1 /* $NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $ */
2
3 /*-
4 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
5 * Copyright (c) 2008 Christos Zoulas <christos@NetBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. The name of the author may not be used to endorse or promote products
17 * derived from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30 #if HAVE_NBTOOL_CONFIG_H
31 #include "nbtool_config.h"
32 #endif
33
34 #include <sys/cdefs.h>
35 #ifndef lint
36 #ifdef __RCSID
37 __RCSID("$NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $");
38 #endif
39 #endif /* not lint */
40
41 #include <sys/types.h>
42 #ifdef HAVE_NBTOOL_CONFIG_H
43 #include "../../sys/sys/exec_elf.h"
44 #else
45 #include <elf.h>
46 #endif
47 #include <stdio.h>
48 #include <err.h>
49 #include <fcntl.h>
50 #include <unistd.h>
51 #include <stdlib.h>
52 #include <string.h>
53
54 static void usage(void) __dead;
55 static uint32_t pax_flag(char);
56 static int pax_flags_sane(uint32_t);
57 static int pax_haveflags(uint32_t);
58 static void pax_printflags(const char *, int, uint32_t);
59
60 #ifndef ELF_NOTE_TYPE_PAX_TAG
61 /* NetBSD-specific note type: PaX. There should be 1 NOTE per executable.
62 section. desc is a 32 bit bitmask */
63 #define ELF_NOTE_TYPE_PAX_TAG 3
64 #define ELF_NOTE_PAX_MPROTECT 0x01 /* Force enable MPROTECT */
65 #define ELF_NOTE_PAX_NOMPROTECT 0x02 /* Force disable MPROTECT */
66 #define ELF_NOTE_PAX_GUARD 0x04 /* Force enable Segvguard */
67 #define ELF_NOTE_PAX_NOGUARD 0x08 /* Force disable Segvguard */
68 #define ELF_NOTE_PAX_ASLR 0x10 /* Force enable ASLR */
69 #define ELF_NOTE_PAX_NOASLR 0x20 /* Force disable ASLR */
70 #define ELF_NOTE_PAX_NAMESZ 4
71 #define ELF_NOTE_PAX_NAME "PaX\0"
72 #define ELF_NOTE_PAX_DESCSZ 4
73 #endif
74 #ifndef __arraycount
75 #define __arraycount(a) (sizeof(a) / sizeof(a[0]))
76 #endif
77
78
79 static const struct paxflag {
80 char mark;
81 const char *name;
82 uint32_t bits;
83 } flags[] = {
84 { 'A', "ASLR, explicit enable",
85 ELF_NOTE_PAX_ASLR },
86 { 'a', "ASLR, explicit disable",
87 ELF_NOTE_PAX_NOASLR },
88 { 'G', "Segvguard, explicit enable",
89 ELF_NOTE_PAX_GUARD },
90 { 'g', "Segvguard, explicit disable",
91 ELF_NOTE_PAX_NOGUARD },
92 { 'M', "mprotect(2) restrictions, explicit enable",
93 ELF_NOTE_PAX_MPROTECT },
94 { 'm', "mprotect(2) restrictions, explicit disable",
95 ELF_NOTE_PAX_NOMPROTECT },
96 };
97
98 static void
usage(void)99 usage(void)
100 {
101 (void)fprintf(stderr,
102 "Usage: %s [ -0 | <-|+><A|a|G|g|M|m> ] <file> ...\n",
103 #if HAVE_NBTOOL_CONFIG_H
104 "paxctl"
105 #else
106 getprogname()
107 #endif
108 );
109 exit(1);
110 }
111
112 static uint32_t
pax_flag(char s)113 pax_flag(char s)
114 {
115 size_t i;
116
117 if (s == '\0')
118 return (uint32_t)-1;
119
120 for (i = 0; i < __arraycount(flags); i++)
121 if (s == flags[i].mark)
122 return flags[i].bits;
123
124 return (uint32_t)-1;
125 }
126
127 static int
pax_flags_sane(uint32_t f)128 pax_flags_sane(uint32_t f)
129 {
130 size_t i;
131
