Skip to content

Commit 5e725c5

Browse files
cr4zyengineercr4zyengineer
committed
Fixed vulnerability #15 where a process entry gets duplicated on removal.
1 parent fe203b1 commit 5e725c5

File tree

9 files changed

+65
-162
lines changed

9 files changed

+65
-162
lines changed

‎Nyxian.xcodeproj/project.pbxproj‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,6 @@
158158
LindChain/ProcEnvironment/Surface/proc/new.m,
159159
LindChain/ProcEnvironment/Surface/proc/remove.m,
160160
LindChain/ProcEnvironment/Surface/proc/replace.m,
161-
LindChain/ProcEnvironment/Surface/proc/sync.m,
162161
LindChain/ProcEnvironment/Surface/rusage.m,
163162
LindChain/ProcEnvironment/Surface/surface.m,
164163
LindChain/ProcEnvironment/Sysctl/kern/maxproc.m,

‎Nyxian.xcodeproj/project.xcworkspace/xcuserdata/seanistethered.xcuserdatad/UserInterfaceState.xcuserstate‎

306 Bytes
Binary file not shown.

‎Nyxian/AppDelegate.swift‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,4 @@ import UIKit
7474
}
7575
return true
7676
}
77-
78-
func applicationWillEnterForeground(_ application: UIApplication) {
79-
proc_sync()
80-
}
8177
}

‎Nyxian/LindChain/Multitask/ProcessManager/LDEProcess.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
@property (nonatomic) BOOL isSuspended;
5454

5555
@property (nonatomic) dispatch_once_t removeOnce;
56+
@property (nonatomic) dispatch_once_t addOnce;
5657

5758
// Callback
5859
@property (nonatomic, copy) void (^exitingCallback)(void);

