x86-64: Check if mprotect works before rewriting PLT

Systemd execution environment configuration may prohibit changing a memory
mapping to become executable:

MemoryDenyWriteExecute=
Takes a boolean argument. If set, attempts to create memory mappings
that are writable and executable at the same time, or to change existing
memory mappings to become executable, or mapping shared memory segments
as executable, are prohibited.

When it is set, systemd service stops working if PLT rewrite is enabled.
Check if mprotect works before rewriting PLT.  This fixes BZ #31230.
This also works with SELinux when deny_execmem is on.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/sysdeps/x86/cpu-features.c b/sysdeps/x86/cpu-features.c
index 46bdaffbc2..25e6622a79 100644
--- a/sysdeps/x86/cpu-features.c
+++ b/sysdeps/x86/cpu-features.c
@@ -28,10 +28,16 @@ extern void TUNABLE_CALLBACK (set_hwcaps) (tunable_val_t *)
   attribute_hidden;
 
 #if defined SHARED && defined __x86_64__
+# include <dl-plt-rewrite.h>
+
 static void
 TUNABLE_CALLBACK (set_plt_rewrite) (tunable_val_t *valp)
 {
-  if (valp->numval != 0)
+  /* We must be careful about where we put the call to
+     dl_plt_rewrite_supported() since it may generate
+     spurious SELinux log entries.  It should only be
+     attempted if the user requested a PLT rewrite.  */
+  if (valp->numval != 0 && dl_plt_rewrite_supported ())
     {
       /* Use JMPABS only on APX processors.  */
       const struct cpu_features *cpu_features = __get_cpu_features ();