Loading...
--- xnu/xnu-792.2.4/iokit/Kernel/IOUserClient.cpp
+++ xnu/xnu-792.25.20/iokit/Kernel/IOUserClient.cpp
@@ -22,8 +22,8 @@
#include <IOKit/IOKitServer.h>
+#include <IOKit/IOKitKeysPrivate.h>
#include <IOKit/IOUserClient.h>
-#include <IOKit/IOService.h>
#include <IOKit/IOService.h>
#include <IOKit/IORegistryEntry.h>
#include <IOKit/IOCatalogue.h>
@@ -757,50 +757,93 @@
asyncRef[kIOAsyncCalloutRefconIndex] = (natural_t) refcon;
}
-IOReturn IOUserClient::clientHasPrivilege( void * securityToken,
- const char * privilegeName )
-{
- kern_return_t kr;
- security_token_t token;
- mach_msg_type_number_t count;
-
- count = TASK_SECURITY_TOKEN_COUNT;
- kr = task_info( (task_t) securityToken, TASK_SECURITY_TOKEN,
- (task_info_t) &token, &count );
-
- if (KERN_SUCCESS != kr)
- {}
- else if (!strcmp(privilegeName, kIOClientPrivilegeAdministrator))
- {
- if (0 != token.val[0])
- kr = kIOReturnNotPrivileged;
- }
- else if (!strcmp(privilegeName, kIOClientPrivilegeLocalUser))
- {
- OSArray * array;
- OSDictionary * user = 0;
+inline OSDictionary * CopyConsoleUser(UInt32 uid)
+{
+ OSArray * array;
+ OSDictionary * user = 0;
if ((array = OSDynamicCast(OSArray,
IORegistryEntry::getRegistryRoot()->copyProperty(gIOConsoleUsersKey))))
{
for (unsigned int idx = 0;
(user = OSDynamicCast(OSDictionary, array->getObject(idx)));
- idx++)
- {
- OSNumber * num;
- if ((num = OSDynamicCast(OSNumber, user->getObject(gIOConsoleSessionUIDKey)))
- && (token.val[0] == num->unsigned32BitValue()))
- break;
+ idx++) {
+ OSNumber * num;
+
+ if ((num = OSDynamicCast(OSNumber, user->getObject(gIOConsoleSessionUIDKey)))
+ && (uid == num->unsigned32BitValue())) {
+ user->retain();
+ break;
+ }
}
array->release();
}
- if (!user)
- kr = kIOReturnNotPrivileged;
- }
+ return user;
+}
+
+IOReturn IOUserClient::clientHasPrivilege( void * securityToken,
+ const char * privilegeName )
+{
+ kern_return_t kr;
+ security_token_t token;
+ mach_msg_type_number_t count;
+ task_t task;
+ OSDictionary * user;
+ bool secureConsole;
+
+ if ((secureConsole = !strcmp(privilegeName, kIOClientPrivilegeSecureConsoleProcess)))
+ task = (task_t)((IOUCProcessToken *)securityToken)->token;
else
- kr = kIOReturnUnsupported;
+ task = (task_t)securityToken;
+
+ count = TASK_SECURITY_TOKEN_COUNT;
+ kr = task_info( task, TASK_SECURITY_TOKEN, (task_info_t) &token, &count );
+
+ if (KERN_SUCCESS != kr)
+ {}
+ else if (!strcmp(privilegeName, kIOClientPrivilegeAdministrator)) {
+ if (0 != token.val[0])
+ kr = kIOReturnNotPrivileged;
+ } else if (!strcmp(privilegeName, kIOClientPrivilegeLocalUser)) {
+ user = CopyConsoleUser(token.val[0]);
+ if ( user )
+ user->release();
+ else
+ kr = kIOReturnNotPrivileged;
+ } else if (secureConsole || !strcmp(privilegeName, kIOClientPrivilegeConsoleUser)) {
+ user = CopyConsoleUser(token.val[0]);
+ if ( user ) {
+ if (user->getObject(gIOConsoleSessionOnConsoleKey) != kOSBooleanTrue)
+ kr = kIOReturnNotPrivileged;
+ else if ( secureConsole ) {
+ OSNumber * pid = OSDynamicCast(OSNumber, user->getObject(gIOConsoleSessionSecureInputPIDKey));
+ if ( pid && pid->unsigned32BitValue() != ((IOUCProcessToken *)securityToken)->pid)
+ kr = kIOReturnNotPrivileged;
+ }
+ user->release();
+ }
+ else
+ kr = kIOReturnNotPrivileged;
+ } else
+ kr = kIOReturnUnsupported;
return (kr);
+}
+
+bool IOUserClient::init()
+{
+ if( getPropertyTable())
+ return true;
+ else
+ return super::init();
+}
+
+bool IOUserClient::init(OSDictionary * dictionary)
+{
+ if( getPropertyTable())
+ return true;
+ else
+ return super::init(dictionary);
}
bool IOUserClient::initWithTask(task_t owningTask,
@@ -1726,6 +1769,7 @@
return( ret );
}
+
/* Routine io_registry_entry_get_property */
kern_return_t is_io_registry_entry_get_property(
io_object_t registry_entry,
@@ -1959,7 +2003,7 @@
CHECK( IOService, _service, service );
err = service->newUserClient( owningTask, (void *) owningTask,
- connect_type, &client );
+ connect_type, 0, &client );
if( err == kIOReturnSuccess) {
assert( OSDynamicCast(IOUserClient, client) );
@@ -1967,6 +2011,101 @@
}
return( err);
+}
+
+/* Routine io_service_open_ndr */
+kern_return_t is_io_service_open_extended(
+ io_object_t _service,
+ task_t owningTask,
+ int connect_type,
+ NDR_record_t ndr,
+ io_buf_ptr_t properties,
+ mach_msg_type_number_t propertiesCnt,
+ natural_t * result,
+ io_object_t *connection )
+{
+ IOUserClient * client = 0;
+ kern_return_t err = KERN_SUCCESS;
+ IOReturn res = kIOReturnSuccess;
+ OSDictionary * propertiesDict = 0;
+ bool crossEndian;
+ bool disallowAccess;
+
+ CHECK( IOService, _service, service );
+
+ do
+ {
+ if (properties)
+ {
+ OSObject * obj;
+ vm_offset_t data;
+ vm_map_offset_t map_data;
+
+ err = vm_map_copyout( kernel_map, &map_data, (vm_map_copy_t) properties );
+ res = err;
+ data = CAST_DOWN(vm_offset_t, map_data);
+ if (KERN_SUCCESS == err)
+ {
+ // must return success after vm_map_copyout() succeeds
+ obj = OSUnserializeXML( (const char *) data );
+ vm_deallocate( kernel_map, data, propertiesCnt );
+ propertiesDict = OSDynamicCast(OSDictionary, obj);
+ if (!propertiesDict)
+ {
+ res = kIOReturnBadArgument;
+ if (obj)
+ obj->release();
+ }
+ }
+ if (kIOReturnSuccess != res)
+ break;
+ }
+
+ crossEndian = (ndr.int_rep != NDR_record.int_rep);
+ if (crossEndian)
+ {
+ if (!propertiesDict)
+ propertiesDict = OSDictionary::withCapacity(4);
+ OSData * data = OSData::withBytes(&ndr, sizeof(ndr));
+ if (data)
+ {
+ if (propertiesDict)
+ propertiesDict->setObject(kIOUserClientCrossEndianKey, data);
+ data->release();
+ }
+ }
+
+ res = service->newUserClient( owningTask, (void *) owningTask,
+ connect_type, propertiesDict, &client );
+
+ if (propertiesDict)
+ propertiesDict->release();
+
+ if (res == kIOReturnSuccess)
+ {
+ assert( OSDynamicCast(IOUserClient, client) );
+
+ disallowAccess = (crossEndian
+ && (kOSBooleanTrue != service->getProperty(kIOUserClientCrossEndianCompatibleKey))
+ && (kOSBooleanTrue != client->getProperty(kIOUserClientCrossEndianCompatibleKey)));
+
+ if (disallowAccess)
+ {
+ client->clientClose();
+ client->release();
+ client = 0;
+ res = kIOReturnUnsupported;
+ break;
+ }
+ client->sharedInstance = (0 != client->getProperty(kIOUserClientSharedInstanceKey));
+ }
+ }
+ while (false);
+
+ *connection = client;
+ *result = res;
+
+ return (err);
}
/* Routine io_service_close */
@@ -2035,7 +2174,8 @@
if( mapSize)
*mapSize = map->getLength();
- if( task != current_task()) {
+ if( client->sharedInstance
+ || (task != current_task())) {
// push a name out to the task owning the map,
// so we can clean up maps
#if IOASSERT