1 /* 2 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SYS_CODESIGN_H_ 30 #define _SYS_CODESIGN_H_ 31 32 #include <kern/cs_blobs.h> 33 34 /* MAC flags used by F_ADDFILESIGS_* */ 35 #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ 36 37 #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" 38 #define OVERRIDE_PLUGIN_HOST_ENTITLEMENT "com.apple.private.security.override-plugin-host-detection" 39 40 /* csops operations */ 41 #define CS_OPS_STATUS 0 /* return status */ 42 #define CS_OPS_MARKINVALID 1 /* invalidate process */ 43 #define CS_OPS_MARKHARD 2 /* set HARD flag */ 44 #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ 45 #ifdef KERNEL_PRIVATE 46 /* CS_OPS_PIDPATH 4 */ 47 #endif 48 #define CS_OPS_CDHASH 5 /* get code directory hash */ 49 #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ 50 #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ 51 #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ 52 #define CS_OPS_SET_STATUS 9 /* set codesign flags */ 53 #define CS_OPS_BLOB 10 /* get codesign blob */ 54 #define CS_OPS_IDENTITY 11 /* get codesign identity */ 55 #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ 56 #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ 57 #define CS_OPS_TEAMID 14 /* get team id */ 58 #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ 59 #define CS_OPS_DER_ENTITLEMENTS_BLOB 16 /* get der entitlements blob */ 60 61 #define CS_MAX_TEAMID_LEN 64 62 63 #ifndef KERNEL 64 65 #include <sys/types.h> 66 #include <mach/message.h> 67 68 __BEGIN_DECLS 69 /* code sign operations */ 70 int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); 71 int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); 72 __END_DECLS 73 74 #else /* !KERNEL */ 75 76 #include <mach/machine.h> 77 #include <mach/vm_types.h> 78 79 #include <sys/cdefs.h> 80 #include <sys/_types/_off_t.h> 81 82 struct vnode; 83 struct cs_blob; 84 struct fileglob; 85 86 __BEGIN_DECLS 87 int cs_valid(struct proc *); 88 int cs_process_enforcement(struct proc *); 89 int cs_process_global_enforcement(void); 90 int cs_system_enforcement(void); 91 int cs_vm_supports_4k_translations(void); 92 int cs_require_lv(struct proc *); 93 int csproc_forced_lv(struct proc* p); 94 int cs_system_require_lv(void); 95 uint32_t cs_entitlement_flags(struct proc *p); 96 int cs_entitlements_blob_get_vnode(struct vnode *, off_t, void **, size_t *); 97 int cs_entitlements_dictionary_copy_vnode(struct vnode *, off_t, void **); 98 int cs_entitlements_blob_get(struct proc *, void **, size_t *); 99 #ifdef KERNEL_PRIVATE 100 int cs_entitlements_dictionary_copy(struct proc *, void **); 101 #endif 102 int cs_restricted(struct proc *); 103 uint8_t * cs_get_cdhash(struct proc *); 104 105 struct cs_blob * csproc_get_blob(struct proc *); 106 struct cs_blob * csvnode_get_blob(struct vnode *, off_t); 107 void csvnode_print_debug(struct vnode *); 108 109 off_t csblob_get_base_offset(struct cs_blob *); 110 vm_size_t csblob_get_size(struct cs_blob *); 111 vm_address_t csblob_get_addr(struct cs_blob *); 112 const char * csblob_get_teamid(struct cs_blob *); 113 const char * csblob_get_identity(struct cs_blob *); 114 const uint8_t * csblob_get_cdhash(struct cs_blob *); 115 int csblob_get_platform_binary(struct cs_blob *); 116 unsigned int csblob_get_flags(struct cs_blob *); 117 uint8_t csblob_get_hashtype(struct cs_blob const *); 118 unsigned int csblob_get_signer_type(struct cs_blob *); 119 #if DEVELOPMENT || DEBUG 120 void csproc_clear_platform_binary(struct proc *); 121 #endif 122 123 int csblob_register_profile(struct cs_blob *, void*, vm_size_t); 124 125 void csproc_disable_enforcement(struct proc* p); 126 void csproc_mark_invalid_allowed(struct proc* p); 127 int csproc_check_invalid_allowed(struct proc* p); 128 int csproc_hardened_runtime(struct proc* p); 129 130 int csblob_get_entitlements(struct cs_blob *, void **, size_t *); 131 int csblob_get_der_entitlements(struct cs_blob *, const CS_GenericBlob **, size_t *); 132 133 const CS_GenericBlob * 134 csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); 135 const CS_GenericBlob * 136 csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); 137 void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); 138 void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); 139 140 // New APIs 141 void csblob_os_entitlements_set(struct cs_blob *csblob, void * entitlements); 142 void * csblob_os_entitlements_copy(struct cs_blob *csblob); 143 void * csblob_os_entitlements_get(struct cs_blob *csblob); 144 void * csblob_get_storage_addr(struct cs_blob *csblob); 145 /* 146 * Mostly convenience functions below 147 */ 148 149 const char * csproc_get_teamid(struct proc *); 150 const char * csproc_get_identity(struct proc *); 151 const char * csvnode_get_teamid(struct vnode *, off_t); 152 int csproc_get_platform_binary(struct proc *); 153 int csproc_get_prod_signed(struct proc *); 154 const char * csfg_get_teamid(struct fileglob *); 155 const char * csfg_get_supplement_teamid(struct fileglob *); 156 int csfg_get_path(struct fileglob *, char *, int *); 157 int csfg_get_platform_binary(struct fileglob *); 158 int csfg_get_supplement_platform_binary(struct fileglob *); 159 uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); 160 uint8_t * csfg_get_supplement_cdhash(struct fileglob *, uint64_t, size_t *); 161 const uint8_t * csfg_get_supplement_linkage_cdhash(struct fileglob *, uint64_t, size_t *); 162 int csfg_get_prod_signed(struct fileglob *); 163 int csfg_get_supplement_prod_signed(struct fileglob *fg); 164 unsigned int csfg_get_signer_type(struct fileglob *); 165 unsigned int csfg_get_supplement_signer_type(struct fileglob *); 166 const char *csfg_get_identity(struct fileglob *fg, off_t offset); 167 unsigned int csproc_get_signer_type(struct proc *); 168 169 uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); 170 uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); 171 uint8_t csproc_get_platform_identifier(struct proc *); 172 173 extern int cs_debug; 174 extern int cs_debug_fail_on_unsigned_code; 175 extern unsigned int cs_debug_unsigned_exec_failures; 176 extern unsigned int cs_debug_unsigned_mmap_failures; 177 178 int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, 179 struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); 180 181 void cs_blob_free(struct cs_blob *blob); 182 183 #ifdef XNU_KERNEL_PRIVATE 184 185 int cs_allow_invalid(struct proc *); 186 int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); 187 void cs_process_invalidated(struct proc *); 188 int csproc_get_platform_path(struct proc *); 189 190 #if !SECURE_KERNEL 191 extern int cs_enforcement_panic; 192 #endif 193 194 #endif /* XNU_KERNEL_PRIVATE */ 195 196 197 __END_DECLS 198 199 200 201 #endif /* KERNEL */ 202 203 #endif /* _SYS_CODESIGN_H_ */ 204