summaryrefslogtreecommitdiffstats
path: root/sys/kern/exec_elf.c
AgeCommit message (Collapse)AuthorFilesLines
2020-01-25The ELF NOTE parser would only inspect the first NOTE for 'OpenBSD'.deraadt1-55/+77
Furthermore the parser was unaware a NOTE could contain multiple records. The scanner has been rewritten. Another bonus bug: if the binary was labelled as OPENBSD ABI, NOTE parsing was completely skipped so WXNEEDED wasn't learned either... Now that NOTEs are scanned correctly, search for the 'Go' NOTE. (During this work found the Go linker produces slightly broken NOTEs - Go team will probably fix that). Work is happening for our Go dynamic-binaries to use libc syscall stubs, but the change isn't ready. Go (and reportedly free-pascal also?) binaries are the only dynamic programs which require syscalls in the main-program. Since Go binaries are now identifiable, we can disable syscalls in all other regular dynamic-main-programs, gaining the strict enforcement we want. When the the Go-libc-stub change arrives we'll delete the Go NOTE scan and treat Go binaries same as regular binaries. This change probably breaks free-pascal, a lower priority item to repair. some discussion with jsing, ok kettenis
2019-12-09typoderaadt1-2/+2
2019-11-29Repurpose the "syscalls must be on a writeable page" mechanism toderaadt1-2/+15
enforce a new policy: system calls must be in pre-registered regions. We have discussed more strict checks than this, but none satisfy the cost/benefit based upon our understanding of attack methods, anyways let's see what the next iteration looks like. This is intended to harden (translation: attackers must put extra effort into attacking) against a mixture of W^X failures and JIT bugs which allow syscall misinterpretation, especially in environments with polymorphic-instruction/variable-sized instructions. It fits in a bit with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash behaviour, particularily for remote problems. Less effective once on-host since someone the libraries can be read. For static-executables the kernel registers the main program's PIE-mapped exec section valid, as well as the randomly-placed sigtramp page. For dynamic executables ELF ld.so's exec segment is also labelled valid; ld.so then has enough information to register libc's exec section as valid via call-once msyscall(2) For dynamic binaries, we continue to to permit the main program exec segment because "go" (and potentially a few other applications) have embedded system calls in the main program. Hopefully at least go gets fixed soon. We declare the concept of embedded syscalls a bad idea for numerous reasons, as we notice the ecosystem has many of static-syscall-in-base-binary which are dynamically linked against libraries which in turn use libc, which contains another set of syscall stubs. We've been concerned about adding even one additional syscall entry point... but go's approach tends to double the entry-point attack surface. This was started at a nano-hackathon in Bob Beck's basement 2 weeks ago during a long discussion with mortimer trying to hide from the SSL scream-conversations, and finished in more comfortable circumstances next to a wood-stove at Elk Lakes cabin with UVM scream-conversations. ok guenther kettenis mortimer, lots of feedback from others conversations about go with jsing tb sthen
2019-05-13When killing a process, the signal is handled by any thread thatbluhm1-2/+2
does not block the signal. If all threads block the signal, we delivered it to the main thread. This does not conform to POSIX. If any thread unblocks the signal, it should be delivered immediately to this thread. Mark such signals pending at the process instead of a single thread. Then any thread can handle it later. OK kettenis@ guenther@
2019-05-11wxneeded binaries on wxallowed filesystems were refused execution. We havederaadt1-14/+1
encountered a wxneeded binary that attempts correct operation when started on a nowxallowed filesystem (it tries mprotect with RWX, notices ENOTSUP and acts in a different way). So permit execution (but of course don't allow W^X violating mappings) ok sthen kettenis robert
2019-05-09If mallocing the array program header fails, give up on coredumpingguenther1-2/+4
instead of panicing ok deraadt@, tedu@, mpi@
2019-04-20#define ELFROUNDSIZE 4 /* XXX Should it be sizeof(Elf_Word)? */deraadt1-2/+2
Now that alpha is fixed, we can use sizeof().
