1 #include "exc_helpers.h"
2 #include <darwintest.h>
3
4 #include <mach/mach_init.h>
5 #include <mach/mach_port.h>
6 #include <pthread/private.h>
7 #include <pthread.h>
8 #include <sys/sysctl.h>
9 #include <mach/task.h>
10 #include <mach/thread_status.h>
11 #include <ptrauth.h>
12 #include <stdbool.h>
13 #include <stdlib.h>
14 #include <unistd.h>
15 #include <mach/mach.h>
16 #include <mach/exception.h>
17 #include <mach/thread_status.h>
18 #include <sys/types.h>
19 #include <sys/sysctl.h>
20 #include <sys/code_signing.h>
21 #include <TargetConditionals.h>
22 #include <mach/semaphore.h>
23
24 #if __arm64__
25 #define EXCEPTION_THREAD_STATE ARM_THREAD_STATE64
26 #define EXCEPTION_THREAD_STATE_COUNT ARM_THREAD_STATE64_COUNT
27 #elif __x86_64__
28 #define EXCEPTION_THREAD_STATE x86_THREAD_STATE
29 #define EXCEPTION_THREAD_STATE_COUNT x86_THREAD_STATE_COUNT
30 #else
31 #error Unsupported architecture
32 #endif
33
34 T_GLOBAL_META(
35 T_META_NAMESPACE("xnu.ipc"),
36 T_META_RADAR_COMPONENT_NAME("xnu"),
37 T_META_RADAR_COMPONENT_VERSION("IPC"),
38 T_META_RUN_CONCURRENTLY(true));
39
40 struct mach_exception_options {
41 mach_port_t exc_port;
42 exception_mask_t exceptions_allowed;
43 exception_behavior_t behaviors_allowed;
44 thread_state_flavor_t flavors_allowed;
45 };
46
47 static void
bad_access_func(void)48 bad_access_func(void)
49 {
50 T_QUIET; T_LOG("Crashing");
51 *(void *volatile *)5 = 0;
52 T_QUIET; T_LOG("Recoverd!");
53 return;
54 }
55
56 static int num_exceptions = 0;
57
58 static uint32_t signing_key = (uint32_t)(0xa8000000 & 0xff000000);
59
60 static size_t
exc_handler_state_identity_protected(task_id_token_t token,uint64_t thread_id,exception_type_t type,__unused exception_data_t codes,thread_state_t in_state,mach_msg_type_number_t in_state_count,thread_state_t out_state,mach_msg_type_number_t * out_state_count)61 exc_handler_state_identity_protected(
62 task_id_token_t token,
63 uint64_t thread_id,
64 exception_type_t type,
65 __unused exception_data_t codes,
66 thread_state_t in_state,
67 mach_msg_type_number_t in_state_count,
68 thread_state_t out_state,
69 mach_msg_type_number_t *out_state_count)
70 {
71 mach_port_t port1, port2;
72 #pragma unused(port1)
73 #pragma unused(port2)
74 #pragma unused(token)
75 #pragma unused(thread_id)
76 #pragma unused(type)
77 #pragma unused(in_state)
78 #pragma unused(in_state_count)
79 #pragma unused(out_state)
80 #pragma unused(out_state_count)
81 *out_state_count = in_state_count;
82 T_LOG("Got protected exception!");
83 num_exceptions++;
84 #if __arm64__
85 arm_thread_state64_t *state = (arm_thread_state64_t*)(void *)out_state;
86 void *func_pc = (void *)arm_thread_state64_get_pc(*state);
87
88 /* Sign a PC which skips over the faulting instruction */
89 func_pc = ptrauth_strip(func_pc, ptrauth_key_function_pointer);
90 func_pc += 4;
91 uint64_t pc_discriminator = ptrauth_blend_discriminator((void *)(unsigned long)signing_key, ptrauth_string_discriminator("pc"));
92 func_pc = ptrauth_sign_unauthenticated(func_pc, ptrauth_key_function_pointer, pc_discriminator);
93
94 // Set/Sign the PC of the excepting thread
95 T_LOG("userspace discriminator=%llu\n", pc_discriminator);
96 arm_thread_state64_set_pc_presigned_fptr(*state, func_pc);
97
98 /* Corrupting the thread state should not crash as only the PC is accepted in hardened exceptions */
99 arm_thread_state64_set_lr_presigned_fptr(*state, func_pc);
100 arm_thread_state64_set_sp(*state, 0);
101 arm_thread_state64_set_fp(*state, 0);
102
103 #endif /* __arm64__ */
104
105 return KERN_SUCCESS;
