1 /* $NetBSD: t_mprotect.c,v 1.9 2020/04/18 17:44:53 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2011, 2020 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jukka Ruohonen. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 #include <sys/cdefs.h> 32 __RCSID("$NetBSD: t_mprotect.c,v 1.9 2020/04/18 17:44:53 christos Exp $"); 33 34 #include <sys/param.h> 35 #include <sys/mman.h> 36 #include <sys/sysctl.h> 37 #include <sys/wait.h> 38 39 #include <errno.h> 40 #include <fcntl.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <unistd.h> 44 45 #include <atf-c.h> 46 47 #include "../common/exec_prot.h" 48 #include "t_mprotect_helper.h" 49 50 static long page = 0; 51 static char path[] = "mmap"; 52 53 static void sighandler(int); 54 static bool paxinit(void); 55 56 static void 57 sighandler(int signo) 58 { 59 _exit(signo); 60 } 61 62 static bool 63 paxinit(void) 64 { 65 size_t len = sizeof(int); 66 int pax_flags; 67 int rv; 68 69 rv = sysctlbyname("proc.curproc.paxflags", 70 &pax_flags, &len, NULL, 0); 71 72 if (rv != 0) 73 return false; 74 75 return ((pax_flags & CTL_PROC_PAXFLAGS_MPROTECT) != 0); 76 } 77 78 ATF_TC_WITH_CLEANUP(mprotect_access); 79 ATF_TC_HEAD(mprotect_access, tc) 80 { 81 atf_tc_set_md_var(tc, "descr", "Test for EACCES from mprotect(2)"); 82 } 83 84 ATF_TC_BODY(mprotect_access, tc) 85 { 86 int prot[2] = { PROT_NONE, PROT_READ }; 87 void *map; 88 size_t i; 89 int fd; 90 91 fd = open(path, O_RDONLY | O_CREAT, 0600); 92 ATF_REQUIRE(fd >= 0); 93 94 /* 95 * The call should fail with EACCES if we try to mark 96 * a PROT_NONE or PROT_READ file/section as PROT_WRITE. 97 */ 98 for (i = 0; i < __arraycount(prot); i++) { 99 100 map = mmap(NULL, page, prot[i], MAP_SHARED, fd, 0); 101 102 if (map == MAP_FAILED) 103 continue; 104 105 errno = 0; 106 107 ATF_REQUIRE(mprotect(map, page, PROT_WRITE) != 0); 108 ATF_REQUIRE(errno == EACCES); 109 ATF_REQUIRE(munmap(map, page) == 0); 110 } 111 112 ATF_REQUIRE(close(fd) == 0); 113 } 114 115 ATF_TC_CLEANUP(mprotect_access, tc) 116 { 117 (void)unlink(path); 118 } 119 120 ATF_TC(mprotect_err); 121 ATF_TC_HEAD(mprotect_err, tc) 122 { 123 atf_tc_set_md_var(tc, "descr", "Test error conditions of mprotect(2)"); 124 } 125 126 ATF_TC_BODY(mprotect_err, tc) 127 { 128 errno = 0; 129 130 ATF_REQUIRE(mprotect((char *)-1, 1, PROT_READ) != 0); 131 ATF_REQUIRE(errno == EINVAL); 132 } 133 134 ATF_TC(mprotect_exec); 135 ATF_TC_HEAD(mprotect_exec, tc) 136 { 137 atf_tc_set_md_var(tc, "descr", 138 "Test mprotect(2) executable space protections"); 139 } 140 141 /* 142 * Trivial function -- should fit into a page 143 */ 144 ATF_TC_BODY(mprotect_exec, tc) 145 { 146 pid_t pid; 147 void *map; 148 int sta, xp_support; 149 150 xp_support = exec_prot_support(); 151 152 switch (xp_support) { 153 case NOTIMPL: 154 atf_tc_skip( 155 "Execute protection callback check not implemented"); 156 break; 157 case NO_XP: 158 atf_tc_skip( 159 "Host does not support executable space protection"); 160 break; 161 case PARTIAL_XP: case PERPAGE_XP: default: 162 break; 163 } 164 165 /* 166 * Map a page read/write and copy a trivial assembly function inside. 167 * We will then change the mapping rights: 168 * - first by setting the execution right, and check that we can 169 * call the code found in the allocated page. 170 * - second by removing the execution right. This should generate 171 * a SIGSEGV on architectures that can enforce --x permissions. 172 */ 173 174 map = mmap(NULL, page, PROT_MPROTECT(PROT_EXEC)|PROT_WRITE|PROT_READ, 175 MAP_ANON, -1, 0); 176 ATF_REQUIRE(map != MAP_FAILED); 177 178 memcpy(map, (void *)return_one, 179 (uintptr_t)return_one_end - (uintptr_t)return_one); 180 181 /* give r-x rights then call code in page */ 182 ATF_REQUIRE(mprotect(map, page, PROT_EXEC|PROT_READ) == 0); 183 ATF_REQUIRE(((int (*)(void))map)() == 1); 184 185 /* remove --x right */ 186 ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0); 187 188 pid = fork(); 189 ATF_REQUIRE(pid >= 0); 190 191 if (pid == 0) { 192 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 193 ATF_CHECK(((int (*)(void))map)() == 1); 194 _exit(0); 195 } 196 197 (void)wait(&sta); 198 199 ATF_REQUIRE(munmap(map, page) == 0); 200 201 ATF_REQUIRE(WIFEXITED(sta) != 0); 202 203 switch (xp_support) { 204 case PARTIAL_XP: 205 /* Partial protection might fail; skip the test when it does */ 206 if (WEXITSTATUS(sta) != SIGSEGV) { 207 atf_tc_skip("Host only supports " 208 "partial executable space protection"); 209 } 210 break; 211 case PERPAGE_XP: default: 212 /* Per-page --x protection should not fail */ 213 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 214 break; 215 } 216 } 217 218 ATF_TC(mprotect_pax); 219 ATF_TC_HEAD(mprotect_pax, tc) 220 { 221 atf_tc_set_md_var(tc, "descr", "PaX restrictions and mprotect(2)"); 222 atf_tc_set_md_var(tc, "require.user", "root"); 223 } 224 225 ATF_TC_BODY(mprotect_pax, tc) 226 { 227 const int prot[4] = { PROT_NONE, PROT_READ, PROT_WRITE }; 228 const char *str = NULL; 229 void *map; 230 size_t i; 231 int rv; 232 233 if (!paxinit()) 234 atf_tc_skip("PaX MPROTECT restrictions not enabled"); 235 236 /* 237 * As noted in the original PaX documentation [1], 238 * the following restrictions should apply: 239 * 240 * (1) creating executable anonymous mappings 241 * 242 * (2) creating executable/writable file mappings 243 * 244 * (3) making a non-executable mapping executable 245 * 246 * (4) making an executable/read-only file mapping 247 * writable except for performing relocations 248 * on an ET_DYN ELF file (non-PIC shared library) 249 * 250 * The following will test only the case (3). 251 * 252 * [1] http://pax.grsecurity.net/docs/mprotect.txt 253 * 254 * (Sun Apr 3 11:06:53 EEST 2011.) 255 */ 256 for (i = 0; i < __arraycount(prot); i++) { 257 258 map = mmap(NULL, page, prot[i], MAP_ANON, -1, 0); 259 260 if (map == MAP_FAILED) 261 continue; 262 263 rv = mprotect(map, 1, prot[i] | PROT_EXEC); 264 265 (void)munmap(map, page); 266 267 if (rv == 0) { 268 str = "non-executable mapping made executable"; 269 goto out; 270 } 271 } 272 273 out: 274 if (str != NULL) 275 atf_tc_fail("%s", str); 276 } 277 278 ATF_TC(mprotect_write); 279 ATF_TC_HEAD(mprotect_write, tc) 280 { 281 atf_tc_set_md_var(tc, "descr", "Test mprotect(2) write protections"); 282 } 283 284 ATF_TC_BODY(mprotect_write, tc) 285 { 286 pid_t pid; 287 void *map; 288 int sta; 289 290 /* 291 * Map a page read/write, change the protection 292 * to read-only with mprotect(2), and try to write 293 * to the page. This should generate a SIGSEGV. 294 */ 295 map = mmap(NULL, page, PROT_WRITE|PROT_READ, MAP_ANON, -1, 0); 296 ATF_REQUIRE(map != MAP_FAILED); 297 298 ATF_REQUIRE(strlcpy(map, "XXX", 3) == 3); 299 ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0); 300 301 pid = fork(); 302 ATF_REQUIRE(pid >= 0); 303 304 if (pid == 0) { 305 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 306 ATF_REQUIRE(strlcpy(map, "XXX", 3) == 0); 307 } 308 309 (void)wait(&sta); 310 311 ATF_REQUIRE(WIFEXITED(sta) != 0); 312 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 313 ATF_REQUIRE(munmap(map, page) == 0); 314 } 315 316 ATF_TC(mprotect_mremap_exec); 317 ATF_TC_HEAD(mprotect_mremap_exec, tc) 318 { 319 atf_tc_set_md_var(tc, "descr", 320 "Test mremap(2)+mprotect(2) executable space protections"); 321 } 322 323 /* 324 * Trivial function -- should fit into a page 325 */ 326 ATF_TC_BODY(mprotect_mremap_exec, tc) 327 { 328 void *map, *map2; 329 pid_t pid; 330 int sta; 331 332 /* 333 * Map a page read/write/exec and duplicate it. 334 * Map the copy executable. 