132 for (i = 0; i < __arraycount(flags) - 1; i += 2) {
133 uint32_t g = flags[i].bits | flags[i+1].bits;
134 if ((f & g) == g)
135 return 0;
136 }
137
138 return 1;
139 }
140
141 static int
pax_haveflags(uint32_t f)142 pax_haveflags(uint32_t f)
143 {
144 size_t i;
145
146 for (i = 0; i < __arraycount(flags); i++)
147 if (f & flags[i].bits)
148 return (1);
149
150 return (0);
151 }
152
153 static void
pax_printflags(const char * name,int many,uint32_t f)154 pax_printflags(const char *name, int many, uint32_t f)
155 {
156 size_t i;
157
158 for (i = 0; i < __arraycount(flags); i++)
159 if (f & flags[i].bits) {
160 if (many)
161 (void)printf("%s: ", name);
162 (void)printf(" %c: %s\n",
163 flags[i].mark, flags[i].name);
164 }
165 }
166
167 static int
process_one(const char * name,uint32_t add_flags,uint32_t del_flags,int clear,int list,int many)168 process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
169 int clear, int list, int many)
170 {
171 union {
172 Elf32_Ehdr h32;
173 Elf64_Ehdr h64;
174 } e;
175 union {
176 Elf32_Shdr h32;
177 Elf64_Shdr h64;
178 } s;
179 union {
180 Elf32_Nhdr h32;
181 Elf64_Nhdr h64;
182 } n;
183 #define SWAP(a) (swap == 0 ? (a) : \
184 /*LINTED*/(sizeof(a) == 1 ? (a) : \
185 /*LINTED*/(sizeof(a) == 2 ? bswap16(a) : \
186 /*LINTED*/(sizeof(a) == 4 ? bswap32(a) : \
187 /*LINTED*/(sizeof(a) == 8 ? bswap64(a) : (abort(), (a)))))))
188 #define EH(field) (size == 32 ? SWAP(e.h32.field) : SWAP(e.h64.field))
189 #define SH(field) (size == 32 ? SWAP(s.h32.field) : SWAP(s.h64.field))
190 #define NH(field) (size == 32 ? SWAP(n.h32.field) : SWAP(n.h64.field))
191 #define SHSIZE (size == 32 ? sizeof(s.h32) : sizeof(s.h64))
192 #define NHSIZE (size == 32 ? sizeof(n.h32) : sizeof(n.h64))
193 struct {
194 char name[ELF_NOTE_PAX_NAMESZ];
195 uint32_t flags;
196 } pax_tag;
197 int fd, size, ok = 0, flagged = 0, swap, error = 1;
198 size_t i;
199
200 fd = open(name, list ? O_RDONLY: O_RDWR, 0);
201 if (fd == -1) {
202 warn("Can't open `%s'", name);
203 return error;
204 }
205
206 if (read(fd, &e, sizeof(e)) != sizeof(e)) {
207 warn("Can't read ELF header from `%s'", name);
208 goto out;
209 }
210
211 if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0) {
212 warnx("Bad ELF magic from `%s' (maybe it's not an ELF?)", name);
213 goto out;
214 }
215
216 if (e.h32.e_ehsize == sizeof(e.h32)) {
217 size = 32;
218 swap = 0;
219 } else if (e.h64.e_ehsize == sizeof(e.h64)) {
220 size = 64;
221 swap = 0;
222 } else if (bswap16(e.h32.e_ehsize) == sizeof(e.h32)) {
223 size = 32;
224 swap = 1;
225 } else if (bswap16(e.h64.e_ehsize) == sizeof(e.h64)) {
226 size = 64;
227 swap = 1;
228 } else {
229 warnx("Bad ELF size %d from `%s' (maybe it's not an ELF?)",
230 (int)e.h32.e_ehsize, name);
231 goto out;
232 }
233
234 for (i = 0; i < EH(e_shnum); i++) {
235 if ((size_t)pread(fd, &s, SHSIZE,
236 (off_t)EH(e_shoff) + i * SHSIZE) != SHSIZE) {
237 warn("Can't read section header data from `%s'", name);
238 goto out;
239 }
240
241 if (SH(sh_type) != SHT_NOTE)
242 continue;
243
