You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
255 lines
8.2 KiB
255 lines
8.2 KiB
2 years ago
|
commit 66e9d27a090874ab93030a908eb86fc29f856151
|
||
|
|
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
||
|
|
Date: Tue Jul 20 11:03:34 2021 -0300
|
||
|
|
|
||
|
|
elf: Add _dl_audit_activity_map and _dl_audit_activity_nsid
|
||
|
|
|
||
|
|
It consolidates the code required to call la_activity audit
|
||
|
|
callback.
|
||
|
|
|
||
|
|
Also for a new Lmid_t the namespace link_map list are empty, so it
|
||
|
|
requires to check if before using it. This can happen for when audit
|
||
|
|
module is used along with dlmopen.
|
||
|
|
|
||
|
|
Checked on x86_64-linux-gnu, i686-linux-gnu, and aarch64-linux-gnu.
|
||
|
|
|
||
|
|
Reviewed-by: Florian Weimer <fweimer@redhat.com>
|
||
|
|
(cherry picked from commit 3dac3959a5cb585b065cef2cb8a8d909c907e202)
|
||
|
|
|
||
|
|
diff --git a/elf/dl-audit.c b/elf/dl-audit.c
|
||
|
|
index 4066dfe85146b9d4..74b87f4b39be75e1 100644
|
||
|
|
--- a/elf/dl-audit.c
|
||
|
|
+++ b/elf/dl-audit.c
|
||
|
|
@@ -18,6 +18,32 @@
|
||
|
|
|
||
|
|
#include <ldsodefs.h>
|
||
|
|
|
||
|
|
+void
|
||
|
|
+_dl_audit_activity_map (struct link_map *l, int action)
|
||
|
|
+{
|
||
|
|
+ struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
+ for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
+ {
|
||
|
|
+ if (afct->activity != NULL)
|
||
|
|
+ afct->activity (&link_map_audit_state (l, cnt)->cookie, action);
|
||
|
|
+ afct = afct->next;
|
||
|
|
+ }
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
+void
|
||
|
|
+_dl_audit_activity_nsid (Lmid_t nsid, int action)
|
||
|
|
+{
|
||
|
|
+ /* If head is NULL, the namespace has become empty, and the audit interface
|
||
|
|
+ does not give us a way to signal LA_ACT_CONSISTENT for it because the
|
||
|
|
+ first loaded module is used to identify the namespace. */
|
||
|
|
+ struct link_map *head = GL(dl_ns)[nsid]._ns_loaded;
|
||
|
|
+ if (__glibc_likely (GLRO(dl_naudit) == 0)
|
||
|
|
+ || head == NULL || head->l_auditing)
|
||
|
|
+ return;
|
||
|
|
+
|
||
|
|
+ _dl_audit_activity_map (head, action);
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
void
|
||
|
|
_dl_audit_objopen (struct link_map *l, Lmid_t nsid)
|
||
|
|
{
|
||
|
|
diff --git a/elf/dl-close.c b/elf/dl-close.c
|
||
|
|
index f6fbf9de7d78555b..5a8cc9e7cb5186cc 100644
|
||
|
|
--- a/elf/dl-close.c
|
||
|
|
+++ b/elf/dl-close.c
|
||
|
|
@@ -472,25 +472,7 @@ _dl_close_worker (struct link_map *map, bool force)
|
||
|
|
|
||
|
|
#ifdef SHARED
|
||
|
|
/* Auditing checkpoint: we will start deleting objects. */
|
||
|
|
- if (__glibc_unlikely (do_audit))
|
||
|
|
- {
|
||
|
|
- struct link_map *head = ns->_ns_loaded;
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- /* Do not call the functions for any auditing object. */
|
||
|
|
- if (head->l_auditing == 0)
|
||
|
|
- {
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- {
|
||
|
|
- struct auditstate *state = link_map_audit_state (head, cnt);
|
||
|
|
- afct->activity (&state->cookie, LA_ACT_DELETE);
|
||
|
|
- }
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ _dl_audit_activity_nsid (nsid, LA_ACT_DELETE);
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* Notify the debugger we are about to remove some loaded objects. */
|
||
|
|
@@ -785,32 +767,9 @@ _dl_close_worker (struct link_map *map, bool force)
|
||
|
|
__rtld_lock_unlock_recursive (GL(dl_load_tls_lock));
|
||
|
|
|
||
|
|
#ifdef SHARED
|
||
|
|
- /* Auditing checkpoint: we have deleted all objects. */
|
||
|
|
- if (__glibc_unlikely (do_audit))
|
||
|
|
- {
|
||
|
|
- struct link_map *head = ns->_ns_loaded;
|
||
|
|
- /* If head is NULL, the namespace has become empty, and the
|
||
|
|
- audit interface does not give us a way to signal
|
||
|
|
- LA_ACT_CONSISTENT for it because the first loaded module is
|
||
|
|
- used to identify the namespace.
