xref: /xnu-11417.140.69/bsd/kern/kern_resource.c (revision 43a90889846e00bfb5cf1d255cdc0a701a1e05a4)
1 /*
2  * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /* Copyright (c) 1995, 1997 Apple Computer, Inc. All Rights Reserved */
29 /*-
30  * Copyright (c) 1982, 1986, 1991, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  * (c) UNIX System Laboratories, Inc.
33  * All or some portions of this file are derived from material licensed
34  * to the University of California by American Telephone and Telegraph
35  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36  * the permission of UNIX System Laboratories, Inc.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. All advertising materials mentioning features or use of this software
47  *    must display the following acknowledgement:
48  *	This product includes software developed by the University of
49  *	California, Berkeley and its contributors.
50  * 4. Neither the name of the University nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64  * SUCH DAMAGE.
65  *
66  *	@(#)kern_resource.c	8.5 (Berkeley) 1/21/94
67  */
68 /*
69  * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
70  * support for mandatory and extensible security protections.  This notice
71  * is included in support of clause 2.2 (b) of the Apple Public License,
72  * Version 2.0.
73  */
74 
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/sysctl.h>
78 #include <sys/kernel.h>
79 #include <sys/file_internal.h>
80 #include <sys/resourcevar.h>
81 #include <sys/malloc.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/sysproto.h>
86 
87 #include <security/audit/audit.h>
88 
89 #include <machine/vmparam.h>
90 
91 #include <mach/mach_types.h>
92 #include <mach/time_value.h>
93 #include <mach/task.h>
94 #include <mach/task_info.h>
95 #include <mach/vm_map.h>
96 #include <mach/mach_vm.h>
97 #include <mach/thread_act.h>  /* for thread_policy_set( ) */
98 #include <kern/thread.h>
99 #include <kern/policy_internal.h>
100 
101 #include <kern/task.h>
102 #include <kern/clock.h>         /* for absolutetime_to_microtime() */
103 #include <netinet/in.h>         /* for TRAFFIC_MGT_SO_* */
104 #if CONFIG_FREEZE
105 #include <sys/kern_memorystatus_freeze.h> /* for memorystatus_freeze_mark_ui_transition */
106 #endif /* CONFIG_FREEZE */
107 #include <sys/socketvar.h>      /* for struct socket */
108 #if NECP
109 #include <net/necp.h>
110 #endif /* NECP */
111 
112 #include <vm/vm_map_xnu.h>
113 
114 #include <kern/assert.h>
115 #include <sys/resource.h>
116 #include <sys/resource_private.h>
117 #include <sys/priv.h>
118 #include <IOKit/IOBSD.h>
119 
120 #if CONFIG_MACF
121 #include <security/mac_framework.h>
122 #endif
123 
124 static void proc_limitblock(proc_t p);
125 static void proc_limitunblock(proc_t p);
126 static void proc_limitupdate(proc_t p, bool unblock,
127     void (^update)(struct plimit *plim));
128 
129 static int donice(struct proc *curp, struct proc *chgp, int n);
130 static int dosetrlimit(struct proc *p, u_int which, struct rlimit *limp);
131 static void do_background_socket(struct proc *p, thread_t thread);
132 static int do_background_thread(thread_t thread, int priority);
133 static int do_background_proc(struct proc *curp, struct proc *targetp, int priority);
134 static int set_gpudeny_proc(struct proc *curp, struct proc *targetp, int priority);
135 static int proc_set_darwin_role(proc_t curp, proc_t targetp, int priority);
136 static int proc_get_darwin_role(proc_t curp, proc_t targetp, int *priority);
137 static int proc_set_game_mode(proc_t targetp, int priority);
138 static int proc_get_game_mode(proc_t targetp, int *priority);
139 static int proc_set_carplay_mode(proc_t targetp, int priority);
140 static int proc_get_carplay_mode(proc_t targetp, int *priority);
141 static int get_background_proc(struct proc *curp, struct proc *targetp, int *priority);
142 
143 int fill_task_rusage(task_t task, rusage_info_current *ri);
144 void fill_task_billed_usage(task_t task, rusage_info_current *ri);
145 int fill_task_io_rusage(task_t task, rusage_info_current *ri);
146 int fill_task_qos_rusage(task_t task, rusage_info_current *ri);
147 uint64_t get_task_logical_writes(task_t task, bool external);
148 
149 rlim_t maxdmap = MAXDSIZ;       /* XXX */
150 rlim_t maxsmap = MAXSSIZ - PAGE_MAX_SIZE;       /* XXX */
151 
152 /* For plimit reference count */
153 os_refgrp_decl(, rlimit_refgrp, "plimit_refcnt", NULL);
154 
155 static KALLOC_TYPE_DEFINE(plimit_zone, struct plimit, KT_DEFAULT);
156 
157 /*
158  * Limits on the number of open files per process, and the number
159  * of child processes per process.
160  *
161  * Note: would be in kern/subr_param.c in FreeBSD.
162  */
163 __private_extern__ int maxfilesperproc = OPEN_MAX;              /* per-proc open files limit */
164 
165 SYSCTL_INT(_kern, KERN_MAXPROCPERUID, maxprocperuid, CTLFLAG_RW | CTLFLAG_LOCKED,
166     &maxprocperuid, 0, "Maximum processes allowed per userid" );
167 
168 SYSCTL_INT(_kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW | CTLFLAG_LOCKED,
169     &maxfilesperproc, 0, "Maximum files allowed open per process" );
170 
171 /* Args and fn for proc_iteration callback used in setpriority */
172 struct puser_nice_args {
173 	proc_t curp;
174 	int     prio;
175 	id_t    who;
176 	int *   foundp;
177 	int *   errorp;
178 };
179 static int puser_donice_callback(proc_t p, void * arg);
180 
181 
182 /* Args and fn for proc_iteration callback used in setpriority */
183 struct ppgrp_nice_args {
184 	proc_t curp;
185 	int     prio;
186 	int *   foundp;
187 	int *   errorp;
188 };
189 static int ppgrp_donice_callback(proc_t p, void * arg);
190 
191 /*
192  * Resource controls and accounting.
193  */
194 int
getpriority(struct proc * curp,struct getpriority_args * uap,int32_t * retval)195 getpriority(struct proc *curp, struct getpriority_args *uap, int32_t *retval)
196 {
197 	struct proc *p;
198 	int low = PRIO_MAX + 1;
199 	kauth_cred_t my_cred;
200 	int refheld = 0;
201 	int error = 0;
202 
203 	/* would also test (uap->who < 0), but id_t is unsigned */
204 	if (uap->who > 0x7fffffff) {
205 		return EINVAL;
206 	}
207 
208 	switch (uap->which) {
209 	case PRIO_PROCESS:
210 		if (uap->who == 0) {
211 			p = curp;
212 			low = p->p_nice;
213 		} else {
214 			p = proc_find(uap->who);
215 			if (p == 0) {
216 				break;
217 			}
218 			low = p->p_nice;
219 			proc_rele(p);
220 		}
221 		break;
222 
223 	case PRIO_PGRP: {
224 		struct pgrp *pg = PGRP_NULL;
225 
226 		if (uap->who == 0) {
227 			/* returns the pgrp to ref */
228 			pg = proc_pgrp(curp, NULL);
229 		} else if ((pg = pgrp_find(uap->who)) == PGRP_NULL) {
230 			break;
231 		}
232 		/* No need for iteration as it is a simple scan */
233 		pgrp_lock(pg);
234 		PGMEMBERS_FOREACH(pg, p) {
235 			if (p->p_nice < low) {
236 				low = p->p_nice;
237 			}
238 		}
239 		pgrp_unlock(pg);
240 		pgrp_rele(pg);
241 		break;
242 	}
243 
244 	case PRIO_USER:
245 		if (uap->who == 0) {
246 			uap->who = kauth_cred_getuid(kauth_cred_get());
247 		}
248 
249 		proc_list_lock();
250 
251 		for (p = allproc.lh_first; p != 0; p = p->p_list.le_next) {
252 			my_cred = kauth_cred_proc_ref(p);
253 			if (kauth_cred_getuid(my_cred) == uap->who &&
254 			    p->p_nice < low) {
255 				low = p->p_nice;
256 			}
257 			kauth_cred_unref(&my_cred);
258 		}
259 
260 		proc_list_unlock();
261 
262 		break;
263 
264 	case PRIO_DARWIN_THREAD:
265 		/* we currently only support the current thread */
266 		if (uap->who != 0) {
267 			return EINVAL;
268 		}
269 
270 		low = proc_get_thread_policy(current_thread(), TASK_POLICY_INTERNAL, TASK_POLICY_DARWIN_BG);
271 
272 		break;
273 
274 	case PRIO_DARWIN_PROCESS:
275 		if (uap->who == 0) {
276 			p = curp;
277 		} else {
278 			p = proc_find(uap->who);
279 			if (p == PROC_NULL) {
280 				break;
281 			}
282 			refheld = 1;
283 		}
284 
285 		error = get_background_proc(curp, p, &low);
286 
287 		if (refheld) {
288 			proc_rele(p);
289 		}
290 		if (error) {
291 			return error;
292 		}
293 		break;
294 
295 	case PRIO_DARWIN_ROLE:
296 		if (uap->who == 0) {
297 			p = curp;
298 		} else {
299 			p = proc_find(uap->who);
300 			if (p == PROC_NULL) {
301 				break;
302 			}
303 			refheld = 1;
304 		}
305 
306 		error = proc_get_darwin_role(curp, p, &low);
307 
308 		if (refheld) {
309 			proc_rele(p);
310 		}
311 		if (error) {
312 			return error;
313 		}
314 		break;
315 
316 	case PRIO_DARWIN_GAME_MODE:
317 		if (uap->who == 0) {
318 			p = curp;
319 		} else {
320 			p = proc_find(uap->who);
321 			if (p == PROC_NULL) {
322 				break;
323 			}
324 			refheld = 1;
325 		}
326 
327 
328 		error = proc_get_game_mode(p, &low);
329 
330 		if (refheld) {
331 			proc_rele(p);
332 		}
333 		if (error) {
334 			return error;
335 		}
336 		break;
337 
338 	case PRIO_DARWIN_CARPLAY_MODE:
339 		if (uap->who == 0) {
340 			p = curp;
341 		} else {
342 			p = proc_find(uap->who);
343 			if (p == PROC_NULL) {
344 				break;
345 			}
346 			refheld = 1;
347 		}
348 
349 
350 		error = proc_get_carplay_mode(p, &low);
351 
352 		if (refheld) {
353 			proc_rele(p);
354 		}
355 		if (error) {
356 			return error;
357 		}
358 		break;
359 
360 	default:
361 		return EINVAL;
362 	}
363 	if (low == PRIO_MAX + 1) {
364 		return ESRCH;
365 	}
366 	*retval = low;
367 	return 0;
368 }
369 
370 /* call back function used for proc iteration in PRIO_USER */
371 static int
puser_donice_callback(proc_t p,void * arg)372 puser_donice_callback(proc_t p, void * arg)
373 {
374 	int error, n;
375 	struct puser_nice_args * pun = (struct puser_nice_args *)arg;
376 	kauth_cred_t my_cred;
377 
378 	my_cred = kauth_cred_proc_ref(p);
379 	if (kauth_cred_getuid(my_cred) == pun->who) {
380 		error = donice(pun->curp, p, pun->prio);
381 		if (pun->errorp != NULL) {
382 			*pun->errorp = error;
383 		}
384 		if (pun->foundp != NULL) {
385 			n = *pun->foundp;
386 			*pun->foundp = n + 1;
387 		}
388 	}
389 	kauth_cred_unref(&my_cred);
390 
391 	return PROC_RETURNED;
392 }
393 
394 /* call back function used for proc iteration in PRIO_PGRP */
395 static int
ppgrp_donice_callback(proc_t p,void * arg)396 ppgrp_donice_callback(proc_t p, void * arg)
397 {
398 	int error;
399 	struct ppgrp_nice_args * pun = (struct ppgrp_nice_args *)arg;
400 	int n;
401 
402 	error = donice(pun->curp, p, pun->prio);
403 	if (pun->errorp != NULL) {
404 		*pun->errorp = error;
405 	}
406 	if (pun->foundp != NULL) {
407 		n = *pun->foundp;
408 		*pun->foundp = n + 1;
409 	}
410 
411 	return PROC_RETURNED;
412 }
413 
414 /*
415  * Returns:	0			Success
416  *		EINVAL
417  *		ESRCH
418  *	donice:EPERM
419  *	donice:EACCES
420  */
421 /* ARGSUSED */
422 int
setpriority(struct proc * curp,struct setpriority_args * uap,int32_t * retval)423 setpriority(struct proc *curp, struct setpriority_args *uap, int32_t *retval)
424 {
425 	struct proc *p;
426 	int found = 0, error = 0;
427 	int refheld = 0;
428 
429 	AUDIT_ARG(cmd, uap->which);
430 	AUDIT_ARG(owner, uap->who, 0);
431 	AUDIT_ARG(value32, uap->prio);
432 
433 	/* would also test (uap->who < 0), but id_t is unsigned */
434 	if (uap->who > 0x7fffffff) {
435 		return EINVAL;
436 	}
437 
438 	switch (uap->which) {
439 	case PRIO_PROCESS:
440 		if (uap->who == 0) {
441 			p = curp;
442 		} else {
443 			p = proc_find(uap->who);
444 			if (p == 0) {
445 				break;
446 			}
447 			refheld = 1;
448 		}
449 		error = donice(curp, p, uap->prio);
450 		found++;
451 		if (refheld != 0) {
452 			proc_rele(p);
453 		}
454 		break;
455 
456 	case PRIO_PGRP: {
457 		struct pgrp *pg = PGRP_NULL;
458 		struct ppgrp_nice_args ppgrp;
459 
460 		if (uap->who == 0) {
461 			pg = proc_pgrp(curp, NULL);
462 		} else if ((pg = pgrp_find(uap->who)) == PGRP_NULL) {
463 			break;
464 		}
465 
466 		ppgrp.curp = curp;
467 		ppgrp.prio = uap->prio;
468 		ppgrp.foundp = &found;
469 		ppgrp.errorp = &error;
470 
471 		pgrp_iterate(pg, ppgrp_donice_callback, (void *)&ppgrp, NULL);
472 		pgrp_rele(pg);
473 
474 		break;
475 	}
476 
477 	case PRIO_USER: {
478 		struct puser_nice_args punice;
479 
480 		if (uap->who == 0) {
481 			uap->who = kauth_cred_getuid(kauth_cred_get());
482 		}
483 
484 		punice.curp = curp;
485 		punice.prio = uap->prio;
486 		punice.who = uap->who;
487 		punice.foundp = &found;
488 		error = 0;
489 		punice.errorp = &error;
490 		proc_iterate(PROC_ALLPROCLIST, puser_donice_callback, (void *)&punice, NULL, NULL);
491 
492 		break;
493 	}
494 
495 	case PRIO_DARWIN_THREAD: {
496 		/* we currently only support the current thread */
497 		if (uap->who != 0) {
498 			return EINVAL;
499 		}
500 
501 		error = do_background_thread(current_thread(), uap->prio);
502 		found++;
503 		break;
504 	}
505 
506 	case PRIO_DARWIN_PROCESS: {
507 		if (uap->who == 0) {
508 			p = curp;
509 		} else {
510 			p = proc_find(uap->who);
511 			if (p == 0) {
512 				break;
513 			}
514 			refheld = 1;
515 		}
516 
517 		error = do_background_proc(curp, p, uap->prio);
518 
519 		found++;
520 		if (refheld != 0) {
521 			proc_rele(p);
522 		}
523 		break;
524 	}
525 
526 	case PRIO_DARWIN_GPU: {
527 		if (uap->who == 0) {
528 			return EINVAL;
529 		}
530 
531 		p = proc_find(uap->who);
532 		if (p == PROC_NULL) {
533 			break;
534 		}
535 
536 		error = set_gpudeny_proc(curp, p, uap->prio);
537 
538 		found++;
539 		proc_rele(p);
540 		break;
541 	}
542 
543 	case PRIO_DARWIN_ROLE: {
544 		if (uap->who == 0) {
545 			p = curp;
546 		} else {
547 			p = proc_find(uap->who);
548 			if (p == PROC_NULL) {
549 				break;
550 			}
551 			refheld = 1;
552 		}
553 
554 		error = proc_set_darwin_role(curp, p, uap->prio);
555 
556 		found++;
557 		if (refheld != 0) {
558 			proc_rele(p);
559 		}
560 		break;
561 	}
562 
563 	case PRIO_DARWIN_GAME_MODE: {
564 		if (uap->who == 0) {
565 			p = curp;
566 		} else {
567 			p = proc_find(uap->who);
568 			if (p == PROC_NULL) {
569 				break;
570 			}
571 			refheld = 1;
572 		}
573 
574 
575 		error = proc_set_game_mode(p, uap->prio);
576 
577 		found++;
578 		if (refheld != 0) {
579 			proc_rele(p);
580 		}
581 		break;
582 	}
583 
584 	case PRIO_DARWIN_CARPLAY_MODE: {
585 		if (uap->who == 0) {
586 			p = curp;
587 		} else {
588 			p = proc_find(uap->who);
589 			if (p == PROC_NULL) {
590 				break;
591 			}
592 			refheld = 1;
593 		}
594 
595 		error = proc_set_carplay_mode(p, uap->prio);
596 
597 		found++;
598 		if (refheld != 0) {
599 			proc_rele(p);
600 		}
601 		break;
602 	}
603 
604 	default:
605 		return EINVAL;
606 	}
607 	if (found == 0) {
608 		return ESRCH;
609 	}
610 	if (error == EIDRM) {
611 		*retval = -2;
612 		error = 0;
613 	}
614 	return error;
615 }
616 
617 
618 /*
619  * Returns:	0			Success
620  *		EPERM
621  *		EACCES
622  *	mac_check_proc_sched:???
623  */
624 static int
donice(struct proc * curp,struct proc * chgp,int n)625 donice(struct proc *curp, struct proc *chgp, int n)
626 {
627 	int error = 0;
628 	kauth_cred_t ucred;
629 	kauth_cred_t my_cred;
630 
631 	ucred = kauth_cred_proc_ref(curp);
632 	my_cred = kauth_cred_proc_ref(chgp);
633 
634 	if (suser(ucred, NULL) && kauth_cred_getruid(ucred) &&
635 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(my_cred) &&
636 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(my_cred)) {
637 		error = EPERM;
638 		goto out;
639 	}
640 	if (n > PRIO_MAX) {
641 		n = PRIO_MAX;
642 	}
643 	if (n < PRIO_MIN) {
644 		n = PRIO_MIN;
645 	}
646 	if (n < chgp->p_nice && suser(ucred, &curp->p_acflag)) {
647 		error = EACCES;
648 		goto out;
649 	}
650 #if CONFIG_MACF
651 	error = mac_proc_check_sched(curp, chgp);
652 	if (error) {
653 		goto out;
654 	}
655 #endif
656 	proc_lock(chgp);
657 	chgp->p_nice = (char)n;
658 	proc_unlock(chgp);
659 	(void)resetpriority(chgp);
660 out:
661 	kauth_cred_unref(&ucred);
662 	kauth_cred_unref(&my_cred);
663 	return error;
664 }
665 
666 static int
set_gpudeny_proc(struct proc * curp,struct proc * targetp,int priority)667 set_gpudeny_proc(struct proc *curp, struct proc *targetp, int priority)
668 {
669 	int error = 0;
670 	kauth_cred_t ucred;
671 	kauth_cred_t target_cred;
672 
673 	ucred = kauth_cred_get();
674 	target_cred = kauth_cred_proc_ref(targetp);
675 
676 	/* TODO: Entitlement instead of uid check */
677 
678 	if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
679 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
680 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
681 		error = EPERM;
682 		goto out;
683 	}
684 
685 	if (curp == targetp) {
686 		error = EPERM;
687 		goto out;
688 	}
689 
690 #if CONFIG_MACF
691 	error = mac_proc_check_sched(curp, targetp);
692 	if (error) {
693 		goto out;
694 	}
695 #endif
696 
697 	switch (priority) {
698 	case PRIO_DARWIN_GPU_DENY:
699 		task_set_gpu_denied(proc_task(targetp), TRUE);
700 		break;
701 	case PRIO_DARWIN_GPU_ALLOW:
702 		task_set_gpu_denied(proc_task(targetp), FALSE);
703 		break;
704 	default:
705 		error = EINVAL;
706 		goto out;
707 	}
708 
709 out:
710 	kauth_cred_unref(&target_cred);
711 	return error;
712 }
713 
714 static int
proc_set_darwin_role(proc_t curp,proc_t targetp,int priority)715 proc_set_darwin_role(proc_t curp, proc_t targetp, int priority)
716 {
717 	int error = 0;
718 	uint32_t flagsp = 0;
719 
720 	kauth_cred_t ucred, target_cred;
721 
722 	ucred = kauth_cred_get();
723 	target_cred = kauth_cred_proc_ref(targetp);
724 
725 	if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
726 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
727 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
728 		if (priv_check_cred(ucred, PRIV_SETPRIORITY_DARWIN_ROLE, 0) != 0) {
729 			error = EPERM;
730 			goto out;
731 		}
732 	}
733 
734 	if (curp != targetp) {
735 #if CONFIG_MACF
736 		if ((error = mac_proc_check_sched(curp, targetp))) {
737 			goto out;
738 		}
739 #endif
740 	}
741 
742 	proc_get_darwinbgstate(proc_task(targetp), &flagsp);
743 	if ((flagsp & PROC_FLAG_APPLICATION) != PROC_FLAG_APPLICATION) {
744 		error = ENOTSUP;
745 		goto out;
746 	}
747 
748 	task_role_t role = TASK_UNSPECIFIED;
749 
750 	if ((error = proc_darwin_role_to_task_role(priority, &role))) {
751 		goto out;
752 	}
753 
754 	proc_set_task_policy(proc_task(targetp), TASK_POLICY_ATTRIBUTE,
755 	    TASK_POLICY_ROLE, role);
756 
757 #if CONFIG_FREEZE
758 	if (priority == PRIO_DARWIN_ROLE_UI_FOCAL || priority == PRIO_DARWIN_ROLE_UI || priority == PRIO_DARWIN_ROLE_UI_NON_FOCAL) {
759 		memorystatus_freezer_mark_ui_transition(targetp);
760 	}
761 #endif /* CONFIG_FREEZE */
762 
763 out:
764 	kauth_cred_unref(&target_cred);
765 	return error;
766 }
767 
768 static int
proc_get_darwin_role(proc_t curp,proc_t targetp,int * priority)769 proc_get_darwin_role(proc_t curp, proc_t targetp, int *priority)
770 {
771 	int error = 0;
772 	int role = 0;
773 
774 	kauth_cred_t ucred, target_cred;
775 
776 	ucred = kauth_cred_get();
777 	target_cred = kauth_cred_proc_ref(targetp);
778 
779 	if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
780 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
781 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
782 		error = EPERM;
783 		goto out;
784 	}
785 
786 	if (curp != targetp) {
787 #if CONFIG_MACF
788 		if ((error = mac_proc_check_sched(curp, targetp))) {
789 			goto out;
790 		}
791 #endif
792 	}
793 
794 	role = proc_get_task_policy(proc_task(targetp), TASK_POLICY_ATTRIBUTE, TASK_POLICY_ROLE);
795 
796 	*priority = proc_task_role_to_darwin_role(role);
797 
798 out:
799 	kauth_cred_unref(&target_cred);
800 	return error;
801 }
802 
803 #define SET_GAME_MODE_ENTITLEMENT "com.apple.private.set-game-mode"
804 
805 static int
proc_set_game_mode(proc_t targetp,int priority)806 proc_set_game_mode(proc_t targetp, int priority)
807 {
808 	int error = 0;
809 
810 	kauth_cred_t ucred, target_cred;
811 
812 	ucred = kauth_cred_get();
813 	target_cred = kauth_cred_proc_ref(targetp);
814 
815 	boolean_t entitled = FALSE;
816 	entitled = IOCurrentTaskHasEntitlement(SET_GAME_MODE_ENTITLEMENT);
817 	if (!entitled) {
818 		error = EPERM;
819 		goto out;
820 	}
821 
822 	/* Even with entitlement, non-root is only alllowed to set same-user */
823 	if (!kauth_cred_issuser(ucred) &&
824 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred)) {
825 		error = EPERM;
826 		goto out;
827 	}
828 
829 	switch (priority) {
830 	case PRIO_DARWIN_GAME_MODE_OFF:
831 		task_set_game_mode(proc_task(targetp), false);
832 		break;
833 	case PRIO_DARWIN_GAME_MODE_ON:
834 		task_set_game_mode(proc_task(targetp), true);
835 		break;
836 	default:
837 		error = EINVAL;
838 		goto out;
839 	}
840 
841 out:
842 	kauth_cred_unref(&target_cred);
843 	return error;
844 }
845 
846 static int
proc_get_game_mode(proc_t targetp,int * priority)847 proc_get_game_mode(proc_t targetp, int *priority)
848 {
849 	int error = 0;
850 
851 	kauth_cred_t ucred, target_cred;
852 
853 	ucred = kauth_cred_get();
854 	target_cred = kauth_cred_proc_ref(targetp);
855 
856 	boolean_t entitled = FALSE;
857 	entitled = IOCurrentTaskHasEntitlement(SET_GAME_MODE_ENTITLEMENT);
858 
859 	/* Root is allowed to get without entitlement */
860 	if (!kauth_cred_issuser(ucred) && !entitled) {
861 		error = EPERM;
862 		goto out;
863 	}
864 
865 	/* Even with entitlement, non-root is only alllowed to see same-user */
866 	if (!kauth_cred_issuser(ucred) &&
867 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred)) {
868 		error = EPERM;
869 		goto out;
870 	}
871 
872 	if (task_get_game_mode(proc_task(targetp))) {
873 		*priority = PRIO_DARWIN_GAME_MODE_ON;
874 	} else {
875 		*priority = PRIO_DARWIN_GAME_MODE_OFF;
876 	}
877 
878 out:
879 	kauth_cred_unref(&target_cred);
880 	return error;
881 }
882 
883 #define SET_CARPLAY_MODE_ENTITLEMENT "com.apple.private.set-carplay-mode"
884 
885 static int
proc_set_carplay_mode(proc_t targetp,int priority)886 proc_set_carplay_mode(proc_t targetp, int priority)
887 {
888 	int error = 0;
889 
890 	kauth_cred_t ucred, target_cred;
891 
892 	ucred = kauth_cred_get();
893 	target_cred = kauth_cred_proc_ref(targetp);
894 
895 	boolean_t entitled = FALSE;
896 	entitled = IOCurrentTaskHasEntitlement(SET_CARPLAY_MODE_ENTITLEMENT);
897 	if (!entitled) {
898 		error = EPERM;
899 		goto out;
900 	}
901 
902 	/* Even with entitlement, non-root is only alllowed to set same-user */
903 	if (!kauth_cred_issuser(ucred) &&
904 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred)) {
905 		error = EPERM;
906 		goto out;
907 	}
908 
909 	switch (priority) {
910 	case PRIO_DARWIN_CARPLAY_MODE_OFF:
911 		task_set_carplay_mode(proc_task(targetp), false);
912 		break;
913 	case PRIO_DARWIN_CARPLAY_MODE_ON:
914 		task_set_carplay_mode(proc_task(targetp), true);
915 		break;
916 	default:
917 		error = EINVAL;
918 		goto out;
919 	}
920 
921 out:
922 	kauth_cred_unref(&target_cred);
923 	return error;
924 }
925 
926 static int
proc_get_carplay_mode(proc_t targetp,int * priority)927 proc_get_carplay_mode(proc_t targetp, int *priority)
928 {
929 	int error = 0;
930 
931 	kauth_cred_t ucred, target_cred;
932 
933 	ucred = kauth_cred_get();
934 	target_cred = kauth_cred_proc_ref(targetp);
935 
936 	boolean_t entitled = FALSE;
937 	entitled = IOCurrentTaskHasEntitlement(SET_CARPLAY_MODE_ENTITLEMENT);
938 
939 	/* Root is allowed to get without entitlement */
940 	if (!kauth_cred_issuser(ucred) && !entitled) {
941 		error = EPERM;
942 		goto out;
943 	}
944 
945 	/* Even with entitlement, non-root is only alllowed to see same-user */
946 	if (!kauth_cred_issuser(ucred) &&
947 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred)) {
948 		error = EPERM;
949 		goto out;
950 	}
951 
952 	if (task_get_carplay_mode(proc_task(targetp))) {
953 		*priority = PRIO_DARWIN_CARPLAY_MODE_ON;
954 	} else {
955 		*priority = PRIO_DARWIN_CARPLAY_MODE_OFF;
956 	}
957 
958 out:
959 	kauth_cred_unref(&target_cred);
960 	return error;
961 }
962 
963 static int
get_background_proc(struct proc * curp,struct proc * targetp,int * priority)964 get_background_proc(struct proc *curp, struct proc *targetp, int *priority)
965 {
966 	int external = 0;
967 	int error = 0;
968 	kauth_cred_t ucred, target_cred;
969 
970 	ucred = kauth_cred_get();
971 	target_cred = kauth_cred_proc_ref(targetp);
972 
973 	if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
974 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
975 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
976 		error = EPERM;
977 		goto out;
978 	}
979 
980 	external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
981 
982 	*priority = proc_get_task_policy(current_task(), external, TASK_POLICY_DARWIN_BG);
983 
984 out:
985 	kauth_cred_unref(&target_cred);
986 	return error;
987 }
988 
989 static int
do_background_proc(struct proc * curp,struct proc * targetp,int priority)990 do_background_proc(struct proc *curp, struct proc *targetp, int priority)
991 {
992 #if !CONFIG_MACF
993 #pragma unused(curp)
994 #endif
995 	int error = 0;
996 	kauth_cred_t ucred;
997 	kauth_cred_t target_cred;
998 	int external;
999 	int enable;
1000 
1001 	ucred = kauth_cred_get();
1002 	target_cred = kauth_cred_proc_ref(targetp);
1003 
1004 	if (!kauth_cred_issuser(ucred) && kauth_cred_getruid(ucred) &&
1005 	    kauth_cred_getuid(ucred) != kauth_cred_getuid(target_cred) &&
1006 	    kauth_cred_getruid(ucred) != kauth_cred_getuid(target_cred)) {
1007 		error = EPERM;
1008 		goto out;
1009 	}
1010 
1011 #if CONFIG_MACF
1012 	error = mac_proc_check_sched(curp, targetp);
1013 	if (error) {
1014 		goto out;
1015 	}
1016 #endif
1017 
1018 	external = (curp == targetp) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
1019 
1020 	switch (priority) {
1021 	case PRIO_DARWIN_BG:
1022 		enable = TASK_POLICY_ENABLE;
1023 		break;
1024 	case PRIO_DARWIN_NONUI:
1025 		/* ignored for compatibility */
1026 		goto out;
1027 	default:
1028 		/* TODO: EINVAL if priority != 0 */
1029 		enable = TASK_POLICY_DISABLE;
1030 		break;
1031 	}
1032 
1033 	proc_set_task_policy(proc_task(targetp), external, TASK_POLICY_DARWIN_BG, enable);
1034 
1035 out:
1036 	kauth_cred_unref(&target_cred);
1037 	return error;
1038 }
1039 
1040 static void
do_background_socket(struct proc * p,thread_t thread)1041 do_background_socket(struct proc *p, thread_t thread)
1042 {
1043 #if SOCKETS
1044 	struct fileproc *fp;
1045 	int              background = false;
1046 #if NECP
1047 	int              update_necp = false;
1048 #endif /* NECP */
1049 
1050 	if (thread != THREAD_NULL &&
1051 	    get_threadtask(thread) != proc_task(p)) {
1052 		return;
1053 	}
1054 
1055 	proc_fdlock(p);
1056 
1057 	if (thread != THREAD_NULL) {
1058 		background = proc_get_effective_thread_policy(thread, TASK_POLICY_ALL_SOCKETS_BG);
1059 	} else {
1060 		background = proc_get_effective_task_policy(proc_task(p), TASK_POLICY_ALL_SOCKETS_BG);
1061 	}
1062 
1063 	if (background) {
1064 		/*
1065 		 * For PRIO_DARWIN_PROCESS (thread is NULL), simply mark
1066 		 * the sockets with the background flag.  There's nothing
1067 		 * to do here for the PRIO_DARWIN_THREAD case.
