kern_pax.c revision 1.51
1 /* $NetBSD: kern_pax.c,v 1.51 2016/05/25 17:25:32 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2015 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Maxime Villard. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. The name of the author may not be used to endorse or promote products 45 * derived from this software without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 51 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 52 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 53 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 54 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 55 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 56 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.51 2016/05/25 17:25:32 christos Exp $"); 61 62 #include "opt_pax.h" 63 64 #include <sys/param.h> 65 #include <sys/proc.h> 66 #include <sys/exec.h> 67 #include <sys/exec_elf.h> 68 #include <sys/pax.h> 69 #include <sys/sysctl.h> 70 #include <sys/kmem.h> 71 #include <sys/mman.h> 72 #include <sys/fileassoc.h> 73 #include <sys/syslog.h> 74 #include <sys/vnode.h> 75 #include <sys/queue.h> 76 #include <sys/bitops.h> 77 #include <sys/kauth.h> 78 #include <sys/cprng.h> 79 80 #ifdef PAX_ASLR_DEBUG 81 #define PAX_DPRINTF(_fmt, args...) \ 82 do if (pax_aslr_debug) uprintf("%s: " _fmt "\n", __func__, ##args); \ 83 while (/*CONSTCOND*/0) 84 #else 85 #define PAX_DPRINTF(_fmt, args...) do {} while (/*CONSTCOND*/0) 86 #endif 87 88 #ifdef PAX_ASLR 89 #include <sys/mman.h> 90 91 int pax_aslr_enabled = 1; 92 int pax_aslr_global = PAX_ASLR; 93 94 #ifndef PAX_ASLR_DELTA_MMAP_LSB 95 #define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 96 #endif 97 #ifndef PAX_ASLR_DELTA_MMAP_LEN 98 #define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 99 #endif 100 #ifndef PAX_ASLR_DELTA_MMAP_LEN32 101 #define PAX_ASLR_DELTA_MMAP_LEN32 ((sizeof(uint32_t) * NBBY) / 2) 102 #endif 103 #ifndef PAX_ASLR_DELTA_STACK_LSB 104 #define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 105 #endif 106 #ifndef PAX_ASLR_DELTA_STACK_LEN 107 #define PAX_ASLR_DELTA_STACK_LEN ((sizeof(void *) * NBBY) / 4) 108 #endif 109 #ifndef PAX_ASLR_DELTA_STACK_LEN32 110 #define PAX_ASLR_DELTA_STACK_LEN32 ((sizeof(uint32_t) * NBBY) / 4) 111 #endif 112 #define PAX_ASLR_MAX_STACK_WASTE 8 113 114 static bool pax_aslr_elf_flags_active(uint32_t); 115 #endif /* PAX_ASLR */ 116 117 #ifdef PAX_MPROTECT 118 static int pax_mprotect_enabled = 1; 119 static int pax_mprotect_global = PAX_MPROTECT; 120 static bool pax_mprotect_elf_flags_active(uint32_t); 121 #endif /* PAX_MPROTECT */ 122 #ifdef PAX_MPROTECT_DEBUG 123 int pax_mprotect_debug; 124 #endif 125 126 #ifdef PAX_SEGVGUARD 127 #ifndef PAX_SEGVGUARD_EXPIRY 128 #define PAX_SEGVGUARD_EXPIRY (2 * 60) 129 #endif 130 #ifndef PAX_SEGVGUARD_SUSPENSION 131 #define PAX_SEGVGUARD_SUSPENSION (10 * 60) 132 #endif 133 #ifndef PAX_SEGVGUARD_MAXCRASHES 134 #define PAX_SEGVGUARD_MAXCRASHES 5 135 #endif 136 137 #ifdef PAX_ASLR_DEBUG 138 int pax_aslr_debug; 139 /* flag set means disable */ 140 int pax_aslr_flags; 141 uint32_t pax_aslr_rand; 142 #define PAX_ASLR_STACK 0x01 143 #define PAX_ASLR_STACK_GAP 0x02 144 #define PAX_ASLR_MMAP 0x04 145 #define PAX_ASLR_EXEC_OFFSET 0x08 146 #define PAX_ASLR_RTLD_OFFSET 0x10 147 #define PAX_ASLR_FIXED 0x20 148 #endif 149 150 static int pax_segvguard_enabled = 1; 151 static int pax_segvguard_global = PAX_SEGVGUARD; 152 static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 153 static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 154 static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 155 156 static fileassoc_t segvguard_id; 157 158 struct pax_segvguard_uid_entry { 159 uid_t sue_uid; 160 size_t sue_ncrashes; 161 time_t sue_expiry; 162 time_t sue_suspended; 163 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 164 }; 165 166 struct pax_segvguard_entry { 167 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 168 }; 169 170 static bool pax_segvguard_elf_flags_active(uint32_t); 171 static void pax_segvguard_cleanup_cb(void *); 172 #endif /* PAX_SEGVGUARD */ 173 174 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 175 { 176 const struct sysctlnode *rnode = NULL, *cnode; 177 178 sysctl_createv(clog, 0, NULL, &rnode, 179 CTLFLAG_PERMANENT, 180 CTLTYPE_NODE, "pax", 181 SYSCTL_DESCR("PaX (exploit mitigation) features."), 182 NULL, 0, NULL, 0, 183 CTL_SECURITY, CTL_CREATE, CTL_EOL); 184 185 cnode = rnode; 186 187 #ifdef PAX_MPROTECT 188 rnode = cnode; 189 sysctl_createv(clog, 0, &rnode, &rnode, 190 CTLFLAG_PERMANENT, 191 CTLTYPE_NODE, "mprotect", 192 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 193 NULL, 0, NULL, 0, 194 CTL_CREATE, CTL_EOL); 195 sysctl_createv(clog, 0, &rnode, NULL, 196 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 197 CTLTYPE_INT, "enabled", 198 SYSCTL_DESCR("Restrictions enabled."), 199 NULL, 0, &pax_mprotect_enabled, 0, 200 CTL_CREATE, CTL_EOL); 201 sysctl_createv(clog, 0, &rnode, NULL, 202 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 203 CTLTYPE_INT, "global", 204 SYSCTL_DESCR("When enabled, unless explicitly " 205 "specified, apply restrictions to " 206 "all processes."), 207 NULL, 0, &pax_mprotect_global, 0, 208 CTL_CREATE, CTL_EOL); 209 #ifdef PAX_MPROTECT_DEBUG 210 sysctl_createv(clog, 0, &rnode, NULL, 211 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 212 CTLTYPE_INT, "debug", 213 SYSCTL_DESCR("print mprotect changes."), 214 NULL, 0, &pax_mprotect_debug, 0, 215 CTL_CREATE, CTL_EOL); 216 #endif 217 #endif /* PAX_MPROTECT */ 218 219 #ifdef PAX_SEGVGUARD 220 rnode = cnode; 221 sysctl_createv(clog, 0, &rnode, &rnode, 222 CTLFLAG_PERMANENT, 223 CTLTYPE_NODE, "segvguard", 224 SYSCTL_DESCR("PaX segvguard."), 225 NULL, 0, NULL, 0, 226 CTL_CREATE, CTL_EOL); 227 sysctl_createv(clog, 0, &rnode, NULL, 228 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 229 CTLTYPE_INT, "enabled", 230 SYSCTL_DESCR("segvguard enabled."), 231 NULL, 0, &pax_segvguard_enabled, 0, 232 CTL_CREATE, CTL_EOL); 233 sysctl_createv(clog, 0, &rnode, NULL, 234 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 