Print this page
sync further changes from uts/aslr
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -40,10 +40,11 @@
 #include <sys/vnode.h>
 #include <sys/mman.h>
 #include <sys/kmem.h>
 #include <sys/proc.h>
 #include <sys/pathname.h>
+#include <sys/policy.h>
 #include <sys/cmn_err.h>
 #include <sys/systm.h>
 #include <sys/elf.h>
 #include <sys/vmsystm.h>
 #include <sys/debug.h>

@@ -63,12 +64,14 @@
 #include <sys/fasttrap.h>
 #include <sys/brand.h>
 #include "elf_impl.h"
 #include <sys/sdt.h>
 #include <sys/siginfo.h>
+#include <sys/random.h>
 
 extern int at_flags;
+extern volatile size_t aslr_max_brk_skew;
 
 #define ORIGIN_STR      "ORIGIN"
 #define ORIGIN_STR_SIZE 6
 
 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);

@@ -160,10 +163,45 @@
         args->thrptr = phdrp->p_vaddr + base;
 
         return (0);
 }
 
+static int
+handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
+{
+        uint_t flag;
+
+        switch (dt) {
+        case DT_SUNW_ASLR:
+                flag = PROC_SEC_ASLR;
+                break;
+        default:
+                return (EINVAL);
+        }
+
+        if (val == 0) {
+                if (secflag_isset(p->p_secflags.psf_lower, flag))
+                        return (EPERM);
+                if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
+                    secflag_isset(p->p_secflags.psf_inherit, flag))
+                        return (EPERM);
+
+                secflag_clear(&p->p_secflags.psf_effective, flag);
+        } else {
+                if (!secflag_isset(p->p_secflags.psf_upper, flag))
+                        return (EPERM);
+
+                if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
+                    !secflag_isset(p->p_secflags.psf_inherit, flag))
+                        return (EPERM);
+
+                secflag_set(&p->p_secflags.psf_effective, flag);
+        }
+
+        return (0);
+}
+
 /*
  * Map in the executable pointed to by vp. Returns 0 on success.
  */
 int
 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,

@@ -253,11 +291,12 @@
         aux_entry_t     *aux;
         int             error;
         ssize_t         resid;
         int             fd = -1;
         intptr_t        voffset;
-        Phdr            *dyphdr = NULL;
+        Phdr            *intphdr = NULL;
+        Phdr            *dynamicphdr = NULL;
         Phdr            *stphdr = NULL;
         Phdr            *uphdr = NULL;
         Phdr            *junk = NULL;
         size_t          len;
         ssize_t         phdrsize;

@@ -267,13 +306,14 @@
         Phdr            *dataphdrp = NULL;
         Phdr            *dtrphdr;
         Phdr            *capphdr = NULL;
         Cap             *cap = NULL;
         ssize_t         capsize;
+        Dyn             *dyn = NULL;
         int             hasu = 0;
         int             hasauxv = 0;
-        int             hasdy = 0;
+        int             hasintp = 0;
         int             branded = 0;
 
         struct proc *p = ttoproc(curthread);
         struct user *up = PTOU(p);
         struct bigwad {

@@ -368,11 +408,11 @@
         hsize = ehdrp->e_phentsize;
         phdrp = (Phdr *)phdrbase;
         for (i = nphdrs; i > 0; i--) {
                 switch (phdrp->p_type) {
                 case PT_INTERP:
-                        hasauxv = hasdy = 1;
+                        hasauxv = hasintp = 1;
                         break;
                 case PT_PHDR:
                         hasu = 1;
                         break;
                 case PT_SUNWSTACK:

@@ -388,10 +428,13 @@
                         dataphdrp = phdrp;
                         break;
                 case PT_SUNWCAP:
                         capphdr = phdrp;
                         break;
+                case PT_DYNAMIC:
+                        dynamicphdr = phdrp;
+                        break;
                 }
                 phdrp = (Phdr *)((caddr_t)phdrp + hsize);
         }
 
         if (ehdrp->e_type != ET_EXEC) {

@@ -430,11 +473,11 @@
                  *      AT_SUN_EXECNAME (added in stk_copyout)
                  *      AT_NULL
                  *
                  * total == 9
                  */
-                if (hasdy && hasu) {
+                if (hasintp && hasu) {
                         /*
                          * Has PT_INTERP & PT_PHDR - the auxvectors that
                          * will be built are:
                          *
                          *      AT_PHDR

