1 /* $NetBSD: t_mprotect.c,v 1.9 2020/04/18 17:44:53 christos Exp $ */
2
3 /*-
4 * Copyright (c) 2011, 2020 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jukka Ruohonen.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31 #include <sys/cdefs.h>
32 __RCSID("$NetBSD: t_mprotect.c,v 1.9 2020/04/18 17:44:53 christos Exp $");
33
34 #include <sys/param.h>
35 #include <sys/mman.h>
36 #include <sys/sysctl.h>
37 #include <sys/wait.h>
38
39 #include <errno.h>
40 #include <fcntl.h>
41 #include <stdlib.h>
42 #include <string.h>
43 #include <unistd.h>
44
45 #include <atf-c.h>
46
47 #include "../common/exec_prot.h"
48 #include "t_mprotect_helper.h"
49
50 static long page = 0;
51 static char path[] = "mmap";
52
53 static void sighandler(int);
54 static bool paxinit(void);
55
56 static void
sighandler(int signo)57 sighandler(int signo)
58 {
59 _exit(signo);
60 }
61
62 static bool
paxinit(void)63 paxinit(void)
64 {
65 size_t len = sizeof(int);
66 int pax_flags;
67 int rv;
68
69 rv = sysctlbyname("proc.curproc.paxflags",
70 &pax_flags, &len, NULL, 0);
71
72 if (rv != 0)
73 return false;
74
75 return ((pax_flags & CTL_PROC_PAXFLAGS_MPROTECT) != 0);
76 }
77
78 ATF_TC_WITH_CLEANUP(mprotect_access);
ATF_TC_HEAD(mprotect_access,tc)79 ATF_TC_HEAD(mprotect_access, tc)
80 {
81 atf_tc_set_md_var(tc, "descr", "Test for EACCES from mprotect(2)");
82 }
83
ATF_TC_BODY(mprotect_access,tc)84 ATF_TC_BODY(mprotect_access, tc)
85 {
86 int prot[2] = { PROT_NONE, PROT_READ };
87 void *map;
88 size_t i;
89 int fd;
90
91 fd = open(path, O_RDONLY | O_CREAT, 0600);
92 ATF_REQUIRE(fd >= 0);
93
94 /*
95 * The call should fail with EACCES if we try to mark
96 * a PROT_NONE or PROT_READ file/section as PROT_WRITE.
97 */
98 for (i = 0; i < __arraycount(prot); i++) {
99
100 map = mmap(NULL, page, prot[i], MAP_SHARED, fd, 0);
101
102 if (map == MAP_FAILED)
103 continue;
104
105 errno = 0;
106
107 ATF_REQUIRE(mprotect(map, page, PROT_WRITE) != 0);
108 ATF_REQUIRE(errno == EACCES);
109 ATF_REQUIRE(munmap(map, page) == 0);
110 }
111
112 ATF_REQUIRE(close(fd) == 0);
113 }
114
ATF_TC_CLEANUP(mprotect_access,tc)115 ATF_TC_CLEANUP(mprotect_access, tc)
116 {
117 (void)unlink(path);
118 }
119
120 ATF_TC(mprotect_err);
ATF_TC_HEAD(mprotect_err,tc)121 ATF_TC_HEAD(mprotect_err, tc)
122 {
123 atf_tc_set_md_var(tc, "descr", "Test error conditions of mprotect(2)");
124 }
125
ATF_TC_BODY(mprotect_err,tc)126 ATF_TC_BODY(mprotect_err, tc)
127 {
128 errno = 0;
129
130 ATF_REQUIRE(mprotect((char *)-1, 1, PROT_READ) != 0);
131 ATF_REQUIRE(errno == EINVAL);
132 }
133
134 ATF_TC(mprotect_exec);
ATF_TC_HEAD(mprotect_exec,tc)135 ATF_TC_HEAD(mprotect_exec, tc)
136 {
137 atf_tc_set_md_var(tc, "descr",
138 "Test mprotect(2) executable space protections");
139 }
140
141 /*
142 * Trivial function -- should fit into a page
143 */
ATF_TC_BODY(mprotect_exec,tc)144 ATF_TC_BODY(mprotect_exec, tc)
145 {
146 pid_t pid;
147 void *map;
148 int sta, xp_support;
149
150 xp_support = exec_prot_support();
151
152 switch (xp_support) {
153 case NOTIMPL:
154 atf_tc_skip(
155 "Execute protection callback check not implemented");
156 break;
157 case NO_XP:
158 atf_tc_skip(
159 "Host does not support executable space protection");
160 break;
161 case PARTIAL_XP: case PERPAGE_XP: default:
162 break;
163 }
164
165 /*
166 * Map a page read/write and copy a trivial assembly function inside.