244 if (pread(fd, &n, NHSIZE, (off_t)SH(sh_offset)) != NHSIZE) {
245 warn("Can't read note header from `%s'", name);
246 goto out;
247 }
248 if (NH(n_type) != ELF_NOTE_TYPE_PAX_TAG ||
249 NH(n_descsz) != ELF_NOTE_PAX_DESCSZ ||
250 NH(n_namesz) != ELF_NOTE_PAX_NAMESZ)
251 continue;
252 if (pread(fd, &pax_tag, sizeof(pax_tag), SH(sh_offset) + NHSIZE)
253 != sizeof(pax_tag)) {
254 warn("Can't read pax_tag from `%s'", name);
255 goto out;
256 }
257 if (memcmp(pax_tag.name, ELF_NOTE_PAX_NAME,
258 sizeof(pax_tag.name)) != 0) {
259 warn("Unknown pax_tag name `%*.*s' from `%s'",
260 ELF_NOTE_PAX_NAMESZ, ELF_NOTE_PAX_NAMESZ,
261 pax_tag.name, name);
262 goto out;
263 }
264 ok = 1;
265
266 if (list) {
267 if (!pax_haveflags(SWAP(pax_tag.flags)))
268 break;
269
270 if (!pax_flags_sane(SWAP(pax_tag.flags)))
271 warnx("Current flags 0x%x don't make sense",
272 (uint32_t)SWAP(pax_tag.flags));
273
274 if (many)
275 (void)printf("%s: ", name);
276 (void)printf("PaX flags:\n");
277
278 pax_printflags(name, many, SWAP(pax_tag.flags));
279 flagged = 1;
280 break;
281 }
282
283 if (clear) {
284 pax_tag.flags = 0;
285 } else {
286 pax_tag.flags |= SWAP(add_flags);
287 pax_tag.flags &= SWAP(~del_flags);
288 }
289
290 if (!pax_flags_sane(SWAP(pax_tag.flags))) {
291 warnx("New flags 0x%x don't make sense",
292 (uint32_t)SWAP(pax_tag.flags));
293 goto out;
294 }
295
296 if (pwrite(fd, &pax_tag, sizeof(pax_tag),
297 (off_t)SH(sh_offset) + NHSIZE) != sizeof(pax_tag))
298 warn("Can't modify flags on `%s'", name);
299 break;
300 }
301
302 if (!ok) {
303 warnx("Could not find an ELF PaX SHT_NOTE section in `%s'",
304 name);
305 goto out;
306 }
307
308 error = 0;
309 if (list && !flagged) {
310 if (many)
311 (void)printf("%s: ", name);
312 (void)printf("No PaX flags.\n");
313 }
314 out:
315 (void)close(fd);
316 return error;
317 }
318
319 int
main(int argc,char ** argv)320 main(int argc, char **argv)
321 {
322 char *opt;
323 int i, clear = 0, list = 0, bad = 0, many, minus;
324 uint32_t add_flags = 0, del_flags = 0;
325
326 setprogname(argv[0]);
327
328 if (argc < 2)
329 usage();
330
331 for (i = 1; i < argc; i++) {
332 opt = argv[i];
333
334 if (strcmp(opt, "-0") == 0) {
335 clear = 1;
336 continue;
337 }
338
339 if (*opt == '-' || *opt == '+') {
340 uint32_t t;
341 minus = 0;
342
343 while (*opt) {
344 switch (*opt) {
345 case '+':
346 minus = 0;
347 opt++;
348 break;
349 case '-':
350 minus = 1;
351 opt++;
352 break;
353 case ',':
354 opt++;
355 break;
356 default:
357 t = pax_flag(*opt++);
358 if (t == (uint32_t)-1)
359 usage();
360 if (minus)
361 del_flags |= t;
362 else
363 add_flags |= t;
364 break;
365 }
366 }
367 } else
368 break;
369 }
370
371 if (i == argc)
372 usage();
373
374 switch ((add_flags != 0 || del_flags != 0) + clear) {
375 case 0:
376 list = 1;
377 break;
378 case 1:
379 break;
380 default:
381 usage();
382 }
383
384 many = i != argc - 1;
385 for (; i < argc; i++) {
386 bad |= process_one(argv[i], add_flags, del_flags,
387 clear, list, many);
388 }
389
390 return bad ? EXIT_FAILURE : 0;
391 }
392