Files
glibc/csu/libc-start.c
T
Adhemerval Zanella 3923b80921 elf: Make string tunables startup-only
A string tunable value usually references the GLIBC_TUNABLES (or alias)
environment string, which lives in the environment block the kernel places
on the initial stack.  That memory is owned by the application, which may
overwrite it (e.g. setproctitle), so the reference is only safe while no
application code has run (a value coming from the system-wide tunables
cache is a copy instead, but the rule is applied uniformly).

This patch make the lifetime explicit and enforced without copying the value
or allocating any memory by adding __tunable_seal_strings, which drops every
string tunable reference once early startup is complete.

The seal is applied after the only string tunable consumer and before any
code outside of the startup sequence runs.

Checked on aarch64-linux-gnu and x86_64-linux-gnu.  I also run the elf
tests on powerpc64le-linux-gnu, loongarch64-linux-gnuf64, and
s390x-linux-gnu.
2026-08-24 13:49:12 -03:00

411 lines
13 KiB
C

/* Perform initialization and invoke main.
Copyright (C) 1998-2026 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
/* Note: This code is only part of the startup code proper for
statically linked binaries. For dynamically linked binaries, it
resides in libc.so. */
/* Mark symbols hidden in static PIE for early self relocation to work. */
#if BUILD_PIE_DEFAULT
# pragma GCC visibility push(hidden)
#endif
#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <ldsodefs.h>
#include <libc-diag.h>
#include <libc-internal.h>
#include <elf/libc-early-init.h>
#include <stdbool.h>
#include <elf-initfini.h>
#include <shlib-compat.h>
#include <elf/dl-tunables.h>
extern void __libc_init_first (int argc, char **argv, char **envp);
#include <tls.h>
#ifndef SHARED
# include <dl-osinfo.h>
# include <dl-reseed-random.h>
# include <dl-symbol-redir-ifunc.h>
# ifndef THREAD_SET_STACK_GUARD
/* Only exported for architectures that don't store the stack guard canary
in thread local area. */
uintptr_t __stack_chk_guard attribute_relro;
# endif
uintptr_t __pointer_chk_guard_local attribute_relro attribute_hidden;
#endif
#ifndef SHARED
# include <link.h>
# include <dl-irel.h>
# include <dl-symbol-redir-ifunc.h>
# ifdef ELF_MACHINE_IRELA
# define IREL_T ElfW(Rela)
# define IPLT_START __rela_iplt_start
# define IPLT_END __rela_iplt_end
# define IREL elf_irela
# elif defined ELF_MACHINE_IREL
# define IREL_T ElfW(Rel)
# define IPLT_START __rel_iplt_start
# define IPLT_END __rel_iplt_end
# define IREL elf_irel
# endif
static void
apply_irel (void)
{
# ifdef IREL
/* We use weak references for these so that we'll still work with a linker
that doesn't define them. Such a linker doesn't support IFUNC at all
and so uses won't work, but a statically-linked program that doesn't
use any IFUNC symbols won't have a problem. */
extern const IREL_T IPLT_START[] __attribute__ ((weak));
extern const IREL_T IPLT_END[] __attribute__ ((weak));
for (const IREL_T *ipltent = IPLT_START; ipltent < IPLT_END; ++ipltent)
IREL (ipltent);
# endif
}
#endif
#ifdef LIBC_START_MAIN
# ifdef LIBC_START_DISABLE_INLINE
# define STATIC static
# else
# define STATIC static inline __attribute__ ((always_inline))
# endif
# define DO_DEFINE_LIBC_START_MAIN_VERSION 0
#else
# define STATIC
# define LIBC_START_MAIN __libc_start_main_impl
# define DO_DEFINE_LIBC_START_MAIN_VERSION 1
#endif
#ifdef MAIN_AUXVEC_ARG
/* main gets passed a pointer to the auxiliary. */
# define MAIN_AUXVEC_DECL , void *
# define MAIN_AUXVEC_PARAM , auxvec
#else
# define MAIN_AUXVEC_DECL
# define MAIN_AUXVEC_PARAM
#endif
#ifndef ARCH_INIT_CPU_FEATURES
# define ARCH_INIT_CPU_FEATURES()
#endif
/* Obtain the definition of __libc_start_call_main. */
#include <libc_start_call_main.h>
#ifdef SHARED
/* Initialization for dynamic executables. Find the main executable
link map and run its init functions. */
static void
call_init (int argc, char **argv, char **env)
{
/* Obtain the main map of the executable. */
struct link_map *l = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
/* DT_PREINIT_ARRAY is not processed here. It is already handled in
_dl_init in elf/dl-init.c. Also see the call_init function in
the same file. */
if (ELF_INITFINI && l->l_info[DT_INIT] != NULL)
DL_CALL_DT_INIT(l, l->l_addr + l->l_info[DT_INIT]->d_un.d_ptr,
argc, argv, env);
