BSD syscall#74
svc · unix #74
mprotect
Changes the protection (read / write / execute) of a range of mapped pages.
Prototype
int mprotect(caddr_t addr, size_t len, int prot);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| addr | caddr_t | - | |
| len | size_t | - | |
| prot | int | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 74 |
| xnu-1486.2.11 | — | 74 |
| xnu-1504.15.3 | — | 74 |
| xnu-1504.3.12 | — | 74 |
| xnu-1504.7.4 | — | 74 |
| xnu-1504.9.17 | — | 74 |
| xnu-1504.9.26 | — | 74 |
| xnu-1504.9.37 | — | 74 |
Examples
C — make a page executable
if (mprotect(jit, 0x4000, PROT_READ | PROT_EXEC) != 0) {
perror("mprotect");
}Notes
mprotect(2) translates into mach_vm_protect() on the task's vm_map. Under the hardened runtime, transitioning a page to PROT_EXEC requires that the underlying object was created with MAP_JIT or that the page was loaded from a code-signed Mach-O. On Apple Silicon the toggle is paired with pthread_jit_write_protect_np() to flip the per-thread APRR/SPRR W^X mode.
Detection
Endpoint Security ships ES_EVENT_TYPE_NOTIFY_MPROTECT with the requested protection bits and address range. DTrace's syscall::mprotect:entry is the equivalent low-overhead probe.
Related APIs
mmapmach_vm_protectvm_protectpthread_jit_write_protect_np