From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org)
	by finch.gentoo.org with esmtp (Exim 4.60)
	(envelope-from <gentoo-commits+bounces-393593-garchives=archives.gentoo.org@lists.gentoo.org>)
	id 1RGITM-0003dE-2v
	for garchives@archives.gentoo.org; Tue, 18 Oct 2011 22:49:24 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id D7FC821C085;
	Tue, 18 Oct 2011 22:48:41 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
	by pigeon.gentoo.org (Postfix) with ESMTP id 784E221C085
	for <gentoo-commits@lists.gentoo.org>; Tue, 18 Oct 2011 22:48:41 +0000 (UTC)
Received: from pelican.gentoo.org (unknown [66.219.59.40])
	(using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by smtp.gentoo.org (Postfix) with ESMTPS id 77E581B4030
	for <gentoo-commits@lists.gentoo.org>; Tue, 18 Oct 2011 22:48:40 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
	by pelican.gentoo.org (Postfix) with ESMTP id 63C2080042
	for <gentoo-commits@lists.gentoo.org>; Tue, 18 Oct 2011 22:48:39 +0000 (UTC)
From: "Anthony G. Basile" <blueness@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Anthony G. Basile" <blueness@gentoo.org>
Message-ID: <e51a1cb0fe4635751e74683f43b0093049700b97.blueness@gentoo>
Subject: [gentoo-commits] proj/elfix:master commit in: src/
X-VCS-Repository: proj/elfix
X-VCS-Files: src/paxctl-ng.c
X-VCS-Directories: src/
X-VCS-Committer: blueness
X-VCS-Committer-Name: Anthony G. Basile
X-VCS-Revision: e51a1cb0fe4635751e74683f43b0093049700b97
Date: Tue, 18 Oct 2011 22:48:39 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: quoted-printable
X-Archives-Salt: 
X-Archives-Hash: 1ea50de26da12bbc747bff909af445de

commit:     e51a1cb0fe4635751e74683f43b0093049700b97
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 18 22:48:33 2011 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Tue Oct 18 22:48:33 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=3Dproj/elfix.git;a=3D=
commit;h=3De51a1cb0

src/paxctl-ng.c: add XT_PAX flag support

---
 src/paxctl-ng.c |  375 ++++++++++++++++++++++++++++++++++++-------------=
------
 1 files changed, 246 insertions(+), 129 deletions(-)

diff --git a/src/paxctl-ng.c b/src/paxctl-ng.c
index 9114d4e..f5d9048 100644
--- a/src/paxctl-ng.c
+++ b/src/paxctl-ng.c
@@ -24,6 +24,7 @@
 #include <libgen.h>
=20
 #include <gelf.h>
+#include <attr/xattr.h>
=20
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -32,6 +33,10 @@
=20
 #include <config.h>
=20
+
+#define PAX_NAMESPACE	"trusted.pax"
+#define BUF_SIZE	7
+
 void
 print_help(char *v)
