Date: Wed, 29 Mar 2017 11:03:08 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r316135 - in stable/11/libexec/rtld-elf: . aarch64 amd64 arm i386 mips powerpc powerpc64 riscv sparc64 Message-ID: <201703291103.v2TB38GJ028535@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Wed Mar 29 11:03:08 2017 New Revision: 316135 URL: https://svnweb.freebsd.org/changeset/base/316135 Log: MFC r315331: Implement LD_BIND_NOT knob for rtld. MFC r315337: Disable LD_BIND_NOT for setugid processes. MFC r315429 (by jilles): Document that LD_BIND_NOT is unset for setugid processes. Modified: stable/11/libexec/rtld-elf/aarch64/reloc.c stable/11/libexec/rtld-elf/aarch64/rtld_machdep.h stable/11/libexec/rtld-elf/amd64/reloc.c stable/11/libexec/rtld-elf/amd64/rtld_machdep.h stable/11/libexec/rtld-elf/arm/reloc.c stable/11/libexec/rtld-elf/arm/rtld_machdep.h stable/11/libexec/rtld-elf/i386/reloc.c stable/11/libexec/rtld-elf/i386/rtld_machdep.h stable/11/libexec/rtld-elf/mips/reloc.c stable/11/libexec/rtld-elf/mips/rtld_machdep.h stable/11/libexec/rtld-elf/powerpc/reloc.c stable/11/libexec/rtld-elf/powerpc/rtld_machdep.h stable/11/libexec/rtld-elf/powerpc64/reloc.c stable/11/libexec/rtld-elf/powerpc64/rtld_machdep.h stable/11/libexec/rtld-elf/riscv/reloc.c stable/11/libexec/rtld-elf/riscv/rtld_machdep.h stable/11/libexec/rtld-elf/rtld.1 stable/11/libexec/rtld-elf/rtld.c stable/11/libexec/rtld-elf/rtld.h stable/11/libexec/rtld-elf/sparc64/reloc.c stable/11/libexec/rtld-elf/sparc64/rtld_machdep.h Directory Properties: stable/11/ (props changed) Modified: stable/11/libexec/rtld-elf/aarch64/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/aarch64/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/aarch64/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -293,10 +293,9 @@ reloc_jmpslot(Elf_Addr *where, Elf_Addr assert(ELF_R_TYPE(rel->r_info) == R_AARCH64_JUMP_SLOT); - if (*where != target) + if (*where != target && !ld_bind_not) *where = target; - - return target; + return (target); } void Modified: stable/11/libexec/rtld-elf/aarch64/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/aarch64/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/aarch64/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -47,9 +47,8 @@ struct Struct_Obj_Entry; }) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/amd64/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/amd64/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/amd64/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -387,6 +387,20 @@ reloc_jmpslots(Obj_Entry *obj, int flags return 0; } +/* Fixup the jump slot at "where" to transfer control to "target". */ +Elf_Addr +reloc_jmpslot(Elf_Addr *where, Elf_Addr target, + const struct Struct_Obj_Entry *obj, const struct Struct_Obj_Entry *refobj, + const Elf_Rel *rel) +{ +#ifdef dbg + dbg("reloc_jmpslot: *%p = %p", where, (void *)target); +#endif + if (!ld_bind_not) + *where = target; + return (target); +} + int reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate) { Modified: stable/11/libexec/rtld-elf/amd64/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/amd64/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/amd64/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -38,21 +38,11 @@ struct Struct_Obj_Entry; Elf_Dyn *rtld_dynamic_addr(void); #define rtld_dynamic(obj) rtld_dynamic_addr() -/* Fixup the jump slot at "where" to transfer control to "target". */ -static inline Elf_Addr -reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *obj, - const struct Struct_Obj_Entry *refobj, const Elf_Rel *rel) -{ -#ifdef dbg - dbg("reloc_jmpslot: *%p = %p", (void *)(where), - (void *)(target)); -#endif - (*(Elf_Addr *)(where) = (Elf_Addr)(target)); - return target; -} +Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, + const struct Struct_Obj_Entry *obj, const struct Struct_Obj_Entry *refobj, + const Elf_Rel *rel); -#define make_function_pointer(def, defobj) \ +#define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) #define