kern_pax.c revision 1.28
1/* $NetBSD: kern_pax.c,v 1.28 2015/04/13 16:36:12 riastradh Exp $ */ 2 3/*- 4 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30#include <sys/cdefs.h> 31__KERNEL_RCSID(0, "$NetBSD: kern_pax.c,v 1.28 2015/04/13 16:36:12 riastradh Exp $"); 32 33#include "opt_pax.h" 34 35#include <sys/param.h> 36#include <sys/proc.h> 37#include <sys/exec_elf.h> 38#include <sys/pax.h> 39#include <sys/sysctl.h> 40#include <sys/kmem.h> 41#include <sys/fileassoc.h> 42#include <sys/syslog.h> 43#include <sys/vnode.h> 44#include <sys/queue.h> 45#include <sys/kauth.h> 46#include <sys/cprng.h> 47 48#ifdef PAX_ASLR 49#include <sys/mman.h> 50#include <sys/exec.h> 51 52int pax_aslr_enabled = 1; 53int pax_aslr_global = PAX_ASLR; 54 55#ifndef PAX_ASLR_DELTA_MMAP_LSB 56#define PAX_ASLR_DELTA_MMAP_LSB PGSHIFT 57#endif 58#ifndef PAX_ASLR_DELTA_MMAP_LEN 59#define PAX_ASLR_DELTA_MMAP_LEN ((sizeof(void *) * NBBY) / 2) 60#endif 61#ifndef PAX_ASLR_DELTA_STACK_LSB 62#define PAX_ASLR_DELTA_STACK_LSB PGSHIFT 63#endif 64#ifndef PAX_ASLR_DELTA_STACK_LEN 65#define PAX_ASLR_DELTA_STACK_LEN 12 66#endif 67 68#endif /* PAX_ASLR */ 69 70#ifdef PAX_MPROTECT 71static int pax_mprotect_enabled = 1; 72static int pax_mprotect_global = PAX_MPROTECT; 73#endif /* PAX_MPROTECT */ 74 75#ifdef PAX_SEGVGUARD 76#ifndef PAX_SEGVGUARD_EXPIRY 77#define PAX_SEGVGUARD_EXPIRY (2 * 60) 78#endif 79 80#ifndef PAX_SEGVGUARD_SUSPENSION 81#define PAX_SEGVGUARD_SUSPENSION (10 * 60) 82#endif 83 84#ifndef PAX_SEGVGUARD_MAXCRASHES 85#define PAX_SEGVGUARD_MAXCRASHES 5 86#endif 87 88static int pax_segvguard_enabled = 1; 89static int pax_segvguard_global = PAX_SEGVGUARD; 90static int pax_segvguard_expiry = PAX_SEGVGUARD_EXPIRY; 91static int pax_segvguard_suspension = PAX_SEGVGUARD_SUSPENSION; 92static int pax_segvguard_maxcrashes = PAX_SEGVGUARD_MAXCRASHES; 93 94static fileassoc_t segvguard_id; 95 96struct pax_segvguard_uid_entry { 97 uid_t sue_uid; 98 size_t sue_ncrashes; 99 time_t sue_expiry; 100 time_t sue_suspended; 101 LIST_ENTRY(pax_segvguard_uid_entry) sue_list; 102}; 103 104struct pax_segvguard_entry { 105 LIST_HEAD(, pax_segvguard_uid_entry) segv_uids; 106}; 107 108static void pax_segvguard_cb(void *); 109#endif /* PAX_SEGVGUARD */ 110 111/* PaX internal setspecific flags */ 112#define PAX_MPROTECT_EXPLICIT_ENABLE (void *)0x01 113#define PAX_MPROTECT_EXPLICIT_DISABLE (void *)0x02 114#define PAX_SEGVGUARD_EXPLICIT_ENABLE (void *)0x03 115#define PAX_SEGVGUARD_EXPLICIT_DISABLE (void *)0x04 116#define PAX_ASLR_EXPLICIT_ENABLE (void *)0x05 117#define PAX_ASLR_EXPLICIT_DISABLE (void *)0x06 118 119SYSCTL_SETUP(sysctl_security_pax_setup, "sysctl security.pax setup") 120{ 121 const struct sysctlnode *rnode = NULL, *cnode; 122 123 sysctl_createv(clog, 0, NULL, &rnode, 124 CTLFLAG_PERMANENT, 125 CTLTYPE_NODE, "pax", 126 SYSCTL_DESCR("PaX (exploit mitigation) features."), 127 NULL, 0, NULL, 0, 128 CTL_SECURITY, CTL_CREATE, CTL_EOL); 129 130 cnode = rnode; 131 132#ifdef PAX_MPROTECT 133 rnode = cnode; 134 sysctl_createv(clog, 0, &rnode, &rnode, 135 CTLFLAG_PERMANENT, 136 CTLTYPE_NODE, "mprotect", 137 SYSCTL_DESCR("mprotect(2) W^X restrictions."), 138 NULL, 0, NULL, 0, 139 CTL_CREATE, CTL_EOL); 140 sysctl_createv(clog, 0, &rnode, NULL, 141 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 142 CTLTYPE_INT, "enabled", 143 SYSCTL_DESCR("Restrictions