Home | History | Annotate | Line # | Download | only in paxctl 
      1 /* $NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      5  * Copyright (c) 2008 Christos Zoulas <christos (at) NetBSD.org>
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. The name of the author may not be used to endorse or promote products
     17  *    derived from this software without specific prior written permission.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     29  */
     30 #if HAVE_NBTOOL_CONFIG_H
     31 #include "nbtool_config.h"
     32 #endif
     33 
     34 #include <sys/cdefs.h>
     35 #ifndef lint
     36 #ifdef __RCSID
     37 __RCSID("$NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $");
     38 #endif
     39 #endif /* not lint */
     40 
     41 #include <sys/types.h>
     42 #ifdef HAVE_NBTOOL_CONFIG_H
     43 #include "../../sys/sys/exec_elf.h"
     44 #else
     45 #include <elf.h>
     46 #endif
     47 #include <stdio.h>
     48 #include <err.h>
     49 #include <fcntl.h>
     50 #include <unistd.h>
     51 #include <stdlib.h>
     52 #include <string.h>
     53 
     54 static void usage(void) __dead;
     55 static uint32_t pax_flag(char);
     56 static int pax_flags_sane(uint32_t);
     57 static int pax_haveflags(uint32_t);
     58 static void pax_printflags(const char *, int, uint32_t);
     59 
     60 #ifndef ELF_NOTE_TYPE_PAX_TAG
     61 /* NetBSD-specific note type: PaX.  There should be 1 NOTE per executable.
     62    section.  desc is a 32 bit bitmask */
     63 #define ELF_NOTE_TYPE_PAX_TAG		3
     64 #define	ELF_NOTE_PAX_MPROTECT		0x01	/* Force enable MPROTECT */
     65 #define	ELF_NOTE_PAX_NOMPROTECT		0x02	/* Force disable MPROTECT */
     66 #define	ELF_NOTE_PAX_GUARD		0x04	/* Force enable Segvguard */
     67 #define	ELF_NOTE_PAX_NOGUARD		0x08	/* Force disable Segvguard */
     68 #define	ELF_NOTE_PAX_ASLR		0x10	/* Force enable ASLR */
     69 #define	ELF_NOTE_PAX_NOASLR		0x20	/* Force disable ASLR */
     70 #define ELF_NOTE_PAX_NAMESZ		4
     71 #define ELF_NOTE_PAX_NAME		"PaX\0"
     72 #define ELF_NOTE_PAX_DESCSZ		4
     73 #endif
     74 #ifndef __arraycount
     75 #define __arraycount(a) (sizeof(a) / sizeof(a[0]))
     76 #endif
     77 
     78 
     79 static const struct paxflag {
     80 	char mark;
     81 	const char *name;
     82 	uint32_t bits;
     83 } flags[] = {
     84 	{ 'A', "ASLR, explicit enable",
     85 	  ELF_NOTE_PAX_ASLR },
     86 	{ 'a', "ASLR, explicit disable",
     87 	  ELF_NOTE_PAX_NOASLR },
     88 	{ 'G', "Segvguard, explicit enable",
     89 	  ELF_NOTE_PAX_GUARD },
     90 	{ 'g', "Segvguard, explicit disable",
     91 	  ELF_NOTE_PAX_NOGUARD },
     92 	{ 'M', "mprotect(2) restrictions, explicit enable",
     93 	  ELF_NOTE_PAX_MPROTECT },
     94 	{ 'm', "mprotect(2) restrictions, explicit disable",
     95 	  ELF_NOTE_PAX_NOMPROTECT },
     96 };
     97 
     98 static void
     99 usage(void)
    100 {
    101 	(void)fprintf(stderr,
    102 	    "Usage: %s [ -0 | <-|+><A|a|G|g|M|m> ] <file> ...\n",
    103 #if HAVE_NBTOOL_CONFIG_H
    104 	    "paxctl"
    105 #else
    106 	    getprogname()
    107 #endif
    108 	);
    109 	exit(1);
    110 }
    111 
    112 static uint32_t
    113 pax_flag(char s)
    114 {
    115 	size_t i;
    116 
    117 	if (s == '\0')
    118 		return (uint32_t)-1;
    119 
    120 	for (i = 0; i < __arraycount(flags); i++)
    121 		if (s == flags[i].mark)
    122 			return flags[i].bits;
    123 
    124 	return (uint32_t)-1;
    125 }
    126 
    127 static int
    128 pax_flags_sane(uint32_t f)
    129 {
    130 	size_t i;
    131 
    132 	for (i = 0; i < __arraycount(flags) - 1; i += 2) {
