1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
|
/* x86 CET initializers function.
Copyright (C) 2018 Free Software Foundation, Inc.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
#include <unistd.h>
#include <errno.h>
#include <libintl.h>
#include <ldsodefs.h>
#include <dl-cet.h>
#include <cet-tunables.h>
/* GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK
are defined in <elf.h>, which are only available for C sources.
X86_FEATURE_1_IBT and X86_FEATURE_1_SHSTK are defined in <sysdep.h>
which are available for both C and asm sources. They must match. */
#if GNU_PROPERTY_X86_FEATURE_1_IBT != X86_FEATURE_1_IBT
# error GNU_PROPERTY_X86_FEATURE_1_IBT != X86_FEATURE_1_IBT
#endif
#if GNU_PROPERTY_X86_FEATURE_1_SHSTK != X86_FEATURE_1_SHSTK
# error GNU_PROPERTY_X86_FEATURE_1_SHSTK != X86_FEATURE_1_SHSTK
#endif
static int
dl_cet_mark_legacy_region (struct link_map *l)
{
/* Mark PT_LOAD segments with PF_X in legacy code page bitmap. */
size_t i, phnum = l->l_phnum;
const ElfW(Phdr) *phdr = l->l_phdr;
#ifdef __x86_64__
typedef unsigned long long word_t;
#else
typedef unsigned long word_t;
#endif
unsigned int bits_to_set;
word_t mask_to_set;
#define BITS_PER_WORD (sizeof (word_t) * 8)
#define BITMAP_FIRST_WORD_MASK(start) \
(~((word_t) 0) << ((start) & (BITS_PER_WORD - 1)))
#define BITMAP_LAST_WORD_MASK(nbits) \
(~((word_t) 0) >> (-(nbits) & (BITS_PER_WORD - 1)))
word_t *bitmap = (word_t *) GL(dl_x86_legacy_bitmap)[0];
word_t bitmap_size = GL(dl_x86_legacy_bitmap)[1];
word_t *p;
size_t page_size = GLRO(dl_pagesize);
for (i = 0; i < phnum; i++)
if (phdr[i].p_type == PT_LOAD && (phdr[i].p_flags & PF_X))
{
/* One bit in legacy bitmap represents a page. */
ElfW(Addr) start = (phdr[i].p_vaddr + l->l_addr) / page_size;
ElfW(Addr) len = (phdr[i].p_memsz + page_size - 1) / page_size;
ElfW(Addr) end = start + len;
if ((end / 8) > bitmap_size)
return -EINVAL;
p = bitmap + (start / BITS_PER_WORD);
bits_to_set = BITS_PER_WORD - (start % BITS_PER_WORD);
mask_to_set = BITMAP_FIRST_WORD_MASK (start);
while (len >= bits_to_set)
{
*p |= mask_to_set;
len -= bits_to_set;
bits_to_set = BITS_PER_WORD;
mask_to_set = ~((word_t) 0);
p++;
}
if (len)
{
mask_to_set &= BITMAP_LAST_WORD_MASK (end);
*p |= mask_to_set;
}
}
return 0;
}
/* Check if object M is compatible with CET. */
static void
dl_cet_check (struct link_map *m, const char *program)
{
/* Check how IBT should be enabled. */
unsigned int enable_ibt_type
= GL(dl_x86_feature_1)[1] & ((1 << CET_MAX) - 1);
/* Check how SHSTK should be enabled. */
unsigned int enable_shstk_type
= ((GL(dl_x86_feature_1)[1] >> CET_MAX) & ((1 << CET_MAX) - 1));
/* No legacy object check if both IBT and SHSTK are always on. */
if (enable_ibt_type == CET_ALWAYS_ON
&& enable_shstk_type == CET_ALWAYS_ON)
return;
/* Check if IBT is enabled by kernel. */
bool ibt_enabled
= (GL(dl_x86_feature_1)[0] & GNU_PROPERTY_X86_FEATURE_1_IBT) != 0;
/* Check if SHSTK is enabled by kernel. */
bool shstk_enabled
= (GL(dl_x86_feature_1)[0] & GNU_PROPERTY_X86_FEATURE_1_SHSTK) != 0;
if (ibt_enabled || shstk_enabled)
{
struct link_map *l = NULL;
/* Check if IBT and SHSTK are enabled in object. */
bool enable_ibt = (ibt_enabled
&& enable_ibt_type != CET_ALWAYS_OFF);
bool enable_shstk = (shstk_enabled
&& enable_shstk_type != CET_ALWAYS_OFF);
if (program)
{
/* Enable IBT and SHSTK only if they are enabled in executable.
NB: IBT and SHSTK may be disabled by environment variable:
GLIBC_TUNABLES=glibc.tune.hwcaps=-IBT,-SHSTK
*/
enable_ibt &= (HAS_CPU_FEATURE (IBT)
&& (enable_ibt_type == CET_ALWAYS_ON
|| (m->l_cet & lc_ibt) != 0));
enable_shstk &= (HAS_CPU_FEATURE (SHSTK)
&& (enable_shstk_type == CET_ALWAYS_ON
|| (m->l_cet & lc_shstk) != 0));
}
/* ld.so is CET-enabled by kernel. But shared objects may not
support IBT nor SHSTK. */
if (enable_ibt || enable_shstk)
{
int res;
unsigned int i;
unsigned int first_legacy, last_legacy;
bool need_legacy_bitmap = false;
i = m->l_searchlist.r_nlist;
while (i-- > 0)
{
/* Check each shared object to see if IBT and SHSTK are
enabled. */
l = m->l_initfini[i];
if (l->l_init_called)
continue;
#ifdef SHARED
/* Skip CET check for ld.so since ld.so is CET-enabled.
CET will be disabled later if CET isn't enabled in
executable. */
if (l == &GL(dl_rtld_map)
|| l->l_real == &GL(dl_rtld_map)
|| (program && l == m))
continue;
#endif
if (enable_ibt
&& enable_ibt_type != CET_ALWAYS_ON
&& !(l->l_cet & lc_ibt))
{
/* Remember the first and last legacy objects. */
if (!need_legacy_bitmap)
last_legacy = i;
first_legacy = i;
need_legacy_bitmap = true;
}
/* SHSTK is enabled only if it is enabled in executable as
well as all shared objects. */
enable_shstk &= (enable_shstk_type == CET_ALWAYS_ON
|| (l->l_cet & lc_shstk) != 0);
}
if (need_legacy_bitmap)
{
if (GL(dl_x86_legacy_bitmap)[0])
{
/* Change legacy bitmap to writable. */
if (__mprotect ((void *) GL(dl_x86_legacy_bitmap)[0],
GL(dl_x86_legacy_bitmap)[1],
PROT_READ | PROT_WRITE) < 0)
{
mprotect_failure:
if (program)
_dl_fatal_printf ("%s: mprotect legacy bitmap failed\n",
l->l_name);
else
_dl_signal_error (EINVAL, l->l_name, "dlopen",
N_("mprotect legacy bitmap failed"));
}
}
else
{
/* Allocate legacy bitmap. */
int res = dl_cet_allocate_legacy_bitmap
(GL(dl_x86_legacy_bitmap));
if (res != 0)
{
if (program)
_dl_fatal_printf ("%s: legacy bitmap isn't available\n",
l->l_name);
else
_dl_signal_error (EINVAL, l->l_name, "dlopen",
N_("legacy bitmap isn't available"));
}
}
/* Put legacy shared objects in legacy bitmap. */
for (i = first_legacy; i <= last_legacy; i++)
{
l = m->l_initfini[i];
if (l->l_init_called || (l->l_cet & lc_ibt))
continue;
#ifdef SHARED
if (l == &GL(dl_rtld_map)
|| l->l_real == &GL(dl_rtld_map)
|| (program && l == m))
continue;
#endif
/* If IBT is enabled in executable and IBT isn't enabled
in this shard object, mark PT_LOAD segments with PF_X
in legacy code page bitmap. */
res = dl_cet_mark_legacy_region (l);
if (res != 0)
{
if (program)
_dl_fatal_printf ("%s: failed to mark legacy code region\n",
l->l_name);
else
_dl_signal_error (-res, l->l_name, "dlopen",
N_("failed to mark legacy code region"));
}
}
/* Change legacy bitmap to read-only. */
if (__mprotect ((void *) GL(dl_x86_legacy_bitmap)[0],
GL(dl_x86_legacy_bitmap)[1], PROT_READ) < 0)
goto mprotect_failure;
}
}
bool cet_feature_changed = false;
if (enable_ibt != ibt_enabled || enable_shstk != shstk_enabled)
{
if (!program
&& enable_shstk_type != CET_PERMISSIVE)
{
/* When SHSTK is enabled, we can't dlopening a shared
object without SHSTK. */
if (enable_shstk != shstk_enabled)
_dl_signal_error (EINVAL, l->l_name, "dlopen",
N_("shadow stack isn't enabled"));
return;
}
/* Disable IBT and/or SHSTK if they are enabled by kernel, but
disabled in executable or shared objects. */
unsigned int cet_feature = 0;
/* Disable IBT only during program startup. */
if (program && !enable_ibt)
cet_feature |= GNU_PROPERTY_X86_FEATURE_1_IBT;
if (!enable_shstk)
cet_feature |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
int res = dl_cet_disable_cet (cet_feature);
if (res != 0)
{
if (program)
_dl_fatal_printf ("%s: can't disable CET\n", program);
else
_dl_signal_error (-res, l->l_name, "dlopen",
N_("can't disable CET"));
}
/* Clear the disabled bits in dl_x86_feature_1. */
GL(dl_x86_feature_1)[0] &= ~cet_feature;
cet_feature_changed = true;
}
#ifdef SHARED
if (program
&& (!shstk_enabled
|| enable_shstk_type != CET_PERMISSIVE)
&& (ibt_enabled || shstk_enabled))
{
/* Lock CET if IBT or SHSTK is enabled in executable. Don't
lock CET if SHSTK is enabled permissively. */
int res = dl_cet_lock_cet ();
if (res != 0)
_dl_fatal_printf ("%s: can't lock CET\n", program);
cet_feature_changed = true;
}
#endif
if (cet_feature_changed)
{
unsigned int feature_1 = 0;
if (enable_ibt)
feature_1 |= GNU_PROPERTY_X86_FEATURE_1_IBT;
if (enable_shstk)
feature_1 |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
struct pthread *self = THREAD_SELF;
THREAD_SETMEM (self, header.feature_1, feature_1);
}
}
}
void
_dl_cet_open_check (struct link_map *l)
{
dl_cet_check (l, NULL);
}
#ifdef SHARED
# ifndef LINKAGE
# define LINKAGE
# endif
LINKAGE
void
_dl_cet_check (struct link_map *main_map, const char *program)
{
dl_cet_check (main_map, program);
}
#endif /* SHARED */
|
