libc_init_common.cpp revision 7fda8d2aa4d24ab400f6f0cb9f792488b634afae
1/* 2 * Copyright (C) 2008 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include "libc_init_common.h" 30 31#include <elf.h> 32#include <errno.h> 33#include <fcntl.h> 34#include <stddef.h> 35#include <stdint.h> 36#include <stdio.h> 37#include <stdlib.h> 38#include <string.h> 39#include <sys/auxv.h> 40#include <sys/personality.h> 41#include <sys/time.h> 42#include <unistd.h> 43 44#include "private/bionic_auxv.h" 45#include "private/bionic_ssp.h" 46#include "private/bionic_tls.h" 47#include "private/KernelArgumentBlock.h" 48#include "private/libc_logging.h" 49#include "pthread_internal.h" 50 51extern "C" abort_msg_t** __abort_message_ptr; 52extern "C" void __bionic_setjmp_cookie_init(void); 53extern "C" int __system_properties_init(void); 54extern "C" int __set_tls(void* ptr); 55extern "C" int __set_tid_address(int* tid_address); 56 57__LIBC_HIDDEN__ void __libc_init_vdso(); 58 59// Not public, but well-known in the BSDs. 60const char* __progname; 61 62// Declared in <unistd.h>. 63char** environ; 64 65// Declared in "private/bionic_ssp.h". 66uintptr_t __stack_chk_guard = 0; 67 68// Setup for the main thread. For dynamic executables, this is called by the 69// linker _before_ libc is mapped in memory. This means that all writes to 70// globals from this function will apply to linker-private copies and will not 71// be visible from libc later on. 72// 73// Note: this function creates a pthread_internal_t for the initial thread and 74// stores the pointer in TLS, but does not add it to pthread's thread list. This 75// has to be done later from libc itself (see __libc_init_common). 76void __libc_init_main_thread(KernelArgumentBlock& args) { 77 __libc_auxv = args.auxv; 78 79 static pthread_internal_t main_thread; 80 81 // Tell the kernel to clear our tid field when we exit, so we're like any other pthread. 82 // As a side-effect, this tells us our pid (which is the same as the main thread's tid). 83 main_thread.tid = __set_tid_address(&main_thread.tid); 84 main_thread.set_cached_pid(main_thread.tid); 85 86 // We don't want to free the main thread's stack even when the main thread exits 87 // because things like environment variables with global scope live on it. 88 // We also can't free the pthread_internal_t itself, since that lives on the main 89 // thread's stack rather than on the heap. 90 // The main thread has no mmap allocated space for stack or pthread_internal_t. 91 main_thread.mmap_size = 0; 92 pthread_attr_init(&main_thread.attr); 93 main_thread.attr.guard_size = 0; // The main thread has no guard page. 94 main_thread.attr.stack_size = 0; // User code should never see this; we'll compute it when asked. 95 // TODO: the main thread's sched_policy and sched_priority need to be queried. 96 97 __init_thread(&main_thread); 98 __init_tls(&main_thread); 99 __set_tls(main_thread.tls); 100 101 // Store a pointer to the kernel argument block in a TLS slot to be 102 // picked up by the libc constructor. 103 main_thread.tls[TLS_SLOT_BIONIC_PREINIT] = &args; 104 105 __init_alternate_signal_stack(&main_thread); 106} 107 108void __libc_init_common(KernelArgumentBlock& args) { 109 // Initialize various globals. 110 environ = args.envp; 111 errno = 0; 112 __libc_auxv = args.auxv; 113 __progname = args.argv[0] ? args.argv[0] : "<unknown>"; 114 __abort_message_ptr = args.abort_message_ptr; 115 116 // AT_RANDOM is a pointer to 16 bytes of randomness on the stack. 117 __stack_chk_guard = *reinterpret_cast<uintptr_t*>(getauxval(AT_RANDOM)); 118 119 // Get the main thread from TLS and add it to the thread list. 120 pthread_internal_t* main_thread = __get_thread(); 121 __pthread_internal_add(main_thread); 122 123 __system_properties_init(); // Requires 'environ'. 