Print this page
Code review comments from jeffpc
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/sys/procfs.h
          +++ new/usr/src/uts/common/sys/procfs.h
↓ open down ↓ 56 lines elided ↑ open up ↑
  57   57  #include <sys/time_impl.h>
  58   58  #include <sys/signal.h>
  59   59  #include <sys/siginfo.h>
  60   60  #include <sys/fault.h>
  61   61  #include <sys/syscall.h>
  62   62  #include <sys/pset.h>
  63   63  #include <sys/procfs_isa.h>
  64   64  #include <sys/priv.h>
  65   65  #include <sys/stat.h>
  66   66  #include <sys/param.h>
       67 +#include <sys/secflags.h>
  67   68  
  68   69  /*
  69   70   * System call interfaces for /proc.
  70   71   */
  71   72  
  72   73  /*
  73   74   * Control codes (long values) for messages written to ctl and lwpctl files.
  74   75   */
  75   76  #define PCNULL   0L     /* null request, advance to next message */
  76   77  #define PCSTOP   1L     /* direct process or lwp to stop and wait for stop */
↓ open down ↓ 314 lines elided ↑ open up ↑
 391  392  /*
 392  393   * Process privileges.  PCSPRIV and /proc/<pid>/priv
 393  394   */
 394  395  typedef struct prpriv {
 395  396          uint32_t        pr_nsets;               /* number of privilege set */
 396  397          uint32_t        pr_setsize;             /* size of privilege set */
 397  398          uint32_t        pr_infosize;            /* size of supplementary data */
 398  399          priv_chunk_t    pr_sets[1];             /* array of sets */
 399  400  } prpriv_t;
 400  401  
      402 +#define PRSECFLAGS_VERSION_1            1
      403 +#define PRSECFLAGS_VERSION_CURRENT      PRSECFLAGS_VERSION_1
      404 +typedef struct prsecflags {
      405 +        uint32_t pr_version;
      406 +        char pr_pad[4];
      407 +        secflagset_t pr_effective;
      408 +        secflagset_t pr_inherit;
      409 +        secflagset_t pr_lower;
      410 +        secflagset_t pr_upper;
      411 +} prsecflags_t;
      412 +
 401  413  /*
 402  414   * Watchpoint interface.  PCWATCH and /proc/<pid>/watch
 403  415   */
 404  416  typedef struct prwatch {
 405  417          uintptr_t pr_vaddr;     /* virtual address of watched area */
 406  418          size_t  pr_size;        /* size of watched area in bytes */
 407  419          int     pr_wflags;      /* watch type flags */
 408  420          int     pr_pad;
 409  421  } prwatch_t;
 410  422  
↓ open down ↓ 451 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX