kern_pax.c revision 1.39
1 /* $NetBSD: kern_pax.c,v 1.39 2016/04/10 15:02:17 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Maxime Villard. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. The name of the author may not be used to endorse or promote products 45 * derived from this software without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.39 2016/04/10 15:02:17 christos Exp $"); 61 62 #include "opt_pax.h" 63 64 #include <sys/param.h> 65 #include <sys/proc.h> 66 #include <sys/exec.h> 67 #include <sys/exec_elf.h> 68 #include <sys/pax.h> 69 #include <sys/sysctl.h> 70 #include <sys/kmem.h> 71 #include <sys/mman.h> 72 #include <sys/fileassoc.h> 73 #include <sys/syslog.h> 74 #include <sys/vnode.h> 75 #include <sys/queue.h> 76 #include <sys/kauth.h> 77 #include <sys/cprng.h> 78 79 #ifdef PAX_ASLR_DEBUG 80 #define PAX_DPRINTF(_fmt, args...) \ 81 do if (pax_aslr_debug) uprintf("%s: " _fmt "\n", __func__, ##args); \ 82 while (/*CONSTCOND*/0) 83 #else 84 #define PAX_DPRINTF(_fmt, args...) do {} while (/*CONSTCOND*/0) 85 #endif 86 87 #ifdef PAX_ASLR 88 #include <sys/mman.h> 89 90 int pax_aslr_enabled = 1; 91 int pax_aslr_global = PAX_ASLR; 92 93 #ifndef PAX_ASLR_DELTA_MMAP_LSB 94 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 95 #endif 96 #ifndef PAX_ASLR_DELTA_MMAP_LEN 97 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 98 #endif 99 #ifndef PAX_ASLR_DELTA_MMAP_LEN32 100 #define PAX_ASLR_DELTA_MMAP_LEN32 ((sizeof(uint32_t) * NBBY) / 2) 101 #endif 102 #ifndef PAX_ASLR_DELTA_STACK_LSB 103 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 104 #endif 105 #ifndef PAX_ASLR_DELTA_STACK_LEN 106 #define PAX_ASLR_DELTA_STACK_LEN 12 107 #endif 108 109 static bool pax_aslr_elf_flags_active(uint32_t); 110 #endif /* PAX_ASLR */ 111 112 #ifdef PAX_MPROTECT 113 static int pax_mprotect_enabled = 1; 114 static int pax_mprotect_global = PAX_MPROTECT; 115 static bool pax_mprotect_elf_flags_active(uint32_t); 116 #endif /* PAX_MPROTECT */ 117 #ifdef PAX_MPROTECT_DEBUG 118 int pax_mprotect_debug; 119 #endif 120 121 #ifdef PAX_SEGVGUARD 122 #ifndef PAX_SEGVGUARD_EXPIRY 123 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 124 #endif 125 #ifndef PAX_SEGVGUARD_SUSPENSION 126 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 127 #endif 128 #ifndef PAX_SEGVGUARD_MAXCRASHES 129 #define PAX_SEGVGUARD_MAXCRASHES 5 130 #endif 131 132 #ifdef PAX_ASLR_DEBUG 133 int pax_aslr_debug; 134 /* flag set means disable */ 135 int pax_aslr_flags; 136 #define PAX_ASLR_STACK 1 137 #define PAX_ASLR_EXEC 2 138 #define PAX_ASLR_MMAP 4 139 #endif 140 141 static int pax_segvguard_enabled = 1; 142 static int pax_segvguard_global = PAX_SEGVGUARD; 143 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 144 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 145 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 146 147 static fileassoc_t segvguard_id; 148 149 struct pax_segvguard_uid_entry { 150 uid_t sue_uid; 151 size_t sue_ncrashes; 152 time_t sue_expiry; 153 time_t sue_suspended; 154 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 155 }; 156 157 struct pax_segvguard_entry { 158 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 159 }; 160 161 static bool pax_segvguard_elf_flags_active(uint32_t); 162 static void pax_segvguard_cleanup_cb(void *); 163 #endif /* PAX_SEGVGUARD */ 164 165 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 166 { 167 const struct sysctlnode *rnode = NULL, *cnode; 168 169 sysctl_createv(clog, 0, NULL, &rnode, 170 CTLFLAG_PERMANENT, 171 CTLTYPE_NODE, "pax", 172 SYSCTL_DESCR("PaX (exploit mitigation) features."), 173 NULL, 0, NULL, 0, 174 CTL_SECURITY, CTL_CREATE, CTL_EOL); 175 176 cnode = rnode; 177 178 #ifdef PAX_MPROTECT 179 rnode = cnode; 180 sysctl_createv(clog, 0, &rnode, &rnode, 181 CTLFLAG_PERMANENT, 182 CTLTYPE_NODE, "mprotect", 183 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 184 NULL, 0, NULL, 0, 185 CTL_CREATE, CTL_EOL); 186 sysctl_createv(clog, 0, &rnode, NULL, 187 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 188 CTLTYPE_INT, "enabled", 189 SYSCTL_DESCR("Restrictions enabled."), 190 NULL, 0, &pax_mprotect_enabled, 0, 191 CTL_CREATE, CTL_EOL); 192 sysctl_createv(clog, 0, &rnode, NULL, 193 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 194 CTLTYPE_INT, "global", 195 SYSCTL_DESCR("When enabled, unless explicitly " 196 "specified, apply restrictions to " 197 "all processes."), 198 NULL, 0, &pax_mprotect_global, 0, 199 CTL_CREATE, CTL_EOL); 200 #ifdef PAX_MPROTECT_DEBUG 201 sysctl_createv(clog, 0, &rnode, NULL, 202 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 203 CTLTYPE_INT, "debug", 204 SYSCTL_DESCR("print mprotect changes."), 205 NULL, 0, &pax_mprotect_debug, 0, 206 CTL_CREATE, CTL_EOL); 207 #endif 208 #endif /* PAX_MPROTECT */ 209 210 #ifdef PAX_SEGVGUARD 211 rnode = cnode; 212 sysctl_createv(clog, 0, &rnode, &rnode, 213 CTLFLAG_PERMANENT, 214 CTLTYPE_NODE, "segvguard", 215 SYSCTL_DESCR("PaX segvguard."), 216 NULL, 0, NULL, 0, 217 CTL_CREATE, CTL_EOL); 218 sysctl_createv(clog, 0, &rnode, NULL, 219 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 220 CTLTYPE_INT, "enabled", 221 SYSCTL_DESCR("segvguard enabled."), 222 NULL, 0, &pax_segvguard_enabled, 0, 223 CTL_CREATE, CTL_EOL); 224 sysctl_createv(clog, 0, &rnode, NULL, 225 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 226 CTLTYPE_INT, "global", 227 SYSCTL_DESCR("segvguard all programs."), 228 NULL, 0, &pax_segvguard_global, 0, 229 CTL_CREATE, CTL_EOL); 230 sysctl_createv(clog, 0, &rnode, NULL, 231 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 232 CTLTYPE_INT, "expiry_timeout", 233 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 234 NULL, 0, &pax_segvguard_expiry, 0, 235 CTL_CREATE, CTL_EOL); 236 sysctl_createv(clog, 0, &rnode, NULL, 237 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 238 CTLTYPE_INT, "suspend_timeout", 239 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 240 NULL, 0, &pax_segvguard_suspension, 0, 241 CTL_CREATE, CTL_EOL); 242 sysctl_createv(clog, 0, &rnode, NULL, 243 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 244 CTLTYPE_INT, "max_crashes", 245 SYSCTL_DESCR("Max number of crashes before expiry."), 246 NULL, 0, &pax_segvguard_maxcrashes, 0, 247 CTL_CREATE, CTL_EOL); 248 #endif /* PAX_SEGVGUARD */ 249 250 #ifdef PAX_ASLR 251 rnode = cnode; 252 sysctl_createv(clog, 0, &rnode, &rnode, 253 CTLFLAG_PERMANENT, 254 CTLTYPE_NODE, "aslr", 255 SYSCTL_DESCR("Address Space Layout Randomization."), 256 NULL, 0, NULL, 0, 257 CTL_CREATE, CTL_EOL); 258 sysctl_createv(clog, 0, &rnode, NULL, 259 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 260 CTLTYPE_INT, "enabled", 261 SYSCTL_DESCR("Restrictions enabled."), 262 NULL, 0, &pax_aslr_enabled, 0, 263 CTL_CREATE, CTL_EOL); 264 sysctl_createv(clog, 0, &rnode, NULL, 265 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 266 CTLTYPE_INT, "global", 267 SYSCTL_DESCR("When enabled, unless explicitly " 268 "specified, apply to all processes."), 269 NULL, 0, &pax_aslr_global, 0, 270 CTL_CREATE, CTL_EOL); 271 #ifdef