Security hardening merged: safer usercopy, user-fault isolation, and ARP cache protection

[idrassi]

I have opened 3 security-focused pull requests that have now been merged into main. Together, they strengthen three important isolation boundaries in TinyOS Enhanced: kernel access to user memory, containment of faulty user tasks, and trust management in the ARP cache.

1. PAE-aware usercopy validation

PR #22: fix(usercopy): enforce PAE user page permissions

The copy_from_user() and copy_to_user() helpers cross the user/kernel privilege boundary. Previously, they relied mainly on virtual-address bounds and fault recovery, without first proving that every page in the supplied range was present and accessible from user mode. In addition, destinations passed to copy_to_user() were not explicitly required to be writable.

This could allow malformed or malicious user pointers to make the kernel access unmapped, supervisor-only, or read-only pages. Depending on the affected call path, this weakened protection against kernel memory disclosure, corruption, and denial of service.

The merged change now walks the active PAE page tables before dereferencing a user pointer. Every covered page must be present and marked as user-accessible, and copy_to_user() additionally requires writable mappings. Null-page access, address overflow, unmapped pages, supervisor mappings, and ranges outside user space are rejected.

Fault recovery remains as defense in depth, but it is no longer used as the primary authorization mechanism.

2. Containment of user-mode CPU exceptions

PR #23: fix(exceptions): terminate faulty user tasks

Previously, ordinary CPU exceptions raised by a CPL3 task could reach the generic kernel panic path. A buggy or malicious user program could therefore trigger an exception such as an invalid opcode and turn a single-task failure into a system-wide denial of service.

The interrupt path now distinguishes containable user-mode exceptions from kernel faults and system-critical exceptions. When an ordinary CPL3 exception occurs, TinyOS records an audit event, terminates the responsible task, queues it for normal cleanup, and schedules another runnable task.

Kernel-mode faults and critical vectors such as NMI, double fault, and machine check remain fatal. This preserves fail-stop behavior for conditions where continuing execution would be unsafe while ensuring that an ordinary user process cannot crash the entire operating system.

3. ARP cache learning hardening

PR #24: fix(net): harden ARP cache learning

ARP cache poisoning can redirect, intercept, modify, or drop network traffic. The gateway mapping is especially sensitive because replacing its MAC address can affect all off-subnet communication.

Before this change, ARP validation policy was distributed across callers, while the underlying cache-update routine could replace an existing mapping whenever it was reached. Incoming IP packets could also influence the ARP cache before completing IP, firewall, and IDS validation.

The merged implementation centralizes the trust policy in arp_cache_update(). It now:

• Rejects invalid sender IP and MAC addresses, self mappings, and off-subnet senders.
• Prevents unsolicited replacement of an existing IP-to-MAC mapping.
• Requires a matching pending ARP request before accepting a changed mapping.
• Requires pending resolution before learning the gateway entry.
• Refreshes unchanged mappings without unnecessarily replacing them.
• Performs passive local-peer learning only after the packet has passed the relevant IP, firewall, and IDS checks.

This substantially reduces exposure to unsolicited cache poisoning. It does not make ARP cryptographically authenticated, so an attacker able to answer or race a solicited request remains outside the protection provided by this policy.

Regression coverage

The security test suite was extended alongside these changes. It now covers PAE permission and boundary cases for usercopy, containment of a user task executing UD2, and multiple legitimate and hostile ARP-learning scenarios.

Each change was also validated by building the kernel and ISO and running the complete sectest suite under QEMU.

These improvements make TinyOS Enhanced a stronger base for secure operating system development by demonstrating explicit page-table authorization, process-level fault isolation, and centralized validation of security-sensitive network state.