kern_pax.c revision 1.3.16.2
1 1.3.16.2 rpaulo /* $NetBSD: kern_pax.c,v 1.3.16.2 2006/09/09 02:57:16 rpaulo Exp $ */ 2 1.3.16.2 rpaulo 3 1.3.16.2 rpaulo /*- 4 1.3.16.2 rpaulo * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 5 1.3.16.2 rpaulo * All rights reserved. 6 1.3.16.2 rpaulo * 7 1.3.16.2 rpaulo * Redistribution and use in source and binary forms, with or without 8 1.3.16.2 rpaulo * modification, are permitted provided that the following conditions 9 1.3.16.2 rpaulo * are met: 10 1.3.16.2 rpaulo * 1. Redistributions of source code must retain the above copyright 11 1.3.16.2 rpaulo * notice, this list of conditions and the following disclaimer. 12 1.3.16.2 rpaulo * 2. Redistributions in binary form must reproduce the above copyright 13 1.3.16.2 rpaulo * notice, this list of conditions and the following disclaimer in the 14 1.3.16.2 rpaulo * documentation and/or other materials provided with the distribution. 15 1.3.16.2 rpaulo * 3. All advertising materials mentioning features or use of this software 16 1.3.16.2 rpaulo * must display the following acknowledgement: 17 1.3.16.2 rpaulo * This product includes software developed by Elad Efrat. 18 1.3.16.2 rpaulo * 4. The name of the author may not be used to endorse or promote products 19 1.3.16.2 rpaulo * derived from this software without specific prior written permission. 20 1.3.16.2 rpaulo * 21 1.3.16.2 rpaulo * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 1.3.16.2 rpaulo * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 1.3.16.2 rpaulo * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 1.3.16.2 rpaulo * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.3.16.2 rpaulo * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 1.3.16.2 rpaulo * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 1.3.16.2 rpaulo * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 1.3.16.2 rpaulo * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 1.3.16.2 rpaulo * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 1.3.16.2 rpaulo * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 1.3.16.2 rpaulo */ 32 1.3.16.2 rpaulo 33 1.3.16.2 rpaulo #include "opt_pax.h" 34 1.3.16.2 rpaulo 35 1.3.16.2 rpaulo #include <sys/param.h> 36 1.3.16.2 rpaulo #include <sys/proc.h> 37 1.3.16.2 rpaulo #include <sys/exec_elf.h> 38 1.3.16.2 rpaulo #include <uvm/uvm_extern.h> 39 1.3.16.2 rpaulo #include <sys/pax.h> 40 1.3.16.2 rpaulo #include <sys/sysctl.h> 41 1.3.16.2 rpaulo 42 1.3.16.2 rpaulo int pax_mprotect_enabled = 1; 43 1.3.16.2 rpaulo int pax_mprotect_global = PAX_MPROTECT; 44 1.3.16.2 rpaulo 45 1.3.16.2 rpaulo SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 46 1.3.16.2 rpaulo { 47 1.3.16.2 rpaulo const struct sysctlnode *rnode = NULL; 48 1.3.16.2 rpaulo 49 1.3.16.2 rpaulo sysctl_createv(clog, 