IABSD.fr/src/libexec/ld.so
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
fe251f38 | 2022-11-25 14:56:56 | Add ld.so linker script for mips64 Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. OK deraadt@ | |
 |
8fd2446c | 2022-11-14 13:21:50 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for powerpc64 and a modified version of the diff deraadt@ mailed out to make sure the LOADs are in increasing address order. this is the alpha version | |
|
b6feb2a9 | 2022-11-14 13:20:23 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for powerpc64 and a modified version of the diff deraadt@ mailed out to make sure the LOADs are in increasing address order. this is the i386 version | |
|
b3a51cd3 | 2022-11-14 13:13:19 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for powerpc64 and a modified version of the diff deraadt@ mailed out to make sure the LOADs are in increasing address order. this is the version for sparc64, tested by pascal also | |
|
e201c79b | 2022-11-14 13:12:59 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for powerpc64 and a modified version of the diff deraadt@ mailed out to make sure the LOADs are in increasing address order. this is the version for powerpc, tested by pascal | |
 |
9044b3fc | 2022-11-10 16:14:50 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for powerpc64 and a modified version of the diff deraadt@ mailed out to make sure the LOADs are in increasing address order. | |
|
82e9b32a | 2022-11-09 19:50:25 | Now that dlopen() sets object->nodelete for RTLD_NODELETE, _dl_load_dep_libs() can consider this same as the "booting" case, and instruct lower layers to do immutability. With this change in place, the not-yet-commited library-immutable diff leaves 1 page of libc (malloc related) and 6 non-RTLD_NODELETE libraries mutable in chrome. Everything else is immutable, except for the program's transient memory allocations & file mappings. This is an unexpected result. | |
|
b75fe819 | 2022-11-09 18:44:11 | dlopen() with RTLD_NODELETE should also set the object nodelete flag, so the mapping layer will know it can use mimmutable() | |
|
7f8a129b | 2022-11-09 18:39:35 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for 32-bit arm, tested by phessler | |
|
b8b81751 | 2022-11-08 13:47:22 | In the new scheme, the main executable object needs to be marked nodelete, so that _dl_relro() will immutable it's relro. | |
|
59d66fc3 | 2022-11-08 06:55:53 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. ok kettenis and guenther seemed to like it also This one is for riscv64, tested by jca | |
|
8e29f60a | 2022-11-08 06:47:31 | Instead of unmapping boot.text, and then a future allocation could land in the gap, mmap a fresh MAP_FIXED MAP_ANON PROT_NONE and make it immutable for good measure ok guenther kettenis | |
|
cd3e981d | 2022-11-07 21:12:57 | Missed an ALIGN (which I will admit I do not understand, this is voodoo) | |
|
a5c19628 | 2022-11-07 20:41:38 | Since the introduction of automatic immutable from the kernel, the munmap() of ld.so boot.text region is now (silently) failing because the region is contained within the text LOAD, which is immutable. So create a new btext LOAD with flags PF_X|PF_R|PF_OPENBSD_MUTABLE, and place all boot.text objects in there. This LOAD must also be page-aligned so it doesn't skip unmapping some of the object region, previously it was hilariously unaligned. Similar changes for other architectures coming after more testing. ok kettenis and guenther seemed to like it also | |
|
07cf23bb | 2022-11-07 10:35:26 | dtors were broken by trying to reuse DF_1_NODELETE to hint that this library would never unload, and could be immutable. Pass a seperate flag for our purposes Noticed from regress tests by anton, ok kettenis | |
|
d23cb5cd | 2022-11-06 12:00:20 | TEXTREL binaries are loaded without immutable on un-writeable sections. After text relocations are finished, these regions (in the binary) can become immutable. OPENBSD_MUTABLE section always overlaps writeable LOADs, so don't be afraid of that case, it's covered. | |
|
980da63b | 2022-11-06 11:43:19 | ld.so wants to make it's own RELRO immutable, which is obviously done right after it does mprotect PROT_READ. | |