PAX_ASLR_DEBUG 272 sysctl_createv(clog, 0, &rnode, NULL, 273 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 274 CTLTYPE_INT, "debug", 275 SYSCTL_DESCR("Pring ASLR selected addresses."), 276 NULL, 0, &pax_aslr_debug, 0, 277 CTL_CREATE, CTL_EOL); 278 sysctl_createv(clog, 0, &rnode, NULL, 279 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 280 CTLTYPE_INT, "flags", 281 SYSCTL_DESCR("Disable/Enable select ASLR features."), 282 NULL, 0, &pax_aslr_flags, 0, 283 CTL_CREATE, CTL_EOL); 284 #endif 285 sysctl_createv(clog, 0, &rnode, NULL, 286 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 287 CTLTYPE_INT, "mmap_len", 288 SYSCTL_DESCR("Number of bits randomized for " 289 "mmap(2) calls."), 290 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 291 CTL_CREATE, CTL_EOL); 292 sysctl_createv(clog, 0, &rnode, NULL, 293 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 294 CTLTYPE_INT, "stack_len", 295 SYSCTL_DESCR("Number of bits randomized for " 296 "the stack."), 297 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 298 CTL_CREATE, CTL_EOL); 299 sysctl_createv(clog, 0, &rnode, NULL, 300 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 301 CTLTYPE_INT, "exec_len", 302 SYSCTL_DESCR("Number of bits randomized for " 303 "the PIE exec base."), 304 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 305 CTL_CREATE, CTL_EOL); 306 307 #endif /* PAX_ASLR */ 308 } 309 310 /* 311 * Initialize PaX. 312 */ 313 void 314 pax_init(void) 315 { 316 #ifdef PAX_SEGVGUARD 317 int error; 318 319 error = fileassoc_register("segvguard", pax_segvguard_cleanup_cb, 320 &segvguard_id); 321 if (error) { 322 panic("pax_init: segvguard_id: error=%d\n", error); 323 } 324 #endif /* PAX_SEGVGUARD */ 325 } 326 327 void 328 pax_setup_elf_flags(struct exec_package *epp, uint32_t elf_flags) 329 { 330 uint32_t flags = 0; 331 332 #ifdef PAX_ASLR 333 if (pax_aslr_elf_flags_active(elf_flags)) { 334 flags |= P_PAX_ASLR; 335 } 336 #endif 337 #ifdef PAX_MPROTECT 338 if (pax_mprotect_elf_flags_active(elf_flags)) { 339 flags |= P_PAX_MPROTECT; 340 } 341 #endif 342 #ifdef PAX_SEGVGUARD 343 if (pax_segvguard_elf_flags_active(elf_flags)) { 344 flags |= P_PAX_GUARD; 345 } 346 #endif 347 348 epp->ep_pax_flags = flags; 349 } 350 351 #if defined(PAX_MPROTECT) || defined(PAX_SEGVGUARD) || defined(PAX_ASLR) 352 static inline bool 353 pax_flags_active(uint32_t flags, uint32_t opt) 354 { 355 if (!(flags & opt)) 356 return false; 357 return true; 358 } 359 #endif /* PAX_MPROTECT || PAX_SEGVGUARD || PAX_ASLR */ 360 361 #ifdef PAX_MPROTECT 362 static bool 363 pax_mprotect_elf_flags_active(uint32_t flags) 364 { 365 if (!pax_mprotect_enabled) 366 return false; 367 if (pax_mprotect_global && (flags & ELF_NOTE_PAX_NOMPROTECT) != 0) { 368 /* Mprotect explicitly disabled */ 369 return false; 370 } 371 if (!pax_mprotect_global && (flags & ELF_NOTE_PAX_MPROTECT) == 0) { 372 /* Mprotect not requested */ 373 return false; 374 } 375 return true; 376 } 377 378 void 379 pax_mprotect_adjust( 380 #ifdef PAX_MPROTECT_DEBUG 381 const char *file, size_t line, 382 #endif 383 struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 384 { 385 uint32_t flags; 386 387 flags = l->l_proc->p_pax; 388 if (!pax_flags_active(flags, P_PAX_MPROTECT)) 389 return; 390 391 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 392 #ifdef PAX_MPROTECT_DEBUG 393 struct proc *p = l->l_proc; 394 if (pax_mprotect_debug) { 395 printf("%s: %s,%zu: %d.