‎Nyxian/LindChain/Multitask/ProcessManager/LDEProcess.m‎

Lines changed: 64 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ - (instancetype)initWithItems:(NSDictionary*)items withParentProcessIdentifier:(
7777
NSArray<RBSProcessState *> *states = [monitor states];
7878
if([states count] == 0)
7979
{
80-
// Process dead!
80+
// Remove Once
8181
dispatch_once(&strongSelf->_removeOnce, ^{
8282
if(strongSelf.wid != -1) [[LDEWindowServer shared] closeWindowWithIdentifier:strongSelf.wid];
8383
[[LDEProcessManager shared] unregisterProcessWithProcessIdentifier:strongSelf.pid];
@@ -86,71 +86,74 @@ - (instancetype)initWithItems:(NSDictionary*)items withParentProcessIdentifier:(
8686
}
8787
else
8888
{
89-
dispatch_sync(dispatch_get_main_queue(), ^{
90-
// Setting process handle directly from process monitor
91-
weakSelf.processHandle = handle;
92-
FBProcessManager *manager = [PrivClass(FBProcessManager) sharedInstance];
93-
// At this point, the process is spawned and we're ready to create a scene to render in our app
94-
[manager registerProcessForAuditToken:self.processHandle.auditToken];
95-
self.sceneID = [NSString stringWithFormat:@"sceneID:%@-%@", @"LiveProcess", NSUUID.UUID.UUIDString];
96-
97-
FBSMutableSceneDefinition *definition = [PrivClass(FBSMutableSceneDefinition) definition];
98-
definition.identity = [PrivClass(FBSSceneIdentity) identityForIdentifier:self.sceneID];
99-
100-
// FIXME: Handle when the process is not valid anymore, it will cause EXC_BREAKPOINT otherwise because of "Invalid condition not satisfying: processIdentity"
101-
definition.clientIdentity = [PrivClass(FBSSceneClientIdentity) identityForProcessIdentity:self.processHandle.identity];
102-
definition.specification = [UIApplicationSceneSpecification specification];
103-
FBSMutableSceneParameters *parameters = [PrivClass(FBSMutableSceneParameters) parametersForSpecification:definition.specification];
104-
105-
UIMutableApplicationSceneSettings *settings = [UIMutableApplicationSceneSettings new];
106-
settings.canShowAlerts = YES;
107-
settings.cornerRadiusConfiguration = [[PrivClass(BSCornerRadiusConfiguration) alloc] initWithTopLeft:0 bottomLeft:0 bottomRight:0 topRight:0];
108-
settings.displayConfiguration = UIScreen.mainScreen.displayConfiguration;
109-
settings.foreground = YES;
110-
111-
settings.deviceOrientation = UIDevice.currentDevice.orientation;
112-
settings.interfaceOrientation = UIApplication.sharedApplication.statusBarOrientation;
113-
114-
CGRect rect = CGRectMake(50, 50, 400, 400);
115-
if(self.bundleIdentifier != nil)
116-
{
117-
NSValue *value = runtimeStoredRectValuesByBundleIdentifier[self.bundleIdentifier];
118-
if(value != nil)
89+
// Initilize once
90+
dispatch_once(&strongSelf->_addOnce, ^{
91+
dispatch_sync(dispatch_get_main_queue(), ^{
92+
// Setting process handle directly from process monitor
93+
weakSelf.processHandle = handle;
94+
FBProcessManager *manager = [PrivClass(FBProcessManager) sharedInstance];
95+
// At this point, the process is spawned and we're ready to create a scene to render in our app
96+
[manager registerProcessForAuditToken:self.processHandle.auditToken];
97+
self.sceneID = [NSString stringWithFormat:@"sceneID:%@-%@", @"LiveProcess", NSUUID.UUID.UUIDString];
98+
99+
FBSMutableSceneDefinition *definition = [PrivClass(FBSMutableSceneDefinition) definition];
100+
definition.identity = [PrivClass(FBSSceneIdentity) identityForIdentifier:self.sceneID];
101+
102+
// FIXME: Handle when the process is not valid anymore, it will cause EXC_BREAKPOINT otherwise because of "Invalid condition not satisfying: processIdentity"
103+
definition.clientIdentity = [PrivClass(FBSSceneClientIdentity) identityForProcessIdentity:self.processHandle.identity];
104+
definition.specification = [UIApplicationSceneSpecification specification];
105+
FBSMutableSceneParameters *parameters = [PrivClass(FBSMutableSceneParameters) parametersForSpecification:definition.specification];
106+
107+
UIMutableApplicationSceneSettings *settings = [UIMutableApplicationSceneSettings new];
108+
settings.canShowAlerts = YES;
109+
settings.cornerRadiusConfiguration = [[PrivClass(BSCornerRadiusConfiguration) alloc] initWithTopLeft:0 bottomLeft:0 bottomRight:0 topRight:0];
110+
settings.displayConfiguration = UIScreen.mainScreen.displayConfiguration;
111+
settings.foreground = YES;
112+
113+
settings.deviceOrientation = UIDevice.currentDevice.orientation;
114+
settings.interfaceOrientation = UIApplication.sharedApplication.statusBarOrientation;
115+
116+
CGRect rect = CGRectMake(50, 50, 400, 400);
117+
if(self.bundleIdentifier != nil)
119118
{
120-
rect = [value CGRectValue];
119+
NSValue *value = runtimeStoredRectValuesByBundleIdentifier[self.bundleIdentifier];
120+
if(value != nil)
121+
{
122+
rect = [value CGRectValue];
123+
}
121124
}
122-
}
123-
settings.frame = rect;
124-
125-
//settings.interruptionPolicy = 2; // reconnect
126-
settings.level = 1;
127-
settings.persistenceIdentifier = NSUUID.UUID.UUIDString;
128-
129-
// it seems some apps don't honor these settings so we don't cover the top of the app
130-
settings.peripheryInsets = UIEdgeInsetsMake(0, 0, 0, 0);
131-
settings.safeAreaInsetsPortrait = UIEdgeInsetsMake(0, 0, 0, 0);
125+
settings.frame = rect;
126+
127+
//settings.interruptionPolicy = 2; // reconnect
128+
settings.level = 1;
129+
settings.persistenceIdentifier = NSUUID.UUID.UUIDString;
130+
131+
// it seems some apps don't honor these settings so we don't cover the top of the app
132+
settings.peripheryInsets = UIEdgeInsetsMake(0, 0, 0, 0);
133+
settings.safeAreaInsetsPortrait = UIEdgeInsetsMake(0, 0, 0, 0);
134+
135+
settings.statusBarDisabled = YES;
136+
parameters.settings = settings;
137+
138+
UIMutableApplicationSceneClientSettings *clientSettings = [UIMutableApplicationSceneClientSettings new];
139+
clientSettings.interfaceOrientation = UIInterfaceOrientationPortrait;
140+
clientSettings.statusBarStyle = 0;
141+
parameters.clientSettings = clientSettings;
142+
143+
self.scene = [[PrivClass(FBSceneManager) sharedInstance] createSceneWithDefinition:definition initialParameters:parameters];
144+
self.scene.delegate = self;
145+
});
132146

133-
settings.statusBarDisabled = YES;
134-
parameters.settings = settings;
147+
// TODO: We gonna shrink down this part more and more to move the tasks all slowly to the proc api (ie procv2 eventually)
148+
// MARK: The process cannot call UIApplicationMain until its own process was added because of the waittrap it waits in
149+
ksurface_error_t error = kSurfaceErrorUndefined;
150+
error = proc_new_child_proc(parentProcessIdentifier, weakSelf.pid, weakSelf.executablePath);
135151

136-
UIMutableApplicationSceneClientSettings *clientSettings = [UIMutableApplicationSceneClientSettings new];
137-
clientSettings.interfaceOrientation = UIInterfaceOrientationPortrait;
138-
clientSettings.statusBarStyle = 0;
139-
parameters.clientSettings = clientSettings;
140-
141-
self.scene = [[PrivClass(FBSceneManager) sharedInstance] createSceneWithDefinition:definition initialParameters:parameters];
142-
self.scene.delegate = self;
152+
if(error != kSurfaceErrorSuccess)
153+
{
154+
[weakSelf terminate];
155+
}
143156
});
144-
145-
// TODO: We gonna shrink down this part more and more to move the tasks all slowly to the proc api (ie procv2 eventually)
146-
// MARK: The process cannot call UIApplicationMain until its own process was added because of the waittrap it waits in
147-
ksurface_error_t error = kSurfaceErrorUndefined;
148-
error = proc_new_child_proc(parentProcessIdentifier, weakSelf.pid, weakSelf.executablePath);
149-
150-
if(error != kSurfaceErrorSuccess)
151-
{
152-
[weakSelf terminate];
153-
}
154157
}
155158
}];
156159
}

‎Nyxian/LindChain/ProcEnvironment/Surface/proc/proc.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,5 @@
2828
#import <LindChain/ProcEnvironment/Surface/proc/fetch.h>
2929
#import <LindChain/ProcEnvironment/Surface/proc/exit.h>
3030
#import <LindChain/ProcEnvironment/Surface/proc/edit.h>
31-
#import <LindChain/ProcEnvironment/Surface/proc/sync.h>
3231

3332
#endif /* PROC_H */

‎Nyxian/LindChain/ProcEnvironment/Surface/proc/sync.h‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎Nyxian/LindChain/ProcEnvironment/Surface/proc/sync.m‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎Nyxian/bridge.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@
4141
#import <LindChain/Multitask/WindowServer/Session/LDEWindowSessionApplication.h>
4242
#import <LindChain/Multitask/WindowServer/Session/LDEWindowSessionTerminal.h>
4343
#import <LindChain/ProcEnvironment/Server/Trust.h>
44-
#import <LindChain/ProcEnvironment/Surface/proc/sync.h>
4544
#import <LindChain/ProcEnvironment/Utils/klog.h>
4645

4746
/*

0 commit comments

Comments
 (0)