Alternative libio vtable hardening approach

[Florian Weimer]

On 06/01/2016 07:08 PM, Kees Cook wrote:

> Right, totally agreed. I guess I'm not clear on the execution order of
> some of these things. How early in the process lifetime can glibc know
> that it must use the compat logic? Is it early enough that the dynamic
> linker can decide and write the result into what-will-be-read-only
> memory?

glibc knows it when it sees the symbol to the constructor function.  The 
function might still not be called, ever, but it is a very strong indicator.

Unfortunately, due to lazy binding, glibc won't learn this information 
during the initial link (unless BIND_NOW is used).

dlopen may also open a DSO which contain such a symbol, so the reference 
may not even be contained in the initial set of DSOs.  The reference to 
dlopen can also be lazily bound (or hidden behind a call to gethostbyname).

It's quite messy.  For most architectures, arguing against the need for 
backwards compatibility will be the better approach. :)

Florian