elf: Remove __libc_enable_secure_decided
Checks
Context |
Check |
Description |
dj/TryBot-apply_patch |
success
|
Patch applied to master at the time it was sent
|
dj/TryBot-32bit |
success
|
Build for i686
|
Commit Message
No functional change. __libc_enable_secure_decided is always 0 since
73fc4e28b9464f0e13edc719a5372839970e7ddb.
---
elf/enbl-secure.c | 7 ++-----
include/unistd.h | 1 -
2 files changed, 2 insertions(+), 6 deletions(-)
Comments
* Fangrui Song:
> No functional change. __libc_enable_secure_decided is always 0 since
> 73fc4e28b9464f0e13edc719a5372839970e7ddb.
> ---
> elf/enbl-secure.c | 7 ++-----
> include/unistd.h | 1 -
> 2 files changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/elf/enbl-secure.c b/elf/enbl-secure.c
> index aa2a0bd877..6a0a6d0f0f 100644
> --- a/elf/enbl-secure.c
> +++ b/elf/enbl-secure.c
> @@ -26,15 +26,12 @@
> #include <startup.h>
> #include <libc-internal.h>
>
> -/* If nonzero __libc_enable_secure is already set. */
> -int __libc_enable_secure_decided;
> /* Safest assumption, if somehow the initializer isn't run. */
> int __libc_enable_secure = 1;
>
> void
> __libc_init_secure (void)
> {
> - if (__libc_enable_secure_decided == 0)
> - __libc_enable_secure = (startup_geteuid () != startup_getuid ()
> - || startup_getegid () != startup_getgid ());
> + __libc_enable_secure = (startup_geteuid () != startup_getuid ()
> + || startup_getegid () != startup_getgid ());
> }
Thanks for catching this in time before a release, this would have
turned into a minor security vulnerability.
__libc_init_secure should not overwrite __libc_enable_secure on Linux
because _dl_aux_init in dl-support.c already initializes it, and the
real vs effective check does not always yield the right results (it
exits AT_SECURE mode for a pure capabilities-based transition, for
example).
Hurd already overrides __libc_init_secure with an empty function. I
think we should remove it completely. Then we can also simply
<startup.h> a bit, I think. Would you be able to write a patch along
those lines, or should I work on this?
Thanks,
Florian
On Mon, Apr 18, 2022 at 3:00 AM Florian Weimer <fweimer@redhat.com> wrote:
>
> * Fangrui Song:
>
> > No functional change. __libc_enable_secure_decided is always 0 since
> > 73fc4e28b9464f0e13edc719a5372839970e7ddb.
> > ---
> > elf/enbl-secure.c | 7 ++-----
> > include/unistd.h | 1 -
> > 2 files changed, 2 insertions(+), 6 deletions(-)
> >
> > diff --git a/elf/enbl-secure.c b/elf/enbl-secure.c
> > index aa2a0bd877..6a0a6d0f0f 100644
> > --- a/elf/enbl-secure.c
> > +++ b/elf/enbl-secure.c
> > @@ -26,15 +26,12 @@
> > #include <startup.h>
> > #include <libc-internal.h>
> >
> > -/* If nonzero __libc_enable_secure is already set. */
> > -int __libc_enable_secure_decided;
> > /* Safest assumption, if somehow the initializer isn't run. */
> > int __libc_enable_secure = 1;
> >
> > void
> > __libc_init_secure (void)
> > {
> > - if (__libc_enable_secure_decided == 0)
> > - __libc_enable_secure = (startup_geteuid () != startup_getuid ()
> > - || startup_getegid () != startup_getgid ());
> > + __libc_enable_secure = (startup_geteuid () != startup_getuid ()
> > + || startup_getegid () != startup_getgid ());
> > }
>
> Thanks for catching this in time before a release, this would have
> turned into a minor security vulnerability.
>
> __libc_init_secure should not overwrite __libc_enable_secure on Linux
> because _dl_aux_init in dl-support.c already initializes it, and the
> real vs effective check does not always yield the right results (it
> exits AT_SECURE mode for a pure capabilities-based transition, for
> example).
>
> Hurd already overrides __libc_init_secure with an empty function. I
> think we should remove it completely. Then we can also simply
> <startup.h> a bit, I think. Would you be able to write a patch along
> those lines, or should I work on this?
>
> Thanks,
> Florian
>
Thanks for the analysis! I debugged it a bit and understand it better now.
Sent https://sourceware.org/pipermail/libc-alpha/2022-April/137942.html
for clean-up.
@@ -26,15 +26,12 @@
#include <startup.h>
#include <libc-internal.h>
-/* If nonzero __libc_enable_secure is already set. */
-int __libc_enable_secure_decided;
/* Safest assumption, if somehow the initializer isn't run. */
int __libc_enable_secure = 1;
void
__libc_init_secure (void)
{
- if (__libc_enable_secure_decided == 0)
- __libc_enable_secure = (startup_geteuid () != startup_getuid ()
- || startup_getegid () != startup_getgid ());
+ __libc_enable_secure = (startup_geteuid () != startup_getuid ()
+ || startup_getegid () != startup_getgid ());
}
@@ -192,7 +192,6 @@ libc_hidden_proto (__tcsetpgrp)
and some functions contained in the C library ignore various
environment variables that normally affect them. */
extern int __libc_enable_secure attribute_relro;
-extern int __libc_enable_secure_decided;
rtld_hidden_proto (__libc_enable_secure)