Re: [PATCH 3/3] crt: add dcrt1, with support for locating the dynamic loader at runtime

[Szabolcs Nagy <nsz@port70.net>]

* Rodger Combs <rodger.combs@gmail.com> [2019-04-27 19:16:30 -0500]:
> > On Apr 27, 2019, at 18:55, Szabolcs Nagy <nsz@port70.net> wrote:
> > * Rodger Combs <rodger.combs@gmail.com> [2019-04-27 17:51:17 -0500]:
> >> On Apr 27, 2019, at 12:19, Rich Felker <dalias@libc.org> wrote:
> >>> On Fri, Apr 26, 2019 at 08:13:29PM -0500, Rodger Combs wrote:
> >>>> +	secure = ((aux[0] & 0x7800) != 0x7800 || aux[AT_UID] != aux[AT_EUID]
> >>>> +		|| aux[AT_GID] != aux[AT_EGID] || aux[AT_SECURE]);
> >>> 
> >>> At this point we can just abort if secure != 0. There is unbounded
> >>> attack surface trying to load a (possibly relative) ldso with elevated
> >>> privileges.
> >> 
> >> No more so than dynlink.c normally has when loading other SOs. Like there, I don't follow $ORIGIN in secure mode, and additionally here I don't handle relative-to-cwd paths in secure mode. I don't see a problem with allowing a load from an absolute rpath, or from the hardcoded path, using this mechanism, though.
> >> Basically, I'm intending for this to be a feature that you could just turn on in your linker flags for everything you build, and get the functionality in the cases where you want it, at no significant cost in those where you don't.
> > 
> > i think the code should be written such that it is obvious
> > that user input cannot affect runtime behaviour in secure
> > mode in any way (in particular the loaded code).
> 
> This is the case (CWD, the executable path, and env vars are all ignored in secure mode); if there's something you'd like changed to make that more clear, please elaborate.

the current code does not *obviously* have the right
security properties (it does not even document the
properties it guarantees).

if an auditor has to read complex code like find_linker
to verify important security properties then it is not
obviously secure.

the original musl ldso code is already fairly complicated
and you created a dcrt1 that has more state and branching
around user input.

i suggest refactoring at least find_linker (e.g. into a
secure and a non-secure version, but there might be ways
with less code duplication) and documenting assumptions
about the secure paths (e.g. not user writable).

> >>>> +	// Copy the program headers into an anonymous mapping
> >>>> +	new_hdr = mmap(0, (aux[AT_PHENT] * (aux[AT_PHNUM] + 2) + linker_len + PAGE_SIZE - 1) & -PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> >>>> +	if (map_library_failed(new_hdr))
> >>>> +		goto error;
> >>> 
> >>> Can you remind us why patched program headers are needed? I think it
> >>> was absence of PT_PHDR or something...
> >> 
> >> Yeah, the linker doesn't add PT_PHDR when we tell it not to set a dynamic loader, and dynlink needs it.
> > 
> > there should be a strong reason to add fake program headers.
> > why is PT_PHDR required?
> > who uses PT_INTERP?
> 
> PT_PHDR is needed for the dynamic loader to find the executable's base address.
> PT_INTERP isn't currently used by musl, but it is in glibc (to find its own path, so it knows where it's loaded from for future dlopen()s and such, and potentially for debugging?), and it seems reasonable that the linker might care about it in the future, so I'm including it for potential forwards-compatibility (and also glibc compatibility), since we already need to create an entry for PHDR anyway, so it's trivial to do this as well.

i think base address can be found without PT_PHDR if
there is a dynamic section or with a new api between
the ldso and loader of the ldso (i'd only try the
fake phdr mapping if other options are explored and
turn out to be worse).