[RFC] elf: Add elf checks for main executable

[H.J. Lu]

On Thu, Nov 18, 2021 at 12:08 PM H.J. Lu <hjl.tools@gmail.com> wrote:
>
> On Thu, Nov 18, 2021 at 12:01 PM Florian Weimer <fweimer@redhat.com> wrote:
> >
> > * H. J. Lu:
> >
> > >  On Thu, Nov 18, 2021 at 11:55 AM Adhemerval Zanella
> > > <adhemerval.zanella@linaro.org> wrote:
> > >>
> > >> The ELF header integrity check is only done on open_verify(), i.e,
> > >> for objects explicitly loaded.  For main executable (issued with
> > >> execve() for the binary) only kernel checks are done, which does
> > >> not check EI_ABIVERSION.
> > >
> > > I believe the EI_ABIVERSION check on the executable should be
> > > done in kernel, not in glibc, so that static PIE can be checked easily.
> >
> > There is no need to check statically linked binaries.  The kernel does
> > not do any relocation processing.  The link editor plus the rest of the
> > toolchain can make sure t hat the built-in relocator can process the
> > relocations in the program.
>
> You are right.   But if we want to change ld.so on all glibc branches
> to check EI_ABIVERSION, won't it be easier to implement something
> like DT_REQUIRED, DT_MANDATORY, DT_CRITICAL?
>

We can add GLIBC_PRIVATE_RELR when DT_RELR is added linking
against glibc:

Version needs section '.gnu.version_r' contains 1 entry:
 Addr: 0x0000000000400470  Offset: 0x000470  Link: 8 (.dynstr)
  000000: Version: 1  File: libc.so.6  Cnt: 2
  0x0010:   Name: GLIBC_PRIVATE_RELR  Flags: none  Version: 3
  0x0020:   Name: GLIBC_2.34  Flags: none  Version: 2

-- 
H.J.