ElfW(Dyn) *init_array = l->l_info[DT_INIT_ARRAY];
if (init_array != NULL)
{
unsigned int jm
= l->l_info[DT_INIT_ARRAYSZ]->d_un.d_val / sizeof (ElfW(Addr));
ElfW(Addr) *addrs = (void *) (init_array->d_un.d_ptr + l->l_addr);
for (unsigned int j = 0; j < jm; ++j)
((dl_init_t) addrs[j]) (argc, argv, env);
}
}
#else /* !SHARED */
/* These magic symbols are provided by the linker. */
extern void (*__preinit_array_start []) (int, char **, char **)
attribute_hidden;
extern void (*__preinit_array_end []) (int, char **, char **)
attribute_hidden;
extern void (*__init_array_start []) (int, char **, char **)
attribute_hidden;
extern void (*__init_array_end []) (int, char **, char **)
attribute_hidden;
extern void (*__fini_array_start []) (void) attribute_hidden;
extern void (*__fini_array_end []) (void) attribute_hidden;
# if ELF_INITFINI
/* These function symbols are provided for the .init/.fini section entry
points automagically by the linker. */
extern void _init (void);
extern void _fini (void);
# endif
/* Initialization for static executables. There is no dynamic
segment, so we access the symbols directly. */
static void
call_init (int argc, char **argv, char **envp)
{
/* For static executables, preinit happens right before init. */
{
const size_t size = __preinit_array_end - __preinit_array_start;
size_t i;
for (i = 0; i < size; i++)
(*__preinit_array_start [i]) (argc, argv, envp);
}
# if ELF_INITFINI
_init ();
# endif
const size_t size = __init_array_end - __init_array_start;
for (size_t i = 0; i < size; i++)
(*__init_array_start [i]) (argc, argv, envp);
}
/* Likewise for the destructor. */
static void
call_fini (void *unused)
{
size_t i = __fini_array_end - __fini_array_start;
while (i-- > 0)
(*__fini_array_start [i]) ();
# if ELF_INITFINI
_fini ();
# endif
}
#endif /* !SHARED */
#include <libc-start.h>
#include <dl-exec-post.h>
STATIC int LIBC_START_MAIN (int (*main) (int, char **, char **
MAIN_AUXVEC_DECL),
int argc,
char **argv,
#ifdef LIBC_START_MAIN_AUXVEC_ARG
ElfW(auxv_t) *auxvec,
#endif
__typeof (main) init,
void (*fini) (void),
void (*rtld_fini) (void),
void *stack_end)
__attribute__ ((noreturn));
/* Note: The init and fini parameters are no longer used. fini is
completely unused, init is still called if not NULL, but the
current startup code always passes NULL. (In the future, it would
be possible to use fini to pass a version code if init is NULL, to
indicate the link-time glibc without introducing a hard
incompatibility for new programs with older glibc versions.)
For dynamically linked executables, the dynamic segment is used to
locate constructors and destructors. For statically linked
executables, the relevant symbols are access directly. */
STATIC int
LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
int argc, char **argv,
#ifdef LIBC_START_MAIN_AUXVEC_ARG
ElfW(auxv_t) *auxvec,
#endif
__typeof (main) init,
void (*fini) (void),
void (*rtld_fini) (void), void *stack_end)
{
#ifndef SHARED
char **ev = &argv[argc + 1];
__environ = ev;
/* Store the lowest stack address. This is done in ld.so if this is
the code for the DSO. */
__libc_stack_end = stack_end;
# ifdef HAVE_AUX_VECTOR
/* First process the auxiliary vector since we need to find the
program header to locate an eventually present PT_TLS entry. */
# ifndef LIBC_START_MAIN_AUXVEC_ARG
ElfW(auxv_t) *auxvec;
{
char **evp = ev;
while (*evp++ != NULL)
;
auxvec = (ElfW(auxv_t) *) evp;
}
# endif
_dl_aux_init (auxvec);
# endif
__tunables_init (__environ, argv);
ARCH_INIT_CPU_FEATURES ();
/* Every string tunable has been consumed by ARCH_INIT_CPU_FEATURES, before
any code outside of libc startup runs. */
__tunable_seal_strings ();
/* Do static-pie self relocation for the non-IRELATIVE part after tunables
and cpu features are set up. IFUNC entries are deferred until after the
TCB and the stack-protector canary are usable, so that an instrumented
resolver does not fault. Before this point relocations must be
avoided. */
_dl_relocate_static_pie ();
/* Set up the TCB so that the IFUNC pass below can fire resolvers
compiled with stack protection, and so that resolvers reading TLS
(errno, __thread variables, powerpc's hwcap / at_platform in the
TCB) observe an initialised slot. */
ARCH_SETUP_TLS ();
/* Set up the stack checker's canary. Must happen before any IFUNC resolver
runs so a resolver compiled with stack protection loads a defined