call_initfini_pointer(obj, target) \ Modified: stable/11/libexec/rtld-elf/arm/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/arm/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/arm/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -468,15 +468,14 @@ reloc_gnu_ifunc(Obj_Entry *obj, int flag Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, const Obj_Entry *defobj, - const Obj_Entry *obj, const Elf_Rel *rel) + const Obj_Entry *obj, const Elf_Rel *rel) { assert(ELF_R_TYPE(rel->r_info) == R_ARM_JUMP_SLOT); - if (*where != target) + if (*where != target && !ld_bind_not) *where = target; - - return target; + return (target); } void Modified: stable/11/libexec/rtld-elf/arm/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/arm/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/arm/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -38,9 +38,8 @@ struct Struct_Obj_Entry; #define rtld_dynamic(obj) (&_DYNAMIC) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/i386/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/i386/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/i386/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -344,6 +344,20 @@ reloc_jmpslots(Obj_Entry *obj, int flags return 0; } +/* Fixup the jump slot at "where" to transfer control to "target". */ +Elf_Addr +reloc_jmpslot(Elf_Addr *where, Elf_Addr target, + const struct Struct_Obj_Entry *obj, const struct Struct_Obj_Entry *refobj, + const Elf_Rel *rel) +{ +#ifdef dbg + dbg("reloc_jmpslot: *%p = %p", where, (void *)target); +#endif + if (!ld_bind_not) + *where = target; + return (target); +} + int reloc_iresolve(Obj_Entry *obj, RtldLockState *lockstate) { Modified: stable/11/libexec/rtld-elf/i386/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/i386/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/i386/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -38,21 +38,11 @@ struct Struct_Obj_Entry; #define rtld_dynamic(obj) \ ((const Elf_Dyn *)((obj)->relocbase + (Elf_Addr)&_DYNAMIC)) -/* Fixup the jump slot at "where" to transfer control to "target". */ -static inline Elf_Addr -reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *obj, - const struct Struct_Obj_Entry *refobj, const Elf_Rel *rel) -{ -#ifdef dbg - dbg("reloc_jmpslot: *%p = %p", (void *)(where), - (void *)(target)); -#endif - (*(Elf_Addr *)(where) = (Elf_Addr)(target)); - return target; -} +Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, + const struct Struct_Obj_Entry *obj, const struct Struct_Obj_Entry *refobj, + const Elf_Rel *rel); -#define make_function_pointer(def, defobj) \ +#define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) #define call_initfini_pointer(obj, target) \ Modified: stable/11/libexec/rtld-elf/mips/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/mips/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/mips/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -259,7 +259,8 @@ _mips_rtld_bind(Obj_Entry *obj, Elf_Size obj->path, (intmax_t)reloff, defobj->strtab + def->st_name, (void *)*where, (void *)target); - *where = target; + if (!ld_bind_not) + *where = target; lock_release(rtld_bind_lock, &lockstate); return (Elf_Addr)target; } Modified: stable/11/libexec/rtld-elf/mips/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/mips/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/mips/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -39,9 +39,8 @@ struct Struct_Obj_Entry; #define rtld_dynamic(obj) (&_DYNAMIC) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/powerpc/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/powerpc/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/powerpc/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -468,7 +468,7 @@ reloc_jmpslots(Obj_Entry *obj, int flags */ Elf_Addr reloc_jmpslot(Elf_Addr *wherep, Elf_Addr target, const Obj_Entry *defobj, - const Obj_Entry *obj, const Elf_Rel *rel) + const Obj_Entry *obj, const Elf_Rel *rel) { Elf_Addr offset; const