1 #include <darwintest.h>
2 #include <servers/bootstrap.h>
3 #include <mach/mach.h>
4 #include <mach/message.h>
5 #include <stdlib.h>
6 #include <sys/sysctl.h>
7 #include <unistd.h>
8 #include <darwintest_multiprocess.h>
9 #include <excserver.h>
10 #include <spawn.h>
11 #include <spawn_private.h>
12 #include <libproc_internal.h>
13 #include <signal.h>
14
15 #include <IOKit/IOKitLib.h>
16
17 T_GLOBAL_META(
18 T_META_NAMESPACE("xnu.ipc"),
19 T_META_RUN_CONCURRENTLY(TRUE),
20 T_META_RADAR_COMPONENT_NAME("xnu"),
21 T_META_RADAR_COMPONENT_VERSION("IPC"),
22 T_META_TAG_VM_PREFERRED);
23
24 #define TASK_EXC_GUARD_MP_DELIVER 0x10
25 #define MAX_ARGV 2
26
27 extern char **environ;
28
29 kern_return_t
catch_mach_exception_raise_state(mach_port_t exception_port,exception_type_t exception,const mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,const thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)30 catch_mach_exception_raise_state(mach_port_t exception_port,
31 exception_type_t exception,
32 const mach_exception_data_t code,
33 mach_msg_type_number_t code_count,
34 int * flavor,
35 const thread_state_t old_state,
36 mach_msg_type_number_t old_state_count,
37 thread_state_t new_state,
38 mach_msg_type_number_t * new_state_count)
39 {
40 #pragma unused(exception_port, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
41 T_FAIL("Unsupported catch_mach_exception_raise_state");
42 return KERN_NOT_SUPPORTED;
43 }
44
45 kern_return_t
catch_mach_exception_raise_state_identity(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count,int * flavor,thread_state_t old_state,mach_msg_type_number_t old_state_count,thread_state_t new_state,mach_msg_type_number_t * new_state_count)46 catch_mach_exception_raise_state_identity(mach_port_t exception_port,
47 mach_port_t thread,
48 mach_port_t task,
49 exception_type_t exception,
50 mach_exception_data_t code,
51 mach_msg_type_number_t code_count,
52 int * flavor,
53 thread_state_t old_state,
54 mach_msg_type_number_t old_state_count,
55 thread_state_t new_state,
56 mach_msg_type_number_t * new_state_count)
57 {
58 #pragma unused(exception_port, thread, task, exception, code, code_count, flavor, old_state, old_state_count, new_state, new_state_count)
59 T_FAIL("Unsupported catch_mach_exception_raise_state_identity");
60 return KERN_NOT_SUPPORTED;
61 }
62
63 kern_return_t
catch_mach_exception_raise(mach_port_t exception_port,mach_port_t thread,mach_port_t task,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t code_count)64 catch_mach_exception_raise(mach_port_t exception_port,
65 mach_port_t thread,
66 mach_port_t task,
67 exception_type_t exception,
68 mach_exception_data_t code,
69 mach_msg_type_number_t code_count)
70 {
71 #pragma unused(exception_port, task, thread, code_count)
72 T_ASSERT_EQ(exception, EXC_GUARD, "exception type");
73 T_LOG("Exception raised with exception code : %llx\n", *code);
74 T_END;
75 return KERN_SUCCESS;
76 }
77
78 typedef struct {
79 mach_msg_header_t header;
80 mach_msg_body_t body;
81 mach_msg_port_descriptor_t port_descriptor;
82 mach_msg_trailer_t trailer; // subtract this when sending
83 } ipc_complex_message;
84
85 struct args {
86 char *server_port_name;
87 mach_port_t server_port;
88 };
89
90 void parse_args(struct args *args);
91 void server_setup(struct args* args);
92 void* exception_server_thread(void *arg);
93 mach_port_t create_exception_port(void);
94
95 #define TEST_TIMEOUT 10
96
97 void
parse_args(struct args * args)98 parse_args(struct args *args)
99 {
100 args->server_port_name = "TEST_IMMOVABLE_SEND";
101 args->server_port = MACH_PORT_NULL;
102 }
103
104 /* Create a mach IPC listener which will respond to the client's message */
105 void
server_setup(struct args * args)106 server_setup(struct args *args)
107 {
108 kern_return_t ret;
109 mach_port_t bsport;
110
111 ret = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE,
112 &args->server_port);
113 T_ASSERT_MACH_SUCCESS(ret, "server: mach_port_allocate()");