1068 		 */
1069 		if (thread == THREAD_NULL) {
1070 			fdt_foreach(fp, p) {
1071 				if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_SOCKET) {
1072 					struct socket *sockp = (struct socket *)fp_get_data(fp);
1073 					socket_set_traffic_mgt_flags(sockp, TRAFFIC_MGT_SO_BACKGROUND);
1074 					sockp->so_background_thread = NULL;
1075 				}
1076 #if NECP
1077 				else if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_NETPOLICY) {
1078 					if (necp_set_client_as_background(p, fp, background)) {
1079 						update_necp = true;
1080 					}
1081 				}
1082 #endif /* NECP */
1083 			}
1084 		}
1085 	} else {
1086 		/* disable networking IO throttle.
1087 		 * NOTE - It is a known limitation of the current design that we
1088 		 * could potentially clear TRAFFIC_MGT_SO_BACKGROUND bit for
1089 		 * sockets created by other threads within this process.
1090 		 */
1091 		fdt_foreach(fp, p) {
1092 			struct socket *sockp;
1093 
1094 			if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_SOCKET) {
1095 				sockp = (struct socket *)fp_get_data(fp);
1096 				/* skip if only clearing this thread's sockets */
1097 				if ((thread) && (sockp->so_background_thread != thread)) {
1098 					continue;
1099 				}
1100 				socket_clear_traffic_mgt_flags(sockp, TRAFFIC_MGT_SO_BACKGROUND);
1101 				sockp->so_background_thread = NULL;
1102 			}
1103 #if NECP
1104 			else if (FILEGLOB_DTYPE(fp->fp_glob) == DTYPE_NETPOLICY) {
1105 				if (necp_set_client_as_background(p, fp, background)) {
1106 					update_necp = true;
1107 				}
1108 			}
1109 #endif /* NECP */
1110 		}
1111 	}
1112 
1113 	proc_fdunlock(p);
1114 
1115 #if NECP
1116 	if (update_necp) {
1117 		necp_update_all_clients();
1118 	}
1119 #endif /* NECP */
1120 #else
1121 #pragma unused(p, thread)
1122 #endif
1123 }
1124 
1125 
1126 /*
1127  * do_background_thread
1128  *
1129  * Requires: thread reference
1130  *
1131  * Returns:     0                       Success
1132  *              EPERM                   Tried to background while in vfork
1133  * XXX - todo - does this need a MACF hook?
1134  */
1135 static int
do_background_thread(thread_t thread,int priority)1136 do_background_thread(thread_t thread, int priority)
1137 {
1138 	int enable, external;
1139 	int rv = 0;
1140 
1141 	/* Backgrounding is unsupported for workq threads */
1142 	if (thread_is_static_param(thread)) {
1143 		return EPERM;
1144 	}
1145 
1146 	/* Not allowed to combine QoS and DARWIN_BG, doing so strips the QoS */
1147 	if (thread_has_qos_policy(thread)) {
1148 		thread_remove_qos_policy(thread);
1149 		rv = EIDRM;
1150 	}
1151 
1152 	/* TODO: Fail if someone passes something besides 0 or PRIO_DARWIN_BG */
1153 	enable   = (priority == PRIO_DARWIN_BG) ? TASK_POLICY_ENABLE   : TASK_POLICY_DISABLE;
1154 	external = (current_thread() == thread) ? TASK_POLICY_INTERNAL : TASK_POLICY_EXTERNAL;
1155 
1156 	proc_set_thread_policy(thread, external, TASK_POLICY_DARWIN_BG, enable);
1157 
1158 	return rv;
1159 }
1160 
1161 
1162 /*
1163  * Returns:	0			Success
1164  *	copyin:EFAULT
1165  *	dosetrlimit:
1166  */
1167 /* ARGSUSED */
1168 int
setrlimit(struct proc * p,struct setrlimit_args * uap,__unused int32_t * retval)1169 setrlimit(struct proc *p, struct setrlimit_args *uap, __unused int32_t *retval)
1170 {
1171 	struct rlimit alim;
1172 	int error;
1173 
1174 	if ((error = copyin(uap->rlp, (caddr_t)&alim,
1175 	    sizeof(struct rlimit)))) {
1176 		return error;
1177 	}
1178 
1179 	return dosetrlimit(p, uap->which, &alim);
1180 }
1181 
1182 /*
1183  * Returns:	0			Success
1184  *		EINVAL
1185  *	suser:EPERM
1186  *
1187  * Notes:	EINVAL is returned both for invalid arguments, and in the
1188  *		case that the current usage (e.g. RLIMIT_STACK) is already
1189  *		in excess of the requested limit.
1190  */
1191 static int
dosetrlimit(struct proc * p,u_int which,struct rlimit * newrlim)1192 dosetrlimit(struct proc *p, u_int which, struct rlimit *newrlim)
1193 {
1194 	struct rlimit        rlim, stack_rlim = {.rlim_cur = 0, .rlim_max = 0};
1195 	int                  error;
1196 	kern_return_t        kr;
1197 
1198 	/* Mask out POSIX flag, saved above */
1199 	which &= ~_RLIMIT_POSIX_FLAG;
1200 
1201 	/* Unknown resource */
1202 	if (which >= RLIM_NLIMITS) {
1203 		return EINVAL;
1204 	}
1205 
1206 	proc_lock(p);
1207 
1208 	/* Only one thread is able to change the current process's rlimit values */
1209 	proc_limitblock(p);
1210 
1211 	/*
1212 	 * Take a snapshot of the current rlimit values and read this throughout
1213 	 * this routine. This minimizes the critical sections and allow other
1214 	 * processes in the system to access the plimit while we are in the
1215 	 * middle of this setrlimit call.
1216 	 */
1217 	rlim = smr_serialized_load(&p->p_limit)->pl_rlimit[which];
1218 
1219 	proc_unlock(p);
1220 
1221 	error = 0;
1222 	/* Sanity check: new soft limit cannot exceed new hard limit */
1223 	if (newrlim->rlim_cur > newrlim->rlim_max) {
1224 		error = EINVAL;
1225 	}
1226 	/*
1227 	 * Sanity check: only super-user may raise the hard limit.
1228 	 * newrlim->rlim_cur > rlim.rlim_max implies that the call
1229 	 * is increasing the hard limit as well.
1230 	 */
1231 	else if (newrlim->rlim_cur > rlim.rlim_max || newrlim->rlim_max > rlim.rlim_max) {
1232 		/* suser() returns 0 if the calling thread is super user. */
1233 		error = suser(kauth_cred_get(), &p->p_acflag);
1234 	}
1235 
1236 	if (error) {
1237 		/* Invalid setrlimit request: EINVAL or EPERM */
1238 		goto out;
1239 	}
1240 
1241 	/* We have the reader lock of the process's plimit so it's safe to read the rlimit values */
1242 	switch (which) {
1243 	case RLIMIT_CPU:
1244 		if (newrlim->rlim_cur == RLIM_INFINITY) {
1245 			task_vtimer_clear(proc_task(p), TASK_VTIMER_RLIM);
1246 			timerclear(&p->p_rlim_cpu);
1247 		} else {
1248 			task_absolutetime_info_data_t   tinfo;
1249 			mach_msg_type_number_t          count;
1250 			struct timeval                  ttv, tv;
1251 			clock_sec_t                     tv_sec;
1252 			clock_usec_t                    tv_usec;
1253 
1254 			count = TASK_ABSOLUTETIME_INFO_COUNT;
1255 			task_info(proc_task(p), TASK_ABSOLUTETIME_INFO, (task_info_t)&tinfo, &count);
1256 			absolutetime_to_microtime(tinfo.total_user + tinfo.total_system, &tv_sec, &tv_usec);
1257 			ttv.tv_sec = tv_sec;
1258 			ttv.tv_usec = tv_usec;
1259 
1260 			tv.tv_sec = (newrlim->rlim_cur > __INT_MAX__ ? __INT_MAX__ : (__darwin_time_t)newrlim->rlim_cur);
1261 			tv.tv_usec = 0;
1262 			timersub(&tv, &ttv, &p->p_rlim_cpu);
1263 
1264 			timerclear(&tv);
1265 			if (timercmp(&p->p_rlim_cpu, &tv, >)) {
1266 				task_vtimer_set(proc_task(p), TASK_VTIMER_RLIM);
1267 			} else {
1268 				task_vtimer_clear(proc_task(p), TASK_VTIMER_RLIM);
1269 
1270 				timerclear(&p->p_rlim_cpu);
1271 
1272 				psignal(p, SIGXCPU);
1273 			}
1274 		}
1275 		break;
1276 
1277 	case RLIMIT_DATA:
1278 #if 00
1279 		if (newrlim->rlim_cur > maxdmap) {
1280 			newrlim->rlim_cur = maxdmap;
1281 		}
1282 		if (newrlim->rlim_max > maxdmap) {
1283 			newrlim->rlim_max = maxdmap;
1284 		}
1285 #endif
1286 
1287 		/* Over to Mach VM to validate the new data limit */
1288 		if (vm_map_set_data_limit(current_map(), newrlim->rlim_cur) != KERN_SUCCESS) {
1289 			/* The limit specified cannot be lowered because current usage is already higher than the limit. */
1290 			error =  EINVAL;
1291 			goto out;
1292 		}
1293 		break;
1294 
1295 	case RLIMIT_STACK:
1296 		if (p->p_lflag & P_LCUSTOM_STACK) {
1297 			/* Process has a custom stack set - rlimit cannot be used to change it */
1298 			error = EINVAL;
1299 			goto out;
1300 		}
1301 
1302 		/*
1303 		 * Note: the real stack size limit is enforced by maxsmap, not a process's RLIMIT_STACK.
1304 		 *
1305 		 * The kernel uses maxsmap to control the actual stack size limit. While we allow
1306 		 * processes to set RLIMIT_STACK to RLIM_INFINITY (UNIX 03), accessing memory
1307 		 * beyond the maxsmap will still trigger an exception.
1308 		 *
1309 		 * stack_rlim is used to store the user-defined RLIMIT_STACK values while we adjust
1310 		 * the stack size using kernel limit (i.e. maxsmap).
1311 		 */
1312 		if (newrlim->rlim_cur > maxsmap ||
1313 		    newrlim->rlim_max > maxsmap) {
1314 			if (newrlim->rlim_cur > maxsmap) {
1315 				stack_rlim.rlim_cur = newrlim->rlim_cur;
1316 				newrlim->rlim_cur = maxsmap;
1317 			}
1318 			if (newrlim->rlim_max > maxsmap) {
1319 				stack_rlim.rlim_max = newrlim->rlim_max;
1320 				newrlim->rlim_max = maxsmap;
1321 			}
1322 		}
1323 
1324 		/*
1325 		 * rlim.rlim_cur/rlim_max could be arbitrarily large due to previous calls to setrlimit().
1326 		 * Use the actual size for stack region adjustment.
1327 		 */
1328 		if (rlim.rlim_cur > maxsmap) {
1329 			rlim.rlim_cur = maxsmap;
1330 		}
1331 		if (rlim.rlim_max > maxsmap) {
1332 			rlim.rlim_max = maxsmap;
1333 		}
1334 
1335 		/*
1336 		 * Stack is allocated to the max at exec time with only
1337 		 * "rlim_cur" bytes accessible.  If stack limit is going
1338 		 * up make more accessible, if going down make inaccessible.
1339 		 */
1340 		if (newrlim->rlim_cur > rlim.rlim_cur) {
1341 			mach_vm_offset_t addr;
1342 			mach_vm_size_t size;
1343 
1344 			/* grow stack */
1345 			size = newrlim->rlim_cur;
1346 			if (round_page_overflow(size, &size)) {
1347 				error = EINVAL;
1348 				goto out;
1349 			}
1350 			size -= round_page_64(rlim.rlim_cur);
1351 
1352 			addr = (mach_vm_offset_t)(p->user_stack - round_page_64(newrlim->rlim_cur));
1353 			kr = mach_vm_protect(current_map(), addr, size, FALSE, VM_PROT_DEFAULT);
1354 			if (kr != KERN_SUCCESS) {
1355 				error = EINVAL;
1356 				goto out;
1357 			}
1358 		} else if (newrlim->rlim_cur < rlim.rlim_cur) {
1359 			mach_vm_offset_t addr;
1360 			mach_vm_size_t size;
1361 			uint64_t cur_sp;
1362 
1363 			/* shrink stack */
1364 
1365 			/*
1366 			 * First check if new stack limit would agree
1367 			 * with current stack usage.
1368 			 * Get the current thread's stack pointer...
1369 			 */
1370 			cur_sp = thread_adjuserstack(current_thread(), 0);
1371 			if (cur_sp <= p->user_stack &&
1372 			    cur_sp > (p->user_stack - round_page_64(rlim.rlim_cur))) {
1373 				/* stack pointer is in main stack */
1374 				if (cur_sp <= (p->user_stack - round_page_64(newrlim->rlim_cur))) {
1375 					/*
1376 					 * New limit would cause current usage to be invalid:
1377 					 * reject new limit.
