On Linux (or Solaris) is there a better way than hand parsing /proc/self/maps
repeatedly to figure out whether or not you can read, write or execute whatever is stored at one or more addresses in memory?
For instance, in Windows you have VirtualQuery
.
In Linux, I can mprotect
to change those values, but I can't read them back.
Furthermore, is there any way to know when those permissions change (e.g. when someone uses mmap
on a file behind my back) other than doing something terribly invasive and using ptrace
on all threads in the process and intercepting any attempt to make a syscall
that could affect the memory map?
Update:
Unfortunately, I'm using this inside of a JIT that has very little information about the code it is executing to get an approximation of what is constant. Yes, I realize I could have a constant map of mutable data, like the vsyscall page used by Linux. I can safely fall back on an assumption that anything that isn't included in the initial parse is mutable and dangerous, but I'm not entirely happy with that option.
Right now what I do is I read /proc/self/maps
and build a structure I can binary search through for a given address's protection. Any time I need to know something about a page that isn't in my structure I reread /proc/self/maps assuming it has been added in the meantime or I'd be about to segfault anyways.
It just seems that parsing text to get at this information and not knowing when it changes is awfully crufty. (/dev/inotify
doesn't work on pretty much anything in /proc
)
I do not know an equivalent of VirtualQuery
on Linux. But some other ways to do it which may or may not work are:
you setup a signal handler trapping SIGBUS/SIGSEGV and go ahead with your read or write. If the memory is protected, your signal trapping code will be called. If not your signal trapping code is not called. Either way you win.
you could track each time you call
mprotect
and build a corresponding data structure which helps you in knowing if a region is read or write protected. This is good if you have access to all the code which usesmprotect
.you can monitor all the
mprotect
calls in your process by linking your code with a library redefining the functionmprotect
. You can then build the necessary data structure for knowing if a region is read or write protected and then call the systemmprotect
for really setting the protection.you may try to use
/dev/inotify
and monitor the file/proc/self/maps
for any change. I guess this one does not work, but should be worth the try.
There sorta is/was /proc/[pid|self]/pagemap, documentation in the kernel, caveats here: https://lkml.org/lkml/2015/7/14/477 So it isn't completely harmless...
来源:https://stackoverflow.com/questions/269314/is-there-a-better-way-than-parsing-proc-self-maps-to-figure-out-memory-protecti