kern_pax.c revision 1.37
1 /* $NetBSD: kern_pax.c,v 1.37 2016/04/04 16:47:39 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Maxime Villard. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. The name of the author may not be used to endorse or promote products 45 * derived from this software without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.37 2016/04/04 16:47:39 christos Exp $"); 61 62 #include "opt_pax.h" 63 64 #include <sys/param.h> 65 #include <sys/proc.h> 66 #include <sys/exec.h> 67 #include <sys/exec_elf.h> 68 #include <sys/pax.h> 69 #include <sys/sysctl.h> 70 #include <sys/kmem.h> 71 #include <sys/mman.h> 72 #include <sys/fileassoc.h> 73 #include <sys/syslog.h> 74 #include <sys/vnode.h> 75 #include <sys/queue.h> 76 #include <sys/kauth.h> 77 #include <sys/cprng.h> 78 79 #ifdef PAX_ASLR_DEBUG 80 #define PAX_DPRINTF(_fmt, args...) \ 81 do if (pax_aslr_debug) uprintf("%s: " _fmt "\n", __func__, ##args); \ 82 while (/*CONSTCOND*/0) 83 #else 84 #define PAX_DPRINTF(_fmt, args...) do {} while (/*CONSTCOND*/0) 85 #endif 86 87 #ifdef PAX_ASLR 88 #include <sys/mman.h> 89 90 int pax_aslr_enabled = 1; 91 int pax_aslr_global = PAX_ASLR; 92 93 #ifndef PAX_ASLR_DELTA_MMAP_LSB 94 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 95 #endif 96 #ifndef PAX_ASLR_DELTA_MMAP_LEN 97 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 98 #endif 99 #ifndef PAX_ASLR_DELTA_MMAP_LEN32 100 #define PAX_ASLR_DELTA_MMAP_LEN32 ((sizeof(uint32_t) * NBBY) / 2) 101 #endif 102 #ifndef PAX_ASLR_DELTA_STACK_LSB 103 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 104 #endif 105 #ifndef PAX_ASLR_DELTA_STACK_LEN 106 #define PAX_ASLR_DELTA_STACK_LEN 12 107 #endif 108 109 static bool pax_aslr_elf_flags_active(uint32_t); 110 #endif /* PAX_ASLR */ 111 112 #ifdef PAX_MPROTECT 113 static int pax_mprotect_enabled = 1; 114 static int pax_mprotect_global = PAX_MPROTECT; 115 static bool pax_mprotect_elf_flags_active(uint32_t); 116 #endif /* PAX_MPROTECT */ 117 118 #ifdef PAX_SEGVGUARD 119 #ifndef PAX_SEGVGUARD_EXPIRY 120 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 121 #endif 122 #ifndef PAX_SEGVGUARD_SUSPENSION 123 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 124 #endif 125 #ifndef PAX_SEGVGUARD_MAXCRASHES 126 #define PAX_SEGVGUARD_MAXCRASHES 5 127 #endif 128 129 #ifdef PAX_ASLR_DEBUG 130 int pax_aslr_debug; 131 #endif 132 133 static int pax_segvguard_enabled = 1; 134 static int pax_segvguard_global = PAX_SEGVGUARD; 135 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 136 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 137 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 138 139 static fileassoc_t segvguard_id; 140 141 struct pax_segvguard_uid_entry { 142 uid_t sue_uid; 143 size_t sue_ncrashes; 144 time_t sue_expiry; 145 time_t sue_suspended; 146 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 147 }; 148 149 struct pax_segvguard_entry { 150 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 151 }; 152 153 static bool pax_segvguard_elf_flags_active(uint32_t); 154 static void pax_segvguard_cleanup_cb(void *); 155 #endif /* PAX_SEGVGUARD */ 156 157 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 158 { 159 const struct sysctlnode *rnode = NULL, *cnode; 160 161 sysctl_createv(clog, 0, NULL, &rnode, 162 CTLFLAG_PERMANENT, 163 CTLTYPE_NODE, "pax", 164 SYSCTL_DESCR("PaX (exploit mitigation) features."), 165 NULL, 0, NULL, 0, 166 CTL_SECURITY, CTL_CREATE, CTL_EOL); 167 168 cnode = rnode; 169 170 #ifdef PAX_MPROTECT 171 rnode = cnode; 172 sysctl_createv(clog, 0, &rnode, &rnode, 173 CTLFLAG_PERMANENT, 174 CTLTYPE_NODE, "mprotect", 175 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 176 NULL, 0, NULL, 0, 177 CTL_CREATE, CTL_EOL); 178 sysctl_createv(clog, 0, &rnode, NULL, 179 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 180 CTLTYPE_INT, "enabled", 181 SYSCTL_DESCR("Restrictions enabled."), 182 NULL, 0, &pax_mprotect_enabled, 0, 183 CTL_CREATE, CTL_EOL); 184 sysctl_createv(clog, 0, &rnode, NULL, 185 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 186 CTLTYPE_INT, "global", 187 SYSCTL_DESCR("When enabled, unless explicitly " 188 "specified, apply restrictions to " 189 "all processes."), 190 NULL, 0, &pax_mprotect_global, 0, 191 CTL_CREATE, CTL_EOL); 192 #endif /* PAX_MPROTECT */ 193 194 #ifdef PAX_SEGVGUARD 195 rnode = cnode; 196 sysctl_createv(clog, 0, &rnode, &rnode, 197 CTLFLAG_PERMANENT, 198 CTLTYPE_NODE, "segvguard", 199 SYSCTL_DESCR("PaX segvguard."), 200 NULL, 0, NULL, 0, 201 CTL_CREATE, CTL_EOL); 202 sysctl_createv(clog, 0, &rnode, NULL, 203 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 204 CTLTYPE_INT, "enabled", 205 SYSCTL_DESCR("segvguard enabled."), 206 NULL, 0, &pax_segvguard_enabled, 0, 207 CTL_CREATE, CTL_EOL); 208 sysctl_createv(clog, 0, &rnode, NULL, 209 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 210 CTLTYPE_INT, "global", 211 SYSCTL_DESCR("segvguard all programs."), 212 NULL, 0, &pax_segvguard_global, 0, 213 CTL_CREATE, CTL_EOL); 214 sysctl_createv(clog, 0, &rnode, NULL, 215 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 216 CTLTYPE_INT, "expiry_timeout", 217 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 218 NULL, 0, &pax_segvguard_expiry, 0, 219 CTL_CREATE, CTL_EOL); 220 sysctl_createv(clog, 0, &rnode, NULL, 221 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 222 CTLTYPE_INT, "suspend_timeout", 223 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 224 NULL, 0, &pax_segvguard_suspension, 0, 225 CTL_CREATE, CTL_EOL); 226 sysctl_createv(clog, 0, &rnode, NULL, 227 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 228 CTLTYPE_INT, "max_crashes", 229 SYSCTL_DESCR("Max number of crashes before expiry."), 230 NULL, 0, &pax_segvguard_maxcrashes, 0, 231 CTL_CREATE, CTL_EOL); 232 #endif /* PAX_SEGVGUARD */ 233 234 #ifdef PAX_ASLR 235 rnode = cnode; 236 sysctl_createv(clog, 0, &rnode, &rnode, 237 CTLFLAG_PERMANENT, 238 CTLTYPE_NODE, "aslr", 239 SYSCTL_DESCR("Address Space Layout Randomization."), 240 NULL, 0, NULL, 0, 241 CTL_CREATE, CTL_EOL); 242 sysctl_createv(clog, 0, &rnode, NULL, 243 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 244 CTLTYPE_INT, "enabled", 245 SYSCTL_DESCR("Restrictions enabled."), 246 NULL, 0, &pax_aslr_enabled, 0, 247 CTL_CREATE, CTL_EOL); 248 sysctl_createv(clog, 0, &rnode, NULL, 249 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 250 CTLTYPE_INT, "global", 251 SYSCTL_DESCR("When enabled, unless explicitly " 252 "specified, apply to all processes."), 253 NULL, 0, &pax_aslr_global, 0, 254 CTL_CREATE, CTL_EOL); 255 #ifdef PAX_ASLR_DEBUG 256 sysctl_createv(clog, 0, &rnode, NULL, 257 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 258 CTLTYPE_INT, "debug", 259 SYSCTL_DESCR("Pring ASLR selected addresses."), 260 NULL, 0, &pax_aslr_debug, 0, 261 CTL_CREATE, CTL_EOL); 262 #endif 263 sysctl_createv(clog, 0, &rnode, NULL, 264 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 265 CTLTYPE_INT, "mmap_len", 266 SYSCTL_DESCR("Number of bits randomized for " 267 "mmap(2) calls."), 268 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 269 CTL_CREATE, CTL_EOL); 270 sysctl_createv(clog, 0, &rnode, NULL, 271 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 272 CTLTYPE_INT, "stack_len", 273 SYSCTL_DESCR("Number of bits randomized for " 274 "the stack."), 275 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 276 CTL_CREATE, CTL_EOL); 277 sysctl_createv(clog, 0, &rnode, NULL, 278 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 279 CTLTYPE_INT, "exec_len", 280 SYSCTL_DESCR("Number of bits randomized for " 281 "the PIE exec base."), 282 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 283 CTL_CREATE, CTL_EOL); 284 285 #endif /* PAX_ASLR */ 286 } 287 288 /* 289 * Initialize PaX. 290 */ 291 void 292 pax_init(void) 293 { 294 #ifdef PAX_SEGVGUARD 295 int error; 296 297 error = fileassoc_register("segvguard", pax_segvguard_cleanup_cb, 298 &segvguard_id); 299 if (error) { 300 panic("pax_init: segvguard_id: error=%d\n", error); 301 } 302 #endif /* PAX_SEGVGUARD */ 303 } 304 305 void 306 pax_setup_elf_flags(struct exec_package *epp, uint32_t elf_flags) 307 { 308 uint32_t flags = 0; 309 310 #ifdef PAX_ASLR 311 if (pax_aslr_elf_flags_active(elf_flags)) { 312 flags |= P_PAX_ASLR; 313 } 314 #endif 315 #ifdef PAX_MPROTECT 316 if (pax_mprotect_elf_flags_active(elf_flags)) { 317 flags |= P_PAX_MPROTECT; 318 } 319 #endif 320 #ifdef PAX_SEGVGUARD 321 if (pax_segvguard_elf_flags_active(elf_flags)) { 322 flags |= P_PAX_GUARD; 323 } 324 #endif 325 326 epp->ep_pax_flags = flags; 327 } 328 329 #if defined(PAX_MPROTECT) || defined(PAX_SEGVGUARD) || defined(PAX_ASLR) 330 static inline bool 331 pax_flags_active(uint32_t flags, uint32_t opt) 332 { 333 if (!(flags & opt)) 334 return false; 335 return true; 336 } 337 #endif /* PAX_MPROTECT || PAX_SEGVGUARD || PAX_ASLR */ 338 339 #ifdef PAX_MPROTECT 340 static bool 341 pax_mprotect_elf_flags_active(uint32_t flags) 342 { 343 if (!pax_mprotect_enabled) 344 return false; 345 if (pax_mprotect_global && (flags & ELF_NOTE_PAX_NOMPROTECT) != 0) { 346 /* Mprotect explicitly disabled */ 347 return false; 348 } 349 if (!pax_mprotect_global && (flags & ELF_NOTE_PAX_MPROTECT) == 0) { 350 /* Mprotect not requested */ 351 return false; 352 } 353 return true; 354 } 355 356 void 357 pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 358 { 359 uint32_t flags; 360 361 flags = l->l_proc->p_pax; 362 if (!pax_flags_active(flags, P_PAX_MPROTECT)) 363 return; 364 365 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 366 #ifdef DIAGNOSTIC 367 struct proc *p = l->l_proc; 368 printf("%s: %d.%d (%s): clearing execute bit\n", __func__, 369 p->p_pid, l->l_lid, p->p_comm); 370 #endif 371 *prot &= ~VM_PROT_EXECUTE; 372 *maxprot &= ~VM_PROT_EXECUTE; 373 } else { 374 #ifdef DIAGNOSTIC 375 struct proc *p = l->l_proc; 376 printf("%s: %d.