[v7] elf: Don't execute shared object directly [BZ #28453]

diff --git a/elf/Makefile b/elf/Makefile
index fe42caeb0e..1337ec2d0b 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -47,7 +47,8 @@  tunables-type = $(addprefix TUNABLES_FRONTEND_,$(have-tunables))
 CPPFLAGS-dl-tunables.c += -DTUNABLES_FRONTEND=$(tunables-type)
 
 ifeq (yesyes,$(build-shared)$(run-built-tests))
-tests-special += $(objpfx)list-tunables.out
+tests-special += $(objpfx)list-tunables.out \
+  $(objpfx)tst-rtld-run-dso.out
 endif
 
 # Make sure that the compiler does not insert any library calls in tunables
@@ -1892,6 +1893,13 @@  $(objpfx)list-tunables.out: tst-rtld-list-tunables.sh $(objpfx)ld.so
 	    $(objpfx)/tst-rtld-list-tunables.out > $@; \
 	$(evaluate-test)
 
+$(objpfx)tst-rtld-run-dso.out: tst-rtld-run-dso.sh $(objpfx)ld.so \
+			    $(objpfx)tst-ro-dynamic-mod.so
+	$(SHELL) tst-rtld-run-dso.sh $(objpfx)ld.so \
+	    $(objpfx)tst-ro-dynamic-mod.so \
+	    '$(test-wrapper-env)' '$(run_program_env)' > $@
+	$(evaluate-test)
+
 tst-dst-static-ENV = LD_LIBRARY_PATH='$$ORIGIN'
 
 $(objpfx)tst-rtld-help.out: $(objpfx)ld.so
diff --git a/elf/dl-reloc-static-pie.c b/elf/dl-reloc-static-pie.c
index 5b85df8a2e..ad91721fe3 100644
--- a/elf/dl-reloc-static-pie.c
+++ b/elf/dl-reloc-static-pie.c
@@ -24,6 +24,7 @@ 
 #include <ldsodefs.h>
 
 #include <dl-machine.h>
+#include <dl-debug.h>
 
 #define RESOLVE_MAP(map, scope, sym, version, flags) map
 #include "dynamic-link.h"
@@ -68,14 +69,6 @@  _dl_relocate_static_pie (void)
 
   /* Set up debugging before the debugger is notified for the first
      time.  */
-# ifdef ELF_MACHINE_DEBUG_SETUP
-  /* Some machines (e.g. MIPS) don't use DT_DEBUG in this way.  */
-  ELF_MACHINE_DEBUG_SETUP (main_map, r);
-# else
-  if (main_map->l_info[DT_DEBUG] != NULL)
-    /* There is a DT_DEBUG entry in the dynamic section.  Fill it in
-       with the run-time address of the r_debug structure  */
-    main_map->l_info[DT_DEBUG]->d_un.d_ptr = (ElfW(Addr)) r;
-# endif
+  elf_setup_debug_entry (main_map, r);
 }
 #endif
diff --git a/elf/rtld.c b/elf/rtld.c
index 4b09e84b0d..e1b3ccce76 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -62,6 +62,9 @@ 
 #define RESOLVE_MAP(map, scope, sym, version, flags) map
 #include "dynamic-link.h"
 
+/* Must include after <dl-machine.h> for DT_MIPS definition.  */
+#include <dl-debug.h>
+
 /* Only enables rtld profiling for architectures which provides non generic
    hp-timing support.  The generic support requires either syscall
    (clock_gettime), which will incur in extra overhead on loading time.
@@ -1108,8 +1111,9 @@  load_audit_modules (struct link_map *main_map, struct audit_list *audit_list)
 }
 
 /* Check if the executable is not actualy dynamically linked, and
-   invoke it directly in that case.  */
-static void
+   invoke it directly in that case.  Return true if it can be executed
+   directly by ld.so.  */
+static bool
 rtld_chain_load (struct link_map *main_map, char *argv0)
 {
   /* The dynamic loader run against itself.  */
@@ -1122,17 +1126,22 @@  rtld_chain_load (struct link_map *main_map, char *argv0)
 		  + main_map->l_info[DT_SONAME]->d_un.d_val)) == 0)
     _dl_fatal_printf ("%s: loader cannot load itself\n", rtld_soname);
 
