[illumos-gate merge]

commit d2a70789f056fc6c9ce3ab047b52126d80b0e3da
    7029 want per-process exploit mitigation features (secflags)
    7030 want basic address space layout randomization (ASLR)
    7031 noexec_user_stack should be a security-flag
    7032 want a means to forbid mappings around NULL
commit 8ab1c3f559468e655c4eb8acce993320403dd72b
    7469 loader should use acpica provided by OS
commit a1964bdd47804c37e09db1a79c23937c9aeac165
    7470 acpi build sometimes doesn't descend into SUBDIRS
commit abf99a006172ea5aab2246bda23f9d6d935bf1ad
    7420 signalfd deadlock on pollwakeup
    7421 panic in signalfd

	Conflicts:
	usr/src/cmd/sgs/libconv/common/corenote.c
	usr/src/cmd/zonecfg/zonecfg.c
	usr/src/cmd/zonecfg/zonecfg.h
	usr/src/cmd/zonecfg/zonecfg_grammar.y
	usr/src/cmd/zonecfg/zonecfg_lex.l
	usr/src/head/libzonecfg.h
	usr/src/lib/libzonecfg/common/libzonecfg.c
	usr/src/man/man1m/zonecfg.1m
	usr/src/man/man4/proc.4
	usr/src/pkg/manifests/system-test-ostest.mf
	usr/src/test/os-tests/tests/Makefile
	usr/src/uts/common/exec/elf/elf.c
	usr/src/uts/common/io/signalfd.c
	usr/src/uts/common/os/sysent.c
	usr/src/uts/common/os/zone.c
	usr/src/uts/common/sys/proc.h
	usr/src/uts/common/sys/zone.h

12 files changed, 217 insertions, 15 deletions

diff --git a/usr/src/lib/libc/Makefile.targ b/usr/src/lib/libc/Makefile.targ
index bb9ccf467d..d78aace6d0 100644
--- a/usr/src/lib/libc/Makefile.targ
+++ b/usr/src/lib/libc/Makefile.targ
@@ -295,6 +295,10 @@ $(DTRACEOBJS:%=pics/%): $(SRC)/common/dtrace/$$(@F:.o=.c)
 	$(COMPILE.c) -o $@ $(SRC)/common/dtrace/$(@F:.o=.c)
 	$(POST_PROCESS_O)
 
+$(SECFLAGSOBJS:%=pics/%): $(SRC)/common/secflags/$$(@F:.o=.c)
+	$(COMPILE.c) -o $@ $(SRC)/common/secflags/$(@F:.o=.c)
+	$(POST_PROCESS_O)
+
 $(UNICODEOBJS:%=pics/%): $(SRC)/common/unicode/$$(@F:.o=.c)
 	$(COMPILE.c) -o $@ $(SRC)/common/unicode/$(@F:.o=.c)
 	$(POST_PROCESS_O)
diff --git a/usr/src/lib/libc/amd64/Makefile b/usr/src/lib/libc/amd64/Makefile
index b5514c4bed..a50c8d84be 100644
--- a/usr/src/lib/libc/amd64/Makefile
+++ b/usr/src/lib/libc/amd64/Makefile
@@ -246,6 +246,7 @@ COMSYSOBJS=			\
 	processor_bind.o	\
 	processor_info.o	\
 	profil.o		\
+	psecflagsset.o		\
 	putmsg.o		\
 	putpmsg.o		\
 	pwrite.o		\
@@ -499,6 +500,7 @@ PORTGEN=			\
 	priocntl.o		\
 	privlib.o		\
 	priv_str_xlate.o	\
+	psecflags.o		\
 	psiginfo.o		\
 	psignal.o		\
 	pt.o			\
@@ -812,6 +814,9 @@ RTOBJS=				\
 	shm.o			\
 	sigev_thread.o
 
