ldso: move the suid/secure check code closer to env/auxv processing

[musl] / src / ldso / dynlink.c

diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index 7a26e9e..57a5ba4 100644 (file)
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -14,6 +14,7 @@
 #include <elf.h>
 #include <setjmp.h>
 #include <pthread.h>
+#include <ctype.h>
 #include <dlfcn.h>
 
 #include "reloc.h"
@@ -59,7 +60,7 @@ static int runtime;
 static jmp_buf rtld_fail;
 static pthread_rwlock_t lock;
 
-#define AUX_CNT 15
+#define AUX_CNT 24
 #define DYN_CNT 34
 
 static void decode_vec(size_t *v, size_t *a, size_t cnt)
@@ -410,6 +411,20 @@ static void load_deps(struct dso *p)
        }
 }
 
+static void load_preload(char *s)
+{
+       int tmp;
+       char *z;
+       for (z=s; *z; s=z) {
+               for (   ; *s && isspace(*s); s++);
+               for (z=s; *z && !isspace(*z); z++);
+               tmp = *z;
+               *z = 0;
+               load_library(s);
+               *z = tmp;
+       }
+}
+
 static void make_global(struct dso *p)
 {
        for (; p; p=p->next) p->global = 1;
@@ -455,15 +470,25 @@ void *__dynlink(int argc, char **argv, size_t *got)
        struct dso *const lib = builtin_dsos+1;
        struct dso *const vdso = builtin_dsos+2;
        size_t vdso_base=0;
+       char *env_preload=0;
 
        /* Find aux vector just past environ[] */
        for (i=argc+1; argv[i]; i++)
                if (!memcmp(argv[i], "LD_LIBRARY_PATH=", 16))
                        env_path = argv[i]+16;
+               else if (!memcmp(argv[i], "LD_PRELOAD=", 11))
+                       env_preload = argv[i]+11;
        auxv = (void *)(argv+i+1);
 
        decode_vec(auxv, aux, AUX_CNT);
 
+       /* Only trust user/env if kernel says we're not suid/sgid */
+       if ((aux[0]&0x7800)!=0x7800 || aux[AT_UID]!=aux[AT_EUID]
+         || aux[AT_GID]!=aux[AT_EGID] || aux[AT_SECURE]) {
+               env_path = 0;
+               env_preload = 0;
+       }
+
        for (i=0; auxv[i]; i+=2) {
                if (auxv[i]==AT_SYSINFO_EHDR) {
                        vdso_base = auxv[i+1];
@@ -471,12 +496,6 @@ void *__dynlink(int argc, char **argv, size_t *got)
                }
        }
 
-       /* Only trust user/env if kernel says we're not suid/sgid */
-       if ((aux[0]&0x7800)!=0x7800 || aux[AT_UID]!=aux[AT_EUID]
-         || aux[AT_GID]!=aux[AT_EGID]) {
-               env_path = 0;
-       }
-
        /* Relocate ldso's DYNAMIC pointer and load vector */
        decode_vec((void *)(got[0] += aux[AT_BASE]), lib_dyn, DYN_CNT);
 
@@ -547,6 +566,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
        head = tail = app;
        libc = lib;
        app->next = 0;
+       if (env_preload) load_preload(env_preload);
        load_deps(head);
 
        make_global(head);
@@ -618,11 +638,16 @@ end:
        return p;
 }
 
-static void *do_dlsym(struct dso *p, const char *s)
+static void *do_dlsym(struct dso *p, const char *s, void *ra)
 {
        size_t i;
        uint32_t h;
        Sym *sym;
+       if (p == RTLD_NEXT) {
+               for (p=head; p && (unsigned char *)ra-p->map>p->map_len; p=p->next);
+               if (!p) p=head;
+               p=p->next;
+       }
        if (p == head || p == RTLD_DEFAULT)
                return find_sym(head, s, 0);
        h = hash(s);
@@ -638,11 +663,11 @@ static void *do_dlsym(struct dso *p, const char *s)
        return 0;
 }
 
-void *dlsym(void *p, const char *s)
+void *__dlsym(void *p, const char *s, void *ra)
 {
        void *res;
        pthread_rwlock_rdlock(&lock);
-       res = do_dlsym(p, s);
+       res = do_dlsym(p, s, ra);
        pthread_rwlock_unlock(&lock);
        return res;
 }