1 /*
2 * Copyright (c) 2022 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * The contents of this file constitute Original Code as defined in and
7 * are subject to the Apple Public Source License Version 1.1 (the
8 * "License"). You may not use this file except in compliance with the
9 * License. Please obtain a copy of the License at
10 * http://www.apple.com/publicsource and read it before using this file.
11 *
12 * This Original Code and all software distributed under the License are
13 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
14 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
15 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
16 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
17 * License for the specific language governing rights and limitations
18 * under the License.
19 *
20 * @APPLE_LICENSE_HEADER_END@
21 */
22
23 #ifndef _SYS_CODE_SIGNING_H_
24 #define _SYS_CODE_SIGNING_H_
25
26 #include <sys/cdefs.h>
27 __BEGIN_DECLS
28
29 #pragma GCC diagnostic push
30 #pragma GCC diagnostic ignored "-Wnullability-completeness"
31 #pragma GCC diagnostic ignored "-Wnullability-completeness-on-arrays"
32
33 typedef uint32_t code_signing_monitor_type_t;
34 typedef uint32_t code_signing_config_t;
35
36 /* Monitor Types */
37 #define CS_MONITOR_TYPE_NONE (0)
38 #define CS_MONITOR_TYPE_PPL (1)
39 #define CS_MONITOR_TYPE_TXM (2)
40
41 /* Config - Exemptions */
42 #define CS_CONFIG_UNRESTRICTED_DEBUGGING (1 << 0)
43 #define CS_CONFIG_ALLOW_ANY_SIGNATURE (1 << 1)
44 #define CS_CONFIG_ENFORCEMENT_DISABLED (1 << 2)
45 #define CS_CONFIG_GET_OUT_OF_MY_WAY (1 << 3)
46 #define CS_CONFIG_INTEGRITY_SKIP (1 << 4)
47 #define CS_CONFIG_RELAX_PROFILE_TRUST (1 << 5)
48 #define CS_CONFIG_DEV_MODE_POLICY (1 << 6)
49
50 /* Config - Features */
51 #define CS_CONFIG_REM_SUPPORTED (1 << 25)
52 #define CS_CONFIG_MAP_JIT (1 << 26)
53 #define CS_CONFIG_DEVELOPER_MODE_SUPPORTED (1 << 27)
54 #define CS_CONFIG_COMPILATION_SERVICE (1 << 28)
55 #define CS_CONFIG_LOCAL_SIGNING (1 << 29)
56 #define CS_CONFIG_OOP_JIT (1 << 30)
57 #define CS_CONFIG_CSM_ENABLED (1 << 31)
58
59 #ifdef KERNEL_PRIVATE
60 /* All definitions for XNU and kernel extensions */
61
62 #include <mach/boolean.h>
63 #include <mach/kern_return.h>
64 #include <img4/firmware.h>
65
66 #if !XNU_KERNEL_PRIVATE
67 /*
68 * This header file is shared across the SDK and the KDK. When we're compiling code
69 * for the kernel, but not for XNU, such as a kernel extension, the code signing
70 * traps information is found through <image4/cs/traps.h>. When we're within XNU
71 * proper, this header shouldn't be directory included and instead we should include
72 * <libkern/image4/dlxk.h> instead, which is what we do within XNU_KERNEL_PRIVATE
73 * down below.
74 */
75 #if __has_include(<image4/cs/traps.h>)
76 #include <image4/cs/traps.h>
77 #else
78 typedef uint64_t image4_cs_trap_t;
79 #endif /* __has_include(<image4/cs/traps.h>) */
80 #endif /* !XNU_KERNEL_PRIVATE */
81
82 /* Availability macros for KPI functions */
83 #define XNU_SUPPORTS_CSM_TYPE 1
84 #define XNU_SUPPORTS_CSM_APPLE_IMAGE4 1
85 #define XNU_SUPPORTS_PROFILE_GARBAGE_COLLECTION 1
86 #define XNU_SUPPORTS_COMPILATION_SERVICE 1
87 #define XNU_SUPPORTS_LOCAL_SIGNING 1
88 #define XNU_SUPPORTS_CE_ACCELERATION 1
89 #define XNU_SUPPORTS_DISABLE_CODE_SIGNING_FEATURE 1
90 #define XNU_SUPPORTS_IMAGE4_MONITOR_TRAP 1
91 #define XNU_SUPPORTS_RESTRICTED_EXECUTION_MODE 1
92 #define XNU_SUPPORTS_SECURE_CHANNEL_SHARED_PAGE 1
93 #define XNU_SUPPORTS_CSM_DEVICE_STATE 1
94 #define XNU_SUPPORTS_REGISTER_PROFILE 1
95 #define XNU_SUPPORTS_RESEARCH_STATE 1
96
97 /* Forward declarations */
98 struct cs_blob;
99
100 /* Local signing public key size */
101 #define XNU_LOCAL_SIGNING_KEY_SIZE 97
102
103 typedef struct _cs_profile_register_t {
104 /*
105 * The kernel performs duduplication of registered provisioning profiles
106 * in order to optimize the profile loading code-path. The profile Uuid
107 * is used as the identifier.