|
118353ea | 2022-11-06 11:38:54 | Library RELRO sections are excluded from the immutable list, because ld.so tweaks them quite late. _dl_relro() is called when that work is done, and the final mprotect PROT_READ happens. Then we can make mark it immutable. ok kettenis | |
|
3349f56c | 2022-11-06 11:34:50 | When loading startup libraries, pass DF_1_NODELETE to indicate these are unloadable libraries. This allows us make consider making parts of those libraries immutable (in future commits) ok guenther kettenis | |
|
1916ec13 | 2022-11-05 18:48:31 | The /var/run/ld.so.hints file is mapped into memory. It is never replaced, so the mapping can be immutable. ok kettenis | |
|
baca2ca6 | 2022-11-05 18:44:09 | teach ld.so how to call the mimmutable() system call ok kettenis | |
|
c0929e80 | 2022-10-28 15:07:25 | Implement support for DT_MIPS_RLD_MAP_REL. ok deraadt@ | |
 |
71bb1f4c | 2022-09-05 20:09:24 | Do not perform out-of-bounds arrray accesses for bogus relocation type values. | |
|
3e492f6e | 2022-09-02 06:19:04 | Use a shorter system call invocation template for system calls in the range 0-127, where immediate addressing can be used to load the system call number in r0, rather than performing a memory load using pc-relative addressing. No functional change, but rm(1) runs a couple cycles faster per file now. | |
 |
07c7d596 | 2022-08-29 02:08:13 | use ansi volatile keyword, not __volatile__ ok miod@ guenther@ | |
 |
ab4d5173 | 2022-08-20 14:11:31 | Support RTLD_NOLOAD in ld.so. From guenther@. OK jca@ guenther@ | |
 |
8b7b35eb | 2022-06-14 09:56:07 | Document search order Explain when and how LD_LIBRARY_PATH, DT_RUNPATH and DT_RPATH are used. Input OK guenther | |
 |
42d2c245 | 2022-05-24 17:15:22 | Address the clang 13 "changed binding to STB_WEAK" warning on arm (32bit): * add _?ENTRY_NB to arm/asm.h * make sure ld.so's arm asm bits see the same includes as libc * switch libc's arm bits to the generic DEFS.h * switch arm ASM bits from ENTRY to ENTRY_NB as necessary ok kettenis@ miod@ | |
|
92d6eede | 2022-05-10 20:23:57 | Prevent out-of-bounds array access with binaries that use unsupported relocations. ok guenther@ | |
|
eabe4e05 | 2022-05-01 11:03:48 | Prevent out-of-bounds array access with binaries that use unsupported relocations. ok guenther@ | |
|
d11a561f | 2022-01-31 05:44:13 | Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" matches the others and it's hard to see how it will fail | |
|
fdacdf06 | 2022-01-31 05:43:22 | Inline RELOC_* into boot_md.c and simplify the code based on what we can verify at build time. Track dt_pltgot as an Elf_Addr instead of an Elf_Addr* to eliminat casts on both setting and using. Set RELATIVE_RELOC so the ld.so Makefile can verify that it has just the relocation types we expect. Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" Tested with full build. | |
|
c340fc50 | 2022-01-28 05:01:28 | Update comment: struct link_map is defined in <link_elf.h> noted by miod | |
|
be3edcf0 | 2022-01-18 21:59:29 | Avoid pulling sys/param.h, by using _ALIGN instead. sys/time.h now gets NBBY and howmany() also ok guenther | |
|
a175a520 | 2022-01-17 19:45:34 | Stop supporting a GOT with only one reserved entry in static PIE and ld.so itself: support for that in dynamic objects was removed in 2010. Inline RELOC_GOT() into boot_md.c and clean up the result like boot.c, snag just the three DT_MIPS_* tags needed, and delete the error case which is verified at build time. ok visa@ | |
|
b0714f38 | 2022-01-17 01:35:36 | Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" these are the ones I tested; kettenis@ was on board with the concept | |
|
b0a1b819 | 2022-01-16 02:17:05 | Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" ok jca@ | |
|
2a697c88 | 2022-01-16 02:16:40 | Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" ok kettenis@ | |
|
b3a968f5 | 2022-01-16 02:14:27 | Nothing depends on archdep.h pulling in other #includes anymore, so delete the #includes and hide the RELOC_* functions that are only used by lib/csu behind "#ifdef RCRT0" ok aoyama@ | |
|
1f204c7b | 2022-01-08 18:30:18 | archdep.h needed for _dl_dcbf, on powerpc | |
|
fa1e3a20 | 2022-01-08 17:28:49 | need "archdep.h" for _dl_md_plabel on hppa | |
