From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ot1-x32b.google.com (mail-ot1-x32b.google.com [IPv6:2607:f8b0:4864:20::32b]) by sourceware.org (Postfix) with ESMTPS id 786603857818 for ; Tue, 1 Feb 2022 12:43:37 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 786603857818 Received: by mail-ot1-x32b.google.com with SMTP id s6-20020a0568301e0600b0059ea5472c98so16036809otr.11 for ; Tue, 01 Feb 2022 04:43:37 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:references:from:in-reply-to :content-transfer-encoding; bh=x/JXxPfbK6qwULbYsT4bTB+/L3WmCpNxt0L1xzg+Iz8=; b=zjrds/5Tfz3hocsh6lS0BM7CsjBEJMD7imKxYF+/hJhxBbrwtmlCu8zGsaJs1L8rtN LlRTmjlVqTqK7i9uHwSoIgyWJR+Wx6QBqBk5AzGMgmwWHSzeXq0O78OJlNPS7n7s+SHP HyDVvwDL9BY28POVDIChkqF1oIDd4qoEieCzdJSkDeml2HaoG0TyufypSDltA1HixT6L doeR09BgDyHqIE3VBDh+79YAx5K91XDCMivGMM+PYSg3fzNgw7pcomnKY21EewTOmYTa jMZ8A4dXKisKOGteSoghthHfJhLBBuuldBZ07S0ft5Mi/5vB5GloBF2Xg/6D29ZSIEjP QwWQ== X-Gm-Message-State: AOAM530E6rq/Zw79XfV2sMRqZ1a/0+yFXDN3NFJw6/me3+CfnkwzPVwC F6ERwZbfJKVp6aUhgshs5AnJAo6pqfMjgQ== X-Google-Smtp-Source: ABdhPJzAtu6eXbWHd+qQy4BWvPppPU28k8dNRFR8H+k3rvmEA/QmcEbonz9YM/cQw76kNYjlrYOGBg== X-Received: by 2002:a9d:e94:: with SMTP id 20mr13861298otj.200.1643719416734; Tue, 01 Feb 2022 04:43:36 -0800 (PST) Received: from ?IPV6:2804:431:c7ca:709a:f3cb:a92a:e1ce:d27d? ([2804:431:c7ca:709a:f3cb:a92a:e1ce:d27d]) by smtp.gmail.com with ESMTPSA id h17sm12088326otn.60.2022.02.01.04.43.35 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 01 Feb 2022 04:43:36 -0800 (PST) Message-ID: Date: Tue, 1 Feb 2022 09:43:33 -0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.5.1 Subject: Re: How can I wrap ld-linux or execve into it? Content-Language: en-US To: Farid Zakaria , Libc-help References: From: Adhemerval Zanella In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-5.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libc-help@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-help mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Feb 2022 12:43:39 -0000 On 31/01/2022 17:10, Farid Zakaria via Libc-help wrote: > Hi, > > I am looking to perform some functionality before the dynamic linker > (linux-ld/ld.so) is invoked. > > My naive assessment was that I would be able to set in the PT_INTERP > section of a binary, my *static binary*, which will then execve into > the dynamic linker after doing some precanned actions. > > Unfortunately, trying this has resulted in some SIGSEGV... > > I came across https://github.com/Mic92/nix-ld which seems to do > something similar, but I was curious why it has to do a lot more to > achieve the same effect with a jump. > > I have also been pointed to LD_AUDIT however I am also interested in > having it agnostic to libc (glibc vs. musl) > > Thank you for any tips, guidance or links you can provide. > FZ The issue is for static linking _dl_aux_init will setup the _dl_phdr to the loaded binary (since it was done by the kernel) passed on auxiliary vectors: elf/dl-support.c: 246 void 247 _dl_aux_init (ElfW(auxv_t) *av) 248 { [...] 269 case AT_PHDR: 270 GL(dl_phdr) = (const void *) av->a_un.a_val; 271 break; [...] And this is later used to setup the TCB: csu/libc-tls.c 104 void 105 __libc_setup_tls (void) 106 { [...] 120 /* Look through the TLS segment if there is any. */ 121 if (_dl_phdr != NULL) 122 for (phdr = _dl_phdr; phdr < &_dl_phdr[_dl_phnum]; ++phdr) 123 if (phdr->p_type == PT_TLS) 124 { 125 /* Remember the values we need. */ 126 memsz = phdr->p_memsz; 127 filesz = phdr->p_filesz; 128 initimage = (void *) phdr->p_vaddr + main_map->l_addr; 129 align = phdr->p_align; 130 if (phdr->p_align > max_align) 131 max_align = phdr->p_align; 132 break; 133 } The problem is seice _dl_phdr is not pointing to the static programs acting as loader, the PT_TLS is not considered and thus not initialized correctly. That's why once __ctype_init tries to access TLS variables it triggers an invalid memory reference: (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x000000000045f464 in __ctype_init () at ctype-info.c:31 31 *bp = (const uint16_t *) _NL_CURRENT (LC_CTYPE, _NL_CTYPE_CLASS) + 128; And I don't think this would be easy to support without changing a *lot* on static linking organization. If you check the loader code, it avoids to use TLS exactly to avoid this initialization issue. I think the best option to work by checking elt/rtld.c and see if you can hack a way link you code after its initialization.