1272343Sngie/* $NetBSD: t_mprotect.c,v 1.3 2011/07/20 22:53:44 jym Exp $ */ 2272343Sngie 3272343Sngie/*- 4272343Sngie * Copyright (c) 2011 The NetBSD Foundation, Inc. 5272343Sngie * All rights reserved. 6272343Sngie * 7272343Sngie * This code is derived from software contributed to The NetBSD Foundation 8272343Sngie * by Jukka Ruohonen. 9272343Sngie * 10272343Sngie * Redistribution and use in source and binary forms, with or without 11272343Sngie * modification, are permitted provided that the following conditions 12272343Sngie * are met: 13272343Sngie * 1. Redistributions of source code must retain the above copyright 14272343Sngie * notice, this list of conditions and the following disclaimer. 15272343Sngie * 2. Redistributions in binary form must reproduce the above copyright 16272343Sngie * notice, this list of conditions and the following disclaimer in the 17272343Sngie * documentation and/or other materials provided with the distribution. 18272343Sngie * 19272343Sngie * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20272343Sngie * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21272343Sngie * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22272343Sngie * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23272343Sngie * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24272343Sngie * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25272343Sngie * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26272343Sngie * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27272343Sngie * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28272343Sngie * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29272343Sngie * POSSIBILITY OF SUCH DAMAGE. 30272343Sngie */ 31272343Sngie#include <sys/cdefs.h> 32272343Sngie__RCSID("$NetBSD: t_mprotect.c,v 1.3 2011/07/20 22:53:44 jym Exp $"); 33272343Sngie 34272343Sngie#include <sys/param.h> 35272343Sngie#include <sys/mman.h> 36272343Sngie#include <sys/sysctl.h> 37272343Sngie#include <sys/wait.h> 38272343Sngie 39272343Sngie#include <errno.h> 40272343Sngie#include <fcntl.h> 41272343Sngie#include <stdlib.h> 42272343Sngie#include <string.h> 43272343Sngie#include <unistd.h> 44272343Sngie 45272343Sngie#include <atf-c.h> 46272343Sngie 47276478Sngie#ifdef __NetBSD__ 48272343Sngie#include "../common/exec_prot.h" 49276478Sngie#endif 50272343Sngie 51272343Sngiestatic long page = 0; 52272343Sngiestatic int pax_global = -1; 53272343Sngiestatic int pax_enabled = -1; 54272343Sngiestatic char path[] = "mmap"; 55272343Sngie 56272343Sngiestatic void sighandler(int); 57272343Sngiestatic bool paxinit(void); 58272343Sngiestatic bool paxset(int, int); 59272343Sngie 60272343Sngiestatic void 61272343Sngiesighandler(int signo) 62272343Sngie{ 63272343Sngie _exit(signo); 64272343Sngie} 65272343Sngie 66272343Sngiestatic bool 67272343Sngiepaxinit(void) 68272343Sngie{ 69272343Sngie size_t len = sizeof(int); 70272343Sngie int rv; 71272343Sngie 72272343Sngie rv = sysctlbyname("security.pax.mprotect.global", 73272343Sngie &pax_global, &len, NULL, 0); 74272343Sngie 75272343Sngie if (rv != 0) 76272343Sngie return false; 77272343Sngie 78272343Sngie rv = sysctlbyname("security.pax.mprotect.enabled", 79272343Sngie &pax_enabled, &len, NULL, 0); 80272343Sngie 81272343Sngie if (rv != 0) 82272343Sngie return false; 