335 * Copy a trivial assembly function to the writeable mapping. 336 * Try to execute it. This should never create a SIGSEGV. 337 */ 338 339 map = mmap(NULL, page, PROT_MPROTECT(PROT_EXEC|PROT_WRITE|PROT_READ), 340 MAP_ANON, -1, 0); 341 ATF_REQUIRE(map != MAP_FAILED); 342 map2 = mremap(map, page, NULL, page, MAP_REMAPDUP); 343 ATF_REQUIRE(map2 != MAP_FAILED); 344 ATF_REQUIRE(mprotect(map, page, PROT_WRITE|PROT_READ) == 0); 345 ATF_REQUIRE(mprotect(map2, page, PROT_EXEC|PROT_READ) == 0); 346 347 memcpy(map, (void *)return_one, 348 (uintptr_t)return_one_end - (uintptr_t)return_one); 349 __builtin___clear_cache(map, (void *)((uintptr_t)map + page)); 350 351 ATF_REQUIRE(((int (*)(void))map2)() == 1); 352 353 /* Double check that the executable mapping is not writeable. */ 354 pid = fork(); 355 ATF_REQUIRE(pid >= 0); 356 357 if (pid == 0) { 358 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 359 ATF_REQUIRE(strlcpy(map2, "XXX", 3) == 0); 360 } 361 362 (void)wait(&sta); 363 364 ATF_REQUIRE(WIFEXITED(sta) != 0); 365 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 366 367 if (exec_prot_support() == PERPAGE_XP) { 368 /* Double check that the writeable mapping is not executable. */ 369 pid = fork(); 370 ATF_REQUIRE(pid >= 0); 371 372 if (pid == 0) { 373 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 374 ATF_REQUIRE(((int (*)(void))map)() == 1); 375 } 376 377 (void)wait(&sta); 378 379 ATF_REQUIRE(WIFEXITED(sta) != 0); 380 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 381 } 382 383 ATF_REQUIRE(munmap(map, page) == 0); 384 ATF_REQUIRE(munmap(map2, page) == 0); 385 } 386 387 ATF_TC(mprotect_mremap_fork_exec); 388 ATF_TC_HEAD(mprotect_mremap_fork_exec, tc) 389 { 390 atf_tc_set_md_var(tc, "descr", 391 "Test mremap(2)+fork(2)+mprotect(2) executable space protections"); 392 } 393 394 ATF_TC_BODY(mprotect_mremap_fork_exec, tc) 395 { 396 void *map, *map2; 397 pid_t pid; 398 399 atf_tc_expect_fail("PR lib/55177"); 400 401 /* 402 * Map a page read/write/exec and duplicate it. 403 * Map the copy executable. 404 * Copy a function to the writeable mapping and execute it 405 * Fork a child and wait for it 406 * Copy a different function to the writeable mapping and execute it 407 * The original function shouldn't be called 408 */ 409 410 map = mmap(NULL, page, PROT_READ|PROT_WRITE|PROT_MPROTECT(PROT_EXEC), 411 MAP_ANON, -1, 0); 412 ATF_REQUIRE(map != MAP_FAILED); 413 map2 = mremap(map, page, NULL, page, MAP_REMAPDUP); 414 ATF_REQUIRE(map2 != MAP_FAILED); 415 ATF_REQUIRE(mprotect(map2, page, PROT_EXEC|PROT_READ) == 0); 416 417 memcpy(map, (void *)return_1, 418 (uintptr_t)return_2 - (uintptr_t)return_1); 419 __builtin___clear_cache(map, (void *)((uintptr_t)map + page)); 420 421 ATF_REQUIRE(((int (*)(void))map2)() == 1); 422 423 pid = fork(); 424 ATF_REQUIRE(pid >= 0); 425 426 if (pid == 0) 427 _exit(0); 428 429 (void)wait(NULL); 430 431 memcpy(map, (void *)return_2, 432 (uintptr_t)return_3 - (uintptr_t)return_2); 433 __builtin___clear_cache(map, (void *)((uintptr_t)map + page)); 434 435 ATF_REQUIRE(((int (*)(void))map2)() == 2); 436 437 ATF_REQUIRE(munmap(map, page) == 0); 438 ATF_REQUIRE(munmap(map2, page) == 0); 439 } 440 441 ATF_TP_ADD_TCS(tp) 442 { 443 page = sysconf(_SC_PAGESIZE); 444 ATF_REQUIRE(page >= 0); 445 446 ATF_TP_ADD_TC(tp, mprotect_access); 447 ATF_TP_ADD_TC(tp, mprotect_err); 448 ATF_TP_ADD_TC(tp, mprotect_exec); 449 ATF_TP_ADD_TC(tp, mprotect_pax); 450 ATF_TP_ADD_TC(tp, mprotect_write); 451 ATF_TP_ADD_TC(tp, mprotect_mremap_exec); 452 ATF_TP_ADD_TC(tp, mprotect_mremap_fork_exec); 453 454 return atf_no_error(); 455 } 456
Indexes created Sat Sep 20 22:09:52 GMT 2025