1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * Copyright (c) 1988 AT&T 29 * All Rights Reserved 30 */ 31 32 #include <string.h> 33 #include <stdio.h> 34 #include <unistd.h> 35 #include <sys/stat.h> 36 #include <sys/mman.h> 37 #include <sys/debug.h> 38 #include <fcntl.h> 39 #include <limits.h> 40 #include <dlfcn.h> 41 #include <errno.h> 42 #include <link.h> 43 #include <debug.h> 44 #include <conv.h> 45 #include "_rtld.h" 46 #include "_audit.h" 47 #include "_elf.h" 48 #include "_a.out.h" 49 #include "_inline.h" 50 #include "msg.h" 51 52 /* 53 * If a load filter flag is in effect, and this object is a filter, trigger the 54 * loading of all its filtees. The load filter flag is in effect when creating 55 * configuration files, or when under the control of ldd(1), or the LD_LOADFLTR 56 * environment variable is set, or this object was built with the -zloadfltr 57 * flag. Otherwise, filtee loading is deferred until triggered by a relocation. 58 */ 59 static void 60 load_filtees(Rt_map *lmp, int *in_nfavl) 61 { 62 if ((FLAGS1(lmp) & MSK_RT_FILTER) && 63 ((FLAGS(lmp) & FLG_RT_LOADFLTR) || 64 (LIST(lmp)->lm_tflags & LML_TFLG_LOADFLTR))) { 65 Dyninfo *dip = DYNINFO(lmp); 66 uint_t cnt, max = DYNINFOCNT(lmp); 67 Slookup sl; 68 69 /* 70 * Initialize the symbol lookup data structure. Note, no symbol 71 * name is supplied. This NULL name causes filters to be loaded 72 * but no symbol to be searched for. 73 */ 74 SLOOKUP_INIT(sl, 0, lmp, lmp, ld_entry_cnt, 0, 0, 0, 0, 0); 75 76 for (cnt = 0; cnt < max; cnt++, dip++) { 77 uint_t binfo; 78 Sresult sr; 79 80 SRESULT_INIT(sr, NULL); 81 82 if (((dip->di_flags & MSK_DI_FILTER) == 0) || 83 ((dip->di_flags & FLG_DI_AUXFLTR) && 84 (rtld_flags & RT_FL_NOAUXFLTR))) 85 continue; 86 (void) elf_lookup_filtee(&sl, &sr, &binfo, cnt, 87 in_nfavl); 88 } 89 } 90 } 91 92 /* 93 * Analyze one or more link-maps of a link map control list. This routine is 94 * called at startup to continue the processing of the main executable. It is 95 * also called each time a new set of objects are loaded, ie. from filters, 96 * lazy-loaded objects, or dlopen(). 97 * 98 * In each instance we traverse the link-map control list starting with the 99 * initial object. As dependencies are analyzed they are added to the link-map 100 * control list. Thus the list grows as we traverse it - this results in the 101 * breadth first ordering of all needed objects. 102 * 103 * Return the initial link-map from which analysis starts for relocate_lmc(). 104 */ 105 Rt_map * 106 analyze_lmc(Lm_list *lml, Aliste nlmco, Rt_map *nlmp, int *in_nfavl) 107 { 108 Rt_map *lmp; 109 Lm_cntl *nlmc; 110 111 /* 112 * If this link-map control list is being analyzed, return. The object 113 * that has just been added will be picked up by the existing analysis 114 * thread. Note, this is only really meaningful during process init- 115 * ialization, as objects are added to the main link-map control list. 116 * Following this initialization, each family of objects that are loaded 117 * are added to a new link-map control list. 118 */ 119 /* LINTED */ 120 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 121 if (nlmc->lc_flags & LMC_FLG_ANALYZING) 122 return (nlmp); 123 124 /* 125 * If this object doesn't belong to the present link-map control list 126 * then it must already have been analyzed, or it is in the process of 127 * being analyzed prior to us recursing into this analysis. In either 128 * case, ignore the object as it's already being taken care of. 129 */ 130 if (nlmco != CNTL(nlmp)) 131 return (nlmp); 132 133 nlmc->lc_flags |= LMC_FLG_ANALYZING; 134 135 for (lmp = nlmp; lmp; lmp = NEXT_RT_MAP(lmp)) { 136 if (FLAGS(lmp) & 137 (FLG_RT_ANALZING | FLG_RT_ANALYZED | FLG_RT_DELETE)) 138 continue; 139 140 /* 141 * Indicate that analyzing is under way. 142 */ 143 FLAGS(lmp) |= FLG_RT_ANALZING; 144 145 /* 146 * If this link map represents a relocatable object, then we 147 * need to finish the link-editing of the object at this point. 148 */ 149 if (FLAGS(lmp) & FLG_RT_OBJECT) { 150 Rt_map *olmp; 151 152 if ((olmp = elf_obj_fini(lml, lmp, in_nfavl)) == NULL) { 153 if (lml->lm_flags & LML_FLG_TRC_ENABLE) 154 continue; 155 nlmp = NULL; 156 break; 157 } 158 159 /* 160 * The original link-map that captured a relocatable 161 * object is a temporary link-map, that basically acts 162 * as a place holder in the link-map list. On 163 * completion of relocatable object processing, a new 164 * link-map is created, and switched with the place 165 * holder. Therefore, reassign both the present 166 * link-map pointer and the return link-map pointer. 167 * The former resets this routines link-map processing, 168 * while the latter provides for later functions, like 169 * relocate_lmc(), to start processing from this new 170 * link-map. 171 */ 172 if (nlmp == lmp) 173 nlmp = olmp; 174 lmp = olmp; 175 } 176 177 DBG_CALL(Dbg_file_analyze(lmp)); 178 179 /* 180 * Establish any dependencies this object requires. 