Re: Possible glibc 2.35 ARM regression in LD_BIND_NOT

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

> On 5 Jul 2022, at 11:34, Nathan Nye <nnye@whitebeamsec.com> wrote:
> 
> All,
> 
> I isolated the issue. When compiling binaries using gcc on Ubuntu 20.04 or below, the resulting binary does not have PIE - regardless of the -pie argument being passed to the compiler. Ubuntu 22.04 correctly reflects the default build flags being PIE and the binaries have PIE unless the arguments passed to gcc include -no-pie.
> 
> Thanks,
> Nathan Nye

The problem is not in fact PIE, but rather that newer toolchain default to
bindnow. Using the provided example on 

* Ubuntu 14 (glibc 2.19), Ubuntu 16 (glibc 2.23), and Ubuntu 18 (glibc 2.27)

$ gcc -Wall runevp.c -o runevp -Wl,-z,lazy
$ gcc -Wall -fPIC -shared -o auditlib.so auditlib.c
$ LD_AUDIT=./auditlib.so LD_BIND_NOT=1 LD_BIND_NOW=1 ./runevp
$

* And on Ubuntu 22.04 (glibc 2.35)

$ gcc -Wall runevp.c -o runevp -Wl,-z,lazy
$ gcc -Wall -fPIC -shared -o auditlib.so auditlib.c
$ LD_AUDIT=./auditlib.so LD_BIND_NOT=1 LD_BIND_NOW=1 ./runevp
symbol binding for ‘execvp'

On glibc 2.34 we now see a bind-now la_symbind event, different than
previous version.  If you build with -Wl,-z,lazy we will see the previous
behavior where la_symbind will be called on each symbol resolution.

Now for LD_BIND_NOT and bind-now, I think this is the correct behavior:
we need to always update the GOT entry since runtime won’t setup a
lazy resolution PLT entry (symbols resolution is always setup at 
startup phase).  Otherwise we will need to add a hack similar to
LD_PROFILE and I really don’t think this is the best strategy.

> 
> On 7/4/22 3:31 PM, Nathan Nye wrote:
>> +Adhemerval
>> 
>> Hi Adhemerval,
>> 
>> I think you may know the relevant source best if this issue exists. Your feedback would be really valuable if you're able to test it.
>> 
>> Very respectfully,
>> Nathan Nye
>> 
>> On 7/4/22 3:14 PM, Nathan Nye wrote:
>>> Good afternoon,
>>> 
>>> I'm reviewing what could be a regression in LD_BIND_NOT's functionality in glibc 2.35 on ARM architectures (there were a few recent ARM audit changes). Symbol binding only occurs a single time on glibc 2.35/ARM, even when LD_BIND_NOT is enabled. I've tested:
>>> 	• Ubuntu 22.04 x86_64 glibc 2.35
>>> 	• Ubuntu 20.04 ARM glibc 2.34
>>> 	• Ubuntu 22.04 ARM glibc 2.35
>>> I could use a second pair of eyes on this issue to verify it exists. Here is the test case I cobbled together, please excuse the poor C code I wrote while testing: https://pastebin.com/raw/HSSYjemj
>>> 
>>> I've also attached the test case to this email. Thanks!
>>> 
>>> Very respectfully,
>>> Nathan Nye
>> 
> 
> <OpenPGP_0xCB7269934F16882E.asc>