1 /*
2 * Copyright (c) 2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #if CONFIG_DEBUG_SYSCALL_REJECTION
30
31 #include <kern/bits.h>
32 #include <kern/exc_guard.h>
33 #include <kern/exception.h>
34 #include <kern/kalloc.h>
35 #include <kern/simple_lock.h>
36 #include <kern/startup.h>
37 #include <kern/syscall_sw.h>
38
39 #include <pexpert/pexpert.h>
40
41 #include <sys/syscall.h>
42 #include <sys/sysctl.h>
43 #include <sys/sysent.h>
44 #include <sys/systm.h>
45 #include <sys/types.h>
46 #include <sys/user.h>
47
48 #include <sys/kern_debug.h>
49
50 #define SYSCALL_REJECTION_MODE_IGNORE 0
51 #define SYSCALL_REJECTION_MODE_GUARD 1
52 #define SYSCALL_REJECTION_MODE_CRASH 2
53
54 int debug_syscall_rejection_mode = 0;
55 SYSCTL_INT(_kern, OID_AUTO, debug_syscall_rejection_mode, CTLFLAG_RW | CTLFLAG_LOCKED,
56 &debug_syscall_rejection_mode, 0, "0: ignore, 1: non-fatal, 2: crash");
57
58 static size_t const predefined_masks = 2; // 0: null mask (all 0), 1: all mask (all 1)
59
60 /*
61 * The number of masks is derived from the mask selector data type:
62 *
63 * A selector is just made of an index into syscall_rejection_masks,
64 * with the exception of the highest bit, which indicates whether the
65 * mask is to be added as an "allow" mask or a "deny" mask.
66 * Additionally, predefined masks don't actually have storage and are
67 * handled specially, so syscall_rejection_masks starts with the first
68 * non-predefined mask (and is sized appropriately).
69 */
70 static size_t const syscall_rejection_mask_count =
71 (1 << (8 * sizeof(syscall_rejection_selector_t) - predefined_masks)) - 1;
72 static syscall_rejection_mask_t syscall_rejection_masks[syscall_rejection_mask_count];
73
74 #define SR_MASK_SIZE (BITMAP_SIZE(mach_trap_count + nsysent))
75
76 static LCK_GRP_DECLARE(syscall_rejection_lck_grp, "syscall rejection lock");
77 static LCK_MTX_DECLARE(syscall_rejection_mtx, &syscall_rejection_lck_grp);
78
79 extern kern_return_t task_violated_guard(mach_exception_code_t, mach_exception_subcode_t, void *);
80
81 bool
debug_syscall_rejection_handle(int syscall_mach_trap_number)82 debug_syscall_rejection_handle(int syscall_mach_trap_number)
83 {
84 bool fatal = false;
85
86 switch (debug_syscall_rejection_mode) {
87 case SYSCALL_REJECTION_MODE_CRASH:
88 fatal = true;
89 OS_FALLTHROUGH;
90 case SYSCALL_REJECTION_MODE_GUARD: {
91 mach_exception_code_t code = 0;
92 EXC_GUARD_ENCODE_TYPE(code, GUARD_TYPE_REJECTED_SC);
93 EXC_GUARD_ENCODE_FLAVOR(code, 0);
94 EXC_GUARD_ENCODE_TARGET(code, syscall_mach_trap_number < 0);
95 mach_exception_subcode_t subcode =
96 syscall_mach_trap_number < 0 ? -syscall_mach_trap_number : syscall_mach_trap_number;
97
98 if (!fatal) {
99 task_violated_guard(code, subcode, NULL);
100 } else {
101 thread_guard_violation(current_thread(), code, subcode, fatal);
102 }
103 break;
104 };
105 default:
106 /* ignore */
107 ;
108 }
109 return fatal;
110 }
111
112 void
rejected_syscall_guard_ast(thread_t __unused t,mach_exception_data_type_t code,mach_exception_data_type_t subcode)113 rejected_syscall_guard_ast(
114 thread_t __unused t,
115 mach_exception_data_type_t code,
116 mach_exception_data_type_t subcode)
117 {
118 task_exception_notify(EXC_GUARD, code, subcode);
119 proc_t p = current_proc();
120 psignal(p, SIGSYS);
121 }
122
123
124 static void
_syscall_rejection_apply_mask(syscall_rejection_mask_t dest,const syscall_rejection_mask_t src,bool apply_as_allow)125 _syscall_rejection_apply_mask(syscall_rejection_mask_t dest, const syscall_rejection_mask_t src, bool apply_as_allow)
126 {
127 assert(dest != NULL);
128 assert(src != NULL);
129
130 if (apply_as_allow) {
131 bitmap_or(dest, dest, src, mach_trap_count + nsysent);
132 } else {
133 bitmap_and_not(dest, dest, src, mach_trap_count + nsysent);
134 }
135 }
136
137 /*
138 * The masks to apply are passed to the kernel as packed selectors,
139 * which are just however many of the selector data type fit into one
140 * (or more) fields of the natural word size (i.e. a register). This
141 * avoids copying from user space.
