1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* 27 * Copyright (c) 1988 AT&T 28 * All Rights Reserved 29 */ 30 /* 31 * Copyright (c) 2012, Joyent, Inc. All rights reserved. 32 */ 33 34 /* 35 * Run time linker common setup. 36 * 37 * Called from _setup to get the process going at startup. 38 */ 39 40 #include <stdlib.h> 41 #include <fcntl.h> 42 #include <stdio.h> 43 #include <sys/types.h> 44 #include <sys/stat.h> 45 #include <sys/mman.h> 46 #include <string.h> 47 #include <unistd.h> 48 #include <dlfcn.h> 49 #include <sys/sysconfig.h> 50 #include <sys/auxv.h> 51 #include <debug.h> 52 #include <conv.h> 53 #include "_rtld.h" 54 #include "_audit.h" 55 #include "_elf.h" 56 #include "msg.h" 57 58 59 extern int _end, _edata, _etext; 60 extern void _init(void); 61 extern int _brk_unlocked(void *); 62 63 /* needed for _brk_unlocked() */ 64 void *_nd = &_end; 65 66 /* 67 * Counters that are incremented every time an object is mapped/unmapped. 68 * 69 * Note that exec() will usually map 2 objects before we receive control, 70 * but this can be 1 if ld.so.1 is executed directly. We count one of these 71 * here, and add another as necessary in setup(). 72 */ 73 u_longlong_t cnt_map = 1; 74 u_longlong_t cnt_unmap = 0; 75 76 77 /* 78 * Define for the executable's interpreter. 79 * Usually it is ld.so.1, but for the first release of ICL binaries 80 * it is libc.so.1. We keep this information so that we don't end 81 * up mapping libc twice if it is the interpreter. 82 */ 83 static Interp _interp; 84 85 /* 86 * LD_PRELOAD objects. 87 */ 88 static int 89 preload(const char *str, Rt_map *mlmp, Rt_map **clmp) 90 { 91 Alist *palp = NULL; 92 char *objs, *ptr, *next; 93 Word lmflags = lml_main.lm_flags; 94 int lddstub; 95 96 DBG_CALL(Dbg_util_nl(&lml_main, DBG_NL_STD)); 97 98 if ((objs = strdup(str)) == NULL) 99 return (0); 100 101 /* 102 * Determine if we've been called from lddstub. 103 */ 104 lddstub = (lmflags & LML_FLG_TRC_ENABLE) && 105 (FLAGS1(*clmp) & FL1_RT_LDDSTUB); 106 107 108 for (ptr = strtok_r(objs, MSG_ORIG(MSG_STR_DELIMIT), &next); 109 ptr != NULL; 110 ptr = strtok_r(NULL, MSG_ORIG(MSG_STR_DELIMIT), &next)) { 111 Rt_map *nlmp = NULL; 112 uint_t flags; 113 114 DBG_CALL(Dbg_file_preload(&lml_main, ptr)); 115 116 /* 117 * Establish the flags for loading each object. If we're 118 * called via lddstub, then the first preloaded object is the 119 * object being inspected by ldd(1). This object should not be 120 * marked as an interposer, as this object is intended to act 121 * as the target object of the process. 122 */ 123 if (lddstub) 124 flags = FLG_RT_PRELOAD; 125 else 126 flags = (FLG_RT_PRELOAD | FLG_RT_OBJINTPO); 127 128 /* 129 * If this a secure application, then preload errors are 130 * reduced to warnings, as the errors are non-fatal. 131 */ 132 if (rtld_flags & RT_FL_SECURE) 133 rtld_flags2 |= RT_FL2_FTL2WARN; 134 if (expand_paths(*clmp, ptr, &palp, AL_CNT_NEEDED, 135 PD_FLG_EXTLOAD, 0) != 0) 136 nlmp = load_one(&lml_main, ALIST_OFF_DATA, palp, *clmp, 137 MODE(mlmp), flags, 0, NULL); 138 remove_alist(&palp, 0); 139 if (rtld_flags & RT_FL_SECURE) 140 rtld_flags2 &= ~RT_FL2_FTL2WARN; 141 if (nlmp && (bind_one(*clmp, nlmp, BND_NEEDED) == 0)) 142 nlmp = NULL; 143 144 if (lddstub && nlmp) { 145 lddstub = 0; 146 147 /* 148 * Fabricate a binding between the target shared object 149 * and lddstub so that the target object isn't called 150 * out from unused() processing. 151 */ 152 if (lmflags & 153 (LML_FLG_TRC_UNREF | LML_FLG_TRC_UNUSED)) { 154 if (bind_one(*clmp, nlmp, BND_REFER) == 0) 155 nlmp = NULL; 156 } 157 158 /* 159 * By identifying lddstub as the caller, several 160 * confusing ldd() diagnostics get suppressed. These 161 * diagnostics would reveal how the target shared object 162 * was found from lddstub. Now that the real target is 163 * loaded, identify the target as the caller so that all 164 * ldd() diagnostics are enabled for subsequent objects. 165 */ 166 if (nlmp) 167 *clmp = nlmp; 168 } 169 170 /* 171 * If no error occurred with loading this object, indicate that 172 * this link-map list contains an interposer. 