167 * We will then change the mapping rights:
168 * - first by setting the execution right, and check that we can
169 * call the code found in the allocated page.
170 * - second by removing the execution right. This should generate
171 * a SIGSEGV on architectures that can enforce --x permissions.
172 */
173
174 map = mmap(NULL, page, PROT_MPROTECT(PROT_EXEC)|PROT_WRITE|PROT_READ,
175 MAP_ANON, -1, 0);
176 ATF_REQUIRE(map != MAP_FAILED);
177
178 memcpy(map, (void *)return_one,
179 (uintptr_t)return_one_end - (uintptr_t)return_one);
180
181 /* give r-x rights then call code in page */
182 ATF_REQUIRE(mprotect(map, page, PROT_EXEC|PROT_READ) == 0);
183 ATF_REQUIRE(((int (*)(void))map)() == 1);
184
185 /* remove --x right */
186 ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0);
187
188 pid = fork();
189 ATF_REQUIRE(pid >= 0);
190
191 if (pid == 0) {
192 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR);
193 ATF_CHECK(((int (*)(void))map)() == 1);
194 _exit(0);
195 }
196
197 (void)wait(&sta);
198
199 ATF_REQUIRE(munmap(map, page) == 0);
200
201 ATF_REQUIRE(WIFEXITED(sta) != 0);
202
203 switch (xp_support) {
204 case PARTIAL_XP:
205 /* Partial protection might fail; skip the test when it does */
206 if (WEXITSTATUS(sta) != SIGSEGV) {
207 atf_tc_skip("Host only supports "
208 "partial executable space protection");
209 }
210 break;
211 case PERPAGE_XP: default:
212 /* Per-page --x protection should not fail */
213 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
214 break;
215 }
216 }
217
218 ATF_TC(mprotect_pax);
ATF_TC_HEAD(mprotect_pax,tc)219 ATF_TC_HEAD(mprotect_pax, tc)
220 {
221 atf_tc_set_md_var(tc, "descr", "PaX restrictions and mprotect(2)");
222 atf_tc_set_md_var(tc, "require.user", "root");
223 }
224
ATF_TC_BODY(mprotect_pax,tc)225 ATF_TC_BODY(mprotect_pax, tc)
226 {
227 const int prot[4] = { PROT_NONE, PROT_READ, PROT_WRITE };
228 const char *str = NULL;
229 void *map;
230 size_t i;
231 int rv;
232
233 if (!paxinit())
234 atf_tc_skip("PaX MPROTECT restrictions not enabled");
235
236 /*
237 * As noted in the original PaX documentation [1],
238 * the following restrictions should apply:
239 *
240 * (1) creating executable anonymous mappings
241 *
242 * (2) creating executable/writable file mappings
243 *
244 * (3) making a non-executable mapping executable
245 *
246 * (4) making an executable/read-only file mapping
247 * writable except for performing relocations
248 * on an ET_DYN ELF file (non-PIC shared library)
249 *
250 * The following will test only the case (3).
251 *
252 * [1] http://pax.grsecurity.net/docs/mprotect.txt
253 *
254 * (Sun Apr 3 11:06:53 EEST 2011.)