108 */
109 uuid_t uuid;
110
111 /*
112 * Counter-signature of the profile used for verifying that the user has
113 * opted to trust the profile. This is only required for certain kinds of
114 * profiles.
115 */
116 const void *sig_data;
117 size_t sig_size;
118
119 /* The profile data itself -- only DER profiles supported */
120 const void *data;
121 size_t size;
122 } cs_profile_register_t;
123
124 #if XNU_KERNEL_PRIVATE
125
126 #include <sys/code_signing_internal.h>
127 #include <pexpert/pexpert.h>
128 #include <libkern/img4/interface.h>
129 #include <libkern/image4/dlxk.h>
130
131 #if PMAP_CS_INCLUDE_CODE_SIGNING
132 #if XNU_LOCAL_SIGNING_KEY_SIZE != PMAP_CS_LOCAL_SIGNING_KEY_SIZE
133 #error "XNU local signing key size and PMAP_CS local signing key size differ!"
134 #endif
135 #endif /* PMAP_CS_INCLUDE_CODE_SIGNING */
136
137 /* Common developer mode state variable */
138 extern bool *developer_mode_enabled;
139
140 /* Common research mode state variables */
141 extern bool research_mode_enabled;
142 extern bool extended_research_mode_enabled;
143
144 /**
145 * This function is used to allocate code signing data which in some cases needs to
146 * align to a page length. This is a frequent operation, and as a result, a common
147 * helper is very useful.
148 */
149 vm_address_t
150 code_signing_allocate(
151 size_t alloc_size);
152
153 /**
154 * This function is used to deallocate data received from code_signing_allocate.
155 */
156 void
157 code_signing_deallocate(
158 vm_address_t *alloc_addr,
159 size_t alloc_size);
160
161 /**
162 * AppleImage4 does not provide an API to convert an object specification index to an
163 * actual object specification. Since this particular function is used across different
164 * places, it makes sense to keep it in a shared header file.
165 *
166 * This function may be called in contexts where printing is not possible, so do NOT
167 * leave a print statement here under any ciscumstances.
168 */
169 static inline const img4_runtime_object_spec_t*
image4_get_object_spec_from_index(img4_runtime_object_spec_index_t obj_spec_index)170 image4_get_object_spec_from_index(
171 img4_runtime_object_spec_index_t obj_spec_index)
172 {
173 const img4_runtime_object_spec_t *__single obj_spec = NULL;
174
175 switch (obj_spec_index) {
176 case IMG4_RUNTIME_OBJECT_SPEC_INDEX_SUPPLEMENTAL_ROOT:
177 obj_spec = IMG4_RUNTIME_OBJECT_SPEC_SUPPLEMENTAL_ROOT;
178 break;
179
180 case IMG4_RUNTIME_OBJECT_SPEC_INDEX_LOCAL_POLICY:
181 obj_spec = IMG4_RUNTIME_OBJECT_SPEC_LOCAL_POLICY;
182 break;
183
184 default:
185 break;
186 }
187
188 return obj_spec;
189 }
190
191 /**
192 * Research modes are only allowed when we're using a virtual device, security research
193 * device or when we're using a dev-fused device.
194 */
195 static inline bool
allow_research_modes(void)196 allow_research_modes(void)
197 {
198 if (PE_vmm_present != 0) {
199 return true;
200 } else if ((PE_esdm_fuses & (1 << 0)) != 0) {
201 return true;
202 } else if (PE_i_can_has_debugger(NULL) == true) {
203 return true;
204 }
205 return false;
206 }
207
208 /**
209 * Perform any initialization required for managing code signing state on the system.