235 CTLTYPE_INT, "global", 236 SYSCTL_DESCR("segvguard all programs."), 237 NULL, 0, &pax_segvguard_global, 0, 238 CTL_CREATE, CTL_EOL); 239 sysctl_createv(clog, 0, &rnode, NULL, 240 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 241 CTLTYPE_INT, "expiry_timeout", 242 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 243 NULL, 0, &pax_segvguard_expiry, 0, 244 CTL_CREATE, CTL_EOL); 245 sysctl_createv(clog, 0, &rnode, NULL, 246 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 247 CTLTYPE_INT, "suspend_timeout", 248 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 249 NULL, 0, &pax_segvguard_suspension, 0, 250 CTL_CREATE, CTL_EOL); 251 sysctl_createv(clog, 0, &rnode, NULL, 252 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 253 CTLTYPE_INT, "max_crashes", 254 SYSCTL_DESCR("Max number of crashes before expiry."), 255 NULL, 0, &pax_segvguard_maxcrashes, 0, 256 CTL_CREATE, CTL_EOL); 257 #endif /* PAX_SEGVGUARD */ 258 259 #ifdef PAX_ASLR 260 rnode = cnode; 261 sysctl_createv(clog, 0, &rnode, &rnode, 262 CTLFLAG_PERMANENT, 263 CTLTYPE_NODE, "aslr", 264 SYSCTL_DESCR("Address Space Layout Randomization."), 265 NULL, 0, NULL, 0, 266 CTL_CREATE, CTL_EOL); 267 sysctl_createv(clog, 0, &rnode, NULL, 268 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 269 CTLTYPE_INT, "enabled", 270 SYSCTL_DESCR("Restrictions enabled."), 271 NULL, 0, &pax_aslr_enabled, 0, 272 CTL_CREATE, CTL_EOL); 273 sysctl_createv(clog, 0, &rnode, NULL, 274 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 275 CTLTYPE_INT, "global", 276 SYSCTL_DESCR("When enabled, unless explicitly " 277 "specified, apply to all processes."), 278 NULL, 0, &pax_aslr_global, 0, 279 CTL_CREATE, CTL_EOL); 280 #ifdef PAX_ASLR_DEBUG 281 sysctl_createv(clog, 0, &rnode, NULL, 282 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 283 CTLTYPE_INT, "debug", 284 SYSCTL_DESCR("Pring ASLR selected addresses."), 285 NULL, 0, &pax_aslr_debug, 0, 286 CTL_CREATE, CTL_EOL); 287 sysctl_createv(clog, 0, &rnode, NULL, 288 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 289 CTLTYPE_INT, "flags", 290 SYSCTL_DESCR("Disable/Enable select ASLR features."), 291 NULL, 0, &pax_aslr_flags, 0, 292 CTL_CREATE, CTL_EOL); 293 sysctl_createv(clog, 0, &rnode, NULL, 294 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 295 CTLTYPE_INT, "rand", 296 SYSCTL_DESCR("Use the given fixed random value"), 297 NULL, 0, &pax_aslr_rand, 0, 298 CTL_CREATE, CTL_EOL); 299 #endif 300 sysctl_createv(clog, 0, &rnode, NULL, 301 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 302 CTLTYPE_INT, "mmap_len", 303 SYSCTL_DESCR("Number of bits randomized for " 304 "mmap(2) calls."), 305 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 306 CTL_CREATE, CTL_EOL); 307 sysctl_createv(clog, 0, &rnode, NULL, 308 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 309 CTLTYPE_INT, "stack_len", 310 SYSCTL_DESCR("Number of bits randomized for " 311 "the stack."), 312 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 313 CTL_CREATE, CTL_EOL); 314 sysctl_createv(clog, 0, &rnode, NULL, 