181 */ 182 if (LM_NEEDED(lmp)(lml, nlmco, lmp, in_nfavl) == 0) { 183 if (lml->lm_flags & LML_FLG_TRC_ENABLE) 184 continue; 185 nlmp = NULL; 186 break; 187 } 188 189 FLAGS(lmp) &= ~FLG_RT_ANALZING; 190 FLAGS(lmp) |= FLG_RT_ANALYZED; 191 192 /* 193 * If we're building a configuration file, determine if this 194 * object is a filter and if so load its filtees. This 195 * traversal is only necessary for crle(1), as typical use of 196 * an object will load filters as part of relocation processing. 197 */ 198 if (MODE(nlmp) & RTLD_CONFGEN) 199 load_filtees(lmp, in_nfavl); 200 201 /* 202 * If an interposer has been added, it will have been inserted 203 * in the link-map before the link we're presently analyzing. 204 * Break out of this analysis loop and return to the head of 205 * the link-map control list to analyze the interposer. Note 206 * that this rescan preserves the breadth first loading of 207 * dependencies. 208 */ 209 /* LINTED */ 210 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 211 if (nlmc->lc_flags & LMC_FLG_REANALYZE) { 212 nlmc->lc_flags &= ~LMC_FLG_REANALYZE; 213 lmp = nlmc->lc_head; 214 } 215 } 216 217 /* LINTED */ 218 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 219 nlmc->lc_flags &= ~LMC_FLG_ANALYZING; 220 221 return (nlmp); 222 } 223 224 /* 225 * Determine whether a symbol represents zero, .bss, bits. Most commonly this 226 * function is used to determine whether the data for a copy relocation refers 227 * to initialized data or .bss. If the data definition is within .bss, then the 228 * data is zero filled, and as the copy destination within the executable is 229 * .bss, we can skip copying zero's to zero's. 230 * 231 * However, if the defining object has MOVE data, it's .bss might contain 232 * non-zero data, in which case copy the definition regardless. 233 * 234 * For backward compatibility copy relocation processing, this routine can be 235 * used to determine precisely if a copy destination is a move record recipient. 236 */ 237 static int 238 are_bits_zero(Rt_map *dlmp, Sym *dsym, int dest) 239 { 240 mmapobj_result_t *mpp; 241 caddr_t daddr = (caddr_t)dsym->st_value; 242 243 if ((FLAGS(dlmp) & FLG_RT_FIXED) == 0) 244 daddr += ADDR(dlmp); 245 246 /* 247 * Determine the segment that contains the copy definition. Given that 248 * the copy relocation records have already been captured and verified, 249 * a segment must be found (but we add an escape clause never the less). 250 */ 251 if ((mpp = find_segment(daddr, dlmp)) == NULL) 252 return (1); 253 254 /* 255 * If the definition is not within .bss, indicate this is not zero data. 256 */ 257 if (daddr < (mpp->mr_addr + mpp->mr_offset + mpp->mr_fsize)) 258 return (0); 259 260 /* 261 * If the definition is within .bss, make sure the definition isn't the 262 * recipient of a move record. Note, we don't precisely analyze whether 263 * the address is a move record recipient, as the infrastructure to 264 * prepare for, and carry out this analysis, is probably more costly 265 * than just copying the bytes regardless. 266 */ 267 if ((FLAGS(dlmp) & FLG_RT_MOVE) == 0) 268 return (1); 269 270 /* 271 * However, for backward compatibility copy relocation processing, we 272 * can afford to work a little harder. Here, determine precisely 273 * whether the destination in the executable is a move record recipient. 274 * See comments in lookup_sym_interpose(), below. 275 */ 276 if (dest && is_move_data(daddr)) 277 return (0); 278 279 return (1); 280 } 281 282 /* 283 * Relocate an individual object. 284 */ 285 static int 286 relocate_so(Lm_list *lml, Rt_map *lmp, int *relocated, int now, int *in_nfavl) 287 { 288 APlist *textrel = NULL; 289 int ret = 1; 290 291 /* 292 * If we're running under ldd(1), and haven't been asked to trace any 293 * warnings, skip any actual relocation processing. 294 */ 295 if (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) || 296 (lml->lm_flags & LML_FLG_TRC_WARN)) { 297 298 if (relocated) 299 (*relocated)++; 300 301 if ((LM_RELOC(lmp)(lmp, now, in_nfavl, &textrel) == 0) && 302 ((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0)) 303 ret = 0; 304 305 /* 306 * Finally process any move data. Note, this is carried out 307 * with ldd(1) under relocation processing too, as it can flush 308 * out move errors, and enables lari(1) to provide a true 309 * representation of the runtime bindings. 310 */ 311 if ((FLAGS(lmp) & FLG_RT_MOVE) && 312 (move_data(lmp, &textrel) == 0) && 313 ((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0)) 314 ret = 0; 315 } 316 317 /* 318 * If a text segment was write enabled to perform any relocations or 319 * move records, then re-protect the segment by disabling writes. 