Re: RFC: Audit external function called indirectly via GOT

["H.J. Lu" <hjl.tools@gmail.com>]

On Thu, Mar 22, 2018 at 1:59 AM, Florian Weimer <fw@deneb.enyo.de> wrote:
> * Carlos O'Donell:
>
>> On 03/21/2018 03:04 PM, Florian Weimer wrote:
>>> * H. J. Lu:
>>>
>>>>> Could we ship a template for the PLT entries in ld.so instead?  And if
>>>>> needed, map it from the file together with an address array, like this?
>>>>
>>>> This won't work since linker needs to know exactly PLT layout to generate
>>>> JUMP_SLOT relocations for LD_AUDIT.
>>>
>>> Why would we need JUMP_SLOT relocations?  Couldn't we install suitable
>>> interceptors for GLOB_DAT relocations instead, as long as they resolve
>>> to external function symbols?
>>
>> I think your suggestion might work, but why alter the existing
>> behaviour which users expect and is documented in countless linker
>> text books?
>
> If you have references, please add them to the glibc implementation or
> the wiki.  It would certainly help those who are trying to work on the
> code.
>
> My understanding is that the whole thing is quite underdocumented.
> For LD_AUDIT in particular, we only have the Solaris documentation,
> and that's for an independent implementation.
>
>> Existing tooling to process such relocations and entries could
>> remain unchanged and we would continue to support LD_AUDIT.
>
> My understanding is that H.J.'s proposal requires changes when running
> in non-audit mode.  It certainly requires relinking all binaries,
> perhaps even with special flags.

Please see

https://github.com/hjl-tools/glibc/tree/hjl/plt/audit

and

https://github.com/hjl-tools/binutils-gdb/tree/users/hjl/plt/audit

for my glibc and binutils implementations.  My changes are relatively
small and have minimum overhead when LD_AUDIT isn't used.

> Using ld.so-generated thunks for all GLOB_DAT function symbol
> relocations would happen in audit mode only and should work with
> existing binaries which were built with -Wl,-z,now.

It means to put parts of ld into ld.so.  This is a much bigger change.

-- 
H.J.