1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <unistd.h>
4 #include <darwintest.h>
5 #include <spawn.h>
6 #include <mach/mach.h>
7 #include <sys/sysctl.h>
8 #include <signal.h>
9 #include "excserver_protect.h"
10 #include "../osfmk/ipc/ipc_init.h"
11 #include "../osfmk/mach/port.h"
12 #include "../osfmk/kern/exc_guard.h"
13 #include "exc_helpers.h"
14
15 #define MAX_TEST_NUM 5
16 #define MAX_ARGV 3
17
18 extern char **environ;
19 static mach_exception_data_type_t received_exception_code = 0;
20 static mach_exception_data_type_t expected_exception_code = 0;
21 static exception_type_t exception_taken = 0;
22
23 /*
24 * This test infrastructure is inspired from imm_pinned_control_port.c.
25 * It verifies no reply port security semantics are violated.
26 *
27 * 1. The rcv right of the port would be marked immovable.
28 */
29 T_GLOBAL_META(
30 T_META_NAMESPACE("xnu.ipc"),
31 T_META_RADAR_COMPONENT_NAME("xnu"),
32 T_META_RADAR_COMPONENT_VERSION("IPC"),
33 T_META_RUN_CONCURRENTLY(TRUE));
34
35 static mach_port_t
alloc_exception_port(void)36 alloc_exception_port(void)
37 {
38 kern_return_t kret;
39 mach_port_t exc_port = MACH_PORT_NULL;
40 mach_port_t task = mach_task_self();
41
42 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
43 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
44
45 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
46 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
47
48 return exc_port;
49 }
50
51 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)52 catch_mach_exception_raise_state(mach_port_t exception_port,
53 exception_type_t exception,
54 const mach_exception_data_t code,
55 mach_msg_type_number_t code_count,
56 int * flavor,
57 const thread_state_t old_state,
58 mach_msg_type_number_t old_state_count,
59 thread_state_t new_state,
60 mach_msg_type_number_t * new_state_count)
61 {
62 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
63 T_FAIL("Unsupported catch_mach_exception_raise_state");
64 return KERN_NOT_SUPPORTED;
65 }
66
67 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)68 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
69 mach_port_t thread,
70 mach_port_t task,
71 exception_type_t exception,
72 mach_exception_data_t code,
73 mach_msg_type_number_t code_count,
74 int * flavor,
75 thread_state_t old_state,
76 mach_msg_type_number_t old_state_count,
77 thread_state_t new_state,
78 mach_msg_type_number_t * new_state_count)
79 {
80 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
81 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
82 return KERN_NOT_SUPPORTED;
83 }
84
85 kern_return_t
catch_mach_exception_raise_identity_protected(__unused mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt)86 catch_mach_exception_raise_identity_protected(
87 __unused mach_port_t exception_port,
88 uint64_t thread_id,
89 mach_port_t task_id_token,
90 exception_type_t exception,
91 mach_exception_data_t codes,
92 mach_msg_type_number_t codeCnt)
93 {
94 #pragma unused(exception_port, thread_id, task_id_token)
95
96 T_ASSERT_GT_UINT(codeCnt, 0, "CodeCnt");
97
98 T_LOG("Caught exception type: %d code: 0x%llx", exception, codes[0]);
99 exception_taken = exception;
100 if (exception == EXC_GUARD) {
101 received_exception_code = EXC_GUARD_DECODE_GUARD_FLAVOR((uint64_t)codes[0]);
102 } else if (exception == EXC_CORPSE_NOTIFY) {
103 received_exception_code = codes[0];
104 } else {
105 T_FAIL("Unexpected exception");
106 }
107 return KERN_SUCCESS;
108 }
109
110 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)111 catch_mach_exception_raise(mach_port_t exception_port,
112 mach_port_t thread,
113 mach_port_t task,
114 exception_type_t exception,
115 mach_exception_data_t code,
116 mach_msg_type_number_t code_count)
117 {
118 #pragma unused(exception_port, thread, task, exception, code, code_count)
119 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
120 return KERN_NOT_SUPPORTED;
121 }
122
123 static void *
