about summary refs log tree commit diff
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2020-07-07 09:58:45 +0200
committerFlorian Weimer <fweimer@redhat.com>2020-07-07 09:58:45 +0200
commit3ad5dab476205d6e16156cf0511fa6884b3b0fc4 (patch)
tree475e0e5a8a6bd645d664ee989c86c191d1877042
parent08538f360f14dbe2e3b04a30148e342f248d9de5 (diff)
downloadglibc-3ad5dab476205d6e16156cf0511fa6884b3b0fc4.tar.gz
glibc-3ad5dab476205d6e16156cf0511fa6884b3b0fc4.tar.xz
glibc-3ad5dab476205d6e16156cf0511fa6884b3b0fc4.zip
elf: Do not signal LA_ACT_CONSISTENT for an empty namespace [BZ #26076]
The auditing interface identifies namespaces by their first loaded
module.  Once the namespace is empty, it is no longer possible to signal
LA_ACT_CONSISTENT for it because the first loaded module is already gone
at that point.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-rw-r--r--elf/dl-close.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/elf/dl-close.c b/elf/dl-close.c
index 73b2817bbf..8e146ecee1 100644
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -781,8 +781,14 @@ _dl_close_worker (struct link_map *map, bool force)
   if (__glibc_unlikely (do_audit))
     {
       struct link_map *head = ns->_ns_loaded;
-      /* Do not call the functions for any auditing object.  */
-      if (head->l_auditing == 0)
+      /* If head is NULL, the namespace has become empty, and the
+	 audit interface does not give us a way to signal
+	 LA_ACT_CONSISTENT for it because the first loaded module is
+	 used to identify the namespace.
+
+	 Furthermore, do not notify auditors of the cleanup of a
+	 failed audit module loading attempt.  */
+      if (head != NULL && head->l_auditing == 0)
 	{
 	  struct audit_ifaces *afct = GLRO(dl_audit);
 	  for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)