1 /*
2 * Copyright (c) 2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include <spawn_filtering_private.h>
25
26 #if POSIX_SPAWN_FILTERING_ENABLED
27
28 #include <spawn.h>
29 #include <spawn_private.h>
30 #include <sys/spawn_internal.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <strings.h>
34 #include <errno.h>
35 #include <fcntl.h>
36 #include <unistd.h>
37
38 extern void __posix_spawnattr_init(struct _posix_spawnattr *psattrp);
39
40 /*
41 * Actual syscall wrappers.
42 */
43 extern int __posix_spawn(pid_t * __restrict, const char * __restrict,
44 struct _posix_spawn_args_desc *, char *const argv[__restrict],
45 char *const envp[__restrict]);
46 extern int __execve(const char *fname, char * const *argp, char * const *envp);
47 extern int __open_nocancel(const char *path, int oflag, mode_t mode);
48 extern ssize_t __read_nocancel(int, void *, size_t);
49 extern int __close_nocancel(int fd);
50
51 static const char *
_simple_getenv(char * const * envp,const char * var)52 _simple_getenv(char * const *envp, const char *var)
53 {
54 size_t var_len = strlen(var);
55
56 for (char * const *p = envp; p && *p; p++) {
57 size_t p_len = strlen(*p);
58
59 if (p_len >= var_len && memcmp(*p, var, var_len) == 0 &&
60 (*p)[var_len] == '=') {
61 return &(*p)[var_len + 1];
62 }
63 }
64
65 return NULL;
66 }
67
68 /*
69 * Read filtering rules from /usr/local/share/posix_spawn_filtering_rules, and
70 * if the target being launched matches, apply changes to the posix_spawn
71 * request. Example contents of the file:
72 *
73 * binary_name:Calculator
74 * binary_name:ld
75 * path_start:/opt/bin/
76 * add_env:DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib
77 * binpref:x86_64
78 * alt_rosetta:1
79 *
80 * In this case, if we're launching either Calculator or ld, or anything in
81 * /opt/bin (arbitrarily deep), DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib
82 * will be added to the environment of the target, it will be launched with
83 * x86_64 binpref, and alternative rosetta runtime.
84 *
85 * Unrecognized lines are silently skipped. All lines must be 1023 characters
86 * or shorter.
87 *
88 * We need to be careful in this codepath (and in all called functions) because
89 * we can be called as part of execve() and that's required to be
90 * async-signal-safe by POSIX. We're also replacing one syscall with multiple,
91 * so we need to watch out to preserve cancellation/EINTR semantics, and avoid
92 * changing errno.
93 */
94 static bool
evaluate_rules(const char * rules_file_path,const char * fname,char ** envs,size_t envs_capacity,char * env_storage,size_t env_storage_capacity,cpu_type_t * type,cpu_subtype_t * subtype,uint32_t * psa_options)95 evaluate_rules(const char *rules_file_path, const char *fname, char **envs,
96 size_t envs_capacity, char *env_storage, size_t env_storage_capacity,
97 cpu_type_t *type, cpu_subtype_t *subtype, uint32_t *psa_options)
98 {
99 int saveerrno = errno;
100 int fd = -1;
101
102 /*
103 * Preflight check on rules_file_path to avoid triggering sandbox reports in
104 * case the process doesn't have access. We don't care about TOCTOU here.
105 *
106 * access() does not have a cancellation point, so it's already nocancel.
107 */
108 if (access(rules_file_path, R_OK) != 0) {
109 errno = saveerrno;
110 return false;
111 }
112
113 while (1) {
114 fd = __open_nocancel(rules_file_path, O_RDONLY | O_CLOEXEC, 0);
115 if (fd >= 0) {
116 break;
117 }
118 if (errno == EINTR) {
119 continue;
120 }
121 errno = saveerrno;
122 return false;
123 }
124
125 const char *fname_basename = fname;
126 const char *slash_pos;
127 while ((slash_pos = strchr(fname_basename, '/')) != NULL) {
128 fname_basename = slash_pos + 1;
129 }
130
131 bool fname_matches = false;
132
133 char read_buffer[1024];
134 size_t bytes = 0;
135 while (1) {
136 if (sizeof(read_buffer) - bytes <= 0) {
137 break;
138 }
139
140 bzero(read_buffer + bytes, sizeof(read_buffer) - bytes);
141 size_t read_result = __read_nocancel(fd,
142 read_buffer + bytes, sizeof(read_buffer) - bytes);
143
144 if (read_result == 0) {
145 break;
146 } else if (read_result < 0) {
147 if (errno == EINTR) {
148 continue;
149 } else {
150 break;
151 }
152 }
153 bytes += read_result;
154
155 while (bytes > 0) {
156 char *newline_pos = memchr(read_buffer, '\n', bytes);
157 if (newline_pos == NULL) {
158 break;
159 }
160
161 char *line = read_buffer;
162 size_t line_length = newline_pos - read_buffer;
163 *newline_pos = '\0';
164
165 /* 'line' now has a NUL-terminated string of 1023 chars max */
166 if (memcmp(line, "binary_name:", strlen("binary_name:")) == 0) {
167 char *binary_name = line + strlen("binary_name:");
168 if (strcmp(fname_basename, binary_name) == 0) {
169 fname_matches = true;
170 }
171 } else if (memcmp(line, "path_start:", strlen("path_start:")) == 0) {
172 char *path_start = line + strlen("path_start:");
173 if (strncmp(fname, path_start, strlen(path_start)) == 0) {
174 fname_matches = true;
175 }
176 } else if (memcmp(line, "add_env:", strlen("add_env:")) == 0) {
177 char *add_env = line + strlen("add_env:");
178 size_t env_size = strlen(add_env) + 1;
179 if (env_storage_capacity >= env_size && envs_capacity > 0) {
180 memcpy(env_storage, add_env, env_size);
181 envs[0] = env_storage;
182
183 envs += 1;
184 envs_capacity -= 1;
185 env_storage += env_size;
186 env_storage_capacity -= env_size;
187 }
188 } else if (memcmp(line, "binpref:", strlen("binpref:")) == 0) {
189 char *binpref = line + strlen("binpref:");
190 if (strcmp(binpref, "x86_64") == 0) {
191 *type = CPU_TYPE_X86_64;
192 *subtype = CPU_SUBTYPE_ANY;
193 }
194 } else if (memcmp(line, "alt_rosetta:", strlen("alt_rosetta:")) == 0) {
195 char *alt_rosetta = line + strlen("alt_rosetta:");
196 if (strcmp(alt_rosetta, "1") == 0) {
197 *psa_options |= PSA_OPTION_ALT_ROSETTA;
198 }
199 }
200
201 memmove(read_buffer, newline_pos + 1, sizeof(read_buffer) - line_length);
202 bytes -= line_length + 1;
203 }
204 }
205
206 __close_nocancel(fd);
207 errno = saveerrno;
208 return fname_matches;
209 }
210
211 /*
212 * Apply posix_spawn filtering rules, and invoke a possibly modified posix_spawn
213 * call. Returns true if the posix_spawn was handled/invoked (and populates the
214 * 'ret' outparam in that case), false if the filter does not apply and the
215 * caller should proceed to call posix_spawn/exec normally.
216 *
217 * We need to be careful in this codepath (and in all called functions) because
218 * we can be called as part of execve() and that's required to be
219 * async-signal-safe by POSIX. We're also replacing one syscall with multiple,
220 * so we need to watch out to preserve cancellation/EINTR semantics, and avoid
221 * changing errno.
222 */
223 __attribute__((visibility("hidden")))
224 bool
_posix_spawn_with_filter(pid_t * pid,const char * fname,char * const * argp,char * const * envp,struct _posix_spawn_args_desc * adp,int * ret)225 _posix_spawn_with_filter(pid_t *pid, const char *fname, char * const *argp,
226 char * const *envp, struct _posix_spawn_args_desc *adp, int *ret)
227 {
228 /*
229 * For testing, the path to the rules file can be overridden with an env var.
230 * It's hard to get access to 'environ' or '_NSGetEnviron' here so instead
231 * peek into the envp arg of posix_spawn/exec, even though we should really
232 * inspect the parent's env instead. For testing only purposes, it's fine.
233 */
234 const char *rules_file_path =
235 _simple_getenv(envp, "POSIX_SPAWN_FILTERING_RULES_PATH")
236 ?: "/usr/local/share/posix_spawn_filtering_rules";
237
238 /*
239 * Stack-allocated storage for extra env vars to add to the posix_spawn call.
240 * 16 env vars, and 1024 bytes total should be enough for everyone.
