Posts on Terminal

Knightctf 2023 writeup RE Category

Sat, 28 Jan 2023 13:52:32 +0000

Hi there,

Last weekend, I played a CTF for fun. Here are the writeups of the tasks that I solved (Reverse Engineering category)

[RE 100] Help Jimmy

It was a 64-bit Linux elf binary having a simple implementation where the player has to choose between going to Jungle or Sea and regardless of any decision, it ended up being attacked by tigers or pirates or an invalid choice and resulting in not getting the flag.

This challenge wants to examine the assembly code instead of blindly following the decompiled code from Ghidra or any decompiler, so there is a missing CALL instrn after the assignments and that function call is responsible for the flag.

Load the binary into radare2 and decompile it with the r2ghidra plugin which is more beneficial here as compared to traditional gdb to decompile and debug it.

radare2 disassembly:

radare2 - r2ghidra decompilation

Pseudo code:

var_10h._0_4_ = 5;
var_10h._4_4_ = 5;
if (var_10h._0_4_ != var_10h._4_4_) {
    call_function();
}

The solution for this challenge would be just modifying any variable’s value to get into the check and call the function or directly skipping the check and setting rip to call_function would also work.

[0x55bfcefac629]> dr eax
0x00000005
[0x55bfcefac629]> dr eax=4
0x00000005 ->0x00000004
[0x55bfcefac629]> dc

Well Done!
You have found an alternate way for Jimmy!

Flag:
KCTF{y0u_may_ch00s3_to_look_7h3_other_way_but_y0u_can_n3v3r_say_4gain_that_y0u_did_n0t_know}

[RE 150] The Activator

This challenge is somewhat similar to first challenge, that is, Help Jimmy. I have followed the same approach as internally it has similar pattern.

There are lots of tools available to choose from and solve them, best way to learn is by doing manually then we can switch to tools. I have used radare2 and ghidra most of the time. In gdb/pwngdb/gef, we have to set the piebase and then look up the address from ghidra or ida then add them to piebase to get the address of the respective function. For example, to get the address of main(), load ghidra, set the base address to something like 0x555555554000 then go to the main() and note the address then set the same base with gdb then address mapping would be similar then put breakpoint and play with it.

In radare2, we don’t have to go through these processes manually, directly load the binary and analyze it then switch to main() and then pdf to get the disassembly. So, the following is the disassembly and decompilation of the code from the r2ghidra plugin.

radare2 disassembly:- call function which prints the flag after comparision

So, the approach would be nop out the check or after the input modify the rip value to the call instrn which will directly invoke the function and prints the flag.

[0x557615132860]> db 0x557615132bc5
[0x557615132860]> dc

           -KOS-

KnightOS License Checker.
Enter KnightOS Activation Key: 1234
INFO: hit breakpoint at: 0x557615132bc5
[0x557615132bc5]> dr rip=0x557615132bce
0x557615132bc5 ->0x557615132bce
[0x557615132bc5]> dc

KCTF{Th47_License_ch3cker_w4S_similar_t0_Wind0ws_95_OSR_Activator_Right?}
(3627) Process exited with status=0x0
[0x7f70ba718ca1]>

[RE 150] The Defuser

This challenge is about the bomb that has to be defused within some time frame. While executing this challenge it has signals which kill the process after some timeframe.

Following is the execution flow:

bsdb0y@test:~/challs/knight/reverse$ ./defuser

Time is ticking...

Defuse the bomb real quick if you want to save your Imaginarica!
I bet you won't be able to save it...
Hahahahaha...

Convince me to stop the explosion:




Hahahahaha LOSER!
The bomb has exploded.
You shouldn't have waste your time.
Remember, every second is valueable.



Terminated

So, after examining the disassembly and decompilation code, we can see that there are some things given below:

signals call
alarm call
setting parameter to 0x17b447b
env variables
- LAB_HOSTNAME=DEFUSER_PC
- LAB_USERNAME=FRITZ

Load the binary in radare2/gdb, set the environment variables to the value mentioned above and skip the signal/alarm calls then take the input from the user and step into the function at 0x2760. It expects the 1st argument to be 0x17b447b, then continues and it prints the flag.

[0x5610de303596]> dc



You have saved the country from a destruction.

Here is your reward:
KCTF{st0p_war_spr34d_10v3_and_p34c3}

(3995) Process exited with status=0x0

[RE 200] KrackMe 1.0

In this challenge, the flag was split into some strings then XORed with constant bytes then compared with static hardcoded strings. It had some checks on the command line argument, so provide 4 arguments to successfully get into the flag input state. So, for this, I had some approaches like:

either extract all the strings and then write a python code to do the same operation as manually examined from the assembly.
use angr to automate the flag-finding process and this binary was a perfect fit for the same.

I have decided to use angr and the following is the script:

#!/usr/bin/python3
 
import angr
import pdb
import sys
import claripy
 
FLAG_LEN = 40

def solve(elf_binary):
    project = angr.Project(elf_binary, load_options={'auto_load_libs': False}) #load up binary
    arg_chrs = [claripy.BVS('arg_%d' % i ,8) for i in range(FLAG_LEN)] #set a bit vector for argv[1]
    arg = claripy.Concat(*arg_chrs) 
    initial_state = project.factory.entry_state(args=[elf_binary, "q", "q", "q", "q"], stdin=arg) #set entry state for execution

    # To debug - insert the breakpoints at runtime
    '''
    def stoca(state):
        print("GOT HERE")
        import pdb; pdb.set_trace()
 
    initial_state.inspect.b('instruction', instruction=0x401613, when=angr.BP_AFTER, action=stoca)
    initial_state.inspect.b('instruction', instruction=0x401667, when=angr.BP_AFTER, action=stoca)
    initial_state.inspect.b('instruction', instruction=0x401311, when=angr.BP_AFTER, action=stoca)
    #initial_state.inspect.b('instruction', instruction=0x4018d9, when=angr.BP_AFTER, action=stoca)
    '''

    for byte in arg.chop(8):
        initial_state.solver.add(byte < 0x7f)
        initial_state.solver.add(byte >= 0x20)
 
    simulation = project.factory.simgr(initial_state) #get a simulation manager object under entry state
    simulation.explore(find=is_successful)
    
    if len(simulation.found) > 0: #if we find that our 'found' array is not empty then we have a solution!
        for solution_state in simulation.found: #loop over each solution just for interest sake
            print("[>>] {!r}".format(solution_state.solver.eval(arg,cast_to=bytes))) #print the goodness!
 

def is_successful(state):
    output = state.posix.dumps(sys.stdout.fileno()) #grab the screen output everytime Angr thinks we have a solution
    if b'Congratulations !!' in output: #make sure it says 'Congratulations'!
        return True
    return False
 

if __name__=="__main__":
    if len(sys.argv) < 2:
        print("[*] need 1 arguments\nUsage: %s [binary path]")
        sys.exit()
 
    solve(sys.argv[1]) #solve!

After executing the above angr script, here’s the output:

bsdb0y@test:~/challs/knight/reverse$ ./reverse.py krackme_1.out
WARNING  | 2023-01-30 14:35:45,601 | cle.loader     | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000.
WARNING  | 2023-01-30 14:35:45,643 | angr.simos.simos | stdin is constrained to 40 bytes (has_end=True). If you are only providing the first 40 bytes instead of the entire stdin, please use stdin=SimFileStream(name='stdin', content=your_first_n_bytes, has_end=False).
WARNING  | 2023-01-30 14:36:03,538 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing memory with an unspecified value. This could indicate unwanted behavior.
WARNING  | 2023-01-30 14:36:03,542 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING  | 2023-01-30 14:36:03,543 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING  | 2023-01-30 14:36:03,545 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING  | 2023-01-30 14:36:03,547 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING  | 2023-01-30 14:36:03,550 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xffffffffffffffc0 with 64 unconstrained bytes referenced from 0x500038 (printf+0x0 in extern-address space (0x38))
WARNING  | 2023-01-30 14:36:03,555 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x0 with 65 unconstrained bytes referenced from 0x500038 (printf+0x0 in extern-address space (0x38))
WARNING  | 2023-01-30 14:36:26,106 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7fffffffffefec9 with 23 unconstrained bytes referenced from 0x500028 (strlen+0x0 in extern-address space (0x28))
WARNING  | 2023-01-30 14:36:26,111 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7fffffffffeff1b with 6 unconstrained bytes referenced from 0x500028 (strlen+0x0 in extern-address space (0x28))
WARNING  | 2023-01-30 14:36:28,008 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7fffffffffefe19 with 7 unconstrained bytes referenced from 0x500028 (strlen+0x0 in extern-address space (0x28))
WARNING  | 2023-01-30 14:36:28,012 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7fffffffffefe3b with 5 unconstrained bytes referenced from 0x500028 (strlen+0x0 in extern-address space (0x28))
[>>] b'KCTF{kRaCk_M3_oNe_0_fLaG_c0xs_bAzar}'

[RE 250] Fan

I liked this challenge, we are provided with python’s dis() output bytecode in the text file. For this challenge, I decided to manually re-implement the code from bytecode to python.

Following the re-implementation of python bytecode:

def define_false(s):
    lstr = []
    u = 0
    packed = ''
    for c in s:
        if c == "[":
            lstr.append((u, packed))
            packed = ''
            u = 0
            continue
        if c == "]":
            num, prev_string = lstr.pop()
            packed = prev_string + packed * num
            continue
        if c.isdigit():
            u = u * 10 + int(c)
            continue

        packed += c
    return packed


def define_true(p):
    res = ''
    for packed in p:
        res += str(len(packed)) + '[:]' + packed
    return res


def define_both(p):
    unpacked = []
    for i in p:
        packed = i.split(')')
        char = ''
        for j in packed:
            if j == '':
                break
            j += ')'
            char += eval(j)

        unpacked.append(char)
    return unpacked


if __name__ == '__main__':
  s = [
    'chr(75)chr(67)chr(84)chr(70)chr(123)',
    'chr(115)chr(105)chr(85)chr(85)chr(85)',
    'chr(109)chr(69)chr(51)chr(115)chr(115)chr(105)',
    'chr(105)chr(115)',
    'chr(103)chr(48)chr(79)chr(97)chr(116)chr(125)'
  ]

  print(define_false(define_true(define_both(s))))

bsdb0y@test:~/challs/knight/reverse$ python3 bytecode_reverse.py
:::::KCTF{:::::siUUU::::::mEssi::::::::::::::::::::::::::::::::is::::::gOat}

[RE 250] Take RISC five times

This challenge has provided an assembly file for riscv, the assembly function fun_risc_v calling reverse_str function multiple times. So, modified the asm file a little like replace; with # and put .globl in front of the fun_risc_v label then called this function from c code.

C code:

extern void fun_risc_v();
 
void reverse_str(char *str, int len) {
        char *temp;
        int index;
        for (index = 0; index < len; index--) {
                temp[index] = str[index];
                str[index] = str[len - index - 1];
                str[len- index - 1] = temp[index];
        }
}
 
int main(void) {
  fun_risc_v();
  return 0;
}

Compilation and linking with the RISC-V toolchain:

riscv64-linux-gnu-gcc-12 main.c take-risc-five-times.S /usr/riscv64-linux-gnu/lib/ld-linux-riscv64-lp64d.so.1 -o main

After the compilation, I am not able to execute it. I have tried qemu-system-riscv64 with --machine targets but nothing works. So, instead of executing I have used ghidra to decompile it and check. So, from the code, I got the flag:

  local_20 = 0x22563d53;
  local_1c = 0x46;
  local_1b = 0x54;
  local_1a = 0x43;
  local_19 = 0x4b;
  reverse_str(&local_1c,4);
  local_18 = 0x7b;
  local_17 = 0;
  local_30 = 0x3c222325;
  local_2c = 0x33;
  local_2b = 0x6b;
  local_2a = 0x34;
  local_29 = 0x74;
  reverse_str(&local_2c,4);
  local_28 = 0x5f;
  local_27 = 0;
  local_40 = 0x1b581a0a;
  local_3c = 99;
  local_3b = 0x73;
  local_3a = 0x31;
  local_39 = 0x72;
  reverse_str(&local_3c,4);
  local_38 = 0x5f;
  local_37 = 0;
  local_50 = 0x3775;
  local_4c = 0x72;
  local_4b = 0x30;
  reverse_str(&local_4c,2);
  local_4a = 0x5f;
  local_49 = 0;
  local_5c = 0x68;
  local_5b = 0x35;
  local_5a = 0x69;
  local_59 = 0x72;
  local_58 = 0x33;
  local_57 = 0x70;
  reverse_str(&local_5c,6);
  trap();
  trap();
                    /* WARNING: Bad instruction - Truncating control flow here */
  halt_baddata();
}

Flag: KCTF{t4k3_r1sc_0r_p3ri5h}

[RE 400] Stegorev

For this challenge, an image is provided so I have used the stegseek tool with rockyou.txt file to crack the password and extract the hidden ELF file.

bsdb0y@ubuarm64:~/Downloads$ stegseek kctf-rng70.jpg rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "this.parentNode.offsetWidth) {this.width=this.parentNode.offsetWidth-10; this.style.cursor='hand';this.onload=null;}">"

[i] Original filename: "stegorev-rng70".
[i] Extracting to "kctf-rng70.jpg.out".

while analyzing the extracted ELF file from stegseek, we can see that it checks whether the file named ckrIupRS782prsdsf is present in the pwd.

[0x5620da9a980f]> pdg

// WARNING: Variable defined which should be unmapped: var_8h

ulong main(void)

{
    char cVar1;
    ulong uVar2;
    ulong var_a0h;
    ulong var_80h;
    ulong var_51h;
    ulong var_30h;
    ulong var_8h;

    sym.imp.std::allocator_char_::allocator__(&var_51h);
    sym.imp.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
              (&var_80h, "ckrIupRS782prsdsf", &var_51h);
    fcn.5620da9a9486(&var_a0h, &var_80h);
    fcn.5620da9a90a0(&var_80h);
    fcn.5620da9a9140(&var_51h);
    cVar1 = fcn.5620da9a9c13(&var_a0h, "The file maybe lost in the matrix. Try hard to find it");
    if (cVar1 != '\0') {
    // WARNING: Subroutine does not return
        sym.imp.exit(0);
    }
    ...
    ...
}

decompilation of function fcn.5620da9a9486(&var_a0h, &var_80h);:

[0x5620da9a980f]> pdg @fcn.5620da9a9486

// WARNING: Variable defined which should be unmapped: var_8h

ulong fcn.5620da9a9486(ulong arg1, ulong arg2)

{
    char cVar1;
    ulong uVar2;
    ulong var_250h;
    ulong var_248h;
    ulong var_240h;
    ulong var_220h;
    ulong var_11h;
    ulong var_8h;

    sym.imp.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream__(&var_220h);    // => Here, var_220 belongs to file 
                                                                                                // => "ckrIupRS782prsdsf"
    sym.imp.std::basic_ifstream_char__std::char_traits_char___::open_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::_Ios_Openmode_
              (&var_220h, arg2, 8);
    cVar1 = sym.imp.std::basic_ifstream_char__std::char_traits_char___::is_open__(&var_220h);
    if (cVar1 == '\0') {

Later realized it is easily found by executing strace

bsdb0y@test:~/challs/knight/reverse$ ./kctf-rng70.jpg.out
Flag:
 ?==? JBVE~k_lRciOX*=(HG=,0KKEl
What do you want me to return? :)

enter the JBVE~k_lRciOX*=(HG=,0KKEl string into the file ckrIupRS782prsdsf then it directly dumps the flag:

bsdb0y@test:~/challs/knight/reverse$ echo "JBVE~k_lRciOX*=(HG=,0KKEl" > ckrIupRS782prsdsf
bsdb0y@test:~/challs/knight/reverse$ ./kctf-rng70.jpg.out
Flag: JBVE~k_lRciOX*=(HG=,0KKEl
KCTF{cRypT0_1S_su_hArd:e} ?==? JBVE~k_lRciOX*=(HG=,0KKEl
What do you want me to return? :)
bsdb0y@test:~/challs/knight/reverse$

Tale of OpenBSD secure memory allocator internals - malloc(3)

Sat, 28 Mar 2020 18:24:56 +0000

Hi there,

It’s been a long time since I have written anything, so, continuing with the journey of reading and exloring the OpenBSD source codes with my friend debugger. This time it is about OpenBSD malloc(3), secure memory allocator

I will try to keep it as n part series due to length of the blog post and this series will be mostly focussed on user-space code of malloc(3) and friends

First of all, I would like to thanks Otto Moerbeek, Bryan Steele and Fabien Romano for helping me to understand the malloc(3) internals and resolving my queries/doubts.

Lets start…

Consider the following code-snippet to start our memory allocator journey on OpenBSD 6.6-stable malloc(3)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(int argc, char **argv) {
    char *buff1 = NULL;
    buff1 = (char *)malloc(8);
    strcpy(buff1, argv[1]);
    free(buff1);
    return 0;
}

Compile libc with debug symbols and turn off the optimization by compiling it with option “-O0 -g”.

cd $openbsd_src_directory
cd lib/libc
CFLAGS="-g -O0" CXXFLAGS="-g -O0" make obj
CFLAGS="-g -O0" CXXFLAGS="-g -O0" make

Used debugger for understanding the code internals instead of printf style debugging.

