From owner-svn-src-all@freebsd.org Sun Feb 19 20:51:06 2017 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2FA60CE52E4; Sun, 19 Feb 2017 20:51:06 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D3EC6823; Sun, 19 Feb 2017 20:51:05 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v1JKp4Kf085622; Sun, 19 Feb 2017 20:51:04 GMT (envelope-from kib@FreeBSD.org) Received: (from kib@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v1JKp48x085620; Sun, 19 Feb 2017 20:51:04 GMT (envelope-from kib@FreeBSD.org) Message-Id: <201702192051.v1JKp48x085620@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org using -f From: Konstantin Belousov Date: Sun, 19 Feb 2017 20:51:04 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r313967 - in head/sys: fs/devfs kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Feb 2017 20:51:06 -0000 Author: kib Date: Sun Feb 19 20:51:04 2017 New Revision: 313967 URL: https://svnweb.freebsd.org/changeset/base/313967 Log: Apply noexec mount option for mmap(PROT_EXEC). Right now the noexec mount option disallows image activators to try execve the files on the mount point. Also, after r127187, noexec also limits max_prot map entries permissions for mappings of files from such mounts, but not the actual mapping permissions. As result, the API behaviour is inconsistent. The files from noexec mount can be mapped with PROT_EXEC, but if mprotect(2) drops execution permission, it cannot be re-enabled later. Make this consistent logically and aligned with behaviour of other systems, by disallowing PROT_EXEC for mmap(2). Note that this change only ensures aligned results from mmap(2) and mprotect(2), it does not prevent actual code execution from files coming from noexec mount. Such files can always be read into anonymous executable memory and executed from there. Reported by: shamaz.mazum@gmail.com PR: 217062 Reviewed by: alc Sponsored by: The FreeBSD Foundation MFC after: 1 week Modified: head/sys/fs/devfs/devfs_vnops.c head/sys/kern/vfs_vnops.c Modified: head/sys/fs/devfs/devfs_vnops.c ============================================================================== --- head/sys/fs/devfs/devfs_vnops.c Sun Feb 19 20:40:07 2017 (r313966) +++ head/sys/fs/devfs/devfs_vnops.c Sun Feb 19 20:51:04 2017 (r313967) @@ -1803,9 +1803,11 @@ devfs_mmap_f(struct file *fp, vm_map_t m * compatible. */ mp = vp->v_mount; - if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0) + if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0) { maxprot = VM_PROT_NONE; - else + if ((prot & VM_PROT_EXECUTE) != 0) + return (EACCES); + } else maxprot = VM_PROT_EXECUTE; if ((fp->f_flag & FREAD) != 0) maxprot |= VM_PROT_READ; Modified: head/sys/kern/vfs_vnops.c ============================================================================== --- head/sys/kern/vfs_vnops.c Sun Feb 19 20:40:07 2017 (r313966) +++ head/sys/kern/vfs_vnops.c Sun Feb 19 20:51:04 2017 (r313967) @@ -2430,9 +2430,11 @@ vn_mmap(struct file *fp, vm_map_t map, v * proc does a setuid? */ mp = vp->v_mount; - if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0) + if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0) { maxprot = VM_PROT_NONE; - else + if ((prot & VM_PROT_EXECUTE) != 0) + return (EACCES); + } else maxprot = VM_PROT_EXECUTE; if ((fp->f_flag & FREAD) != 0) maxprot |= VM_PROT_READ;