173 */ 174 if (nlmp == NULL) { 175 if ((lmflags & LML_FLG_TRC_ENABLE) || 176 (rtld_flags & RT_FL_SECURE)) 177 continue; 178 else 179 return (0); 180 } 181 if (flags & FLG_RT_OBJINTPO) 182 lml_main.lm_flags |= LML_FLG_INTRPOSE; 183 184 } 185 186 free(palp); 187 free(objs); 188 return (1); 189 } 190 191 Rt_map * 192 setup(char **envp, auxv_t *auxv, Word _flags, char *_platform, int _syspagsz, 193 char *_rtldname, ulong_t ld_base, ulong_t interp_base, int fd, Phdr *phdr, 194 char *execname, char **argv, uid_t uid, uid_t euid, gid_t gid, gid_t egid, 195 int auxflags, uint_t *hwcap) 196 { 197 Rt_map *rlmp, *mlmp, *clmp, **tobj = NULL; 198 Ehdr *ehdr; 199 rtld_stat_t status; 200 int features = 0, ldsoexec = 0; 201 size_t eaddr, esize; 202 char *str, *argvname; 203 Word lmflags; 204 mmapobj_result_t *mpp; 205 Fdesc fdr = { 0 }, fdm = { 0 }; 206 Rej_desc rej = { 0 }; 207 APlist *ealp = NULL; 208 209 /* 210 * Now that ld.so has relocated itself, initialize our own 'environ' so 211 * as to establish an address suitable for any libc requirements. 212 */ 213 _environ = (char **)((ulong_t)auxv - sizeof (char *)); 214 _init(); 215 _environ = envp; 216 217 /* 218 * Establish a base time. Total time diagnostics start from entering 219 * ld.so.1 here, however the base time is reset each time the ld.so.1 220 * is re-entered. Note also, there will be a large time associated 221 * with the first diagnostic from ld.so.1, as bootstrapping ld.so.1 222 * and establishing the liblddbg infrastructure takes some time. 223 */ 224 (void) gettimeofday(&DBG_TOTALTIME, NULL); 225 DBG_DELTATIME = DBG_TOTALTIME; 226 227 /* 228 * Determine how ld.so.1 has been executed. 229 */ 230 if ((fd == -1) && (phdr == NULL)) { 231 /* 232 * If we received neither the AT_EXECFD nor the AT_PHDR aux 233 * vector, ld.so.1 must have been invoked directly from the 234 * command line. 235 */ 236 ldsoexec = 1; 237 238 /* 239 * AT_SUN_EXECNAME provides the most precise name, if it is 240 * available, otherwise fall back to argv[0]. At this time, 241 * there is no process name. 242 */ 243 if (execname) 244 rtldname = execname; 245 else if (argv[0]) 246 rtldname = argv[0]; 247 else 248 rtldname = (char *)MSG_INTL(MSG_STR_UNKNOWN); 249 } else { 250 /* 251 * Otherwise, we have a standard process. AT_SUN_EXECNAME 252 * provides the most precise name, if it is available, 253 * otherwise fall back to argv[0]. Provided the application 254 * is already mapped, the process is the application, so 255 * simplify the application name for use in any diagnostics. 256 */ 257 if (execname) 258 argvname = execname; 259 else if (argv[0]) 260 argvname = execname = argv[0]; 261 else 262 argvname = execname = (char *)MSG_INTL(MSG_STR_UNKNOWN); 263 264 if (fd == -1) { 265 if ((str = strrchr(argvname, '/')) != NULL) 266 procname = ++str; 267 else 268 procname = argvname; 269 } 270 271 /* 272 * At this point, we don't know the runtime linkers full path 273 * name. The _rtldname passed to us is the SONAME of the 274 * runtime linker, which is typically /lib/ld.so.1 no matter 275 * what the full path is. Use this for now, we'll reset the 276 * runtime linkers name once the application is analyzed. 277 */ 278 if (_rtldname) { 279 if ((str = strrchr(_rtldname, '/')) != NULL) 280 rtldname = ++str; 281 else 282 rtldname = _rtldname; 283 } else 284 rtldname = (char *)MSG_INTL(MSG_STR_UNKNOWN); 285 286 /* exec() brought in two objects for us. Count the second one */ 287 cnt_map++; 288 } 289 290 /* 291 * Initialize any global variables. 292 */ 293 at_flags = _flags; 294 295 if ((org_scapset->sc_plat = _platform) != NULL) 296 org_scapset->sc_platsz = strlen(_platform); 297 298 if (org_scapset->sc_plat == NULL) 299 platform_name(org_scapset); 300 if (org_scapset->sc_mach == NULL) 301 machine_name(org_scapset); 302 303 /* 304 * If pagesize is unspecified find its value. 305 */ 306 if ((syspagsz = _syspagsz) == 0) 307 syspagsz = _sysconfig(_CONFIG_PAGESIZE); 308 309 /* 310 * Add the unused portion of the last data page to the free space list. 311 * The page size must be set before doing this. Here, _end refers to 312 * the end of the runtime linkers bss. Note that we do not use the 313 * unused data pages from any included .so's to supplement this free 314 * space as badly behaved .os's may corrupt this data space, and in so 315 * doing ruin our data. 316 */ 317 eaddr = S_DROUND((size_t)&_end); 318 esize = eaddr % syspagsz; 319 if (esize) { 320 esize = syspagsz - esize; 321 addfree((void *)eaddr, esize); 322 } 323 324 /* 325 * Establish initial link-map list flags, and link-map list alists. 326 */ 327 if (alist_append(&lml_main.lm_lists, NULL, sizeof (Lm_cntl), 328 AL_CNT_LMLISTS) == NULL) 329 return (0); 330 lml_main.lm_flags |= LML_FLG_BASELM; 331 lml_main.lm_lmid = LM_ID_BASE; 332 lml_main.lm_lmidstr = (char *)MSG_ORIG(MSG_LMID_BASE); 333 334 if (alist_append(&lml_rtld.lm_lists, NULL, sizeof (Lm_cntl), 335 AL_CNT_LMLISTS) == NULL) 336 return (0); 337 lml_rtld.lm_flags |= (LML_FLG_RTLDLM | LML_FLG_HOLDLOCK); 338 lml_rtld.lm_tflags |= LML_TFLG_NOAUDIT; 339 lml_rtld.lm_lmid = LM_ID_LDSO; 340 lml_rtld.lm_lmidstr = (char *)MSG_ORIG(MSG_LMID_LDSO); 341 342 /* 343 * Determine whether we have a secure executable. 