For printf style debugging, one can use dprintf(3) or write(2) calls to print anything but keep in mind that after installation of libc with printf it will print a lot of information for every executable, so, it is not a good idea to install it.

Suggestion: one can either compile libc with or without printf statements and use LD_PRELOAD to load it and use debugger. With printf debugging one use the same LD_PRELOAD for the code snippet.

From the code snippet jumped to malloc(3) defination from libc present in the file /usr/src/lib/libc/stdlib/malloc.c:1278

1277 void *
1278 malloc(size_t size)
1279 {
1280         void *r;
1281         struct dir_info *d;
1282         int saved_errno = errno;
1283
1284         PROLOGUE(getpool(), "malloc")
1285         r = omalloc(d, size, 0, CALLER);
1286         EPILOGUE()
1287         return r;
1288 }

As explained by the developer Otto@ in the tweet on twitter that struct dir_info contains all the meta information malloc needs to keep track of what page regions have been allocated, which pages regions are in the free-cache and for pages of chunks which chunks are free and which are allocated. (UPDATE: tweet is no more available)

So, we can see that after some basic initialization, there are some macros, PROLOGUE and EPILOGUE

prologue: english meaning of prologue refers to introductory or an opening to a story which sets the context and in computer terms, it referes the same meaning which means it set-up the necessary things to start execution.

epilogue: in english, it means conclusion or ending part and in computer terms, it refers clearing up things which set-up by prologue.

defination of PROLGOUE macro:

1256 #define PROLOGUE(p, fn)                 \
1257         d = (p);                        \
1258         if (d == NULL) {                \
1259                 _malloc_init(0);        \
1260                 d = (p);                \
1261         }                               \
1262         _MALLOC_LOCK(d->mutex);         \
1263         d->func = fn;                   \
1264         if (d->active++) {              \
1265                 malloc_recurse(d);      \
1266                 return NULL;            \
1267
            }                               \

From the above malloc(3) defination, we can see that the first argument of PROLOGUE is function getpool() and second is the function string, that is, “malloc” and from the PROLOGUE macro expansion, we can see that it first calls getpool() and the defination of getpool() as mentioned

270 static inline struct dir_info *
271 getpool(void)
272 {
273         if (!mopts.malloc_mt)
274                 return mopts.malloc_pool[1];
275         else    /* first one reserved for special pool */
276                 return mopts.malloc_pool[1 + TIB_GET()->tib_tid %
277                     (mopts.malloc_mutexes - 1)];
278 }

from the above code defination, it first checks whether it has multi-threads or single-threads. And, in our case it is single threaded executable, so after if it returns mopts.malloc_pool[1] which is NULL.

then as per the PROLOGUE defination, it checks whether d is NULL or not. In our case it is NULL as at first it will always be NULL and after that it calls _malloc_init(0) but when d is not NULL then it assigns fn to d->func and after that increment the d->active within if cond then calls malloc_recurse(d) and returns NULL but for our situation it is not the flow.

Defination of _malloc_init(0)

1207 void
1208 _malloc_init(int from_rthreads)
1209 {
1210         u_int i, nmutexes;
1211         struct dir_info *d;
1212 
1213         _MALLOC_LOCK(1);
1214         if (!from_rthreads && mopts.malloc_pool[1]) {
1215                 _MALLOC_UNLOCK(1);
1216                 return;
1217         }
1218         if (!mopts.malloc_canary)
1219                 omalloc_init();
1220 
1221         nmutexes = from_rthreads ? mopts.malloc_mutexes : 2;
1222         if (((uintptr_t)&malloc_readonly & MALLOC_PAGEMASK) == 0)
1223                 mprotect(&malloc_readonly, sizeof(malloc_readonly),
1224                     PROT_READ | PROT_WRITE);
1225         for (i = 0; i < nmutexes; i++) {
1226                 if (mopts.malloc_pool[i])
1227                         continue;
1228                 if (i == 0) {
1229                         omalloc_poolinit(&d, MAP_CONCEAL);
1230                         d->malloc_junk = 2;
1231                         d->malloc_cache = 0;
1232                 } else {
1233                         omalloc_poolinit(&d, 0);
1234                         d->malloc_junk = mopts.def_malloc_junk;
1235                         d->malloc_cache = mopts.def_malloc_cache;
1236                 }
1237                 d->mutex = i;
1238                 mopts.malloc_pool[i] = d;
1239         }
1240 
1241         if (from_rthreads)
1242                 mopts.malloc_mt = 1;
1243         else
1244                 mopts.internal_funcs = 1;
1245 
1246         /*
1247          * Options have been set and will never be reset.
1248          * Prevent further tampering with them.
1249          */
1250         if (((uintptr_t)&malloc_readonly & MALLOC_PAGEMASK) == 0)
1251                 mprotect(&malloc_readonly, sizeof(malloc_readonly), PROT_READ);
1252         _MALLOC_UNLOCK(1);
1253 }

from the above code-snippet, we can see that first it does some MALLOC_LOCKing and checks for from_rthreads and mopts.malloc_pool[1] as a result it is not true due to mopts.malloc_pool[1] which is NULL. Then, after that it checks for mopts.malloc_canary and for the first time it will be 0 due to the structure initialized to zero (0) and then it calls function omalloc_init() and the defination as given below:

405	static void
406	omalloc_init(void)
407	{
408		char *p, *q, b[16];
409		int i, j, mib[2];
410		size_t sb;
411
412		/*
413		 * Default options
414		 */
415		mopts.malloc_mutexes = 8;
416		mopts.def_malloc_junk = 1;
417		mopts.def_malloc_cache = MALLOC_DEFAULT_CACHE;
418
419		for (i = 0; i < 3; i++) {
420			switch (i) {
421			case 0:
422				mib[0] = CTL_VM;
423				mib[1] = VM_MALLOC_CONF;
424				sb = sizeof(b);
425				j = sysctl(mib, 2, b, &sb, NULL, 0);
426				if (j != 0)
427					continue;
428				p = b;
429				break;
430			case 1:
431				if (issetugid() == 0)
432					p = getenv("MALLOC_OPTIONS");
433				else
434					continue;
435				break;
436			case 2:
437				p = malloc_options;
438				break;
439			default:
440				p = NULL;
441			}
442
443			for (; p != NULL && *p != '\0'; p++) {
444				switch (*p) {
445				case 'S':
446					for (q = "CFGJ"; *q != '\0'; q++)
447						omalloc_parseopt(*q);
448					mopts.def_malloc_cache = 0;
449					break;
450				case 's':
451					for (q = "cfgj"; *q != '\0'; q++)
452						omalloc_parseopt(*q);
453					mopts.def_malloc_cache = MALLOC_DEFAULT_CACHE;
454					break;
455				default:
456					omalloc_parseopt(*p);
457					break;
458				}
459			}
460		}
461
462	#ifdef MALLOC_STATS
463		if (mopts.malloc_stats && (atexit(malloc_exit) == -1)) {
464			dprintf(STDERR_FILENO, "malloc() warning: atexit(2) failed."
465			    " Will not be able to dump stats on exit\n");
466		}
467	#endif /* MALLOC_STATS */
468
469		while ((mopts.malloc_canary = arc4random()) == 0)
470			;
471	}

OpenBSD malloc(3) has lots of security features and they are configurable using three options:

systcl(8)
environment variable MALLOC_OPTIONS
compile-time option malloc_options

Suppose, for better security we would like to use the canaries, so that can be enabled by setting the option using systcl(8), for example: systcl vm.malloc_conf=C

omalloc_init() code workings:

Initializes some variables of malloc_readonly structure to default values like mopts.malloc_mutexes is the default number of mutexes, mopts.def_malloc_junk is the default number of junk filling and mopts.def_malloc_cache is the default number of free page cache
Then, it checks the option which we have used to configure malloc and we have used sysctl(8). So, for sysctl it goes to case 0: and get the value to char b[16] and then it assigns to pointer to character variable p then after looping for other two it goes for extracting the value that is there in p
further, it checks for the malloc option S which enables all the security auditing features of OpenBSD malloc(3)
- If it is there then it calls omalloc_parseopt(*q); function then after that it sets mopts.def_malloc_cache to 0 or to MALLOC_DEFAULT_CACHE, depends on whether it is S or s
- If it is not there, then it simply calls the function omalloc_parseopt(*p); omalloc_parseopt(char opt) is responsible for extracting the character and in our case it is C for malloc canaries, after parsing it goes to case ‘C’ and sets mopts.chunk_canaries to 1, it does the same for other options and set or enables (initializes) their variables.

Defination of omalloc_parseopt(char opt) as mentioned:

322	static void
323	omalloc_parseopt(char opt)
324	{
325		switch (opt) {
326		case '+':
327			mopts.malloc_mutexes <<= 1;
328			if (mopts.malloc_mutexes > _MALLOC_MUTEXES)
329				mopts.malloc_mutexes = _MALLOC_MUTEXES;
330			break;
331		case '-':
332			mopts.malloc_mutexes >>= 1;
333			if (mopts.malloc_mutexes < 2)
334				mopts.malloc_mutexes = 2;
335			break;
336		case '>':
337			mopts.def_malloc_cache <<= 1;
338			if (mopts.def_malloc_cache > MALLOC_MAXCACHE)
339				mopts.def_malloc_cache = MALLOC_MAXCACHE;
340			break;
341		case '<':
342			mopts.def_malloc_cache >>= 1;
343			break;
344		case 'c':
345			mopts.chunk_canaries = 0;
346			break;
347		case 'C':
348			mopts.chunk_canaries = 1;
349			break;
350	#ifdef MALLOC_STATS
351		case 'd':
352			mopts.malloc_stats = 0;
353			break;
354		case 'D':
355			mopts.malloc_stats = 1;
356			break;
357	#endif /* MALLOC_STATS */
358		case 'f':
359			mopts.malloc_freecheck = 0;
360			mopts.malloc_freeunmap = 0;
361			break;
362		case 'F':
363			mopts.malloc_freecheck = 1;
364			mopts.malloc_freeunmap = 1;
365			break;
366		case 'g':
367			mopts.malloc_guard = 0;
368			break;
369		case 'G':
370			mopts.malloc_guard = MALLOC_PAGESIZE;
371			break;
372		case 'j':
373			if (mopts.def_malloc_junk > 0)
374				mopts.def_malloc_junk--;
375			break;
376		case 'J':
377			if (mopts.def_malloc_junk < 2)
378				mopts.def_malloc_junk++;
379			break;
380		case 'r':
381			mopts.malloc_realloc = 0;
382			break;
383		case 'R':
384			mopts.malloc_realloc = 1;
385			break;
386		case 'u':
387			mopts.malloc_freeunmap = 0;
388			break;
389		case 'U':
390			mopts.malloc_freeunmap = 1;
391			break;
392		case 'x':
393			mopts.malloc_xmalloc = 0;
394			break;
395		case 'X':
396			mopts.malloc_xmalloc = 1;
397			break;
398		default:
399			dprintf(STDERR_FILENO, "malloc() warning: "
400	                    "unknown char in MALLOC_OPTIONS\n");
401			break;
402		}
403	}

As we can see that there are some MALLOC_STATS in the entire source, which means it dumps extra malloc stats information. So, coming back to omalloc_init(), after completing omalloc_parseopt(char opt) function, there are some malloc stats condition then, a random cookie gets assign to mopts.malloc_canary using arc4random()

Coming back to defination of _malloc_init(0), after the completion of omalloc_init(), there is a variable named nmutexes which gets assign bydefault to 2 for single-threaded programs, we have already seen the initalization of mopts.malloc_mutexes default to 8 for multi-threaded programs in the function omalloc_init(). For single-threaded, the value of variable from_rthread is 0 Then, it checks for MALLOC_PAGEMASK bit for malloc_readonly address or simply we can say that it is checking the last 12 bits of the malloc_readonly structure address and all 12 bits must be 0 to apply the perm bit PROT_READ and PROT_WRITE. Could say from the debugger that it is also checking for even address

After that, there is a loop till the nmutexes which is 2 for our single-threaded case.

For single-threaded programs, it maintains two malloc dir_info pools as indicates from the variable nmutexes. One for MAP_CONCEALED memory and one for regular
For multi-threaded porgram more pools are created. This is to avoid contention, accesses to diffrent pools can run concurently.

reference:

related to multi-pools - mailing list

github diff for more pools

if i == 0 responsible for MAP_CONCEALED memory through call omalloc_poolinit(&d, MAP_CONCEAL); and else responsible for omalloc_poolinit(&d, 0); regular memory pools.

Defination of omalloc_poolinit():

473 static void
474 omalloc_poolinit(struct dir_info **dp, int mmap_flag)
475 {
476         char *p;
477         size_t d_avail, regioninfo_size;
478         struct dir_info *d;
479         int i, j;
480
481         /*
482          * Allocate dir_info with a guard page on either side. Also
483          * randomise offset inside the page at which the dir_info
484          * lies (subject to alignment by 1 << MALLOC_MINSHIFT)
485          */
486         if ((p = MMAPNONE(DIR_INFO_RSZ + (MALLOC_PAGESIZE * 2), mmap_flag)) ==
487             MAP_FAILED)
488                 wrterror(NULL, "malloc init mmap failed");
489         mprotect(p + MALLOC_PAGESIZE, DIR_INFO_RSZ, PROT_READ | PROT_WRITE);
490         d_avail = (DIR_INFO_RSZ - sizeof(*d)) >> MALLOC_MINSHIFT;
491         d = (struct dir_info *)(p + MALLOC_PAGESIZE +
492             (arc4random_uniform(d_avail) << MALLOC_MINSHIFT));
493
494         rbytes_init(d);
495         d->regions_free = d->regions_total = MALLOC_INITIAL_REGIONS;
496         regioninfo_size = d->regions_total * sizeof(struct region_info);
497         d->r = MMAP(regioninfo_size, mmap_flag);
498         if (d->r == MAP_FAILED) {
499                 d->regions_total = 0;
500                 wrterror(NULL, "malloc init mmap failed");
501         }
502         for (i = 0; i <= MALLOC_MAXSHIFT; i++) {
503                 LIST_INIT(&d->chunk_info_list[i]);
504                 for (j = 0; j < MALLOC_CHUNK_LISTS; j++)
505                         LIST_INIT(&d->chunk_dir[i][j]);
506         }
507         STATS_ADD(d->malloc_used, regioninfo_size + 3 * MALLOC_PAGESIZE);
508         d->mmap_flag = mmap_flag;
509         d->malloc_junk = mopts.def_malloc_junk;
510         d->malloc_cache = mopts.def_malloc_cache;
511         d->canary1 = mopts.malloc_canary ^ (u_int32_t)(uintptr_t)d;
512         d->canary2 = ~d->canary1;
513
514         *dp = d;
515 }

omalloc_poolinit(struct dir_info **dp, int mmap_flag) workings:

After some basic variable declarations, first it maps page into memory using mmap(2) in MMAPNONE(sz, f) where sz is the size and f is the flag

96 #define MMAPNONE(sz,f)  mmap(NULL, (sz), PROT_NONE, \
97     MAP_ANON | MAP_PRIVATE | (f), -1, 0)

So, as from the above macro defination, we can see that the first parameter of mmap(2), that is, addr is NULL and as per the mmap(2) man page

The mmap() function causes the contents of fd, starting at offset, to be
mapped in memory at the given addr.  The mapping will extend at least len
bytes, subject to page alignment restrictions.

The addr argument describes the address where the system should place the
mapping.  If the MAP_FIXED flag is specified, the allocation will happen
at the specified address, replacing any previously established mappings
in its range.  Otherwise, the mapping will be placed at the available
spot at addr; failing that it will be placed "close by".

If addr is NULL the system can pick any address. Except for MAP_FIXED mappings, the
system will never replace existing mappings.

The len argument describes the minimum amount of bytes the mapping will
span.  Since mmap() maps pages into memory, len may be rounded up to hit
a page boundary.  If len is 0, the mapping will fail with EINVAL.

