1/* $NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $ */
2
3/*-
4 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
5 * Copyright (c) 2008 Christos Zoulas <christos@NetBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. The name of the author may not be used to endorse or promote products
17 *    derived from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30#if HAVE_NBTOOL_CONFIG_H
31#include "nbtool_config.h"
32#endif
33
34#include <sys/cdefs.h>
35#ifndef lint
36#ifdef __RCSID
37__RCSID("$NetBSD: paxctl.c,v 1.13 2023/06/23 01:56:21 rin Exp $");
38#endif
39#endif /* not lint */
40
41#include <sys/types.h>
42#ifdef HAVE_NBTOOL_CONFIG_H
43#include "../../sys/sys/exec_elf.h"
44#else
45#include <elf.h>
46#endif
47#include <stdio.h>
48#include <err.h>
49#include <fcntl.h>
50#include <unistd.h>
51#include <stdlib.h>
52#include <string.h>
53
54static void usage(void) __dead;
55static uint32_t pax_flag(char);
56static int pax_flags_sane(uint32_t);
57static int pax_haveflags(uint32_t);
58static void pax_printflags(const char *, int, uint32_t);
59
60#ifndef ELF_NOTE_TYPE_PAX_TAG
61/* NetBSD-specific note type: PaX.  There should be 1 NOTE per executable.
62   section.  desc is a 32 bit bitmask */
63#define ELF_NOTE_TYPE_PAX_TAG		3
64#define	ELF_NOTE_PAX_MPROTECT		0x01	/* Force enable MPROTECT */
65#define	ELF_NOTE_PAX_NOMPROTECT		0x02	/* Force disable MPROTECT */
66#define	ELF_NOTE_PAX_GUARD		0x04	/* Force enable Segvguard */
67#define	ELF_NOTE_PAX_NOGUARD		0x08	/* Force disable Segvguard */
68#define	ELF_NOTE_PAX_ASLR		0x10	/* Force enable ASLR */
69#define	ELF_NOTE_PAX_NOASLR		0x20	/* Force disable ASLR */
70#define ELF_NOTE_PAX_NAMESZ		4
71#define ELF_NOTE_PAX_NAME		"PaX\0"
72#define ELF_NOTE_PAX_DESCSZ		4
73#endif
74#ifndef __arraycount
75#define __arraycount(a) (sizeof(a) / sizeof(a[0]))
76#endif
77
78
79static const struct paxflag {
80	char mark;
81	const char *name;
82	uint32_t bits;
83} flags[] = {
84	{ 'A', "ASLR, explicit enable",
85	  ELF_NOTE_PAX_ASLR },
86	{ 'a', "ASLR, explicit disable",
87	  ELF_NOTE_PAX_NOASLR },
88	{ 'G', "Segvguard, explicit enable",
89	  ELF_NOTE_PAX_GUARD },
90	{ 'g', "Segvguard, explicit disable",
91	  ELF_NOTE_PAX_NOGUARD },
92	{ 'M', "mprotect(2) restrictions, explicit enable",
93	  ELF_NOTE_PAX_MPROTECT },
94	{ 'm', "mprotect(2) restrictions, explicit disable",
95	  ELF_NOTE_PAX_NOMPROTECT },
96};
97
98static void
99usage(void)
100{
101	(void)fprintf(stderr,
102	    "Usage: %s [ -0 | <-|+><A|a|G|g|M|m> ] <file> ...\n",
103#if HAVE_NBTOOL_CONFIG_H
104	    "paxctl"
105#else
106	    getprogname()
107#endif
108	);
109	exit(1);
110}
111
112static uint32_t
113pax_flag(char s)
114{
115	size_t i;
116
117	if (s == '\0')
118		return (uint32_t)-1;
119
120	for (i = 0; i < __arraycount(flags); i++)
121		if (s == flags[i].mark)
122			return flags[i].bits;
123
124	return (uint32_t)-1;
125}
126
127static int
128pax_flags_sane(uint32_t f)
129{
130	size_t i;
131
132	for (i = 0; i < __arraycount(flags) - 1; i += 2) {
133		uint32_t g = flags[i].bits | flags[i+1].bits;
