|
Packit |
6c4009 |
/* x86 CET initializers function.
|
|
Packit |
6c4009 |
Copyright (C) 2018 Free Software Foundation, Inc.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is free software; you can redistribute it and/or
|
|
Packit |
6c4009 |
modify it under the terms of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License as published by the Free Software Foundation; either
|
|
Packit |
6c4009 |
version 2.1 of the License, or (at your option) any later version.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
The GNU C Library is distributed in the hope that it will be useful,
|
|
Packit |
6c4009 |
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
6c4009 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit |
6c4009 |
Lesser General Public License for more details.
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
You should have received a copy of the GNU Lesser General Public
|
|
Packit |
6c4009 |
License along with the GNU C Library; if not, see
|
|
Packit |
6c4009 |
<http://www.gnu.org/licenses/>. */
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#include <unistd.h>
|
|
Packit |
6c4009 |
#include <errno.h>
|
|
Packit |
6c4009 |
#include <libintl.h>
|
|
Packit |
6c4009 |
#include <ldsodefs.h>
|
|
Packit |
6c4009 |
#include <dl-cet.h>
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK
|
|
Packit |
6c4009 |
are defined in <elf.h>, which are only available for C sources.
|
|
Packit |
6c4009 |
X86_FEATURE_1_IBT and X86_FEATURE_1_SHSTK are defined in <sysdep.h>
|
|
Packit |
6c4009 |
which are available for both C and asm sources. They must match. */
|
|
Packit |
6c4009 |
#if GNU_PROPERTY_X86_FEATURE_1_IBT != X86_FEATURE_1_IBT
|
|
Packit |
6c4009 |
# error GNU_PROPERTY_X86_FEATURE_1_IBT != X86_FEATURE_1_IBT
|
|
Packit |
6c4009 |
#endif
|
|
Packit |
6c4009 |
#if GNU_PROPERTY_X86_FEATURE_1_SHSTK != X86_FEATURE_1_SHSTK
|
|
Packit |
6c4009 |
# error GNU_PROPERTY_X86_FEATURE_1_SHSTK != X86_FEATURE_1_SHSTK
|
|
Packit |
6c4009 |
#endif
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Check if object M is compatible with CET. */
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
static void
|
|
Packit |
6c4009 |
dl_cet_check (struct link_map *m, const char *program)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
/* Check how IBT should be enabled. */
|
|
Packit Service |
9a392c |
enum dl_x86_cet_control enable_ibt_type
|
|
Packit Service |
9a392c |
= GL(dl_x86_feature_control).ibt;
|
|
Packit |
6c4009 |
/* Check how SHSTK should be enabled. */
|
|
Packit Service |
9a392c |
enum dl_x86_cet_control enable_shstk_type
|
|
Packit Service |
9a392c |
= GL(dl_x86_feature_control).shstk;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* No legacy object check if both IBT and SHSTK are always on. */
|
|
Packit Service |
9a392c |
if (enable_ibt_type == cet_always_on
|
|
Packit Service |
9a392c |
&& enable_shstk_type == cet_always_on)
|
|
Packit |
6c4009 |
return;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Check if IBT is enabled by kernel. */
|
|
Packit |
6c4009 |
bool ibt_enabled
|
|
Packit Service |
9a392c |
= (GL(dl_x86_feature_1) & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0;
|
|
Packit |
6c4009 |
/* Check if SHSTK is enabled by kernel. */
|
|
Packit |
6c4009 |
bool shstk_enabled
|
|
Packit Service |
9a392c |
= (GL(dl_x86_feature_1) & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (ibt_enabled || shstk_enabled)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
struct link_map *l = NULL;
|
|
Packit Service |
42c491 |
unsigned int ibt_legacy = 0, shstk_legacy = 0;
|
|
Packit Service |
42c491 |
bool found_ibt_legacy = false, found_shstk_legacy = false;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Check if IBT and SHSTK are enabled in object. */
|
|
Packit |
6c4009 |
bool enable_ibt = (ibt_enabled
|
|
Packit Service |
9a392c |
&& enable_ibt_type != cet_always_off);
|
|
Packit |
6c4009 |
bool enable_shstk = (shstk_enabled
|
|
Packit Service |
9a392c |
&& enable_shstk_type != cet_always_off);
|
|
Packit |
6c4009 |
if (program)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
/* Enable IBT and SHSTK only if they are enabled in executable.
