xref: /xnu-12377.1.9/tests/reply_port_defense.c (revision f6217f891ac0bb64f3d375211650a4c1ff8ca1ea)
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <unistd.h>
4 #include <darwintest.h>
5 #include <spawn.h>
6 #include <mach/mach.h>
7 #include <sys/sysctl.h>
8 #include <sys/csr.h>
9 #include <signal.h>
10 #include "excserver_protect_state.h"
11 #include "../osfmk/mach/port.h"
12 #include "../osfmk/kern/exc_guard.h"
13 #include "exc_helpers.h"
14 #include <sys/code_signing.h>
15 #include "cs_helpers.h"
16 #include <TargetConditionals.h>
17 
18 #define MAX_ARGV 3
19 
20 extern char **environ;
21 static mach_exception_data_type_t received_exception_code = 0;
22 static exception_type_t exception_taken = 0;
23 
24 /*
25  * This test infrastructure is inspired from imm_pinned_control_port.c.
26  * It verifies no reply port security semantics are violated.
27  *
28  * 1. The rcv right of the port would be marked immovable.
29  */
30 T_GLOBAL_META(
31 	T_META_NAMESPACE("xnu.ipc"),
32 	T_META_RADAR_COMPONENT_NAME("xnu"),
33 	T_META_RADAR_COMPONENT_VERSION("IPC"),
34 	T_META_TIMEOUT(10),
35 	T_META_RUN_CONCURRENTLY(TRUE));
36 
37 static bool
check_current_cs_flags(code_signing_config_t expected_cs_config)38 check_current_cs_flags(code_signing_config_t expected_cs_config)
39 {
40 	code_signing_config_t cur_cs_config = 0;
41 	size_t cs_config_size = sizeof(cur_cs_config);
42 	sysctlbyname("security.codesigning.config", &cur_cs_config, &cs_config_size, NULL, 0);
43 	return cur_cs_config & expected_cs_config;
44 }
45 
46 static bool
unrestricted_debugging()47 unrestricted_debugging()
48 {
49 	/* AMFI often disables security features if debugging is unrestricted */
50 	bool unrestricted_debugging = check_current_cs_flags(CS_CONFIG_UNRESTRICTED_DEBUGGING);
51 	if (unrestricted_debugging) {
52 		T_LOG("UNRESTRICTED DEBUGGING");
53 	}
54 	return unrestricted_debugging;
55 }
56 
57 static bool
sip_disabled()58 sip_disabled()
59 {
60 #if XNU_TARGET_OS_OSX || XNU_TARGET_OS_BRIDGE
61 	/* SIP can only be disabled on macOS */
62 	bool sip_disabled = csr_check(CSR_ALLOW_UNRESTRICTED_FS) != 0;
63 	if (sip_disabled) {
64 		T_LOG("SIP DISABLED");
65 	}
66 	return sip_disabled;
67 #else
68 	return false;
69 #endif
70 }
71 
72 static bool
ipc_hardening_disabled()73 ipc_hardening_disabled()
74 {
75 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
76 	/*
77 	 * CS_CONFIG_GET_OUT_OF_MY_WAY (enabled via AMFI boot-args)
78 	 * disables IPC security features. This boot-arg previously
79 	 * caused a headache for developers on macos, who frequently use it for
80 	 * testing purposes, because all of their 3rd party apps will
81 	 * crash due to being treated as platform code. Unfortunately
82 	 * BATS runs with this boot-arg enabled very frequently.
83 	 */
84 	bool enforcement_disabled = check_current_cs_flags(CS_CONFIG_GET_OUT_OF_MY_WAY);
85 	if (enforcement_disabled) {
86 		T_LOG("IPC HARDENING ENFORCEMENT IS DISABLED");
87 	} else {
88 		T_LOG("IPC HARDENING ENABLED");
89 	}
90 	return enforcement_disabled;
91 #else /* TARGET_OS_OSX || TARGET_OS_BRIDGE */
92 	/* mach hardening is only disabled by boot-args on macOS */
93 	return false;
94 #endif
95 }
96 
97 static bool
is_release_kernel()98 is_release_kernel()
99 {
100 	int kernel_type = 0;
101 	size_t kernel_type_size = sizeof(kernel_type);
102 	int r;
103 	r = sysctlbyname("kern.development", &kernel_type, &kernel_type_size, NULL, 0);
104 	if (r < 0) {
105 		T_WITH_ERRNO;
106 		T_SKIP("could not find \"kern.development\" sysctl");
107 	}
108 	return kernel_type == 0;
109 }
110 
111 
112 
113 static mach_port_t
alloc_exception_port(void)114 alloc_exception_port(void)
115 {
116 	kern_return_t kret;
117 	mach_port_t exc_port = MACH_PORT_NULL;
118 	mach_port_t task = mach_task_self();
119 
120 	kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
121 	T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
122 
123 	kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
124 	T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
125 
126 	return exc_port;
127 }
128 
129 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)130 catch_mach_exception_raise_state(mach_port_t exception_port,
131     exception_type_t exception,
132     const mach_exception_data_t code,
133     mach_msg_type_number_t code_count,
134     int * flavor,
135     const thread_state_t old_state,
136     mach_msg_type_number_t old_state_count,
137     thread_state_t new_state,
138     mach_msg_type_number_t * new_state_count)
139 {
140 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
141 	T_FAIL("Unsupported catch_mach_exception_raise_state");
142 	return KERN_NOT_SUPPORTED;
143 }
144 
145 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)146 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
147     mach_port_t thread,
148     mach_port_t task,
149     exception_type_t exception,
150     mach_exception_data_t code,
151     mach_msg_type_number_t code_count,
152     int * flavor,
153     thread_state_t old_state,
154     mach_msg_type_number_t old_state_count,
155     thread_state_t new_state,
156     mach_msg_type_number_t * new_state_count)
157 {
158 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
159 	T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
160 	return KERN_NOT_SUPPORTED;
161 }
162 
163 kern_return_t
catch_mach_exception_raise_state_identity_protected(__unused mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt,__unused int * flavor,__unused thread_state_t old_state,__unused mach_msg_type_number_t old_state_count,__unused thread_state_t new_state,__unused mach_msg_type_number_t * new_state_count)164 catch_mach_exception_raise_state_identity_protected(
165 	__unused mach_port_t      exception_port,
166 	uint64_t                  thread_id,
167 	mach_port_t               task_id_token,
168 	exception_type_t          exception,
169 	mach_exception_data_t     codes,
170 	mach_msg_type_number_t    codeCnt,
171 	__unused int * flavor,
172 	__unused thread_state_t old_state,
173 	__unused mach_msg_type_number_t old_state_count,
174 	__unused thread_state_t new_state,
175 	__unused mach_msg_type_number_t * new_state_count)
176 {
177 #pragma unused(exception_port, thread_id, task_id_token, exception, codes, codeCnt)
178 
179 	T_FAIL("Unsupported catch_mach_exception_raise_state_identity_protected");
180 	return KERN_NOT_SUPPORTED;
181 }
182 
183 kern_return_t
catch_mach_exception_raise_identity_protected(__unused mach_port_t exception_port,uint64_t thread_id,mach_port_t task_id_token,exception_type_t exception,mach_exception_data_t codes,mach_msg_type_number_t codeCnt)184 catch_mach_exception_raise_identity_protected(
185 	__unused mach_port_t      exception_port,
186 	uint64_t                  thread_id,
187 	mach_port_t               task_id_token,
188 	exception_type_t          exception,
189 	mach_exception_data_t     codes,
190 	mach_msg_type_number_t    codeCnt)
191 {
192 #pragma unused(exception_port, thread_id, task_id_token)
193 
194 	T_ASSERT_GT_UINT(codeCnt, 1, "CodeCnt");
195 
196 	T_LOG("Caught %d codes", codeCnt);
197 	T_LOG("Caught exception type: %d code[0]: 0x%llx code[1]:0x%llx", exception, codes[0], codes[1]);
198 	exception_taken = exception;
199 	if (exception == EXC_GUARD) {
200 		received_exception_code = EXC_GUARD_DECODE_GUARD_FLAVOR((uint64_t)codes[0]);
201 	} else {
202 		T_FAIL("Unexpected exception");
203 	}
204 	return KERN_SUCCESS;
205 }
206 