%d (%s): clearing write bit\n", __func__, 377 p->p_pid, l->l_lid, p->p_comm); 378 #endif 379 *prot &= ~VM_PROT_WRITE; 380 *maxprot &= ~VM_PROT_WRITE; 381 } 382 } 383 #endif /* PAX_MPROTECT */ 384 385 #ifdef PAX_ASLR 386 static bool 387 pax_aslr_elf_flags_active(uint32_t flags) 388 { 389 if (!pax_aslr_enabled) 390 return false; 391 if (pax_aslr_global && (flags & ELF_NOTE_PAX_NOASLR) != 0) { 392 /* ASLR explicitly disabled */ 393 return false; 394 } 395 if (!pax_aslr_global && (flags & ELF_NOTE_PAX_ASLR) == 0) { 396 /* ASLR not requested */ 397 return false; 398 } 399 return true; 400 } 401 402 bool 403 pax_aslr_epp_active(struct exec_package *epp) 404 { 405 return pax_flags_active(epp->ep_pax_flags, P_PAX_ASLR); 406 } 407 408 bool 409 pax_aslr_active(struct lwp *l) 410 { 411 return pax_flags_active(l->l_proc->p_pax, P_PAX_ASLR); 412 } 413 414 void 415 pax_aslr_init_vm(struct lwp *l, struct vmspace *vm, struct exec_package *ep) 416 { 417 if (!pax_aslr_active(l)) 418 return; 419 420 uint32_t len = (ep->ep_flags & EXEC_32) ? 421 PAX_ASLR_DELTA_MMAP_LEN32 : PAX_ASLR_DELTA_MMAP_LEN; 422 423 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 424 PAX_ASLR_DELTA_MMAP_LSB, len); 425 426 PAX_DPRINTF("delta_mmap=%#jx/%u", vm->vm_aslr_delta_mmap, len); 427 } 428 429 void 430 pax_aslr_mmap(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 431 { 432 if (!pax_aslr_active(l)) 433 return; 434 #ifdef PAX_ASLR_DEBUG 435 char buf[256]; 436 if (pax_aslr_debug) 437 snprintb(buf, sizeof(buf), MAP_FMT, f); 438 else 439 buf[0] = '\0'; 440 #endif 441 442 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 443 PAX_DPRINTF("applying to %#jx orig_addr=%#jx f=%s", 444 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 445 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 446 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 447 else 448 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 449 PAX_DPRINTF("result %#jx", (uintmax_t)*addr); 450 } else { 451 PAX_DPRINTF("not applying to %#jx orig_addr=%#jx f=%s", 452 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 453 } 454 } 455 456 void 457 pax_aslr_stack(struct exec_package *epp, u_long *max_stack_size) 458 { 459 if (!pax_aslr_epp_active(epp)) 460 return; 461 462 u_long d = PAX_ASLR_DELTA(cprng_fast32(), 463 PAX_ASLR_DELTA_STACK_LSB, 464 PAX_ASLR_DELTA_STACK_LEN); 465 PAX_DPRINTF("stack %#jx delta=%#lx diff=%lx", 466 (uintmax_t)epp->ep_minsaddr, d, epp->ep_minsaddr - d); 467 epp->ep_minsaddr -= d; 468 *max_stack_size -= d; 469 if (epp->ep_ssize > *max_stack_size) 470 epp->ep_ssize = *max_stack_size; 471 } 472 #endif /* PAX_ASLR */ 473 474 #ifdef PAX_SEGVGUARD 475 static bool 476 pax_segvguard_elf_flags_active(uint32_t flags) 477 { 478 if (!pax_segvguard_enabled) 479 return false; 480 if (pax_segvguard_global && (flags & ELF_NOTE_PAX_NOGUARD) != 0) { 481 /* Segvguard explicitly disabled */ 482 return false; 483 } 484 if (!pax_segvguard_global && (flags & ELF_NOTE_PAX_GUARD) == 0) { 485 /* Segvguard not requested */ 486 return false; 487 } 488 return true; 489 } 490 491 static void 492 pax_segvguard_cleanup_cb(void *v) 493 { 494 struct pax_segvguard_entry *p = v; 495 struct pax_segvguard_uid_entry *up; 496 497 if (p == NULL) { 498 return; 499 } 500 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 501 LIST_REMOVE(up, sue_list); 502 kmem_free(up, sizeof(*up)); 503 } 504 kmem_free(p, sizeof(*p)); 505 } 506 507 /* 508 * Called when a process of image vp generated a segfault. 