1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <unistd.h>
4 #include <darwintest.h>
5 #include <spawn.h>
6 #include <mach/mach.h>
7 #include <sys/sysctl.h>
8 #include <excserver.h>
9 #include <signal.h>
10 #include "../osfmk/ipc/ipc_init.h"
11 #include "../osfmk/mach/port.h"
12 #include "../osfmk/kern/exc_guard.h"
13
14 #define MAX_TEST_NUM 4
15 #define MAX_ARGV 3
16
17 extern char **environ;
18 static mach_exception_data_type_t received_exception_code = 0;
19 static mach_exception_data_type_t expected_exception_code = 0;
20 static exception_type_t exception_taken = 0;
21
22 /*
23 * This test infrastructure is inspired from imm_pinned_control_port.c.
24 * It verifies no reply port security semantics are violated.
25 *
26 * 1. The rcv right of the port would be marked immovable.
27 */
28 T_GLOBAL_META(
29 T_META_NAMESPACE("xnu.ipc"),
30 T_META_RADAR_COMPONENT_NAME("xnu"),
31 T_META_RADAR_COMPONENT_VERSION("IPC"),
32 T_META_RUN_CONCURRENTLY(TRUE));
33
34 static mach_port_t
alloc_exception_port(void)35 alloc_exception_port(void)
36 {
37 kern_return_t kret;
38 mach_port_t exc_port = MACH_PORT_NULL;
39 mach_port_t task = mach_task_self();
40
41 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
42 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
43
44 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
45 T_QUIET; T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
46
47 return exc_port;
48 }
49
50 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)51 catch_mach_exception_raise_state(mach_port_t exception_port,
52 exception_type_t exception,
53 const mach_exception_data_t code,
54 mach_msg_type_number_t code_count,
55 int * flavor,
56 const thread_state_t old_state,
57 mach_msg_type_number_t old_state_count,
58 thread_state_t new_state,
59 mach_msg_type_number_t * new_state_count)
60 {
61 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
62 T_FAIL("Unsupported catch_mach_exception_raise_state");
63 return KERN_NOT_SUPPORTED;
64 }
65
66 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)67 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
68 mach_port_t thread,
69 mach_port_t task,
70 exception_type_t exception,
71 mach_exception_data_t code,
72 mach_msg_type_number_t code_count,
73 int * flavor,
74 thread_state_t old_state,
75 mach_msg_type_number_t old_state_count,
76 thread_state_t new_state,
77 mach_msg_type_number_t * new_state_count)
78 {
79 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
80 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
81 return KERN_NOT_SUPPORTED;
82 }
83
84 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)85 catch_mach_exception_raise(mach_port_t exception_port,
86 mach_port_t thread,
87 mach_port_t task,
88 exception_type_t exception,
89 mach_exception_data_t code,
90 mach_msg_type_number_t code_count)
91 {
92 #pragma unused(exception_port, code_count)
93 kern_return_t kr;
94
95 kr = mach_port_deallocate(mach_task_self(), thread);
96 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_port_deallocate");
97 kr = mach_port_deallocate(mach_task_self(), task);
98 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_port_deallocate");
99
100 T_LOG("Caught exception type: %d code: 0x%llx", exception, *code);
101 exception_taken = exception;
102 if (exception == EXC_GUARD) {
103 received_exception_code = EXC_GUARD_DECODE_GUARD_FLAVOR( *((uint64_t *)code));
104 } else if (exception == EXC_CORPSE_NOTIFY) {
105 received_exception_code = *code;
106 } else {
107 T_FAIL("Unexpected exception");
108 }
109 return KERN_SUCCESS;
110 }
111
112 static void *
exception_server_thread(void * arg)113 exception_server_thread(void *arg)
114 {
115 kern_return_t kr;
116 mach_port_t exc_port = *(mach_port_t *)arg;
117
118 /* Handle exceptions on exc_port */
119 kr = mach_msg_server_once(mach_exc_server, 4096, exc_port, 0);
120 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server_once");
121
122 return NULL;
123 }
124
125 T_DECL(reply_port_defense, "Test reply port semantics violations", T_META_IGNORECRASHES(".*reply_port_defense_client.*"), T_META_CHECK_LEAKS(false))
126 {
127 int ret = 0;
128
129 uint32_t task_exc_guard = 0;
130 size_t te_size = sizeof(&task_exc_guard);
131
132 char *test_prog_name = "./reply_port_defense_client";
133 char *child_args[MAX_ARGV];
134 pid_t client_pid = 0;
135 posix_spawnattr_t attrs;
136
137 pthread_t s_exc_thread;
138 mach_port_t exc_port;
139
140 T_LOG("Check if task_exc_guard exception has been enabled\n");
141 ret = sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
142 T_ASSERT_EQ(ret, 0, "sysctlbyname");
143
144 if (!(task_exc_guard & TASK_EXC_GUARD_MP_DELIVER)) {
145 T_SKIP("task_exc_guard exception is not enabled");
146 }
147
148 for (int i = 0; i < MAX_TEST_NUM; i++) {
149 exc_port = alloc_exception_port();
150 T_QUIET; T_ASSERT_NE(exc_port, MACH_PORT_NULL, "Create a new exception port");
151
152 /* Create exception serving thread */
153 ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
154 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
155
156 /* Initialize posix_spawn attributes */
157 posix_spawnattr_init(&attrs);
158
159 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD | EXC_MASK_CORPSE_NOTIFY, exc_port,
160 (exception_behavior_t) (EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES), 0);
161 T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
162
163 child_args[0] = test_prog_name;
164 char test_num[10];
165 sprintf(test_num, "%d", i);
166 child_args[1] = test_num;
167 child_args[2] = NULL;
168
169 T_LOG("========== Spawning new child ==========");
170 err = posix_spawn(&client_pid, child_args[0], NULL, &attrs, &child_args[0], environ);
171 T_ASSERT_POSIX_SUCCESS(err, "posix_spawn reply_port_defense_client = %d", client_pid);
172
173 int child_status;
174 /* Wait for child and check for exception */
175 if (-1 == waitpid(-1, &child_status, 0)) {
176 T_FAIL("waitpid: child");
177 }
178 if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
179 T_FAIL("Child exited with status = %x", child_status);
180 T_END;
181 }
182
183 sleep(1);
184 kill(1, SIGKILL);
185
186 ret = pthread_join(s_exc_thread, NULL);
187 T_QUIET; T_ASSERT_POSIX_SUCCESS(ret, "pthread_join");
188
189 mach_port_deallocate(mach_task_self(), exc_port);
190
191 if (i == 0) { /* The first test is setup as moving immovable receive right of a reply port. */
192 expected_exception_code = (mach_exception_data_type_t)kGUARD_EXC_IMMOVABLE;
193 } else {
194 expected_exception_code = (mach_exception_data_type_t)kGUARD_EXC_INVALID_RIGHT;
195 }
196
197 T_LOG("Exception code: Received code = 0x%llx Expected code = 0x%llx", received_exception_code, expected_exception_code);
198 T_EXPECT_EQ(received_exception_code, expected_exception_code, "Exception code: Received == Expected");
199 }
200 }
201