|
||
|
|
-
|
||
|
|
- Furthermore, do not notify auditors of the cleanup of a
|
||
|
|
- failed audit module loading attempt. */
|
||
|
|
- if (head != NULL && head->l_auditing == 0)
|
||
|
|
- {
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- {
|
||
|
|
- struct auditstate *state = link_map_audit_state (head, cnt);
|
||
|
|
- afct->activity (&state->cookie, LA_ACT_CONSISTENT);
|
||
|
|
- }
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ /* Auditing checkpoint: we have deleted all objects. Also, do not notify
|
||
|
|
+ auditors of the cleanup of a failed audit module loading attempt. */
|
||
|
|
+ _dl_audit_activity_nsid (nsid, LA_ACT_CONSISTENT);
|
||
|
|
#endif
|
||
|
|
|
||
|
|
if (__builtin_expect (ns->_ns_loaded == NULL, 0)
|
||
|
|
diff --git a/elf/dl-load.c b/elf/dl-load.c
|
||
|
|
index a2d73d025c65cd79..baf0a926053deaed 100644
|
||
|
|
--- a/elf/dl-load.c
|
||
|
|
+++ b/elf/dl-load.c
|
||
|
|
@@ -1482,24 +1482,8 @@ cannot enable executable stack as shared object requires");
|
||
|
|
/* Auditing checkpoint: we are going to add new objects. Since this
|
||
|
|
is called after _dl_add_to_namespace_list the namespace is guaranteed
|
||
|
|
to not be empty. */
|
||
|
|
- if ((mode & __RTLD_AUDIT) == 0
|
||
|
|
- && __glibc_unlikely (GLRO(dl_naudit) > 0))
|
||
|
|
- {
|
||
|
|
- struct link_map *head = GL(dl_ns)[nsid]._ns_loaded;
|
||
|
|
- /* Do not call the functions for any auditing object. */
|
||
|
|
- if (head->l_auditing == 0)
|
||
|
|
- {
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- afct->activity (&link_map_audit_state (head, cnt)->cookie,
|
||
|
|
- LA_ACT_ADD);
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ if ((mode & __RTLD_AUDIT) == 0)
|
||
|
|
+ _dl_audit_activity_nsid (nsid, LA_ACT_ADD);
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* Notify the debugger we have added some objects. We need to
|
||
|
|
diff --git a/elf/dl-open.c b/elf/dl-open.c
|
||
|
|
index bc68e2c376debd71..3f01aa480730da13 100644
|
||
|
|
--- a/elf/dl-open.c
|
||
|
|
+++ b/elf/dl-open.c
|
||
|
|
@@ -611,25 +611,7 @@ dl_open_worker_begin (void *a)
|
||
|
|
|
||
|
|
#ifdef SHARED
|
||
|
|
/* Auditing checkpoint: we have added all objects. */
|
||
|
|
- if (__glibc_unlikely (GLRO(dl_naudit) > 0))
|
||
|
|
- {
|
||
|
|
- struct link_map *head = GL(dl_ns)[new->l_ns]._ns_loaded;
|
||
|
|
- /* Do not call the functions for any auditing object. */
|
||
|
|
- if (head->l_auditing == 0)
|
||
|
|
- {
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- {
|
||
|
|
- struct auditstate *state = link_map_audit_state (head, cnt);
|
||
|
|
- afct->activity (&state->cookie, LA_ACT_CONSISTENT);
|
||
|
|
- }
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ _dl_audit_activity_nsid (new->l_ns, LA_ACT_CONSISTENT);
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* Notify the debugger all new objects are now ready to go. */
