Encoding page size in the ELF header

[Rich Felker]

On Mon, Sep 28, 2015 at 01:55:15PM +0200, Florian Weimer wrote:
> On 09/27/2015 07:41 PM, Rich Felker wrote:
> 
> > There are several clean solutions, like putting the data in its own
> > .so or allocating it at runtime with mmap rather than using static
> > storage. But these all may defeat the intended security benefits since
> > then you have to rely on a pointer to the data that's located
> > somewhere that may be writable. The safest is probably the
> > separate-.so approach with a pointer to it in const .data where it can
> > be protected by relro.
> 
> I'm not sure if that solves anything.  I don't think it's possible in
> general just to set the .data section of a DSO to PROT_READ because the
> implementation may have stored helper variables there which need
> updating.  What am I missing?  I think the DSO has the same issues as
> the main program.

The .data.relro section, where const data that can't be in .rodata
because it contains initialized pointers that require relocation goes,
is arranged by the linker to be in its own page(s) so it ldso will
mprotect it read-only at load time.

Rich