kern_pax.c revision 1.38
1 /* $NetBSD: kern_pax.c,v 1.38 2016/04/07 03:31:12 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Maxime Villard. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. The name of the author may not be used to endorse or promote products 45 * derived from this software without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.38 2016/04/07 03:31:12 christos Exp $"); 61 62 #include "opt_pax.h" 63 64 #include <sys/param.h> 65 #include <sys/proc.h> 66 #include <sys/exec.h> 67 #include <sys/exec_elf.h> 68 #include <sys/pax.h> 69 #include <sys/sysctl.h> 70 #include <sys/kmem.h> 71 #include <sys/mman.h> 72 #include <sys/fileassoc.h> 73 #include <sys/syslog.h> 74 #include <sys/vnode.h> 75 #include <sys/queue.h> 76 #include <sys/kauth.h> 77 #include <sys/cprng.h> 78 79 #ifdef PAX_ASLR_DEBUG 80 #define PAX_DPRINTF(_fmt, args...) \ 81 do if (pax_aslr_debug) uprintf("%s: " _fmt "\n", __func__, ##args); \ 82 while (/*CONSTCOND*/0) 83 #else 84 #define PAX_DPRINTF(_fmt, args...) do {} while (/*CONSTCOND*/0) 85 #endif 86 87 #ifdef PAX_ASLR 88 #include <sys/mman.h> 89 90 int pax_aslr_enabled = 1; 91 int pax_aslr_global = PAX_ASLR; 92 93 #ifndef PAX_ASLR_DELTA_MMAP_LSB 94 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 95 #endif 96 #ifndef PAX_ASLR_DELTA_MMAP_LEN 97 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 98 #endif 99 #ifndef PAX_ASLR_DELTA_MMAP_LEN32 100 #define PAX_ASLR_DELTA_MMAP_LEN32 ((sizeof(uint32_t) * NBBY) / 2) 101 #endif 102 #ifndef PAX_ASLR_DELTA_STACK_LSB 103 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 104 #endif 105 #ifndef PAX_ASLR_DELTA_STACK_LEN 106 #define PAX_ASLR_DELTA_STACK_LEN 12 107 #endif 108 109 static bool pax_aslr_elf_flags_active(uint32_t); 110 #endif /* PAX_ASLR */ 111 112 #ifdef PAX_MPROTECT 113 static int pax_mprotect_enabled = 1; 114 static int pax_mprotect_global = PAX_MPROTECT; 115 static bool pax_mprotect_elf_flags_active(uint32_t); 116 #endif /* PAX_MPROTECT */ 117 #ifdef PAX_MPROTECT_DEBUG 118 int pax_mprotect_debug; 119 #endif 120 121 #ifdef PAX_SEGVGUARD 122 #ifndef PAX_SEGVGUARD_EXPIRY 123 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 124 #endif 125 #ifndef PAX_SEGVGUARD_SUSPENSION 126 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 127 #endif 128 #ifndef PAX_SEGVGUARD_MAXCRASHES 129 #define PAX_SEGVGUARD_MAXCRASHES 5 130 #endif 131 132 #ifdef PAX_ASLR_DEBUG 133 int pax_aslr_debug; 134 #endif 135 136 static int pax_segvguard_enabled = 1; 137 static int pax_segvguard_global = PAX_SEGVGUARD; 138 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 139 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 140 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 141 142 static fileassoc_t segvguard_id; 143 144 struct pax_segvguard_uid_entry { 145 uid_t sue_uid; 146 size_t sue_ncrashes; 147 time_t sue_expiry; 148 time_t sue_suspended; 149 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 150 }; 151 152 struct pax_segvguard_entry { 153 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 154 }; 155 156 static bool pax_segvguard_elf_flags_active(uint32_t); 157 static void pax_segvguard_cleanup_cb(void *); 158 #endif /* PAX_SEGVGUARD */ 159 160 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 161 { 162 const struct sysctlnode *rnode = NULL, *cnode; 163 164 sysctl_createv(clog, 0, NULL, &rnode, 165 CTLFLAG_PERMANENT, 166 CTLTYPE_NODE, "pax", 167 