C++ personality函数代码示例

struct cleanup *
maybe_disable_address_space_randomization (int disable_randomization)
{
  int personality_orig = 0;
  int personality_set = 0;

#ifdef HAVE_PERSONALITY
  if (disable_randomization)
    {
      errno = 0;
      personality_orig = personality (0xffffffff);
      if (errno == 0 && !(personality_orig & ADDR_NO_RANDOMIZE))
	{
	  personality_set = 1;
	  personality (personality_orig | ADDR_NO_RANDOMIZE);
	}
      if (errno != 0 || (personality_set
			 && !(personality (0xffffffff) & ADDR_NO_RANDOMIZE)))
	warning (_("Error disabling address space randomization: %s"),
		 safe_strerror (errno));
    }
#endif /* HAVE_PERSONALITY */

  return make_disable_asr_cleanup (personality_set,
				   personality_orig);
}

/**
 * This function configures the process for recording/replay. In particular:
 * (1) address space randomization is disabled
 * (2) rdtsc is disabled
 */
static void set_up_process()
{
	/* disable address space randomization */
	int orig_pers;

	if (0 > (orig_pers = personality(0xffffffff))) {
		fatal("error getting personaity");
	}
	if (0 > personality(orig_pers | ADDR_NO_RANDOMIZE)) {
		fatal("error disabling randomization");
	}
	if (0 > prctl(PR_SET_TSC, PR_TSC_SIGSEGV, 0, 0, 0)) {
		fatal("error setting up prctl -- bailing out");
	}
	/* If rr goes down, there's nothing more useful we can do.
	 * Time for seppuku.
	 *
	 * XXX the tracee can reset or change this ...*/
	if (0 > prctl(PR_SET_PDEATHSIG, SIGKILL)) {
		fatal("Couldn't set parent-death signal");
	}

	/* XXX is it faster to mask off a CPU affinity when this
	 * process is the only intensive one in the system? */
}

static void __initialize_personality() {
#if !defined(__LP64__)
  int old_value = personality(0xffffffff);
  if (old_value == -1) {
    __libc_fatal("error getting old personality value: %s", strerror(errno));
  }

  if (personality((static_cast<unsigned int>(old_value) & ~PER_MASK) | PER_LINUX32) == -1) {
    __libc_fatal("error setting PER_LINUX32 personality: %s", strerror(errno));
  }
#endif
}

static int set_personality(unsigned long mask)
{
	unsigned long per;

	per = personality(0xffffffff) | mask;
	logger(3, 0, "Set personality %#10.8lx", per);
	if (personality(per) == -1) {
		logger(-1, errno, "Unable to set personality PER_LINUX32");
		return  -1;
	}
	return 0;
}

static int set_personality(unsigned long mask)
{
	unsigned long per;

	per = personality(0xffffffff) | mask;
	printf("Set personality %#10.8lx", per);
	if (personality(per) == -1) {
		perror("Unable to set personality PER_LINUX32");
		return  -1;
	}
	return 0;
}

SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
{
	int ret;

	if (personality(current->personality) == PER_LINUX32 &&
	    personality(personality) == PER_LINUX)
		personality |= PER_LINUX32;
	ret = sys_personality(personality);
	if (personality(ret) == PER_LINUX32)
		ret &= ~PER_LINUX32;

	return ret;
}

int main(int ac, char **av)
{
	int lc;				/* loop counter */
	char *msg;			/* message returned from parse_opts */
        int start_pers;

	/* parse standard options */
	if ((msg = parse_opts(ac, av, (option_t *)NULL, NULL)) != (char *)NULL){
		tst_brkm(TBROK, cleanup, "OPTION PARSING ERROR - %s", msg);
	}

	setup();			/* global setup */

        start_pers = personality(PER_LINUX);
        if (start_pers == -1) {
           printf("personality01:  Test Failed\n");
           exit(-1);
        }

	/* The following checks the looping state if -i option given */

	for (lc = 0; TEST_LOOPING(lc); lc++) {
		/* reset Tst_count in case we are looping */
		Tst_count = 0;

		TEST(personality(PER_BAD));

		if (TEST_RETURN != 0) {
			tst_brkm(TFAIL, cleanup, "call failed - errno = %d "
				 "- %s", TEST_ERRNO, strerror(TEST_ERRNO));
		} else {
			tst_resm(TPASS, "call to personality() with a "
					"bad personality passed");
		}

		TEST_ERROR_LOG(TEST_ERRNO);

		/*
		 * set our personality back to PER_LINUX
		 */
		if (personality(start_pers) == -1) {
			tst_brkm(TBROK, cleanup, "personality reset failed");
		}
	}

	cleanup();

	/*NOTREACHED*/
	return(0);
}

// ---------------------------------------------------------------------------
void disable_aslr() {
  if(personality(ADDR_NO_RANDOMIZE) == -1) {
    log("{red}Could not turn off ASLR: %s{/red}", strerror(errno));
  } else {
    log("ASLR turned off successfully");
  }
}

