mmap giving Permission Denied error
Hello all, I tried mmap'ing to address zero after setting */proc/sys/vm/mmap_min_addr*to * 0*, but mmap is giving Permission Denied error. My C code is as below - #include <stdio.h> #include <stdlib.h> #include <sys/mman.h> int main(void) { int *ptr = NULL; ptr = mmap(0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0); if(ptr == MAP_FAILED) { perror("Error in mapping\n"); exit(1); } printf("After mmap\n"); *ptr = 16; printf("Contents of address 0x%x is :: %d\n",ptr,*ptr); return 0; } Am I doing anything wrong here? Thank you in advance. Regards, Ravi Teja
MAP_FIXED could be trying to get a map from 0. Pls remove this flag and try. On Sat, Sep 21, 2013 at 6:55 PM, Ravi Teja <ravi2j@gmail.com> wrote:
Hello all,
I tried mmap'ing to address zero after setting */proc/sys/vm/mmap_min_addr * to* 0*, but mmap is giving Permission Denied error.
My C code is as below -
#include <stdio.h> #include <stdlib.h> #include <sys/mman.h>
int main(void) { int *ptr = NULL; ptr = mmap(0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0); if(ptr == MAP_FAILED) { perror("Error in mapping\n"); exit(1); } printf("After mmap\n"); *ptr = 16; printf("Contents of address 0x%x is :: %d\n",ptr,*ptr); return 0; }
Am I doing anything wrong here?
Thank you in advance.
Regards, Ravi Teja
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Hello Ratheesh, I have intentionally used MAP_FIXED flag as* *I am interested in mapping to 0x00000000. Even after setting the mmap_min_addr in /proc/sys/vm to 0 (which was previously 4096), I am getting this error. Is there anything wrong that I am doing? On Sat, Sep 21, 2013 at 7:17 PM, ratheesh kannoth <ratheesh.ksz@gmail.com>wrote:
MAP_FIXED could be trying to get a map from 0.
Pls remove this flag and try.
On Sat, Sep 21, 2013 at 6:55 PM, Ravi Teja <ravi2j@gmail.com> wrote:
Hello all,
I tried mmap'ing to address zero after setting * /proc/sys/vm/mmap_min_addr* to* 0*, but mmap is giving Permission Denied error.
My C code is as below -
#include <stdio.h> #include <stdlib.h> #include <sys/mman.h>
int main(void) { int *ptr = NULL; ptr = mmap(0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0); if(ptr == MAP_FAILED) { perror("Error in mapping\n"); exit(1); } printf("After mmap\n"); *ptr = 16; printf("Contents of address 0x%x is :: %d\n",ptr,*ptr); return 0; }
Am I doing anything wrong here?
Thank you in advance.
Regards, Ravi Teja
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
On Sep 21, 2013 7:35 PM, "Ravi Teja" <ravi2j@gmail.com> wrote:
Hello Ratheesh,
I have intentionally used MAP_FIXED flag as I am interested in mapping to
0x00000000. AFAICS in linux generally mapping to null address is not allowed as this decision helps in debugging null dereference errors.
Even after setting the mmap_min_addr in /proc/sys/vm to 0 (which was
previously 4096), I am getting this error.
Is there anything wrong that I am doing?
On Sat, Sep 21, 2013 at 7:17 PM, ratheesh kannoth <ratheesh.ksz@gmail.com>
wrote:
MAP_FIXED could be trying to get a map from 0.
Pls remove this flag and try.
On Sat, Sep 21, 2013 at 6:55 PM, Ravi Teja <ravi2j@gmail.com> wrote:
Hello all,
I tried mmap'ing to address zero after setting
/proc/sys/vm/mmap_min_addr to 0, but mmap is giving Permission Denied error.
My C code is as below -
#include <stdio.h> #include <stdlib.h> #include <sys/mman.h>
int main(void) { int *ptr = NULL; ptr =
mmap(0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0);
if(ptr == MAP_FAILED) { perror("Error in mapping\n"); exit(1); } printf("After mmap\n"); *ptr = 16; printf("Contents of address 0x%x is :: %d\n",ptr,*ptr); return 0; }
Am I doing anything wrong here?
Thank you in advance.
Regards, Ravi Teja
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Hello all, I have successfully acessed(read and write) to 0x00000000(NULL) address. I had to make certain changes in .config file and recompile it. Thank you all. Regards Ravi Teja On Sat, Sep 21, 2013 at 8:00 PM, anish singh <anish198519851985@gmail.com>wrote:
On Sep 21, 2013 7:35 PM, "Ravi Teja" <ravi2j@gmail.com> wrote:
Hello Ratheesh,
I have intentionally used MAP_FIXED flag as I am interested in mapping
to 0x00000000. AFAICS in linux generally mapping to null address is not allowed as this decision helps in debugging null dereference errors.
Even after setting the mmap_min_addr in /proc/sys/vm to 0 (which was
previously 4096), I am getting this error.
