Can I write-protect every page in the address space of a Linux process?

烂漫一生 提交于 2019-12-03 20:17:55

问题


I'm wondering if there's a way to write-protect every page in a Linux process' address space (from inside of the process itself, by way of mprotect()). By "every page", I really mean every page of the process's address space that might be written to by an ordinary program running in user mode -- so, the program text, the constants, the globals, and the heap -- but I would be happy with just constants, globals, and heap. I don't want to write-protect the stack -- that seems like a bad idea.

One problem is that I don't know where to start write-protecting memory. Looking at /proc/pid/maps, which shows the sections of memory in use for a given pid, they always seem to start with the address 0x08048000, with the program text. (In Linux, as far as I can tell, the memory of a process is laid out with the program text at the bottom, then constants above that, then globals, then the heap, then an empty space of varying size depending on the size of the heap or stack, and then the stack growing down from the top of memory at virtual address 0xffffffff.) There's a way to tell where the top of the heap is (by calling sbrk(0), which simply returns a pointer to the current "break", i.e., the top of the heap), but not really a way to tell where the heap begins.

If I try to protect all pages from 0x08048000 up to the break, I eventually get an mprotect: Cannot allocate memory error. I don't know why mprotect would be allocating memory anyway -- and Google is not very helpful. Any ideas?

By the way, the reason I want to do this is because I want to create a list of all pages that are written to during a run of the program, and the way that I can think of to do this is to write-protect all pages, let any attempted writes cause a write fault, then implement a write fault handler that will add the page to the list and then remove the write protection. I think I know how to implement the handler, if only I could figure out which pages to protect and how to do it.

Thanks!


回答1:


You recieve ENOMEM from mprotect() if you try to call it on pages that aren't mapped.

Your best bet is to open /proc/self/maps, and read it a line at a time with fgets() to find all the mappings in your process. For each writeable mapping (indicated in the second field) that isn't the stack (indicated in the last field), call mprotect() with the right base address and length (calculated from the start and end addresses in the first field).

Note that you'll need to have your fault handler already set up at this point, because the act of reading the maps file itself will likely cause writes within your address space.




回答2:


Start simple. Write-protect a few page and make sure your signal handler works for these pages. Then worry about expanding the scope of the protection. For example, you probably do not need to write-protect the code-section: operating systems can implement write-or-execute protection semantics on memory that will prevent code sections from ever being written to:

  • http://en.wikipedia.org/wiki/Self-modifying_code#Operating_systems


来源:https://stackoverflow.com/questions/3444052/can-i-write-protect-every-page-in-the-address-space-of-a-linux-process

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!