1 /*
2 * Copyright (c) 2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #if DEVELOPMENT || DEBUG
30 #if __has_feature(ptrauth_calls)
31
32 #include <pexpert/pexpert.h>
33 #include <mach/port.h>
34 #include <mach/task.h>
35 #include <kern/task.h>
36 #include <vm/vm_map.h>
37 #include <vm/pmap.h>
38 #include <ipc/ipc_types.h>
39 #include <ipc/ipc_port.h>
40 #include <kern/ipc_kobject.h>
41 #include <kern/kern_types.h>
42 #include <libkern/ptrauth_utils.h>
43
44 kern_return_t ptrauth_data_tests(void);
45
46 /*
47 * Given an existing PAC pointer (ptr), its declaration type (decl), the (key)
48 * used to sign it and the string discriminator (discr), extract the raw pointer
49 * along with the signature and compare it with one computed on the fly
50 * via ptrauth_sign_unauthenticated().
51 *
52 * If the two mismatch, return an error and fail the test.
53 */
54 #define VALIDATE_PTR(decl, ptr, key, discr) { \
55 decl raw = *(decl *)&(ptr); \
56 decl cmp = ptrauth_sign_unauthenticated(ptr, key, \
57 ptrauth_blend_discriminator(&ptr, ptrauth_string_discriminator(discr))); \
58 if (cmp != raw) { \
59 printf("kern.run_pac_test: %s (%s) (discr=%s) is not signed as expected (%p vs %p)\n", #decl, #ptr, #discr, raw, cmp); \
60 kr = KERN_INVALID_ADDRESS; \
61 } \
62 }
63
64 /*
65 * Allocate the containing structure, and store a pointer to the desired member,
66 * which should be subject to pointer signing.
67 */
68 #define ALLOC_VALIDATE_DATA_PTR(structure, decl, member, discr) { \
69 __typed_allocators_ignore_push \
70 structure *tmp = kalloc_data(sizeof(structure), Z_WAITOK | Z_ZERO); \
71 if (!tmp) return KERN_NO_SPACE; \
72 tmp->member = (void*)0xffffffff41414141; \
73 VALIDATE_DATA_PTR(decl, tmp->member, discr) \
74 kfree_data(tmp, sizeof(structure)); \
75 __typed_allocators_ignore_pop \
76 }
77
78 #define VALIDATE_DATA_PTR(decl, ptr, discr) VALIDATE_PTR(decl, ptr, ptrauth_key_process_independent_data, discr)
79
80 static kern_return_t
ptrauth_data_blob_tests(void)81 ptrauth_data_blob_tests(void)
82 {
83 /*
84 * Regression test for rdar://103054854
85 */
86 unsigned char a[] = { 0x41, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
87 unsigned char b[] = { 0x41, 0x41, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
88
89 if (ptrauth_utils_sign_blob_generic(a, 1, 0, 0) != ptrauth_utils_sign_blob_generic(b, 1, 0, 0)) {
90 printf("kern.run_pac_test: ptrauth_data_blob_tests: mismatched blob signatures (rdar://103054854)\n");
91 return KERN_FAILURE;
92 }
93
94 return KERN_SUCCESS;
95 }
96
97 /*
98 * Validate that a pointer that is supposed to be signed, is, and that the signature
99 * matches based on signing key, location and discriminator
100 */
101 kern_return_t
ptrauth_data_tests(void)102 ptrauth_data_tests(void)
103 {
104 int kr = KERN_SUCCESS;
105
106 /* task_t */
107 ALLOC_VALIDATE_DATA_PTR(struct task, vm_map_t, map, "task.map");
108 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_task_ports[0], "task.itk_task_ports");
109 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_settable_self, "task.itk_settable_self");
110 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_host, "task.itk_host");
111 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_bootstrap, "task.itk_bootstrap");
112 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_debug_control, "task.itk_debug_control");
113 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_space *, itk_space, "task.itk_space");
114 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_task_access, "task.itk_task_access");
115 ALLOC_VALIDATE_DATA_PTR(struct task, struct ipc_port *, itk_resume, "task.itk_resume");
116
117 /* _vm_map */
118 ALLOC_VALIDATE_DATA_PTR(struct _vm_map, pmap_t, pmap, "_vm_map.pmap");
119
120 /* ipc_port */
121 ALLOC_VALIDATE_DATA_PTR(struct ipc_port, ipc_kobject_label_t, ip_kolabel, "ipc_port.kolabel");
122
123 /* ipc_kobject_label */
124 ALLOC_VALIDATE_DATA_PTR(struct ipc_kobject_label, ipc_kobject_t, ikol_alt_port, "ipc_kobject_label.ikol_alt_port");
125
126 /* ipc_entry */
127 ALLOC_VALIDATE_DATA_PTR(struct ipc_entry, struct ipc_object *, ie_object, "ipc_entry.ie_object");
128
129 /* ipc_kmsg */
130 ALLOC_VALIDATE_DATA_PTR(struct ipc_kmsg, struct ipc_port *, ikm_prealloc, "kmsg.ikm_prealloc");
131 ALLOC_VALIDATE_DATA_PTR(struct ipc_kmsg, void *, ikm_udata, "kmsg.ikm_udata");
132 ALLOC_VALIDATE_DATA_PTR(struct ipc_kmsg, struct ipc_port *, ikm_voucher_port, "kmsg.ikm_voucher_port");
133
134 kr = ptrauth_data_blob_tests();
135 return kr;
136 }
137
138 #endif /* __has_feature(ptrauth_calls) */
139 #endif /* DEVELOPMENT || DEBUG */
140