395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# This file and its contents are supplied under the terms of the
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# Common Development and Distribution License ("CDDL"), version 1.0.
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# You may only use this file in accordance with the terms of version
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# 1.0 of the CDDL.
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# A full copy of the text of the CDDL should have accompanied this
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# source. A copy of the CDDL is also available via the Internet at
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# Copyright (c) 2015, Joyent, Inc. All rights reserved.
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# When we lack dtrace_kernel, we expect to not be able to get at kernel memory
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# via any subroutine or other vector.
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill# trace(func((void *)&\`utsname)); }
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill/usr/sbin/dtrace -wq -Cs /dev/stdin 2> $err <<EOF
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#define FAIL \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill printf("able to read kernel memory via %s!\n", badsubr); \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#define CANTREAD1(func) \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill BEGIN { badsubr = "func()"; func((void *)&\`utsname); FAIL }
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#define CANTREAD2(func, arg1) \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill BEGIN { badsubr = "func()"; func((void *)&\`utsname, arg1); FAIL }
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#define CANTREAD2ARG1(func, arg0) \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill BEGIN { badsubr = "func() (arg1)"; func(arg0, (void *)&\`utsname); FAIL }
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#define CANTREAD3(func, arg1, arg2) \
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill BEGIN { badsubr = "func()"; func((void *)&\`utsname, arg1, arg2); FAIL }
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(mutex_owned)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(mutex_owner)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(mutex_type_adaptive)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(mutex_type_spin)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(rw_read_held)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(rw_write_held)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(rw_iswriter)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD3(bcopy, alloca(1), 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(msgsize)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(msgdsize)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(strlen)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(strchr, '!')
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(strrchr, '!')
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(strstr, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(strstr, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(index, "bagnoogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(index, "bagnoogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(rindex, "bagnoogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(rindex, "bagnoogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(strtok, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(strtok, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(json, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(json, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(toupper)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(tolower)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(ddi_pathname, 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2(strjoin, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD2ARG1(strjoin, "doogle")
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(strtoll)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(dirname)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(basename)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD1(cleanpath)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#if defined(__amd64)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD3(copyout, uregs[R_R9], 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD3(copyoutstr, uregs[R_R9], 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill#if defined(__i386)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD3(copyout, uregs[R_ESP], 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan CantrillCANTREAD3(copyoutstr, uregs[R_ESP], 1)
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill/arg4 != DTRACEFLT_KPRIV/
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill printf("bad error code via %s (expected %d, found %d)\n",
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill badsubr, DTRACEFLT_KPRIV, arg4);
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill/arg4 == DTRACEFLT_KPRIV/
395c7a3dcfc66b8b671dc4b3c4a2f0ca26449922Bryan Cantrill printf("illegal kernel access properly prevented from %s\n", badsubr);