1 #include <darwintest.h>
2
3 #include <mach/host_priv.h>
4 #include <mach/mach.h>
5 #include <mach/mach_types.h>
6 #include <mach/mach_vm.h>
7 #include <mach_debug/ipc_info.h>
8 #include <mach/processor_set.h>
9 #include <mach/task.h>
10 #include <signal.h>
11 #include <sys/wait.h>
12 #include <sys/proc.h>
13 #include <sys/sysctl.h>
14 #include <unistd.h>
15 #include <TargetConditionals.h>
16
17 #define IKOT_THREAD_CONTROL 1
18 #define IKOT_THREAD_READ 47
19 #define IKOT_THREAD_INSPECT 46
20
21 #define IKOT_TASK_CONTROL 2
22 #define IKOT_TASK_READ 45
23 #define IKOT_TASK_INSPECT 44
24 #define IKOT_TASK_NAME 20
25
26
27 /*
28 * This test verifies various security properties for task and thread
29 * read/inspect interfaces. Specifically, it checks and makes sure:
30 *
31 * 1. Task/thread can't get higher priv'ed ports from lower ones through
32 * {task, thread}_get_special_port()
33 * 2. Correct level of thread ports are returned from task_threads() with
34 * a given task port flavor
35 * 3. Correct level of task ports are returned from processor_set_tasks()
36 * 4. MIG intrans conversion and enforcement for task/thread port does not break.
37 * 5. task_{, read, inspect, name}_for_pid() works for self and other process
38 * 6. The new mach_vm_remap_new interface behaves correctly
39 */
40
41 T_GLOBAL_META(
42 T_META_NAMESPACE("xnu.ipc"),
43 T_META_RADAR_COMPONENT_NAME("xnu"),
44 T_META_RADAR_COMPONENT_VERSION("IPC"),
45 T_META_RUN_CONCURRENTLY(TRUE));
46
47 static void
RESULT_CHECK(kern_return_t kr,unsigned int flavor,unsigned int required,char * f_name)48 RESULT_CHECK(
49 kern_return_t kr,
50 unsigned int flavor, /* task_flavor_t or thread_flavor_t */
51 unsigned int required, /* task_flavor_t or thread_flavor_t */
52 char *f_name)
53 {
54 if (flavor <= required) {
55 T_EXPECT_EQ(kr, KERN_SUCCESS, "%s should succeed with task/thread flavor %d, kr: 0x%x", f_name, flavor, kr);
56 } else {
57 T_EXPECT_NE(kr, KERN_SUCCESS, "%s should fail with task/thread flavor %d, kr: 0x%x", f_name, flavor, kr);
58 }
59 }
60
61 static void
test_task_get_special_port(task_t tport,task_flavor_t flavor)62 test_task_get_special_port(
63 task_t tport,
64 task_flavor_t flavor)
65 {
66 kern_return_t kr;
67 mach_port_t special_port = MACH_PORT_NULL;
68 mach_port_t tfp_port = MACH_PORT_NULL;
69
70 T_LOG("Testing task_get_special_port() with task flavor %d", flavor);
71 /* gettable with at least control port */
72 kr = task_get_special_port(tport, TASK_KERNEL_PORT, &special_port);
73 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_KERNEL_PORT)");
74 mach_port_deallocate(mach_task_self(), special_port);
75 special_port = MACH_PORT_NULL;
76
77 kr = task_get_special_port(tport, TASK_BOOTSTRAP_PORT, &special_port);
78 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_BOOTSTRAP_PORT)");
79 mach_port_deallocate(mach_task_self(), special_port);
80 special_port = MACH_PORT_NULL;
81
82 kr = task_get_special_port(tport, TASK_HOST_PORT, &special_port);
83 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_special_port(TASK_HOST_PORT)");
84 mach_port_deallocate(mach_task_self(), special_port);
85 special_port = MACH_PORT_NULL;
86
87 /* gettable with at least read port */
88 kr = task_get_special_port(tport, TASK_READ_PORT, &special_port);
89 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "task_get_special_port(TASK_READ_PORT)");
90 if (KERN_SUCCESS == kr) {