-  /* With DT_NEEDED dependencies, the executable is dynamically
-     linked.  */
-  if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
-    return;
-
-  /* If the executable has program interpreter, it is dynamically
-     linked.  */
+  /* If it has program interpreter, it can be executed directly by
+     ld.so.  Otherwise, it must be a static executable or a shared
+     library.  */
+  bool has_pt_dynamic = false;
   for (size_t i = 0; i < main_map->l_phnum; ++i)
     if (main_map->l_phdr[i].p_type == PT_INTERP)
-      return;
+      return true;
+    else if (main_map->l_phdr[i].p_type == PT_DYNAMIC)
+      has_pt_dynamic = true;
 
+  /* If there is no debugging entry in PT_DYNAMIC segment, it is a
+     shared library.  */
+  if (has_pt_dynamic && !elf_has_debug_entry_p (main_map))
+    return false;
+
+  /* This is a static executable.  */
   const char *pathname = _dl_argv[0];
   if (argv0 != NULL)
     _dl_argv[0] = argv0;
@@ -1144,6 +1153,7 @@  rtld_chain_load (struct link_map *main_map, char *argv0)
   else
     _dl_fatal_printf("%s: cannot execute %s: %d\n",
 		     rtld_soname, pathname, errcode);
+  return true;
 }
 
 static void
@@ -1181,6 +1191,8 @@  dl_main (const ElfW(Phdr) *phdr,
   _dl_starting_up = 1;
 #endif
 
+  bool can_execute = true;
+
   const char *ld_so_name = _dl_argv[0];
   if (*user_entry == (ElfW(Addr)) ENTRY_POINT)
     {
@@ -1415,7 +1427,7 @@  dl_main (const ElfW(Phdr) *phdr,
       main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
 
       if (__glibc_likely (state.mode == rtld_mode_normal))
-	rtld_chain_load (main_map, argv0);
+	can_execute = rtld_chain_load (main_map, argv0);
 
       phdr = main_map->l_phdr;
       phnum = main_map->l_phnum;
@@ -1796,15 +1808,7 @@  dl_main (const ElfW(Phdr) *phdr,
   size_t count_modids = _dl_count_modids ();
 
   /* Set up debugging before the debugger is notified for the first time.  */
-#ifdef ELF_MACHINE_DEBUG_SETUP
-  /* Some machines (e.g. MIPS) don't use DT_DEBUG in this way.  */
-  ELF_MACHINE_DEBUG_SETUP (main_map, r);
-#else
-  if (main_map->l_info[DT_DEBUG] != NULL)
-    /* There is a DT_DEBUG entry in the dynamic section.  Fill it in
-       with the run-time address of the r_debug structure  */
-    main_map->l_info[DT_DEBUG]->d_un.d_ptr = (ElfW(Addr)) r;
-#endif
+  elf_setup_debug_entry (main_map, r);
 
   /* We start adding objects.  */
   r->r_state = RT_ADD;
@@ -2491,6 +2495,11 @@  dl_main (const ElfW(Phdr) *phdr,
       rtld_timer_accum (&relocate_time, start);
     }
 
