kern_pax.c revision 1.3.10.2
1 1.3.10.2 yamt /* $NetBSD: kern_pax.c,v 1.3.10.2 2006/06/21 15:09:37 yamt Exp $ */ 2 1.3.10.2 yamt 3 1.3.10.2 yamt /*- 4 1.3.10.2 yamt * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 5 1.3.10.2 yamt * All rights reserved. 6 1.3.10.2 yamt * 7 1.3.10.2 yamt * Redistribution and use in source and binary forms, with or without 8 1.3.10.2 yamt * modification, are permitted provided that the following conditions 9 1.3.10.2 yamt * are met: 10 1.3.10.2 yamt * 1. Redistributions of source code must retain the above copyright 11 1.3.10.2 yamt * notice, this list of conditions and the following disclaimer. 12 1.3.10.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 13 1.3.10.2 yamt * notice, this list of conditions and the following disclaimer in the 14 1.3.10.2 yamt * documentation and/or other materials provided with the distribution. 15 1.3.10.2 yamt * 3. All advertising materials mentioning features or use of this software 16 1.3.10.2 yamt * must display the following acknowledgement: 17 1.3.10.2 yamt * This product includes software developed by Elad Efrat. 18 1.3.10.2 yamt * 4. The name of the author may not be used to endorse or promote products 19 1.3.10.2 yamt * derived from this software without specific prior written permission. 20 1.3.10.2 yamt * 21 1.3.10.2 yamt * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 1.3.10.2 yamt * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 1.3.10.2 yamt * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 1.3.10.2 yamt * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.3.10.2 yamt * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 1.3.10.2 yamt * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 1.3.10.2 yamt * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 1.3.10.2 yamt * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 1.3.10.2 yamt * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 1.3.10.2 yamt * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 1.3.10.2 yamt */ 32 1.3.10.2 yamt 33 1.3.10.2 yamt #include "opt_pax.h" 34 1.3.10.2 yamt 35 1.3.10.2 yamt #include <sys/param.h> 36 1.3.10.2 yamt #include <sys/proc.h> 37 1.3.10.2 yamt #include <sys/exec_elf.h> 38 1.3.10.2 yamt #include <uvm/uvm_extern.h> 39 1.3.10.2 yamt #include <sys/pax.h> 40 1.3.10.2 yamt #include <sys/sysctl.h> 41 1.3.10.2 yamt 42 1.3.10.2 yamt int pax_mprotect_enabled = 1; 43 1.3.10.2 yamt int pax_mprotect_global = PAX_MPROTECT; 44 1.3.10.2 yamt 45 1.3.10.2 yamt SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 46 1.3.10.2 yamt { 47 1.3.10.2 yamt const struct sysctlnode *rnode = NULL; 48 1.3.10.2 yamt 49 1.3.10.2 yamt sysctl_createv(clog, 0, NULL, &rnode, 50 1.3.10.2 yamt CTLFLAG_PERMANENT, 51 1.3.10.2 yamt CTLTYPE_NODE, "security", NULL, 52 1.3.10.2 yamt NULL, 0, NULL, 0, 53 1.3.10.2 yamt CTL_CREATE, CTL_EOL); 54 1.3.10.2 yamt 55 1.3.10.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 56 1.3.10.2 yamt CTLFLAG_PERMANENT, 57 1.3.10.2 yamt CTLTYPE_NODE, "pax", 58 1.3.10.2 yamt SYSCTL_DESCR("PaX (exploit mitigation) features."), 59 1.3.10.2 yamt NULL, 0, NULL, 0, 60 1.3.10.2 yamt CTL_CREATE, CTL_EOL); 61 1.3.10.2 yamt 62 1.3.10.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 63 1.3.10.2 yamt CTLFLAG_PERMANENT, 64 1.3.10.2 yamt CTLTYPE_NODE, "mprotect", 65 1.3.10.2 yamt SYSCTL_DESCR("mprotect(2) W^X restrictions."), 66 1.3.10.2 yamt NULL, 0, NULL, 0, 67 1.3.10.2 yamt CTL_CREATE, CTL_EOL); 68 1.3.10.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 69 1.3.10.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 70 1.3.10.2 yamt CTLTYPE_INT, "enabled", 71 1.3.10.2 yamt SYSCTL_DESCR("Restrictions enabled."), 72 1.3.10.2 yamt NULL, 0, &pax_mprotect_enabled, 0, 73 1.3.10.2 yamt CTL_CREATE, CTL_EOL); 74 1.3.10.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 75 1.3.10.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 76 1.3.10.2 yamt CTLTYPE_INT, "global_protection", 77 1.3.10.2 yamt SYSCTL_DESCR("When enabled, unless explicitly " 78 1.3.10.2 yamt "specified, apply restrictions to" 79 1.3.10.2 yamt "all processes."), 80 1.3.10.2 yamt NULL, 0, &pax_mprotect_global, 0, 81 1.3.10.2 yamt CTL_CREATE, CTL_EOL); 82 1.3.10.2 yamt } 83 1.3.10.2 yamt 84 1.3.10.2 yamt void 85 1.3.10.2 yamt pax_mprotect_adjust(struct lwp *l, int f) 86 1.3.10.2 yamt { 87 1.3.10.2 yamt if (!pax_mprotect_enabled) 88 1.3.10.2 yamt return; 89 1.3.10.2 yamt 90 1.3.10.2 yamt if (f & PF_PAXMPROTECT) 91 1.3.10.2 yamt l->l_proc->p_flag |= P_PAXMPROTECT; 92 1.3.10.2 yamt if (f & PF_PAXNOMPROTECT) 93 1.3.10.2 yamt l->l_proc->p_flag |= P_PAXNOMPROTECT; 94 1.3.10.2 yamt } 95 1.3.10.2 yamt 96 1.3.10.2 yamt void 97 1.3.10.2 yamt pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 98 1.3.10.2 yamt { 99 1.3.10.2 yamt if (!pax_mprotect_enabled || 100 1.3.10.2 yamt (pax_mprotect_global && (l->l_proc->p_flag & P_PAXNOMPROTECT)) || 101 1.3.10.2 yamt (!pax_mprotect_global && !(l->l_proc->p_flag & P_PAXMPROTECT))) 102 1.3.10.2 yamt return; 103 1.3.10.2 yamt 104 1.3.10.2 yamt if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 105 1.3.10.2 yamt *prot &= ~VM_PROT_EXECUTE; 106 1.3.10.2 yamt *maxprot &= ~VM_PROT_EXECUTE; 107 1.3.10.2 yamt } else { 108 1.3.10.2 yamt *prot &= ~VM_PROT_WRITE; 109 1.3.10.2 yamt *maxprot &= ~VM_PROT_WRITE; 110 1.3.10.2 yamt } 111 1.3.10.2 yamt } 112
Indexes created Tue Sep 30 11:09:46 GMT 2025