142 *
143 * More specifically, at the time of this writing, a selector is 1
144 * byte wide, and there is only one uint64_t argument
145 * (args->packed_selectors), so up to 8 selectors can be specified,
146 * which are then stuffed into the 64 bits of the argument. If less
147 * than 8 masks are requested to be applied, the remaining selectors
148 * will just be left as 0, which naturally resolves as the "empty" or
149 * "NULL" mask that changes nothing.
150 *
151 * The libsyscall wrapper provides a more convenient interface where
152 * an array (up to 8 elements long) and its length are passed in,
153 * which the wrapper then packs into packed_selectors of the actual
154 * system call.
155 */
156
157 int
debug_syscall_reject(struct proc * p __unused,struct debug_syscall_reject_args * args,int * retval)158 debug_syscall_reject(struct proc *p __unused, struct debug_syscall_reject_args *args, int *retval)
159 {
160 int error = 0;
161
162 *retval = 0;
163
164 if (debug_syscall_rejection_mode == SYSCALL_REJECTION_MODE_IGNORE) {
165 return 0;
166 }
167
168 uthread_t ut = current_uthread();
169
170 bitmap_t mask[SR_MASK_SIZE / sizeof(bitmap_t)];
171 // syscall rejection masks are always reset to "deny all"
172 memset(mask, 0, SR_MASK_SIZE);
173
174 lck_mtx_lock(&syscall_rejection_mtx);
175
176 for (int i = 0; i < sizeof(args->packed_selectors) / sizeof(syscall_rejection_selector_t); i++) {
177 syscall_rejection_selector_t selector = ((syscall_rejection_selector_t const *)&(args->packed_selectors))[i];
178 bool const is_allow_mask = selector & SYSCALL_REJECTION_IS_ALLOW_MASK;
179 int const mask_index = selector & SYSCALL_REJECTION_INDEX_MASK;
180
181 if (mask_index == SYSCALL_REJECTION_NULL) {
182 // mask 0 is always empty (nothing to apply)
183 continue;
184 }
185
186 if (mask_index == SYSCALL_REJECTION_ALL) {
187 // mask 1 is always full (overrides everything)
188 memset(mask, is_allow_mask ? 0xff : 0x00, SR_MASK_SIZE);
189 continue;
190 }
191
192 syscall_rejection_mask_t mask_to_apply = syscall_rejection_masks[mask_index - predefined_masks];
193
194 if (mask_to_apply == NULL) {
195 error = ENOENT;
196 goto out_locked;
197 }
198
199 _syscall_rejection_apply_mask(mask, mask_to_apply, is_allow_mask);
200 }
201
202 if (ut->syscall_rejection_mask == NULL) {
203 /* Not RT-safe, but only necessary once. */
204
205 ut->syscall_rejection_mask = kalloc_data(SR_MASK_SIZE, Z_WAITOK);
206
207 if (ut->syscall_rejection_mask == NULL) {
208 error = ENOMEM;
209 goto out_locked;
210 }
211 }
212
213 memcpy(ut->syscall_rejection_mask, mask, SR_MASK_SIZE);
214
215 out_locked:
216 lck_mtx_unlock(&syscall_rejection_mtx);
217
218 return error;
219 }
220
221 static bool
_syscall_rejection_add(syscall_rejection_mask_t dst,char const * name)222 _syscall_rejection_add(syscall_rejection_mask_t dst, char const *name)
223 {
224 /*
225 * Yes, this function is O(n+m), making the whole act of setting a
226 * mask O(l*(n+m)), but defining masks is done rarely enough (and
227 * i, n and m small enough) for this to not matter.
