elf: execve statically linked programs instead of crashing [BZ #28648]
Checks
Context |
Check |
Description |
dj/TryBot-apply_patch |
success
|
Patch applied to master at the time it was sent
|
dj/TryBot-32bit |
success
|
Build for i686
|
Commit Message
Programs without dynamic dependencies and without a program
interpreter are now run via execve.
Previously, the dynamic linker either crashed while attempting to
read a non-existing dynamic segment (looking for DT_AUDIT/DT_DEPAUDIT
data), or the self-relocated in the static PIE executable crashed
because the outer dynamic linker had already applied RELRO protection.
<dl-execve.h> is needed because execve is not available in the
dynamic loader on Hurd.
Tested on i686-linux-gnu and x86_64-linux-gnu. Built with
build-many-glibcs.py.
---
NEWS | 4 +++
elf/Makefile | 3 ++
elf/rtld.c | 54 +++++++++++++++++++++++++++-----
elf/tst-rtld-run-static.c | 62 +++++++++++++++++++++++++++++++++++++
sysdeps/generic/dl-execve.h | 25 +++++++++++++++
sysdeps/unix/sysv/linux/dl-execve.h | 25 +++++++++++++++
6 files changed, 165 insertions(+), 8 deletions(-)
Comments
On Sat, Dec 4, 2021 at 11:05 AM Florian Weimer via Libc-alpha
<libc-alpha@sourceware.org> wrote:
>
> Programs without dynamic dependencies and without a program
> interpreter are now run via execve.
>
> Previously, the dynamic linker either crashed while attempting to
> read a non-existing dynamic segment (looking for DT_AUDIT/DT_DEPAUDIT
> data), or the self-relocated in the static PIE executable crashed
> because the outer dynamic linker had already applied RELRO protection.
>
> <dl-execve.h> is needed because execve is not available in the
> dynamic loader on Hurd.
>
> Tested on i686-linux-gnu and x86_64-linux-gnu. Built with
> build-many-glibcs.py.
>
> ---
> NEWS | 4 +++
> elf/Makefile | 3 ++
> elf/rtld.c | 54 +++++++++++++++++++++++++++-----
> elf/tst-rtld-run-static.c | 62 +++++++++++++++++++++++++++++++++++++
> sysdeps/generic/dl-execve.h | 25 +++++++++++++++
> sysdeps/unix/sysv/linux/dl-execve.h | 25 +++++++++++++++
> 6 files changed, 165 insertions(+), 8 deletions(-)
>
> diff --git a/NEWS b/NEWS
> index f10971b180..1398cf2e87 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -184,6 +184,10 @@ Major new features:
> than or equal to a given integer. This function is a GNU extension,
> although Solaris also provides a similar function.
>
> +* When invoked explicitly, the dynamic linker now uses the kernel to
> + execute programs that do not have any dynamic dependency (that is,
> + they are statically linked). This feature is Linux-specific.
> +
> Deprecated and removed features, and other changes affecting compatibility:
>
> * The function pthread_mutex_consistent_np has been deprecated; programs
> diff --git a/elf/Makefile b/elf/Makefile
> index 4723c159cb..ef36008673 100644
> --- a/elf/Makefile
> +++ b/elf/Makefile
> @@ -231,6 +231,7 @@ tests += restest1 preloadtest loadfail multiload origtest resolvfail \
> tst-tls20 tst-tls21 tst-dlmopen-dlerror tst-dlmopen-gethostbyname \
> tst-dl-is_dso tst-ro-dynamic \
> tst-audit18 \
> + tst-rtld-run-static \
> # reldep9
> tests-internal += loadtest unload unload2 circleload1 \
> neededtest neededtest2 neededtest3 neededtest4 \
> @@ -1977,3 +1978,5 @@ $(objpfx)tst-ro-dynamic-mod.so: $(objpfx)tst-ro-dynamic-mod.os \
> $(LINK.o) -nostdlib -nostartfiles -shared -o $@ \
> -Wl,--script=tst-ro-dynamic-mod.map \
> $(objpfx)tst-ro-dynamic-mod.os
> +
> +$(objpfx)tst-rtld-run-static.out: $(objpfx)/ldconfig
> diff --git a/elf/rtld.c b/elf/rtld.c
> index 847141e21d..4291fe8640 100644
> --- a/elf/rtld.c
> +++ b/elf/rtld.c
> @@ -50,6 +50,7 @@
> #include <gnu/lib-names.h>
> #include <dl-tunables.h>
> #include <get-dynamic-info.h>
> +#include <dl-execve.h>
>
> #include <assert.h>
>
> @@ -1106,6 +1107,49 @@ load_audit_modules (struct link_map *main_map, struct audit_list *audit_list)
> }
> }
>
> +/* Check if the executable is not actualy dynamically linked, and
> + invoke it directly in that case. */
> +static void
> +rtld_chain_load (struct link_map *main_map, char *argv0)
> +{
> + /* The dynamic loader run against itself. */
> + const char *rtld_soname = "ld.so";
Why is "ld.so" used? ld.so should have DT_SONAME.