210 * This is called within XNU itself and doesn't need to be exported to anything external.
211 */
212 void
213 code_signing_init(void);
214
215 #endif /* XNU_KERNEL_PRIVATE */
216
217 /**
218 * Query the system to understand the code signing configuration of the system. This
219 * includes information on what monitor environment is available on the system as well
220 * as what the state of the system looks like with the provided boot-args.
221 */
222 void
223 code_signing_configuration(
224 code_signing_monitor_type_t *monitor_type,
225 code_signing_config_t *config);
226
227 /**
228 * This function can be called by a component to disable a particular code signing
229 * feature on the system. For instance, code_signing_configuration is initialized in
230 * early boot, where some kernel extensions which affect code signing aren't online.
231 * When these extensions come online, they may choose to call this function to affect
232 * the state which was previously initialized within code_signing_configuration.
233 */
234 void
235 disable_code_signing_feature(
236 code_signing_config_t feature);
237
238 /**
239 * AppleSEPManager uses this API to obtain the physical page which must be mapped as
240 * the secure channel within the SEP. This API is only supported on systems which have
241 * the Trusted Execution Monitor system monitor.
242 */
243 kern_return_t
244 secure_channel_shared_page(
245 uint64_t *secure_channel_phys,
246 size_t *secure_channel_size);
247
248 /**
249 * Enable developer mode on the system. When the system contains a monitor environment,
250 * developer mode is turned on by trapping into the appropriate monitor environment.
251 */
252 void
253 enable_developer_mode(void);
254
255 /**
256 * Disable developer mode on the system. When the system contains a monitor environment,
257 * developer mode is turned off by trapping into the appropriate monitor environment.
258 */
259 void
260 disable_developer_mode(void);
261
262 /**
263 * Query the current state of developer mode on the system. This call never traps into
264 * the monitor environment because XNU can directly read the monitors memory.
265 */
266 bool
267 developer_mode_state(void);
268
269 /*
270 * Query the current state of research mode on the system. This call never traps into
271 * the monitor environment as the state is queried at boot and saved in read-only-late
272 * memory.
273 *
274 * This state can only ever be enabled on platforms which support the trusted execution
275 * monitor environment. The state requires research fusing and the use of a security
276 * research device.
277 */
278 bool
279 research_mode_state(void);
280
281 /*
282 * Query the current state of extended research mode on the system. This call never traps
283 * into the monitor environment as the state is queried at boot and saved in read-only-late
284 * memory.
285 *
286 * This state can only ever be enabled on platforms which support the trusted execution
287 * monitor environment. The state requires research fusing and the use of a security
288 * research device.
289 */
290 bool
291 extended_research_mode_state(void);
292
293 /**
294 * Attempt to enable restricted execution mode on the system. Not all systems support
295 * restricted execution mode. If the call is successful, KERN_SUCCESS is returned, or
296 * an error.
297 */
298 kern_return_t
299 restricted_execution_mode_enable(void);
300
301 /**
302 * Query the current state of restricted execution mode on the system. Not all systems
303 * support restricted execution mode. If REM is enabled, KERN_SUCCESS is returned. If
304 * REM is disabled, KERN_DENIED is returned. If REM is not supported on this platform,
305 * then KERN_NOT_SUPPORTED is returned.
306 */
307 kern_return_t
308 restricted_execution_mode_state(void);
309
310 /**
311 * This function is called whem the kernel wants the code-signing monitor to update its
312 * device state which is provided by the SEP using an OOB buffer.
313 */
314 void
315 update_csm_device_state(void);
316
317 /*
318 * This function called when the kernel wants the code-signing monitor to complete the
319 * functionality of a security boot mode.
320 */
321 void
322 complete_security_boot_mode(
323 uint32_t security_boot_mode);
324
325 /*
326 * Register and attempt to associate a provisioning profile with the code signature
327 * attached to the csblob. This call is only relevant for systems which have a code
328 * signing monitor, but it is exported to kernel extensions since AMFI is the primary
329 * consumer.
330 */
331 int
332 csblob_register_profile(
333 struct cs_blob *csblob,
334 cs_profile_register_t *profile);
335
336 /**
337 * Wrapper function which is exposed to kernel extensions. This can be used to trigger
338 * a call to the garbage collector for going through and unregistring all unused profiles
339 * on the system.
