Index: lib/libc/Makefile =================================================================== --- lib/libc/Makefile +++ lib/libc/Makefile @@ -95,6 +95,7 @@ .include "${LIBC_SRCTOP}/stdtime/Makefile.inc" .include "${LIBC_SRCTOP}/string/Makefile.inc" .include "${LIBC_SRCTOP}/sys/Makefile.inc" +.include "${LIBC_SRCTOP}/secure/Makefile.inc" .include "${LIBC_SRCTOP}/rpc/Makefile.inc" .include "${LIBC_SRCTOP}/uuid/Makefile.inc" .include "${LIBC_SRCTOP}/xdr/Makefile.inc" Index: lib/libc/secure/Makefile.inc =================================================================== --- /dev/null +++ lib/libc/secure/Makefile.inc @@ -0,0 +1,9 @@ +# libc sources related to security +.PATH: ${LIBC_SRCTOP}/secure + +# Sources common to both syscall interfaces: +SRCS+= \ + stack_protector.c \ + stack_protector_compat.c + +SYM_MAPS+= ${LIBC_SRCTOP}/secure/Symbol.map Index: lib/libc/secure/Symbol.map =================================================================== --- /dev/null +++ lib/libc/secure/Symbol.map @@ -0,0 +1,14 @@ +/* + * $FreeBSD$ + */ + +/* + * It'd be nice to have this automatically generated, but we don't + * know to what version they will eventually belong, so for now + * it has to be manual. + */ +FBSD_1.0 { + __chk_fail; + __stack_chk_fail; + __stack_chk_guard; +}; Index: lib/libc/sys/Makefile.inc =================================================================== --- lib/libc/sys/Makefile.inc +++ lib/libc/sys/Makefile.inc @@ -21,8 +21,6 @@ # Sources common to both syscall interfaces: SRCS+= \ - stack_protector.c \ - stack_protector_compat.c \ __error.c \ interposing_table.c Index: lib/libc/sys/Symbol.map =================================================================== --- lib/libc/sys/Symbol.map +++ lib/libc/sys/Symbol.map @@ -56,7 +56,6 @@ bind; chdir; chflags; - __chk_fail; chmod; chown; chroot; @@ -281,8 +280,6 @@ sigwaitinfo; socket; socketpair; - __stack_chk_fail; - __stack_chk_guard; stat; statfs; swapoff; Index: lib/libc/sys/stack_protector.c =================================================================== --- lib/libc/sys/stack_protector.c +++ lib/libc/sys/stack_protector.c @@ -1,117 +0,0 @@ -/* $NetBSD: stack_protector.c,v 1.4 2006/11/22 17:23:25 christos Exp $ */ -/* $OpenBSD: stack_protector.c,v 1.10 2006/03/31 05:34:44 deraadt Exp $ */ -/* - * Copyright (c) 2002 Hiroaki Etoh, Federico G. Schwindt, and Miodrag Vallat. - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN - * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - * POSSIBILITY OF SUCH DAMAGE. - * - */ - -#include -__FBSDID("$FreeBSD$"); - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include "libc_private.h" - -extern int __sysctl(const int *name, u_int namelen, void *oldp, - size_t *oldlenp, void *newp, size_t newlen); - -long __stack_chk_guard[8] = {0, 0, 0, 0, 0, 0, 0, 0}; -static void __guard_setup(void) __attribute__((__constructor__, __used__)); -static void __fail(const char *); -void __stack_chk_fail(void); -void __chk_fail(void); - -/*LINTED used*/ -static void -__guard_setup(void) -{ - static const int mib[2] = { CTL_KERN, KERN_ARND }; - size_t len; - int error; - - if (__stack_chk_guard[0] != 0) - return; - error = _elf_aux_info(AT_CANARY, __stack_chk_guard, - sizeof(__stack_chk_guard)); - if (error == 0 && __stack_chk_guard[0] != 0) - return; - - len = sizeof(__stack_chk_guard); - if (__sysctl(mib, nitems(mib), __stack_chk_guard, &len, NULL, 0) == - -1 || len != sizeof(__stack_chk_guard)) { - /* If sysctl was unsuccessful, use the "terminator canary". */ - ((unsigned char *)(void *)__stack_chk_guard)[0] = 0; - ((unsigned char *)(void *)__stack_chk_guard)[1] = 0; - ((unsigned char *)(void *)__stack_chk_guard)[2] = '\n'; - ((unsigned char *)(void *)__stack_chk_guard)[3] = 255; - } -} - -/*ARGSUSED*/ -static void -__fail(const char *msg) -{ - struct sigaction sa; - sigset_t mask; - - /* Immediately block all signal handlers from running code */ - (void)sigfillset(&mask); - (void)sigdelset(&mask, SIGABRT); - (void)sigprocmask(SIG_BLOCK, &mask, NULL); - - /* This may fail on a chroot jail... */ - syslog(LOG_CRIT, "%s", msg); - - (void)memset(&sa, 0, sizeof(sa)); - (void)sigemptyset(&sa.sa_mask); - sa.sa_flags = 0; - sa.sa_handler = SIG_DFL; - (void)sigaction(SIGABRT, &sa, NULL); - (void)kill(getpid(), SIGABRT); - _exit(127); -} - -void -__stack_chk_fail(void) -{ - __fail("stack overflow detected; terminated"); -} - -void -__chk_fail(void) -{ - __fail("buffer overflow detected; terminated"); -} - -#ifndef PIC -__weak_reference(__stack_chk_fail, __stack_chk_fail_local); -#endif Index: lib/libc/sys/stack_protector_compat.c =================================================================== --- lib/libc/sys/stack_protector_compat.c +++ lib/libc/sys/stack_protector_compat.c @@ -1,20 +0,0 @@ -/* - * Written by Alexander Kabaev - * The file is in public domain. - */ - -#include -__FBSDID("$FreeBSD$"); - -void __stack_chk_fail(void); - -#ifdef PIC -void -__stack_chk_fail_local_hidden(void) -{ - - __stack_chk_fail(); -} - -__sym_compat(__stack_chk_fail_local, __stack_chk_fail_local_hidden, FBSD_1.0); -#endif