* Cannot audit dlopen-ed libraries?
@ 2021-06-30 12:49 Fengkai Sun
2021-07-07 9:23 ` Fengkai Sun
0 siblings, 1 reply; 3+ messages in thread
From: Fengkai Sun @ 2021-06-30 12:49 UTC (permalink / raw)
To: libc-help
Hi list,
I want to use the audit interface to change the symbol bindings in
dlopen-ed libraries. However, the bindings in such libraries seem uncatched
by it:
// lib1.c
#include <stdio.h>
#include <stdlib.h>
int foo()
{
printf("hello world\n");
void *p = malloc(16);
return 0;
}
//libaudit.c
#define _GNU_SOURCE
#include <link.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
unsigned int la_version(unsigned int version)
{
return LAV_CURRENT;
}
unsigned int la_objopen(struct link_map *map, Lmid_t lmid, uintptr_t
*cookie)
{
// monitor everything
return LA_FLG_BINDTO | LA_FLG_BINDFROM;
}
uintptr_t la_symbind64(Elf64_Sym *sym, unsigned int ndx, uintptr_t
*refcook, uintptr_t *defcook, unsigned int *flags, const char *symname)
{
printf("binding symbol: %s\n", symname);
return sym->st_value;
}
// main.c
#include <stdlib.h>
#include <dlfcn.h>
int main()
{
void *handle = dlopen("./lib1.so", RTLD_NOW);
int (*foo)() = dlsym(handle, "foo");
foo();
return 0;
}
And the result is:
binding symbol: _dl_find_dso_for_object
binding symbol: __tunable_get_val
binding symbol: dlopen
binding symbol: _dl_catch_error
binding symbol: dlsym
binding symbol: _dl_sym
binding symbol: foo
hello world
I was expecting printf and malloc to appear, but it seems that only symbols
from main program are catched.
Is this an expected behavior or I misused the audit interface?
Thanks for your time.
Best,
Fengkai
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Cannot audit dlopen-ed libraries?
2021-06-30 12:49 Cannot audit dlopen-ed libraries? Fengkai Sun
@ 2021-07-07 9:23 ` Fengkai Sun
2021-07-07 9:25 ` Florian Weimer
0 siblings, 1 reply; 3+ messages in thread
From: Fengkai Sun @ 2021-07-07 9:23 UTC (permalink / raw)
To: libc-help
Hi list,
I did more experiments and found functions inside dlopen-ed libraries can
be audited with RTLD_LAZY instead of RTLD_NOW set.
However, I want to audit all of the symbol bindings during dlopen, like
those printed by setting LD_DEBUG=bindings. Is this possible?
Best,
Fengkai
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Cannot audit dlopen-ed libraries?
2021-07-07 9:23 ` Fengkai Sun
@ 2021-07-07 9:25 ` Florian Weimer
0 siblings, 0 replies; 3+ messages in thread
From: Florian Weimer @ 2021-07-07 9:25 UTC (permalink / raw)
To: Fengkai Sun via Libc-help; +Cc: Fengkai Sun
* Fengkai Sun via Libc-help:
> However, I want to audit all of the symbol bindings during dlopen, like
> those printed by setting LD_DEBUG=bindings. Is this possible?
Not right now. There have been recent discussions on libc-alpha to call
the la_symbind hook in more cases. This requires changing LAV_CURRENT.
Thanks,
Florian
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-07-07 9:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-30 12:49 Cannot audit dlopen-ed libraries? Fengkai Sun
2021-07-07 9:23 ` Fengkai Sun
2021-07-07 9:25 ` Florian Weimer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).