Home | History | Annotate | Line # | Download | only in paxctl
paxctl.c revision 1.1 
      1 /* $NetBSD: paxctl.c,v 1.1 2007/01/30 19:40:08 elad Exp $ */
      2 
      3 /*-
      4  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     28  */
     29 #if HAVE_NBTOOL_CONFIG_H
     30 #include "nbtool_config.h"
     31 #endif
     32 
     33 #include <sys/cdefs.h>
     34 #ifndef lint
     35 #ifdef __RCSID
     36 __RCSID("$NetBSD: paxctl.c,v 1.1 2007/01/30 19:40:08 elad Exp $");
     37 #endif
     38 #endif /* not lint */
     39 
     40 #include <sys/types.h>
     41 #ifdef HAVE_NBTOOL_CONFIG_H
     42 #include "../../sys/sys/exec_elf.h"
     43 #else
     44 #include <elf.h>
     45 #endif
     46 #include <stdio.h>
     47 #include <err.h>
     48 #include <fcntl.h>
     49 #include <unistd.h>
     50 #include <stdlib.h>
     51 #include <string.h>
     52 
     53 static void usage(void) __attribute__((__noreturn__));
     54 static int pax_flag(const char *);
     55 static int pax_flags_sane(u_long);
     56 static int pax_haveflags(u_long);
     57 static void pax_printflags(u_long);
     58 
     59 #ifndef PF_PAXMPROTECT
     60 #define PF_PAXMPROTECT		0x08000000
     61 #define PF_PAXNOMPROTECT	0x04000000
     62 #endif
     63 #ifndef PF_PAXGUARD
     64 #define PF_PAXGUARD		0x02000000
     65 #define PF_PAXNOGUARD		0x01000000
     66 #endif
     67 #ifndef __arraycount
     68 #define __arraycount(a) (sizeof(a) / sizeof(a[0]))
     69 #endif
     70 
     71 
     72 static const struct paxflag {
     73 	char mark;
     74 	const char *name;
     75 	int bits;
     76 } flags[] = {
     77 	{ 'G', "Segvguard, explicit enable", PF_PAXGUARD },
     78 	{ 'g', "Segvguard, explicit disable", PF_PAXNOGUARD },
     79 	{ 'M', "mprotect(2) restrictions, explicit enable", PF_PAXMPROTECT },
     80 	{ 'm', "mprotect(2) restrictions, explicit disable", PF_PAXNOMPROTECT },
     81 };
     82 
     83 static void
     84 usage(void)
     85 {
     86 	(void)fprintf(stderr, "Usage: %s [ <-|+><G|g|M|m> ] <file>\n",
     87 #if HAVE_NBTOOL_CONFIG_H
     88 	    "paxctl"
     89 #else
     90 	    getprogname()
     91 #endif
     92 	);
     93 	exit(1);
     94 }
     95 
     96 static int
     97 pax_flag(const char *s)
     98 {
     99 	size_t i;
    100 
    101 	if (s[0] == '\0' || s[1] != '\0')
    102 		return -1;
    103 
    104 	for (i = 0; i < __arraycount(flags); i++)
    105 		if (*s == flags[i].mark)
    106 			return flags[i].bits;
    107 
    108 	return -1;
    109 }
    110 
    111 static int
    112 pax_flags_sane(u_long f)
    113 {
    114 	size_t i;
    115 
    116 	for (i = 0; i < __arraycount(flags) - 1; i += 2) {
    117 		int g = flags[i].bits | flags[i+1].bits;
    118 		if ((f & g) == g)
    119 			return 0;
    120 	}
    121 
    122 	return 1;
    123 }
    124 
    125 static int
    126 pax_haveflags(u_long f)
    127 {
    128 	size_t i;
    129 
    130 	for (i = 0; i < __arraycount(flags); i++)
    131 		if (f & flags[i].bits)
    132 			return (1);
    133 
    134 	return (0);
    135 }
    136 
    137 static void
    138 pax_printflags(u_long f)
    139 {
    140 	size_t i;
    141 
    142 	for (i = 0; i < __arraycount(flags); i++)
    143 		if (f & flags[i].bits)
    144 			(void)printf("  %c: %s\n",
    145 			    flags[i].mark, flags[i].name);
    146 }
    147 
    148 int
    149 main(int argc, char **argv)
    150 {
    151 	union {
    152 	    Elf32_Ehdr h32;
    153 	    Elf64_Ehdr h64;
    154 	} e;
