Re: RFA: Add a new gynamic tag: DT_GNU_GOT_PLT_END

[Florian Weimer <fweimer@redhat.com>]

On 06/24/2018 08:04 PM, Cary Coutant wrote:

> My point is that a DT_PLTGOTSZ entry could be useful on its own to
> indicate the size of the PLT GOT. If you make it *also* imply that the
> PLT GOT is isolated on its own pages, you're pre-empting that meaning
> of the tag (which, given the name, would be the most obvious meaning).
> Although I guess DT_PLTGOTSZ could be taken to mean: "Here's the size
> of the PLT GOT, possibly including any trailing padding intended to
> pad it out to a page boundary. If it works out that the beginning and
> end of the segment are both at page boundaries, then it's possible to
> make it relro." In other words, the tag's presence doesn't -- on its
> own -- imply that the PLT GOT has been placed on separate pages, but
> provides the information to determine whether it has.

That's right, the dynamic linker would still have to apply checks to 
make sure that everything is laid out as expected because the run-time 
page size could be larger than the link-time page size.  That shouldn't 
happen, but you can't really now.

> That leads me to another question: How would this be different from -z
> relro -z now? It looks to me like a binary with such a PLT GOT would
> be nothing more than a -z relro -z now binary where nothing but the
> .got.plt section ends up as RELRO. So why not just use the
> PT_GNU_RELRO program header for this?

It doesn't disable lazy binding, so there is no visible semantic 
difference in symbol binding.

With page isolation, we can use pkey_mprotect to assign a protection key 
to the .got.plt and only make it readable while _dl_fixup is running. 
That would provide most of the security benefits of BIND_NOW+RELRO, 
without disabling lazy binding.

Thanks,
Florian