> + if (GL(dl_rtld_map).l_info[DT_SONAME] != NULL)
Should ld.so stop if it doesn't have DT_SONAME?
> + {
> + rtld_soname = ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
> + + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val);
> + if (rtld_soname != NULL
> + && main_map->l_info[DT_SONAME] != NULL
> + && strcmp (rtld_soname,
> + (const char *) D_PTR (main_map, l_info[DT_STRTAB])
> + + main_map->l_info[DT_SONAME]->d_un.d_val) == 0)
> + _dl_fatal_printf ("%s: loader cannot load itself\n", rtld_soname);
> + }
> +
> + /* With DT_NEEDED dependencies, the executable is dynamically
> + linked. */
> + if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
> + return;
> +
> + /* If the executable has program interpreter, it is dynamically
> + linked. */
> + for (size_t i = 0; i < main_map->l_phnum; ++i)
> + if (main_map->l_phdr[i].p_type == PT_INTERP)
> + return;
> +
> + const char *pathname = _dl_argv[0];
> + if (argv0 != NULL)
> + _dl_argv[0] = argv0;
> + int errcode = __rtld_execve (pathname, _dl_argv, _environ);
> + const char *errname = strerrorname_np (errcode);
> + if (errname != NULL)
> + _dl_fatal_printf("%s: cannot execute %s: %s\n",
> + rtld_soname, pathname, errname);
> + else
> + _dl_fatal_printf("%s: cannot execute %s: %d\n",
> + rtld_soname, pathname, errno);
> +}
> +
> static void
> dl_main (const ElfW(Phdr) *phdr,
> ElfW(Word) phnum,
> @@ -1374,14 +1418,8 @@ dl_main (const ElfW(Phdr) *phdr,
> /* Now the map for the main executable is available. */
> main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
>
> - if (__glibc_likely (state.mode == rtld_mode_normal)
> - && GL(dl_rtld_map).l_info[DT_SONAME] != NULL
> - && main_map->l_info[DT_SONAME] != NULL
> - && strcmp ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
> - + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val,
> - (const char *) D_PTR (main_map, l_info[DT_STRTAB])
> - + main_map->l_info[DT_SONAME]->d_un.d_val) == 0)
> - _dl_fatal_printf ("loader cannot load itself\n");
> + if (__glibc_likely (state.mode == rtld_mode_normal))
> + rtld_chain_load (main_map, argv0);
>
> phdr = main_map->l_phdr;
> phnum = main_map->l_phnum;
> diff --git a/elf/tst-rtld-run-static.c b/elf/tst-rtld-run-static.c
> new file mode 100644
> index 0000000000..7281093504
> --- /dev/null
> +++ b/elf/tst-rtld-run-static.c
> @@ -0,0 +1,62 @@
> +/* Test running statically linked programs using ld.so.
> + Copyright (C) 2021 Free Software Foundation, Inc.
> + This file is part of the GNU C Library.
> +
> + The GNU C Library is free software; you can redistribute it and/or
> + modify it under the terms of the GNU Lesser General Public
> + License as published by the Free Software Foundation; either
> + version 2.1 of the License, or (at your option) any later version.
> +
> + The GNU C Library is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + Lesser General Public License for more details.
