Print this page 
uts: Allow for address space randomisation.
Randomise the base addresses of shared objects, non-fixed mappings, the
stack and the heap.  Introduce a service, svc:/system/process-security,
and a tool psecflags(1) to control and observe it
Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/truss/print.c
          +++ new/usr/src/cmd/truss/print.c
↓ open down ↓ 59 lines elided ↑ open up ↑ 
  60   60  #include <sys/aio.h>
  61   61  #include <sys/aiocb.h>
  62   62  #include <sys/corectl.h>
  63   63  #include <sys/cpc_impl.h>
  64   64  #include <sys/priocntl.h>
  65   65  #include <sys/tspriocntl.h>
  66   66  #include <sys/iapriocntl.h>
  67   67  #include <sys/rtpriocntl.h>
  68   68  #include <sys/fsspriocntl.h>
  69   69  #include <sys/fxpriocntl.h>
       70 +#include <sys/proc.h>
  70   71  #include <netdb.h>
  71   72  #include <nss_dbdefs.h>
  72   73  #include <sys/socketvar.h>
  73   74  #include <netinet/in.h>
  74   75  #include <netinet/tcp.h>
  75   76  #include <netinet/udp.h>
  76   77  #include <netinet/sctp.h>
  77   78  #include <net/route.h>
  78   79  #include <sys/utrap.h>
  79   80  #include <sys/lgrp_user.h>
↓ open down ↓ 1513 lines elided ↑ open up ↑ 
1593 1594                  print_pck(pri, 0, vpp->pc_key);
1594 1595                  outstring(pri, ", ");
1595 1596                  prt_hex(pri, 0, (long)vpp->pc_parm);
1596 1597                  outstring(pri, ", ");
1597 1598          }
1598 1599  
1599 1600          prt_dec(pri, 0, PC_KY_NULL);
1600 1601  }
1601 1602  
1602 1603  /*
     1604 + * Print a psecflags(2) command
     1605 + */
     1606 +void
     1607 +prt_psfcmd(private_t *pri, int raw, long val)
     1608 +{
     1609 +        const char *s = NULL;
     1610 +
     1611 +        if (raw == 0) {
     1612 +                switch ((psecflags_cmd_t)val) {
     1613 +                case PSECFLAGS_SET:
     1614 +                        s = "PSECFLAGS_SET";
     1615 +                        break;
     1616 +                case PSECFLAGS_DISABLE:
     1617 +                        s = "PSECFLAGS_DISABLE";
     1618 +                        break;
     1619 +                case PSECFLAGS_ENABLE:
     1620 +                        s = "PSECFLAGS_ENABLE";
     1621 +                        break;
     1622 +                }
     1623 +        }
     1624 +
     1625 +        if (s == NULL)
     1626 +                prt_dec(pri, 0, val);
     1627 +        else
     1628 +                outstring(pri, s);
     1629 +}
     1630 +
     1631 +void
     1632 +prt_psflags(private_t *pri, int raw, long val)
     1633 +{
     1634 +        char *str = pri->code_buf;
     1635 +
     1636 +        if (raw == 1) {
     1637 +                prt_hex(pri, 0, val);
     1638 +                return;
     1639 +        }
     1640 +
     1641 +        *str = '\0';
     1642 +        if (val & PROC_SEC_ASLR) {
     1643 +                (void) strlcat(str, "|PROC_SEC_ASLR", sizeof (pri->code_buf));
     1644 +                val &= ~PROC_SEC_ASLR;
     1645 +        }
     1646 +
     1647 +        if (val != 0)
     1648 +                (void) snprintf(str, sizeof (pri->code_buf), "%s|%x", str, val);
     1649 +
     1650 +        outstring(pri, str + 1);
     1651 +}
     1652 +
     1653 +/*
1603 1654   * Print processor set id, including logical expansion of "special" ids.
1604 1655   */
1605 1656  void
1606 1657  prt_pst(private_t *pri, int raw, long val)
1607 1658  {
1608 1659          const char *s = NULL;
1609 1660  
1610 1661          if (!raw) {
1611 1662                  switch ((psetid_t)val) {
1612 1663                  case PS_NONE:           s = "PS_NONE";          break;
↓ open down ↓ 1250 lines elided ↑ open up ↑ 
2863 2914          prt_rcf,        /* RCF -- print rctlsys_ctl() flags */
2864 2915          prt_fxf,        /* FXF -- print forkx() flags */
2865 2916          prt_spf,        /* SPF -- print rctlsys_projset() flags */
2866 2917          prt_un1,        /* UN1 -- as prt_uns except for -1 */
2867 2918          prt_mob,        /* MOB -- print mmapobj() flags */
2868 2919          prt_snf,        /* SNF -- print AT_SYMLINK_[NO]FOLLOW flag */
2869 2920          prt_skc,        /* SKC -- print sockconfig() subcode */
2870 2921          prt_acf,        /* ACF -- print accept4 flags */
2871 2922          prt_pfd,        /* PFD -- print pipe fds */
2872 2923          prt_grf,        /* GRF -- print getrandom flags */
     2924 +        prt_psfcmd,     /* PSFCMD -- print psecflags(2) command */
     2925 +        prt_psflags,    /* PSFLG -- print psecflags(2) flags */
2873 2926          prt_dec,        /* HID -- hidden argument, make this the last one */
2874 2927  };
    
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX