Home | History | Annotate | Line # | Download | only in kern
kern_pax.c revision 1.1 
      1 /* $NetBSD: kern_pax.c,v 1.1 2006/05/16 00:08:25 elad Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *      This product includes software developed by Elad Efrat.
     18  * 4. The name of the author may not be used to endorse or promote products
     19  *    derived from this software without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 #include "opt_pax.h"
     34 
     35 #include <sys/param.h>
     36 #include <sys/proc.h>
     37 #include <sys/exec_elf.h>
     38 #include <uvm/uvm_extern.h>
     39 #include <sys/pax.h>
     40 #include <sys/sysctl.h>
     41 
     42 int pax_mprotect_enabled;
     43 int pax_mprotect_global;
     44 
     45 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup")
     46 {
     47 	const struct sysctlnode *rnode = NULL;
     48 
     49         sysctl_createv(clog, 0, NULL, &rnode,
     50                        CTLFLAG_PERMANENT,
     51                        CTLTYPE_NODE, "security", NULL,
     52                        NULL, 0, NULL, 0,
     53                        CTL_CREATE, CTL_EOL);
     54 
     55 	sysctl_createv(clog, 0, &rnode, &rnode,
     56 		       CTLFLAG_PERMANENT,
     57 		       CTLTYPE_NODE, "pax",
     58 		       SYSCTL_DESCR("PaX (exploit mitigation) features."),
     59 		       NULL, 0, NULL, 0,
     60 		       CTL_CREATE, CTL_EOL);
     61 
     62 	sysctl_createv(clog, 0, &rnode, &rnode,
     63 		       CTLFLAG_PERMANENT,
     64 		       CTLTYPE_NODE, "mprotect",
     65 		       SYSCTL_DESCR("mprotect(2) W^X restrictions."),
     66 		       NULL, 0, NULL, 0,
     67 		       CTL_CREATE, CTL_EOL);
     68 	sysctl_createv(clog, 0, &rnode, NULL,
     69 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_IMMEDIATE,
     70 		       CTLTYPE_INT, "enabled",
     71 		       SYSCTL_DESCR("Restrictions enabled."),
     72 		       NULL, 1, &pax_mprotect_enabled, 0,
     73 		       CTL_CREATE, CTL_EOL);
     74 	sysctl_createv(clog, 0, &rnode, NULL,
     75 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_IMMEDIATE,
     76 		       CTLTYPE_INT, "global_protection",
     77 		       SYSCTL_DESCR("When enabled, unless explicitly "
     78 				    "specified, apply restrictions to"
     79 				    "all processes."),
     80 		       NULL, PAX_MPROTECT, &pax_mprotect_global, 0,
     81 		       CTL_CREATE, CTL_EOL);
     82 }
     83 
     84 void
     85 pax_mprotect_adjust(struct lwp *l, int f)
     86 {
     87 	if (!pax_mprotect_enabled ||
     88 	    (f & (PF_PAXMPROTECT|PF_PAXNOMPROTECT)))
     89 		return;
     90 
     91 	if (f & PF_PAXMPROTECT)
     92 		l->l_proc->p_flag |= P_PAXMPROTECT;
     93 	if (f & PF_PAXNOMPROTECT)
     94 		l->l_proc->p_flag |= P_PAXNOMPROTECT;
     95 }
     96 
     97 void
     98 pax_mprotect(struct lwp *l, struct uvm_object *obj, vm_prot_t *new_prot)
     99 {
    100 	if (!pax_mprotect_enabled ||
    101 	    (pax_mprotect_global && (l->l_proc->p_flag & P_PAXNOMPROTECT)) ||
    102 	    (!pax_mprotect_global && !(l->l_proc->p_flag & P_PAXMPROTECT)))
    103 		return;
    104 
    105 	if (obj == NULL) {
    106 		/* Anonymous mappings always get their execute bit stripped. */
    107 		*new_prot &= ~VM_PROT_EXECUTE;
    108 	} else {
    109 		/* File mappings. */
    110 		if ((*new_prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) ==
    111 		    VM_PROT_WRITE)
    112 			*new_prot &= ~VM_PROT_EXECUTE;
    113 		else
    114 			*new_prot &= ~VM_PROT_WRITE;
    115 	}
    116 }
    117