> +
> + You should have received a copy of the GNU Lesser General Public
> + License along with the GNU C Library; if not, see
> + <https://www.gnu.org/licenses/>. */
> +
> +#include <support/check.h>
> +#include <support/support.h>
> +#include <support/capture_subprocess.h>
> +#include <string.h>
> +#include <stdlib.h>
> +
> +static int
> +do_test (void)
> +{
> + char *ldconfig_path = xasprintf ("%s/elf/ldconfig", support_objdir_root);
> +
> + {
> + char *argv[] = { (char *) "ld.so", ldconfig_path, (char *) "--help", NULL };
> + struct support_capture_subprocess cap
> + = support_capture_subprogram (support_objdir_elf_ldso, argv);
> + support_capture_subprocess_check (&cap, "no --argv0", 0, sc_allow_stdout);
> + puts ("info: output without --argv0:");
> + puts (cap.out.buffer);
> + TEST_VERIFY (strstr (cap.out.buffer, "Usage: ldconfig [OPTION...]\n")
> + == cap.out.buffer);
> + support_capture_subprocess_free (&cap);
> + }
> +
> + {
> + char *argv[] =
> + {
> + (char *) "ld.so", (char *) "--argv0", (char *) "ldconfig-argv0",
> + ldconfig_path, (char *) "--help", NULL
> + };
> + struct support_capture_subprocess cap
> + = support_capture_subprogram (support_objdir_elf_ldso, argv);
> + support_capture_subprocess_check (&cap, "with --argv0", 0, sc_allow_stdout);
> + puts ("info: output with --argv0:");
> + puts (cap.out.buffer);
> + TEST_VERIFY (strstr (cap.out.buffer, "Usage: ldconfig-argv0 [OPTION...]\n")
> + == cap.out.buffer);
> + support_capture_subprocess_free (&cap);
> + }
> +
> + free (ldconfig_path);
> + return 0;
> +}
> +
> +#include <support/test-driver.c>
> diff --git a/sysdeps/generic/dl-execve.h b/sysdeps/generic/dl-execve.h
> new file mode 100644
> index 0000000000..5fd097df69
> --- /dev/null
> +++ b/sysdeps/generic/dl-execve.h
> @@ -0,0 +1,25 @@
> +/* execve for the dynamic linker. Generic stub version.
> + Copyright (C) 2021 Free Software Foundation, Inc.
> + This file is part of the GNU C Library.
> +
> + The GNU C Library is free software; you can redistribute it and/or
> + modify it under the terms of the GNU Lesser General Public
> + License as published by the Free Software Foundation; either
> + version 2.1 of the License, or (at your option) any later version.
> +
> + The GNU C Library is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + Lesser General Public License for more details.
> +
> + You should have received a copy of the GNU Lesser General Public
> + License along with the GNU C Library; if not, see
> + <https://www.gnu.org/licenses/>. */
> +
> +#include <errno.h>
> +
> +static int
> +__rtld_execve (const char *path, char *const *argv, char *const *envp)
> +{
> + return ENOSYS;
> +}
> diff --git a/sysdeps/unix/sysv/linux/dl-execve.h b/sysdeps/unix/sysv/linux/dl-execve.h
> new file mode 100644
> index 0000000000..ead3e1c28d
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/dl-execve.h
> @@ -0,0 +1,25 @@
> +/* execve for the dynamic linker. Linux version.
> + Copyright (C) 2021 Free Software Foundation, Inc.
> + This file is part of the GNU C Library.
> +
> + The GNU C Library is free software; you can redistribute it and/or
> + modify it under the terms of the GNU Lesser General Public
> + License as published by the Free Software Foundation; either
> + version 2.1 of the License, or (at your option) any later version.
> +
> + The GNU C Library is distributed in the hope that it will be useful,
> + but WITHOUT ANY WARRANTY; without even the implied warranty of
> + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + Lesser General Public License for more details.
> +
> + You should have received a copy of the GNU Lesser General Public
> + License along with the GNU C Library; if not, see
> + <https://www.gnu.org/licenses/>. */
> +
> +#include <errno.h>
> +
> +static inline int
> +__rtld_execve (const char *path, char *const *argv, char *const *envp)
> +{
> + return -INTERNAL_SYSCALL_CALL (execve, path, argv, envp);
> +}
>
* H. J. Lu:
>> +/* Check if the executable is not actualy dynamically linked, and
>> + invoke it directly in that case. */
>> +static void
>> +rtld_chain_load (struct link_map *main_map, char *argv0)
>> +{
>> + /* The dynamic loader run against itself. */
>> + const char *rtld_soname = "ld.so";
>
> Why is "ld.so" used? ld.so should have DT_SONAME.
>
>> + if (GL(dl_rtld_map).l_info[DT_SONAME] != NULL)
>
> Should ld.so stop if it doesn't have DT_SONAME?
This was there before:
>> - if (__glibc_likely (state.mode == rtld_mode_normal)
>> - && GL(dl_rtld_map).l_info[DT_SONAME] != NULL
Should I just remove it? We link with:
-Wl,-soname=$(rtld-installed-name) \
So no soname should just not happen.
Thanks,
Florian
On Sat, Dec 4, 2021 at 11:53 AM Florian Weimer <fweimer@redhat.com> wrote:
>
> * H. J. Lu:
>
> >> +/* Check if the executable is not actualy dynamically linked, and
> >> + invoke it directly in that case. */
> >> +static void
> >> +rtld_chain_load (struct link_map *main_map, char *argv0)
> >> +{
> >> + /* The dynamic loader run against itself. */
> >> + const char *rtld_soname = "ld.so";
> >
> > Why is "ld.so" used? ld.so should have DT_SONAME.
> >
> >> + if (GL(dl_rtld_map).l_info[DT_SONAME] != NULL)
> >
> > Should ld.so stop if it doesn't have DT_SONAME?
>
> This was there before:
>
> >> - if (__glibc_likely (state.mode == rtld_mode_normal)
> >> - && GL(dl_rtld_map).l_info[DT_SONAME] != NULL
>
> Should I just remove it? We link with:
>
> -Wl,-soname=$(rtld-installed-name) \
>
> So no soname should just not happen.
>
Just remove it. If you want, you can stop if DT_SONAME
doesn't exist.
@@ -184,6 +184,10 @@ Major new features:
than or equal to a given integer. This function is a GNU extension,
although Solaris also provides a similar function.
+* When invoked explicitly, the dynamic linker now uses the kernel to
+ execute programs that do not have any dynamic dependency (that is,
+ they are statically linked). This feature is Linux-specific.
+
Deprecated and removed features, and other changes affecting compatibility:
* The function pthread_mutex_consistent_np has been deprecated; programs
@@ -231,6 +231,7 @@ tests += restest1 preloadtest loadfail multiload origtest resolvfail \
tst-tls20 tst-tls21 tst-dlmopen-dlerror tst-dlmopen-gethostbyname \
tst-dl-is_dso tst-ro-dynamic \
tst-audit18 \
+ tst-rtld-run-static \
# reldep9
tests-internal += loadtest unload unload2 circleload1 \
neededtest neededtest2 neededtest3 neededtest4 \
@@ -1977,3 +1978,5 @@ $(objpfx)tst-ro-dynamic-mod.so: $(objpfx)tst-ro-dynamic-mod.os \
$(LINK.o) -nostdlib -nostartfiles -shared -o $@ \
-Wl,--script=tst-ro-dynamic-mod.map \
$(objpfx)tst-ro-dynamic-mod.os
+
+$(objpfx)tst-rtld-run-static.out: $(objpfx)/ldconfig
@@ -50,6 +50,7 @@
#include <gnu/lib-names.h>
#include <dl-tunables.h>
#include <get-dynamic-info.h>
+#include <dl-execve.h>
#include <assert.h>
@@ -1106,6 +1107,49 @@ load_audit_modules (struct link_map *main_map, struct audit_list *audit_list)
}
}
+/* Check if the executable is not actualy dynamically linked, and
+ invoke it directly in that case. */
+static void
+rtld_chain_load (struct link_map *main_map, char *argv0)
+{
+ /* The dynamic loader run against itself. */
+ const char *rtld_soname = "ld.so";
+ if (GL(dl_rtld_map).l_info[DT_SONAME] != NULL)
+ {
+ rtld_soname = ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
+ + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val);
+ if (rtld_soname != NULL
+ && main_map->l_info[DT_SONAME] != NULL
+ && strcmp (rtld_soname,
+ (const char *) D_PTR (main_map, l_info[DT_STRTAB])
+ + main_map->l_info[DT_SONAME]->d_un.d_val) == 0)
+ _dl_fatal_printf ("%s: loader cannot load itself\n", rtld_soname);
+ }
+
+ /* With DT_NEEDED dependencies, the executable is dynamically
+ linked. */
+ if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
+ return;
+
