1 /*
2  * Copyright (c) 2019-2021 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 
29 /*
30  * tests for scheduler hygiene system call rejection feature
31  */
32 
33 #include <darwintest.h>
34 #include <darwintest_posix.h>
35 #include <darwintest_utils.h>
36 
37 #include <errno.h>
38 #include <libgen.h>
39 #include <pthread.h>
40 #include <signal.h>
41 #include <stdarg.h>
42 #include <stdio.h>
43 #include <string.h>
44 #include <sys/sysctl.h>
45 #include <unistd.h>
46 
47 #include <mach/mach.h>
48 #include <mach/mach_traps.h>
49 #include <mach/mach_types.h>
50 
51 #include <darwintest.h>
52 #include <darwintest_utils.h>
53 
54 #include <sys/kern_debug.h>
55 #include <sys/stat.h>
56 
57 #include <mach-o/dyld.h>
58 
59 T_GLOBAL_META(
60 	T_META_NAMESPACE("xnu.debug"),
61 	T_META_RADAR_COMPONENT_NAME("xnu"),
62 	T_META_RADAR_COMPONENT_VERSION("arm"),
63 	T_META_OWNER("julien_oster")
64 	);
65 
66 static int const ALIVE = 0;
67 static int const DEAD = 1;
68 
69 static int
helper(char ** args)70 helper(char **args)
71 {
72 	int ret = 0;
73 	int status = 0;
74 	int signal = 0;
75 	int timeout = 30;
76 
77 	pid_t child_pid = 0;
78 	bool wait_ret = true;
79 
80 	char binary_path[MAXPATHLEN], *binary_dir = NULL;
81 	uint32_t path_size = sizeof(binary_path);
82 
83 	ret = _NSGetExecutablePath(binary_path, &path_size);
84 	T_QUIET; T_ASSERT_EQ(ret, 0, "_NSGetExecutablePath: %s, size: %d", binary_path, path_size);
85 	binary_dir = dirname(binary_path);
86 	T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(binary_dir, "get binary directory: %s", binary_dir);
87 
88 	char const *helper_binary = "debug_syscall_rejection_helper";
89 	snprintf(binary_path, MAXPATHLEN, "%s/%s", binary_dir, helper_binary);
90 	args[0] = binary_path;
91 
92 	ret = dt_launch_tool(&child_pid, args, false, NULL, NULL);
93 	T_QUIET; T_ASSERT_EQ(ret, 0, "launch helper: %s", helper_binary);
94 
95 	wait_ret = dt_waitpid(child_pid, &status, &signal, timeout);
96 
97 	if (wait_ret) {
98 		// T_LOG("helper returned: %d", status);
99 
100 		T_EXPECT_EQ(status, 0, "helper returned exit code %i", status);
101 
102 		return 0;
103 	}
104 
105 	// helper crashed (possibly expectedly)
106 
107 	if (signal != 0) {
108 		// T_LOG("signal terminated helper: %d", signal);
109 
110 		T_EXPECT_EQ(signal, SIGKILL, "helper terminated with signal %i", signal);
111 		return 1;
112 	}
113 
114 	T_FAIL("helper terminated with unexpected condition (status: %i, signal: %i)", status, signal);
115 	return 2;
116 }
117 
118 static void
do_test(char const * msg,int expectation,...)119 do_test(char const *msg, int expectation, ...)
120 {
121 	size_t const arg_max_count = 128;
122 	char *args[arg_max_count] = {0};
123 
124 	va_list ap;
125 	va_start(ap, expectation);
126 
127 	char *arg;
128 	int i = 1;
129 	while ((arg = va_arg(ap, char *)) != NULL) {
130 		T_QUIET; T_ASSERT_LT(i, (int)arg_max_count, "no args overflow");
131 		args[i++] = arg;
132 	}
133 
134 	va_end(ap);
135 
136 	T_EXPECT_EQ(helper(args), expectation, "%s", msg);
137 }
138 
139 #define ALLOW(pos, mask) "-a", "-s", #mask, "-i", #pos
140 #define DENY(pos, mask) "-d", "-s", #mask, "-i", #pos
141 
142 T_DECL(debug_syscall_rejection_tests,
143     "Verify that syscall rejection works",
144     T_META_SYSCTL_INT("kern.debug_syscall_rejection_mode=1"),
145     T_META_REQUIRES_SYSCTL_EQ("kern.debug_syscall_rejection_mode", 1), T_META_TAG_VM_PREFERRED)
146 {
147 	int old_mode;
148 	size_t old_mode_size = sizeof(old_mode);
149 	int new_mode = 2;
150 
151 	// test syscall mode switching (even if already done by T_META_SYSCTL_INT)
152 	int ret = sysctlbyname("kern.debug_syscall_rejection_mode", &old_mode, &old_mode_size, &new_mode, sizeof(new_mode));
153 	if (ret != 0) {
154 		T_ASSERT_FAIL("Syscall rejection mode switching failed: ret %d, errno %d", ret, errno);
155 	}
156 
157 	T_ASSERT_EQ(old_mode_size, sizeof(old_mode), "sysctl returns correct size");
158 
159 	char * const set_mask_12 = "12: chdir debug_syscall_reject_config";
160 	size_t const set_mask_12_size = strlen(set_mask_12);
161 	T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.syscall_rejection_masks", NULL, NULL, set_mask_12, set_mask_12_size),
162 	    "set syscall rej test mask");
163 
164 	do_test("default is disallow all", DEAD, NULL);
165 	do_test("disallow all dies", DEAD, DENY(0, 1), NULL);
166 	do_test("allow all lives", ALIVE, ALLOW(0, 1), NULL);