320 */ 321 if (textrel) { 322 mmapobj_result_t *mpp; 323 Aliste idx; 324 325 for (APLIST_TRAVERSE(textrel, idx, mpp)) 326 (void) set_prot(lmp, mpp, 0); 327 free(textrel); 328 } 329 330 return (ret); 331 } 332 333 /* 334 * Relocate the objects on a link-map control list. 335 */ 336 static int 337 _relocate_lmc(Lm_list *lml, Aliste lmco, Rt_map *nlmp, int *relocated, 338 int *in_nfavl) 339 { 340 Rt_map *lmp; 341 342 for (lmp = nlmp; lmp; lmp = NEXT_RT_MAP(lmp)) { 343 /* 344 * If this object has already been relocated, we're done. If 345 * this object is being deleted, skip it, there's probably a 346 * relocation error somewhere that's causing this deletion. 347 */ 348 if (FLAGS(lmp) & 349 (FLG_RT_RELOCING | FLG_RT_RELOCED | FLG_RT_DELETE)) 350 continue; 351 352 /* 353 * Indicate that relocation processing is under way. 354 */ 355 FLAGS(lmp) |= FLG_RT_RELOCING; 356 357 /* 358 * Relocate the object. 359 */ 360 if (relocate_so(lml, lmp, relocated, 0, in_nfavl) == 0) 361 return (0); 362 363 /* 364 * Indicate that the objects relocation is complete. 365 */ 366 FLAGS(lmp) &= ~FLG_RT_RELOCING; 367 FLAGS(lmp) |= FLG_RT_RELOCED; 368 369 /* 370 * If this object is being relocated on the main link-map list 371 * indicate that this object's init is available for harvesting. 372 * Objects that are being collected on other link-map lists 373 * will have there init availability tagged when the objects 374 * are move to the main link-map list (ie, after we know they, 375 * and their dependencies, are fully relocated and ready for 376 * use). 377 * 378 * Note, even under ldd(1) this init identification is necessary 379 * for -i (tsort) gathering. 380 */ 381 if (lmco == ALIST_OFF_DATA) { 382 lml->lm_init++; 383 lml->lm_flags |= LML_FLG_OBJADDED; 384 } 385 386 /* 387 * Determine if this object is a filter, and if a load filter 388 * flag is in effect, trigger the loading of all its filtees. 389 */ 390 load_filtees(lmp, in_nfavl); 391 } 392 393 /* 394 * Perform special copy relocations. These are only meaningful for 395 * dynamic executables (fixed and head of their link-map list). If 396 * this ever has to change then the infrastructure of COPY() has to 397 * change. Presently, a given link map can only have a receiver or 398 * supplier of copy data, so a union is used to overlap the storage 399 * for the COPY_R() and COPY_S() lists. These lists would need to 400 * be separated. 401 */ 402 if ((FLAGS(nlmp) & FLG_RT_FIXED) && (nlmp == LIST(nlmp)->lm_head) && 403 (((lml->lm_flags & LML_FLG_TRC_ENABLE) == 0) || 404 (lml->lm_flags & LML_FLG_TRC_WARN))) { 405 Rt_map *lmp; 406 Aliste idx1; 407 Word tracing; 408 409 #if defined(__i386) 410 if (elf_copy_gen(nlmp) == 0) 411 return (0); 412 #endif 413 if (COPY_S(nlmp) == NULL) 414 return (1); 415 416 if ((LIST(nlmp)->lm_flags & LML_FLG_TRC_ENABLE) && 417 (((rtld_flags & RT_FL_SILENCERR) == 0) || 418 (LIST(nlmp)->lm_flags & LML_FLG_TRC_VERBOSE))) 419 tracing = 1; 420 else 421 tracing = 0; 422 423 DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD)); 424 425 for (APLIST_TRAVERSE(COPY_S(nlmp), idx1, lmp)) { 426 Rel_copy *rcp; 427 Aliste idx2; 428 429 for (ALIST_TRAVERSE(COPY_R(lmp), idx2, rcp)) { 430 int zero; 431 432 /* 433 * Only copy the data if the data is from 434 * a non-zero definition (ie. not .bss). 435 */ 436 zero = are_bits_zero(rcp->r_dlmp, 437 rcp->r_dsym, 0); 438 DBG_CALL(Dbg_reloc_copy(rcp->r_dlmp, nlmp, 439 rcp->r_name, zero)); 440 if (zero) 441 continue; 442 443 (void) memcpy(rcp->r_radd, rcp->r_dadd, 444 rcp->r_size); 445 446 if ((tracing == 0) || ((FLAGS1(rcp->r_dlmp) & 447 FL1_RT_DISPREL) == 0)) 448 continue; 449 450 (void) printf(MSG_INTL(MSG_LDD_REL_CPYDISP), 451 demangle(rcp->r_name), NAME(rcp->r_dlmp)); 452 } 453 } 454 455 DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD)); 456 457 free(COPY_S(nlmp)); 458 COPY_S(nlmp) = NULL; 459 } 460 return (1); 461 } 462 463 int 464 relocate_lmc(Lm_list *lml, Aliste nlmco, Rt_map *clmp, Rt_map *nlmp, 465 int *in_nfavl) 466 { 467 int lret = 1, pret = 1; 468 APlist *alp; 469 Aliste plmco; 470 Lm_cntl *plmc, *nlmc; 471 472 /* 473 * If this link-map control list is being relocated, return. The object 474 * that has just been added will be picked up by the existing relocation 475 * thread. Note, this is only really meaningful during process init- 476 * ialization, as objects are added to the main link-map control list. 477 * Following this initialization, each family of objects that are loaded 478 * are added to a new link-map control list. 479 */ 480 /* LINTED */ 481 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 482 483 if (nlmc->lc_flags & LMC_FLG_RELOCATING) 484 return (1); 485 486 nlmc->lc_flags |= LMC_FLG_RELOCATING; 487 488 /* 489 * Relocate one or more link-maps of a link map control list. If this 490 * object doesn't belong to the present link-map control list then it 491 * must already have been relocated, or it is in the process of being 492 * relocated prior to us recursing into this relocation. In either 493 * case, ignore the object as it's already being taken care of, however, 494 * fall through and capture any relocation promotions that might have 495 * been established from the reference mode of this object. 