 {
@@ -61,7 +66,7 @@ print_help(char *v)
=20
=20
 char *
-parse_cmd_args(int c, char *v[], int *pax_flags, int *view_flags)
+parse_cmd_args(int c, char *v[], uint16_t *pax_flags, int *view_flags)
 {
 	int i, oc;
 	int compat;
@@ -151,174 +156,285 @@ parse_cmd_args(int c, char *v[], int *pax_flags, =
int *view_flags)
 }
=20
=20
-#define BUF_SIZE 7
-
-void
-print_flags(Elf *elf)
+uint16_t
+read_pt_flags(Elf *elf)
 {
 	GElf_Phdr phdr;
-	char pt_buf[BUF_SIZE];
-	char found_pt_pax;
 	size_t i, phnum;
=20
-	memset(pt_buf, 0, BUF_SIZE);
+	uint16_t pt_flags;
+	char found_pt_pax;
=20
 	found_pt_pax =3D 0;
 	elf_getphdrnum(elf, &phnum);
-	for(i=3D0; i<phnum; ++i)
+
+	for(i=3D0; i<phnum; i++)
 	{
 		if(gelf_getphdr(elf, i, &phdr) !=3D &phdr)
 			error(EXIT_FAILURE, 0, "gelf_getphdr(): %s", elf_errmsg(elf_errno()))=
;
+
 		if(phdr.p_type =3D=3D PT_PAX_FLAGS)
 		{
 			found_pt_pax =3D 1;
+			pt_flags =3D phdr.p_flags;
+		}
+	}
=20
-			pt_buf[0] =3D phdr.p_flags & PF_PAGEEXEC ? 'P' :
-				phdr.p_flags & PF_NOPAGEEXEC ? 'p' : '-' ;
+	if(!found_pt_pax)
+	{
+		printf("PT_PAX: not found\n");
+		pt_flags =3D UINT16_MAX;
+	}
=20
-			pt_buf[1] =3D phdr.p_flags & PF_SEGMEXEC   ? 'S' :=20
-				phdr.p_flags & PF_NOSEGMEXEC ? 's' : '-';
+	return pt_flags;
+}
=20
-			pt_buf[2] =3D phdr.p_flags & PF_MPROTECT   ? 'M' :
-				phdr.p_flags & PF_NOMPROTECT ? 'm' : '-';
=20
-			pt_buf[3] =3D phdr.p_flags & PF_EMUTRAMP   ? 'E' :
-				phdr.p_flags & PF_NOEMUTRAMP ? 'e' : '-';
+uint16_t
+read_xt_flags(int fd)
+{
+	uint16_t xt_flags;
=20
-			pt_buf[4] =3D phdr.p_flags & PF_RANDMMAP   ? 'R' :
-				phdr.p_flags & PF_NORANDMMAP ? 'r' : '-';
+	if(fgetxattr(fd, PAX_NAMESPACE, &xt_flags, sizeof(uint16_t)) =3D=3D -1)
+	{
=20
-			pt_buf[5] =3D phdr.p_flags & PF_RANDEXEC   ? 'X' :
-				phdr.p_flags & PF_NORANDEXEC ? 'x' : '-';
+		// ERANGE  =3D xattrs supported, PAX_NAMESPACE present, but wrong size
+		// ENOATTR =3D xattrs supported, PAX_NAMESPACE not present
+		if(errno =3D=3D ERANGE || errno =3D=3D ENOATTR)
+		{
+			printf("XT_PAX: creating/repairing flags\n");
+			xt_flags =3D PF_NOEMUTRAMP | PF_NORANDEXEC;
+			if(fsetxattr(fd, PAX_NAMESPACE, &xt_flags, sizeof(uint16_t), 0) =3D=3D=
 -1)
+			{
+				if(errno =3D=3D ENOSPC || errno =3D=3D EDQUOT)
+					printf("XT_PAX: access error\n");
+				if(errno =3D=3D ENOTSUP)
+					printf("XT_PAX: not supported\n");
+			}
+		}
+
+		// ENOTSUP =3D xattrs not supported
+		if(errno =3D=3D ENOTSUP)
+		{
+			xt_flags =3D UINT16_MAX; //invalid value
+			printf("XT_PAX: not supported\n");