Following are the page mapping calculations based on debugging

sz = DIR_INFO_RSZ + (MALLOC_PAGESIZE * 2)
where DIR_INFO_RSZ = ((sizeof(struct dir_info) + MALLOC_PAGEMASK) & ~MALLOC_PAGEMASK)
MALLOC_PAGEMASK = 4095 bytes
MALLOC_PAGESIZE = 4096 bytes
So, `DIR_INFO_RSZ` becomes `(4284 + 4095) & ~4095 = 8192 bytes`
and sz becomes 8192 + (4096 * 2) = 16384 bytes
and, f = MMAP_CONCEAL; which means it prevents from leaking the information and also it excludes the mapping from core dumps

So in above page mapping calculation, DIR_INFO_RSZ indicates that to store the dir_info structure we need 2 pages and allocate 4 pages PROT_NONE using MMAPNONE with flag as “MAP_CONCEAL”, which we can see from the omalloc_poolinit():L486
Then, making two middle pages R/W which can be seen from the macro value of DIR_INFO_RSZ, 2 pages
then, calculate the d_avail to randomise offset inside the page at which the dir_info present (subject to alignment by 1 « MALLOC_MINSHIFT) d_avail = (8192 - 4824) >> 4 = 3368 >> 4 = 210 the d_avail is 210, now calculate offset, d d = (struct dir_info *)(p + MALLOC_PAGESIZE + (arc4random_uniform(d_avail) << MALLOC_MINSHIFT));
So, as mentioned by the developer Otto@ in the mailing list that the dir_info structure ends up on an aligned address somewhere in the middle pages on an offset between 0 and (210«4) which further resolves in between 0 to 3360, counting from the start of the two middle pages. So, it becomes like d = [p + MALLOC_PAGESIZE + (0..3360)], where (0..3360) is the offset value from 0 to 3360 max
from my understanding, it looks like there is no guard page bydefault enabled on the both the sides, however, it is there for only one side but after confirming the understanding with the developer Otto@, he mentioned that dir_info is special and having a guard page on both sides for regular allocation can be done, but would waste more pages and also mentioned to note that allocations are already spread throughout the address space, so it is very likely that an allocation is surrounded by unmapped pages. So, finally the conclusion is that there will be guard pages on each side as per the malloc design so no need to allocate extra as that will be waste of pages.
Then it initializes random bytes using the rbytes_init(d).

Defination of rbytes_init(struct dir_info *d); as mentioned:

303 static void
304 rbytes_init(struct dir_info *d)
305 {
306         arc4random_buf(d->rbytes, sizeof(d->rbytes));
307         /* add 1 to account for using d->rbytes[0] */
308         d->rbytesused = 1 + d->rbytes[0] % (sizeof(d->rbytes) / 2);
309 }

rbytes_init() is responsible for filling the d->rbytes with the random bytes using the arc4random_buf() and keeps track/count of the rbytes used through d->rbytesused
after this, coming back to omalloc_poolinit(), it is initializing the default values for some of the structure members, d->regions_free = dir->regions_total = MALLOC_INTIAL_REGIONS; where the value of macro MALLOC_INITIAL_REGIONS is 512. Also, calculates the total region_info size, regioninfo_size = d->regions_total * sizeof(struct region_info);

105 struct region_info {
106         void *p;                /* page; low bits used to mark chunks */
107         uintptr_t size;         /* size for pages, or chunk_info pointer */
108 #ifdef MALLOC_STATS
109         void *f;                /* where allocated from */
110 #endif
111 };

The structure struct region_info is used to keep track of mmap’ed regions by storing their address and size into a hash table as mentioned in the slides of Otto@
further, it maps pages of size regioninfo_size for regions with the flag MAP_CONCEAL and assigns it to d->r and then check if mapping failed
While understanding the internals of malloc(3), I did not understand the working of the code-snippet as mentioned:

...
...
...
502         for (i = 0; i <= MALLOC_MAXSHIFT; i++) {
503                 LIST_INIT(&d->chunk_info_list[i]);
504                 for (j = 0; j < MALLOC_CHUNK_LISTS; j++)
505                         LIST_INIT(&d->chunk_dir[i][j]);
506         }
...
...
...

What is the purpose of creating these many linked lists?

after discussing the query with the developer Otto@, I came to know that these many lists is used to allow more randomization, as per the words by the developer, Otto@ said More than one list of free chunk pages per chunk size is maintained to allow for more randomization.
in short, the above nested for loops will create 12 chunk_info_list where i is 0 to 11 and for each and every ith index there is j, so as per that,

chunk_info_list[0]
	chunk_dir[0][0]
	chunk_dir[0][1]
	chunk_dir[0][2]
	chunk_dir[0][3]
...
...
...
chunk_info_list[11]
	chunk_dir[11][0]
	chunk_dir[11][1]
	chunk_dir[11][2]
	chunk_dir[11][3]

...
...
...

also confirmed with the developer that we can also allow more randomization by increasing the MALLOC_CHUNK_LISTS but at the cost of overhead. Increasing the MALLOC_MAXSHIFT is not possible because it is the shift of the max chunk size that fits in a page. We will see later how these lists helps to achieve randomization
then, adds and updated the d->malloc_used for dumping the malloc stats information
further, updated the default initialization of variables given below:

...
...
...
508         d->mmap_flag = mmap_flag;
509         d->malloc_junk = mopts.def_malloc_junk;
510         d->malloc_cache = mopts.def_malloc_cache;
511         d->canary1 = mopts.malloc_canary ^ (u_int32_t)(uintptr_t)d;
512         d->canary2 = ~d->canary1;
513
514         *dp = d;
515 }
	/* where it is already mentioned above code snippets that mopts.def_malloc_junk is 1 and
	 *  mopts.def_malloc_cache is 64, already initialized default values in omalloc_init() 
	 */

then, dir_info uses two canaries. Its calculation is easy to understand. Whatever the address of d ( struct dir_info *d) just typecast it to (u_int32_t)(uintptr_t) and XOR it with mopts.malloc_canary and assign the result to d->canary1 and then compute the not (~) of d->canary1 then assign the result to d->canary2 or in simpler words, convert into binary then take each bit and flips them to their logical opposite. convert 1’s to 0’s and vice versa then convert it to hex and assign it to d->canary2
Finally assign the initialized dir_info structure d to *dp

Coming back to _malloc_init(int from_rthreads), so, as per the defination _malloc_init(), for i == 0, we have completed the function omalloc_poolinit(&d, MAP_CONCEAL);, now further, it assigns d->malloc_junk = 2; and d->malloc_cache = 0;

Then, it saves the index i to d->mutex and stored the initialized MAP_CONCEALED pool to mopts.malloc_pool[i] = d;

The value of nmutexes is 2, so, the loop will execute again and will do the whole same operations for index i == 1 (or i != 0). So, again it invokes omalloc_poolinit(&d, 0) but without MAP_CONCEAL flag and this time it is 0. It performs same operation with second argument as 0.

After complete execution of function omalloc_poolinit(&d, 0), it sets junk value to default junk value and same for malloc_cache, that is, d->malloc_junk = mopts.def_malloc_junk; and d->malloc_cache = mopts.def_malloc_cache;. Now, again performes the same operation like for saving the new index 1 to d->mutex and stores the pool to mopts.malloc_pool[i] = d if i == 1

Now, mopts.malloc_pool has two pools,

mopts.malloc_pool[0]
mopts.malloc_pool[1]

Next, it checks for multi-threading from variable from_rthreads, if the value is non-zero then it sets mopts.malloc_mt = 1 which shows that program is multi-threaded but for our case it is zero (0), so if cond fails and else cond executes and sets mopts.internal_funcs = 1, from the structure malloc_readonly, it shows that setting internal_funcs means to use better function like recallocarray/freezero but there is no such things occurs for our case, maybe we have to use it for some other scenarios like in case of, calloc, etc. recallocarray(3) - mailing list

Finally, it sets the perms to readonly, to prevent further tampering with them, again it checks last 12 bits and if they are 0 then it sets perms to PROT_READ, and malloc_init(0) completed. Now, coming back to PROGLOGUE macro code as mentioned below:

1256 #define PROLOGUE(p, fn)                 \
1257         d = (p);                        \
1258         if (d == NULL) {                \
1259                 _malloc_init(0);        \
1260                 d = (p);                \
1261         }                               \
1262         _MALLOC_LOCK(d->mutex);         \
1263         d->func = fn;                   \
1264         if (d->active++) {              \
1265                 malloc_recurse(d);      \
1266                 return NULL;            \
1267         }                               \

So, we have completed the malloc_init(0) function. Remember, p refers to the function getpool(), which gets called in lineno. 1260 and due to single-threaded program, it returns mopts.malloc_pool[1], which has the regular pool, not MAP_CONCEALED one, that, further returns to d then malloc_lock and assigns fn to d->fn, here fn means func string “malloc”. It checks and incremented the d->active and doesn’t go inside the if code-flow due to 0 value of d->active

malloc(size) code from libc:

1277 void *
1278 malloc(size_t size)
1279 {
1280         void *r;
1281         struct dir_info *d;
1282         int saved_errno = errno;
1283
1284         PROLOGUE(getpool(), "malloc")
1285         r = omalloc(d, size, 0, CALLER);
1286         EPILOGUE()
1287         return r;
1288 }
From line no. 1285, after PROLOGUE it calls omalloc(d, size, CALLER). Defination of omalloc(d, size, CALLER) as mentioned:

1126 static void *
1127 omalloc(struct dir_info *pool, size_t sz, int zero_fill, void *f)
1128 {
1129 	void *p;
1130 	size_t psz;
1131
1132	if (sz > MALLOC_MAXCHUNK) {
1133		if (sz >= SIZE_MAX - mopts.malloc_guard - MALLOC_PAGESIZE) {
1134			errno = ENOMEM;
1135			return NULL;
1136		}
1137		sz += mopts.malloc_guard;
1138		psz = PAGEROUND(sz);
1139		p = map(pool, NULL, psz, zero_fill);
1140		if (p == MAP_FAILED) {
1141			errno = ENOMEM;
1142			return NULL;
1143		}
1144		if (insert(pool, p, sz, f)) {
1145			unmap(pool, p, psz, 0, 0);
1146			errno = ENOMEM;
1147			return NULL;
1148		}
1149		if (mopts.malloc_guard) {
1150			if (mprotect((char *)p + psz - mopts.malloc_guard,
1151			    mopts.malloc_guard, PROT_NONE))
1152				wrterror(pool, "mprotect");
1153			STATS_ADD(pool->malloc_guarded, mopts.malloc_guard);
1154		}
1155
1156    	if (MALLOC_MOVE_COND(sz)) {
1157    		/* fill whole allocation */
1158    		if (pool->malloc_junk == 2)
1159    			memset(p, SOME_JUNK, psz - mopts.malloc_guard);
1160    		/* shift towards the end */
1161    		p = MALLOC_MOVE(p, sz);
1162    		/* fill zeros if needed and overwritten above */
1163    		if (zero_fill && pool->malloc_junk == 2)
1164    			memset(p, 0, sz - mopts.malloc_guard);
1165    	} else {
1166    		if (pool->malloc_junk == 2) {
1167    			if (zero_fill)
1168    				memset((char *)p + sz - mopts.malloc_guard,
1169    				    SOME_JUNK, psz - sz);
1170    			else
1171    				memset(p, SOME_JUNK,
1172    				    psz - mopts.malloc_guard);
1173    		} else if (mopts.chunk_canaries)
1174    			fill_canary(p, sz - mopts.malloc_guard,
1175    			    psz - mopts.malloc_guard);
1176    	}
1177
1178	} else {
1179		/* takes care of SOME_JUNK */
1180		p = malloc_bytes(pool, sz, f);
1181		if (zero_fill && p != NULL && sz > 0)
1182			memset(p, 0, sz);
1183	}
1184
1185 	return p;
1186 }

omalloc(struct dir_info *pool, size_t sz, int zero_fill, void *f); function internals:

There are two code flows
- if ( sz > MALLOC_MAXCHUNK). Our size is 8 as mentioned in the sample code, so this condition will not be true but still we are going to divein a little. First, it checks if the size is greater than the MALLOC_MAXCHUNK, which is 2048
- If size is less, then it uses 2nd code flow which is else condition, that is, it calls malloc_bytes(pool, sz, f); which we will see further, for now we are going to explore the case when the size is greater:
  - After checking the size with MALLOC_MAXCHUNK, it further checks if the requested size is greater than SIZE_MAX (excluding mopts.malloc_guard and MALLOC_PAGESIZE) and if yes, then it sets errno to ENOMEM and returns NULL
  - then if size is less, it adds the malloc_guard value to requested size and it roundsup the page to multiple of pagesize, for example: if requested size is <= 4096 then it rounds it to 4096 but if requested size is 4097 then it roundsup to 8192
  - further, it maps the page to size psz with hint address is equals to NULL then check if it fails
  - next, it calls insert(pool, p, sz, f); function to keep track of mmap’ed regions by storing their address and size into a hash table, we will dive more in-depth later, if it fails to insert then it unmaps the page and return ENOMEM
  - it checks for malloc_guard page option, if it sets then it adds a guarded page as per the size mentioned by malloc_guard variable with PROT_NONE perms bit and then it adds the information for stats
  - then, it checks for MALLOC_MOVE_COND, if the condition is true then it shifts the allocations towards the end, as mentioned in the source code comment,

70 /*
71  * We move allocations between half a page and a whole page towards the end,
72  * subject to alignment constraints. This is the extra headroom we allow.
73  * Set to zero to be the most strict.
74  */
75 #define MALLOC_LEEWAY           0
76 #define MALLOC_MOVE_COND(sz)    ((sz) - mopts.malloc_guard <            \
77                                     MALLOC_PAGESIZE - MALLOC_LEEWAY)
78 #define MALLOC_MOVE(p, sz)      (((char *)(p)) +                        \
79                                     ((MALLOC_PAGESIZE - MALLOC_LEEWAY - \
80                                     ((sz) - mopts.malloc_guard)) &      \
81                                     ~(MALLOC_MINSIZE - 1)))`

after checking for condition, first, it checks for junk value, that is,pool->malloc_junk == 2 if it equals then it fills the mmap’ed page p with SOME_JUNK which has byte 0xdb, then as previously mentioned it shifts the allocation towards end with macro MALLOC_MOVE(p, sz), later it checks, if zero-filling requires, if yes then it fills the same JUNKed filled page with zeroes
if the MALLOC_MOVE_COND condition is not true then it checks for junk value, that is, pool->malloc_junk == 2, if it equals to 2 then it checks for zero filling and if it requires then it fills from the address as mentioned in the code snippet and if zero filling not requires then it simply fills with SOME_JUNK as mentioned

...
...
...
1166				if (pool->malloc_junk == 2) {
1167					if (zero_fill)
1168						memset((char *)p + sz - mopts.malloc_guard,
1169						    SOME_JUNK, psz - sz);
1170					else
1171						memset(p, SOME_JUNK,
1172						    psz - mopts.malloc_guard);

if pool->malloc_junk == 2 is not true then it checks for canaries, that is, else if (mopts.chunk_canaries) then it calls the fill_canary() to fill the canaries
coming back to omalloc(), sz > MALLOC_MAXCHUNK has already covered now if requested size is less than the MALLOC_MAXCHUNK then it calls the function malloc_bytes(pool, sz, f); and the defination as given below:

948	/*
949	 * Allocate a chunk
950	 */
951	static void *
952	malloc_bytes(struct dir_info *d, size_t size, void *f)
953	{
954		u_int i, r;
955		int j, listnum;
956		size_t k;
957		u_short	*lp;
958		struct chunk_info *bp;
959		void *p;
960	
961		if (mopts.malloc_canary != (d->canary1 ^ (u_int32_t)(uintptr_t)d) ||
962		    d->canary1 != ~d->canary2)
963			wrterror(d, "internal struct corrupt");
964	
965		j = find_chunksize(size);
966	
967		r = ((u_int)getrbyte(d) << 8) | getrbyte(d);
968		listnum = r % MALLOC_CHUNK_LISTS;
969		/* If it's empty, make a page more of that size chunks */
970		if ((bp = LIST_FIRST(&d->chunk_dir[j][listnum])) == NULL) {
971			bp = omalloc_make_chunks(d, j, listnum);
972			if (bp == NULL)
973				return NULL;
974		}
975	
976		if (bp->canary != (u_short)d->canary1)
977			wrterror(d, "chunk info corrupted");
978	
979		i = (r / MALLOC_CHUNK_LISTS) & (bp->total - 1);
980	
981		/* start somewhere in a short */
982		lp = &bp->bits[i / MALLOC_BITS];
983		if (*lp) {
984			j = i % MALLOC_BITS;
985			k = ffs(*lp >> j);
986			if (k != 0) {
987				k += j - 1;
988				goto found;
989			}
990		}
991		/* no bit halfway, go to next full short */
992		i /= MALLOC_BITS;
993		for (;;) {
994			if (++i >= bp->total / MALLOC_BITS)
995				i = 0;
996			lp = &bp->bits[i];
997			if (*lp) {
998				k = ffs(*lp) - 1;
999				break;
1000			}
1001		}
1002	found:
1003	#ifdef MALLOC_STATS
1004		if (i == 0 && k == 0) {
1005			struct region_info *r = find(d, bp->page);
1006			r->f = f;
1007		}
1008	#endif
1009	
1010		*lp ^= 1 << k;
1011	
1012		/* If there are no more free, remove from free-list */
1013		if (--bp->free == 0)
1014			LIST_REMOVE(bp, entries);
1015	
1016		/* Adjust to the real offset of that chunk */
1017		k += (lp - bp->bits) * MALLOC_BITS;
1018	
1019		if (mopts.chunk_canaries && size > 0)
1020			bp->bits[bp->offset + k] = size;
1021	
1022		k <<= bp->shift;
1023	
1024		p = (char *)bp->page + k;
1025		if (bp->size > 0) {
1026			if (d->malloc_junk == 2)
1027				memset(p, SOME_JUNK, bp->size);
1028			else if (mopts.chunk_canaries)
1029				fill_canary(p, size, bp->size);
1030		}
1031		return p;
1032	}

malloc_bytes(pool, sz, f); is used to allocate a chunk and after some basic variable declarations, it checks for internal structure corruption with canaries of d and mopts.malloc_canary
Then, it finds the chunk size with the function find_chunksize(size);, defination as given below:

