7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -67,10 +67,11 @@
 #include <sys/lwpchan_impl.h>
 #include <sys/pool.h>
 #include <sys/sdt.h>
 #include <sys/brand.h>
 #include <sys/klpd.h>
+#include <sys/random.h>
 
 #include <c2/audit.h>
 
 #include <vm/hat.h>
 #include <vm/anon.h>

@@ -97,10 +98,25 @@
 #endif
 
 #define PSUIDFLAGS              (SNOCD|SUGID)
 
 /*
+ * These are consumed within the specific exec modules, but are defined here
+ * because
+ *
+ * 1) The exec modules are unloadable, which would make this near useless.
+ *
+ * 2) We want them to be common across all of them, should more than ELF come
+ *    to support them.
+ *
+ * All must be powers of 2.
+ */
+size_t aslr_max_brk_skew = 16 * 1024 * 1024; /* 16MB */
+#pragma weak exec_stackgap = aslr_max_stack_skew /* Old, compatible name */
+size_t aslr_max_stack_skew = 64 * 1024; /* 64KB */
+
+/*
  * exece() - system call wrapper around exec_common()
  */
 int
 exece(const char *fname, const char **argp, const char **envp)
 {

@@ -558,10 +574,13 @@
         int setid;
         cred_t *oldcred, *newcred = NULL;
         int privflags = 0;
         int setidfl;
         priv_set_t fset;
+        secflagset_t old_secflags;
+
+        secflags_copy(&old_secflags, &pp->p_secflags.psf_effective);
 
         /*
          * If the SNOCD or SUGID flag is set, turn it off and remember the
          * previous setting so we can restore it if we encounter an error.
          */

@@ -658,10 +677,13 @@
                 priv_intersect(&CR_LPRIV(cred), &CR_IPRIV(cred));
                 CR_EPRIV(cred) = CR_PPRIV(cred) = CR_IPRIV(cred);
                 priv_adjust_PA(cred);
         }
 
+        /* The new image gets the inheritable secflags as its secflags */
+        secflags_promote(pp);
+
         /* SunOS 4.x buy-back */
         if ((vp->v_vfsp->vfs_flag & VFS_NOSETUID) &&
             (vattr.va_mode & (VSUID|VSGID))) {
                 char path[MAXNAMELEN];
                 refstr_t *mntpt = NULL;

@@ -718,11 +740,12 @@
 
         /*
          * Use /etc/system variable to determine if the stack
          * should be marked as executable by default.
          */
-        if (noexec_user_stack)
+        if ((noexec_user_stack != 0) ||
+            secflag_enabled(pp, PROC_SEC_NOEXECSTACK))
                 args->stk_prot &= ~PROT_EXEC;
 
         args->execswp = eswp; /* Save execsw pointer in uarg for exec_func */
         args->ex_vp = vp;
 

@@ -804,11 +827,11 @@
                         oldcred = curthread->t_cred;
                         curthread->t_cred = cred;
                         crfree(oldcred);
 
                         if (priv_basic_test >= 0 &&
-                            !PRIV_ISASSERT(&CR_IPRIV(newcred),
+                            !PRIV_ISMEMBER(&CR_IPRIV(newcred),
                             priv_basic_test)) {
                                 pid_t pid = pp->p_pid;
                                 char *fn = PTOU(pp)->u_comm;
 
                                 cmn_err(CE_WARN, "%s[%d]: exec: basic_test "

@@ -874,15 +897,21 @@
         if (newcred != NULL)
                 crfree(newcred);
         if (error == 0)
                 error = ENOEXEC;
 
-        if (suidflags) {
                 mutex_enter(&pp->p_lock);
+        if (suidflags) {
                 pp->p_flag |= suidflags;
-                mutex_exit(&pp->p_lock);
         }
+        /*
+         * Restore the effective secflags, to maintain the invariant they
+         * never change for a given process
+         */
+        secflags_copy(&pp->p_secflags.psf_effective, &old_secflags);
+        mutex_exit(&pp->p_lock);
+
         return (error);
 }
 
 extern char *execswnames[];
 

@@ -1785,10 +1814,48 @@
 
         return (0);
 }
 
 /*
+ * Though the actual stack base is constant, slew the %sp by a random aligned
+ * amount in [0,aslr_max_stack_skew).  Mostly, this makes life slightly more
+ * complicated for buffer overflows hoping to overwrite the return address.
+ *
+ * On some platforms this helps avoid cache thrashing when identical processes
+ * simultaneously share caches that don't provide enough associativity
+ * (e.g. sun4v systems). In this case stack slewing makes the same hot stack
+ * variables in different processes live in different cache sets increasing
+ * effective associativity.
+ */
+size_t
+exec_get_spslew(void)
+{
+#ifdef sun4v
+        static uint_t sp_color_stride = 16;
+        static uint_t sp_color_mask = 0x1f;
+        static uint_t sp_current_color = (uint_t)-1;
+#endif
+        size_t off;
+
+        ASSERT(ISP2(aslr_max_stack_skew));
+
+        if ((aslr_max_stack_skew == 0) ||
+            !secflag_enabled(curproc, PROC_SEC_ASLR)) {
+#ifdef sun4v
+                uint_t spcolor = atomic_inc_32_nv(&sp_current_color);
+                return ((size_t)((spcolor & sp_color_mask) *
+                    SA(sp_color_stride)));
+#else
+                return (0);
+#endif
+        }
+
+        (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
+        return (SA(P2PHASE(off, aslr_max_stack_skew)));
+}
+
+/*
  * Initialize a new user stack with the specified arguments and environment.
  * The initial user stack layout is as follows:
  *
  *      User Stack
  *      +---------------+ <--- curproc->p_usrstack

@@ -2014,21 +2081,14 @@
 
         mutex_enter(&p->p_lock);
         p->p_flag |= SAUTOLPG;  /* kernel controls page sizes */
         mutex_exit(&p->p_lock);
 
-        /*
-         * Some platforms may choose to randomize real stack start by adding a
-         * small slew (not more than a few hundred bytes) to the top of the
-         * stack. This helps avoid cache thrashing when identical processes
-         * simultaneously share caches that don't provide enough associativity
-         * (e.g. sun4v systems). In this case stack slewing makes the same hot
-         * stack variables in different processes to live in different cache
-         * sets increasing effective associativity.
-         */
         sp_slew = exec_get_spslew();
         ASSERT(P2PHASE(sp_slew, args->stk_align) == 0);
+        /* Be certain we don't underflow */
+        VERIFY((curproc->p_usrstack - (size + sp_slew)) < curproc->p_usrstack);
         exec_set_sp(size + sp_slew);
 
         as = as_alloc();
         p->p_as = as;
         as->a_proc = p;