diff --git a/lld/MachO/OutputSegment.h b/lld/MachO/OutputSegment.h --- a/lld/MachO/OutputSegment.h +++ b/lld/MachO/OutputSegment.h @@ -45,6 +45,7 @@ size_t numNonHiddenSections() const; uint64_t fileOff = 0; + uint64_t fileSize = 0; StringRef name; uint32_t maxProt = 0; uint32_t initProt = 0; diff --git a/lld/MachO/SyntheticSections.h b/lld/MachO/SyntheticSections.h --- a/lld/MachO/SyntheticSections.h +++ b/lld/MachO/SyntheticSections.h @@ -15,6 +15,7 @@ #include "OutputSection.h" #include "OutputSegment.h" #include "Target.h" +#include "cs_blobs.h" #include "llvm/ADT/PointerUnion.h" #include "llvm/ADT/SetVector.h" @@ -40,6 +41,7 @@ constexpr const char symbolTable[] = "__symbol_table"; constexpr const char indirectSymbolTable[] = "__ind_sym_tab"; constexpr const char stringTable[] = "__string_table"; +constexpr const char codeSignature[] = "__code_signature"; constexpr const char got[] = "__got"; constexpr const char threadPtrs[] = "__thread_ptrs"; constexpr const char unwindInfo[] = "__unwind_info"; @@ -94,7 +96,7 @@ // NOTE: This assumes that the extra bytes required for alignment can be // zero-valued bytes. uint64_t getSize() const override final { - return llvm::alignTo(getRawSize(), WordSize); + return llvm::alignTo(getRawSize(), align); } }; @@ -482,6 +484,28 @@ void writeTo(uint8_t *buf) const override; }; +// The code signature comes at the very end of the linked output file. +class CodeSignatureSection : public LinkEditSection { +public: + const uint8_t blockSizeShift = 12; + const ssize_t blockSize = (1 << blockSizeShift); // 4 KiB + const size_t hashSize = 256 / 8; + const uint32_t blobHeadersSize = sizeof(CS_SuperBlob) + sizeof(CS_BlobIndex); + const uint32_t fixedHeadersSize = blobHeadersSize + sizeof(CS_CodeDirectory); + + uint32_t fileNameSize = 0; + uint32_t fileNamePad = 0; + uint32_t allHeadersSize = 0; + StringRef fileName; + + CodeSignatureSection(); + uint64_t getRawSize() const override; + bool isNeeded() const override { return true; } + void writeTo(uint8_t *buf) const override; + uint32_t getBlockCount() const; + void writeHashes(uint8_t *buf) const; +}; + struct InStruct { MachHeaderSection *header = nullptr; RebaseSection *rebase = nullptr; diff --git a/lld/MachO/SyntheticSections.cpp b/lld/MachO/SyntheticSections.cpp --- a/lld/MachO/SyntheticSections.cpp +++ b/lld/MachO/SyntheticSections.cpp @@ -24,6 +24,9 @@ #include "llvm/Support/FileSystem.h" #include "llvm/Support/LEB128.h" #include "llvm/Support/Path.h" +#include "llvm/Support/SHA256.h" + +#include using namespace llvm; using namespace llvm::support; @@ -868,3 +871,87 @@ off += str.size() + 1; // account for null terminator } } + +CodeSignatureSection::CodeSignatureSection() + : LinkEditSection(segment_names::linkEdit, section_names::codeSignature) { + align = 16; // required by libstuff + fileName = config->outputFile; + size_t slashIndex = fileName.rfind("/"); + if (slashIndex != std::string::npos) + fileName = fileName.drop_front(slashIndex + 1); + fileNameSize = fileName.size(); + allHeadersSize = alignTo(fixedHeadersSize + fileNameSize + 1, WordSize); + fileNamePad = allHeadersSize - fixedHeadersSize - fileNameSize; +} + +uint32_t CodeSignatureSection::getBlockCount() const { + return (fileOff + blockSize - 1) / blockSize; +} + +uint64_t CodeSignatureSection::getRawSize() const { + return allHeadersSize + getBlockCount() * hashSize; +} + +void CodeSignatureSection::writeHashes(uint8_t *buf) const { + uint8_t *code = buf; + uint8_t *codeEnd = buf + fileOff; + uint8_t *hashes = codeEnd + allHeadersSize; + while (code < codeEnd) { + StringRef block(reinterpret_cast(code), + std::min(codeEnd - code, blockSize)); + SHA256 hasher; + hasher.update(block); + StringRef hash = hasher.final(); + assert(hash.size() == hashSize); + memcpy(hashes, hash.data(), hashSize); + code += blockSize; + hashes += hashSize; + } + // The kernel creates a signature-verification cache entry at + // mmap(2) time, before the signature exists. Now that the + // signature is written, invalidate the bogus cache entry. + msync(buf, fileOff + getSize(), MS_INVALIDATE); +} + +void CodeSignatureSection::writeTo(uint8_t *buf) const { + using namespace llvm::support::endian; + uint32_t blobHeadersSize = sizeof(CS_SuperBlob) + sizeof(CS_BlobIndex); + uint32_t signatureSize = static_cast(getSize()); + auto *superBlob = reinterpret_cast(buf); + write32be(&superBlob->magic, CSMAGIC_EMBEDDED_SIGNATURE); + write32be(&superBlob->length, signatureSize); + write32be(&superBlob->count, 1); + auto *blobIndex = reinterpret_cast(&superBlob[1]); + write32be(&blobIndex->type, CSSLOT_CODEDIRECTORY); + write32be(&blobIndex->offset, blobHeadersSize); + auto *codeDirectory = reinterpret_cast(&blobIndex[1]); + write32be(&codeDirectory->magic, CSMAGIC_CODEDIRECTORY); + write32be(&codeDirectory->length, signatureSize - blobHeadersSize); + write32be(&codeDirectory->version, 0x20400); + write32be(&codeDirectory->flags, CS_ADHOC | CS_LINKER_SIGNED); + write32be(&codeDirectory->hashOffset, + sizeof(CS_CodeDirectory) + fileNameSize + fileNamePad); + write32be(&codeDirectory->identOffset, sizeof(CS_CodeDirectory)); + codeDirectory->nSpecialSlots = 0; + write32be(&codeDirectory->nCodeSlots, getBlockCount()); + write32be(&codeDirectory->codeLimit, fileOff); + codeDirectory->hashSize = hashSize; + codeDirectory->hashType = kSecCodeSignatureHashSHA256; + codeDirectory->platform = 0; + codeDirectory->pageSize = blockSizeShift; + codeDirectory->spare2 = 0; + codeDirectory->scatterOffset = 0; + codeDirectory->teamOffset = 0; + codeDirectory->spare3 = 0; + codeDirectory->codeLimit64 = 0; + OutputSegment *textSeg = getOrCreateOutputSegment(segment_names::text); + write64be(&codeDirectory->execSegBase, textSeg->fileOff); + write64be(&codeDirectory->execSegLimit, textSeg->fileSize); + write64be(&codeDirectory->execSegFlags, + config->outputType == llvm::MachO::MH_EXECUTE + ? CS_EXECSEG_MAIN_BINARY + : 0); + auto *id = reinterpret_cast(&codeDirectory[1]); + memcpy(id, fileName.begin(), fileNameSize); + memset(id + fileNameSize, 0, fileNamePad); +} diff --git a/lld/MachO/Writer.cpp b/lld/MachO/Writer.cpp --- a/lld/MachO/Writer.cpp +++ b/lld/MachO/Writer.cpp @@ -52,6 +52,7 @@ void openFile(); void writeSections(); void writeUuid(); + void writeCodeSignature(); void run(); @@ -62,6 +63,7 @@ StringTableSection *stringTableSection = nullptr; SymtabSection *symtabSection = nullptr; IndirectSymtabSection *indirectSymtabSection = nullptr; + CodeSignatureSection *codeSignatureSection = nullptr; UnwindInfoSection *unwindInfoSection = nullptr; LCUuid *uuidCommand = nullptr; }; @@ -400,6 +402,24 @@ mutable uint8_t *uuidBuf; }; +// TODO(gkm): write block comment +class LCCodeSignature : public LoadCommand { +public: + LCCodeSignature(CodeSignatureSection *section) : section(section) {} + + uint32_t getSize() const override { return sizeof(linkedit_data_command); } + + void writeTo(uint8_t *buf) const override { + auto *c = reinterpret_cast(buf); + c->cmd = LC_CODE_SIGNATURE; + c->cmdsize = getSize(); + c->dataoff = static_cast(section->fileOff); + c->datasize = section->getSize(); + } + + CodeSignatureSection *section; +}; + } // namespace static void prepareSymbolRelocation(lld::macho::Symbol *sym, @@ -515,6 +535,9 @@ } } + if (codeSignatureSection) + in.header->addLoadCommand(make(codeSignatureSection)); + const uint32_t MACOS_MAXPATHLEN = 1024; config->headerPad = std::max( config->headerPad, (config->headerPadMaxInstallNames @@ -618,6 +641,7 @@ .Case(section_names::symbolTable, -3) .Case(section_names::indirectSymbolTable, -2) .Case(section_names::stringTable, -1) + .Case(section_names::codeSignature, std::numeric_limits::max()) .Default(0); } // ZeroFill sections must always be the at the end of their segments, @@ -672,6 +696,9 @@ unwindInfoSection = make(); // TODO(gkm): only when no -r symtabSection = make(*stringTableSection); indirectSymtabSection = make(); + if (config->outputType == MH_EXECUTE && + (config->arch == AK_arm64 || config->arch == AK_arm64e)) + codeSignatureSection = make(); switch (config->outputType) { case MH_EXECUTE: @@ -737,6 +764,7 @@ addr += osec->getSize(); fileOff += osec->getFileSize(); } + seg->fileSize = fileOff - seg->fileOff; } void Writer::openFile() { @@ -759,11 +787,18 @@ } void Writer::writeUuid() { - uint64_t digest = - xxHash64({buffer->getBufferStart(), buffer->getBufferEnd()}); + uint8_t *codeEnd = + buffer->getBufferEnd() - + (codeSignatureSection ? codeSignatureSection->getSize() : 0); + uint64_t digest = xxHash64({buffer->getBufferStart(), codeEnd}); uuidCommand->writeUuid(digest); } +void Writer::writeCodeSignature() { + if (codeSignatureSection) + codeSignatureSection->writeHashes(buffer->getBufferStart()); +} + void Writer::run() { // dyld requires __LINKEDIT segment to always exist (even if empty). OutputSegment *linkEditSegment = @@ -811,6 +846,7 @@ writeSections(); writeUuid(); + writeCodeSignature(); if (auto e = buffer->commit()) error("failed to write to the output file: " + toString(std::move(e))); diff --git a/lld/MachO/cs_blobs.h b/lld/MachO/cs_blobs.h new file mode 100644 --- /dev/null +++ b/lld/MachO/cs_blobs.h @@ -0,0 +1,275 @@ +/* + * Copyright (c) 2017 Apple Computer, Inc. All rights reserved. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. + * + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ + */ + +#ifndef _KERN_CODESIGN_H_ +#define _KERN_CODESIGN_H_ + +#include + +/* code signing attributes of a process */ +#define CS_VALID 0x00000001 /* dynamically valid */ +#define CS_ADHOC 0x00000002 /* ad hoc signed */ +#define CS_GET_TASK_ALLOW 0x00000004 /* has get-task-allow entitlement */ +#define CS_INSTALLER 0x00000008 /* has installer entitlement */ + +#define CS_FORCED_LV \ + 0x00000010 /* Library Validation required by Hardened System Policy */ +#define CS_INVALID_ALLOWED \ + 0x00000020 /* (macOS Only) Page invalidation allowed by task port policy */ + +#define CS_HARD 0x00000100 /* don't load invalid pages */ +#define CS_KILL 0x00000200 /* kill process if it becomes invalid */ +#define CS_CHECK_EXPIRATION 0x00000400 /* force expiration checking */ +#define CS_RESTRICT 0x00000800 /* tell dyld to treat restricted */ + +#define CS_ENFORCEMENT 0x00001000 /* require enforcement */ +#define CS_REQUIRE_LV 0x00002000 /* require library validation */ +#define CS_ENTITLEMENTS_VALIDATED \ + 0x00004000 /* code signature permits restricted entitlements */ +#define CS_NVRAM_UNRESTRICTED \ + 0x00008000 /* has com.apple.rootless.restricted-nvram-variables.heritable \ + entitlement */ + +#define CS_RUNTIME 0x00010000 /* Apply hardened runtime policies */ +#define CS_LINKER_SIGNED 0x00020000 /* Automatically signed by the linker */ + +#define CS_ALLOWED_MACHO \ + (CS_ADHOC | CS_HARD | CS_KILL | CS_CHECK_EXPIRATION | CS_RESTRICT | \ + CS_ENFORCEMENT | CS_REQUIRE_LV | CS_RUNTIME | CS_LINKER_SIGNED) + +#define CS_EXEC_SET_HARD 0x00100000 /* set CS_HARD on any exec'ed process */ +#define CS_EXEC_SET_KILL 0x00200000 /* set CS_KILL on any exec'ed process */ +#define CS_EXEC_SET_ENFORCEMENT \ + 0x00400000 /* set CS_ENFORCEMENT on any exec'ed process */ +#define CS_EXEC_INHERIT_SIP \ + 0x00800000 /* set CS_INSTALLER on any exec'ed process */ + +#define CS_KILLED 0x01000000 /* was killed by kernel for invalidity */ +#define CS_DYLD_PLATFORM \ + 0x02000000 /* dyld used to load this is a platform binary */ +#define CS_PLATFORM_BINARY 0x04000000 /* this is a platform binary */ +#define CS_PLATFORM_PATH \ + 0x08000000 /* platform binary by the fact of path (osx only) */ + +#define CS_DEBUGGED \ + 0x10000000 /* process is currently or has previously been debugged and \ + allowed to run with invalid pages */ +#define CS_SIGNED \ + 0x20000000 /* process has a signature (may have gone invalid) */ +#define CS_DEV_CODE \ + 0x40000000 /* code is dev signed, cannot be loaded into prod signed code \ + (will go away with rdar://problem/28322552) */ +#define CS_DATAVAULT_CONTROLLER \ + 0x80000000 /* has Data Vault controller entitlement */ + +#define CS_ENTITLEMENT_FLAGS \ + (CS_GET_TASK_ALLOW | CS_INSTALLER | CS_DATAVAULT_CONTROLLER | \ + CS_NVRAM_UNRESTRICTED) + +/* executable segment flags */ + +#define CS_EXECSEG_MAIN_BINARY \ + 0x1 /* executable segment denotes main binary \ + */ +#define CS_EXECSEG_ALLOW_UNSIGNED \ + 0x10 /* allow unsigned pages (for debugging) */ +#define CS_EXECSEG_DEBUGGER 0x20 /* main binary is debugger */ +#define CS_EXECSEG_JIT 0x40 /* JIT enabled */ +#define CS_EXECSEG_SKIP_LV 0x80 /* OBSOLETE: skip library validation */ +#define CS_EXECSEG_CAN_LOAD_CDHASH 0x100 /* can bless cdhash for execution */ +#define CS_EXECSEG_CAN_EXEC_CDHASH 0x200 /* can execute blessed cdhash */ + +/* + * Magic numbers used by Code Signing + */ +enum { + CSMAGIC_REQUIREMENT = 0xfade0c00, /* single Requirement blob */ + CSMAGIC_REQUIREMENTS = + 0xfade0c01, /* Requirements vector (internal requirements) */ + CSMAGIC_CODEDIRECTORY = 0xfade0c02, /* CodeDirectory blob */ + CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0, /* embedded form of signature data */ + CSMAGIC_EMBEDDED_SIGNATURE_OLD = 0xfade0b02, /* XXX */ + CSMAGIC_EMBEDDED_ENTITLEMENTS = 0xfade7171, /* embedded entitlements */ + CSMAGIC_DETACHED_SIGNATURE = + 0xfade0cc1, /* multi-arch collection of embedded signatures */ + CSMAGIC_BLOBWRAPPER = 0xfade0b01, /* CMS Signature, among other things */ + + CS_SUPPORTSSCATTER = 0x20100, + CS_SUPPORTSTEAMID = 0x20200, + CS_SUPPORTSCODELIMIT64 = 0x20300, + CS_SUPPORTSEXECSEG = 0x20400, + CS_SUPPORTSRUNTIME = 0x20500, + CS_SUPPORTSLINKAGE = 0x20600, + + CSSLOT_CODEDIRECTORY = 0, /* slot index for CodeDirectory */ + CSSLOT_INFOSLOT = 1, + CSSLOT_REQUIREMENTS = 2, + CSSLOT_RESOURCEDIR = 3, + CSSLOT_APPLICATION = 4, + CSSLOT_ENTITLEMENTS = 5, + + CSSLOT_ALTERNATE_CODEDIRECTORIES = + 0x1000, /* first alternate CodeDirectory, if any */ + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX = 5, /* max number of alternate CD slots */ + CSSLOT_ALTERNATE_CODEDIRECTORY_LIMIT = + CSSLOT_ALTERNATE_CODEDIRECTORIES + + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX, /* one past the last */ + + CSSLOT_SIGNATURESLOT = 0x10000, /* CMS Signature */ + CSSLOT_IDENTIFICATIONSLOT = 0x10001, + CSSLOT_TICKETSLOT = 0x10002, + + CSTYPE_INDEX_REQUIREMENTS = 0x00000002, /* compat with amfi */ + CSTYPE_INDEX_ENTITLEMENTS = 0x00000005, /* compat with amfi */ + + CS_HASHTYPE_SHA1 = 1, + CS_HASHTYPE_SHA256 = 2, + CS_HASHTYPE_SHA256_TRUNCATED = 3, + CS_HASHTYPE_SHA384 = 4, + + CS_SHA1_LEN = 20, + CS_SHA256_LEN = 32, + CS_SHA256_TRUNCATED_LEN = 20, + + CS_CDHASH_LEN = 20, /* always - larger hashes are truncated */ + CS_HASH_MAX_SIZE = 48, /* max size of the hash we'll support */ + + /* + * Currently only to support Legacy VPN plugins, and Mac App Store + * but intended to replace all the various platform code, dev code etc. bits. + */ + CS_SIGNER_TYPE_UNKNOWN = 0, + CS_SIGNER_TYPE_LEGACYVPN = 5, + CS_SIGNER_TYPE_MAC_APP_STORE = 6, + + CS_SUPPL_SIGNER_TYPE_UNKNOWN = 0, + CS_SUPPL_SIGNER_TYPE_TRUSTCACHE = 7, + CS_SUPPL_SIGNER_TYPE_LOCAL = 8, +}; + +#define KERNEL_HAVE_CS_CODEDIRECTORY 1 +#define KERNEL_CS_CODEDIRECTORY_HAVE_PLATFORM 1 + +/* + * C form of a CodeDirectory. + */ +typedef struct __CodeDirectory { + uint32_t magic; /* magic number (CSMAGIC_CODEDIRECTORY) */ + uint32_t length; /* total length of CodeDirectory blob */ + uint32_t version; /* compatibility version */ + uint32_t flags; /* setup and mode flags */ + uint32_t hashOffset; /* offset of hash slot element at index zero */ + uint32_t identOffset; /* offset of identifier string */ + uint32_t nSpecialSlots; /* number of special hash slots */ + uint32_t nCodeSlots; /* number of ordinary (code) hash slots */ + uint32_t codeLimit; /* limit to main image signature range */ + uint8_t hashSize; /* size of each hash in bytes */ + uint8_t hashType; /* type of hash (cdHashType* constants) */ + uint8_t platform; /* platform identifier; zero if not platform binary */ + uint8_t pageSize; /* log2(page size in bytes); 0 => infinite */ + uint32_t spare2; /* unused (must be zero) */ + + // char end_earliest[0]; + + /* Version 0x20100 */ + uint32_t scatterOffset; /* offset of optional scatter vector */ + // char end_withScatter[0]; + + /* Version 0x20200 */ + uint32_t teamOffset; /* offset of optional team identifier */ + // char end_withTeam[0]; + + /* Version 0x20300 */ + uint32_t spare3; /* unused (must be zero) */ + uint64_t codeLimit64; /* limit to main image signature range, 64 bits */ + // char end_withCodeLimit64[0]; + + /* Version 0x20400 */ + uint64_t execSegBase; /* offset of executable segment */ + uint64_t execSegLimit; /* limit of executable segment */ + uint64_t execSegFlags; /* executable segment flags */ + // char end_withExecSeg[0]; + /* Version 0x20500 */ + uint32_t runtime; + uint32_t preEncryptOffset; + // char end_withPreEncryptOffset[0]; + + /* Version 0x20600 */ + uint8_t linkageHashType; + uint8_t linkageTruncated; + uint16_t spare4; + uint32_t linkageOffset; + uint32_t linkageSize; + // char end_withLinkage[0]; + + /* followed by dynamic content as located by offset fields above */ +} CS_CodeDirectory __attribute__((aligned(1))); + +/* + * Structure of an embedded-signature SuperBlob + */ + +typedef struct __BlobIndex { + uint32_t type; /* type of entry */ + uint32_t offset; /* offset of entry */ +} CS_BlobIndex __attribute__((aligned(1))); + +typedef struct __SC_SuperBlob { + uint32_t magic; /* magic number */ + uint32_t length; /* total length of SuperBlob */ + uint32_t count; /* number of index entries following */ + // CS_BlobIndex index[]; /* (count) entries */ + /* followed by Blobs in no particular order as indicated by offsets in index + */ +} CS_SuperBlob __attribute__((aligned(1))); + +#define KERNEL_HAVE_CS_GENERICBLOB 1 +typedef struct __SC_GenericBlob { + uint32_t magic; /* magic number */ + uint32_t length; /* total length of blob */ + // char data[]; +} CS_GenericBlob __attribute__((aligned(1))); + +typedef struct __SC_Scatter { + uint32_t count; // number of pages; zero for sentinel (only) + uint32_t base; // first page number + uint64_t targetOffset; // offset in target + uint64_t spare; // reserved +} SC_Scatter __attribute__((aligned(1))); + +enum SecCSDigestAlgorithm : uint32_t { + kSecCodeSignatureNoHash = 0, /* null value */ + kSecCodeSignatureHashSHA1 = 1, /* SHA-1 */ + kSecCodeSignatureHashSHA256 = 2, /* SHA-256 */ + kSecCodeSignatureHashSHA256Truncated = + 3, /* SHA-256 truncated to first 20 bytes */ + kSecCodeSignatureHashSHA384 = 4, /* SHA-384 */ + kSecCodeSignatureHashSHA512 = 5, /* SHA-512 */ +}; + +#endif /* _KERN_CODESIGN_H */