From 3ad5dab476205d6e16156cf0511fa6884b3b0fc4 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 7 Jul 2020 09:58:45 +0200 Subject: elf: Do not signal LA_ACT_CONSISTENT for an empty namespace [BZ #26076] The auditing interface identifies namespaces by their first loaded module. Once the namespace is empty, it is no longer possible to signal LA_ACT_CONSISTENT for it because the first loaded module is already gone at that point. Reviewed-by: Carlos O'Donell --- elf/dl-close.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/elf/dl-close.c b/elf/dl-close.c index 73b2817bbf..8e146ecee1 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -781,8 +781,14 @@ _dl_close_worker (struct link_map *map, bool force) if (__glibc_unlikely (do_audit)) { struct link_map *head = ns->_ns_loaded; - /* Do not call the functions for any auditing object. */ - if (head->l_auditing == 0) + /* If head is NULL, the namespace has become empty, and the + audit interface does not give us a way to signal + LA_ACT_CONSISTENT for it because the first loaded module is + used to identify the namespace. + + Furthermore, do not notify auditors of the cleanup of a + failed audit module loading attempt. */ + if (head != NULL && head->l_auditing == 0) { struct audit_ifaces *afct = GLRO(dl_audit); for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) -- cgit 1.4.1