509 */ 510 int 511 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 512 bool crashed) 513 { 514 struct pax_segvguard_entry *p; 515 struct pax_segvguard_uid_entry *up; 516 struct timeval tv; 517 uid_t uid; 518 uint32_t flags; 519 bool have_uid; 520 521 flags = l->l_proc->p_pax; 522 if (!pax_flags_active(flags, P_PAX_GUARD)) 523 return 0; 524 525 if (vp == NULL) 526 return EFAULT; 527 528 /* Check if we already monitor the file. */ 529 p = fileassoc_lookup(vp, segvguard_id); 530 531 /* Fast-path if starting a program we don't know. */ 532 if (p == NULL && !crashed) 533 return 0; 534 535 microtime(&tv); 536 537 /* 538 * If a program we don't know crashed, we need to create a new entry 539 * for it. 540 */ 541 if (p == NULL) { 542 p = kmem_alloc(sizeof(*p), KM_SLEEP); 543 fileassoc_add(vp, segvguard_id, p); 544 LIST_INIT(&p->segv_uids); 545 546 /* 547 * Initialize a new entry with "crashes so far" of 1. 548 * The expiry time is when we purge the entry if it didn't 549 * reach the limit. 550 */ 551 up = kmem_alloc(sizeof(*up), KM_SLEEP); 552 up->sue_uid = kauth_cred_getuid(l->l_cred); 553 up->sue_ncrashes = 1; 554 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 555 up->sue_suspended = 0; 556 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 557 return 0; 558 } 559 560 /* 561 * A program we "know" either executed or crashed again. 562 * See if it's a culprit we're familiar with. 563 */ 564 uid = kauth_cred_getuid(l->l_cred); 565 have_uid = false; 566 LIST_FOREACH(up, &p->segv_uids, sue_list) { 567 if (up->sue_uid == uid) { 568 have_uid = true; 569 break; 570 } 571 } 572 573 /* 574 * It's someone else. Add an entry for him if we crashed. 575 */ 576 if (!have_uid) { 577 if (crashed) { 578 up = kmem_alloc(sizeof(*up), KM_SLEEP); 579 up->sue_uid = uid; 580 up->sue_ncrashes = 1; 581 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 582 up->sue_suspended = 0; 583 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 584 } 585 return 0; 586 } 587 588 if (crashed) { 589 /* Check if timer on previous crashes expired first. */ 590 if (up->sue_expiry < tv.tv_sec) { 591 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 592 " expired.\n", name ? name : "unknown"); 593 up->sue_ncrashes = 1; 594 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 595 up->sue_suspended = 0; 596 return 0; 597 } 598 599 up->sue_ncrashes++; 600 601 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 602 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 603 "execution for %d seconds after %zu crashes.\n", 604 name ? name : "unknown", pax_segvguard_suspension, 605 up->sue_ncrashes); 606 607 /* Suspend this program for a while. */ 608 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 609 up->sue_ncrashes = 0; 610 up->sue_expiry = 0; 611 } 612 } else { 613 /* Are we supposed to be suspended? */ 614 if (up->sue_suspended > tv.tv_sec) { 615 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 616 "execution due to repeated segfaults.\n", name ? 617 name : "unknown"); 618 return EPERM; 619 } 620 } 621 622 return 0; 623 } 624 #endif /* PAX_SEGVGUARD */ 625
Indexes created Sun Sep 21 20:09:37 GMT 2025