Code

Syscall filtering PoC#267

Code

Merged

fw-immunant merged 16 commits intomainimmunant/IA2-Phase2:mainfrom fw/syscall-filtering-pocimmunant/IA2-Phase2:fw/syscall-filtering-pocCopy head branch name to clipboardSep 12, 2023

+1,858

Commits

Commits on Sep 11, 2023

• tests: add mmap_loop test

  fw-immunant

  committed
  3df0c00

• runtime: add PoC demos

  fw-immunant

  committed
  5909883

Commits on Sep 12, 2023

• runtime: RIIR memory_map data structure

  Show description for ee6ff39
  fw-immunant

  committed
  ee6ff39

• runtime: memory-map: change to storing complex state

  Show description for 22a0038
  fw-immunant

  committed
  22a0038

• runtime: memory-map: track whether regions have been pkey_mprotected yet

  fw-immunant

  committed
  3fe5798

• runtime: memory-map: align ranges to 4k where necessary

  Show description for 32ff83d
  fw-immunant

  committed
  32ff83d

• runtime: memory-map: add memory prot tracking

  fw-immunant

  committed
  6c33044

• runtime: memory-map: allow pkey_mprotect on any memory from any compartment at most once

  Show description for 28a8450
  fw-immunant

  committed
  28a8450

• runtime: memory-map: allow pkey_mprotect and mprotect of unknown memory

  Show description for 41330fb
  fw-immunant

  committed
  41330fb

• runtime: memory-map: print error when a request to pkey_mprotect will be denied

  fw-immunant

  committed
  68a06f4

• runtime: memory-map: print warning when a region is multiply mprotect()ed

  fw-immunant

  committed
  d182971

• runtime: memory-map: cfg away debug printing

  fw-immunant

  committed
  953856b

• runtime: track_memory_map: do not look at pre-existing mappings when validating mmap(NULL)

  fw-immunant

  committed
  4a5cf63

• runtime: track_memory_map: allow mprotect() any time it applies the same permissions that currently apply

  fw-immunant

  committed
  1d6a5c8

• runtime: track_memory_map: treat several pkru values seen in program startup as compartment 0

  fw-immunant

  committed
  26e39e6

• runtime: track_memory_map: gate debug printing behind #define

  fw-immunant

  committed
  dcc2167