[PATCH v7] elf: Add ELF_DYNAMIC_AFTER_RELOC to rewrite PLT

[H.J. Lu]

On Thu, Jan 11, 2024 at 5:35 AM Adhemerval Zanella Netto
<adhemerval.zanella@linaro.org> wrote:
>
>
>
> On 11/01/24 10:25, H.J. Lu wrote:
> >>>
> >>> I got PLT rewrite failure without SELinux:
> >>>
> >>> https://sourceware.org/bugzilla/show_bug.cgi?id=31230
> >>
> >> Add back the original mmap -> write -> mprotect check?
> >
> > I will try it.
> >
>
> Any idea of which security mechanism is preventing it? I recall that
> systemd has a mmap policy to avoid PROT_WRITE | PROT_EXEC (the
> MemoryDenyWriteExecute [1]) but it does not seems to be case
> of x86_64_rewrite_plt_in_place case.

MemoryDenyWriteExecute=
Takes a boolean argument. If set, attempts to create memory mappings
that are writable and executable at the same time, or to change
existing memory mappings to become executable, or mapping shared
memory segments as executable, are prohibited.

My /usr/lib/systemd/user/pipewire.service has

[Service]
LockPersonality=yes
MemoryDenyWriteExecute=yes

I will put back the mprotect check.

> And I am afraid that this strategy of PLT rewrite through mprotect
> PROT_WRITE -> PROT_EXEC will start to trigger a *lot* of security
> hardening; which would require either projects to disable it on
> x86_64, add some extra rules on specific projects, or just ignore
> it.

PLT rewrite is disabled by default.  This shouldn't be a big issue.

> [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html


-- 
H.J.