Always enable pointer guard [BZ #18928]

Honoring the LD_POINTER_GUARD environment variable in AT_SECURE mode
has security implications.  This commit enables pointer guard
unconditionally, and the environment variable is now ignored.

        [BZ #18928]
        * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove
        _dl_pointer_guard member.
        * elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard
        initializer.
        (security_init): Always set up pointer guard.
        (process_envvars): Do not process LD_POINTER_GUARD.

(cherry picked from commit a014cecd82b71b70a6a843e250e06b541ad524f7)

Conflicts:
	NEWS

diff --git a/ChangeLog b/ChangeLog
index 53e173f5f09cc3c95a00c29caac18ca3f1fd3d7b..f0bd73669448caf2c632329a40fcc4912a7691f6 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2016-07-11  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #18928]
+       * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove
+       _dl_pointer_guard member.
+       * elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard
+       initializer.
+       (security_init): Always set up pointer guard.
+       (process_envvars): Do not process LD_POINTER_GUARD.
+
 2016-07-11  Leonhard Holz  <leonhard.holz@web.de>
 
        [BZ #16009]

diff --git a/NEWS b/NEWS
index 2a8f8f478881c083cc7b4b93a31d2154d9f898f1..9bd31e4ab4ce0966592501d8860788e2335f7228 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,8 +12,8 @@ Version 2.19.1
   15946, 16009, 16545, 16574, 16623, 16657, 16695, 16743, 16758, 16759,
   16760, 16878, 16882, 16885, 16916, 16932, 16943, 16958, 17048, 17062,
   17069, 17079, 17137, 17153, 17213, 17263, 17269, 17325, 17555, 17905,
-  18007, 18032, 18080, 18240, 18287, 18508, 18665, 18905, 19779, 19791,
-  19879, 20010, 20112.
+  18007, 18032, 18080, 18240, 18287, 18508, 18665, 18905, 18928, 19779,
+  19791, 19879, 20010, 20112.
 
 * A buffer overflow in gethostbyname_r and related functions performing DNS
   requests has been fixed.  If the NSS functions were called with a

diff --git a/elf/rtld.c b/elf/rtld.c
index 6dcbabc2847b04ca1a313301cad4831cf4d46d95..375c47d72c2454e942e03afc1a53db9a7bf1e1ee 100644 (file)
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -162,7 +162,6 @@ struct rtld_global_ro _rtld_global_ro attribute_relro =
     ._dl_hwcap_mask = HWCAP_IMPORTANT,
     ._dl_lazy = 1,
     ._dl_fpu_control = _FPU_DEFAULT,
-    ._dl_pointer_guard = 1,
     ._dl_pagesize = EXEC_PAGESIZE,
     ._dl_inhibit_cache = 0,
 
@@ -857,15 +856,12 @@ security_init (void)
 #endif
 
   /* Set up the pointer guard as well, if necessary.  */
-  if (GLRO(dl_pointer_guard))
-    {
-      uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
-                                                            stack_chk_guard);
+  uintptr_t pointer_chk_guard
+    = _dl_setup_pointer_guard (_dl_random, stack_chk_guard);
 #ifdef THREAD_SET_POINTER_GUARD
-      THREAD_SET_POINTER_GUARD (pointer_chk_guard);
+  THREAD_SET_POINTER_GUARD (pointer_chk_guard);
 #endif
-      __pointer_chk_guard_local = pointer_chk_guard;
-    }
+  __pointer_chk_guard_local = pointer_chk_guard;
 
   /* We do not need the _dl_random value anymore.  The less
      information we leave behind, the better, so clear the
@@ -2605,9 +2601,6 @@ process_envvars (enum mode *modep)
              GLRO(dl_use_load_bias) = envline[14] == '1' ? -1 : 0;
              break;
            }
-
-         if (memcmp (envline, "POINTER_GUARD", 13) == 0)
-           GLRO(dl_pointer_guard) = envline[14] != '0';
          break;
 
        case 14:

diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index ffeb093887e69845dfc8ab5d8d87cde8a4e443bc..9d767b64d2bbcb44fa4d33f9785dd769e3546917 100644 (file)
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -590,9 +590,6 @@ struct rtld_global_ro
   /* List of auditing interfaces.  */
   struct audit_ifaces *_dl_audit;
   unsigned int _dl_naudit;
-
-  /* 0 if internal pointer values should not be guarded, 1 if they should.  */
-  EXTERN int _dl_pointer_guard;
 };
 # define __rtld_global_attribute__
 # ifdef IS_IN_rtld