|
b722ba42 | 2022-01-08 06:49:41 | Prep .c files for removing the #includes from */archdep.h * replace #include "archdep.h" with #includes of what is used, pulling in "syscall.h", "util.h", and "archdep.h" as needed * delete #include <sys/syscall.h> from syscall.h * only pull in <sys/stat.h> to the three files that use _dl_fstat(), forward declare struct stat in syscall.h for the others * NBBY is for <sys/select.h> macros; just use '8' in dl_printf.c * <machine/vmparam.h> is only needed on i386; conditionalize it * stop using __LDPGSZ: use _MAX_PAGE_SHIFT (already used by malloc.c) where necessary * delete other bogus #includes, order legit per style: <sys/*> then <*/*>, then <*>, then "*" dir.c improvement from jsg@ ok and testing assistance deraadt@ | |
|
7544b685 | 2021-12-30 08:39:19 | Sync from libc: Use _MAX_PAGE_SHIFT, rather than #ifdef mips64 ok otto@ | |
|
5a2b798a | 2021-12-30 04:48:13 | Delete dead (duplicate) test | |
|
1d60349d | 2021-12-23 18:50:31 | Roll the syscalls that have an off_t argument to remove the explicit padding. Switch libc and ld.so to the generic stubs for these calls. WARNING: reboot to updated kernel before installing libc or ld.so! Time for a story... When gcc (back in 1.x days) first implemented long long, it didn't (always) pass 64bit arguments in 'aligned' registers/stack slots, with the result that argument offsets didn't match structure offsets. This affected the nine system calls that pass off_t arguments: ftruncate lseek mmap mquery pread preadv pwrite pwritev truncate To avoid having to do custom ASM wrappers for those, BSD put an explicit pad argument in so that the off_t argument would always start on a even slot and thus be naturally aligned. Thus those odd wrappers in lib/libc/sys/ that use __syscall() and pass an extra '0' argument. The ABIs for different CPUs eventually settled how things should be passed on each and gcc 2.x followed them. The only arch now where it helps is landisk, which needs to skip the last argument register if it would be the first half of a 64bit argument. So: add new syscalls without the pad argument and on landisk do that skipping directly in the syscall handler in the kernel. Keep compat support for the existing syscalls long enough for the transition. ok deraadt@ | |
|
1dde9cbe | 2021-12-14 07:20:16 | A better approach is to defined __CONCAT locally | |
|
64890fb5 | 2021-12-14 02:17:39 | Sigh. This sys/cdefs.h is hiding use of __CONCAT in a non-C context. Needs some other repairs first. | |
|
e16a722a | 2021-12-13 18:28:39 | including sys/cdefs.h manually started as a result of netbsd trying to macro-build a replacement for sccsid, and was done without any concern for namespace damage. Unfortunately this practice started infecting other code as others were unaware they didn't need the file. ok millert guenther | |
|
1be08e70 | 2021-11-27 15:13:09 | Remove an unneeded variable to fix compiler warning with clang 13. OK jsg@ | |
|
246ef78e | 2021-11-14 22:07:38 | Delete all the no-op RELOC_GOT() macros and their uses. Annotate RELOC_DYN() on non-hppa as only used in lib/csu. Delete some inconsistent comments, adjust whitespace, and reorder mips64's archdep.h so that the ld.so/*/archdep.h files look (almost) the same. ok visa@ kettenis@ | |
|
b3331980 | 2021-11-12 22:28:13 | Add support for RELR relocations in the executable and share objects. This doesn't affect ld.so's self-reloc, which still requires DT_REL/DT_RELA ok kettenis@ | |
|
9e6d8a17 | 2021-11-09 21:22:29 | Like most archs, riscv doesn't need resolution of JUMP_SLOT relocations in static PIE binaries: delete RELOC_JMPREL and HAVE_JMPREL there. ok kettenis@ | |
|
b7041c07 | 2021-10-24 21:24:15 | For open/openat, if the flags parameter does not contain O_CREAT, the 3rd (variadic) mode_t parameter is irrelevant. Many developers in the past have passed mode_t (0, 044, 0644, or such), which might lead future people to copy this broken idiom, and perhaps even believe this parameter has some meaning or implication or application. Delete them all. This comes out of a conversation where tb@ noticed that a strange (but intentional) pledge behaviour is to always knock-out high-bits from mode_t on a number of system calls as a safety factor, and his bewilderment that this appeared to be happening against valid modes (at least visually), but no sorry, they are all irrelevant junk. They could all be 0xdeafbeef. ok millert | |
