Extend mmap/mprotect API to specify the max page

protections.

A new macro PROT_MAX() alters a protection value so it can be OR'd with
a regular protection value to specify the maximum permissions.  If
present, these flags specify the maximum permissions.

While these flags are non-portable, they can be used in portable code
with simple ifdefs to expand PROT_MAX() to 0.

This change allows (e.g.) a region that must be writable during run-time
linking or JIT code generation to be made permanently read+execute after
writes are complete.  This complements W^X protections allowing more
precise control by the programmer.

This change alters mprotect argument checking and returns an error when
unhandled protection flags are set.  This differs from POSIX (in that
POSIX only specifies an error), but is the documented behavior on Linux
and more closely matches historical mmap behavior.

In addition to explicit setting of the maximum permissions, an
experimental sysctl vm.imply_prot_max causes mmap to assume that the
initial permissions requested should be the maximum when the sysctl is
set to 1.  PROT_NONE mappings are excluded from this for compatibility
with rtld and other consumers that use such mappings to reserve
address space before mapping contents into part of the reservation.  A
final version this is expected to provide per-binary and per-process
opt-in/out options and this sysctl will go away in its current form.
As such it is undocumented.

Reviewed by:	emaste, kib (prior version), markj
Additional suggestions from:	alc
Obtained from:	CheriBSD
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D18880
This commit is contained in:
brooks 2019-06-20 18:24:16 +00:00 committed by Ken Brown
parent b808f23d14
commit fc5d0d6b7a
1 changed files with 9 additions and 1 deletions

View File

@ -29,7 +29,7 @@
* SUCH DAMAGE.
*
* @(#)mman.h 8.2 (Berkeley) 1/9/95
* $FreeBSD: head/sys/sys/mman.h 326023 2017-11-20 19:43:44Z pfg $
* $FreeBSD: head/sys/sys/mman.h 349240 2019-06-20 18:24:16Z brooks $
*/
#ifndef _SYS_MMAN_H_
@ -55,6 +55,14 @@
#define PROT_READ 0x01 /* pages can be read */
#define PROT_WRITE 0x02 /* pages can be written */
#define PROT_EXEC 0x04 /* pages can be executed */
#if __BSD_VISIBLE
#define _PROT_ALL (PROT_READ | PROT_WRITE | PROT_EXEC)
#define PROT_EXTRACT(prot) ((prot) & _PROT_ALL)
#define _PROT_MAX_SHIFT 16
#define PROT_MAX(prot) ((prot) << _PROT_MAX_SHIFT)
#define PROT_MAX_EXTRACT(prot) (((prot) >> _PROT_MAX_SHIFT) & _PROT_ALL)
#endif
/*
* Flags contain sharing type and options.