12. Segregation of Kernel Memory from Userspace Memory

Segregation of Kernel Memory from Userspace Memory

Segregation of kernel memory from userspace memory is a security feature implemented in modern operating systems, including x86's Supervisor Mode Execution Protection (SMEP), Supervisor Mode Access Prevention (SMAP), and ARM's Privileged eXecute Never (PXN) and Privileged Access Never (PAN). These features prevent the execution of code from userspace memory in the kernel and restrict access to kernel memory from userspace.

Lab Activity: Demonstrating Segregation of Kernel Memory from Userspace Memory

In this lab activity, we'll demonstrate the implementation of SMAP (Supervisor Mode Access Prevention) in an x86-based system.

With SMAP Enabled

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void kernel_function() {
    printf("Kernel function called!\n");
}

int main() {
    void (*func_ptr)() = kernel_function;

    asm volatile (
        "movq %0, %%rax\n\t"
        "call *%%rax"
        : 
        : "r" (func_ptr)
        : "rax"
    );

    return 0;
}

In this code snippet, we attempt to call a kernel function directly from userspace memory. However, with SMAP enabled, such attempts would result in a segmentation fault or a similar access violation error.