315 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 316 CTLTYPE_INT, "exec_len", 317 SYSCTL_DESCR("Number of bits randomized for " 318 "the PIE exec base."), 319 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 320 CTL_CREATE, CTL_EOL); 321 322 #endif /* PAX_ASLR */ 323 } 324 325 /* 326 * Initialize PaX. 327 */ 328 void 329 pax_init(void) 330 { 331 #ifdef PAX_SEGVGUARD 332 int error; 333 334 error = fileassoc_register("segvguard", pax_segvguard_cleanup_cb, 335 &segvguard_id); 336 if (error) { 337 panic("pax_init: segvguard_id: error=%d\n", error); 338 } 339 #endif /* PAX_SEGVGUARD */ 340 #ifdef PAX_ASLR 341 /* Adjust maximum stack by the size we can consume for ASLR */ 342 extern rlim_t maxsmap; 343 maxsmap = MAXSSIZ - (MAXSSIZ / PAX_ASLR_MAX_STACK_WASTE); 344 // XXX: compat32 is not handled. 345 #endif 346 } 347 348 void 349 pax_setup_elf_flags(struct exec_package *epp, uint32_t elf_flags) 350 { 351 uint32_t flags = 0; 352 353 #ifdef PAX_ASLR 354 if (pax_aslr_elf_flags_active(elf_flags)) { 355 flags |= P_PAX_ASLR; 356 } 357 #endif 358 #ifdef PAX_MPROTECT 359 if (pax_mprotect_elf_flags_active(elf_flags)) { 360 flags |= P_PAX_MPROTECT; 361 } 362 #endif 363 #ifdef PAX_SEGVGUARD 364 if (pax_segvguard_elf_flags_active(elf_flags)) { 365 flags |= P_PAX_GUARD; 366 } 367 #endif 368 369 epp->ep_pax_flags = flags; 370 } 371 372 #if defined(PAX_MPROTECT) || defined(PAX_SEGVGUARD) || defined(PAX_ASLR) 373 static inline bool 374 pax_flags_active(uint32_t flags, uint32_t opt) 375 { 376 if (!(flags & opt)) 377 return false; 378 return true; 379 } 380 #endif /* PAX_MPROTECT || PAX_SEGVGUARD || PAX_ASLR */ 381 382 #ifdef PAX_MPROTECT 383 static bool 384 pax_mprotect_elf_flags_active(uint32_t flags) 385 { 386 if (!pax_mprotect_enabled) 387 return false; 388 if (pax_mprotect_global && (flags & ELF_NOTE_PAX_NOMPROTECT) != 0) { 389 /* Mprotect explicitly disabled */ 390 return false; 391 } 392 if (!pax_mprotect_global && (flags & ELF_NOTE_PAX_MPROTECT) == 0) { 393 /* Mprotect not requested */ 394 return false; 395 } 396 return true; 397 } 398 399 void 400 pax_mprotect_adjust( 401 #ifdef PAX_MPROTECT_DEBUG 402 const char *file, size_t line, 403 #endif 404 struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 405 { 406 uint32_t flags; 407 408 flags = l->l_proc->p_pax; 409 if (!pax_flags_active(flags, P_PAX_MPROTECT)) 410 return; 411 412 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 413 #ifdef PAX_MPROTECT_DEBUG 414 struct proc *p = l->l_proc; 415 if ((*prot & VM_PROT_EXECUTE) && pax_mprotect_debug) { 416 printf("%s: %s,%zu: %d.%d (%s): -x\n", 417 __func__, file, line, 418 p->p_pid, l->l_lid, p->p_comm); 419 } 420 #endif 421 *prot &= ~VM_PROT_EXECUTE; 422 *maxprot &= ~VM_PROT_EXECUTE; 423 } else { 424 #ifdef PAX_MPROTECT_DEBUG 425 struct proc *p = l->l_proc; 426 if ((*prot & VM_PROT_WRITE) && pax_mprotect_debug) { 427 printf("%s: %s,%zu: %d.