Skip to content

Commit b5c90f5

Browse files
cr4zyengineercr4zyengineer
committed
security: made permitive system more flexible
1 parent 9d5cb2c commit b5c90f5

File tree

6 files changed

+70
-83
lines changed

6 files changed

+70
-83
lines changed

‎Config.xcconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99
// https://developer.apple.com/documentation/xcode/adding-a-build-configuration-file-to-your-project
1010

1111
VERSION = 0.9.0
12-
BUILD_NUMBER = 20260223.82.US.seanistethered
12+
BUILD_NUMBER = 20260223.89.US.seanistethered

‎Nyxian/LindChain/ProcEnvironment/Surface/entitlement.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@
2828
@abstract Entitlements which are responsible for the permitives of the environment hostsided
2929
*/
3030
typedef NS_OPTIONS(uint64_t, PEEntitlement) {
31+
/*! No entitlements at all */
32+
PEEntitlementNone = 0,
33+
3134
/*! Grants other processes with appropriate permitives to get task port of process .*/
3235
PEEntitlementGetTaskAllowed = 1ull << 0,
3336

‎Nyxian/LindChain/ProcEnvironment/Surface/permit.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@
2323
#import <LindChain/ProcEnvironment/Surface/surface.h>
2424
#import <LindChain/ProcEnvironment/Surface/proc/proc.h>
2525

26-
BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc, pid_t targetPid);
26+
BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc, pid_t targetPid, BOOL allowRootBypass, BOOL allowSessionBypass, BOOL allowPlatformBypass, PEEntitlement entitlementsNeeded, PEEntitlement targetEntitlementsNeeded);
2727

2828
#endif /* PROCENVIRONMENT_PERMIT_H */

‎Nyxian/LindChain/ProcEnvironment/Surface/permit.m‎

Lines changed: 47 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,12 @@
2222
#import <LindChain/ProcEnvironment/Surface/proc/list.h>
2323

2424
BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
25-
pid_t targetPid)
25+
pid_t targetPid,
26+
BOOL allowRootBypass,
27+
BOOL allowSessionBypass,
28+
BOOL allowPlatformBypass,
29+
PEEntitlement entitlementsNeeded,
30+
PEEntitlement targetEntitlementsNeeded)
2631
{
2732
/* null pointer check */
2833
if(proc == NULL)
@@ -35,7 +40,7 @@ BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
3540
pid_t caller_sid = proc_getsid(proc);
3641

3742
/* if proc is root its automatically allowed */
38-
if(caller_uid == 0)
43+
if(allowRootBypass && caller_uid == 0)
3944
{
4045
return YES;
4146
}
@@ -63,14 +68,6 @@ BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
6368
/* locking target process aswell */
6469
kvo_rdlock(targetProc);
6570

66-
/* checking if target process is a platformised process and therefore can only be decided at by a other process that is platformised */
67-
if(entitlement_got_entitlement(proc_getentitlements(targetProc), PEEntitlementPlatform) &&
68-
!entitlement_got_entitlement(proc_getentitlements(proc), PEEntitlementPlatform))
69-
{
70-
/* nope! */
71-
goto out_unlock;
72-
}
73-
7471
/* getting visibility */
7572
proc_visibility_t vis = get_proc_visibility(proc);
7673

@@ -81,9 +78,47 @@ BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
8178
goto out_unlock;
8279
}
8380

84-
/* checking if the process is allowed to gain permitives naturally over the target */
85-
if(caller_uid == proc_getruid(targetProc) ||
81+
if(entitlementsNeeded != PEEntitlementNone &&
82+
!entitlement_got_entitlement(proc_getentitlements(proc), entitlementsNeeded))
83+
{
84+
goto out_unlock;
85+
}
86+
87+
/* handling sid bypass */
88+
if(allowSessionBypass &&
89+
caller_uid == proc_getruid(targetProc) &&
8690
caller_sid == proc_getsid(targetProc))
91+
{
92+
allowed = YES;
93+
goto out_unlock;
94+
}
95+
96+
/* handling platform bypass */
97+
if(allowPlatformBypass &&
98+
(caller_uid == proc_getruid(targetProc) || caller_uid == 0) &&
99+
entitlement_got_entitlement(proc_getentitlements(proc), PEEntitlementPlatform))
100+
{
101+
allowed = YES;
102+
goto out_unlock;
103+
}
104+
105+
/* checking if target got entitlement if applicable */
106+
if(targetEntitlementsNeeded != PEEntitlementNone &&
107+
!entitlement_got_entitlement(proc_getentitlements(targetProc), targetEntitlementsNeeded))
108+
{
109+
/* nope! */
110+
goto out_unlock;
111+
}
112+
113+
/* checking if target process is a platformised process and therefore can only be decided at by a other process that is platformised */
114+
if(entitlement_got_entitlement(proc_getentitlements(targetProc), PEEntitlementPlatform) &&
115+
!entitlement_got_entitlement(proc_getentitlements(proc), PEEntitlementPlatform))
116+
{
117+
/* still nope! */
118+
goto out_unlock;
119+
}
120+
121+
if(caller_uid == proc_getruid(targetProc))
87122
{
88123
allowed = YES;
89124
}

‎Nyxian/LindChain/ProcEnvironment/Surface/sys/compat/gettask.m‎

Lines changed: 17 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -31,24 +31,6 @@
3131
pid_t pid = (pid_t)args[0];
3232
bool name_only = (bool)args[1];
3333

34-
/* check if the pid passed is the caller them selves */
35-
bool isCaller = (pid == proc_getpid(sys_proc_copy_));
36-
37-
/*
38-
* checking if the caller process got the entitlement to
39-
* use tfp or if its the caller it self requesting its
40-
* own task port which is allowed in any case.
41-
*/
42-
if(!entitlement_got_entitlement(proc_getentitlements(sys_proc_copy_), PEEntitlementTaskForPid) &&
43-
!isCaller &&
44-
!name_only)
45-
{
46-
sys_return_failure(EPERM);
47-
}
48-
49-
/* check if the pid passed is the kernel process */
50-
bool isHost = (pid == proc_getpid(kernel_proc_));
51-
5234
/* placeholder for target process */
5335
ksurface_proc_t *target = NULL;
5436

@@ -69,57 +51,26 @@
6951
*/
7052
task_rdlock();
7153

72-
/*
73-
* if host we can skip this crap :3
74-
*
75-
* and we shall skip it in that case,
76-
* because I dont wanna take another reference
77-
* of kernel_proc_, way too much CPU time for
78-
* a fact we already know lol.
79-
*/
80-
if(!isHost)
81-
{
82-
/* getting the target process */
83-
ksurface_return_t ret = proc_for_pid(pid, &target);
54+
/* getting the target process */
55+
ksurface_return_t ret = proc_for_pid(pid, &target);
8456

85-
/* checking if successful */
86-
if(ret != SURFACE_SUCCESS ||
87-
target == NULL)
88-
{
89-
errnov = ESRCH;
90-
goto out_unlock_failure;
91-
}
92-
93-
/*
94-
* checks if target gives permissions to get the task port of it self
95-
* in the first place and if the process allows for it except if the
96-
* caller is a special process.
97-
*/
98-
if(!entitlement_got_entitlement(proc_getentitlements(sys_proc_copy_), PEEntitlementPlatform) &&
99-
((!entitlement_got_entitlement(proc_getentitlements(target), PEEntitlementGetTaskAllowed) && (!isCaller || !name_only)) ||
100-
!permitive_over_pid_allowed(sys_proc_copy_, pid)))
101-
{
102-
errnov = EPERM;
103-
goto out_proc_release_failure;
104-
}
105-
}
106-
else
57+
/* checking if successful */
58+
if(ret != SURFACE_SUCCESS ||
59+
target == NULL)
10760
{
108-
/* checking if child is entitled */
109-
if(!entitlement_got_entitlement(proc_getentitlements(sys_proc_copy_), PEEntitlementPlatform))
110-
{
111-
errnov = EPERM;
112-
goto out_unlock_failure;
113-
}
114-
115-
/* trying to retain kernel process */
116-
if(!kvo_retain(kernel_proc_))
117-
{
118-
errnov = ESRCH;
119-
goto out_unlock_failure;
120-
}
61+
errnov = ESRCH;
62+
goto out_unlock_failure;
63+
}
12164

122-
target = kernel_proc_;
65+
/*
66+
* checks if target gives permissions to get the task port of it self
67+
* in the first place and if the process allows for it except if the
68+
* caller is a special process.
69+
*/
70+
if(!permitive_over_pid_allowed(sys_proc_copy_, pid, YES, YES, YES, name_only ? PEEntitlementNone : PEEntitlementTaskForPid, name_only ? PEEntitlementNone : PEEntitlementGetTaskAllowed))
71+
{
72+
errnov = EPERM;
73+
goto out_proc_release_failure;
12374
}
12475

12576
/* getting flavour */

‎Nyxian/LindChain/ProcEnvironment/Surface/sys/proc/kill.m‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,7 @@
4242
* also checks if the caller process has the entitlement to kill
4343
* and checks if the process has permitive over the other process.
4444
*/
45-
if(pid != proc_getpid(sys_proc_copy_) &&
46-
(!entitlement_got_entitlement(proc_getentitlements(sys_proc_copy_), PEEntitlementProcessKill) ||
47-
!permitive_over_pid_allowed(sys_proc_copy_, pid)))
45+
if(!permitive_over_pid_allowed(sys_proc_copy_, pid, YES, YES, YES, PEEntitlementProcessKill, PEEntitlementNone))
4846
{
4947
sys_return_failure(EINVAL);
5048
}

0 commit comments

Comments
 (0)