344 */ 345 security(uid, euid, gid, egid, auxflags); 346 347 /* 348 * Make an initial pass of environment variables to pick off those 349 * related to locale processing. At the same time, collect and save 350 * any LD_XXXX variables for later processing. Note that this later 351 * processing will be skipped if ld.so.1 is invoked from the command 352 * line with -e LD_NOENVIRON. 353 */ 354 if (envp && (readenv_user((const char **)envp, &ealp) == 1)) 355 return (0); 356 357 /* 358 * If ld.so.1 has been invoked directly, process its arguments. 359 */ 360 if (ldsoexec) { 361 /* 362 * Process any arguments that are specific to ld.so.1, and 363 * reorganize the process stack to effectively remove ld.so.1 364 * from the stack. Reinitialize the environment pointer, as 365 * this pointer may have been shifted after skipping ld.so.1's 366 * arguments. 367 */ 368 if (rtld_getopt(argv, &envp, &auxv, &(lml_main.lm_flags), 369 &(lml_main.lm_tflags)) == 1) { 370 eprintf(&lml_main, ERR_NONE, MSG_INTL(MSG_USG_BADOPT)); 371 return (0); 372 } 373 _environ = envp; 374 375 /* 376 * Open the object that ld.so.1 is to execute. 377 */ 378 argvname = execname = argv[0]; 379 380 if ((fd = open(argvname, O_RDONLY)) == -1) { 381 int err = errno; 382 eprintf(&lml_main, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), 383 argvname, strerror(err)); 384 return (0); 385 } 386 } 387 388 /* 389 * Having processed any ld.so.1 command line options, return to process 390 * any LD_XXXX environment variables. 391 */ 392 if (ealp) { 393 if (((rtld_flags & RT_FL_NOENVIRON) == 0) && 394 (procenv_user(ealp, &(lml_main.lm_flags), 395 &(lml_main.lm_tflags)) == 1)) 396 return (0); 397 free(ealp); 398 } 399 400 /* 401 * Initialize a hardware capability descriptor for use in comparing 402 * each loaded object. The aux vector must provide AF_SUN_HWCAPVERIFY, 403 * as prior to this setting any hardware capabilities that were found 404 * could not be relied upon. 405 */ 406 if (auxflags & AF_SUN_HWCAPVERIFY) { 407 rtld_flags2 |= RT_FL2_HWCAP; 408 org_scapset->sc_hw_1 = (Xword)hwcap[0]; 409 org_scapset->sc_hw_2 = (Xword)hwcap[1]; 410 } 411 412 /* 413 * Create a mapping descriptor for ld.so.1. We can determine our 414 * two segments information from known symbols. 415 */ 416 if ((mpp = calloc(2, sizeof (mmapobj_result_t))) == NULL) 417 return (0); 418 mpp[0].mr_addr = (caddr_t)M_PTRUNC(ld_base); 419 mpp[0].mr_msize = (caddr_t)&_etext - mpp[0].mr_addr; 420 mpp[0].mr_fsize = mpp[0].mr_msize; 421 mpp[0].mr_prot = (PROT_READ | PROT_EXEC); 422 423 mpp[1].mr_addr = (caddr_t)M_PTRUNC((uintptr_t)&r_debug); 424 mpp[1].mr_msize = (caddr_t)&_end - mpp[1].mr_addr; 425 mpp[1].mr_fsize = (caddr_t)&_edata - mpp[1].mr_addr; 426 mpp[1].mr_prot = (PROT_READ | PROT_WRITE | PROT_EXEC); 427 428 if ((fdr.fd_nname = stravl_insert(_rtldname, 0, 0, 0)) == NULL) 429 return (0); 430 if ((rlmp = elf_new_lmp(&lml_rtld, ALIST_OFF_DATA, &fdr, 431 (Addr)mpp->mr_addr, (size_t)((uintptr_t)eaddr - (uintptr_t)ld_base), 432 NULL, NULL, NULL)) == NULL) 433 return (0); 434 435 MMAPS(rlmp) = mpp; 436 MMAPCNT(rlmp) = 2; 437 PADSTART(rlmp) = (ulong_t)mpp[0].mr_addr; 438 PADIMLEN(rlmp) = (ulong_t)mpp[0].mr_addr + (ulong_t)mpp[1].mr_addr + 439 (ulong_t)mpp[1].mr_msize; 440 441 MODE(rlmp) |= (RTLD_LAZY | RTLD_NODELETE | RTLD_GLOBAL | RTLD_WORLD); 442 FLAGS(rlmp) |= (FLG_RT_ANALYZED | FLG_RT_RELOCED | FLG_RT_INITDONE | 443 FLG_RT_INITCLCT | FLG_RT_FINICLCT | FLG_RT_MODESET); 444 445 /* 446 * Initialize the runtime linkers information. 447 */ 448 interp = &_interp; 449 interp->i_name = (char *)rtldname; 450 interp->i_faddr = (caddr_t)ADDR(rlmp); 451 ldso_plt_init(rlmp); 452 453 /* 454 * Map in the file, if exec has not already done so, or if the file 455 * was passed as an argument to an explicit execution of ld.so.1 from 456 * the command line. 457 */ 458 if (fd != -1) { 459 /* 460 * Map the file. Once the object is mapped we no longer need 461 * the file descriptor. 462 */ 463 (void) rtld_fstat(fd, &status); 464 fdm.fd_oname = argvname; 465 fdm.fd_ftp = map_obj(&lml_main, &fdm, status.st_size, argvname, 466 fd, &rej); 467 (void) close(fd); 468 469 if (fdm.fd_ftp == NULL) { 470 Conv_reject_desc_buf_t rej_buf; 471 472 eprintf(&lml_main, ERR_FATAL, 473 MSG_INTL(err_reject[rej.rej_type]), argvname, 474 conv_reject_desc(&rej, &rej_buf, M_MACH)); 475 return (0); 476 } 477 478 /* 479 * Finish processing the loading of the file. 480 */ 481 if ((fdm.fd_nname = stravl_insert(argvname, 0, 0, 0)) == NULL) 482 return (0); 483 fdm.fd_dev = status.st_dev; 484 fdm.fd_ino = status.st_ino; 485 486 if ((mlmp = load_file(&lml_main, ALIST_OFF_DATA, NULL, &fdm, 487 NULL)) == NULL) 488 return (0); 489 490 /* 491 * We now have a process name for error diagnostics. 