    133 		uint32_t g = flags[i].bits | flags[i+1].bits;
    134 		if ((f & g) == g)
    135 			return 0;
    136 	}
    137 
    138 	return 1;
    139 }
    140 
    141 static int
    142 pax_haveflags(uint32_t f)
    143 {
    144 	size_t i;
    145 
    146 	for (i = 0; i < __arraycount(flags); i++)
    147 		if (f & flags[i].bits)
    148 			return (1);
    149 
    150 	return (0);
    151 }
    152 
    153 static void
    154 pax_printflags(const char *name, int many, uint32_t f)
    155 {
    156 	size_t i;
    157 
    158 	for (i = 0; i < __arraycount(flags); i++)
    159 		if (f & flags[i].bits) {
    160 			if (many)
    161 				(void)printf("%s: ", name);
    162 			(void)printf("  %c: %s\n",
    163 			    flags[i].mark, flags[i].name);
    164 		}
    165 }
    166 
    167 static int
    168 process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
    169     int clear, int list, int many)
    170 {
    171 	union {
    172 	    Elf32_Ehdr h32;
    173 	    Elf64_Ehdr h64;
    174 	} e;
    175 	union {
    176 	    Elf32_Shdr h32;
    177 	    Elf64_Shdr h64;
    178 	} s;
    179 	union {
    180 	    Elf32_Nhdr h32;
    181 	    Elf64_Nhdr h64;
    182 	} n;
    183 #define SWAP(a)	(swap == 0 ? (a) : \
    184     /*LINTED*/(sizeof(a) == 1 ? (a) : \
    185     /*LINTED*/(sizeof(a) == 2 ? bswap16(a) : \
    186     /*LINTED*/(sizeof(a) == 4 ? bswap32(a) : \
    187     /*LINTED*/(sizeof(a) == 8 ? bswap64(a) : (abort(), (a)))))))
    188 #define EH(field)	(size == 32 ? SWAP(e.h32.field) : SWAP(e.h64.field))
    189 #define SH(field)	(size == 32 ? SWAP(s.h32.field) : SWAP(s.h64.field))
    190 #define NH(field)	(size == 32 ? SWAP(n.h32.field) : SWAP(n.h64.field))
    191 #define SHSIZE		(size == 32 ? sizeof(s.h32) : sizeof(s.h64))
    192 #define NHSIZE		(size == 32 ? sizeof(n.h32) : sizeof(n.h64))
    193 	struct {
    194 		char name[ELF_NOTE_PAX_NAMESZ];
    195 		uint32_t flags;
    196 	} pax_tag;
    197 	int fd, size, ok = 0, flagged = 0, swap, error = 1;
    198 	size_t i;
    199 
    200 	fd = open(name, list ? O_RDONLY: O_RDWR, 0);
    201 	if (fd == -1) {
    202 		warn("Can't open `%s'", name);
    203 		return error;
    204 	}
    205 
    206 	if (read(fd, &e, sizeof(e)) != sizeof(e)) {
    207 		warn("Can't read ELF header from `%s'", name);
    208 		goto out;
    209 	}
    210 
    211 	if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0) {
    212 		warnx("Bad ELF magic from `%s' (maybe it's not an ELF?)", name);
    213 		goto out;
    214 	}
    215 
    216 	if (e.h32.e_ehsize == sizeof(e.h32)) {
    217 		size = 32;
    218 		swap = 0;
    219 	} else if (e.h64.e_ehsize == sizeof(e.h64)) {
    220 		size = 64;
    221 		swap = 0;
    222 	} else if (bswap16(e.h32.e_ehsize) == sizeof(e.h32)) {
    223 		size = 32;
    224 		swap = 1;
    225 	} else if (bswap16(e.h64.e_ehsize) == sizeof(e.h64)) {
    226 		size = 64;
    227 		swap = 1;
    228 	} else {
    229 		warnx("Bad ELF size %d from `%s' (maybe it's not an ELF?)",
    230 		    (int)e.h32.e_ehsize, name);
    231 		goto out;
    232 	}
    233 
    234 	for (i = 0; i < EH(e_shnum); i++) {
    235 		if ((size_t)pread(fd, &s, SHSIZE,
    236 		    (off_t)EH(e_shoff) + i * SHSIZE) != SHSIZE) {
    237 			warn("Can't read section header data from `%s'", name);
    238 			goto out;
    239 		}
    240 
    241 		if (SH(sh_type) != SHT_NOTE)
    242 			continue;
    243 
    244 		if (pread(fd, &n, NHSIZE, (off_t)SH(sh_offset)) != NHSIZE) {
    245 			warn("Can't read note header from `%s'", name);
    246 			goto out;
    247 		}
    248 		if (NH(n_type) != ELF_NOTE_TYPE_PAX_TAG ||
    249 		    NH(n_descsz) != ELF_NOTE_PAX_DESCSZ ||
