darwin: Disable advanced features in hardened processes

- pipe: Avoid socket APIs, and accept that child gating won't work. - fdt-padder: Avoid padding file-descriptor table, as the system calls for doing so are often off limits, and because child gating isn't possible there is no point anyway. - exceptor: Disable to avoid deadlocks in case Mach ports are guarded. Co-authored-by: Håvard Sørbø <havard@hsorbo.no>
frida · Dec 1, 2022 · d31a543 · d31a543
1 parent 94bef43
commit d31a543
Show file tree

Hide file tree

Showing 6 changed files with 34 additions and 5 deletions.
diff --git a/lib/agent/agent.vala b/lib/agent/agent.vala
@@ -254,6 +254,9 @@ namespace Frida.Agent {
 			string[] tokens = agent_parameters.split ("|");
 			unowned string transport_uri = tokens[0];
 			bool enable_exceptor = true;
+#if DARWIN
+			enable_exceptor = !Gum.Darwin.query_hardened ();
+#endif
 			bool enable_exit_monitor = true;
 			bool enable_thread_suspend_monitor = true;
 			foreach (unowned string option in tokens[1:]) {

diff --git a/lib/agent/meson.build b/lib/agent/meson.build
@@ -14,6 +14,9 @@ extra_link_args = []
 if host_os_family != 'windows'
   extra_vala_args += ['--pkg=posix']
 endif
+if host_os_family == 'darwin'
+  extra_vala_args += ['--pkg=frida-gum-darwin-1.0']
+endif
 
 if host_os_family == 'darwin'
   extra_link_args += ['-Wl,-exported_symbol,_frida_agent_main']

diff --git a/lib/payload/fdt-padder.vala b/lib/payload/fdt-padder.vala
@@ -30,6 +30,11 @@ namespace Frida {
 		}
 
 		private FileDescriptorTablePadder () {
+#if DARWIN
+			if (Gum.Darwin.query_hardened ())
+				return;
+#endif
+
 			open_needed_descriptors ();
 		}
 
@@ -44,6 +49,11 @@ namespace Frida {
 		}
 
 		public void move_descriptor_if_needed (ref int fd) {
+#if DARWIN
+			if (Gum.Darwin.query_hardened ())
+				return;
+#endif
+
 			if (fd >= MIN_TABLE_SIZE)
 				return;
 

diff --git a/lib/payload/meson.build b/lib/payload/meson.build
@@ -29,6 +29,9 @@ extra_vala_args = []
 if host_os_family != 'windows'
   extra_vala_args += ['--pkg=posix']
 endif
+if host_os_family == 'darwin'
+  extra_vala_args += ['--pkg=frida-gum-darwin-1.0']
+endif
 if host_os_family == 'linux'
   extra_vala_args += ['--pkg=linux']
 endif

diff --git a/lib/pipe/meson.build b/lib/pipe/meson.build
@@ -12,6 +12,9 @@ if host_os_family == 'windows'
   ]
 elif host_os in ['macos', 'ios']
   pipe_sources += ['pipe-darwin.c']
+
+  system_deps += [gio_unix_dep]
+  vala_args += ['--pkg=frida-gum-darwin-1.0', '--pkg=posix']
 else
   pipe_sources += ['pipe-unix.c']
 

diff --git a/lib/pipe/pipe.vala b/lib/pipe/pipe.vala
@@ -118,14 +118,21 @@ namespace Frida {
 	}
 #elif MACOS || IOS
 	namespace DarwinPipe {
-		public static Future<SocketConnection> open (string address, Cancellable? cancellable) {
-			var promise = new Promise<SocketConnection> ();
+		public static Future<IOStream> open (string address, Cancellable? cancellable) {
+			var promise = new Promise<IOStream> ();
 
 			try {
 				var fd = _consume_stashed_file_descriptor (address);
-				var socket = new Socket.from_fd (fd);
-				var connection = SocketConnection.factory_create_connection (socket);
-				promise.resolve (connection);
+				IOStream stream;
+				if (Gum.Darwin.query_hardened ()) {
+					var input = new UnixInputStream (fd, true);
+					var output = new UnixOutputStream (fd, false);
+					stream = new SimpleIOStream (input, output);
+				} else {
+					var socket = new Socket.from_fd (fd);
+					stream = SocketConnection.factory_create_connection (socket);
+				}
+				promise.resolve (stream);
 			} catch (GLib.Error e) {
 				promise.reject (e);
 			}