91 kr = task_read_for_pid(mach_task_self(), getpid(), &tfp_port);
92 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_read_for_pid()");
93 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_read_for_pid() should match TASK_READ_PORT");
94 mach_port_deallocate(mach_task_self(), tfp_port);
95 }
96 mach_port_deallocate(mach_task_self(), special_port);
97 special_port = MACH_PORT_NULL;
98
99 /* gettable with at least inspect port */
100 kr = task_get_special_port(tport, TASK_INSPECT_PORT, &special_port);
101 RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_special_port(TASK_INSPECT_PORT)");
102 if (KERN_SUCCESS == kr) {
103 kr = task_inspect_for_pid(mach_task_self(), getpid(), &tfp_port);
104 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_inspect_for_pid()");
105 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_inspect_for_pid() should match TASK_INSPECT_PORT");
106 mach_port_deallocate(mach_task_self(), tfp_port);
107 }
108 mach_port_deallocate(mach_task_self(), special_port);
109 special_port = MACH_PORT_NULL;
110
111 /* gettable with at least name port */
112 kr = task_get_special_port(tport, TASK_NAME_PORT, &special_port);
113 RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_special_port(TASK_NAME_PORT)");
114 if (KERN_SUCCESS == kr) {
115 kr = task_name_for_pid(mach_task_self(), getpid(), &tfp_port);
116 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_name_for_pid()");
117 T_QUIET; T_EXPECT_EQ(tfp_port, special_port, "task_name_for_pid() should match TASK_NAME_PORT");
118 mach_port_deallocate(mach_task_self(), tfp_port);
119 }
120 mach_port_deallocate(mach_task_self(), special_port);
121 special_port = MACH_PORT_NULL;
122 }
123
124 static void
test_thread_get_special_port(thread_t tport,thread_flavor_t flavor)125 test_thread_get_special_port(
126 thread_t tport,
127 thread_flavor_t flavor)
128 {
129 kern_return_t kr;
130 mach_port_t special_port = MACH_PORT_NULL;
131
132 T_LOG("Testing thread_get_special_port() with thread flavor %d", flavor);
133 /* gettable with at least control port */
134 kr = thread_get_special_port(tport, THREAD_KERNEL_PORT, &special_port);
135 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_CONTROL, "thread_get_special_port(THREAD_KERNEL_PORT)");
136 mach_port_deallocate(mach_task_self(), special_port);
137 special_port = MACH_PORT_NULL;
138
139 /* gettable with at least read port */
140 kr = thread_get_special_port(tport, THREAD_READ_PORT, &special_port);
141 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_READ, "thread_get_special_port(THREAD_READ_PORT)");
142 mach_port_deallocate(mach_task_self(), special_port);
143 special_port = MACH_PORT_NULL;
144
145 /* gettable with at least inspect port */
146 kr = thread_get_special_port(tport, THREAD_INSPECT_PORT, &special_port);
147 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_INSPECT, "thread_get_special_port(THREAD_INSPECT_PORT)");
148 mach_port_deallocate(mach_task_self(), special_port);
149 special_port = MACH_PORT_NULL;
150 }
151
152 static void
test_task_threads(task_t tport,task_flavor_t flavor)153 test_task_threads(
154 task_t tport,
155 task_flavor_t flavor)
156 {
157 kern_return_t kr;
158 thread_array_t threadList;
159 mach_msg_type_number_t threadCount = 0;
160
161 unsigned int kotype;
162 unsigned int kaddr;
163
164 T_LOG("Testing task_threads() with task flavor %d", flavor);
165