228 */
229
230 for (int i = 0; i < mach_trap_count; i++) {
231 if (strcmp(mach_syscall_name_table[i], name) == 0) {
232 bitmap_set(dst, i);
233 return true;
234 }
235 }
236
237 extern char const *syscallnames[];
238
239 for (int i = 0; i < nsysent; i++) {
240 if (strcmp(syscallnames[i], name) == 0) {
241 bitmap_set(dst, i + mach_trap_count);
242 return true;
243 }
244 }
245
246 printf("%s: trying to add non-existing syscall/mach trap '%s'\n", __func__, name);
247 return false;
248 }
249
250 /* Pretty much arbitrary, we just don't want userspace to pass
251 * unreasonably large buffers to parse. */
252 static size_t const max_input_size = 16 * PAGE_MAX_SIZE;
253
254 static int
_sysctl_debug_syscall_rejection_masks(struct sysctl_oid __unused * oidp,void * __unused arg1,int __unused arg2,struct sysctl_req * req)255 _sysctl_debug_syscall_rejection_masks(struct sysctl_oid __unused *oidp, void * __unused arg1, int __unused arg2,
256 struct sysctl_req *req)
257 {
258 if (req->newptr == 0) {
259 return 0;
260 }
261
262 if (req->newlen > max_input_size) {
263 return E2BIG;
264 }
265
266 size_t const len = req->newlen;
267 char *buf = kalloc_data(len + 1, Z_WAITOK);
268
269 if (buf == NULL) {
270 return ENOMEM;
271 }
272
273 /*
274 * sysctl_io_string always copies out the given buffer as the
275 * "old" value if requested. We could construct a text
276 * representation of existing masks, but this is not particularly
277 * interesting, so we just return the dummy string "<masks>".
278 */
279 strlcpy(buf, "<masks>", len + 1);
280 int changed = 0;
281 int error = sysctl_io_string(req, buf, len + 1, 0, &changed);
282
283 if (error != 0 || !changed) {
284 goto out;
285 }
286
287 char const *p = buf;
288
289 int id = 0;
290 int l = 0;
291 int n = sscanf(p, "%i: %n", &id, &l);
292
293 if (n != 1 || id < predefined_masks || id > syscall_rejection_mask_count + predefined_masks) {
294 printf("%s: invalid mask id %i (or conversion failed)\n", __FUNCTION__, id);
295 error = EINVAL;
296 goto out;
297 }
298
299 p += l;
300
301 syscall_rejection_mask_t new_mask = kalloc_data(SR_MASK_SIZE,
302 Z_WAITOK | Z_ZERO);
303 if (new_mask == NULL) {
304 printf("%s: allocating new mask for id %i failed\n", __FUNCTION__, id);
305 error = ENOMEM;
306 goto out;
307 }
308
309 size_t const max_name_len = 128;
310 char name[max_name_len];
311
312 error = 0;
313
314 while (p < buf + len && *p != 0) {
315 name[0] = 0;
316 n = sscanf(p, "%127s %n", name, &l);
317 if (n != 1 || name[0] == 0) {
318 error = EINVAL;
319 kfree_data(new_mask, SR_MASK_SIZE);
320 goto out;
321 }
322
323 if (!_syscall_rejection_add(new_mask, name)) {
324 error = ENOENT;
325 kfree_data(new_mask, SR_MASK_SIZE);
326 goto out;
327 }
328
329 p += l;
330 }
331
332
333 syscall_rejection_mask_t to_free = NULL;
334
335 lck_mtx_lock(&syscall_rejection_mtx);
336
337 syscall_rejection_mask_t *target_mask = &syscall_rejection_masks[id - predefined_masks];
338
339 to_free = *target_mask;
340 *target_mask = new_mask;
341
342 lck_mtx_unlock(&syscall_rejection_mtx);
343
344 kfree_data(to_free, SR_MASK_SIZE);
345 out:
346
347 kfree_data(buf, len);
348 return error;
349 }
350
351 SYSCTL_PROC(_kern, OID_AUTO, syscall_rejection_masks, CTLTYPE_STRING | CTLFLAG_WR | CTLFLAG_MASKED | CTLFLAG_LOCKED,
352 0, 0, _sysctl_debug_syscall_rejection_masks, "A", "system call rejection masks");
353
354 #else /* CONFIG_DEBUG_SYSCALL_REJECTION */
355
356 #include <sys/kern_debug.h>
357
358 int
debug_syscall_reject(struct proc * p __unused,struct debug_syscall_reject_args * __unused args,int __unused * ret)359 debug_syscall_reject(struct proc *p __unused, struct debug_syscall_reject_args * __unused args, int __unused *ret)
360 {
361 /* not supported. */
362 return ENOTSUP;
363 }
364
365 #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
366