241 */
242 #define MAX_EXTRA_ENVS 16
243 #define MAX_ENV_STORAGE_SIZE 1024
244 char env_storage[MAX_ENV_STORAGE_SIZE];
245 bzero(env_storage, sizeof(env_storage));
246 char *envs_to_add[MAX_EXTRA_ENVS];
247 bzero(envs_to_add, sizeof(envs_to_add));
248 cpu_type_t cputype_binpref = 0;
249 cpu_subtype_t cpusubtype_binpref = 0;
250 uint32_t psa_options = 0;
251 bool should_apply_rules = evaluate_rules(rules_file_path, fname,
252 envs_to_add, sizeof(envs_to_add) / sizeof(envs_to_add[0]),
253 env_storage, sizeof(env_storage),
254 &cputype_binpref, &cpusubtype_binpref,
255 &psa_options);
256
257 if (!should_apply_rules) {
258 return false;
259 }
260
261 /*
262 * Create stack-allocated private copies of args_desc and spawnattr_t structs
263 * that we can modify.
264 */
265 struct _posix_spawn_args_desc new_ad;
266 bzero(&new_ad, sizeof(new_ad));
267 struct _posix_spawnattr new_attr;
268 __posix_spawnattr_init(&new_attr);
269 if (adp != NULL) {
270 memcpy(&new_ad, adp, sizeof(new_ad));
271 }
272 if (new_ad.attrp != NULL) {
273 memcpy(&new_attr, new_ad.attrp, sizeof(new_attr));
274 }
275 new_ad.attrp = &new_attr;
276
277 /*
278 * Now 'new_ad' and 'new_attr' are always non-NULL and okay to be modified.
279 */
280 if (cputype_binpref != 0) {
281 for (int i = 0; i < NBINPREFS; i++) {
282 new_attr.psa_binprefs[i] = 0;
283 new_attr.psa_subcpuprefs[i] = CPU_SUBTYPE_ANY;
284 }
285 new_attr.psa_binprefs[0] = cputype_binpref;
286 new_attr.psa_subcpuprefs[0] = cpusubtype_binpref;
287 }
288
289 if (psa_options != 0) {
290 new_attr.psa_options |= psa_options;
291 }
292
293 /*
294 * Count old envs.
295 */
296 size_t envp_count = 0;
297 char *const *ep = envp;
298 while (*ep++) {
299 envp_count += 1;
300 }
301
302 /*
303 * Count envs to add.
304 */
305 size_t envs_to_add_count = 0;
306 ep = envs_to_add;
307 while (envs_to_add_count < MAX_EXTRA_ENVS && *ep++) {
308 envs_to_add_count += 1;
309 }
310
311 /*
312 * Make enough room for old and new envs plus NULL at the end.
313 */
314 char *new_envp[envs_to_add_count + envp_count + 1];
315
316 /*
317 * Prepend the new envs so that they get picked up by Libc's getenv and common
318 * simple_getenv implementations. It's technically undefined what happens if
319 * a name occurs multiple times, but the common implementations pick the first
320 * entry.
321 */
322 bzero(&new_envp[0], sizeof(new_envp));
323 memcpy(&new_envp[0], &envs_to_add[0], envs_to_add_count * sizeof(void *));
324 memcpy(&new_envp[envs_to_add_count], envp, envp_count * sizeof(void *));
325
326 *ret = __posix_spawn(pid, fname, &new_ad, argp, new_envp);
327 return true;
328 }
329
330 __attribute__((visibility("hidden")))
331 int
_execve_with_filter(const char * fname,char * const * argp,char * const * envp)332 _execve_with_filter(const char *fname, char * const *argp, char * const *envp)
333 {
334 int ret = 0;
335
336 /*
337 * Rewrite the execve() call into a posix_spawn(SETEXEC) call. We need to be
338 * careful in this codepath (and in all called functions) because execve is
339 * required to be async-signal-safe by POSIX.
340 */
341 struct _posix_spawn_args_desc ad;
342 bzero(&ad, sizeof(ad));
343
344 struct _posix_spawnattr attr;
345 __posix_spawnattr_init(&attr);
346 attr.psa_flags |= POSIX_SPAWN_SETEXEC;
347
348 ad.attrp = &attr;
349 ad.attr_size = sizeof(struct _posix_spawnattr);
350
351 if (_posix_spawn_with_filter(NULL, fname, argp, envp, &ad, &ret)) {
352 if (ret == 0) {
353 return 0;
354 } else {
355 errno = ret;
356 return -1;
357 }
358 }
359
360 ret = __execve(fname, argp, envp);
361 return ret;
362 }
363
364 #endif /* POSIX_SPAWN_FILTERING_ENABLED */
365