[PATCH v6 03/20] elf: Add _dl_audit_activity_map and _dl_audit_activity_nsid

[Adhemerval Zanella]

On 10/12/2021 10:54, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>> diff --git a/elf/dl-close.c b/elf/dl-close.c
>> index 4f5cfcc1c3..79dbb41094 100644
>> --- a/elf/dl-close.c
>> +++ b/elf/dl-close.c
> 
>> +  /* Auditing checkpoint: we have deleted all objects.  If head is NULL, the
>> +     namespace has become empty, and the audit interface does not give us a
>> +     way to signal LA_ACT_CONSISTENT for it because the first loaded module
>> +     is used to identify the namespace.
>> +
>> +     Furthermore, do not notify auditors of the cleanup of a failed audit
>> +     module loading attempt.  */
>> +  _dl_audit_activity_nsid (nsid, LA_ACT_CONSISTENT);
>>  #endif
> 
> The comment is not really well-placed here.  I think it belongs to the
> head == NULL check in _dl_audit_activity_nsid.
> 

Ack.

>>  
>>    if (__builtin_expect (ns->_ns_loaded == NULL, 0)
>> diff --git a/elf/dl-load.c b/elf/dl-load.c
>> index 907ab8f5f7..848d3e08eb 100644
>> --- a/elf/dl-load.c
>> +++ b/elf/dl-load.c
>> @@ -1483,25 +1483,7 @@ cannot enable executable stack as shared object requires");
>>    if (r->r_state == RT_CONSISTENT)
>>      {
>>  #ifdef SHARED
>> -      /* Auditing checkpoint: we are going to add new objects.  */
>> -      if ((mode & __RTLD_AUDIT) == 0
>> -	  && __glibc_unlikely (GLRO(dl_naudit) > 0))
> 
> The mode & __RTLD_AUDIT check is not included in
> _dl_audit_activity_nsid.

Ack, I have reinstated it on _dl_map_object_from_fd.

> 
>> diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
>> index dec592bf53..ea481cbe84 100644
>> --- a/sysdeps/generic/ldsodefs.h
>> +++ b/sysdeps/generic/ldsodefs.h
>> @@ -1392,6 +1392,13 @@ link_map_audit_state (struct link_map *l, size_t index)
>>      }
>>  }
>>  
>> +/* Call the la_activity() from the audit modules from the link map L
>> +   and issues the ACTION argument.  */
>> +void _dl_audit_activity_map (struct link_map *l, int action)
>> +  attribute_hidden;
>> +/* Call the la_activity() from the audit modules from the link map
>> +   from the namespace NSSID and issues the ACTION argument.  */
>> +void _dl_audit_activity_nsid (Lmid_t nsid, int action);
> 
> (), typo: NS[S]ID.  Maybe we should have a general comment here that
> these notifications are skipped for auditing namespaces?

Ack.  Yeah I think mention auditing namespaces is worth here.

> 
> Thanks,
> Florian
>