496 * 497 * If we're generating a configuration file using crle(1), two passes 498 * may be involved. Under the first pass, RTLD_CONFGEN is set. Under 499 * this pass, crle() loads objects into the process address space. No 500 * relocation is necessary at this point, we simply need to analyze the 501 * objects to ensure any directly bound dependencies, filtees, etc. 502 * get loaded. Although we skip the relocation, fall through to ensure 503 * any control lists are maintained appropriately. 504 * 505 * If objects are to be dldump(3c)'ed, crle(1) makes a second pass, 506 * using RTLD_NOW and RTLD_CONFGEN. The RTLD_NOW effectively carries 507 * out the relocations of all loaded objects. 508 */ 509 if ((nlmco == CNTL(nlmp)) && 510 ((MODE(nlmp) & (RTLD_NOW | RTLD_CONFGEN)) != RTLD_CONFGEN)) { 511 int relocated = 0; 512 513 /* 514 * Determine whether the initial link-map control list has 515 * started relocation. From this point, should any interposing 516 * objects be added to this link-map control list, the objects 517 * are demoted to standard objects. Their interposition can't 518 * be guaranteed once relocations have been carried out. 519 */ 520 if (nlmco == ALIST_OFF_DATA) 521 lml->lm_flags |= LML_FLG_STARTREL; 522 523 /* 524 * Relocate the link-map control list. Should this relocation 525 * fail, clean up this link-map list. Relocations within this 526 * list may have required relocation promotions on other lists, 527 * so before acting upon these, and possibly adding more objects 528 * to the present link-map control list, try and clean up any 529 * failed objects now. 530 */ 531 lret = _relocate_lmc(lml, nlmco, nlmp, &relocated, in_nfavl); 532 if ((lret == 0) && (nlmco != ALIST_OFF_DATA)) 533 remove_lmc(lml, clmp, nlmco, NAME(nlmp)); 534 } 535 536 /* 537 * Determine the new, and previous link-map control lists. 538 */ 539 /* LINTED */ 540 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 541 if (nlmco == ALIST_OFF_DATA) { 542 plmco = nlmco; 543 plmc = nlmc; 544 } else { 545 plmco = nlmco - lml->lm_lists->al_size; 546 /* LINTED */ 547 plmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, plmco); 548 } 549 550 /* 551 * Having completed this control list of objects, they can now be bound 552 * to from other objects. Move this control list to the control list 553 * that precedes it. Although this control list may have only bound to 554 * controls lists much higher up the control list stack, it must only 555 * be moved up one control list so as to preserve the link-map order 556 * that may have already been traversed in search of symbols. 557 */ 558 if (lret && (nlmco != ALIST_OFF_DATA) && nlmc->lc_head) 559 lm_move(lml, nlmco, plmco, nlmc, plmc); 560 561 /* 562 * Determine whether existing objects that have already been relocated, 563 * need any additional relocations performed. This can occur when new 564 * objects are loaded with RTLD_NOW, and these new objects have 565 * dependencies on objects that are already loaded. Note, that we peel 566 * any relocation promotions off of one control list at a time. This 567 * prevents relocations from being bound to objects that might yet fail 568 * to relocate themselves. 569 */ 570 while ((alp = plmc->lc_now) != NULL) { 571 Aliste idx; 572 Rt_map *lmp; 573 574 /* 575 * Remove the relocation promotion list, as performing more 576 * relocations may result in discovering more objects that need 577 * promotion. 578 */ 579 plmc->lc_now = NULL; 580 581 for (APLIST_TRAVERSE(alp, idx, lmp)) { 582 /* 583 * If the original relocation of the link-map control 584 * list failed, or one of the relocation promotions of 585 * this loop has failed, demote any pending objects 586 * relocation mode. 587 */ 588 if ((lret == 0) || (pret == 0)) { 589 MODE(lmp) &= ~RTLD_NOW; 590 MODE(lmp) |= RTLD_LAZY; 591 continue; 592 } 593 594 /* 595 * If a relocation fails, save the error condition. 596 * It's possible that all new objects on the original 597 * link-map control list have been relocated 598 * successfully, but if the user request requires 599 * promoting objects that have already been loaded, we 600 * have to indicate that this operation couldn't be 601 * performed. The unrelocated objects are in use on 602 * another control list, and may continue to be used. 603 * If the .plt that resulted in the error is called, 604 * then the process will receive a fatal error at that 605 * time. But, the .plt may never be called. 