166 kr = task_threads(tport, &threadList, &threadCount);
167 RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_threads");
168
169 if (kr) {
170 T_LOG("task_threads failed, skipping test_task_threads()");
171 return;
172 }
173
174 T_QUIET; T_ASSERT_GE(threadCount, 1, "threadCount should be at least 1");
175
176 /*
177 * TASK_FLAVOR_CONTROL -> THREAD_FLAVOR_CONTROL
178 * TASK_FLAVOR_READ -> THREAD_FLAVOR_READ
179 * TASK_FLAVOR_INSPECT -> THREAD_FLAVOR_INSPECT
180 * TASK_FLAOVR_NAME -> KERN_FAILURE
181 */
182 for (size_t i = 0; i < threadCount; i++) {
183 kr = mach_port_kernel_object(mach_task_self(), threadList[i], &kotype, &kaddr);
184 if (kr == KERN_INVALID_RIGHT || kr == KERN_INVALID_NAME) {
185 /* thread port is inactive */
186 T_LOG("thread port name 0x%x is inactive", threadList[i]);
187 continue;
188 } else if (kr) {
189 T_FAIL("mach_port_kernel_object() failed with kr: 0x%x", kr);
190 }
191 switch (flavor) {
192 case TASK_FLAVOR_CONTROL:
193 T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_CONTROL, "Task control port should yield thread control port");
194 break;
195 case TASK_FLAVOR_READ:
196 T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_READ, "Task read port should yield thread read port");
197 break;
198 case TASK_FLAVOR_INSPECT:
199 T_QUIET; T_EXPECT_EQ(kotype, IKOT_THREAD_INSPECT, "Task inspect port should yield thread inspect port");
200 break;
201 default:
202 T_FAIL("task_threads() returned thread ports with task name port??");
203 break;
204 }
205 }
206
207 for (size_t i = 0; i < threadCount; i++) {
208 mach_port_deallocate(mach_task_self(), threadList[i]);
209 }
210 vm_deallocate(mach_task_self(), (vm_address_t)threadList,
211 sizeof(threadList[0]) * threadCount);
212 }
213
214 static void
test_processor_set_tasks(task_flavor_t flavor)215 test_processor_set_tasks(
216 task_flavor_t flavor)
217 {
218 kern_return_t kr;
219 processor_set_name_array_t psets;
220 processor_set_t pset_priv;
221 task_array_t taskList;
222 mach_msg_type_number_t pcnt = 0, tcnt = 0;
223 mach_port_t host = mach_host_self();
224
225 unsigned int kotype;
226 unsigned int kaddr;
227
228 T_LOG("Testing processor_set_tasks() with task flavor %d", flavor);
229
230 kr = host_processor_sets(host, &psets, &pcnt);
231 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_sets");
232 T_QUIET; T_ASSERT_GE(pcnt, 1, "should have at least 1 processor set");
233
234 kr = host_processor_set_priv(host, psets[0], &pset_priv);
235 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "host_processor_set_priv");
236 for (size_t i = 0; i < pcnt; i++) {
237 mach_port_deallocate(mach_task_self(), psets[i]);
238 }
239 mach_port_deallocate(mach_task_self(), host);
240
241 kr = processor_set_tasks_with_flavor(pset_priv, flavor, &taskList, &tcnt);
242 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "processor_set_tasks_with_flavor");
243 T_QUIET; T_ASSERT_GE(tcnt, 1, "should have at least 1 task");
244 mach_port_deallocate(mach_task_self(), pset_priv);
245
246 for (size_t i = 0; i < tcnt; i++) {
247 kr = mach_port_kernel_object(mach_task_self(), taskList[i], &kotype, &kaddr);
248 if (kr == KERN_INVALID_RIGHT || kr == KERN_INVALID_NAME) {
249 /* task port is inactive */
250 T_LOG("task port name 0x%x is inactive", taskList[i]);
251 continue;
252 } else if (kr) {
253 T_FAIL("mach_port_kernel_object() failed with kr: 0x%x", kr);
254 }
255 switch (flavor) {
256 case TASK_FLAVOR_CONTROL:
257 T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_CONTROL, "TASK_FLAVOR_CONTROL should yield control ports");
258 break;
259 case TASK_FLAVOR_READ:
260 T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_READ, "TASK_FLAVOR_READ should yield read ports");
261 break;
262 case TASK_FLAVOR_INSPECT:
263 T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_INSPECT, "TASK_FLAVOR_INSPECT should yield inspect ports");
264 break;
265 case TASK_FLAVOR_NAME:
266 T_QUIET; T_EXPECT_EQ(kotype, IKOT_TASK_NAME, "TASK_FLAVOR_NAME should yield name ports");
267 break;
268 default:
269 T_FAIL("strange flavor");
270 break;
271 }
272 }
273
274 for (size_t i = 0; i < tcnt; i++) {
275 mach_port_deallocate(mach_task_self(), taskList[i]);
276 }
277 }
278
279 static void
test_task_port_mig_intrans(task_t tport,task_flavor_t flavor)280 test_task_port_mig_intrans(
281 task_t tport,
282 task_flavor_t flavor)
283 {
284 kern_return_t kr;
285
286 T_LOG("Testing various MIG/manual intrans task interfaces with task flavor %d", flavor);
287
288 {
289 /* 1. Test some control port interfaces */
290 int data = 0x41;
291 int new_value = 0x42;
292 kr = mach_vm_write(tport,
293 (mach_vm_address_t)&data,
294 (vm_offset_t)&new_value,
295 (mach_msg_type_number_t)sizeof(int));
296 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "mach_vm_write");
297
298 /* mach_vm_remap_new with max_protection VM_PROT_WRITE | VM_PROT_READ */
299 int *localAddress = 0;
300 mach_vm_address_t localMachVMAddress = 0;
301 vm_prot_t cur_protection = VM_PROT_WRITE | VM_PROT_READ;
302 vm_prot_t max_protection = VM_PROT_WRITE | VM_PROT_READ;
303 /* rdar://67706101 (mach_vm_remap flag that allows restricting protection of remapped region) */
304 kr = mach_vm_remap_new(mach_task_self(),
305 &localMachVMAddress,
306 sizeof(int),
307 0,
308 VM_FLAGS_ANYWHERE,
309 tport, /* remote task, use self task port */
310 (mach_vm_address_t)&data,
311 false,
312 &cur_protection,
313 &max_protection,
314 VM_INHERIT_NONE);
315 localAddress = (int *)(uintptr_t)localMachVMAddress;
316
317 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "mach_vm_remap_new - VM_PROT_WRITE");
318 if (KERN_SUCCESS == kr) {
319 T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
320 T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
321 T_QUIET; T_EXPECT_EQ(*localAddress, data, NULL); /* read */
322 *localAddress = 0; /* write */
323 }
324
325 exception_mask_t masks[EXC_TYPES_COUNT] = {};
326 mach_msg_type_number_t nmasks = 0;
327 exception_port_t ports[EXC_TYPES_COUNT] = {};
328 exception_behavior_t behaviors[EXC_TYPES_COUNT] = {};
329 thread_state_flavor_t flavors[EXC_TYPES_COUNT] = {};
330 kr = task_get_exception_ports(tport, EXC_MASK_ALL,
331 masks, &nmasks, ports, behaviors, flavors);
332 RESULT_CHECK(kr, flavor, TASK_FLAVOR_CONTROL, "task_get_exception_ports");
333 for (size_t i = 0; i < EXC_TYPES_COUNT; i++) {
334 mach_port_deallocate(mach_task_self(), ports[i]);
335 }
336 }
337
338 {
339 /* 2. Test some read port interfaces */
340 vm_offset_t read_value = 0;
341 mach_msg_type_number_t read_cnt = 0;
342 int data = 0x41;
343 kr = mach_vm_read(tport,
344 (mach_vm_address_t)&data,
345 (mach_msg_type_number_t)sizeof(int),
346 &read_value,
347 &read_cnt);
348 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_read");
349
350 /* mach_vm_remap_new with max_protection VM_PROT_READ */
351 int *localAddress = 0;