    155 	union {
    156 	    Elf32_Phdr h32;
    157 	    Elf64_Phdr h64;
    158 	} p;
    159 #define EH(field)	(size == 32 ? e.h32.field : e.h64.field)
    160 #define PH(field)	(size == 32 ? p.h32.field : p.h64.field)
    161 #define SPH(field, val)	do { \
    162     if (size == 32) \
    163 	    p.h32.field val; \
    164     else \
    165 	    p.h64.field val; \
    166 } while (/*CONSTCOND*/0)
    167 #define PHSIZE		(size == 32 ? sizeof(p.h32) : sizeof(p.h64))
    168 
    169 	int size;
    170 	char *opt = NULL;
    171 	int fd, i, add_flags = 0, del_flags = 0, list = 0, ok = 0, flagged = 0;
    172 
    173 	if (argc < 2)
    174 		usage();
    175 
    176 	for (i = 1; i < argc; i++) {
    177 		opt = argv[i];
    178 
    179 		if (*opt == '-' || *opt == '+') {
    180 			int t;
    181 
    182 			t = pax_flag(opt + 1);
    183 			if (t == -1)
    184 				usage();
    185 
    186 			if (*opt == '-')
    187 				del_flags |= t;
    188 			else
    189 				add_flags |= t;
    190 
    191 			opt = NULL;
    192 		} else
    193 			break;
    194 	}
    195 
    196 	if (opt == NULL)
    197 		usage();
    198 
    199 	if (add_flags || del_flags) {
    200 		if (list)
    201 			usage();
    202 	} else
    203 		list = 1;
    204 
    205 	fd = open(opt, O_RDWR, 0);
    206 	if (fd == -1) {
    207 		if (!list || (fd = open(opt, O_RDONLY, 0))  == -1)
    208 			err(EXIT_FAILURE, "Can't open `%s'", opt);
    209 	}
    210 
    211 	if (read(fd, &e, sizeof(e)) != sizeof(e))
    212 		err(EXIT_FAILURE, "Can't read ELF header from `%s'", opt);
    213 
    214 	if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0)
    215 		errx(EXIT_FAILURE,
    216 		    "Bad ELF magic from `%s' (maybe it's not an ELF?)", opt);
    217 
    218 	if (e.h32.e_ehsize == sizeof(e.h32))
    219 		size = 32;
    220 	else if (e.h64.e_ehsize == sizeof(e.h64))
    221 		size = 64;
    222 	else
    223 		errx(EXIT_FAILURE,
    224 		    "Bad ELF size %d from `%s' (maybe it's not an ELF?)",
    225 		    (int)e.h32.e_ehsize, opt);
    226 
    227 	for (i = 0; i < EH(e_phnum); i++) {
    228 		if (pread(fd, &p, PHSIZE,
    229 		    (off_t)EH(e_phoff) + i * PHSIZE) != PHSIZE)
    230 			err(EXIT_FAILURE, "Can't read data from `%s'", opt);
    231 
    232 		if (PH(p_type) != PT_NOTE)
    233 			continue;
    234 
    235 		ok = 1;
    236 
    237 		if (list) {
    238 			if (!pax_haveflags((u_long)PH(p_flags)))
    239 				break;
    240 
    241 			if (!pax_flags_sane((u_long)PH(p_flags)))
    242 				warnx("Current flags %lx don't make sense",
    243 				    (u_long)PH(p_flags));
    244 
    245 			(void)printf("PaX flags:\n");
    246 
    247 			pax_printflags((u_long)PH(p_flags));
    248 
    249 			flagged = 1;
    250 
    251 			break;
    252 		}
    253 
    254 		SPH(p_flags, |= add_flags);
    255 		SPH(p_flags, &= ~del_flags);
    256 
    257 		if (!pax_flags_sane((u_long)PH(p_flags)))
    258 			errx(EXIT_FAILURE, "New flags %lx don't make sense",
    259 			    (u_long)PH(p_flags));
    260 
    261 		if (pwrite(fd, &p, PHSIZE,
    262 		    (off_t)EH(e_phoff) + i * PHSIZE) != PHSIZE)
    263 			err(EXIT_FAILURE, "Can't modify flags on `%s'", opt);
    264 
    265 		break;
    266 	}
    267 
    268 	(void)close(fd);
    269 
    270 	if (!ok)
    271 		errx(EXIT_FAILURE,
    272 		    "Could not find an ELF PT_NOTE section in `%s'", opt);
    273 
    274 	if (list && !flagged)
    275 		(void)printf("No PaX flags.\n");
    276 	return 0;
    277 }
    278