These examples do not use any standard C library, instead a handful of functions are implemented from scratch. These implementations are not tuned for performance, instead they are supposed to demonstrate how explicit use of Morello features and tools can be used to write safe purecap code.
The applications in this group are supposed to be built for purecap and rely on PCuABI user-kernel interface.
The listauxv binary will run without any parameters and prints the
contents of auxiliary vector. On a PCuABI system, this vector will
include special capabilities along with the standard integer values.
The capabilities are printed with information on bounds, permissions,
and object type.
The selftest binary will run without any arguments and will execute
a number of unit tests that check correctness of the utility functions.
The hackfmt binary accepts one optional argument that is then used
as format string for the printf function:
int main(int argc, char *argv[], char *envp[])
{
int n = printf(argv[1]);
printf("\nprinted %d characters\n", n);
return 0;
}
This illustrates an unsafe use of this function when user input affects
the format string. This is one of the well-known security issues for
which the mitigation is to always use static strings for formatting.
However, the printf function is implemented in a way that prevents
any tempering with memory thus eliminating the vulnerability.
Try it yourself:
./build/bin/hackfmt %p%p%p
If you run this program without any arguments, it will still work as
expected: the passed NULL pointer will be treated as an empty string.
The details of how this works are described below.
These examples don't use any standard C library, therefore some basic utilities are implemented here. This includes the following:
init_morello_relative and deprecated init_cap_relocs.EXIT_GROUP
and WRITE.(s)printf, strlen, strcpy, strcmp,
memset, and capability-aware memcpy.The functions mentioned above are using information about capability bounds to avoid inappropriate memory accesses that would result in a capability fault leading to a segfault. Explicit validity and bounds checks allow to mitigate spatial memory vulnerabilities. Refer to the comments in sources for more details.