From: Carlos O'Donell <codonell@redhat.com>
To: Florian Weimer <fweimer@redhat.com>
Cc: libc-alpha@sourceware.org
Subject: Re: [PATCH] elf: Refuse to dlopen PIE objects [BZ #24323]
Date: Mon, 29 Apr 2019 17:36:18 -0400 [thread overview]
Message-ID: <5d7cf811-1ea3-5b5b-4e5a-f5f290655b47@redhat.com> (raw)
In-Reply-To: <87r29kbilj.fsf@oldenburg2.str.redhat.com>
On 4/29/19 5:35 PM, Florian Weimer wrote:
> * Carlos O'Donell:
>
>>> ifeq (yes,$(build-shared))
>>> # NB: Please keep cet-built-dso in sysdeps/x86/Makefile in sync with
>>> diff --git a/elf/dl-load.c b/elf/dl-load.c
>>> index 2bbef81b6e..9b0c1406c9 100644
>>> --- a/elf/dl-load.c
>>> +++ b/elf/dl-load.c
>>> @@ -1158,6 +1158,10 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd,
>>> goto call_lose;
>>> }
>>> + /* dlopen of an executable is not valid because it is not
>>> possible
>>> + to perform proper relocations and run the ELF constructors.
>>> + For PIE, the check needs the dynamic section, so there is
>>> + another check below. */
>>
>> Suggest you mention exactly which relocations are the problem.
>> I assume it's COPY relocs into the main executable which can't be
>> done twice, because both execs will want to reference their own
>> copy. Likewise the problem with ELF constructors should be expanded
>> with more details.
>
> I assume that static TLS is also negatively impacted. TLS variables
> from the dlopen'ed PIE binary and the real main program will probably
> overlap.
Absolutely. They will both use constant offsets from TP and that will
be directly encoded in the program code with no way to change it.
--
Cheers,
Carlos.
prev parent reply other threads:[~2019-04-29 21:36 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-12 13:02 [PATCH] elf: Refuse to dlopen PIE objects [BZ #24323] Florian Weimer
2019-04-15 13:00 ` Florian Weimer
2019-04-29 21:18 ` Carlos O'Donell
2019-04-29 21:35 ` Florian Weimer
2019-04-29 21:36 ` Carlos O'Donell [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/libc/involved.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5d7cf811-1ea3-5b5b-4e5a-f5f290655b47@redhat.com \
--to=codonell@redhat.com \
--cc=fweimer@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).