352 mach_vm_address_t localMachVMAddress = 0;
353 vm_prot_t cur_protection = VM_PROT_READ;
354 vm_prot_t max_protection = VM_PROT_READ;
355 /* rdar://67706101 (mach_vm_remap flag that allows restricting protection of remapped region) */
356 kr = mach_vm_remap_new(mach_task_self(),
357 &localMachVMAddress,
358 sizeof(int),
359 0,
360 VM_FLAGS_ANYWHERE,
361 tport, /* remote task, use self task port */
362 (mach_vm_address_t)&data,
363 false,
364 &cur_protection,
365 &max_protection,
366 VM_INHERIT_NONE);
367 localAddress = (int *)(uintptr_t)localMachVMAddress;
368
369 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_remap_new - VM_PROT_READ");
370 if (KERN_SUCCESS == kr) {
371 T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ, NULL);
372 T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ, NULL);
373 T_QUIET; T_EXPECT_EQ(*localAddress, data, NULL); /* read */
374 }
375
376 /* mach_vm_remap_new with copy == TRUE */
377 int data2 = 0x42;
378 localAddress = 0;
379 localMachVMAddress = 0;
380 cur_protection = VM_PROT_WRITE | VM_PROT_READ;
381 max_protection = VM_PROT_WRITE | VM_PROT_READ;
382
383 kr = mach_vm_remap_new(mach_task_self(),
384 &localMachVMAddress,
385 sizeof(int),
386 0,
387 VM_FLAGS_ANYWHERE,
388 tport, /* remote task, use self task port */
389 (mach_vm_address_t)&data2,
390 true,
391 &cur_protection,
392 &max_protection,
393 VM_INHERIT_NONE);
394 localAddress = (int *)(uintptr_t)localMachVMAddress;
395
396 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_vm_remap_new - copy==TRUE");
397 if (KERN_SUCCESS == kr) {
398 T_QUIET; T_EXPECT_EQ(max_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
399 T_QUIET; T_EXPECT_EQ(cur_protection, VM_PROT_READ | VM_PROT_WRITE, NULL);
400 /* Following is causing bus error tracked by rdar://71616700 (Unexpected BUS ERROR in mach_vm_remap_new()) */
401 // T_QUIET; T_EXPECT_EQ(*localAddress, data2, NULL); /* read */
402 // *localAddress = 0; /* write */
403 }
404
405 /* */
406 mach_port_t voucher = MACH_PORT_NULL;
407 kr = task_get_mach_voucher(tport, 0, &voucher);
408 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "task_get_mach_voucher");
409 mach_port_deallocate(mach_task_self(), voucher);
410
411 /* */
412 ipc_info_space_t space_info;
413 ipc_info_name_array_t table;
414 mach_msg_type_number_t tableCount;
415 ipc_info_tree_name_array_t tree; /* unused */
416 mach_msg_type_number_t treeCount; /* unused */
417 kr = mach_port_space_info(tport, &space_info, &table, &tableCount, &tree, &treeCount);
418 RESULT_CHECK(kr, flavor, TASK_FLAVOR_READ, "mach_port_space_info");
419 }
420
421 {
422 /* 3. Test some inspect port interfaces */
423 task_exc_guard_behavior_t exc_behavior;
424 kr = task_get_exc_guard_behavior(tport, &exc_behavior);
425 RESULT_CHECK(kr, flavor, TASK_FLAVOR_INSPECT, "task_get_exc_guard_behavior");
426 }
427
428 {
429 /* 4. Test some name port interfaces */
430 struct task_basic_info info;
431 mach_msg_type_number_t size = sizeof(info);
432 kr = task_info(tport,
433 TASK_BASIC_INFO,
434 (task_info_t)&info,
435 &size);
436 RESULT_CHECK(kr, flavor, TASK_FLAVOR_NAME, "task_info");
437 }
438 }
439
440 static void
test_thread_port_mig_intrans(thread_t tport,thread_flavor_t flavor)441 test_thread_port_mig_intrans(
442 thread_t tport,
443 thread_flavor_t flavor)
444 {
445 kern_return_t kr;
446
447 T_LOG("Testing various MIG/manual intrans thread interfaces with thread flavor %d", flavor);
448
449 {
450 /* 1. Test some control port interfaces */
451 exception_mask_t masks[EXC_TYPES_COUNT] = {};
452 mach_msg_type_number_t nmasks = 0;
453 exception_port_t ports[EXC_TYPES_COUNT] = {};
454 exception_behavior_t behaviors[EXC_TYPES_COUNT] = {};;
455 thread_state_flavor_t flavors[EXC_TYPES_COUNT] = {};;
456 kr = thread_get_exception_ports(tport, EXC_MASK_ALL,
457 masks, &nmasks, ports, behaviors, flavors);
458 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_CONTROL, "thread_get_exception_ports");
459 for (size_t i = 0; i < EXC_TYPES_COUNT; i++) {
460 mach_port_deallocate(mach_task_self(), ports[i]);
461 }
462 }
463
464 {
465 /* 2. Test some read port interfaces */
466 mach_voucher_t voucher = MACH_PORT_NULL;
467 kr = thread_get_mach_voucher(tport, 0, &voucher);
468 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_READ, "thread_get_mach_voucher");
469 mach_port_deallocate(mach_task_self(), voucher);
470 }
471
472 {
473 /* 3. Test some inspect port interfaces */
474 processor_set_name_t name = MACH_PORT_NULL;
475 kr = thread_get_assignment(tport, &name);
476 RESULT_CHECK(kr, flavor, THREAD_FLAVOR_INSPECT, "thread_get_assignment");
477 mach_port_deallocate(mach_task_self(), name);
478 }
479 }
480
481 static void
test_get_child_task_port(void)482 test_get_child_task_port(void)
483 {
484 pid_t child_pid;
485 kern_return_t kr;
486 mach_port_name_t tr, ti, tp, tn;
487
488 child_pid = fork();
489
490 T_LOG("Testing get child task ports");
491
492 if (child_pid < 0) {
493 T_FAIL("fork failed in test_get_child_port.");
494 }
495
496 if (child_pid == 0) {
497 /* hang the child */
498 while (1) {
499 sleep(10);
500 }
501 }
502
503 kr = task_for_pid(mach_task_self(), child_pid, &tp);
504 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_for_pid for child %u", child_pid);
505
506 kr = task_read_for_pid(mach_task_self(), child_pid, &tr);
507 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_read_for_pid for child %u", child_pid);
508
509 kr = task_inspect_for_pid(mach_task_self(), child_pid, &ti);
510 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_inspect_for_pid for child %u", child_pid);
511
512 kr = task_name_for_pid(mach_task_self(), child_pid, &tn);
513 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "task_name_for_pid for child %u", child_pid);
514
515 mach_port_deallocate(mach_task_self(), tp);
516 mach_port_deallocate(mach_task_self(), tr);
517 mach_port_deallocate(mach_task_self(), ti);
518 mach_port_deallocate(mach_task_self(), tn);
519
520 kill(child_pid, SIGKILL);
521 int status;
522 wait(&status);
523 }
524
525 T_DECL(read_inspect, "Test critical read and inspect port interfaces")
526 {
527 mach_port_t control_port, movable_port, read_port, inspect_port, name_port;
528 mach_port_t th_control_port, th_movable_port, th_read_port, th_inspect_port;
529 #define TASK_PORT_COUNT 5
530 #define THREAD_PORT_COUNT 4
531 mach_port_t task_ports[TASK_PORT_COUNT];
532 task_flavor_t task_flavors[TASK_PORT_COUNT];
533 mach_port_t thread_ports[THREAD_PORT_COUNT];
534 thread_flavor_t thread_flavors[THREAD_PORT_COUNT];
535 kern_return_t kr;
536
537 /* first, try getting all flavors of task port for self */
538 kr = task_for_pid(mach_task_self(), getpid(), &control_port);
539 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_for_pid()");
540 task_ports[0] = control_port;
541 task_flavors[0] = TASK_FLAVOR_CONTROL;