83272343Sngie 84272343Sngie return paxset(1, 1); 85272343Sngie} 86272343Sngie 87272343Sngiestatic bool 88272343Sngiepaxset(int global, int enabled) 89272343Sngie{ 90272343Sngie size_t len = sizeof(int); 91272343Sngie int rv; 92272343Sngie 93272343Sngie rv = sysctlbyname("security.pax.mprotect.global", 94272343Sngie NULL, NULL, &global, len); 95272343Sngie 96272343Sngie if (rv != 0) 97272343Sngie return false; 98272343Sngie 99272343Sngie rv = sysctlbyname("security.pax.mprotect.enabled", 100272343Sngie NULL, NULL, &enabled, len); 101272343Sngie 102272343Sngie if (rv != 0) 103272343Sngie return false; 104272343Sngie 105272343Sngie return true; 106272343Sngie} 107272343Sngie 108272343Sngie 109272343SngieATF_TC_WITH_CLEANUP(mprotect_access); 110272343SngieATF_TC_HEAD(mprotect_access, tc) 111272343Sngie{ 112272343Sngie atf_tc_set_md_var(tc, "descr", "Test for EACCES from mprotect(2)"); 113272343Sngie} 114272343Sngie 115272343SngieATF_TC_BODY(mprotect_access, tc) 116272343Sngie{ 117272343Sngie int prot[2] = { PROT_NONE, PROT_READ }; 118272343Sngie void *map; 119272343Sngie size_t i; 120272343Sngie int fd; 121272343Sngie 122272343Sngie fd = open(path, O_RDONLY | O_CREAT); 123272343Sngie ATF_REQUIRE(fd >= 0); 124272343Sngie 125272343Sngie /* 126272343Sngie * The call should fail with EACCES if we try to mark 127272343Sngie * a PROT_NONE or PROT_READ file/section as PROT_WRITE. 128272343Sngie */ 129272343Sngie for (i = 0; i < __arraycount(prot); i++) { 130272343Sngie 131272343Sngie map = mmap(NULL, page, prot[i], MAP_SHARED, fd, 0); 132272343Sngie 133272343Sngie if (map == MAP_FAILED) 134272343Sngie continue; 135272343Sngie 136272343Sngie errno = 0; 137272343Sngie 138272343Sngie ATF_REQUIRE(mprotect(map, page, PROT_WRITE) != 0); 139272343Sngie ATF_REQUIRE(errno == EACCES); 140272343Sngie ATF_REQUIRE(munmap(map, page) == 0); 141272343Sngie } 142272343Sngie 143272343Sngie ATF_REQUIRE(close(fd) == 0); 144272343Sngie} 145272343Sngie 146272343SngieATF_TC_CLEANUP(mprotect_access, tc) 147272343Sngie{ 148272343Sngie (void)unlink(path); 149272343Sngie} 150272343Sngie 151272343SngieATF_TC(mprotect_err); 152272343SngieATF_TC_HEAD(mprotect_err, tc) 153272343Sngie{ 154272343Sngie atf_tc_set_md_var(tc, "descr", "Test error conditions of mprotect(2)"); 155272343Sngie} 156272343Sngie 157272343SngieATF_TC_BODY(mprotect_err, tc) 158272343Sngie{ 159272343Sngie errno = 0; 160272343Sngie 161272343Sngie ATF_REQUIRE(mprotect((char *)-1, 1, PROT_READ) != 0); 162272343Sngie ATF_REQUIRE(errno == EINVAL); 163272343Sngie} 164272343Sngie 165276478Sngie#ifdef __NetBSD__ 166272343SngieATF_TC(mprotect_exec); 167272343SngieATF_TC_HEAD(mprotect_exec, tc) 168272343Sngie{ 169272343Sngie atf_tc_set_md_var(tc, "descr", 170272343Sngie "Test mprotect(2) executable space protections"); 171272343Sngie} 172272343Sngie 173272343Sngie/* 174272343Sngie * Trivial function -- should fit into a page 175272343Sngie */ 176272343SngieATF_TC_BODY(mprotect_exec, tc) 177272343Sngie{ 178272343Sngie pid_t pid; 179272343Sngie void *map; 180272343Sngie int sta, xp_support; 181272343Sngie 182272343Sngie xp_support = exec_prot_support(); 183272343Sngie 184272343Sngie switch (xp_support) { 185272343Sngie case NOTIMPL: 186272343Sngie atf_tc_skip( 187272343Sngie "Execute protection callback check not implemented"); 188272343Sngie break; 189272343Sngie case NO_XP: 190272343Sngie atf_tc_skip( 191272343Sngie "Host does not support executable space protection"); 192272343Sngie break; 193272343Sngie case PARTIAL_XP: case PERPAGE_XP: default: 194272343Sngie break; 195272343Sngie } 196272343Sngie 197272343Sngie /* 198272343Sngie * Map a page read/write and copy a trivial assembly function inside. 199272343Sngie * We will then change the mapping rights: 200272343Sngie * - first by setting the execution right, and check that we can 201272343Sngie * call the code found in the allocated page. 202272343Sngie * - second by removing the execution right. This should generate 203272343Sngie * a SIGSEGV on architectures that can enforce --x permissions. 204272343Sngie */ 205272343Sngie 206272343Sngie map = mmap(NULL, page, PROT_WRITE|PROT_READ, MAP_ANON, -1, 0); 207272343Sngie ATF_REQUIRE(map != MAP_FAILED); 208272343Sngie 209272343Sngie memcpy(map, (void *)return_one, 210272343Sngie (uintptr_t)return_one_end - (uintptr_t)return_one); 211272343Sngie 212272343Sngie /* give r-x rights then call code in page */ 213272343Sngie ATF_REQUIRE(mprotect(map, page, PROT_EXEC|PROT_READ) == 0); 214272343Sngie ATF_REQUIRE(((int (*)(void))map)() == 1); 215272343Sngie 216272343Sngie /* remove --x right */ 217272343Sngie ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0); 218272343Sngie 219272343Sngie pid = fork(); 220272343Sngie ATF_REQUIRE(pid >= 0); 221272343Sngie 222272343Sngie if (pid == 0) { 223272343Sngie ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 224272343Sngie ATF_CHECK(((int (*)(void))map)() == 1); 225272343Sngie _exit(0); 226272343Sngie } 227272343Sngie 228272343Sngie (void)wait(&sta); 229272343Sngie 230272343Sngie ATF_REQUIRE(munmap(map, page) == 0); 231272343Sngie 232272343Sngie ATF_REQUIRE(WIFEXITED(sta) != 0); 233272343Sngie 234272343Sngie switch (xp_support) { 235272343Sngie case PARTIAL_XP: 236272343Sngie /* Partial protection might fail; skip the test when it does */ 237272343Sngie if (WEXITSTATUS(sta) != SIGSEGV) { 238272343Sngie atf_tc_skip("Host only supports " 239272343Sngie "partial executable space protection"); 240272343Sngie } 241272343Sngie break; 242272343Sngie case PERPAGE_XP: default: 243272343Sngie /* Per-page --x protection should not fail */ 244272343Sngie ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 245272343Sngie break; 246272343Sngie } 247272343Sngie} 248276478Sngie#endif 249272343Sngie 250272343SngieATF_TC(mprotect_pax); 251272343SngieATF_TC_HEAD(mprotect_pax, tc) 252272343Sngie{ 253272343Sngie atf_tc_set_md_var(tc, "descr", "PaX restrictions and mprotect(2)"); 254272343Sngie atf_tc_set_md_var(tc, "require.user", "root"); 255272343Sngie} 256272343Sngie 257272343SngieATF_TC_BODY(mprotect_pax, tc) 258272343Sngie{ 259272343Sngie const int prot[4] = { PROT_NONE, PROT_READ, PROT_WRITE }; 260272343Sngie const char *str = NULL; 261272343Sngie void *map; 262272343Sngie size_t i; 263272343Sngie int rv; 264272343Sngie 265272343Sngie if (paxinit() != true) 266272343Sngie return; 267272343Sngie 268272343Sngie /* 269272343Sngie * As noted in the original PaX documentation [1], 270272343Sngie * the following restrictions should apply: 271272343Sngie * 272272343Sngie * (1) creating executable anonymous mappings 273272343Sngie * 274272343Sngie * (2) creating executable/writable file mappings 275272343Sngie * 276272343Sngie * (3) making a non-executable mapping executable 277272343Sngie * 278272343Sngie * (4) making an executable/read-only file mapping 279272343Sngie * writable except for performing relocations 280272343Sngie * on an ET_DYN ELF file (non-PIC shared library) 281272343Sngie * 282272343Sngie * The following will test only the case (3). 