kern_pax.c revision 1.3.6.2
1 1.3.6.2 kardel /* $NetBSD: kern_pax.c,v 1.3.6.2 2006/06/01 22:38:07 kardel Exp $ */ 2 1.3.6.2 kardel 3 1.3.6.2 kardel /*- 4 1.3.6.2 kardel * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 5 1.3.6.2 kardel * All rights reserved. 6 1.3.6.2 kardel * 7 1.3.6.2 kardel * Redistribution and use in source and binary forms, with or without 8 1.3.6.2 kardel * modification, are permitted provided that the following conditions 9 1.3.6.2 kardel * are met: 10 1.3.6.2 kardel * 1. Redistributions of source code must retain the above copyright 11 1.3.6.2 kardel * notice, this list of conditions and the following disclaimer. 12 1.3.6.2 kardel * 2. Redistributions in binary form must reproduce the above copyright 13 1.3.6.2 kardel * notice, this list of conditions and the following disclaimer in the 14 1.3.6.2 kardel * documentation and/or other materials provided with the distribution. 15 1.3.6.2 kardel * 3. All advertising materials mentioning features or use of this software 16 1.3.6.2 kardel * must display the following acknowledgement: 17 1.3.6.2 kardel * This product includes software developed by Elad Efrat. 18 1.3.6.2 kardel * 4. The name of the author may not be used to endorse or promote products 19 1.3.6.2 kardel * derived from this software without specific prior written permission. 20 1.3.6.2 kardel * 21 1.3.6.2 kardel * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 1.3.6.2 kardel * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 1.3.6.2 kardel * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 1.3.6.2 kardel * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.3.6.2 kardel * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 1.3.6.2 kardel * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 1.3.6.2 kardel * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 1.3.6.2 kardel * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 1.3.6.2 kardel * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 1.3.6.2 kardel * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 1.3.6.2 kardel */ 32 1.3.6.2 kardel 33 1.3.6.2 kardel #include "opt_pax.h" 34 1.3.6.2 kardel 35 1.3.6.2 kardel #include <sys/param.h> 36 1.3.6.2 kardel #include <sys/proc.h> 37 1.3.6.2 kardel #include <sys/exec_elf.h> 38 1.3.6.2 kardel #include <uvm/uvm_extern.h> 39 1.3.6.2 kardel #include <sys/pax.h> 40 1.3.6.2 kardel #include <sys/sysctl.h> 41 1.3.6.2 kardel 42 1.3.6.2 kardel int pax_mprotect_enabled = 1; 43 1.3.6.2 kardel int pax_mprotect_global = PAX_MPROTECT; 44 1.3.6.2 kardel 45 1.3.6.2 kardel SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 46 1.3.6.2 kardel { 47 1.3.6.2 kardel const struct sysctlnode *rnode = NULL; 48 1.3.6.2 kardel 49 1.3.6.2 kardel sysctl_createv(clog, 0, NULL, &rnode, 50 1.3.6.2 kardel CTLFLAG_PERMANENT, 51 1.3.6.2 kardel CTLTYPE_NODE, "security", NULL, 52 1.3.6.2 kardel NULL, 0, NULL, 0, 53 1.3.6.2 kardel CTL_CREATE, CTL_EOL); 54 1.3.6.2 kardel 55 1.3.6.2 kardel sysctl_createv(clog, 0, &rnode, &rnode, 56 1.3.6.2 kardel CTLFLAG_PERMANENT, 57 1.3.6.2 kardel CTLTYPE_NODE, "pax", 58 1.3.6.2 kardel SYSCTL_DESCR("PaX (exploit mitigation) features."), 59 1.3.6.2 kardel NULL, 0, NULL, 0, 60 1.3.6.2 kardel CTL_CREATE, CTL_EOL); 61 1.3.6.2 kardel 62 1.3.6.2 kardel sysctl_createv(clog, 0, &rnode, &rnode, 63 1.3.6.2 kardel CTLFLAG_PERMANENT, 64 1.3.6.2 kardel CTLTYPE_NODE, "mprotect", 65 1.3.6.2 kardel SYSCTL_DESCR("mprotect(2) W^X restrictions."), 66 1.3.6.2 kardel NULL, 0, NULL, 0, 67 1.3.6.2 kardel CTL_CREATE, CTL_EOL); 68 1.3.6.2 kardel sysctl_createv(clog, 0, &rnode, NULL, 69 1.3.6.2 kardel CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 70 1.3.6.2 kardel CTLTYPE_INT, "enabled", 71 1.3.6.2 kardel SYSCTL_DESCR("Restrictions enabled."), 72 1.3.6.2 kardel NULL, 0, &pax_mprotect_enabled, 0, 73 1.3.6.2 kardel CTL_CREATE, CTL_EOL); 74 1.3.6.2 kardel sysctl_createv(clog, 0, &rnode, NULL, 75 1.3.6.2 kardel CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 76 1.3.6.2 kardel CTLTYPE_INT, "global_protection", 77 1.3.6.2 kardel SYSCTL_DESCR("When enabled, unless explicitly " 78 1.3.6.2 kardel "specified, apply restrictions to" 79 1.3.6.2 kardel "all processes."), 80 1.3.6.2 kardel NULL, 0, &pax_mprotect_global, 0, 81 1.3.6.2 kardel CTL_CREATE, CTL_EOL); 82 1.3.6.2 kardel } 83 1.3.6.2 kardel 84 1.3.6.2 kardel void 85 1.3.6.2 kardel pax_mprotect_adjust(struct lwp *l, int f) 86 1.3.6.2 kardel { 87 1.3.6.2 kardel if (!pax_mprotect_enabled) 88 1.3.6.2 kardel return; 89 1.3.6.2 kardel 90 1.3.6.2 kardel if (f & PF_PAXMPROTECT) 91 1.3.6.2 kardel l->l_proc->p_flag |= P_PAXMPROTECT; 92 1.3.6.2 kardel if (f & PF_PAXNOMPROTECT) 93 1.3.6.2 kardel l->l_proc->p_flag |= P_PAXNOMPROTECT; 94 1.3.6.2 kardel } 95 1.3.6.2 kardel 96 1.3.6.2 kardel void 97 1.3.6.2 kardel pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 98 1.3.6.2 kardel { 99 1.3.6.2 kardel if (!pax_mprotect_enabled || 100 1.3.6.2 kardel (pax_mprotect_global && (l->l_proc->p_flag & P_PAXNOMPROTECT)) || 101 1.3.6.2 kardel (!pax_mprotect_global && !(l->l_proc->p_flag & P_PAXMPROTECT))) 102 1.3.6.2 kardel return; 103 1.3.6.2 kardel 104 1.3.6.2 kardel if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 105 1.3.6.2 kardel *prot &= ~VM_PROT_EXECUTE; 106 1.3.6.2 kardel *maxprot &= ~VM_PROT_EXECUTE; 107 1.3.6.2 kardel } else { 108 1.3.6.2 kardel *prot &= ~VM_PROT_WRITE; 109 1.3.6.2 kardel *maxprot &= ~VM_PROT_WRITE; 110 1.3.6.2 kardel } 111 1.3.6.2 kardel } 112
Indexes created Tue Sep 30 11:09:46 GMT 2025