aboutsummaryrefslogtreecommitdiff
path: root/sys/kern/imgact_elf.c
Commit message (Collapse)AuthorAgeFilesLines
* imgact_elf: Add const to the checknote parameter to __elfN(parse_notes)John Baldwin2024-03-051-1/+1
| | | | | | Reviewed by: imp, kib Sponsored by: University of Cambridge, Google, Inc. Differential Revision: https://reviews.freebsd.org/D44215
* imgact_elf: Add const to a few struct image_params pointersAlex Richardson2024-03-051-10/+11
| | | | | | | | This makes it more obvious which functions modify fields in this struct. Reviewed by: imp, kib Obtained from: CheriBSD Differential Revision: https://reviews.freebsd.org/D44214
* ELF note parser: provide more info on failureKonstantin Belousov2024-02-111-3/+12
| | | | | | | | | | Print reasons when parser declined to parse notes, due to mis-alignment, invalid length, or too many notes (the later typically means that there is a loop). Also increase the loop limit to 4096, which gives enough iterations for notes to fill whole notes' page. Sponsored by: The FreeBSD Foundation MFC after: 3 days
* imgact_elf.c: remove sys/cdefs.h includeKonstantin Belousov2024-02-111-1/+0
| | | | | Sponsored by: The FreeBSD Foundation MFC after: 3 days
* sysent: Add sv_protectAndrew Turner2023-11-101-0/+6
| | | | | | | | | | To allow for architecture specific protections add sv_protect to struct sysent. This can be used to apply these after the executable is loaded into the new address space. Reviewed by: kib Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D42440
* imgact_elf: Export __elfN(parse_notes)Andrew Turner2023-11-101-1/+1
| | | | | | | | | | This is useful to check if a note is present and contains an expected value, e.g. to read NT_GNU_PROPERTY_TYPE_0 on arm64 to see if we should enable BTI. Reviewed by: kib, markj Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D42439
* imgact_elf: Move GNU_ABI_VENDOR to a common headerAndrew Turner2023-11-101-1/+0
| | | | | | | | | Move the definition of GNU_ABI_VENDOR to a common location so it can be used in multiple files. Reviewed by: emaste, kib, imp Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D42442
* auxv: make AT_BSDFLAGS unsignedBrooks Davis2023-10-261-1/+2
| | | | | | | | AT_BSDFLAGS shouldn't be sign extended on 64-bit systems so use a uint32_t instead of an int. Reviewed by: imp, kib Differential Revision: https://reviews.freebsd.org/D42365
* user stack randomization: only enable by default for 64bit processesKonstantin Belousov2023-10-241-1/+1
| | | | | | | | | | | All aslr knobs are disabled by default for 32bit processes, except stack. This results in weird stack location, typically making around 1G of user address space hard to use. Reviewed by: emaste Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D42356
* sys: Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* imgact: Make et_dyn_addr part of image_paramsJessica Clarke2023-05-301-18/+17
| | | | | | | | | | This already gets passed around between various imgact_elf functions, so moving it removes an argument from all those places. A future commit will make use of this for hwpmc, though, to provide the load base for PIEs, which currently isn't available to tools like pmcstat. Reviewed by: kib, markj, jhb Differential Revision: https://reviews.freebsd.org/D39594
* Brandinfo: Retire emul_path as unneeded anymoreDmitry Chagin2023-05-291-12/+0
| | | | | | | | | | The Barndinfo emul_path was used by the Elf image activator to fixup interpreter file name according to ABI root directory. Since the non-native ABI can now specify its root directory directly to namei() via pwd_altroot() call this facility is not needed anymore. Differential Revision: https://reviews.freebsd.org/D40091 MFC after: 2 month
* Add AT_USRSTACK{BASE, LIM} AT vectors, and ELF_BSDF_VMNOOVERCOMMIT flagKonstantin Belousov2022-09-161-3/+11
