From c1cb2deeca1a85c6fc5bd41b90816d48a95bc434 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sun, 5 Dec 2021 11:28:34 +0100 Subject: elf: execve statically linked programs instead of crashing [BZ #28648] Programs without dynamic dependencies and without a program interpreter are now run via execve. Previously, the dynamic linker either crashed while attempting to read a non-existing dynamic segment (looking for DT_AUDIT/DT_DEPAUDIT data), or the self-relocated in the static PIE executable crashed because the outer dynamic linker had already applied RELRO protection. is needed because execve is not available in the dynamic loader on Hurd. Reviewed-by: H.J. Lu --- elf/rtld.c | 50 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 42 insertions(+), 8 deletions(-) (limited to 'elf/rtld.c') diff --git a/elf/rtld.c b/elf/rtld.c index 847141e21d..6ce1e07dc0 100644 --- a/elf/rtld.c +++ b/elf/rtld.c @@ -50,6 +50,7 @@ #include #include #include +#include #include @@ -1106,6 +1107,45 @@ load_audit_modules (struct link_map *main_map, struct audit_list *audit_list) } } +/* Check if the executable is not actualy dynamically linked, and + invoke it directly in that case. */ +static void +rtld_chain_load (struct link_map *main_map, char *argv0) +{ + /* The dynamic loader run against itself. */ + const char *rtld_soname + = ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB]) + + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val); + if (main_map->l_info[DT_SONAME] != NULL + && strcmp (rtld_soname, + ((const char *) D_PTR (main_map, l_info[DT_STRTAB]) + + main_map->l_info[DT_SONAME]->d_un.d_val)) == 0) + _dl_fatal_printf ("%s: loader cannot load itself\n", rtld_soname); + + /* With DT_NEEDED dependencies, the executable is dynamically + linked. */ + if (__glibc_unlikely (main_map->l_info[DT_NEEDED] != NULL)) + return; + + /* If the executable has program interpreter, it is dynamically + linked. */ + for (size_t i = 0; i < main_map->l_phnum; ++i) + if (main_map->l_phdr[i].p_type == PT_INTERP) + return; + + const char *pathname = _dl_argv[0]; + if (argv0 != NULL) + _dl_argv[0] = argv0; + int errcode = __rtld_execve (pathname, _dl_argv, _environ); + const char *errname = strerrorname_np (errcode); + if (errname != NULL) + _dl_fatal_printf("%s: cannot execute %s: %s\n", + rtld_soname, pathname, errname); + else + _dl_fatal_printf("%s: cannot execute %s: %d\n", + rtld_soname, pathname, errno); +} + static void dl_main (const ElfW(Phdr) *phdr, ElfW(Word) phnum, @@ -1374,14 +1414,8 @@ dl_main (const ElfW(Phdr) *phdr, /* Now the map for the main executable is available. */ main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded; - if (__glibc_likely (state.mode == rtld_mode_normal) - && GL(dl_rtld_map).l_info[DT_SONAME] != NULL - && main_map->l_info[DT_SONAME] != NULL - && strcmp ((const char *) D_PTR (&GL(dl_rtld_map), l_info[DT_STRTAB]) - + GL(dl_rtld_map).l_info[DT_SONAME]->d_un.d_val, - (const char *) D_PTR (main_map, l_info[DT_STRTAB]) - + main_map->l_info[DT_SONAME]->d_un.d_val) == 0) - _dl_fatal_printf ("loader cannot load itself\n"); + if (__glibc_likely (state.mode == rtld_mode_normal)) + rtld_chain_load (main_map, argv0); phdr = main_map->l_phdr; phnum = main_map->l_phnum; -- cgit v1.2.3-70-g09d2