[PATCH v2 0/5] Add support for memory sealing

[Adhemerval Zanella Netto]

On 31/07/24 17:48, Mike Hommey wrote:
> Thanks for the Cc.
> 
> On Wed, Jul 31, 2024 at 05:02:03PM -0300, Adhemerval Zanella wrote:
>> The final patch adds support for GNU_PROPERTY_NO_MEMORY_SEAL, where the
>> binary can be marked to avoid sealing (i.e., on Firefox hack to bypass the
>> dynamic loader and enable DT_RELR on older glibc [3]).  In this case, it is
>> up to the module to apply memory sealing itself.  I have a patch to
>> binutils to add -Wl,-z,no-memory-seal option to enable it.
> 
> Somehow I missed your message from the previous thread where you were
> talking about .note.gnu.property. It is rather inconvenient that this
> requires a patched or very new linker, and even more inconvenient that
> current linkers don't preserve .gnu.note.property from object files,
> so it can't even be added "manually" via current linkers.

The .note.gnu.property gives us more freedom to define the required, and
it is used on other configuration for security hardening that requires
loading action, like AArch64 BTI or Intel CET (as I noted [1]).

And the linker support was already raised by Florian on same thread [2].  
At least with newer binutils versions, the '.gnu.note.property' are merged
(but I will double checked if it were the case for GNU_PROPERTY_NO_MEMORY_SEAL
with my patch).

I am not sure how to accomplish all the requirements your are imposing for
a very specific hack without adding an ad-hoc solutions (like a
new ELF mark just for memory sealing disable) or some hacks to make it work
with old linker (specially when recent work is being moving toward to use 
.note.gnu.property for such support).

At least with GNU_PROPERTY_NO_MEMORY_SEAL, you can still mseal your binaries
if requires after you relocate it (you will need to handle the zero padding
as done in elf/dl-map-segments.h).  This is slight better than disable the
sealing altogether with the tunable, and I think it is not that troublesome
to require a linker update to accomplish it.

[1] https://sourceware.org/pipermail/libc-alpha/2024-June/157769.html
[2] https://sourceware.org/pipermail/libc-alpha/2024-June/157853.html