1378 					 */
1379 					error =  EINVAL;
1380 					goto out;
1381 				}
1382 			} else {
1383 				/* not on the main stack: reject */
1384 				error =  EINVAL;
1385 				goto out;
1386 			}
1387 
1388 			size = round_page_64(rlim.rlim_cur);
1389 			size -= round_page_64(rlim.rlim_cur);
1390 
1391 			addr = (mach_vm_offset_t)(p->user_stack - round_page_64(rlim.rlim_cur));
1392 
1393 			kr = mach_vm_protect(current_map(), addr, size, FALSE, VM_PROT_NONE);
1394 			if (kr != KERN_SUCCESS) {
1395 				error =  EINVAL;
1396 				goto out;
1397 			}
1398 		} else {
1399 			/* no change ... */
1400 		}
1401 
1402 		/*
1403 		 * We've adjusted the process's stack region. If the user-defined limit is greater
1404 		 * than maxsmap, we need to reflect this change in rlimit interface.
1405 		 */
1406 		if (stack_rlim.rlim_cur != 0) {
1407 			newrlim->rlim_cur = stack_rlim.rlim_cur;
1408 		}
1409 		if (stack_rlim.rlim_max != 0) {
1410 			newrlim->rlim_max = stack_rlim.rlim_max;
1411 		}
1412 		break;
1413 
1414 	case RLIMIT_NOFILE:
1415 		/*
1416 		 * Nothing to be done here as we already performed the sanity checks before entering the switch code block.
1417 		 * The real NOFILE limits enforced by the kernel is capped at MIN(RLIMIT_NOFILE, maxfilesperproc)
1418 		 */
1419 		break;
1420 
1421 	case RLIMIT_AS:
1422 		/* Over to Mach VM to validate the new address space limit */
1423 		if (vm_map_set_size_limit(current_map(), newrlim->rlim_cur) != KERN_SUCCESS) {
1424 			/* The limit specified cannot be lowered because current usage is already higher than the limit. */
1425 			error =  EINVAL;
1426 			goto out;
1427 		}
1428 		break;
1429 
1430 	case RLIMIT_NPROC:
1431 		/*
1432 		 * Only root can set to the maxproc limits, as it is
1433 		 * systemwide resource; all others are limited to
1434 		 * maxprocperuid (presumably less than maxproc).
1435 		 */
1436 		if (kauth_cred_issuser(kauth_cred_get())) {
1437 			if (newrlim->rlim_cur > (rlim_t)maxproc) {
1438 				newrlim->rlim_cur = maxproc;
1439 			}
1440 			if (newrlim->rlim_max > (rlim_t)maxproc) {
1441 				newrlim->rlim_max = maxproc;
1442 			}
1443 		} else {
1444 			if (newrlim->rlim_cur > (rlim_t)maxprocperuid) {
1445 				newrlim->rlim_cur = maxprocperuid;
1446 			}
1447 			if (newrlim->rlim_max > (rlim_t)maxprocperuid) {
1448 				newrlim->rlim_max = maxprocperuid;
1449 			}
1450 		}
1451 		break;
1452 
1453 	case RLIMIT_MEMLOCK:
1454 		/*
1455 		 * Tell the Mach VM layer about the new limit value.
1456 		 */
1457 		newrlim->rlim_cur = (vm_size_t)newrlim->rlim_cur;
1458 		vm_map_set_user_wire_limit(current_map(), (vm_size_t)newrlim->rlim_cur);
1459 		break;
1460 	} /* switch... */
1461 
1462 	/* Everything checks out and we are now ready to update the rlimit */
1463 	error = 0;
1464 
1465 out:
1466 
1467 	if (error == 0) {
1468 		/*
1469 		 * COW the current plimit if it's shared, otherwise update it in place.
1470 		 * Finally unblock other threads wishing to change plimit.
1471 		 */
1472 		proc_limitupdate(p, true, ^(struct plimit *plim) {
1473 			plim->pl_rlimit[which] = *newrlim;
1474 		});
1475 	} else {
1476 		/*
1477 		 * This setrlimit has failed, just leave the plimit as is and unblock other
1478 		 * threads wishing to change plimit.
1479 		 */
1480 		proc_lock(p);
1481 		proc_limitunblock(p);
1482 		proc_unlock(p);
1483 	}
1484 
1485 	return error;
1486 }
1487 
1488 /* ARGSUSED */
1489 int
getrlimit(struct proc * p,struct getrlimit_args * uap,__unused int32_t * retval)1490 getrlimit(struct proc *p, struct getrlimit_args *uap, __unused int32_t *retval)
1491 {
1492 	struct rlimit lim = {};
1493 
1494 	/*
1495 	 * Take out flag now in case we need to use it to trigger variant
1496 	 * behaviour later.
1497 	 */
1498 	uap->which &= ~_RLIMIT_POSIX_FLAG;
1499 
1500 	if (uap->which >= RLIM_NLIMITS) {
1501 		return EINVAL;
1502 	}
1503 	lim = proc_limitget(p, uap->which);
1504 	return copyout((caddr_t)&lim,
1505 	           uap->rlp, sizeof(struct rlimit));
1506 }
1507 
1508 /*
1509  * Transform the running time and tick information in proc p into user,
1510  * system, and interrupt time usage.
1511  */
1512 /* No lock on proc is held for this.. */
1513 void
calcru(struct proc * p,struct timeval * up,struct timeval * sp,struct timeval * ip)1514 calcru(struct proc *p, struct timeval *up, struct timeval *sp, struct timeval *ip)
1515 {
1516 	task_t                  task;
1517 
1518 	timerclear(up);
1519 	timerclear(sp);
1520 	if (ip != NULL) {
1521 		timerclear(ip);
1522 	}
1523 
1524 	task = proc_task(p);
1525 	if (task) {
1526 		mach_task_basic_info_data_t tinfo;
1527 		task_thread_times_info_data_t ttimesinfo;
1528 		task_events_info_data_t teventsinfo;
1529 		mach_msg_type_number_t task_info_count, task_ttimes_count;
1530 		mach_msg_type_number_t task_events_count;
1531 		struct timeval ut, st;
1532 
1533 		task_info_count = MACH_TASK_BASIC_INFO_COUNT;
1534 		task_info(task, MACH_TASK_BASIC_INFO,
1535 		    (task_info_t)&tinfo, &task_info_count);
1536 		ut.tv_sec = tinfo.user_time.seconds;
1537 		ut.tv_usec = tinfo.user_time.microseconds;
1538 		st.tv_sec = tinfo.system_time.seconds;
1539 		st.tv_usec = tinfo.system_time.microseconds;
1540 		timeradd(&ut, up, up);
1541 		timeradd(&st, sp, sp);
1542 
1543 		task_ttimes_count = TASK_THREAD_TIMES_INFO_COUNT;
1544 		task_info(task, TASK_THREAD_TIMES_INFO,
1545 		    (task_info_t)&ttimesinfo, &task_ttimes_count);
1546 
1547 		ut.tv_sec = ttimesinfo.user_time.seconds;
1548 		ut.tv_usec = ttimesinfo.user_time.microseconds;
1549 		st.tv_sec = ttimesinfo.system_time.seconds;
1550 		st.tv_usec = ttimesinfo.system_time.microseconds;
1551 		timeradd(&ut, up, up);
1552 		timeradd(&st, sp, sp);
1553 
1554 		task_events_count = TASK_EVENTS_INFO_COUNT;
1555 		task_info(task, TASK_EVENTS_INFO,
1556 		    (task_info_t)&teventsinfo, &task_events_count);
1557 
1558 		/*
1559 		 * No need to lock "p":  this does not need to be
1560 		 * completely consistent, right ?
1561 		 */
1562 		p->p_stats->p_ru.ru_minflt = (teventsinfo.faults -
1563 		    teventsinfo.pageins);
1564 		p->p_stats->p_ru.ru_majflt = teventsinfo.pageins;
1565 		p->p_stats->p_ru.ru_nivcsw = (teventsinfo.csw -
1566 		    p->p_stats->p_ru.ru_nvcsw);
1567 		if (p->p_stats->p_ru.ru_nivcsw < 0) {
1568 			p->p_stats->p_ru.ru_nivcsw = 0;
1569 		}
1570 
1571 		p->p_stats->p_ru.ru_maxrss = (long)tinfo.resident_size_max;
1572 	}
1573 }
1574 
1575 __private_extern__ void munge_user64_rusage(struct rusage *a_rusage_p, struct user64_rusage *a_user_rusage_p);
1576 __private_extern__ void munge_user32_rusage(struct rusage *a_rusage_p, struct user32_rusage *a_user_rusage_p);
1577 
1578 /* ARGSUSED */
1579 int
getrusage(struct proc * p,struct getrusage_args * uap,__unused int32_t * retval)1580 getrusage(struct proc *p, struct getrusage_args *uap, __unused int32_t *retval)
1581 {
1582 	struct rusage *rup, rubuf;
1583 	struct user64_rusage rubuf64 = {};
1584 	struct user32_rusage rubuf32 = {};
1585 	size_t retsize = sizeof(rubuf);                 /* default: 32 bits */
1586 	caddr_t retbuf = (caddr_t)&rubuf;               /* default: 32 bits */
1587 	struct timeval utime;
1588 	struct timeval stime;
1589 
1590 
1591 	switch (uap->who) {
1592 	case RUSAGE_SELF:
1593 		calcru(p, &utime, &stime, NULL);
1594 		proc_lock(p);
1595 		rup = &p->p_stats->p_ru;
1596 		rup->ru_utime = utime;
1597 		rup->ru_stime = stime;
1598 
1599 		rubuf = *rup;
1600 		proc_unlock(p);
1601 
1602 		break;
1603 
1604 	case RUSAGE_CHILDREN:
1605 		proc_lock(p);
1606 		rup = &p->p_stats->p_cru;
1607 		rubuf = *rup;
1608 		proc_unlock(p);
1609 		break;
1610 
1611 	default:
1612 		return EINVAL;
1613 	}
1614 	if (IS_64BIT_PROCESS(p)) {
1615 		retsize = sizeof(rubuf64);
1616 		retbuf = (caddr_t)&rubuf64;
1617 		munge_user64_rusage(&rubuf, &rubuf64);
1618 	} else {
1619 		retsize = sizeof(rubuf32);
1620 		retbuf = (caddr_t)&rubuf32;
1621 		munge_user32_rusage(&rubuf, &rubuf32);
1622 	}
1623 
1624 	return copyout(retbuf, uap->rusage, retsize);
1625 }
1626 
1627 void
ruadd(struct rusage * ru,struct rusage * ru2)1628 ruadd(struct rusage *ru, struct rusage *ru2)
1629 {
1630 	long *ip, *ip2;
1631 	long i;
1632 
1633 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
1634 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
1635 	if (ru->ru_maxrss < ru2->ru_maxrss) {
1636 		ru->ru_maxrss = ru2->ru_maxrss;
1637 	}
1638 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
1639 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--) {
1640 		*ip++ += *ip2++;
1641 	}
1642 }
1643 
1644 /*
1645  * Add the rusage stats of child in parent.
1646  *
1647  * It adds rusage statistics of child process and statistics of all its
1648  * children to its parent.
1649  *
1650  * Note: proc lock of parent should be held while calling this function.
1651  */
1652 void
update_rusage_info_child(struct rusage_info_child * ri,rusage_info_current * ri_current)1653 update_rusage_info_child(struct rusage_info_child *ri, rusage_info_current *ri_current)
1654 {
1655 	ri->ri_child_user_time += (ri_current->ri_user_time +
1656 	    ri_current->ri_child_user_time);
1657 	ri->ri_child_system_time += (ri_current->ri_system_time +
1658 	    ri_current->ri_child_system_time);
1659 	ri->ri_child_pkg_idle_wkups += (ri_current->ri_pkg_idle_wkups +
1660 	    ri_current->ri_child_pkg_idle_wkups);
1661 	ri->ri_child_interrupt_wkups += (ri_current->ri_interrupt_wkups +
1662 	    ri_current->ri_child_interrupt_wkups);
1663 	ri->ri_child_pageins += (ri_current->ri_pageins +
1664 	    ri_current->ri_child_pageins);
1665 	ri->ri_child_elapsed_abstime += ((ri_current->ri_proc_exit_abstime -
1666 	    ri_current->ri_proc_start_abstime) + ri_current->ri_child_elapsed_abstime);
1667 }
1668 
1669 static void
proc_limit_free(smr_node_t node)1670 proc_limit_free(smr_node_t node)
1671 {
1672 	struct plimit *plimit = __container_of(node, struct plimit, pl_node);
1673 
1674 	zfree(plimit_zone, plimit);
1675 }
1676 
1677 static void
proc_limit_release(struct plimit * plimit)1678 proc_limit_release(struct plimit *plimit)
1679 {
1680 	if (os_ref_release(&plimit->pl_refcnt) == 0) {
1681 		smr_proc_task_call(&plimit->pl_node, sizeof(*plimit), proc_limit_free);
1682 	}
1683 }
1684 
1685 /*
1686  * Reading soft limit from specified resource.
1687  */
1688 rlim_t
proc_limitgetcur(proc_t p,int which)1689 proc_limitgetcur(proc_t p, int which)
1690 {
1691 	rlim_t rlim_cur;
1692 
1693 	assert(p);
1694 	assert(which < RLIM_NLIMITS);
1695 
1696 	smr_proc_task_enter();
1697 	rlim_cur = smr_entered_load(&p->p_limit)->pl_rlimit[which].rlim_cur;
1698 	smr_proc_task_leave();
1699 
1700 	return rlim_cur;
1701 }
1702 
1703 /*
1704  * Handle commonly asked limit that needs to be clamped with maxfilesperproc.
1705  */
1706 int
proc_limitgetcur_nofile(struct proc * p)1707 proc_limitgetcur_nofile(struct proc *p)
1708 {
1709 	rlim_t lim = proc_limitgetcur(p, RLIMIT_NOFILE);
1710 
1711 	return (int)MIN(lim, maxfilesperproc);
1712 }
1713 
1714 /*
1715  * Writing soft limit to specified resource. This is an internal function
1716  * used only by proc_exit to update RLIMIT_FSIZE in
1717  * place without invoking setrlimit.
1718  */
1719 void
proc_limitsetcur_fsize(proc_t p,rlim_t value)1720 proc_limitsetcur_fsize(proc_t p, rlim_t value)
1721 {
1722 	proc_limitupdate(p, false, ^(struct plimit *plimit) {
1723 		plimit->pl_rlimit[RLIMIT_FSIZE].rlim_cur = value;
1724 	});
1725 }
1726 
1727 struct rlimit
proc_limitget(proc_t p,int which)1728 proc_limitget(proc_t p, int which)
1729 {
1730 	struct rlimit lim;
1731 
1732 	assert(which < RLIM_NLIMITS);
1733 
1734 	smr_proc_task_enter();
1735 	lim = smr_entered_load(&p->p_limit)->pl_rlimit[which];
1736 	smr_proc_task_leave();
1737 
1738 	return lim;
1739 }
1740 
1741 void
proc_limitfork(proc_t parent,proc_t child)1742 proc_limitfork(proc_t parent, proc_t child)
1743 {
1744 	struct plimit *plim;
1745 
1746 	proc_lock(parent);
1747 	plim = smr_serialized_load(&parent->p_limit);
1748 	os_ref_retain(&plim->pl_refcnt);
1749 	proc_unlock(parent);
1750 
1751 	smr_init_store(&child->p_limit, plim);
1752 }
1753 
1754 void
proc_limitdrop(proc_t p)1755 proc_limitdrop(proc_t p)
1756 {
1757 	struct plimit *plimit = NULL;
1758 
1759 	proc_lock(p);
1760 	plimit = smr_serialized_load(&p->p_limit);
1761 	smr_clear_store(&p->p_limit);
1762 	proc_unlock(p);
1763 
1764 	proc_limit_release(plimit);
1765 }
1766 
1767 /*
1768  * proc_limitblock/unblock are used to serialize access to plimit
1769  * from concurrent threads within the same process.
