Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
155,981 Commits 606 Branches 0 Tags 3.1 GiB
8f4adbff6b
Commit Graph

13 Commits

Author SHA1 Message Date
elad
119d4b5acd PR/35253: YAMAMOTO Takashi: fileassoc hash size problem 
fileassoc_table_add() was removed from the KPI and made internal. From now
fileassoc(9) will manage the optimal table size internally.

Input from and okay yamt@.
 2007-02-06 01:09:48 +00:00
elad
d2e4f7167b Remove advertising clause from all of my stuff. 2007-01-09 12:49:36 +00:00
elad
74409752fc Fix copy/paste error: Veriexec's sysctl setup routine was named after 
PaX's.
 2006-12-26 19:31:33 +00:00
yamt
e49bb7c765 - remove the fileassoc "tabledata" functionality. use mountspecific instead. 
- make pax_segvguard_cb static.

tested and ok'ed by elad.
 2006-12-23 08:35:43 +00:00
yamt
b0a14e5934 - remove a static configuration, FILEASSOC_NHOOKS. do it dynamically instead. 
- make fileassoc_t a pointer and remove FILEASSOC_INVAL.
- clean up kern_fileassoc.c.  unify duplicated code.
- unexport fileassoc_init using RUN_ONCE(9).
- plug memory leaks in fileassoc_file_delete and fileassoc_table_delete.
- always call callbacks, regardless of the value of the associated data.

ok'ed by elad.
 2006-12-11 15:24:27 +00:00
elad
a84fee7faf Initial implementation of PaX Segvguard (this is still work-in-progress, 
it's just to get it out of my local tree).
 2006-11-22 02:02:51 +00:00
elad
156f4ce7bb Make PaX MPROTECT use specificdata(9), freeing up two P_* flags. 
While here, make more generic for upcoming PaX features.
 2006-11-22 00:41:38 +00:00
yamt
86a24f7e0c - remove an unnecessary #include. 
- make some variables static.
 2006-11-01 09:36:28 +00:00
cbiere
9e6aff1165 Added missing whitespace in sysctl description string. PR kern/34915. 2006-10-25 20:55:11 +00:00
elad
5c38108d28 Change the PaX mprotect(2) restrictions' "global_protection" knob to 
just "global" -- it's shorter and more readable. Update documentation.
 2006-09-26 14:48:40 +00:00
elad
b3e7e1b010 Better implementation of PaX MPROTECT, after looking some more into the 
code and not trying to use temporary solutions.

Lots of comments and help from YAMAMOTO Takashi, also thanks to the PaX
author for being quick to recognize that something fishy's going on. :)

Hook up in mmap/vmcmd rather than (ugh!) uvm_map_protect().

Next time I suggest to commit a temporary solution just revoke my
commit bit.
 2006-05-20 15:45:37 +00:00
elad
b6894eda07 CTLFLAG_IMMEDIATE doesn't do what I thought it did. from yamt@, thanks! 2006-05-18 17:33:18 +00:00
elad
04d63f90b5 Introduce PaX MPROTECT -- mprotect(2) restrictions used to strengthen 
W^X mappings.

Disabled by default.

First proposed in:

	http://mail-index.netbsd.org/tech-security/2005/12/18/0000.html

More information in:

	http://pax.grsecurity.net/docs/mprotect.txt

Read relevant parts of options(4) and sysctl(3) before using!

Lots of thanks to the PaX author and Matt Thomas.
 2006-05-16 00:08:24 +00:00