MapGuard

MapGuard is a page allocation proxy and cache that aims to mitigate some memory safety exploits by intercepting, modifying, and logging mmap based page allocations. It enforces a simple set of allocation security policies configurable via environment variables. It works transparently on open and closed source programs with no source modifications in the target required. It can be used along side any mmap based memory allocator.

Implementation

MapGuard uses the dynamic linker interface via dlsym to hook libc functions. When calls to those functions are intercepted MapGuard will inspect their arguments and then consult runtime policies for whether that behavior should be allowed, denied, or logged.

The library requires hooking mmap, munmap, mprotect, and mremap. Enabling all protections may introduce some performance and memory overhead, especially if guard pages are enabled.

Performance

MapGuard can introduce performance overhead when allocating many raw pages. This is particulary true when MG_USE_MAPPING_CACHE is enabled because it has to manage metadata for each page allocation and tracking this data introduces CPU and memory overhead. Faster data structures are available for managing this metadata but they all rely on malloc which makes it easier to bypass the security controls the library introduces.

Configuration

The following functionality can be enabled/disabled via environment variables:

• MG_PREVENT_RWX - Prevent PROT_READ, PROT_WRITE, PROT_EXEC mappings
• MG_PREVENT_TRANSITION_TO_X - Prevent RW- allocations to ever transition to PROT_EXEC
• MG_PREVENT_TRANSITION_FROM_X - Prevent R-X allocations to ever transition to PROT_WRITE
• MG_PREVENT_STATIC_ADDRESS - Prevent page allocations at a set address (enforces ASLR)
• MG_ENABLE_GUARD_PAGES - Force guard page allocations on either side of all mappings
• MG_PANIC_ON_VIOLATION - Abort the process when any policies are violated
• MG_POISON_ON_ALLOCATION - Fill all allocated pages with a byte pattern 0xde
• MG_USE_MAPPING_CACHE - Enable the mapping cache, required for guard pages and other protections
• MG_ENABLE_SYSLOG - Enable logging of policy violations to syslog

Compiling

make library - Compiles the library

make tests - Compiles a debug version of the library

make perf_tests - Compiles the performance tests

make format - Run clang format on the code base

Now run your own program with the library:

MG_PANIC_ON_VIOLATION=0         \
MG_USE_MAPPING_CACHE=1          \
MG_PREVENT_RWX=1               \
MG_PREVENT_STATIC_ADDRESS=1    \
MG_ENABLE_GUARD_PAGES=1         \
MG_PREVENT_TRANSITION_TO_X=1   \
MG_PREVENT_TRANSITION_FROM_X=1 \
MG_POISON_ON_ALLOCATION=1       \
LD_PRELOAD=build/libmapguard.so ./your_program

Testing

You can test MapGuard by running ./run_tests.sh:

# ./run_tests.sh 
Running mapguard_test test... Succeeded
Running mapguard_thread_test test... Succeeded

# ./run_perf_test.sh
================================================================
Running baseline performance (no MapGuard)...
================================================================
test_name,iterations,time_ms,ops_per_sec
simple_alloc_free,10000,8.28,1207522.82
alloc_write_free,10000,27.56,362884.76
batch_alloc_then_free,10000,7.53,1327830.27
varied_sizes,1000,0.75,1325820.35
mprotect_transitions,1000,1.29,777756.17
large_allocations,1000,0.74,1347180.55
partial_munmap,1000,1.36,734686.38

================================================================
Running with MapGuard (no config)...
================================================================
test_name,iterations,time_ms,ops_per_sec
simple_alloc_free,10000,8.00,1249934.85
alloc_write_free,10000,26.70,374585.62
batch_alloc_then_free,10000,7.58,1319130.69
varied_sizes,1000,0.81,1228689.91
mprotect_transitions,1000,1.33,753130.01
large_allocations,1000,0.83,1198442.98
partial_munmap,1000,1.31,764696.12

================================================================
Running with MapGuard (cache enabled)...
================================================================
test_name,iterations,time_ms,ops_per_sec
simple_alloc_free,10000,8.40,1190452.52
alloc_write_free,10000,27.73,360684.77
batch_alloc_then_free,10000,12.23,817661.49
varied_sizes,1000,0.85,1170561.32
mprotect_transitions,1000,1.46,685674.95
large_allocations,1000,0.84,1190239.56
partial_munmap,1000,1.39,721478.86

================================================================
Running with MapGuard (full protection)...
================================================================
test_name,iterations,time_ms,ops_per_sec
simple_alloc_free,10000,38.66,258667.52
alloc_write_free,10000,38.82,257607.74
batch_alloc_then_free,10000,56.12,178201.50
varied_sizes,1000,5.17,193604.62
mprotect_transitions,1000,4.84,206417.86
large_allocations,1000,97.63,10243.05
partial_munmap,1000,6.01,166516.33

================================================================
Performance Summary
================================================================
Test                           Baseline    Minimal   Cache        Full        Overhead %  
====================================================================================================
simple_alloc_free             1207523     1249935     1190453      258668        78.6%
alloc_write_free               362885      374586      360685      257608        29.0%
batch_alloc_then_free         1327830     1319131      817661      178202        86.6%
varied_sizes                  1325820     1228690     1170561      193605        85.4%
mprotect_transitions           777756      753130      685675      206418        73.5%
large_allocations             1347181     1198443     1190240       10243        99.2%
partial_munmap                 734686      764696      721479      166516        77.3%

# ./run_fuzz_tests
...
(see if anything crashes!)

Who

MapGuard is written and maintained by Chris Rohlf - chris.rohlf@gmail.com