542
543 kr = task_get_special_port(mach_task_self(), TASK_KERNEL_PORT, &movable_port);
544 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_get_special_port(..TASK_KERNEL_PORT..)");
545 task_ports[1] = movable_port;
546 task_flavors[1] = TASK_FLAVOR_CONTROL;
547
548 kr = task_read_for_pid(mach_task_self(), getpid(), &read_port);
549 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_read_for_pid()");
550 task_ports[2] = read_port;
551 task_flavors[2] = TASK_FLAVOR_READ;
552
553 kr = task_inspect_for_pid(mach_task_self(), getpid(), &inspect_port);
554 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_inspect_for_pid()");
555 task_ports[3] = inspect_port;
556 task_flavors[3] = TASK_FLAVOR_INSPECT;
557
558 kr = task_name_for_pid(mach_task_self(), getpid(), &name_port);
559 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "task_name_for_pid()");
560 task_ports[4] = name_port;
561 task_flavors[4] = TASK_FLAVOR_NAME;
562
563
564 for (size_t i = 0; i < TASK_PORT_COUNT; i++) {
565 /*
566 * 1. Make sure can't get higher priv'ed ports from lower ones through
567 * task_get_special_port()
568 */
569 test_task_get_special_port(task_ports[i], task_flavors[i]);
570
571 /*
572 * 2. Make sure correct level of thread ports are returned from task_threads
573 */
574 test_task_threads(task_ports[i], task_flavors[i]);
575
576 /*
577 * 3. Make sure correct level of task ports are returned from processor_set_tasks
578 */
579 if (i >= 1) {
580 test_processor_set_tasks(task_flavors[i]);
581 }
582
583 /*
584 * 4. Make sure our MIG intrans enforcement for tasks does not break.
585 */
586 test_task_port_mig_intrans(task_ports[i], task_flavors[i]);
587 }
588
589
590 for (size_t i = 0; i < TASK_PORT_COUNT; i++) {
591 mach_port_deallocate(mach_task_self(), task_ports[i]);
592 }
593
594 /* 4. Try spawning a child an get its task ports */
595 test_get_child_task_port();
596
597 /* Now, test thread read/inspect ports */
598 th_control_port = mach_thread_self();
599 thread_ports[0] = th_control_port;
600 thread_flavors[0] = THREAD_FLAVOR_CONTROL;
601
602 kr = thread_get_special_port(th_control_port, THREAD_KERNEL_PORT, &th_movable_port);
603 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_KERNEL_PORT..)");
604 thread_ports[1] = th_movable_port;
605 thread_flavors[1] = THREAD_FLAVOR_CONTROL;
606
607 kr = thread_get_special_port(th_control_port, THREAD_READ_PORT, &th_read_port);
608 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_READ_PORT..)");
609 thread_ports[2] = th_read_port;
610 thread_flavors[2] = THREAD_FLAVOR_READ;
611
612 kr = thread_get_special_port(th_control_port, THREAD_INSPECT_PORT, &th_inspect_port);
613 T_QUIET; T_ASSERT_MACH_SUCCESS(kr, "thread_get_special_port(..THREAD_INSPECT_PORT..)");
614 thread_ports[3] = th_inspect_port;
615 thread_flavors[3] = THREAD_FLAVOR_INSPECT;
616
617
618 for (size_t i = 0; i < THREAD_PORT_COUNT; i++) {
619 /*
620 * 1. Make sure can't get higher priv'ed ports from lower ones through
621 * thread_get_special_port()
622 */
623 test_thread_get_special_port(thread_ports[i], thread_flavors[i]);
624
625 /*
626 * 2. Make sure our MIG intrans enforcement for threads does not break.
627 */
628 test_thread_port_mig_intrans(thread_ports[i], thread_flavors[i]);
629 }
630
631 for (size_t i = 0; i < THREAD_PORT_COUNT; i++) {
632 mach_port_deallocate(mach_task_self(), thread_ports[i]);
633 }
634 }
635