+SECFLAGSOBJS=			\
+	secflags.o
+
 TPOOLOBJS=			\
 	thread_pool.o
 
@@ -965,6 +970,7 @@ MOSTOBJS=			\
 	$(PORTSYS64)		\
 	$(AIOOBJS)		\
 	$(RTOBJS)		\
+	$(SECFLAGSOBJS)		\
 	$(TPOOLOBJS)		\
 	$(THREADSOBJS)		\
 	$(THREADSMACHOBJS)	\
@@ -1093,6 +1099,7 @@ SRCS=							\
 	$(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)			\
 	$(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)			\
 	$(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)			\
+	$(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)		\
 	$(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)		\
 	$(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)		\
 	$(THREADSMACHOBJS:%.o=threads/%.c)		\
diff --git a/usr/src/lib/libc/common/sys/brk.s b/usr/src/lib/libc/common/sys/brk.s
index fbd2f4c135..fe1413769d 100644
--- a/usr/src/lib/libc/common/sys/brk.s
+++ b/usr/src/lib/libc/common/sys/brk.s
@@ -37,5 +37,5 @@
 	ENTRY_NP(_brk_unlocked)
 	SYSTRAP_RVAL1(brk)
 	SYSCERROR
-	RETC
+	RET
 	SET_SIZE(_brk_unlocked)
diff --git a/usr/src/lib/libc/common/sys/psecflagsset.s b/usr/src/lib/libc/common/sys/psecflagsset.s
new file mode 100644
index 0000000000..d47d3d8595
--- /dev/null
+++ b/usr/src/lib/libc/common/sys/psecflagsset.s
@@ -0,0 +1,21 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/* Copyright 2015, Richard Lowe */
+
+	.file	"psecflagsset.s"
+
+#include <sys/asm_linkage.h>
+#include "SYS.h"
+        
+        SYSCALL2_RVAL1(__psecflagsset,psecflags)
+        RET
+        SET_SIZE(__psecflagsset)
diff --git a/usr/src/lib/libc/i386/Makefile.com b/usr/src/lib/libc/i386/Makefile.com
index d3176ce802..4f855d43da 100644
--- a/usr/src/lib/libc/i386/Makefile.com
+++ b/usr/src/lib/libc/i386/Makefile.com
@@ -113,6 +113,9 @@ COMOBJS=			\
 DTRACEOBJS=			\
 	dtrace_data.o
 
+SECFLAGSOBJS=			\
+	secflags.o
+
 GENOBJS=			\
 	$(COMMPAGE_OBJS)	\
 	_div64.o		\
@@ -270,6 +273,7 @@ COMSYSOBJS=			\
 	processor_bind.o	\
 	processor_info.o	\
 	profil.o		\
+	psecflagsset.o		\
 	putmsg.o		\
 	putpmsg.o		\
 	pwrite.o		\
@@ -532,6 +536,7 @@ PORTGEN=			\
 	priocntl.o		\
 	privlib.o		\
 	priv_str_xlate.o	\
+	psecflags.o		\
 	psiginfo.o		\
 	psignal.o		\
 	pt.o			\
@@ -1008,6 +1013,7 @@ MOSTOBJS=			\
 	$(PORTSYS64)		\
 	$(AIOOBJS)		\
 	$(RTOBJS)		\
+	$(SECFLAGSOBJS)		\
 	$(TPOOLOBJS)		\
 	$(THREADSOBJS)		\
 	$(THREADSMACHOBJS)	\
@@ -1157,6 +1163,7 @@ SRCS=							\
 	$(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)			\
 	$(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)			\
 	$(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)			\
+	$(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)		\
 	$(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)		\
 	$(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)		\
 	$(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)	\
diff --git a/usr/src/lib/libc/port/gen/priv_str_xlate.c b/usr/src/lib/libc/port/gen/priv_str_xlate.c
index 9796a2d858..60ed80c122 100644
--- a/usr/src/lib/libc/port/gen/priv_str_xlate.c
+++ b/usr/src/lib/libc/port/gen/priv_str_xlate.c
@@ -72,8 +72,8 @@ priv_basic(void)
  */
 priv_set_t *
 priv_str_to_set(const char *priv_names,
-		const char *separators,
-		const char **endptr)
+    const char *separators,
+    const char **endptr)
 {
 