SYSCTL_DESCR("PaX (exploit mitigation) features."), 168 NULL, 0, NULL, 0, 169 CTL_SECURITY, CTL_CREATE, CTL_EOL); 170 171 cnode = rnode; 172 173 #ifdef PAX_MPROTECT 174 rnode = cnode; 175 sysctl_createv(clog, 0, &rnode, &rnode, 176 CTLFLAG_PERMANENT, 177 CTLTYPE_NODE, "mprotect", 178 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 179 NULL, 0, NULL, 0, 180 CTL_CREATE, CTL_EOL); 181 sysctl_createv(clog, 0, &rnode, NULL, 182 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 183 CTLTYPE_INT, "enabled", 184 SYSCTL_DESCR("Restrictions enabled."), 185 NULL, 0, &pax_mprotect_enabled, 0, 186 CTL_CREATE, CTL_EOL); 187 sysctl_createv(clog, 0, &rnode, NULL, 188 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 189 CTLTYPE_INT, "global", 190 SYSCTL_DESCR("When enabled, unless explicitly " 191 "specified, apply restrictions to " 192 "all processes."), 193 NULL, 0, &pax_mprotect_global, 0, 194 CTL_CREATE, CTL_EOL); 195 #ifdef PAX_MPROTECT_DEBUG 196 sysctl_createv(clog, 0, &rnode, NULL, 197 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 198 CTLTYPE_INT, "debug", 199 SYSCTL_DESCR("print mprotect changes."), 200 NULL, 0, &pax_mprotect_debug, 0, 201 CTL_CREATE, CTL_EOL); 202 #endif 203 #endif /* PAX_MPROTECT */ 204 205 #ifdef PAX_SEGVGUARD 206 rnode = cnode; 207 sysctl_createv(clog, 0, &rnode, &rnode, 208 CTLFLAG_PERMANENT, 209 CTLTYPE_NODE, "segvguard", 210 SYSCTL_DESCR("PaX segvguard."), 211 NULL, 0, NULL, 0, 212 CTL_CREATE, CTL_EOL); 213 sysctl_createv(clog, 0, &rnode, NULL, 214 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 215 CTLTYPE_INT, "enabled", 216 SYSCTL_DESCR("segvguard enabled."), 217 NULL, 0, &pax_segvguard_enabled, 0, 218 CTL_CREATE, CTL_EOL); 219 sysctl_createv(clog, 0, &rnode, NULL, 220 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 221 CTLTYPE_INT, "global", 222 SYSCTL_DESCR("segvguard all programs."), 223 NULL, 0, &pax_segvguard_global, 0, 224 CTL_CREATE, CTL_EOL); 225 sysctl_createv(clog, 0, &rnode, NULL, 226 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 227 CTLTYPE_INT, "expiry_timeout", 228 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 229 NULL, 0, &pax_segvguard_expiry, 0, 230 CTL_CREATE, CTL_EOL); 231 sysctl_createv(clog, 0, &rnode, NULL, 232 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 233 CTLTYPE_INT, "suspend_timeout", 234 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 235 NULL, 0, &pax_segvguard_suspension, 0, 236 CTL_CREATE, CTL_EOL); 237 sysctl_createv(clog, 0, &rnode, NULL, 238 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 239 CTLTYPE_INT, "max_crashes", 240 SYSCTL_DESCR("Max number of crashes before expiry."), 241 NULL, 0, &pax_segvguard_maxcrashes, 0, 242 CTL_CREATE, CTL_EOL); 243 #endif /* PAX_SEGVGUARD */ 244 245 #ifdef PAX_ASLR 246 rnode = cnode; 247 sysctl_createv(clog, 0, &rnode, &rnode, 248 CTLFLAG_PERMANENT, 249 CTLTYPE_NODE, "aslr", 250 SYSCTL_DESCR("Address Space Layout Randomization."), 251 NULL, 0, NULL, 0, 252 CTL_CREATE, CTL_EOL); 253 sysctl_createv(clog, 0, &rnode, NULL, 254 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 255 CTLTYPE_INT, "enabled", 256 SYSCTL_DESCR("Restrictions enabled."), 257 NULL, 0, &pax_aslr_enabled, 0, 258 CTL_CREATE, CTL_EOL); 259 sysctl_createv(clog, 0, &rnode, NULL, 260 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 261 CTLTYPE_INT, "global", 262 SYSCTL_DESCR("When enabled, unless explicitly " 263 "specified, apply to all processes."), 264 NULL, 0, &pax_aslr_global, 0, 265 CTL_CREATE, CTL_EOL); 266 #ifdef PAX_ASLR_DEBUG 267 sysctl_createv(clog, 0, &rnode, NULL, 268 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 269 CTLTYPE_INT, "debug", 270 SYSCTL_DESCR("Pring ASLR selected addresses."), 271 NULL, 0, &pax_aslr_debug, 0, 272 CTL_CREATE, CTL_EOL); 273 #endif 274 sysctl_createv(clog, 0, &rnode, NULL, 275 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 276 CTLTYPE_INT, "mmap_len", 277 SYSCTL_DESCR("Number of bits randomized for " 278 "mmap(2) calls."), 279 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 280 CTL_CREATE, CTL_EOL); 281 sysctl_createv(clog, 0, &rnode, NULL, 282 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 283 CTLTYPE_INT, "stack_len", 284 SYSCTL_DESCR("Number of bits randomized for " 285 "the stack."), 286 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 287 CTL_CREATE, CTL_EOL); 288 sysctl_createv(clog, 0, &rnode, NULL, 289 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 290 CTLTYPE_INT, "exec_len", 291 SYSCTL_DESCR("Number of bits randomized for " 292 "the PIE exec base."), 293 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 294 CTL_CREATE, CTL_EOL); 295 296 #endif /* PAX_ASLR */ 297 } 298 299 /* 300 * Initialize PaX. 301 */ 302 void 303 pax_init(void) 304 { 305 #ifdef PAX_SEGVGUARD 306 int error; 307 308 error = fileassoc_register("segvguard", pax_segvguard_cleanup_cb, 309 &segvguard_id); 310 if (error) { 311 panic("pax_init: segvguard_id: error=%d\n", error); 312 } 313 #endif /* PAX_SEGVGUARD */ 314 } 315 316 void 317 pax_setup_elf_flags(struct exec_package *epp, uint32_t elf_flags) 318 { 319 uint32_t flags = 0; 320 321 #ifdef PAX_ASLR 322 if (pax_aslr_elf_flags_active(elf_flags)) { 323 flags |= P_PAX_ASLR; 324 } 325 #endif 326 #ifdef PAX_MPROTECT 327 if (pax_mprotect_elf_flags_active(elf_flags)) { 328 flags |= P_PAX_MPROTECT; 329 } 330 #endif 331 #ifdef PAX_SEGVGUARD 332 if (pax_segvguard_elf_flags_active(elf_flags)) { 333 flags |= P_PAX_GUARD; 334 } 335 #endif 336 337 epp->ep_pax_flags = flags; 338 } 339 340 #if defined(PAX_MPROTECT) || defined(PAX_SEGVGUARD) || defined(PAX_ASLR) 341 static inline bool 342 pax_flags_active(uint32_t flags, uint32_t opt) 343 { 344 if (!(flags & opt)) 345 return false; 346 return true; 347 } 348 #endif /* PAX_MPROTECT || PAX_SEGVGUARD || PAX_ASLR */ 349 350 #ifdef PAX_MPROTECT 351 static bool 352 pax_mprotect_elf_flags_active(uint32_t flags) 353 { 354 if (!pax_mprotect_enabled) 355 return false; 356 if (pax_mprotect_global && (flags & ELF_NOTE_PAX_NOMPROTECT) != 0) { 357 /* Mprotect explicitly disabled */ 358 return false; 359 } 360 if (!pax_mprotect_global && (flags & ELF_NOTE_PAX_MPROTECT) == 0) { 361 /* Mprotect not requested */ 362 return false; 363 } 364 return true; 365 } 366 367 void 368 pax_mprotect_adjust( 369 #ifdef PAX_MPROTECT_DEBUG 370 const char *file, size_t line, 371 #endif 372 struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 373 { 374 uint32_t flags; 375 376 flags = l->l_proc->p_pax; 377 if (!pax_flags_active(flags, P_PAX_MPROTECT)) 378 return; 379 380 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 381 #ifdef PAX_MPROTECT_DEBUG 382 struct proc *p = l->l_proc; 383 if (pax_mprotect_debug) { 384 printf("%s: %s,%zu: %d.