summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_exec.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* remove stale lint annotationstedu2015-12-051-2/+1
|
* move the pledgenote annotation from `struct proc' to `struct nameidata'semarie2015-11-021-2/+2
| | | | | | | | | | pledgenote is used for annotate the policy for a namei context. So make it tracking the nameidata. It is expected for the caller to explicitly define the policy. It is a kernel bug to not do so. ok deraadt@
* move p_pledgenote setting next to NDINIT()deraadt2015-10-281-2/+2
|
* Fold "malloc" into "stdio" and -- recognizing that no program so far hasderaadt2015-10-251-2/+2
| | | | | | | | | | | | | | | used less than "stdio" -- include all the "self" operations. Instead of different defines, use regular PLEDGE_* in the "p_pledgenote" variable (which indicates the operation subtype a system call is performing). Many checks before easier to understand. p_pledgenote can often be passed directly to ktrace, so that kdump says: 15565 test CALL pledge(0xa9a3f804c51,0) 15565 test STRU pledge request="stdio" 15565 test RET pledge 0 15565 test CALL open(0xa9a3f804c57,0x2<O_RDWR>) 15565 test NAMI "/tmp/testfile" 15565 test PLDG open, "wpath", errno 1 Operation not permitted with help from semarie, ok guenther
* I forgot execve would go through the namei codepath, so a program markedderaadt2015-10-101-1/+2
| | | | | | "stdio rpath" this would fail to execve. pre-indicate exec actions to the namei checker to allow them through. ok semarie
* Rename tame() to pledge(). This fairly interface has evolved to be morederaadt2015-10-091-4/+4
| | | | | | strict than anticipated. It allows a programmer to pledge/promise/covenant that their program will operate within an easily defined subset of the Unix environment, or it pays the price.
* Add the tame "exec" request. This allows processes which requestderaadt2015-10-071-1/+5
| | | | | | | | | | | | | | | "exec" to call execve(2), potentially fork(2) beforehands if they asked for "proc". Calling execve is what "shells" (ksh, tmux, etc) have as their primary purpose. But meantime, if such a shell has a nasty bug, we want to mitigate the process from opening a socket or calling 100+ other system calls. Unfortunately silver bullets are in short supply, so if our goal is to stay in a POSIX-y environment, we have to let shells call execve(). POSIX ate the world, so choices do we all have? Warning for many: silver bullets are even more rare in other OS ecosystems, so please accept this as a narrow lowering of the bar in a very raised environment. Commited from a machine running tame "proc exec" ksh, make, etc.
* missing ) in COMPAT_LINUX blockderaadt2015-10-021-2/+2
|
* Add ktracing of argv and envp to execve(2), with envp not traced by defaultguenther2015-10-021-5/+26
| | | | ok tedu@ deraadt@
* Track size of an opaque allocation to pass to free() laterderaadt2015-09-281-6/+6
| | | | ok guenther tedu
* memory leak in execve with systrace, plus some unreachable codederaadt2015-07-221-3/+3
| | | | | spotted by Maxime Villard ok guenther millert
* Add kbind, a syscall for ld.so to use to securely and efficiently updateguenther2015-07-201-1/+3
| | | | | | memory for lazy binding ok deraadt@
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-3/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* Change the way stackgap_random is applied. Instead of applying it within themiod2015-02-091-3/+9
| | | | | | fixed stack area of the exec'd image, and risking hitting process limits, should we want to increase stackgap_random, the randomness is applied to the stack region in the process' vmspace.
