iOS 26.4 如何限制系统进程使用 JavaScriptCore

#include<stdio.h>#include<stdint.h>#include<dlfcn.h>intmain(void){    uint64_t (*os_security_config_get)(void) =        (uint64_t (*)(void))dlsym(RTLD_DEFAULT, "os_security_config_get");    if (!os_security_config_get) {        fprintf(stderr, "system too old\n");        return 1;    }    uint64_t cfg = os_security_config_get();    printf("os_security_config_get() = 0x%llx  | SCRIPT_RESTRICTIONS(0x40)=%s"            "  HARDENED_HEAP(0x1)=%s TPRO(0x2)=%s GUARD_OBJECTS(0x100)=%s\n",            (unsigned long long)cfg,            (cfg & 0x40)  ? "ON"  : "off",            (cfg & 0x1)   ? "on"  : "off",            (cfg & 0x2)   ? "on"  : "off",            (cfg & 0x100) ? "on"  : "off");    void *jsc = dlopen("/System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore", RTLD_NOW);    if (!jsc) { printf("dlopen(JavaScriptCore) FAILED: %s\n", dlerror()); return 2; }    void* (*JSGlobalContextCreate)(void*)               = dlsym(jsc, "JSGlobalContextCreate");    void* (*JSStringCreateWithUTF8CString)(const char*) = dlsym(jsc, "JSStringCreateWithUTF8CString");    void* (*JSEvaluateScript)(void*,void*,void*,void*,int,void**) = dlsym(jsc, "JSEvaluateScript");    double (*JSValueToNumber)(void*,void*,void**)       = dlsym(jsc, "JSValueToNumber");    printf("dlopen JSC=%p  JSGlobalContextCreate=%p\n", jsc, (void*)JSGlobalContextCreate);    void *ctx = JSGlobalContextCreate(NULL);            // <- traps here under restrictions    printf("JSGlobalContextCreate -> %p\n", ctx);    void *src = JSStringCreateWithUTF8CString("40 + 2");    void *exc = NULL;    void *res = JSEvaluateScript(ctx, src, NULL, NULL, 0, &exc);    double out = JSValueToNumber(ctx, res, NULL);    printf("40 + 2 = %g\n", out);    return 0;}

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plistPUBLIC"-//Apple//DTD PLIST 1.0//EN""http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plistversion="1.0"><dict>    <key>com.apple.security.script-restrictions</key>    <true/></dict></plist>

cc test_jsc.c -o test_jsccodesign -s - --entitlements ent.plist --force test_jsc

➜  jsc_test lldb test_jsc(lldb) target create "test_jsc"Current executable set to '/Users/cc/Projects/phrack/jsc_test/test_jsc' (arm64).(lldb) rProcess 49313 launched: '/Users/cc/Projects/phrack/jsc_test/test_jsc' (arm64)os_security_config_get() = 0x40  | SCRIPT_RESTRICTIONS(0x40)=ON  HARDENED_HEAP(0x1)=off TPRO(0x2)=off GUARD_OBJECTS(0x100)=offdlopen JSC=0x365fa85a0  JSGlobalContextCreate=0x1a786a9bcProcess 49313 stopped* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x1a7ac6854)    frame #0: 0x00000001a7ac6854 JavaScriptCore`WTF::makePagesFreezable(void*, unsigned long) + 304JavaScriptCore`WTF::makePagesFreezable:->  0x1a7ac6854 <+304>: brk    #0xc471    0x1a7ac6858 <+308>: brk    #0x1    0x1a7ac685c <+312>: adrp   x1, 5970    0x1a7ac6860 <+316>: add    x1, x1, #0xb44 ; "/AppleInternal/Library/BuildRoots/4~CN9QugCEa5fya5kkZXSbadtTe9oVa3sO3gsEwzc/Library/Caches/com.apple.xbs/TemporaryDirectory.sbZNe3/Sources/WTF/Source/WTF/wtf/PageBlock.cpp"Target 0: (test_jsc) stopped.

/*! * @enum os_security_config_t * * @discussion * Supported security configurations that a process/task can have. * This is a bitmask type, allowing multiple configurations to be active. * * @constant OS_SECURITY_CONFIG_NONE * No security config flags set. * * @constant OS_SECURITY_CONFIG_HARDENED_HEAP * Indicates that the Hardened Heap configuration is enabled for the process/task. * This implies security-critical settings for the system memory allocator. * * @constant OS_SECURITY_CONFIG_TPRO * Indicates that Trusted Path Read-Only (TPRO) is enabled for the process/task. * * @constant OS_SECURITY_CONFIG_SCRIPT_RESTRICTIONS * Indicates Script Restrictions are enabled for the process/task. * * @constant OS_SECURITY_CONFIG_GUARD_OBJECTS * Indicates that the Guard Objects configuration is enabled for the process/task. */__API_AVAILABLE(macos(26.0), ios(26.0), tvos(26.0), watchos(26.0), visionos(26.0), driverkit(25.0))OS_OPTIONS(os_security_config, uint64_t,  OS_SECURITY_CONFIG_NONE = 0x0,  OS_SECURITY_CONFIG_HARDENED_HEAP OS_SWIFT_NAME(hardenedHeap) = 0x1,  OS_SECURITY_CONFIG_TPRO OS_SWIFT_NAME(trustedPathReadOnly) = 0x2,  OS_SECURITY_CONFIG_MTE OS_SWIFT_NAME(memoryTaggingExtension) = 0x4,  OS_SECURITY_CONFIG_SCRIPT_RESTRICTIONS OS_SWIFT_NAME(scriptRestrictions) = 0x40,  OS_SECURITY_CONFIG_GUARD_OBJECTS OS_SWIFT_NAME(guardObjects) = 0x100,);

struct task_security_config {union {struct {uint16_t hardened_heap: 1,			    tpro: 1,#if HAS_MTE || HAS_MTE_EMULATION_SHIMS			    sec: 1,#else/* HAS_MTE || HAS_MTE_EMULATION_SHIMS */			reserved: 1,#endif			platform_restrictions_version: 3,			    script_restrictions: 1,			    ipc_containment_vessel: 1,			    guard_objects: 1;uint8_t hardened_process_version;		};uint32_t value;	};};

uint64_t os_security_config_get(){  return __restrictions_config & 0x40 | __security_config & 0x107;}

