1 /* 2 * Copyright (c) 2006 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SYS_CODESIGN_H_ 30 #define _SYS_CODESIGN_H_ 31 32 #include <kern/cs_blobs.h> 33 34 /* MAC flags used by F_ADDFILESIGS_* */ 35 #define MAC_VNODE_CHECK_DYLD_SIM 0x1 /* tells the MAC framework that dyld-sim is being loaded */ 36 37 #define CLEAR_LV_ENTITLEMENT "com.apple.private.security.clear-library-validation" 38 #define OVERRIDE_PLUGIN_HOST_ENTITLEMENT "com.apple.private.security.override-plugin-host-detection" 39 40 /* csops operations */ 41 #define CS_OPS_STATUS 0 /* return status */ 42 #define CS_OPS_MARKINVALID 1 /* invalidate process */ 43 #define CS_OPS_MARKHARD 2 /* set HARD flag */ 44 #define CS_OPS_MARKKILL 3 /* set KILL flag (sticky) */ 45 #ifdef KERNEL_PRIVATE 46 /* CS_OPS_PIDPATH 4 */ 47 #endif 48 #define CS_OPS_CDHASH 5 /* get code directory hash */ 49 #define CS_OPS_PIDOFFSET 6 /* get offset of active Mach-o slice */ 50 #define CS_OPS_ENTITLEMENTS_BLOB 7 /* get entitlements blob */ 51 #define CS_OPS_MARKRESTRICT 8 /* set RESTRICT flag (sticky) */ 52 #define CS_OPS_SET_STATUS 9 /* set codesign flags */ 53 #define CS_OPS_BLOB 10 /* get codesign blob */ 54 #define CS_OPS_IDENTITY 11 /* get codesign identity */ 55 #define CS_OPS_CLEARINSTALLER 12 /* clear INSTALLER flag */ 56 #define CS_OPS_CLEARPLATFORM 13 /* clear platform binary status (DEVELOPMENT-only) */ 57 #define CS_OPS_TEAMID 14 /* get team id */ 58 #define CS_OPS_CLEAR_LV 15 /* clear the library validation flag */ 59 #define CS_OPS_DER_ENTITLEMENTS_BLOB 16 /* get der entitlements blob */ 60 #define CS_OPS_VALIDATION_CATEGORY 17 /* get process validation category */ 61 62 #define CS_MAX_TEAMID_LEN 64 63 64 #ifndef KERNEL 65 66 #include <sys/types.h> 67 #include <mach/message.h> 68 69 __BEGIN_DECLS 70 /* code sign operations */ 71 int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize); 72 int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token); 73 __END_DECLS 74 75 #else /* !KERNEL */ 76 77 #include <mach/machine.h> 78 #include <mach/vm_types.h> 79 80 #include <sys/cdefs.h> 81 #include <sys/_types/_off_t.h> 82 83 struct vnode; 84 struct cs_blob; 85 struct fileglob; 86 87 __BEGIN_DECLS 88 int cs_valid(struct proc *); 89 int cs_process_enforcement(struct proc *); 90 int cs_process_global_enforcement(void); 91 int cs_system_enforcement(void); 92 int cs_vm_supports_4k_translations(void); 93 int cs_require_lv(struct proc *); 94 int csproc_forced_lv(struct proc* p); 95 int cs_system_require_lv(void); 96 uint32_t cs_entitlement_flags(struct proc *p); 97 int cs_entitlements_blob_get_vnode(struct vnode *, off_t, void **, size_t *); 98 int cs_entitlements_dictionary_copy_vnode(struct vnode *, off_t, void **); 99 int cs_entitlements_blob_get(struct proc *, void **, size_t *); 100 #ifdef KERNEL_PRIVATE 101 int cs_entitlements_dictionary_copy(struct proc *, void **); 102 #endif 103 int cs_restricted(struct proc *); 104 uint8_t *__counted_by_or_null(CS_CDHASH_LEN) cs_get_cdhash(struct proc *); 105 cs_launch_type_t launch_constraint_data_get_launch_type(launch_constraint_data_t lcd); 106 107 struct cs_blob * csproc_get_blob(struct proc *); 108 struct cs_blob * csvnode_get_blob(struct vnode *, off_t); 109 void csvnode_print_debug(struct vnode *); 110 111 off_t csblob_get_base_offset(struct cs_blob *); 112 vm_size_t csblob_get_size(struct cs_blob *); 113 vm_address_t csblob_get_addr(struct cs_blob *); 114 const char * csblob_get_teamid(struct cs_blob *); 115 const char * csblob_get_identity(struct cs_blob *); 116 const uint8_t * csblob_get_cdhash(struct cs_blob *); 117 const CS_CodeDirectory* csblob_get_code_directory(struct cs_blob *csblob); 118 int csblob_get_platform_binary(struct cs_blob *); 119 void csblob_invalidate_flags(struct cs_blob *blob); 120 void csvnode_invalidate_flags(struct vnode * vp); 121 unsigned int csblob_get_flags(struct cs_blob *); 122 uint8_t csblob_get_hashtype(struct cs_blob const *); 123 unsigned int csblob_get_signer_type(struct cs_blob *); 124 #if DEVELOPMENT || DEBUG 125 void csproc_clear_platform_binary(struct proc *); 126 #endif 127 128 #define XNU_CSBLOB_HAS_VALIDATION_CATEGORY 