%d (%s): -w\n", 428 __func__, file, line, 429 p->p_pid, l->l_lid, p->p_comm); 430 } 431 #endif 432 *prot &= ~VM_PROT_WRITE; 433 *maxprot &= ~VM_PROT_WRITE; 434 } 435 } 436 #endif /* PAX_MPROTECT */ 437 438 #ifdef PAX_ASLR 439 static bool 440 pax_aslr_elf_flags_active(uint32_t flags) 441 { 442 if (!pax_aslr_enabled) 443 return false; 444 if (pax_aslr_global && (flags & ELF_NOTE_PAX_NOASLR) != 0) { 445 /* ASLR explicitly disabled */ 446 return false; 447 } 448 if (!pax_aslr_global && (flags & ELF_NOTE_PAX_ASLR) == 0) { 449 /* ASLR not requested */ 450 return false; 451 } 452 return true; 453 } 454 455 static bool 456 pax_aslr_epp_active(struct exec_package *epp) 457 { 458 if (__predict_false((epp->ep_flags & (EXEC_32|EXEC_TOPDOWN_VM)) == 0)) 459 return false; 460 return pax_flags_active(epp->ep_pax_flags, P_PAX_ASLR); 461 } 462 463 static bool 464 pax_aslr_active(struct lwp *l) 465 { 466 return pax_flags_active(l->l_proc->p_pax, P_PAX_ASLR); 467 } 468 469 void 470 pax_aslr_init_vm(struct lwp *l, struct vmspace *vm, struct exec_package *ep) 471 { 472 if (!pax_aslr_active(l)) 473 return; 474 475 if (__predict_false((ep->ep_flags & (EXEC_32|EXEC_TOPDOWN_VM)) == 0)) 476 return; 477 478 #ifdef PAX_ASLR_DEBUG 479 if (pax_aslr_flags & PAX_ASLR_MMAP) 480 return; 481 #endif 482 483 uint32_t len = (ep->ep_flags & EXEC_32) ? 484 PAX_ASLR_DELTA_MMAP_LEN32 : PAX_ASLR_DELTA_MMAP_LEN; 485 486 uint32_t rand = cprng_fast32(); 487 #ifdef PAX_ASLR_DEBUG 488 if (pax_aslr_flags & PAX_ASLR_FIXED) 489 rand = pax_aslr_rand; 490 #endif 491 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(rand, 492 PAX_ASLR_DELTA_MMAP_LSB, len); 493 494 PAX_DPRINTF("delta_mmap=%#jx/%u", 495 (uintmax_t)vm->vm_aslr_delta_mmap, len); 496 } 497 498 void 499 pax_aslr_mmap(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 500 { 501 if (!pax_aslr_active(l)) 502 return; 503 #ifdef PAX_ASLR_DEBUG 504 char buf[256]; 505 506 if (pax_aslr_flags & PAX_ASLR_MMAP) 507 return; 508 509 if (pax_aslr_debug) 510 snprintb(buf, sizeof(buf), MAP_FMT, f); 511 else 512 buf[0] = '\0'; 513 #endif 514 515 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 516 PAX_DPRINTF("applying to %#jx orig_addr=%#jx f=%s", 517 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 518 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 519 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 520 else 521 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 522 PAX_DPRINTF("result %#jx", (uintmax_t)*addr); 523 } else { 524 PAX_DPRINTF("not applying to %#jx orig_addr=%#jx f=%s", 525 (uintmax_t)*addr, (uintmax_t)orig_addr, buf); 526 } 527 } 528 529 static vaddr_t 530 pax_aslr_offset(vaddr_t align) 531 { 532 size_t pax_align, l2, delta; 533 uint32_t rand; 534 vaddr_t offset; 535 536 pax_align = align == 0 ? PGSHIFT : align; 537 l2 = ilog2(pax_align); 538 539 rand = cprng_fast32(); 540 #ifdef PAX_ASLR_DEBUG 541 if (pax_aslr_flags & PAX_ASLR_FIXED) 542 rand = pax_aslr_rand; 543 #endif 544 545 #define PAX_TRUNC(a, b) ((a) & ~((b) - 1)) 546 547 delta = PAX_ASLR_DELTA(rand, l2, PAX_ASLR_DELTA_EXEC_LEN); 548 offset = PAX_TRUNC(delta, pax_align) + PAGE_SIZE; 549 550 PAX_DPRINTF("rand=%#x l2=%#zx pax_align=%#zx delta=%#zx offset=%#jx", 551 