kauth_authorize_process(kauth_cred_get(), KAUTH_PROCESS_CANTRACE,
276 t, (uintptr_t)&cb_err, 0, 0);
277
278 if (err == 0) {
279 /* it's OK to attach */
280 proc_lock(t);
281 SET(t->p_lflag, P_LTRACED);
282 if (tr_sigexc) {
283 SET(t->p_lflag, P_LSIGEXC);
284 }
285
286 proc_disable_sec_soft_mode_locked(t);
287
288 t->p_oppid = t->p_ppid;
289 /* Check whether child and parent are allowed to run modified
290 * code (they'll have to) */
291 proc_unlock(t);
292 cs_allow_invalid(t);
293 cs_allow_invalid(p);
294 if (t->p_pptr != p) {
295 proc_reparentlocked(t, p, 1, 0);
296 }
297
298 proc_lock(t);
299 if (get_task_userstop(task) > 0) {
300 stopped = 1;
301 }
302 t->p_xstat = 0;
303 proc_unlock(t);
304 psignal(t, SIGSTOP);
305 /*
306 * If the process was stopped, wake up and run through
307 * issignal() again to properly connect to the tracing
308 * process.
309 */
310 if (stopped) {
311 task_resume(task);
312 }
313 error = 0;
314 goto out;
315 } else {
316 error = cb_err;
317 if (error == ESRCH) {
318 /*
319 * The target 't' is not valid anymore as it
320 * could not be found after the MAC check.
321 */
322 return error;
323 }
324 /* not allowed to attach, proper error code returned by kauth_authorize_process */
325 if (ISSET(t->p_lflag, P_LNOATTACH)) {
326 psignal(p, SIGSEGV);
327 }
328 goto out;
329 }
330 }
331
332 /*
333 * You can't do what you want to the process if:
334 * (1) It's not being traced at all,
335 */
336 proc_lock(t);
337 if (!ISSET(t->p_lflag, P_LTRACED)) {
338 proc_unlock(t);
339 error = EPERM;
340 goto out;
341 }
342
343 /*
344 * (2) it's not being traced by _you_, or
345 */
346 if (t->p_pptr != p) {
347 proc_unlock(t);
348 error = EBUSY;
349 goto out;
350 }
351
352 /*
353 * (3) it's not currently stopped.
354 */
355 if (t->p_stat != SSTOP) {
356 proc_unlock(t);
357 error = EBUSY;
358 goto out;
359 }
360
361 /*
362 * Mach version of ptrace executes request directly here,
363 * thus simplifying the interaction of ptrace and signals.
364 */
365 /* proc lock is held here */
366 switch (uap->req) {
367 case PT_DETACH:
368 if (t->p_oppid != t->p_ppid) {
369 struct proc *pp;
370
371 proc_unlock(t);
372 pp = proc_find(t->p_oppid);
373 if (pp != PROC_NULL) {
374 proc_reparentlocked(t, pp, 1, 0);
375 proc_rele(pp);
376 } else {
377 /* original parent exited while traced */
378 proc_list_lock();
379 t->p_listflag |= P_LIST_DEADPARENT;
380 proc_list_unlock();
381 proc_reparentlocked(t, initproc, 1, 0);
382 }
383 proc_lock(t);
384 }
385
386 t->p_oppid = 0;
387 CLR(t->p_lflag, P_LTRACED);
388 CLR(t->p_lflag, P_LSIGEXC);
389 proc_unlock(t);
390 goto resume;
391
392 case PT_KILL:
393 /*
394 * Tell child process to kill itself after it
395 * is resumed by adding NSIG to p_cursig. [see issig]
396 */
397 proc_unlock(t);
398 #if CONFIG_MACF
399 error = mac_proc_check_signal(p, NULL, &tident, SIGKILL);
400 if (0 != error) {
401 goto resume;
402 }
403 #endif
404 psignal(t, SIGKILL);
405 goto resume;
406
407 case PT_STEP: /* single step the child */
408 case PT_CONTINUE: /* continue the child */
409 proc_unlock(t);
410 th_act = (thread_t)get_firstthread(task);
411 if (th_act == THREAD_NULL) {
412 error = EINVAL;
413 goto out;
414 }
415
416 /* force use of Mach SPIs (and task_for_pid security checks) to adjust PC */
417 if (uap->addr != (user_addr_t)1) {
418 error = ENOTSUP;
419 goto out;
420 }
421
422 if ((unsigned)uap->data >= NSIG) {
423 error = EINVAL;
424 goto out;
425 }
426
427 if (uap->data != 0) {
428 #if CONFIG_MACF
429 error = mac_proc_check_signal(p, NULL, &tident, uap->data);
430 if (0 != error) {
431 goto out;
432 }
433 #endif
434 psignal(t, uap->data);
435 }
436
437 if (uap->req == PT_STEP) {
438 /*
439 * set trace bit
440 * we use sending SIGSTOP as a comparable security check.