 	char *base;
diff --git a/usr/src/lib/libc/port/gen/psecflags.c b/usr/src/lib/libc/port/gen/psecflags.c
new file mode 100644
index 0000000000..5fe15df88c
--- /dev/null
+++ b/usr/src/lib/libc/port/gen/psecflags.c
@@ -0,0 +1,112 @@
+/*
+ * This file and its contents are supplied under the terms of the
+ * Common Development and Distribution License ("CDDL"), version 1.0.
+ * You may only use this file in accordance with the terms of version
+ * 1.0 of the CDDL.
+ *
+ * A full copy of the text of the CDDL should have accompanied this
+ * source.  A copy of the CDDL is also available via the Internet at
+ * http://www.illumos.org/license/CDDL.
+ */
+
+/* Copyright 2015, Richard Lowe. */
+
+#include "lint.h"
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+#include <sys/proc.h>
+#include <sys/procset.h>
+#include <sys/syscall.h>
+#include <sys/secflags.h>
+
+extern int __psecflagsset(procset_t *, psecflagwhich_t, secflagdelta_t *);
+
+int
+psecflags(idtype_t idtype, id_t id, psecflagwhich_t which,
+    secflagdelta_t *delta)
+{
+	procset_t procset;
+
+	setprocset(&procset, POP_AND, idtype, id, P_ALL, 0);
+
+	return (__psecflagsset(&procset, which, delta));
+}
+
+int
+secflags_parse(const secflagset_t *defaults, const char *flags,
+    secflagdelta_t *ret)
+{
+	char *flag;
+	char *s, *ss;
+	boolean_t current = B_FALSE;
+
+	/* Guarantee a clean base */
+	bzero(ret, sizeof (*ret));
+
+	if ((ss = s = strdup(flags)) == NULL)
+		return (-1);	/* errno set for us */
+
+
+	while ((flag = strsep(&s, ",")) != NULL) {
+		secflag_t sf = 0;
+		boolean_t del = B_FALSE;
+
+		if (strcasecmp(flag, "default") == 0) {
+			if (defaults != NULL) {
+				secflags_union(&ret->psd_add, defaults);
+			} else {
+				free(ss);
+				errno = EINVAL;
+				return (-1);
+			}
+			continue;
+		} else if (strcasecmp(flag, "all") == 0) {
+			secflags_fullset(&ret->psd_add);
+			continue;
+		} else if (strcasecmp(flag, "none") == 0) {
+			secflags_fullset(&ret->psd_rem);
+			continue;
+		} else if (strcasecmp(flag, "current") == 0) {
+			current = B_TRUE;
+			continue;
+		}
+
+		if ((flag[0] == '-') || (flag[0] == '!')) {
+			flag++;
+			del = B_TRUE;
+		} else if (flag[0] == '+') {
+			flag++;
+		}
+
+		if ((secflag_by_name(flag, &sf)) != B_TRUE) {
+			free(ss);
+			errno = EINVAL;
+			return (-1);
+		}
+
+		if (del)
+			secflag_set(&(ret->psd_rem), sf);
+		else
+			secflag_set(&(ret->psd_add), sf);
+	}
+
+	/*
+	 * If we're not using the current flags, this is strict assignment.
+	 * Negatives "win".
+	 */
+	if (!current) {
+		secflags_copy(&ret->psd_assign, &ret->psd_add);
+		secflags_difference(&ret->psd_assign, &ret->psd_rem);
+		ret->psd_ass_active = B_TRUE;
+		secflags_zero(&ret->psd_add);
+		secflags_zero(&ret->psd_rem);
+	}
+
+	free(ss);
+	return (0);
+}
diff --git a/usr/src/lib/libc/port/mapfile-vers b/usr/src/lib/libc/port/mapfile-vers
index 98efe9ed72..9185b621bc 100644
--- a/usr/src/lib/libc/port/mapfile-vers
+++ b/usr/src/lib/libc/port/mapfile-vers
@@ -3053,6 +3053,7 @@ $endif
 	option_to_attr;
 	__priv_bracket;
 	__priv_relinquish;
+	psecflags;
 	pset_assign_forced;
 	pset_bind_lwp;
 	_psignal;
@@ -3069,6 +3070,26 @@ $endif
 	_rpcsys;
 	_sbrk_grow_aligned;
 	scrwidth;
+	secflag_by_name;
+	secflag_clear;
+	secflags_copy;
+	secflags_difference;
+	secflags_fullset;
+	secflags_intersection;
+	secflags_isempty;
+	secflag_isset;
+	secflags_issubset;
+	secflags_issuperset;
+	secflag_set;
+	secflag_to_bit;
+	secflag_to_str;
+	secflags_union;
+	psecflags_validate_delta;
+	secflags_zero;
+	psecflags_default;
+	secflags_parse;
+	secflags_to_str;
+	psecflags_validate;
 	semctl64;
 	_semctl64;
 	set_escaped_context_cleanup;
diff --git a/usr/src/lib/libc/port/sys/sbrk.c b/usr/src/lib/libc/port/sys/sbrk.c
index 156f7bd797..d7224599dd 100644
--- a/usr/src/lib/libc/port/sys/sbrk.c
+++ b/usr/src/lib/libc/port/sys/sbrk.c
@@ -24,8 +24,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #pragma weak _sbrk = sbrk
 #pragma weak _brk = brk
 