1770  * Callers must be holding the proc lock to enter, return with
1771  * the proc lock locked
1772  */
1773 static void
proc_limitblock(proc_t p)1774 proc_limitblock(proc_t p)
1775 {
1776 	lck_mtx_assert(&p->p_mlock, LCK_MTX_ASSERT_OWNED);
1777 
1778 	while (p->p_lflag & P_LLIMCHANGE) {
1779 		p->p_lflag |= P_LLIMWAIT;
1780 		msleep(&p->p_limit, &p->p_mlock, 0, "proc_limitblock", NULL);
1781 	}
1782 	p->p_lflag |= P_LLIMCHANGE;
1783 }
1784 
1785 /*
1786  * Callers must be holding the proc lock to enter, return with
1787  * the proc lock locked
1788  */
1789 static void
proc_limitunblock(proc_t p)1790 proc_limitunblock(proc_t p)
1791 {
1792 	lck_mtx_assert(&p->p_mlock, LCK_MTX_ASSERT_OWNED);
1793 
1794 	p->p_lflag &= ~P_LLIMCHANGE;
1795 	if (p->p_lflag & P_LLIMWAIT) {
1796 		p->p_lflag &= ~P_LLIMWAIT;
1797 		wakeup(&p->p_limit);
1798 	}
1799 }
1800 
1801 /*
1802  * Perform an rlimit update (as defined by the arbitrary `update` function).
1803  *
1804  * Because plimits are accessed without holding any locks,
1805  * with only a hazard reference, the struct plimit is always
1806  * copied, updated, and replaced, to implement a const value type.
1807  */
1808 static void
1809 proc_limitupdate(proc_t p, bool unblock, void (^update)(struct plimit *))
1810 {
1811 	struct plimit  *cur_plim;
1812 	struct plimit  *copy_plim;
1813 
1814 	copy_plim = zalloc_flags(plimit_zone, Z_WAITOK | Z_ZERO | Z_NOFAIL);
1815 
1816 	proc_lock(p);
1817 
1818 	cur_plim = smr_serialized_load(&p->p_limit);
1819 
1820 	os_ref_init_count(&copy_plim->pl_refcnt, &rlimit_refgrp, 1);
1821 	bcopy(cur_plim->pl_rlimit, copy_plim->pl_rlimit,
1822 	    sizeof(struct rlimit) * RLIM_NLIMITS);
1823 
1824 	update(copy_plim);
1825 
1826 	smr_serialized_store(&p->p_limit, copy_plim);
1827 
1828 	if (unblock) {
1829 		proc_limitunblock(p);
1830 	}
1831 	proc_unlock(p);
1832 
1833 	proc_limit_release(cur_plim);
1834 }
1835 
1836 static int
1837 iopolicysys_disk(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1838 static int
1839 iopolicysys_vfs_hfs_case_sensitivity(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1840 static int
1841 iopolicysys_vfs_atime_updates(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1842 static int
1843 iopolicysys_vfs_statfs_no_data_volume(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1844 static int
1845 iopolicysys_vfs_trigger_resolve(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1846 static int
1847 iopolicysys_vfs_ignore_content_protection(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1848 static int
1849 iopolicysys_vfs_ignore_node_permissions(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *ipo_param);
1850 static int
1851 iopolicysys_vfs_skip_mtime_update(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1852 static int
1853 iopolicysys_vfs_allow_lowspace_writes(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1854 static int
1855 iopolicysys_vfs_disallow_rw_for_o_evtonly(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1856 static int iopolicysys_vfs_altlink(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1857 static int iopolicysys_vfs_nocache_write_fs_blksize(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1858 static int
1859 iopolicysys_vfs_support_long_paths(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param);
1860 
1861 /*
1862  * iopolicysys
1863  *
1864  * Description:	System call MUX for use in manipulating I/O policy attributes of the current process or thread
1865  *
1866  * Parameters:	cmd				Policy command
1867  *		arg				Pointer to policy arguments
1868  *
1869  * Returns:	0				Success
1870  *		EINVAL				Invalid command or invalid policy arguments
1871  *
1872  */
1873 int
iopolicysys(struct proc * p,struct iopolicysys_args * uap,int32_t * retval)1874 iopolicysys(struct proc *p, struct iopolicysys_args *uap, int32_t *retval)
1875 {
1876 	int     error = 0;
1877 	struct _iopol_param_t iop_param;
1878 
1879 	if ((error = copyin(uap->arg, &iop_param, sizeof(iop_param))) != 0) {
1880 		goto out;
1881 	}
1882 
1883 	switch (iop_param.iop_iotype) {
1884 	case IOPOL_TYPE_DISK:
1885 		error = iopolicysys_disk(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1886 		if (error == EIDRM) {
1887 			*retval = -2;
1888 			error = 0;
1889 		}
1890 		if (error) {
1891 			goto out;
1892 		}
1893 		break;
1894 	case IOPOL_TYPE_VFS_HFS_CASE_SENSITIVITY:
1895 		error = iopolicysys_vfs_hfs_case_sensitivity(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1896 		if (error) {
1897 			goto out;
1898 		}
1899 		break;
1900 	case IOPOL_TYPE_VFS_ATIME_UPDATES:
1901 		error = iopolicysys_vfs_atime_updates(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1902 		if (error) {
1903 			goto out;
1904 		}
1905 		break;
1906 	case IOPOL_TYPE_VFS_MATERIALIZE_DATALESS_FILES:
1907 		error = iopolicysys_vfs_materialize_dataless_files(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1908 		if (error) {
1909 			goto out;
1910 		}
1911 		break;
1912 	case IOPOL_TYPE_VFS_STATFS_NO_DATA_VOLUME:
1913 		error = iopolicysys_vfs_statfs_no_data_volume(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1914 		if (error) {
1915 			goto out;
1916 		}
1917 		break;
1918 	case IOPOL_TYPE_VFS_TRIGGER_RESOLVE:
1919 		error = iopolicysys_vfs_trigger_resolve(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1920 		if (error) {
1921 			goto out;
1922 		}
1923 		break;
1924 	case IOPOL_TYPE_VFS_IGNORE_CONTENT_PROTECTION:
1925 		error = iopolicysys_vfs_ignore_content_protection(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1926 		if (error) {
1927 			goto out;
1928 		}
1929 		break;
1930 	case IOPOL_TYPE_VFS_IGNORE_PERMISSIONS:
1931 		error = iopolicysys_vfs_ignore_node_permissions(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1932 		if (error) {
1933 			goto out;
1934 		}
1935 		break;
1936 	case IOPOL_TYPE_VFS_SKIP_MTIME_UPDATE:
1937 		error = iopolicysys_vfs_skip_mtime_update(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1938 		if (error) {
1939 			goto out;
1940 		}
1941 		break;
1942 	case IOPOL_TYPE_VFS_ALLOW_LOW_SPACE_WRITES:
1943 		error = iopolicysys_vfs_allow_lowspace_writes(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1944 		if (error) {
1945 			goto out;
1946 		}
1947 		break;
1948 	case IOPOL_TYPE_VFS_DISALLOW_RW_FOR_O_EVTONLY:
1949 		error = iopolicysys_vfs_disallow_rw_for_o_evtonly(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1950 		if (error) {
1951 			goto out;
1952 		}
1953 		break;
1954 	case IOPOL_TYPE_VFS_ALTLINK:
1955 		error = iopolicysys_vfs_altlink(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1956 		if (error) {
1957 			goto out;
1958 		}
1959 		break;
1960 	case IOPOL_TYPE_VFS_NOCACHE_WRITE_FS_BLKSIZE:
1961 		error = iopolicysys_vfs_nocache_write_fs_blksize(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1962 		if (error) {
1963 			goto out;
1964 		}
1965 		break;
1966 	case IOPOL_TYPE_VFS_SUPPORT_LONG_PATHS:
1967 		error = iopolicysys_vfs_support_long_paths(p, uap->cmd, iop_param.iop_scope, iop_param.iop_policy, &iop_param);
1968 		if (error) {
1969 			goto out;
1970 		}
1971 		break;
1972 
1973 	default:
1974 		error = EINVAL;
1975 		goto out;
1976 	}
1977 
1978 	/* Individual iotype handlers are expected to update iop_param, if requested with a GET command */
1979 	if (uap->cmd == IOPOL_CMD_GET) {
1980 		error = copyout((caddr_t)&iop_param, uap->arg, sizeof(iop_param));
1981 		if (error) {
1982 			goto out;
1983 		}
1984 	}
1985 
1986 out:
1987 	return error;
1988 }
1989 
1990 static int
iopolicysys_disk(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)1991 iopolicysys_disk(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
1992 {
1993 	int                     error = 0;
1994 	thread_t        thread;
1995 	int                     policy_flavor;
1996 
1997 	/* Validate scope */
1998 	switch (scope) {
1999 	case IOPOL_SCOPE_PROCESS:
2000 		thread = THREAD_NULL;
2001 		policy_flavor = TASK_POLICY_IOPOL;
2002 		break;
2003 
2004 	case IOPOL_SCOPE_THREAD:
2005 		thread = current_thread();
2006 		policy_flavor = TASK_POLICY_IOPOL;
2007 
2008 		/* Not allowed to combine QoS and (non-PASSIVE) IO policy, doing so strips the QoS */
2009 		if (cmd == IOPOL_CMD_SET && thread_has_qos_policy(thread)) {
2010 			switch (policy) {
2011 			case IOPOL_DEFAULT:
2012 			case IOPOL_PASSIVE:
2013 				break;
2014 			case IOPOL_UTILITY:
2015 			case IOPOL_THROTTLE:
2016 			case IOPOL_IMPORTANT:
2017 			case IOPOL_STANDARD:
2018 				if (!thread_is_static_param(thread)) {
2019 					thread_remove_qos_policy(thread);
2020 					/*
2021 					 * This is not an error case, this is to return a marker to user-space that
2022 					 * we stripped the thread of its QoS class.
2023 					 */
2024 					error = EIDRM;
2025 					break;
2026 				}
2027 				OS_FALLTHROUGH;
2028 			default:
2029 				error = EINVAL;
2030 				goto out;
2031 			}
2032 		}
2033 		break;
2034 
2035 	case IOPOL_SCOPE_DARWIN_BG:
2036 #if !defined(XNU_TARGET_OS_OSX)
2037 		/* We don't want this on platforms outside of macOS as BG is always IOPOL_THROTTLE */
2038 		error = ENOTSUP;
2039 		goto out;
2040 #else /* !defined(XNU_TARGET_OS_OSX) */
2041 		thread = THREAD_NULL;
2042 		policy_flavor = TASK_POLICY_DARWIN_BG_IOPOL;
2043 		break;
2044 #endif /* !defined(XNU_TARGET_OS_OSX) */
2045 
2046 	default:
2047 		error = EINVAL;
2048 		goto out;
2049 	}
2050 
2051 	/* Validate policy */
2052 	if (cmd == IOPOL_CMD_SET) {
2053 		switch (policy) {
2054 		case IOPOL_DEFAULT:
2055 			if (scope == IOPOL_SCOPE_DARWIN_BG) {
2056 				/* the current default BG throttle level is UTILITY */
2057 				policy = IOPOL_UTILITY;
2058 			} else {
2059 				policy = IOPOL_IMPORTANT;
2060 			}
2061 			break;
2062 		case IOPOL_UTILITY:
2063 		/* fall-through */
2064 		case IOPOL_THROTTLE:
2065 			/* These levels are OK */
2066 			break;
2067 		case IOPOL_IMPORTANT:
2068 		/* fall-through */
2069 		case IOPOL_STANDARD:
2070 		/* fall-through */
2071 		case IOPOL_PASSIVE:
2072 			if (scope == IOPOL_SCOPE_DARWIN_BG) {
2073 				/* These levels are invalid for BG */
2074 				error = EINVAL;
2075 				goto out;
2076 			} else {
2077 				/* OK for other scopes */
2078 			}
2079 			break;
2080 		default:
2081 			error = EINVAL;
2082 			goto out;
2083 		}
2084 	}
2085 
2086 	/* Perform command */
2087 	switch (cmd) {
2088 	case IOPOL_CMD_SET:
2089 		if (thread != THREAD_NULL) {
2090 			proc_set_thread_policy(thread, TASK_POLICY_INTERNAL, policy_flavor, policy);
2091 		} else {
2092 			proc_set_task_policy(current_task(), TASK_POLICY_INTERNAL, policy_flavor, policy);
2093 		}
2094 		break;
2095 	case IOPOL_CMD_GET:
2096 		if (thread != THREAD_NULL) {
2097 			policy = proc_get_thread_policy(thread, TASK_POLICY_INTERNAL, policy_flavor);
2098 		} else {
2099 			policy = proc_get_task_policy(current_task(), TASK_POLICY_INTERNAL, policy_flavor);
2100 		}
2101 		iop_param->iop_policy = policy;
2102 		break;
2103 	default:
2104 		error = EINVAL;         /* unknown command */
2105 		break;
2106 	}
2107 
2108 out:
2109 	return error;
2110 }
2111 
2112 static int
iopolicysys_vfs_hfs_case_sensitivity(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2113 iopolicysys_vfs_hfs_case_sensitivity(struct proc *p, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
2114 {
2115 	int                     error = 0;
2116 
2117 	/* Validate scope */
2118 	switch (scope) {
2119 	case IOPOL_SCOPE_PROCESS:
2120 		/* Only process OK */
2121 		break;
2122 	default:
2123 		error = EINVAL;
2124 		goto out;
2125 	}
2126 
2127 	/* Validate policy */
2128 	if (cmd == IOPOL_CMD_SET) {
2129 		switch (policy) {
2130 		case IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT:
2131 		/* fall-through */
2132 		case IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE:
2133 			/* These policies are OK */
2134 			break;
2135 		default:
2136 			error = EINVAL;
2137 			goto out;
2138 		}
2139 	}
2140 
2141 	/* Perform command */
2142 	switch (cmd) {
2143 	case IOPOL_CMD_SET:
2144 		if (0 == kauth_cred_issuser(kauth_cred_get())) {
2145 			/* If it's a non-root process, it needs to have the entitlement to set the policy */
2146 			boolean_t entitled = FALSE;
2147 			entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
2148 			if (!entitled) {
2149 				error = EPERM;
2150 				goto out;
2151 			}
2152 		}
2153 
2154 		switch (policy) {
2155 		case IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT:
2156 			OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY), &p->p_vfs_iopolicy);
2157 			break;
2158 		case IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE:
2159 			OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY, &p->p_vfs_iopolicy);
2160 			break;
2161 		default:
2162 			error = EINVAL;
2163 			goto out;
2164 		}
2165 
2166 		break;
2167 	case IOPOL_CMD_GET:
2168 		iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_FORCE_HFS_CASE_SENSITIVITY)
2169 		    ? IOPOL_VFS_HFS_CASE_SENSITIVITY_FORCE_CASE_SENSITIVE
2170 		    : IOPOL_VFS_HFS_CASE_SENSITIVITY_DEFAULT;
2171 		break;
2172 	default:
2173 		error = EINVAL;         /* unknown command */