|
||
|
|
diff --git a/elf/rtld.c b/elf/rtld.c
|
||
|
|
index 45fec0df3043b90a..b6bb46ca97b7972f 100644
|
||
|
|
--- a/elf/rtld.c
|
||
|
|
+++ b/elf/rtld.c
|
||
|
|
@@ -1804,18 +1804,7 @@ dl_main (const ElfW(Phdr) *phdr,
|
||
|
|
|
||
|
|
/* Auditing checkpoint: we are ready to signal that the initial map
|
||
|
|
is being constructed. */
|
||
|
|
- if (__glibc_unlikely (GLRO(dl_naudit) > 0))
|
||
|
|
- {
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- afct->activity (&link_map_audit_state (main_map, cnt)->cookie,
|
||
|
|
- LA_ACT_ADD);
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ _dl_audit_activity_map (main_map, LA_ACT_ADD);
|
||
|
|
|
||
|
|
/* We have two ways to specify objects to preload: via environment
|
||
|
|
variable and via the file /etc/ld.so.preload. The latter can also
|
||
|
|
@@ -2496,23 +2485,7 @@ dl_main (const ElfW(Phdr) *phdr,
|
||
|
|
|
||
|
|
#ifdef SHARED
|
||
|
|
/* Auditing checkpoint: we have added all objects. */
|
||
|
|
- if (__glibc_unlikely (GLRO(dl_naudit) > 0))
|
||
|
|
- {
|
||
|
|
- struct link_map *head = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
|
||
|
|
- /* Do not call the functions for any auditing object. */
|
||
|
|
- if (head->l_auditing == 0)
|
||
|
|
- {
|
||
|
|
- struct audit_ifaces *afct = GLRO(dl_audit);
|
||
|
|
- for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
|
||
|
|
- {
|
||
|
|
- if (afct->activity != NULL)
|
||
|
|
- afct->activity (&link_map_audit_state (head, cnt)->cookie,
|
||
|
|
- LA_ACT_CONSISTENT);
|
||
|
|
-
|
||
|
|
- afct = afct->next;
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
- }
|
||
|
|
+ _dl_audit_activity_nsid (LM_ID_BASE, LA_ACT_CONSISTENT);
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* Notify the debugger all new objects are now ready to go. We must re-get
|
||
|
|
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
|
||
|
|
index 5709e4e48dff4355..7384abcf5e0e8e24 100644
|
||
|
|
--- a/sysdeps/generic/ldsodefs.h
|
||
|
|
+++ b/sysdeps/generic/ldsodefs.h
|
||
|
|
@@ -1373,6 +1373,16 @@ link_map_audit_state (struct link_map *l, size_t index)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
+/* Call the la_activity from the audit modules from the link map L and issues
|
||
|
|
+ the ACTION argument. */
|
||
|
|
+void _dl_audit_activity_map (struct link_map *l, int action)
|
||
|
|
+ attribute_hidden;
|
||
|
|
+
|
||
|
|
+/* Call the la_activity from the audit modules from the link map from the
|
||
|
|
+ namespace NSID and issues the ACTION argument. */
|
||
|
|
+void _dl_audit_activity_nsid (Lmid_t nsid, int action)
|
||
|
|
+ attribute_hidden;
|
||
|
|
+
|
||
|
|
/* Call the la_objopen from the audit modules for the link_map L on the
|
||
|
|
namespace identification NSID. */
|
||
|
|
void _dl_audit_objopen (struct link_map *l, Lmid_t nsid)
|