1 #ifdef T_NAMESPACE
2 #undef T_NAMESPACE
3 #endif
4
5 #include <darwintest.h>
6
7 #include <mach/host_priv.h>
8 #include <mach/mach.h>
9 #include <mach/mach_types.h>
10 #include <mach/mach_vm.h>
11 #include <mach/processor_set.h>
12 #include <mach/task.h>
13 #include <sys/sysctl.h>
14 #include <mach_debug/ipc_info.h>
15 #include <unistd.h>
16
17 T_GLOBAL_META(T_META_NAMESPACE("xnu.ipc"),
18 T_META_RADAR_COMPONENT_NAME("xnu"),
19 T_META_RADAR_COMPONENT_VERSION("IPC"),
20 T_META_RUN_CONCURRENTLY(true),
21 T_META_TAG_VM_PREFERRED);
22
23 /*
24 * Attempt to inspect kernel_task using a task_inspect_t. Interact with the
25 * kernel in the same way top(1) and lsmp(1) do.
26 */
27
28 static int found_kernel_task = 0;
29
30 static void
check_secure_kernel(void)31 check_secure_kernel(void)
32 {
33 int secure_kern = 0;
34 size_t secure_kern_size = sizeof(secure_kern);
35
36 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.secure_kernel", &secure_kern,
37 &secure_kern_size, NULL, 0), NULL);
38
39 if (secure_kern) {
40 T_SKIP("secure kernel: processor_set_tasks will not return kernel_task");
41 }
42 }
43
44 static void
attempt_kernel_inspection(task_t task)45 attempt_kernel_inspection(task_t task)
46 {
47 pid_t pid = (pid_t)-1;
48 mach_msg_type_number_t i, count, thcnt;
49 struct task_basic_info_64 ti;
50 thread_act_array_t threads;
51
52 if (pid_for_task(task, &pid)) {
53 return;
54 }
55
56 T_QUIET; T_LOG("Checking pid %d", pid);
57
58 if (pid != 0) {
59 return;
60 }
61
62 T_LOG("found kernel_task, attempting to inspect");
63 found_kernel_task++;
64
65 count = TASK_BASIC_INFO_64_COUNT;
66 T_EXPECT_MACH_SUCCESS(task_info(task, TASK_BASIC_INFO_64, (task_info_t)&ti,
67 &count), "task_info(... TASK_BASIC_INFO_64 ...)");
68
69 T_EXPECT_MACH_SUCCESS(task_threads(task, &threads, &thcnt), "task_threads");
70 T_LOG("Found %d kernel threads.", thcnt);
71 for (i = 0; i < thcnt; i++) {
72 kern_return_t kr;
73 thread_basic_info_data_t basic_info;
74 mach_msg_type_number_t bi_count = THREAD_BASIC_INFO_COUNT;
75
76 kr = thread_info(threads[i], THREAD_BASIC_INFO,
77 (thread_info_t)&basic_info, &bi_count);
78 /*
79 * Ignore threads that have gone away.
80 */
81 if (kr == MACH_SEND_INVALID_DEST) {
82 T_LOG("ignoring thread that has been destroyed");
83 continue;
84 }
85 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "thread_info(... THREAD_BASIC_INFO ...)");
86
87 /* Now try out READ (skip eval) interfaces on kernel thread */
88 mach_msg_type_number_t msk_count = EXC_TYPES_COUNT;
89 exception_mask_t masks[EXC_TYPES_COUNT];
90 ipc_info_port_t ports_info[EXC_TYPES_COUNT];
91 exception_behavior_t behaviors[EXC_TYPES_COUNT];
92 thread_state_flavor_t flavors[EXC_TYPES_COUNT];
93 kr = thread_get_exception_ports_info(threads[i], EXC_MASK_ALL, masks, &msk_count, ports_info, behaviors, flavors);
94 T_QUIET; T_EXPECT_MACH_SUCCESS(kr, "thread_get_exception_ports_info() on kernel thread: 0x%x", kr);
95
96 /* READ (with eval) interfaces should fail */
97 mach_port_t voucher;
98 kr = thread_get_mach_voucher(threads[i], 0, &voucher);
99 T_QUIET; T_EXPECT_EQ(kr, KERN_INVALID_ARGUMENT, "thread_get_mach_voucher() should fail with KERN_INVALID_ARGUMENT");
100
101 (void)mach_port_deallocate(mach_task_self(), threads[i]);
102 }
103 mach_vm_deallocate(mach_task_self(),
104 (mach_vm_address_t)(uintptr_t)threads,
105 thcnt * sizeof(*threads));
106
107 ipc_info_space_basic_t basic_info;
108 T_EXPECT_MACH_SUCCESS(mach_port_space_basic_info(task, &basic_info), "mach_port_space_basic_info");
109
110 ipc_info_space_t info_space;
111 ipc_info_name_array_t table;
112 ipc_info_tree_name_array_t tree;
113 mach_msg_type_number_t tblcnt = 0, treecnt = 0;