+  /* Stop if it can't be executed.  */
+  if (!can_execute)
+    _dl_fatal_printf ("%s: cannot execute shared object '%s' directly\n",
+		      ld_so_name, rtld_progname);
+
   /* Relocation is complete.  Perform early libc initialization.  This
      is the initial libc, even if audit modules have been loaded with
      other libcs.  */
diff --git a/elf/tst-rtld-run-dso.sh b/elf/tst-rtld-run-dso.sh
new file mode 100755
index 0000000000..5192f64210
--- /dev/null
+++ b/elf/tst-rtld-run-dso.sh
@@ -0,0 +1,33 @@ 
+#!/bin/sh
+# Test for ld.so on a shared library with no associated entry point.
+# Copyright (C) 2021 Free Software Foundation, Inc.
+# This file is part of the GNU C Library.
+#
+# The GNU C Library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# The GNU C Library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNU C Library; if not, see
+# <https://www.gnu.org/licenses/>.
+
+set -e
+
+rtld=$1
+dso=$2
+test_wrapper_env=$3
+run_program_env=$4
+
+LC_ALL=C
+export LC_ALL
+
+${test_wrapper_env} \
+${run_program_env} \
+$rtld $dso 2>&1 \
+| grep "cannot execute"
diff --git a/sysdeps/generic/dl-debug.h b/sysdeps/generic/dl-debug.h
new file mode 100644
index 0000000000..87a3ccf795
--- /dev/null
+++ b/sysdeps/generic/dl-debug.h
@@ -0,0 +1,42 @@ 
+/* Debugging support.  Generic version.
+   Copyright (C) 2021 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#ifndef _DL_DEBUG_H
+#define _DL_DEBUG_H
+
+/* There is a DT_DEBUG entry in the dynamic section.  Fill it in with the
+   run-time address of the r_debug structure  */
+
+static inline void
+__attribute ((always_inline))
+elf_setup_debug_entry (struct link_map *l, struct r_debug *r)
+{
+  if (l->l_info[DT_DEBUG] != NULL)
+    l->l_info[DT_DEBUG]->d_un.d_ptr = (ElfW(Addr)) r;
+}
+
+/* Return true if there is a DT_DEBUG entry in the dynamic section.  */
+
+static inline bool
+__attribute ((always_inline))
+elf_has_debug_entry_p (struct link_map *l)
+{
+  return l->l_info[DT_DEBUG] != NULL;
+}
+
+#endif /* _DL_DEBUG_H */
diff --git a/sysdeps/mips/dl-debug.h b/sysdeps/mips/dl-debug.h
new file mode 100644
index 0000000000..85b2920a4b
--- /dev/null
+++ b/sysdeps/mips/dl-debug.h
@@ -0,0 +1,52 @@ 
+/* Debugging support.  MIPS version.
+   Copyright (C) 2021 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#ifndef _DL_DEBUG_H
+#define _DL_DEBUG_H
+
+/* If there is a DT_MIPS_RLD_MAP_REL or DT_MIPS_RLD_MAP entry in the
+   dynamic section, fill in the debug map pointer with the run-time
+   address of the r_debug structure.  */
+
+static inline void
+__attribute ((always_inline))
+elf_setup_debug_entry (struct link_map *l, struct r_debug *r)
+{
+  if (l->l_info[DT_MIPS (RLD_MAP_REL)] != NULL)
+    {
+      char *ptr = (char *) l->l_info[DT_MIPS (RLD_MAP_REL)];
+      ptr += l->l_info[DT_MIPS (RLD_MAP_REL)]->d_un.d_val;
+      *(ElfW(Addr) *) ptr = (ElfW(Addr)) r;
+    }
+  else if (l->l_info[DT_MIPS (RLD_MAP)] != NULL)
+    *(ElfW(Addr) *) (l->l_info[DT_MIPS (RLD_MAP)]->d_un.d_ptr)
+      = (ElfW(Addr)) r;
+}
+
+/* Return true if there is a DT_MIPS_RLD_MAP_REL or DT_MIPS_RLD_MAP entry
+   in the dynamic section.  */
+
+static inline bool
+__attribute ((always_inline))
+elf_has_debug_entry_p (struct link_map *l)
+{
+  return (l->l_info[DT_MIPS (RLD_MAP_REL)] != NULL
+	  || l->l_info[DT_MIPS (RLD_MAP)] != NULL);
+}
+
+#endif /* _DL_DEBUG_H */
diff --git a/sysdeps/mips/dl-machine.h b/sysdeps/mips/dl-machine.h
index d7b8341b74..ea8c881807 100644
--- a/sysdeps/mips/dl-machine.h
+++ b/sysdeps/mips/dl-machine.h
@@ -65,21 +65,6 @@ 
    in l_info array.  */
 #define DT_MIPS(x) (DT_MIPS_##x - DT_LOPROC + DT_NUM)
 
-/* If there is a DT_MIPS_RLD_MAP_REL or DT_MIPS_RLD_MAP entry in the dynamic
-   section, fill in the debug map pointer with the run-time address of the
-   r_debug structure.  */
-#define ELF_MACHINE_DEBUG_SETUP(l,r) \
-do { if ((l)->l_info[DT_MIPS (RLD_MAP_REL)]) \
-       { \
-	 char *ptr = (char *)(l)->l_info[DT_MIPS (RLD_MAP_REL)]; \
-	 ptr += (l)->l_info[DT_MIPS (RLD_MAP_REL)]->d_un.d_val; \
-	 *(ElfW(Addr) *)ptr = (ElfW(Addr)) (r); \
-       } \
-     else if ((l)->l_info[DT_MIPS (RLD_MAP)]) \
-       *(ElfW(Addr) *)((l)->l_info[DT_MIPS (RLD_MAP)]->d_un.d_ptr) = \
-       (ElfW(Addr)) (r); \
-   } while (0)
-
 #if ((defined __mips_nan2008 && !defined HAVE_MIPS_NAN2008) \
      || (!defined __mips_nan2008 && defined HAVE_MIPS_NAN2008))
 # error "Configuration inconsistency: __mips_nan2008 != HAVE_MIPS_NAN2008, overridden CFLAGS?"