Home | History | Annotate | Line # | Download | only in kern
kern_pax.c revision 1.7 
      1 /* $NetBSD: kern_pax.c,v 1.7 2006/11/22 00:41:38 elad Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *      This product includes software developed by Elad Efrat.
     18  * 4. The name of the author may not be used to endorse or promote products
     19  *    derived from this software without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 #include "opt_pax.h"
     34 
     35 #include <sys/param.h>
     36 #include <sys/proc.h>
     37 #include <sys/exec_elf.h>
     38 #include <sys/pax.h>
     39 #include <sys/sysctl.h>
     40 
     41 #ifdef PAX_MPROTECT
     42 static int pax_mprotect_enabled = 1;
     43 static int pax_mprotect_global = PAX_MPROTECT;
     44 
     45 specificdata_key_t pax_mprotect_key;
     46 #endif /* PAX_MPROTECT */
     47 
     48 /* PaX internal setspecific flags */
     49 #define	PAX_MPROTECT_EXPLICIT_ENABLE	(void *)0x01
     50 #define	PAX_MPROTECT_EXPLICIT_DISABLE	(void *)0x02
     51 
     52 SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup")
     53 {
     54 	const struct sysctlnode *rnode = NULL;
     55 
     56         sysctl_createv(clog, 0, NULL, &rnode,
     57                        CTLFLAG_PERMANENT,
     58                        CTLTYPE_NODE, "security", NULL,
     59                        NULL, 0, NULL, 0,
     60                        CTL_CREATE, CTL_EOL);
     61 
     62 	sysctl_createv(clog, 0, &rnode, &rnode,
     63 		       CTLFLAG_PERMANENT,
     64 		       CTLTYPE_NODE, "pax",
     65 		       SYSCTL_DESCR("PaX (exploit mitigation) features."),
     66 		       NULL, 0, NULL, 0,
     67 		       CTL_CREATE, CTL_EOL);
     68 
     69 #ifdef PAX_MPROTECT
     70 	sysctl_createv(clog, 0, &rnode, &rnode,
     71 		       CTLFLAG_PERMANENT,
     72 		       CTLTYPE_NODE, "mprotect",
     73 		       SYSCTL_DESCR("mprotect(2) W^X restrictions."),
     74 		       NULL, 0, NULL, 0,
     75 		       CTL_CREATE, CTL_EOL);
     76 	sysctl_createv(clog, 0, &rnode, NULL,
     77 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
     78 		       CTLTYPE_INT, "enabled",
     79 		       SYSCTL_DESCR("Restrictions enabled."),
     80 		       NULL, 0, &pax_mprotect_enabled, 0,
     81 		       CTL_CREATE, CTL_EOL);
     82 	sysctl_createv(clog, 0, &rnode, NULL,
     83 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
     84 		       CTLTYPE_INT, "global",
     85 		       SYSCTL_DESCR("When enabled, unless explicitly "
     86 				    "specified, apply restrictions to "
     87 				    "all processes."),
     88 		       NULL, 0, &pax_mprotect_global, 0,
     89 		       CTL_CREATE, CTL_EOL);
     90 #endif /* PAX_MPROTECT */
     91 }
     92 
     93 /*
     94  * Initialize PaX.
     95  */
     96 void
     97 pax_init(void)
     98 {
     99 #ifdef PAX_MPROTECT
    100 	proc_specific_key_create(&pax_mprotect_key, NULL);
    101 #endif /* PAX_MPROTECT */
    102 }
    103 
    104 void
    105 pax_adjust(struct lwp *l, int f)
    106 {
    107 #ifdef PAX_MPROTECT
    108 	if (pax_mprotect_enabled) {
    109 		if (f & PF_PAXMPROTECT)
    110 			proc_setspecific(l->l_proc, pax_mprotect_key,
    111 			    PAX_MPROTECT_EXPLICIT_ENABLE);
    112 		if (f & PF_PAXNOMPROTECT)
    113 			proc_setspecific(l->l_proc, pax_mprotect_key,
    114 			    PAX_MPROTECT_EXPLICIT_DISABLE);
    115 	}
    116 #endif /* PAX_MPROTECT */
    117 }
    118 
    119 #ifdef PAX_MPROTECT
    120 void
    121 pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot)
    122 {
    123 	void *t;
    124 
    125 	if (!pax_mprotect_enabled)
    126 		return;
    127 
    128 	t = proc_getspecific(l->l_proc, pax_mprotect_key);
    129 	if ((pax_mprotect_global && t == PAX_MPROTECT_EXPLICIT_DISABLE) ||
    130 	    (!pax_mprotect_global && t != PAX_MPROTECT_EXPLICIT_ENABLE))
    131 		return;
    132 
    133 	if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) {
    134 		*prot &= ~VM_PROT_EXECUTE;
    135 		*maxprot &= ~VM_PROT_EXECUTE;
    136 	} else {
    137 		*prot &= ~VM_PROT_WRITE;
    138 		*maxprot &= ~VM_PROT_WRITE;
    139 	}
    140 }
    141 #endif /* PAX_MPROTECT */
    142