summaryrefslogtreecommitdiff
path: root/sys/kern/kern_exec.c
AgeCommit message (Collapse)Author
2016-04-25boom goes the dynamiteTed Unangst
2016-03-19Remove the unused flags argument from VOP_UNLOCK().natano
torture tested on amd64, i386 and macppc ok beck mpi stefan "the change looks right" deraadt
2016-03-06No more compat emulations, so remove ktrace EMUL records and the baggagePhilip Guenther
for generating and parsing them. ok mpi@ naddy@ millert@ deraadt@
2015-12-05remove stale lint annotationsTed Unangst
2015-11-02move the pledgenote annotation from `struct proc' to `struct nameidata'Sebastien Marie
pledgenote is used for annotate the policy for a namei context. So make it tracking the nameidata. It is expected for the caller to explicitly define the policy. It is a kernel bug to not do so. ok deraadt@
2015-10-28move p_pledgenote setting next to NDINIT()Theo de Raadt
2015-10-25Fold "malloc" into "stdio" and -- recognizing that no program so far hasTheo de Raadt
used less than "stdio" -- include all the "self" operations. Instead of different defines, use regular PLEDGE_* in the "p_pledgenote" variable (which indicates the operation subtype a system call is performing). Many checks before easier to understand. p_pledgenote can often be passed directly to ktrace, so that kdump says: 15565 test CALL pledge(0xa9a3f804c51,0) 15565 test STRU pledge request="stdio" 15565 test RET pledge 0 15565 test CALL open(0xa9a3f804c57,0x2<O_RDWR>) 15565 test NAMI "/tmp/testfile" 15565 test PLDG open, "wpath", errno 1 Operation not permitted with help from semarie, ok guenther
2015-10-10I forgot execve would go through the namei codepath, so a program markedTheo de Raadt
"stdio rpath" this would fail to execve. pre-indicate exec actions to the namei checker to allow them through. ok semarie
2015-10-09Rename tame() to pledge(). This fairly interface has evolved to be moreTheo de Raadt
strict than anticipated. It allows a programmer to pledge/promise/covenant that their program will operate within an easily defined subset of the Unix environment, or it pays the price.
2015-10-07Add the tame "exec" request. This allows processes which requestTheo de Raadt
"exec" to call execve(2), potentially fork(2) beforehands if they asked for "proc". Calling execve is what "shells" (ksh, tmux, etc) have as their primary purpose. But meantime, if such a shell has a nasty bug, we want to mitigate the process from opening a socket or calling 100+ other system calls. Unfortunately silver bullets are in short supply, so if our goal is to stay in a POSIX-y environment, we have to let shells call execve(). POSIX ate the world, so choices do we all have? Warning for many: silver bullets are even more rare in other OS ecosystems, so please accept this as a narrow lowering of the bar in a very raised environment. Commited from a machine running tame "proc exec" ksh, make, etc.
2015-10-02missing ) in COMPAT_LINUX blockTheo de Raadt
2015-10-02Add ktracing of argv and envp to execve(2), with envp not traced by defaultPhilip Guenther
ok tedu@ deraadt@
2015-09-28Track size of an opaque allocation to pass to free() laterTheo de Raadt
ok guenther tedu
2015-07-22memory leak in execve with systrace, plus some unreachable codeTheo de Raadt
spotted by Maxime Villard ok guenther millert
2015-07-20Add kbind, a syscall for ld.so to use to securely and efficiently updatePhilip Guenther
memory for lazy binding ok deraadt@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-09Change the way stackgap_random is applied. Instead of applying it within theMiod Vallat
fixed stack area of the exec'd image, and risking hitting process limits, should we want to increase stackgap_random, the randomness is applied to the stack region in the process' vmspace.