rand, l2, pax_align, delta, (uintmax_t)offset); 552 553 return offset; 554 } 555 556 vaddr_t 557 pax_aslr_exec_offset(struct exec_package *epp, vaddr_t align) 558 { 559 if (!pax_aslr_epp_active(epp)) 560 goto out; 561 562 #ifdef PAX_ASLR_DEBUG 563 if (pax_aslr_flags & PAX_ASLR_EXEC_OFFSET) 564 goto out; 565 #endif 566 return pax_aslr_offset(align) + PAGE_SIZE; 567 out: 568 return MAX(align, PAGE_SIZE); 569 } 570 571 voff_t 572 pax_aslr_rtld_offset(struct exec_package *epp, vaddr_t align, int use_topdown) 573 { 574 voff_t offset; 575 576 if (!pax_aslr_epp_active(epp)) 577 return 0; 578 579 #ifdef PAX_ASLR_DEBUG 580 if (pax_aslr_flags & PAX_ASLR_RTLD_OFFSET) 581 return 0; 582 #endif 583 offset = pax_aslr_offset(align); 584 if (use_topdown) 585 offset = -offset; 586 587 return offset; 588 } 589 590 void 591 pax_aslr_stack(struct exec_package *epp, u_long *max_stack_size) 592 { 593 if (!pax_aslr_epp_active(epp)) 594 return; 595 #ifdef PAX_ASLR_DEBUG 596 if (pax_aslr_flags & PAX_ASLR_STACK) 597 return; 598 #endif 599 600 uint32_t len = (epp->ep_flags & EXEC_32) ? 601 PAX_ASLR_DELTA_STACK_LEN32 : PAX_ASLR_DELTA_STACK_LEN; 602 uint32_t rand = cprng_fast32(); 603 #ifdef PAX_ASLR_DEBUG 604 if (pax_aslr_flags & PAX_ASLR_FIXED) 605 rand = pax_aslr_rand; 606 #endif 607 u_long d = PAX_ASLR_DELTA(rand, PAX_ASLR_DELTA_STACK_LSB, len); 608 d &= (*max_stack_size / PAX_ASLR_MAX_STACK_WASTE) - 1; 609 u_long newminsaddr = (u_long)STACK_GROW(epp->ep_minsaddr, d); 610 PAX_DPRINTF("old minsaddr=%#jx delta=%#lx new minsaddr=%#lx", 611 (uintmax_t)epp->ep_minsaddr, d, newminsaddr); 612 epp->ep_minsaddr = (vaddr_t)newminsaddr; 613 *max_stack_size -= d; 614 } 615 616 uint32_t 617 pax_aslr_stack_gap(struct exec_package *epp) 618 { 619 if (!pax_aslr_epp_active(epp)) 620 return 0; 621 622 #ifdef PAX_ASLR_DEBUG 623 if (pax_aslr_flags & PAX_ASLR_STACK_GAP) 624 return 0; 625 #endif 626 627 uint32_t rand = cprng_fast32(); 628 #ifdef PAX_ASLR_DEBUG 629 if (pax_aslr_flags & PAX_ASLR_FIXED) 630 rand = pax_aslr_rand; 631 #endif 632 rand %= PAGE_SIZE; 633 PAX_DPRINTF("stack gap=%#x\n", rand); 634 return rand; 635 } 636 #endif /* PAX_ASLR */ 637 638 #ifdef PAX_SEGVGUARD 639 static bool 640 pax_segvguard_elf_flags_active(uint32_t flags) 641 { 642 if (!pax_segvguard_enabled) 643 return false; 644 if (pax_segvguard_global && (flags & ELF_NOTE_PAX_NOGUARD) != 0) { 645 /* Segvguard explicitly disabled */ 646 return false; 647 } 648 if (!pax_segvguard_global && (flags & ELF_NOTE_PAX_GUARD) == 0) { 649 /* Segvguard not requested */ 650 return false; 651 } 652 return true; 653 } 654 655 static void 656 pax_segvguard_cleanup_cb(void *v) 657 { 658 struct pax_segvguard_entry *p = v; 659 struct pax_segvguard_uid_entry *up; 660 661 if (p == NULL) { 662 return; 663 } 664 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 665 LIST_REMOVE(up, sue_list); 666 kmem_free(up, sizeof(*up)); 667 } 668 kmem_free(p, sizeof(*p)); 669 } 670 671 /* 672 * Called when a process of image vp generated a segfault. 