First entries of got.plt can be protected using RelRo technique,
this patch implements this by shifting got.plt to the memory page,
where relro is active.
Both gold and bfd do that and it should be good for security.
Paths
| Differential D20024
[ELF] - Protect first entries of got.plt with RelRo. AbandonedPublic Authored by grimar on May 6 2016, 10:09 AM.
Details
Diff Detail Event Timelinegrimar updated this object. Comment Actions Interesting, but it is tricky. What exactly is the threat for putting the first entry of .got.plt in a writable segment, how realistic is the attack is, and how much does this mitigate the risk? Comment Actions Remind me again how the first entry works. From the ABI it looks like But, it looks like it is actually .got.plt that has that. Also, if the Comment Actions I see that musl just does lea _DYNAMIC(%rip),%rsi to find its own _DYNAMIC. I wonder if we can just drop the magical first entries. Cheers, Comment Actions
This patch is not terribly complex, but I also suspect that in practice folks will use -zrelro & -znow if this is a concern.
Comment Actions Well, I assumed it is useful, at least because even linkerscript has special command .got : { *(.got) *(.igot) } . = DATA_SEGMENT_RELRO_END (24, .); .got.plt : { *(.got.plt) *(.igot.plt) } I don't know how realistic is attack using unprotected first 3 entries.
Revision Contents
Diff 56429 ELF/OutputSections.h
ELF/Writer.cpp
test/ELF/aarch64-condb-reloc.s
test/ELF/aarch64-gnu-ifunc.s
test/ELF/aarch64-tstbr14-reloc.s
test/ELF/copy-rel-pie.s
test/ELF/dynamic-reloc-index.s
test/ELF/dynamic-reloc.s
test/ELF/gnu-ifunc-i386.s
test/ELF/gnu-ifunc.s
test/ELF/lto/undefined-puts.ll
test/ELF/mips-26.s
test/ELF/plt-aarch64.s
test/ELF/plt-i686.s
test/ELF/plt.s
test/ELF/relocation.s
test/ELF/relro.s
test/ELF/undef-with-plt-addr.s
|
This comment is now confusing to me -- "page aligned" isn't how I'd describe the effect of PageAlignKind::GotPlt. What about just describing these three types where the enum is defined?