1/* $NetBSD: paxctl.c,v 1.11 2009/05/02 16:19:36 christos Exp $ */
2
3/*-
4 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
5 * Copyright (c) 2008 Christos Zoulas <christos@NetBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. The name of the author may not be used to endorse or promote products
17 *    derived from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30#if HAVE_NBTOOL_CONFIG_H
31#include "nbtool_config.h"
32#endif
33
34#include <sys/cdefs.h>
35#ifndef lint
36#ifdef __RCSID
37__RCSID("$NetBSD: paxctl.c,v 1.11 2009/05/02 16:19:36 christos Exp $");
38#endif
39#endif /* not lint */
40
41#include <sys/types.h>
42#ifdef HAVE_NBTOOL_CONFIG_H
43#include "../../sys/sys/exec_elf.h"
44#else
45#include <elf.h>
46#endif
47#include <stdio.h>
48#include <err.h>
49#include <fcntl.h>
50#include <unistd.h>
51#include <stdlib.h>
52#include <string.h>
53
54static void usage(void) __dead;
55static uint32_t pax_flag(char);
56static int pax_flags_sane(uint32_t);
57static int pax_haveflags(uint32_t);
58static void pax_printflags(const char *, int, uint32_t);
59
60#ifndef ELF_NOTE_TYPE_PAX_TAG
61/* NetBSD-specific note type: PaX.  There should be 1 NOTE per executable.
62   section.  desc is a 32 bit bitmask */
63#define ELF_NOTE_TYPE_PAX_TAG		3
64#define	ELF_NOTE_PAX_MPROTECT		0x01	/* Force enable MPROTECT */
65#define	ELF_NOTE_PAX_NOMPROTECT		0x02	/* Force disable MPROTECT */
66#define	ELF_NOTE_PAX_GUARD		0x04	/* Force enable Segvguard */
67#define	ELF_NOTE_PAX_NOGUARD		0x08	/* Force disable Segvguard */
68#define	ELF_NOTE_PAX_ASLR		0x10	/* Force enable ASLR */
69#define	ELF_NOTE_PAX_NOASLR		0x20	/* Force disable ASLR */
70#define ELF_NOTE_PAX_NAMESZ		4
71#define ELF_NOTE_PAX_NAME		"PaX\0"
72#define ELF_NOTE_PAX_DESCSZ		4
73#endif
74#ifndef __arraycount
75#define __arraycount(a) (sizeof(a) / sizeof(a[0]))
76#endif
77
78
79static const struct paxflag {
80	char mark;
81	const char *name;
82	uint32_t bits;
83} flags[] = {
84	{ 'A', "ASLR, explicit enable",
85	  ELF_NOTE_PAX_ASLR },
86	{ 'a', "ASLR, explicit disable",
87	  ELF_NOTE_PAX_NOASLR },
88	{ 'G', "Segvguard, explicit enable",
89	  ELF_NOTE_PAX_GUARD },
90	{ 'g', "Segvguard, explicit disable",
91	  ELF_NOTE_PAX_NOGUARD },
92	{ 'M', "mprotect(2) restrictions, explicit enable",
93	  ELF_NOTE_PAX_MPROTECT },
94	{ 'm', "mprotect(2) restrictions, explicit disable",
95	  ELF_NOTE_PAX_NOMPROTECT },
96};
97
98static void
99usage(void)
100{
101	(void)fprintf(stderr, "Usage: %s [ <-|+><A|a|G|g|M|m> ] <file> ...\n",
102#if HAVE_NBTOOL_CONFIG_H
103	    "paxctl"
104#else
105	    getprogname()
106#endif
107	);
108	exit(1);
109}
110
111static uint32_t
112pax_flag(char s)
113{
114	size_t i;
115
116	if (s == '\0')
117		return (uint32_t)-1;
118
119	for (i = 0; i < __arraycount(flags); i++)
120		if (s == flags[i].mark)
121			return flags[i].bits;
122
123	return (uint32_t)-1;
124}
125
126static int
127pax_flags_sane(uint32_t f)
128{
129	size_t i;
130