207 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)208 catch_mach_exception_raise(mach_port_t exception_port,
209     mach_port_t thread,
210     mach_port_t task,
211     exception_type_t exception,
212     mach_exception_data_t code,
213     mach_msg_type_number_t code_count)
214 {
215 #pragma unused(exception_port, thread, task, exception, code, code_count)
216 	T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
217 	return KERN_NOT_SUPPORTED;
218 }
219 
220 static void *
exception_server_thread(void * arg)221 exception_server_thread(void *arg)
222 {
223 	kern_return_t kr;
224 	mach_port_t exc_port = *(mach_port_t *)arg;
225 
226 	/* Handle exceptions on exc_port */
227 	kr = mach_msg_server_once(mach_exc_server, 4096, exc_port, 0);
228 	T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server_once");
229 
230 	return NULL;
231 }
232 
233 static void
reply_port_defense(const bool thirdparty_hardened,int test_index,mach_exception_data_type_t expected_exception_code,bool triggers_exception)234 reply_port_defense(const bool thirdparty_hardened, int test_index, mach_exception_data_type_t expected_exception_code, bool triggers_exception)
235 {
236 	/* reset exception code before running this test */
237 	received_exception_code = 0;
238 	int ret = 0;
239 
240 	uint32_t task_exc_guard = 0;
241 	size_t te_size = sizeof(&task_exc_guard);
242 
243 	/* Test that the behavior is the same between these two */
244 	char *test_prog_name = thirdparty_hardened ?
245 	    "./reply_port_defense_client_3P_hardened" : "./reply_port_defense_client";
246 	char *child_args[MAX_ARGV];
247 	pid_t client_pid = 0;
248 	posix_spawnattr_t attrs;
249 
250 	pthread_t s_exc_thread;
251 	mach_port_t exc_port;
252 
253 	T_LOG("Check if task_exc_guard exception has been enabled\n");
254 	ret = sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
255 	T_ASSERT_EQ(ret, 0, "sysctlbyname");
256 
257 	if (!(task_exc_guard & TASK_EXC_GUARD_MP_DELIVER)) {
258 		T_SKIP("task_exc_guard exception is not enabled");
259 	}
260 
261 	exc_port = alloc_exception_port();
262 	T_QUIET; T_ASSERT_NE(exc_port, MACH_PORT_NULL, "Create a new exception port");
263 
264 	/* Create exception serving thread */
265 	ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
266 	T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
267 
268 	/* Initialize posix_spawn attributes */
269 	posix_spawnattr_init(&attrs);
270 
271 	/*
272 	 * It is allowed for us to set an exception port because we are entitled test process.
273 	 * If you are using this code as an example for platform binaries,
274 	 * use `EXCEPTION_IDENTITY_PROTECTED` instead of `EXCEPTION_DEFAULT`
275 	 */
276 	int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD, exc_port,
277 	    (exception_behavior_t) (EXCEPTION_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES), 0);
278 	T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
279 
280 	child_args[0] = test_prog_name;
281 	char test_num[10];
282 	sprintf(test_num, "%d", test_index);
283 	child_args[1] = test_num;
284 	child_args[2] = NULL;
285 
286 	T_LOG("========== Spawning new child ==========");
287 	err = posix_spawn(&client_pid, child_args[0], NULL, &attrs, &child_args[0], environ);
288 	T_ASSERT_POSIX_SUCCESS(err, "posix_spawn reply_port_defense_client = %d", client_pid);
289 
290 	int child_status;
291 	/* Wait for child and check for exception */
292 	if (-1 == waitpid(-1, &child_status, 0)) {
293 		T_FAIL("%s waitpid: child", strerror(errno));
294 	}
295 	if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
296 		T_FAIL("Child exited with status = 0x%x", child_status);
297 	}
298 	sleep(1);
299 	kill(1, SIGKILL);
300 	if (triggers_exception) {
301 		ret = pthread_join(s_exc_thread, NULL);
302 		T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_join");
303 	}
304 
305 	mach_port_deallocate(mach_task_self(), exc_port);
306 
307 	T_LOG("Exception code: Received code = 0x%llx Expected code = 0x%llx", received_exception_code, expected_exception_code);
308 	T_EXPECT_EQ(received_exception_code, expected_exception_code, "Exception code: Received == Expected");
309 }
310 
311 T_DECL(reply_port_defense,
312     "Test reply port semantics violations",
313     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
314     T_META_CHECK_LEAKS(false),
315     T_META_TAG_VM_PREFERRED,
316     T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {
317 	if (ipc_hardening_disabled()) {
318 		T_SKIP("hardening disabled due to boot-args");
319 	}
320 	bool triggers_exception = true;
321 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
322 	int test_num = 0;
323 	int rp_defense_max_test_idx = 3;
324 	/* Run the reply_port_defense tests 0, 1, 2 */
