From: Nix <nix@esperi.org.uk>
To: libc-alpha@sourceware.org
Cc: carlos@redhat.com
Subject: [PATCH 07/14] Prevent the rtld mapfile computation from dragging in __stack_chk_fail().
Date: Tue, 23 Feb 2016 23:39:00 -0000 [thread overview]
Message-ID: <1456270777-9083-8-git-send-email-nix@esperi.org.uk> (raw)
In-Reply-To: <1456270777-9083-1-git-send-email-nix@esperi.org.uk>
From: Nick Alcock <nick.alcock@oracle.com>
The previous commit prevented rtld itself from being built with
-fstack-protector, but this is not quite enough. We identify which
objects belong in rtld via a test link and analysis of the resulting
mapfile. That link is necessarily done against objects that are
stack-protected, so drags in __stack_chk_fail() and all the libc
and libio code it uses.
To stop this happening, use --defsym in the test librtld.map-production
link to force the linker to predefine __stack_chk_fail() (to 0, but it
could be to anything). (In a real link, this would of course be
catastrophic, but these object files are never used for anything else.)
v2: New.
---
elf/Makefile | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/elf/Makefile b/elf/Makefile
index 0cb03b0..dcf44c8 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -346,9 +346,19 @@ $(objpfx)dl-allobjs.os: $(all-rtld-routines:%=$(objpfx)%.os)
# are compiled with special flags, and puts these modules into rtld-libc.a
# for us. Then we do the real link using rtld-libc.a instead of libc_pic.a.
+# If the compiler can do SSP, build the mapfile with a dummy __stack_chk_fail
+# symbol defined, to prevent the real thing being dragged into rtld
+# even though rtld is never built with stack-protection.
+
+ifeq ($(have-ssp),yes)
+dummy-stack-chk-fail := -Wl,--defsym='__stack_chk_fail=0'
+else
+dummy-stack-chk-fail :=
+endif
+
$(objpfx)librtld.map: $(objpfx)dl-allobjs.os $(common-objpfx)libc_pic.a
@-rm -f $@T
- $(reloc-link) -o $@.o '-Wl,-(' $^ -lgcc '-Wl,-)' -Wl,-Map,$@T
+ $(reloc-link) -o $@.o $(dummy-stack-chk-fail) '-Wl,-(' $^ -lgcc '-Wl,-)' -Wl,-Map,$@T
rm -f $@.o
mv -f $@T $@
--
2.7.0.198.g6dd47b6
next prev parent reply other threads:[~2016-02-23 23:39 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-23 23:39 --enable-stack-protector for glibc, v2, now with sparc Nix
2016-02-23 23:39 ` [PATCH 05/14] Allow overriding of CFLAGS as well as CPPFLAGS for rtld Nix
2016-02-23 23:39 ` Nix [this message]
2016-02-23 23:40 ` [PATCH 14/14] sparc: do not stack-protect the sigreturn handler Nix
2016-02-23 23:40 ` [PATCH 03/14] Mark all machinery needed in early static-link init as -fno-stack-protector Nix
2016-02-23 23:40 ` [PATCH 04/14] Open-code the memcpy() at static TLS initialization time Nix
2016-02-23 23:40 ` [PATCH 11/14] Work even with compilers hacked to enable -fstack-protector by default Nix
2016-02-23 23:40 ` [PATCH 08/14] Link libc.so with libc_nonshared.a to pull in __stack_chk_fail Nix
2016-02-23 23:40 ` [PATCH 12/14] Drop explicit stack-protection of pieces of the system Nix
2016-02-23 23:40 ` [PATCH 02/14] Initialize the stack guard earlier when linking statically Nix
2016-02-23 23:40 ` [PATCH 13/14] Avoid stack-protecting certain functions called from assembly Nix
2016-02-23 23:40 ` [PATCH 09/14] Link various tests with -fno-stack-protector Nix
2016-02-24 13:07 ` Andreas Schwab
2016-02-24 13:09 ` Nix
2016-02-23 23:40 ` [PATCH 01/14] Configury support for --enable-stack-protector Nix
2016-02-23 23:40 ` [PATCH 10/14] Enable -fstack-protector=* when requested by configure Nix
2016-02-24 9:46 ` Andreas Schwab
2016-02-24 17:16 ` Nix
2016-02-24 0:57 ` [PATCH 06/14] Compile the entire dynamic linker with -fno-stack-protector Nix
2016-02-24 23:28 --enable-stack-protector for glibc, v3 Nix
2016-02-24 23:29 ` [PATCH 07/14] Prevent the rtld mapfile computation from dragging in __stack_chk_fail() Nix
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1456270777-9083-8-git-send-email-nix@esperi.org.uk \
--to=nix@esperi.org.uk \
--cc=carlos@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).