Re: [PATCH v4] elf: Only allow execute libc.so.6 directly [BZ #28453]

[Florian Weimer <fweimer@redhat.com>]

* H. J. Lu:

> On Fri, Dec 10, 2021 at 6:59 AM Florian Weimer <fweimer@redhat.com> wrote:
>>
>> * H. J. Lu:
>>
>> > +  /* With DT_NEEDED dependencies, it is a shared library.  Only allow
>> > +     execute libc.so directly.  */
>> > +  if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
>> > +    return (main_map->l_info[DT_SONAME] != NULL
>> > +         && strncmp ("libc.so.6",
>> > +                     ((const char *) D_PTR (main_map, l_info[DT_STRTAB])
>> > +                      + main_map->l_info[DT_SONAME]->d_un.d_val),
>> > +                     sizeof ("libc.so.6") - 1) == 0);
>>
>> I don't think this works.  See /usr/bin/npc in Fedora, it has a soname.
>
> It should work:
>
> $ readelf -l /usr/bin/npc
>
> Elf file type is DYN (Position-Independent Executable file)
> Entry point 0x2a5c0
> There are 14 program headers, starting at offset 64
>
> Program Headers:
>   Type           Offset             VirtAddr           PhysAddr
>                  FileSiz            MemSiz              Flags  Align
>   PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040
>                  0x0000000000000310 0x0000000000000310  R      0x8
>   INTERP         0x0000000000000350 0x0000000000000350 0x0000000000000350
>                  0x000000000000001c 0x000000000000001c  R      0x1
>       [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
>
> My patch checks PT_INTERP first.

But libc.so.6 has a program interpreter?  Why do we need to flag it
separately?

I'm really confused now. 8-(

Thanks,
Florian