[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: RFC: Audit external function called indirectly via GOT
On Thu, Mar 22, 2018 at 1:59 AM, Florian Weimer <fw@deneb.enyo.de> wrote:
> * Carlos O'Donell:
>
>> On 03/21/2018 03:04 PM, Florian Weimer wrote:
>>> * H. J. Lu:
>>>
>>>>> Could we ship a template for the PLT entries in ld.so instead? And if
>>>>> needed, map it from the file together with an address array, like this?
>>>>
>>>> This won't work since linker needs to know exactly PLT layout to generate
>>>> JUMP_SLOT relocations for LD_AUDIT.
>>>
>>> Why would we need JUMP_SLOT relocations? Couldn't we install suitable
>>> interceptors for GLOB_DAT relocations instead, as long as they resolve
>>> to external function symbols?
>>
>> I think your suggestion might work, but why alter the existing
>> behaviour which users expect and is documented in countless linker
>> text books?
>
> If you have references, please add them to the glibc implementation or
> the wiki. It would certainly help those who are trying to work on the
> code.
>
> My understanding is that the whole thing is quite underdocumented.
> For LD_AUDIT in particular, we only have the Solaris documentation,
> and that's for an independent implementation.
>
>> Existing tooling to process such relocations and entries could
>> remain unchanged and we would continue to support LD_AUDIT.
>
> My understanding is that H.J.'s proposal requires changes when running
> in non-audit mode. It certainly requires relinking all binaries,
> perhaps even with special flags.
Please see
https://github.com/hjl-tools/glibc/tree/hjl/plt/audit
and
https://github.com/hjl-tools/binutils-gdb/tree/users/hjl/plt/audit
for my glibc and binutils implementations. My changes are relatively
small and have minimum overhead when LD_AUDIT isn't used.
> Using ld.so-generated thunks for all GLOB_DAT function symbol
> relocations would happen in audit mode only and should work with
> existing binaries which were built with -Wl,-z,now.
It means to put parts of ld into ld.so. This is a much bigger change.
--
H.J.