114 T_EXPECT_MACH_SUCCESS(mach_port_space_info(task, &info_space, &table,
115 &tblcnt, &tree, &treecnt), "mach_port_space_info");
116 if (tblcnt > 0) {
117 mach_vm_deallocate(mach_task_self(),
118 (mach_vm_address_t)(uintptr_t)table,
119 tblcnt * sizeof(*table));
120 }
121 if (treecnt > 0) {
122 mach_vm_deallocate(mach_task_self(),
123 (mach_vm_address_t)(uintptr_t)tree,
124 treecnt * sizeof(*tree));
125 }
126
127 /* Now try out READ (skip eval) interfaces on kernel task */
128 mach_msg_type_number_t msk_count = EXC_TYPES_COUNT;
129 exception_mask_t masks[EXC_TYPES_COUNT];
130 ipc_info_port_t ports_info[EXC_TYPES_COUNT];
131 exception_behavior_t behaviors[EXC_TYPES_COUNT];
132 thread_state_flavor_t flavors[EXC_TYPES_COUNT];
133 kern_return_t kr = task_get_exception_ports_info(task, EXC_MASK_ALL, masks, &msk_count, ports_info, behaviors, flavors);
134 T_EXPECT_MACH_SUCCESS(kr, "task_get_exception_ports_info() on kernel_task: 0x%x", kr);
135
136 /* READ (with eval) interfaces should fail */
137 vm_offset_t data;
138 mach_msg_type_number_t cnt;
139 mach_vm_address_t addr = 0x10000000; /* can be whatever, the call should fail before getting to VM */
140
141 kr = mach_vm_read(task, (mach_vm_address_t)addr, 8, &data, &cnt);
142 T_EXPECT_EQ(kr, KERN_INVALID_ARGUMENT, "mach_vm_read() should fail with KERN_INVALID_ARGUMENT");
143
144 mach_port_t voucher;
145 kr = task_get_mach_voucher(task, 0, &voucher);
146 T_EXPECT_EQ(kr, KERN_INVALID_TASK, "task_get_mach_voucher() should fail with KERN_INVALID_TASK");
147
148 /* Control interfaces should absolutely fail */
149 kr = task_set_mach_voucher(task, mach_task_self()); /* voucher arg is unused, can be whatever port */
150 T_EXPECT_EQ(kr, KERN_INVALID_TASK, "task_set_mach_voucher() should fail with KERN_INVALID_TASK");
151 }
152
153 T_DECL(inspect_kernel_task,
154 "ensure that kernel task can be inspected",
155 T_META_CHECK_LEAKS(false),
156 T_META_ASROOT(true))
157 {
158 processor_set_name_array_t psets;
159 processor_set_t pset;
160 task_array_t tasks;
161 mach_msg_type_number_t i, j, tcnt, pcnt = 0;
162 mach_port_t self = mach_host_self();
163
164 check_secure_kernel();
165
166 T_ASSERT_MACH_SUCCESS(host_processor_sets(self, &psets, &pcnt),
167 NULL);
168
169 for (i = 0; i < pcnt; i++) {
170 T_ASSERT_MACH_SUCCESS(host_processor_set_priv(self, psets[i], &pset), NULL);
171 T_LOG("Checking pset %d/%d", i, pcnt - 1);
172
173 tcnt = 0;
174 T_LOG("Attempting kernel inspection with control port...");
175 T_ASSERT_MACH_SUCCESS(processor_set_tasks(pset, &tasks, &tcnt), NULL);
176
177 for (j = 0; j < tcnt; j++) {
178 attempt_kernel_inspection(tasks[j]);
179 mach_port_deallocate(self, tasks[j]);
180 }
181
182 /* free tasks array */
183 mach_vm_deallocate(mach_task_self(),
184 (mach_vm_address_t)(uintptr_t)tasks,
185 tcnt * sizeof(*tasks));
186
187 T_LOG("Attempting kernel inspection with read port...");
188 T_ASSERT_MACH_SUCCESS(processor_set_tasks_with_flavor(pset, TASK_FLAVOR_READ, &tasks, &tcnt), NULL);
189
190 for (j = 0; j < tcnt; j++) {
191 attempt_kernel_inspection(tasks[j]);
192 mach_port_deallocate(self, tasks[j]);
193 }
194
195 mach_vm_deallocate(mach_task_self(),
196 (mach_vm_address_t)(uintptr_t)tasks,
197 tcnt * sizeof(*tasks));
198
199 mach_port_deallocate(mach_task_self(), pset);
200 mach_port_deallocate(mach_task_self(), psets[i]);
201 }
202 mach_vm_deallocate(mach_task_self(),
203 (mach_vm_address_t)(uintptr_t)psets,
204 pcnt * sizeof(*psets));
205
206 if (found_kernel_task != 2) {
207 /* One for kernel control port test, one for kernel read port test. */
208 T_FAIL("could not find kernel_task in list of tasks returned");
209 }
210 }
211