7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

          --- old/usr/src/cmd/svc/milestone/Makefile
          +++ new/usr/src/cmd/svc/milestone/Makefile

   1    1  #
   2    2  # CDDL HEADER START
   3    3  #
   4    4  # The contents of this file are subject to the terms of the
   5    5  # Common Development and Distribution License (the "License").
   6    6  # You may not use this file except in compliance with the License.
   7    7  #
   8    8  # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9    9  # or http://www.opensolaris.org/os/licensing.
  10   10  # See the License for the specific language governing permissions
  11   11  # and limitations under the License.
  12   12  #
  13   13  # When distributing Covered Code, include this CDDL HEADER in each
  14   14  # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15  # If applicable, add the following below this CDDL HEADER, with the
  16   16  # fields enclosed by brackets "[]" replaced with your own identifying
  17   17  # information: Portions Copyright [yyyy] [name of copyright owner]
  18   18  #
  19   19  # CDDL HEADER END
  20   20  #
  21   21  #
  22   22  # Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  23   23  #
  24   24  
  25   25  include ../../Makefile.cmd
  26   26  
  27   27  FILEMODE = 0444
  28   28  
  29   29  BUILTXML= \
  30   30          console-login.xml
  31   31  
  32   32  FSSVCS= \
  33   33          local-fs.xml \
  34   34          minimal-fs.xml \
  35   35          root-fs.xml \
  36   36          usr-fs.xml
  37   37  
  38   38  FSMANIFESTS= $(FSSVCS:%=$(ROOTSVCSYSTEMFILESYSTEM)/%)
  39   39  
  40   40  NETSVCS= \
  41   41          network-initial.xml \
  42   42          network-install.xml \
  43   43          network-iptun.xml \
  44   44          network-ipqos.xml \
  45   45          network-location.xml \
  46   46          network-loopback.xml \
  47   47          network-netcfg.xml \
  48   48          network-netmask.xml \
  49   49          network-netcfg.xml \
  50   50          network-physical.xml \
  51   51          network-routing-setup.xml \
  52   52          network-service.xml
  53   53  
  54   54  NETMANIFESTS= $(NETSVCS:%=$(ROOTSVCNETWORK)/%)
  55   55  
  56   56  MAINMILESTONES= \
  57   57          multi-user-server.xml \
  58   58          multi-user.xml \
  59   59          name-services.xml \
  60   60          network.xml \
  61   61          single-user.xml \
  62   62          sysconfig.xml
  63   63  
  64   64  MAINMANIFESTS= $(MAINMILESTONES:%=$(ROOTSVCMILESTONE)/%)
  65   65  
  66   66  SYSDEVSVCS= \
  67   67          devices-local.xml \

  68   68          devices-audio.xml
  69   69  
  70   70  SYSDEVMANIFESTS= $(SYSDEVSVCS:%=$(ROOTSVCSYSTEMDEVICE)/%)
  71   71  
  72   72  SYSTEMSVCS= \
  73   73          boot-archive.xml \
  74   74          console-login.xml \
  75   75          early-manifest-import.xml \
  76   76          identity.xml \
  77   77          manifest-import.xml \
       78 +        process-security.xml \
  78   79          rmtmpfiles.xml  \
  79   80          vtdaemon.xml
  80   81  
  81   82  SYSTEMMANIFESTS = $(SYSTEMSVCS:%=$(ROOTSVCSYSTEM)/%)
  82   83  
  83   84  SYSTEMSVCSVCS= \
  84   85          restarter.xml \
  85   86          global.xml
  86   87  
  87   88  SYSTEMSVCMANIFESTS= $(SYSTEMSVCSVCS:%=$(ROOTSVCSYSTEM)/svc/%)

  88   89  
  89   90  MISCFILES= \
  90   91          README.share
  91   92  
  92   93  SYSTEMMISCFILES = $(MISCFILES:%.share=$(ROOT)/lib/svc/share/%)
  93   94  
  94   95  #
  95   96  # MANIFEST is used solely in the construction of the check target.
  96   97  #
  97   98  MANIFEST= $(FSSVCS) $(NETSVCS) $(MAINMILESTONES) $(SYSTEMSVCS) \
  98   99          $(SYSDEVSVCS) $(SYSTEMSVCSVCS)
  99  100  
 100  101  SVCMETHOD=\
 101  102          boot-archive \
 102  103          console-login \
 103  104          devices-audio \
 104  105          devices-local \
 105  106          fs-local \
 106  107          fs-minimal \
 107  108          fs-root \
 108  109          fs-usr \
 109  110          identity-domain \
 110  111          identity-node \
 111  112          manifest-import \
 112  113          net-loc \
 113  114          net-loopback \
 114  115          net-init \
 115  116          net-install \
 116  117          net-iptun \
 117  118          net-ipqos \
 118  119          net-netmask \
 119  120          net-nwam \
 120  121          net-physical \
 121  122          net-routing-setup \
 122  123          net-svc \
 123  124          rmtmpfiles \
 124  125          vtdaemon
 125  126  
 126  127  $(ROOTSVCMETHOD) := FILEMODE = 0555
 127  128  
 128  129  all: $(BUILTXML)
 129  130  
 130  131  install: $(FSMANIFESTS) $(MAINMANIFESTS) $(NETMANIFESTS) $(SYSTEMMANIFESTS) \
 131  132          $(ROOTSVCMETHOD) $(SYSDEVMANIFESTS) $(SYSTEMSVCMANIFESTS) \
 132  133          $(SYSTEMMISCFILES)
 133  134  
 134  135  check:  $(CHKMANIFEST)
 135  136  
 136  137  console-login.xml: make-console-login-xml
 137  138          $(SH) ./make-console-login-xml
 138  139  
 139  140  clobber: clean
 140  141          -$(RM) $(BUILTXML)
 141  142  
 142  143  $(ROOTSVCMILESTONE)/%: %
 143  144          $(INS.file)
 144  145  
 145  146  $(ROOTSVCNETWORK)/%: %
 146  147          $(INS.file)
 147  148  
 148  149  $(ROOTSVCSYSTEM)/%: %
 149  150          $(INS.file)
 150  151  
 151  152  $(ROOTSVCSYSTEMDEVICE)/%: %
 152  153          $(INS.file)
 153  154  
 154  155  $(ROOTSVCSYSTEMFILESYSTEM)/%: %
 155  156          $(INS.file)
 156  157  
 157  158  $(ROOTSVCSYSTEM)/svc/%: %
 158  159          $(INS.file)
 159  160  
 160  161  $(ROOT)/lib/svc/share/%: %.share
 161  162          $(INS.rename)
 162  163  
 163  164  clean lint _msg:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX