linker_environ.cpp revision a0f64756a4a55ab48b2b5511d4e7c45583dac44b
1/* 2 * Copyright (C) 2010 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include "linker_environ.h" 30 31#include <linux/auxvec.h> 32#include <stddef.h> 33#include <stdlib.h> 34#include <unistd.h> 35 36static char** _envp; 37static bool _AT_SECURE_value = true; 38 39bool get_AT_SECURE() { 40 return _AT_SECURE_value; 41} 42 43static void __init_AT_SECURE(unsigned* auxv) { 44 // Check auxv for AT_SECURE first to see if program is setuid, setgid, 45 // has file caps, or caused a SELinux/AppArmor domain transition. 46 for (unsigned* v = auxv; v[0]; v += 2) { 47 if (v[0] == AT_SECURE) { 48 // Kernel told us whether to enable secure mode. 49 _AT_SECURE_value = v[1]; 50 return; 51 } 52 } 53 54 // We don't support ancient kernels. 55 const char* msg = "FATAL: kernel did not supply AT_SECURE\n"; 56 write(2, msg, strlen(msg)); 57 exit(EXIT_FAILURE); 58} 59 60// Check if the environment variable definition at 'envstr' 61// starts with '<name>=', and if so return the address of the 62// first character after the equal sign. Otherwise return NULL. 63static const char* env_match(const char* envstr, const char* name) { 64 size_t i = 0; 65 66 while (envstr[i] == name[i] && name[i] != '\0') { 67 ++i; 68 } 69 70 if (name[i] == '\0' && envstr[i] == '=') { 71 return envstr + i + 1; 72 } 73 74 return NULL; 75} 76 77static bool __is_valid_environment_variable(const char* name) { 78 // According to its sources, the kernel uses 32*PAGE_SIZE by default 79 // as the maximum size for an env. variable definition. 80 const int MAX_ENV_LEN = 32*4096; 81 82 if (name == NULL) { 83 return false; 84 } 85 86 // Parse the string, looking for the first '=' there, and its size. 87 int pos = 0; 88 int first_equal_pos = -1; 89 while (pos < MAX_ENV_LEN) { 90 if (name[pos] == '\0') { 91 break; 92 } 93 if (name[pos] == '=' && first_equal_pos < 0) { 94 first_equal_pos = pos; 95 } 96 pos++; 97 } 98 99 // Check that it's smaller than MAX_ENV_LEN (to detect non-zero terminated strings). 100 if (pos >= MAX_ENV_LEN) { 101 return false; 102 } 103 104 // Check that it contains at least one equal sign that is not the first character 105 if (first_equal_pos < 1) { 106 return false; 107 } 108 109 return true; 110} 111 112static bool __is_unsafe_environment_variable(const char* name) { 113 // None of these should be allowed in setuid programs. 114 static const char* const UNSAFE_VARIABLE_NAMES[] = { 115 "ANDROID_PROPERTY_WORKSPACE", 116 "GCONV_PATH", 117 "GETCONF_DIR", 118 "HOSTALIASES", 119 "LD_AOUT_LIBRARY_PATH", 120 "LD_AOUT_PRELOAD", 121 "LD_AUDIT", 122 "LD_DEBUG", 123 "LD_DEBUG_OUTPUT", 124 "LD_DYNAMIC_WEAK", 125 "LD_LIBRARY_PATH", 126 "LD_ORIGIN_PATH", 127 "LD_PRELOAD", 128 "LD_PROFILE", 129 "LD_SHOW_AUXV", 130 "LD_USE_LOAD_BIAS", 131 "LOCALDOMAIN", 132 "LOCPATH", 133 "MALLOC_CHECK_", 134 "MALLOC_TRACE", 135 "NIS_PATH", 136 "NLSPATH", 137 "RESOLV_HOST_CONF", 138 "RES_OPTIONS", 139 "TMPDIR", 140 "TZDIR", 141 NULL 142 }; 143 for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != NULL; ++i) { 144 if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != NULL) { 145 return true; 146 } 147 } 148 return false; 149} 150 151static void __sanitize_environment_variables() { 152 char** src = _envp; 153 char** dst = _envp; 154 for (; src[0] != NULL; ++src) { 155 if (!__is_valid_environment_variable(src[0])) { 156 continue; 157 } 158 // Remove various unsafe environment variables if we're loading a setuid program. 159 if (get_AT_SECURE() && __is_unsafe_environment_variable(src[0])) { 160 continue; 161 } 162 dst[0] = src[0]; 163 ++dst; 164 } 165 dst[0] = NULL; 166} 167 168unsigned* linker_env_init(unsigned* environment_and_aux_vectors) { 169 // Store environment pointer - can't be NULL. 170 _envp = reinterpret_cast<char**>(environment_and_aux_vectors); 171 172 // Skip over all environment variable definitions. 173 // The end of the environment block is marked by two NULL pointers. 174 unsigned* aux_vectors = environment_and_aux_vectors; 175 while (aux_vectors[0] != 0) { 176 ++aux_vectors; 177 } 178 ++aux_vectors; 179 180 __init_AT_SECURE(aux_vectors); 181 __sanitize_environment_variables(); 182 183 return aux_vectors; 184} 185 186const char* linker_env_get(const char* name) { 187 if (name == NULL || name[0] == '\0') { 188 return NULL; 189 } 190 191 for (char** p = _envp; p[0] != NULL; ++p) { 192 const char* val = env_match(p[0], name); 193 if (val != NULL) { 194 if (val[0] == '\0') { 195 return NULL; // Return NULL for empty strings. 196 } 197 return val; 198 } 199 } 200 return NULL; 201} 202