[PATCH 0/1] aarch64: Add LD_DEBUG=protect protection warnings

[Yury Khrustalev]

Introduce DL_DEBUG_PROTECT mask to enable messages related to loading
modules that lack certain target-dependent protection features.

Running a program with LD_DEBUG=protect will result in printing messages
about any missing target-specific protection features in shared libraries
being loaded by the dynamic loader or via dlopen(). When the corresponding
protection feature is enforced, these debug messages is of course limited
because in this case enforcement usually means early error. However, for
permissive policies where protection is desired but not enforced, this
additional message will help find the dependencies that do not provide
corresponding protection yet.

The caveats:

 1) The statically linked binaries will not be covered, however, for such
    a binary it is easy to check protection using readelf -n.
 2) In case of GCS, the implementation stops processing dependencies as
    soon as 1st incompatibility is found, so the GCS messages will only
    contain 1 incompatible dependency found 1st. We can fix this if it is
    required though.

The feedback is needed to understand if using LD_DEBUG for this purpose
is OK and also helpful for end users.

---

Passes regression on AArch64. OK for trunk?
Base commit: 866fa41ef8

---

Yury Khrustalev (1):
  aarch64: Add LD_DEBUG=protect to log BTI and GCS warnings

 elf/rtld.c                                    |  4 +-
 manual/dynlink.texi                           |  4 ++
 misc/tst-dl-debug-protect.sh                  | 48 +++++++++++++++++++
 sysdeps/aarch64/Makefile                      | 19 ++++++++
 sysdeps/aarch64/dl-bti.c                      | 10 +++-
 sysdeps/aarch64/dl-gcs.c                      |  3 ++
 .../aarch64/tst-bti-ld-debug-unprot-exe-dep.c |  3 ++
 .../aarch64/tst-bti-ld-debug-unprot-exe-one.c | 35 ++++++++++++++
 sysdeps/generic/ldsodefs.h                    |  1 +
 sysdeps/unix/sysv/linux/aarch64/Makefile      | 19 ++++++++
 .../aarch64/tst-gcs-ld-debug-unprot-exe-dep.c | 37 ++++++++++++++
 .../aarch64/tst-gcs-ld-debug-unprot-exe-one.c |  2 +
 12 files changed, 182 insertions(+), 3 deletions(-)
 create mode 100644 misc/tst-dl-debug-protect.sh
 create mode 100644 sysdeps/aarch64/tst-bti-ld-debug-unprot-exe-dep.c
 create mode 100644 sysdeps/aarch64/tst-bti-ld-debug-unprot-exe-one.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/tst-gcs-ld-debug-unprot-exe-dep.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/tst-gcs-ld-debug-unprot-exe-one.c

-- 
2.47.3