Is there anything wrong that I am doing?
On Sat, Sep 21, 2013 at 7:17 PM, ratheesh kannoth <
ratheesh.ksz@gmail.com> wrote:
MAP_FIXED could be trying to get a map from 0.
Pls remove this flag and try.
On Sat, Sep 21, 2013 at 6:55 PM, Ravi Teja <ravi2j@gmail.com> wrote:
Hello all,
I tried mmap'ing to address zero after setting
/proc/sys/vm/mmap_min_addr to 0, but mmap is giving Permission Denied error.
My C code is as below -
#include <stdio.h> #include <stdlib.h> #include <sys/mman.h>
int main(void) { int *ptr = NULL; ptr =
mmap(0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0);
if(ptr == MAP_FAILED) { perror("Error in mapping\n"); exit(1); } printf("After mmap\n"); *ptr = 16; printf("Contents of address 0x%x is :: %d\n",ptr,*ptr); return 0; }
Am I doing anything wrong here?
Thank you in advance.
Regards, Ravi Teja
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Ravi Teja <ravi2j <at> gmail.com> writes:
Hello Ravi Teja, I've got the same problem as you. I've set mmap_min_addr as 0 and when I intentionally use MAP_FIXED to mmap to 0x00000000. I've got error "Permission Denied".
I want to ask you that which .config file have you modified and what modification have you make. I really hope you can help me. Thank you. Best Regards to you. Yaner
Hello all, I have successfully acessed(read and write) to 0x00000000(NULL) address. I
had to make certain changes in .config file and recompile it.
Thank you all.
Regards Ravi Teja
On Sat, Sep 21, 2013 at 8:00 PM, anish singh <anish198519851985 <at>
gmail.com> wrote:
On Sep 21, 2013 7:35 PM, "Ravi Teja" <ravi2j <at> gmail.com> wrote:
Hello Ratheesh,
I have intentionally used MAP_FIXED flag as I am interested in mapping
to 0x00000000.
AFAICS in linux generally mapping to null address is not allowed as this
decision helps in debugging null dereference errors.
Even after setting the mmap_min_addr in /proc/sys/vm to 0 (which was
previously 4096), I am getting this error.
Is there anything wrong that I am doing?
_______________________________________________ Kernelnewbies mailing list Kernelnewbies <at> kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Hi, Le samedi 21 septembre 2013 à 18:55 +0530, Ravi Teja a écrit :
I tried mmap'ing to address zero after setting /proc/sys/vm/mmap_min_addr to 0, but mmap is giving Permission Denied error.
Le vendredi 28 février 2014 à 07:39 +0000, Dongyan Yang a écrit :
I've got the same problem as you. I've set mmap_min_addr as 0 and when I intentionally use MAP_FIXED to mmap to 0x00000000. I've got error "Permission Denied".
Too many reason why you're denied from mapping a page at 0x0. - /proc/sys/vm/mmap_min_addr, but you already enable it sysctl -w vm.mmap_min_addr=0 - capabilities: your process need to have CAP_SYS_RAWIO running it at root is likely to give the aforementioned capability. - SELinux: you're running your process in a context that deny mapping page 0 check with: getselinux mmap_low_allowed temporary allow with: setselinux mmap_low_allowed=on But allowing mapping page 0 is widening exposure to null pointer dereferences exploit. You should think very carefully before allowing such. "Bypassing Linux' NULL pointer dereference exploit prevention (mmap_min_addr)", Friday, June 26, 2009, Julien Tinnes http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html "Fun with NULL pointers, part 1" , Jonathan Corbet, July 20, 2009 http://lwn.net/Articles/342330/ "Fun with NULL pointers, part 2" By Jonathan Corbet, July 21, 2009 http://lwn.net/Articles/342420/ "mmap_min_addr on SELinux and non-SELinux systems", Eric Paris, July 21st, 2009 http://eparis.livejournal.com/606.html "Confining the unconfined. Oxymoron?", Dan Walsh, July 21st, 2009 http://danwalsh.livejournal.com/30084.html "Bug 511143 - selinux policy allows addr 0 mappings by default", July 13, 2009 https://bugzilla.redhat.com/show_bug.cgi?id=511143 "Security-Enhanced Linux (SELinux) policy and the mmap_min_addr protection (CVE-2009-2695)" https://access.redhat.com/site/articles/17995 "How do I mitigate against NULL pointer dereference vulnerabilities?" https://access.redhat.com/site/articles/20484 "SELinux hardening for mmap_min_addr protections" Eric Paris August 26th, 2009 http://eparis.livejournal.com/891.html "Much ado about NULL: Exploiting a kernel NULL dereference" By Nelson Elhage on Apr 12, 2010 https://blogs.oracle.com/ksplice/entry/much_ado_about_null_exploiting1 Regards. -- Yann Droneaud OPTEYA
participants (5)
-
anish singh -
Dongyan Yang -
ratheesh kannoth -
Ravi Teja -
Yann Droneaud