|
|
Packit |
6c4009 |
NB: IBT and SHSTK may be disabled by environment variable:
|
|
Packit |
6c4009 |
|
|
Packit Service |
9550b6 |
GLIBC_TUNABLES=glibc.cpu.hwcaps=-IBT,-SHSTK
|
|
Packit |
6c4009 |
*/
|
|
Packit |
6c4009 |
enable_ibt &= (HAS_CPU_FEATURE (IBT)
|
|
Packit Service |
9a392c |
&& (enable_ibt_type == cet_always_on
|
|
Packit |
6c4009 |
|| (m->l_cet & lc_ibt) != 0));
|
|
Packit |
6c4009 |
enable_shstk &= (HAS_CPU_FEATURE (SHSTK)
|
|
Packit Service |
9a392c |
&& (enable_shstk_type == cet_always_on
|
|
Packit |
6c4009 |
|| (m->l_cet & lc_shstk) != 0));
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* ld.so is CET-enabled by kernel. But shared objects may not
|
|
Packit |
6c4009 |
support IBT nor SHSTK. */
|
|
Packit |
6c4009 |
if (enable_ibt || enable_shstk)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
unsigned int i;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
i = m->l_searchlist.r_nlist;
|
|
Packit |
6c4009 |
while (i-- > 0)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
/* Check each shared object to see if IBT and SHSTK are
|
|
Packit |
6c4009 |
enabled. */
|
|
Packit |
6c4009 |
l = m->l_initfini[i];
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (l->l_init_called)
|
|
Packit |
6c4009 |
continue;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#ifdef SHARED
|
|
Packit |
6c4009 |
/* Skip CET check for ld.so since ld.so is CET-enabled.
|
|
Packit |
6c4009 |
CET will be disabled later if CET isn't enabled in
|
|
Packit |
6c4009 |
executable. */
|
|
Packit |
6c4009 |
if (l == &GL(dl_rtld_map)
|
|
Packit |
6c4009 |
|| l->l_real == &GL(dl_rtld_map)
|
|
Packit |
6c4009 |
|| (program && l == m))
|
|
Packit |
6c4009 |
continue;
|
|
Packit |
6c4009 |
#endif
|
|
Packit |
6c4009 |
|
|
Packit Service |
42c491 |
/* IBT is enabled only if it is enabled in executable as
|
|
Packit Service |
42c491 |
well as all shared objects. */
|
|
Packit Service |
9a392c |
enable_ibt &= (enable_ibt_type == cet_always_on
|
|
Packit Service |
42c491 |
|| (l->l_cet & lc_ibt) != 0);
|
|
Packit Service |
42c491 |
if (!found_ibt_legacy && enable_ibt != ibt_enabled)
|
|
Packit |
6c4009 |
{
|
|
Packit Service |
42c491 |
found_ibt_legacy = true;
|
|
Packit Service |
42c491 |
ibt_legacy = i;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* SHSTK is enabled only if it is enabled in executable as
|
|
Packit |
6c4009 |
well as all shared objects. */
|
|
Packit Service |
9a392c |
enable_shstk &= (enable_shstk_type == cet_always_on
|
|
Packit |
6c4009 |
|| (l->l_cet & lc_shstk) != 0);
|
|
Packit Service |
42c491 |
if (enable_shstk != shstk_enabled)
|
|
Packit Service |
6de65a |
{
|
|
Packit Service |
42c491 |
found_shstk_legacy = true;
|
|
Packit Service |
42c491 |
shstk_legacy = i;
|
|
Packit Service |
6de65a |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
bool cet_feature_changed = false;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (enable_ibt != ibt_enabled || enable_shstk != shstk_enabled)
|
|
Packit |
6c4009 |
{
|
|
Packit Service |
42c491 |
if (!program)
|
|
Packit |
6c4009 |
{
|
|
Packit Service |
9a392c |
if (enable_ibt_type != cet_permissive)
|
|
Packit Service |
42c491 |
{
|
|
Packit Service |
42c491 |
/* When IBT is enabled, we cannot dlopen a shared
|
|
Packit Service |
42c491 |
object without IBT. */
|
|
Packit Service |
42c491 |
if (found_ibt_legacy)
|
|
Packit Service |
42c491 |
_dl_signal_error (0,
|
|
Packit Service |
42c491 |
m->l_initfini[ibt_legacy]->l_name,
|
|
Packit Service |
42c491 |
"dlopen",
|
|
Packit Service |
42c491 |
N_("rebuild shared object with IBT support enabled"));
|
|
Packit Service |
42c491 |
}
|
|
Packit Service |
42c491 |
|
|
Packit Service |
9a392c |
if (enable_shstk_type != cet_permissive)
|
|
Packit Service |
42c491 |
{
|
|
Packit Service |
42c491 |
/* When SHSTK is enabled, we cannot dlopen a shared
|
|
Packit Service |
42c491 |
object without SHSTK. */
|
|
Packit Service |
42c491 |
if (found_shstk_legacy)
|
|
Packit Service |
42c491 |
_dl_signal_error (0,
|
|
Packit Service |
42c491 |
m->l_initfini[shstk_legacy]->l_name,
