From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <qcloud1014@gmail.com>
Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com
 [IPv6:2a00:1450:4864:20::22b])
 by sourceware.org (Postfix) with ESMTPS id A3F11388A411
 for <libc-help@sourceware.org>; Wed, 30 Jun 2021 12:50:08 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org A3F11388A411
Received: by mail-lj1-x22b.google.com with SMTP id a6so3147985ljq.3
 for <libc-help@sourceware.org>; Wed, 30 Jun 2021 05:50:08 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
 bh=ATIbuvUAUVz/o0hNHIgVoMROcFx8qJfW/QVjoIK4SCg=;
 b=TGmfU4LgUbYkOQ+RePMlYiyBmgfFxJA/CbBVOIRmUPfgkAPRYYZM6RzQ5xmg6KyWJR
 Iu2YCT32gSLqeLmPvu4WVvz6RZ14i/dG7HtBdl/4J1HVZBXKCeN2+Gfq3Q36kdVzK7zj
 k+9/lhUoxlszw8sWRYjM1PzFIdHhIe/Q8hRyaLb7I+N50q3XmqZAejWKo2C2t0/SDuRx
 Y9GDYEjnSCEoENPSectC7BuHJuCZjOmEJhO+95KXDmnWepdZbe/lHwntiPQqEGRGV43z
 oOuUzDKSNwAf5k1jJSc70dQ3+pjzHPUO85DbRn009nX+XqcbpgNXYISRZ95h1msAbYAD
 YWNA==
X-Gm-Message-State: AOAM531OGbguSabFoU4V+4p9+zfMUZcP9GfyMH9Wrc+L5hz8qOKhpyTB
 WQ8rf6dvkUfSJBqZvLo4HTqoyTNW23FBEI4LT90vtfvg/iHiDg==
X-Google-Smtp-Source: ABdhPJzirYzQhP9dVnmoOxrwhX6ct0bShKszTnVZiTYRCADA7Cvr66GgZavxwtlxzs61IA4bpzF1ydH2SDQh0nkB1oI=
X-Received: by 2002:a2e:8941:: with SMTP id b1mr7980875ljk.284.1625057407293; 
 Wed, 30 Jun 2021 05:50:07 -0700 (PDT)
MIME-Version: 1.0
From: Fengkai Sun <qcloud1014@gmail.com>
Date: Wed, 30 Jun 2021 20:49:56 +0800
Message-ID: <CAF6YOcOH8V7mcosXtE2c9nhU3HY+xkqWQJPUCfv3j6C2-4CAsQ@mail.gmail.com>
Subject: Cannot audit dlopen-ed libraries?
To: libc-help@sourceware.org
X-Spam-Status: No, score=-0.2 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_ENVFROM_END_DIGIT,
 FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS,
 TXREP autolearn=ham autolearn_force=no version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
 server2.sourceware.org
Content-Type: text/plain; charset="UTF-8"
X-Content-Filtered-By: Mailman/MimeDel 2.1.29
X-BeenThere: libc-help@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Libc-help mailing list <libc-help.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/libc-help>,
 <mailto:libc-help-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/libc-help/>
List-Help: <mailto:libc-help-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/libc-help>,
 <mailto:libc-help-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Jun 2021 12:50:12 -0000

Hi list,

I want to use the audit interface to change the symbol bindings in
dlopen-ed libraries. However, the bindings in such libraries seem uncatched
by it:

// lib1.c
#include <stdio.h>
#include <stdlib.h>

int foo()
{
    printf("hello world\n");
    void *p = malloc(16);

    return 0;
}

//libaudit.c
#define _GNU_SOURCE
#include <link.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>

unsigned int la_version(unsigned int version)
{
    return LAV_CURRENT;
}

unsigned int la_objopen(struct link_map *map, Lmid_t lmid, uintptr_t
*cookie)
{
    // monitor everything
    return LA_FLG_BINDTO | LA_FLG_BINDFROM;
}

uintptr_t la_symbind64(Elf64_Sym *sym, unsigned int ndx, uintptr_t
*refcook, uintptr_t *defcook, unsigned int *flags, const char *symname)
{
    printf("binding symbol: %s\n", symname);
    return sym->st_value;
}

// main.c
#include <stdlib.h>
#include <dlfcn.h>

int main()
{
    void *handle = dlopen("./lib1.so", RTLD_NOW);
    int (*foo)() = dlsym(handle, "foo");

    foo();

    return 0;
}

And the result is:
binding symbol: _dl_find_dso_for_object
binding symbol: __tunable_get_val
binding symbol: dlopen
binding symbol: _dl_catch_error
binding symbol: dlsym
binding symbol: _dl_sym
binding symbol: foo
hello world


I was expecting printf and malloc to appear, but it seems that only symbols
from main program are catched.
Is this an expected behavior or I misused the audit interface?

Thanks for your time.


Best,
Fengkai