diff mbox series

[v3,10/20] elf: Add _dl_audit_symbind_alt and _dl_audit_symbind

Message ID 20210730194715.881900-11-adhemerval.zanella@linaro.org
State New
Headers show
Series Some rtld-audit fixes | expand

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent

Commit Message

Adhemerval Zanella July 30, 2021, 7:47 p.m. UTC
It consolidates the code required to call la_symbind{32,64}() audit
callback.

No function change, checked on x86_64-linux-gnu.
---
 elf/Versions               |   1 +
 elf/dl-audit.c             | 122 +++++++++++++++++++++++++++++++++++++
 elf/dl-runtime.c           |  77 -----------------------
 elf/dl-sym-post.h          |  47 +-------------
 sysdeps/generic/ldsodefs.h |  14 +++++
 5 files changed, 138 insertions(+), 123 deletions(-)
diff mbox series

Patch

diff --git a/elf/Versions b/elf/Versions
index 775aab62af..25e91339b5 100644
--- a/elf/Versions
+++ b/elf/Versions
@@ -55,6 +55,7 @@  ld {
     _dl_argv; _dl_find_dso_for_object; _dl_get_tls_static_info;
     _dl_deallocate_tls; _dl_make_stack_executable;
     _dl_rtld_di_serinfo; _dl_starting_up; _dl_fatal_printf;
+    _dl_audit_symbind_alt;
     _rtld_global; _rtld_global_ro;
 
     # Only here for gdb while a better method is developed.
diff --git a/elf/dl-audit.c b/elf/dl-audit.c
index ef34ff761c..8e4c65fdaf 100644
--- a/elf/dl-audit.c
+++ b/elf/dl-audit.c
@@ -16,6 +16,7 @@ 
    License along with the GNU C Library; if not, see
    <https://www.gnu.org/licenses/>.  */
 
+#include <assert.h>
 #include <ldsodefs.h>
 
 #ifdef SHARED
@@ -120,4 +121,125 @@  _dl_audit_objclose (struct link_map *l, Lmid_t nsid)
       afct = afct->next;
     }
 }
+
+void
+_dl_audit_symbind_alt (struct link_map *l, const ElfW(Sym) *ref, void **value,
+		       lookup_t result)
+{
+  if ((l->l_audit_any_plt | result->l_audit_any_plt) == 0)
+    return;
+
+  const char *strtab = (const char *) D_PTR (result, l_info[DT_STRTAB]);
+  /* Compute index of the symbol entry in the symbol table of the DSO with
+     the definition.  */
+  unsigned int ndx = (ref - (ElfW(Sym) *) D_PTR (result, l_info[DT_SYMTAB]));
+
+  unsigned int altvalue = 0;
+  /* Synthesize a symbol record where the st_value field is the result.  */
+  ElfW(Sym) sym = *ref;
+  sym.st_value = (ElfW(Addr)) *value;
+
+  struct audit_ifaces *afct = GLRO(dl_audit);
+  for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
+    {
+      struct auditstate *match_audit = link_map_audit_state (l, cnt);
+      struct auditstate *result_audit = link_map_audit_state (result, cnt);
+      if (afct->symbind != NULL
+	  && ((match_audit->bindflags & LA_FLG_BINDFROM) != 0
+	      || ((result_audit->bindflags & LA_FLG_BINDTO)
+		  != 0)))
+	{
+	  unsigned int flags = altvalue | LA_SYMB_DLSYM;
+	  uintptr_t new_value = afct->symbind (&sym, ndx,
+					       &match_audit->cookie,
+					       &result_audit->cookie,
+					       &flags, strtab + ref->st_name);
+	  if (new_value != (uintptr_t) sym.st_value)
+	    {
+	      altvalue = LA_SYMB_ALTVALUE;
+	      sym.st_value = new_value;
+	    }
+
+	  afct = afct->next;
+	}
+
+      *value = (void *) sym.st_value;
+    }
+}
+rtld_hidden_def (_dl_audit_symbind_alt)
+
+void
+_dl_audit_symbind (struct link_map *l, struct reloc_result *reloc_result,
+		   const ElfW(Sym) *defsym, DL_FIXUP_VALUE_TYPE *value,
+		   lookup_t result)
+{
+  reloc_result->bound = result;
+  /* Compute index of the symbol entry in the symbol table of the DSO with the
+     definition.  */
+  reloc_result->boundndx = (defsym - (ElfW(Sym) *) D_PTR (result,
+							  l_info[DT_SYMTAB]));
+
+  if ((l->l_audit_any_plt | result->l_audit_any_plt) == 0)
+    {
+      /* Set all bits since this symbol binding is not interesting.  */
+      reloc_result->enterexit = (1u << DL_NNS) - 1;
+      return;
+    }
+
+  /* Synthesize a symbol record where the st_value field is the result.  */
+  ElfW(Sym) sym = *defsym;
+  sym.st_value = DL_FIXUP_VALUE_ADDR (*value);
+
+  /* Keep track whether there is any interest in tracing the call in the lower
+     two bits.  */
+  assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8);
+  assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3);
+  reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT;
+
+  const char *strtab2 = (const void *) D_PTR (result, l_info[DT_STRTAB]);
+
+  unsigned int flags = 0;
+  struct audit_ifaces *afct = GLRO(dl_audit);
+  for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
+    {
+      /* XXX Check whether both DSOs must request action or only one */
+      struct auditstate *l_state = link_map_audit_state (l, cnt);
+      struct auditstate *result_state = link_map_audit_state (result, cnt);
+      if ((l_state->bindflags & LA_FLG_BINDFROM) != 0
+	  && (result_state->bindflags & LA_FLG_BINDTO) != 0)
+	{
+	  if (afct->symbind != NULL)
+	    {
+	      uintptr_t new_value = afct->symbind (&sym,
+						   reloc_result->boundndx,
+						   &l_state->cookie,
+						   &result_state->cookie,
+						   &flags,
+						   strtab2 + defsym->st_name);
+	      if (new_value != (uintptr_t) sym.st_value)
+		{
+		  flags |= LA_SYMB_ALTVALUE;
+		  sym.st_value = new_value;
+		}
+	    }
+
+	  /* Remember the results for every audit library and store a summary
+	     in the first two bits.  */
+	  reloc_result->enterexit &= flags & (LA_SYMB_NOPLTENTER
+					      | LA_SYMB_NOPLTEXIT);
+	  reloc_result->enterexit |= ((flags & (LA_SYMB_NOPLTENTER
+						| LA_SYMB_NOPLTEXIT))
+				      << ((cnt + 1) * 2));
+	}
+      else
+	/* If the bind flags say this auditor is not interested, set the bits
+	   manually.  */
+	reloc_result->enterexit |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)
+				    << ((cnt + 1) * 2));
+      afct = afct->next;
+    }
+
+  reloc_result->flags = flags;
+  *value = DL_FIXUP_ADDR_VALUE (sym.st_value);
+}
 #endif
diff --git a/elf/dl-runtime.c b/elf/dl-runtime.c
index 29031099f5..680e66a6d6 100644
--- a/elf/dl-runtime.c
+++ b/elf/dl-runtime.c
@@ -43,83 +43,6 @@ 
 # define ARCH_FIXUP_ATTRIBUTE
 #endif
 