canary. */
uintptr_t stack_chk_guard = _dl_setup_stack_chk_guard (_dl_random);
# ifdef THREAD_SET_STACK_GUARD
THREAD_SET_STACK_GUARD (stack_chk_guard);
# else
__stack_chk_guard = stack_chk_guard;
# endif
/* Set up the pointer guard value. */
uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
stack_chk_guard);
__pointer_chk_guard_local = pointer_chk_guard;
/* We do not need the _dl_random value anymore. Scrub the AT_RANDOM
bytes and clear the pointer; on targets with an entropy source, refill
the bytes with fresh random data. */
_dl_reseed_random (&_dl_random);
/* Now that the TCB, canary, and pointer guard are in place, run the
deferred IFUNC relocations. For non-PIE static binaries this is
ARCH_SETUP_IREL (apply_irel); for static-pie it is the IRELATIVE
phase of _dl_relocate_static_pie above. */
_dl_relocate_static_pie_ifunc ();
ARCH_SETUP_IREL ();
/* This must run after the IFUNC relocations: _dl_executable_postprocess
may call IFUNC-resolved routines. */
struct link_map *main_map = _dl_get_dl_main_map ();
_dl_executable_postprocess (main_map, GL(dl_phdr), GL(dl_phnum));
/* Initialize libpthread if linked in. */
if (__pthread_initialize_minimal != NULL)
__pthread_initialize_minimal ();
#endif /* !SHARED */
/* Register the destructor of the dynamic linker if there is any. */
if (__glibc_likely (rtld_fini != NULL))
__cxa_atexit ((void (*) (void *)) rtld_fini, NULL, NULL);
#ifndef SHARED
/* Perform early initialization. In the shared case, this function
is called from the dynamic loader as early as possible. */
__libc_early_init (true);
/* Call the initializer of the libc. This is only needed here if we
are compiling for the static library in which case we haven't
run the constructors in `_dl_start_user'. */
__libc_init_first (argc, argv, __environ);
/* Register the destructor of the statically-linked program. */
__cxa_atexit (call_fini, NULL, NULL);
/* Some security at this point. Prevent starting a SUID binary where
the standard file descriptors are not opened. We have to do this
only for statically linked applications since otherwise the dynamic
loader did the work already. */
if (__builtin_expect (__libc_enable_secure, 0))
__libc_check_standard_fds ();
#endif /* !SHARED */
/* Call the initializer of the program, if any. */
#ifdef SHARED
if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_IMPCALLS, 0))
GLRO(dl_debug_printf) ("\ninitialize program: %s\n\n", argv[0]);
if (init != NULL)
/* This is a legacy program which supplied its own init
routine. */
(*init) (argc, argv, __environ MAIN_AUXVEC_PARAM);
else
/* This is a current program. Use the dynamic segment to find
constructors. */
call_init (argc, argv, __environ);
/* Auditing checkpoint: we have a new object. */
_dl_audit_preinit (GL(dl_ns)[LM_ID_BASE]._ns_loaded);
if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_IMPCALLS))
GLRO(dl_debug_printf) ("\ntransferring control: %s\n\n", argv[0]);
#else /* !SHARED */
call_init (argc, argv, __environ);
_dl_debug_initialize (0, LM_ID_BASE);
#endif
__libc_start_call_main (main, argc, argv MAIN_AUXVEC_PARAM);
}
/* Starting with glibc 2.34, the init parameter is always NULL. Older
libcs are not prepared to handle that. The macro
DEFINE_LIBC_START_MAIN_VERSION creates GLIBC_2.34 alias, so that
newly linked binaries reflect that dependency. The macros below
expect that the exported function is called
__libc_start_main_impl. */
#ifdef SHARED
# define DEFINE_LIBC_START_MAIN_VERSION \
DEFINE_LIBC_START_MAIN_VERSION_1 \
strong_alias (__libc_start_main_impl, __libc_start_main_alias_2) \
versioned_symbol (libc, __libc_start_main_alias_2, __libc_start_main, \
GLIBC_2_34);
# if SHLIB_COMPAT(libc, GLIBC_2_0, GLIBC_2_34)
# define DEFINE_LIBC_START_MAIN_VERSION_1 \
strong_alias (__libc_start_main_impl, __libc_start_main_alias_1) \
compat_symbol (libc, __libc_start_main_alias_1, __libc_start_main, GLIBC_2_0);
# else
# define DEFINE_LIBC_START_MAIN_VERSION_1
# endif
#else /* !SHARED */
/* Enable calling the function under its exported name. */
# define DEFINE_LIBC_START_MAIN_VERSION \
strong_alias (__libc_start_main_impl, __libc_start_main)
#endif
/* Only define the version information if LIBC_START_MAIN was not set.
If there is a wrapper file, it must expand
DEFINE_LIBC_START_MAIN_VERSION on its own. */
#if DO_DEFINE_LIBC_START_MAIN_VERSION
DEFINE_LIBC_START_MAIN_VERSION
#endif