From: David van Moolenbroek Date: Sun, 6 Sep 2015 06:06:24 +0000 (+0200) Subject: Basic live rerandomization infrastructure X-Git-Url: http://zhaoyanbai.com/repos/%22http:/static/doc/zpipe.c?a=commitdiff_plain;h=refs%2Fchanges%2F75%2F3175%2F1;p=minix.git Basic live rerandomization infrastructure This commits adds a basic infrastructure to support Address Space Randomization (ASR). In a nutshell, using the already imported ASR LLVM pass, multiple versions can be generated for the same system service, each with a randomized, different address space layout. Combined with the magic instrumentation for state transfer, a system service can be live updated into another ASR-randomized version at runtime, thus providing live rerandomization. Since MINIX3 is not yet capable of running LLVM linker passes, the ASR-randomized service binaries have to be pregenerated during crosscompilation. These pregenerated binaries can then be cycled through at runtime. This patch provides the basic proof-of-concept infrastructure for both these parts. In order to support pregeneration, the clientctl host script has been extended with a "buildasr" command. It is to be used after building the entire system with bitcode and magic support, and will produce a given number of ASR-randomized versions of all system services. These services are placed in /usr/service/asr in the image that is generated as final step by the "buildasr" command. In order to support runtime updating, a new update_asr(8) command has been added to MINIX3. This command attempts to live-update the running system services into their next ASR-randomized versions. For now, this command is not run automatically, and thus must be invoked manually. Technical notes: - For various reasons, magic instrumentation is x86-only for now, and ASR functionality is therefore to be used on x86 only as well. - The ASR-randomized binaries are placed in numbered subdirectories so as not to have to change their actual program names, which are assumed to be static in various places (system.conf, procfs). - The root partition is typically too small to contain all the produced binaries, which is why we introduce /usr/service. There is a symlink from /service/asr to /usr/service/asr for no other reason than to let userland continue to assume that all services are reachable through /service. - The ASR count field (r_asr_count/ASRcount) maintained by RS is not used within RS in any way; it is only passed through procfs to userland in order to allow update_asr(8) to keep track of which version is currently loaded without having to maintain own state. - Ideally, pre-instrumentation linking of a service would remove all its randomized versions. Currently, the user is assumed not to perform ASR instrumentation and then recompile system services without performing ASR instrumentation again, as the randomized binaries included in the image would then be stale. This aspect has to be improved later. - Various other issues are flagged in the comments of the various parts of this patch. Change-Id: I093ad57f31c18305591f64b2d491272288aa0937 --- diff --git a/distrib/sets/checkflist b/distrib/sets/checkflist index bc8f19a23..fb320f0e7 100644 --- a/distrib/sets/checkflist +++ b/distrib/sets/checkflist @@ -100,6 +100,7 @@ shift $((${OPTIND} - 1)) # * ignore var/db/syspkg and its contents # * ignore METALOG and METALOG.* # * ignore etc/mtree/set.* +# * MINIX3 only: ignore ASR service binaries # ignore_exceptions() { @@ -107,12 +108,14 @@ IGNORE_REGEXP_SYSPKG="^\./var/db/syspkg(\$|/)" IGNORE_REGEXP_METALOG="^\./METALOG(\..*)?\$" IGNORE_REGEXP_SETS="^\./SETS\..*\$" IGNORE_REGEXP_MTREE="^\./etc/mtree/set\.