[PATCH] gold: Add -Bsymbolic-non-weak-functions

[Fangrui Song]

On Wed, Jun 2, 2021 at 9:28 PM Fangrui Song <i@maskray.me> wrote:
>
> :)

We can look at this from a different angle: security hardening.

@CarlosODonell: LD_PRELOAD/AUDIT give you concealment with no other
privileges. You have several options. Disable semantic interposition
in the way you build your binaries (see MaskRay's work). Disable
PRELOAD/AUDIT, which is what I'm going to pursue e.g. system-wide
glibc hardening tunable.

If LD_PRELOAD is disabled, it feels very natural that we should claim
the -Bsymbolic-non-weak-functions benefit.
Or look it differently: -Bsymbolic-non-weak-functions reduces the
attack surface of arbitrarily binding default visibility functions
elsewhere.

> On Wed, May 26, 2021 at 9:21 PM Fangrui Song <i@maskray.me> wrote:
> >
> >
> > On 2021-05-27, Alan Modra wrote:
> > >On Wed, May 26, 2021 at 04:22:46PM -0700, Fangrui Song wrote:
> > >> This will be a great addition to the ELF world. (My libLLVM.so
> > >> libclang-cpp.so linked clang is more than 15% faster due to saved
> > >> dynamic relocations)
> > >
> > >That is quite an impressive speedup, but couldn't you get exactly the
> > >same effect or better by giving functions protected visibility?
> >
> > The existing -fvisibility=protected is coarse-grained. There isn't an
> > option to exclude variables.
> >
> > Even if we introduce a -fvisibility-functions=protected, there is pointer
> > equality issue for C++.
> > https://maskray.me/blog/2021-05-16-elf-interposition-and-bsymbolic#pointer-equality-for-functions
> > The address of an inline function may be different from the address seen from
> > outside the shared object.
> >
> > (On x86, it is more unfortunate:
> > https://maskray.me/blog/2021-01-09-copy-relocations-canonical-plt-entries-and-protected#protected-function-symbols-and-canonical-plt-entries )
> >
> >
> > -Bsymbolic-non-weak-functions is safer.
> > We only one thing from compilers https://gcc.gnu.org/PR100593
> > [ELF] -fno-pic: Use GOT to take address of an external default visibility function
> >
> > For many distributions, -fno-pic is very uncommon. The canonical PLT entry problem can mostly be ignored.