2015-02-09Stop using USRSTACK as the edge of the stack, but rather use the vmspaceMiod Vallat
vm_minsaddr or vm_maxsaddr, depending upon the direction the stack goes in. This should have no effect on the existing behaviourrr. ok kettenis@ deraadt@
2015-02-07forbid execve() with argc == 0. prompted by a millert email.Ted Unangst
ok deraadt miod
2015-01-26Move the "stackgap" from the stack into its own page at a random address.Mark Kettenis
This allows us the unmap the initial part of the stack, such that it can't be used as a staging area for ROP (or other) attacks. ok guenther@, tedu@
2015-01-20Move ps_strings "after" the random stackgap. This makes its location aMark Kettenis
per-process value, and therefpore turns the VM_PSSTRINGS sysctl into a per-process one as well. This gets rid of a pointer to the bottom of the stack at a fixed location. Also clears the road for unmapping the stackgap. ok deraadt@
2015-01-15Map the sigcode page with MAP_INHERIT_COPY to make sure it isn't shared aterMark Kettenis
a fork. ok deraadt@
2015-01-15Map the sigcode page copy-on-write. This allows userland to put breakpointsMark Kettenis
in the signal trampoline. Solves some long-standing issues with debugging signal handlers in GDB. ok deraadt@
2014-12-17Prefer MADV_* over POSIX_MADV_* in kernel for consistency: the latterPhilip Guenther
doesn't have all the values and therefore can't be used everywhere. ok deraadt@ kettenis@
2014-12-16primary change: move uvm_vnode out of vnode, keeping only a pointer.Ted Unangst
objective: vnode.h doesn't include uvm_extern.h anymore. followup changes: include uvm_extern.h or lock.h where necessary. ok and help from deraadt
2014-12-15Use MAP_INHERIT_* for the 'inh' argument to the UMV_MAPFLAG() macro,Philip Guenther
eliminating the must-be-kept-in-sync UVM_INH_* macros ok deraadt@ tedu@
2014-12-10convert bcopy to memcpy. ok millertTed Unangst
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-11-16Replace a plethora of historical protection options with justTheo de Raadt
PROT_NONE, PROT_READ, PROT_WRITE, and PROT_EXEC from mman.h. PROT_MASK is introduced as the one true way of extracting those bits. Remove UVM_ADV_* wrapper, using the standard names. ok doug guenther kettenis
2014-10-18Don't assume that ep_taddr and ep_daddr are page-aligned. It is possible toMark Kettenis
construct ELF executables for which ep_daddr ends up not being properly aligned. Sanitize the addresses before setting up the address space for the new executable. Should fix the panic discovered by Alejandro Hernandez. ok miod@
2014-09-28Replace uvm_km_alloc(9) and uvm_km_free(9) with the equivalent km_alooc(9)Mark Kettenis
and km_free(9) calls. ok tedu@, mlarkin@
2014-09-08Delete procfs; it's always had races and is now unused: no one noticed forPhilip Guenther
months that I broke it before the 5.5 release. confirmed as not being required by ports by sthen@, ajacoutot@, dcoppa@
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-07-08decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.hTheo de Raadt
don't need to be married. ok guenther miod beck jsing kettenis
2014-05-15Move from struct proc to process the reference-count-holding pointersPhilip Guenther
to the process's vmspace and filedescs. struct proc continues to keep copies of the pointers, copying them on fork, clearing them on exit, and (for vmspace) refreshing on exec. Also, make uvm_swapout_threads() thread aware, eliminating p_swtime in kernel. particular testing by ajacoutot@ and sebastia@
2014-04-18Have each thread keeps its own (counted!) reference to the process's ucredsPhilip Guenther
to avoid possible use-after-free references when swapping ids in threaded processes. "Do I have the right creds?" checks are always made with the threads creds. Inspired by FreeBSD and NetBSD "right time" deraadt@
2014-03-30Eliminates struct pcred by moving the real and saved ugids intoPhilip Guenther
struct ucred; struct process then directly links to the ucred Based on a discussion at c2k10 or so before noting that FreeBSD and NetBSD did this too. ok matthew@
2014-03-26Move p_emul and p_sigcode from proc to process.Philip Guenther
Tweak the handling of ktrace EMUL when changing ktracing: only generate one per process (not one per thread) and pass the correct proc pointer down to the VFS layer. Permit generating of NAMI and CSW records inside ktrace(2) itself. ok deraadt@ millert@
2014-03-19Properly align the stack using _STACKALIGNBYTES, rather that the ALIGN()Theo de Raadt
macro which is unaware that stacks may need larger alignment. This may mean that some workarounds in crt0 can go away (here's looking at you mips64..) Tested on about half the architectures (the most special cases), so let's see what happens. with tobiasu
2014-01-21bzero -> memsetTed Unangst
2014-01-20Move p_textvp from struct proc to struct process so that the exit codePhilip Guenther
can be further simplified. ok kettenis@
2013-06-17Add support for the _POSIX_CPUTIME and _POSIX_THREAD_CPUTIME options,Philip Guenther
including CLOCK_{PROCESS,THREAD}_CPUTIME_ID constants and {clock,pthread}_getcpuclockid() functions. Worked out at t2k13 with help from tedu@ and matthew@ and testing by aja@ ok matthew@
2013-03-30vrele() is a tricky beast. it can sleep if the refcount hits zero,Ted Unangst
leaving us with a free type function that isn't atomic. deal with this by erasing any reachable pointers to the vnode first, then free it. ok deraadt guenther
2013-03-28do not include machine/cpu.h from a .c file; it is the responsibility ofTheo de Raadt
.h files to pull it in, if needed ok tedu
2012-08-02Apply profiling to all threads instead of just the thread that calledPhilip Guenthe
profil() by moving P_PROFIL from proc->p_flag to process->ps_flags with matching adjustment in fork1() and exit1() ok matthew@
2012-05-01Correct the error path in execve when there's a race to single threadPhilip Guenthe
the process. noted and ok markus@
2012-04-22Add struct proc * argument to FRELE() and FILE_SET_MATURE() inPhilip Guenthe
anticipation of further changes to closef(). No binary change. ok krw@ miod@ deraadt@
2012-04-13First stab at making ptrace(2) usable for debugging multi-threaded programs.Mark Kettenis
It implements a full-stop model where all threads are stopped before handing over control to the debugger. Events are reported as before through wait(2); you will have to call ptrace(PT_GET_PROCESS_STATE, ...) to find out which thread hit the event. Since this changes the size of struct ptrace_state, you will have to recompile gdb. ok guenther@
2012-04-12move accounting flags to struct process; idea and ok guentherMike Belopuhov
2012-03-26clear junk in p_comm before copying shorter names into itTheo de Raadt
ok jsing guenther miod
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-28 00:01:13 +0000