ce426f
From a014cecd82b71b70a6a843e250e06b541ad524f7 Mon Sep 17 00:00:00 2001
ce426f
From: Florian Weimer <fweimer@redhat.com>
ce426f
Date: Thu, 15 Oct 2015 09:23:07 +0200
ce426f
Subject: [PATCH] Always enable pointer guard [BZ #18928]
ce426f
ce426f
Honoring the LD_POINTER_GUARD environment variable in AT_SECURE mode
ce426f
has security implications.  This commit enables pointer guard
ce426f
unconditionally, and the environment variable is now ignored.
ce426f
ce426f
        [BZ #18928]
ce426f
        * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove
ce426f
        _dl_pointer_guard member.
ce426f
        * elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard
ce426f
        initializer.
ce426f
        (security_init): Always set up pointer guard.
ce426f
        (process_envvars): Do not process LD_POINTER_GUARD.
ce426f
ce426f
diff -rup a/elf/rtld.c b/elf/rtld.c
ce426f
--- a/elf/rtld.c	2017-03-06 14:38:55.000000000 -0500
ce426f
+++ b/elf/rtld.c	2017-03-06 14:41:19.502556336 -0500
ce426f
@@ -160,7 +160,6 @@ struct rtld_global_ro _rtld_global_ro at
ce426f
     ._dl_hwcap_mask = HWCAP_IMPORTANT,
ce426f
     ._dl_lazy = 1,
ce426f
     ._dl_fpu_control = _FPU_DEFAULT,
ce426f
-    ._dl_pointer_guard = 1,
ce426f
     ._dl_pagesize = EXEC_PAGESIZE,
ce426f
     ._dl_inhibit_cache = 0,
ce426f
 
ce426f
@@ -844,15 +843,12 @@ security_init (void)
ce426f
 #endif
ce426f
 
ce426f
   /* Set up the pointer guard as well, if necessary.  */
ce426f
-  if (GLRO(dl_pointer_guard))
ce426f
-    {
ce426f
-      uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
ce426f
-							     stack_chk_guard);
ce426f
+  uintptr_t pointer_chk_guard
ce426f
+    = _dl_setup_pointer_guard (_dl_random, stack_chk_guard);
ce426f
 #ifdef THREAD_SET_POINTER_GUARD
ce426f
-      THREAD_SET_POINTER_GUARD (pointer_chk_guard);
ce426f
+  THREAD_SET_POINTER_GUARD (pointer_chk_guard);
ce426f
 #endif
ce426f
-      __pointer_chk_guard_local = pointer_chk_guard;
ce426f
-    }
ce426f
+  __pointer_chk_guard_local = pointer_chk_guard;
ce426f
 
ce426f
   /* We do not need the _dl_random value anymore.  The less
ce426f
      information we leave behind, the better, so clear the
ce426f
@@ -2599,9 +2595,6 @@ process_envvars (enum mode *modep)
ce426f
 	      GLRO(dl_use_load_bias) = envline[14] == '1' ? -1 : 0;
ce426f
 	      break;
ce426f
 	    }
ce426f
-
ce426f
-	  if (memcmp (envline, "POINTER_GUARD", 13) == 0)
ce426f
-	    GLRO(dl_pointer_guard) = envline[14] != '0';
ce426f
 	  break;
ce426f
 
ce426f
 	case 14:
ce426f
diff -rup a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
ce426f
--- a/sysdeps/generic/ldsodefs.h	2017-03-06 14:38:57.000000000 -0500
ce426f
+++ b/sysdeps/generic/ldsodefs.h	2017-03-06 14:41:19.506556361 -0500
ce426f
@@ -588,9 +588,6 @@ struct rtld_global_ro
ce426f
   /* List of auditing interfaces.  */
ce426f
   struct audit_ifaces *_dl_audit;
ce426f
   unsigned int _dl_naudit;
ce426f
-
ce426f
-  /* 0 if internal pointer values should not be guarded, 1 if they should.  */
ce426f
-  EXTERN int _dl_pointer_guard;
ce426f
 };
ce426f
 # define __rtld_global_attribute__
ce426f
 # if IS_IN (rtld)