167 	do_test("allow testmask lives", ALIVE, ALLOW(0, 12), NULL);
168 	do_test("disallow testmask overrides dies", DEAD, ALLOW(0, 1), DENY(1, 12), NULL);
169 
170 	// check that all slots work as expected
171 	int const slots = 16;
172 	for (int i = 0; i < slots - 1; i++) {
173 		size_t const max_pos_len = 16;
174 		char pos1[max_pos_len], pos2[max_pos_len];
175 		T_QUIET; T_ASSERT_GE_INT(snprintf(pos1, max_pos_len, "%u", i), 0, "creating pos1");
176 		T_QUIET; T_ASSERT_GE_INT(snprintf(pos2, max_pos_len, "%u", i + 1), 0, "creating pos2");
177 
178 		char *args[] = {DENY(pos1, ALL), ALLOW(pos2, 12), NULL};
179 		T_EXPECT_EQ(helper(args), ALIVE, "pos %s/%s works (alive)", pos1, pos2);
180 		char *args_d[] = {ALLOW(pos1, ALL), DENY(pos2, 12), NULL};
181 		T_EXPECT_EQ(helper(args_d), DEAD, "pos %s/%s works (dead)", pos1, pos2);
182 	}
183 
184 	// check non-fatal mode
185 	new_mode = 1;
186 	T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)),
187 	    "set syscall rej mode to non-fatal");
188 
189 	do_test("non-fatal: default is disallow all", ALIVE, NULL);
190 	do_test("non-fatal: disallow all", ALIVE, DENY(0, 1), NULL);
191 	do_test("non-fatal: allow all", ALIVE, ALLOW(0, 1), NULL);
192 	do_test("non-fatal: allow testmask", ALIVE, ALLOW(0, 12), NULL);
193 	do_test("non-fatal: disallow testmask overrides", ALIVE, ALLOW(0, 1), DENY(1, 12), NULL);
194 
195 	// check force-fatal override
196 	new_mode = 1;
197 	T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)),
198 	    "set syscall rej mode to non-fatal");
199 
200 	do_test("force-fatal: default is disallow all", DEAD, "-F", NULL);
201 	do_test("force-fatal: disallow all", DEAD, DENY(0, 1), "-F", NULL);
202 	do_test("force-fatal: allow all", ALIVE, ALLOW(0, 1), "-F", NULL);
203 	do_test("force-fatal: allow testmask", ALIVE, ALLOW(0, 12), "-F", NULL);
204 	do_test("force-fatal: disallow testmask overrides", DEAD, ALLOW(0, 1), DENY(1, 12), "-F", NULL);
205 }
206 
207 T_DECL(debug_enable_syscall_rejection_crash_count,
208     "count syscall rejection crash reports",
209     T_META_ENABLED(FALSE), /* currently a manual test */
210     T_META_TAG_VM_PREFERRED
211     )
212 {
213 	syscall_rejection_selector_t masks[] = {
214 		SYSCALL_REJECTION_ALLOW(SYSCALL_REJECTION_ALL),
215 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
216 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
217 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
218 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
219 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
220 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
221 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
222 		SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL),
223 		SYSCALL_REJECTION_DENY(2),
224 		SYSCALL_REJECTION_DENY(2),
225 		SYSCALL_REJECTION_DENY(2),
226 		SYSCALL_REJECTION_DENY(2),
227 		SYSCALL_REJECTION_DENY(2),
228 		SYSCALL_REJECTION_DENY(2),
229 		SYSCALL_REJECTION_DENY(2),
230 	};
231 
232 	int ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_DEFAULT);
233 
234 	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config");
235 
236 	ret = chdir("/tmp");
237 	ret = chdir("/tmp");
238 	ret = chdir("/tmp");
239 
240 	printf("chdir: %i\n", ret);
241 
242 	ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE);
243 
244 	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once");
245 
246 	ret = chdir("/tmp");
247 	ret = chdir("/tmp");
248 	ret = chdir("/tmp");
249 
250 	printf("chdir once: %i\n", ret);
251 
252 	ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE);
253 
254 	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once ignore");
255 
256 	ret = chdir("/tmp");
257 	ret = chdir("/tmp");
258 	ret = chdir("/tmp");
259 
260 	printf("chdir once ignore: %i\n", ret);
261 
262 	ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_FORCE_FATAL);
263 
264 	T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config fatal");
265 
266 	ret = chdir("/tmp");
267 	ret = chdir("/tmp");
268 	ret = chdir("/tmp");
269 
270 	printf("chdir fatal: %i\n", ret); // unreached, but this is currently manual testing only
271 
272 	/*
273 	 * Expected number of crash reports:
274 	 * Mode				Crashes		Reason
275 	 * Ignore (0)		1			force fatal causes final crash
276 	 * Guard (1)		5			3 without ONCE flag, 1 with ONCE flag, final forced fatal crash
277 	 * Fatal (2)		1			first crash is fatal
278 	 */
279 }
280