492 */ 493 if ((str = strrchr(argvname, '/')) != NULL) 494 procname = ++str; 495 else 496 procname = argvname; 497 498 if (ldsoexec) { 499 mmapobj_result_t *mpp = MMAPS(mlmp); 500 uint_t mnum, mapnum = MMAPCNT(mlmp); 501 void *brkbase = NULL; 502 503 /* 504 * Since ld.so.1 was the primary executed object - the 505 * brk() base has not yet been initialized, we need to 506 * initialize it. For an executable, initialize it to 507 * the end of the object. For a shared object (ET_DYN) 508 * initialize it to the first page in memory. 509 */ 510 for (mnum = 0; mnum < mapnum; mnum++, mpp++) 511 brkbase = mpp->mr_addr + mpp->mr_msize; 512 513 if (brkbase == NULL) 514 brkbase = (void *)syspagsz; 515 516 if (_brk_unlocked(brkbase) == -1) { 517 int err = errno; 518 519 eprintf(&lml_main, ERR_FATAL, 520 MSG_INTL(MSG_SYS_BRK), argvname, 521 strerror(err)); 522 return (0); 523 } 524 } 525 } else { 526 if (phdr != NULL) { 527 Phdr *pptr; 528 Off i_offset = 0; 529 Addr base = 0; 530 ulong_t phsize; 531 mmapobj_result_t *mpp, *fmpp, *hmpp = NULL; 532 uint_t mapnum = 0; 533 int i; 534 size_t msize; 535 536 /* 537 * Using the executables phdr address determine the base 538 * address of the input file. NOTE, this assumes the 539 * program headers and elf header are part of the same 540 * mapped segment. Although this has held for many 541 * years now, it might be more flexible if the kernel 542 * gave use the ELF headers start address, rather than 543 * the Program headers. 544 * 545 * Determine from the ELF header if we're been called 546 * from a shared object or dynamic executable. If the 547 * latter, then any addresses within the object are used 548 * as is. Addresses within shared objects must be added 549 * to the process's base address. 550 */ 551 ehdr = (Ehdr *)((Addr)phdr - phdr->p_offset); 552 phsize = ehdr->e_phentsize; 553 if (ehdr->e_type == ET_DYN) 554 base = (Addr)ehdr; 555 556 /* 557 * Allocate a mapping array to retain mapped segment 558 * information. 559 */ 560 if ((fmpp = mpp = calloc(ehdr->e_phnum, 561 sizeof (mmapobj_result_t))) == NULL) 562 return (0); 563 564 /* 565 * Extract the needed information from the segment 566 * headers. 567 */ 568 for (i = 0, pptr = phdr; i < ehdr->e_phnum; i++) { 569 if (pptr->p_type == PT_INTERP) { 570 i_offset = pptr->p_offset; 571 interp->i_faddr = 572 (caddr_t)interp_base; 573 } 574 if ((pptr->p_type == PT_LOAD) && 575 (pptr->p_filesz || pptr->p_memsz)) { 576 int perm = (PROT_READ | PROT_EXEC); 577 size_t off; 578 579 if (i_offset && pptr->p_filesz && 580 (i_offset >= pptr->p_offset) && 581 (i_offset <= 582 (pptr->p_memsz + pptr->p_offset))) { 583 interp->i_name = (char *) 584 pptr->p_vaddr + i_offset - 585 pptr->p_offset + base; 586 i_offset = 0; 587 } 588 589 if (pptr->p_flags & PF_W) 590 perm |= PROT_WRITE; 591 592 /* 593 * Retain segments mapping info. Round 594 * each segment to a page boundary, as 595 * this insures addresses are suitable 596 * for mprotect() if required. 597 */ 598 off = pptr->p_vaddr + base; 599 if (hmpp == NULL) { 600 hmpp = mpp; 601 mpp->mr_addr = (caddr_t)ehdr; 602 } else 603 mpp->mr_addr = (caddr_t)off; 604 605 off -= (size_t)(uintptr_t)mpp->mr_addr; 606 mpp->mr_msize = pptr->p_memsz + off; 607 mpp->mr_fsize = pptr->p_filesz + off; 608 mpp->mr_prot = perm; 609 610 mpp++, mapnum++; 611 } 612 613 pptr = (Phdr *)((ulong_t)pptr + phsize); 614 } 615 616 mpp--; 617 msize = (size_t)(mpp->mr_addr + mpp->mr_msize) - 618 S_ALIGN((size_t)fmpp->mr_addr, syspagsz); 619 620 if ((fdm.fd_nname = 621 stravl_insert(execname, 0, 0, 0)) == NULL) 622 return (0); 623 if ((mlmp = elf_new_lmp(&lml_main, ALIST_OFF_DATA, 624 &fdm, (Addr)hmpp->mr_addr, msize, 625 NULL, NULL, NULL)) == NULL) 626 return (0); 627 628 MMAPS(mlmp) = fmpp; 629 MMAPCNT(mlmp) = mapnum; 630 PADSTART(mlmp) = (ulong_t)fmpp->mr_addr; 631 PADIMLEN(mlmp) = (ulong_t)fmpp->mr_addr + 632 (ulong_t)mpp->mr_addr + (ulong_t)mpp->mr_msize; 633 } 634 } 635 636 /* 637 * Establish the interpretors name as that defined within the initial 638 * object (executable). This provides for ORIGIN processing of ld.so.1 639 * dependencies. Note, the NAME() of the object remains that which was 640 * passed to us as the SONAME on execution. 641 */ 642 if (ldsoexec == 0) { 643 size_t len = strlen(interp->i_name); 644 645 if (expand(&interp->i_name, &len, 0, 0, 646 (PD_TKN_ISALIST | PD_TKN_CAP), rlmp) & PD_TKN_RESOLVED) 647 fdr.fd_flags |= FLG_FD_RESOLVED; 648 } 649 fdr.fd_pname = interp->i_name; 650 (void) fullpath(rlmp, &fdr); 651 652 /* 653 * The runtime linker acts as a filtee for various dl*() functions that 654 * are defined in libc (and libdl). Make sure this standard name for 655 * the runtime linker is also registered in the FullPathNode AVL tree. 656 */ 657 (void) fpavl_insert(&lml_rtld, rlmp, _rtldname, 0); 658 659 /* 660 * Having established the true runtime linkers name, simplify the name 661 * for error diagnostics. 662 */ 663 if ((str = strrchr(PATHNAME(rlmp), '/')) != NULL) 664 rtldname = ++str; 665 else 666 rtldname = PATHNAME(rlmp); 667 668 /* 669 * Expand the fullpath name of the application. This typically occurs 670 * as a part of loading an object, but as the kernel probably mapped 671 * it in, complete this processing now. 672 */ 673 (void) fullpath(mlmp, 0); 674 675 /* 676 * Some troublesome programs will change the value of argv[0]. Dupping 677 * the process string protects us, and insures the string is left in 678 * any core files. 679 */ 680 if ((str = (char *)strdup(procname)) == NULL) 681 return (0); 682 procname = str; 683 684 FLAGS(mlmp) |= (FLG_RT_ISMAIN | FLG_RT_MODESET); 685 FLAGS1(mlmp) |= FL1_RT_USED; 686 687 /* 688 * It's the responsibility of MAIN(crt0) to call it's _init and _fini 689 * section, therefore null out any INIT/FINI so that this object isn't 690 * collected during tsort processing. And, if the application has no 691 * initarray or finiarray we can economize on establishing bindings. 692 */ 693 INIT(mlmp) = FINI(mlmp) = NULL; 694 if ((INITARRAY(mlmp) == NULL) && (FINIARRAY(mlmp) == NULL)) 695 FLAGS1(mlmp) |= FL1_RT_NOINIFIN; 696 697 /* 698 * Identify lddstub if necessary. 699 */ 700 if (lml_main.lm_flags & LML_FLG_TRC_LDDSTUB) 701 FLAGS1(mlmp) |= FL1_RT_LDDSTUB; 702 703 /* 704 * Retain our argument information for use in dlinfo. 705 */ 706 argsinfo.dla_argv = argv--; 707 argsinfo.dla_argc = (long)*argv; 708 argsinfo.dla_envp = envp; 709 argsinfo.dla_auxv = auxv; 710 711 (void) enter(0); 712 713 /* 714 * Add our two main link-maps to the dynlm_list 715 */ 716 if (aplist_append(&dynlm_list, &lml_main, AL_CNT_DYNLIST) == NULL) 717 return (0); 718 719 if (aplist_append(&dynlm_list, &lml_rtld, AL_CNT_DYNLIST) == NULL) 720 return (0); 721 722 /* 723 * Reset the link-map counts for both lists. The init count is used to 724 * track how many objects have pending init sections, this gets incre- 725 * mented each time an object is relocated. Since ld.so.1 relocates 726 * itself, it's init count will remain zero. 727 * The object count is used to track how many objects have pending fini 728 * sections, as ld.so.1 handles its own fini we can zero its count. 729 */ 730 lml_main.lm_obj = 1; 731 lml_rtld.lm_obj = 0; 732 733 /* 734 * Initialize debugger information structure. Some parts of this 735 * structure were initialized statically. 736 */ 737 r_debug.rtd_rdebug.r_map = (Link_map *)lml_main.lm_head; 738 r_debug.rtd_rdebug.r_ldsomap = (Link_map *)lml_rtld.lm_head; 739 r_debug.rtd_rdebug.r_ldbase = r_debug.rtd_rdebug.r_ldsomap->l_addr; 740 r_debug.rtd_dynlmlst = &dynlm_list; 741 742 /* 743 * Determine the dev/inode information for the executable to complete 744 * load_so() checking for those who might call dlopen(3c) on the 745 * executable . 746 */ 747 if (rtld_stat(PATHNAME(mlmp), &status) == 0) { 748 STDEV(mlmp) = status.st_dev; 749 STINO(mlmp) = status.st_ino; 750 } 751 752 /* 753 * Initialize any configuration information. 754 */ 755 if (!(rtld_flags & RT_FL_NOCFG)) { 756 if ((features = elf_config(mlmp)) == -1) 757 return (0); 758 } 759 760 #if defined(_ELF64) 761 /* 762 * If this is a 64-bit process, determine whether this process has 763 * restricted the process address space to 32-bits. Any dependencies 764 * that are restricted to a 32-bit address space can only be loaded if 765 * the executable has established this requirement. 766 */ 767 if (CAPSET(mlmp).sc_sf_1 & SF1_SUNW_ADDR32) 768 rtld_flags2 |= RT_FL2_ADDR32; 769 #endif 770 /* 771 * Establish any alternative capabilities, and validate this object 772 * if it defines it's own capabilities information. 