1 129 int csblob_set_validation_category(struct cs_blob *, unsigned int); 130 unsigned int csblob_get_validation_category(struct cs_blob *); 131 132 #include <uuid/uuid.h> 133 #define XNU_SUPPORTS_PROVISIONING_PROFILE_UUID 1 134 int csblob_register_profile_uuid(struct cs_blob *, const uuid_t, void*, vm_size_t); 135 136 void csproc_disable_enforcement(struct proc* p); 137 void csproc_mark_invalid_allowed(struct proc* p); 138 int csproc_check_invalid_allowed(struct proc* p); 139 int csproc_hardened_runtime(struct proc* p); 140 141 int csblob_get_entitlements(struct cs_blob *, void **, size_t *); 142 int csblob_get_der_entitlements(struct cs_blob *, const CS_GenericBlob **, size_t *); 143 #define XNU_HAS_GET_DER_ENTITLEMENTS_UNSAFE 1 144 const CS_GenericBlob* csblob_get_der_entitlements_unsafe(struct cs_blob *); 145 146 const CS_GenericBlob * 147 csblob_find_blob(struct cs_blob *, uint32_t, uint32_t); 148 const CS_GenericBlob * 149 csblob_find_blob_bytes(const uint8_t *, size_t, uint32_t, uint32_t); 150 void * csblob_entitlements_dictionary_copy(struct cs_blob *csblob); 151 void csblob_entitlements_dictionary_set(struct cs_blob *csblob, void * entitlements); 152 153 // New APIs 154 void csblob_os_entitlements_set(struct cs_blob *csblob, void * entitlements); 155 void * csblob_os_entitlements_copy(struct cs_blob *csblob); 156 void * csblob_os_entitlements_get(struct cs_blob *csblob); 157 void * csblob_get_storage_addr(struct cs_blob *csblob); 158 /* 159 * Mostly convenience functions below 160 */ 161 162 const char * csproc_get_teamid(struct proc *); 163 const char * csproc_get_identity(struct proc *); 164 const char * csvnode_get_teamid(struct vnode *, off_t); 165 int csproc_get_platform_binary(struct proc *); 166 int csproc_get_prod_signed(struct proc *); 167 const char * csfg_get_teamid(struct fileglob *); 168 const char * csfg_get_supplement_teamid(struct fileglob *); 169 int csfg_get_path(struct fileglob *, char *, int *); 170 int csfg_get_platform_binary(struct fileglob *); 171 int csfg_get_supplement_platform_binary(struct fileglob *); 172 uint8_t * csfg_get_cdhash(struct fileglob *, uint64_t, size_t *); 173 uint8_t * csfg_get_supplement_cdhash(struct fileglob *, uint64_t, size_t *); 174 const uint8_t * csfg_get_supplement_linkage_cdhash(struct fileglob *, uint64_t, size_t *); 175 int csfg_get_prod_signed(struct fileglob *); 176 int csfg_get_supplement_prod_signed(struct fileglob *fg); 177 unsigned int csfg_get_signer_type(struct fileglob *); 178 unsigned int csfg_get_supplement_signer_type(struct fileglob *); 179 unsigned int csfg_get_validation_category(struct fileglob *fg, uint64_t offset); 180 unsigned int csfg_get_supplement_validation_category(struct fileglob *fg, uint64_t offset); 181 const char *csfg_get_identity(struct fileglob *fg, off_t offset); 182 unsigned int csproc_get_signer_type(struct proc *); 183 184 uint8_t csfg_get_platform_identifier(struct fileglob *, off_t); 185 uint8_t csvnode_get_platform_identifier(struct vnode *, off_t); 186 uint8_t csproc_get_platform_identifier(struct proc *); 187 188 struct cs_blob* csfg_get_csblob(struct fileglob*, uint64_t); 189 struct cs_blob* csfg_get_supplement_csblob(struct fileglob*, uint64_t); 190 191 extern int cs_debug; 192 extern int cs_debug_fail_on_unsigned_code; 193 extern unsigned int cs_debug_unsigned_exec_failures; 194 extern unsigned int cs_debug_unsigned_mmap_failures; 195 196 int cs_blob_create_validated(vm_address_t* addr, vm_size_t size, 197 struct cs_blob ** ret_blob, CS_CodeDirectory const **ret_cd); 198 199 void cs_blob_free(struct cs_blob *blob); 200 201 #ifdef XNU_KERNEL_PRIVATE 202 203 int cs_allow_invalid(struct proc *); 204 int cs_invalid_page(addr64_t vaddr, boolean_t *cs_killed); 205 void cs_process_invalidated(struct proc *); 206 int csproc_get_platform_path(struct proc *); 207 int csproc_get_validation_category(struct proc *, unsigned int *); 208 209 #if !SECURE_KERNEL 210 extern int cs_enforcement_panic; 211 #endif 212 213 #endif /* XNU_KERNEL_PRIVATE */ 214 215 __END_DECLS 216 217 #endif /* KERNEL */ 218 219 #endif /* _SYS_CODESIGN_H_ */ 220