Re: [PATCH 3/3] crt: add dcrt1, with support for locating the dynamic loader at runtime

[Szabolcs Nagy <nsz@port70.net>]

* Rodger Combs <rodger.combs@gmail.com> [2019-04-27 17:51:17 -0500]:
> On Apr 27, 2019, at 12:19, Rich Felker <dalias@libc.org> wrote:
> > On Fri, Apr 26, 2019 at 08:13:29PM -0500, Rodger Combs wrote:
> >> +	secure = ((aux[0] & 0x7800) != 0x7800 || aux[AT_UID] != aux[AT_EUID]
> >> +		|| aux[AT_GID] != aux[AT_EGID] || aux[AT_SECURE]);
> > 
> > At this point we can just abort if secure != 0. There is unbounded
> > attack surface trying to load a (possibly relative) ldso with elevated
> > privileges.
> 
> No more so than dynlink.c normally has when loading other SOs. Like there, I don't follow $ORIGIN in secure mode, and additionally here I don't handle relative-to-cwd paths in secure mode. I don't see a problem with allowing a load from an absolute rpath, or from the hardcoded path, using this mechanism, though.
> Basically, I'm intending for this to be a feature that you could just turn on in your linker flags for everything you build, and get the functionality in the cases where you want it, at no significant cost in those where you don't.

i think the code should be written such that it is obvious
that user input cannot affect runtime behaviour in secure
mode in any way (in particular the loaded code).

> >> +	// Copy the program headers into an anonymous mapping
> >> +	new_hdr = mmap(0, (aux[AT_PHENT] * (aux[AT_PHNUM] + 2) + linker_len + PAGE_SIZE - 1) & -PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> >> +	if (map_library_failed(new_hdr))
> >> +		goto error;
> > 
> > Can you remind us why patched program headers are needed? I think it
> > was absence of PT_PHDR or something...
> 
> Yeah, the linker doesn't add PT_PHDR when we tell it not to set a dynamic loader, and dynlink needs it.

there should be a strong reason to add fake program headers.
why is PT_PHDR required?
who uses PT_INTERP?