{#define SECURITY_CONFIG_KEY "security_config="char security_config_str[strlen(SECURITY_CONFIG_KEY) + HEX_STR_LEN + 1];	snprintf(security_config_str, sizeof(security_config_str),	    SECURITY_CONFIG_KEY "0x%x", task_get_security_config(task));	error = exec_add_user_string(imgp, CAST_USER_ADDR_T(security_config_str), UIO_SYSSPACE, FALSE);	imgp->ip_applec++;}#if HAS_MTE || HAS_MTE_EMULATION_SHIMSif (task_has_sec(task)) {const char *sec_transition_shims = "has_sec_transition=1";		error = exec_add_user_string(imgp, CAST_USER_ADDR_T(sec_transition_shims), UIO_SYSSPACE, FALSE);if (error) {			printf("Failed to add security translation shims notification\n");goto bad;		}		imgp->ip_applec++;/* Push down MTE-specific configuration options that allocators may be interested into. */#define SEC_TRANSITION_POLICY_KEY "sec_transition_policy="char sec_transition_policy[strlen(SEC_TRANSITION_POLICY_KEY) + HEX_STR_LEN + 1];		snprintf(sec_transition_policy, sizeof(sec_transition_policy),		    SEC_TRANSITION_POLICY_KEY "0x%x", task_get_sec_policy(task));		error = exec_add_user_string(imgp, CAST_USER_ADDR_T(sec_transition_policy), UIO_SYSSPACE, FALSE);		imgp->ip_applec++;	}#endif/* HAS_MTE || HAS_MTE_EMULATION_SHIMS */

if (v7 & OS_SECURITY_CONFIG_GUARD_OBJECTS)      __security_config |= OS_SECURITY_CONFIG_GUARD_OBJECTS;if (v7 & OS_SECURITY_CONFIG_SCRIPT_RESTRICTIONS ){      address = (mach_vm_address_t)&os_script_config_storage;      if ( mach_vm_map(mach_task_self_, &address,                       0x4000, //                        0,                                 // mask                       VM_FLAGS_OVERWRITE | VM_FLAGS_PERMANENT,                       MEMORY_OBJECT_NULL, 0, FALSE,      // object / offset / copy                       VM_PROT_NONE,                      // cur_protection                       VM_PROT_NONE,                      // max_protection                       VM_INHERIT_COPY) )                 // inheritance (== VM_INHERIT_DEFAULT)          __os_security_config_init_cold_2();      address = (mach_vm_address_t)&__restrictions_config;      if ( mach_vm_map(mach_task_self_, &address,                       0x4000, 0,                       VM_FLAGS_OVERWRITE | VM_FLAGS_PERMANENT,                       MEMORY_OBJECT_NULL, 0, FALSE,                       VM_PROT_READ | VM_PROT_WRITE,      // cur_protection                       VM_PROT_READ | VM_PROT_WRITE,      // max_protection                       VM_INHERIT_COPY) )          __os_security_config_init_cold_3();      __restrictions_config = OS_SECURITY_CONFIG_SCRIPT_RESTRICTIONS;      result = mach_vm_protect(mach_task_self_, address,                               0x4000,                               /*set_maximum=*/ TRUE,                               VM_PROT_READ);      if ( (kern_return_t)result )          __os_security_config_init_cold_4();  }

staticboolscriptingIsForbidden(){    return processHasEntitlement("com.apple.security.script-restrictions"_s);}voidinitialize(){    ...    WTF::makePagesFreezable(&os_script_config_storage, OpcodeConfigSizeToProtect);    if (g_jscConfig.vmEntryDisallowed || scriptingIsForbidden()) [[unlikely]] {        g_jscConfig.vmEntryDisallowed = true;        WTF::permanentlyFreezePages(&os_script_config_storage, OpcodeConfigSizeToProtect,                                    WTF::FreezePagePermission::None);        return;    }    WTF::compilerFence();    ...}

// Works together with permanentlyFreezePages().voidmakePagesFreezable(void* base, size_t size){    RELEASE_ASSERT(roundUpToMultipleOf(pageSize(), size) == size);#if PLATFORM(COCOA)    mach_vm_address_t addr = std::bit_cast<uintptr_t>(base);    auto flags = VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE | VM_FLAGS_PERMANENT;    auto attemptVMMapping = [&] {        auto result = mach_vm_map(mach_task_self(), &addr, size, pageSize() - 1, flags, MEMORY_OBJECT_NULL, 0, false, VM_PROT_READ | VM_PROT_WRITE, VM_PROT_READ | VM_PROT_WRITE, VM_INHERIT_DEFAULT);        return result;    };    auto result = attemptVMMapping();#if PLATFORM(IOS_FAMILY_SIMULATOR)    if (result != KERN_SUCCESS) {        flags &= ~VM_FLAGS_PERMANENT; // See rdar://75747788.        result = attemptVMMapping();    }#endif    RELEASE_ASSERT(result == KERN_SUCCESS);#else    UNUSED_PARAM(base);    UNUSED_PARAM(size);#endif}