enabled."), 144 NULL, 0, &pax_mprotect_enabled, 0, 145 CTL_CREATE, CTL_EOL); 146 sysctl_createv(clog, 0, &rnode, NULL, 147 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 148 CTLTYPE_INT, "global", 149 SYSCTL_DESCR("When enabled, unless explicitly " 150 "specified, apply restrictions to " 151 "all processes."), 152 NULL, 0, &pax_mprotect_global, 0, 153 CTL_CREATE, CTL_EOL); 154#endif /* PAX_MPROTECT */ 155 156#ifdef PAX_SEGVGUARD 157 rnode = cnode; 158 sysctl_createv(clog, 0, &rnode, &rnode, 159 CTLFLAG_PERMANENT, 160 CTLTYPE_NODE, "segvguard", 161 SYSCTL_DESCR("PaX segvguard."), 162 NULL, 0, NULL, 0, 163 CTL_CREATE, CTL_EOL); 164 sysctl_createv(clog, 0, &rnode, NULL, 165 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 166 CTLTYPE_INT, "enabled", 167 SYSCTL_DESCR("segvguard enabled."), 168 NULL, 0, &pax_segvguard_enabled, 0, 169 CTL_CREATE, CTL_EOL); 170 sysctl_createv(clog, 0, &rnode, NULL, 171 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 172 CTLTYPE_INT, "global", 173 SYSCTL_DESCR("segvguard all programs."), 174 NULL, 0, &pax_segvguard_global, 0, 175 CTL_CREATE, CTL_EOL); 176 sysctl_createv(clog, 0, &rnode, NULL, 177 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 178 CTLTYPE_INT, "expiry_timeout", 179 SYSCTL_DESCR("Entry expiry timeout (in seconds)."), 180 NULL, 0, &pax_segvguard_expiry, 0, 181 CTL_CREATE, CTL_EOL); 182 sysctl_createv(clog, 0, &rnode, NULL, 183 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 184 CTLTYPE_INT, "suspend_timeout", 185 SYSCTL_DESCR("Entry suspension timeout (in seconds)."), 186 NULL, 0, &pax_segvguard_suspension, 0, 187 CTL_CREATE, CTL_EOL); 188 sysctl_createv(clog, 0, &rnode, NULL, 189 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 190 CTLTYPE_INT, "max_crashes", 191 SYSCTL_DESCR("Max number of crashes before expiry."), 192 NULL, 0, &pax_segvguard_maxcrashes, 0, 193 CTL_CREATE, CTL_EOL); 194#endif /* PAX_SEGVGUARD */ 195 196#ifdef PAX_ASLR 197 rnode = cnode; 198 sysctl_createv(clog, 0, &rnode, &rnode, 199 CTLFLAG_PERMANENT, 200 CTLTYPE_NODE, "aslr", 201 SYSCTL_DESCR("Address Space Layout Randomization."), 202 NULL, 0, NULL, 0, 203 CTL_CREATE, CTL_EOL); 204 sysctl_createv(clog, 0, &rnode, NULL, 205 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 206 CTLTYPE_INT, "enabled", 207 SYSCTL_DESCR("Restrictions enabled."), 208 NULL, 0, &pax_aslr_enabled, 0, 209 CTL_CREATE, CTL_EOL); 210 sysctl_createv(clog, 0, &rnode, NULL, 211 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 212 CTLTYPE_INT, "global", 213 SYSCTL_DESCR("When enabled, unless explicitly " 214 "specified, apply to all processes."), 215 NULL, 0, &pax_aslr_global, 0, 216 CTL_CREATE, CTL_EOL); 217 sysctl_createv(clog, 0, &rnode, NULL, 218 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 219 CTLTYPE_INT, "mmap_len", 220 SYSCTL_DESCR("Number of bits randomized for " 221 "mmap(2) calls."), 222 NULL, PAX_ASLR_DELTA_MMAP_LEN, NULL, 0, 223 CTL_CREATE, CTL_EOL); 224 sysctl_createv(clog, 0, &rnode, NULL, 225 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 226 CTLTYPE_INT, "stack_len", 227 SYSCTL_DESCR("Number of bits randomized for " 228 "the stack."), 229 NULL, PAX_ASLR_DELTA_STACK_LEN, NULL, 0, 230 CTL_CREATE, CTL_EOL); 231 sysctl_createv(clog, 0, &rnode, NULL, 232 CTLFLAG_PERMANENT|CTLFLAG_IMMEDIATE, 233 CTLTYPE_INT, "exec_len", 234 SYSCTL_DESCR("Number of bits randomized for " 235 "the PIE exec base."), 236 NULL, PAX_ASLR_DELTA_EXEC_LEN, NULL, 0, 237 CTL_CREATE, CTL_EOL); 238 239#endif /* PAX_ASLR */ 240} 241 242/* 243 * Initialize PaX. 244 */ 245void 246pax_init(void) 247{ 248#ifdef PAX_SEGVGUARD 249 int error; 250#endif /* PAX_SEGVGUARD */ 251 252#ifdef PAX_SEGVGUARD 253 error = fileassoc_register("segvguard", pax_segvguard_cb, 254 &segvguard_id); 255 if (error) { 256 panic("pax_init: segvguard_id: error=%d\n", error); 257 } 258#endif /* PAX_SEGVGUARD */ 259} 260 261#ifdef PAX_MPROTECT 262void 263pax_mprotect(struct lwp *l, vm_prot_t *prot, vm_prot_t *maxprot) 264{ 265 uint32_t f; 266 267 if (!pax_mprotect_enabled) 268 return; 269 270 f = l->l_proc->p_pax; 271 if ((pax_mprotect_global && (f & ELF_NOTE_PAX_NOMPROTECT) != 0) || 272 (!pax_mprotect_global && (f & ELF_NOTE_PAX_MPROTECT) == 0)) 273 return; 274 275 if ((*prot & (VM_PROT_WRITE|VM_PROT_EXECUTE)) != VM_PROT_EXECUTE) { 276 *prot &= ~VM_PROT_EXECUTE; 277 *maxprot &= ~VM_PROT_EXECUTE; 278 } else { 279 *prot &= ~VM_PROT_WRITE; 280 *maxprot &= ~VM_PROT_WRITE; 281 } 282} 283#endif /* PAX_MPROTECT */ 284 285#ifdef PAX_ASLR 286bool 287pax_aslr_active(struct lwp *l) 288{ 289 uint32_t f; 290 291 if (!pax_aslr_enabled) 292 return false; 293 294 f = l->l_proc->p_pax; 295 if ((pax_aslr_global && (f & ELF_NOTE_PAX_NOASLR) != 0) || 296 (!pax_aslr_global && (f & ELF_NOTE_PAX_ASLR) == 0)) 297 return false; 298 return true; 299} 300 301void 302pax_aslr_init(struct lwp *l, struct vmspace *vm) 303{ 304 if (!pax_aslr_active(l)) 305 return; 306 307 vm->vm_aslr_delta_mmap = PAX_ASLR_DELTA(cprng_fast32(), 308 PAX_ASLR_DELTA_MMAP_LSB, PAX_ASLR_DELTA_MMAP_LEN); 309} 310 311void 312pax_aslr(struct lwp *l, vaddr_t *addr, vaddr_t orig_addr, int f) 313{ 314 if (!pax_aslr_active(l)) 315 return; 316 317 if (!(f & MAP_FIXED) && ((orig_addr == 0) || !(f & MAP_ANON))) { 318#ifdef PAX_ASLR_DEBUG 319 uprintf("applying to 0x%lx orig_addr=0x%lx f=%x\n", 320 (unsigned long)*addr, (unsigned long)orig_addr, f); 321#endif 322 if (!(l->l_proc->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN)) 323 *addr += l->l_proc->p_vmspace->vm_aslr_delta_mmap; 324 else 325 *addr -= l->l_proc->p_vmspace->vm_aslr_delta_mmap; 326#ifdef PAX_ASLR_DEBUG 327 uprintf("result 0x%lx\n", *addr); 328#endif 329 } 330#ifdef PAX_ASLR_DEBUG 331 else 332 uprintf("not applying to 0x%lx orig_addr=0x%lx f=%x\n", 333 (unsigned long)*addr, (unsigned long)orig_addr, f); 334#endif 335} 336 337void 338pax_aslr_stack(struct lwp *l, struct exec_package *epp, u_long *max_stack_size) 339{ 340 if (pax_aslr_active(l)) { 341 u_long d = PAX_ASLR_DELTA(cprng_fast32(), 342 PAX_ASLR_DELTA_STACK_LSB, 343 PAX_ASLR_DELTA_STACK_LEN); 344#ifdef PAX_ASLR_DEBUG 345 uprintf("stack 0x%lx d=0x%lx 0x%lx\n", 346 epp->ep_minsaddr, d, epp->ep_minsaddr - d); 347#endif 348 epp->ep_minsaddr -= d; 349 *max_stack_size -= d; 350 if (epp->ep_ssize > *max_stack_size) 351 epp->ep_ssize = *max_stack_size; 352 } 353} 354#endif /* PAX_ASLR */ 355 356#ifdef PAX_SEGVGUARD 357static void 358pax_segvguard_cb(void *v) 359{ 360 struct pax_segvguard_entry *p = v; 361 struct pax_segvguard_uid_entry *up; 362 363 if (p == NULL) { 364 return; 365 } 366 while ((up = LIST_FIRST(&p->segv_uids)) != NULL) { 367 LIST_REMOVE(up, sue_list); 368 kmem_free(up, sizeof(*up)); 369 } 370 kmem_free(p, sizeof(*p)); 371} 372 373/* 374 * Called when a process of image vp generated a segfault. 