919 static int
920 find_chunksize(size_t size)
921 {
922         int r;
923
924         /* malloc(0) is special */
925         if (size == 0)
926                 return 0;
927
928         if (size < MALLOC_MINSIZE)
929                 size = MALLOC_MINSIZE;
930         size--;
931
932         r = MALLOC_MINSHIFT;
933         while (size >> r)
934                 r++;
935         return r;
936 }

first it will check if given size is 0 then it returns 0, then it checks if size is less than MALLOC_MINSIZE then it sets size to MALLOC_MINSIZE, else, it decrements the size and sets r = MALLOC_MINSHIFT; and the value of MALLOC_MINSHIFT is 4. Then it right shifts the size by r and it keeps incrementing the r till right shifting result becomes zero, then returns r. In our case, the size is 8, which is less than MALLOC_MINSIZE and then it sets the size to MALLOC_MINSIZE, which is 16, then it decrements and it becomes 15 and 15 » 4, as we know r is MALLOC_MINSHIFT, which is 4. So, the output of 15 »4 is 0 then it returns r, which is 4
coming back to malloc_bytes() after find_chunksize(size), it calls ((u_int)getrbyte(d) << 8) | getrbyte(d);, so, defination of getrbyte(d) as given below:

311 static inline u_char
312 getrbyte(struct dir_info *d)
313 {
314         u_char x;
315 
316         if (d->rbytesused >= sizeof(d->rbytes))
317                 rbytes_init(d);
318         x = d->rbytes[d->rbytesused++];
319         return x;
320 }

in the above code, first it checks whether the rbytesused is more than the sizeof(rbytes), if yes, then it initializes the random bytes using rbytes_init(d) and then assigns the value of d->rbytes[d->rbytesused] to x and also increments the d->rbytesused count and returns the same but if the condition fails then it will directly assigns the rbytesused count to x and increment the same and return the same x
So as per the name indicates, my feeling is that the getrbyte() means get-random-byte(), basically the whole line r = ((u_int)getrbyte(d) << 8) | getrbyte(d); does the following magic

get-random-byte then left shits by 8 then OR'ed with again some random byte
let's suppose,
1) a =  get-random-bytes
2) left shift a by 8 
3) b = get-random-bytes
4) r = a | b

for example, 0xd4 -> 0xd400 -> 0xd4cb, so r = 0xd4cb

Then it finds the listnum, listnum = r % MALLOC_CHUNK_LISTS;, where MALLOC_CHUNK_LISTS is 4
as per our understanding about the for loops on randomization, we have seen that there is nested for loops which creates lists, helpful to allow randomization. So, here we can see that it randomly chooses the created lists for allocation of chunk_info
then, it chooses some random list and makes it first list, now if the list is empty, that is, head is NULL then it calls function

omalloc_make_chunks(d, j, listnum); to allocate page of chunks. Defination of omalloc_make_chunks() as given below:
885 /*
886  * Allocate a page of chunks
887  */
888 static struct chunk_info *
889 omalloc_make_chunks(struct dir_info *d, int bits, int listnum)
890 {
891         struct chunk_info *bp;
892         void *pp;
893
894         /* Allocate a new bucket */
895         pp = map(d, NULL, MALLOC_PAGESIZE, 0);
896         if (pp == MAP_FAILED)
897                 return NULL;
898
899         /* memory protect the page allocated in the malloc(0) case */
900         if (bits == 0 && mprotect(pp, MALLOC_PAGESIZE, PROT_NONE) == -1)
901                 goto err;
902
903         bp = alloc_chunk_info(d, bits);
904         if (bp == NULL)
905                 goto err;
906         bp->page = pp;
907
908         if (insert(d, (void *)((uintptr_t)pp | (bits + 1)), (uintptr_t)bp,
909             NULL))
910                 goto err;
911         LIST_INSERT_HEAD(&d->chunk_dir[bits][listnum], bp, entries);
912         return bp;
913
914 err:
915         unmap(d, pp, MALLOC_PAGESIZE, 0, d->malloc_junk);
916         return NULL;
917 }

The above code is used to allocate a page of chunks, as mentioned in the comments. First, it maps/allocates page up to len MALLOC_PAGESIZE with hint addr as NULL using map(d, NULL, MALLOC_PAGESIZE, 0);, then it checks for its failure and returns NULL if fails. Defination of map() as given below

751 static void *
752 map(struct dir_info *d, void *hint, size_t sz, int zero_fill)
753 {
754	size_t psz = sz >> MALLOC_PAGESHIFT;
755	struct region_info *r, *big = NULL;
756	u_int i;
757	void *p;
758 
759	if (mopts.malloc_canary != (d->canary1 ^ (u_int32_t)(uintptr_t)d) ||
760	    d->canary1 != ~d->canary2)
761		wrterror(d, "internal struct corrupt");
762	if (sz != PAGEROUND(sz))
763		wrterror(d, "map round");
764 
765	if (hint == NULL && psz > d->free_regions_size) {
766		_MALLOC_LEAVE(d);
767		p = MMAP(sz, d->mmap_flag);
768		_MALLOC_ENTER(d);
769		if (p != MAP_FAILED)
770			STATS_ADD(d->malloc_used, sz);
771		/* zero fill not needed */
772		return p;
773	}
774	for (i = 0; i < d->malloc_cache; i++) {
775		r = &d->free_regions[(i + d->rotor) & (d->malloc_cache - 1)];
776		if (r->p != NULL) {
777			if (hint != NULL && r->p != hint)
778				continue;
779			if (r->size == psz) {
780				p = r->p;
781				r->p = NULL;
782				d->free_regions_size -= psz;
783				if (mopts.malloc_freeunmap)
784					mprotect(p, sz, PROT_READ | PROT_WRITE);
785				if (zero_fill)
786					memset(p, 0, sz);
787				else if (d->malloc_junk == 2 &&
788				    mopts.malloc_freeunmap)
789					memset(p, SOME_FREEJUNK, sz);
790				d->rotor += i + 1;
791				return p;
792			} else if (r->size > psz)
793				big = r;
794		}
795	}
796	if (big != NULL) {
797		r = big;
798		p = r->p;
799		r->p = (char *)r->p + (psz << MALLOC_PAGESHIFT);
800		if (mopts.malloc_freeunmap)
801			mprotect(p, sz, PROT_READ | PROT_WRITE);
802		r->size -= psz;
803		d->free_regions_size -= psz;
804		if (zero_fill)
805			memset(p, 0, sz);
806		else if (d->malloc_junk == 2 && mopts.malloc_freeunmap)
807			memset(p, SOME_FREEJUNK, sz);
808		return p;
809	}
810	if (hint != NULL)
811		return MAP_FAILED;
812	if (d->free_regions_size > d->malloc_cache)
813		wrterror(d, "malloc cache");
814	_MALLOC_LEAVE(d);
815	p = MMAP(sz, d->mmap_flag);
816	_MALLOC_ENTER(d);
817	if (p != MAP_FAILED)
818		STATS_ADD(d->malloc_used, sz);
819	/* zero fill not needed */
820	return p;
821 }

parameters for the map() function given below:

calls map(d, NULL, MALLOC_PAGESIZE, 0);
    first parameter, d belongs to struct dir_info *d
    second parameter, NULL belongs to *hint
	third parameter, MALLOC_PAGESIZE belongs to sz
	fourth parameter, 0 indicates zero_filling requirements

First, map() assigns the right shifted value of sz by MALLOC_PAGESHIFT bytes, which is 4096 » 12 => 0x1. So, psz = 0x1 then, it defines some pointer objects for the structure region_info and some other pointer variables, later, it checks for internal struct corruption through canaries. Then, it verifies the roundness of size sz. if it passes, then it checks whether the provided hint is NULL and psz is greater than free_pages_cache. So, for our case, the d->free_regions_size is 0x0 and psz is 0x1 and the condition satisfies and it comes under if code, where if code first does MALLOC_LEAVE, which means it checks if it is multi-threaded program then decrement the d->active count and unlock malloc and returns but if it is single-threaded like for our case, then it simply returns without doing anything
Then, it maps pages with provided flag mmap_flag and size sz. mmap_flag is 0x0, as if we remember correctly then second time getpool() returns d with mmap_flag is 0x0. Then, it does MALLOC_ENTER which is the opposite of MALLOC_LEAVE which means check if the program is multi-threaded then lock malloc and increment the d->active count but if the program is single-threaded then it does nothing and simply returns. Then , it checks whether p is failed. If not then it adds stats information, that is, increments the d->malloc_used to sz, that is, d->malloc_used += sz then it returns p
For our case, map() completed but other code paths may be explained later in the upcoming malloc series, as the blog has already become lengthy
Then, coming back to omalloc_make_chunks(), if the bits is 0 means for malloc(0) case, it memory protects the allocated page with PROT_NONE but for our case, bits is 4 and we have used malloc(8)
Then, it allocates the chunk info by calling the function alloc_chunk_info(d, bits); and code for the same given below:

847 static struct chunk_info *
848 alloc_chunk_info(struct dir_info *d, int bits)
849 {
850         struct chunk_info *p;
851
852         if (LIST_EMPTY(&d->chunk_info_list[bits])) {
853                 size_t size, count, i;
854                 char *q;
855
856                 if (bits == 0)
857                         count = MALLOC_PAGESIZE / MALLOC_MINSIZE;
858                 else
859                         count = MALLOC_PAGESIZE >> bits;
860
861                 size = howmany(count, MALLOC_BITS);
862                 size = sizeof(struct chunk_info) + (size - 1) * sizeof(u_short);
863                 if (mopts.chunk_canaries)
864                         size += count * sizeof(u_short);
865                 size = _ALIGN(size);
866
867                 q = MMAP(MALLOC_PAGESIZE, d->mmap_flag);
868                 if (q == MAP_FAILED)
869                         return NULL;
870                 STATS_ADD(d->malloc_used, MALLOC_PAGESIZE);
871                 count = MALLOC_PAGESIZE / size;
872
873                 for (i = 0; i < count; i++, q += size) {
874                         p = (struct chunk_info *)q;
875                         LIST_INSERT_HEAD(&d->chunk_info_list[bits], p, entries);
876                 }
877         }
878         p = LIST_FIRST(&d->chunk_info_list[bits]);
879         LIST_REMOVE(p, entries);
880         if (p->shift == 0)
881                 init_chunk_info(d, p, bits);
882         return p;
883 }

First it checks if the list is empty where bits is 4 for our case, and if it is empty then it checks if bits is 0, if yes, then it calculates the count by dividing the MALLOC_PAGESIZE with MALLOC_MINSIZE but in our case bits is equals to 4, so, it calculates count for all cases when bit != 0 by MALLOC_PAGESIZE » bits, which comes as 256 for our case
Then, howmany(x, y) is ((x) + ((y) - 1) / y), so as per that, x = count and y is MALLOC_BITS, which is 256 and 16 respectively for our case and the result is 16
Then, it calculates size from adding the sizeof(struct chunk_info) + (size - 1) * sizeof(u_short), for our case, it came as 40 + (16 - 1) * 2 = 70 and then it checks for mopt.chunk_canaries and if it is there then it calculates size += count * sizeof(u_short); remember we have compiled our sample code with malloc option C, so, chunk_canaries is there, for our case size became, size = 70 + 256 * 2 = 582 then it aligns the size to ALIGN(size), which make it from 582 to 584
In simpler words, the above point explains the size calculations for a chunk. It includes the size = [size of structure chunk_info] + [ size of bitmap] and as we already know that the bits will be different for different chunk size, so, the size of bitmap varies as per the different bits. It also adds the size of canary, if enable
Then, it maps page using mmap(2) upto MALLOC_PAGESIZE with mmap_flag value as 0 due to the mopts.malloc_pool[1], mopts.malloc_pool[0] has MAP_CONCEALed memory.Then, it adds information about malloc usage count from adding MALLOC_PAGESIZE to variable d->malloc_used. Then, it calculates count from count = MALLOC_PAGESIZE / size where it is 4096 / 584 = 7, for our case
Then, it creates count number of lists for chunk_info. For our case, count is 7 so, it creates 7 lists with the list head updated with p. Then, it chooses first list or in other words we can say it chooses the last inserted head list then removes it from the lists. Then it checks for p->shift and here shift means how may shifts it will take to get the p->size, if it is zero (0) then it calls function init_chunk_info(d, p, bits); then after the initializaton it returns p.

Defination of the init_chunk_info() as given below:

823 static void
824 init_chunk_info(struct dir_info *d, struct chunk_info *p, int bits)
825 {
826         int i;
827
828         if (bits == 0) {
829                 p->shift = MALLOC_MINSHIFT;
830                 p->total = p->free = MALLOC_PAGESIZE >> p->shift;
831                 p->size = 0;
832                 p->offset = 0xdead;
833         } else {
834                 p->shift = bits;
835                 p->total = p->free = MALLOC_PAGESIZE >> p->shift;
836                 p->size = 1U << bits;
837                 p->offset = howmany(p->total, MALLOC_BITS);
838         }
839         p->canary = (u_short)d->canary1;
840
841         /* set all valid bits in the bitmap */
842         i = p->total - 1;
843         memset(p->bits, 0xff, sizeof(p->bits[0]) * (i / MALLOC_BITS));
844         p->bits[i / MALLOC_BITS] = (2U << (i % MALLOC_BITS)) - 1;
845 }

init_chunk_info() is used to initialize the chunk information. It checks for whether the value of bits is 0 or not and if 0 then it initializes some default value as mentioned in the code and it seems that bit == 0, is the case of malloc(0) but if it is not 0 then it initializes some other values as mentioned in the code. Then, it assigns dir_info canary1 to chunk canary with typecasts in u_short, that is p->canary = (u_short)d->canary1;
Then, set all the valid bits in the bitmap. For our case, i = p->total - 1;, where p->total = 256 and i = 255 then it copies the 0xff to p->bits upto sizeof(p->bits[0]) * (i / MALLOC_BITS)) - 1 which we have observed 30 for our case.
Then it assigns some value to p->bits, where a bitmap specifing which chunks are still free to use, for better explanation on p->bits, for our case, i = 255, MALLOC_BITS = 16, so, it becomes,

p->bits[255 / 16] = (2U << ( 255 % 16)) - 1
then, p->bits[15] = (2U << ( 15 )) - 1
then, p->bits[15] = 65536 - 1
then, p->bits[15] = 65535

Now, the chunk initializaton is completed, we can see that after the function init_chunk_info(d, p, bits);, it returns the initialized chunk p
after the completion of both the functions init_chunk_info() and alloc_chunk_info(), it returns the allocated and initialized chunk to the function caller function omalloc_make_chunks(), returns the new initialized and allocated chunk p to bp and after lineno. 903 it checks bp for NULL and if bp is not NULL then it assigns the new page that it creates on line no. 895, that is, bp->page = pp;. Then, it invokes insert(d, (void *)((uintptr_t)pp | (bits + 1)), (uintptr_t)bp, NULL) and as we have previously understood that insert() is use to keep track of regions by keeping their address and size into a hash table. Defination for insert(struct dir_info *d, void *p, size_t sz, void *f) as given below:

564 /*
565  * The hashtable uses the assumption that p is never NULL. This holds since
566  * non-MAP_FIXED mappings with hint 0 start at BRKSIZ.
567  */
568 static int
569 insert(struct dir_info *d, void *p, size_t sz, void *f)
570 {
571         size_t index;
572         size_t mask;
573         void *q;
574
575         if (d->regions_free * 4 < d->regions_total) {
576                 if (omalloc_grow(d))
577                         return 1;
578         }
579         mask = d->regions_total - 1;
580         index = hash(p) & mask;
581         q = d->r[index].p;
582         STATS_INC(d->inserts);
583         while (q != NULL) {
584                 index = (index - 1) & mask;
585                 q = d->r[index].p;
586                 STATS_INC(d->insert_collisions);
587         }
588         d->r[index].p = p;
589         d->r[index].size = sz;
590 #ifdef MALLOC_STATS
591         d->r[index].f = f;
592 #endif
593         d->regions_free--;
594         return 0;
595 }

we can see that initially it checks for whether the slots is too filled, which means more than 75% (>75%), if yes then it calls omalloc_grow(d); and returns 1, if no then means it is less 75% (<75%) then it decrements d->regions_total by 1 and assign it to mask variable. Then it calculates, index, through anding (&) a hash(p) function and mask. Defination of hash(p) function given below:

254 static inline size_t
255 hash(void *p)
256 {
257         size_t sum;
258         uintptr_t u;
259
260         u = (uintptr_t)p >> MALLOC_PAGESHIFT;
261         sum = u;
262         sum = (sum << 7) - sum + (u >> 16);
263 #ifdef __LP64__
264         sum = (sum << 7) - sum + (u >> 32);
265         sum = (sum << 7) - sum + (u >> 48);
266 #endif
267         return sum;
268 }

hash(p) - after doing some shifting, it returns the sum. Coming back to insert(), d->r refers to the structure struct region_info, which has address and size to maintain mmap’ed regions into hash table. After that it assigns the already existing address to q, that is, q = d->r[index].p. If q is not NULL then it again calulcates the index and then finds the q and increment the collisions information for stats. if q is NULL, then it simply keeps the new addr p to struct region_info, same for size, then it decrements the free slots count
then, coming back to omalloc_make_chunks(), it inserts list head using LIST_INSERT_HEAD(&d->chunk_dir[bits][listnum], bp, entries);, where bits is 4 for our case and listnum is random for each invocaton then returns the associated meta-info, bp with the allocated-initialized chunk information and page of chunks, bp->page
as per my understanding, from the malloc_bytes the bp seems to be the allocated chunks in a page, and pp seems to be the bucket of chunks or can say a page of chunks as we can see from the omalloc_make_chunks():L895
now, coming back to the malloc_bytes(), it checks for chunk canary corruption on line no. 976, if(bp->canary != (u_short)d->canary1), if the condition is true then calls wrterror() with the string “chunk info corrupted” and then calls abort()
if the condition is false then it calculates i, i = (r / MALLOC_CHUNK_LISTS) & (bp->total - 1);, where r is the random byte, MALLOC_CHUNK_LISTS is 4 and bp->total is the total no. of chunks. Then, after calculating the i it calculates the index of the chunk which is free, as if we remember bp->bits is responsible for tracking the free chunks to use.