2018-12-06Core files with >65535 sections have to use PN_XNUM and a section headerguenther1-8/+65
to pass the real count, with a minimal .shstrtab segment for consistency. Also, add support for PN_XNUM to readelf. problem reported and testing by claudio@ ok kettenis@
2018-08-05Decouple unveil from the pledge flags, by adding dedicated unveil flagsbeck1-1/+2
to the namei args. This fixes a bug where chmod would be allowed when with only READ. This also allows some further cleanup of some awkward things like PLEDGE_STAT that will follow Lots of assistence from semarie@ - thanks! ok semarie@
2018-07-20Remove a few leftovers from the days of emulation, which could result inderaadt1-3/+2
a bad/corrupt binary not returning ENOEXEC but some other error. ok guenther kettenis bluhm
2018-07-20Fail if a PT_LOAD segment has a memory size of 0. This prevents a panickettenis1-3/+7
later on, and it makes no sense for a binary to have such a segment. ok bluhm@, guenther@
2018-07-10Move from sendsig() to its callers the initsiginfo() calls andguenther1-2/+1
instead of passing sendsig() the code+type+val, pass a siginfo_t* to copy from. Eliminate the indirection through struct emul for sendsig(); we no longer have a SunOS4-compat version of sendsig() ok deraadt@
2017-12-30Don't pull in <sys/file.h> just to get fcntl.hguenther1-2/+2
ok deraadt@ krw@
2017-09-07In elf_load_file() to not call free(9) with an uninitialized sizebluhm1-2/+2
even if the pointer is NULL. This is not a real bug as free(9) checks the addr pointer before the size value, but the compiler cannot know that. found by clang -Wuninitialized; OK deraadt@
2017-03-20Initialize the stack buffer used to build the auxiliary vector to zero tokettenis1-1/+2
avoid leaking the contents of the kernel stack into userspace. ok guenther@, deraadt@
2017-03-05Generating a coredump requires walking the map twice; changeguenther1-125/+118
uvm_coredump_walkmap() to do both with a callback in between so it can hold locks/change state across the two. ok stefan@
2017-02-11Correct the entry point and base address calculations for anguenther1-2/+4
interpreter whose entry point isn't in its first PT_LOAD segment. problem report and testing by patrick@
2017-02-08Remove support for forcing the ELF interpreter to a specific address,guenther1-21/+12
last used by COMPAT_SYSV which was removed in 2011. ok millert@
2017-02-08In exec_elf.c: expand ELFNAME(), ELFNAME2(), and ELFNAMEEND() exceptguenther1-78/+77
leaving out the size, so that ELFNAME2(exec,makecmds) becomes exec_elf_makecmds instead of exec_elf{32,64}_makecmds and then delete the ELFNAME2() and ELFNAMEEND() macros. Move the prototypes for functions local to exec_elf.c to there from exec_elf.h. Simplify the SMALL_KERNEL conditionals around the ELF coredump code. Change exec_conf.c to use the size-generic names and macros Remove exec_elf{32,64}.c and just build exec_elf.c; delete the _KERN_DO_ELF and _KERN_DO_ELF64 #defines. ok jca@, encouragement from deraadt@ and tom@
2017-02-08Move ELF_AUX_ENTRIES from exec_elf.h to exec_elf.c; it's totally internalguenther1-1/+6
and not something we guarantee to userspace ok jca@
2017-02-08Change ELFNAME(read_from)'s buf parameter to be void*, eliminating a castguenther1-9/+8
from all but one call ok jca@
2017-02-08elf{32,64}_check_brand() isn't used; delete itguenther1-13/+1
ok jca@
2017-02-08Provide size-generic ELF_NO_ADDR in <sys/exec_elf.h> and use that insteadguenther1-11/+11
of ELFDEFNNAME(NO_ADDR) ok jca@
2017-02-05Since we expect to never do binary compat with other OSes again,guenther1-23/+5
delete the no-longer-used probe hook support. ok mpi@ jca@
2017-01-21p_comm is the process's command and isn't per thread, so move it fromguenther1-2/+2
struct proc to struct process. ok deraadt@ kettenis@
2016-11-07Split PID from TID, giving processes a PID unrelated to the TID of theirguenther1-2/+2
initial thread ok jsing@ kettenis@
2016-10-05Display/test/use the process PID, not the thread's TID, in a few places.guenther1-2/+2
ok mpi@ mikeb@
2016-09-12When trying to run an ELF binary marked PT_OPENBSD_WXNEEDED from aschwarze1-5/+6
file system mounted without MNT_WXALLOWED, fail with EACCES rather than with ENOEXEC, to discourage the shell from trying to run the file as a shell script. OK deraadt@ millert@; tedu@ and halex@ agreed with the general direction.
