Fwd: [PATCH v5 00/22] Some rtld-audit fixes

[Adhemerval Zanella]

On 19/11/2021 17:31, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>>> "" for the main executable is widely known.  Usually code uses it to
>>> implement a fallback on argv[0] or /proc/self/exe, though.
>>
>> There are still the issue where audit interface does not have direct
>> access to argv[0] from the audited process and '/proc' might also not
>> be accessible.  I am still not convinced that provided argv[0] for
>> l_name for main executable is worse than "", specially because the
>> fallback might not work.
> 
> I think it's better to give the auditor a chance to figure out whether
> they want to use program_invocation_name (if that's not available in the
> inner libc, that's for sure a bug we must fix), AT_EXECFN, or
> /proc/self/exe.  If we pick one of these for the auditor, we make it
> more difficult to make the appropriate choice.
> 
>>> Changing l_addr will break the libgcc unwinder.  It uses l_addr to
>>> relocate the program header (see the code I quoted previously).  Not
>>> everyone uses the platform unwinder, and the libgcc unwinder is
>>> sometimes linked statically.  This is different from the l_name change:
>>> The l_addr would definitely cause widespread breakage.
>>>
>>>>  - Every use case I can think of for obtaining a link_map from the dl*
>>>> functions (dlinfo and dladdr1) will either already have the special 
>>>> handling, or won't operate on the main executable, or likely won't opt
>>>> to use l_addr (vs. dlsym or dli_fbase) or l_name (vs. dli_fname).
>>>
>>> Some special-case the main executable based on l_name, I expect, which
>>> is why I'm so reluctant to change l_name.  The GDB comment is actually
>>> hinting strongly towards a "" convention (that Solaris broke).
>>
>> So I take that Solaris does provide the application name to l_name? And
>> what kind of breakage it has done on gdb?
> 
> Solaris seems to use the pathname argument to execve as l_name,
> via AT_SUN_EXECNAME.  I do not know if it is an absolute name.
> The documentation for getexecname suggests it may not be:
> 
> | Normally this is an absolute pathname, as the majority of commands are
> | executed by the shells that append the command name to the user's PATH
> | components. If this is not an absolute path, the output of getcwd(3C)
> | can be prepended to it to create an absolute path, unless the process
> | or one of its ancestors has changed its root directory or current
> | working directory since the last successful call to one of the exec
> | family of functions.
> 
> <https://docs.oracle.com/cd/E36784_01/html/E36874/getexecname-3c.html>
> 
> If that's accurate, it would be just like our AT_EXECFN.  I suspect this
> won't work for fexecve, so they are just going to fall back to argv[0]
> in that case.

I seems to return a relative path used for process execution:

azanella@gcc-solaris11:~$ uname -a
SunOS gcc-solaris11 5.11 11.3 sun4u sparc SUNW,SPARC-Enterprise
azanella@gcc-solaris11:~$ cat lname.c 
#include <link.h>
#include <dlfcn.h>
#include <stdio.h>
#include <assert.h>

int main (int argc, char *argv[])
{
  void *h = dlopen (NULL, RTLD_NOW);
  assert (h != NULL);
  struct link_map *l;
  assert (dlinfo (h, RTLD_DI_LINKMAP, &l) == 0);

  printf ("%s\n", l->l_name);

  return 0;
}
azanella@gcc-solaris11:~$ gcc -Wall lname.c -o lname
azanella@gcc-solaris11:~$ ./lname 
lname
azanella@gcc-solaris11:~$ /export/home/azanella/lname 
/export/home/azanella/lname

> 
> Still I think we have 20+ years of doing things our way (the BSD way),
> and I do worry about the backwards compatibility impact of such a
> change.
>