0, NULL, &rnode, 50 1.3.16.2 rpaulo CTLFLAG_PERMANENT, 51 1.3.16.2 rpaulo CTLTYPE_NODE, "security", NULL, 52 1.3.16.2 rpaulo NULL, 0, NULL, 0, 53 1.3.16.2 rpaulo CTL_CREATE, CTL_EOL); 54 1.3.16.2 rpaulo 55 1.3.16.2 rpaulo sysctl_createv(clog, 0, &rnode, &rnode, 56 1.3.16.2 rpaulo CTLFLAG_PERMANENT, 57 1.3.16.2 rpaulo CTLTYPE_NODE, "pax", 58 1.3.16.2 rpaulo SYSCTL_DESCR("PaX (exploit mitigation) features."), 59 1.3.16.2 rpaulo NULL, 0, NULL, 0, 60 1.3.16.2 rpaulo CTL_CREATE, CTL_EOL); 61 1.3.16.2 rpaulo 62 1.3.16.2 rpaulo sysctl_createv(clog, 0, &rnode, &rnode, 63 1.3.16.2 rpaulo CTLFLAG_PERMANENT, 64 1.3.16.2 rpaulo CTLTYPE_NODE, "mprotect", 65 1.3.16.2 rpaulo SYSCTL_DESCR("mprotect(2) W^X restrictions."), 66 1.3.16.2 rpaulo NULL, 0, NULL, 0, 67 1.3.16.2 rpaulo CTL_CREATE, CTL_EOL); 68 1.3.16.2 rpaulo sysctl_createv(clog, 0, &rnode, NULL, 69 1.3.16.2 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 70 1.3.16.2 rpaulo CTLTYPE_INT, "enabled", 71 1.3.16.2 rpaulo SYSCTL_DESCR("Restrictions enabled."), 72 1.3.16.2 rpaulo NULL, 0, &pax_mprotect_enabled, 0, 73 1.3.16.2 rpaulo CTL_CREATE, CTL_EOL); 74 1.3.16.2 rpaulo sysctl_createv(clog, 0, &rnode, NULL, 75 1.3.16.2 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 76 1.3.16.2 rpaulo CTLTYPE_INT, "global_protection", 77 1.3.16.2 rpaulo SYSCTL_DESCR("When enabled, unless explicitly " 78 1.3.16.2 rpaulo "specified, apply restrictions to" 79 1.3.16.2 rpaulo "all processes."), 80 1.3.16.2 rpaulo NULL, 0, &pax_mprotect_global, 0, 81 1.3.16.2 rpaulo CTL_CREATE, CTL_EOL); 82 1.3.16.2 rpaulo } 83 1.3.16.2 rpaulo 84 1.3.16.2 rpaulo void 85 1.3.16.2 rpaulo pax_mprotect_adjust(struct lwp *l, int f) 86 1.3.16.2 rpaulo { 87 1.3.16.2 rpaulo if (!pax_mprotect_enabled) 88 1.3.16.2 rpaulo return; 89 1.3.16.2 rpaulo 90 1.3.16.2 rpaulo if (f & PF_PAXMPROTECT) 91 1.3.16.2 rpaulo l->l_proc->p_flag |= P_PAXMPROTECT; 92 1.3.16.2 rpaulo if (f & PF_PAXNOMPROTECT) 93 1.3.16.2 rpaulo l->l_proc->p_flag |= P_PAXNOMPROTECT; 94 1.3.16.2 rpaulo } 95 1.3.16.2 rpaulo 96 1.3.16.2 rpaulo void 97 1.3.16.2 rpaulo pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 98 1.3.16.2 rpaulo { 99 1.3.16.2 rpaulo if (!pax_mprotect_enabled || 100 1.3.16.2 rpaulo (pax_mprotect_global && (l->l_proc->p_flag & P_PAXNOMPROTECT)) || 101 1.3.16.2 rpaulo (!pax_mprotect_global && !(l->l_proc->p_flag & P_PAXMPROTECT))) 102 1.3.16.2 rpaulo return; 103 1.3.16.2 rpaulo 104 1.3.16.2 rpaulo if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 105 1.3.16.2 rpaulo *prot &= ~VM_PROT_EXECUTE; 106 1.3.16.2 rpaulo *maxprot &= ~VM_PROT_EXECUTE; 107 1.3.16.2 rpaulo } else { 108 1.3.16.2 rpaulo *prot &= ~VM_PROT_WRITE; 109 1.3.16.2 rpaulo *maxprot &= ~VM_PROT_WRITE; 110 1.3.16.2 rpaulo } 111 1.3.16.2 rpaulo } 112
Indexes created Tue Sep 30 11:09:46 GMT 2025