2174 		break;
2175 	}
2176 
2177 out:
2178 	return error;
2179 }
2180 
2181 static inline int
get_thread_atime_policy(struct uthread * ut)2182 get_thread_atime_policy(struct uthread *ut)
2183 {
2184 	return (ut->uu_flag & UT_ATIME_UPDATE) ? IOPOL_ATIME_UPDATES_OFF : IOPOL_ATIME_UPDATES_DEFAULT;
2185 }
2186 
2187 static inline void
set_thread_atime_policy(struct uthread * ut,int policy)2188 set_thread_atime_policy(struct uthread *ut, int policy)
2189 {
2190 	if (policy == IOPOL_ATIME_UPDATES_OFF) {
2191 		ut->uu_flag |= UT_ATIME_UPDATE;
2192 	} else {
2193 		ut->uu_flag &= ~UT_ATIME_UPDATE;
2194 	}
2195 }
2196 
2197 static inline void
set_task_atime_policy(struct proc * p,int policy)2198 set_task_atime_policy(struct proc *p, int policy)
2199 {
2200 	if (policy == IOPOL_ATIME_UPDATES_OFF) {
2201 		OSBitOrAtomic16((uint16_t)P_VFS_IOPOLICY_ATIME_UPDATES, &p->p_vfs_iopolicy);
2202 	} else {
2203 		OSBitAndAtomic16(~((uint16_t)P_VFS_IOPOLICY_ATIME_UPDATES), &p->p_vfs_iopolicy);
2204 	}
2205 }
2206 
2207 static inline int
get_task_atime_policy(struct proc * p)2208 get_task_atime_policy(struct proc *p)
2209 {
2210 	return (p->p_vfs_iopolicy & P_VFS_IOPOLICY_ATIME_UPDATES) ? IOPOL_ATIME_UPDATES_OFF : IOPOL_ATIME_UPDATES_DEFAULT;
2211 }
2212 
2213 static int
iopolicysys_vfs_atime_updates(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2214 iopolicysys_vfs_atime_updates(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
2215 {
2216 	int                     error = 0;
2217 	thread_t                thread;
2218 
2219 	/* Validate scope */
2220 	switch (scope) {
2221 	case IOPOL_SCOPE_THREAD:
2222 		thread = current_thread();
2223 		break;
2224 	case IOPOL_SCOPE_PROCESS:
2225 		thread = THREAD_NULL;
2226 		break;
2227 	default:
2228 		error = EINVAL;
2229 		goto out;
2230 	}
2231 
2232 	/* Validate policy */
2233 	if (cmd == IOPOL_CMD_SET) {
2234 		switch (policy) {
2235 		case IOPOL_ATIME_UPDATES_DEFAULT:
2236 		case IOPOL_ATIME_UPDATES_OFF:
2237 			break;
2238 		default:
2239 			error = EINVAL;
2240 			goto out;
2241 		}
2242 	}
2243 
2244 	/* Perform command */
2245 	switch (cmd) {
2246 	case IOPOL_CMD_SET:
2247 		if (thread != THREAD_NULL) {
2248 			set_thread_atime_policy(get_bsdthread_info(thread), policy);
2249 		} else {
2250 			set_task_atime_policy(p, policy);
2251 		}
2252 		break;
2253 	case IOPOL_CMD_GET:
2254 		if (thread != THREAD_NULL) {
2255 			policy = get_thread_atime_policy(get_bsdthread_info(thread));
2256 		} else {
2257 			policy = get_task_atime_policy(p);
2258 		}
2259 		iop_param->iop_policy = policy;
2260 		break;
2261 	default:
2262 		error = EINVAL;         /* unknown command */
2263 		break;
2264 	}
2265 
2266 out:
2267 	return error;
2268 }
2269 
2270 static inline int
get_thread_materialize_policy(struct uthread * ut)2271 get_thread_materialize_policy(struct uthread *ut)
2272 {
2273 	if (ut->uu_flag & UT_NSPACE_NODATALESSFAULTS) {
2274 		return IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
2275 	} else if (ut->uu_flag & UT_NSPACE_FORCEDATALESSFAULTS) {
2276 		return IOPOL_MATERIALIZE_DATALESS_FILES_ON;
2277 	}
2278 	/* Default thread behavior is "inherit process behavior". */
2279 	return IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT;
2280 }
2281 
2282 static inline void
set_thread_materialize_policy(struct uthread * ut,int policy)2283 set_thread_materialize_policy(struct uthread *ut, int policy)
2284 {
2285 	if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_OFF) {
2286 		ut->uu_flag &= ~UT_NSPACE_FORCEDATALESSFAULTS;
2287 		ut->uu_flag |= UT_NSPACE_NODATALESSFAULTS;
2288 	} else if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_ON) {
2289 		ut->uu_flag &= ~UT_NSPACE_NODATALESSFAULTS;
2290 		ut->uu_flag |= UT_NSPACE_FORCEDATALESSFAULTS;
2291 	} else {
2292 		ut->uu_flag &= ~(UT_NSPACE_NODATALESSFAULTS | UT_NSPACE_FORCEDATALESSFAULTS);
2293 	}
2294 }
2295 
2296 static inline void
set_proc_materialize_policy(struct proc * p,int policy)2297 set_proc_materialize_policy(struct proc *p, int policy)
2298 {
2299 	if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT) {
2300 		/*
2301 		 * Caller has specified "use the default policy".
2302 		 * The default policy is to NOT materialize dataless
2303 		 * files.
2304 		 */
2305 		policy = IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
2306 	}
2307 	if (policy == IOPOL_MATERIALIZE_DATALESS_FILES_ON) {
2308 		OSBitOrAtomic16((uint16_t)P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES, &p->p_vfs_iopolicy);
2309 	} else {
2310 		OSBitAndAtomic16(~((uint16_t)P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES), &p->p_vfs_iopolicy);
2311 	}
2312 }
2313 
2314 static int
get_proc_materialize_policy(struct proc * p)2315 get_proc_materialize_policy(struct proc *p)
2316 {
2317 	return (p->p_vfs_iopolicy & P_VFS_IOPOLICY_MATERIALIZE_DATALESS_FILES) ? IOPOL_MATERIALIZE_DATALESS_FILES_ON : IOPOL_MATERIALIZE_DATALESS_FILES_OFF;
2318 }
2319 
2320 int
iopolicysys_vfs_materialize_dataless_files(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2321 iopolicysys_vfs_materialize_dataless_files(struct proc *p __unused, int cmd, int scope, int policy, struct _iopol_param_t *iop_param)
2322 {
2323 	int                     error = 0;
2324 	thread_t                thread;
2325 
2326 	/* Validate scope */
2327 	switch (scope) {
2328 	case IOPOL_SCOPE_THREAD:
2329 		thread = current_thread();
2330 		break;
2331 	case IOPOL_SCOPE_PROCESS:
2332 		thread = THREAD_NULL;
2333 		break;
2334 	default:
2335 		error = EINVAL;
2336 		goto out;
2337 	}
2338 
2339 	/* Validate policy */
2340 	if (cmd == IOPOL_CMD_SET) {
2341 		switch (policy) {
2342 		case IOPOL_MATERIALIZE_DATALESS_FILES_DEFAULT:
2343 		case IOPOL_MATERIALIZE_DATALESS_FILES_OFF:
2344 		case IOPOL_MATERIALIZE_DATALESS_FILES_ON:
2345 			break;
2346 		default:
2347 			error = EINVAL;
2348 			goto out;
2349 		}
2350 	}
2351 
2352 	/* Perform command */
2353 	switch (cmd) {
2354 	case IOPOL_CMD_SET:
2355 		if (thread != THREAD_NULL) {
2356 			set_thread_materialize_policy(get_bsdthread_info(thread), policy);
2357 		} else {
2358 			set_proc_materialize_policy(p, policy);
2359 		}
2360 		break;
2361 	case IOPOL_CMD_GET:
2362 		if (thread != THREAD_NULL) {
2363 			policy = get_thread_materialize_policy(get_bsdthread_info(thread));
2364 		} else {
2365 			policy = get_proc_materialize_policy(p);
2366 		}
2367 		iop_param->iop_policy = policy;
2368 		break;
2369 	default:
2370 		error = EINVAL;         /* unknown command */
2371 		break;
2372 	}
2373 
2374 out:
2375 	return error;
2376 }
2377 
2378 static int
iopolicysys_vfs_statfs_no_data_volume(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2379 iopolicysys_vfs_statfs_no_data_volume(struct proc *p __unused, int cmd,
2380     int scope, int policy, struct _iopol_param_t *iop_param)
2381 {
2382 	int error = 0;
2383 
2384 	/* Validate scope */
2385 	switch (scope) {
2386 	case IOPOL_SCOPE_PROCESS:
2387 		/* Only process OK */
2388 		break;
2389 	default:
2390 		error = EINVAL;
2391 		goto out;
2392 	}
2393 
2394 	/* Validate policy */
2395 	if (cmd == IOPOL_CMD_SET) {
2396 		switch (policy) {
2397 		case IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT:
2398 		/* fall-through */
2399 		case IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME:
2400 			/* These policies are OK */
2401 			break;
2402 		default:
2403 			error = EINVAL;
2404 			goto out;
2405 		}
2406 	}
2407 
2408 	/* Perform command */
2409 	switch (cmd) {
2410 	case IOPOL_CMD_SET:
2411 		if (0 == kauth_cred_issuser(kauth_cred_get())) {
2412 			/* If it's a non-root process, it needs to have the entitlement to set the policy */
2413 			boolean_t entitled = FALSE;
2414 			entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
2415 			if (!entitled) {
2416 				error = EPERM;
2417 				goto out;
2418 			}
2419 		}
2420 
2421 		switch (policy) {
2422 		case IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT:
2423 			OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME), &p->p_vfs_iopolicy);
2424 			break;
2425 		case IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME:
2426 			OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME, &p->p_vfs_iopolicy);
2427 			break;
2428 		default:
2429 			error = EINVAL;
2430 			goto out;
2431 		}
2432 
2433 		break;
2434 	case IOPOL_CMD_GET:
2435 		iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_STATFS_NO_DATA_VOLUME)
2436 		    ? IOPOL_VFS_STATFS_FORCE_NO_DATA_VOLUME
2437 		    : IOPOL_VFS_STATFS_NO_DATA_VOLUME_DEFAULT;
2438 		break;
2439 	default:
2440 		error = EINVAL;         /* unknown command */
2441 		break;
2442 	}
2443 
2444 out:
2445 	return error;
2446 }
2447 
2448 static int
iopolicysys_vfs_trigger_resolve(struct proc * p __unused,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2449 iopolicysys_vfs_trigger_resolve(struct proc *p __unused, int cmd,
2450     int scope, int policy, struct _iopol_param_t *iop_param)
2451 {
2452 	int error = 0;
2453 
2454 	/* Validate scope */
2455 	switch (scope) {
2456 	case IOPOL_SCOPE_PROCESS:
2457 		/* Only process OK */
2458 		break;
2459 	default:
2460 		error = EINVAL;
2461 		goto out;
2462 	}
2463 
2464 	/* Validate policy */
2465 	if (cmd == IOPOL_CMD_SET) {
2466 		switch (policy) {
2467 		case IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT:
2468 		/* fall-through */
2469 		case IOPOL_VFS_TRIGGER_RESOLVE_OFF:
2470 			/* These policies are OK */
2471 			break;
2472 		default:
2473 			error = EINVAL;
2474 			goto out;
2475 		}
2476 	}
2477 
2478 	/* Perform command */
2479 	switch (cmd) {
2480 	case IOPOL_CMD_SET:
2481 		switch (policy) {
2482 		case IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT:
2483 			OSBitAndAtomic16(~((uint32_t)P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE), &p->p_vfs_iopolicy);
2484 			break;
2485 		case IOPOL_VFS_TRIGGER_RESOLVE_OFF:
2486 			OSBitOrAtomic16((uint32_t)P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE, &p->p_vfs_iopolicy);
2487 			break;
2488 		default:
2489 			error = EINVAL;
2490 			goto out;
2491 		}
2492 
2493 		break;
2494 	case IOPOL_CMD_GET:
2495 		iop_param->iop_policy = (p->p_vfs_iopolicy & P_VFS_IOPOLICY_TRIGGER_RESOLVE_DISABLE)
2496 		    ? IOPOL_VFS_TRIGGER_RESOLVE_OFF
2497 		    : IOPOL_VFS_TRIGGER_RESOLVE_DEFAULT;
2498 		break;
2499 	default:
2500 		error = EINVAL;         /* unknown command */
2501 		break;
2502 	}
2503 
2504 out:
2505 	return error;
2506 }
2507 
2508 static int
iopolicysys_vfs_ignore_content_protection(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2509 iopolicysys_vfs_ignore_content_protection(struct proc *p, int cmd, int scope,
2510     int policy, struct _iopol_param_t *iop_param)
2511 {
2512 	int error = 0;
2513 
2514 	/* Validate scope */
2515 	switch (scope) {
2516 	case IOPOL_SCOPE_PROCESS:
2517 		/* Only process OK */
2518 		break;
2519 	default:
2520 		error = EINVAL;
2521 		goto out;
2522 	}
2523 
2524 	/* Validate policy */
2525 	if (cmd == IOPOL_CMD_SET) {
2526 		switch (policy) {
2527 		case IOPOL_VFS_CONTENT_PROTECTION_DEFAULT:
2528 			OS_FALLTHROUGH;
2529 		case IOPOL_VFS_CONTENT_PROTECTION_IGNORE:
2530 			/* These policies are OK */
2531 			break;
2532 		default:
2533 			error = EINVAL;
2534 			goto out;
2535 		}
2536 	}
2537 
2538 	/* Perform command */
2539 	switch (cmd) {
2540 	case IOPOL_CMD_SET:
2541 		if (0 == kauth_cred_issuser(kauth_cred_get())) {
2542 			/* If it's a non-root process, it needs to have the entitlement to set the policy */
2543 			boolean_t entitled = FALSE;
2544 			entitled = IOCurrentTaskHasEntitlement("com.apple.private.iopol.case_sensitivity");
2545 			if (!entitled) {
2546 				error = EPERM;
2547 				goto out;
2548 			}
2549 		}
2550 
2551 		switch (policy) {
2552 		case IOPOL_VFS_CONTENT_PROTECTION_DEFAULT:
2553 			os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION, relaxed);
2554 			break;
2555 		case IOPOL_VFS_CONTENT_PROTECTION_IGNORE:
2556 			os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION, relaxed);
2557 			break;
2558 		default:
2559 			error = EINVAL;
2560 			goto out;
2561 		}
2562 
2563 		break;
2564 	case IOPOL_CMD_GET:
2565 		iop_param->iop_policy = (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_IGNORE_CONTENT_PROTECTION)
2566 		    ? IOPOL_VFS_CONTENT_PROTECTION_IGNORE
2567 		    : IOPOL_VFS_CONTENT_PROTECTION_DEFAULT;
2568 		break;
2569 	default:
2570 		error = EINVAL;         /* unknown command */
2571 		break;
2572 	}
2573 
2574 out:
2575 	return error;
2576 }
2577 
2578 #define AUTHORIZED_ACCESS_ENTITLEMENT \
2579 	"com.apple.private.vfs.authorized-access"
2580 int
iopolicysys_vfs_ignore_node_permissions(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2581 iopolicysys_vfs_ignore_node_permissions(struct proc *p, int cmd, int scope,
2582     int policy, __unused struct _iopol_param_t *iop_param)
2583 {
2584 	int error = EINVAL;
2585 
2586 	switch (scope) {
2587 	case IOPOL_SCOPE_PROCESS:
2588 		break;
2589 	default:
2590 		goto out;
2591 	}
2592 
2593 	switch (cmd) {
2594 	case IOPOL_CMD_GET:
2595 		policy = os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS ?