 |
052aa85f | 2021-10-07 14:47:32 | Print the name of the symbol that can't be resolved when using LD_DEBUG ok mpi, kn | |
|
6a3ad11d | 2021-06-26 14:50:25 | Make lazy binding work on riscv64. prompted by deraadt@ | |
|
c5bd6813 | 2021-06-26 14:47:54 | Build ld.so with --march=rv64imac on riscv64 to be absolutely sure that ld.so doesn't use the FP registers. ok deraadt@ | |
|
bde8342f | 2021-06-26 14:46:48 | Use AFLAGS when building syscall stubs. Drop AINC wich isn't used. ok deraadt@ | |
 |
296fbf9f | 2021-06-02 07:29:03 | add RTLD_NODELETE support if RTLD_NODELETE isn't POSIX, it is widely deployed: at least linux, freebsd, dragonfly, netbsd, solaris, illumos, apple, and fuchsia have it. ok kettenis@ on previous version with help from and ok guenther@ diff partially inspired from a diff from brad@ | |
|
f9a87ca6 | 2021-05-25 17:01:36 | program headers: do not rely on DYNAMIC coming before GNU_RELRO Except for some specific cases (thanks guenther) ELF mandates nothing but the file header be at a fixed location, hence ld.so(1) must not assume any specific order for headers, segments, etc. Looping over the program header table to parse segment headers, _dl_boot() creates the executable object upon DYNAMIC and expects it to be set upon GNU_RELRO, resulting in a NULL dereference iff that order is reversed. Store relocation bits in temporary variables and update the executable object once all segment headers are parsed to lift this dependency. Under __mips__ _dl_boot() later on uses the same temporary variable, so move nothing but the declaration out of MI code so as to not alter the MD code's logic/behaviour. Found while porting patchelf(1) from NixOS. OK guenther | |
 |
94ffa4e9 | 2021-05-16 16:00:50 | Correct problem in riscv64 dtors execution load the function pointer correctly and do not overwrite it in csu. allows most ld.so regressions to pass confirmed by jsg@, ok kettenis | |
|
6d91b5a8 | 2021-04-28 15:16:26 | riscv64 ld.so derived from arm64 go ahead deraadt@ | |
 |
52918795 | 2021-04-19 06:43:15 | Same internal consistency check as libc malloc: size in hash table should correspond to size of chunk meta data | |
 |
0458707b | 2021-03-16 18:03:06 | On i386 don't attempt to map shared libraries in low memory when a large executable's .text section crosses the 512MB exec line. Executables that have MAXTSIZ > 64MB can map above the default 512MB exec line. When this happens, shared libs that attempt to map into low memory will find their .data section can not be mapped. ld.so will attempt to remap the share lib at higher addresses until it can be mapped. For very large executables like chrome this process is very time consuming. This change detects how much of the executable's .text section exceeds 512MB and uses that as the initial hint for shared libs to map into which avoids attempting to map into blocked memory. okay deraadt@ | |
|
e8542567 | 2020-12-26 13:17:33 | Fix a nasty mem leak in ld.so's own malloc. This was hard to diagnose, since malloc dumping and gdb do not help at all when studying ld.so. In the end it turns out ot be a simple merge error causing extra mmap calls. ok miller@ tb@ | |
 |
15572fcf | 2020-11-28 19:49:30 | Add retguard to macppc kernel locore.S, ofwreal.S, setjmp.S This changes RETGUARD_SETUP(ffs) to RETGUARD_SETUP(ffs, %r11, %r12) and RETGUARD_CHECK(ffs) to RETGUARD_CHECK(ffs, %r11, %r12) to show that r11 and r12 are in use between setup and check, and to pick registers other than r11 and r12 in some kernel functions. ok mortimer@ deraadt@ | |
|
d2c5a474 | 2020-10-26 22:07:05 | Retguard asm macros for powerpc libc, ld.so Add retguard to some, but not all, asm functions in libc. Edit SYS.h in libc to remove the PREFIX macros and add SYSENTRY (more like aarch64 and powerpc64), so we can insert RETGUARD_SETUP after SYSENTRY. Some .S files in this commit don't get retguard, but do stop using the old prefix macros. Tested by deraadt@, who put this diff in a macppc snap. | |
|