Found one of the interesting old paper which provides some details about the phkmalloc internals. According to the paper, it is mentioned that

struct pginfo {
    struct pginfo       *next;  /* next on the free list */
    void                *page;  /* Pointer to the page */
    u_short             size;   /* size of this page's chunks */
    u_short             shift;  /* How far to shift for this size chunks */
    u_short             free;   /* How many free chunks */
    u_short             total;  /* How many chunk */
    u_int               bits[1]; /* Which chunks are free */
};

where the next field is a pointer to the next structure in the list, or 0 if the element is the last of the list.
The page field points to the beginning of the page (it is always a multiple of malloc_pagesize).
The size field is set to the size in bytes of the chunks contained in this page.
The free field is the number of free chunks in the page.
The total field is the sum of the number of free chunks in the page and of the number of allocated chunks in the page. The page is freed (ie. returned to the lower layer) whenever ( free == total ) becomes true.
the bits field is a variable size array indicating which chunks in the page are free chunks. Each chunk is associated with a unique bit in the field, namely the bit obtained when applying the ( 1 « n ) mask to bits[i] where: ( i * MALLOC_BITS ) + n = ( chunk_address & malloc_pagemask ) / chunk_size

MALLOC_BITS is the number of bits a u_int has on the specific architecture where phkmalloc is using. It is defined as follows:

#define MALLOC_BITS ((int)(8*sizeof(u_int)))

This bit is set to one when the chunk is free, and to 0 when the chunk is in use. Of course, the effective size of the bits field will depend on the number of chunks in the page. the calculation given below computes the offset of the chunk in the page

...
...
...
981		/* start somewhere in a short */
982		lp = &bp->bits[i / MALLOC_BITS];
983		if (*lp) {
984			j = i % MALLOC_BITS;
985			k = ffs(*lp >> j);
986			if (k != 0) {
987				k += j - 1;
988				goto found;
989			}
990		}
991		/* no bit halfway, go to next full short */
992		i /= MALLOC_BITS;
993		for (;;) {
994			if (++i >= bp->total / MALLOC_BITS)
995				i = 0;
996			lp = &bp->bits[i];
997			if (*lp) {
998				k = ffs(*lp) - 1;
999				break;
1000			}
1001		}
1002	found:
1003	#ifdef MALLOC_STATS
1004		if (i == 0 && k == 0) {
1005			struct region_info *r = find(d, bp->page);
1006			r->f = f;
1007		}
1008	#endif
1009	
1010		*lp ^= 1 << k;
1011	
1012		/* If there are no more free, remove from free-list */
1013		if (--bp->free == 0)
1014			LIST_REMOVE(bp, entries);
1015	
1016		/* Adjust to the real offset of that chunk */
1017		k += (lp - bp->bits) * MALLOC_BITS;
1018	
1019		if (mopts.chunk_canaries && size > 0)
1020			bp->bits[bp->offset + k] = size;
1021	
1022		k <<= bp->shift;
1023	
1024		p = (char *)bp->page + k;
1025		if (bp->size > 0) {
1026			if (d->malloc_junk == 2)
1027				memset(p, SOME_JUNK, bp->size);
1028			else if (mopts.chunk_canaries)
1029				fill_canary(p, size, bp->size);
1030		}
1031		return p;
1032	}

It assigns the address of bp->bits[13] to lp, for our case i = 0xd3 (or 211) and MALLOC_BITS is 16 then if *lp is not null then it assigns i % MALLOC_BITS to j, which is j = 3, then it goes to find the first set bit and assign it to k, k = ffs(*lp » j);, ffs() defination as given below

 1 /* ffs -- Find the first bit set in the parameter
 2
 3 @deftypefn Supplemental int ffs (int @var{valu})
 4
 5 Find the first (least significant) bit set in @var{valu}.  Bits are
 6 numbered from right to left, starting with bit 1 (corresponding to the
 7 value 1).  If @var{valu} is zero, zero is returned.
 8
 9 @end deftypefn
10
11 */
12
13 int
14 ffs (register int valu)
15 {
16   register int bit;
17
18   if (valu == 0)
19     return 0;
20
21   for (bit = 1; !(valu & 1); bit++)
22         valu >>= 1;
23
24   return bit;
25 }

For our case,
- *lp is 0xffff and j is 3, so the outcome of operation *lp » j is 8191 and ffs(8191) is 1 which returns to k and if k != 0 then k = k + j - 1 => k = 1 + 3 - 1 => k = 3, then goto found
lp = *lp ^ 1 « k, then 0xffff ^ 1 « 0x3 => *lp = 0xfff7. Here, it sets the bits of the bitmap. Then, if bp->free is 0 then remove lists bp and decrement the bp->free value, if not 0 then also decrement the bp->free and k = k + (lp - bp->bits) * MALLOC_BITS; => k = 0xd3 (or 211). Then, check if mopts.chunk_canaries is enable and size > 0, if yes, then bp->bits[bp->offset + k] = size => bp->bits[16 + 211] = 0x8
Then, k «= bp->shift which means k = k « bp->shift => k = 0xd3 (or 211) * 16 => k = 0xd30 (or 3376). Then, calculate offset in the page, p = (char *)bp->page + k;, for our case, bp->page is 0xcde2d918000 and k is 0xd30 => p = 0xcde2d918d30. Then it checks if the bp->size > 0, if true then check for more junking through, d->malloc_junk == 2, if more junking set, then it copies SOME_JUNK to p till the bp->size, but if no more_junking option set then it checks for mopt.chunk_canaries, and if canary is enable then, fill_canary functions calls with p, size and bp->size
Here, in short, information about the offset calculations
- bp->page or pp is the page of chunks and bp is the associated meta-info
- k is the chunk number, before shiting, which means k is the index for the chunk in the page bp->page
- After shifting, k becomes the byte offset of the chunk inside the bp->page page
fill_canary() function as given below

938 static void
939 fill_canary(char *ptr, size_t sz, size_t allocated)
940 {
941         size_t check_sz = allocated - sz;
942
943         if (check_sz > CHUNK_CHECK_LENGTH)
944                 check_sz = CHUNK_CHECK_LENGTH;
945         memset(ptr + sz, SOME_JUNK, check_sz);
946 }

For our case, check_sz is 16 - 8, which further resolves down to check_sz = 8, then check for maximum chunk length and if greater than CHUNK_CHECK_LENGTH then sets the CHUNK_CHECK_LENGTH to check_sz and then copy the SOME_JUNK to ptr + sz till size check_sz and further ptr + sz becomes 0xcde2d918d38, where ptr=0xcde2d918d30 and sz=0x8 copies SOME_JUNK till check_sz which has 0x10 length. Now, if in the case of heap-overflow, if any buffer tries to write more than size sz, that is, 0x8 then it corrupts the SOME_JUNK value and that detects as heap-overflow attack and abort(). Rest about canary validation we will see on further series on malloc family calls
Then, finally it returns the page + offset address filled with canary
Now, the malloc_bytes() is completed and as we can see further in omalloc() defination, after the malloc_bytes() function call, it checks for zero_filling and also checks if p != NULL and sz > 0 and if all conditions meets then it copies zero to entire address p till size sz and returns p
coming back to malloc(size_t size), after completing the omalloc() function, it expands EPILOGUE() code. Following the code explains about the EPILOGUE() macro

1269 #define EPILOGUE()                              \
1270         d->active--;                            \
1271         _MALLOC_UNLOCK(d->mutex);               \
1272         if (r == NULL && mopts.malloc_xmalloc)  \
1273                 wrterror(d, "out of memory");   \
1274         if (r != NULL)                          \
1275                 errno = saved_errno;            \

above code shows what EPILOGUE() does
- It decrements the active count
- Unlock the locked stuff
- Then, it checks if r is NULL and also checks for mopts.malloc_xmalloc then it “prints out of memory” as error and abort() but if r is not NULL then it saves saved_errno to errno variable and completes the epilogue() process

1277 void *
1278 malloc(size_t size)
1279 {
1280         void *r;
1281         struct dir_info *d;
1282         int saved_errno = errno;
1283
1284         PROLOGUE(getpool(), "malloc")
1285         r = omalloc(d, size, 0, CALLER);
1286         EPILOGUE()
1287         return r;
1288 }

after EPILOGUE(), it returns the r, which has the address value, 0xcde2d918d30, from the malloc_bytes():L1024 - (char *)bp->page + k
coming back to our sample code we have buff1 = (char *)malloc(8); and after that it copies the user controlled input to buff1 through vulnerable string function, strcpy() and then calls free(buff1).

Sample code showing the canary overwrite and detection:

openbsd# LD_PRELOAD=/usr/src/lib/libc/obj/libc.so.95.1 gdb -q sample
(gdb) br main
Breakpoint 1 at 0x1363: file sample.c, line 7.
(gdb) r AAAABBBBCCCCDDDD
Starting program: /root/test/sample AAAABBBBCCCCDDDD
Breakpoint 1 at 0x4517aff7363: file sample.c, line 7.
Error while reading shared library symbols:
Dwarf Error: wrong version in compilation unit header (is 4, should be 2) [in module /usr/libexec/ld.so]

Breakpoint 1, main (argc=2, argv=0x7f7ffffee678) at sample.c:7
7		char *buff1 = NULL;
Current language:  auto; currently minimal
(gdb) n
8		buff1 = (char *)malloc(8);
(gdb) n
9		strcpy(buff1, argv[1]);
(gdb) x/16x buff1
0x453ec9b6fe0:	0x00000000	0x00000000	0xdbdbdbdb	0xdbdbdbdb
0x453ec9b6ff0:	0x00000000	0x00000000	0x00000000	0x00000000
0x453ec9b7000:	Cannot access memory at address 0x453ec9b7000
(gdb) n
10		free(buff1);
(gdb) x/16x buff1
0x453ec9b6fe0:	0x41414141	0x42424242	0x43434343	0x44444444
0x453ec9b6ff0:	0x00000000	0x00000000	0x00000000	0x00000000
0x453ec9b7000:	Cannot access memory at address 0x453ec9b7000
(gdb) c
Continuing.
sample(3165) in free(): chunk canary corrupted 0x453ec9b6fe0 0x8@0x8

Program received signal SIGABRT, Aborted.
thrkill () at -:3
3	-: No such file or directory.
	in -
Current language:  auto; currently asm
(gdb)

From the above debugging, we can see that just after the malloc(3) allocation there are canaries with 0xdb bytes, which is filled by the fill_canary() which we have already seen and understood.
Then, after the memory allocation that is explained above, it copies the user controlled input to that memory area and after giving string AAAABBBBCCCCDDDD, we can see that the canaries are corrupted as it has overwritten the 0xdb bytes with the 0x43 and 0x44 which is C and D then next it calls free(buff1), which is responsible to validate canaries and calls abort() if corrupted with the information like chunk address and size.
So, validation of canaries in user-related chunk is validated in free() which we will cover in the further series of malloc(3) friends library calls

References:

malloc(3) man page
OpenBSD community - mailing list
A new malloc(3) for OpenBSD slides by Otto Moerbeek
BSD Heap Smashing, paper by bbp@krukh.net on phkmalloc [from security point of view]
GitHub code history for old commit messages
information on all the commits in mailing list
phkmalloc, paper by Poul-Henning Kamp
malloc(3) code series by Adam Wolk and @DuClare
discussions on twitter with developers
Google :)

Finally!! It was a bit long journey. If something is missing or not correct, please feel free to update.

Again, a huge thanks to all OpenBSD community and especially Otto@ for helping me to understand the malloc internals and patiently listening my queries :).

Happy Kernel Hacking

OpenBSD kernel internals - Lifecycle of process from user-space to kernel space :: creation

Thu, 25 Oct 2018 18:24:23 +0000

Hi there,

Have you ever thought what happens internally when we execute any command/executable from the command line?

We will be diving in to the ocean of kernel code internals and working of the process lifecycle (creation) in OpenBSD operating system from user-space to kernel space.

We will execute the ls command from the command line then trace it through the debugger to see the magic.

Following are the basic lifecycle of a process,

creation
execution
exit

For this blog, we will be limiting the focuss to only the creation of the process.

Debugger used: GDB to debug the kernel code.

Whenever we execute any command from the cli, for example ls, the parent process is ksh because the default shell on OpenBSD is ksh which invokes ls command or any other command.

So mostly, every process is created by sys_fork() function responsible for creating new processes (child process) which further calls fork1(9) function:

based on man-page fork1(9) — OpenBSD kernel developer’s manual

#include <sys/types.h>
#include <sys/proc.h>

int
fork1(struct proc *p1, int flags, void (*func)(void *), void *arg, register_t *retval, struct proc **rnewprocp);

fork1(9) creates a new process out of p1, which should be the current thread. This function is used primarily to implement the fork(2) and vfork(2) system calls, as well as the kthread_create(9) function.

Life cycle of a process (in brief):

“ls” → fork(2) → sys_fork() → fork1() → sys_execve() → sys_exit() → exit1()

working of fork1(): after “ls” from user-space it goes to fork() from libc and then from there to sys_fork()

int
sys_fork(struct proc *p, void *v, register_t *retval)
{
    int flags;

    flags = FORK_FORK;
    if (p->p_p->ps_ptmask & PTRACE_FORK)
        flags |= FORK_PTRACE;
    return fork1(p, flags, fork_return, NULL, retval, NULL);
}

FORK_FORK: It is a macro which defines that the call is done by the fork(2). Used only for statistics.

#define FORK_FORK 0x00000001
So, the value of “flags” variable is set to 1 , because the call is done by fork(2)
check for PTRACE and if enable then update the flags with FORK_PTRACE else leave it and return to the fork1()

fork1() initial code

int
fork1(struct proc *curp, int flags, void (*func)(void *), void *arg,
    register_t *retval, struct proc **rnewprocp)
{
    struct process *curpr = curp->p_p;
    struct process *pr;
    struct proc *p;
    uid_t uid = curp->p_ucred->cr_ruid;
    struct vmspace *vm;
    int count;
    vaddr_t uaddr;
    int error;
    struct  ptrace_state *newptstat = NULL;

    KASSERT((flags & ~(FORK_FORK | FORK_VFORK | FORK_PPWAIT | FORK_PTRACE
        | FORK_IDLE | FORK_SHAREVM | FORK_SHAREFILES | FORK_NOZOMBIE
        | FORK_SYSTEM | FORK_SIGHAND)) == 0);
    KASSERT((flags & FORK_SIGHAND) == 0 || (flags & FORK_SHAREVM));
    KASSERT(func != NULL);

    if ((error = fork_check_maxthread(uid)))
        return error;

    if ((nprocesses >= maxprocess - 5 && uid != 0) ||
        nprocesses >= maxprocess) {
        static struct timeval lasttfm;

        if (ratecheck(&lasttfm, &fork_tfmrate))
            tablefull("process");
        nthreads--;
        return EAGAIN;
    }
    nprocesses++;
...
...
...

