about summary refs log tree commit diff
path: root/elf/rtld.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2015-10-15 09:23:07 +0200
committerFlorian Weimer <fweimer@redhat.com>2015-10-15 09:23:32 +0200
commita014cecd82b71b70a6a843e250e06b541ad524f7 (patch)
treed402fc41e0212d4feb335c39972752fc5e320d3a /elf/rtld.c
parent0c25f5b5bb48a9d550b5fb403b9a801ba04c146f (diff)
downloadglibc-a014cecd82b71b70a6a843e250e06b541ad524f7.tar.gz
glibc-a014cecd82b71b70a6a843e250e06b541ad524f7.tar.xz
glibc-a014cecd82b71b70a6a843e250e06b541ad524f7.zip
Always enable pointer guard [BZ #18928]
Honoring the LD_POINTER_GUARD environment variable in AT_SECURE mode
has security implications.  This commit enables pointer guard
unconditionally, and the environment variable is now ignored.

        [BZ #18928]
        * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Remove
        _dl_pointer_guard member.
        * elf/rtld.c (_rtld_global_ro): Remove _dl_pointer_guard
        initializer.
        (security_init): Always set up pointer guard.
        (process_envvars): Do not process LD_POINTER_GUARD.
Diffstat (limited to 'elf/rtld.c')
-rw-r--r--elf/rtld.c15
1 files changed, 4 insertions, 11 deletions
diff --git a/elf/rtld.c b/elf/rtld.c
index 1474c72cde..52160dfde6 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -162,7 +162,6 @@ struct rtld_global_ro _rtld_global_ro attribute_relro =
     ._dl_hwcap_mask = HWCAP_IMPORTANT,
     ._dl_lazy = 1,
     ._dl_fpu_control = _FPU_DEFAULT,
-    ._dl_pointer_guard = 1,
     ._dl_pagesize = EXEC_PAGESIZE,
     ._dl_inhibit_cache = 0,
 
@@ -709,15 +708,12 @@ security_init (void)
 #endif
 
   /* Set up the pointer guard as well, if necessary.  */
-  if (GLRO(dl_pointer_guard))
-    {
-      uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
-							     stack_chk_guard);
+  uintptr_t pointer_chk_guard
+    = _dl_setup_pointer_guard (_dl_random, stack_chk_guard);
 #ifdef THREAD_SET_POINTER_GUARD
-      THREAD_SET_POINTER_GUARD (pointer_chk_guard);
+  THREAD_SET_POINTER_GUARD (pointer_chk_guard);
 #endif
-      __pointer_chk_guard_local = pointer_chk_guard;
-    }
+  __pointer_chk_guard_local = pointer_chk_guard;
 
   /* We do not need the _dl_random value anymore.  The less
      information we leave behind, the better, so clear the
@@ -2471,9 +2467,6 @@ process_envvars (enum mode *modep)
 	      GLRO(dl_use_load_bias) = envline[14] == '1' ? -1 : 0;
 	      break;
 	    }
-
-	  if (memcmp (envline, "POINTER_GUARD", 13) == 0)
-	    GLRO(dl_pointer_guard) = envline[14] != '0';
 	  break;
 
 	case 14: