kern_pax.c revision 1.27.6.4
1 /* $NetBSD: kern_pax.c,v 1.27.6.4 2016/04/22 15:44:16 skrll Exp $ */ 2 3 /* 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Maxime Villard. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. The name of the author may not be used to endorse or promote products 45 * derived from this software without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.27.6.4 2016/04/22 15:44:16 skrll Exp $"); 61 62 #include "opt_pax.h" 63 64 #include <sys/param.h> 65 #include <sys/proc.h> 66 #include <sys/exec.h> 67 #include <sys/exec_elf.h> 68 #include <sys/pax.h> 69 #include <sys/sysctl.h> 70 #include <sys/kmem.h> 71 #include <sys/mman.h> 72 #include <sys/fileassoc.h> 73 #include <sys/syslog.h> 74 #include <sys/vnode.h> 75 #include <sys/queue.h> 76 #include <sys/kauth.h> 77 #include <sys/cprng.h> 78 79 #ifdef PAX_ASLR_DEBUG 80 #define PAX_DPRINTF(_fmt, args...) \ 81 do if (pax_aslr_debug) uprintf("%s: " _fmt "\n", __func__, ##args); \ 82 while (/*CONSTCOND*/0) 83 #else 84 #define PAX_DPRINTF(_fmt, args...) do {} while (/*CONSTCOND*/0) 85 #endif 86 87 #ifdef PAX_ASLR 88 #include <sys/mman.h> 89 90 int pax_aslr_enabled = 1; 91 int pax_aslr_global = PAX_ASLR; 92 93 #ifndef PAX_ASLR_DELTA_MMAP_LSB 94 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 95 #endif 96 #ifndef PAX_ASLR_DELTA_MMAP_LEN 97 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 98 #endif 99 #ifndef PAX_ASLR_DELTA_MMAP_LEN32 100 #define PAX_ASLR_DELTA_MMAP_LEN32 ((sizeof(uint32_t) * NBBY) / 2) 101 #endif 102 #ifndef PAX_ASLR_DELTA_STACK_LSB 103 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 104 #endif 105 #ifndef PAX_ASLR_DELTA_STACK_LEN 106 #define PAX_ASLR_DELTA_STACK_LEN PAX_ASLR_DELTA_MMAP_LEN 107 #endif 108 #ifndef PAX_ASLR_DELTA_STACK_LEN32 109 #define PAX_ASLR_DELTA_STACK_LEN32 PAX_ASLR_DELTA_MMAP_LEN32 110 #endif 111 112 static bool pax_aslr_elf_flags_active(uint32_t); 113 #endif /* PAX_ASLR */ 114 115 #ifdef PAX_MPROTECT 116 static int pax_mprotect_enabled = 1; 117 static int pax_mprotect_global = PAX_MPROTECT; 118 static bool pax_mprotect_elf_flags_active(uint32_t); 119 #endif /* PAX_MPROTECT */ 120 #ifdef PAX_MPROTECT_DEBUG 121 int pax_mprotect_debug; 122 #endif 123 124 #ifdef PAX_SEGVGUARD 125 #ifndef PAX_SEGVGUARD_EXPIRY 126 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 127 #endif 128 #ifndef PAX_SEGVGUARD_SUSPENSION 129 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 130 #endif 131 #ifndef PAX_SEGVGUARD_MAXCRASHES 132 #define PAX_SEGVGUARD_MAXCRASHES 5 133 #endif 134 135 #ifdef PAX_ASLR_DEBUG 136 int pax_aslr_debug; 137 /* flag set means disable */ 138 int pax_aslr_flags; 139 #define PAX_ASLR_STACK 1 140 #define PAX_ASLR_MMAP 2 141 #endif 142 143 static int pax_segvguard_enabled = 1; 144 static int pax_segvguard_global = PAX_SEGVGUARD; 145 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 146 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 147 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 148 149 static fileassoc_t segvguard_id; 150 151 struct pax_segvguard_uid_entry { 152 uid_t sue_uid; 153 size_t sue_ncrashes; 154 time_t sue_expiry; 155 time_t sue_suspended; 156 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 157 }; 158 159 struct pax_segvguard_entry { 160 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 161 }; 162 163 static bool pax_segvguard_elf_flags_active(uint32_t); 164 static void pax_segvguard_cleanup_cb(void *); 165 #endif /* PAX_SEGVGUARD */ 166 167 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 168 { 169 const struct sysctlnode *rnode = NULL, *cnode; 170 171 sysctl_createv(clog, 0, NULL, &rnode, 172 CTLFLAG_PERMANENT, 173 CTLTYPE_NODE, "pax", 174 SYSCTL_DESCR("PaX (exploit mitigation) features."), 175 NULL, 0, NULL, 0, 176 CTL_SECURITY, CTL_CREATE, CTL_EOL); 177 178 cnode = rnode; 179 180 #ifdef PAX_MPROTECT 181 rnode = cnode; 182 sysctl_createv(clog, 0, &rnode, &rnode, 183 CTLFLAG_PERMANENT, 184 CTLTYPE_NODE, "mprotect", 185 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 186 NULL, 0, NULL, 0, 187 CTL_CREATE, CTL_EOL); 188 sysctl_createv(clog, 0, &rnode, NULL, 189 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 190 CTLTYPE_INT, "enabled", 191 SYSCTL_DESCR("Restrictions enabled."), 192 NULL, 0, &pax_mprotect_enabled, 0, 193 CTL_CREATE, CTL_EOL); 194 sysctl_createv(clog, 0, &rnode, NULL, 195 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 196 CTLTYPE_INT, "global", 197 SYSCTL_DESCR("When enabled, unless explicitly " 198 "specified, apply restrictions to " 199 "all processes."), 200 NULL, 0, &pax_mprotect_global, 0, 201 CTL_CREATE, CTL_EOL); 202 #ifdef PAX_MPROTECT_DEBUG 203 sysctl_createv(clog, 0, &rnode, NULL, 204 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 205 CTLTYPE_INT, "debug", 206 SYSCTL_DESCR("print mprotect changes."), 207 NULL, 0, &pax_mprotect_debug, 0, 208 CTL_CREATE, CTL_EOL); 209 #endif 210 #endif /* PAX_MPROTECT */ 211 212 #ifdef PAX_SEGVGUARD 213 rnode = cnode; 214 sysctl_createv(clog, 0, &rnode, &rnode, 215 CTLFLAG_PERMANENT, 216 CTLTYPE_NODE, "segvguard", 217 SYSCTL_DESCR("PaX segvguard."), 218 NULL, 0, NULL, 0, 219 CTL_CREATE, CTL_EOL); 220 sysctl_createv(clog, 0, &rnode, NULL, 221 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 222 CTLTYPE_INT, "enabled", 223 SYSCTL_DESCR("segvguard enabled."), 224 NULL, 0, &pax_segvguard_enabled, 0, 225 CTL_CREATE, CTL_EOL); 226 sysctl_createv(clog, 0, &rnode, NULL, 227 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 228 CTLTYPE_INT, "global", 229 SYSCTL_DESCR("segvguard all programs."), 230 NULL, 0, &pax_segvguard_global, 0, 231 CTL_CREATE, CTL_EOL); 232 sysctl_createv(clog, 0, &rnode, NULL, 233 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 234 CTLTYPE_INT, "expiry_timeout", 235 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 236 NULL, 0, &pax_segvguard_expiry, 0, 237 CTL_CREATE, CTL_EOL); 238 sysctl_createv(clog, 0, &rnode, NULL, 239 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 240 CTLTYPE_INT, "suspend_timeout", 241 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 242 NULL, 0, &pax_segvguard_suspension, 0, 243 CTL_CREATE, CTL_EOL); 244 sysctl_createv(clog, 0, &rnode, NULL, 245 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 246 CTLTYPE_INT, "max_crashes", 247 SYSCTL_DESCR("Max number of crashes before expiry."), 248 NULL, 0, &pax_segvguard_maxcrashes, 0, 249 CTL_CREATE, CTL_EOL); 250 #endif /* PAX_SEGVGUARD */ 251 252 #ifdef PAX_ASLR 253 rnode = cnode; 254 sysctl_createv(clog, 0, &rnode, &rnode, 255 CTLFLAG_PERMANENT, 256 CTLTYPE_NODE, "aslr", 257 SYSCTL_DESCR("Address Space Layout Randomization."), 258 NULL, 0, NULL, 0, 259 CTL_CREATE, CTL_EOL); 260 sysctl_createv(clog, 0, &rnode, NULL, 261 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 262 CTLTYPE_INT, "enabled", 263 SYSCTL_DESCR("Restrictions enabled."), 264 NULL, 0, &pax_aslr_enabled, 0, 265 CTL_CREATE, CTL_EOL); 266 sysctl_createv(clog, 0, &rnode, NULL, 267 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 268 CTLTYPE_INT, "global", 269 SYSCTL_DESCR("When enabled, unless explicitly " 270 "specified, apply to all processes."), 271 NULL, 0, &pax_aslr_global, 0, 272 CTL_CREATE, CTL_EOL); 273 #ifdef PAX_ASLR_DEBUG 274 sysctl_createv(clog, 0, &rnode, NULL, 275 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 276 CTLTYPE_INT, "debug", 277 SYSCTL_DESCR("Pring ASLR selected addresses."), 278 NULL, 0, &pax_aslr_debug, 0, 279 CTL_CREATE, CTL_EOL); 280 sysctl_createv(clog, 0, &rnode, NULL, 281 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 282 CTLTYPE_INT, "flags", 283 SYSCTL_DESCR("Disable/Enable select ASLR features."), 284 NULL, 0, &pax_aslr_flags, 0, 285 CTL_CREATE, CTL_EOL); 286 #endif 287 sysctl_createv(clog, 0, &rnode, NULL, 288 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 289 CTLTYPE_INT, "mmap_len", 290 SYSCTL_DESCR("Number of bits randomized for " 291 "mmap(2) calls."), 292 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 293 CTL_CREATE, CTL_EOL); 294 sysctl_createv(clog, 0, &rnode, NULL, 295 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 296 CTLTYPE_INT, "stack_len", 297 SYSCTL_DESCR("Number of bits randomized for " 298 "the stack."), 299 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 300 CTL_CREATE, CTL_EOL); 301 sysctl_createv(clog, 0, &rnode, NULL, 302 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 303 CTLTYPE_INT, "exec_len", 304 SYSCTL_DESCR("Number of bits randomized for " 305 "the PIE exec base."), 306 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 307 CTL_CREATE, CTL_EOL); 308 309 #endif /* PAX_ASLR */ 310 } 311 312 /* 313 * Initialize PaX. 314 */ 315 void 316 pax_init(void) 317 { 318 #ifdef PAX_SEGVGUARD 319 int error; 320 321 error = fileassoc_register("segvguard", pax_segvguard_cleanup_cb, 322 &segvguard_id); 323 if (error) { 324 panic("pax_init: segvguard_id: error=%d\n", error); 325 } 326 #endif /* PAX_SEGVGUARD */ 327 } 328 329 void 330 pax_setup_elf_flags(struct exec_package *epp, uint32_t elf_flags) 331 { 332 uint32_t flags = 0; 333 334 #ifdef PAX_ASLR 335 if (pax_aslr_elf_flags_active(elf_flags)) { 336 flags |= P_PAX_ASLR; 337 } 338 #endif 339 #ifdef PAX_MPROTECT 340 if (pax_mprotect_elf_flags_active(elf_flags)) { 341 flags |= P_PAX_MPROTECT; 342 } 343 #endif 344 #ifdef PAX_SEGVGUARD 345 if (pax_segvguard_elf_flags_active(elf_flags)) { 346 flags |= P_PAX_GUARD; 347 } 348 #endif 349 350 epp->ep_pax_flags = flags; 351 } 352 353 #if defined(PAX_MPROTECT) || defined(PAX_SEGVGUARD) || defined(PAX_ASLR) 354 static inline bool 355 pax_flags_active(uint32_t flags, uint32_t opt) 356 { 357 if (!(flags & opt)) 358 return false; 359 return true; 360 } 361 #endif /* PAX_MPROTECT || PAX_SEGVGUARD || PAX_ASLR */ 362 363 #ifdef PAX_MPROTECT 364 static bool 365 pax_mprotect_elf_flags_active(uint32_t flags) 366 { 367 if (!pax_mprotect_enabled) 368 return false; 369 if (pax_mprotect_global && (flags & ELF_NOTE_PAX_NOMPROTECT) != 0) { 370 /* Mprotect explicitly disabled */ 371 return false; 372 } 373 if (!pax_mprotect_global && (flags & ELF_NOTE_PAX_MPROTECT) == 0) { 374 /* Mprotect not requested */ 375 return false; 376 } 377 return true; 378 } 379 380 void 381 pax_mprotect_adjust( 382 #ifdef PAX_MPROTECT_DEBUG 383 const char *file, size_t line, 384 #endif 385 struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 386 { 387 uint32_t flags; 388 389 flags = l->l_proc->p_pax; 390 if (!pax_flags_active(flags, P_PAX_MPROTECT)) 391 return; 392 393 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 394 #ifdef PAX_MPROTECT_DEBUG 395 struct proc *p = l->l_proc; 396 if (pax_mprotect_debug) { 397 printf("%s: %s,%zu: %d.%d (%s): -x\n", 398 __func__, file, line, 399 p->p_pid, l->l_lid, p->p_comm); 400 } 401 #endif 402 *prot &= ~VM_PROT_EXECUTE; 403 *maxprot &= ~VM_PROT_EXECUTE; 404 } else { 405 #ifdef PAX_MPROTECT_DEBUG 406 struct proc *p = l->l_proc; 407 if (pax_mprotect_debug) { 408 printf("%s: %s,%zu: %d.%d (%s): -w\n", 409 __func__, file, line, 410 p->p_pid, l->l_lid, p->p_comm); 411 } 412 #endif 413 *prot &= ~VM_PROT_WRITE; 414 *maxprot &= ~VM_PROT_WRITE; 415 } 416 } 417 #endif /* PAX_MPROTECT */ 418 419 #ifdef PAX_ASLR 420 static bool 421 pax_aslr_elf_flags_active(uint32_t flags) 422 { 423 if (!pax_aslr_enabled) 424 return false; 425 if (pax_aslr_global && (flags & ELF_NOTE_PAX_NOASLR) != 0) { 426 /* ASLR explicitly disabled */ 427 return false; 428 } 429 if (!pax_aslr_global && (flags & ELF_NOTE_PAX_ASLR) == 0) { 430 /* ASLR not requested */ 431 return false; 432 } 433 return true; 434 } 435 436 bool 437 pax_aslr_epp_active(struct exec_package *epp) 438 { 439 return pax_flags_active(epp->ep_pax_flags, P_PAX_ASLR); 440 } 441 442 bool 443 pax_aslr_active(struct lwp *l) 444 { 445 return pax_flags_active(l->l_proc->p_pax, P_PAX_ASLR); 446 } 447 448 void 449 pax_aslr_init_vm(struct lwp *l, struct vmspace *vm, struct exec_package *ep) 450 { 451 if (!pax_aslr_active(l)) 452 return; 453 454 #ifdef PAX_ASLR_DEBUG 455 if (pax_aslr_flags & PAX_ASLR_MMAP) 456 return; 457 #endif 458 459 uint32_t len = (ep->ep_flags & EXEC_32) ? 460 PAX_ASLR_DELTA_MMAP_LEN32 : PAX_ASLR_DELTA_MMAP_LEN; 461 462 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 463 PAX_ASLR_DELTA_MMAP_LSB, len); 464 465 PAX_DPRINTF("delta_mmap=%#jx/%u", vm->vm_aslr_delta_mmap, len); 466 } 467 468 void 469 pax_aslr_mmap(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 470 { 471 if (!pax_aslr_active(l)) 472 return; 473 #ifdef PAX_ASLR_DEBUG 474 char buf[256]; 475 476 if (pax_aslr_flags & PAX_ASLR_MMAP) 477 return; 478 479 if (pax_aslr_debug) 480 snprintb(buf, sizeof(buf), MAP_FMT, f); 481 else 482 buf[0] = '\0'; 483 #endif 484 485 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 486 PAX_DPRINTF("applying to %#jx orig_addr=%#jx f=%s", 487 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 488 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 489 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 490 else 491 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 492 PAX_DPRINTF("result %#jx", (uintmax_t)*addr); 493 } else { 494 PAX_DPRINTF("not applying to %#jx orig_addr=%#jx f=%s", 495 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 496 } 497 } 498 499 void 500 pax_aslr_stack(struct exec_package *epp, u_long *max_stack_size) 501 { 502 if (!pax_aslr_epp_active(epp)) 503 return; 504 #ifdef PAX_ASLR_DEBUG 505 if (pax_aslr_flags & PAX_ASLR_STACK) 506 return; 507 #endif 508 509 uint32_t len = (epp->ep_flags & EXEC_32) ? 510 PAX_ASLR_DELTA_STACK_LEN32 : PAX_ASLR_DELTA_STACK_LEN; 511 u_long d = PAX_ASLR_DELTA(cprng_fast32(), PAX_ASLR_DELTA_STACK_LSB, 512 len); 513 u_long newminsaddr = (u_long)STACK_ALLOC(epp->ep_minsaddr, d); 514 PAX_DPRINTF("old minsaddr=%#jx delta=%#lx new minsaddr=%#lx", 515 (uintmax_t)epp->ep_minsaddr, d, newminsaddr); 516 epp->ep_minsaddr = (vaddr_t)newminsaddr; 517 *max_stack_size -= d; 518 if (epp->ep_ssize > *max_stack_size) 519 epp->ep_ssize = *max_stack_size; 520 } 521 #endif /* PAX_ASLR */ 522 523 #ifdef PAX_SEGVGUARD 524 static bool 525 pax_segvguard_elf_flags_active(uint32_t flags) 526 { 527 if (!pax_segvguard_enabled) 528 return false; 529 if (pax_segvguard_global && (flags & ELF_NOTE_PAX_NOGUARD) != 0) { 530 /* Segvguard explicitly disabled */ 531 return false; 532 } 533 if (!pax_segvguard_global && (flags & ELF_NOTE_PAX_GUARD) == 0) { 534 /* Segvguard not requested */ 535 return false; 536 } 537 return true; 538 } 539 540 static void 541 pax_segvguard_cleanup_cb(void *v) 542 { 543 struct pax_segvguard_entry *p = v; 544 struct pax_segvguard_uid_entry *up; 545 546 if (p == NULL) { 547 return; 548 } 549 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 550 LIST_REMOVE(up, sue_list); 551 kmem_free(up, sizeof(*up)); 552 } 553 kmem_free(p, sizeof(*p)); 554 } 555 556 /* 557 * Called when a process of image vp generated a segfault. 558 */ 559 int 560 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 561 bool crashed) 562 { 563 struct pax_segvguard_entry *p; 564 struct pax_segvguard_uid_entry *up; 565 struct timeval tv; 566 uid_t uid; 567 uint32_t flags; 568 bool have_uid; 569 570 flags = l->l_proc->p_pax; 571 if (!pax_flags_active(flags, P_PAX_GUARD)) 572 return 0; 573 574 if (vp == NULL) 575 return EFAULT; 576 577 /* Check if we already monitor the file. */ 578 p = fileassoc_lookup(vp, segvguard_id); 579 580 /* Fast-path if starting a program we don't know. */ 581 if (p == NULL && !crashed) 582 return 0; 583 584 microtime(&tv); 585 586 /* 587 * If a program we don't know crashed, we need to create a new entry 588 * for it. 589 */ 590 if (p == NULL) { 591 p = kmem_alloc(sizeof(*p), KM_SLEEP); 592 fileassoc_add(vp, segvguard_id, p); 593 LIST_INIT(&p->segv_uids); 594 595 /* 596 * Initialize a new entry with "crashes so far" of 1. 597 * The expiry time is when we purge the entry if it didn't 598 * reach the limit. 599 */ 600 up = kmem_alloc(sizeof(*up), KM_SLEEP); 601 up->sue_uid = kauth_cred_getuid(l->l_cred); 602 up->sue_ncrashes = 1; 603 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 604 up->sue_suspended = 0; 605 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 606 return 0; 607 } 608 609 /* 610 * A program we "know" either executed or crashed again. 611 * See if it's a culprit we're familiar with. 612 */ 613 uid = kauth_cred_getuid(l->l_cred); 614 have_uid = false; 615 LIST_FOREACH(up, &p->segv_uids, sue_list) { 616 if (up->sue_uid == uid) { 617 have_uid = true; 618 break; 619 } 620 } 621 622 /* 623 * It's someone else. Add an entry for him if we crashed. 624 */ 625 if (!have_uid) { 626 if (crashed) { 627 up = kmem_alloc(sizeof(*up), KM_SLEEP); 628 up->sue_uid = uid; 629 up->sue_ncrashes = 1; 630 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 631 up->sue_suspended = 0; 632 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 633 } 634 return 0; 635 } 636 637 if (crashed) { 638 /* Check if timer on previous crashes expired first. */ 639 if (up->sue_expiry < tv.tv_sec) { 640 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 641 " expired.\n", name ? name : "unknown"); 642 up->sue_ncrashes = 1; 643 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 644 up->sue_suspended = 0; 645 return 0; 646 } 647 648 up->sue_ncrashes++; 649 650 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 651 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 652 "execution for %d seconds after %zu crashes.\n", 653 name ? name : "unknown", pax_segvguard_suspension, 654 up->sue_ncrashes); 655 656 /* Suspend this program for a while. */ 657 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 658 up->sue_ncrashes = 0; 659 up->sue_expiry = 0; 660 } 661 } else { 662 /* Are we supposed to be suspended? */ 663 if (up->sue_suspended > tv.tv_sec) { 664 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 665 "execution due to repeated segfaults.\n", name ? 666 name : "unknown"); 667 return EPERM; 668 } 669 } 670 671 return 0; 672 } 673 #endif /* PAX_SEGVGUARD */ 674
Indexes created Tue Sep 30 11:09:46 GMT 2025