-#ifdef SHARED
-static void
-_dl_audit_symbind (struct link_map *l, struct reloc_result *reloc_result,
-		   const ElfW(Sym) *defsym, DL_FIXUP_VALUE_TYPE *value,
-		   lookup_t result)
-{
-  reloc_result->bound = result;
-  /* Compute index of the symbol entry in the symbol table of the DSO with the
-     definition.  */
-  reloc_result->boundndx = (defsym - (ElfW(Sym) *) D_PTR (result,
-							  l_info[DT_SYMTAB]));
-
-  if ((l->l_audit_any_plt | result->l_audit_any_plt) == 0)
-    {
-      /* Set all bits since this symbol binding is not interesting.  */
-      reloc_result->enterexit = (1u << DL_NNS) - 1;
-      return;
-    }
-
-  /* Synthesize a symbol record where the st_value field is the result.  */
-  ElfW(Sym) sym = *defsym;
-  sym.st_value = DL_FIXUP_VALUE_ADDR (*value);
-
-  /* Keep track whether there is any interest in tracing the call in the lower
-     two bits.  */
-  assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8);
-  assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3);
-  reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT;
-
-  const char *strtab2 = (const void *) D_PTR (result, l_info[DT_STRTAB]);
-
-  unsigned int flags = 0;
-  struct audit_ifaces *afct = GLRO(dl_audit);
-  for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
-    {
-      /* XXX Check whether both DSOs must request action or only one */
-      struct auditstate *l_state = link_map_audit_state (l, cnt);
-      struct auditstate *result_state = link_map_audit_state (result, cnt);
-
-      if ((l_state->bindflags & LA_FLG_BINDFROM) != 0
-	  && (result_state->bindflags & LA_FLG_BINDTO) != 0)
-	{
-	  if (afct->symbind != NULL)
-	    {
-	      uintptr_t new_value = afct->symbind (&sym,
-						   reloc_result->boundndx,
-						   &l_state->cookie,
-						   &result_state->cookie,
-						   &flags,
-						   strtab2 + defsym->st_name);
-	      if (new_value != (uintptr_t) sym.st_value)
-		{
-		  flags |= LA_SYMB_ALTVALUE;
-		  sym.st_value = new_value;
-		}
-	    }
-
-	  /* Remember the results for every audit library and store a summary
-	     in the first two bits.  */
-	  reloc_result->enterexit &= flags & (LA_SYMB_NOPLTENTER
-					      | LA_SYMB_NOPLTEXIT);
-	  reloc_result->enterexit |= ((flags & (LA_SYMB_NOPLTENTER
-						| LA_SYMB_NOPLTEXIT))
-				      << ((cnt + 1) * 2));
-	}
-      else
-	/* If the bind flags say this auditor is not interested, set the bits
-	   manually.  */
-	reloc_result->enterexit |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)
-				    << ((cnt + 1) * 2));
-      afct = afct->next;
-    }
-
-  reloc_result->flags = flags;
-  *value = DL_FIXUP_ADDR_VALUE (sym.st_value);
-}
-#endif
 