@@ -40,12 +38,11 @@
 #include "mtlib.h"
 #include "libc.h"
 
-extern int _end;
-void *_nd = &_end;
+void *_nd = NULL;
 mutex_t __sbrk_lock = DEFAULTMUTEX;
 
-extern int _brk_unlocked(void *);
-extern void *_sbrk_unlocked(intptr_t);
+extern intptr_t _brk_unlocked(void *);
+void *_sbrk_unlocked(intptr_t);
 
 /*
  * The break must always be at least 8-byte aligned
@@ -87,8 +84,15 @@ sbrk(intptr_t addend)
 void *
 _sbrk_unlocked(intptr_t addend)
 {
-	char *old_brk = BRKALIGN(_nd);
-	char *new_brk = BRKALIGN(old_brk + addend);
+	char *old_brk;
+	char *new_brk;
+
+	if (_nd == NULL) {
+		_nd = (void *)_brk_unlocked(0);
+	}
+
+	old_brk = BRKALIGN(_nd);
+	new_brk = BRKALIGN(old_brk + addend);
 
 	if ((addend > 0 && new_brk < old_brk) ||
 	    (addend < 0 && new_brk > old_brk)) {
@@ -118,7 +122,7 @@ _sbrk_grow_aligned(size_t min_size, size_t low_align, size_t high_align,
 	uintptr_t ret_brk;
 	uintptr_t high_brk;
 	uintptr_t new_brk;
-	int brk_result;
+	intptr_t brk_result;
 
 	if (!primary_link_map) {
 		errno = ENOTSUP;
@@ -134,6 +138,9 @@ _sbrk_grow_aligned(size_t min_size, size_t low_align, size_t high_align,
 
 	lmutex_lock(&__sbrk_lock);
 
+	if (_nd == NULL)
+		_nd = (void *)_brk_unlocked(0);
+
 	old_brk = (uintptr_t)BRKALIGN(_nd);
 	ret_brk = P2ROUNDUP(old_brk, low_align);
 	high_brk = ret_brk + min_size;
@@ -163,7 +170,16 @@ _sbrk_grow_aligned(size_t min_size, size_t low_align, size_t high_align,
 int
 brk(void *new_brk)
 {
-	int result;
+	intptr_t result;
+
+	/*
+	 * brk(2) will return the current brk if given an argument of 0, so we
+	 * need to fail it here
+	 */
+	if (new_brk == 0) {
+		errno = ENOMEM;
+		return (-1);
+	}
 