325 	for (int i = test_num; i < rp_defense_max_test_idx; i++) {
326 		reply_port_defense(true, i, expected_exception_code, triggers_exception);
327 		reply_port_defense(false, i, expected_exception_code, triggers_exception);
328 	}
329 	reply_port_defense(true, 3, kGUARD_EXC_INVALID_RIGHT, triggers_exception);
330 	reply_port_defense(false, 3, kGUARD_EXC_INVALID_RIGHT, triggers_exception);
331 }
332 
333 T_DECL(test_unentitled_thread_set_exception_ports,
334     "thread_set_exception_ports should fail without an entitlement",
335     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
336     T_META_CHECK_LEAKS(false)) {
337 	int test_num = 5;
338 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_EXCEPTION_BEHAVIOR_ENFORCE;
339 	bool triggers_exception = true;
340 
341 	if (ipc_hardening_disabled()) {
342 		T_SKIP("hardening disabled due to boot-args");
343 	}
344 
345 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
346 	// reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
347 }
348 
349 T_DECL(test_unentitled_thread_set_state,
350     "thread_set_state should fail without an entitlement",
351     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
352     T_META_CHECK_LEAKS(false),
353     T_META_ENABLED(false /* rdar://133955889 */))
354 {
355 	int test_num = 6;
356 	if (ipc_hardening_disabled()) {
357 		T_SKIP("hardening disabled due to boot-args");
358 	}
359 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_THREAD_SET_STATE;
360 	bool triggers_exception = true;
361 
362 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
363 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
364 }
365 
366 T_DECL(unentitled_set_exception_ports_pass,
367     "set_exception_ports should succeed",
368     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
369     T_META_CHECK_LEAKS(false)) {
370 	int test_num = 7;
371 	if (ipc_hardening_disabled()) {
372 		T_SKIP("hardening disabled due to boot-args");
373 	}
374 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_NONE;
375 	bool triggers_exception = false;
376 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
377 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
378 }
379 
380 
381 T_DECL(kobject_reply_port_defense,
382     "sending messages to kobjects without a proper reply port should crash",
383     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
384     T_META_TAG_VM_PREFERRED,
385     T_META_CHECK_LEAKS(false),
386     T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {         /* disable on macOS due to BATS boot-args */
387 	if (ipc_hardening_disabled()) {
388 		T_SKIP("hardening disabled due to boot-args");
389 	}
390 	int test_num = 9;
391 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_KOBJECT_REPLY_PORT_SEMANTICS;
392 	bool triggers_exception = true;
393 
394 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
395 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
396 }
397 
398 T_DECL(test_alloc_weak_reply_port,
399     "1p is not allowed to create weak reply ports",
400     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
401     T_META_CHECK_LEAKS(false)) {
402 	if (ipc_hardening_disabled()) {
403 		T_SKIP("hardening disabled due to boot-args");
404 	}
405 
406 	int test_num = 10;
407 	mach_exception_data_type_t expected_exception_code;
408 	bool triggers_exception = true;
409 
410 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
411 	expected_exception_code = kGUARD_EXC_PROVISIONAL_REPLY_PORT;
412 #else
413 	expected_exception_code = kGUARD_EXC_INVALID_MPO_ENTITLEMENT;
414 #endif /* TARGET_OS_OSX || TARGET_OS_BRIDGE */
415 
416 	/* rdar://136996362 (iOS+ telemetry for restricting 1P usage of provisional reply port) */
417 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
418 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
419 }
420 
421 T_DECL(test_move_service_port,
422     "service ports are immovable",
423     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
424     T_META_CHECK_LEAKS(false)) {
425 	int test_num = 11;
426 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_SERVICE_PORT_VIOLATION_FATAL;
427 	bool triggers_exception = true;
428 
429 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
430 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
431 }
432 
433 
434 T_DECL(test_notification_policy,
435     "registering notifications on an mktimer crashes",
436     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
437     T_META_CHECK_LEAKS(false),
438     T_META_TAG_VM_PREFERRED,
439     T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {         /* disable on macOS due to BATS boot-args */
440 	if (ipc_hardening_disabled()) {
441 		T_SKIP("hardening disabled due to boot-args");
442 	}
