@ctrl-spc/cs 0.7.13 → 0.7.15

package/dist/native/darwin-coalition.c

@@ -0,0 +1,145 @@
+/* The launchd job is the execution owner; this helper only reads and signals
+ * its kernel resource coalition. No privilege or runtime compiler is required.
+ * Apple exports these SPI but omits their structures from the public SDK.
+ * Check every ABI size/capability, and fail closed when unavailable.
+ * Sources: apple-oss-distributions/xnu: bsd/sys/proc_info_private.h,
+ * osfmk/mach/coalition.h, osfmk/kern/coalition.c, bsd/kern/sys_coalition.c.
+ */
+#include <libproc.h>
+#include <sys/sysctl.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+struct coalition_info { uint64_t ids[2], reserved[3]; };
+struct unique_info { uint8_t uuid[16]; uint64_t unique, parent; int32_t version, parent_version; uint64_t reserved[2]; };
+struct process_info { struct proc_bsdinfo bsd; struct unique_info unique; };
+_Static_assert(sizeof(struct coalition_info) == 40, "coalition ABI");
+_Static_assert(sizeof(struct unique_info) == 56, "process ABI");
+static int (*resource_usage)(uint64_t, void *, size_t);
+static int (*signal_token)(audit_token_t *, int);
+static char boot[64];
+
+static void fail(const char *message) { fprintf(stderr, "%s (OS error %d).\n", message, errno); exit(1); }
+static void changed(void) { fputs("Mac execution membership changed during inspection.\n",stderr); exit(75); }
+static uint64_t number(const char *text) {
+  char *end; errno=0; uint64_t value=strtoull(text,&end,10);
+  if(errno || !*text || *end || !value) fail("Invalid Mac execution identity");
+  return value;
+}
+static int coalition(pid_t pid, uint64_t *id) {
+  struct coalition_info info={0}; int n=proc_pidinfo(pid,20,0,&info,sizeof(info));
+  if(n==sizeof(info)) { *id=info.ids[0]; return 1; }
+  if(n==0 && (errno==ESRCH || errno==ENOENT)) return 0;
+  fail("Mac execution ownership cannot be inspected"); return 0;
+}
+static int process_info(pid_t pid, struct process_info *info) {
+  int n=proc_pidinfo(pid,18,0,info,sizeof(*info));
+  if(n==sizeof(*info)) return 1;
+  if(n==0 && (errno==ESRCH || errno==ENOENT)) return 0;
+  fail("Mac process lifetime cannot be inspected"); return 0;
+}
+static int active(uint64_t id, uint64_t *count) {
+  uint64_t usage[2]={0};
+  if(resource_usage(id,usage,sizeof(usage))!=0) {
+    if(errno==ESRCH) { *count=0; return 0; }
+    fail("Mac execution membership cannot be inspected");
+  }
+  if(usage[1]>usage[0]) fail("Invalid Mac execution membership");
+  *count=usage[0]-usage[1]; return 1;
+}
+static void capability(void) {
+  resource_usage=dlsym(RTLD_DEFAULT,"coalition_info_resource_usage");
+  signal_token=dlsym(RTLD_DEFAULT,"proc_signal_with_audittoken");
+  size_t size=sizeof(boot);
+  if(!resource_usage || !signal_token || sysctlbyname("kern.bootsessionuuid",boot,&size,NULL,0)!=0 || size<36 || size>sizeof(boot))
+    fail("This Mac cannot verify safe agent execution; no agent was started");
+  uint64_t id, count; struct process_info info={0};
+  if(!coalition(getpid(),&id) || !process_info(getpid(),&info) || !active(id,&count))
+    fail("This Mac cannot verify safe agent execution; no agent was started");
+}
+static void same_boot(const char *expected) {
+  if(strcmp(expected,boot)) fail("Mac execution belongs to a different boot");
+}
+static void birth(struct process_info *info, char *output, size_t capacity) {
+  time_t seconds=(time_t)info->bsd.pbi_start_tvsec; struct tm tm; char date[32];
+  gmtime_r(&seconds,&tm); strftime(date,sizeof(date),"%Y-%m-%dT%H:%M:%S",&tm);
+  snprintf(output,capacity,"%s.%06"PRIu64"Z",date,info->bsd.pbi_start_tvusec);
+}
+int main(int argc,char **argv) {
+  capability();
+  if(argc==5 && !strcmp(argv[1],"signal-process")) {
+    same_boot(argv[2]); pid_t pid=(pid_t)number(argv[3]); struct process_info info={0}; char started[64];
+    if(!process_info(pid,&info)) return 0;
+    birth(&info,started,sizeof(started));
+    if(strcmp(started,argv[4])) return 0;
+    if(info.bsd.pbi_uid!=getuid()) fail("Mac execution belongs to another user");
+    audit_token_t token={{0}}; token.val[5]=(uint32_t)pid; token.val[7]=(uint32_t)info.unique.version;
+    if(signal_token(&token,SIGKILL)!=0 && errno!=ESRCH) fail("Owned Mac process could not be stopped");
+    return 0;
+  }
+  if(argc==3 && !strcmp(argv[1],"process")) {
+    pid_t pid=(pid_t)number(argv[2]); uint64_t id; struct process_info info={0};
+    if(!process_info(pid,&info) || !coalition(pid,&id)) { puts("null"); return 0; }
+    if(info.bsd.pbi_uid!=getuid()) fail("Mac execution belongs to another user");
+    time_t seconds=(time_t)info.bsd.pbi_start_tvsec; struct tm tm; char date[32];
+    gmtime_r(&seconds,&tm); strftime(date,sizeof(date),"%Y-%m-%dT%H:%M:%S",&tm);
+    printf("{\"id\":\"%"PRIu64"\",\"boot\":\"%s\",\"pid\":%d,\"ppid\":%u,\"pgid\":%u,\"owner\":%u,\"birth\":\"%s.%06"PRIu64"Z\",\"version\":%u}\n",id,boot,pid,info.bsd.pbi_ppid,info.bsd.pbi_pgid,getuid(),date,info.bsd.pbi_start_tvusec,(uint32_t)info.unique.version); return 0;
+  }
+  int all=argc==2 && !strcmp(argv[1],"all");
+  if(!all && argc<4) fail("Invalid Mac execution helper command");
+  uint64_t id=all?0:number(argv[2]);
+  // These one-shot jobs have no future-login plist. A changed kernel boot also
+  // proves every member and queued launch from the recorded boot has ended.
+  if(argc==4 && !strcmp(argv[1],"inspect") && strcmp(argv[3],boot)) { puts("{\"exists\":false,\"active\":0,\"members\":[]}"); return 0; }
+  if(!all) same_boot(argv[3]);
+  if(argc==7 && !strcmp(argv[1],"signal")) {
+    pid_t pid=(pid_t)number(argv[4]); uint64_t version=number(argv[5]), actual;
+    int signal=!strcmp(argv[6],"TERM")?SIGTERM:!strcmp(argv[6],"KILL")?SIGKILL:0;
+    if(!signal) fail("Invalid Mac execution signal");
+    struct process_info info={0};
+    if(!coalition(pid,&actual) || actual!=id || !process_info(pid,&info) || (uint32_t)info.unique.version!=version) return 0;
+    if(info.bsd.pbi_uid!=getuid()) fail("Mac execution belongs to another user");
+    audit_token_t token={{0}}; token.val[5]=(uint32_t)pid; token.val[7]=(uint32_t)version;
+    // The kernel compares the PID version while holding the process reference;
+    // a reused PID cannot receive this signal.
+    if(signal_token(&token,signal)!=0 && errno!=ESRCH) fail("Owned Mac execution could not be stopped");
+    return 0;
+  }
+  if(!all && (argc!=4 || strcmp(argv[1],"inspect"))) fail("Invalid Mac execution helper command");
+  uint64_t count=1; int exists=all?1:active(id,&count);
+  if(!exists || !count) { printf("{\"exists\":%s,\"active\":0,\"members\":[]}\n",exists?"true":"false"); return 0; }
+  int capacity=proc_listpids(PROC_UID_ONLY,getuid(),NULL,0)/(int)sizeof(pid_t)+1024;
+  if(capacity<=1024 || capacity>1000000) fail("Mac process enumeration is unavailable");
+  pid_t *pids=calloc((size_t)capacity,sizeof(pid_t));
+  struct process_info *rows=calloc((size_t)capacity,sizeof(struct process_info));
+  if(!pids || !rows) fail("Mac process enumeration could not allocate memory");
+  int bytes=proc_listpids(PROC_UID_ONLY,getuid(),pids,capacity*(int)sizeof(pid_t));
+  if(bytes<0 || bytes%(int)sizeof(pid_t)) fail("Mac process enumeration is unavailable");
+  int total=bytes/(int)sizeof(pid_t), found=0;
+  if(total<0 || total>=capacity) changed();
+  for(int i=0;i<total;i++) {
+    uint64_t candidate; if(pids[i]<=0 || (!all && (!coalition(pids[i],&candidate) || candidate!=id))) continue;
+    struct process_info row={0}, after={0};
+    if(!process_info(pids[i],&row) || (!all && (!coalition(pids[i],&candidate) || candidate!=id)) || !process_info(pids[i],&after)) continue;
+    if(row.unique.version!=after.unique.version) continue;
+    if(row.bsd.pbi_uid!=getuid()) fail("Mac execution membership includes a different user");
+    rows[found++]=row;
+  }
+  if(all) count=(uint64_t)found; else exists=active(id,&count);
+  // A new task missing from the snapshot is uncertainty, never empty success.
+  if(count>(uint64_t)found) changed();
+  printf("{\"exists\":%s,\"active\":%"PRIu64",\"members\":[",exists?"true":"false",count);
+  for(int i=0;count && i<found;i++) {
+    struct process_info *row=&rows[i]; time_t seconds=(time_t)row->bsd.pbi_start_tvsec; struct tm tm; char date[32];
+    gmtime_r(&seconds,&tm); strftime(date,sizeof(date),"%Y-%m-%dT%H:%M:%S",&tm);
+    printf("%s{\"pid\":%u,\"ppid\":%u,\"pgid\":%u,\"owner\":\"%u\",\"birth\":\"%s.%06"PRIu64"Z\",\"version\":%u}",i?",":"",row->bsd.pbi_pid,row->bsd.pbi_ppid,row->bsd.pbi_pgid,row->bsd.pbi_uid,date,row->bsd.pbi_start_tvusec,(uint32_t)row->unique.version);
+  }
+  puts("]}"); free(rows); free(pids); return 0;
+}