syscall call-from verification
The following change only permits system calls from address-ranges in the process which system calls are expected from.
If you manage to upload exploit code containing a raw system call sequence and instruction, and mprotect -w+x that block, such a system call will not succeed but the process is killed. This obliges the attacker to use the libc system call stubs, which in some circumstances are difficult to find due to libc random-relinking at boot...
https://marc.info/?l=openbsd-tech&m=157488907117170
#syscall
The following change only permits system calls from address-ranges in the process which system calls are expected from.
If you manage to upload exploit code containing a raw system call sequence and instruction, and mprotect -w+x that block, such a system call will not succeed but the process is killed. This obliges the attacker to use the libc system call stubs, which in some circumstances are difficult to find due to libc random-relinking at boot...
https://marc.info/?l=openbsd-tech&m=157488907117170
#syscall
OpenBSD system-call pinning
... In December, De Raadt sent a patch to the OpenBSD mailing list expanding OpenBSD's restrictions on the locations from which a process can make system calls...
https://lwn.net/SubscriberLink/959562/0578b8e463f790c1/
#pinsyscalls #syscall
... In December, De Raadt sent a patch to the OpenBSD mailing list expanding OpenBSD's restrictions on the locations from which a process can make system calls...
https://lwn.net/SubscriberLink/959562/0578b8e463f790c1/
#pinsyscalls #syscall