673 */ 674 int 675 pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 676 bool crashed) 677 { 678 struct pax_segvguard_entry *p; 679 struct pax_segvguard_uid_entry *up; 680 struct timeval tv; 681 uid_t uid; 682 uint32_t flags; 683 bool have_uid; 684 685 flags = l->l_proc->p_pax; 686 if (!pax_flags_active(flags, P_PAX_GUARD)) 687 return 0; 688 689 if (vp == NULL) 690 return EFAULT; 691 692 /* Check if we already monitor the file. */ 693 p = fileassoc_lookup(vp, segvguard_id); 694 695 /* Fast-path if starting a program we don't know. */ 696 if (p == NULL && !crashed) 697 return 0; 698 699 microtime(&tv); 700 701 /* 702 * If a program we don't know crashed, we need to create a new entry 703 * for it. 704 */ 705 if (p == NULL) { 706 p = kmem_alloc(sizeof(*p), KM_SLEEP); 707 fileassoc_add(vp, segvguard_id, p); 708 LIST_INIT(&p->segv_uids); 709 710 /* 711 * Initialize a new entry with "crashes so far" of 1. 712 * The expiry time is when we purge the entry if it didn't 713 * reach the limit. 714 */ 715 up = kmem_alloc(sizeof(*up), KM_SLEEP); 716 up->sue_uid = kauth_cred_getuid(l->l_cred); 717 up->sue_ncrashes = 1; 718 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 719 up->sue_suspended = 0; 720 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 721 return 0; 722 } 723 724 /* 725 * A program we "know" either executed or crashed again. 726 * See if it's a culprit we're familiar with. 727 */ 728 uid = kauth_cred_getuid(l->l_cred); 729 have_uid = false; 730 LIST_FOREACH(up, &p->segv_uids, sue_list) { 731 if (up->sue_uid == uid) { 732 have_uid = true; 733 break; 734 } 735 } 736 737 /* 738 * It's someone else. Add an entry for him if we crashed. 739 */ 740 if (!have_uid) { 741 if (crashed) { 742 up = kmem_alloc(sizeof(*up), KM_SLEEP); 743 up->sue_uid = uid; 744 up->sue_ncrashes = 1; 745 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 746 up->sue_suspended = 0; 747 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 748 } 749 return 0; 750 } 751 752 if (crashed) { 753 /* Check if timer on previous crashes expired first. */ 754 if (up->sue_expiry < tv.tv_sec) { 755 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 756 " expired.\n", name ? name : "unknown"); 757 up->sue_ncrashes = 1; 758 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 759 up->sue_suspended = 0; 760 return 0; 761 } 762 763 up->sue_ncrashes++; 764 765 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 766 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 767 "execution for %d seconds after %zu crashes.\n", 768 name ? name : "unknown", pax_segvguard_suspension, 769 up->sue_ncrashes); 770 771 /* Suspend this program for a while. */ 772 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 773 up->sue_ncrashes = 0; 774 up->sue_expiry = 0; 775 } 776 } else { 777 /* Are we supposed to be suspended? */ 778 if (up->sue_suspended > tv.tv_sec) { 779 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 780 "execution due to repeated segfaults.\n", name ? 781 name : "unknown"); 782 return EPERM; 783 } 784 } 785 786 return 0; 787 } 788 #endif /* PAX_SEGVGUARD */ 789
Indexes created Sun Sep 21 16:09:51 GMT 2025