[Bug dynamic-link/30127] [rfe]: enable ld audit at run-time

["janderson at rice dot edu" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30127

--- Comment #31 from Jonathon Anderson <janderson at rice dot edu> ---
(In reply to Stas Sergeev from comment #30)
> Hi Jonathon, so if you are satisfied with the current
> solution (return EINVAL for disallowed audit call-backs),
> then maybe you can give me an ACK? :)
> I am not aware of any problems or a pending review
> comments for the last (v6) version of the patch.

Busy week for me, expect more slow responses. :)

I can't say the current solutions are appealing. You've made it very difficult
for a dynamically-loaded auditor to accomplish any auditor-like task, outside
of a hypothetical callback (la_premap) that hasn't been mainstreamed yet. On
top of that, I'm still a bit leery of letting the application observe the
auditors at all (outside of _r_debug).

Before your patches, there are parts of your use case that I am not convinced
do not have alternative solutions. One doesn't hack Glibc before exploring all
other alternatives, so I assume you've tried these but I'd like the context to
know why they don't work:

You mentioned in another ticket
(https://sourceware.org/bugzilla/show_bug.cgi?id=30007#c2) that the whole point
of this is to access data objects in the solib. Do you write this solib? If you
do, can you replace these static objects with pointers that are mmap'd into the
right location (e.g. initialized in an init() function or init constructors)?
If you don't, these are data structures that (a) part of the public API for the
solib and (b) are certainly identical (alignment padding included) between the
64-bit and 32-bit ABI?

Could you override mmap itself for the files you want mapped in the right
locations? If LD_PRELOAD won't fly, newer kernels have syscall user dispatch
[1] for doing this at the syscall level.

You mentioned DT_AUDIT wouldn't work, so I presume the executable is out of
your control, e.g. you're extending a VM with an solib plugin? If so, do you
not have the access to set LD_AUDIT in the environment before launching the
executable? You can always make your auditor "no-op" except when needed.

[1]: https://docs.kernel.org/admin-guide/syscall-user-dispatch.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.