From the above code-snippet, curp->p_p->ps_comm is “ksh”, which is a parent process that will fork “ls”
Initially some process structures, then, setting uid = curp->p_ucred->cr_ruid
Then, the structure for process address space information
Then, some variables and ptrace_state structure and then the condition which is checking for flag values using KASSERT.
fork_check_maxthread(uid): it is used to the check or track the number of threads invoked by the specific uid
It checks the number of threads invoked by specific uid shouldn’t be greater than the number of maximum threads allowed or for maxthread 5 because the last 5 process from the maxthread is reserved for the root
If it is greater than defined maxthread or maxthread — 5, it will print the messagetablefullonce every 10 seconds. Else, it will increment the number of threads

Defination of fork_check_maxthread(uid)

int
fork_check_maxthread(uid_t uid)
{
    /*
     * Although process entries are dynamically created, we still keep
     * a global limit on the maximum number we will create. We reserve
     * the last 5 processes to root. The variable nprocesses is the
     * current number of processes, maxprocess is the limit.  Similar
     * rules for threads (struct proc): we reserve the last 5 to root;
     * the variable nthreads is the current number of procs, maxthread is
     * the limit.
     */
    if ((nthreads >= maxthread - 5 && uid != 0) || nthreads >= maxthread) {
        static struct timeval lasttfm;

        if (ratecheck(&lasttfm, &fork_tfmrate))
            tablefull("proc");
        return EAGAIN;
    }
    nthreads++;

    return 0;
}

after fork_check_thread(), similar code logic is implemented for tracking process as visible from the fork1(9) defination

fork1(9) defination continued…

...
...
    /*
     * Increment the count of processes running with this uid.
     * Don't allow a nonprivileged user to exceed their current limit.
     */
    count = chgproccnt(uid, 1);
    if (uid != 0 && count > lim_cur(RLIMIT_NPROC)) {
        (void)chgproccnt(uid, -1);
        nprocesses--;
        nthreads--;
        return EAGAIN;
    }

    uaddr = uvm_uarea_alloc();
    if (uaddr == 0) {
        (void)chgproccnt(uid, -1);
        nprocesses--;
        nthreads--;
        return (ENOMEM);
    }

    /*
     * From now on, we're committed to the fork and cannot fail.
     */
    p = thread_new(curp, uaddr);
    pr = process_new(p, curpr, flags);

    p->p_fd     = pr->ps_fd;
    p->p_vmspace    = pr->ps_vmspace;
    if (pr->ps_flags & PS_SYSTEM)
        atomic_setbits_int(&p->p_flag, P_SYSTEM);

    if (flags & FORK_PPWAIT) {
        atomic_setbits_int(&pr->ps_flags, PS_PPWAIT);
        atomic_setbits_int(&curpr->ps_flags, PS_ISPWAIT);
    }
...
...

It is changing the count of threads for a specific user via chgproccnt(uid,1) and the defination given below:

/*
 * Change the count associated with number of threads
 * a given user is using.
 */
int
chgproccnt(uid_t uid, int diff)
{
    struct uidinfo *uip;
    long count;

    uip = uid_find(uid);
    count = (uip->ui_proccnt += diff);
    uid_release(uip);
    if (count < 0)
        panic("chgproccnt: procs < 0");
    return count;
}

struct uidinfo structure maintains every uid resource consumption counts including the process count and socket buffer space usage.
uid_find(uid) function looks up and returns the uidinfo structure for uid. If no uidinfo structure exists for uid, a new structure will be allocated and initialized.
Then, it increments the number of processes, that is, ui_proccnt by diff then returns count. coming back to fork1(9) code after chgproccnt(), it checks for the non-privileged “uid” and also checks for the number of process is greater than the soft limit of resources which is 0x7fffffffffffffff based on the observation through debugging.
If non-privileged is allowed and the count is increased by the maximum resource limit, it will decrease the count via chgproccnt() by passing -1 as diff parameter and also decrease the number of processes and threads.
Next, uvm_uarea_alloc() function allocates a thread’s uarea, the memory where its kernel stack and PCB are stored.
Now, it checks if the “uaddr” variable doesn’t contain any thread’s address, if it is zero, then it decrements the count of the number of process and thread.
there are some important functions:
- thread_new(struct proc *parent, vaddr_t uaddr)
- process_new(struct proc *p, struct process *parent, int flags)

/*
* Allocate and initialize a thread (proc) structure, given the parent thread.
*/
struct proc *
thread_new(struct proc *parent, vaddr_t uaddr)
{
   struct proc *p; 

   p = pool_get(&proc_pool, PR_WAITOK);
   p->p_stat = SIDL;           /* protect against others */
   p->p_flag = 0;
   p->p_limit = NULL;

   /*
    * Make a proc table entry for the new process.
    * Start by zeroing the section of proc that is zero-initialized,
    * then copy the section that is copied directly from the parent.
    */
   memset(&p->p_startzero, 0,
       (caddr_t)&p->p_endzero - (caddr_t)&p->p_startzero);
   memcpy(&p->p_startcopy, &parent->p_startcopy,
       (caddr_t)&p->p_endcopy - (caddr_t)&p->p_startcopy);
   crhold(p->p_ucred);
   p->p_addr = (struct user *)uaddr;

   /*
    * Initialize the timeouts.
    */
   timeout_set(&p->p_sleep_to, endtsleep, p);

   /*
    * set priority of child to be that of parent
    * XXX should move p_estcpu into the region of struct proc which gets
    * copied.
    */
   scheduler_fork_hook(parent, p);

#ifdef WITNESS
   p->p_sleeplocks = NULL;
#endif

#if NKCOV > 0
   p->p_kd = NULL;
#endif

   return p;
}
       }

in the thread_new(), we will get our user-space process, that is, in our case “ls”. The process gets retrieved from the pool of processess, that is, proc_pool through pool_get() function.
then, we set the state of the thread to be SIDL , which means that the process/thread is being created by fork(2), then set p→p_flag = 0
then, it zeroes the section of “proc”. the below code snippet from “sys/proc.h”

/* The following fields are all zeroed upon creation in fork. */
#define p_startzero p_dupfd
    int p_dupfd;     /* Sideways return value from filedescopen. XXX */

    long    p_thrslpid; /* for thrsleep syscall */

    /* scheduling */
    u_int   p_estcpu;       /* [s] Time averaged val of p_cpticks */
    int p_cpticks;   /* Ticks of cpu time. */
    const volatile void *p_wchan;   /* [s] Sleep address. */
    struct  timeout p_sleep_to;/* timeout for tsleep() */
    const char *p_wmesg;        /* [s] Reason for sleep. */
    fixpt_t p_pctcpu;       /* [s] %cpu for this thread */
    u_int   p_slptime;      /* [s] Time since last blocked. */
    u_int   p_uticks;       /* Statclock hits in user mode. */
    u_int   p_sticks;       /* Statclock hits in system mode. */
    u_int   p_iticks;       /* Statclock hits processing intr. */
    struct  cpu_info * volatile p_cpu; /* [s] CPU we're running on. */

    struct  rusage p_ru;        /* Statistics */
    struct  tusage p_tu;        /* accumulated times. */
    struct  timespec p_rtime;   /* Real time. */

    int  p_siglist;     /* Signals arrived but not delivered. */

/* End area that is zeroed on creation. */

the above code snippet: all the variables will be zeroed via memset() upon creation in the fork. then, they are copying the section from parent→p_startcopy to p→p_startcopy using memcpy. Following are the field members that will be copied.

#define p_startcopy p_sigmask
    sigset_t p_sigmask; /* Current signal mask. */

    u_char  p_priority; /* [s] Process priority. */
    u_char  p_usrpri;   /* [s] User-prio based on p_estcpu & ps_nice. */
    int p_pledge_syscall;   /* Cache of current syscall */

    struct  ucred *p_ucred;     /* cached credentials */
    struct  sigaltstack p_sigstk;   /* sp & on stack state variable */

    u_long  p_prof_addr;    /* tmp storage for profiling addr until AST */
    u_long  p_prof_ticks;   /* tmp storage for profiling ticks until AST */

/* End area that is copied on creation. */
#define p_endcopy   p_addr

coming back to thread_new(), crhold(p->p_ucred) functions will increment the reference count in struct ucred structure, that is, p->p_ucred->cr_ref++.
then, typecast the thread’s addr, that is, (struct user *)uaddr and save it in kernel’s virtual addr of u-area.
Now, it will initialize the timeout.
dummy function to show the timeout_set function working. timeout_set(timeout, b, argument);:

void
timeout_set(struct timeout *new, void (*fn)(void *), void *arg)
{
        new->to_func = fn;
        new->to_arg = arg;
        new->to_flags = TIMEOUT_INITIALIZED;
}

above function will initialize the timeout struture and call the function b with argument.
scheduler_fork_hook(parent, p): It is a macro which will update the p_estcpu of child from parent’s p_estcpu.
p_estcpu holds an estimate of the amount of CPU that the process has used recently

/* Inherit the parent’s scheduler history */
#define scheduler_fork_hook(parent, child) do {    \
 (child)->p_estcpu = (parent)->p_estcpu;           \
} while (0)

then, return the newly created thread p.
another important function is process_new() which creates the process in a similar fashion like thread_new().

Defination of process_new():

/*
 * Allocate and initialize a new process.
 */
struct process *
process_new(struct proc *p, struct process *parent, int flags)
{
    struct process *pr;

    pr = pool_get(&process_pool, PR_WAITOK);

    /*
     * Make a process structure for the new process.
     * Start by zeroing the section of proc that is zero-initialized,
     * then copy the section that is copied directly from the parent.
     */
    memset(&pr->ps_startzero, 0,
        (caddr_t)&pr->ps_endzero - (caddr_t)&pr->ps_startzero);
    memcpy(&pr->ps_startcopy, &parent->ps_startcopy,
        (caddr_t)&pr->ps_endcopy - (caddr_t)&pr->ps_startcopy);

    process_initialize(pr, p);
    pr->ps_pid = allocpid();
    lim_fork(parent, pr);

    /* post-copy fixups */
    pr->ps_pptr = parent;

    /* bump references to the text vnode (for sysctl) */
    pr->ps_textvp = parent->ps_textvp;
    if (pr->ps_textvp)
        vref(pr->ps_textvp);

    /* copy unveil if unveil is active */
    unveil_copy(parent, pr);

    pr->ps_flags = parent->ps_flags &
        (PS_SUGID | PS_SUGIDEXEC | PS_PLEDGE | PS_EXECPLEDGE | PS_WXNEEDED);
    if (parent->ps_session->s_ttyvp != NULL)
        pr->ps_flags |= parent->ps_flags & PS_CONTROLT;
...
...
}

the initials of process_new() is similar to thread_new() like select process from process_pool via pool_get() then zeroing using memset and copying using memcpy. Next, the initialization of process using process_initialize(), defination as given below:

/*
 * Initialize common bits of a process structure, given the initial thread.
 */
void
process_initialize(struct process *pr, struct proc *p)
{
    /* initialize the thread links */
    pr->ps_mainproc = p;
    TAILQ_INIT(&pr->ps_threads);
    TAILQ_INSERT_TAIL(&pr->ps_threads, p, p_thr_link);
    pr->ps_refcnt = 1;
    p->p_p = pr;

    /* give the process the same creds as the initial thread */
    pr->ps_ucred = p->p_ucred;
    crhold(pr->ps_ucred);
    KASSERT(p->p_ucred->cr_ref >= 2);   /* new thread and new process */

    LIST_INIT(&pr->ps_children);
    LIST_INIT(&pr->ps_ftlist);
    LIST_INIT(&pr->ps_kqlist);
    LIST_INIT(&pr->ps_sigiolst);

    mtx_init(&pr->ps_mtx, IPL_MPFLOOR);

    timeout_set(&pr->ps_realit_to, realitexpire, pr);
    timeout_set(&pr->ps_rucheck_to, rucheck, pr);
}

process_initialize() internals:

ps_mainproc : It is the original and main thread in the process. It’s only special for handling of p_xstat, some signals and ptrace behaviours that need to be fixed.
Copy initial thread, that is, p to pr->mainproc
Initialize the queue with referenced by head. Here, head is pr→ps_threads. Then, Insert “elm” at the TAIL of the queue. Here, elm is p .
set the number of references to 1, that is, pr->ps_refcnt = 1
copy the process pr to the process of initial thread.
set the same creds for process as the initial thread.
condition check for the new thread and the new process via KASSERT.
Initialize the List referenced by head. Here, head is pr->ps_children
Again, initialize timeout. (for detail, see thead_new)
after the process initialization, pid allocation takes place. ps→ps_pid = allocpid(); where allocpid() returns unused pid
allocpid() internally calls the arc4random_uniform() which further calls arc4random() then through arc4random() a completely randomized number is returned which is used as pid.
then, for the availability of pid (or for unused pid) it verifies that whether the new pid is already taken or not by any process. It verifies this one by one in the process, process groups, and zombie process by using function ispidtaken(pid_t pid) which internally calls following functions:
- prfind(pid_t pid) : Locate a process by number
- pgfind(pid_t pgid) : Locate a process group by number
- zombiefind(pid_t pid :Locate a zombie process by number

/*
 * Checks for current use of a pid, either as a pid or pgid.
 */
pid_t oldpids[128];
int
ispidtaken(pid_t pid)
{
    uint32_t i;

    for (i = 0; i < nitems(oldpids); i++)
        if (pid == oldpids[i])
            return (1);

    if (prfind(pid) != NULL)
        return (1);
    if (pgfind(pid) != NULL)
        return (1);
    if (zombiefind(pid) != NULL)
        return (1);
    return (0);
}

/* Find an unused pid */
pid_t
allocpid(void)
{
    static pid_t lastpid;
    pid_t pid;

    if (!randompid) {
        /* only used early on for system processes */
        pid = ++lastpid;
    } else {
        /* Find an unused pid satisfying lastpid < pid <= PID_MAX */
        do {
            pid = arc4random_uniform(PID_MAX - lastpid) + 1 +
                lastpid;
        } while (ispidtaken(pid));
    }

    return pid;
}

store the pointer to parent process in pr→ps_pptr
Increment the number of references count in process limit structure, that is, struct plimit
Store the vnode of executable of parent into pr→ps_textvp ,that is,pr→ps_textvp = parent→ps_textvp;

if (pr→ps_textvp)
        vref(pr→ps_textvp); /* vref --> vnode reference */

above code snippet means, if valid vnode found then increment the v_usecount++ variable inside the struct vnode structure of the executable. Now, the calculation for setting up process flags:

pr→ps_flags = parent →ps_flags & (PS_SUGID | PS_SUGIDEXEC | PS_PLEDGE | PS_EXECPLEDGE | PS_WXNEEDED);
pr →ps_flags = parent →ps_flags & (0x10 | 0x20 | 0x100000 | 0x400000 | 0x200000)
if (vnode of controlling terminal != NULL)
        pr→ps_flags |= parent→ps_flags & PS_CONTROLT;

process_new() continued…

    /*
     * Duplicate sub-structures as needed.
     * Increase reference counts on shared objects.
     */
    if (flags & FORK_SHAREFILES)
        pr->ps_fd = fdshare(parent);
    else
        pr->ps_fd = fdcopy(parent);
    if (flags & FORK_SIGHAND)
        pr->ps_sigacts = sigactsshare(parent);
    else
        pr->ps_sigacts = sigactsinit(parent);
    if (flags & FORK_SHAREVM)
        pr->ps_vmspace = uvmspace_share(parent);
    else
        pr->ps_vmspace = uvmspace_fork(parent);

    if (parent->ps_flags & PS_PROFIL)
        startprofclock(pr);
    if (flags & FORK_PTRACE)
        pr->ps_flags |= parent->ps_flags & PS_TRACED;
    if (flags & FORK_NOZOMBIE)
        pr->ps_flags |= PS_NOZOMBIE;
    if (flags & FORK_SYSTEM)
        pr->ps_flags |= PS_SYSTEM;

    /* mark as embryo to protect against others */
    pr->ps_flags |= PS_EMBRYO;

    /* Force visibility of all of the above changes */
    membar_producer();

    /* it's sufficiently inited to be globally visible */
    LIST_INSERT_HEAD(&allprocess, pr, ps_list);

    return pr;
}

if-else conditions explained:

- if child_able_to_share_file_descriptor_table_with_parent:
         pr->ps_fd = fdshare(parent)      /* share the table */
  else
         pr->ps_fd = fdcopy(parent)       /* copy the table */
- if child_able_to_share_the_parent's_signal_actions:
         pr->ps_sigacts = sigactsshare(parent) /* share */
  else
         pr->ps_sigacts = sigactsinit(parent)  /* copy */
- if child_able_to_share_the_parent's addr space:
         pr->ps_vmspace = uvmspace_share(parent)
  else
         pr->ps_vmspace = uvmspace_fork(parent)
- if process_able_to_start_profiling:
         smartprofclock(pr);    /* start profiling on a process */
- if check_child_able_to_start_ptracing:
         pr->ps_flags |= parent->ps_flags & PS_PTRACED
- if check_no_signal_or_zombie_at_exit:
         pr->ps_flags |= PS_NOZOMBIE /*No signal or zombie at exit */
- if check_signals_stat_swaping:
         pr->ps_flags |= PS_SYSTEM

update the pr→ps_flags with PS_EMBRYO by ORing it, that is, pr→ps_flags |= PS_EMBRYO /* New process, not yet fledged */

membar_producer() → Force visibility of all of the above changes. - All stores preceding the memory barrier will reach global visibility before any stores after the memory barrier reach global visibility.

In short, as per my understanding based on the discussion with OpenBSD community, it means forcefully make visible changes globally.

