Selective access to executable memory
In an embodiment, a data processing method comprises: in a computer executing a supervisor program, the supervisor program establishing different memory access permissions comprising any combination of read, write, and execute permissions for one or more different regions of memory of a first domain, receiving a request from a process to execute a particular memory page of the regions of memory, the particular memory page comprising a memory access permission set to read-writeable or read-only, throwing an execute fault for the particular memory page, performing one or more responsive actions to restore execution access or content of the particular memory page, and after performing the one or more responsive actions, setting the memory access permission to execute only.
1. A computer-implemented method comprising:
in a computer executing a supervisor program:
the supervisor program establishing a plurality of different memory access permissions comprising any combination of read, write, and execute permissions for one or more different regions of memory of a first domain;
receiving a request from a process to execute a particular memory page of the regions of memory, wherein the particular memory page comprises a memory access permission set to read-writeable or read-only;
throwing an execute fault for the particular memory page;
performing one or more responsive actions to restore execution access or content of the particular memory page;
after performing the one or more responsive actions, setting the memory access permission to execute only;
permitting the process to execute the particular memory page.
2. The method of claim 1 , wherein execution access is restored by removing the read-writeable or read-only memory access permission.
3. The method of claim 1 , wherein the content comprises one or more data values of the particular memory page that had been deleted or updated.
4. The method of claim 3 , wherein the one or more data values are restored from a copy of the particular memory page accessible to the supervisor program.
5. The method of claim 1 , wherein the supervisor program is a hypervisor.
6. The method of claim 1 , further comprising determining one or more responsive actions to perform based on an identity of the process.
7. One or more non-transitory computer-readable media storing one or more sequence of instructions which when executed cause one or more computing device to perform:
establishing a plurality of different memory access permissions comprising any combination of read, write, and execute permissions for one or more different regions of memory of a first domain;
receiving a request from a process to execute a particular memory page of the regions of memory, wherein the particular memory page comprises a memory access permission set to read-writeable or read-only;
throwing an execute fault for the particular memory page;
performing one or more responsive actions to restore execution access or content of the particular memory page;
after performing the one or more responsive actions, setting the memory access permission to execute only;
permitting the process to execute the particular memory page.
8. The non-transitory computer-readable media of claim 7 , wherein execution access is restored by removing the read-writeable or read-only memory access permission.
9. The non-transitory computer-readable media of claim 7 , wherein the content comprises one or more data values of the particular memory page that had been deleted or updated.
10. The non-transitory computer-readable media of claim 9 , wherein the one or more data values are restored from a copy of the particular memory page accessible to a supervisor program.
11. The non-transitory computer-readable media of claim 7 , wherein the one or more sequence of instructions comprise a supervisor program, and wherein the supervisor program is a hypervisor.
12. The non-transitory computer-readable media of claim 7 , further comprising determining one or more responsive actions to perform based on an identity of the process.
13. A system comprising:
a processor and a memory, the memory storing instructions for a supervisor program which, when executed by the processor, cause:
establishing a plurality of different memory access permissions comprising any combination of read, write, and execute permissions for one or more different regions of memory of a first domain;
receiving a request from a process to execute a particular memory page of the regions of memory, wherein the particular memory page comprises a memory access permission set to read-writeable or read-only;
throwing an execute fault for the particular memory page;
performing one or more responsive actions to restore execution access or content of the particular memory page;
after performing the one or more responsive actions, setting the memory access permission to execute only;
permitting the process to execute the particular memory page.
14. The system of claim 13 , wherein execution access is restored by removing the read-writeable or read-only memory access permission.
15. The system of claim 13 , wherein the content comprises one or more data values of the particular memory page that had been deleted or updated.
16. The system of claim 15 , wherein the one or more data values are restored from a copy of the particular memory page accessible to the supervisor program.
17. The system of claim 13 , wherein the supervisor program is a hypervisor.