// TODO: move into r_util? r_run_... ? with the rest of funcs?
static void setASLR(int enabled) {
#if __linux__
#define RVAS "/proc/sys/kernel/randomize_va_space"
	if (enabled) {
		system ("echo 2 > "RVAS);
	} else {
#if __ANDROID__
		system ("echo 0 > "RVAS);
#else
#ifdef ADDR_NO_RANDOMIZE
		if (personality (ADDR_NO_RANDOMIZE) == -1)
#endif
			system ("echo 0 > "RVAS);
#endif
	}
#elif __APPLE__
	// TOO OLD setenv ("DYLD_NO_PIE", "1", 1);
	// disable this because its
	//eprintf ("Patch mach0.hdr.flags with:\n"
	//	"f MH_PIE=0x00200000; wB-MH_PIE @ 24\n");
	// for osxver>=10.7
	// "unset the MH_PIE bit in an already linked executable" with --no-pie flag of the script
	// the right way is to disable the aslr bit in the spawn call
#else
	// not supported for this platform
#endif
}

static struct exec_domain *
lookup_exec_domain(u_long personality)
{
   struct exec_domain * ep;
   u_long         pers = personality(personality);

   read_lock(&exec_domains_lock);
   for (ep = exec_domains; ep; ep = ep->next) {
      if (pers >= ep->pers_low && pers <= ep->pers_high)
         if (try_module_get(ep->module))
            goto out;
   }

#ifdef CONFIG_KMOD
   read_unlock(&exec_domains_lock);
   request_module("personality-%ld", pers);
   read_lock(&exec_domains_lock);

   for (ep = exec_domains; ep; ep = ep->next) {
      if (pers >= ep->pers_low && pers <= ep->pers_high)
         if (try_module_get(ep->module))
            goto out;
   }
#endif

   ep = &default_exec_domain;
out:
   read_unlock(&exec_domains_lock);
   return (ep);
}

int setarch_main(int argc ATTRIBUTE_UNUSED, char **argv)
{
	int pers = -1;

	/* Figure out what personality we are supposed to switch to ...
	 * we can be invoked as either:
	 * argv[0],argv[1] -> "setarch","personality"
	 * argv[0]         -> "personality"
	 */
retry:
	if (argv[0][5] == '6') /* linux64 */
		pers = PER_LINUX;
	else if (argv[0][5] == '3') /* linux32 */
		pers = PER_LINUX32;
	else if (pers == -1 && argv[1] != NULL) {
		pers = PER_LINUX32;
		++argv;
		goto retry;
	}

	/* make user actually gave us something to do */
	++argv;
	if (argv[0] == NULL)
		bb_show_usage();

	/* Try to set personality */
	if (personality(pers) >= 0) {

		/* Try to execute the program */
		BB_EXECVP(argv[0], argv);
	}

	bb_simple_perror_msg_and_die(argv[0]);
}

SYSCALL_DEFINE1(arm64_personality, unsigned int, personality)
{
	if (personality(personality) == PER_LINUX32 &&
		!system_supports_32bit_el0())
		return -EINVAL;
	return ksys_personality(personality);
}

int main(void)
{
	int ret;
	struct stat fstat;

	ret = personality(PER_SVR4);

	if (ret == -1) {
		fprintf(stderr, "Unable to set personality!\n");
		return 3;
	}

	fprintf(stdout, " [+] Personality set to: PER_SVR4\n");

	if (stat(PULSEAUDIO_PATH, &fstat)) {
		fprintf(stderr, "Pulseaudio does not exist!\n");
		return 3;
	}

	if (!(fstat.st_mode & S_ISUID) || fstat.st_uid != 0) {
		fprintf(stderr, "Pulseaudio is not suid root!\n");
		return 3;
	}
	
	execl(PULSEAUDIO_PATH, PULSEAUDIO_PATH, "--log-level=0", "-L", PATH_TO_EXPLOIT, NULL);

	return 3;
}

int do_test_misc(const char *test_parm)
{
    (void) test_parm;

    char buf[BSIZE];
    int rc;

    test_check_eq(getpagesize(),4096);

    test_check_eq(personality(0xffffffff), 0);

    {
    struct utsname phantom_uname;
    test_check_eq(uname(&phantom_uname), 0);

    printf("uland: uname sys '%s'\n\tnode    %s\n\trel    %s\n\tver     %s\n\tmachine %s\n\tdomain  %s\n",
           phantom_uname.sysname,
           phantom_uname.nodename,
           phantom_uname.release,
           phantom_uname.version,
           phantom_uname.machine,
           phantom_uname.domainname
          );
    }

    rc = gethostname(buf, BSIZE);
    test_check_ge(rc,0);
    printf("uland: hostname %s\n", buf );


    return 0;
}

int main(int ac, char **av)
{
        int leaked;

        leaked = dump_uts();
        if (leaked) {
                printf("Leaked %d bytes even without UNAME26!?\n", leaked);
                return 1;
        }


        if (personality(PER_LINUX | UNAME26) < 0) {
                perror("personality");
                exit(1);
        }

        leaked = dump_uts();
        if (leaked) {
                printf("Leaked %d bytes!\n", leaked);
                return 1;
        } else {
                printf("Seems safe.\n");
                return 0;
        }
}