ldso: move the suid/secure check code closer to env/auxv processing

[musl] / src / ldso / dynlink.c

diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index d8f641a..57a5ba4 100644 (file)
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -14,6 +14,7 @@
 #include <elf.h>
 #include <setjmp.h>
 #include <pthread.h>
+#include <ctype.h>
 #include <dlfcn.h>
 
 #include "reloc.h"
@@ -59,7 +60,7 @@ static int runtime;
 static jmp_buf rtld_fail;
 static pthread_rwlock_t lock;
 
-#define AUX_CNT 15
+#define AUX_CNT 24
 #define DYN_CNT 34
 
 static void decode_vec(size_t *v, size_t *a, size_t cnt)
@@ -92,10 +93,12 @@ static Sym *lookup(const char *s, uint32_t h, Sym *syms, uint32_t *hashtab, char
 }
 
 #define OK_TYPES (1<<STT_NOTYPE | 1<<STT_OBJECT | 1<<STT_FUNC | 1<<STT_COMMON)
+#define OK_BINDS (1<<STB_GLOBAL | 1<<STB_WEAK)
 
 static void *find_sym(struct dso *dso, const char *s, int need_def)
 {
        uint32_t h = hash(s);
+       void *def = 0;
        if (h==0x6b366be && !strcmp(s, "dlopen")) rtld_used = 1;
        if (h==0x6b3afd && !strcmp(s, "dlsym")) rtld_used = 1;
        for (; dso; dso=dso->next) {
@@ -103,10 +106,14 @@ static void *find_sym(struct dso *dso, const char *s, int need_def)
                if (!dso->global) continue;
                sym = lookup(s, h, dso->syms, dso->hashtab, dso->strings);
                if (sym && (!need_def || sym->st_shndx) && sym->st_value
-                && (1<<(sym->st_info&0xf) & OK_TYPES))
-                       return dso->base + sym->st_value;
+                && (1<<(sym->st_info&0xf) & OK_TYPES)
+                && (1<<(sym->st_info>>4) & OK_BINDS)) {
+                       if (def && sym->st_info>>4 == STB_WEAK) continue;
+                       def = dso->base + sym->st_value;
+                       if (sym->st_info>>4 == STB_GLOBAL) break;
+               }
        }
-       return 0;
+       return def;
 }
 
 static void do_relocs(unsigned char *base, size_t *rel, size_t rel_size, size_t stride, Sym *syms, char *strings, struct dso *dso)
@@ -404,6 +411,20 @@ static void load_deps(struct dso *p)
        }
 }
 
+static void load_preload(char *s)
+{
+       int tmp;
+       char *z;
+       for (z=s; *z; s=z) {
+               for (   ; *s && isspace(*s); s++);
+               for (z=s; *z && !isspace(*z); z++);
+               tmp = *z;
+               *z = 0;
+               load_library(s);
+               *z = tmp;
+       }
+}
+
 static void make_global(struct dso *p)
 {
        for (; p; p=p->next) p->global = 1;
@@ -449,15 +470,25 @@ void *__dynlink(int argc, char **argv, size_t *got)
        struct dso *const lib = builtin_dsos+1;
        struct dso *const vdso = builtin_dsos+2;
        size_t vdso_base=0;
+       char *env_preload=0;
 
        /* Find aux vector just past environ[] */
        for (i=argc+1; argv[i]; i++)
                if (!memcmp(argv[i], "LD_LIBRARY_PATH=", 16))
                        env_path = argv[i]+16;
+               else if (!memcmp(argv[i], "LD_PRELOAD=", 11))
+                       env_preload = argv[i]+11;
        auxv = (void *)(argv+i+1);
 
        decode_vec(auxv, aux, AUX_CNT);
 
+       /* Only trust user/env if kernel says we're not suid/sgid */
+       if ((aux[0]&0x7800)!=0x7800 || aux[AT_UID]!=aux[AT_EUID]
+         || aux[AT_GID]!=aux[AT_EGID] || aux[AT_SECURE]) {
+               env_path = 0;
+               env_preload = 0;
+       }
+
        for (i=0; auxv[i]; i+=2) {
                if (auxv[i]==AT_SYSINFO_EHDR) {
                        vdso_base = auxv[i+1];
@@ -465,12 +496,6 @@ void *__dynlink(int argc, char **argv, size_t *got)
                }
        }
 
-       /* Only trust user/env if kernel says we're not suid/sgid */
-       if ((aux[0]&0x7800)!=0x7800 || aux[AT_UID]!=aux[AT_EUID]
-         || aux[AT_GID]!=aux[AT_EGID]) {
-               env_path = 0;
-       }
-
        /* Relocate ldso's DYNAMIC pointer and load vector */
        decode_vec((void *)(got[0] += aux[AT_BASE]), lib_dyn, DYN_CNT);
 
@@ -519,6 +544,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
                vdso->hashtab = (void *)(vdso->base + vdso_dyn[DT_HASH]);
                vdso->strings = (void *)(vdso->base + vdso_dyn[DT_STRTAB]);
                vdso->name = "linux-gate.so.1";
+               vdso->global = 1;
 
                vdso->prev = lib;
                lib->next = vdso;
@@ -540,6 +566,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
        head = tail = app;
        libc = lib;
        app->next = 0;
+       if (env_preload) load_preload(env_preload);
        load_deps(head);
 
        make_global(head);
@@ -611,11 +638,16 @@ end:
        return p;
 }
 
-static void *do_dlsym(struct dso *p, const char *s)
+static void *do_dlsym(struct dso *p, const char *s, void *ra)
 {
        size_t i;
        uint32_t h;
        Sym *sym;
+       if (p == RTLD_NEXT) {
+               for (p=head; p && (unsigned char *)ra-p->map>p->map_len; p=p->next);
+               if (!p) p=head;
+               p=p->next;
+       }
        if (p == head || p == RTLD_DEFAULT)
                return find_sym(head, s, 0);
        h = hash(s);
@@ -631,11 +663,11 @@ static void *do_dlsym(struct dso *p, const char *s)
        return 0;
 }
 
-void *dlsym(void *p, const char *s)
+void *__dlsym(void *p, const char *s, void *ra)
 {
        void *res;
        pthread_rwlock_rdlock(&lock);
-       res = do_dlsym(p, s);
+       res = do_dlsym(p, s, ra);
        pthread_rwlock_unlock(&lock);
        return res;
 }