From patchwork Tue Mar 12 13:02:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 1055380 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-100584-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="XIiTFQzm"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 44JZrm6v7Nz9s5c for ; Wed, 13 Mar 2019 00:02:47 +1100 (AEDT) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:date:to:subject:mime-version:content-type :content-transfer-encoding:message-id:from; q=dns; s=default; b= I/rB5W9IFdSKXjcsSmRDJexfrH538TECm8TdLOzEnbcXWwBV4zhuVUBHjIrLXt6l ZSPbUSN9vqP6Lmz5KjSkMlD8yFHzfK/hW2CvEC6aC3wQNjccm4er2BYmwmPz4zYP WUOLE5+WtE2j24bo5oSmvn9GjLmWN9ESeV3W56lQJzA= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:date:to:subject:mime-version:content-type :content-transfer-encoding:message-id:from; s=default; bh=6nCnkp /CrJ+m+xmIcJtvFm/a37o=; b=XIiTFQzmLY5GhFhJP53bPEEOW+Bte0m031DzMK u4FpRT+BiBmlcJ/6FOYzyBtbMCgtnHt2exHncdOBsX9B60jHITM4luvYP0nHKP3V DsSd52cS+ww/lLtpD0M9ORHYHacbVeBc7k02WcoXilqIDs0pQNYOgrKhx/VrsDrg 7wBCY= Received: (qmail 118603 invoked by alias); 12 Mar 2019 13:02:42 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 118587 invoked by uid 89); 12 Mar 2019 13:02:41 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-19.4 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, SPF_HELO_PASS autolearn=ham version=3.3.1 spammy= X-HELO: mx1.redhat.com Date: Tue, 12 Mar 2019 14:02:35 +0100 To: libc-alpha@sourceware.org Subject: [PATCH] elf: Refuse to dlopen PIE objects [BZ #24323] User-Agent: Heirloom mailx 12.5 7/5/10 MIME-Version: 1.0 Message-Id: <20190312130235.8E82C89CE49C@oldenburg2.str.redhat.com> From: Florian Weimer Another executable has already been mapped, so the dynamic linker cannot perform relocations correctly for the second executable. 2019-03-12 Florian Weimer [BZ #24323] * include/elf.h (DT_1_SUPPORTED_MASK): Include DF_1_PIE. * elf/dl-load.c (_dl_map_object_from_fd): Check for DF_1_PIE and fail when called from dlopen. * elf/Makefile [have-fpie && build-shared] (tests): Add tst-dlopen-pie. (tst-dlopen-pie): Link with -ldl. (tst-dlopen-pie.out): Add run-time dependency on tst-pie1. * elf/tst-dlopen-pie.c (do_test): New file. Reviewed-by: Carlos O'Donell diff --git a/elf/Makefile b/elf/Makefile index 310a37cc13..ef861abac8 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -305,7 +305,7 @@ test-xfail-tst-protected1b = yes endif ifeq (yesyes,$(have-fpie)$(build-shared)) modules-names += tst-piemod1 -tests += tst-pie1 tst-pie2 +tests += tst-pie1 tst-pie2 tst-dlopen-pie tests-pie += tst-pie1 tst-pie2 ifeq (yes,$(have-protected-data)) tests += vismain @@ -1079,6 +1079,8 @@ CFLAGS-tst-pie2.c += $(pie-ccflag) $(objpfx)tst-piemod1.so: $(libsupport) $(objpfx)tst-pie1: $(objpfx)tst-piemod1.so +$(objpfx)tst-dlopen-pie: $(libdl) +$(objpfx)tst-dlopen-pie.out: $(objpfx)tst-pie1 ifeq (yes,$(build-shared)) # NB: Please keep cet-built-dso in sysdeps/x86/Makefile in sync with diff --git a/elf/dl-load.c b/elf/dl-load.c index 2bbef81b6e..9b0c1406c9 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -1158,6 +1158,10 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, goto call_lose; } + /* dlopen of an executable is not valid because it is not possible + to perform proper relocations and run the ELF constructors. + For PIE, the check needs the dynamic section, so there is + another check below. */ if (__glibc_unlikely (type != ET_DYN) && __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0)) { @@ -1194,9 +1198,11 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, elf_get_dynamic_info (l, NULL); /* Make sure we are not dlopen'ing an object that has the - DF_1_NOOPEN flag set. */ - if (__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN) - && (mode & __RTLD_DLOPEN)) + DF_1_NOOPEN flag set, or a PIE object. */ + if ((__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN) + && (mode & __RTLD_DLOPEN)) + || (__glibc_unlikely (l->l_flags_1 & DF_1_PIE) + && __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0))) { /* We are not supposed to load this object. Free all resources. */ _dl_unmap_segments (l); @@ -1207,7 +1213,11 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, if (l->l_phdr_allocated) free ((void *) l->l_phdr); - errstring = N_("shared object cannot be dlopen()ed"); + if (l->l_flags_1 & DF_1_PIE) + errstring + = N_("cannot dynamically load position-independent executable"); + else + errstring = N_("shared object cannot be dlopen()ed"); goto call_lose; } diff --git a/elf/tst-dlopen-pie.c b/elf/tst-dlopen-pie.c new file mode 100644 index 0000000000..6a41c731cb --- /dev/null +++ b/elf/tst-dlopen-pie.c @@ -0,0 +1,49 @@ +/* dlopen test for PIE objects. + Copyright (C) 2019 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* This test attempts to open the (otherwise unrelated) PIE test + program elf/tst-pie1 and expects the attempt to fail. */ + +#include +#include +#include +#include +#include + +static void +test_mode (int mode) +{ + char *pie_path = xasprintf ("%s/elf/tst-pie1", support_objdir_root); + if (dlopen (pie_path, mode) != NULL) + FAIL_EXIT1 ("dlopen succeeded unexpectedly (%d)", mode); + const char *message = dlerror (); + const char *expected + = "cannot dynamically load position-independent executable"; + if (strstr (message, expected) == NULL) + FAIL_EXIT1 ("unexpected error message (mode %d): %s", mode, message); +} + +static int +do_test (void) +{ + test_mode (RTLD_LAZY); + test_mode (RTLD_NOW); + return 0; +} + +#include diff --git a/include/elf.h b/include/elf.h index ab76aafb1e..14ed67ff67 100644 --- a/include/elf.h +++ b/include/elf.h @@ -23,7 +23,7 @@ # endif # define DT_1_SUPPORTED_MASK \ (DF_1_NOW | DF_1_NODELETE | DF_1_INITFIRST | DF_1_NOOPEN \ - | DF_1_ORIGIN | DF_1_NODEFLIB) + | DF_1_ORIGIN | DF_1_NODEFLIB | DF_1_PIE) #endif /* !_ISOMAC */ #endif /* elf.h */