tree c9c58b5a396ae6543a5c669ca91e2d7935e6d131
parent 68ca3a9b2a5d6067e26d3e1cf535327b2f9e0b76
author Gaurav-Aggarwal-AWS <33462878+aggarg@users.noreply.github.com> 1607363602 -0800
committer GitHub <noreply@github.com> 1607363602 -0800
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJfzmwSCRBK7hj4Ov3rIwAAdHIIAEy8iSxsh4/jgoSj8CqdQMmZ
 eNu1w056u6mPktfeUjQ7843eir2URfv9FHoPO5V1iu3HJc0g4/Hg+NpjMPFcG1cn
 jRuaVJI+RSXx3preuAX4CpNqJcbYfKdtTbrHy2hfaMlrT+iT0YditneoU3q21tLj
 6FLTRga3qojpmivRJERGYDWU20mCKyIawOTaV7IaINl/fNl9rT4RrlzS7zxIvD1I
 auvM86G0+AYtx1IbgEjgQ54h8RGGHMdE82ouiDksMupSk5ZelCVjXadXAu1zhIt4
 SvjuoKmq+OzmkvooVusf3l485TpD3XdpVRnw2GabfInBHMxYM0qCKutD30601Wo=
 =o3k9
 -----END PGP SIGNATURE-----
 

Prevent unprivileged task from altering MPU configuration (#227)

This change removes the FreeRTOS System Calls (aka MPU wrappers) for the
following kernel APIs:
- xTaskCreateRestricted
- xTaskCreateRestrictedStatic
- vTaskAllocateMPURegions

A system call allows an unprivileged task to execute a kernel API which
is otherwise accessible to privileged software only. The above 3 APIs
can create a new task with a different MPU configuration or alter the
MPU configuration of an existing task. This an be (mis)used by an
unprivileged task to grant itself access to a region which it does not
have access to.

Removing the system calls for these APIs ensures that an unprivileged
task cannot execute this APIs. If an unprivileged task attempts to
execute any of these API, it will result in a Memory Fault.

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>