Insert the new element, that is, pr at the head of the list. Here, head is allprocess and returns pr

fork1() code continued…

...
...
...
    p->p_fd     = pr->ps_fd;
    p->p_vmspace    = pr->ps_vmspace;
    if (pr->ps_flags & PS_SYSTEM)
        atomic_setbits_int(&p->p_flag, P_SYSTEM);

    if (flags & FORK_PPWAIT) {
        atomic_setbits_int(&pr->ps_flags, PS_PPWAIT);
        atomic_setbits_int(&curpr->ps_flags, PS_ISPWAIT);
    }

#ifdef KTRACE
    /*
     * Copy traceflag and tracefile if enabled.
     * If not inherited, these were zeroed above.
     */
    if (curpr->ps_traceflag & KTRFAC_INHERIT)
        ktrsettrace(pr, curpr->ps_traceflag, curpr->ps_tracevp,
            curpr->ps_tracecred);
#endif

    /*
     * Finish creating the child thread.  cpu_fork() will copy
     * and update the pcb and make the child ready to run.  If
     * this is a normal user fork, the child will exit directly
     * to user mode via child_return() on its first time slice
     * and will not return here.  If this is a kernel thread,
     * the specified entry point will be executed.
     */
    cpu_fork(curp, p, NULL, NULL, func, arg ? arg : p);

    vm = pr->ps_vmspace;

    if (flags & FORK_FORK) {
        forkstat.cntfork++;
        forkstat.sizfork += vm->vm_dsize + vm->vm_ssize;
    } else if (flags & FORK_VFORK) {
        forkstat.cntvfork++;
        forkstat.sizvfork += vm->vm_dsize + vm->vm_ssize;
    } else {
        forkstat.cntkthread++;
    }

    if (pr->ps_flags & PS_TRACED && flags & FORK_FORK)
        newptstat = malloc(sizeof(*newptstat), M_SUBPROC, M_WAITOK);

    p->p_tid = alloctid();

    LIST_INSERT_HEAD(&allproc, p, p_list);
    LIST_INSERT_HEAD(TIDHASH(p->p_tid), p, p_hash);
    LIST_INSERT_HEAD(PIDHASH(pr->ps_pid), pr, ps_hash);
    LIST_INSERT_AFTER(curpr, pr, ps_pglist);
    LIST_INSERT_HEAD(&curpr->ps_children, pr, ps_sibling);

Substructures p→p_fd and p→p_vmspace directly copied values of pr→ps_fd and pr→ps_vmspace

/* substructures: */
struct filedesc *p_fd;      /* copy of p_p->ps_fd */
struct vmspace *p_vmspace;  /* copy of p_p->ps_vmspace */

if (process_has_no_signals_stats_or_swapping) then atomically set bits using atomic_setbits_int(pr →ps_flags, PS_SYSTEM);

if (child_is_suspending_the_parent_process_until_the_child_is terminated (by calling _exit(2) or abnormally), or makes a call to execve(2)) then atomically set bits, atomic_setbits_int(pr →ps_flags, PS_PPWAIT); atomic_setbits_int(pr →ps_flags, PS_ISPWAIT);

#ifdef KTRACE
/* Some KTRACE related things */
#endif
cpu_fork(curp, p, NULL, NULL, func, arg ?arg: p)

/*
 * Finish creating the child thread. cpu_fork() will copy
 * and update the pcb and make the child ready to run. The
 * child will exit directly to user mode via child_return()
 * on its first time slice and will not return here.
 */

to create or update PCB and make child ready to RUN.

Address space vm = pr→ps_vmspace

if (call is done by fork syscall); then
    increment the number of fork() system calls.
    update the vm_pages affected by fork() syscall with addition of data page and stack page. 
else if (call is done by vfork() syscall); then
    do as same as if it was fork syscall but for vfork system call. (see above if {for fork})
else
    increment the number of kernel threads created.

If (process is being traced && created by fork system call);then
{
    The malloc() function allocates the uninitialized memory in the kernel address space for an object whose size is specified by size, that is, here, sizeof(*newptstat). And, struct ptrace_state *newptstat
}

allocate thread ID, that is, p→p_tid = alloctid();

/* Find an unused tid */
pid_t
alloctid(void)
{
    pid_t tid;

    do {
        /* (0 .. TID_MASK+1] */
        tid = 1 + (arc4random() & TID_MASK);
    } while (tfind(tid) != NULL);

    return (tid);
}

calling arc4random() directly and using tfind function for finding the thread ID by number

inserts the new element p at the head of the allprocess list
insert the new element p at the head of the thread hash list
insert the new element pr at the head of the process hash list
insert the new element pr after the curpr element
insert the new element pr at the head of the children process list

fork1() continued…


    if (pr->ps_flags & PS_TRACED) {
        pr->ps_oppid = curpr->ps_pid;
        if (pr->ps_pptr != curpr->ps_pptr)
            proc_reparent(pr, curpr->ps_pptr);

        /*
         * Set ptrace status.
         */
        if (newptstat != NULL) {
            pr->ps_ptstat = newptstat;
            newptstat = NULL;
            curpr->ps_ptstat->pe_report_event = PTRACE_FORK;
            pr->ps_ptstat->pe_report_event = PTRACE_FORK;
            curpr->ps_ptstat->pe_other_pid = pr->ps_pid;
            pr->ps_ptstat->pe_other_pid = curpr->ps_pid;
        }
    }

    /*
     * For new processes, set accounting bits and mark as complete.
     */
    getnanotime(&pr->ps_start);
    pr->ps_acflag = AFORK;
    atomic_clearbits_int(&pr->ps_flags, PS_EMBRYO);

    if ((flags & FORK_IDLE) == 0)
        fork_thread_start(p, curp, flags);
    else
        p->p_cpu = arg;

    free(newptstat, M_SUBPROC, sizeof(*newptstat));

    /*
     * Notify any interested parties about the new process.
     */
    KNOTE(&curpr->ps_klist, NOTE_FORK | pr->ps_pid);

    /*
     * Update stats now that we know the fork was successful.
     */
    uvmexp.forks++;
    if (flags & FORK_PPWAIT)
        uvmexp.forks_ppwait++;
    if (flags & FORK_SHAREVM)
        uvmexp.forks_sharevm++;

    /*
     * Pass a pointer to the new process to the caller.
     */
    if (rnewprocp != NULL)
        *rnewprocp = p;
If (isProcessPTRACED())
{
    then save the parent process id during ptracing, that is, 
    pr→ps_oppid = curpr→ps_pid
    If (pointer to parent process_of_child != pointer to parent process_of_current_process)
    {
        proc_reparent(pr, curpr→ps_pptr); /* Make current process the new parent of process child, that is, pr*/
    }
}

Now, check whether newptstat contains some address, in our case, newptstat contains a kernel virtual address returned by malloc(9)

If above condition is true, that is, newptstat != NULL . Then, set the ptrace status:

Set newptstat point to the ptrace state structure then make the newptstat point to NULL
Update the ptrace status to the curpr process and also the pr process.

curpr->ps_ptstat->pe_report_event = PTRACE_FORK;
pr->ps_ptstat->pe_report_event = PTRACE_FORK;
curpr->ps_ptstat->pe_other_pid = pr->ps_pid;
pr->ps_ptstat->pe_other_pid = curpr->ps_pid;

for the new process set accounting bits and mark it as complete.

get the nano time to start the process.
Set accounting flags to AFORK which means forked but not execed.
atomically clear the bits.
Then, check for the new child is in the IDLE state or not, if yes then make it runnable and add it to the run queue by fork_thread_start()
If it is not in the IDLE state then put arg to the current CPU, running on
Freeing the memory or kernel virtual address that is allocated by malloc for newptstat through free

Notify any interested parties about the new process via KNOTE

Now, update the stats counter for successfully forked

        uvmexp.forks++; /* -->For forks */ 

        if (flags & FORK_PPWAIT)
                uvmexp.forks_ppwait++; /* --> counter for forks where parent waits */
        if (flags & FORK_SHAREVM)
                uvmexp.forks_sharevm++; /* --> counter for forks where vmspace is shared */

Now, pass pointer of the new process to the caller.

if (rnewprocp != NULL)
        *rnewprocp = p;
    /*
     * Preserve synchronization semantics of vfork.  If waiting for
     * child to exec or exit, set PS_PPWAIT on child and PS_ISPWAIT
     * on ourselves, and sleep on our process for the latter flag
     * to go away.
     * XXX Need to stop other rthreads in the parent
     */
    if (flags & FORK_PPWAIT)
        while (curpr->ps_flags & PS_ISPWAIT)
            tsleep(curpr, PWAIT, "ppwait", 0);

    /*
     * If we're tracing the child, alert the parent too.
     */
    if ((flags & FORK_PTRACE) && (curpr->ps_flags & PS_TRACED))
        psignal(curp, SIGTRAP);

    /*
     * Return child pid to parent process
     */
    if (retval != NULL) {
        retval[0] = pr->ps_pid;
        retval[1] = 0;
    }
    return (0);
}

setting the PPWAIT on child and the PS_ISPWAIT on ourselves, that is, the parent and then go to the sleep on our process via tsleep Check, If the child is started with tracing enables && the current process is being traced then alert the parent by using SIGTRAP signal Now, return the child pid to the parent process then we can see in the debugger that after the fork1, it jumps to sys/arch/amd64/amd64/trap.c file for system call handling and for the setting frame.

Some of the machine independent (MI) functions defined in sys/sys/syscall_mi.h file, like, mi_syscall(), mi_syscall_return() and mi_child_return().

after handling the system calls from “trap.c”, control pass to the sys_execve() system call

References:

OpenBSD Source Codes
OpenBSD kernel Internals — The Hitchhiker’s Guide
OpenBSD manual pages
BSD Virtual Memory
NetBSD manual pages
FreeBSD manual pages
Understanding The Linux Kernel
Linux Kernel Development - Robert Love
Google :)

Finally!! If something is missing or not correct, please feel free to update.

Happy Kernel Hacking

OpenBSD - short intro on “execpromises” in the pledge(2)

Tue, 02 Oct 2018 18:24:12 +0000

Hi there,

Today, we will be looking at the update for pledge(2) on OpenBSD and also about howto and usecase.

In the previous post about pledge(2), we understood the implementation and some internal working of pledge(2)

On 11 December 2017, **Theo de Raadt** said:

        List: openbsd-tech
        Subject: pledge execpromises
        From: Theo de Raadt 
        Date: 2017-12-11 21:20:51
        Message-ID: 6735.1513027251 () cvs ! openbsd ! org

        This will probably be committed in the next day or so.

        The 2nd argument of pledge() becomes execpromises, which is what
        will gets activated after execve.

        There is also a small new feature called “error”, which causes
        violating system calls to return -1 with ENOSYS rather than killing
        the process. This must be used with EXTREME CAUTION because libraries
        and programs are full of unchecked system calls. If you carry on past
        one of these failures, your program is in uncharted territory and
        risks of exploitation become high.

        “error” is being introduced for a different reason: The pre-exec
        process’s expectation of what the post-exec process will do might
        mismatch, so “error” allows things like starting an editor which has
        no network access or maybe other restrictions in the future...

    cvsweb.openbsd.org
OpenBSD 6.2-stable

pledge(2):

#include <unistd.h>
int pledge(const char *promises, const char *paths[]);

updated pledge(2):

#include <unistd.h>
int pledge(const char *promises, const char *execpromises);

the latest update introduces the second parameter for execpromises which are used to provide promises on child process which is invoked using the combination of execve(2) and fork(2)

execve(2):

#include <unistd.h>
int execve(const char *file, char *const argv[], char *const envp[]);

Description of exec-family syscalls:

Like all of the exec functions, execve replaces the calling process image with a new process image. This has the effect of running a new program with the process ID of the calling process. Note that a new process is not started; the new process image simply overlays the original process image. The execve function is most commonly used to overlay a process image that has been created by a call to the fork function.

Return value:

A successful call to execve does not have a return value because the new process image overlays the calling process image. However, a -1 is returned if the call to execve is unsuccessful. consider following example implementation

// cat test_parent1.c

#include <stdio.h>
#include <unistd.h>

int main (int argc, char **argv)
{
    if(pledge("stdio exec","stdio rpath") == -1)
    {
        err(1,"parent pledge");
    }

    printf ("Parent: Hello, World!\n");
    char *arg[] = { "./child", 0, 0, 0 };
    execve(arg[0], &arg[0], NULL);
    return 0;
}

// cat test_child1.c

#include <stdio.h>
#include <stdlib.h>

int main (int argc, char **argv)
{
    printf("child process\n");

    while(1) {}
    return 0;
}

# gcc -o parent test_parent1.c
# gcc -o child test_child1.c

# ./parent &
[1] 80962
# Parent: Hello, World!

# dmesg|grep 80962
process_name:  child    pid:  80962    ps_pledge:  9
process_name:  child    pid:  80962    ps_pledge:  9
As from above code, we have seen that pledge value of the new execve image is 9, that is;

#cat sys/pledge.h

#define PLEDGE_RPATH 0x0000000000000001ULL /* allow open for read */

#define PLEDGE_STDIO 0x0000000000000008ULL /* operate on own pid */

pledge for new execve image:

(RPATH)              (STDIO)                (NEW PLEDGE) 
0x0000000000000001 | 0x0000000000000008 = 0x0000000000000009

So, better to use fork(2) with the combination of execve(2), so that, execve(2) will overlay forked process’s image, not parent’s image

This update on the pledge(2) is one step further towards improving OS security in OpenBSD

If something is missing or not correct, please feel free to update.

pledge(2): OpenBSD’s defensive approach to OS Security

Wed, 01 Aug 2018 18:24:39 +0000

Hello there,

I would like to introduce you all to the pledge(2) which is used to restrict the system operations and supported only on OpenBSD at the time of writing the blog.

I am learning about OpenBSD kernel internals and development and would like to share some tips on how to learn about OpenBSD kernel internals and development.

Following materials I followed while learning about BSD kernel internals:

the book “The design and implementation of the BSD operating system” by Kirk McKusick
OpenBSD source code
man pages and few presentations-papers on OpenBSD
ask in mailing lists and OpenBSD Facebook group.

What is pledge(2)?

“pledge” refers to “a solemn promise or undertaking”

So, as in OpenBSD context:

Calling pledge(2) in a program means the program is promissing to the kernel that it will only use the resources which it informs about prior using them

For example: if a user-space program promises kernel to use only IO family calls then it can not perform/call any other family calls like network, process, etc. if it will try to call the other calls without prior informing to kernel then the kernel will abort() the process. How does it make a program more secure?

By limiting the operations of a program. For example:

we write a program named “abc” that only needed the stdio to just print something to stdout
then we have to add pledge to use only stdio.
then, a malicious user found out that there is a vulnerability in our program which one can exploit to get into shell.
exploiting our program to open a shell will result in the kernel killing the process with SIGABRT, which can not be catch/ignore and generate a log in the dmesg
this happens because opening a shell out of current program needs others family operations like we need fork(2) which resides in “proc” and execution is in “exec” then for network activities “net” but these are not promissed to kernel so calling apis from such family will be forbidden and leads to abort()

after discussing with the developers, they mentioned that pledge(2) is not a system call filter. So, it is not used to restrict system calls, instead of that pledge(2) works on subset promise families like stdio, dns, inet, proc, net etc. but not directly on system calls like read, write, fork, etc.

pledge("read", NULL): incorrect way of using pledge(2) pledge("stdio inet", NULL): correct way of using pledge(2) and, based on the discussion with the developers they mentioned that pledge(2) works on behavioral approach not just like 1:1 approach with the system calls.

On 11 December 2017, Theo de Raadt said:

List: openbsd-tech
Subject: pledge execpromises
From: Theo de Raadt 
Date: 2017-12-11 21:20:51
Message-ID: 6735.1513027251 () cvs ! openbsd ! org

This will probably be committed in the next day or so.

The 2nd argument of pledge() becomes execpromises, which is what
will gets activated after execve.

There is also a small new feature called "error", which causes
violating system calls to return -1 with ENOSYS rather than killing
the process. This must be used with EXTREME CAUTION because libraries
and programs are full of unchecked system calls. If you carry on past
one of these failures, your program is in uncharted territory and
risks of exploitation become high.

"error" is being introduced for a different reason: The pre-exec
process's expectation of what the post-exec process will do might
mismatch, so "error" allows things like starting an editor which has
no network access or maybe other restrictions in the future...

previously it was:

#include <unistd.h>
int pledge(const char *promises, const char *paths[]);

and now it is,

#include <unistd.h>
int pledge(const char *promises, const char *execpromises);

as per OpenBSD 6.2 stable and at the time of writing the blog, developers are still using pledge(const char *promises, const char *paths[]) so our focus will be on the same

How to use pledge() in a program? Let’s take a simple hello world example:

#include <unistd.h>
#include <stdio.h>
int
main() {
    if(pledge("stdio",NULL) == -1) {
        err(1,"pledge");
    }
printf("Pledged\n");
return 0;
}

In the above example, the program takes pledge that it will only use stdio operations.

Now, if the above program tries to open network socket(2) or any other operation like fork(2), then the kernel will kill this program with SIGABRT signal.