255 */
256 for (i = 0; i < __arraycount(prot); i++) {
257
258 map = mmap(NULL, page, prot[i], MAP_ANON, -1, 0);
259
260 if (map == MAP_FAILED)
261 continue;
262
263 rv = mprotect(map, 1, prot[i] | PROT_EXEC);
264
265 (void)munmap(map, page);
266
267 if (rv == 0) {
268 str = "non-executable mapping made executable";
269 goto out;
270 }
271 }
272
273 out:
274 if (str != NULL)
275 atf_tc_fail("%s", str);
276 }
277
278 ATF_TC(mprotect_write);
ATF_TC_HEAD(mprotect_write,tc)279 ATF_TC_HEAD(mprotect_write, tc)
280 {
281 atf_tc_set_md_var(tc, "descr", "Test mprotect(2) write protections");
282 }
283
ATF_TC_BODY(mprotect_write,tc)284 ATF_TC_BODY(mprotect_write, tc)
285 {
286 pid_t pid;
287 void *map;
288 int sta;
289
290 /*
291 * Map a page read/write, change the protection
292 * to read-only with mprotect(2), and try to write
293 * to the page. This should generate a SIGSEGV.
294 */
295 map = mmap(NULL, page, PROT_WRITE|PROT_READ, MAP_ANON, -1, 0);
296 ATF_REQUIRE(map != MAP_FAILED);
297
298 ATF_REQUIRE(strlcpy(map, "XXX", 3) == 3);
299 ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0);
300
301 pid = fork();
302 ATF_REQUIRE(pid >= 0);
303
304 if (pid == 0) {
305 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR);
306 ATF_REQUIRE(strlcpy(map, "XXX", 3) == 0);
307 }
308
309 (void)wait(&sta);
310
311 ATF_REQUIRE(WIFEXITED(sta) != 0);
312 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
313 ATF_REQUIRE(munmap(map, page) == 0);
314 }
315
316 ATF_TC(mprotect_mremap_exec);
ATF_TC_HEAD(mprotect_mremap_exec,tc)317 ATF_TC_HEAD(mprotect_mremap_exec, tc)
318 {
319 atf_tc_set_md_var(tc, "descr",
320 "Test mremap(2)+mprotect(2) executable space protections");
321 }
322
323 /*
324 * Trivial function -- should fit into a page
325 */
ATF_TC_BODY(mprotect_mremap_exec,tc)326 ATF_TC_BODY(mprotect_mremap_exec, tc)
327 {
328 void *map, *map2;
329 pid_t pid;
330 int sta;
331
332 /*
333 * Map a page read/write/exec and duplicate it.
334 * Map the copy executable.
335 * Copy a trivial assembly function to the writeable mapping.
336 * Try to execute it. This should never create a SIGSEGV.
