From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 45743 invoked by alias); 4 Nov 2019 20:05:37 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 45732 invoked by uid 89); 4 Nov 2019 20:05:37 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.3 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-18.1 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_SHORT autolearn=ham version=3.3.1 spammy=stringh, string.h, UD:string.h X-Spam-Status: No, score=-18.1 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_0,GIT_PATCH_1,GIT_PATCH_2,GIT_PATCH_3,KAM_SHORT autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on sourceware.org X-Spam-Level: X-HELO: us-smtp-1.mimecast.com Received: from us-smtp-delivery-1.mimecast.com (HELO us-smtp-1.mimecast.com) (205.139.110.120) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 04 Nov 2019 20:05:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1572897933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FJ2z71na0uR6Y5fgPrGFRpw6QUPMmsCq65rthY3ERNg=; b=Nr0kbC6Tb1LwHRtjbPIqo1HBXSS/MLBah+b1Dghwpn+VUL/tsMZMNZD2ySFs2xnXCYxz5P pR9X19ZszC1WckxM33Q1WaudnNJihk0HJ8fFkyFqJlsTeCOSc5usavIKWPWZaTNtJO5Hmg rnsUfAy0y2lefIYcEeiwEPJGjKtnPR4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-438-WpxV8Zy9MDCGrEYjwiKoHw-1; Mon, 04 Nov 2019 15:05:31 -0500 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 79D261800D53 for ; Mon, 4 Nov 2019 20:05:30 +0000 (UTC) Received: from greed.delorie.com (ovpn-116-12.phx2.redhat.com [10.3.116.12]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 471C626FC4 for ; Mon, 4 Nov 2019 20:05:30 +0000 (UTC) Received: from greed.delorie.com.redhat.com (localhost [127.0.0.1]) by greed.delorie.com (8.14.7/8.14.7) with ESMTP id xA4K5Tvi007614 for ; Mon, 4 Nov 2019 15:05:29 -0500 Date: Tue, 01 Jan 2019 00:00:00 -0000 Message-Id: From: DJ Delorie To: libc-stable@sourceware.org Subject: [2.29 COMMITTED] elf: Refuse to dlopen PIE objects [BZ #24323] X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-MC-Unique: WpxV8Zy9MDCGrEYjwiKoHw-1 X-Mimecast-Spam-Score: 0 Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes X-SW-Source: 2019-11/txt/msg00005.txt.bz2 From: Florian Weimer Another executable has already been mapped, so the dynamic linker cannot perform relocations correctly for the second executable. (cherry picked from commit 2c75b545de6fe3c44138799c68217a94bc669a88) diff --git a/ChangeLog b/ChangeLog index 440aa42cef..c0af7c3005 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2019-06-18 Florian Weimer + + [BZ #24323] + * include/elf.h (DT_1_SUPPORTED_MASK): Include DF_1_PIE. + * elf/dl-load.c (_dl_map_object_from_fd): Check for DF_1_PIE and + fail when called from dlopen. + * elf/Makefile [have-fpie && build-shared] (tests): Add + tst-dlopen-pie. + (tst-dlopen-pie): Link with -ldl. + (tst-dlopen-pie.out): Add run-time dependency on tst-pie1. + * elf/tst-dlopen-pie.c (do_test): New file. + 2019-07-10 DJ Delorie Sergei Trofimovich =20 diff --git a/elf/Makefile b/elf/Makefile index e7457e809f..fa86ce2b8f 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -305,7 +305,7 @@ test-xfail-tst-protected1b =3D yes endif ifeq (yesyes,$(have-fpie)$(build-shared)) modules-names +=3D tst-piemod1 -tests +=3D tst-pie1 tst-pie2 +tests +=3D tst-pie1 tst-pie2 tst-dlopen-pie tests-pie +=3D tst-pie1 tst-pie2 ifeq (yes,$(have-protected-data)) tests +=3D vismain @@ -1066,6 +1066,8 @@ CFLAGS-tst-pie2.c +=3D $(pie-ccflag) =20 $(objpfx)tst-piemod1.so: $(libsupport) $(objpfx)tst-pie1: $(objpfx)tst-piemod1.so +$(objpfx)tst-dlopen-pie: $(libdl) +$(objpfx)tst-dlopen-pie.out: $(objpfx)tst-pie1 =20 ifeq (yes,$(build-shared)) # NB: Please keep cet-built-dso in sysdeps/x86/Makefile in sync with diff --git a/elf/dl-load.c b/elf/dl-load.c index f972524421..88bd04e687 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -1173,6 +1173,10 @@ _dl_map_object_from_fd (const char *name, const char= *origname, int fd, goto call_lose; } =20 + /* dlopen of an executable is not valid because it is not possible + to perform proper relocations, handle static TLS, or run the + ELF constructors. For PIE, the check needs the dynamic + section, so there is another check below. */ if (__glibc_unlikely (type !=3D ET_DYN) && __glibc_unlikely ((mode & __RTLD_OPENEXEC) =3D=3D 0)) { @@ -1209,9 +1213,11 @@ _dl_map_object_from_fd (const char *name, const char= *origname, int fd, elf_get_dynamic_info (l, NULL); =20 /* Make sure we are not dlopen'ing an object that has the - DF_1_NOOPEN flag set. */ - if (__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN) - && (mode & __RTLD_DLOPEN)) + DF_1_NOOPEN flag set, or a PIE object. */ + if ((__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN) + && (mode & __RTLD_DLOPEN)) + || (__glibc_unlikely (l->l_flags_1 & DF_1_PIE) + && __glibc_unlikely ((mode & __RTLD_OPENEXEC) =3D=3D 0))) { /* We are not supposed to load this object. Free all resources. */ _dl_unmap_segments (l); @@ -1222,7 +1228,11 @@ _dl_map_object_from_fd (const char *name, const char= *origname, int fd, if (l->l_phdr_allocated) free ((void *) l->l_phdr); =20 - errstring =3D N_("shared object cannot be dlopen()ed"); + if (l->l_flags_1 & DF_1_PIE) + errstring + =3D N_("cannot dynamically load position-independent executable"); + else + errstring =3D N_("shared object cannot be dlopen()ed"); goto call_lose; } =20 diff --git a/elf/tst-dlopen-pie.c b/elf/tst-dlopen-pie.c new file mode 100644 index 0000000000..6a41c731cb --- /dev/null +++ b/elf/tst-dlopen-pie.c @@ -0,0 +1,49 @@ +/* dlopen test for PIE objects. + Copyright (C) 2019 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +/* This test attempts to open the (otherwise unrelated) PIE test + program elf/tst-pie1 and expects the attempt to fail. */ + +#include +#include +#include +#include +#include + +static void +test_mode (int mode) +{ + char *pie_path =3D xasprintf ("%s/elf/tst-pie1", support_objdir_root); + if (dlopen (pie_path, mode) !=3D NULL) + FAIL_EXIT1 ("dlopen succeeded unexpectedly (%d)", mode); + const char *message =3D dlerror (); + const char *expected + =3D "cannot dynamically load position-independent executable"; + if (strstr (message, expected) =3D=3D NULL) + FAIL_EXIT1 ("unexpected error message (mode %d): %s", mode, message); +} + +static int +do_test (void) +{ + test_mode (RTLD_LAZY); + test_mode (RTLD_NOW); + return 0; +} + +#include diff --git a/include/elf.h b/include/elf.h index ab76aafb1e..14ed67ff67 100644 --- a/include/elf.h +++ b/include/elf.h @@ -23,7 +23,7 @@ # endif # define DT_1_SUPPORTED_MASK \ (DF_1_NOW | DF_1_NODELETE | DF_1_INITFIRST | DF_1_NOOPEN \ - | DF_1_ORIGIN | DF_1_NODEFLIB) + | DF_1_ORIGIN | DF_1_NODEFLIB | DF_1_PIE) =20 #endif /* !_ISOMAC */ #endif /* elf.h */