340 */
341 void
342 garbage_collect_provisioning_profiles(void);
343
344 /**
345 * Set the CDHash which is currently being used by the compilation service. This CDHash
346 * is compared against when validating the signature of a compilation service library.
347 */
348 void
349 set_compilation_service_cdhash(
350 const uint8_t *cdhash);
351
352 /**
353 * Match a CDHash against the currently stored CDHash for the compilation service.
354 */
355 bool
356 match_compilation_service_cdhash(
357 const uint8_t *cdhash);
358
359 /**
360 * Set the local signing key which is currently being used on the system. This key is used
361 * to validate any signatures which are signed on device.
362 */
363 void
364 set_local_signing_public_key(
365 const uint8_t public_key[XNU_LOCAL_SIGNING_KEY_SIZE]);
366
367 /**
368 * Get the local signing key which is currently being used on the system. This API is
369 * mostly used by kernel extensions which validate code signatures on the platform.
370 */
371 uint8_t*
372 get_local_signing_public_key(void);
373
374 /**
375 * Unrestrict a particular CDHash for local signing, allowing it to be loaded and run on
376 * the system. This is only required to be done for main binaries, since libraries do not
377 * need to be unrestricted.
378 */
379 void
380 unrestrict_local_signing_cdhash(
381 const uint8_t *cdhash);
382
383 /**
384 * The kernel or the monitor environments allocate some data which is used by AppleImage4
385 * for storing critical system information such as nonces. AppleImage4 uses this API to
386 * get access to this data while abstracting the implementation underneath.
387 */
388 void*
389 kernel_image4_storage_data(
390 size_t *allocated_size);
391
392 /**
393 * AppleImage4 uses this API to store the specified nonce into the nonce storage. This API
394 * abstracts away the kernel or monitor implementation used.
395 */
396 void
397 kernel_image4_set_nonce(
398 const img4_nonce_domain_index_t ndi,
399 const img4_nonce_t *nonce);
400
401 /**
402 * AppleImage4 uses this API to roll a specified nonce on the next boot. This API abstracts
403 * away the kernel or monitor implementation used.
404 */
405 void
406 kernel_image4_roll_nonce(
407 const img4_nonce_domain_index_t ndi);
408
409 /**
410 * AppleImage4 uses this API to copy a specified nonce from the nonce storage. This API
411 * abstracts away the kernel or monitor implementation used.
412 *
413 * We need this API since the nonces use a lock to protect against concurrency, and the
414 * lock can only be taken within the monitor environment, if any.
415 */
416 errno_t
417 kernel_image4_copy_nonce(
418 const img4_nonce_domain_index_t ndi,
419 img4_nonce_t *nonce_out);
420
421 /**
422 * AppleImage4 uses this API to perform object execution on a particular object type. This
423 * API abstracts away the kernel or monitor implementation used.
424 */
425 errno_t
426 kernel_image4_execute_object(
427 img4_runtime_object_spec_index_t obj_spec_index,
428 const img4_buff_t *payload,
429 const img4_buff_t *manifest);
430
431 /**
432 * AppleImage4 uses this API to copy the contents of an executed object. This API abstracts
433 * away the kernel or monitor implementation used.
434 */
435 errno_t
436 kernel_image4_copy_object(
437 img4_runtime_object_spec_index_t obj_spec_index,
438 vm_address_t object_out,
439 size_t *object_length);
440
441 /**
442 * AppleImage4 uses this API to get a pointer to the structure which is used for exporting
443 * monitor locked down data to the rest of the system.
444 */
445 const void*
446 kernel_image4_get_monitor_exports(void);
447
448 /**
449 * AppleImage4 uses this API to let the monitor environment know the release type for the
450 * the current boot. Under some circumstances, the monitor isn't able to gauge this on its
451 * own.
452 */
453 errno_t
454 kernel_image4_set_release_type(
455 const char *release_type);
456
457 /**
458 * AppleImage4 uses this API to let the monitor know when a nonce domain is shadowing the
459 * AP boot nonce. Since this information is queried from the NVRAM, the monitor cant know
460 * this on its own.
461 */
462 errno_t
463 kernel_image4_set_bnch_shadow(
464 const img4_nonce_domain_index_t ndi);
465
466 /**
467 * AppleImage4 uses this API to trap into the code signing monitor on the platform for
468 * the image4 dispatch routines. A single entry point is multiplexed into a whole dispatch
469 * table.
