1 /*
2 * Copyright (c) 2019-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * tests for scheduler hygiene system call rejection feature
31 */
32
33 #include <darwintest.h>
34 #include <darwintest_posix.h>
35 #include <darwintest_utils.h>
36
37 #include <errno.h>
38 #include <libgen.h>
39 #include <pthread.h>
40 #include <signal.h>
41 #include <stdarg.h>
42 #include <stdio.h>
43 #include <string.h>
44 #include <sys/sysctl.h>
45 #include <unistd.h>
46
47 #include <mach/mach.h>
48 #include <mach/mach_traps.h>
49 #include <mach/mach_types.h>
50
51 #include <darwintest.h>
52 #include <darwintest_utils.h>
53
54 #include <sys/kern_debug.h>
55 #include <sys/stat.h>
56
57 #include <mach-o/dyld.h>
58
59 T_GLOBAL_META(
60 T_META_NAMESPACE("xnu.debug"),
61 T_META_RADAR_COMPONENT_NAME("xnu"),
62 T_META_RADAR_COMPONENT_VERSION("arm"),
63 T_META_OWNER("julien_oster")
64 );
65
66 static int const ALIVE = 0;
67 static int const DEAD = 1;
68
69 static int
helper(char ** args)70 helper(char **args)
71 {
72 int ret = 0;
73 int status = 0;
74 int signal = 0;
75 int timeout = 30;
76
77 pid_t child_pid = 0;
78 bool wait_ret = true;
79
80 char binary_path[MAXPATHLEN], *binary_dir = NULL;
81 uint32_t path_size = sizeof(binary_path);
82
83 ret = _NSGetExecutablePath(binary_path, &path_size);
84 T_QUIET; T_ASSERT_EQ(ret, 0, "_NSGetExecutablePath: %s, size: %d", binary_path, path_size);
85 binary_dir = dirname(binary_path);
86 T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(binary_dir, "get binary directory: %s", binary_dir);
87
88 char const *helper_binary = "debug_syscall_rejection_helper";
89 snprintf(binary_path, MAXPATHLEN, "%s/%s", binary_dir, helper_binary);
90 args[0] = binary_path;
91
92 ret = dt_launch_tool(&child_pid, args, false, NULL, NULL);
93 T_QUIET; T_ASSERT_EQ(ret, 0, "launch helper: %s", helper_binary);
94
95 wait_ret = dt_waitpid(child_pid, &status, &signal, timeout);
96
97 if (wait_ret) {
98 // T_LOG("helper returned: %d", status);
99
100 T_EXPECT_EQ(status, 0, "helper returned exit code %i", status);
101
102 return 0;
103 }
104
105 // helper crashed (possibly expectedly)
106
107 if (signal != 0) {
108 // T_LOG("signal terminated helper: %d", signal);
109
110 T_EXPECT_EQ(signal, SIGKILL, "helper terminated with signal %i", signal);
111 return 1;
112 }
113
114 T_FAIL("helper terminated with unexpected condition (status: %i, signal: %i)", status, signal);
115 return 2;
116 }
117
118 static void
do_test(char const * msg,int expectation,...)119 do_test(char const *msg, int expectation, ...)
120 {
121 size_t const arg_max_count = 128;
122 char *args[arg_max_count] = {0};
123
124 va_list ap;
125 va_start(ap, expectation);
126
127 char *arg;
128 int i = 1;
129 while ((arg = va_arg(ap, char *)) != NULL) {
130 T_QUIET; T_ASSERT_LT(i, (int)arg_max_count, "no args overflow");
131 args[i++] = arg;
132 }
133
134 va_end(ap);
135
136 T_EXPECT_EQ(helper(args), expectation, "%s", msg);
137 }
138
139 #define ALLOW(pos, mask) "-a", "-s", #mask, "-i", #pos
140 #define DENY(pos, mask) "-d", "-s", #mask, "-i", #pos
141
142 T_DECL(debug_syscall_rejection_tests,
143 "Verify that syscall rejection works",
144 T_META_SYSCTL_INT("kern.debug_syscall_rejection_mode=1"),
145 T_META_REQUIRES_SYSCTL_EQ("kern.debug_syscall_rejection_mode", 1), T_META_TAG_VM_PREFERRED)
146 {
147 int old_mode;
148 size_t old_mode_size = sizeof(old_mode);
149 int new_mode = 2;
150
151 // test syscall mode switching (even if already done by T_META_SYSCTL_INT)
152 int ret = sysctlbyname("kern.debug_syscall_rejection_mode", &old_mode, &old_mode_size, &new_mode, sizeof(new_mode));
153 if (ret != 0) {
154 T_ASSERT_FAIL("Syscall rejection mode switching failed: ret %d, errno %d", ret, errno);
155 }
156
157 T_ASSERT_EQ(old_mode_size, sizeof(old_mode), "sysctl returns correct size");
158
159 char * const set_mask_12 = "12: chdir debug_syscall_reject_config";
160 size_t const set_mask_12_size = strlen(set_mask_12);
161 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.syscall_rejection_masks", NULL, NULL, set_mask_12, set_mask_12_size),
162 "set syscall rej test mask");
163
164 do_test("default is disallow all", DEAD, NULL);
165 do_test("disallow all dies", DEAD, DENY(0, 1), NULL);
166 do_test("allow all lives", ALIVE, ALLOW(0, 1), NULL);