773 */ 774 if (cap_alternative() == 0) 775 return (0); 776 777 if (cap_check_lmp(mlmp, &rej) == 0) { 778 if (lml_main.lm_flags & LML_FLG_TRC_ENABLE) { 779 /* LINTED */ 780 (void) printf(MSG_INTL(ldd_warn[rej.rej_type]), 781 NAME(mlmp), rej.rej_str); 782 } else { 783 /* LINTED */ 784 eprintf(&lml_main, ERR_FATAL, 785 MSG_INTL(err_reject[rej.rej_type]), 786 NAME(mlmp), rej.rej_str); 787 return (0); 788 } 789 } 790 791 /* 792 * Establish the modes of the initial object. These modes are 793 * propagated to any preloaded objects and explicit shared library 794 * dependencies. 795 * 796 * If we're generating a configuration file using crle(1), remove 797 * any RTLD_NOW use, as we don't want to trigger any relocation proc- 798 * essing during crle(1)'s first past (this would just be unnecessary 799 * overhead). Any filters are explicitly loaded, and thus RTLD_NOW is 800 * not required to trigger filter loading. 801 * 802 * Note, RTLD_NOW may have been established during analysis of the 803 * application had the application been built -z now. 804 */ 805 MODE(mlmp) |= (RTLD_NODELETE | RTLD_GLOBAL | RTLD_WORLD); 806 807 if (rtld_flags & RT_FL_CONFGEN) { 808 MODE(mlmp) |= RTLD_CONFGEN; 809 MODE(mlmp) &= ~RTLD_NOW; 810 rtld_flags2 &= ~RT_FL2_BINDNOW; 811 } 812 813 if ((MODE(mlmp) & RTLD_NOW) == 0) { 814 if (rtld_flags2 & RT_FL2_BINDNOW) 815 MODE(mlmp) |= RTLD_NOW; 816 else 817 MODE(mlmp) |= RTLD_LAZY; 818 } 819 820 /* 821 * If debugging was requested initialize things now that any cache has 822 * been established. A user can specify LD_DEBUG=help to discover the 823 * list of debugging tokens available without running the application. 824 * However, don't allow this setting from a configuration file. 825 * 826 * Note, to prevent recursion issues caused by loading and binding the 827 * debugging libraries themselves, a local debugging descriptor is 828 * initialized. Once the debugging setup has completed, this local 829 * descriptor is copied to the global descriptor which effectively 830 * enables diagnostic output. 831 * 832 * Ignore any debugging request if we're being monitored by a process 833 * that expects the old getpid() initialization handshake. 834 */ 835 if ((rpl_debug || prm_debug) && ((rtld_flags & RT_FL_DEBUGGER) == 0)) { 836 Dbg_desc _dbg_desc = {0}; 837 struct timeval total = DBG_TOTALTIME; 838 struct timeval delta = DBG_DELTATIME; 839 840 if (rpl_debug) { 841 if (dbg_setup(rpl_debug, &_dbg_desc) == 0) 842 return (0); 843 if (_dbg_desc.d_extra & DBG_E_HELP_EXIT) 844 rtldexit(&lml_main, 0); 845 } 846 if (prm_debug) 847 (void) dbg_setup(prm_debug, &_dbg_desc); 848 849 *dbg_desc = _dbg_desc; 850 DBG_TOTALTIME = total; 851 DBG_DELTATIME = delta; 852 } 853 854 /* 855 * Now that debugging is enabled generate any diagnostics from any 856 * previous events. 857 */ 858 if (DBG_ENABLED) { 859 DBG_CALL(Dbg_cap_val(&lml_main, org_scapset, alt_scapset, 860 M_MACH)); 861 DBG_CALL(Dbg_file_config_dis(&lml_main, config->c_name, 862 features)); 863 864 DBG_CALL(Dbg_file_ldso(rlmp, envp, auxv, 865 LIST(rlmp)->lm_lmidstr, ALIST_OFF_DATA)); 866 867 if (THIS_IS_ELF(mlmp)) { 868 DBG_CALL(Dbg_file_elf(&lml_main, PATHNAME(mlmp), 869 ADDR(mlmp), MSIZE(mlmp), LIST(mlmp)->lm_lmidstr, 870 ALIST_OFF_DATA)); 871 } 872 } 873 874 /* 875 * Enable auditing. 876 */ 877 if (rpl_audit || prm_audit || profile_lib) { 878 int ndx; 879 const char *aud[3]; 880 881 aud[0] = rpl_audit; 882 aud[1] = prm_audit; 883 aud[2] = profile_lib; 884 885 /* 886 * Any global auditing (set using LD_AUDIT or LD_PROFILE) that 887 * can't be established is non-fatal. 888 */ 889 if ((auditors = calloc(1, sizeof (Audit_desc))) == NULL) 890 return (0); 891 892 for (ndx = 0; ndx < 3; ndx++) { 893 if (aud[ndx]) { 894 if ((auditors->ad_name = 895 strdup(aud[ndx])) == NULL) 896 return (0); 897 rtld_flags2 |= RT_FL2_FTL2WARN; 898 (void) audit_setup(mlmp, auditors, 899 PD_FLG_EXTLOAD, NULL); 900 rtld_flags2 &= ~RT_FL2_FTL2WARN; 901 } 902 } 903 lml_main.lm_tflags |= auditors->ad_flags; 904 } 905 if (AUDITORS(mlmp)) { 906 /* 907 * Any object required auditing (set with a DT_DEPAUDIT dynamic 908 * entry) that can't be established is fatal. 909 */ 910 if (FLAGS1(mlmp) & FL1_RT_GLOBAUD) { 911 /* 912 * If this object requires global auditing, use the 913 * local auditing information to set the global 914 * auditing descriptor. The effect is that a 915 * DT_DEPAUDIT act as an LD_AUDIT. 916 */ 917 if ((auditors == NULL) && ((auditors = calloc(1, 918 sizeof (Audit_desc))) == NULL)) 919 return (0); 920 921 auditors->ad_name = AUDITORS(mlmp)->ad_name; 922 if (audit_setup(mlmp, auditors, 0, NULL) == 0) 923 return (0); 924 lml_main.lm_tflags |= auditors->ad_flags; 925 926 /* 927 * Clear the local auditor information. 928 */ 929 free((void *) AUDITORS(mlmp)); 930 AUDITORS(mlmp) = NULL; 931 932 } else { 933 /* 934 * Establish any local auditing. 935 */ 936 if (audit_setup(mlmp, AUDITORS(mlmp), 0, NULL) == 0) 937 return (0); 938 939 AFLAGS(mlmp) |= AUDITORS(mlmp)->ad_flags; 940 lml_main.lm_flags |= LML_FLG_LOCAUDIT; 941 } 942 } 943 944 /* 945 * Explicitly add the initial object and ld.so.1 to those objects being 946 * audited. Note, although the ld.so.1 link-map isn't auditable, 947 * establish a cookie for ld.so.1 as this may be bound to via the 948 * dl*() family. 949 */ 950 if ((lml_main.lm_tflags | AFLAGS(mlmp)) & LML_TFLG_AUD_MASK) { 951 if (((audit_objopen(mlmp, mlmp) == 0) || 952 (audit_objopen(mlmp, rlmp) == 0)) && 953 (AFLAGS(mlmp) & LML_TFLG_AUD_MASK)) 954 return (0); 955 } 956 957 /* 958 * Map in any preloadable shared objects. Establish the caller as the 959 * head of the main link-map list. In the case of being exercised from 960 * lddstub, the caller gets reassigned to the first target shared object 961 * so as to provide intuitive diagnostics from ldd(). 962 * 963 * Note, it is valid to preload a 4.x shared object with a 5.0 964 * executable (or visa-versa), as this functionality is required by 965 * ldd(1). 966 */ 967 clmp = mlmp; 968 if (rpl_preload && (preload(rpl_preload, mlmp, &clmp) == 0)) 969 return (0); 970 if (prm_preload && (preload(prm_preload, mlmp, &clmp) == 0)) 971 return (0); 972 973 /* 974 * Load all dependent (needed) objects. 975 */ 976 if (analyze_lmc(&lml_main, ALIST_OFF_DATA, mlmp, mlmp, NULL) == NULL) 977 return (0); 978 979 /* 980 * Relocate all the dependencies we've just added. 981 * 982 * If this process has been established via crle(1), the environment 983 * variable LD_CONFGEN will have been set. crle(1) may create this 984 * process twice. The first time crle only needs to gather dependency 985 * information. The second time, is to dldump() the images. 986 * 987 * If we're only gathering dependencies, relocation is unnecessary. 988 * As crle(1) may be building an arbitrary family of objects, they may 989 * not fully relocate either. Hence the relocation phase is not carried 990 * out now, but will be called by crle(1) once all objects have been 991 * loaded. 992 */ 993 if ((rtld_flags & RT_FL_CONFGEN) == 0) { 994 995 DBG_CALL(Dbg_util_nl(&lml_main, DBG_NL_STD)); 996 997 if (relocate_lmc(&lml_main, ALIST_OFF_DATA, mlmp, 998 mlmp, NULL) == 0) 999 return (0); 1000 1001 /* 1002 * Inform the debuggers that basic process initialization is 1003 * complete, and that the state of ld.so.1 (link-map lists, 1004 * etc.) is stable. This handshake enables the debugger to 1005 * initialize themselves, and consequently allows the user to 1006 * set break points in .init code. 1007 * 1008 * Most new debuggers use librtld_db to monitor activity events. 1009 * Older debuggers indicated their presence by setting the 1010 * DT_DEBUG entry in the dynamic executable (see elf_new_lm()). 1011 * In this case, getpid() is called so that the debugger can 1012 * catch the system call. This old mechanism has some 1013 * restrictions, as getpid() should not be called prior to 1014 * basic process initialization being completed. This 1015 * restriction has become increasingly difficult to maintain, 1016 * as the use of auditors, LD_DEBUG, and the initialization 1017 * handshake with libc can result in "premature" getpid() 1018 * calls. The use of this getpid() handshake is expected to 1019 * disappear at some point in the future, and there is intent 1020 * to work towards that goal. 1021 */ 1022 rd_event(&lml_main, RD_DLACTIVITY, RT_CONSISTENT); 1023 rd_event(&lml_rtld, RD_DLACTIVITY, RT_CONSISTENT); 1024 1025 if (rtld_flags & RT_FL_DEBUGGER) { 1026 r_debug.rtd_rdebug.r_flags |= RD_FL_ODBG; 1027 (void) getpid(); 1028 } 1029 } 1030 1031 /* 1032 * Indicate preinit activity, and call any auditing routines. These 1033 * routines are called before initializing any threads via libc, or 1034 * before collecting the complete set of .inits on the primary link-map. 1035 * Although most libc interfaces are encapsulated in local routines 1036 * within libc, they have been known to escape (ie. call a .plt). As 1037 * the appcert auditor uses preinit as a trigger to establish some 1038 * external interfaces to the main link-maps libc, we need to activate 1039 * this trigger before exercising any code within libc. Additionally, 1040 * I wouldn't put it past an auditor to add additional objects to the 1041 * primary link-map. Hence, we collect .inits after the audit call. 1042 */ 1043 rd_event(&lml_main, RD_PREINIT, 0); 1044 1045 if (aud_activity || 1046 ((lml_main.lm_tflags | AFLAGS(mlmp)) & LML_TFLG_AUD_ACTIVITY)) 1047 audit_activity(mlmp, LA_ACT_CONSISTENT); 1048 if (aud_preinit || 1049 ((lml_main.lm_tflags | AFLAGS(mlmp)) & LML_TFLG_AUD_PREINIT)) 1050 audit_preinit(mlmp); 1051 1052 /* 1053 * If we're creating initial configuration information, we're done 1054 * now that the auditing step has been called. 1055 */ 1056 if (rtld_flags & RT_FL_CONFGEN) { 1057 leave(LIST(mlmp), 0); 1058 return (mlmp); 1059 } 1060 1061 /* 1062 * Sort the .init sections of all objects we've added. If we're 1063 * tracing we only need to execute this under ldd(1) with the -i or -u 1064 * options. 1065 */ 1066 lmflags = lml_main.lm_flags; 1067 if (((lmflags & LML_FLG_TRC_ENABLE) == 0) || 1068 (lmflags & (LML_FLG_TRC_INIT | LML_FLG_TRC_UNREF))) { 1069 if ((tobj = tsort(mlmp, LIST(mlmp)->lm_init, 1070 RT_SORT_REV)) == (Rt_map **)S_ERROR) 1071 return (0); 1072 } 1073 1074 /* 1075 * If we are tracing we're done. This is the one legitimate use of a 1076 * direct call to rtldexit() rather than return, as we don't want to 1077 * return and jump to the application. 1078 */ 1079 if (lmflags & LML_FLG_TRC_ENABLE) { 1080 unused(&lml_main); 1081 rtldexit(&lml_main, 0); 1082 } 1083 1084 /* 1085 * Check if this instance of the linker should have a primary link 1086 * map. This flag allows multiple copies of the -same- -version- 1087 * of the linker (and libc) to run in the same address space. 1088 * 1089 * Without this flag we only support one copy of the linker in a 1090 * process because by default the linker will always try to 1091 * initialize at one primary link map The copy of libc which is 1092 * initialized on a primary link map will initialize global TLS 1093 * data which can be shared with other copies of libc in the 1094 * process. The problem is that if there is more than one copy 1095 * of the linker, only one copy should link libc onto a primary 1096 * link map, otherwise libc will attempt to re-initialize global 1097 * TLS data. So when a copy of the linker is loaded with this 1098 * flag set, it will not initialize any primary link maps since 1099 * presumably another copy of the linker will do this. 1100 * 1101 * Note that this flag only allows multiple copies of the -same- 1102 * -version- of the linker (and libc) to coexist. This approach 1103 * will not work if we are trying to load different versions of 1104 * the linker and libc into the same process. The reason for 1105 * this is that the format of the global TLS data may not be 1106 * the same for different versions of libc. In this case each 1107 * different version of libc must have it's own primary link map 1108 * and be able to maintain it's own TLS data. The only way this 1109 * can be done is by carefully managing TLS pointers on transitions 1110 * between code associated with each of the different linkers. 1111 * Note that this is actually what is done for processes in lx 1112 * branded zones. Although in the lx branded zone case, the 1113 * other linker and libc are actually gld and glibc. But the 1114 * same general TLS management mechanism used by the lx brand 1115 * would apply to any attempts to run multiple versions of the 1116 * solaris linker and libc in a single process. 1117 */ 1118 if (auxflags & AF_SUN_NOPLM) 1119 rtld_flags2 |= RT_FL2_NOPLM; 1120 1121 /* 1122 * Establish any static TLS for this primary link-map. Note, regardless 1123 * of whether TLS is available, an initial handshake occurs with libc to 1124 * indicate we're processing the primary link-map. Having identified 1125 * the primary link-map, initialize threads. 1126 */ 1127 if (rt_get_extern(&lml_main, mlmp) == 0) 1128 return (0); 1129 1130 if ((rtld_flags2 & RT_FL2_NOPLM) == 0) { 1131 if (tls_statmod(&lml_main, mlmp) == 0) 1132 return (0); 1133 rt_thr_init(&lml_main); 1134 rtld_flags2 |= RT_FL2_PLMSETUP; 1135 } else { 1136 rt_thr_init(&lml_main); 1137 } 1138 1139 /* 1140 * Fire all dependencies .init sections. Identify any unused 1141 * dependencies, and leave the runtime linker - effectively calling 1142 * the dynamic executables entry point. 1143 */ 1144 call_array(PREINITARRAY(mlmp), (uint_t)PREINITARRAYSZ(mlmp), mlmp, 1145 SHT_PREINIT_ARRAY); 1146 1147 if (tobj) 1148 call_init(tobj, DBG_INIT_SORT); 1149 1150 rd_event(&lml_main, RD_POSTINIT, 0); 1151 1152 unused(&lml_main); 1153 1154 DBG_CALL(Dbg_util_call_main(mlmp)); 1155 1156 rtld_flags |= (RT_FL_OPERATION | RT_FL_APPLIC); 1157 1158 leave(LIST(mlmp), 0); 1159 1160 return (mlmp); 1161 } 1162