1 /*
2 * Copyright (c) 2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23 #include <stdbool.h>
24
25 #include <sys/errno.h>
26
27 #include <sys/kern_debug.h>
28
29 /* Syscall entry points */
30 int __debug_syscall_reject_config(uint64_t packed_selectors1, uint64_t packed_selectors2, uint64_t flags);
31
32 static bool supported = true;
33
34 typedef uint64_t packed_selector_t;
35
36 int
debug_syscall_reject_config(const syscall_rejection_selector_t * selectors,size_t len,uint64_t flags)37 debug_syscall_reject_config(const syscall_rejection_selector_t *selectors, size_t len, uint64_t flags)
38 {
39 _Static_assert(sizeof(syscall_rejection_selector_t) == 1, "selector size is not 1 byte");
40
41 if (!supported) {
42 /* Gracefully ignored if unsupported (e.g. if compiled out of RELEASE). */
43 return 0;
44 }
45
46 if (len > (2 * 8 * sizeof(packed_selector_t)) / SYSCALL_REJECTION_SELECTOR_BITS) {
47 /* selectors are packed one per 7 bits into two uint64_ts */
48 errno = E2BIG;
49 return -1;
50 }
51
52 /*
53 * The masks to apply are passed to the kernel as packed selectors,
54 * which are just however many of the selector data type fit into one
55 * (or more) fields of the natural word size (i.e. a register). This
56 * avoids copying from user space.
57 *
58 * More specifically, at the time of this writing, a selector is 1
59 * byte wide, and there is only one uint64_t argument
60 * (args->packed_selectors), so up to 8 selectors can be specified,
61 * which are then stuffed into the 64 bits of the argument. If less
62 * than 8 masks are requested to be applied, the remaining selectors
63 * will just be left as 0, which naturally resolves as the "empty" or
64 * "NULL" mask that changes nothing.
65 *
66 * This libsyscall wrapper provides a more convenient interface where
67 * an array (up to 8 elements long) and its length are passed in,
68 * which the wrapper then packs into packed_selectors of the actual
69 * system call.
70 */
71
72 uint64_t packed_selectors[2] = { 0 };
73 int shift = 0;
74
75 #define s_left_shift(x, n) ((n) < 0 ? ((x) >> -(n)) : ((x) << (n)))
76
77 for (int i = 0; i < len; i++, shift += SYSCALL_REJECTION_SELECTOR_BITS) {
78 int const second_shift = shift - 64;
79
80 if (shift < 8 * sizeof(packed_selector_t)) {
81 packed_selectors[0] |= ((uint64_t)(selectors[i]) & SYSCALL_REJECTION_SELECTOR_MASK) << shift;
82 }
83 if (second_shift > -SYSCALL_REJECTION_SELECTOR_BITS) {
84 packed_selectors[1] |= s_left_shift((uint64_t)(selectors[i] & SYSCALL_REJECTION_SELECTOR_MASK), second_shift);
85 }
86 }
87
88 int ret = __debug_syscall_reject_config(packed_selectors[0], packed_selectors[1], flags);
89
90 if (ret == -1 && errno == ENOTSUP) {
91 errno = 0;
92 supported = false;
93 return 0;
94 }
95
96 return ret;
97 }
98
99 /* Compatibility to old system call. */
100 int
debug_syscall_reject(const syscall_rejection_selector_t * selectors,size_t len)101 debug_syscall_reject(const syscall_rejection_selector_t *selectors, size_t len)
102 {
103 return debug_syscall_reject_config(selectors, len, SYSCALL_REJECTION_FLAGS_DEFAULT);
104 }
105