ATF_TC_BODY(mprotect_pax, tc)
{
const int prot[4] = { PROT_NONE, PROT_READ, PROT_WRITE };
const char *str = NULL;
void *map;
size_t i;
int rv;
if (paxinit() != true)
return;
/*
* As noted in the original PaX documentation [1],
* the following restrictions should apply:
*
* (1) creating executable anonymous mappings
*
* (2) creating executable/writable file mappings
*
* (3) making a non-executable mapping executable
*
* (4) making an executable/read-only file mapping
* writable except for performing relocations
* on an ET_DYN ELF file (non-PIC shared library)
*
* The following will test only the case (3).
*
* [1] http://pax.grsecurity.net/docs/mprotect.txt
*
* (Sun Apr 3 11:06:53 EEST 2011.)
*/
for (i = 0; i < __arraycount(prot); i++) {
map = mmap(NULL, page, prot[i], MAP_ANON, -1, 0);
if (map == MAP_FAILED)
continue;
rv = mprotect(map, 1, prot[i] | PROT_EXEC);
(void)munmap(map, page);
if (rv == 0) {
str = "non-executable mapping made executable";
goto out;
}
}
out:
if (pax_global != -1 && pax_enabled != -1)
(void)paxset(pax_global, pax_enabled);
if (str != NULL)
atf_tc_fail("%s", str);
}
/*
* Trivial function -- should fit into a page
*/
ATF_TC_BODY(mprotect_exec, tc)
{
pid_t pid;
void *map;
int sta, xp_support;
xp_support = exec_prot_support();
switch (xp_support) {
case NOTIMPL:
atf_tc_skip(
"Execute protection callback check not implemented");
break;
case NO_XP:
atf_tc_skip(
"Host does not support executable space protection");
break;
case PARTIAL_XP: case PERPAGE_XP: default:
break;
}
if (!paxinit())
return;
if (pax_enabled == 1 && pax_global == 1)
atf_tc_skip("PaX MPROTECT restrictions enabled");
/*
* Map a page read/write and copy a trivial assembly function inside.
* We will then change the mapping rights:
* - first by setting the execution right, and check that we can
* call the code found in the allocated page.
* - second by removing the execution right. This should generate
* a SIGSEGV on architectures that can enforce --x permissions.
*/
map = mmap(NULL, page, PROT_WRITE|PROT_READ, MAP_ANON, -1, 0);
ATF_REQUIRE(map != MAP_FAILED);
memcpy(map, (void *)return_one,
(uintptr_t)return_one_end - (uintptr_t)return_one);
/* give r-x rights then call code in page */
ATF_REQUIRE(mprotect(map, page, PROT_EXEC|PROT_READ) == 0);
ATF_REQUIRE(((int (*)(void))map)() == 1);
/* remove --x right */
ATF_REQUIRE(mprotect(map, page, PROT_READ) == 0);
pid = fork();
ATF_REQUIRE(pid >= 0);
if (pid == 0) {
ATF_REQUIRE(signal(SIGSEGV, sighandler) != SIG_ERR);
ATF_CHECK(((int (*)(void))map)() == 1);
_exit(0);
}
(void)wait(&sta);
ATF_REQUIRE(munmap(map, page) == 0);
ATF_REQUIRE(WIFEXITED(sta) != 0);
switch (xp_support) {
case PARTIAL_XP:
/* Partial protection might fail; skip the test when it does */
if (WEXITSTATUS(sta) != SIGSEGV) {
atf_tc_skip("Host only supports "
"partial executable space protection");
}
break;
case PERPAGE_XP: default:
/* Per-page --x protection should not fail */
ATF_REQUIRE(WEXITSTATUS(sta) == SIGSEGV);
break;
}
}