 		}
 	}
=20
-	if(found_pt_pax)
-		printf("PT_PAX: %s\n", pt_buf);
-	else
-		printf("PT_PAX: not found\n");
+	return xt_flags;
+}
+
+
+void
+bin2string(uint16_t flags, char *buf)
+{
+	buf[0] =3D flags & PF_PAGEEXEC ? 'P' :
+		flags & PF_NOPAGEEXEC ? 'p' : '-' ;
+
+	buf[1] =3D flags & PF_SEGMEXEC   ? 'S' :=20
+		flags & PF_NOSEGMEXEC ? 's' : '-';
+
+	buf[2] =3D flags & PF_MPROTECT   ? 'M' :
+		flags & PF_NOMPROTECT ? 'm' : '-';
+
+	buf[3] =3D flags & PF_EMUTRAMP   ? 'E' :
+		flags & PF_NOEMUTRAMP ? 'e' : '-';
+
+	buf[4] =3D flags & PF_RANDMMAP   ? 'R' :
+		flags & PF_NORANDMMAP ? 'r' : '-';
+
+	buf[5] =3D flags & PF_RANDEXEC   ? 'X' :
+		flags & PF_NORANDEXEC ? 'x' : '-';
+}
+
+
+void
+print_flags(int fd, Elf *elf)
+{
+	uint16_t flags;
+	char buf[BUF_SIZE];
+
+	flags =3D read_pt_flags(elf);
+	if( flags !=3D UINT16_MAX )
+	{
+		memset(buf, 0, BUF_SIZE);
+		bin2string(flags, buf);
+		printf("PT_PAX: %s\n", buf);
+	}
+
+	flags =3D read_xt_flags(fd);
+	if( flags !=3D UINT16_MAX )
+	{
+		memset(buf, 0, BUF_SIZE);
+		bin2string(flags, buf);
+		printf("XT_PAX: %s\n", buf);
+	}
+}
+
+
+
+uint16_t
+new_flags(uint16_t flags, uint16_t pax_flags)
+{
+	//PAGEEXEC
+	if(pax_flags & PF_PAGEEXEC)
+	{
+		flags |=3D PF_PAGEEXEC;
+		flags &=3D ~PF_NOPAGEEXEC;
+	}
+	if(pax_flags & PF_NOPAGEEXEC)
+	{
+		flags &=3D ~PF_PAGEEXEC;
+		flags |=3D PF_NOPAGEEXEC;
+	}
+	if((pax_flags & PF_PAGEEXEC) && (pax_flags & PF_NOPAGEEXEC))
+	{
+		flags &=3D ~PF_PAGEEXEC;
+		flags &=3D ~PF_NOPAGEEXEC;
+	}
+
+	//SEGMEXEC
+	if(pax_flags & PF_SEGMEXEC)
+	{
+		flags |=3D PF_SEGMEXEC;
+		flags &=3D ~PF_NOSEGMEXEC;
+	}
+	if(pax_flags & PF_NOSEGMEXEC)
+	{
+		flags &=3D ~PF_SEGMEXEC;
+		flags |=3D PF_NOSEGMEXEC;
+	}
+	if((pax_flags & PF_SEGMEXEC) && (pax_flags & PF_NOSEGMEXEC))
+	{
+		flags &=3D ~PF_SEGMEXEC;
+		flags &=3D ~PF_NOSEGMEXEC;
+	}
+
+	//MPROTECT
+	if(pax_flags & PF_MPROTECT)
+	{
+		flags |=3D PF_MPROTECT;
+		flags &=3D ~PF_NOMPROTECT;
+	}
+	if(pax_flags & PF_NOMPROTECT)
+	{
+		flags &=3D ~PF_MPROTECT;
+		flags |=3D PF_NOMPROTECT;
+	}
+	if((pax_flags & PF_MPROTECT) && (pax_flags & PF_NOMPROTECT))
+	{
+		flags &=3D ~PF_MPROTECT;
+		flags &=3D ~PF_NOMPROTECT;
+	}
+
+	//EMUTRAMP
+	if(pax_flags & PF_EMUTRAMP)
+	{
+		flags |=3D PF_EMUTRAMP;
+		flags &=3D ~PF_NOEMUTRAMP;
+	}
+	if(pax_flags & PF_NOEMUTRAMP)
+	{
+		flags &=3D ~PF_EMUTRAMP;
+		flags |=3D PF_NOEMUTRAMP;
+	}
+	if((pax_flags & PF_EMUTRAMP) && (pax_flags & PF_NOEMUTRAMP))
+	{
+		flags &=3D ~PF_EMUTRAMP;
+		flags &=3D ~PF_NOEMUTRAMP;
+	}
+
+	//RANDMMAP
