[lsb-bugs] [Bug 2402] appchk fails on binaries linked with relro option

bugzilla-daemon at linux-foundation.org bugzilla-daemon at linux-foundation.org
Wed May 13 01:28:25 PDT 2009


http://bugs.linuxbase.org/show_bug.cgi?id=2402


Denis Silakov <silakov at ispras.ru> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |silakov at ispras.ru




--- Comment #12 from Denis Silakov <silakov at ispras.ru>  2009-05-13 01:28:23 ---
The tricks with RELRO come from the mechanism of this 'read-only'
implementation:

"ld.so does not honor the p_flags either of the PT_LOAD or the PT_GNU_RELRO
when it applies PT_GNU_RELRO, it just mprotect's the area with PROT_READ.
<...> When PT_GNU_RELRO is applied, then the PF_X/PROT_EXEC required by the
PT_LOAD is no longer in force."

Thus, sections inside PT_GNU_RELRO still may have SHF_WRITE and SHF_EXECINSTR
attributes (and they do have, indeed); however, these flags may have no sense
since the memory itself is write-protected. (We haven't met problems with
SHF_EXECINSTR yet, since all sections mentioned in this bug don't have this
attribute; however, it seems that we should improve the patch a little to catch
the situations when sections with SHF_EXECINSTR are located inside
PT_GNU_RELRO).

When checking elf header, elfchk compares section flags with the segment's
ones. In case of PT_LOAD, the check is passed, but in case of PT_GNU_RELRO the
segment's permissions are formally more strict than the section's ones and this
leads to a failure. Memory protection is not taken into account.

So in general, the current description of PT_GNU_RELRO in LSB is definitely
correct, but can be enhanced with a note about section attributes been ignored.


As for possible intersection of .got.plt and PT_GNU_RELRO, I don't actually see
any requirements in System V ABI or LSB that would forbid this (a common
practice is to only say 'segment contains one or more sections'; fix me, if
I've missed something). The existence of such intersection just means that some
bytes of .got.plt will be read-only. For .got.plt, this doesn't seem to break
anything, but I wonder if in future it is possible to meet similar situations
with other sections and headers...


-- 
Configure bugmail: http://bugs.linuxbase.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.


More information about the lsb-bugs mailing list