mprotect: Setting Memory Permissions

• We showed how to use the mmap system call to map a file into memory. Recall that the third argument to mmap is a bitwise or of memory protection flags PROT_READ, PROT_WRITE, and PROT_EXEC for read, write, and execute permission, respectively, or PROT_NONE for no memory access.
• If a program attempts to perform an operation on a memory location that is not allowed by these permissions, it is terminated with a SIGSEGV (segmentation violation) signal.
• After memory has been mapped, these permissions can be modified with the mprotect system call.
• Obtaining Page-Aligned Memory; Note that memory regions returned by malloc are typically not page-aligned, even if the size of the memory is a multiple of the page size. If you want to protect memory obtained from malloc, you will have to allocate a larger memory region and find a page-aligned region within it.

  int fd = open ("/dev/zero",O_RDONLY);
  char* memory = mmap (NULL, page_size, PROT_READ | PROT_WRITE,
  MAP_PRIVATE, fd, 0);
  close (fd);
  mprotect (memory, page_size, PROT_READ);
  

• An advanced technique to monitor memory access is to protect the region of memory using mmap or mprotect and then handle the SIGSEGV signal that Linux sends to the program when it tries to access that memory.
• The http://siber.cankaya.edu.tr/SystemsProgramming/cfiles/mprotect.c example in Fig. 6 illustrates this technique.

  Figure 6: Detect Memory Access Using mprotect.