2596 		    IOPOL_VFS_IGNORE_PERMISSIONS_ON : IOPOL_VFS_IGNORE_PERMISSIONS_OFF;
2597 		iop_param->iop_policy = policy;
2598 		goto out_ok;
2599 	case IOPOL_CMD_SET:
2600 		/* SET is handled after the switch */
2601 		break;
2602 	default:
2603 		goto out;
2604 	}
2605 
2606 	if (!IOCurrentTaskHasEntitlement(AUTHORIZED_ACCESS_ENTITLEMENT)) {
2607 		error = EPERM;
2608 		goto out;
2609 	}
2610 
2611 	switch (policy) {
2612 	case IOPOL_VFS_IGNORE_PERMISSIONS_OFF:
2613 		os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS, relaxed);
2614 		break;
2615 	case IOPOL_VFS_IGNORE_PERMISSIONS_ON:
2616 		os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_IGNORE_NODE_PERMISSIONS, relaxed);
2617 		break;
2618 	default:
2619 		break;
2620 	}
2621 
2622 out_ok:
2623 	error = 0;
2624 out:
2625 	return error;
2626 }
2627 
2628 static inline void
set_thread_skip_mtime_policy(struct uthread * ut,int policy)2629 set_thread_skip_mtime_policy(struct uthread *ut, int policy)
2630 {
2631 	os_atomic_andnot(&ut->uu_flag, UT_SKIP_MTIME_UPDATE |
2632 	    UT_SKIP_MTIME_UPDATE_IGNORE, relaxed);
2633 
2634 	if (policy == IOPOL_VFS_SKIP_MTIME_UPDATE_ON) {
2635 		os_atomic_or(&ut->uu_flag, UT_SKIP_MTIME_UPDATE, relaxed);
2636 	} else if (policy == IOPOL_VFS_SKIP_MTIME_UPDATE_IGNORE) {
2637 		os_atomic_or(&ut->uu_flag, UT_SKIP_MTIME_UPDATE_IGNORE, relaxed);
2638 	}
2639 }
2640 
2641 static inline int
get_thread_skip_mtime_policy(struct uthread * ut)2642 get_thread_skip_mtime_policy(struct uthread *ut)
2643 {
2644 	return (os_atomic_load(&ut->uu_flag, relaxed) & UT_SKIP_MTIME_UPDATE) ?
2645 	       IOPOL_VFS_SKIP_MTIME_UPDATE_ON : IOPOL_VFS_SKIP_MTIME_UPDATE_OFF;
2646 }
2647 
2648 static inline void
set_proc_skip_mtime_policy(struct proc * p,int policy)2649 set_proc_skip_mtime_policy(struct proc *p, int policy)
2650 {
2651 	if (policy == IOPOL_VFS_SKIP_MTIME_UPDATE_ON) {
2652 		os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SKIP_MTIME_UPDATE, relaxed);
2653 	} else {
2654 		os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SKIP_MTIME_UPDATE, relaxed);
2655 	}
2656 }
2657 
2658 static inline int
get_proc_skip_mtime_policy(struct proc * p)2659 get_proc_skip_mtime_policy(struct proc *p)
2660 {
2661 	return (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_SKIP_MTIME_UPDATE) ?
2662 	       IOPOL_VFS_SKIP_MTIME_UPDATE_ON : IOPOL_VFS_SKIP_MTIME_UPDATE_OFF;
2663 }
2664 
2665 #define SKIP_MTIME_UPDATE_ENTITLEMENT \
2666 	"com.apple.private.vfs.skip-mtime-updates"
2667 int
iopolicysys_vfs_skip_mtime_update(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2668 iopolicysys_vfs_skip_mtime_update(struct proc *p, int cmd, int scope,
2669     int policy, __unused struct _iopol_param_t *iop_param)
2670 {
2671 	thread_t thread;
2672 	int error = 0;
2673 
2674 	/* Validate scope */
2675 	switch (scope) {
2676 	case IOPOL_SCOPE_THREAD:
2677 		thread = current_thread();
2678 		break;
2679 	case IOPOL_SCOPE_PROCESS:
2680 		thread = THREAD_NULL;
2681 		break;
2682 	default:
2683 		error = EINVAL;
2684 		goto out;
2685 	}
2686 
2687 	/* Validate policy */
2688 	if (cmd == IOPOL_CMD_SET) {
2689 		switch (policy) {
2690 		case IOPOL_VFS_SKIP_MTIME_UPDATE_ON:
2691 		case IOPOL_VFS_SKIP_MTIME_UPDATE_OFF:
2692 		case IOPOL_VFS_SKIP_MTIME_UPDATE_IGNORE:
2693 			if (!IOCurrentTaskHasEntitlement(SKIP_MTIME_UPDATE_ENTITLEMENT)) {
2694 				error = EPERM;
2695 				goto out;
2696 			}
2697 			break;
2698 		default:
2699 			error = EINVAL;
2700 			goto out;
2701 		}
2702 	}
2703 
2704 	/* Perform command */
2705 	switch (cmd) {
2706 	case IOPOL_CMD_SET:
2707 		if (thread != THREAD_NULL) {
2708 			set_thread_skip_mtime_policy(get_bsdthread_info(thread), policy);
2709 		} else {
2710 			/*
2711 			 * The 'IOPOL_VFS_SKIP_MTIME_UPDATE_IGNORE' policy is only
2712 			 * applicable for thread.
2713 			 */
2714 			if (policy == IOPOL_VFS_SKIP_MTIME_UPDATE_IGNORE) {
2715 				error = EINVAL;
2716 				goto out;
2717 			}
2718 			set_proc_skip_mtime_policy(p, policy);
2719 		}
2720 		break;
2721 	case IOPOL_CMD_GET:
2722 		if (thread != THREAD_NULL) {
2723 			policy = get_thread_skip_mtime_policy(get_bsdthread_info(thread));
2724 		} else {
2725 			policy = get_proc_skip_mtime_policy(p);
2726 		}
2727 		iop_param->iop_policy = policy;
2728 		break;
2729 	default:
2730 		error = EINVAL;         /* unknown command */
2731 		break;
2732 	}
2733 
2734 out:
2735 	return error;
2736 }
2737 
2738 #define ALLOW_LOW_SPACE_WRITES_ENTITLEMENT \
2739 	"com.apple.private.vfs.allow-low-space-writes"
2740 static int
iopolicysys_vfs_allow_lowspace_writes(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2741 iopolicysys_vfs_allow_lowspace_writes(struct proc *p, int cmd, int scope,
2742     int policy, __unused struct _iopol_param_t *iop_param)
2743 {
2744 	int error = EINVAL;
2745 
2746 	switch (scope) {
2747 	case IOPOL_SCOPE_PROCESS:
2748 		break;
2749 	default:
2750 		goto out;
2751 	}
2752 
2753 	switch (cmd) {
2754 	case IOPOL_CMD_GET:
2755 		policy = os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES ?
2756 		    IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_ON : IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_OFF;
2757 		iop_param->iop_policy = policy;
2758 		goto out_ok;
2759 	case IOPOL_CMD_SET:
2760 		break;
2761 	default:
2762 		break;
2763 	}
2764 
2765 	if (!IOCurrentTaskHasEntitlement(ALLOW_LOW_SPACE_WRITES_ENTITLEMENT)) {
2766 		error = EPERM;
2767 		goto out;
2768 	}
2769 
2770 	switch (policy) {
2771 	case IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_OFF:
2772 		os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES, relaxed);
2773 		break;
2774 	case IOPOL_VFS_ALLOW_LOW_SPACE_WRITES_ON:
2775 		os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_ALLOW_LOW_SPACE_WRITES, relaxed);
2776 		break;
2777 	default:
2778 		break;
2779 	}
2780 
2781 out_ok:
2782 	error = 0;
2783 out:
2784 	return error;
2785 }
2786 
2787 #define DISALLOW_RW_FOR_O_EVTONLY_ENTITLEMENT \
2788 	"com.apple.private.vfs.disallow-rw-for-o-evtonly"
2789 
2790 static int
iopolicysys_vfs_disallow_rw_for_o_evtonly(struct proc * p,int cmd,int scope,int policy,__unused struct _iopol_param_t * iop_param)2791 iopolicysys_vfs_disallow_rw_for_o_evtonly(struct proc *p, int cmd, int scope,
2792     int policy, __unused struct _iopol_param_t *iop_param)
2793 {
2794 	int error = EINVAL;
2795 
2796 	switch (scope) {
2797 	case IOPOL_SCOPE_PROCESS:
2798 		break;
2799 	default:
2800 		goto out;
2801 	}
2802 
2803 	switch (cmd) {
2804 	case IOPOL_CMD_GET:
2805 		policy = (os_atomic_load(&p->p_vfs_iopolicy, relaxed) &
2806 		    P_VFS_IOPOLICY_DISALLOW_RW_FOR_O_EVTONLY) ?
2807 		    IOPOL_VFS_DISALLOW_RW_FOR_O_EVTONLY_ON :
2808 		    IOPOL_VFS_DISALLOW_RW_FOR_O_EVTONLY_DEFAULT;
2809 		iop_param->iop_policy = policy;
2810 		goto out_ok;
2811 	case IOPOL_CMD_SET:
2812 		break;
2813 	default:
2814 		goto out;
2815 	}
2816 
2817 	if (!IOCurrentTaskHasEntitlement(DISALLOW_RW_FOR_O_EVTONLY_ENTITLEMENT)) {
2818 		error = EPERM;
2819 		goto out;
2820 	}
2821 
2822 	/* Once set, we don't allow the process to clear it. */
2823 	switch (policy) {
2824 	case IOPOL_VFS_DISALLOW_RW_FOR_O_EVTONLY_ON:
2825 		os_atomic_or(&p->p_vfs_iopolicy,
2826 		    P_VFS_IOPOLICY_DISALLOW_RW_FOR_O_EVTONLY, relaxed);
2827 		break;
2828 	default:
2829 		goto out;
2830 	}
2831 
2832 out_ok:
2833 	error = 0;
2834 out:
2835 	return error;
2836 }
2837 
2838 static int
iopolicysys_vfs_altlink(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2839 iopolicysys_vfs_altlink(struct proc *p, int cmd, int scope, int policy,
2840     struct _iopol_param_t *iop_param)
2841 {
2842 	if (scope != IOPOL_SCOPE_PROCESS) {
2843 		return EINVAL;
2844 	}
2845 
2846 	if (cmd == IOPOL_CMD_GET) {
2847 		policy = (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_ALTLINK) ?
2848 		    IOPOL_VFS_ALTLINK_ENABLED : IOPOL_VFS_ALTLINK_DISABLED;
2849 		iop_param->iop_policy = policy;
2850 		return 0;
2851 	}
2852 
2853 	/* Once set, we don't allow the process to clear it. */
2854 	if (policy == IOPOL_VFS_ALTLINK_ENABLED) {
2855 		os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_ALTLINK, relaxed);
2856 		return 0;
2857 	}
2858 
2859 	return EINVAL;
2860 }
2861 
2862 static int
iopolicysys_vfs_nocache_write_fs_blksize(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2863 iopolicysys_vfs_nocache_write_fs_blksize(struct proc *p, int cmd, int scope, int policy,
2864     struct _iopol_param_t *iop_param)
2865 {
2866 	thread_t thread;
2867 
2868 	switch (scope) {
2869 	case IOPOL_SCOPE_THREAD:
2870 		thread = current_thread();
2871 		break;
2872 	case IOPOL_SCOPE_PROCESS:
2873 		thread = THREAD_NULL;
2874 		break;
2875 	default:
2876 		return EINVAL;
2877 	}
2878 
2879 	if (cmd == IOPOL_CMD_GET) {
2880 		if (thread != THREAD_NULL) {
2881 			struct uthread *ut = get_bsdthread_info(thread);
2882 			policy = ut->uu_flag & UT_FS_BLKSIZE_NOCACHE_WRITES ?
2883 			    IOPOL_VFS_NOCACHE_WRITE_FS_BLKSIZE_ON : IOPOL_VFS_NOCACHE_WRITE_FS_BLKSIZE_DEFAULT;
2884 		} else {
2885 			policy = (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_NOCACHE_WRITE_FS_BLKSIZE) ?
2886 			    IOPOL_VFS_NOCACHE_WRITE_FS_BLKSIZE_ON : IOPOL_VFS_NOCACHE_WRITE_FS_BLKSIZE_DEFAULT;
2887 		}
2888 		iop_param->iop_policy = policy;
2889 		return 0;
2890 	}
2891 
2892 	/* Once set, we don't allow the process or thread to clear it. */
2893 	if ((cmd == IOPOL_CMD_SET) && (policy == IOPOL_VFS_NOCACHE_WRITE_FS_BLKSIZE_ON)) {
2894 		if (thread != THREAD_NULL) {
2895 			struct uthread *ut = get_bsdthread_info(thread);
2896 			ut->uu_flag |= UT_FS_BLKSIZE_NOCACHE_WRITES;
2897 		} else {
2898 			os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_NOCACHE_WRITE_FS_BLKSIZE, relaxed);
2899 		}
2900 		return 0;
2901 	}
2902 
2903 	return EINVAL;
2904 }
2905 
2906 static inline void
set_thread_support_long_paths(struct uthread * ut,int policy)2907 set_thread_support_long_paths(struct uthread *ut, int policy)
2908 {
2909 	if (policy == IOPOL_VFS_SUPPORT_LONG_PATHS_ON) {
2910 		os_atomic_or(&ut->uu_flag, UT_SUPPORT_LONG_PATHS, relaxed);
2911 	} else {
2912 		os_atomic_andnot(&ut->uu_flag, UT_SUPPORT_LONG_PATHS, relaxed);
2913 	}
2914 }
2915 
2916 static inline int
get_thread_support_long_paths(struct uthread * ut)2917 get_thread_support_long_paths(struct uthread *ut)
2918 {
2919 	return (os_atomic_load(&ut->uu_flag, relaxed) & UT_SUPPORT_LONG_PATHS) ?
