kern_pax.c revision 1.26
1 /* $NetBSD: kern_pax.c,v 1.26 2011/11/19 22:51:25 tls Exp $ */ 2 3 /*- 4 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.26 2011/11/19 22:51:25 tls Exp $"); 32 33 #include "opt_pax.h" 34 35 #include <sys/param.h> 36 #include <sys/proc.h> 37 #include <sys/exec_elf.h> 38 #include <sys/pax.h> 39 #include <sys/sysctl.h> 40 #include <sys/kmem.h> 41 #include <sys/fileassoc.h> 42 #include <sys/syslog.h> 43 #include <sys/vnode.h> 44 #include <sys/queue.h> 45 #include <sys/kauth.h> 46 #include <sys/cprng.h> 47 48 #ifdef PAX_ASLR 49 #include <sys/mman.h> 50 #include <sys/rnd.h> 51 #include <sys/exec.h> 52 53 int pax_aslr_enabled = 1; 54 int pax_aslr_global = PAX_ASLR; 55 56 #ifndef PAX_ASLR_DELTA_MMAP_LSB 57 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 58 #endif 59 #ifndef PAX_ASLR_DELTA_MMAP_LEN 60 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 61 #endif 62 #ifndef PAX_ASLR_DELTA_STACK_LSB 63 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 64 #endif 65 #ifndef PAX_ASLR_DELTA_STACK_LEN 66 #define PAX_ASLR_DELTA_STACK_LEN 12 67 #endif 68 69 #endif /* PAX_ASLR */ 70 71 #ifdef PAX_MPROTECT 72 static int pax_mprotect_enabled = 1; 73 static int pax_mprotect_global = PAX_MPROTECT; 74 #endif /* PAX_MPROTECT */ 75 76 #ifdef PAX_SEGVGUARD 77 #ifndef PAX_SEGVGUARD_EXPIRY 78 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 79 #endif 80 81 #ifndef PAX_SEGVGUARD_SUSPENSION 82 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 83 #endif 84 85 #ifndef PAX_SEGVGUARD_MAXCRASHES 86 #define PAX_SEGVGUARD_MAXCRASHES 5 87 #endif 88 89 static int pax_segvguard_enabled = 1; 90 static int pax_segvguard_global = PAX_SEGVGUARD; 91 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 92 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 93 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 94 95 static fileassoc_t segvguard_id; 96 97 struct pax_segvguard_uid_entry { 98 uid_t sue_uid; 99 size_t sue_ncrashes; 100 time_t sue_expiry; 101 time_t sue_suspended; 102 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 103 }; 104 105 struct pax_segvguard_entry { 106 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 107 }; 108 109 static void pax_segvguard_cb(void *); 110 #endif /* PAX_SEGVGUARD */ 111 112 /* PaX internal setspecific flags */ 113 #define PAX_MPROTECT_EXPLICIT_ENABLE (void *)0x01 114 #define PAX_MPROTECT_EXPLICIT_DISABLE (void *)0x02 115 #define PAX_SEGVGUARD_EXPLICIT_ENABLE (void *)0x03 116 #define PAX_SEGVGUARD_EXPLICIT_DISABLE (void *)0x04 117 #define PAX_ASLR_EXPLICIT_ENABLE (void *)0x05 118 #define PAX_ASLR_EXPLICIT_DISABLE (void *)0x06 119 120 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 121 { 122 const struct sysctlnode *rnode = NULL, *cnode; 123 124 sysctl_createv(clog, 0, NULL, &rnode, 125 CTLFLAG_PERMANENT, 126 CTLTYPE_NODE, "security", NULL, 127 NULL, 0, NULL, 0, 128 CTL_SECURITY, CTL_EOL); 129 130 sysctl_createv(clog, 0, &rnode, &rnode, 131 CTLFLAG_PERMANENT, 132 CTLTYPE_NODE, "pax", 133 SYSCTL_DESCR("PaX (exploit mitigation) features."), 134 NULL, 0, NULL, 0, 135 CTL_CREATE, CTL_EOL); 136 137 cnode = rnode; 138 139 #ifdef PAX_MPROTECT 140 rnode = cnode; 141 sysctl_createv(clog, 0, &rnode, &rnode, 142 CTLFLAG_PERMANENT, 143 CTLTYPE_NODE, "mprotect", 144 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 145 NULL, 0, NULL, 0, 146 CTL_CREATE, CTL_EOL); 147 sysctl_createv(clog, 0, &rnode, NULL, 148 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 149 CTLTYPE_INT, "enabled", 150 SYSCTL_DESCR("Restrictions enabled."), 151 NULL, 0, &pax_mprotect_enabled, 0, 152 CTL_CREATE, CTL_EOL); 153 sysctl_createv(clog, 0, &rnode, NULL, 154 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 155 CTLTYPE_INT, "global", 156 SYSCTL_DESCR("When enabled, unless explicitly " 157 "specified, apply restrictions to " 158 "all processes."), 159 NULL, 0, &pax_mprotect_global, 0, 160 CTL_CREATE, CTL_EOL); 161 #endif /* PAX_MPROTECT */ 162 163 #ifdef PAX_SEGVGUARD 164 rnode = cnode; 165 sysctl_createv(clog, 0, &rnode, &rnode, 166 CTLFLAG_PERMANENT, 167 CTLTYPE_NODE, "segvguard", 168 SYSCTL_DESCR("PaX segvguard."), 169 NULL, 0, NULL, 0, 170 CTL_CREATE, CTL_EOL); 171 sysctl_createv(clog, 0, &rnode, NULL, 172 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 173 CTLTYPE_INT, "enabled", 174 SYSCTL_DESCR("segvguard enabled."), 175 NULL, 0, &pax_segvguard_enabled, 0, 176 CTL_CREATE, CTL_EOL); 177 sysctl_createv(clog, 0, &rnode, NULL, 178 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 179 CTLTYPE_INT, "global", 180 SYSCTL_DESCR("segvguard all programs."), 181 NULL, 0, &pax_segvguard_global, 0, 182 CTL_CREATE, CTL_EOL); 183 sysctl_createv(clog, 0, &rnode, NULL, 184 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 185 CTLTYPE_INT, "expiry_timeout", 186 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 187 NULL, 0, &pax_segvguard_expiry, 0, 188 CTL_CREATE, CTL_EOL); 189 sysctl_createv(clog, 0, &rnode, NULL, 190 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 191 CTLTYPE_INT, "suspend_timeout", 192 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 193 NULL, 0, &pax_segvguard_suspension, 0, 194 CTL_CREATE, CTL_EOL); 195 sysctl_createv(clog, 0, &rnode, NULL, 196 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 197 CTLTYPE_INT, "max_crashes", 198 SYSCTL_DESCR("Max number of crashes before expiry."), 199 NULL, 0, &pax_segvguard_maxcrashes, 0, 200 CTL_CREATE, CTL_EOL); 201 #endif /* PAX_SEGVGUARD */ 202 203 #ifdef PAX_ASLR 204 rnode = cnode; 205 sysctl_createv(clog, 0, &rnode, &rnode, 206 CTLFLAG_PERMANENT, 207 CTLTYPE_NODE, "aslr", 208 SYSCTL_DESCR("Address Space Layout Randomization."), 209 NULL, 0, NULL, 0, 210 CTL_CREATE, CTL_EOL); 211 sysctl_createv(clog, 0, &rnode, NULL, 212 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 213 CTLTYPE_INT, "enabled", 214 SYSCTL_DESCR("Restrictions enabled."), 215 NULL, 0, &pax_aslr_enabled, 0, 216 CTL_CREATE, CTL_EOL); 217 sysctl_createv(clog, 0, &rnode, NULL, 218 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 219 CTLTYPE_INT, "global", 220 SYSCTL_DESCR("When enabled, unless explicitly " 221 "specified, apply to all processes."), 222 NULL, 0, &pax_aslr_global, 0, 223 CTL_CREATE, CTL_EOL); 224 sysctl_createv(clog, 0, &rnode, NULL, 225 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 226 CTLTYPE_INT, "mmap_len", 227 SYSCTL_DESCR("Number of bits randomized for " 228 "mmap(2) calls."), 229 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 230 CTL_CREATE, CTL_EOL); 231 sysctl_createv(clog, 0, &rnode, NULL, 232 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 233 CTLTYPE_INT, "stack_len", 234 SYSCTL_DESCR("Number of bits randomized for " 235 "the stack."), 236 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 237 CTL_CREATE, CTL_EOL); 238 sysctl_createv(clog, 0, &rnode, NULL, 239 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 240 CTLTYPE_INT, "exec_len", 241 SYSCTL_DESCR("Number of bits randomized for " 242 "the PIE exec base."), 243 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 244 CTL_CREATE, CTL_EOL); 245 246 #endif /* PAX_ASLR */ 247 } 248 249 /* 250 * Initialize PaX. 251 */ 252 void 253 pax_init(void) 254 { 255 #ifdef PAX_SEGVGUARD 256 int error; 257 #endif /* PAX_SEGVGUARD */ 258 259 #ifdef PAX_SEGVGUARD 260 error = fileassoc_register("segvguard", pax_segvguard_cb, 261 &segvguard_id); 262 if (error) { 263 panic("pax_init: segvguard_id: error=%d\n", error); 264 } 265 #endif /* PAX_SEGVGUARD */ 266 } 267 268 #ifdef PAX_MPROTECT 269 void 270 pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 271 { 272 uint32_t f; 273 274 if (!pax_mprotect_enabled) 275 return; 276 277 f = l->l_proc->p_pax; 278 if ((pax_mprotect_global && (f & ELF_NOTE_PAX_NOMPROTECT) != 0) || 279 (!pax_mprotect_global && (f & ELF_NOTE_PAX_MPROTECT) == 0)) 280 return; 281 282 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 283 *prot &= ~VM_PROT_EXECUTE; 284 *maxprot &= ~VM_PROT_EXECUTE; 285 } else { 286 *prot &= ~VM_PROT_WRITE; 287 *maxprot &= ~VM_PROT_WRITE; 288 } 289 } 290 #endif /* PAX_MPROTECT */ 291 292 #ifdef PAX_ASLR 293 bool 294 pax_aslr_active(struct lwp *l) 295 { 296 uint32_t f; 297 298 if (!pax_aslr_enabled) 299 return false; 300 301 f = l->l_proc->p_pax; 302 if ((pax_aslr_global && (f & ELF_NOTE_PAX_NOASLR) != 0) || 303 (!pax_aslr_global && (f & ELF_NOTE_PAX_ASLR) == 0)) 304 return false; 305 return true; 306 } 307 308 void 309 pax_aslr_init(struct lwp *l, struct vmspace *vm) 310 { 311 if (!pax_aslr_active(l)) 312 return; 313 314 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 315 PAX_ASLR_DELTA_MMAP_LSB, PAX_ASLR_DELTA_MMAP_LEN); 316 } 317 318 void 319 pax_aslr(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 320 { 321 if (!pax_aslr_active(l)) 322 return; 323 324 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 325 #ifdef PAX_ASLR_DEBUG 326 uprintf("applying to 0x%lx orig_addr=0x%lx f=%x\n", 327 (unsigned long)*addr, (unsigned long)orig_addr, f); 328 #endif 329 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 330 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 331 else 332 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 333 #ifdef PAX_ASLR_DEBUG 334 uprintf("result 0x%lx\n", *addr); 335 #endif 336 } 337 #ifdef PAX_ASLR_DEBUG 338 else 339 uprintf("not applying to 0x%lx orig_addr=0x%lx f=%x\n", 340 (unsigned long)*addr, (unsigned long)orig_addr, f); 341 #endif 342 } 343 344 void 345 pax_aslr_stack(struct lwp *l, struct exec_package *epp, u_long *max_stack_size) 346 { 347 if (pax_aslr_active(l)) { 348 u_long d = PAX_ASLR_DELTA(cprng_fast32(), 349 PAX_ASLR_DELTA_STACK_LSB, 350 PAX_ASLR_DELTA_STACK_LEN); 351 #ifdef PAX_ASLR_DEBUG 352 uprintf("stack 0x%lx d=0x%lx 0x%lx\n", 353 epp->ep_minsaddr, d, epp->ep_minsaddr - d); 354 #endif 355 epp->ep_minsaddr -= d; 356 *max_stack_size -= d; 357 if (epp->ep_ssize > *max_stack_size) 358 epp->ep_ssize = *max_stack_size; 359 } 360 } 361 #endif /* PAX_ASLR */ 362 363 #ifdef PAX_SEGVGUARD 364 static void 365 pax_segvguard_cb(void *v) 366 { 367 struct pax_segvguard_entry *p = v; 368 struct pax_segvguard_uid_entry *up; 369 370 if (p == NULL) { 371 return; 372 } 373 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 374 LIST_REMOVE(up, sue_list); 375 kmem_free(up, sizeof(*up)); 376 } 377 kmem_free(p, sizeof(*p)); 378 } 379 380 /* 381 * Called when a process of image vp generated a segfault. 