134		if ((f & g) == g)
135			return 0;
136	}
137
138	return 1;
139}
140
141static int
142pax_haveflags(uint32_t f)
143{
144	size_t i;
145
146	for (i = 0; i < __arraycount(flags); i++)
147		if (f & flags[i].bits)
148			return (1);
149
150	return (0);
151}
152
153static void
154pax_printflags(const char *name, int many, uint32_t f)
155{
156	size_t i;
157
158	for (i = 0; i < __arraycount(flags); i++)
159		if (f & flags[i].bits) {
160			if (many)
161				(void)printf("%s: ", name);
162			(void)printf("  %c: %s\n",
163			    flags[i].mark, flags[i].name);
164		}
165}
166
167static int
168process_one(const char *name, uint32_t add_flags, uint32_t del_flags,
169    int clear, int list, int many)
170{
171	union {
172	    Elf32_Ehdr h32;
173	    Elf64_Ehdr h64;
174	} e;
175	union {
176	    Elf32_Shdr h32;
177	    Elf64_Shdr h64;
178	} s;
179	union {
180	    Elf32_Nhdr h32;
181	    Elf64_Nhdr h64;
182	} n;
183#define SWAP(a)	(swap == 0 ? (a) : \
184    /*LINTED*/(sizeof(a) == 1 ? (a) : \
185    /*LINTED*/(sizeof(a) == 2 ? bswap16(a) : \
186    /*LINTED*/(sizeof(a) == 4 ? bswap32(a) : \
187    /*LINTED*/(sizeof(a) == 8 ? bswap64(a) : (abort(), (a)))))))
188#define EH(field)	(size == 32 ? SWAP(e.h32.field) : SWAP(e.h64.field))
189#define SH(field)	(size == 32 ? SWAP(s.h32.field) : SWAP(s.h64.field))
190#define NH(field)	(size == 32 ? SWAP(n.h32.field) : SWAP(n.h64.field))
191#define SHSIZE		(size == 32 ? sizeof(s.h32) : sizeof(s.h64))
192#define NHSIZE		(size == 32 ? sizeof(n.h32) : sizeof(n.h64))
193	struct {
194		char name[ELF_NOTE_PAX_NAMESZ];
195		uint32_t flags;
196	} pax_tag;
197	int fd, size, ok = 0, flagged = 0, swap, error = 1;
198	size_t i;
199
200	fd = open(name, list ? O_RDONLY: O_RDWR, 0);
201	if (fd == -1) {
202		warn("Can't open `%s'", name);
203		return error;
204	}
205
206	if (read(fd, &e, sizeof(e)) != sizeof(e)) {
207		warn("Can't read ELF header from `%s'", name);
208		goto out;
209	}
210
211	if (memcmp(e.h32.e_ident, ELFMAG, SELFMAG) != 0) {
212		warnx("Bad ELF magic from `%s' (maybe it's not an ELF?)", name);
213		goto out;
214	}
215
216	if (e.h32.e_ehsize == sizeof(e.h32)) {
217		size = 32;
218		swap = 0;
219	} else if (e.h64.e_ehsize == sizeof(e.h64)) {
220		size = 64;
221		swap = 0;
222	} else if (bswap16(e.h32.e_ehsize) == sizeof(e.h32)) {
223		size = 32;
224		swap = 1;
225	} else if (bswap16(e.h64.e_ehsize) == sizeof(e.h64)) {
226		size = 64;
227		swap = 1;
228	} else {
229		warnx("Bad ELF size %d from `%s' (maybe it's not an ELF?)",
230		    (int)e.h32.e_ehsize, name);
231		goto out;
232	}
233
234	for (i = 0; i < EH(e_shnum); i++) {
235		if ((size_t)pread(fd, &s, SHSIZE,
236		    (off_t)EH(e_shoff) + i * SHSIZE) != SHSIZE) {
237			warn("Can't read section header data from `%s'", name);
238			goto out;
239		}
240
241		if (SH(sh_type) != SHT_NOTE)
242			continue;
243
244		if (pread(fd, &n, NHSIZE, (off_t)SH(sh_offset)) != NHSIZE) {
245			warn("Can't read note header from `%s'", name);
246			goto out;
247		}
248		if (NH(n_type) != ELF_NOTE_TYPE_PAX_TAG ||
