gold linker: rejected multiple definitions with the same absolute value

[Michael Orlitzky]

On 11/27/2017 10:31 AM, Cary Coutant wrote:
>> When compiling a hardened kernel[0] with CONFIG_PAX_RAP=y and using
>> ld.gold as my linker, I get the following error (among others similar):
>>
>>  ld: error: init/mounts.o: multiple definition of '__rap_hash_ret_panic'
>>  ld: init/main.o: previous definition here
>>  
>> But, as you can see, both symbols have equal absolute values. The BFD
>> linker lets that slide. Is the stricter approach the intended behavior
>> for ld.gold?
> 
> ...
> 
> Let me ask you this, though: when the error was pointed out, did you
> feel like it was a simple mistake, easily fixed, or do you think
> there's a rationale for having the definition in both files?

In this case I think the duplication is intentional. Those symbols are
from the RAP plugin,

  https://grsecurity.net/rap_faq.php

which is designed to prevent code-reuse attacks by (among other things)
checking that a function's signature matches at its definition and call
sites. It does that, somehow, by emitting those "__rap_hash" symbols.
Presumably the fact that their two values are equal is a good thing.


> I can see an argument for continuing to issue an error, or perhaps
> just a warning, rather than silently permit it.

Either would be fine. I generally hate making things less strict,
especially considering that this is a "clever abuse" rather than a
typical use case. But on the other hand, their technique is applicable
outside of the kernel, so it could be nice to have the plugin work with
ld.gold.

Personally I only use the patched kernel and I'm happy to switch linkers
for a few minutes.