382 */ 383 int 384 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 385 bool crashed) 386 { 387 struct pax_segvguard_entry *p; 388 struct pax_segvguard_uid_entry *up; 389 struct timeval tv; 390 uid_t uid; 391 uint32_t f; 392 bool have_uid; 393 394 if (!pax_segvguard_enabled) 395 return (0); 396 397 f = l->l_proc->p_pax; 398 if ((pax_segvguard_global && (f & ELF_NOTE_PAX_NOGUARD) != 0) || 399 (!pax_segvguard_global && (f & ELF_NOTE_PAX_GUARD) == 0)) 400 return (0); 401 402 if (vp == NULL) 403 return (EFAULT); 404 405 /* Check if we already monitor the file. */ 406 p = fileassoc_lookup(vp, segvguard_id); 407 408 /* Fast-path if starting a program we don't know. */ 409 if (p == NULL && !crashed) 410 return (0); 411 412 microtime(&tv); 413 414 /* 415 * If a program we don't know crashed, we need to create a new entry 416 * for it. 417 */ 418 if (p == NULL) { 419 p = kmem_alloc(sizeof(*p), KM_SLEEP); 420 fileassoc_add(vp, segvguard_id, p); 421 LIST_INIT(&p->segv_uids); 422 423 /* 424 * Initialize a new entry with "crashes so far" of 1. 425 * The expiry time is when we purge the entry if it didn't 426 * reach the limit. 427 */ 428 up = kmem_alloc(sizeof(*up), KM_SLEEP); 429 up->sue_uid = kauth_cred_getuid(l->l_cred); 430 up->sue_ncrashes = 1; 431 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 432 up->sue_suspended = 0; 433 434 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 435 436 return (0); 437 } 438 439 /* 440 * A program we "know" either executed or crashed again. 441 * See if it's a culprit we're familiar with. 442 */ 443 uid = kauth_cred_getuid(l->l_cred); 444 have_uid = false; 445 LIST_FOREACH(up, &p->segv_uids, sue_list) { 446 if (up->sue_uid == uid) { 447 have_uid = true; 448 break; 449 } 450 } 451 452 /* 453 * It's someone else. Add an entry for him if we crashed. 454 */ 455 if (!have_uid) { 456 if (crashed) { 457 up = kmem_alloc(sizeof(*up), KM_SLEEP); 458 up->sue_uid = uid; 459 up->sue_ncrashes = 1; 460 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 461 up->sue_suspended = 0; 462 463 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 464 } 465 return (0); 466 } 467 468 if (crashed) { 469 /* Check if timer on previous crashes expired first. */ 470 if (up->sue_expiry < tv.tv_sec) { 471 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 472 " expired.\n", name ? name : "unknown"); 473 474 up->sue_ncrashes = 1; 475 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 476 up->sue_suspended = 0; 477 478 return (0); 479 } 480 481 up->sue_ncrashes++; 482 483 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 484 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 485 "execution for %d seconds after %zu crashes.\n", 486 name ? name : "unknown", pax_segvguard_suspension, 487 up->sue_ncrashes); 488 489 /* Suspend this program for a while. */ 490 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 491 up->sue_ncrashes = 0; 492 up->sue_expiry = 0; 493 } 494 } else { 495 /* Are we supposed to be suspended? */ 496 if (up->sue_suspended > tv.tv_sec) { 497 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 498 "execution due to repeated segfaults.\n", name ? 499 name : "unknown"); 500 501 return (EPERM); 502 } 503 } 504 505 return (0); 506 } 507 #endif /* PAX_SEGVGUARD */ 508
Indexes created Mon Sep 22 13:09:51 GMT 2025