Ignore and remove LD_HWCAP_MASK for AT_SECURE programs (bug #21209)

The LD_HWCAP_MASK environment variable may alter the selection of
function variants for some architectures.  For AT_SECURE process it
means that if an outdated routine has a bug that would otherwise not
affect newer platforms by default, LD_HWCAP_MASK will allow that bug
to be exploited.

To be on the safe side, ignore and disable LD_HWCAP_MASK for setuid
binaries.

	[BZ #21209]
	* elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
	AT_SECURE processes.
	* sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.
	* elf/tst-env-setuid.c (test_parent): Test LD_HWCAP_MASK.
	(test_child): Likewise.
	* elf/Makefile (tst-env-setuid-ENV): Add LD_HWCAP_MASK.

diff --git a/ChangeLog b/ChangeLog
index 45251fe6a8ead84943aa397f57cb43b27ae0f3ec..340ae0ee72597baebd5ea94f77cf297e5dea1d3d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2017-03-07  Siddhesh Poyarekar  <siddhesh@sourceware.org>
+
+       [BZ #21209]
+       * elf/rtld.c (process_envvars): Ignore LD_HWCAP_MASK for
+       AT_SECURE processes.
+       * sysdeps/generic/unsecvars.h: Add LD_HWCAP_MASK.
+       * elf/tst-env-setuid.c (test_parent): Test LD_HWCAP_MASK.
+       (test_child): Likewise.
+       * elf/Makefile (tst-env-setuid-ENV): Add LD_HWCAP_MASK.
+
 2017-03-07  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
 
        * sysdeps/unix/sysv/linux/hppa/ipc_priv.h: New file.

diff --git a/elf/Makefile b/elf/Makefile
index 61abeb59eeef0b9ed8e4998b1f28cc1310073644..cc4aeb25b6128cb23ed7fa032c066310a0a9db6c 100644 (file)
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1398,6 +1398,7 @@ $(objpfx)tst-nodelete-dlclose: $(objpfx)tst-nodelete-dlclose-dso.so
 $(objpfx)tst-nodelete-dlclose.out: $(objpfx)tst-nodelete-dlclose-dso.so \
                                   $(objpfx)tst-nodelete-dlclose-plugin.so
 
-tst-env-setuid-ENV = MALLOC_CHECK_=2 MALLOC_MMAP_THRESHOLD_=4096
+tst-env-setuid-ENV = MALLOC_CHECK_=2 MALLOC_MMAP_THRESHOLD_=4096 \
+                    LD_HWCAP_MASK=0xffffffff
 tst-env-setuid-tunables-ENV = \
        GLIBC_TUNABLES=glibc.malloc.check=2:glibc.malloc.mmap_threshold=4096

diff --git a/elf/rtld.c b/elf/rtld.c
index a036ece9568957f125a482209f6342d77313a171..5986eaf4a19e8227153d071887608d7607d110cd 100644 (file)
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2404,7 +2404,8 @@ process_envvars (enum mode *modep)
 
        case 10:
          /* Mask for the important hardware capabilities.  */
-         if (memcmp (envline, "HWCAP_MASK", 10) == 0)
+         if (!__libc_enable_secure
+             && memcmp (envline, "HWCAP_MASK", 10) == 0)
            GLRO(dl_hwcap_mask) = __strtoul_internal (&envline[11], NULL,
                                                      0, 0);
          break;

diff --git a/elf/tst-env-setuid.c b/elf/tst-env-setuid.c
index 6ec3fa587449c6f93e9cf5ca06951851dc35cabf..eec408eb5db6f371cc67f4e40ae67160fd032dfd 100644 (file)
--- a/elf/tst-env-setuid.c
+++ b/elf/tst-env-setuid.c
@@ -213,6 +213,12 @@ test_child (void)
       return 1;
     }
 
+  if (getenv ("LD_HWCAP_MASK") != NULL)
+    {
+      printf ("LD_HWCAP_MASK still set\n");
+      return 1;
+    }
+
   return 0;
 }
 #endif
@@ -233,6 +239,12 @@ test_parent (void)
       return 1;
     }
 
+  if (getenv ("LD_HWCAP_MASK") == NULL)
+    {
+      printf ("LD_HWCAP_MASK lost\n");
+      return 1;
+    }
+
   return 0;
 }
 #endif

diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index a74083786ef4766735a5bf088b26de161ba5d643..5ea8a4a259ef753c9d0d30aa4c0788e93656d047 100644 (file)
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -16,6 +16,7 @@
   "LD_DEBUG\0"                                                               \
   "LD_DEBUG_OUTPUT\0"                                                        \
   "LD_DYNAMIC_WEAK\0"                                                        \
+  "LD_HWCAP_MASK\0"                                                          \
   "LD_LIBRARY_PATH\0"                                                        \
   "LD_ORIGIN_PATH\0"                                                         \
   "LD_PRELOAD\0"                                                             \