Print this page
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/zonecfg/zonecfg_lex.l
          +++ new/usr/src/cmd/zonecfg/zonecfg_lex.l
↓ open down ↓ 175 lines elided ↑ open up ↑
 176  176  <TSTATE>fs      { return FS; }
 177  177  
 178  178  <TSTATE>device  { return DEVICE; }
 179  179  
 180  180  <TSTATE>rctl    { return RCTL; }
 181  181  
 182  182  <TSTATE>attr    { return ATTR; }
 183  183  
 184  184  <TSTATE>admin   { return ADMIN; }
 185  185  
      186 +<TSTATE>security-flags { return SECFLAGS; }
      187 +
 186  188  <TSTATE>zonename        { return ZONENAME; }
 187  189  <CSTATE>zonename        { return ZONENAME; }
 188  190  
 189  191  <TSTATE>dataset { return DATASET; }
 190  192  
 191  193  <TSTATE>dedicated-cpu   { return PSET; }
 192  194  
 193  195  <TSTATE>capped-cpu      { return PCAP; }
 194  196  
 195  197  <TSTATE>capped-memory   { return MCAP; }
↓ open down ↓ 105 lines elided ↑ open up ↑
 301  303  
 302  304  <TSTATE>user    { return USER; }
 303  305  <CSTATE>user    { return USER; }
 304  306  
 305  307  <TSTATE>auths   { return AUTHS; }
 306  308  <CSTATE>auths   { return AUTHS; }
 307  309  
 308  310  <TSTATE>fs-allowed      { return FS_ALLOWED; }
 309  311  <CSTATE>fs-allowed      { return FS_ALLOWED; }
 310  312  
      313 +<TSTATE>default { return DEFAULT; }
      314 +<CSTATE>default { return DEFAULT; }
      315 +
      316 +<TSTATE>lower { return LOWER; }
      317 +<CSTATE>lower { return LOWER; }
      318 +
      319 +<TSTATE>upper { return UPPER; }
      320 +<CSTATE>upper { return UPPER; }
      321 +
 311  322  <TSTATE>=       { return EQUAL; }
 312  323  <LSTATE>=       { return EQUAL; }
 313  324  <CSTATE>=       { return EQUAL; }
 314  325  
 315  326  <TSTATE>"["     {
 316  327                          BEGIN LSTATE;
 317  328                          state = LSTATE;
 318  329                          return OPEN_SQ_BRACKET;
 319  330                  }
 320  331  
↓ open down ↓ 213 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX