1 /* 2 * Copyright (c) 2023 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #include <darwintest.h> 30 31 #include <fcntl.h> 32 #include <stdlib.h> 33 #include <spawn.h> 34 #include <string.h> 35 #include <unistd.h> 36 #include <sys/codesign.h> 37 #include <sys/mman.h> 38 #include <sys/stat.h> 39 #include <sys/wait.h> 40 41 T_GLOBAL_META( 42 T_META_NAMESPACE("xnu.vm"), 43 T_META_RADAR_COMPONENT_NAME("xnu"), 44 T_META_RADAR_COMPONENT_VERSION("VM")); 45 46 T_DECL(vm_tainted_executable, "Test that a tainted executable gets killed", 47 T_META_TAG_VM_PREFERRED, 48 T_META_IGNORECRASHES(".*hell0.*")) 49 { 50 char tmp_path[] = "/tmp/hell0-XXXXXX"; 51 int fd1, fd2; 52 struct stat fs; 53 char *mapaddr1; 54 size_t fsize; 55 char *big_sp, *big_cp, *big_ep, *little_cp; 56 size_t little_len; 57 char *child_argv[2]; 58 pid_t child_pid; 59 int child_status; 60 int cs_status; 61 62 T_SETUPBEGIN; 63 /* copy "./hello" to "/tmp/hell0" */ 64 fd1 = open("./hello", O_RDONLY); 65 T_QUIET; T_ASSERT_POSIX_SUCCESS(fd1, "open(./hello)"); 66 fd2 = mkstemp(tmp_path); 67 T_QUIET; T_ASSERT_POSIX_SUCCESS(fd2, "mkstemp(%s)", tmp_path); 68 T_QUIET; T_ASSERT_POSIX_SUCCESS(fstat(fd1, &fs), NULL); 69 fsize = (size_t)fs.st_size; 70 mapaddr1 = mmap(NULL, fsize, PROT_READ, MAP_FILE | MAP_PRIVATE, fd1, 0); 71 T_QUIET; T_ASSERT_NOTNULL(mapaddr1, NULL); 72 T_QUIET; T_ASSERT_POSIX_SUCCESS(write(fd2, mapaddr1, fsize), NULL); 73 /* change "hello, world!" to "hell0, world!" */ 74 big_sp = &mapaddr1[0]; /* start pointer in "big" byte string */ 75 big_ep = &mapaddr1[fsize]; /* end pointer in "big" byte string */ 76 little_cp = "hello, world!"; /* little byte string */ 77 little_len = strlen(little_cp); /* length of little byte string */ 78 big_cp = big_sp; /* start pointer in "big" byte string */ 79 for (;;) { 80 char zero = '0'; 81 big_cp = memmem(big_cp, (size_t)(big_ep - big_cp), 82 little_cp, little_len); 83 if (big_cp == NULL) { 84 break; 85 } 86 T_LOG("found string at offset 0x%llx", (off_t) (big_cp - big_sp)); 87 T_QUIET; T_ASSERT_POSIX_SUCCESS(pwrite(fd2, &zero, 1, 88 (big_cp - big_sp + 4)), NULL); 89 big_cp += little_len; 90 } 91 /* make the new binary "r-x" */ 92 T_QUIET; T_ASSERT_POSIX_SUCCESS(fchmod(fd2, S_IRUSR | S_IXUSR), NULL); 93 /* cleanup */ 94 T_QUIET; T_ASSERT_POSIX_SUCCESS(close(fd1), NULL); 95 T_QUIET; T_ASSERT_POSIX_SUCCESS(close(fd2), NULL); 96 T_QUIET; T_ASSERT_POSIX_SUCCESS(munmap(mapaddr1, fsize), NULL); 97 T_SETUPEND; 98 /* spawn the newly-tainted binary */ 99 T_LOG("launching '%s'", tmp_path); 100 child_argv[0] = tmp_path; 101 child_argv[1] = NULL; 102 T_QUIET; T_ASSERT_POSIX_SUCCESS(posix_spawn(&child_pid, tmp_path, NULL, NULL, child_argv, NULL), NULL); 103 /* check our code-signing policy, assuming the child has same policy */ 104 T_QUIET; T_ASSERT_POSIX_SUCCESS(csops(getpid(), CS_OPS_STATUS, &cs_status, sizeof(cs_status)), NULL); 105 T_LOG("parent %d cs status 0x%x CS_KILL:%s", getpid(), cs_status, 106 (cs_status & CS_KILL) ? "yes" : "no"); 107 /* get child's exit status */ 108 T_QUIET; T_ASSERT_POSIX_SUCCESS(waitpid(child_pid, &child_status, 0), NULL); 109 T_LOG("child %d exit status 0x%x", child_pid, child_status); 110 /* we no longer need our modified binary */ 111 T_QUIET; T_ASSERT_POSIX_SUCCESS(unlink(tmp_path), NULL); 112 if (cs_status & CS_KILL) { 113 /* check that child got SIGKILL */ 114 T_QUIET; T_ASSERT_TRUE(WIFSIGNALED(child_status), NULL); 115 T_QUIET; T_ASSERT_TRUE(WTERMSIG(child_status) == SIGKILL, NULL); 116 T_PASS("enforced process launched from modified binary got SIGKILL"); 117 } else { 118 /* check that child exited with 0 */ 119 T_QUIET; T_ASSERT_TRUE(WIFEXITED(child_status), NULL); 120 T_QUIET; T_ASSERT_TRUE(WEXITSTATUS(child_status) == 0, NULL); 121 T_PASS("non-enforced process launched from modified binary exited with 0"); 122 } 123 } 124