131	for (i = 0; i < __arraycount(flags) - 1; i += 2) {
132		uint32_t g = flags[i].bits | flags[i+1].bits;
133		if ((f & g) == g)
134			return 0;
135	}
136
137	return 1;
138}
139
140static int
141pax_haveflags(uint32_t f)
142{
143	size_t i;
144
145	for (i = 0; i < __arraycount(flags); i++)
146		if (f & flags[i].bits)
147			return (1);
148
149	return (0);
150}
151
152static void
153pax_printflags(const char *name, int many, uint32_t f)
154{
155	size_t i;
156
157	for (i = 0; i < __arraycount(flags); i++)
158		if (f & flags[i].bits) {
159			if (many)
160				(void)printf("%s: ", name);
161			(void)printf("  %c: %s\n",
162			    flags[i].mark, flags[i].name);
163		}
164}
165
166static int
167process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
168    int list, int many)
169{
170	union {
171	    Elf32_Ehdr h32;
172	    Elf64_Ehdr h64;
173	} e;
174	union {
175	    Elf32_Shdr h32;
176	    Elf64_Shdr h64;
177	} s;
178	union {
179	    Elf32_Nhdr h32;
180	    Elf64_Nhdr h64;
181	} n;
182#define SWAP(a)	(swap == 0 ? (a) : \
183    /*LINTED*/(sizeof(a) == 1 ? (a) : \
184    /*LINTED*/(sizeof(a) == 2 ? bswap16(a) : \
185    /*LINTED*/(sizeof(a) == 4 ? bswap32(a) : \
186    /*LINTED*/(sizeof(a) == 8 ? bswap64(a) : (abort(), (a)))))))
187#define EH(field)	(size == 32 ? SWAP(e.h32.field) : SWAP(e.h64.field))
188#define SH(field)	(size == 32 ? SWAP(s.h32.field) : SWAP(s.h64.field))
189#define NH(field)	(size == 32 ? SWAP(n.h32.field) : SWAP(n.h64.field))
190#define SHSIZE		(size == 32 ? sizeof(s.h32) : sizeof(s.h64))
191#define NHSIZE		(size == 32 ? sizeof(n.h32) : sizeof(n.h64))
192	struct {
193		char name[ELF_NOTE_PAX_NAMESZ];
194		uint32_t flags;
195	} pax_tag;
196	int fd, size, ok = 0, flagged = 0, swap, error = 1;
197	size_t i;
198
199	fd = open(name, list ? O_RDONLY: O_RDWR, 0);
200	if (fd == -1) {
201		warn("Can't open `%s'", name);
202		return error;
203	}
204
205	if (read(fd, &e, sizeof(e)) != sizeof(e)) {
206		warn("Can't read ELF header from `%s'", name);
207		goto out;
208	}
209
210	if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0) {
211		warnx("Bad ELF magic from `%s' (maybe it's not an ELF?)", name);
212		goto out;
213	}
214
215	if (e.h32.e_ehsize == sizeof(e.h32)) {
216		size = 32;
217		swap = 0;
218	} else if (e.h64.e_ehsize == sizeof(e.h64)) {
219		size = 64;
220		swap = 0;
221	} else if (bswap16(e.h32.e_ehsize) == sizeof(e.h32)) {
222		size = 32;
223		swap = 1;
224	} else if (bswap16(e.h64.e_ehsize) == sizeof(e.h64)) {
225		size = 64;
226		swap = 1;
227	} else {
228		warnx("Bad ELF size %d from `%s' (maybe it's not an ELF?)",
229		    (int)e.h32.e_ehsize, name);
230		goto out;
231	}
232
233	for (i = 0; i < EH(e_shnum); i++) {
234		if ((size_t)pread(fd, &s, SHSIZE,
235		    (off_t)EH(e_shoff) + i * SHSIZE) != SHSIZE) {
236			warn("Can't read section header data from `%s'", name);
237			goto out;
238		}
239
240		if (SH(sh_type) != SHT_NOTE)
241			continue;
242
243		if (pread(fd, &n, NHSIZE, (off_t)SH(sh_offset)) != NHSIZE) {
