From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14095 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Szabolcs Nagy Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCH 3/3] crt: add dcrt1, with support for locating the dynamic loader at runtime Date: Sun, 28 Apr 2019 01:55:10 +0200 Message-ID: <20190427235510.GL26605@port70.net> References: <1556327609-27385-1-git-send-email-rodger.combs@gmail.com> <1556327609-27385-3-git-send-email-rodger.combs@gmail.com> <20190427171907.GT23599@brightrain.aerifal.cx> <56F34851-93B5-43D7-8968-4316F0F76157@gmail.com> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="242701"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.10.1 (2018-07-13) To: musl@lists.openwall.com Original-X-From: musl-return-14111-gllmg-musl=m.gmane.org@lists.openwall.com Sun Apr 28 01:55:26 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1hKXAD-001126-Nv for gllmg-musl@m.gmane.org; Sun, 28 Apr 2019 01:55:25 +0200 Original-Received: (qmail 29732 invoked by uid 550); 27 Apr 2019 23:55:23 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 29711 invoked from network); 27 Apr 2019 23:55:22 -0000 Mail-Followup-To: musl@lists.openwall.com Content-Disposition: inline In-Reply-To: <56F34851-93B5-43D7-8968-4316F0F76157@gmail.com> Xref: news.gmane.org gmane.linux.lib.musl.general:14095 Archived-At: * Rodger Combs [2019-04-27 17:51:17 -0500]: > On Apr 27, 2019, at 12:19, Rich Felker wrote: > > On Fri, Apr 26, 2019 at 08:13:29PM -0500, Rodger Combs wrote: > >> + secure = ((aux[0] & 0x7800) != 0x7800 || aux[AT_UID] != aux[AT_EUID] > >> + || aux[AT_GID] != aux[AT_EGID] || aux[AT_SECURE]); > > > > At this point we can just abort if secure != 0. There is unbounded > > attack surface trying to load a (possibly relative) ldso with elevated > > privileges. > > No more so than dynlink.c normally has when loading other SOs. Like there, I don't follow $ORIGIN in secure mode, and additionally here I don't handle relative-to-cwd paths in secure mode. I don't see a problem with allowing a load from an absolute rpath, or from the hardcoded path, using this mechanism, though. > Basically, I'm intending for this to be a feature that you could just turn on in your linker flags for everything you build, and get the functionality in the cases where you want it, at no significant cost in those where you don't. i think the code should be written such that it is obvious that user input cannot affect runtime behaviour in secure mode in any way (in particular the loaded code). > >> + // Copy the program headers into an anonymous mapping > >> + new_hdr = mmap(0, (aux[AT_PHENT] * (aux[AT_PHNUM] + 2) + linker_len + PAGE_SIZE - 1) & -PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); > >> + if (map_library_failed(new_hdr)) > >> + goto error; > > > > Can you remind us why patched program headers are needed? I think it > > was absence of PT_PHDR or something... > > Yeah, the linker doesn't add PT_PHDR when we tell it not to set a dynamic loader, and dynlink needs it. there should be a strong reason to add fake program headers. why is PT_PHDR required? who uses PT_INTERP?