|
 |
8a8cfb |
commit 2c75b545de6fe3c44138799c68217a94bc669a88
|
|
|
8a8cfb |
Author: Florian Weimer <fweimer@redhat.com>
|
|
|
8a8cfb |
Date: Tue Jun 18 16:42:10 2019 +0200
|
|
|
8a8cfb |
|
|
|
8a8cfb |
elf: Refuse to dlopen PIE objects [BZ #24323]
|
|
|
8a8cfb |
|
|
|
8a8cfb |
Another executable has already been mapped, so the dynamic linker
|
|
|
8a8cfb |
cannot perform relocations correctly for the second executable.
|
|
|
8a8cfb |
|
|
|
8a8cfb |
diff --git a/elf/Makefile b/elf/Makefile
|
|
|
8a8cfb |
index 08e2f99..27a2fa8 100644
|
|
|
8a8cfb |
--- a/elf/Makefile
|
|
|
8a8cfb |
+++ b/elf/Makefile
|
|
|
8a8cfb |
@@ -310,7 +310,7 @@ test-xfail-tst-protected1b = yes
|
|
|
8a8cfb |
endif
|
|
|
8a8cfb |
ifeq (yesyes,$(have-fpie)$(build-shared))
|
|
|
8a8cfb |
modules-names += tst-piemod1
|
|
|
8a8cfb |
-tests += tst-pie1 tst-pie2
|
|
|
8a8cfb |
+tests += tst-pie1 tst-pie2 tst-dlopen-pie
|
|
|
8a8cfb |
tests-pie += tst-pie1 tst-pie2
|
|
|
8a8cfb |
ifeq (yes,$(have-protected-data))
|
|
|
8a8cfb |
tests += vismain
|
|
|
8a8cfb |
@@ -1084,6 +1084,8 @@ CFLAGS-tst-pie2.c += $(pie-ccflag)
|
|
|
8a8cfb |
|
|
|
8a8cfb |
$(objpfx)tst-piemod1.so: $(libsupport)
|
|
|
8a8cfb |
$(objpfx)tst-pie1: $(objpfx)tst-piemod1.so
|
|
|
8a8cfb |
+$(objpfx)tst-dlopen-pie: $(libdl)
|
|
|
8a8cfb |
+$(objpfx)tst-dlopen-pie.out: $(objpfx)tst-pie1
|
|
|
8a8cfb |
|
|
|
8a8cfb |
ifeq (yes,$(build-shared))
|
|
|
8a8cfb |
# NB: Please keep cet-built-dso in sysdeps/x86/Makefile in sync with
|
|
|
8a8cfb |
diff --git a/elf/dl-load.c b/elf/dl-load.c
|
|
|
8a8cfb |
index 2bbef81..5abeb86 100644
|
|
|
8a8cfb |
--- a/elf/dl-load.c
|
|
|
8a8cfb |
+++ b/elf/dl-load.c
|
|
|
8a8cfb |
@@ -1158,6 +1158,10 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
|
|
|
8a8cfb |
goto call_lose;
|
|
|
8a8cfb |
}
|
|
|
8a8cfb |
|
|
|
8a8cfb |
+ /* dlopen of an executable is not valid because it is not possible
|
|
|
8a8cfb |
+ to perform proper relocations, handle static TLS, or run the
|
|
|
8a8cfb |
+ ELF constructors. For PIE, the check needs the dynamic
|
|
|
8a8cfb |
+ section, so there is another check below. */
|
|
|
8a8cfb |
if (__glibc_unlikely (type != ET_DYN)
|
|
|
8a8cfb |
&& __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0))
|
|
|
8a8cfb |
{
|
|
|
8a8cfb |
@@ -1194,9 +1198,11 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
|
|
|
8a8cfb |
elf_get_dynamic_info (l, NULL);
|
|
|
8a8cfb |
|
|
|
8a8cfb |
/* Make sure we are not dlopen'ing an object that has the
|
|
|
8a8cfb |
- DF_1_NOOPEN flag set. */
|
|
|
8a8cfb |
- if (__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN)
|
|
|
8a8cfb |
- && (mode & __RTLD_DLOPEN))
|
|
|
8a8cfb |
+ DF_1_NOOPEN flag set, or a PIE object. */
|
|
|
8a8cfb |
+ if ((__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN)
|
|
|
8a8cfb |
+ && (mode & __RTLD_DLOPEN))
|
|
|
8a8cfb |
+ || (__glibc_unlikely (l->l_flags_1 & DF_1_PIE)
|
|
|
8a8cfb |
+ && __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0)))
|
|
|
8a8cfb |
{
|
|
|
8a8cfb |
/* We are not supposed to load this object. Free all resources. */
|
|
|
8a8cfb |
_dl_unmap_segments (l);
|
|
|
8a8cfb |
@@ -1207,7 +1213,11 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
|
|
|
8a8cfb |
if (l->l_phdr_allocated)
|
|
|
8a8cfb |
free ((void *) l->l_phdr);
|
|
|
8a8cfb |
|
|
|
8a8cfb |
- errstring = N_("shared object cannot be dlopen()ed");
|
|
|
8a8cfb |
+ if (l->l_flags_1 & DF_1_PIE)
|
|
|
8a8cfb |
+ errstring
|
|
|
8a8cfb |
+ = N_("cannot dynamically load position-independent executable");
|
|
|
8a8cfb |
+ else
|
|
|
8a8cfb |
+ errstring = N_("shared object cannot be dlopen()ed");
|
|
|
8a8cfb |
goto call_lose;
|
|
|
8a8cfb |
}
|
|
|
8a8cfb |
|
|
|
8a8cfb |
diff --git a/elf/tst-dlopen-pie.c b/elf/tst-dlopen-pie.c
|
|
|
8a8cfb |
new file mode 100644
|
|
|
8a8cfb |
index 0000000..6a41c73
|
|
|
8a8cfb |
--- /dev/null
|
|
|
8a8cfb |
+++ b/elf/tst-dlopen-pie.c
|
|
|
8a8cfb |
@@ -0,0 +1,49 @@
|
|
|
8a8cfb |
+/* dlopen test for PIE objects.