%d (%s): -x\n", 385 __func__, file, line, 386 p->p_pid, l->l_lid, p->p_comm); 387 } 388 #endif 389 *prot &= ~VM_PROT_EXECUTE; 390 *maxprot &= ~VM_PROT_EXECUTE; 391 } else { 392 #ifdef PAX_MPROTECT_DEBUG 393 struct proc *p = l->l_proc; 394 if (pax_mprotect_debug) { 395 printf("%s: %s,%zu: %d.%d (%s): -w\n", 396 __func__, file, line, 397 p->p_pid, l->l_lid, p->p_comm); 398 } 399 #endif 400 *prot &= ~VM_PROT_WRITE; 401 *maxprot &= ~VM_PROT_WRITE; 402 } 403 } 404 #endif /* PAX_MPROTECT */ 405 406 #ifdef PAX_ASLR 407 static bool 408 pax_aslr_elf_flags_active(uint32_t flags) 409 { 410 if (!pax_aslr_enabled) 411 return false; 412 if (pax_aslr_global && (flags & ELF_NOTE_PAX_NOASLR) != 0) { 413 /* ASLR explicitly disabled */ 414 return false; 415 } 416 if (!pax_aslr_global && (flags & ELF_NOTE_PAX_ASLR) == 0) { 417 /* ASLR not requested */ 418 return false; 419 } 420 return true; 421 } 422 423 bool 424 pax_aslr_epp_active(struct exec_package *epp) 425 { 426 return pax_flags_active(epp->ep_pax_flags, P_PAX_ASLR); 427 } 428 429 bool 430 pax_aslr_active(struct lwp *l) 431 { 432 return pax_flags_active(l->l_proc->p_pax, P_PAX_ASLR); 433 } 434 435 void 436 pax_aslr_init_vm(struct lwp *l, struct vmspace *vm, struct exec_package *ep) 437 { 438 if (!pax_aslr_active(l)) 439 return; 440 441 uint32_t len = (ep->ep_flags & EXEC_32) ? 442 PAX_ASLR_DELTA_MMAP_LEN32 : PAX_ASLR_DELTA_MMAP_LEN; 443 444 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 445 PAX_ASLR_DELTA_MMAP_LSB, len); 446 447 PAX_DPRINTF("delta_mmap=%#jx/%u", vm->vm_aslr_delta_mmap, len); 448 } 449 450 void 451 pax_aslr_mmap(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 452 { 453 if (!pax_aslr_active(l)) 454 return; 455 #ifdef PAX_ASLR_DEBUG 456 char buf[256]; 457 if (pax_aslr_debug) 458 snprintb(buf, sizeof(buf), MAP_FMT, f); 459 else 460 buf[0] = '\0'; 461 #endif 462 463 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 464 PAX_DPRINTF("applying to %#jx orig_addr=%#jx f=%s", 465 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 466 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 467 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 468 else 469 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 470 PAX_DPRINTF("result %#jx", (uintmax_t)*addr); 471 } else { 472 PAX_DPRINTF("not applying to %#jx orig_addr=%#jx f=%s", 473 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 474 } 475 } 476 477 void 478 pax_aslr_stack(struct exec_package *epp, u_long *max_stack_size) 479 { 480 if (!pax_aslr_epp_active(epp)) 481 return; 482 483 u_long d = PAX_ASLR_DELTA(cprng_fast32(), 484 PAX_ASLR_DELTA_STACK_LSB, 485 PAX_ASLR_DELTA_STACK_LEN); 486 PAX_DPRINTF("stack %#jx delta=%#lx diff=%lx", 487 (uintmax_t)epp->ep_minsaddr, d, epp->ep_minsaddr - d); 488 epp->ep_minsaddr -= d; 489 *max_stack_size -= d; 490 if (epp->ep_ssize > *max_stack_size) 491 epp->ep_ssize = *max_stack_size; 492 } 493 #endif /* PAX_ASLR */ 494 495 #ifdef PAX_SEGVGUARD 496 static bool 497 pax_segvguard_elf_flags_active(uint32_t flags) 498 { 499 if (!pax_segvguard_enabled) 500 return false; 501 if (pax_segvguard_global && (flags & ELF_NOTE_PAX_NOGUARD) != 0) { 502 /* Segvguard explicitly disabled */ 503 return false; 504 } 505 if (!pax_segvguard_global && (flags & ELF_NOTE_PAX_GUARD) == 0) { 506 /* Segvguard not requested */ 507 return false; 508 } 509 return true; 510 } 511 512 static void 513 pax_segvguard_cleanup_cb(void *v) 514 { 515 struct pax_segvguard_entry *p = v; 516 struct pax_segvguard_uid_entry *up; 517 518 if (p == NULL) { 519 return; 520 } 521 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 522 LIST_REMOVE(up, sue_list); 523 kmem_free(up, sizeof(*up)); 524 } 525 kmem_free(p, sizeof(*p)); 526 } 527 528 /* 529 * Called when a process of image vp generated a segfault. 