summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2017-03-24 08:18:27 +0000
committermartin <martin@NetBSD.org>2017-03-24 08:18:27 +0000
commit4d8aef662cf63bf1022ec0fbf706cd89f8aba709 (patch)
tree301fc2bae8e524491dfbfaa6db8ac81f082a37f1
parent4c79a28e2b20ce2459511ab4e2db7f011847692c (diff)
Do not toggle global security.pax.mprotect state in an attempt to
activate it for the current process. It does not work and tests should not change global system state anyway. Instead: skip the test is pax.mprotect is not globally enabled. We could use a better check for this (querying the current processes pax flags), but unfortunately we don't have one.
-rw-r--r--tests/lib/libc/sys/t_mprotect.c42
1 files changed, 7 insertions, 35 deletions
diff --git a/tests/lib/libc/sys/t_mprotect.c b/tests/lib/libc/sys/t_mprotect.c
index 166dfb5e48d..4db90484185 100644
--- a/tests/lib/libc/sys/t_mprotect.c
+++ b/tests/lib/libc/sys/t_mprotect.c
@@ -1,4 +1,4 @@
-/* $NetBSD: t_mprotect.c,v 1.4 2016/05/28 14:34:49 christos Exp $ */
+/* $NetBSD: t_mprotect.c,v 1.5 2017/03/24 08:18:27 martin Exp $ */
/*-
* Copyright (c) 2011 The NetBSD Foundation, Inc.
@@ -29,7 +29,7 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: t_mprotect.c,v 1.4 2016/05/28 14:34:49 christos Exp $");
+__RCSID("$NetBSD: t_mprotect.c,v 1.5 2017/03/24 08:18:27 martin Exp $");
#include <sys/param.h>
#include <sys/mman.h>
@@ -47,13 +47,10 @@ __RCSID("$NetBSD: t_mprotect.c,v 1.4 2016/05/28 14:34:49 christos Exp $");
#include "../common/exec_prot.h"
static long page = 0;
-static int pax_global = -1;
-static int pax_enabled = -1;
static char path[] = "mmap";
static void sighandler(int);
static bool paxinit(void);
-static bool paxset(int, int);
static void
sighandler(int signo)
@@ -65,6 +62,8 @@ static bool
paxinit(void)
{
size_t len = sizeof(int);
+ int pax_global = -1;
+ int pax_enabled = -1;
int rv;
rv = sysctlbyname("security.pax.mprotect.global",
@@ -76,31 +75,12 @@ paxinit(void)
rv = sysctlbyname("security.pax.mprotect.enabled",
&pax_enabled, &len, NULL, 0);
- return rv == 0;
-}
-
-static bool
-paxset(int global, int enabled)
-{
- size_t len = sizeof(int);
- int rv;
-
- rv = sysctlbyname("security.pax.mprotect.global",
- NULL, NULL, &global, len);
-
if (rv != 0)
return false;
- rv = sysctlbyname("security.pax.mprotect.enabled",
- NULL, NULL, &enabled, len);
-
- if (rv != 0)
- return false;
-
- return true;
+ return pax_global == 1 && pax_enabled == 1;
}
-
ATF_TC_WITH_CLEANUP(mprotect_access);
ATF_TC_HEAD(mprotect_access, tc)
{
@@ -188,11 +168,6 @@ ATF_TC_BODY(mprotect_exec, tc)
break;
}
- if (!paxinit())
- return;
- if (pax_enabled == 1 && pax_global == 1)
- atf_tc_skip("PaX MPROTECT restrictions enabled");
-
/*
* Map a page read/write and copy a trivial assembly function inside.
@@ -261,8 +236,8 @@ ATF_TC_BODY(mprotect_pax, tc)
size_t i;
int rv;
- if (!paxinit() || !paxset(1, 1))
- return;
+ if (!paxinit())
+ atf_tc_skip("PaX MPROTECT restrictions not enabled");
/*
* As noted in the original PaX documentation [1],
@@ -302,9 +277,6 @@ ATF_TC_BODY(mprotect_pax, tc)
}
out:
- if (pax_global != -1 && pax_enabled != -1)
- (void)paxset(pax_global, pax_enabled);
-
if (str != NULL)
atf_tc_fail("%s", str);
}