124 125 __bionic_setjmp_cookie_init(); 126 __libc_init_vdso(); 127} 128 129__noreturn static void __early_abort(int line) { 130 // We can't write to stdout or stderr because we're aborting before we've checked that 131 // it's safe for us to use those file descriptors. We probably can't strace either, so 132 // we rely on the fact that if we dereference a low address, either debuggerd or the 133 // kernel's crash dump will show the fault address. 134 *reinterpret_cast<int*>(line) = 0; 135 _exit(EXIT_FAILURE); 136} 137 138// Force any of the closed stdin, stdout and stderr to be associated with /dev/null. 139static void __nullify_closed_stdio() { 140 int dev_null = TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR)); 141 if (dev_null == -1) { 142 // init won't have /dev/null available, but SELinux provides an equivalent. 143 dev_null = TEMP_FAILURE_RETRY(open("/sys/fs/selinux/null", O_RDWR)); 144 } 145 if (dev_null == -1) { 146 __early_abort(__LINE__); 147 } 148 149 // If any of the stdio file descriptors is valid and not associated 150 // with /dev/null, dup /dev/null to it. 151 for (int i = 0; i < 3; i++) { 152 // If it is /dev/null already, we are done. 153 if (i == dev_null) { 154 continue; 155 } 156 157 // Is this fd already open? 158 int status = TEMP_FAILURE_RETRY(fcntl(i, F_GETFL)); 159 if (status != -1) { 160 continue; 161 } 162 163 // The only error we allow is that the file descriptor does not 164 // exist, in which case we dup /dev/null to it. 165 if (errno == EBADF) { 166 // Try dupping /dev/null to this stdio file descriptor and 167 // repeat if there is a signal. Note that any errors in closing 168 // the stdio descriptor are lost. 169 status = TEMP_FAILURE_RETRY(dup2(dev_null, i)); 170 if (status == -1) { 171 __early_abort(__LINE__); 172 } 173 } else { 174 __early_abort(__LINE__); 175 } 176 } 177 178 // If /dev/null is not one of the stdio file descriptors, close it. 179 if (dev_null > 2) { 180 if (close(dev_null) == -1) { 181 __early_abort(__LINE__); 182 } 183 } 184} 185 186// Check if the environment variable definition at 'envstr' 187// starts with '<name>=', and if so return the address of the 188// first character after the equal sign. Otherwise return null. 189static const char* env_match(const char* envstr, const char* name) { 190 size_t i = 0; 191 192 while (envstr[i] == name[i] && name[i] != '\0') { 193 ++i; 194 } 195 196 if (name[i] == '\0' && envstr[i] == '=') { 197 return envstr + i + 1; 198 } 199 200 return nullptr; 201} 202 203static bool __is_valid_environment_variable(const char* name) { 204 // According to the kernel source, by default the kernel uses 32*PAGE_SIZE 205 // as the maximum size for an environment variable definition. 206 const int MAX_ENV_LEN = 32*4096; 207 208 if (name == nullptr) { 209 return false; 210 } 211 212 // Parse the string, looking for the first '=' there, and its size. 213 int pos = 0; 214 int first_equal_pos = -1; 215 while (pos < MAX_ENV_LEN) { 216 if (name[pos] == '\0') { 217 break; 218 } 219 if (name[pos] == '=' && first_equal_pos < 0) { 220 first_equal_pos = pos; 221 } 222 pos++; 223 } 224 225 // Check that it's smaller than MAX_ENV_LEN (to detect non-zero terminated strings). 226 if (pos >= MAX_ENV_LEN) { 227 return false; 228 } 229 230 // Check that it contains at least one equal sign that is not the first character 231 if (first_equal_pos < 1) { 232 return false; 233 } 234 235 return true; 236} 237 238static bool __is_unsafe_environment_variable(const char* name) { 239 // None of these should be allowed in setuid programs. 240 static const char* const UNSAFE_VARIABLE_NAMES[] = { 241 "GCONV_PATH", 242 "GETCONF_DIR", 243 "HOSTALIASES", 244 "JE_MALLOC_CONF", 245 "LD_AOUT_LIBRARY_PATH", 246 "LD_AOUT_PRELOAD", 247 "LD_AUDIT", 248 "LD_DEBUG", 249 "LD_DEBUG_OUTPUT", 250 "LD_DYNAMIC_WEAK", 251 "LD_LIBRARY_PATH", 252 "LD_ORIGIN_PATH", 253 "LD_PRELOAD", 254 "LD_PROFILE", 255 "LD_SHOW_AUXV", 256 "LD_USE_LOAD_BIAS", 257 "LOCALDOMAIN", 258 "LOCPATH", 259 "MALLOC_CHECK_", 260 "MALLOC_CONF", 261 "MALLOC_TRACE", 262 "NIS_PATH", 263 "NLSPATH", 264 "RESOLV_HOST_CONF", 265 "RES_OPTIONS", 266 "TMPDIR", 267 "TZDIR", 268 nullptr 269 }; 270 for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != nullptr; ++i) { 271 if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != nullptr) { 272 return true; 273 } 274 } 275 return false; 276} 277 278static void __sanitize_environment_variables(char** env) { 279 bool is_AT_SECURE = getauxval(AT_SECURE); 280 char** src = env; 281 char** dst = env; 282 for (; src[0] != nullptr; ++src) { 283 if (!__is_valid_environment_variable(src[0])) { 284 continue; 285 } 286 // Remove various unsafe environment variables if we're loading a setuid program. 287 if (is_AT_SECURE && __is_unsafe_environment_variable(src[0])) { 288 continue; 289 } 290 dst[0] = src[0]; 291 ++dst; 292 } 293 dst[0] = nullptr; 294} 295 296static void __initialize_personality() { 297#if !defined(__LP64__) 298 int old_value = personality(0xffffffff); 299 if (old_value == -1) { 300 __libc_fatal("error getting old personality value: %s", strerror(errno)); 301 } 302 303 if (personality((static_cast<unsigned int>(old_value) & ~PER_MASK) | PER_LINUX32) == -1) { 304 __libc_fatal("error setting PER_LINUX32 personality: %s", strerror(errno)); 305 } 306#endif 307} 308 309void __libc_init_AT_SECURE(KernelArgumentBlock& args) { 310 __libc_auxv = args.auxv; 311 312 // Check that the kernel provided a value for AT_SECURE. 313 bool found_AT_SECURE = false; 314 for (ElfW(auxv_t)* v = __libc_auxv; v->a_type != AT_NULL; ++v) { 315 if (v->a_type == AT_SECURE) { 316 found_AT_SECURE = true; 317 break; 318 } 319 } 320 if (!found_AT_SECURE) __early_abort(__LINE__); 321 322 if (getauxval(AT_SECURE)) { 323 // If this is a setuid/setgid program, close the security hole described in 324 // ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:23.stdio.asc 325 __nullify_closed_stdio(); 326 327 __sanitize_environment_variables(args.envp); 328 } 329 330 // Now the environment has been sanitized, make it available. 331 environ = args.envp; 332 333 __initialize_personality(); 334} 335 336/* This function will be called during normal program termination 337 * to run the destructors that are listed in the .fini_array section 338 * of the executable, if any. 339 * 340 * 'fini_array' points to a list of function addresses. The first 341 * entry in the list has value -1, the last one has value 0. 342 */ 343void __libc_fini(void* array) { 344 typedef void (*Dtor)(); 345 Dtor* fini_array = reinterpret_cast<Dtor*>(array); 346 const Dtor minus1 = reinterpret_cast<Dtor>(static_cast<uintptr_t>(-1)); 347 348 // Sanity check - first entry must be -1. 349 if (array == NULL || fini_array[0] != minus1) { 350 return; 351 } 352 353 // Skip over it. 354 fini_array += 1; 355 356 // Count the number of destructors. 357 int count = 0; 358 while (fini_array[count] != NULL) { 359 ++count; 360 } 361 362 // Now call each destructor in reverse order. 363 while (count > 0) { 364 Dtor dtor = fini_array[--count]; 365 366 // Sanity check, any -1 in the list is ignored. 367 if (dtor == minus1) { 368 continue; 369 } 370 371 dtor(); 372 } 373 374#ifndef LIBC_STATIC 375 { 376 extern void __libc_postfini(void) __attribute__((weak)); 377 if (__libc_postfini) { 378 __libc_postfini(); 379 } 380 } 381#endif 382} 383