| | | | | | | | Reviewed by: brooks, imp (previous version) Discussed with: markj Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D36540
* Disallow invalid PT_GNU_STACKEd Maste2022-08-161-1/+8
| | | | | | | | | | Stack must be at least readable and writable. PR: 242570 Reviewed by: kib, markj MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35867
* elf_note_prpsinfo: handle more failures from proc_getargv()Konstantin Belousov2022-08-091-4/+7
| | | | | | | | | | | | | | | | | | Resulting sbuf_len() from proc_getargv() might return 0 if user mangled ps_strings enough. Also, sbuf_len() API contract is to return -1 if the buffer overflowed. The later should not occur because get_ps_strings() checks for catenated length, but check for this subtle detail explicitly as well to be more resilent. The end result is that p_comm is used in this situations. Approved by: so Security: FreeBSD-SA-22:09.elf Reported by: Josef 'Jeff' Sipek <jeffpc@josefsipek.net> Reviewed by: delphij, markj admbugs: 988 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35391
* Clarify code comments on ASLR default settingsEd Maste2022-08-051-8/+7
| | | | Sponsored by: The FreeBSD Foundation
* Implement shared page address randomizationKornel Dulęba2022-07-181-0/+8
| | | | | | | | | | | | | | | | | | | | | It used to be mapped at the top of the UVA. If the randomization is enabled any address above .data section will be randomly chosen and a guard page will be inserted in the shared page default location. The shared page is now mapped in exec_map_stack, instead of exec_new_vmspace. The latter function is called before image activator has a chance to parse ASLR related flags. The KERN_PROC_VM_LAYOUT sysctl was extended to provide shared page address. The feature is enabled by default for 64 bit applications on all architectures. It can be toggled kern.elf64.aslr.shared_page sysctl. Approved by: mw(mentor) Sponsored by: Stormshield Obtained from: Semihalf Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D35349
* Rework how shared page related data is storedKornel Dulęba2022-07-181-6/+15
| | | | | | | | | | | | | Store the shared page address in struct vmspace. Also instead of storing absolute addresses of various shared page segments save their offsets with respect to the shared page address. This will be more useful when the shared page address is randomized. Approved by: mw(mentor) Sponsored by: Stormshield Obtained from: Semihalf Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D35393
* Add register sets for NT_THRMISC and NT_PTLWPINFO.John Baldwin2022-06-301-61/+68
| | | | | | | | | | For the kernel this is mostly a non-functional change. However, this will be useful for simplifying gcore(1). Reviewed by: markj MFC after: 2 weeks Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D35666
* vfs: NDFREE(&nd, NDF_ONLY_PNBUF) -> NDFREE_PNBUF(&nd)Mateusz Guzik2022-03-241-1/+1
|
* elf: Avoid dumping uninitialized bytes in PRSTATUS core dump notesMark Johnston2022-03-231-0/+1
| | | | | | | | | elf_prstatus_t contains pad space. Reported by: KMSAN MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D34606
* Store core dump notes for all valid register sets for FreeBSD processes.John Baldwin2022-03-101-38/+72
| | | | | | | | | | | | In particular, use a generic wrapper around struct regset rather than requiring per-regset helpers. This helper replaces the MI __elfN(note_prstatus) and __elfN(note_fpregset) helpers. It also removes the need to explicitly dump NT_ARM_ADDR_MASK in the arm64 __elfN(dump_thread). Reviewed by: markj, emaste Sponsored by: University of Cambridge, Google, Inc. Differential Revision: https://reviews.freebsd.org/D34446
* Fix the size returned for NT_FPREGSET.John Baldwin2022-03-041-1/+1
| | | | Sponsored by: University of Cambridge, Google, Inc.
