Re: Flag for late RELRO application

[Florian Weimer <fweimer@redhat.com>]

On 06/11/2018 09:52 PM, Cary Coutant wrote:
>> I would like to add a flag to gABI (visible in the dynamic section) which
>> indicates that the loader shall apply RELRO protection only after running
>> the ELF constructors from DT_INIT and DT_INIT_ARRAY.
>>
>> This would allow applications to allocate a mapping and store a pointer to
>> it in permanently read-only memory.  On the mapping itself, the application
>> can set the protection flags (and keys) as needed.
> 
> Why can't the application that wants to do this simply do the following?
> 
>     mprotect(&ptr, sizeof(ptr), PROT_READ|PROT_WRITE);
>     ptr = ...;
>     mprotect(&ptr, sizeof(ptr), PROT_READ);

The original mapping might have been PROT_READ | PROT_EXEC, and then the 
PROT_EXEC is gone, which isn't good.  Security policy may also preven 
tthe PROT_WRITE → PROT_EXEC transition.

> We have RELRO to collect all the data together that the dynamic loader
> needs to initialize. I see no good reason to extend that feature to
> support an application-specific need, especially when it significantly
> expands the window during which the program is subject to attack.
> Initializers are just as prone to hacking as the rest of the program.

Initializers can access the process environment, true, but for many 
applications, that is trusted and there is no boundary crossed.  That 
only comes later in the process (after running main).

In any case, I wanted to make this opt-in, so that applications or 
libraries can choose the approach they prefer.

Thanks,
Florian