cc-memtest for testing memory security for OpenBSD

Question

http://blog.acumensecurity.net/revisiting-wx-with-openbsd-6-0/

http://blog.acumensecurity.net/fpt_wx_ext-1-a-rundown/

Has anybody got the cc-memtest binary or source code or cc-memtest?

A program that can test the following:

The assurance activities direct the evaluator to:

Acquire or construct a test program which attempts to allocate memory that is both writable and executable. The evaluator will run the program and confirm that it fails to allocate memory that is both writable and executable.
Acquire or construct a test program which allocates memory that is executable and then subsequently requests additional write/modify permissions on that memory. The evaluator will run the program and confirm that at no time during the lifetime of the process is the memory both writable and executable.
Acquire or construct a test program which allocates memory that is writable and then subsequently requests additional execute permissions on that memory. The evaluator will run the program and confirm that at no time during the lifetime of the process is the memory both writable and executable.

Answer 1

From the blog you cite:

..Attempting to run my test application, cc-memtest, ...

Which means its the authors own test application so please contact the author of the blog article.

Apart from that it should not be too hard to construct a program which does these tests as long as you understand mmap(2) and mprotect(2). You will even find some code if you look closer at the pictures in the article. But help in this area (i.e. programming) is off-topic here and I recommend you just read the man pages.

Answer 2

Such a program is likely not released because it is so trivial, calling only a few functions and checking if they succeed or fail. I wrote up a quick C program which should do this, based on the assurance activities you listed. I wrote this on Linux, but it'll likely work just as well on OpenBSD.

The mmap syscall creates a mapping with the specified permissions, and returns the address of the first page on success and MAP_FAILED on failure. The mprotect syscall modifies the permissions of an existing mapping, returning 0 on success and -1 on failure.

#include <err.h>
#include <errno.h>
#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>

int main(void)
{
    void *map;

    /* create: wx */
    if ((map = mmap(NULL, 4096, PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)) == MAP_FAILED)
        perror("unable to create page as wx");

    /* modify: x -> wx */
    if ((map = mmap(NULL, 4096, PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)) == MAP_FAILED)
        err(1, "unable to map x page... this should never happen");

    if (mprotect(map, 4096, PROT_WRITE|PROT_EXEC) < 0)
        perror("unable to change page from x to wx");

    /* modify: w -> wx */
    if ((map = mmap(NULL, 4096, PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)) == MAP_FAILED)
        err(1, "unable to map w page... this should never happen");

    if (mprotect(map, 4096, PROT_WRITE|PROT_EXEC) < 0)
        perror("unable to change page from w to wx");

    return 0;
}

These are the results I get on a Linux system with the PaX patches (PAX_MPROTECT, which provides similar, but more strict, security properties to OpenBSD's W^X).

$ gcc cc-memtest2.c
$ ./a.out
unable to create page as wx: Operation not permitted
unable to change page from x to wx: Permission denied
unable to change page from w to wx: Permission denied