114
115 ret = mach_port_insert_right(mach_task_self(), args->server_port, args->server_port,
116 MACH_MSG_TYPE_MAKE_SEND);
117 T_ASSERT_MACH_SUCCESS(ret, "server: mach_port_insert_right()");
118
119 ret = task_get_bootstrap_port(mach_task_self(), &bsport);
120 T_ASSERT_MACH_SUCCESS(ret, "server: task_get_bootstrap_port()");
121
122 ret = bootstrap_register(bsport, args->server_port_name, args->server_port);
123 T_ASSERT_MACH_SUCCESS(ret, "server: bootstrap_register()");
124
125 T_LOG("server: waiting for IPC messages from client on port '%s'.\n",
126 args->server_port_name);
127 }
128
129 mach_port_t
create_exception_port()130 create_exception_port()
131 {
132 kern_return_t kret;
133 mach_port_t exc_port = MACH_PORT_NULL;
134 mach_port_t task = mach_task_self();
135
136 kret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
137 T_EXPECT_MACH_SUCCESS(kret, "mach_port_allocate exc_port");
138
139 kret = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
140 T_EXPECT_MACH_SUCCESS(kret, "mach_port_insert_right exc_port");
141
142 return exc_port;
143 }
144
145 void *
exception_server_thread(void * arg)146 exception_server_thread(void *arg)
147 {
148 kern_return_t kr;
149 mach_port_t exc_port = *(mach_port_t *)arg;
150 T_EXPECT_NE(exc_port, MACH_PORT_NULL, "exception port is not null");
151
152 /* Handle exceptions on exc_port */
153 kr = mach_msg_server(mach_exc_server, 4096, exc_port, 0);
154 T_EXPECT_MACH_SUCCESS(kr, "mach_msg_server");
155
156 return NULL;
157 }
158
159 T_DECL(catch_immovable_send_exception, "Send guard port descriptor to another process", T_META_IGNORECRASHES(".*immovable_send_client.*"))
160 {
161 uint32_t task_exc_guard = 0;
162 size_t te_size = sizeof(&task_exc_guard);
163 kern_return_t kr;
164 mach_msg_type_number_t maskCount = 1;
165 exception_mask_t mask;
166 exception_handler_t handler;
167 exception_behavior_t behavior;
168 thread_state_flavor_t flavor;
169 mach_port_t task = mach_task_self();
170 struct args* server_args = (struct args*)malloc(sizeof(struct args));
171 posix_spawnattr_t attrs;
172 char *test_prog_name = "./immovable_send_client";
173 char *child_args[MAX_ARGV];
174
175 T_LOG("Check if task_exc_guard exception has been enabled\n");
176 sysctlbyname("kern.task_exc_guard_default", &task_exc_guard, &te_size, NULL, 0);
177 //TODO: check if sysctlbyname is successful
178
179 /* Create the bootstrap port */
180 parse_args(server_args);
181 server_setup(server_args);
182
183 /* Create the exception port for the server */
184 mach_port_t exc_port = create_exception_port();
185 T_EXPECT_NOTNULL(exc_port, "Create a new exception port");
186
187 pthread_t s_exc_thread;
188
189 /* Create exception serving thread */
190 int ret = pthread_create(&s_exc_thread, NULL, exception_server_thread, &exc_port);
191 T_EXPECT_POSIX_SUCCESS(ret, "pthread_create exception_server_thread");
192
193 /* Get current exception ports */
194 kr = task_get_exception_ports(task, EXC_MASK_GUARD, &mask,
195 &maskCount, &handler, &behavior, &flavor);
196 T_EXPECT_MACH_SUCCESS(kr, "task_get_exception_ports");
197
198 /* Initialize posix_spawn attributes */
199 posix_spawnattr_init(&attrs);
200
201 int err = posix_spawnattr_setexceptionports_np(&attrs, EXC_MASK_GUARD, exc_port,
202 (exception_behavior_t) (EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES), 0);
203 T_EXPECT_POSIX_SUCCESS(err, "posix_spawnattr_setflags");
204
205 child_args[0] = test_prog_name;
206 child_args[1] = NULL;
207
208 err = posix_spawn(NULL, child_args[0], NULL, &attrs, &child_args[0], environ);
209 T_EXPECT_POSIX_SUCCESS(err, "posix_spawn immovable_send_client");
210
211 int child_status;
212 /* Wait for child and check for exception */
213 if (-1 == wait4(-1, &child_status, 0, NULL)) {
214 T_FAIL("wait4: child mia");
215 }
216
217 if (WIFEXITED(child_status) && WEXITSTATUS(child_status)) {
218 T_LOG("Child exited with status = %x", child_status);
219 }
220
221 sigsuspend(0);
222 }
223