@@ -444,11 +487,11 @@
                          *      AT_LDDATA
                          *
                          * total = 5
                          */
                         args->auxsize = (9 + 5) * sizeof (aux_entry_t);
-                } else if (hasdy) {
+                } else if (hasintp) {
                         /*
                          * Has PT_INTERP but no PT_PHDR
                          *
                          *      AT_EXECFD
                          *      AT_LDDATA

@@ -477,10 +520,54 @@
                  * the the brandname and 3 for the brand specific aux vectors.
                  */
                 args->auxsize += 4 * sizeof (aux_entry_t);
         }
 
+        /* If the binary has an explicit ASLR flag, it must be honoured */
+        if ((dynamicphdr != NULL) &&
+            (dynamicphdr->p_filesz > 0)) {
+                Dyn *dp;
+                off_t i = 0;
+
+#define DYN_STRIDE      100
+                for (i = 0; i < dynamicphdr->p_filesz;
+                    i += sizeof (*dyn) * DYN_STRIDE) {
+                        int ndyns = (dynamicphdr->p_filesz - i) / sizeof (*dyn);
+                        size_t dynsize;
+
+                        ndyns = MIN(DYN_STRIDE, ndyns);
+                        dynsize = ndyns * sizeof (*dyn);
+
+                        dyn = kmem_alloc(dynsize, KM_SLEEP);
+
+                        if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn,
+                            dynsize, (offset_t)(dynamicphdr->p_offset + i),
+                            UIO_SYSSPACE, 0, (rlim64_t)0,
+                            CRED(), &resid)) != 0) {
+                                uprintf("%s: cannot read .dynamic section\n",
+                                    exec_file);
+                                goto out;
+                        }
+
+                        for (dp = dyn; dp < (dyn + ndyns); dp++) {
+                                if (dp->d_tag == DT_SUNW_ASLR) {
+                                        if ((error = handle_secflag_dt(p,
+                                            DT_SUNW_ASLR,
+                                            dp->d_un.d_val)) != 0) {
+                                                uprintf("%s: error setting "
+                                                    "security-flag from "
+                                                    "DT_SUNW_ASLR: %d\n",
+                                                    exec_file, error);
+                                                goto out;
+                                        }
+                                }
+                        }
+
+                        kmem_free(dyn, dynsize);
+                }
+        }
+
         /* Hardware/Software capabilities */
         if (capphdr != NULL &&
             (capsize = capphdr->p_filesz) > 0 &&
             capsize <= 16 * sizeof (*cap)) {
                 int ncaps = capsize / sizeof (*cap);

@@ -527,39 +614,39 @@
         else
                 len = 0;
 
         dtrphdr = NULL;
 
-        if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr,
+        if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr,
             &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
             len, execsz, &brksize)) != 0)
                 goto bad;
 
-        if (uphdr != NULL && dyphdr == NULL)
+        if (uphdr != NULL && intphdr == NULL)
                 goto bad;
 
         if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
                 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
                 goto bad;
         }
 
-        if (dyphdr != NULL) {
+        if (intphdr != NULL) {
                 size_t          len;
                 uintptr_t       lddata;
                 char            *p;
                 struct vnode    *nvp;
 
-                dlnsize = dyphdr->p_filesz;
+                dlnsize = intphdr->p_filesz;
 
                 if (dlnsize > MAXPATHLEN || dlnsize <= 0)
                         goto bad;
 
                 /*
                  * Read in "interpreter" pathname.
                  */
-                if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz,
-                    (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
+                if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
+                    (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
                     CRED(), &resid)) != 0) {
                         uprintf("%s: Cannot obtain interpreter pathname\n",
                             exec_file);
                         goto bad;
                 }

