/* * Copyright (C) 2021 The Android Open Source Project * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #define SYSCALL_NO_TLS 1 #include #include #include #include #include #include #include #include #include #include #include #include #include #include "reloc.h" #include "syscall.h" typedef void EntryFunc(void); // arm64 doesn't have a constant page size and has to use the value from AT_PAGESZ. #ifndef PAGE_SIZE #define PAGE_SIZE g_page_size #endif #define PAGE_START(x) ((x) & (~(PAGE_SIZE-1))) #define PAGE_END(x) PAGE_START((x) + (PAGE_SIZE - 1)) #define START "_start" #include "crt_arch.h" int main(); weak void _init(); weak void _fini(); int __libc_start_main(int (*)(), int, char **, void (*)(), void(*)(), void(*)()); static ElfW(Phdr) replacement_phdr_table[64]; static char replacement_interp[PATH_MAX]; static bool g_debug = false; static const char* g_prog_name = NULL; static uintptr_t g_page_size = 0; static int g_errno = 0; __attribute__((visibility("hidden"))) extern ElfW(Dyn) _DYNAMIC[]; __attribute__((used)) static long ri_set_errno(unsigned long val) { if (val > -4096UL) { g_errno = -val; return -1; } return val; } #define ri_syscall(...) ri_set_errno(__syscall(__VA_ARGS__)) static ssize_t ri_write(int fd, const void* buf, size_t amt) { return ri_syscall(SYS_write, fd, buf, amt); } __attribute__((noreturn)) static void ri_exit(int status) { ri_syscall(SYS_exit, status); __builtin_unreachable(); } static int ri_open(const char* path, int flags, mode_t mode) { return ri_syscall(SYS_openat, AT_FDCWD, path, flags, mode); } static int ri_close(int fd) { return ri_syscall(SYS_close, fd); } static off_t ri_lseek(int fd, off_t offset, int whence) { return ri_syscall(SYS_lseek, fd, offset, whence); } static ssize_t ri_readlink(const char* path, char* buf, size_t size) { return ri_syscall(SYS_readlinkat, AT_FDCWD, path, buf, size); } static void* ri_mmap(void* addr, size_t length, int prot, int flags, int fd, off_t offset) { #ifdef SYS_mmap2 return (void*)ri_syscall(SYS_mmap2, addr, length, prot, flags, fd, offset/SYSCALL_MMAP2_UNIT); #else return (void*)ri_syscall(SYS_mmap, addr, length, prot, flags, fd, offset); #endif } static void* ri_munmap(void* addr, size_t length) { return (void*)ri_syscall(SYS_munmap, addr, length); } static int ri_mprotect(void* addr, size_t len, int prot) { return ri_syscall(SYS_mprotect, addr, len, prot); } static ssize_t ri_pread(int fd, void* buf, size_t size, off_t ofs) { return ri_syscall(SYS_pread, fd, buf, size, __SYSCALL_LL_PRW(ofs)); } static size_t ri_strlen(const char* src) { for (size_t len = 0;; ++len) { if (src[len] == '\0') return len; } } static char* ri_strcpy(char* dst, const char* src) { char* result = dst; while ((*dst = *src) != '\0') { ++dst; ++src; } return result; } static char* ri_strcat(char* dst, const char* src) { ri_strcpy(dst + ri_strlen(dst), src); return dst; } static void* ri_memset(void* dst, int val, size_t len) { for (size_t i = 0; i < len; ++i) { ((char*)dst)[i] = val; } return dst; } __attribute__ ((unused)) static void* ri_memcpy(void* dst, const void* src, size_t len) { for (size_t i = 0; i < len; ++i) { ((char*)dst)[i] = ((char*)src)[i]; } return dst; } static int ri_strncmp(const char* x, const char *y, size_t maxlen) { for (size_t i = 0;; ++i) { if (i == maxlen) return 0; int result = (unsigned char)x[i] - (unsigned char)y[i]; if (result != 0) return result; if (x[i] == '\0') return 0; } } static int ri_strcmp(const char* x, const char *y) { return ri_strncmp(x, y, SIZE_MAX); } static char* ri_strrchr(const char* str, int ch) { char* result = NULL; while (true) { if (*str == ch) result = (char*)str; if (*str == '\0') break; ++str; } return result; } static char* ri_strchr(const char* str, int ch) { while (*str) { if (*str == ch) return (char*)str; ++str; } return NULL; } static void ri_dirname(char* path) { char* last_slash = ri_strrchr(path, '/'); if (last_slash == NULL) { path[0] = '.'; // returns "." path[1] = '\0'; } else if (last_slash == path) { path[1] = '\0'; // returns "/" } else { *last_slash = '\0'; } } static void out_str_n(const char* str, size_t n) { ri_write(STDERR_FILENO, str, n); } static void out_str(const char* str) { out_str_n(str, ri_strlen(str)); } static char* ul_to_str(unsigned long i, char* out, unsigned char base) { char buf[65]; char* cur = &buf[65]; *--cur = '\0'; do { *--cur = "0123456789abcdef"[i % base]; i /= base; } while (i > 0); return ri_strcpy(out, cur); } static char* l_to_str(long i, char* out, unsigned char base) { if (i < 0) { *out = '-'; ul_to_str(-(unsigned long)i, out + 1, base); return out; } else { return ul_to_str(i, out, base); } } static const char* ri_strerror(int err) { switch (err) { case EPERM: return "Operation not permitted"; case ENOENT: return "No such file or directory"; case EIO: return "I/O error"; case ENXIO: return "No such device or address"; case EAGAIN: return "Try again"; case ENOMEM: return "Out of memory"; case EACCES: return "Permission denied"; case ENODEV: return "No such device"; case ENOTDIR: return "Not a directory"; case EINVAL: return "Invalid argument"; case ENFILE: return "File table overflow"; case EMFILE: return "Too many open files"; case ESPIPE: return "Illegal seek"; case ENAMETOOLONG: return "File name too long"; case ELOOP: return "Too many symbolic links encountered"; } static char buf[64]; ri_strcpy(buf, "Unknown error "); l_to_str(err, buf + ri_strlen(buf), 10); return buf; } static void outv(const char *fmt, va_list ap) { char buf[65]; while (true) { if (fmt[0] == '\0') break; #define NUM_FMT(num_fmt, type, func, base) \ if (!ri_strncmp(fmt, num_fmt, sizeof(num_fmt) - 1)) { \ out_str(func(va_arg(ap, type), buf, base)); \ fmt += sizeof(num_fmt) - 1; \ continue; \ } NUM_FMT("%d", int, l_to_str, 10); NUM_FMT("%ld", long, l_to_str, 10); NUM_FMT("%u", unsigned int, ul_to_str, 10); NUM_FMT("%lu", unsigned long, ul_to_str, 10); NUM_FMT("%zu", size_t, ul_to_str, 10); NUM_FMT("%x", unsigned int, ul_to_str, 16); NUM_FMT("%lx", unsigned long, ul_to_str, 16); NUM_FMT("%zx", size_t, ul_to_str, 16); #undef NUM_FMT if (!ri_strncmp(fmt, "%p", 2)) { out_str(ul_to_str((unsigned long)va_arg(ap, void*), buf, 16)); fmt += 2; } else if (!ri_strncmp(fmt, "%s", 2)) { const char* arg = va_arg(ap, const char*); out_str(arg ? arg : "(null)"); fmt += 2; } else if (!ri_strncmp(fmt, "%%", 2)) { out_str("%"); fmt += 2; } else if (fmt[0] == '%') { buf[0] = fmt[1]; buf[1] = '\0'; out_str("relinterp error: unrecognized output specifier: '%"); out_str(buf); out_str("'\n"); ri_exit(1); } else { size_t len = 0; while (fmt[len] != '\0' && fmt[len] != '%') ++len; out_str_n(fmt, len); fmt += len; } } } __attribute__((format(printf, 1, 2))) static void debug(const char* fmt, ...) { if (!g_debug) return; out_str("relinterp: "); va_list ap; va_start(ap, fmt); outv(fmt, ap); va_end(ap); out_str("\n"); } __attribute__((format(printf, 1, 2), noreturn)) static void fatal(const char* fmt, ...) { out_str("relinterp: "); if (g_prog_name) { out_str(g_prog_name); out_str(": "); } out_str("fatal error: "); va_list ap; va_start(ap, fmt); outv(fmt, ap); va_end(ap); out_str("\n"); ri_exit(1); } static void* optimizer_barrier(void* val) { __asm__ volatile ("nop" :: "r"(&val) : "memory"); return val; } typedef struct { unsigned long key; unsigned long value; } AuxEntry; typedef struct { int argc; char **argv; char **envp; size_t envp_count; AuxEntry* auxv; size_t auxv_count; } KernelArguments; static KernelArguments read_args(void* raw_args) { KernelArguments result; result.argc = *(long*)raw_args; result.argv = (char**)((void**)raw_args + 1); result.envp = result.argv + result.argc + 1; char** envp = result.envp; while (*envp != NULL) ++envp; result.envp_count = envp - result.envp; ++envp; result.auxv = (AuxEntry*)envp; size_t count = 0; while (result.auxv[count].key != 0) { ++count; } result.auxv_count = count; return result; } static void dump_auxv(const KernelArguments* args) { for (size_t i = 0; i < args->auxv_count; ++i) { const char* name = ""; switch (args->auxv[i].key) { case AT_BASE: name = " [AT_BASE]"; break; case AT_EGID: name = " [AT_EGID]"; break; case AT_ENTRY: name = " [AT_ENTRY]"; break; case AT_EUID: name = " [AT_EUID]"; break; case AT_GID: name = " [AT_GID]"; break; case AT_PAGESZ: name = " [AT_PAGESZ]"; break; case AT_PHDR: name = " [AT_PHDR]"; break; case AT_PHENT: name = " [AT_PHENT]"; break; case AT_PHNUM: name = " [AT_PHNUM]"; break; case AT_SECURE: name = " [AT_SECURE]"; break; case AT_SYSINFO: name = " [AT_SYSINFO]"; break; case AT_SYSINFO_EHDR: name = " [AT_SYSINFO_EHDR]"; break; case AT_UID: name = " [AT_UID]"; break; } debug(" %lu => 0x%lx%s", args->auxv[i].key, args->auxv[i].value, name); } } static unsigned long ri_getauxval(const KernelArguments* args, unsigned long kind, bool allow_missing) { for (size_t i = 0; i < args->auxv_count; ++i) { if (args->auxv[i].key == kind) return args->auxv[i].value; } if (!allow_missing) fatal("could not find aux vector entry %lu", kind); return 0; } static int elf_flags_to_prot(int flags) { int result = 0; if (flags & PF_R) result |= PROT_READ; if (flags & PF_W) result |= PROT_WRITE; if (flags & PF_X) result |= PROT_EXEC; return result; } typedef struct { int fd; char path[PATH_MAX]; } OpenedLoader; typedef struct { void* base_addr; EntryFunc* entry; } LoadedInterp; static LoadedInterp load_interp(const OpenedLoader *loader, ElfW(Ehdr)* hdr) { ElfW(Phdr)* phdr = (ElfW(Phdr)*)((char*)hdr + hdr->e_phoff); size_t phdr_count = hdr->e_phnum; size_t max_vaddr = 0; // Find the virtual address extent. for (size_t i = 0; i < phdr_count; ++i) { if (phdr[i].p_type == PT_LOAD) { max_vaddr = PAGE_END(MAX(max_vaddr, phdr[i].p_vaddr + phdr[i].p_memsz)); } } // Map an area to fit the loader. void* loader_vaddr = ri_mmap(NULL, max_vaddr, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (loader_vaddr == (void*)MAP_FAILED) { fatal("reservation mmap of 0x%zx bytes for %s failed: %s", max_vaddr, loader->path, ri_strerror(g_errno)); } // Map each PT_LOAD. for (size_t i = 0; i < phdr_count; ++i) { if (phdr[i].p_type == PT_LOAD) { size_t start = PAGE_START(phdr[i].p_vaddr); const size_t end = PAGE_END(phdr[i].p_vaddr + phdr[i].p_memsz); if (phdr[i].p_filesz > 0) { const size_t file_end = phdr[i].p_vaddr + phdr[i].p_filesz; void* tmp = ri_mmap((char*)loader_vaddr + start, file_end - start, elf_flags_to_prot(phdr[i].p_flags), MAP_PRIVATE | MAP_FIXED, loader->fd, PAGE_START(phdr[i].p_offset)); if (tmp == (void*)MAP_FAILED) { fatal("PT_LOAD mmap failed (%s segment #%zu): %s", loader->path, i, ri_strerror(g_errno)); } start = file_end; if (phdr[i].p_flags & PF_W) { // The bytes between p_filesz and PAGE_END(p_filesz) currently come from the file mapping, // but they need to be zeroed. (Apparently this zeroing isn't necessary if the segment isn't // writable, and zeroing a non-writable page would be inconvenient.) ri_memset((char*)loader_vaddr + start, '\0', PAGE_END(start) - start); } start = PAGE_END(start); } if (start < end) { // The memory is already zeroed, because it comes from an anonymous file mapping. Just set // the protections correctly. int result = ri_mprotect((char*)loader_vaddr + start, end - start, elf_flags_to_prot(phdr[i].p_flags)); if (result != 0) { fatal("mprotect of PT_LOAD failed (%s segment #%zu): %s", loader->path, i, ri_strerror(g_errno)); } } } } return (LoadedInterp) { .base_addr = loader_vaddr, .entry = (EntryFunc*)((uintptr_t)loader_vaddr + hdr->e_entry), }; } typedef struct { ElfW(Phdr)* phdr; size_t phdr_count; uintptr_t load_bias; uintptr_t page_size; char* search_paths; ElfW(Ehdr)* ehdr; ElfW(Phdr)* first_load; bool secure; } ExeInfo; static ExeInfo get_exe_info(const KernelArguments* args) { ExeInfo result = { 0 }; result.phdr = (ElfW(Phdr)*)ri_getauxval(args, AT_PHDR, false); result.phdr_count = ri_getauxval(args, AT_PHNUM, false); result.page_size = ri_getauxval(args, AT_PAGESZ, false); unsigned long uid = ri_getauxval(args, AT_UID, false); unsigned long euid = ri_getauxval(args, AT_EUID, false); unsigned long gid = ri_getauxval(args, AT_GID, false); unsigned long egid = ri_getauxval(args, AT_EGID, false); unsigned long secure = ri_getauxval(args, AT_SECURE, true); result.secure = uid != euid || gid != egid || secure; debug("orig phdr = %p", (void*)result.phdr); debug("orig phnum = %zu", result.phdr_count); for (size_t i = 0; i < result.phdr_count; ++i) { if (result.phdr[i].p_type == PT_DYNAMIC) { result.load_bias = (uintptr_t)&_DYNAMIC - result.phdr[i].p_vaddr; } } debug("load_bias = 0x%lx", (unsigned long)result.load_bias); for (size_t i = 0; i < result.phdr_count; ++i) { ElfW(Phdr)* phdr = &result.phdr[i]; if (phdr->p_type != PT_LOAD) continue; result.first_load = phdr; if (phdr->p_offset != 0) { fatal("expected zero p_offset for first PT_LOAD, found 0x%zx instead", (size_t)phdr->p_offset); } result.ehdr = (ElfW(Ehdr)*)(phdr->p_vaddr + result.load_bias); break; } debug("ehdr = %p", (void*)result.ehdr); ElfW(Word) runpath_offset = -1; char* strtab = NULL; for (ElfW(Dyn)* dyn = _DYNAMIC; dyn->d_tag != DT_NULL; dyn++) { switch (dyn->d_tag) { case DT_RUNPATH: runpath_offset = dyn->d_un.d_val; break; case DT_RPATH: if (runpath_offset == -1) runpath_offset = dyn->d_un.d_val; break; case DT_STRTAB: strtab = (char*)(dyn->d_un.d_ptr + result.load_bias); break; } } if (strtab && runpath_offset != -1) { result.search_paths = strtab + runpath_offset; debug("dt_runpath = %s", result.search_paths); } return result; } // Loaders typically read the PT_INTERP of the executable, e.g. to set a pathname on the loader. // glibc insists on the executable having PT_INTERP, and aborts if it's missing. Musl passes it // to debuggers to find symbols for the loader, which includes all the libc symbols. // // Make a copy of the phdr table and insert PT_INTERP into the copy. // static void insert_pt_interp_into_phdr_table(const KernelArguments* args, const ExeInfo* exe, const char* loader_realpath) { // Reserve extra space for the inserted PT_PHDR and PT_INTERP segments and a null terminator. if (exe->phdr_count + 3 > sizeof(replacement_phdr_table) / sizeof(replacement_phdr_table[0])) { fatal("too many phdr table entries in executable"); } ElfW(Phdr) newPhdr = { .p_type = PT_PHDR, // The replacement phdr is in the BSS section, which has no file location. // Use 0 for the offset. If this causes a problem the replacement phdr could // be moved to the data section and the correct p_offset calculated. .p_offset = 0, .p_vaddr = (uintptr_t)&replacement_phdr_table - exe->load_bias, .p_paddr = (uintptr_t)&replacement_phdr_table - exe->load_bias, .p_memsz = (exe->phdr_count + 1) * sizeof(ElfW(Phdr)), .p_filesz = (exe->phdr_count + 1) * sizeof(ElfW(Phdr)), .p_flags = PF_R, .p_align = alignof(ElfW(Phdr)), }; ElfW(Phdr*) cur = replacement_phdr_table; if (exe->phdr[0].p_type != PT_PHDR) { // ld.bfd does not insert a PT_PHDR if there is no PT_INTERP, fake one. // It has to be first. We're adding an entry so increase memsz and filesz. newPhdr.p_memsz += sizeof(ElfW(Phdr)); newPhdr.p_filesz += sizeof(ElfW(Phdr)); *cur = newPhdr; ++cur; } for (size_t i = 0; i < exe->phdr_count; ++i) { switch (exe->phdr[i].p_type) { case 0: fatal("unexpected null phdr entry at index %zu", i); break; case PT_PHDR: *cur = newPhdr; break; default: *cur = exe->phdr[i]; } ++cur; } // Insert PT_INTERP at the end. cur->p_type = PT_INTERP; cur->p_offset = 0; cur->p_vaddr = (uintptr_t)&replacement_interp - exe->load_bias; cur->p_paddr = cur->p_vaddr; cur->p_filesz = ri_strlen(replacement_interp) + 1; cur->p_memsz = ri_strlen(replacement_interp) + 1; cur->p_flags = PF_R; cur->p_align = 1; ++cur; ri_strcpy(replacement_interp, loader_realpath); debug("new phdr = %p", (void*)&replacement_phdr_table); debug("new phnum = %zu", cur - replacement_phdr_table); // Update the aux vector with the new phdr+phnum. for (size_t i = 0; i < args->auxv_count; ++i) { if (args->auxv[i].key == AT_PHDR) { args->auxv[i].value = (unsigned long)&replacement_phdr_table; } else if (args->auxv[i].key == AT_PHNUM) { args->auxv[i].value = cur - replacement_phdr_table; } } // AT_PHDR and AT_PHNUM are now updated to point to the replacement program // headers, but the e_phoff and e_phnum in the ELF headers still point to the // original program headers. dynlink.c doesn't use e_phoff value from the // main application's program headers. The e_phoff and e_phnum values could // be updated, but that would require using mprotect to allow modifications // to the read-only first page. } static void realpath_fd(int fd, const char* orig_path, char* out, size_t len) { char path[64]; ri_strcpy(path, "/proc/self/fd/"); ul_to_str(fd, path + ri_strlen(path), 10); ssize_t result = ri_readlink(path, out, len); if (result == -1) fatal("could not get realpath of %s: %s", orig_path, ri_strerror(g_errno)); if ((size_t)result >= len) fatal("realpath of %s too long", orig_path); } static int open_loader(const ExeInfo* exe, const char* path, OpenedLoader* loader) { debug("trying to open '%s'", path); loader->fd = ri_open(path, O_RDONLY, 0); if (loader->fd < 0) { debug("could not open loader %s: %s", path, ri_strerror(g_errno)); return -1; } ElfW(Ehdr) hdr; ssize_t l = ri_pread(loader->fd, &hdr, sizeof(hdr), 0); if (l < 0) { debug("reading elf header from %s failed: %s", path, ri_strerror(g_errno)); return -1; } if (l != sizeof(hdr)) { debug("file %s too short to contain elf header", path); return -1; } if (hdr.e_ident[0] != ELFMAG0 || hdr.e_ident[1] != ELFMAG1 || hdr.e_ident[2] != ELFMAG2 || hdr.e_ident[3] != ELFMAG3) { debug("file %s is not an elf file", path); return -1; } if (hdr.e_machine != exe->ehdr->e_machine) { debug("incorrect elf machine for loader %s, expected %d got %d", path, exe->ehdr->e_machine, hdr.e_machine); return -1; } if (hdr.e_ident[EI_CLASS] != exe->ehdr->e_ident[EI_CLASS]) { debug("incorrect elf class for loader %s, expected %d got %d", path, exe->ehdr->e_ident[EI_CLASS], hdr.e_ident[EI_CLASS]); return -1; } realpath_fd(loader->fd, path, loader->path, sizeof(loader->path)); return 0; } static int open_rel_loader(const ExeInfo* exe, const char* dir, const char* rel, OpenedLoader* loader) { char buf[PATH_MAX]; size_t dir_len = ri_strlen(dir); if (dir_len + (dir_len == 0 ? 1 : 0) + ri_strlen(rel) + 2 > sizeof(buf)) { debug("path to loader exceeds PATH_MAX: %s/%s", dir, rel); return 1; } if (dir_len == 0) { ri_strcpy(buf, "."); } else { ri_strcpy(buf, dir); if (dir[dir_len-1] != '/') { ri_strcat(buf, "/"); } } ri_strcat(buf, rel); return open_loader(exe, buf, loader); } static void get_origin(char* buf, size_t buf_len) { ssize_t len = ri_readlink("/proc/self/exe", buf, buf_len); if (len <= 0 || (size_t)len >= buf_len) { fatal("could not readlink /proc/self/exe: %s", ri_strerror(g_errno)); } buf[len] = '\0'; ri_dirname(buf); } static int search_path_list_for_loader(const ExeInfo* exe, const char* loader_rel_path, const char* search_path, const char* search_path_name, bool expand_origin, OpenedLoader *loader) { char origin_buf[PATH_MAX]; char* origin = NULL; const char* p = search_path; while (p && p[0]) { const char* start = p; const char* end = ri_strchr(p, ':'); if (end == NULL) { end = start + ri_strlen(p); p = NULL; } else { p = end + 1; } size_t n = end - start; char search_path_entry[PATH_MAX]; if (n >= sizeof(search_path_entry)) { // Too long, skip. debug("%s entry too long: %s", search_path_name, start); continue; } ri_memcpy(search_path_entry, start, n); search_path_entry[n] = '\0'; char buf[PATH_MAX]; char* d = NULL; if (expand_origin) { d = ri_strchr(search_path_entry, '$'); } if (d && (!ri_strncmp(d, "$ORIGIN", 7) || !ri_strncmp(d, "${ORIGIN}", 9))) { if (!origin) { get_origin(origin_buf, sizeof(origin_buf)); origin = origin_buf; } size_t s = 7; if (d[1] == '{') { s += 2; } ri_memcpy(buf, search_path_entry, d - search_path_entry); buf[d - search_path_entry] = '\0'; if (ri_strlen(buf) + ri_strlen(origin) + ri_strlen(d+s) >= sizeof(buf)) { debug("path to loader %s%s%s too long", buf, origin, d+s); continue; } ri_strcat(buf, origin); ri_strcat(buf, d+s); } else { ri_strcpy(buf, search_path_entry); } debug("trying loader %s at %s", loader_rel_path, buf); if (!open_rel_loader(exe, buf, loader_rel_path, loader)) { debug("opened loader %s at %s", loader_rel_path, buf); return 0; } } return -1; } static int find_and_open_loader(const ExeInfo* exe, const char* ld_library_path, OpenedLoader* loader) { const char* loader_rel_path = LOADER_PATH; if (loader_rel_path[0] == '/') { return open_loader(exe, loader_rel_path, loader); } if (exe->secure) { fatal("relinterp not supported for secure executables"); } if (!search_path_list_for_loader(exe, loader_rel_path, ld_library_path, "LD_LIBRARY_PATH", false, loader)) { return 0; } if (!exe->search_paths || ri_strlen(exe->search_paths) == 0) { // If no DT_RUNPATH search relative to the exe. char origin[PATH_MAX]; get_origin(origin, sizeof(origin)); return open_rel_loader(exe, origin, loader_rel_path, loader); } if (!search_path_list_for_loader(exe, loader_rel_path, exe->search_paths, "rpath", true, loader)) { return 0; } fatal("unable to find loader %s in rpath %s", loader_rel_path, exe->search_paths); } // Use a trick to determine whether the executable has been relocated yet. This variable points to // a variable in libc. It will be NULL if and only if the program hasn't been linked yet. This // should accommodate these situations: // - The program was actually statically-linked instead. // - Either a PIE or non-PIE dynamic executable. // - Any situation where the loader calls the executable's _start: // - In normal operation, the kernel calls the executable's _start, _start jumps to the loader's // entry point, which jumps to _start again after linking it. // - The executable actually has its PT_INTERP set after all. // - The user runs the loader, passing it the path of the executable. // This C file must always be compiled as PIC, or else the linker will use a COPY relocation and // duplicate "environ" into the executable. static bool is_exe_relocated(void) { // Use the GOT to get the address of environ. extern char** environ; void* read_environ = optimizer_barrier(&environ); debug("read_environ = %p", read_environ); return read_environ != NULL; } void _start_c(long* raw_args) { const KernelArguments args = read_args(raw_args); const char* ld_library_path = NULL; for (size_t i = 0; i < args.envp_count; ++i) { if (!ri_strcmp(args.envp[i], "RELINTERP_DEBUG=1")) { g_debug = true; } if (!ri_strncmp(args.envp[i], "LD_LIBRARY_PATH=", 16)) { ld_library_path = args.envp[i] + 16; } } if (args.argc >= 1) { g_prog_name = args.argv[0]; } if (is_exe_relocated()) { debug("exe is already relocated, starting main executable"); int argc = raw_args[0]; char **argv = (void *)(raw_args+1); __libc_start_main(main, argc, argv, _init, _fini, 0); } debug("entering relinterp"); const ExeInfo exe = get_exe_info(&args); g_page_size = exe.page_size; OpenedLoader loader; if (find_and_open_loader(&exe, ld_library_path, &loader)) { fatal("failed to open loader"); } off_t len = ri_lseek(loader.fd, 0, SEEK_END); if (len == (off_t)-1) fatal("lseek on %s failed: %s", loader.path, ri_strerror(g_errno)); void* loader_data = ri_mmap(NULL, len, PROT_READ, MAP_PRIVATE, loader.fd, 0); if (loader_data == (void*)MAP_FAILED) { fatal("could not mmap %s: %s", loader.path, ri_strerror(g_errno)); } LoadedInterp interp = load_interp(&loader, (ElfW(Ehdr)*)loader_data); if (ri_munmap(loader_data, len) != 0) fatal("munmap failed: %s", ri_strerror(g_errno)); debug("original auxv:"); dump_auxv(&args); // Create a virtual phdr table that includes PT_INTERP, for the benefit of loaders that read the // executable PT_INTERP. insert_pt_interp_into_phdr_table(&args, &exe, loader.path); ri_close(loader.fd); // TODO: /proc/pid/auxv isn't updated with the new auxv vector. Is it possible to update it? // XXX: If we try to update it, we'd use prctl(PR_SET_MM, PR_SET_MM_AUXV, &vec, size, 0) // Maybe updating it would be useful as a way to communicate the loader's base to a debugger. // e.g. lldb uses AT_BASE in the aux vector, but it caches the values at process startup, so // it wouldn't currently notice a changed value. // The loader uses AT_BASE to locate itself, so search for the entry and update it. Even though // its value is always zero, the kernel still includes the entry[0]. If this changes (or we want // to make weaker assumptions about the kernel's behavior), then we can copy the kernel arguments // onto the stack (e.g. using alloca) before jumping to the loader's entry point. // [0] https://github.com/torvalds/linux/blob/v5.13/fs/binfmt_elf.c#L263 for (size_t i = 0; i < args.auxv_count; ++i) { if (args.auxv[i].key == AT_BASE) { args.auxv[i].value = (unsigned long)interp.base_addr; debug("new auxv:"); dump_auxv(&args); debug("transferring to real loader"); CRTJMP(interp.entry, raw_args); } } fatal("AT_BASE not found in aux vector"); } // Normally gdb and lldb look for a symbol named "_dl_debug_state" in the // interpreter to get notified when the dynamic loader has modified the // list of shared libraries. When using relinterp, the debugger is not // aware of the interpreter (PT_INTERP is unset and auxv AT_BASE is 0) so it // doesn't know where to look for the symbol. It falls back to looking in the // executable, so provide a symbol for it to find. The dynamic loader will // need to forward its calls to its own _dl_debug_state symbol to this one. // // This has to be defined in a .c file because lldb looks for a symbol with // DWARF language type DW_LANG_C. extern void _dl_debug_state() { }