283272343Sngie * 284272343Sngie * [1] http://pax.grsecurity.net/docs/mprotect.txt 285272343Sngie * 286272343Sngie * (Sun Apr 3 11:06:53 EEST 2011.) 287272343Sngie */ 288272343Sngie for (i = 0; i < __arraycount(prot); i++) { 289272343Sngie 290272343Sngie map = mmap(NULL, page, prot[i], MAP_ANON, -1, 0); 291272343Sngie 292272343Sngie if (map == MAP_FAILED) 293272343Sngie continue; 294272343Sngie 295272343Sngie rv = mprotect(map, 1, prot[i] | PROT_EXEC); 296272343Sngie 297272343Sngie (void)munmap(map, page); 298272343Sngie 299272343Sngie if (rv == 0) { 300272343Sngie str = "non-executable mapping made executable"; 301272343Sngie goto out; 302272343Sngie } 303272343Sngie } 304272343Sngie 305272343Sngieout: 306272343Sngie if (pax_global != -1 && pax_enabled != -1) 307272343Sngie (void)paxset(pax_global, pax_enabled); 308272343Sngie 309272343Sngie if (str != NULL) 310272343Sngie atf_tc_fail("%s", str); 311272343Sngie} 312272343Sngie 313272343SngieATF_TC(mprotect_write); 314272343SngieATF_TC_HEAD(mprotect_write, tc) 315272343Sngie{ 316272343Sngie atf_tc_set_md_var(tc, "descr", "Test mprotect(2) write protections"); 317272343Sngie} 318272343Sngie 319272343SngieATF_TC_BODY(mprotect_write, tc) 320272343Sngie{ 321272343Sngie pid_t pid; 322272343Sngie void *map; 323272343Sngie int sta; 324272343Sngie 325272343Sngie /* 326272343Sngie * Map a page read/write, change the protection 327272343Sngie * to read-only with mprotect(2), and try to write 328272343Sngie * to the page. This should generate a SIGSEGV. 329272343Sngie */ 330272343Sngie map = mmap(NULL, page, PROT_WRITE|PROT_READ, MAP_ANON, -1, 0); 331272343Sngie ATF_REQUIRE(map != MAP_FAILED); 332272343Sngie 333272343Sngie ATF_REQUIRE(strlcpy(map, "XXX", 3) == 3); 334272343Sngie ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0); 335272343Sngie 336272343Sngie pid = fork(); 337272343Sngie ATF_REQUIRE(pid >= 0); 338272343Sngie 339272343Sngie if (pid == 0) { 340272343Sngie ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR); 341272343Sngie ATF_REQUIRE(strlcpy(map, "XXX", 3) == 0); 342272343Sngie } 343272343Sngie 344272343Sngie (void)wait(&sta); 345272343Sngie 346272343Sngie ATF_REQUIRE(WIFEXITED(sta) != 0); 347272343Sngie ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV); 348272343Sngie ATF_REQUIRE(munmap(map, page) == 0); 349272343Sngie} 350272343Sngie 351272343SngieATF_TP_ADD_TCS(tp) 352272343Sngie{ 353272343Sngie page = sysconf(_SC_PAGESIZE); 354272343Sngie ATF_REQUIRE(page >= 0); 355272343Sngie 356272343Sngie ATF_TP_ADD_TC(tp, mprotect_access); 357272343Sngie ATF_TP_ADD_TC(tp, mprotect_err); 358276478Sngie#ifdef __NetBSD__ 359272343Sngie ATF_TP_ADD_TC(tp, mprotect_exec); 360276478Sngie#endif 361272343Sngie ATF_TP_ADD_TC(tp, mprotect_pax); 362272343Sngie ATF_TP_ADD_TC(tp, mprotect_write); 363272343Sngie 364272343Sngie return atf_no_error(); 365272343Sngie} 366