@@ -773,10 +860,11 @@
                 args->auxp_auxflags =
                     (char *)((char *)args->stackend +
                     ((char *)&aux->a_type -
                     (char *)bigwad->elfargs));
                 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
+
                 /*
                  * Hardware capability flag word (performance hints)
                  * Used for choosing faster library routines.
                  * (Potentially different between 32-bit and 64-bit ABIs)
                  */

@@ -1182,11 +1270,11 @@
         vnode_t *vp,
         Ehdr *ehdr,
         int nphdrs,
         caddr_t phdrbase,
         Phdr **uphdr,
-        Phdr **dyphdr,
+        Phdr **intphdr,
         Phdr **stphdr,
         Phdr **dtphdr,
         Phdr *dataphdrp,
         caddr_t *bssbase,
         caddr_t *brkbase,

@@ -1206,15 +1294,19 @@
         int hsize = ehdr->e_phentsize;
         caddr_t mintmp = (caddr_t)-1;
         extern int use_brk_lpg;
 
         if (ehdr->e_type == ET_DYN) {
+                secflagset_t flags = 0;
                 /*
                  * Obtain the virtual address of a hole in the
                  * address space to map the "interpreter".
                  */
-                map_addr(&addr, len, (offset_t)0, 1, 0);
+                if (secflag_enabled(curproc, PROC_SEC_ASLR))
+                        flags |= _MAP_RANDOMIZE;
+
+                map_addr(&addr, len, (offset_t)0, 1, flags);
                 if (addr == NULL)
                         return (ENOMEM);
                 *voffset = (intptr_t)addr;
 
                 /*

@@ -1237,11 +1329,11 @@
         }
         phdr = (Phdr *)phdrbase;
         for (i = nphdrs; i > 0; i--) {
                 switch (phdr->p_type) {
                 case PT_LOAD:
-                        if ((*dyphdr != NULL) && (*uphdr == NULL))
+                        if ((*intphdr != NULL) && (*uphdr == NULL))
                                 return (0);
 
                         ptload = 1;
                         prot = PROT_USER;
                         if (phdr->p_flags & PF_R)

@@ -1292,10 +1384,17 @@
                         if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
                             (prot & PROT_WRITE)) {
                                 uint_t  szc = curproc->p_brkpageszc;
                                 size_t pgsz = page_get_pagesize(szc);
                                 caddr_t ebss = addr + phdr->p_memsz;
+                                /*
+                                 * If we need extra space to keep the BSS an
+                                 * integral number of pages in size, some of
+                                 * that space may fall beyond p_brkbase, so we
+                                 * need to set p_brksize to account for it
+                                 * being (logically) part of the brk.
+                                 */
                                 size_t extra_zfodsz;
 
                                 ASSERT(pgsz > PAGESIZE);
 
                                 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);

@@ -1324,11 +1423,11 @@
                         break;
 
                 case PT_INTERP:
                         if (ptload)
                                 goto bad;
-                        *dyphdr = phdr;
+                        *intphdr = phdr;
                         break;
 
                 case PT_SHLIB:
                         *stphdr = phdr;
                         break;

@@ -1358,10 +1457,35 @@
         if (minaddr != NULL) {
                 ASSERT(mintmp != (caddr_t)-1);
                 *minaddr = (intptr_t)mintmp;
         }
 
+        if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) {
+                size_t off;
+                uintptr_t base = (uintptr_t)*brkbase;
+                uintptr_t oend = base + *brksize;
+
+                ASSERT(ISP2(aslr_max_brk_skew));
+
+                (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
+                base += P2PHASE(off, aslr_max_brk_skew);
+                base = P2ROUNDUP(base, PAGESIZE);
+                *brkbase = (caddr_t)base;
+                /*
+                 * Above, we set *brksize to account for the possibility we
+                 * had to grow the 'brk' in padding out the BSS to a page
+                 * boundary.
+                 *
+                 * We now need to adjust that based on where we now are
+                 * actually putting the brk.
+                 */
+                if (oend > base)
+                        *brksize = oend - base;
+                else
+                        *brksize = 0;
+        }
+
         return (0);
 bad:
         if (error == 0)
                 error = EINVAL;
         return (error);