Re: [PATCH v7 00/16] Multiple rtld-audit fixes

[Florian Weimer <fweimer@redhat.com>]

* Adhemerval Zanella:

> There is also some point brough by John Melloc-Crummey documents that
> I don't have a straighforward answer so I haven't added on this
> patchset:
>
>   1 la_activity(LA_ACT_ADD) is never called for auditor namespaces,
>      even though la_objopen and la_activity(LA_ACT_CONSISTENT) are.
>
>   There is no easy solution for this: we need at least to load the
>   *first* auditor to actually issue the la_activity(LA_ACT_ADD).  It
>   means that it would *only* work for subsequent audit modules, and
>   adding this specific semantic is confusing and does not really
>   improve things (it only helps when multiple audit modules are used).

I suspect we shouldn't call auditors for audit namespaces.  Or perhaps
only for later audit namespaces, but not earlier ones.

>   2. la_objopen is called for the main binary and for ld.so before the
>      first la_activity(LA_ACT_ADD) call.  This contradicts the pattern
>      found in a successful dlopen (where la_activity(LA_ACT_ADD)
>      precedes la_objopen).
>
>   The constrain here is we need to handle DT_AUDIT and DT_DEPAUDIT
>   dynamic tags, which means we need to first load the executable in
>   memory to parse the required audit modules.  So we need to first parse
>   the dynamic audit tags, load the audit modules, and then load the
>   object itself.

Not sure about this yet.

>   3. For non-PIE executables the base address listed in link_map->l_addr
>      for the main application binary is 0, even though dladdr is able to
>      recover the correct offset. La_objopen is affected by this.

Agreed.

Thanks,
Florian