ac44ab0d | 2020-10-16 23:42:53 | Use the retguard macros from asm.h to protect the system call stubs. ok mortimer kettenis | |
|
fa3953db | 2020-10-15 04:12:43 | make three mib[] arrays const, as was done in libc | |
 |
d3e0725e | 2020-08-11 23:32:06 | clang 10 now emits calls to __multi3 from libcompiler_rt Hints from kettenis@, ok kettenis@ deraadt@ | |
|
92e19e77 | 2020-07-18 16:41:43 | Use the same names as the 64-bit PowerPC ELF ABI for the relocations. | |
|
122a6b72 | 2020-07-16 21:26:18 | Rewrite loop to match what is written down in the ABI document. ok drahn@ | |
|
af856e3a | 2020-07-16 21:18:09 | Make lazy binding work. Committing on behalf of drahn@ who is a bit busy. | |
|
89c7f3c9 | 2020-06-28 20:52:05 | Disable powerpc64 lazy binding, code was not for 64 bit ABI DT_PPC_GOT is not used on powerpc64, delete. | |
|
61dad853 | 2020-06-28 17:58:40 | Powerpc64 ld.so asm code needs to conform to Powerpc64 abi, not 32bit. ok kettenis@ | |
|
6a2e3db8 | 2020-06-25 04:00:58 | PowerPC64 ld.so code. Mostly ported, code runs far enough to start first symbol string lookup. build with -gdwarf-4 to remove asm warnings. Do not bother supporting 32 bit non-pic relocations in shared libraries. (however leave the code there for now) | |
|
c6bdb7a3 | 2020-05-08 11:04:50 | ld.so(1) also ignores LD_LIBRARY_PATH an friends for set-group-ID executables While here, use consistent casing and don't use .Ev for set-user-ID/set-group-ID. from Miod | |
|
b3f796b2 | 2020-05-08 10:57:50 | LD_DEBUG is ignored for set-user-ID and set-group-ID executables from Miod | |
 |
fa9f1946 | 2020-03-27 22:17:47 | Add missing space in stack smash handler error message. ok kettenis@, deraadt@ | |
|
f74a2b77 | 2020-03-13 09:31:24 | Anthony Steinhauser reports that 32-bit arm cpus have the same speculation problems as 64-bit models. To resolve the syscall speculation, as a first step "nop; nop" was added after all occurances of the syscall ("swi 0") instruction. Then the kernel was changed to jump over the 2 extra instructions. In this final step, those pair of nops are converted into the speculation-blocking sequence ("dsb nsh; isb"). Don't try to build through these multiple steps, use a snapshot instead. Packages matching the new ABI will be out in a while... ok kettenis | |
|
ded5ef52 | 2020-03-13 06:38:55 | Anthony Steinhauser reports that 32-bit arm cpus have the same speculation problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later. (a lonely swi 0 was hiding in __asm in this file) | |
|
f377c767 | 2020-03-11 12:53:19 | Anthony Steinhauser reports that 32-bit arm cpus have the same speculation problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later. ok kettenis | |
|
5ecc9681 | 2020-02-18 12:19:11 | Now that the kernel skips the two instructions immediately following a syscall, replace the double nop with a dsb nsh; isb; sequence which stops the CPU from speculating any further. This fix was suggested by Anthony Steinhauser. ok deraadt@ | |
|
0c401ffc | 2020-01-26 02:19:43 | Insert two nop instructions after each svc #0 instruction in userland. The will be replaced by a speculation barrier as soon as we teach the kernel to skip over these two instructions when returning from a system call. ok patrick@, deraadt@ | |
|
3d8e19a1 | 2019-12-17 17:16:32 | Eliminate failure returns from _dl_split_path(): if malloc fails just _dl_oom() Prompted by Qualys's leveraging malloc failure in _dl_split_path() to get stuff past. ok deraadt@ millert@ | |
|
4b65c70c | 2019-12-17 03:16:07 | Don't look up env variables until we know we'll trust them. Otherwise, just delete them without looking. ok millert@ | |
 |
eee3c75f | 2019-12-11 18:27:54 | ld.so may fail to remove the LD_LIBRARY_PATH environment variable for set-user-ID and set-group-ID executables in low memory conditions. Reported by Qualys | |
 |
f7d771ca | 2019-12-09 23:15:03 | When loading a library, mmap(2) may fail. Then everything gets unmapped and ld.so tries again with different random address layout. In this case, use the new libc executable address for msyscall(2), not one from the first try. Fixes sporadic bogus syscall on i386. OK deraadt@ | |
|
e5659a93 | 2019-12-09 22:15:15 | print addresses upon msyscall failure, for now | |
