Re: [PATCH v4] elf: Only allow execute libc.so.6 directly [BZ #28453]

["H.J. Lu" <hjl.tools@gmail.com>]

On Fri, Dec 10, 2021 at 6:59 AM Florian Weimer <fweimer@redhat.com> wrote:
>
> * H. J. Lu:
>
> > +  /* With DT_NEEDED dependencies, it is a shared library.  Only allow
> > +     execute libc.so directly.  */
> > +  if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL))
> > +    return (main_map->l_info[DT_SONAME] != NULL
> > +         && strncmp ("libc.so.6",
> > +                     ((const char *) D_PTR (main_map, l_info[DT_STRTAB])
> > +                      + main_map->l_info[DT_SONAME]->d_un.d_val),
> > +                     sizeof ("libc.so.6") - 1) == 0);
>
> I don't think this works.  See /usr/bin/npc in Fedora, it has a soname.

It should work:

$ readelf -l /usr/bin/npc

Elf file type is DYN (Position-Independent Executable file)
Entry point 0x2a5c0
There are 14 program headers, starting at offset 64

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040
                 0x0000000000000310 0x0000000000000310  R      0x8
  INTERP         0x0000000000000350 0x0000000000000350 0x0000000000000350
                 0x000000000000001c 0x000000000000001c  R      0x1
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]

My patch checks PT_INTERP first.

-- 
H.J.