Elf_Rela *rela = (const Elf_Rela *) rel; @@ -476,6 +476,9 @@ reloc_jmpslot(Elf_Addr *wherep, Elf_Addr dbg(" reloc_jmpslot: where=%p, target=%p", (void *)wherep, (void *)target); + if (ld_bind_not) + goto out; + /* * At the PLT entry pointed at by `wherep', construct * a direct transfer to the now fully resolved function @@ -519,6 +522,7 @@ reloc_jmpslot(Elf_Addr *wherep, Elf_Addr } } +out: return (target); } Modified: stable/11/libexec/rtld-elf/powerpc/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/powerpc/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/powerpc/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -38,9 +38,8 @@ struct Struct_Obj_Entry; #define rtld_dynamic(obj) (&_DYNAMIC) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/powerpc64/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/powerpc64/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/powerpc64/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -433,7 +433,7 @@ reloc_jmpslots(Obj_Entry *obj, int flags */ Elf_Addr reloc_jmpslot(Elf_Addr *wherep, Elf_Addr target, const Obj_Entry *defobj, - const Obj_Entry *obj, const Elf_Rel *rel) + const Obj_Entry *obj, const Elf_Rel *rel) { /* @@ -447,6 +447,9 @@ reloc_jmpslot(Elf_Addr *wherep, Elf_Addr (void *)wherep, (void *)target, *(Elf_Addr *)target, (Elf_Addr)defobj->relocbase); + if (ld_bind_not) + goto out; + /* * For the trampoline, the second two elements of the function * descriptor are unused, so we are fine replacing those at any time @@ -476,11 +479,13 @@ reloc_jmpslot(Elf_Addr *wherep, Elf_Addr ((struct funcdesc *)(wherep))->toc += (Elf_Addr)defobj->relocbase; } +out: #else dbg(" reloc_jmpslot: where=%p, target=%p", (void *)wherep, (void *)target); - *wherep = target; + if (!ld_bind_not) + *wherep = target; #endif return (target); Modified: stable/11/libexec/rtld-elf/powerpc64/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/powerpc64/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/powerpc64/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -38,9 +38,8 @@ struct Struct_Obj_Entry; #define rtld_dynamic(obj) (&_DYNAMIC) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/riscv/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/riscv/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/riscv/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -226,10 +226,9 @@ reloc_jmpslot(Elf_Addr *where, Elf_Addr assert(ELF_R_TYPE(rel->r_info) == R_RISCV_JUMP_SLOT); - if (*where != target) + if (*where != target && !ld_bind_not) *where = target; - - return target; + return (target); } /* Modified: stable/11/libexec/rtld-elf/riscv/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/riscv/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/riscv/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -54,9 +54,8 @@ uint64_t set_gp(struct Struct_Obj_Entry }) Elf_Addr reloc_jmpslot(Elf_Addr *where, Elf_Addr target, - const struct Struct_Obj_Entry *defobj, - const struct Struct_Obj_Entry *obj, - const Elf_Rel *rel); + const struct Struct_Obj_Entry *defobj, const struct Struct_Obj_Entry *obj, + const Elf_Rel *rel); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value) Modified: stable/11/libexec/rtld-elf/rtld.1 ============================================================================== --- stable/11/libexec/rtld-elf/rtld.1 Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/rtld.1 Wed Mar 29 11:03:08 2017 (r316135) @@ -28,7 +28,7 @@ .\" .\" $FreeBSD$ .\" -.Dd June 20, 2014 +.Dd March 16, 2017 .Dt RTLD 1 .Os .Sh NAME @@ -199,6 +199,13 @@ This is intended for use within sandboxes, when global namespaces such as the filesystem are unavailable. It is consulted just after LD_LIBRARY_PATH. This variable is unset for set-user-ID and set-group-ID programs. +.It Ev LD_BIND_NOT +When set to a nonempty string, prevents modifications of the PLT slots when +doing bindings. +As result, each call of the PLT-resolved function is resolved. +In combination with debug output, this provides complete account of +all bind actions at runtime. +This variable is unset for set-user-ID and set-group-ID programs. .It Ev LD_BIND_NOW When set to a nonempty string, causes .Nm Modified: stable/11/libexec/rtld-elf/rtld.c ============================================================================== --- stable/11/libexec/rtld-elf/rtld.