375 */ 376int 377pax_segvguard(struct lwp *l, struct vnode *vp, const char *name, 378 bool crashed) 379{ 380 struct pax_segvguard_entry *p; 381 struct pax_segvguard_uid_entry *up; 382 struct timeval tv; 383 uid_t uid; 384 uint32_t f; 385 bool have_uid; 386 387 if (!pax_segvguard_enabled) 388 return (0); 389 390 f = l->l_proc->p_pax; 391 if ((pax_segvguard_global && (f & ELF_NOTE_PAX_NOGUARD) != 0) || 392 (!pax_segvguard_global && (f & ELF_NOTE_PAX_GUARD) == 0)) 393 return (0); 394 395 if (vp == NULL) 396 return (EFAULT); 397 398 /* Check if we already monitor the file. */ 399 p = fileassoc_lookup(vp, segvguard_id); 400 401 /* Fast-path if starting a program we don't know. */ 402 if (p == NULL && !crashed) 403 return (0); 404 405 microtime(&tv); 406 407 /* 408 * If a program we don't know crashed, we need to create a new entry 409 * for it. 410 */ 411 if (p == NULL) { 412 p = kmem_alloc(sizeof(*p), KM_SLEEP); 413 fileassoc_add(vp, segvguard_id, p); 414 LIST_INIT(&p->segv_uids); 415 416 /* 417 * Initialize a new entry with "crashes so far" of 1. 418 * The expiry time is when we purge the entry if it didn't 419 * reach the limit. 420 */ 421 up = kmem_alloc(sizeof(*up), KM_SLEEP); 422 up->sue_uid = kauth_cred_getuid(l->l_cred); 423 up->sue_ncrashes = 1; 424 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 425 up->sue_suspended = 0; 426 427 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 428 429 return (0); 430 } 431 432 /* 433 * A program we "know" either executed or crashed again. 434 * See if it's a culprit we're familiar with. 435 */ 436 uid = kauth_cred_getuid(l->l_cred); 437 have_uid = false; 438 LIST_FOREACH(up, &p->segv_uids, sue_list) { 439 if (up->sue_uid == uid) { 440 have_uid = true; 441 break; 442 } 443 } 444 445 /* 446 * It's someone else. Add an entry for him if we crashed. 447 */ 448 if (!have_uid) { 449 if (crashed) { 450 up = kmem_alloc(sizeof(*up), KM_SLEEP); 451 up->sue_uid = uid; 452 up->sue_ncrashes = 1; 453 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 454 up->sue_suspended = 0; 455 456 LIST_INSERT_HEAD(&p->segv_uids, up, sue_list); 457 } 458 return (0); 459 } 460 461 if (crashed) { 462 /* Check if timer on previous crashes expired first. */ 463 if (up->sue_expiry < tv.tv_sec) { 464 log(LOG_INFO, "PaX Segvguard: [%s] Suspension" 465 " expired.\n", name ? name : "unknown"); 466 467 up->sue_ncrashes = 1; 468 up->sue_expiry = tv.tv_sec + pax_segvguard_expiry; 469 up->sue_suspended = 0; 470 471 return (0); 472 } 473 474 up->sue_ncrashes++; 475 476 if (up->sue_ncrashes >= pax_segvguard_maxcrashes) { 477 log(LOG_ALERT, "PaX Segvguard: [%s] Suspending " 478 "execution for %d seconds after %zu crashes.\n", 479 name ? name : "unknown", pax_segvguard_suspension, 480 up->sue_ncrashes); 481 482 /* Suspend this program for a while. */ 483 up->sue_suspended = tv.tv_sec + pax_segvguard_suspension; 484 up->sue_ncrashes = 0; 485 up->sue_expiry = 0; 486 } 487 } else { 488 /* Are we supposed to be suspended? */ 489 if (up->sue_suspended > tv.tv_sec) { 490 log(LOG_ALERT, "PaX Segvguard: [%s] Preventing " 491 "execution due to repeated segfaults.\n", name ? 492 name : "unknown"); 493 494 return (EPERM); 495 } 496 } 497 498 return (0); 499} 500#endif /* PAX_SEGVGUARD */ 501