    250 		    NH(n_namesz) != ELF_NOTE_PAX_NAMESZ)
    251 			continue;
    252 		if (pread(fd, &pax_tag, sizeof(pax_tag), SH(sh_offset) + NHSIZE)
    253 		    != sizeof(pax_tag)) {
    254 			warn("Can't read pax_tag from `%s'", name);
    255 			goto out;
    256 		}
    257 		if (memcmp(pax_tag.name, ELF_NOTE_PAX_NAME,
    258 		    sizeof(pax_tag.name)) != 0) {
    259 			warn("Unknown pax_tag name `%*.*s' from `%s'",
    260 			    ELF_NOTE_PAX_NAMESZ, ELF_NOTE_PAX_NAMESZ,
    261 			    pax_tag.name, name);
    262 			goto out;
    263 		}
    264 		ok = 1;
    265 
    266 		if (list) {
    267 			if (!pax_haveflags(SWAP(pax_tag.flags)))
    268 				break;
    269 
    270 			if (!pax_flags_sane(SWAP(pax_tag.flags)))
    271 				warnx("Current flags 0x%x don't make sense",
    272 				    (uint32_t)SWAP(pax_tag.flags));
    273 
    274 			if (many)
    275 				(void)printf("%s: ", name);
    276 			(void)printf("PaX flags:\n");
    277 
    278 			pax_printflags(name, many, SWAP(pax_tag.flags));
    279 			flagged = 1;
    280 			break;
    281 		}
    282 
    283 		if (clear) {
    284 			pax_tag.flags = 0;
    285 		} else {
    286 			pax_tag.flags |= SWAP(add_flags);
    287 			pax_tag.flags &= SWAP(~del_flags);
    288 		}
    289 
    290 		if (!pax_flags_sane(SWAP(pax_tag.flags))) {
    291 			warnx("New flags 0x%x don't make sense",
    292 			    (uint32_t)SWAP(pax_tag.flags));
    293 			goto out;
    294 		}
    295 
    296 		if (pwrite(fd, &pax_tag, sizeof(pax_tag),
    297 		    (off_t)SH(sh_offset) + NHSIZE) != sizeof(pax_tag))
    298 			warn("Can't modify flags on `%s'", name);
    299 		break;
    300 	}
    301 
    302 	if (!ok) {
    303 		warnx("Could not find an ELF PaX SHT_NOTE section in `%s'",
    304 		    name);
    305 		goto out;
    306 	}
    307 
    308 	error = 0;
    309 	if (list && !flagged) {
    310 		if (many)
    311 			(void)printf("%s: ", name);
    312 		(void)printf("No PaX flags.\n");
    313 	}
    314 out:
    315 	(void)close(fd);
    316 	return error;
    317 }
    318 
    319 int
    320 main(int argc, char **argv)
    321 {
    322 	char *opt;
    323 	int i, clear = 0, list = 0, bad = 0, many, minus;
    324 	uint32_t add_flags = 0, del_flags = 0;
    325 
    326 	setprogname(argv[0]);
    327 
    328 	if (argc < 2)
    329 		usage();
    330 
    331 	for (i = 1; i < argc; i++) {
    332 		opt = argv[i];
    333 
    334 		if (strcmp(opt, "-0") == 0) {
    335 			clear = 1;
    336 			continue;
    337 		}
    338 
    339 		if (*opt == '-' || *opt == '+') {
    340 			uint32_t t;
    341 			minus = 0;
    342 
    343 			while (*opt) {
    344 				switch (*opt) {
    345 				case '+':
    346 					minus = 0;
    347 					opt++;
    348 					break;
    349 				case '-':
    350 					minus = 1;
    351 					opt++;
    352 					break;
    353 				case ',':
    354 					opt++;
    355 					break;
    356 				default:
    357 					t = pax_flag(*opt++);
    358 					if (t == (uint32_t)-1)
    359 						usage();
    360 					if (minus)
    361 						del_flags |= t;
    362 					else
    363 						add_flags |= t;
    364 					break;
    365 				}
    366 			}
    367 		} else
    368 			break;
    369 	}
    370 
    371 	if (i == argc)
    372 		usage();
    373 
    374 	switch ((add_flags != 0 || del_flags != 0) + clear) {
    375 	case 0:
    376 		list = 1;
    377 		break;
    378 	case 1:
    379 		break;
    380 	default:
    381 		usage();
    382 	}
    383 
    384 	many = i != argc - 1;
    385 	for (; i < argc; i++) {
    386 		bad |= process_one(argv[i], add_flags, del_flags,
    387 		    clear, list, many);
    388 	}
    389 
    390 	return bad ? EXIT_FAILURE : 0;
    391 }
    392