Re: Read-only data in ELF libraries may be remapped writable at runtime (upcoming NDSS'17 paper)

[Mathias Payer <mathias dot payer at nebelwelt dot net>]

>>> The static linker necessarily sees a definition, otherwise it cannot
>>> produce a copy relocation because copy relocations must refer to
>>> objects of known size.
>>
>> Agreed. The static linker knows about the symbol and size but not the
>> permission. That information is discarded after compilation.
> 
> That's not quite true.  At least in the vtable case, the vtable is
> emitted in the .data.rel.ro section, and this information is definitely
> available to the static linker.

(If the linker validates the information from the referenced
library/object.)

> For your class A, the compiler emits the following vtable:
> 
>         .weak   _ZTV1A
>         .section        .data.rel.ro._ZTV1A,"awG",@progbits,_ZTV1A,comdat
>         .align 8
>         .type   _ZTV1A, @object
>         .size   _ZTV1A, 24
> _ZTV1A:
>         .quad   0
>         .quad   _ZTI1A
>         .quad   _ZN1A2a1Ev
> 
> And the static linker, when producing a DSO, puts that into the
> .data.rel.ro section.  (Otherwise, using -fPIC wouldn't server as a
> workaround.)


With format strings it may not work out as well. The original string is
in rodata. Let's assume the executable uses an "extern char str". The
string is then copy relocated to the BSS section in the executable.

---
  .file "test.c"
  .globl  str
  .section  .rodata
  .align 32
  .type str, @object
  .size str, 41
str:
  .string "We expect to print a decimal number: %d\n"
  .text
  .globl  externprint
  .type externprint, @function
externprint:
...
#  (call to printf)
---

When linking the main executable, the linker would have to check the
section information of the library and then infer the permissions of
that section to carry those over. Instead of copying the str into the
BSS section at runtime, the str would have to be allocated in a ro section.

Thanks,
Mathias

Attachment: signature.asc
Description: OpenPGP digital signature