Split to LCKProcessInterface, fix CocoaTop not showing in itself

Author: khanhduytran0

LCKXPCServer.h

@@ -8,14 +8,22 @@
 
 @protocol LCKXPCServiceProtocol
 - (void)proc_pidpath:(pid_t)pid reply:(void (^)(NSString *))reply;
+- (void)allRunningProcessesWithReply:(void (^)(NSArray<NSNumber *> *))reply;
 
-- (void)pid:(pid_t)pid checkinWithInfo:(NSDictionary *)info;
+- (void)checkinWithInfo:(NSDictionary *)info;
 - (void)testShowAlert:(NSString *)msg;
 @end
 
-@interface LCKXPCService : NSObject<NSXPCListenerDelegate, LCKXPCServiceProtocol>
+@interface LCKProcessInterface : NSObject<LCKXPCServiceProtocol>
+@property(nonatomic) NSXPCConnection *connection;
+@property(nonatomic) NSDictionary *info;
+- (instancetype)initWithConnection:(NSXPCConnection *)connection;
+@end
+
+@interface LCKXPCService : NSObject<NSXPCListenerDelegate>
 @property(nonatomic) NSXPCListener *listener;
-@property(nonatomic) NSMutableDictionary *processList;
+@property(nonatomic) NSMutableDictionary<NSNumber *, LCKProcessInterface *> *processList;
++ (instancetype)sharedInstanceIfExists;
 @end
 
 @interface LCKXPCService(Client)

LCKXPCServer.m

@@ -7,42 +7,49 @@
 #import "LCKXPCServer.h"
 #import "LCTaskForPIDTweak.h"
 
-@implementation LCKXPCService
-- (instancetype)init {
+@implementation LCKProcessInterface
+- (instancetype)initWithConnection:(NSXPCConnection *)connection {
     self = [super init];
-    self.listener = [NSXPCListener anonymousListener];
-    self.listener.delegate = self;
-    [self.listener resume];
-    
-    self.processList = [NSMutableDictionary dictionary];
+    self.connection = connection;
     return self;
 }
+- (void)checkinWithInfo:(NSDictionary *)info {
+    if(!self.info) self.info = info;
+}
+- (void)testShowAlert:(NSString *)message {
+    LCShowAlert([NSString stringWithFormat:@"LCTaskForPIDTweak: %@", message]);
+}
+- (void)allRunningProcessesWithReply:(void (^)(NSArray<NSNumber *> *))reply {
+    reply(LCKXPCService.sharedInstanceIfExists.processList.allKeys);
+}
 
-// Protocol
 - (void)proc_pidpath:(pid_t)pid reply:(void (^)(NSString *))reply {
-    reply(self.processList[@(pid)][@"ProgramArguments"][0]);
+    reply(LCKXPCService.sharedInstanceIfExists.processList[@(pid)].info[@"ProgramArguments"][0]);
+}
+@end
+
+@implementation LCKXPCService
+static LCKXPCService *sharedInstance;
++ (instancetype)sharedInstanceIfExists {
+    return sharedInstance;
 }
 
-- (void)pid:(pid_t)pid checkinWithInfo:(NSDictionary *)info {
-    // only allow writing to uninitialized entry
-    if(self.processList[@(pid)] != NSNull.null) {
-        //LCShowAlert([NSString stringWithFormat:@"LCKXPCService Violation: guest tried to overwrite exitsing process info"]);
-        return;
-    }
+- (instancetype)init {
+    self = sharedInstance = [super init];
+    self.listener = [NSXPCListener anonymousListener];
+    self.listener.delegate = self;
+    [self.listener resume];
 
-    self.processList[@(pid)] = info;
-}
-- (void)testShowAlert:(NSString *)message {
-    LCShowAlert([NSString stringWithFormat:@"LCTaskForPIDTweak: %@", message]);
+    self.processList = [NSMutableDictionary dictionary];
+    return self;
 }
 
 // NSXPCListenerDelegate
 - (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection {
-    // set process entry to uninitialized
-    self.processList[@(newConnection.processIdentifier)] = NSNull.null;
-    
+    LCKProcessInterface *obj = [[LCKProcessInterface alloc] initWithConnection:newConnection];
+    self.processList[@(newConnection.processIdentifier)] = obj;
     newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(LCKXPCServiceProtocol)];
-    newConnection.exportedObject = self;
+    newConnection.exportedObject = obj;
     [newConnection resume];
     return YES;
 }

LCTaskForPIDTweak.h

@@ -27,6 +27,7 @@ void LCShowAlert(NSString *msg);
 @end
 
 // private C APIs
+int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize);
 int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token);
 int proc_pidpath(int pid, void *buffer, uint32_t buffersize);
 mach_port_t xpc_endpoint_copy_listener_port_4sim(xpc_object_t endpoint);

README.md

@@ -10,7 +10,6 @@ Allows CocoaTop and VansonMod(?) to work jailed inside LiveContainer environment
 
 ## Known issues
 - No entitlement simulation for now, so an app can get task port of any other running apps
-- CocoaTop does not show itself in the process list
 
 ## Technical details
 ### Hooked methods

TweakGuestApp.m

@@ -7,22 +7,19 @@
 static int hook_sysctl_CTL_KERN_PROC_ALL(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp, size_t newlen) {
     // TODO: implement via LCKXPCServer
     struct kinfo_proc *procs = (struct kinfo_proc *)oldp;
-    NSMutableDictionary *info = [NSMutableDictionary dictionaryWithContentsOfFile:containerLockPath];
-    if(!info) return 0;
+    __block NSArray<NSNumber *> *pids;
+    [LCKXPCService.sharedClientProxy allRunningProcessesWithReply:^(NSArray<NSNumber *> *p) {
+        pids = p;
+    }];
     size_t count = 0;
-    for(NSDictionary *appUsageInfo in info.allValues) {
-        if(![appUsageInfo isKindOfClass:NSDictionary.class]) continue;
-        uint64_t val57 = [appUsageInfo[@"auditToken57"] longLongValue];
-        audit_token_t token;
-        token.val[5] = val57 >> 32;
-        token.val[7] = val57 & 0xffffffff;
-        csops_audittoken(token.val[5], 0, NULL, 0, &token);
+    for(NSNumber *pid in pids) {
+        csops(pid.intValue, 0, NULL, 0);
         if(errno == ESRCH) continue;
         if(oldp) {
             procs[count].kp_eproc.e_ucred.cr_uid = 501; // uid=501
             procs[count].kp_eproc.e_pcred.p_rgid = 501; // gid=501
             procs[count].kp_eproc.e_ppid = 1; // ppid=1
-            procs[count].kp_proc.p_pid = token.val[5];
+            procs[count].kp_proc.p_pid = pid.intValue;
             snprintf(procs[count].kp_proc.p_comm, sizeof(procs[count].kp_proc.p_comm), "LiveProcess");
         }
         count++;
@@ -75,10 +72,9 @@ void guest_check_in(void) {
     exc_port = 0;
 
     // check in with the kernel server
-    NSDictionary *info = @{
+    [LCKXPCService.sharedClientProxy checkinWithInfo:@{
         @"ProgramArguments": NSProcessInfo.processInfo.arguments
-    };
-    [LCKXPCService.sharedClientProxy pid:getpid() checkinWithInfo:info];
+    }];
 }
 
 void init_guest_apps(void) {

TweakLiveContainer.m

@@ -18,20 +18,28 @@ kern_return_t catch_mach_exception_raise_state_identity(mach_port_t exception_po
     mach_msg_server(mach_exc_server, sizeof(union __RequestUnion__catch_mach_exc_subsystem), exc_port, MACH_MSG_OPTION_NONE);
     return NULL;
 }
-static void *kernel_server(void *unused) {
-    static LCKXPCService *service;
-    assert(!service);
-    service = [LCKXPCService new];
+
+static void LCKStartKernelServer(void) {
+    LCKXPCService *service = [LCKXPCService new];
     kern_port = service.listener.machPort;
 
     // Expose the XPC service to the public
     kern_return_t kr = bootstrap_register(bootstrap_port, (char*)LCTaskForPIDTweak.kernelPortName.UTF8String, kern_port);
     if(kr != KERN_SUCCESS) {
         LCShowAlert([NSString stringWithFormat:@"LCTaskForPIDTweak: bootstrap_register(kern_port) failed: %d", kr]);
-        return NULL;
     }
-   
-    return NULL;
+}
+static void LCKStartFakeHostTaskPort(void) {
+    // for now, LiveContainer itself cannot register its real task port since it would need a supporting process to handle the exception
+    mach_port_t fake_task;
+    kern_return_t kr;
+    kr = bootstrap_check_in(bootstrap_port, [LCTaskForPIDTweak taskPortNameForPID:getpid()].UTF8String, &fake_task);
+    if(kr != KERN_SUCCESS) {
+        LCShowAlert([NSString stringWithFormat:@"LCTaskForPIDTweak: bootstrap_check_in(fake_task) failed: %d", kr]);
+        return;
+    }
+    mach_port_insert_right(mach_task_self(), fake_task, fake_task, MACH_MSG_TYPE_MAKE_SEND);
+    // TODO
 }
 void init_livecontainer(void) {
     // in LiveContainer we make a global exception port
@@ -45,6 +53,11 @@ void init_livecontainer(void) {
     mach_port_insert_right(mach_task_self(), exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
     pthread_t tExc;
     pthread_create(&tExc, NULL, exception_server, NULL);
-    //pthread_create(&tKern, NULL, kernel_server, NULL);
-    kernel_server(NULL);
+    LCKStartKernelServer();
+    //LCKStartFakeHostTaskPort();
+    
+    // check in myself with the kernel server
+    [LCKXPCService.sharedClientProxy checkinWithInfo:@{
+        @"ProgramArguments": NSProcessInfo.processInfo.arguments
+    }];
 }