+	if(pax_flags & PF_RANDMMAP)
+	{
+		flags |=3D PF_RANDMMAP;
+		flags &=3D ~PF_NORANDMMAP;
+	}
+	if(pax_flags & PF_NORANDMMAP)
+	{
+		flags &=3D ~PF_RANDMMAP;
+		flags |=3D PF_NORANDMMAP;
+	}
+	if((pax_flags & PF_RANDMMAP) && (pax_flags & PF_NORANDMMAP))
+	{
+		flags &=3D ~PF_RANDMMAP;
+		flags &=3D ~PF_NORANDMMAP;
+	}
+
+	//RANDEXEC
+	if(pax_flags & PF_RANDEXEC)
+	{
+		flags |=3D PF_RANDEXEC;
+		flags &=3D ~PF_NORANDEXEC;
+	}
+	if(pax_flags & PF_NORANDEXEC)
+	{
+		flags &=3D ~PF_RANDEXEC;
+		flags |=3D PF_NORANDEXEC;
+	}
+	if((pax_flags & PF_RANDEXEC) && (pax_flags & PF_NORANDEXEC))
+	{
+		flags &=3D ~PF_RANDEXEC;
+		flags &=3D ~PF_NORANDEXEC;
+	}
+
+	return flags;
 }
=20
=20
 void
-set_flags(Elf *elf, int *pax_flags)
+set_pt_flags(Elf *elf, uint16_t pt_flags)
 {
 	GElf_Phdr phdr;
 	size_t i, phnum;
=20
 	elf_getphdrnum(elf, &phnum);
-	for(i=3D0; i<phnum; ++i)
+
+	for(i=3D0; i<phnum; i++)
 	{
 		if(gelf_getphdr(elf, i, &phdr) !=3D &phdr)
 			error(EXIT_FAILURE, 0, "gelf_getphdr(): %s", elf_errmsg(elf_errno()))=
;
=20
 		if(phdr.p_type =3D=3D PT_PAX_FLAGS)
 		{
-			//PAGEEXEC
-			if(*pax_flags & PF_PAGEEXEC)
-			{
-				phdr.p_flags |=3D PF_PAGEEXEC;
-				phdr.p_flags &=3D ~PF_NOPAGEEXEC;
-			}
-			if(*pax_flags & PF_NOPAGEEXEC)
-			{
-				phdr.p_flags &=3D ~PF_PAGEEXEC;
-				phdr.p_flags |=3D PF_NOPAGEEXEC;
-			}
-			if((*pax_flags & PF_PAGEEXEC) && (*pax_flags & PF_NOPAGEEXEC))
-			{
-				phdr.p_flags &=3D ~PF_PAGEEXEC;
-				phdr.p_flags &=3D ~PF_NOPAGEEXEC;
-			}
+			phdr.p_flags =3D pt_flags;
+			if(!gelf_update_phdr(elf, i, &phdr))
+				error(EXIT_FAILURE, 0, "gelf_update_phdr(): %s", elf_errmsg(elf_errn=
o()));
+		}
+	}
+}
=20
-			//SEGMEXEC
-			if(*pax_flags & PF_SEGMEXEC)
-			{
-				phdr.p_flags |=3D PF_SEGMEXEC;
-				phdr.p_flags &=3D ~PF_NOSEGMEXEC;
-			}
-			if(*pax_flags & PF_NOSEGMEXEC)
-			{
-				phdr.p_flags &=3D ~PF_SEGMEXEC;
-				phdr.p_flags |=3D PF_NOSEGMEXEC;
-			}
-			if((*pax_flags & PF_SEGMEXEC) && (*pax_flags & PF_NOSEGMEXEC))
-			{
-				phdr.p_flags &=3D ~PF_SEGMEXEC;
-				phdr.p_flags &=3D ~PF_NOSEGMEXEC;
-			}
=20
-			//MPROTECT
-			if(*pax_flags & PF_MPROTECT)
-			{
-				phdr.p_flags |=3D PF_MPROTECT;
-				phdr.p_flags &=3D ~PF_NOMPROTECT;
-			}
-			if(*pax_flags & PF_NOMPROTECT)
-			{
-				phdr.p_flags &=3D ~PF_MPROTECT;
-				phdr.p_flags |=3D PF_NOMPROTECT;
-			}
-			if((*pax_flags & PF_MPROTECT) && (*pax_flags & PF_NOMPROTECT))
-			{
-				phdr.p_flags &=3D ~PF_MPROTECT;
-				phdr.p_flags &=3D ~PF_NOMPROTECT;
-			}
+void