470 */
471 errno_t
472 kernel_image4_monitor_trap(
473 image4_cs_trap_t selector,
474 const void *input_data,
475 size_t input_size,
476 void *output_data,
477 size_t *output_size);
478
479 /**
480 * AMFI uses this API to obtain the OSEntitlements object which is associated with the
481 * main binary mapped in for a process.
482 *
483 * This API is considered safer for resolving the OSEntitlements than through the cred
484 * structure on the process because the system maintains a strong binding in the linkage
485 * chain from the process structure through the pmap, which ultimately contains the
486 * code signing monitors address space information for the process.
487 */
488 kern_return_t
489 csm_resolve_os_entitlements_from_proc(
490 const proc_t process,
491 const void **os_entitlements);
492
493 /**
494 * Wrapper function that calls csm_get_trust_level_kdp if there is a CODE_SIGNING_MONITOR
495 * or returns KERN_NOT_SUPPORTED if there isn't one.
496 */
497 kern_return_t
498 get_trust_level_kdp(
499 pmap_t pmap,
500 uint32_t *trust_level);
501
502 /**
503 * Wrapper function that calls csm_get_jit_address_range_kdp if there is a CODE_SIGNING_MONITOR
504 * or returns KERN_NOT_SUPPORTED if there isn't one.
505 */
506 kern_return_t
507 get_jit_address_range_kdp(
508 pmap_t pmap,
509 uintptr_t *jit_region_start,
510 uintptr_t *jit_region_end);
511
512 /**
513 * Check whether a particular proc is marked as debugged or not. For many use cases, this
514 * is a stronger check than simply checking for the enablement of developer mode since
515 * an address space can only be marked as debugged if developer mode is already enabled.
516 *
517 * When the system has a code signing monitor, this function acquires the state of the
518 * address space from the monitor.
519 */
520 kern_return_t
521 address_space_debugged_state(
522 const proc_t process);
523
524 /**
525 * Implements the same policy as address_space_debugged_state(), but returns
526 * with boolean semantics.
527 */
528 bool is_address_space_debugged(
529 const proc_t process);
530
531 #if CODE_SIGNING_MONITOR
532
533 struct vm_map_entry;
534
535 /**
536 * Check to see if the monitor is currently enforcing code signing protections or
537 * not. Even when this is disabled, certains artifacts are still protected by the
538 * monitor environment.
539 */
540 bool
541 csm_enabled(void);
542
543 /**
544 * Check and inform the code signing monitor that the system is entering lockdown mode.
545 * The code signing monitor then enforces policy based on this state. As part of this,
546 * we also update the code signing configuration of the system.
547 */
548 void
549 csm_check_lockdown_mode(void);
550
551 /**
552 * When a task incurs an unresolvable page fault with execute permissions, and is not
553 * being debugged, the task should receive a SIGKILL. This should only happen if the
554 * task isn't actively being debugged. This function abstracts all these details.
555 */
556 void
557 csm_code_signing_violation(
558 proc_t proc,
559 vm_offset_t addr);
560
561 /**
562 * This function is used to initialize the state of the locks for managing provisioning
563 * profiles on the system. It should be called by the kernel bootstrap thread during the
564 * early kernel initialization.
565 */
566 void
567 csm_initialize_provisioning_profiles(void);
568
569 /**
570 * Register a provisioning profile with the monitor environment available on the
571 * system. This function will allocate its own memory for managing the profile and
572 * the caller is allowed to free their own allocation.
573 */
574 kern_return_t
575 csm_register_provisioning_profile(
576 const uuid_t profile_uuid,
577 const void *profile,
578 const size_t profile_size);
579
580 /**
581 * Attempt to trust a provisioning profile with the monitor environment available on
582 * the system. The provided signature will be passed to the monitor as is, and the
583 * caller is responsible for de-allocation of the data, if required.
584 */
585 kern_return_t
586 csm_trust_provisioning_profile(
587 const uuid_t profile_uuid,
588 const void *sig_data,
589 size_t sig_size);
590
591 /**
592 * Associate a registered profile with a code signature object which is managed by
593 * the monitor environment. This incrementes the reference count on the profile object
594 * managed by the monitor, preventing the profile from being unregistered.
