1 /* 2 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SYS_CODESIGN_H_ 30 #define _SYS_CODESIGN_H_ 31 32 #include <kern/cs_blobs.h> 33 34 /* MAC flags used by F_ADDFILESIGS_* */ 35 #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ 36 37 #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" 38 #define OVERRIDE_PLUGIN_HOST_ENTITLEMENT "com.apple.private.security.override-plugin-host-detection" 39 40 /* csops operations */ 41 #define CS_OPS_STATUS 0 /* return status */ 42 #define CS_OPS_MARKINVALID 1 /* invalidate process */ 43 #define CS_OPS_MARKHARD 2 /* set HARD flag */ 44 #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ 45 #ifdef KERNEL_PRIVATE 46 /* CS_OPS_PIDPATH 4 */ 47 #endif 48 #define CS_OPS_CDHASH 5 /* get code directory hash */ 49 #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ 50 #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ 51 #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ 52 #define CS_OPS_SET_STATUS 9 /* set codesign flags */ 53 #define CS_OPS_BLOB 10 /* get codesign blob */ 54 #define CS_OPS_IDENTITY 11 /* get codesign identity */ 55 #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ 56 #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ 57 #define CS_OPS_TEAMID 14 /* get team id */ 58 #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ 59 #define CS_OPS_DER_ENTITLEMENTS_BLOB 16 /* get der entitlements blob */ 60 #define CS_OPS_VALIDATION_CATEGORY 17 /* get process validation category */ 61 #define CS_OPS_CDHASH_WITH_INFO 18 /* get code directory hash with info */ 62 63 #define CS_MAX_TEAMID_LEN 64 64 65 #ifndef KERNEL 66 67 #include <sys/types.h> 68 #include <mach/message.h> 69 70 __BEGIN_DECLS 71 /* code sign operations */ 72 int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); 73 int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); 74 __END_DECLS 75 76 #else /* !KERNEL */ 77 78 #include <mach/machine.h> 79 #include <mach/vm_types.h> 80 81 #include <sys/cdefs.h> 82 #include <sys/_types/_off_t.h> 83 84 struct vnode; 85 struct cs_blob; 86 struct fileglob; 87 88 __BEGIN_DECLS 89 int cs_valid(struct proc *); 90 int cs_process_enforcement(struct proc *); 91 int cs_process_global_enforcement(void); 92 int cs_system_enforcement(void); 93 int cs_vm_supports_4k_translations(void); 94 int cs_require_lv(struct proc *); 95 int csproc_forced_lv(struct proc* p); 96 int cs_system_require_lv(void); 97 uint32_t cs_entitlement_flags(struct proc *p); 98 int cs_entitlements_blob_get_vnode(struct vnode *, off_t, void **, size_t *); 99 int cs_entitlements_dictionary_copy_vnode(struct vnode *, off_t, void **); 100 int cs_entitlements_blob_get(struct proc *, void **, size_t *); 101 #ifdef KERNEL_PRIVATE 102 int cs_entitlements_dictionary_copy(struct proc *, void **); 103 #endif 104 int cs_restricted(struct proc *); 105 uint8_t *__counted_by_or_null(CS_CDHASH_LEN) cs_get_cdhash(struct proc *); 106 cs_launch_type_t launch_constraint_data_get_launch_type(launch_constraint_data_t lcd); 107 108 struct cs_blob * csproc_get_blob(struct proc *); 109 struct cs_blob * csvnode_get_blob(struct vnode *, off_t); 110 void csvnode_print_debug(struct vnode *); 111 112 off_t csblob_get_base_offset(struct cs_blob *); 113 vm_size_t csblob_get_size(struct cs_blob *); 114 vm_address_t csblob_get_addr(struct cs_blob *); 115 const char * csblob_get_teamid(struct cs_blob *); 116 const char * csblob_get_identity(struct cs_blob *); 117 const uint8_t * csblob_get_cdhash(struct cs_blob *); 118 const CS_CodeDirectory* csblob_get_code_directory(struct cs_blob *csblob); 119 int csblob_get_platform_binary(struct cs_blob *); 120 void csblob_invalidate_flags(struct cs_blob *blob); 121 void csvnode_invalidate_flags(struct vnode * vp); 122 unsigned int csblob_get_flags(struct cs_blob *); 123 uint8_t csblob_get_hashtype(struct cs_blob const *); 124 unsigned int csblob_get_signer_type(struct cs_blob *); 125 #if DEVELOPMENT || DEBUG 126 void csproc_clear_platform_binary(struct proc *); 127 #endif 128 129 #define XNU_CSBLOB_HAS_VALIDATION_CATEGORY 1 130 int csblob_set_validation_category(struct cs_blob *, unsigned int); 131 unsigned int csblob_get_validation_category(struct