[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <39499F8B-414B-489A-AF0C-0326A648FFD3@gmail.com>
Date: Sat, 27 Apr 2019 19:16:30 -0500
From: Rodger Combs <rodger.combs@...il.com>
To: musl@...ts.openwall.com
Subject: Re: [PATCH 3/3] crt: add dcrt1, with support for locating the
dynamic loader at runtime
> On Apr 27, 2019, at 18:55, Szabolcs Nagy <nsz@...t70.net> wrote:
>
> * Rodger Combs <rodger.combs@...il.com> [2019-04-27 17:51:17 -0500]:
>> On Apr 27, 2019, at 12:19, Rich Felker <dalias@...c.org> wrote:
>>> On Fri, Apr 26, 2019 at 08:13:29PM -0500, Rodger Combs wrote:
>>>> + secure = ((aux[0] & 0x7800) != 0x7800 || aux[AT_UID] != aux[AT_EUID]
>>>> + || aux[AT_GID] != aux[AT_EGID] || aux[AT_SECURE]);
>>>
>>> At this point we can just abort if secure != 0. There is unbounded
>>> attack surface trying to load a (possibly relative) ldso with elevated
>>> privileges.
>>
>> No more so than dynlink.c normally has when loading other SOs. Like there, I don't follow $ORIGIN in secure mode, and additionally here I don't handle relative-to-cwd paths in secure mode. I don't see a problem with allowing a load from an absolute rpath, or from the hardcoded path, using this mechanism, though.
>> Basically, I'm intending for this to be a feature that you could just turn on in your linker flags for everything you build, and get the functionality in the cases where you want it, at no significant cost in those where you don't.
>
> i think the code should be written such that it is obvious
> that user input cannot affect runtime behaviour in secure
> mode in any way (in particular the loaded code).
This is the case (CWD, the executable path, and env vars are all ignored in secure mode); if there's something you'd like changed to make that more clear, please elaborate.
>
>>>> + // Copy the program headers into an anonymous mapping
>>>> + new_hdr = mmap(0, (aux[AT_PHENT] * (aux[AT_PHNUM] + 2) + linker_len + PAGE_SIZE - 1) & -PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
>>>> + if (map_library_failed(new_hdr))
>>>> + goto error;
>>>
>>> Can you remind us why patched program headers are needed? I think it
>>> was absence of PT_PHDR or something...
>>
>> Yeah, the linker doesn't add PT_PHDR when we tell it not to set a dynamic loader, and dynlink needs it.
>
> there should be a strong reason to add fake program headers.
> why is PT_PHDR required?
> who uses PT_INTERP?
PT_PHDR is needed for the dynamic loader to find the executable's base address.
PT_INTERP isn't currently used by musl, but it is in glibc (to find its own path, so it knows where it's loaded from for future dlopen()s and such, and potentially for debugging?), and it seems reasonable that the linker might care about it in the future, so I'm including it for potential forwards-compatibility (and also glibc compatibility), since we already need to create an entry for PHDR anyway, so it's trivial to do this as well.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