Let’s take another example:

#include <unistd.h>
#include <stdio.h>
int
main() {
    if(pledge("",NULL) == -1) {
        err(1,"pledge");
    }
printf("Pledged\n");
return 0;
}

In the above code snippet, the first parameter of pledge(2) is empty and according to OpenBSD man page, A promises value of "" restricts the process to the _exit(2)

# cat sampe.c
#include <unistd.h>
#include <stdio.h>
int
main() {
    if(pledge("stdio",NULL) == -1) {
        err(1,"pledge");
    }
    printf("Pledged\n");
    return 0;
}
# ./testing
Pledged
#
# vim sampe.c
# gcc -o testing_reduced sampe.c
# cat sampe.c
#include <unistd.h>
#include <stdio.h>
int
main() {
    if(pledge("",NULL) == -1) {
        err(1,"pledge");
    }
    printf("Pledged\n");
    return 0;
}
# ./testing_reduced
Abort trap (core dumped)
#

Introduction on the working of pledge(2) - kernel internals

This part was a little difficult to understand at first. I am very thankful to OpenBSD developers: Marc Espie, Benny Löfgren, Bob Beck, Stuart Henderson and Otto Moerbeek for giving their precious time and resolving queries related to kernel internals of pledge(2).

pledge("stdio", NULL); or pledge("stdio inet proc route dns", NULL)

the above string is split into separate words like “stdio” or “‘stdio’, ‘inet’, ‘proc’, ‘route’, ‘dns’” after that these split words perform look-up operation from pledgereq[] array and if found then their respective flags will return Following pledgereq[] array:

static const struct {
	char *name;
	uint64_t flags;
} pledgereq[] = {
	{ "audio",		PLEDGE_AUDIO },
	{ "bpf",		PLEDGE_BPF },
	{ "chown",		PLEDGE_CHOWN | PLEDGE_CHOWNUID },
	{ "cpath",		PLEDGE_CPATH },
	{ "disklabel",		PLEDGE_DISKLABEL },
	{ "dns",		PLEDGE_DNS },
	{ "dpath",		PLEDGE_DPATH },
	{ "drm",		PLEDGE_DRM },
	{ "error",		PLEDGE_ERROR },
	{ "exec",		PLEDGE_EXEC },
	{ "fattr",		PLEDGE_FATTR | PLEDGE_CHOWN },
	{ "flock",		PLEDGE_FLOCK },
	{ "getpw",		PLEDGE_GETPW },
	{ "id",			PLEDGE_ID },
	{ "inet",		PLEDGE_INET },
	{ "mcast",		PLEDGE_MCAST },
	{ "pf",			PLEDGE_PF },
	{ "proc",		PLEDGE_PROC },
	{ "prot_exec",		PLEDGE_PROTEXEC },
	{ "ps",			PLEDGE_PS },
	{ "recvfd",		PLEDGE_RECVFD },
	{ "route",		PLEDGE_ROUTE },
	{ "rpath",		PLEDGE_RPATH },
	{ "sendfd",		PLEDGE_SENDFD },
	{ "settime",		PLEDGE_SETTIME },
	{ "stdio",		PLEDGE_STDIO },
	{ "tape",		PLEDGE_TAPE },
	{ "tmppath",		PLEDGE_TMPPATH },
	{ "tty",		PLEDGE_TTY },
	{ "unix",		PLEDGE_UNIX },
	{ "unveil",		PLEDGE_UNVEIL },
	{ "vminfo",		PLEDGE_VMINFO },
	{ "vmm",		PLEDGE_VMM },
	{ "wpath",		PLEDGE_WPATH },
	{ "wroute",		PLEDGE_WROUTE },
};

pledgereq array contains macro for every promises; for example, stdio relates to PLEDGE_STDIO. Now, these macros expand into their specific hex pledge values, like PLEDGE_STDIO expands to 0x0000000000000008ULL

For other macros and their expansions as mentioned below:

#include <sys/cdefs.h;>

/*
 * pledge(2) requests
 */
#define PLEDGE_ALWAYS	0xffffffffffffffffULL
#define PLEDGE_RPATH	0x0000000000000001ULL	/* allow open for read */
#define PLEDGE_WPATH	0x0000000000000002ULL	/* allow open for write */
#define PLEDGE_CPATH	0x0000000000000004ULL	/* allow creat, mkdir, unlink etc */
#define PLEDGE_STDIO	0x0000000000000008ULL	/* operate on own pid */
#define PLEDGE_TMPPATH	0x0000000000000010ULL	/* for mk*temp() */
#define PLEDGE_DNS	0x0000000000000020ULL	/* DNS services */
#define PLEDGE_INET	0x0000000000000040ULL	/* AF_INET/AF_INET6 sockets */
#define PLEDGE_FLOCK	0x0000000000000080ULL	/* file locking */
#define PLEDGE_UNIX	0x0000000000000100ULL	/* AF_UNIX sockets */
#define PLEDGE_ID	0x0000000000000200ULL	/* allow setuid, setgid, etc */
#define PLEDGE_TAPE	0x0000000000000400ULL	/* Tape ioctl */
#define PLEDGE_GETPW	0x0000000000000800ULL	/* YP enables if ypbind.lock */
#define PLEDGE_PROC	0x0000000000001000ULL	/* fork, waitpid, etc */
#define PLEDGE_SETTIME	0x0000000000002000ULL	/* able to set/adj time/freq */
#define PLEDGE_FATTR	0x0000000000004000ULL	/* allow explicit file st_* mods */
#define PLEDGE_PROTEXEC	0x0000000000008000ULL	/* allow use of PROT_EXEC */
#define PLEDGE_TTY	0x0000000000010000ULL	/* tty setting */
#define PLEDGE_SENDFD	0x0000000000020000ULL	/* AF_UNIX CMSG fd sending */
#define PLEDGE_RECVFD	0x0000000000040000ULL	/* AF_UNIX CMSG fd receiving */
#define PLEDGE_EXEC	0x0000000000080000ULL	/* execve, child is free of pledge */
#define PLEDGE_ROUTE	0x0000000000100000ULL	/* routing lookups */
#define PLEDGE_MCAST	0x0000000000200000ULL	/* multicast joins */
#define PLEDGE_VMINFO	0x0000000000400000ULL	/* vminfo listings */
#define PLEDGE_PS	0x0000000000800000ULL	/* ps listings */
#define PLEDGE_DISKLABEL 0x0000000002000000ULL	/* disklabels */
#define PLEDGE_PF	0x0000000004000000ULL	/* pf ioctls */
#define PLEDGE_AUDIO	0x0000000008000000ULL	/* audio ioctls */
#define PLEDGE_DPATH	0x0000000010000000ULL	/* mknod & mkfifo */
#define PLEDGE_DRM	0x0000000020000000ULL	/* drm ioctls */
#define PLEDGE_VMM	0x0000000040000000ULL	/* vmm ioctls */
#define PLEDGE_CHOWN	0x0000000080000000ULL	/* chown(2) family */
#define PLEDGE_CHOWNUID	0x0000000100000000ULL	/* allow owner/group changes */
#define PLEDGE_BPF	0x0000000200000000ULL	/* bpf ioctl */
#define PLEDGE_ERROR	0x0000000400000000ULL	/* ENOSYS instead of kill */
#define PLEDGE_WROUTE	0x0000000800000000ULL	/* interface address ioctls */
#define PLEDGE_UNVEIL	0x0000001000000000ULL	/* allow unveil() */

/*
 * Bits outside PLEDGE_USERSET are used by the kernel itself
 * to track program behaviours which have been observed.
 */
#define PLEDGE_USERSET	0x0fffffffffffffffULL
#define PLEDGE_STATLIE	0x4000000000000000ULL
#define PLEDGE_YPACTIVE	0x8000000000000000ULL	/* YP use detected and allowed */

now, all PLEDGE_* macros will perform or("|") operation with each other and as per the promises in the pledge(2) from (user-space) pseudo algorithm for better understanding given below:

uint64_t flags=0
for content_of_PLEDGE_macro from ["stdio", "inet", "proc", "dns", "proc", "route"]

        flags |= content_of_PLEDGE_macro

ps_pledge = flags

Calculation of pledge_bit (pledge value) in kernel mode, (only for demonstration and understanding the concept better):

test@openbsd:~$ cat pledge_python.py
import sys

PLEDGE_ALWAYS    =  0xffffffffffffffff  #/* pledge always */
PLEDGE_RPATH     =  0x0000000000000001  #/* allow open for read */
PLEDGE_WPATH     =  0x0000000000000002  #/* allow open for write */
PLEDGE_CPATH     =  0x0000000000000004  #/* allow creat, mkdir, unlink etc */
PLEDGE_STDIO     =  0x0000000000000008  #/* operate on own pid */
PLEDGE_TMPPATH   =  0x0000000000000010  #/* for mk*temp() */
PLEDGE_DNS       =  0x0000000000000020  # /* DNS services */
PLEDGE_INET      =  0x0000000000000040  # /* AF_INET/AF_INET6 sockets */
PLEDGE_FLOCK     =  0x0000000000000080  # /* file locking */
PLEDGE_UNIX      =  0x0000000000000100  # /* AF_UNIX sockets */
PLEDGE_ID        =  0x0000000000000200  # /* allow setuid, setgid, etc */
PLEDGE_TAPE      =  0x0000000000000400  # /* Tape ioctl */
PLEDGE_GETPW     =  0x0000000000000800  # /* YP enables if ypbind.lock */
PLEDGE_PROC      =  0x0000000000001000  # /* fork, waitpid, etc */
PLEDGE_SETTIME   =  0x0000000000002000  # /* able to set/adj time/freq */
PLEDGE_FATTR     =  0x0000000000004000  # /* allow explicit file st_* mods */
PLEDGE_PROTEXEC  =  0x0000000000008000  # /* allow use of PROT_EXEC */
PLEDGE_TTY       =  0x0000000000010000  # /* tty setting */
PLEDGE_SENDFD    =  0x0000000000020000  # /* AF_UNIX CMSG fd sending */
PLEDGE_RECVFD    =  0x0000000000040000  # /* AF_UNIX CMSG fd receiving */
PLEDGE_EXEC      =  0x0000000000080000  # /* execve, child is free of pledge */
PLEDGE_ROUTE     =  0x0000000000100000  # /* routing lookups */
PLEDGE_MCAST     =  0x0000000000200000  # /* multicast joins */
PLEDGE_VMINFO    =  0x0000000000400000  # /* vminfo listings */
PLEDGE_PS        =  0x0000000000800000  # /* ps listings */
PLEDGE_DISKLABEL =  0x0000000002000000  #/* disklabels */
PLEDGE_PF        =  0x0000000004000000  # /* pf ioctls */
PLEDGE_AUDIO     =  0x0000000008000000  # /* audio ioctls */
PLEDGE_DPATH     =  0x0000000010000000  # /* mknod & mkfifo */
PLEDGE_DRM       =  0x0000000020000000  # /* drm ioctls */
PLEDGE_VMM       =  0x0000000040000000  # /* vmm ioctls */
PLEDGE_CHOWN     =  0x0000000080000000  # /* chown(2) family */
PLEDGE_CHOWNUID  =  0x0000000100000000  # /* allow owner/group changes */
PLEDGE_BPF       =  0x0000000200000000  # /* bpf ioctl */
PLEDGE_ERROR     =  0x0000000400000000  # /* ENOSYS instead of kill */

pledgereq = {   "audio"     :  PLEDGE_AUDIO,
                "bpf"       :  PLEDGE_BPF,
                "chown"     :  PLEDGE_CHOWN | PLEDGE_CHOWNUID,
                "cpath"     :  PLEDGE_CPATH,
                "disklabel" :  PLEDGE_DISKLABEL,
                "dns"       :  PLEDGE_DNS,
                "dpath"     :  PLEDGE_DPATH,
                "drm"       :  PLEDGE_DRM,
                "exec"      :  PLEDGE_EXEC,
                "fattr"     :  PLEDGE_FATTR | PLEDGE_CHOWN,
                "flock"     :  PLEDGE_FLOCK,
                "getpw"     :  PLEDGE_GETPW,
                "id"        :  PLEDGE_ID,
                "inet"      :  PLEDGE_INET,
                "mcast"     :  PLEDGE_MCAST,
                "pf"        :  PLEDGE_PF,
                "proc"      :  PLEDGE_PROC,
                "prot_exec" :  PLEDGE_PROTEXEC,
                "ps"        :  PLEDGE_PS,
                "recvfd"    :  PLEDGE_RECVFD,
                "route"     :  PLEDGE_ROUTE,
                "rpath"     :  PLEDGE_RPATH,
                "sendfd"    :  PLEDGE_SENDFD,
                "settime"   :  PLEDGE_SETTIME,
                "stdio"     :  PLEDGE_STDIO,
                "tape"      :  PLEDGE_TAPE,
                "tmppath"   :  PLEDGE_TMPPATH,
                "tty"       :  PLEDGE_TTY,
                "unix"      :  PLEDGE_UNIX,
                "vminfo"    :  PLEDGE_VMINFO,
                "vmm"       :  PLEDGE_VMM,
                "wpath"     :  PLEDGE_WPATH,
            }

def sys_pledge(promises,path):
    flags = 0
    if len(promises) == 0:
        print "ABRT (SIGABRT)"
        sys.exit(1)
    promises_list = promises.split()
    for perm in promises_list:
        try:
            perms = pledgereq[perm]
        except Exception as e:
            print(str(e) + ": Undefined promise(s) made")
            sys.exit(1)

        flags = flags | pledgereq[perm]
    return flags

if __name__ == '__main__':

    pledge_bits = sys_pledge(sys.argv[1],"NULL");

    print "pledge_bits :" + str(hex(pledge_bits))

Output:

test@openbsd:~$ python pledge_python.py "stdio"
pledge_bits :0x8
test@openbsd:~$
test@openbsd:~$ python pledge_python.py "stdio inet proc route dns"
pledge_bits :0x101068
test@openbsd:~$
test@openbsd:~$ python pledge_python.py "stdio abcd"
'abcd': Undefined promise(s) made
test@openbsd:~$
test@openbsd:~$ python pledge_python.py ""
ABRT (SIGABRT)

there are lots of features and more detailed internals pending to cover which we will be discussing some other time in future

but I will suggest and encourage everyone to read the user and kernel code of the pledge(2) to get more understanding about the internals sys/kern/kern_pledge.c.

One of the interesting part about pledge(2) is that the pledge(2) does check that you never go in increasing the pledge flags once a process gets pledged. So, it works mainly in decreasing order.

Finally!!

If something is missing or not correct, please feel free to update.

Installing Hugo and publishing Hugo web-pages on OpenBSD server

Fri, 20 Jul 2018 18:23:58 +0000

Hi there,

Today, we will looking at installation of hugo - a static site generator and deployment on OpenBSD server

Installing hugo

Tested and deployed hugo generated site pages on OpenBSD 6.3-stable and at the time of writing this blog, hugo is not available in the ports on OpenBSD 6.3, so, we will be proceeding with installation from source.

Dependencies

go
mage (make alternative for go)

Following are the steps to install mage from the source on OpenBSD 6.3:

go get github.com/magefile/mage
cd ${GOPATH:-$HOME/go}/src/github.com/magefile/mage
go run bootstrap.go
then, execute the following command to copy the mage binary to /usr/bin/ directory:
doas cp $HOME/go/bin/mage /usr/bin/
Download hugo from git:
go get -d github.com/gohugoio/hugo
cd ${GOPATH:-$HOME/go}/src/github.com/gohugoio/hugo
mage vendor
mage install

Now, execute the following command to copy the hugo binary to /usr/bin/ directory:

doas cp $HOME/go/bin/hugo /usr/bin/

Generating and hosting static pages using hugo locally

[xxx@localhost ~]$ hugo new site ~/example-site
Congratulations! Your new Hugo site is created in /home/feddy/example-site.

Just a few more steps and you're ready to go:

1\. Download a theme into the same-named folder.
   Choose a theme from https://themes.gohugo.io/, or
   create your own with the "hugo new theme " command.
2\. Perhaps you want to add some content. You can add single files
   with "hugo new /.".
3\. Start the built-in live server via "hugo server".

Visit https://gohugo.io/ for quickstart guide and full documentation.
[xxx@localhost ~]$
[xxx@localhost ~]$ cd example-site/
[xxx@localhost example-site]$ git clone https://github.com/halogenica/beautifulhugo.git themes/beautifulhugo
Cloning into 'themes/beautifulhugo'...
remote: Enumerating objects: 18, done.
remote: Counting objects: 100% (18/18), done.
remote: Compressing objects: 100% (15/15), done.
remote: Total 1786 (delta 4), reused 8 (delta 3), pack-reused 1768
Receiving objects: 100% (1786/1786), 2.45 MiB | 288.00 KiB/s, done.
Resolving deltas: 100% (1053/1053), done.
[xxx@localhost example-site]$

then, edit the config.toml file and add line theme = “beautifulhugo” and start hugo server: hugo server -D or can also use hugo “-t” option from the command line, hugo server -t beautifulhugo open the link in browser to access the geenrated web-page, http://localhost:1313/ Adding the first post using hugo hugo new posts/my-first-post.md for full the documentation please visit Hugo documentation

Deployment of the newly generated static site on OpenBSD server:

deploy the static website after creation of the static site, though, found several blogs and posts about using git and git-hook script for deployment and I feel following is an easy option after creating posts, make sure that draft = true has been removed from the posts which are going to publish.

To genenrate pubish pages: rm -rf public/ && hugo then use scp or rsync to copy the contents of the public/ directory to the server, here, it is OpenBSD Then start the web server, and enjoy :)

If something is missing or not correct, please feel free to update