cs_blob *); 132 133 #define XNU_CSBLOB_HAS_AUXILIARY_INFO 1 134 int csblob_set_auxiliary_info(struct cs_blob *, uint64_t); 135 uint64_t csblob_get_auxiliary_info(struct cs_blob *); 136 137 #define XNU_CSBLOB_HAS_TRUST_LEVEL 1 138 uint32_t csblob_get_trust_level(struct cs_blob *); 139 140 #include <uuid/uuid.h> 141 #define XNU_SUPPORTS_PROVISIONING_PROFILE_UUID 1 142 int csblob_register_profile_uuid(struct cs_blob *, const uuid_t, void*, vm_size_t); 143 144 void csproc_disable_enforcement(struct proc* p); 145 void csproc_mark_invalid_allowed(struct proc* p); 146 int csproc_check_invalid_allowed(struct proc* p); 147 int csproc_hardened_runtime(struct proc* p); 148 149 int csblob_get_entitlements(struct cs_blob *, void **, size_t *); 150 int csblob_get_der_entitlements(struct cs_blob *, const CS_GenericBlob **, size_t *); 151 #define XNU_HAS_GET_DER_ENTITLEMENTS_UNSAFE 1 152 const CS_GenericBlob* csblob_get_der_entitlements_unsafe(struct cs_blob *); 153 154 const CS_GenericBlob * 155 csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); 156 const CS_GenericBlob * 157 csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); 158 void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); 159 void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); 160 161 // New APIs 162 void csblob_os_entitlements_set(struct cs_blob *csblob, void * entitlements); 163 void * csblob_os_entitlements_copy(struct cs_blob *csblob); 164 void * csblob_os_entitlements_get(struct cs_blob *csblob); 165 void * csblob_get_storage_addr(struct cs_blob *csblob); 166 /* 167 * Mostly convenience functions below 168 */ 169 170 const char * csproc_get_teamid(struct proc *); 171 const char * csproc_get_identity(struct proc *); 172 const char * csvnode_get_teamid(struct vnode *, off_t); 173 int csproc_get_platform_binary(struct proc *); 174 int csproc_get_prod_signed(struct proc *); 175 const char * csfg_get_teamid(struct fileglob *); 176 const char * csfg_get_supplement_teamid(struct fileglob *); 177 int csfg_get_path(struct fileglob *, char *, int *); 178 int csfg_get_platform_binary(struct fileglob *); 179 int csfg_get_supplement_platform_binary(struct fileglob *); 180 uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); 181 uint8_t * csfg_get_supplement_cdhash(struct fileglob *, uint64_t, size_t *); 182 const uint8_t * csfg_get_supplement_linkage_cdhash(struct fileglob *, uint64_t, size_t *); 183 int csfg_get_prod_signed(struct fileglob *); 184 int csfg_get_supplement_prod_signed(struct fileglob *fg); 185 unsigned int csfg_get_signer_type(struct fileglob *); 186 unsigned int csfg_get_supplement_signer_type(struct fileglob *); 187 unsigned int csfg_get_validation_category(struct fileglob *fg, uint64_t offset); 188 unsigned int csfg_get_supplement_validation_category(struct fileglob *fg, uint64_t offset); 189 const char *csfg_get_identity(struct fileglob *fg, off_t offset); 190 unsigned int csproc_get_signer_type(struct proc *); 191 192 uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); 193 uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); 194 uint8_t csproc_get_platform_identifier(struct proc *); 195 196 struct cs_blob* csfg_get_csblob(struct fileglob*, uint64_t); 197 struct cs_blob* csfg_get_supplement_csblob(struct fileglob*, uint64_t); 198 199 extern int cs_debug; 200 extern int cs_debug_fail_on_unsigned_code; 201 extern unsigned int cs_debug_unsigned_exec_failures; 202 extern unsigned int cs_debug_unsigned_mmap_failures; 203 204 int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, 205 struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); 206 207 void cs_blob_free(struct cs_blob *blob); 208 209 #ifdef XNU_KERNEL_PRIVATE 210 211 int cs_allow_invalid(struct proc *); 212 int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); 213 void cs_process_invalidated(struct proc *); 214 int csproc_get_platform_path(struct proc *); 215 int csproc_get_validation_category(struct proc *, unsigned int *); 216 217 #if !SECURE_KERNEL 218 extern int cs_enforcement_panic; 219 #endif 220 221 #endif /* XNU_KERNEL_PRIVATE */ 222 223 __END_DECLS 224 225 #endif /* KERNEL */ 226 227 #endif /* _SYS_CODESIGN_H_ */ 228