441 */
442 #if CONFIG_MACF
443 error = mac_proc_check_signal(p, NULL, &tident, SIGSTOP);
444 if (0 != error) {
445 goto out;
446 }
447 #endif
448 if (thread_setsinglestep(th_act, 1) != KERN_SUCCESS) {
449 error = ENOTSUP;
450 goto out;
451 }
452 } else {
453 /*
454 * clear trace bit if on
455 * we use sending SIGCONT as a comparable security check.
456 */
457 #if CONFIG_MACF
458 error = mac_proc_check_signal(p, NULL, &tident, SIGCONT);
459 if (0 != error) {
460 goto out;
461 }
462 #endif
463 if (thread_setsinglestep(th_act, 0) != KERN_SUCCESS) {
464 error = ENOTSUP;
465 goto out;
466 }
467 }
468 resume:
469 proc_lock(t);
470 t->p_xstat = uap->data;
471 t->p_stat = SRUN;
472 if (t->sigwait) {
473 wakeup((caddr_t)&(t->sigwait));
474 proc_unlock(t);
475 if ((t->p_lflag & P_LSIGEXC) == 0) {
476 task_resume(task);
477 }
478 } else {
479 proc_unlock(t);
480 }
481
482 break;
483
484 case PT_THUPDATE: {
485 proc_unlock(t);
486 if ((unsigned)uap->data >= NSIG) {
487 error = EINVAL;
488 goto out;
489 }
490 th_act = port_name_to_thread(CAST_MACH_PORT_TO_NAME(uap->addr),
491 PORT_INTRANS_OPTIONS_NONE);
492 if (th_act == THREAD_NULL) {
493 error = ESRCH;
494 goto out;
495 }
496 ut = (uthread_t)get_bsdthread_info(th_act);
497 if (uap->data) {
498 ut->uu_siglist |= sigmask(uap->data);
499 }
500 proc_lock(t);
501 t->p_xstat = uap->data;
502 t->p_stat = SRUN;
503 proc_unlock(t);
504 error = 0;
505 }
506 break;
507 default:
508 proc_unlock(t);
509 error = EINVAL;
510 goto out;
511 }
512
513 error = 0;
514 out:
515 proc_rele(t);
516 if (th_act) {
517 thread_deallocate(th_act);
518 }
519 return error;
520 }
521
522
523 /*
524 * determine if one process (cur_procp) can trace another process (traced_procp).
525 */
526
527 int
cantrace(proc_t cur_procp,kauth_cred_t creds,proc_t traced_procp,int * errp)528 cantrace(proc_t cur_procp, kauth_cred_t creds, proc_t traced_procp, int *errp)
529 {
530 int my_err;
531 /*
532 * You can't trace a process if:
533 * (1) it's the process that's doing the tracing,
534 */
535 if (proc_getpid(traced_procp) == proc_getpid(cur_procp)) {
536 *errp = EINVAL;
537 return 0;
538 }
539
540 /*
541 * (2) it's already being traced, or
542 */
543 if (ISSET(traced_procp->p_lflag, P_LTRACED)) {
544 *errp = EBUSY;
545 return 0;
546 }
547
548 if (!proc_is_third_party_debuggable_driver(traced_procp)) {
549 kauth_cred_t traced_cred;
550
551 /*
552 * (3) it's not owned by you, or is set-id on exec
553 * (unless you're root).
554 */
555 traced_cred = kauth_cred_proc_ref(traced_procp);
556 if ((kauth_cred_getruid(creds) != kauth_cred_getruid(traced_cred) ||
557 ISSET(traced_procp->p_flag, P_SUGID)) &&
558 (my_err = suser(creds, &cur_procp->p_acflag)) != 0) {
559 kauth_cred_unref(&traced_cred);
560 *errp = my_err;
561 return 0;
562 }
563 kauth_cred_unref(&traced_cred);
564 }
565
566 if ((cur_procp->p_lflag & P_LTRACED) && isinferior(cur_procp, traced_procp)) {
567 *errp = EPERM;
568 return 0;
569 }
570
571 if (ISSET(traced_procp->p_lflag, P_LNOATTACH)) {
572 *errp = EBUSY;
573 return 0;
574 }
575
576 #if CONFIG_MACF
577 struct proc_ident cur_ident = proc_ident_with_policy(cur_procp, IDENT_VALIDATION_PROC_EXACT);
578 struct proc_ident traced_ident = proc_ident_with_policy(traced_procp, IDENT_VALIDATION_PROC_EXACT);
579 kauth_cred_t cur_cred = kauth_cred_proc_ref(cur_procp);
580
581 /*
582 * Drop the proc reference to avoid a deadlock during an upcall and find
583 * (reference) the proc again so our caller can keep using it.
584 */
585 proc_rele(traced_procp);
586 my_err = mac_proc_check_debug(&cur_ident, cur_cred, &traced_ident);
587 kauth_cred_unref(&cur_cred);
588
589 if (proc_find_ident(&traced_ident) == PROC_NULL) {
590 *errp = ESRCH;
591 return 0;
592 }
593 /* restored ref on traced_procp */
594 if (my_err != 0) {
595 *errp = my_err;
596 return 0;
597 }
598 #endif
599 return 1;
600 }
601