1 /* 2 * Copyright (c) 2019-2021 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 /* 30 * tests for scheduler hygiene system call rejection feature 31 */ 32 33 #include <darwintest.h> 34 #include <darwintest_posix.h> 35 #include <darwintest_utils.h> 36 37 #include <errno.h> 38 #include <libgen.h> 39 #include <pthread.h> 40 #include <signal.h> 41 #include <stdarg.h> 42 #include <stdio.h> 43 #include <string.h> 44 #include <sys/sysctl.h> 45 #include <unistd.h> 46 47 #include <mach/mach.h> 48 #include <mach/mach_traps.h> 49 #include <mach/mach_types.h> 50 51 #include <darwintest.h> 52 #include <darwintest_utils.h> 53 54 #include <sys/kern_debug.h> 55 #include <sys/stat.h> 56 57 #include <mach-o/dyld.h> 58 59 T_GLOBAL_META( 60 T_META_NAMESPACE("xnu.debug"), 61 T_META_RADAR_COMPONENT_NAME("xnu"), 62 T_META_RADAR_COMPONENT_VERSION("arm"), 63 T_META_OWNER("julien_oster") 64 ); 65 66 static int const ALIVE = 0; 67 static int const DEAD = 1; 68 69 static int 70 helper(char **args) 71 { 72 int ret = 0; 73 int status = 0; 74 int signal = 0; 75 int timeout = 30; 76 77 pid_t child_pid = 0; 78 bool wait_ret = true; 79 80 char binary_path[MAXPATHLEN], *binary_dir = NULL; 81 uint32_t path_size = sizeof(binary_path); 82 83 ret = _NSGetExecutablePath(binary_path, &path_size); 84 T_QUIET; T_ASSERT_EQ(ret, 0, "_NSGetExecutablePath: %s, size: %d", binary_path, path_size); 85 binary_dir = dirname(binary_path); 86 T_QUIET; T_WITH_ERRNO; T_ASSERT_NOTNULL(binary_dir, "get binary directory: %s", binary_dir); 87 88 char const *helper_binary = "debug_syscall_rejection_helper"; 89 snprintf(binary_path, MAXPATHLEN, "%s/%s", binary_dir, helper_binary); 90 args[0] = binary_path; 91 92 ret = dt_launch_tool(&child_pid, args, false, NULL, NULL); 93 T_QUIET; T_ASSERT_EQ(ret, 0, "launch helper: %s", helper_binary); 94 95 wait_ret = dt_waitpid(child_pid, &status, &signal, timeout); 96 97 if (wait_ret) { 98 // T_LOG("helper returned: %d", status); 99 100 T_EXPECT_EQ(status, 0, "helper returned exit code %i", status); 101 102 return 0; 103 } 104 105 // helper crashed (possibly expectedly) 106 107 if (signal != 0) { 108 // T_LOG("signal terminated helper: %d", signal); 109 110 T_EXPECT_EQ(signal, SIGKILL, "helper terminated with signal %i", signal); 111 return 1; 112 } 113 114 T_FAIL("helper terminated with unexpected condition (status: %i, signal: %i)", status, signal); 115 return 2; 116 } 117 118 static void 119 do_test(char const *msg, int expectation, ...) 120 { 121 size_t const arg_max_count = 128; 122 char *args[arg_max_count] = {0}; 123 124 va_list ap; 125 va_start(ap, expectation); 126 127 char *arg; 128 int i = 1; 129 while ((arg = va_arg(ap, char *)) != NULL) { 130 T_QUIET; T_ASSERT_LT(i, (int)arg_max_count, "no args overflow"); 131 args[i++] = arg; 132 } 133 134 va_end(ap); 135 136 T_EXPECT_EQ(helper(args), expectation, "%s", msg); 137 } 138 139 #define ALLOW(pos, mask) "-a", "-s", #mask, "-i", #pos 140 #define DENY(pos, mask) "-d", "-s", #mask, "-i", #pos 141 142 T_DECL(debug_syscall_rejection_tests, 143 "Verify that syscall rejection works", 144 T_META_SYSCTL_INT("kern.debug_syscall_rejection_mode=1"), 145 T_META_REQUIRES_SYSCTL_EQ("kern.debug_syscall_rejection_mode", 1), T_META_TAG_VM_PREFERRED) 146 { 147 int old_mode; 148 size_t old_mode_size = sizeof(old_mode); 149 int new_mode = 2; 150 151 // test syscall mode switching (even if already done by T_META_SYSCTL_INT) 152 int ret = sysctlbyname("kern.debug_syscall_rejection_mode", &old_mode, &old_mode_size, &new_mode, sizeof(new_mode)); 153 if (ret != 0) { 154 T_ASSERT_FAIL("Syscall rejection mode switching failed: ret %d, errno %d", ret, errno); 155 } 156 157 T_ASSERT_EQ(old_mode_size, sizeof(old_mode), "sysctl returns correct size"); 158 159 char * const set_mask_12 = "12: chdir debug_syscall_reject_config"; 160 size_t const set_mask_12_size = strlen(set_mask_12); 161 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.syscall_rejection_masks", NULL, NULL, set_mask_12, set_mask_12_size), 162 "set syscall rej test mask"); 163 164 do_test("default is disallow all", DEAD, NULL); 165 do_test("disallow all dies", DEAD, DENY(0, 1), NULL); 166 do_test("allow all lives", ALIVE, ALLOW(0, 1), NULL); 167 do_test("allow testmask lives", ALIVE, ALLOW(0, 12), NULL); 168 do_test("disallow testmask