595 */
596 kern_return_t
597 csm_associate_provisioning_profile(
598 void *monitor_sig_obj,
599 const uuid_t profile_uuid);
600
601 /**
602 * Disassociate an associated profile with a code signature object which is managed by
603 * the monitor environment. This decrements the refernce count on the profile object
604 * managed by the monitor, potentially allowing it to be unregistered in case no other
605 * signatures hold a reference count to it.
606 */
607 kern_return_t
608 csm_disassociate_provisioning_profile(
609 void *monitor_sig_obj);
610
611 /**
612 * Trigger the provisioning profile garbage collector to go through each registered
613 * profile on the system and unregister it in case it isn't being used.
614 */
615 void
616 csm_free_provisioning_profiles(void);
617
618 /**
619 * Acquire the largest size for a code signature which the monitor will allocate on
620 * its own. Anything larger than this size needs to be page-allocated and aligned and
621 * will be locked down by the monitor upon registration.
622 */
623 vm_size_t
624 csm_signature_size_limit(void);
625
626 /**
627 * Register a code signature with the monitor environment. The monitor will either
628 * allocate its own memory for the code signature, or it will lockdown the memory which
629 * is given to it. In either case, the signature will be read-only for the kernel.
630 *
631 * If the monitor doesn't enforce code signing, then this function will return the
632 * KERN_SUCCESS condition.
633 */
634 kern_return_t
635 csm_register_code_signature(
636 const vm_address_t signature_addr,
637 const vm_size_t signature_size,
638 const vm_offset_t code_directory_offset,
639 const char *signature_path,
640 void **monitor_sig_obj,
641 vm_address_t *monitor_signature_addr);
642
643 /**
644 * Unregister a code signature previously registered with the monitor environment.
645 * This will free (or unlock) the signature memory held by the monitor.
646 *
647 * If the monitor doesn't enforce code signing, then this function will return the
648 * error KERN_NOT_SUPPORTED.
649 */
650 kern_return_t
651 csm_unregister_code_signature(
652 void *monitor_sig_obj);
653
654 /**
655 * Verify a code signature previously registered with the monitor. After verification,
656 * the signature can be used for making code signature associations with address spaces.
657 *
658 * If the monitor doesn't enforce code signing, then this function will return the
659 * KERN_SUCCESS condition.
660 */
661 kern_return_t
662 csm_verify_code_signature(
663 void *monitor_sig_obj,
664 uint32_t *trust_level);
665
666 /**
667 * Perform 2nd stage reconstitution through the monitor. This unlocks any unused parts
668 * of the code signature, which can then be freed by the kernel. This isn't strictly
669 * required, but it helps in conserving system memory.
670 *
671 * If the monitor doesn't enforce code signing, then this function will return the
672 * error KERN_NOT_SUPPORTED.
673 */
674 kern_return_t
675 csm_reconstitute_code_signature(
676 void *monitor_sig_obj,
677 vm_address_t *unneeded_addr,
678 vm_size_t *unneeded_size);
679
680 /**
681 * Setup a nested address space object with the required base address and size for the
682 * nested region. The code signing monitor will enforce that code signature associations
683 * can only be made within this address region.
684 *
685 * This must be called before any associations can be made with the nested address space.
686 */
687 kern_return_t
688 csm_setup_nested_address_space(
689 pmap_t pmap,
690 const vm_address_t region_addr,
691 const vm_size_t region_size);
692
693 /**
694 * Associate a code signature with an address space for a specified region with the
695 * monitor environment. The code signature can only be associated if it has been
696 * verified before.
697 */
698 kern_return_t
699 csm_associate_code_signature(
700 pmap_t pmap,
701 void *monitor_sig_obj,
702 const vm_address_t region_addr,
703 const vm_size_t region_size,
704 const vm_offset_t region_offset);
705
706 /**
707 * Validate that an address space will allow mapping in a JIT region within the monitor
708 * environment. An address space can only have a single JIT region, and only when it
709 * has the appropriate JIT entitlement.
710 */
711 kern_return_t
712 csm_allow_jit_region(
713 pmap_t pmap);
714
715 /**
716 * Associate a JIT region with an address space in the monitor environment. An address
717 * space can only have a JIT region if it has the appropriate JIT entitlement.