249		    NH(n_descsz) != ELF_NOTE_PAX_DESCSZ ||
250		    NH(n_namesz) != ELF_NOTE_PAX_NAMESZ)
251			continue;
252		if (pread(fd, &pax_tag, sizeof(pax_tag), SH(sh_offset) + NHSIZE)
253		    != sizeof(pax_tag)) {
254			warn("Can't read pax_tag from `%s'", name);
255			goto out;
256		}
257		if (memcmp(pax_tag.name, ELF_NOTE_PAX_NAME,
258		    sizeof(pax_tag.name)) != 0) {
259			warn("Unknown pax_tag name `%*.*s' from `%s'",
260			    ELF_NOTE_PAX_NAMESZ, ELF_NOTE_PAX_NAMESZ,
261			    pax_tag.name, name);
262			goto out;
263		}
264		ok = 1;
265
266		if (list) {
267			if (!pax_haveflags(SWAP(pax_tag.flags)))
268				break;
269
270			if (!pax_flags_sane(SWAP(pax_tag.flags)))
271				warnx("Current flags 0x%x don't make sense",
272				    (uint32_t)SWAP(pax_tag.flags));
273
274			if (many)
275				(void)printf("%s: ", name);
276			(void)printf("PaX flags:\n");
277
278			pax_printflags(name, many, SWAP(pax_tag.flags));
279			flagged = 1;
280			break;
281		}
282
283		if (clear) {
284			pax_tag.flags = 0;
285		} else {
286			pax_tag.flags |= SWAP(add_flags);
287			pax_tag.flags &= SWAP(~del_flags);
288		}
289
290		if (!pax_flags_sane(SWAP(pax_tag.flags))) {
291			warnx("New flags 0x%x don't make sense",
292			    (uint32_t)SWAP(pax_tag.flags));
293			goto out;
294		}
295
296		if (pwrite(fd, &pax_tag, sizeof(pax_tag),
297		    (off_t)SH(sh_offset) + NHSIZE) != sizeof(pax_tag))
298			warn("Can't modify flags on `%s'", name);
299		break;
300	}
301
302	if (!ok) {
303		warnx("Could not find an ELF PaX SHT_NOTE section in `%s'",
304		    name);
305		goto out;
306	}
307
308	error = 0;
309	if (list && !flagged) {
310		if (many)
311			(void)printf("%s: ", name);
312		(void)printf("No PaX flags.\n");
313	}
314out:
315	(void)close(fd);
316	return error;
317}
318
319int
320main(int argc, char **argv)
321{
322	char *opt;
323	int i, clear = 0, list = 0, bad = 0, many, minus;
324	uint32_t add_flags = 0, del_flags = 0;
325
326	setprogname(argv[0]);
327
328	if (argc < 2)
329		usage();
330
331	for (i = 1; i < argc; i++) {
332		opt = argv[i];
333
334		if (strcmp(opt, "-0") == 0) {
335			clear = 1;
336			continue;
337		}
338
339		if (*opt == '-' || *opt == '+') {
340			uint32_t t;
341			minus = 0;
342
343			while (*opt) {
344				switch (*opt) {
345				case '+':
346					minus = 0;
347					opt++;
348					break;
349				case '-':
350					minus = 1;
351					opt++;
352					break;
353				case ',':
354					opt++;
355					break;
356				default:
357					t = pax_flag(*opt++);
358					if (t == (uint32_t)-1)
359						usage();
360					if (minus)
361						del_flags |= t;
362					else
363						add_flags |= t;
364					break;
365				}
366			}
367		} else
368			break;
369	}
370
371	if (i == argc)
372		usage();
373
374	switch ((add_flags != 0 || del_flags != 0) + clear) {
375	case 0:
376		list = 1;
377		break;
378	case 1:
379		break;
380	default:
381		usage();
382	}
383
384	many = i != argc - 1;
385	for (; i < argc; i++) {
386		bad |= process_one(argv[i], add_flags, del_flags,
387		    clear, list, many);
388	}
389
390	return bad ? EXIT_FAILURE : 0;
391}
392