Cannot audit dlopen-ed libraries?

Cannot audit dlopen-ed libraries?

[Fengkai Sun]

Hi list,

I want to use the audit interface to change the symbol bindings in
dlopen-ed libraries. However, the bindings in such libraries seem uncatched
by it:

// lib1.c
#include <stdio.h>
#include <stdlib.h>

int foo()
{
    printf("hello world\n");
    void *p = malloc(16);

    return 0;
}

//libaudit.c
#define _GNU_SOURCE
#include <link.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>

unsigned int la_version(unsigned int version)
{
    return LAV_CURRENT;
}

unsigned int la_objopen(struct link_map *map, Lmid_t lmid, uintptr_t
*cookie)
{
    // monitor everything
    return LA_FLG_BINDTO | LA_FLG_BINDFROM;
}

uintptr_t la_symbind64(Elf64_Sym *sym, unsigned int ndx, uintptr_t
*refcook, uintptr_t *defcook, unsigned int *flags, const char *symname)
{
    printf("binding symbol: %s\n", symname);
    return sym->st_value;
}

// main.c
#include <stdlib.h>
#include <dlfcn.h>

int main()
{
    void *handle = dlopen("./lib1.so", RTLD_NOW);
    int (*foo)() = dlsym(handle, "foo");

    foo();

    return 0;
}

And the result is:
binding symbol: _dl_find_dso_for_object
binding symbol: __tunable_get_val
binding symbol: dlopen
binding symbol: _dl_catch_error
binding symbol: dlsym
binding symbol: _dl_sym
binding symbol: foo
hello world


I was expecting printf and malloc to appear, but it seems that only symbols
from main program are catched.
Is this an expected behavior or I misused the audit interface?

Thanks for your time.


Best,
Fengkai

Re: Cannot audit dlopen-ed libraries?

[Fengkai Sun]

Hi list,

I did more experiments and found functions inside dlopen-ed libraries can
be audited with RTLD_LAZY instead of RTLD_NOW set.

However, I want to audit all of the symbol bindings during dlopen, like
those printed by setting LD_DEBUG=bindings. Is this possible?


Best,
Fengkai

Re: Cannot audit dlopen-ed libraries?

[Florian Weimer]

* Fengkai Sun via Libc-help:

> However, I want to audit all of the symbol bindings during dlopen, like
> those printed by setting LD_DEBUG=bindings. Is this possible?

Not right now.  There have been recent discussions on libc-alpha to call
the la_symbind hook in more cases.  This requires changing LAV_CURRENT.

Thanks,
Florian