+set_xt_flags(int fd, uint16_t xt_flags)
+{
+	if(fsetxattr(fd, PAX_NAMESPACE, &xt_flags, sizeof(uint16_t), 0) =3D=3D =
-1)
+	{
+		if(errno =3D=3D ENOSPC || errno =3D=3D EDQUOT)
+			printf("XT_PAX: access error\n");
+		if(errno =3D=3D ENOTSUP)
+			printf("XT_PAX: not supported\n");
+	}
+}
=20
-			//EMUTRAMP
-			if(*pax_flags & PF_EMUTRAMP)
-			{
-				phdr.p_flags |=3D PF_EMUTRAMP;
-				phdr.p_flags &=3D ~PF_NOEMUTRAMP;
-			}
-			if(*pax_flags & PF_NOEMUTRAMP)
-			{
-				phdr.p_flags &=3D ~PF_EMUTRAMP;
-				phdr.p_flags |=3D PF_NOEMUTRAMP;
-			}
-			if((*pax_flags & PF_EMUTRAMP) && (*pax_flags & PF_NOEMUTRAMP))
-			{
-				phdr.p_flags &=3D ~PF_EMUTRAMP;
-				phdr.p_flags &=3D ~PF_NOEMUTRAMP;
-			}
=20
-			//RANDMMAP
-			if(*pax_flags & PF_RANDMMAP)
-			{
-				phdr.p_flags |=3D PF_RANDMMAP;
-				phdr.p_flags &=3D ~PF_NORANDMMAP;
-			}
-			if(*pax_flags & PF_NORANDMMAP)
-			{
-				phdr.p_flags &=3D ~PF_RANDMMAP;
-				phdr.p_flags |=3D PF_NORANDMMAP;
-			}
-			if((*pax_flags & PF_RANDMMAP) && (*pax_flags & PF_NORANDMMAP))
-			{
-				phdr.p_flags &=3D ~PF_RANDMMAP;
-				phdr.p_flags &=3D ~PF_NORANDMMAP;
-			}
+void
+set_flags(int fd, Elf *elf, uint16_t *pax_flags)
+{
+	uint16_t flags;
=20
-			//RANDEXEC
-			if(*pax_flags & PF_RANDEXEC)
-			{
-				phdr.p_flags |=3D PF_RANDEXEC;
-				phdr.p_flags &=3D ~PF_NORANDEXEC;
-			}
-			if(*pax_flags & PF_NORANDEXEC)
-			{
-				phdr.p_flags &=3D ~PF_RANDEXEC;
-				phdr.p_flags |=3D PF_NORANDEXEC;
-			}
-			if((*pax_flags & PF_RANDEXEC) && (*pax_flags & PF_NORANDEXEC))
-			{
-				phdr.p_flags &=3D ~PF_RANDEXEC;
-				phdr.p_flags &=3D ~PF_NORANDEXEC;
-			}
+	flags =3D read_pt_flags(elf);
+	if( flags !=3D UINT16_MAX )
+	{
+		flags =3D new_flags( flags, *pax_flags);
+		set_pt_flags(elf, flags);
+	}
=20
-			if(!gelf_update_phdr(elf, i, &phdr))
-				error(EXIT_FAILURE, 0, "gelf_update_phdr(): %s", elf_errmsg(elf_errn=
o()));
-		}
+	flags =3D read_xt_flags(fd);
+	if( flags !=3D UINT16_MAX )
+	{
+		flags =3D new_flags( flags, *pax_flags);
+		set_xt_flags(fd, flags);
 	}
 }
=20
@@ -327,7 +443,8 @@ int
 main( int argc, char *argv[])
 {
 	int fd;
-	int pax_flags, view_flags;
+	uint16_t pax_flags;
+	int view_flags;
 	char *f_name;
=20
 	Elf *elf;
@@ -347,10 +464,10 @@ main( int argc, char *argv[])
 		error(EXIT_FAILURE, 0, "elf_kind() fail: this is not an elf file.");
=20
 	if(pax_flags !=3D 0)
-		set_flags(elf, &pax_flags);
+		set_flags(fd, elf, &pax_flags);
=20
 	if(view_flags =3D=3D 1)
-		print_flags(elf);
+		print_flags(fd, elf);
=20
 	elf_end(elf);
 	close(fd);