6 files changed, 127 insertions, 1 deletions

diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c
index c49681476..0112d8aec 100644
--- a/src/fseccomp/seccomp.c
+++ b/src/fseccomp/seccomp.c
@@ -237,6 +237,7 @@ void memory_deny_write_execute(const char *fname) {
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_WRITE|PROT_EXEC, 0, 1),
                 KILL_PROCESS,
                 RETURN_ALLOW,
+
                 // block mprotect(,,PROT_EXEC) so writable memory can't be turned into executable
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_mprotect, 0, 5),
                 EXAMINE_ARGUMENT(2),
@@ -244,6 +245,9 @@ void memory_deny_write_execute(const char *fname) {
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1),
                 KILL_PROCESS,
                 RETURN_ALLOW,
+
+// shmat is not implemented as a syscall on some platforms (i386, possibly arm)
+#ifdef SYS_shmat
                 // block shmat(,,x|SHM_EXEC) so W&X shared memory can't be created
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_shmat, 0, 5),
                 EXAMINE_ARGUMENT(2),
@@ -251,6 +255,7 @@ void memory_deny_write_execute(const char *fname) {
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SHM_EXEC, 0, 1),
                 KILL_PROCESS,
                 RETURN_ALLOW
+#endif
         };
         write_to_file(fd, filter, sizeof(filter));
 
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 4a396b809..8dd4ef8fa 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -744,7 +744,15 @@ $ firejail \-\-machine-id
 \fB\-\-memory-deny-write-execute
 Install a seccomp filter to block attempts to create memory mappings
 that are both writable and executable, to change mappings to be
-executable or to create executable shared memory.
+executable, or to create executable shared memory. The filter examines
+the arguments of mmap, mmap2, mprotect and shmat system calls
+and kills the process if necessary.
+.br
+
+.br
+Note: shmat is not implemented
+as a system call on some platforms including i386, and it cannot be
+handled by seccomp-bpf.
 
 .TP
 \fB\-\-mtu=number
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 6a5ec2b87..8f659237a 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -15,6 +15,9 @@ fi
 
 export PATH="$PATH:/usr/lib/firejail"
 
+echo "TESTING: memory-deny-write-execute (test/filters/memwrexe.exp)"
+./memwrexe.exp
+
 echo "TESTING: debug options (test/filters/debug.exp)"
 ./debug.exp
 
diff --git a/test/filters/memwrexe b/test/filters/memwrexe
new file mode 100755
index 000000000..3a079672c
--- /dev/null
+++ b/test/filters/memwrexe
diff --git a/test/filters/memwrexe.c b/test/filters/memwrexe.c
new file mode 100644
index 000000000..7e14aa23d
--- /dev/null
+++ b/test/filters/memwrexe.c
@@ -0,0 +1,76 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+static void usage(void) {
+        printf("memwrexe options\n");
+        printf("where options is:\n");
+        printf("\tmmap - mmap test\n");
+        printf("\tmprotect - mprotect test\n");
+}
+
+int main(int argc, char **argv) {
+        if (argc != 2) {
+                fprintf(stderr, "TESTING ERROR: memwrexe insufficient params\n");
+                usage();
+                return 1;
+        }
+        
+        if (strcmp(argv[1], "mmap") == 0) {
+                // open some file
+                int fd = open("memwrexe.c", O_RDONLY);
+                if (fd == -1) {
+                        fprintf(stderr, "TESTING ERROR: file not found, cannot run mmap test\n");
+                        return 1;
+                }
+        
+                int size = lseek(fd, 0, SEEK_END);
+                if (size == -1) {
+                        fprintf(stderr, "TESTING ERROR: file not found, cannot run mmap test\n");
+                        return 1;
+                }
+                
+                void *p = mmap (0, size, PROT_WRITE|PROT_READ|PROT_EXEC, MAP_SHARED, fd, 0);
+                printf("mmap successful\n");
+
+                // wait for expect to timeout
+                sleep(100);
+
+                return 0;
+        }
+
+        else if (strcmp(argv[1], "mprotect") == 0) {
+                // open some file
+                int fd = open("memwrexe.c", O_RDWR);
+                if (fd == -1) {
+                        fprintf(stderr, "TESTING ERROR: file not found, cannot run mmap test\n");
+                        return 1;
+                }
+        
+                int size = lseek(fd, 0, SEEK_END);
+                if (size == -1) {
+                        fprintf(stderr, "TESTING ERROR: file not found, cannot run mmap test\n");
+                        return 1;
+                }
+                
+                void *p = mmap (0, size, PROT_READ, MAP_SHARED, fd, 0);
+                if (!p) {
+                        fprintf(stderr, "TESTING ERROR: cannot map file for mprotect test\n");
+                        return 1;
+                }
+                
+                mprotect(p, size, PROT_READ|PROT_WRITE|PROT_EXEC);
+                printf("mprotect successful\n");
+
+                // wait for expect to timeout
+                sleep(100);
+
+                return 0;
+        }
+}
+        
\ No newline at end of file
diff --git a/test/filters/memwrexe.exp b/test/filters/memwrexe.exp
new file mode 100755
index 000000000..6a57b8a07
--- /dev/null
+++ b/test/filters/memwrexe.exp
@@ -0,0 +1,34 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2017 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --memory-deny-write-execute ./memwrexe mmap\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "mmap successful" {puts "TESTING ERROR 2\n";exit}
+        "Parent is shutting down"
+}
+after 100
+
+send --  "firejail --memory-deny-write-execute ./memwrexe mprotect\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "mprotect successful" {puts "TESTING ERROR 12\n";exit}
+        "Parent is shutting down"
+}
+
+after 100
+puts "\nall done\n"