167 do_test("allow testmask lives", ALIVE, ALLOW(0, 12), NULL);
168 do_test("disallow testmask overrides dies", DEAD, ALLOW(0, 1), DENY(1, 12), NULL);
169
170 // check that all slots work as expected
171 int const slots = 16;
172 for (int i = 0; i < slots - 1; i++) {
173 size_t const max_pos_len = 16;
174 char pos1[max_pos_len], pos2[max_pos_len];
175 T_QUIET; T_ASSERT_GE_INT(snprintf(pos1, max_pos_len, "%u", i), 0, "creating pos1");
176 T_QUIET; T_ASSERT_GE_INT(snprintf(pos2, max_pos_len, "%u", i + 1), 0, "creating pos2");
177
178 char *args[] = {DENY(pos1, ALL), ALLOW(pos2, 12), NULL};
179 T_EXPECT_EQ(helper(args), ALIVE, "pos %s/%s works (alive)", pos1, pos2);
180 char *args_d[] = {ALLOW(pos1, ALL), DENY(pos2, 12), NULL};
181 T_EXPECT_EQ(helper(args_d), DEAD, "pos %s/%s works (dead)", pos1, pos2);
182 }
183
184 // check non-fatal mode
185 new_mode = 1;
186 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)),
187 "set syscall rej mode to non-fatal");
188
189 do_test("non-fatal: default is disallow all", ALIVE, NULL);
190 do_test("non-fatal: disallow all", ALIVE, DENY(0, 1), NULL);
191 do_test("non-fatal: allow all", ALIVE, ALLOW(0, 1), NULL);
192 do_test("non-fatal: allow testmask", ALIVE, ALLOW(0, 12), NULL);
193 do_test("non-fatal: disallow testmask overrides", ALIVE, ALLOW(0, 1), DENY(1, 12), NULL);
194
195 // check force-fatal override
196 new_mode = 1;
197 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)),
198 "set syscall rej mode to non-fatal");
199
200 do_test("force-fatal: default is disallow all", DEAD, "-F", NULL);
201 do_test("force-fatal: disallow all", DEAD, DENY(0, 1), "-F", NULL);
202 do_test("force-fatal: allow all", ALIVE, ALLOW(0, 1), "-F", NULL);
203 do_test("force-fatal: allow testmask", ALIVE, ALLOW(0, 12), "-F", NULL);
204 do_test("force-fatal: disallow testmask overrides", DEAD, ALLOW(0, 1), DENY(1, 12), "-F", NULL);
205 }
206
207 T_DECL(debug_enable_syscall_rejection_crash_count,
208 "count syscall rejection crash reports",
209 T_META_ENABLED(FALSE), /* currently a manual test */
210 T_META_TAG_VM_PREFERRED
211 )
212 {
213 syscall_rejection_selector_t masks[] = {
214 SYSCALL_REJECTION_ALLOW(SYSCALL_REJECTION_ALL),
215 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
216 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
217 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
218 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
219 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
220 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
221 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
222 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
223 SYSCALL_REJECTION_DENY(2),
224 SYSCALL_REJECTION_DENY(2),
225 SYSCALL_REJECTION_DENY(2),
226 SYSCALL_REJECTION_DENY(2),
227 SYSCALL_REJECTION_DENY(2),
228 SYSCALL_REJECTION_DENY(2),
229 SYSCALL_REJECTION_DENY(2),
230 };
231
232 int ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_DEFAULT);
233
234 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config");
235
236 ret = chdir("/tmp");
237 ret = chdir("/tmp");
238 ret = chdir("/tmp");
239
240 printf("chdir: %i\n", ret);
241
242 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE);
243
244 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once");
245
246 ret = chdir("/tmp");
247 ret = chdir("/tmp");
248 ret = chdir("/tmp");
249
250 printf("chdir once: %i\n", ret);
251
252 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE);
253
254 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once ignore");
255
256 ret = chdir("/tmp");
257 ret = chdir("/tmp");
258 ret = chdir("/tmp");
259
260 printf("chdir once ignore: %i\n", ret);
261
262 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_FORCE_FATAL);
263
264 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config fatal");
265
266 ret = chdir("/tmp");
267 ret = chdir("/tmp");
268 ret = chdir("/tmp");
269
270 printf("chdir fatal: %i\n", ret); // unreached, but this is currently manual testing only
271
272 /*
273 * Expected number of crash reports:
274 * Mode Crashes Reason
275 * Ignore (0) 1 force fatal causes final crash
276 * Guard (1) 5 3 without ONCE flag, 1 with ONCE flag, final forced fatal crash
277 * Fatal (2) 1 first crash is fatal
278 */
279 }
280