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/rtld.c Wed Mar 29 11:03:08 2017 (r316135) @@ -178,6 +178,7 @@ static char *libmap_override; /* Maps to static bool trust; /* False for setuid and setgid programs */ static bool dangerous_ld_env; /* True if environment variables have been used to affect the libraries loaded */ +bool ld_bind_not; /* Disable PLT update */ static char *ld_bind_now; /* Environment variable for immediate binding */ static char *ld_debug; /* Environment variable for debugging */ static char *ld_library_path; /* Environment variable for search path */ @@ -416,6 +417,7 @@ _rtld(Elf_Addr *sp, func_ptr_type *exit_ md_abi_variant_hook(aux_info); ld_bind_now = getenv(_LD("BIND_NOW")); + /* * If the process is tainted, then we un-set the dangerous environment * variables. The process will be marked as tainted until setuid(2) @@ -425,7 +427,7 @@ _rtld(Elf_Addr *sp, func_ptr_type *exit_ if (!trust) { if (unsetenv(_LD("PRELOAD")) || unsetenv(_LD("LIBMAP")) || unsetenv(_LD("LIBRARY_PATH")) || unsetenv(_LD("LIBRARY_PATH_FDS")) || - unsetenv(_LD("LIBMAP_DISABLE")) || + unsetenv(_LD("LIBMAP_DISABLE")) || unsetenv(_LD("BIND_NOT")) || unsetenv(_LD("DEBUG")) || unsetenv(_LD("ELF_HINTS_PATH")) || unsetenv(_LD("LOADFLTR")) || unsetenv(_LD("LIBRARY_PATH_RPATH"))) { _rtld_error("environment corrupt; aborting"); @@ -433,6 +435,8 @@ _rtld(Elf_Addr *sp, func_ptr_type *exit_ } } ld_debug = getenv(_LD("DEBUG")); + if (ld_bind_now == NULL) + ld_bind_not = getenv(_LD("BIND_NOT")) != NULL; libmap_disable = getenv(_LD("LIBMAP_DISABLE")) != NULL; libmap_override = getenv(_LD("LIBMAP")); ld_library_path = getenv(_LD("LIBRARY_PATH")); Modified: stable/11/libexec/rtld-elf/rtld.h ============================================================================== --- stable/11/libexec/rtld-elf/rtld.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/rtld.h Wed Mar 29 11:03:08 2017 (r316135) @@ -358,6 +358,7 @@ void *malloc_aligned(size_t size, size_t void free_aligned(void *ptr); extern Elf_Addr _GLOBAL_OFFSET_TABLE_[]; extern Elf_Sym sym_zero; /* For resolving undefined weak refs. */ +extern bool ld_bind_not; void dump_relocations(Obj_Entry *); void dump_obj_relocations(Obj_Entry *); Modified: stable/11/libexec/rtld-elf/sparc64/reloc.c ============================================================================== --- stable/11/libexec/rtld-elf/sparc64/reloc.c Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/sparc64/reloc.c Wed Mar 29 11:03:08 2017 (r316135) @@ -581,7 +581,9 @@ reloc_jmpslot(Elf_Addr *wherep, Elf_Addr Elf_Addr offset; Elf_Word *where; - if (rela - refobj->pltrela < 32764) { + if (ld_bind_not) { + /* Skip any PLT modifications */ + } else if (rela - refobj->pltrela < 32764) { /* * At the PLT entry pointed at by `where', we now construct * a direct transfer to the now fully resolved function Modified: stable/11/libexec/rtld-elf/sparc64/rtld_machdep.h ============================================================================== --- stable/11/libexec/rtld-elf/sparc64/rtld_machdep.h Wed Mar 29 10:59:46 2017 (r316134) +++ stable/11/libexec/rtld-elf/sparc64/rtld_machdep.h Wed Mar 29 11:03:08 2017 (r316135) @@ -39,9 +39,8 @@ Elf_Dyn *rtld_dynamic_addr(void); #define rtld_dynamic(obj) rtld_dynamic_addr() Elf_Addr reloc_jmpslot(Elf_Addr *, Elf_Addr, - const struct Struct_Obj_Entry *, - const struct Struct_Obj_Entry *, - const Elf_Rel *); + const struct Struct_Obj_Entry *, const struct Struct_Obj_Entry *, + const Elf_Rel *); #define make_function_pointer(def, defobj) \ ((defobj)->relocbase + (def)->st_value)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703291103.v2TB38GJ028535>