443 
444 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_INVALID_NOTIFICATION_REQ;
445 	bool triggers_exception = true;
446 
447 	int test_num = 12;
448 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
449 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
450 
451 	test_num = 13;
452 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
453 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
454 
455 	test_num = 14;
456 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
457 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
458 }
459 
460 
461 T_DECL(test_reply_port_extract_right_disallowed,
462     "mach_port_extract_right disallowed on reply port",
463     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
464     T_META_CHECK_LEAKS(false)) {
465 	if (ipc_hardening_disabled()) {
466 		T_SKIP("hardening disabled due to boot-args");
467 	}
468 
469 	int test_num = 15;
470 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_INVALID_RIGHT;
471 	bool triggers_exception = true;
472 
473 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
474 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
475 }
476 
477 T_DECL(test_mach_task_self_send_movability,
478     "mach_task_self is immovable unless you have called ",
479     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
480     T_META_CHECK_LEAKS(false)) {
481 	if (ipc_hardening_disabled()) {
482 		T_SKIP("hardening disabled due to boot-args");
483 	}
484 
485 	int test_num = 16;
486 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
487 	bool triggers_exception = true;
488 
489 	if (sip_disabled() || unrestricted_debugging()) {
490 		/*
491 		 * see `proc_check_get_movable_control_port`:
492 		 * enforcement is always controlled by entitlements and
493 		 * unrestricted debugging boot-arg
494 		 * or if SIP is disabled
495 		 */
496 		expected_exception_code = 0;
497 		triggers_exception = false;
498 	}
499 
500 	/*
501 	 * it should fail on reply_port_defense_client_3P_hardened because it doesn't
502 	 * have com.apple.security.get-movable-control-port
503 	 */
504 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
505 	test_num = 17; /* These tests crash the same way */
506 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
507 
508 	/*
509 	 * it should succeed on reply_port_defense_client because it
510 	 * has com.apple.security.get-movable-control-port
511 	 */
512 	test_num = 16;
513 	expected_exception_code = 0;
514 	triggers_exception = false;
515 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
516 	test_num = 17;
517 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
518 }
519 
520 
521 T_DECL(test_send_immovability,
522     "ensure that send immovability is set on ports, even if they are not copied out",
523     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
524     T_META_CHECK_LEAKS(false)) {
525 	/* attempt to move ports created by mach port construct */
526 
527 
528 	/* test_move_newly_constructed_port_immovable_send */
529 	int test_num = 18;
530 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_IMMOVABLE;
531 	bool triggers_exception = true;
532 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
533 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
534 
535 	/* test_move_special_reply_port */
536 	test_num = 19;
537 	expected_exception_code = kGUARD_EXC_IMMOVABLE;
538 	triggers_exception = true;
539 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
540 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
541 }
542 
543 T_DECL(test_reply_port_header_disposition,
544     "Ensure only make_send_once is allowed for reply port",
545     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
546     T_META_CHECK_LEAKS(false),
547     T_META_ENABLED(!TARGET_OS_OSX && !TARGET_OS_BRIDGE)) {
548 #if TARGET_OS_OSX || TARGET_OS_BRIDGE
549 	T_SKIP("disabled on macos");
550 #endif
551 	int test_num = 20;
552 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_SEND_INVALID_REPLY;
553 	bool triggers_exception = true;
554 
555 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
556 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
557 }
558 
559 T_DECL(test_service_port_as_exception_port,
560     "Ensure both service and weak service port can be used as exception port",
561     T_META_IGNORECRASHES(".*reply_port_defense_client.*"),
562     T_META_CHECK_LEAKS(false)) {
563 	int test_num = 21;
564 	mach_exception_data_type_t expected_exception_code = kGUARD_EXC_NONE;
565 	bool triggers_exception = false;
566 
567 	reply_port_defense(true, test_num, expected_exception_code, triggers_exception);
568 	reply_port_defense(false, test_num, expected_exception_code, triggers_exception);
569 }
570