* Stop using USRSTACK as the edge of the stack, but rather use the vmspacemiod2015-02-091-5/+5
| | | | | | | | vm_minsaddr or vm_maxsaddr, depending upon the direction the stack goes in. This should have no effect on the existing behaviourrr. ok kettenis@ deraadt@
* forbid execve() with argc == 0. prompted by a millert email.tedu2015-02-071-1/+7
| | | | ok deraadt miod
* Move the "stackgap" from the stack into its own page at a random address.kettenis2015-01-261-6/+17
| | | | | | | This allows us the unmap the initial part of the stack, such that it can't be used as a staging area for ROP (or other) attacks. ok guenther@, tedu@
* Move ps_strings "after" the random stackgap. This makes its location akettenis2015-01-201-2/+7
| | | | | | | | per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a per-process one as well. This gets rid of a pointer to the bottom of the stack at a fixed location. Also clears the road for unmapping the stackgap. ok deraadt@
* Map the sigcode page with MAP_INHERIT_COPY to make sure it isn't shared aterkettenis2015-01-151-2/+2
| | | | | | a fork. ok deraadt@
* Map the sigcode page copy-on-write. This allows userland to put breakpointskettenis2015-01-151-2/+3
| | | | | | | in the signal trampoline. Solves some long-standing issues with debugging signal handlers in GDB. ok deraadt@
* Prefer MADV_* over POSIX_MADV_* in kernel for consistency: the latterguenther2014-12-171-3/+3
| | | | | | doesn't have all the values and therefore can't be used everywhere. ok deraadt@ kettenis@
* primary change: move uvm_vnode out of vnode, keeping only a pointer.tedu2014-12-161-1/+3
| | | | | | objective: vnode.h doesn't include uvm_extern.h anymore. followup changes: include uvm_extern.h or lock.h where necessary. ok and help from deraadt
* Use MAP_INHERIT_* for the 'inh' argument to the UMV_MAPFLAG() macro,guenther2014-12-151-3/+3
| | | | | | eliminating the must-be-kept-in-sync UVM_INH_* macros ok deraadt@ tedu@
* convert bcopy to memcpy. ok millerttedu2014-12-101-2/+2
|
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-3/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Replace a plethora of historical protection options with justderaadt2014-11-161-5/+5
| | | | | | | PROT_NONE, PROT_READ, PROT_WRITE, and PROT_EXEC from mman.h. PROT_MASK is introduced as the one true way of extracting those bits. Remove UVM_ADV_* wrapper, using the standard names. ok doug guenther kettenis
* Don't assume that ep_taddr and ep_daddr are page-aligned. It is possible tokettenis2014-10-181-5/+7
| | | | | | | | construct ELF executables for which ep_daddr ends up not being properly aligned. Sanitize the addresses before setting up the address space for the new executable. Should fix the panic discovered by Alejandro Hernandez. ok miod@
* Replace uvm_km_alloc(9) and uvm_km_free(9) with the equivalent km_alooc(9)kettenis2014-09-281-5/+10
| | | | | | and km_free(9) calls. ok tedu@, mlarkin@
* Delete procfs; it's always had races and is now unused: no one noticed forguenther2014-09-081-13/+2
| | | | | | months that I broke it before the 5.5 release. confirmed as not being required by ports by sthen@, ajacoutot@, dcoppa@
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-8/+8
| | | | after discussions with beck deraadt kettenis.
* decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.hderaadt2014-07-081-3/+1
| | | | | don't need to be married. ok guenther miod beck jsing kettenis
* Move from struct proc to process the reference-count-holding pointersguenther2014-05-151-10/+9
| | | | | | | | | | to the process's vmspace and filedescs. struct proc continues to keep copies of the pointers, copying them on fork, clearing them on exit, and (for vmspace) refreshing on exec. Also, make uvm_swapout_threads() thread aware, eliminating p_swtime in kernel. particular testing by ajacoutot@ and sebastia@
* Have each thread keeps its own (counted!) reference to the process's ucredsguenther2014-04-181-2/+14
| | | | | | | | | to avoid possible use-after-free references when swapping ids in threaded processes. "Do I have the right creds?" checks are always made with the threads creds. Inspired by FreeBSD and NetBSD "right time" deraadt@
* Eliminates struct pcred by moving the real and saved ugids intoguenther2014-03-301-11/+18
| | | | | | | | | struct ucred; struct process then directly links to the ucred Based on a discussion at c2k10 or so before noting that FreeBSD and NetBSD did this too. ok matthew@
* Move p_emul and p_sigcode from proc to process.guenther2014-03-261-9/+9
| | | | | | | | | Tweak the handling of ktrace EMUL when changing ktracing: only generate one per process (not one per thread) and pass the correct proc pointer down to the VFS layer. Permit generating of NAMI and CSW records inside ktrace(2) itself. ok deraadt@ millert@
* Properly align the stack using _STACKALIGNBYTES, rather that the ALIGN()deraadt2014-03-191-11/+10
| | | | | | | | | macro which is unaware that stacks may need larger alignment. This may mean that some workarounds in crt0 can go away (here's looking at you mips64..) Tested on about half the architectures (the most special cases), so let's see what happens. with tobiasu
* bzero -> memsettedu2014-01-211-2/+2
|
* Move p_textvp from struct proc to struct process so that the exit codeguenther2014-01-201-3/+3
| | | | | | can be further simplified. ok kettenis@
* Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,guenther2013-06-171-1/+5
| | | | | | | | including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and {clock,pthread}_getcpuclockid() functions. Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@ ok matthew@
* vrele() is a tricky beast. it can sleep if the refcount hits zero,tedu2013-03-301-3/+5
| | | | | | leaving us with a free type function that isn't atomic. deal with this by erasing any reachable pointers to the vnode first, then free it. ok deraadt guenther
* do not include machine/cpu.h from a .c file; it is the responsibility ofderaadt2013-03-281-2/+1
| | | | | .h files to pull it in, if needed ok tedu
* Apply profiling to all threads instead of just the thread that calledguenther2012-08-021-2/+2
| | | | | | | profil() by moving P_PROFIL from proc->p_flag to process->ps_flags with matching adjustment in fork1() and exit1() ok matthew@
* Correct the error path in execve when there's a race to single threadguenther2012-05-011-2/+2
| | | | | | the process. noted and ok markus@
* Add struct proc * argument to FRELE() and FILE_SET_MATURE() inguenther2012-04-221-2/+2
| | | | | | anticipation of further changes to closef(). No binary change. ok krw@ miod@ deraadt@
* First stab at making ptrace(2) usable for debugging multi-threaded programs.kettenis2012-04-131-3/+3
| | | | | | | | | | It implements a full-stop model where all threads are stopped before handing over control to the debugger. Events are reported as before through wait(2); you will have to call ptrace(PT_GET_PROCESS_STATE, ...) to find out which thread hit the event. Since this changes the size of struct ptrace_state, you will have to recompile gdb. ok guenther@
* move accounting flags to struct process; idea and ok guenthermikeb2012-04-121-2/+2
|
* clear junk in p_comm before copying shorter names into itderaadt2012-03-261-2/+2
| | | | ok jsing guenther miod
* Make rusage totals, itimers, and profile settings per-process insteadguenther2012-03-231-8/+5
| | | | | | | of per-rthread. Handling of per-thread tick and runtime counters inspired by how FreeBSD does it. ok kettenis@
* New vmmap implementation.ariane2012-03-091-4/+2
| | | | | | | | | | | | no oks (it is really a pain to review properly) extensively tested, I'm confident it'll be stable 'now is the time' from several icb inhabitants Diff provides: - ability to specify different allocators for different regions/maps - a simpler implementation of the current allocator - currently in compatibility mode: it will generate similar addresses as the old allocator
* First steps for making ptrace work with rthreads:guenther2012-02-201-6/+6
| | | | | | | | | | - move the P_TRACED and P_INEXEC flags, and p_oppid, p_ptmask, and p_ptstat member from struct proc to struct process - sort the PT_* requests into those that take a PID vs those that can also take a TID - stub in PT_GET_THREAD_FIRST and PT_GET_THREAD_NEXT ok kettenis@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.