 /* This function is called through a special trampoline from the PLT the
    first time each PLT entry is called.  We must perform the relocation
diff --git a/elf/dl-sym-post.h b/elf/dl-sym-post.h
index d68c2d2b1c..a11095d3e8 100644
--- a/elf/dl-sym-post.h
+++ b/elf/dl-sym-post.h
@@ -52,54 +52,9 @@  _dl_sym_post (lookup_t result, const ElfW(Sym) *ref, void *value,
      tell us whether further auditing is wanted.  */
   if (__glibc_unlikely (GLRO(dl_naudit) > 0))
     {
-      const char *strtab = (const char *) D_PTR (result,
-                                                 l_info[DT_STRTAB]);
-      /* Compute index of the symbol entry in the symbol table of
-         the DSO with the definition.  */
-      unsigned int ndx = (ref - (ElfW(Sym) *) D_PTR (result,
-                                                     l_info[DT_SYMTAB]));
-
       if (match == NULL)
         match = _dl_sym_find_caller_link_map (caller);
-
-      if ((match->l_audit_any_plt | result->l_audit_any_plt) != 0)
-        {
-          unsigned int altvalue = 0;
-          struct audit_ifaces *afct = GLRO(dl_audit);
-          /* Synthesize a symbol record where the st_value field is
-             the result.  */
-          ElfW(Sym) sym = *ref;
-          sym.st_value = (ElfW(Addr)) value;
-
-          for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
-            {
-              struct auditstate *match_audit
-                = link_map_audit_state (match, cnt);
-              struct auditstate *result_audit
-                = link_map_audit_state (result, cnt);
-              if (afct->symbind != NULL
-                  && ((match_audit->bindflags & LA_FLG_BINDFROM) != 0
-                      || ((result_audit->bindflags & LA_FLG_BINDTO)
-                          != 0)))
-                {
-                  unsigned int flags = altvalue | LA_SYMB_DLSYM;
-                  uintptr_t new_value
-                    = afct->symbind (&sym, ndx,
-                                     &match_audit->cookie,
-                                     &result_audit->cookie,
-                                     &flags, strtab + ref->st_name);
-                  if (new_value != (uintptr_t) sym.st_value)
-                    {
-                      altvalue = LA_SYMB_ALTVALUE;
-                      sym.st_value = new_value;
-                    }
-                }
-
-              afct = afct->next;
-            }
-
-          value = (void *) sym.st_value;
-        }
+      _dl_audit_symbind_alt (match, ref, &value, result);
     }
 #endif
   return value;
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index fa56d43678..f7db886fc0 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -1363,6 +1363,20 @@  void _dl_audit_objopen (struct link_map *l, Lmid_t nsid, bool check_audit);
 /* Call the la_objclose () from audit modules for the link_map L on the
    namespace identification NSID.  */
 void _dl_audit_objclose (struct link_map *l, Lmid_t nsid);
+/* Call the la_symbind32() or la_symbind64() from audit modules for the
+   link_map L.  The RELOC_RESULT is the entry from link_map::l_reloc_result used
+   to keep track of the binding actions set by the audir modules, while DEFSYM
+   is the reference used to resolve the target symbol, VALUE is the relocation
+   result value (which might be overwritten by the callback), and RESULT is the
+   link_map for the symbol resolved.  */
+void _dl_audit_symbind (struct link_map *l, struct reloc_result *reloc_result,
+			const ElfW(Sym) *defsym, DL_FIXUP_VALUE_TYPE *value,
+			lookup_t result);
+/* Same as _dl_audit_symbind(), but called from the dlsym().  The flag
+   LA_SYMB_DLSYM will be set before calling la_symbind() callback.  */
+void _dl_audit_symbind_alt (struct link_map *l, const ElfW(Sym) *ref,
+			    void **value, lookup_t result);
+rtld_hidden_proto (_dl_audit_symbind_alt)
 #endif /* SHARED */
 
 #if PTHREAD_IN_LIBC && defined SHARED