summaryrefslogtreecommitdiffstats
path: root/sys/kern/exec_subr.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Repurpose the "syscalls must be on a writeable page" mechanism toderaadt2019-11-291-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | enforce a new policy: system calls must be in pre-registered regions. We have discussed more strict checks than this, but none satisfy the cost/benefit based upon our understanding of attack methods, anyways let's see what the next iteration looks like. This is intended to harden (translation: attackers must put extra effort into attacking) against a mixture of W^X failures and JIT bugs which allow syscall misinterpretation, especially in environments with polymorphic-instruction/variable-sized instructions. It fits in a bit with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash behaviour, particularily for remote problems. Less effective once on-host since someone the libraries can be read. For static-executables the kernel registers the main program's PIE-mapped exec section valid, as well as the randomly-placed sigtramp page. For dynamic executables ELF ld.so's exec segment is also labelled valid; ld.so then has enough information to register libc's exec section as valid via call-once msyscall(2) For dynamic binaries, we continue to to permit the main program exec segment because "go" (and potentially a few other applications) have embedded system calls in the main program. Hopefully at least go gets fixed soon. We declare the concept of embedded syscalls a bad idea for numerous reasons, as we notice the ecosystem has many of static-syscall-in-base-binary which are dynamically linked against libraries which in turn use libc, which contains another set of syscall stubs. We've been concerned about adding even one additional syscall entry point... but go's approach tends to double the entry-point attack surface. This was started at a nano-hackathon in Bob Beck's basement 2 weeks ago during a long discussion with mortimer trying to hide from the SSL scream-conversations, and finished in more comfortable circumstances next to a wood-stove at Elk Lakes cabin with UVM scream-conversations. ok guenther kettenis mortimer, lots of feedback from others conversations about go with jsing tb sthen
* Make resource limit access MP-safe. So far, the copy-on-write sharingvisa2019-06-211-2/+2
| | | | | | | | | | of resource limit structs has been done between processes. By applying copy-on-write also between threads, threads can read rlimits in a nearly lock-free manner. Inspired by code in DragonFly BSD and FreeBSD. OK mpi@, agreement from jmatthew@ and anton@
* Implement MAP_STACK option for mmap(). Synchronous faults (pagefault andderaadt2018-04-121-8/+11
| | | | | | | | | | | | | | syscall) confirm the stack register points at MAP_STACK memory, otherwise SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified to create a MAP_STACK sub-region which satisfies alignment requirements. Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the contents of the region -- there is no mprotect() equivalent operation, so there is no MAP_STACK-adding gadget. This opportunistic software-emulation of a stack protection bit makes stack-pivot operations during ROPchain fragile (kind of like removing a tool from the toolbox). original discussion with tedu, uvm work by stefan, testing by mortimer ok kettenis
* Use sched_pause(yield) to decide when to yield when filling randomdata.mortimer2018-02-101-7/+3
| | | | ok deraadt@
* Use a temporary chacha instance to fill large randomdata sections. Avoidsmortimer2018-02-081-20/+31
| | | | | | grabbing the rnglock repeatedly. ok deraadt@ djm@
* Add a gap of 1MB between the stack and mmap spaces.kettenis2017-05-181-2/+6
| | | | ok deraadt@, millert@, stefan@
* size for free()deraadt2015-08-291-2/+3
|
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* In exec_setup_stack(), move the stack in the right direction ifmiod2015-02-161-1/+6
| | | | MACHINE_STACK_GROWS_UP.
* Change the way stackgap_random is applied. Instead of applying it within themiod2015-02-091-1/+10
| | | | | | fixed stack area of the exec'd image, and risking hitting process limits, should we want to increase stackgap_random, the randomness is applied to the stack region in the process' vmspace.
* Raise ELF_RANDOMIZE_LIMIT to 64K, so that programs and libraries canderaadt2015-02-061-6/+18
| | | | | | | legitimately use random section variables without execve failures... Because this section is not demand faulted, yield() every page during the fill otherwise the costs are charged poorly. ok tedu matthew
* Prefer MADV_* over POSIX_MADV_* in kernel for consistency: the latterguenther2014-12-171-5/+4
| | | | | | doesn't have all the values and therefore can't be used everywhere. ok deraadt@ kettenis@
* primary change: move uvm_vnode out of vnode, keeping only a pointer.tedu2014-12-161-1/+3
| | | | | | objective: vnode.h doesn't include uvm_extern.h anymore. followup changes: include uvm_extern.h or lock.h where necessary. ok and help from deraadt
* Use MAP_INHERIT_* for the 'inh' argument to the UMV_MAPFLAG() macro,guenther2014-12-151-4/+4
| | | | | | eliminating the must-be-kept-in-sync UVM_INH_* macros ok deraadt@ tedu@
* convert bcopy to memcpy. ok millerttedu2014-12-101-2/+2
|
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-3/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Delete a comment that was obsoleted by the switch to UVMguenther2014-11-161-12/+4
| | | | vmcmd_map_zero() just returns the result of uvm_map(), so make it a tail call
* Replace a plethora of historical protection options with justderaadt2014-11-161-13/+13
| | | | | | | PROT_NONE, PROT_READ, PROT_WRITE, and PROT_EXEC from mman.h. PROT_MASK is introduced as the one true way of extracting those bits. Remove UVM_ADV_* wrapper, using the standard names. ok doug guenther kettenis
* prefer sizeof(*ptr) to sizeof(struct) for malloc and freetedu2014-11-141-4/+4
|
* pass size argument to free()deraadt2014-11-031-3/+3
| | | | ok doug tedu
* use mallocarray where arguments are multipled. ok deraadttedu2014-07-131-2/+2
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-4/+4
| | | | after discussions with beck deraadt kettenis.
* decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.hderaadt2014-07-081-2/+1
| | | | | don't need to be married. ok guenther miod beck jsing kettenis
* Use real parameter types for u{dv,vn}_attach() instead of void *matthew2014-07-021-2/+2
| | | | ok guenther
* When vmcmd_map_readvn() maps in the page it reads into, it forcesguenther2014-05-291-3/+3
| | | | | | | | it to be writable but otherwise uses the correct final permissions. Ergo, it only needs to call uvm_map_protect() if the requested permissions didn't include UVM_PROT_WRITE. ok beck@
* Reduce uvm include madness. Use <uvm/uvm_extern.h> instead ofmpi2014-03-281-2/+2
| | | | | | <uvm/uvm.h> if possible and remove double inclusions. ok beck@, mlarkin@, deraadt@
* repair typo talking about a.outderaadt2013-10-151-3/+2
|
* Add support for .openbsd.randomdata sections and PT_OPENBSD_RANDOMIZEmatthew2012-08-201-1/+26
| | | | | | | | segments to the kernel, ld (2.15), and ld.so. Tested on alpha, amd64, i386, macppc, and sparc64 (thanks naddy, mpi, and okan!). Idea discussed for some time; committing now for further testing. ok deraadt
* ansi with a little knf. ok deraadt jsgtedu2011-06-291-28/+15
|
* grammar, spelling, and style fixes from bret lambert;jmc2006-11-141-2/+2
| | | | kern_descrip.c change ok deraadt
* don't call vn_rdwr() with IO_NODELOCKED when the vnode actually isn'tsturm2006-07-261-2/+2
| | | | | | locked; with this diff VFSDEBUG kernels can boot again ok pedro, thib (who came up with the same diff)
* fix typo in commenthshoexer2004-11-231-2/+2
| | | | ok deraadt@ markus@
* vmcmd_map_readvn - don't map the initial mapping with X unless theart2003-05-091-7/+9
| | | | | | | final protection has an X. Doesn't really change anything except reducing I$ flushing. niklas@ ok
* simplify stack grownups (growndowns are not touched)mickey2002-12-191-6/+7
|
* Eliminate the use of KERN_SUCCESS outside of uvm/art2002-11-061-11/+10
| | | | | | | | Also uvm_map returns KERN_* codes that are directly mapped to errnos, so we can return them instead of doing some attempt to translation. drahn@ "I see no problem" pval@ "makes sense"
* Remove a diagnostic check that I added when reorganizing the code.art2002-10-071-5/+1
| | | | | It triggers on ppc and while the check itself is correct, it's better to fix the bug before breaking peoples systems.
* Move out the execution of vmcmds into a separate function.art2002-10-061-3/+36
|
* make it compile w/ DEBUG by syncing w/ exec.h; deraadt@ okmickey2002-10-021-2/+4
|
* Map stack pages without VM_PROT_EXECUTE. Notice that right now thisart2002-07-211-3/+3
| | | | doesn't do anything since no pmap implements exec protection yet.
* First round of __P removal in sysmillert2002-03-141-2/+2
|
* UBC was a disaster. It worked very good when it worked, but on someart2001-12-191-8/+21
| | | | | | | | | machines or some configurations or in some phase of the moon (we actually don't know when or why) files disappeared. Since we've not been able to track down the problem in two weeks intense debugging and we need -current to be stable, back out everything to a state it had before UBC. We apologise for the inconvenience.
* Sync in more uvm changes from NetBSD.art2001-11-281-29/+14
| | | | | This time we're getting rid of KERN_* and VM_PAGER_* error codes and use errnos instead.
* Merge in the unified buffer cache code as found in NetBSD 2001/03/10. Theart2001-11-271-1/+2
| | | | | | | code is written mostly by Chuck Silvers <chuq@chuq.com>/<chs@netbsd.org>. Tested for the past few weeks by many developers, should be in a pretty stable state, but will require optimizations and additional cleanups.
* Add an alignment argument to uvm_map that specifies an alignment hintart2001-11-071-4/+4
| | | | for the virtual address.
* Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.miod2001-11-061-3/+1
| | | | (Look ma, I might have broken the tree)
* remove old vmart2001-06-271-29/+1
|
* KNFderaadt2001-06-221-28/+27
|
* ELF uses more than 5 vmcmds by default, so grow the default vmcmd set sizeart2001-02-221-13/+16
| | | | | | | | | | | to 8. At the same time it seemed like a good idea to avoid to always malloc a new vmcmd array, so put the default sized array into struct exec_vmcmd_set. We might want to make a linked list of vmcmd arrays or exec_vmcmd_sets instead of reallocating them some time in the future, but right now this seems like a waste of time.
* Don't bomb when the length of pagedvn vm_cmd is not page aligned.art2000-11-061-2/+3
| | | | Other commands were checked and look safe.
* Don't use MALLOC/FREE on variable sized allocations.art2000-09-261-6/+5
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.