Re: Flag for late RELRO application

[Carlos O'Donell <carlos@redhat.com>]

On 06/11/2018 07:23 AM, Florian Weimer wrote:
> I would like to add a flag to gABI (visible in the dynamic section)
> which indicates that the loader shall apply RELRO protection only
> after running the ELF constructors from DT_INIT and DT_INIT_ARRAY.

I assume that means also after DT_PREINIT_ARRAY?

Should the semantics be worded in such a way as to simply say that
all constructors have finished running?

That could be a lot of code running without RELRO protections.

> This would allow applications to allocate a mapping and store a
> pointer to it in permanently read-only memory.  On the mapping
> itself, the application can set the protection flags (and keys) as
> needed.

Wouldn't it be safer to have some kind of second "type" of RELRO
for these particular uses?

This way we don't mix what is effectively early RELRO with late
RELRO?

I know that it's easier to just defer RELRO (all the existing
machinery is already in place for it), but I'm wondering if that
won't worsen the protection in substantial ways.

For example how would an application mark a pointer as read-only
but also write to it? If you have to markup existing code with
attributes to get this to work, you might as well collect them
into a special section and use a 'late RELRO' flag for it,
extending the existing RELRO framework.

Just a thought.

Cheers,
Carlos.