exception_server_thread(void * arg)124 exception_server_thread(void *arg)
125 {
126 kern_return_t kr;
127 mach_port_t exc_port = *(mach_port_t *)arg;
128
129 /* Handle exceptions on exc_port */
130 kr = mach_msg_server_once(mach_exc_server, 4096, exc_port, 0);
131 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server_once");
132
133 return NULL;
134 }
135 #define kGUARD_EXC_EXCEPTION_BEHAVIOR_ENFORCE 6
136 T_DECL(reply_port_defense, "Test reply port semantics violations", T_META_IGNORECRASHES(".*reply_port_defense_client.*"), T_META_CHECK_LEAKS(false))
137 {
138 int ret = 0;
139
140 uint32_t task_exc_guard = 0;
141 size_t te_size = sizeof(&task_exc_guard);
142
143 char *test_prog_name = "./reply_port_defense_client";
144 char *child_args[MAX_ARGV];
145 pid_t client_pid = 0;
146 posix_spawnattr_t attrs;
147 bool triggers_exception;
148
149 pthread_t s_exc_thread;
150 mach_port_t exc_port;
151
152 T_LOG("Check if task_exc_guard exception has been enabled\n");
153 ret = sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
154 T_ASSERT_EQ(ret, 0, "sysctlbyname");
155
156 if (!(task_exc_guard & TASK_EXC_GUARD_MP_DELIVER)) {
157 T_SKIP("task_exc_guard exception is not enabled");
158 }
159
160 for (int i = 0; i < MAX_TEST_NUM; i++) {
161 received_exception_code = 0;
162 triggers_exception = true;
163 exc_port = alloc_exception_port();
164 T_QUIET; T_ASSERT_NE(exc_port, MACH_PORT_NULL, "Create a new exception port");
165
166 if (i == 4) {
167 triggers_exception = false;
168 }
169
170 #if defined(TARGET_OS_OSX)
171 /* thread_set_exception_ports is allowed on macos due to third party plugins & drivers */
172 if (i == 5) {
173 triggers_exception = false;
174 }
175 #endif
176
177 /* Create exception serving thread */
178 ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
179 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
180
181 /* Initialize posix_spawn attributes */
182 posix_spawnattr_init(&attrs);
183
184 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD | EXC_MASK_CORPSE_NOTIFY, exc_port,
185 (exception_behavior_t) (EXCEPTION_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES), 0);
186 T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
187
188 child_args[0] = test_prog_name;
189 char test_num[10];
190 sprintf(test_num, "%d", i);
191 child_args[1] = test_num;
192 child_args[2] = NULL;
193
194 T_LOG("========== Spawning new child ==========");
195 err = posix_spawn(&client_pid, child_args[0], NULL, &attrs, &child_args[0], environ);
196 T_ASSERT_POSIX_SUCCESS(err, "posix_spawn reply_port_defense_client = %d", client_pid);
197
198 int child_status;
199 /* Wait for child and check for exception */
200 if (-1 == waitpid(-1, &child_status, 0)) {
201 T_FAIL("%s waitpid: child", strerror(errno));
202 }
203 if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
204 T_FAIL("Child exited with status = 0x%x", child_status);
205 T_END;
206 }
207 sleep(1);
208 kill(1, SIGKILL);
209 if (triggers_exception) {
210 ret = pthread_join(s_exc_thread, NULL);
211 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_join");
212 }
213
214 mach_port_deallocate(mach_task_self(), exc_port);
215
216 if (i == 0) { /* The first test is setup as moving immovable receive right of a reply port. */
217 expected_exception_code = (mach_exception_data_type_t)kGUARD_EXC_IMMOVABLE;
218 } else if (!triggers_exception) {
219 expected_exception_code = 0;
220 } else if (i == 5) {
221 /* 5th test is for thread_set_exception_ports with no entitlement */
222 expected_exception_code = (mach_exception_data_type_t)kGUARD_EXC_EXCEPTION_BEHAVIOR_ENFORCE;
223 } else {
224 expected_exception_code = (mach_exception_data_type_t)kGUARD_EXC_INVALID_RIGHT;
225 }
226
227 T_LOG("Exception code: Received code = 0x%llx Expected code = 0x%llx", received_exception_code, expected_exception_code);
228 T_EXPECT_EQ(received_exception_code, expected_exception_code, "Exception code: Received == Expected");
229 }
230
231 T_END;
232 }
233