|
d9337de3 | 2019-12-07 22:57:47 | Disable ltrace for objects linked with -znow, as at least on amd64, linking that was deletes the lazy relocation trampoline which ltrace currently depends on problem reported by tb@ directional feedback kettenis@ ok mpi@ | |
|
93a664f2 | 2019-12-02 17:19:25 | It is not always clear what ld.so was backed up to ld.so.backup, and better that folk doing development in here use their own cp tooling. | |
|
488dc415 | 2019-11-30 23:06:02 | Sigh, fix i386 msyscall() case to permission the correct address range. | |
|
29ab13eb | 2019-11-29 19:30:56 | As additional paranoia, make a copy of system ld.so into obj/ld.so.backup We don't want to CLEANFILES this one. On occasion this comes in useful. | |
|
e5041725 | 2019-11-29 06:34:44 | Repurpose the "syscalls must be on a writeable page" mechanism to enforce a new policy: system calls must be in pre-registered regions. We have discussed more strict checks than this, but none satisfy the cost/benefit based upon our understanding of attack methods, anyways let's see what the next iteration looks like. This is intended to harden (translation: attackers must put extra effort into attacking) against a mixture of W^X failures and JIT bugs which allow syscall misinterpretation, especially in environments with polymorphic-instruction/variable-sized instructions. It fits in a bit with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash behaviour, particularily for remote problems. Less effective once on-host since someone the libraries can be read. For static-executables the kernel registers the main program's PIE-mapped exec section valid, as well as the randomly-placed sigtramp page. For dynamic executables ELF ld.so's exec segment is also labelled valid; ld.so then has enough information to register libc's exec section as valid via call-once msyscall(2) For dynamic binaries, we continue to to permit the main program exec segment because "go" (and potentially a few other applications) have embedded system calls in the main program. Hopefully at least go gets fixed soon. We declare the concept of embedded syscalls a bad idea for numerous reasons, as we notice the ecosystem has many of static-syscall-in-base-binary which are dynamically linked against libraries which in turn use libc, which contains another set of syscall stubs. We've been concerned about adding even one additional syscall entry point... but go's approach tends to double the entry-point attack surface. This was started at a nano-hackathon in Bob Beck's basement 2 weeks ago during a long discussion with mortimer trying to hide from the SSL scream-conversations, and finished in more comfortable circumstances next to a wood-stove at Elk Lakes cabin with UVM scream-conversations. ok guenther kettenis mortimer, lots of feedback from others conversations about go with jsing tb sthen | |
|
e8e9ef5b | 2019-11-28 16:57:17 | Unrevert: this change was unrelated | |
|
c8754c30 | 2019-11-28 16:54:29 | Revert yesterday's _dl_md_reloc() and _dl_md_reloc_got() changes: something's broken on at least i386. | |
|
98a91d89 | 2019-11-27 01:24:35 | Delete now obsolete comments | |
|
29c3eac4 | 2019-11-27 00:58:59 | unifdef: hppa does HAVE_JMPREL and does not have DT_PROCNUM | |
|
4411ad54 | 2019-11-27 00:11:49 | armv7 and aarch64 specify GLOB_DAT as having an addend, so treat it exactly like the ABS{32,64} relocation there. noted by and ok kettenis@ | |
|
0e51d825 | 2019-11-26 23:38:52 | Clean up _dl_md_reloc(): instead of having tables and piles of conditionals that handle a dozen relocation types for each, just have a nice little switch for the four specific relocations that actually occur. Besides being smaller and easier to understand, this fixes the COPY relocation handling to only do one symbol lookup, instead of looking up the symbol and then immediately looking it up again (with the correct flags to find the instance it needs). ok kettenis@ | |
|
51a0cd2b | 2019-11-26 02:50:11 | Make aarch64, amd64, arm, and i386 more like sparc64: move non-lazy relocation from _dl_md_reloc() to _dl_md_reloc_all_plt() which has the minimal code to do it. Also, avoid division on PLTRELSZ; just use it to offset to the end. ok kettenis@ |