From patchwork Wed Oct 16 17:01:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adhemerval Zanella Netto X-Patchwork-Id: 835816 Delivered-To: patch@linaro.org Received: by 2002:a5d:6804:0:b0:37d:45d0:187 with SMTP id w4csp543583wru; Wed, 16 Oct 2024 10:06:10 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCVBMcRW7bDoGbPypLZEcdx0pQ9hj4Er3UaMsJjGGmdF7aoERzNZs83JimdCYVIFhE+eJ1yX6w==@linaro.org X-Google-Smtp-Source: AGHT+IFfGdEDwQ5ue8+Avp3UgdC6fof5COnbiCgnOxAI3l4aEw1BqKMZi/JKKyRNvBqNq7HDDoag X-Received: by 2002:a05:6358:71cc:b0:1b8:3283:ec6e with SMTP id e5c5f4694b2df-1c3784fac02mr352670155d.24.1729098370232; Wed, 16 Oct 2024 10:06:10 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1729098370; cv=pass; d=google.com; s=arc-20240605; b=MTAUmhgZAfEsKO6xMr0hdk2ehcnqJDUIuBf50QeBvcKTVcBuMKUXaDts1bwJC8w0Wl 5tt6UJH9YSJAkTw3tG7DELtg7N2Ju26XD2JF+Qp9qoMxLcF95hpYKoVPvTfz9vDfUAPx 2S37Ywhl5LHHUtR4cdBsVKgI8tKf/nxZ3ChtmLwOg6RC2TQzHsprt4eRtBWUt9OQINWQ MOSJH0LVAXScORg3ZQ1ivpqwbhvHsURdWZXLm4T6obD8rMAfFXnDWxvgtqSZ4U8yM9k2 D/OwOCwYcL67uWtJ8I/U9+6gZG3pD/H6zkqHwXWNfmPQUU9JSGRShtId5P4Gq4Lv2Qvt LjxA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature:arc-filter:dmarc-filter:delivered-to; bh=dqspZiMgZ3JcIGEt6qQDkOO2tcSy7MIwNhz+45Azy7s=; fh=rjCpEwa0NAgCAfKxc1n8YCvYLFmdHeGXz6gk9UDhPEY=; b=YRyXqA8wHt2dsY0u8I8yfUtfzW3dr14qvoiYoNxKZDADJuUI8kZ2ZU22/xmPKk+fah 2FSrHEeRr/K+ikpOLFXdPB3PRw8n4w2jyLiYUsEOY9S/x1axnF+VUOLggcKIz8WqfQpn WQhNdqoCG4hxQS9f9GcmISd938K148YNLL5SB6uSHWrMpJK+hxQ+9XNYVNfqZEQ4yHOr 57Aj1eMc0j3oyqzxPx9goKzseSrA5XsknX/mm8sQSh/RrB1KlOm00trgd5RW2xWkh4sr 7WbgBcZuH/3RvTseQ8qTVC8+DjmZGuuzK8CgGgX7HxltDoZWB0bJeq4By2+yOQKP3ULF IKSw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=G+cduLIm; arc=pass (i=1); spf=pass (google.com: domain of binutils-bounces~patch=linaro.org@sourceware.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="binutils-bounces~patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from server2.sourceware.org (server2.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id 71dfb90a1353d-50d7aac9f10si991019e0c.54.2024.10.16.10.06.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Oct 2024 10:06:10 -0700 (PDT) Received-SPF: pass (google.com: domain of binutils-bounces~patch=linaro.org@sourceware.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=G+cduLIm; arc=pass (i=1); spf=pass (google.com: domain of binutils-bounces~patch=linaro.org@sourceware.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="binutils-bounces~patch=linaro.org@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id C5E7E3858429 for ; Wed, 16 Oct 2024 17:06:09 +0000 (GMT) X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) by sourceware.org (Postfix) with ESMTPS id 026C33858D37 for ; Wed, 16 Oct 2024 17:04:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 026C33858D37 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 026C33858D37 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::62a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1729098287; cv=none; b=LPHaYXAP455I2wn2Bx+sZYX35crxbxQlEXWI/VkcIICkZ/aNOPzLY4dxJ6oEOXreuy0+MHhcFcOgyLiBdKrz87QmPr9QrM6SY46HG3/CrKrjn8L9o7utPN40j/uQyNlH5lSvP9EOXgME3nQcOMvTtYyRphL3niQS/7gdj+50eSg= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1729098287; c=relaxed/simple; bh=jKHkVLpMKj1oljRuA8TdZBTForumlvbylEynShl7WKk=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=QnEe00O1bfBvKBuBFYOZbOr9UPLv74DKSk5l1mqcjg0n/9ZNmRaqd8crfSKYx5xpbUljj0fgZZYc7gQvKRYuJMauVf2pQuNWUiMi11qGoQ0u54sl6nsgGvjpFMAP0HDI1LoSiT7AXD8qzyTJSm1vdIqKjLFJJZbsubEPVOnOFmI= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pl1-x62a.google.com with SMTP id d9443c01a7336-20c8b557f91so273425ad.2 for ; Wed, 16 Oct 2024 10:04:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1729098282; x=1729703082; darn=sourceware.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=dqspZiMgZ3JcIGEt6qQDkOO2tcSy7MIwNhz+45Azy7s=; b=G+cduLImKom/YveE09aUuOaMUzlq9fCC5EPPTbAdJ3QsFBBlMDbC/GGqht06PruMNZ nDtqj/k8N4TuzVvbLKAlOWAwwB9Pc3o0xsmFoGo+WPAVzDVluFimpP2wW4xuVLp2gEwA XqI4GxjYehyEIgKrENrDOGJgpCDNrOzEUyVzGXZoV6crKCMn0to1lSIgf5fsRfoulCW7 KlMislIAe8C6nd/ugSKDUR4w10NWApdCJnIg7HaCMCC8a32hY2AydEUoMWQPxNLFrJ0k zlmhnbjApAhiFgKtrl3YtIieA+NDsIoghaOsxkFZpd7Ydy8kJJty7SP4PI/HZ/PECUiA hcuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729098282; x=1729703082; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=dqspZiMgZ3JcIGEt6qQDkOO2tcSy7MIwNhz+45Azy7s=; b=Dr6dm//YDLbSaR4I96pt1k0W0rRx3XthlBN25rcktbayNV4czpe3cNn9IC14BWg1G3 xh7g/L5j9/qPx+r3t/ocIV90LoZgJpZ0lZ7/89wW8Zlpnc7QW1YNMLg5XlYXMSfymEXJ /4MKIYrxwltjt7gbC5Gxq69kBhQv8YIX6BqDVHo69Tj+kbNXHByAVfU1zXia+2Hhrp3G JwFkRLoOyFbrgrc3qgSeVGyk5nclFDU2g/+LyiDEkwGmNygLbCdeuxFPA0fOA9CW27uy mO2JXR23zKbrIY9e28Mtl+8KibYN+4uQWJrpepgF+vg9IL4EZ4KWVKlJxqtyoub9k5t4 7dmQ== X-Gm-Message-State: AOJu0YyzCwuTQ7nhCvMT2RpKVjzmQd8k8IMQdp2zaWHk10lbmRdvhAPW ztPNcuCvVzINBnIjDM1ZI8Eo2B9/srPVUmygra3CSXfRwQ6XQtqpfNJcke//2H5Nm/9eQLn79i8 O X-Received: by 2002:a17:902:d4cc:b0:20b:9062:7b08 with SMTP id d9443c01a7336-20d27f27632mr63031035ad.45.1729098281556; Wed, 16 Oct 2024 10:04:41 -0700 (PDT) Received: from mandiga.. ([2804:1b3:a7c3:1434:ab87:e5f9:1b86:daf6]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-20d1805cdaesm30912895ad.281.2024.10.16.10.04.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Oct 2024 10:04:41 -0700 (PDT) From: Adhemerval Zanella To: binutils@sourceware.org Cc: Stephen Roettger , Jeff Xu , "H . J . Lu" Subject: [PATCH v3 1/3] elf: Add GNU_PROPERTY_MEMORY_SEAL gnu property Date: Wed, 16 Oct 2024 14:01:11 -0300 Message-ID: <20241016170435.1404114-2-adhemerval.zanella@linaro.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20241016170435.1404114-1-adhemerval.zanella@linaro.org> References: <20241016170435.1404114-1-adhemerval.zanella@linaro.org> MIME-Version: 1.0 X-Spam-Status: No, score=-12.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: binutils-bounces~patch=linaro.org@sourceware.org On a glibc recent proposal [1] to add Linux mseal support [2], Mike Hommey raised that this feature might potentially break Firefox on Linux. The issue is Firefox is built with DT_RELR support, and post-processed with a tool to both remove the GLIBC_ABI_DT_RELR dependency and instrument the binaries to apply the relocation themselves so they can deploy Firefox regardless if loader supports DT_RELR or not (some more details at [3]). To accomplish it, the instrumentation mimics the dynamic loader and temporarily undo the RELRO segment to be able to apply those relocations, and redo it afterward. This will break if mseal is applied as default. The GNU_PROPERTY_MEMORY_SEAL gnu property is a way to mark such objects to no be sealed by glibc. When linked with -Wl,-z,noseal (the default), glibc will not seal either the binary or the shared library. The new property is ignored if present on ET_REL objects, and only added on ET_EXEC/ET_DYN if the linker option is used. A gnu property is used instead of DT_FLAGS_1 flag to allow memory sealing to work with ET_EXEC without PT_DYNAMIC support (at least on glibc some ports still do no support static-pie). [1] https://sourceware.org/pipermail/libc-alpha/2024-June/157359.html [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8be7258aad44b5e25977a98db136f677fa6f4370 [3] https://sourceware.org/pipermail/libc-alpha/2024-June/157668.html [4] https://glandium.org/blog/?p=4297 --- bfd/elf-properties.c | 100 ++++++++++++++++++++------ bfd/elfxx-x86.c | 3 +- binutils/readelf.c | 6 ++ include/bfdlink.h | 3 + include/elf/common.h | 1 + ld/NEWS | 3 + ld/emultempl/elf.em | 4 ++ ld/ld.texi | 8 +++ ld/lexsup.c | 4 ++ ld/testsuite/ld-elf/property-seal-1.d | 16 +++++ ld/testsuite/ld-elf/property-seal-1.s | 11 +++ ld/testsuite/ld-elf/property-seal-2.d | 17 +++++ ld/testsuite/ld-elf/property-seal-3.d | 16 +++++ ld/testsuite/ld-elf/property-seal-4.d | 16 +++++ ld/testsuite/ld-elf/property-seal-5.d | 15 ++++ ld/testsuite/ld-elf/property-seal-6.d | 16 +++++ ld/testsuite/ld-elf/property-seal-7.d | 14 ++++ ld/testsuite/ld-elf/property-seal-8.d | 15 ++++ 18 files changed, 246 insertions(+), 22 deletions(-) create mode 100644 ld/testsuite/ld-elf/property-seal-1.d create mode 100644 ld/testsuite/ld-elf/property-seal-1.s create mode 100644 ld/testsuite/ld-elf/property-seal-2.d create mode 100644 ld/testsuite/ld-elf/property-seal-3.d create mode 100644 ld/testsuite/ld-elf/property-seal-4.d create mode 100644 ld/testsuite/ld-elf/property-seal-5.d create mode 100644 ld/testsuite/ld-elf/property-seal-6.d create mode 100644 ld/testsuite/ld-elf/property-seal-7.d create mode 100644 ld/testsuite/ld-elf/property-seal-8.d diff --git a/bfd/elf-properties.c b/bfd/elf-properties.c index ee8bd37f2bd..c6acdb60ba2 100644 --- a/bfd/elf-properties.c +++ b/bfd/elf-properties.c @@ -177,6 +177,20 @@ _bfd_elf_parse_gnu_properties (bfd *abfd, Elf_Internal_Note *note) prop->pr_kind = property_number; goto next; + case GNU_PROPERTY_MEMORY_SEAL: + if (datasz != 0) + { + _bfd_error_handler + (_("warning: %pB: corrupt memory sealing size: 0x%x"), + abfd, datasz); + /* Clear all properties. */ + elf_properties (abfd) = NULL; + return false; + } + prop = _bfd_elf_get_property (abfd, type, datasz); + prop->pr_kind = property_number; + goto next; + default: if ((type >= GNU_PROPERTY_UINT32_AND_LO && type <= GNU_PROPERTY_UINT32_AND_HI) @@ -258,6 +272,12 @@ elf_merge_gnu_properties (struct bfd_link_info *info, bfd *abfd, bfd *bbfd, be added to ABFD. */ return aprop == NULL; + case GNU_PROPERTY_MEMORY_SEAL: + /* Memory seal is controlled only by the linker. */ + if (aprop != NULL) + aprop->pr_kind = property_remove; + return true; + default: updated = false; if (pr_type >= GNU_PROPERTY_UINT32_OR_LO @@ -607,6 +627,33 @@ elf_write_gnu_properties (struct bfd_link_info *info, } } +static asection * +_bfd_elf_link_create_gnu_property_sec (struct bfd_link_info *info, bfd *elf_bfd, + unsigned int elfclass) +{ + asection *sec; + + sec = bfd_make_section_with_flags (elf_bfd, + NOTE_GNU_PROPERTY_SECTION_NAME, + (SEC_ALLOC + | SEC_LOAD + | SEC_IN_MEMORY + | SEC_READONLY + | SEC_HAS_CONTENTS + | SEC_DATA)); + if (sec == NULL) + info->callbacks->einfo (_("%F%P: failed to create GNU property section\n")); + + if (!bfd_set_section_alignment (sec, + elfclass == ELFCLASS64 ? 3 : 2)) + info->callbacks->einfo (_("%F%pA: failed to align section\n"), + sec); + + elf_section_type (sec) = SHT_NOTE; + return sec; +} + + /* Set up GNU properties. Return the first relocatable ELF input with GNU properties if found. Otherwise, return NULL. */ @@ -656,23 +703,7 @@ _bfd_elf_link_setup_gnu_properties (struct bfd_link_info *info) /* Support -z indirect-extern-access. */ if (first_pbfd == NULL) { - sec = bfd_make_section_with_flags (elf_bfd, - NOTE_GNU_PROPERTY_SECTION_NAME, - (SEC_ALLOC - | SEC_LOAD - | SEC_IN_MEMORY - | SEC_READONLY - | SEC_HAS_CONTENTS - | SEC_DATA)); - if (sec == NULL) - info->callbacks->einfo (_("%F%P: failed to create GNU property section\n")); - - if (!bfd_set_section_alignment (sec, - elfclass == ELFCLASS64 ? 3 : 2)) - info->callbacks->einfo (_("%F%pA: failed to align section\n"), - sec); - - elf_section_type (sec) = SHT_NOTE; + sec = _bfd_elf_link_create_gnu_property_sec (info, elf_bfd, elfclass); first_pbfd = elf_bfd; has_properties = true; } @@ -690,10 +721,6 @@ _bfd_elf_link_setup_gnu_properties (struct bfd_link_info *info) |= GNU_PROPERTY_1_NEEDED_INDIRECT_EXTERN_ACCESS; } - /* Do nothing if there is no .note.gnu.property section. */ - if (!has_properties) - return NULL; - /* Merge .note.gnu.property sections. */ info->callbacks->minfo (_("\n")); info->callbacks->minfo (_("Merging program properties\n")); @@ -737,6 +764,37 @@ _bfd_elf_link_setup_gnu_properties (struct bfd_link_info *info) } } + if (elf_bfd != NULL) + { + if (info->memory_seal) + { + /* Support -z no-memory-seal. */ + if (first_pbfd == NULL) + { + sec = _bfd_elf_link_create_gnu_property_sec (info, elf_bfd, elfclass); + first_pbfd = elf_bfd; + has_properties = true; + } + + p = _bfd_elf_get_property (first_pbfd, GNU_PROPERTY_MEMORY_SEAL, 0); + if (p->pr_kind == property_unknown) + { + /* Create GNU_PROPERTY_NO_MEMORY_SEAL. */ + p->u.number = GNU_PROPERTY_MEMORY_SEAL; + p->pr_kind = property_number; + } + else + p->u.number |= GNU_PROPERTY_MEMORY_SEAL; + } + else + elf_find_and_remove_property (&elf_properties (elf_bfd), + GNU_PROPERTY_MEMORY_SEAL, true); + } + + /* Do nothing if there is no .note.gnu.property section. */ + if (!has_properties) + return NULL; + /* Rewrite .note.gnu.property section so that GNU properties are always sorted by type even if input GNU properties aren't sorted. */ if (first_pbfd != NULL) diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c index dd951b91f50..8a4405c8a79 100644 --- a/bfd/elfxx-x86.c +++ b/bfd/elfxx-x86.c @@ -4815,7 +4815,8 @@ _bfd_x86_elf_link_fixup_gnu_properties for (p = *listp; p; p = p->next) { unsigned int type = p->property.pr_type; - if (type == GNU_PROPERTY_X86_COMPAT_ISA_1_USED + if (type == GNU_PROPERTY_MEMORY_SEAL + || type == GNU_PROPERTY_X86_COMPAT_ISA_1_USED || type == GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED || (type >= GNU_PROPERTY_X86_UINT32_AND_LO && type <= GNU_PROPERTY_X86_UINT32_AND_HI) diff --git a/binutils/readelf.c b/binutils/readelf.c index 0f8dc1b9716..bf25425bb8d 100644 --- a/binutils/readelf.c +++ b/binutils/readelf.c @@ -21464,6 +21464,12 @@ print_gnu_property_note (Filedata * filedata, Elf_Internal_Note * pnote) printf (_(" "), datasz); goto next; + case GNU_PROPERTY_MEMORY_SEAL: + printf ("memory seal "); + if (datasz) + printf (_(" "), datasz); + goto next; + default: if ((type >= GNU_PROPERTY_UINT32_AND_LO && type <= GNU_PROPERTY_UINT32_AND_HI) diff --git a/include/bfdlink.h b/include/bfdlink.h index f802ec627ef..8b9e391e6ff 100644 --- a/include/bfdlink.h +++ b/include/bfdlink.h @@ -429,6 +429,9 @@ struct bfd_link_info /* TRUE if only one read-only, non-code segment should be created. */ unsigned int one_rosegment: 1; + /* TRUE if GNU_PROPERTY_MEMORY_SEAL should be generated. */ + unsigned int memory_seal: 1; + /* Nonzero if .eh_frame_hdr section and PT_GNU_EH_FRAME ELF segment should be created. 1 for DWARF2 tables, 2 for compact tables. */ unsigned int eh_frame_hdr_type: 2; diff --git a/include/elf/common.h b/include/elf/common.h index c9920e7731a..8938e2f4754 100644 --- a/include/elf/common.h +++ b/include/elf/common.h @@ -890,6 +890,7 @@ /* Values used in GNU .note.gnu.property notes (NT_GNU_PROPERTY_TYPE_0). */ #define GNU_PROPERTY_STACK_SIZE 1 #define GNU_PROPERTY_NO_COPY_ON_PROTECTED 2 +#define GNU_PROPERTY_MEMORY_SEAL 3 /* A 4-byte unsigned integer property: A bit is set if it is set in all relocatable inputs. */ diff --git a/ld/NEWS b/ld/NEWS index 1f14dd6bc77..4a28592fa32 100644 --- a/ld/NEWS +++ b/ld/NEWS @@ -23,6 +23,9 @@ Changes in 2.43: * Add -plugin-save-temps to store plugin intermediate files permanently. +* Add -z memory-seal/-z nomemory-seal options to ELF linker to mark the + object to memory sealed. + Changes in 2.42: * Add -z mark-plt/-z nomark-plt options to x86-64 ELF linker to mark PLT diff --git a/ld/emultempl/elf.em b/ld/emultempl/elf.em index 2e865728587..ccd43531237 100644 --- a/ld/emultempl/elf.em +++ b/ld/emultempl/elf.em @@ -1075,6 +1075,10 @@ fragment <