 	if (!primary_link_map) {
 		errno = ENOTSUP;
diff --git a/usr/src/lib/libc/req.flg b/usr/src/lib/libc/req.flg
index 79170e532a..b501dc546b 100644
--- a/usr/src/lib/libc/req.flg
+++ b/usr/src/lib/libc/req.flg
@@ -23,9 +23,9 @@
 # Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
 
 find_files "s.*" usr/src/common/atomic
-find_files "s.*" usr/src/common/util
 find_files "s.*" usr/src/common/dtrace
+find_files "s.*" usr/src/common/secflags
+find_files "s.*" usr/src/common/util
 find_files "s.*" usr/src/lib/common
diff --git a/usr/src/lib/libc/sparc/Makefile.com b/usr/src/lib/libc/sparc/Makefile.com
index c525f28b3d..164515f9d3 100644
--- a/usr/src/lib/libc/sparc/Makefile.com
+++ b/usr/src/lib/libc/sparc/Makefile.com
@@ -136,6 +136,9 @@ COMOBJS=			\
 DTRACEOBJS=			\
 	dtrace_data.o
 
+SECFLAGSOBJS=			\
+	secflags.o
+
 GENOBJS=			\
 	_getsp.o		\
 	_xregs_clrptr.o		\
@@ -285,6 +288,7 @@ COMSYSOBJS=			\
 	processor_bind.o	\
 	processor_info.o	\
 	profil.o		\
+	psecflagsset.o		\
 	putmsg.o		\
 	putpmsg.o		\
 	pwrite.o		\
@@ -558,6 +562,7 @@ PORTGEN=			\
 	priocntl.o		\
 	privlib.o		\
 	priv_str_xlate.o	\
+	psecflags.o		\
 	psiginfo.o		\
 	psignal.o		\
 	pt.o			\
@@ -1039,6 +1044,7 @@ MOSTOBJS=			\
 	$(PORTSYS64)		\
 	$(AIOOBJS)		\
 	$(RTOBJS)		\
+	$(SECFLAGSOBJS)		\
 	$(TPOOLOBJS)		\
 	$(THREADSOBJS)		\
 	$(THREADSMACHOBJS)	\
@@ -1181,6 +1187,7 @@ SRCS=							\
 	$(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)			\
 	$(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)			\
 	$(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)			\
+	$(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)		\
 	$(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)		\
 	$(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)		\
 	$(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)	\
diff --git a/usr/src/lib/libc/sparcv9/Makefile.com b/usr/src/lib/libc/sparcv9/Makefile.com
index ff896639e2..56f8980f36 100644
--- a/usr/src/lib/libc/sparcv9/Makefile.com
+++ b/usr/src/lib/libc/sparcv9/Makefile.com
@@ -269,6 +269,7 @@ COMSYSOBJS=			\
 	processor_bind.o	\
 	processor_info.o	\
 	profil.o		\
+	psecflagsset.o		\
 	putmsg.o		\
 	putpmsg.o		\
 	pwrite.o		\
@@ -519,6 +520,7 @@ PORTGEN=			\
 	priocntl.o		\
 	privlib.o		\
 	priv_str_xlate.o	\
+	psecflags.o		\
 	psiginfo.o		\
 	psignal.o		\
 	pt.o			\
@@ -830,6 +832,9 @@ RTOBJS=				\
 	shm.o			\
 	sigev_thread.o
 
+SECFLAGSOBJS=			\
+	secflags.o
+
 TPOOLOBJS=			\
 	thread_pool.o
 
@@ -978,6 +983,7 @@ MOSTOBJS=			\
 	$(PORTSYS64)		\
 	$(AIOOBJS)		\
 	$(RTOBJS)		\
+	$(SECFLAGSOBJS)		\
 	$(TPOOLOBJS)		\
 	$(THREADSOBJS)		\
 	$(THREADSMACHOBJS)	\
@@ -1110,6 +1116,7 @@ SRCS=							\
 	$(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)			\
 	$(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)			\
 	$(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)			\
+	$(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)		\
 	$(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)		\
 	$(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)		\
 	$(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)	\