+ /* If the executable has program interpreter, it is dynamically
+ linked. */
+ for (size_t i = 0; i < main_map->l_phnum; ++i)
+ if (main_map->l_phdr[i].p_type == PT_INTERP)
+ return;
+
+ const char *pathname = _dl_argv[0];
+ if (argv0 != NULL)
+ _dl_argv[0] = argv0;
+ int errcode = __rtld_execve (pathname, _dl_argv, _environ);
+ const char *errname = strerrorname_np (errcode);
+ if (errname != NULL)
+ _dl_fatal_printf("%s: cannot execute %s: %s\n",
+ rtld_soname, pathname, errname);
+ else
+ _dl_fatal_printf("%s: cannot execute %s: %d\n",
+ rtld_soname, pathname, errno);
+}
+
static void
dl_main (const ElfW(Phdr) *phdr,
ElfW(Word) phnum,
@@ -1374,14 +1418,8 @@ dl_main (const ElfW(Phdr) *phdr,
/* Now the map for the main executable is available. */
main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
- if (__glibc_likely (state.mode == rtld_mode_normal)
- && GL(dl_rtld_map).l_info[DT_SONAME] != NULL
- && main_map->l_info[DT_SONAME] != NULL
- && strcmp ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB])
- + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val,
- (const char *) D_PTR (main_map, l_info[DT_STRTAB])
- + main_map->l_info[DT_SONAME]->d_un.d_val) == 0)
- _dl_fatal_printf ("loader cannot load itself\n");
+ if (__glibc_likely (state.mode == rtld_mode_normal))
+ rtld_chain_load (main_map, argv0);
phdr = main_map->l_phdr;
phnum = main_map->l_phnum;
new file mode 100644
@@ -0,0 +1,62 @@
+/* Test running statically linked programs using ld.so.
+ Copyright (C) 2021 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <support/check.h>
+#include <support/support.h>
+#include <support/capture_subprocess.h>
+#include <string.h>
+#include <stdlib.h>
+
+static int
+do_test (void)
+{
+ char *ldconfig_path = xasprintf ("%s/elf/ldconfig", support_objdir_root);
+
+ {
+ char *argv[] = { (char *) "ld.so", ldconfig_path, (char *) "--help", NULL };
+ struct support_capture_subprocess cap
+ = support_capture_subprogram (support_objdir_elf_ldso, argv);
+ support_capture_subprocess_check (&cap, "no --argv0", 0, sc_allow_stdout);
+ puts ("info: output without --argv0:");
+ puts (cap.out.buffer);
+ TEST_VERIFY (strstr (cap.out.buffer, "Usage: ldconfig [OPTION...]\n")
+ == cap.out.buffer);
+ support_capture_subprocess_free (&cap);
+ }
+
+ {
+ char *argv[] =
+ {
+ (char *) "ld.so", (char *) "--argv0", (char *) "ldconfig-argv0",
+ ldconfig_path, (char *) "--help", NULL
+ };
+ struct support_capture_subprocess cap
+ = support_capture_subprogram (support_objdir_elf_ldso, argv);
+ support_capture_subprocess_check (&cap, "with --argv0", 0, sc_allow_stdout);
+ puts ("info: output with --argv0:");
+ puts (cap.out.buffer);
+ TEST_VERIFY (strstr (cap.out.buffer, "Usage: ldconfig-argv0 [OPTION...]\n")
+ == cap.out.buffer);
+ support_capture_subprocess_free (&cap);
+ }
+
+ free (ldconfig_path);
+ return 0;
+}
+
+#include <support/test-driver.c>
new file mode 100644
@@ -0,0 +1,25 @@
+/* execve for the dynamic linker. Generic stub version.
+ Copyright (C) 2021 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <errno.h>
+
+static int
+__rtld_execve (const char *path, char *const *argv, char *const *envp)
+{
+ return ENOSYS;
+}
new file mode 100644
@@ -0,0 +1,25 @@
+/* execve for the dynamic linker. Linux version.
+ Copyright (C) 2021 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <errno.h>
+
+static inline int
+__rtld_execve (const char *path, char *const *argv, char *const *envp)
+{
+ return -INTERNAL_SYSCALL_CALL (execve, path, argv, envp);
+}