overrides dies", DEAD, ALLOW(0, 1), DENY(1, 12), NULL); 169 170 // check that all slots work as expected 171 int const slots = 16; 172 for (int i = 0; i < slots - 1; i++) { 173 size_t const max_pos_len = 16; 174 char pos1[max_pos_len], pos2[max_pos_len]; 175 T_QUIET; T_ASSERT_GE_INT(snprintf(pos1, max_pos_len, "%u", i), 0, "creating pos1"); 176 T_QUIET; T_ASSERT_GE_INT(snprintf(pos2, max_pos_len, "%u", i + 1), 0, "creating pos2"); 177 178 char *args[] = {DENY(pos1, ALL), ALLOW(pos2, 12), NULL}; 179 T_EXPECT_EQ(helper(args), ALIVE, "pos %s/%s works (alive)", pos1, pos2); 180 char *args_d[] = {ALLOW(pos1, ALL), DENY(pos2, 12), NULL}; 181 T_EXPECT_EQ(helper(args_d), DEAD, "pos %s/%s works (dead)", pos1, pos2); 182 } 183 184 // check non-fatal mode 185 new_mode = 1; 186 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)), 187 "set syscall rej mode to non-fatal"); 188 189 do_test("non-fatal: default is disallow all", ALIVE, NULL); 190 do_test("non-fatal: disallow all", ALIVE, DENY(0, 1), NULL); 191 do_test("non-fatal: allow all", ALIVE, ALLOW(0, 1), NULL); 192 do_test("non-fatal: allow testmask", ALIVE, ALLOW(0, 12), NULL); 193 do_test("non-fatal: disallow testmask overrides", ALIVE, ALLOW(0, 1), DENY(1, 12), NULL); 194 195 // check force-fatal override 196 new_mode = 1; 197 T_EXPECT_POSIX_SUCCESS(sysctlbyname("kern.debug_syscall_rejection_mode", NULL, NULL, &new_mode, sizeof(new_mode)), 198 "set syscall rej mode to non-fatal"); 199 200 do_test("force-fatal: default is disallow all", DEAD, "-F", NULL); 201 do_test("force-fatal: disallow all", DEAD, DENY(0, 1), "-F", NULL); 202 do_test("force-fatal: allow all", ALIVE, ALLOW(0, 1), "-F", NULL); 203 do_test("force-fatal: allow testmask", ALIVE, ALLOW(0, 12), "-F", NULL); 204 do_test("force-fatal: disallow testmask overrides", DEAD, ALLOW(0, 1), DENY(1, 12), "-F", NULL); 205 } 206 207 T_DECL(debug_enable_syscall_rejection_crash_count, 208 "count syscall rejection crash reports", 209 T_META_ENABLED(FALSE), /* currently a manual test */ 210 T_META_TAG_VM_PREFERRED 211 ) 212 { 213 syscall_rejection_selector_t masks[] = { 214 SYSCALL_REJECTION_ALLOW(SYSCALL_REJECTION_ALL), 215 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 216 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 217 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 218 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 219 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 220 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 221 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 222 SYSCALL_REJECTION_DENY(SYSCALL_REJECTION_NULL), 223 SYSCALL_REJECTION_DENY(2), 224 SYSCALL_REJECTION_DENY(2), 225 SYSCALL_REJECTION_DENY(2), 226 SYSCALL_REJECTION_DENY(2), 227 SYSCALL_REJECTION_DENY(2), 228 SYSCALL_REJECTION_DENY(2), 229 SYSCALL_REJECTION_DENY(2), 230 }; 231 232 int ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_DEFAULT); 233 234 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config"); 235 236 ret = chdir("/tmp"); 237 ret = chdir("/tmp"); 238 ret = chdir("/tmp"); 239 240 printf("chdir: %i\n", ret); 241 242 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE); 243 244 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once"); 245 246 ret = chdir("/tmp"); 247 ret = chdir("/tmp"); 248 ret = chdir("/tmp"); 249 250 printf("chdir once: %i\n", ret); 251 252 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_ONCE); 253 254 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config once ignore"); 255 256 ret = chdir("/tmp"); 257 ret = chdir("/tmp"); 258 ret = chdir("/tmp"); 259 260 printf("chdir once ignore: %i\n", ret); 261 262 ret = debug_syscall_reject_config(masks, sizeof(masks) / sizeof(masks[0]), SYSCALL_REJECTION_FLAGS_FORCE_FATAL); 263 264 T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(ret, "debug_syscall_reject_config fatal"); 265 266 ret = chdir("/tmp"); 267 ret = chdir("/tmp"); 268 ret = chdir("/tmp"); 269 270 printf("chdir fatal: %i\n", ret); // unreached, but this is currently manual testing only 271 272 /* 273 * Expected number of crash reports: 274 * Mode Crashes Reason 275 * Ignore (0) 1 force fatal causes final crash 276 * Guard (1) 5 3 without ONCE flag, 1 with ONCE flag, final forced fatal crash 277 * Fatal (2) 1 first crash is fatal 278 */ 279 } 280