[a-z]*\$" +IGNORE_REGEXP_SERVICE_ASR="^\./usr/service/asr/" ${EGREP} -v \ -e "${IGNORE_REGEXP_SYSPKG}" \ -e "${IGNORE_REGEXP_METALOG}" \ -e "${IGNORE_REGEXP_SETS}" \ - -e "${IGNORE_REGEXP_MTREE}" + -e "${IGNORE_REGEXP_MTREE}" \ + -e "${IGNORE_REGEXP_SERVICE_ASR}" } # diff --git a/distrib/sets/lists/minix/mi b/distrib/sets/lists/minix/mi index 573647fc4..7fe56d914 100644 --- a/distrib/sets/lists/minix/mi +++ b/distrib/sets/lists/minix/mi @@ -184,6 +184,7 @@ ./sbin/reboot minix-sys ./sbin/shutdown minix-sys ./service minix-sys +./service/asr minix-sys ./service/devman minix-sys ./service/ds minix-sys ./service/emmc minix-sys @@ -5269,6 +5270,7 @@ ./usr/man/man8/unstr.8 minix-sys ./usr/man/man8/update.8 minix-sys ./usr/man/man8/updateboot.8 minix-sys +./usr/man/man8/update_asr.8 minix-sys ./usr/man/man8/update_bootcfg.8 minix-sys ./usr/man/man8/usage.8 minix-sys ./usr/man/man8/user.8 minix-sys @@ -5318,6 +5320,7 @@ ./usr/sbin/syslogd minix-sys ./usr/sbin/traceroute minix-sys ./usr/sbin/unlink minix-sys +./usr/sbin/update_asr minix-sys ./usr/sbin/user minix-sys ./usr/sbin/useradd minix-sys ./usr/sbin/userdel minix-sys @@ -5327,6 +5330,8 @@ ./usr/sbin/vnconfig minix-sys ./usr/sbin/vndconfig minix-sys ./usr/sbin/zic minix-sys +./usr/service minix-sys +./usr/service/asr minix-sys ./usr/share minix-sys ./usr/share/atf minix-sys atf ./usr/share/atf/atf-run.hooks minix-sys atf,!kyua diff --git a/etc/Makefile b/etc/Makefile index f0f86a944..432fb138b 100644 --- a/etc/Makefile +++ b/etc/Makefile @@ -275,7 +275,8 @@ CONFIGSYMLINKS+= ${TZDIR}/${LOCALTIME} /etc/localtime \ CONFIGSYMLINKS+= \ /usr/log /var/log \ /usr/tmp /var/tmp \ - /proc/mounts /etc/mtab + /proc/mounts /etc/mtab \ + /usr/service/asr /service/asr .endif # !defined(__MINIX) diff --git a/etc/mtree/NetBSD.dist.base b/etc/mtree/NetBSD.dist.base index b0a8f4c65..830b63d85 100644 --- a/etc/mtree/NetBSD.dist.base +++ b/etc/mtree/NetBSD.dist.base @@ -120,6 +120,8 @@ ./usr/preserve ./usr/run ./usr/sbin +./usr/service +./usr/service/asr ./usr/share ./usr/share/calendar ./usr/share/doc diff --git a/minix/commands/Makefile b/minix/commands/Makefile index 061230c7b..55b2a8393 100644 --- a/minix/commands/Makefile +++ b/minix/commands/Makefile @@ -30,7 +30,7 @@ SUBDIR= add_route arp at backup btrace \ update version vol \ writeisofs fetch \ zdump zmodem pkgin_cd pkgin_all pkgin_sets \ - worldstone updateboot update_bootcfg \ + worldstone updateboot update_asr update_bootcfg \ atnormalize dosread fdisk loadfont \ autopart part partition playwave \ recwave repartition screendump diff --git a/minix/commands/service/service.c b/minix/commands/service/service.c index 2318ac220..b9e44077d 100644 --- a/minix/commands/service/service.c +++ b/minix/commands/service/service.c @@ -136,6 +136,7 @@ static int known_request_types[] = { #define ARG_TRG_LABELNAME "-trg-label" /* target label name */ #define ARG_LU_IPC_BL "-ipc_bl" /* IPC blacklist filter */ #define ARG_LU_IPC_WL "-ipc_wl" /* IPC whitelist filter */ +#define ARG_ASR_COUNT "-asr-count" /* number of ASR live updates */ #define ARG_RESTARTS "-restarts" /* number of restarts */ /* The function parse_arguments() verifies and parses the command line @@ -158,6 +159,7 @@ static int custom_config_file = 0; static int req_lu_state = DEFAULT_LU_STATE; static int req_lu_maxtime = DEFAULT_LU_MAXTIME; static int req_restarts = 0; +static int req_asr_count = -1; static long req_heap_prealloc = 0; static long req_map_prealloc = 0; static int req_sysctl_type = 0; @@ -175,7 +177,7 @@ static void print_usage(char *app_name, char *problem) fprintf(stderr, "Warning, %s\n", problem); fprintf(stderr, "Usage:\n"); fprintf(stderr, - " %s [%s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s] (up|run|edit|update) [%s ] [%s ] [%s ] [%s ] [%s ] [%s ] [%s ] [%s ] [%s ] [%s