From cce7e0611784c644fc906b7ccab4c165b8ce046c Mon Sep 17 00:00:00 2001 From: kib Date: Mon, 30 Jan 2012 19:52:17 +0000 Subject: [PATCH 119/175] Add support for GNU RELRO. Submitted by: John Marino MFC after: 2 weeks git-svn-id: http://svn.freebsd.org/base/head@230784 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f (cherry picked from commit 52813bc5865793286207890c2b99ef25600d00b7) Signed-off-by: Xin Li --- libexec/rtld-elf/map_object.c | 12 ++++++++++++ libexec/rtld-elf/rtld.c | 13 +++++++++++++ libexec/rtld-elf/rtld.h | 3 +++ 3 files changed, 28 insertions(+) diff --git a/libexec/rtld-elf/map_object.c b/libexec/rtld-elf/map_object.c index aca1b2d..6a13692 100644 --- a/libexec/rtld-elf/map_object.c +++ b/libexec/rtld-elf/map_object.c @@ -84,6 +84,8 @@ map_object(int fd, const char *path, const struct stat *sb) Elf_Addr bss_vlimit; caddr_t bss_addr; Elf_Word stack_flags; + Elf_Addr relro_page; + size_t relro_size; hdr = get_elf_header(fd, path); if (hdr == NULL) @@ -100,6 +102,8 @@ map_object(int fd, const char *path, const struct stat *sb) nsegs = -1; phdyn = phinterp = phtls = NULL; phdr_vaddr = 0; + relro_page = 0; + relro_size = 0; segs = alloca(sizeof(segs[0]) * hdr->e_phnum); stack_flags = RTLD_DEFAULT_STACK_PF_EXEC | PF_R | PF_W; while (phdr < phlimit) { @@ -134,6 +138,11 @@ map_object(int fd, const char *path, const struct stat *sb) case PT_GNU_STACK: stack_flags = phdr->p_flags; break; + + case PT_GNU_RELRO: + relro_page = phdr->p_vaddr; + relro_size = phdr->p_memsz; + break; } ++phdr; @@ -269,6 +278,9 @@ map_object(int fd, const char *path, const struct stat *sb) obj->tlsinit = mapbase + phtls->p_vaddr; } obj->stack_flags = stack_flags; + obj->relro_page = obj->relocbase + trunc_page(relro_page); + obj->relro_size = round_page(relro_size); + return obj; } diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index c6eea1a..53e44d5 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -1114,6 +1114,11 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path) case PT_GNU_STACK: obj->stack_flags = ph->p_flags; break; + + case PT_GNU_RELRO: + obj->relro_page = obj->relocbase + trunc_page(ph->p_vaddr); + obj->relro_size = round_page(ph->p_memsz); + break; } } if (nsegs < 1) { @@ -2007,6 +2012,14 @@ relocate_objects(Obj_Entry *first, bool bind_now, Obj_Entry *rtldobj, if (reloc_jmpslots(obj, lockstate) == -1) return -1; + if (obj->relro_size > 0) { + if (mprotect(obj->relro_page, obj->relro_size, PROT_READ) == -1) { + _rtld_error("%s: Cannot enforce relro protection: %s", + obj->path, strerror(errno)); + return -1; + } + } + /* * Set up the magic number and version in the Obj_Entry. These * were checked in the crt1.o from the original ElfKit, so we diff --git a/libexec/rtld-elf/rtld.h b/libexec/rtld-elf/rtld.h index fd1ea26..ac5974e 100644 --- a/libexec/rtld-elf/rtld.h +++ b/libexec/rtld-elf/rtld.h @@ -168,6 +168,9 @@ typedef struct Struct_Obj_Entry { size_t tlsoffset; /* Offset of static TLS block for this module */ size_t tlsalign; /* Alignment of static TLS block */ + caddr_t relro_page; + size_t relro_size; + /* Items from the dynamic section. */ Elf_Addr *pltgot; /* PLT or GOT, depending on architecture */ const Elf_Rel *rel; /* Relocation entries */ -- 1.7.9.4