svn commit: r197711 - head/sys/kern

[Bjoern A. Zeeb]

Author: bz
Date: Fri Oct  2 17:48:51 2009
New Revision: 197711
URL: http://svn.freebsd.org/changeset/base/197711

Log:
  Add a mitigation feature that will prevent user mappings at
  virtual address 0, limiting the ability to convert a kernel
  NULL pointer dereference into a privilege escalation attack.
  
  If the sysctl is set to 0 a newly started process will not be able
  to map anything in the address range of the first page (0 to PAGE_SIZE).
  This is the default. Already running processes are not affected by this.
  
  You can either change the sysctl or the tunable from loader in case
  you need to map at a virtual address of 0, for example when running
  any of the extinct species of a set of a.out binaries, vm86 emulation, ..
  In that case set security.bsd.map_at_zero="1".
  
  Superseeds:		r197537
  In collaboration with:	jhb, kib, alc

Modified:
  head/sys/kern/init_main.c
  head/sys/kern/kern_exec.c

Modified: head/sys/kern/init_main.c
==============================================================================
--- head/sys/kern/init_main.c	Fri Oct  2 17:39:23 2009	(r197710)
+++ head/sys/kern/init_main.c	Fri Oct  2 17:48:51 2009	(r197711)
@@ -505,6 +505,11 @@ proc0_init(void *dummy __unused)
 	pmap_pinit0(vmspace_pmap(&vmspace0));
 	p->p_vmspace = &vmspace0;
 	vmspace0.vm_refcnt = 1;
+
+	/*
+	 * proc0 is not expected to enter usermode, so there is no special
+	 * handling for sv_minuser here, like is done for exec_new_vmspace().
+	 */
 	vm_map_init(&vmspace0.vm_map, p->p_sysent->sv_minuser,
 	    p->p_sysent->sv_maxuser);
 	vmspace0.vm_map.pmap = vmspace_pmap(&vmspace0);

Modified: head/sys/kern/kern_exec.c
==============================================================================
--- head/sys/kern/kern_exec.c	Fri Oct  2 17:39:23 2009	(r197710)
+++ head/sys/kern/kern_exec.c	Fri Oct  2 17:48:51 2009	(r197711)
@@ -122,6 +122,11 @@ u_long ps_arg_cache_limit = PAGE_SIZE / 
 SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, 
     &ps_arg_cache_limit, 0, "");
 
+static int map_at_zero = 0;
+TUNABLE_INT("security.bsd.map_at_zero", &map_at_zero);
+SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RW, &map_at_zero, 0,
+    "Permit processes to map an object at virtual address 0.");
+
 static int
 sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
 {
@@ -999,7 +1004,7 @@ exec_new_vmspace(imgp, sv)
 	int error;
 	struct proc *p = imgp->proc;
 	struct vmspace *vmspace = p->p_vmspace;
-	vm_offset_t stack_addr;
+	vm_offset_t sv_minuser, stack_addr;
 	vm_map_t map;
 	u_long ssiz;
 
@@ -1015,13 +1020,17 @@ exec_new_vmspace(imgp, sv)
 	 * not disrupted
 	 */
 	map = &vmspace->vm_map;
-	if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv->sv_minuser &&
+	if (map_at_zero)
+		sv_minuser = sv->sv_minuser;
+	else
+		sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
+	if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser &&
 	    vm_map_max(map) == sv->sv_maxuser) {
 		shmexit(vmspace);
 		pmap_remove_pages(vmspace_pmap(vmspace));
 		vm_map_remove(map, vm_map_min(map), vm_map_max(map));
 	} else {
-		error = vmspace_exec(p, sv->sv_minuser, sv->sv_maxuser);
+		error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
 		if (error)
 			return (error);
 		vmspace = p->p_vmspace;