|
|
Packit Service |
42c491 |
"dlopen",
|
|
Packit Service |
42c491 |
N_("rebuild shared object with SHSTK support enabled"));
|
|
Packit Service |
42c491 |
}
|
|
Packit Service |
42c491 |
|
|
Packit Service |
9a392c |
if (enable_ibt_type != cet_permissive
|
|
Packit Service |
9a392c |
&& enable_shstk_type != cet_permissive)
|
|
Packit Service |
42c491 |
return;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Disable IBT and/or SHSTK if they are enabled by kernel, but
|
|
Packit |
6c4009 |
disabled in executable or shared objects. */
|
|
Packit |
6c4009 |
unsigned int cet_feature = 0;
|
|
Packit |
6c4009 |
|
|
Packit Service |
42c491 |
if (!enable_ibt)
|
|
Packit |
6c4009 |
cet_feature |= GNU_PROPERTY_X86_FEATURE_1_IBT;
|
|
Packit |
6c4009 |
if (!enable_shstk)
|
|
Packit |
6c4009 |
cet_feature |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
int res = dl_cet_disable_cet (cet_feature);
|
|
Packit |
6c4009 |
if (res != 0)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
if (program)
|
|
Packit |
6c4009 |
_dl_fatal_printf ("%s: can't disable CET\n", program);
|
|
Packit |
6c4009 |
else
|
|
Packit Service |
42c491 |
{
|
|
Packit Service |
42c491 |
if (found_ibt_legacy)
|
|
Packit Service |
42c491 |
l = m->l_initfini[ibt_legacy];
|
|
Packit Service |
42c491 |
else
|
|
Packit Service |
42c491 |
l = m->l_initfini[shstk_legacy];
|
|
Packit Service |
42c491 |
_dl_signal_error (-res, l->l_name, "dlopen",
|
|
Packit Service |
42c491 |
N_("can't disable CET"));
|
|
Packit Service |
42c491 |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
/* Clear the disabled bits in dl_x86_feature_1. */
|
|
Packit Service |
9a392c |
GL(dl_x86_feature_1) &= ~cet_feature;
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
cet_feature_changed = true;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#ifdef SHARED
|
|
Packit Service |
42c491 |
if (program && (ibt_enabled || shstk_enabled))
|
|
Packit |
6c4009 |
{
|
|
Packit Service |
42c491 |
if ((!ibt_enabled
|
|
Packit Service |
9a392c |
|| enable_ibt_type != cet_permissive)
|
|
Packit Service |
42c491 |
&& (!shstk_enabled
|
|
Packit Service |
9a392c |
|| enable_shstk_type != cet_permissive))
|
|
Packit Service |
42c491 |
{
|
|
Packit Service |
42c491 |
/* Lock CET if IBT or SHSTK is enabled in executable unless
|
|
Packit Service |
42c491 |
IBT or SHSTK is enabled permissively. */
|
|
Packit Service |
42c491 |
int res = dl_cet_lock_cet ();
|
|
Packit Service |
42c491 |
if (res != 0)
|
|
Packit Service |
42c491 |
_dl_fatal_printf ("%s: can't lock CET\n", program);
|
|
Packit Service |
42c491 |
}
|
|
Packit |
6c4009 |
|
|
Packit Service |
42c491 |
/* Set feature_1 if IBT or SHSTK is enabled in executable. */
|
|
Packit |
6c4009 |
cet_feature_changed = true;
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
#endif
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
if (cet_feature_changed)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
unsigned int feature_1 = 0;
|
|
Packit |
6c4009 |
if (enable_ibt)
|
|
Packit |
6c4009 |
feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT;
|
|
Packit |
6c4009 |
if (enable_shstk)
|
|
Packit |
6c4009 |
feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
|
|
Packit |
6c4009 |
struct pthread *self = THREAD_SELF;
|
|
Packit |
6c4009 |
THREAD_SETMEM (self, header.feature_1, feature_1);
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
void
|
|
Packit |
6c4009 |
_dl_cet_open_check (struct link_map *l)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
dl_cet_check (l, NULL);
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
#ifdef SHARED
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
# ifndef LINKAGE
|
|
Packit |
6c4009 |
# define LINKAGE
|
|
Packit |
6c4009 |
# endif
|
|
Packit |
6c4009 |
|
|
Packit |
6c4009 |
LINKAGE
|
|
Packit |
6c4009 |
void
|
|
Packit |
6c4009 |
_dl_cet_check (struct link_map *main_map, const char *program)
|
|
Packit |
6c4009 |
{
|
|
Packit |
6c4009 |
dl_cet_check (main_map, program);
|
|
Packit |
6c4009 |
}
|
|
Packit |
6c4009 |
#endif /* SHARED */
|