Do not print backtraces on fatal glibc errors

If the process is in a bad state, we used to print backtraces in
many cases.  This is problematic because doing so could involve
a lot of work, like loading libgcc_s using the dynamic linker,
and this could itself be targeted by exploit writers.  For example,
if the crashing process was forked from a long-lived process, the
addresses in the error message could be used to bypass ASLR.

Commit ed421fca42fd9b4cab7c66e77894b8dd7ca57ed0 ("Avoid backtrace from
__stack_chk_fail [BZ #12189]"), backtraces where no longer printed
because backtrace_and_maps was always called with do_abort == 1.

Rather than fixing this logic error, this change removes the backtrace
functionality from the sources.  With the prevalence of external crash
handlers, it does not appear to be particularly useful.  The crash
handler may also destroy useful information for debugging.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 73121e5323..d0b235d9d0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,21 @@
+2019-08-19  Florian Weimer  <fweimer@redhat.com>
+
+	Do not print backtraces on fatal errors.
+	* debug/fortify_fail.c (__libc_argv): Remove declaration.
+	(__fortify_fail_abort): Remove definition.
+	(__fortify_fail): Call __libc_message directly.
+	* debug/stack_chk_fail.c (__libc_argv): Remove declaration.
+	(__stack_chk_fail): Call __fortify_fail instead of
+	__fortify_fail_abort.
+	* include/stdio.h (__fortify_fail_abort): Remove declaration.
+	* sysdeps/posix/libc_fatal.c (BEFORE_ABORT, before_abort): Remove
+	definitions.
+	(__libc_message): Do not handle do_backtrace.  Do not call
+	BEFORE_ABORT.
+	(__libc_fatal): Do not pass do_backtrace to __libc_message.
+	* sysdeps/unix/sysv/linux/libc_fatal.c (BEFORE_ABORT)
+	(before_abort): Remove definitions.
+
 2019-08-16  Florian Weimer  <fweimer@redhat.com>
 
 	nptl: Move pthread_attr_getdetachstate implementation into libc.