%d (%s): -x\n", 396 __func__, file, line, 397 p->p_pid, l->l_lid, p->p_comm); 398 } 399 #endif 400 *prot &= ~VM_PROT_EXECUTE; 401 *maxprot &= ~VM_PROT_EXECUTE; 402 } else { 403 #ifdef PAX_MPROTECT_DEBUG 404 struct proc *p = l->l_proc; 405 if (pax_mprotect_debug) { 406 printf("%s: %s,%zu: %d.%d (%s): -w\n", 407 __func__, file, line, 408 p->p_pid, l->l_lid, p->p_comm); 409 } 410 #endif 411 *prot &= ~VM_PROT_WRITE; 412 *maxprot &= ~VM_PROT_WRITE; 413 } 414 } 415 #endif /* PAX_MPROTECT */ 416 417 #ifdef PAX_ASLR 418 static bool 419 pax_aslr_elf_flags_active(uint32_t flags) 420 { 421 if (!pax_aslr_enabled) 422 return false; 423 if (pax_aslr_global && (flags & ELF_NOTE_PAX_NOASLR) != 0) { 424 /* ASLR explicitly disabled */ 425 return false; 426 } 427 if (!pax_aslr_global && (flags & ELF_NOTE_PAX_ASLR) == 0) { 428 /* ASLR not requested */ 429 return false; 430 } 431 return true; 432 } 433 434 bool 435 pax_aslr_epp_active(struct exec_package *epp) 436 { 437 return pax_flags_active(epp->ep_pax_flags, P_PAX_ASLR); 438 } 439 440 bool 441 pax_aslr_active(struct lwp *l) 442 { 443 return pax_flags_active(l->l_proc->p_pax, P_PAX_ASLR); 444 } 445 446 void 447 pax_aslr_init_vm(struct lwp *l, struct vmspace *vm, struct exec_package *ep) 448 { 449 if (!pax_aslr_active(l)) 450 return; 451 452 #ifdef PAX_ASLR_DEBUG 453 if (pax_aslr_flags & PAX_ASLR_MMAP) 454 return; 455 #endif 456 457 uint32_t len = (ep->ep_flags & EXEC_32) ? 458 PAX_ASLR_DELTA_MMAP_LEN32 : PAX_ASLR_DELTA_MMAP_LEN; 459 460 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 461 PAX_ASLR_DELTA_MMAP_LSB, len); 462 463 PAX_DPRINTF("delta_mmap=%#jx/%u", vm->vm_aslr_delta_mmap, len); 464 } 465 466 void 467 pax_aslr_mmap(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 468 { 469 if (!pax_aslr_active(l)) 470 return; 471 #ifdef PAX_ASLR_DEBUG 472 char buf[256]; 473 474 if (pax_aslr_flags & PAX_ASLR_MMAP) 475 return; 476 477 if (pax_aslr_debug) 478 snprintb(buf, sizeof(buf), MAP_FMT, f); 479 else 480 buf[0] = '\0'; 481 #endif 482 483 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 484 PAX_DPRINTF("applying to %#jx orig_addr=%#jx f=%s", 485 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 486 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 487 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 488 else 489 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 490 PAX_DPRINTF("result %#jx", (uintmax_t)*addr); 491 } else { 492 PAX_DPRINTF("not applying to %#jx orig_addr=%#jx f=%s", 493 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 494 } 495 } 496 497 void 498 pax_aslr_stack(struct exec_package *epp, u_long *max_stack_size) 499 { 500 if (!pax_aslr_epp_active(epp)) 501 return; 502 #ifdef PAX_ASLR_DEBUG 503 if (pax_aslr_flags & PAX_ASLR_STACK) 504 return; 505 #endif 506 507 u_long d = PAX_ASLR_DELTA(cprng_fast32(), 508 PAX_ASLR_DELTA_STACK_LSB, 509 PAX_ASLR_DELTA_STACK_LEN); 510 PAX_DPRINTF("stack %#jx delta=%#lx diff=%lx", 511 (uintmax_t)epp->ep_minsaddr, d, epp->ep_minsaddr - d); 512 epp->ep_minsaddr -= d; 513 *max_stack_size -= d; 514 if (epp->ep_ssize > *max_stack_size) 515 epp->ep_ssize = *max_stack_size; 516 } 517 #endif /* PAX_ASLR */ 518 519 #ifdef PAX_SEGVGUARD 520 static bool 521 pax_segvguard_elf_flags_active(uint32_t flags) 522 { 523 if (!pax_segvguard_enabled) 524 return false; 525 if (pax_segvguard_global && (flags & ELF_NOTE_PAX_NOGUARD) != 0) { 526 /* Segvguard explicitly disabled */ 527 return false; 528 } 529 if (!pax_segvguard_global && (flags & ELF_NOTE_PAX_GUARD) == 0) { 530 /* Segvguard not requested */ 531 return false; 532 } 533 return true; 534 } 535 536 static void 537 pax_segvguard_cleanup_cb(void *v) 538 { 539 struct pax_segvguard_entry *p = v; 540 struct pax_segvguard_uid_entry *up; 541 542 if (p == NULL) { 543 return; 544 } 545 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 546 LIST_REMOVE(up, sue_list); 547 kmem_free(up, sizeof(*up)); 548 } 549 kmem_free(p, sizeof(*p)); 550 } 551 552 /* 553 * Called when a process of image vp generated a segfault. 