2 * Copyright (c) 2016 The FreeBSD Foundation
5 * This software was developed by Konstantin Belousov <kib@FreeBSD.org>
6 * under sponsorship from the FreeBSD Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
33 #include <sys/procctl.h>
53 str2pid(const char *str)
58 res = strtol(str, &tail, 0);
60 warnx("non-numeric pid");
67 #define KPTI_USAGE "|kpti"
76 fprintf(stderr, "Usage: proccontrol -m (aslr|protmax|trace|trapcap"
78 "[-s (enable|disable)] [-p pid | command]\n");
83 main(int argc, char *argv[])
85 int arg, ch, error, mode;
87 bool enable, do_command, query;
93 while ((ch = getopt(argc, argv, "m:qs:p:")) != -1) {
96 if (strcmp(optarg, "aslr") == 0)
98 else if (strcmp(optarg, "protmax") == 0)
100 else if (strcmp(optarg, "trace") == 0)
102 else if (strcmp(optarg, "trapcap") == 0)
105 else if (strcmp(optarg, "kpti") == 0)
112 if (strcmp(optarg, "enable") == 0)
114 else if (strcmp(optarg, "disable") == 0)
120 pid = str2pid(optarg);
133 do_command = argc != 0;
135 if (pid != -1 || query)
138 } else if (pid == -1) {
145 error = procctl(P_PID, pid, PROC_ASLR_STATUS, &arg);
148 error = procctl(P_PID, pid, PROC_TRACE_STATUS, &arg);
151 error = procctl(P_PID, pid, PROC_TRAPCAP_STATUS, &arg);
154 error = procctl(P_PID, pid, PROC_PROTMAX_STATUS, &arg);
158 error = procctl(P_PID, pid, PROC_KPTI_STATUS, &arg);
166 err(1, "procctl status");
169 switch (arg & ~PROC_ASLR_ACTIVE) {
170 case PROC_ASLR_FORCE_ENABLE:
171 printf("force enabled");
173 case PROC_ASLR_FORCE_DISABLE:
174 printf("force disabled");
176 case PROC_ASLR_NOFORCE:
177 printf("not forced");
180 if ((arg & PROC_ASLR_ACTIVE) != 0)
181 printf(", active\n");
183 printf(", not active\n");
187 printf("disabled\n");
189 printf("enabled, no debugger\n");
191 printf("enabled, traced by %d\n", arg);
195 case PROC_TRAPCAP_CTL_ENABLE:
198 case PROC_TRAPCAP_CTL_DISABLE:
199 printf("disabled\n");
204 switch (arg & ~PROC_PROTMAX_ACTIVE) {
205 case PROC_PROTMAX_FORCE_ENABLE:
206 printf("force enabled");
208 case PROC_PROTMAX_FORCE_DISABLE:
209 printf("force disabled");
211 case PROC_PROTMAX_NOFORCE:
212 printf("not forced");
215 if ((arg & PROC_PROTMAX_ACTIVE) != 0)
216 printf(", active\n");
218 printf(", not active\n");
222 switch (arg & ~PROC_KPTI_STATUS_ACTIVE) {
223 case PROC_KPTI_CTL_ENABLE_ON_EXEC:
226 case PROC_KPTI_CTL_DISABLE_ON_EXEC:
230 if ((arg & PROC_KPTI_STATUS_ACTIVE) != 0)
231 printf(", active\n");
233 printf(", not active\n");
240 arg = enable ? PROC_ASLR_FORCE_ENABLE :
241 PROC_ASLR_FORCE_DISABLE;
242 error = procctl(P_PID, pid, PROC_ASLR_CTL, &arg);
245 arg = enable ? PROC_TRACE_CTL_ENABLE :
246 PROC_TRACE_CTL_DISABLE;
247 error = procctl(P_PID, pid, PROC_TRACE_CTL, &arg);
250 arg = enable ? PROC_TRAPCAP_CTL_ENABLE :
251 PROC_TRAPCAP_CTL_DISABLE;
252 error = procctl(P_PID, pid, PROC_TRAPCAP_CTL, &arg);
255 arg = enable ? PROC_PROTMAX_FORCE_ENABLE :
256 PROC_PROTMAX_FORCE_DISABLE;
257 error = procctl(P_PID, pid, PROC_PROTMAX_CTL, &arg);
261 arg = enable ? PROC_KPTI_CTL_ENABLE_ON_EXEC :
262 PROC_KPTI_CTL_DISABLE_ON_EXEC;
263 error = procctl(P_PID, pid, PROC_KPTI_CTL, &arg);
271 err(1, "procctl ctl");
273 error = execvp(argv[0], argv);