1 #include <darwintest.h>
2 #include <servers/bootstrap.h>
3 #include <mach/mach.h>
4 #include <mach/message.h>
5 #include <stdlib.h>
6 #include <sys/sysctl.h>
7 #include <unistd.h>
8 #include <darwintest_multiprocess.h>
9 #include <excserver.h>
10 #include <spawn.h>
11 #include <spawn_private.h>
12 #include <libproc_internal.h>
13 #include <signal.h>
14
15 #include <IOKit/IOKitLib.h>
16
17 T_GLOBAL_META(
18 T_META_NAMESPACE("xnu.ipc"),
19 T_META_RUN_CONCURRENTLY(TRUE),
20 T_META_RADAR_COMPONENT_NAME("xnu"),
21 T_META_RADAR_COMPONENT_VERSION("IPC"));
22
23 #define TASK_EXC_GUARD_MP_DELIVER 0x10
24 #define MAX_ARGV 2
25
26 extern char **environ;
27
28 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)29 catch_mach_exception_raise_state(mach_port_t exception_port,
30 exception_type_t exception,
31 const mach_exception_data_t code,
32 mach_msg_type_number_t code_count,
33 int * flavor,
34 const thread_state_t old_state,
35 mach_msg_type_number_t old_state_count,
36 thread_state_t new_state,
37 mach_msg_type_number_t * new_state_count)
38 {
39 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
40 T_FAIL("Unsupported catch_mach_exception_raise_state");
41 return KERN_NOT_SUPPORTED;
42 }
43
44 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)45 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
46 mach_port_t thread,
47 mach_port_t task,
48 exception_type_t exception,
49 mach_exception_data_t code,
50 mach_msg_type_number_t code_count,
51 int * flavor,
52 thread_state_t old_state,
53 mach_msg_type_number_t old_state_count,
54 thread_state_t new_state,
55 mach_msg_type_number_t * new_state_count)
56 {
57 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
58 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
59 return KERN_NOT_SUPPORTED;
60 }
61
62 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)63 catch_mach_exception_raise(mach_port_t exception_port,
64 mach_port_t thread,
65 mach_port_t task,
66 exception_type_t exception,
67 mach_exception_data_t code,
68 mach_msg_type_number_t code_count)
69 {
70 #pragma unused(exception_port, task, thread, code_count)
71 T_ASSERT_EQ(exception, EXC_GUARD, "exception type");
72 T_LOG("Exception raised with exception code : %llx\n", *code);
73 T_END;
74 return KERN_SUCCESS;
75 }
76
77 typedef struct {
78 mach_msg_header_t header;
79 mach_msg_body_t body;
80 mach_msg_port_descriptor_t port_descriptor;
81 mach_msg_trailer_t trailer; // subtract this when sending
82 } ipc_complex_message;
83
84 struct args {
85 char *server_port_name;
86 mach_port_t server_port;
87 };
88
89 void parse_args(struct args *args);
90 void server_setup(struct args* args);
91 void* exception_server_thread(void *arg);
92 mach_port_t create_exception_port(void);
93
94 #define TEST_TIMEOUT 10
95
96 void
parse_args(struct args * args)97 parse_args(struct args *args)
98 {
99 args->server_port_name = "TEST_IMMOVABLE_SEND";
100 args->server_port = MACH_PORT_NULL;
101 }
102
103 /* Create a mach IPC listener which will respond to the client's message */
104 void
server_setup(struct args * args)105 server_setup(struct args *args)
106 {
107 kern_return_t ret;
108 mach_port_t bsport;
109
110 ret = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE,
111 &args->server_port);
112 T_ASSERT_MACH_SUCCESS(ret, "server: mach_port_allocate()");
113
114 ret = mach_port_insert_right(mach_task_self(), args->server_port, args->server_port,
115 MACH_MSG_TYPE_MAKE_SEND);
116 T_ASSERT_MACH_SUCCESS(ret, "server: mach_port_insert_right()");
117
118 ret = task_get_bootstrap_port(mach_task_self(), &bsport);
119 T_ASSERT_MACH_SUCCESS(ret, "server: task_get_bootstrap_port()");
120
121 ret = bootstrap_register(bsport, args->server_port_name, args->server_port);
122 T_ASSERT_MACH_SUCCESS(ret, "server: bootstrap_register()");
123
124 T_LOG("server: waiting for IPC messages from client on port '%s'.\n",
125 args->server_port_name);
126 }
127
128 mach_port_t
create_exception_port()129 create_exception_port()
130 {
131 kern_return_t kret;
132 mach_port_t exc_port = MACH_PORT_NULL;
133 mach_port_t task = mach_task_self();
134
135 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
136 T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
137
138 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
139 T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
140
141 return exc_port;
142 }
143
144 void *
exception_server_thread(void * arg)145 exception_server_thread(void *arg)
146 {
147 kern_return_t kr;
148 mach_port_t exc_port = *(mach_port_t *)arg;
149 T_EXPECT_NE(exc_port, MACH_PORT_NULL, "exception port is not null");
150
151 /* Handle exceptions on exc_port */
152 kr = mach_msg_server(mach_exc_server, 4096, exc_port, 0);
153 T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server");
154
155 return NULL;
156 }
157
158 T_DECL(catch_immovable_send_exception, "Send guard port descriptor to another process", T_META_IGNORECRASHES(".*immovable_send_client.*"))
159 {
160 uint32_t task_exc_guard = 0;
161 size_t te_size = sizeof(&task_exc_guard);
162 kern_return_t kr;
163 mach_msg_type_number_t maskCount = 1;
164 exception_mask_t mask;
165 exception_handler_t handler;
166 exception_behavior_t behavior;
167 thread_state_flavor_t flavor;
168 mach_port_t task = mach_task_self();
169 struct args* server_args = (struct args*)malloc(sizeof(struct args));
170 posix_spawnattr_t attrs;
171 char *test_prog_name = "./immovable_send_client";
172 char *child_args[MAX_ARGV];
173
174 T_LOG("Check if task_exc_guard exception has been enabled\n");
175 sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
176 //TODO: check if sysctlbyname is successful
177
178 /* Create the bootstrap port */
179 parse_args(server_args);
180 server_setup(server_args);
181
182 /* Create the exception port for the server */
183 mach_port_t exc_port = create_exception_port();
184 T_EXPECT_NOTNULL(exc_port, "Create a new exception port");
185
186 pthread_t s_exc_thread;
187
188 /* Create exception serving thread */
189 int ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
190 T_EXPECT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
191
192 /* Get current exception ports */
193 kr = task_get_exception_ports(task, EXC_MASK_GUARD, &mask,
194 &maskCount, &handler, &behavior, &flavor);
195 T_EXPECT_MACH_SUCCESS(kr, "task_get_exception_ports");
196
197 /* Initialize posix_spawn attributes */
198 posix_spawnattr_init(&attrs);
199
200 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD, exc_port,
201 (exception_behavior_t) (EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES), 0);
202 T_EXPECT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
203
204 child_args[0] = test_prog_name;
205 child_args[1] = NULL;
206
207 err = posix_spawn(NULL, child_args[0], NULL, &attrs, &child_args[0], environ);
208 T_EXPECT_POSIX_SUCCESS(err, "posix_spawn immovable_send_client");
209
210 int child_status;
211 /* Wait for child and check for exception */
212 if (-1 == wait4(-1, &child_status, 0, NULL)) {
213 T_FAIL("wait4: child mia");
214 }
215
216 if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
217 T_LOG("Child exited with status = %x", child_status);
218 }
219
220 sigsuspend(0);
221 }
222