244			warn("Can't read note header from `%s'", name);
245			goto out;
246		}
247		if (NH(n_type) != ELF_NOTE_TYPE_PAX_TAG ||
248		    NH(n_descsz) != ELF_NOTE_PAX_DESCSZ ||
249		    NH(n_namesz) != ELF_NOTE_PAX_NAMESZ)
250			continue;
251		if (pread(fd, &pax_tag, sizeof(pax_tag), SH(sh_offset) + NHSIZE)
252		    != sizeof(pax_tag)) {
253			warn("Can't read pax_tag from `%s'", name);
254			goto out;
255		}
256		if (memcmp(pax_tag.name, ELF_NOTE_PAX_NAME,
257		    sizeof(pax_tag.name)) != 0) {
258			warn("Unknown pax_tag name `%*.*s' from `%s'",
259			    ELF_NOTE_PAX_NAMESZ, ELF_NOTE_PAX_NAMESZ,
260			    pax_tag.name, name);
261			goto out;
262		}
263		ok = 1;
264
265		if (list) {
266			if (!pax_haveflags(SWAP(pax_tag.flags)))
267				break;
268
269			if (!pax_flags_sane(SWAP(pax_tag.flags)))
270				warnx("Current flags 0x%x don't make sense",
271				    (uint32_t)SWAP(pax_tag.flags));
272
273			if (many)
274				(void)printf("%s: ", name);
275			(void)printf("PaX flags:\n");
276
277			pax_printflags(name, many, SWAP(pax_tag.flags));
278			flagged = 1;
279			break;
280		}
281
282		pax_tag.flags |= SWAP(add_flags);
283		pax_tag.flags &= SWAP(~del_flags);
284
285		if (!pax_flags_sane(SWAP(pax_tag.flags))) {
286			warnx("New flags 0x%x don't make sense",
287			    (uint32_t)SWAP(pax_tag.flags));
288			goto out;
289		}
290
291		if (pwrite(fd, &pax_tag, sizeof(pax_tag),
292		    (off_t)SH(sh_offset) + NHSIZE) != sizeof(pax_tag))
293			warn("Can't modify flags on `%s'", name);
294		break;
295	}
296
297	if (!ok) {
298		warnx("Could not find an ELF PaX SHT_NOTE section in `%s'",
299		    name);
300		goto out;
301	}
302
303	error = 0;
304	if (list && !flagged) {
305		if (many)
306			(void)printf("%s: ", name);
307		(void)printf("No PaX flags.\n");
308	}
309out:
310	(void)close(fd);
311	return error;
312}
313
314int
315main(int argc, char **argv)
316{
317	char *opt;
318	int i, list = 0, bad = 0, many, minus;
319	uint32_t add_flags = 0, del_flags = 0;
320
321	setprogname(argv[0]);
322
323	if (argc < 2)
324		usage();
325
326	for (i = 1; i < argc; i++) {
327		opt = argv[i];
328
329		if (*opt == '-' || *opt == '+') {
330			uint32_t t;
331			minus = 0;
332
333			while (*opt) {
334				switch (*opt) {
335				case '+':
336					minus = 0;
337					opt++;
338					break;
339				case '-':
340					minus = 1;
341					opt++;
342					break;
343				case ',':
344					opt++;
345					break;
346				default:
347					t = pax_flag(*opt++);
348					if (t == (uint32_t)-1)
349						usage();
350					if (minus)
351						del_flags |= t;
352					else
353						add_flags |= t;
354					break;
355				}
356			}
357		} else
358			break;
359	}
360
361	if (i == argc)
362		usage();
363
364	if (add_flags || del_flags) {
365		if (list)
366			usage();
367	} else
368		list = 1;
369
370	many = i != argc - 1;
371	for (; i < argc; i++)
372		bad |= process_one(argv[i], add_flags, del_flags, list, many);
373
374	return bad ? EXIT_FAILURE : 0;
375}
376