RELRO not working on Ubuntu 14.04
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| binutils (Ubuntu) |
Fix Released
|
Undecided
|
Taco Screen team | ||
| Trusty |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
RELRO (RELocation Read-Only) is security feature provided by the linker and implemented in conjunction with glibc to relocations sections that are used to resolve dynamically loaded functions read-only.
The GLIBC side looks at the segments placement set by the linker and if they met some criteria regarding alignment, the are mprotect to be read-only. More specifically, on GLIBC code:
elf/dl-reloc.c:
324 void internal_function
325 _dl_protect_relro (struct link_map *l)
326 {
327 ElfW(Addr) start = ((l->l_addr + l->l_relro_addr)
328 & ~(GLRO(dl_pagesize) - 1));
329 ElfW(Addr) end = ((l->l_addr + l->l_relro_addr + l->l_relro_size)
330 & ~(GLRO(dl_pagesize) - 1));
331
332 if (start != end
333 && __mprotect ((void *) start, end - start, PROT_READ) < 0)
334 {
335 static const char errstring[] = N_("\
336 cannot apply additional memory protection after relocation");
337 _dl_signal_error (errno, l->l_name, NULL, errstring);
338 }
339 }
The problem is, if linker does not set the alignment correctly, 'start' and 'end' will be equal and thus not protected. And this is happening on Ubuntu 14.04 due the fact its uses default binutils elf{32,64}-ppc.c ELF_COMMONPAGESIZE to align it to 4k instead of 64k.
There is a recent patch on binutils-dev maillist [1] to change the default for 64k and Fedora rawhide already sets it [2] in its binutils.spec spec:
# On ppc64 and aarch64, we might use 64KiB pages
sed -i -e '/#define.
sed -i -e '/#define.
Ubuntu for powerpc64le should do the same.
[1] https:/
[2] http://
I tested and building a binutils with the ELF_COMMONPAGESIZE set to 64k instead of default 4k and rebuilding GLIBC I see its relocation sections being correctly mprotected.
| tags: | added: architecture-ppc64le bugnameltc-119848 severity-high targetmilestone-inin--- |
| affects: | ubuntu → glibc (Ubuntu) |
| Changed in glibc (Ubuntu): | |
| status: | New → Confirmed |
| assignee: | nobody → Taco Screen team (taco-screen-team) |
| tags: |
added: targetmilestone-inin14042 removed: targetmilestone-inin--- |
| affects: | glibc (Ubuntu) → binutils (Ubuntu) |
| Launchpad Janitor (janitor) wrote | #1 |
| Changed in binutils (Ubuntu): | |
| status: | Confirmed → Fix Released |
| bugproxy (bugproxy) wrote Comment bridged from LTC Bugzilla | #2 |
| bugproxy (bugproxy) wrote | #3 |
| Breno Leitão (breno-leitao) wrote | #4 |
| Steve Langasek (vorlon) wrote Please test proposed package | #5 |
| Changed in binutils (Ubuntu Trusty): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed |
| tags: |
added: verification-done removed: verification-needed |
| Launchpad Janitor (janitor) wrote | #6 |
| Changed in binutils (Ubuntu Trusty): | |
| status: | Fix Committed → Fix Released |
| Steve Langasek (vorlon) wrote Update Released | #7 |
This bug was fixed in the package binutils - 2.25-2ubuntu2
---------------
binutils (2.25-2ubuntu2) vivid; urgency=medium
* Use 64k for COMMONPAGESIZE on powerpc, ppc64 and ppc64el. LP: #1412553.
-- Matthias Klose <email address hidden> Fri, 23 Jan 2015 14:13:08 +0100