Repurpose the "syscalls must be on a writeable page" mechanism to

enforce a new policy: system calls must be in pre-registered regions.
We have discussed more strict checks than this, but none satisfy the
cost/benefit based upon our understanding of attack methods, anyways
let's see what the next iteration looks like.

This is intended to harden (translation: attackers must put extra
effort into attacking) against a mixture of W^X failures and JIT bugs
which allow syscall misinterpretation, especially in environments with
polymorphic-instruction/variable-sized instructions.  It fits in a bit
with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash
behaviour, particularily for remote problems. Less effective once on-host
since someone the libraries can be read.

For static-executables the kernel registers the main program's
PIE-mapped exec section valid, as well as the randomly-placed sigtramp
page.  For dynamic executables ELF ld.so's exec segment is also
labelled valid; ld.so then has enough information to register libc's
exec section as valid via call-once msyscall(2)

For dynamic binaries, we continue to to permit the main program exec
segment because "go" (and potentially a few other applications) have
embedded system calls in the main program.  Hopefully at least go gets
fixed soon.

We declare the concept of embedded syscalls a bad idea for numerous
reasons, as we notice the ecosystem has many of
static-syscall-in-base-binary which are dynamically linked against
libraries which in turn use libc, which contains another set of
syscall stubs.  We've been concerned about adding even one additional
syscall entry point... but go's approach tends to double the entry-point
attack surface.

This was started at a nano-hackathon in Bob Beck's basement 2 weeks
ago during a long discussion with mortimer trying to hide from the SSL
scream-conversations, and finished in more comfortable circumstances
next to a wood-stove at Elk Lakes cabin with UVM scream-conversations.

ok guenther kettenis mortimer, lots of feedback from others
conversations about go with jsing tb sthen

1 files changed, 17 insertions, 17 deletions

diff --git a/sys/sys/exec_elf.h b/sys/sys/exec_elf.h
index 21d9ea72813..403221a3b3b 100644
--- a/sys/sys/exec_elf.h
+++ b/sys/sys/exec_elf.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exec_elf.h,v 1.84 2019/04/20 23:10:00 deraadt Exp $	*/
+/*	$OpenBSD: exec_elf.h,v 1.85 2019/11/29 06:34:46 deraadt Exp $	*/
 /*
  * Copyright (c) 1995, 1996 Erik Theisen.  All rights reserved.
  *
@@ -56,7 +56,7 @@ typedef __int64_t	Elf64_Sxword;
 typedef __uint64_t	Elf64_Xword;
 typedef __uint64_t	Elf64_Lword;
 
-typedef __uint32_t	Elf64_Half;
+typedef __uint16_t	Elf64_Half;
 typedef __uint16_t	Elf64_Quarter;
 
 /*
@@ -141,11 +141,11 @@ typedef struct {
 	unsigned char	e_ident[EI_NIDENT];	/* Id bytes */
 	Elf64_Quarter	e_type;			/* file type */
 	Elf64_Quarter	e_machine;		/* machine type */
-	Elf64_Half	e_version;		/* version number */
+	Elf64_Word	e_version;		/* version number */
 	Elf64_Addr	e_entry;		/* entry point */
 	Elf64_Off	e_phoff;		/* Program hdr offset */
 	Elf64_Off	e_shoff;		/* Section hdr offset */
-	Elf64_Half	e_flags;		/* Processor flags */
+	Elf64_Word	e_flags;		/* Processor flags */
 	Elf64_Quarter	e_ehsize;		/* sizeof ehdr */
 	Elf64_Quarter	e_phentsize;		/* Program header entry size */
 	Elf64_Quarter	e_phnum;		/* Number of program headers */
@@ -225,14 +225,14 @@ typedef struct {
 } Elf32_Shdr;
 
 typedef struct {
-	Elf64_Half	sh_name;	/* section name */
-	Elf64_Half	sh_type;	/* section type */
+	Elf64_Word	sh_name;	/* section name */
+	Elf64_Word	sh_type;	/* section type */
 	Elf64_Xword	sh_flags;	/* section flags */
 	Elf64_Addr	sh_addr;	/* virtual address */
 	Elf64_Off	sh_offset;	/* file offset */
 	Elf64_Xword	sh_size;	/* section size */
-	Elf64_Half	sh_link;	/* link to another */
-	Elf64_Half	sh_info;	/* misc info */
+	Elf64_Word	sh_link;	/* link to another */
+	Elf64_Word	sh_info;	/* misc info */
 	Elf64_Xword	sh_addralign;	/* memory alignment */
 	Elf64_Xword	sh_entsize;	/* table entry size */
 } Elf64_Shdr;
@@ -335,7 +335,7 @@ typedef struct elf32_sym {
 } Elf32_Sym;
 
 typedef struct {
-	Elf64_Half	st_name;	/* Symbol name index in str table */
+	Elf64_Word	st_name;	/* Symbol name index in str table */
 	Elf_Byte	st_info;	/* type / binding attrs */
 	Elf_Byte	st_other;	/* unused */
 	Elf64_Quarter	st_shndx;	/* section index of symbol */
@@ -443,8 +443,8 @@ typedef struct {
 } Elf32_Phdr;
 
 typedef struct {
-	Elf64_Half	p_type;		/* entry type */
-	Elf64_Half	p_flags;	/* flags */
+	Elf64_Word	p_type;		/* entry type */
+	Elf64_Word	p_flags;	/* flags */
 	Elf64_Off	p_offset;	/* offset */
 	Elf64_Addr	p_vaddr;	/* virtual address */
 	Elf64_Addr	p_paddr;	/* physical address */
@@ -578,9 +578,9 @@ typedef struct {
 } Elf32_Nhdr;
 
 typedef struct {
-	Elf64_Half n_namesz;
-	Elf64_Half n_descsz;
-	Elf64_Half n_type;
+	Elf64_Word n_namesz;
+	Elf64_Word n_descsz;
+	Elf64_Word n_type;
 } Elf64_Nhdr;
 
 /*
@@ -593,9 +593,9 @@ typedef struct {
 } Elf32_Note;
 
 typedef struct {
-	Elf64_Half namesz;
-	Elf64_Half descsz;
-	Elf64_Half type;
+	Elf64_Word namesz;
+	Elf64_Word descsz;
+	Elf64_Word type;
 } Elf64_Note;
 
 /* Values for n_type. */