554 */ 555 int 556 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 557 bool crashed) 558 { 559 struct pax_segvguard_entry *p; 560 struct pax_segvguard_uid_entry *up; 561 struct timeval tv; 562 uid_t uid; 563 uint32_t flags; 564 bool have_uid; 565 566 flags = l->l_proc->p_pax; 567 if (!pax_flags_active(flags, P_PAX_GUARD)) 568 return 0; 569 570 if (vp == NULL) 571 return EFAULT; 572 573 /* Check if we already monitor the file. */ 574 p = fileassoc_lookup(vp, segvguard_id); 575 576 /* Fast-path if starting a program we don't know. */ 577 if (p == NULL && !crashed) 578 return 0; 579 580 microtime(&tv); 581 582 /* 583 * If a program we don't know crashed, we need to create a new entry 584 * for it. 585 */ 586 if (p == NULL) { 587 p = kmem_alloc(sizeof(*p), KM_SLEEP); 588 fileassoc_add(vp, segvguard_id, p); 589 LIST_INIT(&p->segv_uids); 590 591 /* 592 * Initialize a new entry with "crashes so far" of 1. 593 * The expiry time is when we purge the entry if it didn't 594 * reach the limit. 595 */ 596 up = kmem_alloc(sizeof(*up), KM_SLEEP); 597 up->sue_uid = kauth_cred_getuid(l->l_cred); 598 up->sue_ncrashes = 1; 599 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 600 up->sue_suspended = 0; 601 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 602 return 0; 603 } 604 605 /* 606 * A program we "know" either executed or crashed again. 607 * See if it's a culprit we're familiar with. 608 */ 609 uid = kauth_cred_getuid(l->l_cred); 610 have_uid = false; 611 LIST_FOREACH(up, &p->segv_uids, sue_list) { 612 if (up->sue_uid == uid) { 613 have_uid = true; 614 break; 615 } 616 } 617 618 /* 619 * It's someone else. Add an entry for him if we crashed. 620 */ 621 if (!have_uid) { 622 if (crashed) { 623 up = kmem_alloc(sizeof(*up), KM_SLEEP); 624 up->sue_uid = uid; 625 up->sue_ncrashes = 1; 626 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 627 up->sue_suspended = 0; 628 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 629 } 630 return 0; 631 } 632 633 if (crashed) { 634 /* Check if timer on previous crashes expired first. */ 635 if (up->sue_expiry < tv.tv_sec) { 636 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 637 " expired.\n", name ? name : "unknown"); 638 up->sue_ncrashes = 1; 639 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 640 up->sue_suspended = 0; 641 return 0; 642 } 643 644 up->sue_ncrashes++; 645 646 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 647 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 648 "execution for %d seconds after %zu crashes.\n", 649 name ? name : "unknown", pax_segvguard_suspension, 650 up->sue_ncrashes); 651 652 /* Suspend this program for a while. */ 653 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 654 up->sue_ncrashes = 0; 655 up->sue_expiry = 0; 656 } 657 } else { 658 /* Are we supposed to be suspended? */ 659 if (up->sue_suspended > tv.tv_sec) { 660 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 661 "execution due to repeated segfaults.\n", name ? 662 name : "unknown"); 663 return EPERM; 664 } 665 } 666 667 return 0; 668 } 669 #endif /* PAX_SEGVGUARD */ 670
Indexes created Tue Sep 30 11:09:46 GMT 2025