106 }
107
108 static void
thread_register_handler(mach_port_t exc_port,const struct mach_exception_options meo)109 thread_register_handler(mach_port_t exc_port,
110 const struct mach_exception_options meo)
111 {
112 kern_return_t kr = thread_adopt_exception_handler(
113 mach_thread_self(), exc_port, meo.exceptions_allowed,
114 meo.behaviors_allowed, meo.flavors_allowed);
115
116 T_ASSERT_MACH_SUCCESS(kr, "thread register handler");
117 }
118
119 static mach_port_t
create_hardened_exception_port(const struct mach_exception_options meo,uint32_t signing_key_local)120 create_hardened_exception_port(const struct mach_exception_options meo,
121 uint32_t signing_key_local)
122 {
123 #if !__arm64__
124 T_SKIP("Hardened exceptions not supported on !arm64");
125 #endif /* !__arm64__ */
126 kern_return_t kr;
127 mach_port_t exc_port;
128 mach_port_options_t opts = {
129 .flags = MPO_INSERT_SEND_RIGHT | MPO_EXCEPTION_PORT,
130 };
131
132 kr = mach_port_construct(mach_task_self(), &opts, 0ull, &exc_port);
133 T_ASSERT_MACH_SUCCESS(kr, "constructing mach port");
134
135 T_LOG("register with pc_signing_key=0x%x\n", signing_key_local);
136 kr = task_register_hardened_exception_handler(current_task(),
137 signing_key_local, meo.exceptions_allowed,
138 meo.behaviors_allowed, meo.flavors_allowed, exc_port);
139 T_ASSERT_MACH_SUCCESS(kr, "registering an exception handler port");
140 T_ASSERT_NE_UINT(exc_port, 0, "new exception port not null");
141
142 return exc_port;
143 }
144
145 T_DECL(hardened_exceptions_default,
146 "Test creating and using hardened exception ports") {
147 #if !__arm64__
148 T_SKIP("Hardened exceptions not supported on !arm64");
149 #endif /* !__arm64__ */
150 struct mach_exception_options meo;
151 meo.exceptions_allowed = EXC_MASK_BAD_ACCESS;
152 meo.behaviors_allowed = EXCEPTION_STATE_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES;
153 meo.flavors_allowed = EXCEPTION_THREAD_STATE;
154
155 mach_port_t exc_port = create_hardened_exception_port(meo, signing_key);
156
157 thread_register_handler(exc_port, meo);
158
159 run_exception_handler_behavior64(exc_port, NULL,
160 (void*)exc_handler_state_identity_protected,
161 EXCEPTION_STATE_IDENTITY_PROTECTED | MACH_EXCEPTION_CODES, true);
162 bad_access_func();
163
164 printf("Successfully recovered from the exception!\n");
165 }
166
167 extern char *__progname;
168
169 T_DECL(entitled_process_exceptions_disallowed,
170 "Test that when you have the special entitlement you may not use the hardened exception flow, unless you have debugger entitlements",
171 T_META_IGNORECRASHES("*hardened_exceptions_entitled")) {
172 #if !__arm64__
173 T_SKIP("Hardened exceptions not supported on !arm64");
174 #endif /* !__arm64__ */
175
176 bool entitled = strstr(__progname, "entitled") != NULL;
177 bool debugger = strstr(__progname, "debugger") != NULL;
178 /* thread_set_exception_ports as a platform restrictions binary should fail */
179 kern_return_t kr = thread_set_exception_ports(
180 mach_thread_self(),
181 EXC_MASK_ALL,
182 MACH_PORT_NULL,
183 (exception_behavior_t)((unsigned int)EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES),
184 EXCEPTION_THREAD_STATE);
185
186 if (!entitled && !debugger) {
187 T_ASSERT_MACH_SUCCESS(kr, "unentitled works normally");
188 } else if (entitled && !debugger) {
189 T_FAIL("We should have already crashed due to hardening entitlement");
190 } else if (entitled && debugger) {
191 T_ASSERT_MACH_SUCCESS(kr, "debugger entitlement works normally");
192 } else {
193 T_FAIL("invalid configuration");
194 }
195 }
196