2920 	       IOPOL_VFS_SUPPORT_LONG_PATHS_ON : IOPOL_VFS_SUPPORT_LONG_PATHS_DEFAULT;
2921 }
2922 
2923 static inline void
set_proc_support_long_paths(struct proc * p,int policy)2924 set_proc_support_long_paths(struct proc *p, int policy)
2925 {
2926 	if (policy == IOPOL_VFS_SUPPORT_LONG_PATHS_ON) {
2927 		os_atomic_or(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SUPPORT_LONG_PATHS, relaxed);
2928 	} else {
2929 		os_atomic_andnot(&p->p_vfs_iopolicy, P_VFS_IOPOLICY_SUPPORT_LONG_PATHS, relaxed);
2930 	}
2931 }
2932 
2933 static inline int
get_proc_support_long_paths(struct proc * p)2934 get_proc_support_long_paths(struct proc *p)
2935 {
2936 	return (os_atomic_load(&p->p_vfs_iopolicy, relaxed) & P_VFS_IOPOLICY_SUPPORT_LONG_PATHS) ?
2937 	       IOPOL_VFS_SUPPORT_LONG_PATHS_ON : IOPOL_VFS_SUPPORT_LONG_PATHS_DEFAULT;
2938 }
2939 
2940 #define SUPPORT_LONG_PATHS_ENTITLEMENT \
2941 	"com.apple.private.vfs.support-long-paths"
2942 
2943 static int
iopolicysys_vfs_support_long_paths(struct proc * p,int cmd,int scope,int policy,struct _iopol_param_t * iop_param)2944 iopolicysys_vfs_support_long_paths(struct proc *p, int cmd, int scope,
2945     int policy, struct _iopol_param_t *iop_param)
2946 {
2947 	thread_t thread;
2948 	int error = 0;
2949 
2950 	/* Validate scope */
2951 	switch (scope) {
2952 	case IOPOL_SCOPE_THREAD:
2953 		thread = current_thread();
2954 		break;
2955 	case IOPOL_SCOPE_PROCESS:
2956 		thread = THREAD_NULL;
2957 		break;
2958 	default:
2959 		error = EINVAL;
2960 		goto out;
2961 	}
2962 
2963 	/* Validate policy */
2964 	if (cmd == IOPOL_CMD_SET) {
2965 		switch (policy) {
2966 		case IOPOL_VFS_SUPPORT_LONG_PATHS_DEFAULT:
2967 		case IOPOL_VFS_SUPPORT_LONG_PATHS_ON:
2968 			if (!IOCurrentTaskHasEntitlement(SUPPORT_LONG_PATHS_ENTITLEMENT)) {
2969 				error = EPERM;
2970 				goto out;
2971 			}
2972 			break;
2973 		default:
2974 			error = EINVAL;
2975 			goto out;
2976 		}
2977 	}
2978 
2979 	/* Perform command */
2980 	switch (cmd) {
2981 	case IOPOL_CMD_SET:
2982 		if (thread != THREAD_NULL) {
2983 			set_thread_support_long_paths(get_bsdthread_info(thread), policy);
2984 		} else {
2985 			set_proc_support_long_paths(p, policy);
2986 		}
2987 		break;
2988 	case IOPOL_CMD_GET:
2989 		if (thread != THREAD_NULL) {
2990 			policy = get_thread_support_long_paths(get_bsdthread_info(thread));
2991 		} else {
2992 			policy = get_proc_support_long_paths(p);
2993 		}
2994 		iop_param->iop_policy = policy;
2995 		break;
2996 	default:
2997 		error = EINVAL;         /* unknown command */
2998 		break;
2999 	}
3000 
3001 out:
3002 	return error;
3003 }
3004 
3005 void
proc_apply_task_networkbg(int pid,thread_t thread)3006 proc_apply_task_networkbg(int pid, thread_t thread)
3007 {
3008 	proc_t p = proc_find(pid);
3009 
3010 	if (p != PROC_NULL) {
3011 		do_background_socket(p, thread);
3012 		proc_rele(p);
3013 	}
3014 }
3015 
3016 void
gather_rusage_info(proc_t p,rusage_info_current * ru,int flavor)3017 gather_rusage_info(proc_t p, rusage_info_current *ru, int flavor)
3018 {
3019 	struct rusage_info_child *ri_child;
3020 
3021 	assert(p->p_stats != NULL);
3022 	memset(ru, 0, sizeof(*ru));
3023 	switch (flavor) {
3024 	case RUSAGE_INFO_V6:
3025 		ru->ri_neural_footprint = get_task_neural_nofootprint_total(proc_task(p));
3026 		ru->ri_lifetime_max_neural_footprint = get_task_neural_nofootprint_total_lifetime_max(proc_task(p));
3027 #if CONFIG_LEDGER_INTERVAL_MAX
3028 		ru->ri_interval_max_neural_footprint = get_task_neural_nofootprint_total_interval_max(proc_task(p), FALSE);
3029 #endif
3030 		/* Any P-specific resource counters are captured in fill_task_rusage. */
3031 		OS_FALLTHROUGH;
3032 
3033 	case RUSAGE_INFO_V5:
3034 #if __has_feature(ptrauth_calls)
3035 		if (vm_shared_region_is_reslide(proc_task(p))) {
3036 			ru->ri_flags |= RU_PROC_RUNS_RESLIDE;
3037 		}
3038 #endif /* __has_feature(ptrauth_calls) */
3039 		OS_FALLTHROUGH;
3040 
3041 	case RUSAGE_INFO_V4:
3042 		ru->ri_logical_writes = get_task_logical_writes(proc_task(p), false);
3043 		ru->ri_lifetime_max_phys_footprint = get_task_phys_footprint_lifetime_max(proc_task(p));
3044 #if CONFIG_LEDGER_INTERVAL_MAX
3045 		ru->ri_interval_max_phys_footprint = get_task_phys_footprint_interval_max(proc_task(p), FALSE);
3046 #endif
3047 		OS_FALLTHROUGH;
3048 
3049 	case RUSAGE_INFO_V3:
3050 		fill_task_qos_rusage(proc_task(p), ru);
3051 		fill_task_billed_usage(proc_task(p), ru);
3052 		OS_FALLTHROUGH;
3053 
3054 	case RUSAGE_INFO_V2:
3055 		fill_task_io_rusage(proc_task(p), ru);
3056 		OS_FALLTHROUGH;
3057 
3058 	case RUSAGE_INFO_V1:
3059 		/*
3060 		 * p->p_stats->ri_child statistics are protected under proc lock.
3061 		 */
3062 		proc_lock(p);
3063 
3064 		ri_child = &(p->p_stats->ri_child);
3065 		ru->ri_child_user_time = ri_child->ri_child_user_time;
3066 		ru->ri_child_system_time = ri_child->ri_child_system_time;
3067 		ru->ri_child_pkg_idle_wkups = ri_child->ri_child_pkg_idle_wkups;
3068 		ru->ri_child_interrupt_wkups = ri_child->ri_child_interrupt_wkups;
3069 		ru->ri_child_pageins = ri_child->ri_child_pageins;
3070 		ru->ri_child_elapsed_abstime = ri_child->ri_child_elapsed_abstime;
3071 
3072 		proc_unlock(p);
3073 		OS_FALLTHROUGH;
3074 
3075 	case RUSAGE_INFO_V0:
3076 		proc_getexecutableuuid(p, (unsigned char *)&ru->ri_uuid, sizeof(ru->ri_uuid));
3077 		fill_task_rusage(proc_task(p), ru);
3078 		ru->ri_proc_start_abstime = p->p_stats->ps_start;
3079 	}
3080 }
3081 
3082 int
proc_get_rusage(proc_t p,int flavor,user_addr_t buffer,__unused int is_zombie)3083 proc_get_rusage(proc_t p, int flavor, user_addr_t buffer, __unused int is_zombie)
3084 {
3085 	rusage_info_current ri_current = {};
3086 
3087 	size_t size = 0;
3088 
3089 	switch (flavor) {
3090 	case RUSAGE_INFO_V0:
3091 		size = sizeof(struct rusage_info_v0);
3092 		break;
3093 
3094 	case RUSAGE_INFO_V1:
3095 		size = sizeof(struct rusage_info_v1);
3096 		break;
3097 
3098 	case RUSAGE_INFO_V2:
3099 		size = sizeof(struct rusage_info_v2);
3100 		break;
3101 
3102 	case RUSAGE_INFO_V3:
3103 		size = sizeof(struct rusage_info_v3);
3104 		break;
3105 
3106 	case RUSAGE_INFO_V4:
3107 		size = sizeof(struct rusage_info_v4);
3108 		break;
3109 
3110 	case RUSAGE_INFO_V5:
3111 		size = sizeof(struct rusage_info_v5);
3112 		break;
3113 
3114 	case RUSAGE_INFO_V6:
3115 		size = sizeof(struct rusage_info_v6);
3116 		break;
3117 	default:
3118 		return EINVAL;
3119 	}
3120 
3121 	if (size == 0) {
3122 		return EINVAL;
3123 	}
3124 
3125 	/*
3126 	 * If task is still alive, collect info from the live task itself.
3127 	 * Otherwise, look to the cached info in the zombie proc.
3128 	 */
3129 	if (p->p_ru) {
3130 		return copyout(&p->p_ru->ri, buffer, size);
3131 	} else {
3132 		gather_rusage_info(p, &ri_current, flavor);
3133 		ri_current.ri_proc_exit_abstime = 0;
3134 		return copyout(&ri_current, buffer, size);
3135 	}
3136 }
3137 
3138 static int
mach_to_bsd_rv(int mach_rv)3139 mach_to_bsd_rv(int mach_rv)
3140 {
3141 	int bsd_rv = 0;
3142 
3143 	switch (mach_rv) {
3144 	case KERN_SUCCESS:
3145 		bsd_rv = 0;
3146 		break;
3147 	case KERN_INVALID_ARGUMENT:
3148 		bsd_rv = EINVAL;
3149 		break;
3150 	default:
3151 		panic("unknown error %#x", mach_rv);
3152 	}
3153 
3154 	return bsd_rv;
3155 }
3156 
3157 /*
3158  * Resource limit controls
3159  *
3160  * uap->flavor available flavors:
3161  *
3162  *     RLIMIT_WAKEUPS_MONITOR
3163  *     RLIMIT_CPU_USAGE_MONITOR
3164  *     RLIMIT_THREAD_CPULIMITS
3165  *     RLIMIT_FOOTPRINT_INTERVAL
3166  */
3167 int
proc_rlimit_control(__unused struct proc * p,struct proc_rlimit_control_args * uap,__unused int32_t * retval)3168 proc_rlimit_control(__unused struct proc *p, struct proc_rlimit_control_args *uap, __unused int32_t *retval)
3169 {
3170 	proc_t  targetp;
3171 	int     error = 0;
3172 	uint32_t cpumon_flags;
3173 	uint32_t cpulimits_flags;
3174 	kauth_cred_t my_cred, target_cred;
3175 #if CONFIG_LEDGER_INTERVAL_MAX
3176 	uint32_t footprint_interval_flags;
3177 	uint64_t interval_max_footprint;
3178 #endif /* CONFIG_LEDGER_INTERVAL_MAX */
3179 
3180 	/* -1 implicitly means our own process (perhaps even the current thread for per-thread attributes) */
3181 	if (uap->pid == -1) {
3182 		targetp = proc_self();
3183 	} else {
3184 		targetp = proc_find(uap->pid);
3185 	}
3186 
3187 	/* proc_self() can return NULL for an exiting process */
3188 	if (targetp == PROC_NULL) {
3189 		return ESRCH;
3190 	}
3191 
3192 	my_cred = kauth_cred_get();
3193 	target_cred = kauth_cred_proc_ref(targetp);
3194 
3195 	if (!kauth_cred_issuser(my_cred) && kauth_cred_getruid(my_cred) &&
3196 	    kauth_cred_getuid(my_cred) != kauth_cred_getuid(target_cred) &&
3197 	    kauth_cred_getruid(my_cred) != kauth_cred_getuid(target_cred)) {
3198 		proc_rele(targetp);
3199 		kauth_cred_unref(&target_cred);
3200 		return EACCES;
3201 	}
3202 
3203 	switch (uap->flavor) {
3204 	case RLIMIT_WAKEUPS_MONITOR:
3205 		// Ignore requests silently here, no longer supported.
3206 		error = 0;
3207 		break;
3208 	case RLIMIT_CPU_USAGE_MONITOR:
3209 		cpumon_flags = (uint32_t)uap->arg; // XXX temporarily stashing flags in argp (12592127)
3210 		error = mach_to_bsd_rv(task_cpu_usage_monitor_ctl(proc_task(targetp), &cpumon_flags));
3211 		break;
3212 	case RLIMIT_THREAD_CPULIMITS:
3213 		cpulimits_flags = (uint32_t)uap->arg; // only need a limited set of bits, pass in void * argument
3214 
3215 		if (uap->pid != -1) {
3216 			error = EINVAL;
3217 			break;
3218 		}
3219 
3220 		uint8_t percent = 0;
3221 		uint32_t ms_refill = 0;
3222 		uint64_t ns_refill;
3223 
3224 		percent = (uint8_t)(cpulimits_flags & 0xffU);           /* low 8 bits for percent */
3225 		ms_refill = (cpulimits_flags >> 8) & 0xffffff;          /* next 24 bits represent ms refill value */
3226 		if (percent >= 100 || percent == 0) {
3227 			error = EINVAL;
3228 			break;
3229 		}
3230 
3231 		ns_refill = ((uint64_t)ms_refill) * NSEC_PER_MSEC;
3232 
3233 		error = mach_to_bsd_rv(thread_set_cpulimit(THREAD_CPULIMIT_BLOCK, percent, ns_refill));
3234 		break;
3235 
3236 #if CONFIG_LEDGER_INTERVAL_MAX
3237 	case RLIMIT_FOOTPRINT_INTERVAL:
3238 		footprint_interval_flags = (uint32_t)uap->arg; // XXX temporarily stashing flags in argp (12592127)
3239 		/*
3240 		 * There is currently only one option for this flavor.
3241 		 */
3242 		if ((footprint_interval_flags & FOOTPRINT_INTERVAL_RESET) == 0) {
3243 			error = EINVAL;
3244 			break;
3245 		}
3246 		interval_max_footprint = get_task_phys_footprint_interval_max(proc_task(targetp), TRUE);
3247 		interval_max_footprint = get_task_neural_nofootprint_total_interval_max(proc_task(targetp), TRUE);
3248 		break;
3249 
3250 #endif /* CONFIG_LEDGER_INTERVAL_MAX */
3251 	default:
3252 		error = EINVAL;
3253 		break;
3254 	}
3255 
3256 	proc_rele(targetp);
3257 	kauth_cred_unref(&target_cred);
3258 
3259 	/*
3260 	 * Return value from this function becomes errno to userland caller.
3261 	 */
3262 	return error;
3263 }
3264 
3265 /*
3266  * Return the current amount of CPU consumed by this thread (in either user or kernel mode)
3267  */
3268 int
thread_selfusage(struct proc * p __unused,struct thread_selfusage_args * uap __unused,uint64_t * retval)3269 thread_selfusage(struct proc *p __unused, struct thread_selfusage_args *uap __unused, uint64_t *retval)
3270 {
3271 	uint64_t runtime;
3272 
3273 	runtime = thread_get_runtime_self();
3274 	*retval = runtime;
3275 
3276 	return 0;
3277 }
3278