2016-06-11Since epp->ep_name is a userland pointer, use copyinstr(9) to get a copy okkettenis1-2/+5
the string into kernel space before logging the W^X binary warning. ok jca@, guenther@
2016-06-08Enforce W^X and map W|X segments without X permission initially. Thekettenis1-2/+9
dynamic linker will make these read-only and add back X permission after elocation processing. Static executables with W|X segments will probably crash. ok deraadt@, guenther@
2016-05-30Identify W^X labelled binaries at execve() time based upon WX_OPENBSD_WXNEEDEDderaadt1-1/+19
flag set by ld -zwxneeded. Such binaries are allowed to run only on wxallowed mountpoints. They do not report mmap/mprotect problems. Rate limit mmap/mprotect reports from other binaries. These semantics are chosen to encourage progress in the ports ecosystem, without overwhelming the developers who work in the area. ok sthen kettenis
2016-05-30backout to insert correct commit messagederaadt1-19/+1
2016-05-30*** empty log message ***deraadt1-1/+19
2016-05-10SROP mitigation. sendsig() stores a (per-process ^ &sigcontext) cookiederaadt1-2/+3
inside the sigcontext. sigreturn(2) checks syscall entry was from the exact PC addr in the (per-process ASLR) sigtramp, verifies the cookie, and clears it to prevent sigcontext reuse. not yet tested on landisk, sparc, *88k, socppc. ok kettenis
2016-02-28Support for running Linux binaries under emulation is going away.naddy1-8/+1
Remove "option COMPAT_LINUX" and everything directly tied to it from the kernel and the corresponding man page documentation. ok visa@ guenther@
2015-11-02move the pledgenote annotation from `struct proc' to `struct nameidata'semarie1-2/+2
pledgenote is used for annotate the policy for a namei context. So make it tracking the nameidata. It is expected for the caller to explicitly define the policy. It is a kernel bug to not do so. ok deraadt@
2015-10-28Paranoa: p_pledgenote the NAMEI for ld.so loadingderaadt1-1/+3
2015-09-28Track size of an opaque allocation to pass to free() laterderaadt1-3/+4
ok guenther tedu
2015-04-30Now we use p_filesz - 1 to test for NUL check that p_filesz isjsg1-2/+2
at least two and while here allow the upper bound to be MAXPATHLEN by changing a >= to > as suggested by krw@ in a thread on tech where Maxime Villard proposed additional PT_INTERP checks. tested by and ok guenther@
2015-04-30Error out if the PT_INTERP segment isn't NUL terminatedguenther1-1/+3
ok deraadt@ millert@ miod@
2015-04-26Require a PT_LOAD segment's p_filesz to be no larger than its p_memsz.guenther1-1/+7
test cases provided by Alejandro Herna'ndez (nitrousenador (at) gmail.com) ok deraadt@ jsg@
2015-03-30Extend uvm_map_hint() to get an address range as extra arguments, and makemiod1-2/+3
sure it will return an address within that range. Use this in uaddr_rnd_select() to make sure we will not attempt to pick an address beyond what we are allowed to map. In my trees for 9 months, blackmailed s2k15 attendees into agreeing now would be a good time to commit.
2015-02-10Don't use an uninitialized variable when a PT_LOAD segment withguenther1-11/+10
alignment 0 or 1 is encountered. The result before was just a spurious failure by execve(), though I had to manually mangle a binary to hit this case: segments are all long-aligned or better in practice. uninitialized variable noted by Maxime Villard (rustyBSD (at) gmx.fr) ok and prod jsg@
2015-02-06Raise ELF_RANDOMIZE_LIMIT to 64K, so that programs and libraries canderaadt1-4/+1
legitimately use random section variables without execve failures... Because this section is not demand faulted, yield() every page during the fill otherwise the costs are charged poorly. ok tedu matthew
2015-01-27Require EFT shared objects have a PT_PHDR entry to be consideredkurt1-5/+11
a pie binary. The kernel will now reject executing a typical shared library with EINVAL. This breaks compatibility with initial static pie binaries and requires a recent user-land prior to upgrading. In addition, more fine grained errors can be returned from execve(2) when errors occur while attempting to execute ELF objects. okay guenther@, kettenis@, deraadt@
2015-01-20Move ps_strings "after" the random stackgap. This makes its location akettenis1-2/+2
per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a per-process one as well. This gets rid of a pointer to the bottom of the stack at a fixed location. Also clears the road for unmapping the stackgap. ok deraadt@
2014-12-22Make it possible to execute PIE binaries that don't have an PT_INTERP segmentkettenis1-9/+12
(and therefore no interpreter). Necessary to make self-relocating "static" PIE working. This will also allow execution of shared libraries that have the 'x' bit set. Those shouldn't exist, but unfortunately people outside OpenBSD think differently which means third-party software sometimes installs shared libraries with the 'x' bit set. ok kurt@, deraadt@
2014-12-16primary change: move uvm_vnode out of vnode, keeping only a pointer.tedu1-1/+3
objective: vnode.h doesn't include uvm_extern.h anymore. followup changes: include uvm_extern.h or lock.h where necessary. ok and help from deraadt
2014-11-16Replace a plethora of historical protection options with justderaadt1-10/+10
PROT_NONE, PROT_READ, PROT_WRITE, and PROT_EXEC from mman.h. PROT_MASK is introduced as the one true way of extracting those bits. Remove UVM_ADV_* wrapper, using the standard names. ok doug guenther kettenis
2014-11-14prefer sizeof(*ptr) to sizeof(struct) for malloc and freetedu1-2/+2
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.