From: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
To: DJ Delorie <dj@redhat.com>, libc-alpha@sourceware.org
Subject: Re: RFC: system-wide default tunables
Date: Fri, 6 Oct 2023 14:12:20 -0300 [thread overview]
Message-ID: <fdb854e6-92be-47de-b2d7-0c0f1ab6cb42@linaro.org> (raw)
In-Reply-To: <66646260-c6c9-4d2d-b3e3-20f3d5b83ff3@linaro.org>
On 06/10/23 11:44, Adhemerval Zanella Netto wrote:
>
>
> On 04/10/23 17:55, DJ Delorie wrote:
>>
>> Before I start on actual coding, I'm sharing my thoughts on this
>> project to gain consensus...
>>
>> Problem: tunables are set by an environment variable, and may be
>> limited by security settings, containerization, etc. Plus users may
>> not assume that the env var is pre-set, and just overwrite it.
>>
>> Solution: Add a way to specify system-wide defaults for tunables.
>>
>
> The idea sounds ok, but adding on ld.so.cache means it would not work
> for static. I don't think this is really an issue, static PIE is really
> tricky because self-relocation happens after tunable (because tunables
> itself might change ifunc selection); and trying to add support for
> static PIE would require a lot of messy refactoring (all ld.so.cache
> loading would need to be annotated hidden, no external function calling,
> even mem* ones; etc.).
>
>> Ideas:
>>
>> * Specify some file or files in /etc that contain tunables settings.
>> Follow the ld.so.conf patterns, allow subdirectories, etc.
>>
>> * Store tunables info in /etc/ld.so.cache in a new slot at the end,
>> with a new enum for the chunk. This way older glibc will just
>> ignore it. Parsing and storing will be done via ldconfig.
>
> It means that we will have to always load the ld.so.cache, not only when
> we will actually have to load an ET_DYN . It should be ok, but runtimes
> that usually only link against libc.so (like rust) will have additional
> overhead on startup.
>
> We also have DF_1_NODEFLIB to inhibit loader cache search, should we add
> another flag to inhibit the global tunables? It does not make sense to
> set per-library, but it still might be useful to set on ET_EXEC.
>
> So I am not fully sure adding the global tunable setting on ld.so.cache is
> the correct approach. However, adding on an external file will add
> another open/mmap/close on each program; plus the extra mmap.
>
>>
>> * Values in ld.so.cache will be parsed but not range checked; that's
>> dependent on what the glibc app expects.
>
> Importing the range information on tunable definition is straightforward,
> so I think we should add the range check on ldconfig ld.so.cache setup.
> There is no error checking on env var tunable, invalid values are just
> ignored without any user feedback. Since we will do pre-processing,
> I think it would be valuable to at least show any possible invalid range,
> specially because this is a administration setting.
>
>>
>> * read those, do range checking, and call callbacks at runtime
>>
>> * To speed processing, encode a hash for each tunable name, both in
>> glibc's table (which is built at glibc build time) and in
>> /etc/ld.so.cache. Comparing the hash typically fails but avoids a
>> string compare. Matching hashes are followed by a string compare to
>> verify. The hash need not be crypographically secure.
>
> Do we really need this optimization? Internally, the tunables are already
> accessed through a enum, which is essentially a index on tunable_list.
> Why can you we use the same enums value on the cache definition keys?
>
> The string mapping could be accomplished by adding a string list, with
> the tunable value being the offset.
>
>>
>> * I'm not going to try to add some "syntax" to specify if a tunable is
>> overridable or not; this is a simple default-only change.
>
> How should we handle the envvar GLIBC_TUNABLEs in the presence of a system-wide
> tunable? Should we ignore the envvar or merge the results? Which one takes
> precedence (I take the system-wide)? Should we add a way to override system-wide
> value (similar to DF_1_NODEFLIB) as a runtime options (either another envvar or
> a extra field in GLIBC_TUNABLE)?
>
>>
>> * Tunables set by these defaults will not be disabled for setuid
>> programs; it's assumed they're a "trusted source".
>
> This seems reasonable, and with this rationale should we add an option
> to allow some tunable to be disabled or overriden? I take this is an extra
> complexity that we should not pursuit.
Another possible feature that comes from the tunable discussion is whether
make sense to add a per-process tunables. The aarch64 MTE for instance is an
example, it is disabled by default because of performance implications; so
the admin might just enable it on some really security sensitive processes.
next prev parent reply other threads:[~2023-10-06 17:12 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-04 20:55 DJ Delorie
2023-10-06 14:44 ` Adhemerval Zanella Netto
2023-10-06 17:12 ` Adhemerval Zanella Netto [this message]
2023-10-06 18:29 ` DJ Delorie
2023-10-06 19:14 ` Adhemerval Zanella Netto
2023-10-06 20:25 ` DJ Delorie
2023-10-17 14:10 ` Adhemerval Zanella Netto
2023-10-17 14:17 ` Siddhesh Poyarekar
2023-10-17 14:37 ` Siddhesh Poyarekar
2023-10-17 15:43 ` DJ Delorie
2023-10-17 15:58 ` Siddhesh Poyarekar
2023-10-17 16:45 ` DJ Delorie
2023-10-17 16:55 ` Siddhesh Poyarekar
2023-10-17 17:14 ` DJ Delorie
2023-10-18 14:20 ` Siddhesh Poyarekar
2023-10-17 17:40 ` Zack Weinberg
2023-10-17 17:47 ` DJ Delorie
2023-10-17 18:17 ` Zack Weinberg
2023-10-17 18:21 ` DJ Delorie
2023-10-06 22:04 ` DJ Delorie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fdb854e6-92be-47de-b2d7-0c0f1ab6cb42@linaro.org \
--to=adhemerval.zanella@linaro.org \
--cc=dj@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).