530 */ 531 int 532 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 533 bool crashed) 534 { 535 struct pax_segvguard_entry *p; 536 struct pax_segvguard_uid_entry *up; 537 struct timeval tv; 538 uid_t uid; 539 uint32_t flags; 540 bool have_uid; 541 542 flags = l->l_proc->p_pax; 543 if (!pax_flags_active(flags, P_PAX_GUARD)) 544 return 0; 545 546 if (vp == NULL) 547 return EFAULT; 548 549 /* Check if we already monitor the file. */ 550 p = fileassoc_lookup(vp, segvguard_id); 551 552 /* Fast-path if starting a program we don't know. */ 553 if (p == NULL && !crashed) 554 return 0; 555 556 microtime(&tv); 557 558 /* 559 * If a program we don't know crashed, we need to create a new entry 560 * for it. 561 */ 562 if (p == NULL) { 563 p = kmem_alloc(sizeof(*p), KM_SLEEP); 564 fileassoc_add(vp, segvguard_id, p); 565 LIST_INIT(&p->segv_uids); 566 567 /* 568 * Initialize a new entry with "crashes so far" of 1. 569 * The expiry time is when we purge the entry if it didn't 570 * reach the limit. 571 */ 572 up = kmem_alloc(sizeof(*up), KM_SLEEP); 573 up->sue_uid = kauth_cred_getuid(l->l_cred); 574 up->sue_ncrashes = 1; 575 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 576 up->sue_suspended = 0; 577 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 578 return 0; 579 } 580 581 /* 582 * A program we "know" either executed or crashed again. 583 * See if it's a culprit we're familiar with. 584 */ 585 uid = kauth_cred_getuid(l->l_cred); 586 have_uid = false; 587 LIST_FOREACH(up, &p->segv_uids, sue_list) { 588 if (up->sue_uid == uid) { 589 have_uid = true; 590 break; 591 } 592 } 593 594 /* 595 * It's someone else. Add an entry for him if we crashed. 596 */ 597 if (!have_uid) { 598 if (crashed) { 599 up = kmem_alloc(sizeof(*up), KM_SLEEP); 600 up->sue_uid = uid; 601 up->sue_ncrashes = 1; 602 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 603 up->sue_suspended = 0; 604 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 605 } 606 return 0; 607 } 608 609 if (crashed) { 610 /* Check if timer on previous crashes expired first. */ 611 if (up->sue_expiry < tv.tv_sec) { 612 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 613 " expired.\n", name ? name : "unknown"); 614 up->sue_ncrashes = 1; 615 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 616 up->sue_suspended = 0; 617 return 0; 618 } 619 620 up->sue_ncrashes++; 621 622 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 623 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 624 "execution for %d seconds after %zu crashes.\n", 625 name ? name : "unknown", pax_segvguard_suspension, 626 up->sue_ncrashes); 627 628 /* Suspend this program for a while. */ 629 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 630 up->sue_ncrashes = 0; 631 up->sue_expiry = 0; 632 } 633 } else { 634 /* Are we supposed to be suspended? */ 635 if (up->sue_suspended > tv.tv_sec) { 636 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 637 "execution due to repeated segfaults.\n", name ? 638 name : "unknown"); 639 return EPERM; 640 } 641 } 642 643 return 0; 644 } 645 #endif /* PAX_SEGVGUARD */ 646
Indexes created Wed Sep 24 05:09:52 GMT 2025