718 */
719 kern_return_t
720 csm_associate_jit_region(
721 pmap_t pmap,
722 const vm_address_t region_addr,
723 const vm_size_t region_size);
724
725 /**
726 * Associate a debug region with an address space in the monitor environment. An address
727 * space can only have a debug region if it is currently being debugged.
728 */
729 kern_return_t
730 csm_associate_debug_region(
731 pmap_t pmap,
732 const vm_address_t region_addr,
733 const vm_size_t region_size);
734
735 /**
736 * Call out to the monitor to inform it that the address space needs to be debugged. The
737 * monitor will only allow the address space to be debugged if it has the appropriate
738 * entitlements.
739 */
740 kern_return_t
741 csm_allow_invalid_code(
742 pmap_t pmap);
743
744 /**
745 * Acquire the trust level which is placed on the address space within the monitor
746 * environment. There is no clear mapping of the 32-bit integer returned to the actual
747 * trust level because different code signing monitors use different trust levels.
748 *
749 * The code signing monitor itself does not depend on this value and instead uses
750 * other, more secure methods of checking for trust. In general, we only expect this
751 * function to be used for debugging purposes.
752 *
753 * This function should be careful that any code paths within it do not mutate the
754 * state of the system, and as a result, no code paths here should attempt to take
755 * locks of any kind.
756 */
757 kern_return_t
758 csm_get_trust_level_kdp(
759 pmap_t pmap,
760 uint32_t *trust_level);
761
762 /**
763 * Acquire the address range for the JIT region for this address space.
764 *
765 * We expect this function to only be used for debugging purposes, and not for
766 * enforcing any security policies.
767 * This function should be careful that any code paths within it do not mutate the
768 * state of the system, and as a result, no code paths here should attempt to take
769 * locks of any kind.
770 * KERN_SUCCESS is returned if the address space has JIT capability and an address range
771 * was returned in the output arguments.
772 * KERN_NOT_FOUND is returned if the address space does not have JIT, or on systems where
773 * the code signing monitor does not track the JIT range.
774 * KERN_NOT_SUPPORTED is returned for environments where this call is not supported.
775 */
776 kern_return_t
777 csm_get_jit_address_range_kdp(
778 pmap_t pmap,
779 uintptr_t *jit_region_start,
780 uintptr_t *jit_region_end);
781
782 /**
783 * Certain address spaces are exempt from code signing enforcement. This function can be
784 * used to check if the specified address space is such or not.
785 */
786 kern_return_t
787 csm_address_space_exempt(
788 const pmap_t pmap);
789
790 /**
791 * Instruct the monitor that an address space is about to be forked. The monitor can then
792 * do whatever it needs to do in order to prepare for the fork.
793 */
794 kern_return_t
795 csm_fork_prepare(
796 pmap_t old_pmap,
797 pmap_t new_pmap);
798
799 /**
800 * Get the signing identifier which is embedded within the code directory using the
801 * code signing monitor's abstract signature object.
802 */
803 kern_return_t
804 csm_acquire_signing_identifier(
805 const void *monitor_sig_obj,
806 const char **signing_id);
807
808 /**
809 * This API to associate an OSEntitlements objects with the code signing monitor's
810 * signature object. This binding is useful as it can be used to resolve the entitlement
811 * object which is used by the kernel for performing queries.
812 */
813 kern_return_t
814 csm_associate_os_entitlements(
815 void *monitor_sig_obj,
816 const void *os_entitlements);
817
818 /**
819 * Accelerate the CoreEntitlements context within the code signing monitor's memory
820 * in order to speed up all queries for entitlements going through CoreEntitlements.
821 */
822 kern_return_t
823 csm_accelerate_entitlements(
824 void *monitor_sig_obj,
825 CEQueryContext_t *ce_ctx);
826
827 kern_return_t
828 vm_map_entry_cs_associate(
829 vm_map_t map,
830 struct vm_map_entry *entry,
831 vm_map_kernel_flags_t vmk_flags);
832
833 kern_return_t
834 cs_associate_blob_with_mapping(
835 void *pmap,
836 vm_map_offset_t start,
837 vm_map_size_t size,
838 vm_object_offset_t offset,
839 void *blobs_p);
840
841 #endif /* CODE_SIGNING_MONITOR */
842
843 #endif /* KERNEL_PRIVATE */
844
845 #pragma GCC diagnostic pop
846
847 __END_DECLS
848 #endif /* _SYS_CODE_SIGNING_H_ */
849