337 */
338
339 map = mmap(NULL, page, PROT_MPROTECT(PROT_EXEC|PROT_WRITE|PROT_READ),
340 MAP_ANON, -1, 0);
341 ATF_REQUIRE(map != MAP_FAILED);
342 map2 = mremap(map, page, NULL, page, MAP_REMAPDUP);
343 ATF_REQUIRE(map2 != MAP_FAILED);
344 ATF_REQUIRE(mprotect(map, page, PROT_WRITE|PROT_READ) == 0);
345 ATF_REQUIRE(mprotect(map2, page, PROT_EXEC|PROT_READ) == 0);
346
347 memcpy(map, (void *)return_one,
348 (uintptr_t)return_one_end - (uintptr_t)return_one);
349 __builtin___clear_cache(map, (void *)((uintptr_t)map + page));
350
351 ATF_REQUIRE(((int (*)(void))map2)() == 1);
352
353 /* Double check that the executable mapping is not writeable. */
354 pid = fork();
355 ATF_REQUIRE(pid >= 0);
356
357 if (pid == 0) {
358 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR);
359 ATF_REQUIRE(strlcpy(map2, "XXX", 3) == 0);
360 }
361
362 (void)wait(&sta);
363
364 ATF_REQUIRE(WIFEXITED(sta) != 0);
365 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
366
367 if (exec_prot_support() == PERPAGE_XP) {
368 /* Double check that the writeable mapping is not executable. */
369 pid = fork();
370 ATF_REQUIRE(pid >= 0);
371
372 if (pid == 0) {
373 ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR);
374 ATF_REQUIRE(((int (*)(void))map)() == 1);
375 }
376
377 (void)wait(&sta);
378
379 ATF_REQUIRE(WIFEXITED(sta) != 0);
380 ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
381 }
382
383 ATF_REQUIRE(munmap(map, page) == 0);
384 ATF_REQUIRE(munmap(map2, page) == 0);
385 }
386
387 ATF_TC(mprotect_mremap_fork_exec);
ATF_TC_HEAD(mprotect_mremap_fork_exec,tc)388 ATF_TC_HEAD(mprotect_mremap_fork_exec, tc)
389 {
390 atf_tc_set_md_var(tc, "descr",
391 "Test mremap(2)+fork(2)+mprotect(2) executable space protections");
392 }
393
ATF_TC_BODY(mprotect_mremap_fork_exec,tc)394 ATF_TC_BODY(mprotect_mremap_fork_exec, tc)
395 {
396 void *map, *map2;
397 pid_t pid;
398
399 atf_tc_expect_fail("PR lib/55177");
400
401 /*
402 * Map a page read/write/exec and duplicate it.
403 * Map the copy executable.
404 * Copy a function to the writeable mapping and execute it
405 * Fork a child and wait for it
406 * Copy a different function to the writeable mapping and execute it
407 * The original function shouldn't be called
408 */
409
410 map = mmap(NULL, page, PROT_READ|PROT_WRITE|PROT_MPROTECT(PROT_EXEC),
411 MAP_ANON, -1, 0);
412 ATF_REQUIRE(map != MAP_FAILED);
413 map2 = mremap(map, page, NULL, page, MAP_REMAPDUP);
414 ATF_REQUIRE(map2 != MAP_FAILED);
415 ATF_REQUIRE(mprotect(map2, page, PROT_EXEC|PROT_READ) == 0);
416
417 memcpy(map, (void *)return_1,
418 (uintptr_t)return_2 - (uintptr_t)return_1);
419 __builtin___clear_cache(map, (void *)((uintptr_t)map + page));
420
421 ATF_REQUIRE(((int (*)(void))map2)() == 1);
422
423 pid = fork();
424 ATF_REQUIRE(pid >= 0);
425
426 if (pid == 0)
427 _exit(0);
428
429 (void)wait(NULL);
430
431 memcpy(map, (void *)return_2,
432 (uintptr_t)return_3 - (uintptr_t)return_2);
433 __builtin___clear_cache(map, (void *)((uintptr_t)map + page));
434
435 ATF_REQUIRE(((int (*)(void))map2)() == 2);
436
437 ATF_REQUIRE(munmap(map, page) == 0);
438 ATF_REQUIRE(munmap(map2, page) == 0);
439 }
440
ATF_TP_ADD_TCS(tp)441 ATF_TP_ADD_TCS(tp)
442 {
443 page = sysconf(_SC_PAGESIZE);
444 ATF_REQUIRE(page >= 0);
445
446 ATF_TP_ADD_TC(tp, mprotect_access);
447 ATF_TP_ADD_TC(tp, mprotect_err);
448 ATF_TP_ADD_TC(tp, mprotect_exec);
449 ATF_TP_ADD_TC(tp, mprotect_pax);
450 ATF_TP_ADD_TC(tp, mprotect_write);
451 ATF_TP_ADD_TC(tp, mprotect_mremap_exec);
452 ATF_TP_ADD_TC(tp, mprotect_mremap_fork_exec);
453
454 return atf_no_error();
455 }
456