* Add PT_GETREGSETAndrew Turner2022-01-271-12/+93
| | | | | | | | | | | | | | | | | | | This adds the PT_GETREGSET and PT_SETREGSET ptrace types. These can be used to access all the registers from a specified core dump note type. The NT_PRSTATUS and NT_FPREGSET notes are initially supported. Other machine-dependant types are expected to be added in the future. The ptrace addr points to a struct iovec pointing at memory to hold the registers along with its length. On success the length in the iovec is updated to tell userspace the actual length the kernel wrote or, if the base address is NULL, the length the kernel would have written. Because the data field is an int the arguments are backwards when compared to the Linux PTRACE_GETREGSET call. Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19831
* exec: Reimplement stack address randomizationMark Johnston2022-01-171-10/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The approach taken by the stack gap implementation was to insert a random gap between the top of the fixed stack mapping and the true top of the main process stack. This approach was chosen so as to avoid randomizing the previously fixed address of certain process metadata stored at the top of the stack, but had some shortcomings. In particular, mlockall(2) calls would wire the gap, bloating the process' memory usage, and RLIMIT_STACK included the size of the gap so small (< several MB) limits could not be used. There is little value in storing each process' ps_strings at a fixed location, as only very old programs hard-code this address; consumers were converted decades ago to use a sysctl-based interface for this purpose. Thus, this change re-implements stack address randomization by simply breaking the convention of storing ps_strings at a fixed location, and randomizing the location of the entire stack mapping. This implementation is simpler and avoids the problems mentioned above, while being unlikely to break compatibility anywhere the default ASLR settings are used. The kern.elfN.aslr.stack_gap sysctl is renamed to kern.elfN.aslr.stack, and is re-enabled by default. PR: 260303 Reviewed by: kib Discussed with: emaste, mw MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33704
* exec: Remove the stack gap implementationMark Johnston2022-01-171-19/+0
| | | | | | | | | | | | | | | ASLR stack randomization will reappear in a forthcoming commit. Rather than inserting a random gap into the stack mapping, the entire stack mapping itself will be randomized in the same way that other mappings are when ASLR is enabled. No functional change intended, as the stack gap implementation is currently disabled by default. Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33704
* exec: Introduce the PROC_PS_STRINGS() macroMark Johnston2022-01-171-2/+2
| | | | | | | | | | | Rather than fetching the ps_strings address directly from a process' sysentvec, use this macro. With stack address randomization the ps_strings address is no longer fixed. Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33704
* imgact_elf: Disable the stack gap for nowMark Johnston2021-12-141-1/+1
| | | | | | | | | | | | The integration with RLIMIT_STACK is still causing problems for some programs such as lang/sdcc and syzkaller's executor. Until this is resolved by some work currently in progress, disable the stack gap by default. PR: 260303 Reviewed by: kib, emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D33438
* exec_elf: use intermediate u_long variable to correct mismatched typeKonstantin Belousov2021-12-121-2/+3
| | | | | | | vm_offset_t * vs. u_long * Sponsored by: The FreeBSD Foundation MFC after: 1 week
* imgact_elf: avoid mapsz overflowKonstantin Belousov2021-12-121-0/+10
| | | | | | | | Reported and tested by: pho Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* imgact_elf: check that the alignment of PT_LOAD segment is power of twoKonstantin Belousov2021-12-121-2/+3
| | | | | | | | | | | and stop recalculating alignment for PIE base, which was off by one power of two. Suggested and reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* imgact_elf: exclude invalid alignment requestsKonstantin Belousov2021-12-121-1/+19
| | | | | | | | | | | | | | | Only accept at most superpage alignment, or if the arch does not have superpages supported, artificially limit it to PAGE_SIZE * 1024. This is somewhat arbitrary, and e.g. could change what binaries do we accept between native i386 vs. amd64 ia32 with superpages disabled, but I do not believe the difference there is affecting anybody with real (useful) binaries. Reported and tested by: pho Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* rnd_elf: add comment explaining the interfaceKonstantin Belousov2021-12-121-0/+10
| | | | | | | Requested and reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* elf image activator: convert asserts into errorsKonstantin Belousov2021-12-121-18/+26
| | | | | | | | | | | | | | Invalid (artificial) layout of the loadable ELF segments might result in triggering the assertion. This means that the file should not be executed, regardless of the kernel debug mode. Change calling conventions for rnd_elf{32,64} helpers to allow returning an error, and abort activation with ENOEXEC if its invariants are broken. Reported and tested by: pho Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* exec_elf: assert that the image vnode is still locked on returnKonstantin Belousov2021-12-121-0/+1
| | | | | | | | Suggested and reviewed by: markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* StyleKonstantin Belousov2021-12-121-2/+2
| | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D33359
* Add kern.elf{32,64}.vdso knobs to enable/disable vdso preloadingKonstantin Belousov2021-12-061-1/+10
| | | | | | | | | Reviewed by: emaste Discussed with: jrtc27 Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 month Differential revision: https://reviews.freebsd.org/D32960
* Pass vdso address to userspaceKonstantin Belousov2021-12-061-0/+2
| | | | | | | | | Reviewed by: emaste Discussed with: jrtc27 Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 month Differential revision: https://reviews.freebsd.org/D32960
* vfs: remove the unused thread argument from NDINIT*Mateusz Guzik2021-11-251-1/+1
| | | | | | See b4a58fbf640409a1 ("vfs: remove cn_thread") Bump __FreeBSD_version to 1400043.
* elf*_brand_inuse: Change return type to bool.Alex Richardson2021-11-171-3/+3
| | | | | | | Reviewed by: kib Obtained from: CheriBSD Sponsored by: The University of Cambridge, Google Inc. Differential Revision: https://reviews.freebsd.org/D33052
* imgact_elf: Use bool instead of boolean_t.Alex Richardson2021-11-171-22/+22
| | | | | | | Reviewed by: kib Obtained from: CheriBSD Sponsored by: The University of Cambridge, Google Inc. Differential Revision: https://reviews.freebsd.org/D33051
* Enable ASLR by default for 64-bit executablesMarcin Wojtas2021-11-161-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Address Space Layout Randomization (ASLR) is an exploit mitigation technique implemented in the majority of modern operating systems. It involves randomly positioning the base address of an executable and the position of libraries, heap, and stack, in a process's address space. Although over the years ASLR proved to not guarantee full OS security on its own, this mechanism can make exploitation more difficult. Tests on the tier 1 64-bit architectures demonstrated that the ASLR is stable and does not result in noticeable performance degradation, therefore it should be safe to enable this mechanism by default. Moreover its effectiveness is increased for PIE (Position Independent Executable) binaries. Thanks to commit 9a227a2fd642 ("Enable PIE by default on 64-bit architectures"), building from src is not necessary to have PIE binaries. It is enough to control usage of ASLR in the OS solely by setting the appropriate sysctls. This patch toggles the kernel settings to use address map randomization for PIE & non-PIE 64-bit binaries. It also disables SBRK, in order to allow utilization of the bss grow region for mappings. The latter has no effect if ASLR is disabled, so apply it to all architectures. As for the drawbacks, a consequence of using the ASLR is more significant VM fragmentation, hence the issues may be encountered in the systems with a limited address space in high memory consumption cases, such as buildworld. As a result, although the tests on 32-bit architectures with ASLR enabled were mostly on par with what was observed on 64-bit ones, the defaults for the former are not changed at this time. Also, for the sake of safety keep the feature disabled for 32-bit executables on 64-bit machines, too. The committed change affects