|
|
|
8a8cfb |
+ Copyright (C) 2019 Free Software Foundation, Inc.
|
|
|
8a8cfb |
+ This file is part of the GNU C Library.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is free software; you can redistribute it and/or
|
|
|
8a8cfb |
+ modify it under the terms of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License as published by the Free Software Foundation; either
|
|
|
8a8cfb |
+ version 2.1 of the License, or (at your option) any later version.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ The GNU C Library is distributed in the hope that it will be useful,
|
|
|
8a8cfb |
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
8a8cfb |
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
8a8cfb |
+ Lesser General Public License for more details.
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+ You should have received a copy of the GNU Lesser General Public
|
|
|
8a8cfb |
+ License along with the GNU C Library; if not, see
|
|
|
8a8cfb |
+ <http://www.gnu.org/licenses/>. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+/* This test attempts to open the (otherwise unrelated) PIE test
|
|
|
8a8cfb |
+ program elf/tst-pie1 and expects the attempt to fail. */
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <dlfcn.h>
|
|
|
8a8cfb |
+#include <stddef.h>
|
|
|
8a8cfb |
+#include <string.h>
|
|
|
8a8cfb |
+#include <support/check.h>
|
|
|
8a8cfb |
+#include <support/support.h>
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+static void
|
|
|
8a8cfb |
+test_mode (int mode)
|
|
|
8a8cfb |
+{
|
|
|
8a8cfb |
+ char *pie_path = xasprintf ("%s/elf/tst-pie1", support_objdir_root);
|
|
|
8a8cfb |
+ if (dlopen (pie_path, mode) != NULL)
|
|
|
8a8cfb |
+ FAIL_EXIT1 ("dlopen succeeded unexpectedly (%d)", mode);
|
|
|
8a8cfb |
+ const char *message = dlerror ();
|
|
|
8a8cfb |
+ const char *expected
|
|
|
8a8cfb |
+ = "cannot dynamically load position-independent executable";
|
|
|
8a8cfb |
+ if (strstr (message, expected) == NULL)
|
|
|
8a8cfb |
+ FAIL_EXIT1 ("unexpected error message (mode %d): %s", mode, message);
|
|
|
8a8cfb |
+}
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+static int
|
|
|
8a8cfb |
+do_test (void)
|
|
|
8a8cfb |
+{
|
|
|
8a8cfb |
+ test_mode (RTLD_LAZY);
|
|
|
8a8cfb |
+ test_mode (RTLD_NOW);
|
|
|
8a8cfb |
+ return 0;
|
|
|
8a8cfb |
+}
|
|
|
8a8cfb |
+
|
|
|
8a8cfb |
+#include <support/test-driver.c>
|
|
|
8a8cfb |
diff --git a/include/elf.h b/include/elf.h
|
|
|
8a8cfb |
index ab76aaf..14ed67f 100644
|
|
|
8a8cfb |
--- a/include/elf.h
|
|
|
8a8cfb |
+++ b/include/elf.h
|
|
|
8a8cfb |
@@ -23,7 +23,7 @@
|
|
|
8a8cfb |
# endif
|
|
|
8a8cfb |
# define DT_1_SUPPORTED_MASK \
|
|
|
8a8cfb |
(DF_1_NOW | DF_1_NODELETE | DF_1_INITFIRST | DF_1_NOOPEN \
|
|
|
8a8cfb |
- | DF_1_ORIGIN | DF_1_NODEFLIB)
|
|
|
8a8cfb |
+ | DF_1_ORIGIN | DF_1_NODEFLIB | DF_1_PIE)
|
|
|
8a8cfb |
|
|
|
8a8cfb |
#endif /* !_ISOMAC */
|
|
|
8a8cfb |
#endif /* elf.h */
|