the overall OS operation, so the following should be taken into consideration: * Address space fragmentation. * A changed ABI due to modified layout of address space. * More complicated debugging due to: * Non-reproducible address space layout between runs. * Some debuggers automatically disable ASLR for spawned processes, making target's environment different between debug and non-debug runs. In order to confirm/rule-out the dependency of any encountered issue on ASLR it is strongly advised to re-run the test with the feature disabled - it can be done by setting the following sysctls in the /etc/sysctl.conf file: kern.elf64.aslr.enable=0 kern.elf64.aslr.pie_enable=0 Co-developed by: Dawid Gorecki <dgr@semihalf.com> Reviewed by: emaste, kib Obtained from: Semihalf Sponsored by: Stormshield MFC after: 1 month Differential revision: https://reviews.freebsd.org/D27666
* setrlimit: Take stack gap into account.Dawid Gorecki2021-10-151-2/+3
| | | | | | | | | | | | | | | | | | | | Calling setrlimit with stack gap enabled and with low values of stack resource limit often caused the program to abort immediately after exiting the syscall. This happened due to the fact that the resource limit was calculated assuming that the stack started at sv_usrstack, while with stack gap enabled the stack is moved by a random number of bytes. Save information about stack size in struct vmspace and adjust the rlim_cur value. If the rlim_cur and stack gap is bigger than rlim_max, then the value is truncated to rlim_max. PR: 253208 Reviewed by: kib Obtained from: Semihalf Sponsored by: Stormshield MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D31516
* procctl(2): Add PROC_WXMAP_CTL/STATUSKonstantin Belousov2021-09-171-2/+5
| | | | | | | | | | | It allows to override kern.elf{32,64}.allow_wx on per-process basis. In particular, it makes it possible to run binaries without PT_GNU_STACK and without elfctl note while allow_wx = 0. Reviewed by: brooks, emaste, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D31779
* Create sys/reg.h for the common code previously in machine/reg.hAndrew Turner2021-08-301-0/+1
| | | | | | | | | | Move the common kernel function signatures from machine/reg.h to a new sys/reg.h. This is in preperation for adding PT_GETREGSET to ptrace(2). Reviewed by: imp, markj Sponsored by: DARPA, AFRL (original work) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19830
* imgact_elf: Avoid redefining suword()Mark Johnston2021-07-231-2/+2
| | | | | | | | Otherwise this interferes with the definition for sanitizer interceptors. MFC after: 1 week Sponsored by: The FreeBSD Foundation
* Eliminate p_elf_machine from struct proc.Dmitry Chagin2021-06-291-2/+3
| | | | | | | | | | | Instead of p_elf_machine use machine member of the Elf_Brandinfo which is now cached in the struct proc at p_elf_brandinfo member. Note to MFC: D30918, KBI Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D30926 MFC after: 2 weeks
* Add a link to the Elf_Brandinfo into the struc proc.Dmitry Chagin2021-06-291-0/+1
| | | | | | | | | | | | To allow the ABI to make a dicision based on the Brandinfo add a link to the Elf_Brandinfo into the struct proc. Add a note that the high 8 bits of Elf_Brandinfo flags is private to the ABI. Note to MFC: it breaks KBI. Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D30918 MFC after: 2 weeks
* Add infrastructure required for Linux coredump supportEdward Tomasz Napierala2021-06-291-33/+33
| | | | | | | | | | | | | | | | This adds `sv_elf_core_osabi`, `sv_elf_core_abi_vendor`, and `sv_elf_core_prepare_notes` fields to `struct sysentvec`, and modifies imgact_elf.c to make use of them instead of hardcoding FreeBSD-specific values. It also updates all of the ABI definitions to preserve current behaviour. This makes it possible to implement non-native ELF coredump support without unnecessary code duplication. It will be used for Linux coredumps. Reviewed By: kib Sponsored By: EPSRC Differential Revision: https://reviews.freebsd.org/D30921
* imgact_elf.c: style, remove unnecessary castsEdward Tomasz Napierala2021-06-271-15/+15
| | | | | | | | | | Remove unnecessary type casts and redundant brackets. No functional changes. Suggested By: kib Reviewed By: kib Sponsored By: EPSRC Differential Revision: https://reviews.freebsd.org/D30841
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-18 09:38:14 +0000