606 */ 607 if (relocate_so(lml, lmp, 0, 1, in_nfavl) == 0) 608 pret = 0; 609 } 610 611 /* 612 * Having promoted any objects, determine whether additional 613 * dependencies were added, and if so move them to the previous 614 * link-map control list. 615 */ 616 /* LINTED */ 617 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 618 /* LINTED */ 619 plmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, plmco); 620 if ((nlmco != ALIST_OFF_DATA) && nlmc->lc_head) 621 lm_move(lml, nlmco, plmco, nlmc, plmc); 622 free(alp); 623 } 624 625 /* 626 * If relocations have been successful, indicate that relocations are 627 * no longer active for this control list. Otherwise, leave the 628 * relocation flag, as this flag is used to determine the style of 629 * cleanup (see remove_lmc()). 630 */ 631 if (lret && pret) { 632 /* LINTED */ 633 nlmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, nlmco); 634 nlmc->lc_flags &= ~LMC_FLG_RELOCATING; 635 636 return (1); 637 } 638 639 return (0); 640 } 641 642 /* 643 * Inherit the first rejection message for possible later diagnostics. 644 * 645 * Any attempt to process a file that is unsuccessful, should be accompanied 646 * with an error diagnostic. However, some operations like searching for a 647 * simple filename, involve trying numerous paths, and an error message for each 648 * lookup is not required. Although a multiple search can fail, it's possible 649 * that a file was found, but was rejected because it was the wrong type. 650 * To satisfy these possibilities, the first failure is recorded as a rejection 651 * message, and this message is used later for a more specific diagnostic. 652 * 653 * File searches are focused at load_one(), and from here a rejection descriptor 654 * is passed down to various child routines. If these child routines can 655 * process multiple files, then they will maintain their own rejection desc- 656 * riptor. This is filled in for any failures, and a diagnostic produced to 657 * reflect the failure. The child routines then employ rejection_inherit() to 658 * pass the first rejection message back to load_one(). 659 * 660 * Note that the name, and rejection string must be duplicated, as the name 661 * buffer and error string buffer (see conv_ routines) may be reused for 662 * additional processing or rejection messages. 663 */ 664 void 665 rejection_inherit(Rej_desc *rej1, Rej_desc *rej2) 666 { 667 if (rej2->rej_type && (rej1->rej_type == 0)) { 668 rej1->rej_type = rej2->rej_type; 669 rej1->rej_info = rej2->rej_info; 670 rej1->rej_flags = rej2->rej_flags; 671 if (rej2->rej_name) 672 rej1->rej_name = stravl_insert(rej2->rej_name, 0, 0, 0); 673 if ((rej2->rej_str) && ((rej1->rej_str = 674 stravl_insert(rej2->rej_str, 0, 0, 0)) == NULL)) 675 rej1->rej_str = MSG_ORIG(MSG_EMG_ENOMEM); 676 } 677 } 678 679 /* 680 * Helper routine for is_so_matched() that consolidates matching a path name, 681 * or file name component of a link-map name. 682 */ 683 inline static int 684 _is_so_matched(const char *name, const char *str, int path) 685 { 686 const char *_str; 687 688 if ((path == 0) && ((_str = strrchr(str, '/')) != NULL)) 689 _str++; 690 else 691 _str = str; 692 693 return (strcmp(name, _str)); 694 } 695 696 /* 697 * Determine whether a search name matches one of the names associated with a 698 * link-map. A link-map contains several names: 699 * 700 * - a NAME() - this is the basename of the dynamic executable that started 701 * the process, and the path name of any dependencies used by the process. 702 * Most executables are received as full path names, as exec() prepends a 703 * search $PATH to locate the executable. However, simple file names can 704 * be received from exec() if the file is executed from the present working 705 * directory. Regardless, ld.so.1 maintains NAME() as the basename, as 706 * this has always been the name used in diagnostics and error messages. 707 * Most dependencies are full path names, as the typical search for a 708 * dependency, say "libx.so.1", results in search paths being prepended to 709 * the name, which eventually open "/lib/libx.so.1". However, relative 710 * path names can be supplied as dependencies, e.g. dlopen("../libx.so.1"). 711 * 712 * - a PATHNAME() - this is the fully resolved path name of the object. This 713 * name will differ from NAME() for all dynamic executables, and may differ 714 * from the NAME() of dependencies, if the dependency is not a full path 715 * name, or the dependency resolves to a symbolic link. 716 * 717 * - an ALIAS() name - these are alternative names by which the object has 718 * been found, ie. when dependencies are loaded through a variety of 719 * different symbolic links. 720 * 721 * The name pattern matching can differ depending on whether we are looking 722 * for a full path name (path != 0), or a simple file name (path == 0). Full 723 * path names typically match NAME() or PATHNAME() entries. 724 * 725 * For all full path name searches, the link-map names are taken as is. For 726 * simple file name searches, only the file name component of any link-map 727 * names are used for comparison. 728 */ 729 inline static Rt_map * 730 is_so_matched(Rt_map *lmp, const char *name, int path) 731 { 732 Aliste idx; 733 const char *cp; 734 735 if (_is_so_matched(name, NAME(lmp), path) == 0) 736 return (lmp); 737 738 if (PATHNAME(lmp) != NAME(lmp)) { 739 if (_is_so_matched(name, PATHNAME(lmp), path) == 0) 740 return (lmp); 741 } 742 743 for (APLIST_TRAVERSE(ALIAS(lmp), idx, cp)) { 744 if (_is_so_matched(name, cp, path) == 0) 745 return (lmp); 746 } 747 748 return (NULL); 749 } 750 751 /* 752 * Files are opened by ld.so.1 to satisfy dependencies, filtees and dlopen() 753 * requests. Each request investigates the file based upon the callers 754 * environment. Once a full path name has been established, the following 755 * checks are made: 756 * 757 * - does the path exist in the link-map lists FullPathNode AVL tree? if 758 * so, the file is already loaded, and its associated link-map pointer 759 * is returned. 760 * - does the path exist in the not-found AVL tree? if so, this path has 761 * already been determined to not exist, and a failure is returned. 762 * - a device/inode check, to ensure the same file isn't mapped multiple 763 * times through different paths. See file_open(). 764 * 765 * However, there are cases where a test for an existing file name needs to be 766 * carried out, such as dlopen(NOLOAD) requests, dldump() requests, and as a 767 * final fallback to dependency loading. These requests are handled by 768 * is_so_loaded(). 769 * 770 * A traversal through the callers link-map list is carried out, and from each 771 * link-map, a comparison is made against all of the various names by which the 772 * object has been referenced. is_so_matched() is used to compare the link-map 773 * names against the name being searched for. Whether the search name is a full 774 * path name or a simple file name, governs what comparisons are made. 775 * 776 * A full path name, which is a fully resolved path name that starts with a "/" 777 * character, or a relative path name that includes a "/" character, must match 778 * the link-map names exactly. A simple file name, which is any name *not* 779 * containing a "/" character, are matched against the file name component of 780 * any link-map names. 781 */ 782 Rt_map * 783 is_so_loaded(Lm_list *lml, const char *name, int *in_nfavl) 784 { 785 Rt_map *lmp; 786 avl_index_t where; 787 Lm_cntl *lmc; 788 Aliste idx; 789 int path = 0; 790 791 /* 792 * If the name is a full path name, first determine if the path name is 793 * registered on the FullPathNode AVL, or not-found AVL trees. 794 */ 795 if (name[0] == '/') { 796 uint_t hash = sgs_str_hash(name); 797 798 if (((lmp = fpavl_recorded(lml, name, hash, &where)) != NULL) && 799 ((FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE)) == 0)) 800 return (lmp); 801 802 if (pnavl_recorded(&nfavl, name, hash, NULL)) { 803 /* 804 * For dlopen() and dlsym() fall backs, indicate that 805 * a registered not-found path has indicated that this 806 * object does not exist. 807 */ 808 if (in_nfavl) 809 (*in_nfavl)++; 810 return (NULL); 811 } 812 } 813 814 /* 815 * Determine whether the name is a simple file name, or a path name. 816 */ 817 if (strchr(name, '/')) 818 path++; 819 820 /* 821 * Loop through the callers link-map lists. 822 */ 823 for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) { 824 for (lmp = lmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) { 825 if (FLAGS(lmp) & (FLG_RT_OBJECT | FLG_RT_DELETE)) 826 continue; 827 828 if (is_so_matched(lmp, name, path)) 829 return (lmp); 830 } 831 } 832 return (NULL); 833 } 834 835 /* 836 * Tracing is enabled by the LD_TRACE_LOADED_OPTIONS environment variable which 837 * is normally set from ldd(1). For each link map we load, print the load name 838 * and the full pathname of the associated object. 839 */ 840 /* ARGSUSED4 */ 841 static void 842 trace_so(Rt_map *clmp, Rej_desc *rej, const char *name, const char *path, 843 int alter, const char *nfound) 844 { 845 const char *str = MSG_ORIG(MSG_STR_EMPTY); 846 const char *reject = MSG_ORIG(MSG_STR_EMPTY); 847 char _reject[PATH_MAX]; 848 849 /* 850 * The first time through trace_so() will only have lddstub on the 851 * link-map list and the preloaded shared object is supplied as "path". 852 * As we don't want to print this shared object as a dependency, but 853 * instead inspect *its* dependencies, return. 854 */ 855 if (FLAGS1(clmp) & FL1_RT_LDDSTUB) 856 return; 857 858 /* 859 * Without any rejection info, this is a supplied not-found condition. 860 */ 861 if (rej && (rej->rej_type == 0)) { 862 (void) printf(nfound, name); 863 return; 864 } 865 866 /* 867 * If rejection information exists then establish what object was 868 * found and the reason for its rejection. 869 */ 870 if (rej) { 871 Conv_reject_desc_buf_t rej_buf; 872 873 /* LINTED */ 874 (void) snprintf(_reject, PATH_MAX, 875 MSG_INTL(ldd_reject[rej->rej_type]), 876 conv_reject_desc(rej, &rej_buf, M_MACH)); 877 if (rej->rej_name) 878 path = rej->rej_name; 879 reject = (char *)_reject; 880 881 /* 882 * Was an alternative pathname defined (from a configuration 883 * file). 884 */ 885 if (rej->rej_flags & FLG_REJ_ALTER) 886 str = MSG_INTL(MSG_LDD_FIL_ALTER); 887 } else { 888 if (alter) 889 str = MSG_INTL(MSG_LDD_FIL_ALTER); 890 } 891 892 /* 893 * If the load name isn't a full pathname print its associated pathname 894 * together with all the other information we've gathered. 895 */ 896 if (*name == '/') 897 (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH), path, str, reject); 898 else 899 (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV), name, path, str, 900 reject); 901 } 902 903 /* 904 * Establish a link-map mode, initializing it if it has just been loaded, or 905 * potentially updating it if it already exists. 906 */ 907 int 908 update_mode(Rt_map *lmp, int omode, int nmode) 909 { 910 Lm_list *lml = LIST(lmp); 911 int pmode = 0; 912 913 /* 914 * A newly loaded object hasn't had its mode set yet. Modes are used to 915 * load dependencies, so don't propagate any parent or no-load flags, as 916 * these would adversely affect this objects ability to load any of its 917 * dependencies that aren't already loaded. RTLD_FIRST is applicable to 918 * this objects handle creation only, and should not be propagated. 919 */ 920 if ((FLAGS(lmp) & FLG_RT_MODESET) == 0) { 921 MODE(lmp) |= nmode & ~(RTLD_PARENT | RTLD_NOLOAD | RTLD_FIRST); 922 FLAGS(lmp) |= FLG_RT_MODESET; 923 return (1); 924 } 925 926 /* 927 * Establish any new overriding modes. RTLD_LAZY and RTLD_NOW should be 928 * represented individually (this is historic, as these two flags were 929 * the only flags originally available to dlopen()). Other flags are 930 * accumulative, but have a hierarchy of preference. 931 */ 932 if ((omode & RTLD_LAZY) && (nmode & RTLD_NOW)) { 933 MODE(lmp) &= ~RTLD_LAZY; 934 pmode |= RTLD_NOW; 935 } 936 937 pmode |= ((~omode & nmode) & 938 (RTLD_GLOBAL | RTLD_WORLD | RTLD_NODELETE)); 939 if (pmode) { 940 DBG_CALL(Dbg_file_mode_promote(lmp, pmode)); 941 MODE(lmp) |= pmode; 942 } 943 944 /* 945 * If this load is an RTLD_NOW request and the object has already been 946 * loaded non-RTLD_NOW, append this object to the relocation-now list 947 * of the objects associated control list. Note, if the object hasn't 948 * yet been relocated, setting its MODE() to RTLD_NOW will establish 949 * full relocation processing when it eventually gets relocated. 950 */ 951 if ((pmode & RTLD_NOW) && 952 (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))) { 953 Lm_cntl *lmc; 954 955 /* LINTED */ 956 lmc = (Lm_cntl *)alist_item_by_offset(LIST(lmp)->lm_lists, 957 CNTL(lmp)); 958 (void) aplist_append(&lmc->lc_now, lmp, AL_CNT_LMNOW); 959 } 960 961 /* 962 * If this objects .init has been collected but has not yet been called, 963 * it may be necessary to reevaluate the object using tsort(). For 964 * example, a new dlopen() hierarchy may bind to uninitialized objects 965 * that are already loaded, or a dlopen(RTLD_NOW) can establish new 966 * bindings between already loaded objects that require the tsort() 967 * information be recomputed. If however, no new objects have been 968 * added to the process, and this object hasn't been promoted, don't 969 * bother reevaluating the .init. The present tsort() information is 970 * probably as accurate as necessary, and by not establishing a parallel 971 * tsort() we can help reduce the amount of recursion possible between 972 * .inits. 973 */ 974 if (((FLAGS(lmp) & 975 (FLG_RT_INITCLCT | FLG_RT_INITCALL)) == FLG_RT_INITCLCT) && 976 ((lml->lm_flags & LML_FLG_OBJADDED) || ((pmode & RTLD_NOW) && 977 (FLAGS(lmp) & (FLG_RT_RELOCED | FLG_RT_RELOCING))))) { 978 FLAGS(lmp) &= ~FLG_RT_INITCLCT; 979 LIST(lmp)->lm_init++; 980 LIST(lmp)->lm_flags |= LML_FLG_OBJREEVAL; 981 } 982 983 return (pmode); 984 } 985 986 /* 987 * Determine whether an alias name already exists, and if not create one. This 988 * is typically used to retain dependency names, such as "libc.so.1", which 989 * would have been expanded to full path names when they were loaded. The 990 * full path names (NAME() and possibly PATHNAME()) are maintained on the 991 * FullPathNode AVL tree, and thus would have been matched by fpavl_loaded() 992 * during file_open(). 993 */ 994 int 995 append_alias(Rt_map *lmp, const char *str, int *added) 996 { 997 const char *cp; 998 Aliste idx; 999 1000 /* 1001 * Determine if this filename is already on the alias list. 1002 */ 1003 for (APLIST_TRAVERSE(ALIAS(lmp), idx, cp)) { 1004 if (strcmp(cp, str) == 0) 1005 return (1); 1006 } 1007 1008 /* 1009 * This is a new alias, append it to the alias list. 1010 */ 1011 if (((cp = stravl_insert(str, 0, 0, 0)) == NULL) || 1012 (aplist_append(&ALIAS(lmp), cp, AL_CNT_ALIAS) == NULL)) 1013 return (0); 1014 1015 if (added) 1016 *added = 1; 1017 return (1); 1018 } 1019 1020 /* 1021 * Determine whether a file is already loaded by comparing device and inode 1022 * values. 1023 */ 1024 static Rt_map * 1025 is_devinode_loaded(rtld_stat_t *status, Lm_list *lml, const char *name, 1026 uint_t flags) 1027 { 1028 Lm_cntl *lmc; 1029 Aliste idx; 1030 1031 /* 1032 * If this is an auditor, it will have been opened on a new link-map. 1033 * To prevent multiple occurrences of the same auditor on multiple 1034 * link-maps, search the head of each link-map list and see if this 1035 * object is already loaded as an auditor. 1036 */ 1037 if (flags & FLG_RT_AUDIT) { 1038 Lm_list *lml; 1039 1040 for (APLIST_TRAVERSE(dynlm_list, idx, lml)) { 1041 Rt_map *nlmp = lml->lm_head; 1042 1043 if (nlmp && ((FLAGS(nlmp) & 1044 (FLG_RT_AUDIT | FLG_RT_DELETE)) == FLG_RT_AUDIT) && 1045 (STDEV(nlmp) == status->st_dev) && 1046 (STINO(nlmp) == status->st_ino)) 1047 return (nlmp); 1048 } 1049 return (NULL); 1050 } 1051 1052 /* 1053 * If the file has been found determine from the new files status 1054 * information if this file is actually linked to one we already have 1055 * mapped. This catches symlink names not caught by is_so_loaded(). 1056 */ 1057 for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) { 1058 Rt_map *nlmp; 1059 1060 for (nlmp = lmc->lc_head; nlmp; nlmp = NEXT_RT_MAP(nlmp)) { 1061 if ((FLAGS(nlmp) & FLG_RT_DELETE) || 1062 (FLAGS1(nlmp) & FL1_RT_LDDSTUB)) 1063 continue; 1064 1065 if ((STDEV(nlmp) != status->st_dev) || 1066 (STINO(nlmp) != status->st_ino)) 1067 continue; 1068 1069 if (lml->lm_flags & LML_FLG_TRC_VERBOSE) { 1070 /* BEGIN CSTYLED */ 1071 if (*name == '/') 1072 (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH), 1073 name, MSG_ORIG(MSG_STR_EMPTY), 1074 MSG_ORIG(MSG_STR_EMPTY)); 1075 else 1076 (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV), 1077 name, NAME(nlmp), 1078 MSG_ORIG(MSG_STR_EMPTY), 1079 MSG_ORIG(MSG_STR_EMPTY)); 1080 /* END CSTYLED */ 1081 } 1082 return (nlmp); 1083 } 1084 } 1085 return (NULL); 1086 } 1087 1088 /* 1089 * Generate any error messages indicating a file could not be found. When 1090 * preloading or auditing a secure application, it can be a little more helpful 1091 * to indicate that a search of secure directories has failed, so adjust the 1092 * messages accordingly. 1093 */ 1094 void 1095 file_notfound(Lm_list *lml, const char *name, Rt_map *clmp, uint_t flags, 1096 Rej_desc *rej) 1097 { 1098 int secure = 0; 1099 1100 if ((rtld_flags & RT_FL_SECURE) && 1101 (flags & (FLG_RT_PRELOAD | FLG_RT_AUDIT))) 1102 secure++; 1103 1104 if (lml->lm_flags & LML_FLG_TRC_ENABLE) { 1105 /* 1106 * Under ldd(1), auxiliary filtees that can't be loaded are 1107 * ignored, unless verbose errors are requested. 1108 */ 1109 if ((rtld_flags & RT_FL_SILENCERR) && 1110 ((lml->lm_flags & LML_FLG_TRC_VERBOSE) == 0)) 1111 return; 1112 1113 if (secure) 1114 trace_so(clmp, rej, name, 0, 0, 1115 MSG_INTL(MSG_LDD_SEC_NFOUND)); 1116 else 1117 trace_so(clmp, rej, name, 0, 0, 1118 MSG_INTL(MSG_LDD_FIL_NFOUND)); 1119 return; 1120 } 1121 1122 if (rej->rej_type) { 1123 Conv_reject_desc_buf_t rej_buf; 1124 1125 eprintf(lml, ERR_FATAL, MSG_INTL(err_reject[rej->rej_type]), 1126 rej->rej_name ? rej->rej_name : MSG_INTL(MSG_STR_UNKNOWN), 1127 conv_reject_desc(rej, &rej_buf, M_MACH)); 1128 return; 1129 } 1130 1131 if (secure) 1132 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SEC_OPEN), name); 1133 else 1134 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), name, 1135 strerror(ENOENT)); 1136 } 1137 1138 static int 1139 file_open(int err, Lm_list *lml, Rt_map *clmp, uint_t flags, Fdesc *fdp, 1140 Rej_desc *rej, int *in_nfavl) 1141 { 1142 rtld_stat_t status; 1143 Rt_map *nlmp; 1144 avl_index_t nfavlwhere = 0; 1145 const char *oname = fdp->fd_oname, *nname = fdp->fd_nname; 1146 uint_t hash = sgs_str_hash(nname); 1147 1148 1149 if ((nname = stravl_insert(fdp->fd_nname, hash, 0, 0)) == NULL) 1150 return (0); 1151 fdp->fd_nname = nname; 1152 1153 if ((err == 0) && (fdp->fd_flags & FLG_FD_ALTER)) 1154 DBG_CALL(Dbg_file_config_obj(lml, oname, 0, nname)); 1155 1156 /* 1157 * If we're dealing with a full pathname, determine whether this 1158 * pathname is already known. Other pathnames fall through to the 1159 * dev/inode check, as even though the pathname may look the same as 1160 * one previously used, the process may have changed directory. 1161 */ 1162 if ((err == 0) && (nname[0] == '/')) { 1163 if ((nlmp = fpavl_recorded(lml, nname, hash, 1164 &(fdp->fd_avlwhere))) != NULL) { 1165 fdp->fd_lmp = nlmp; 1166 return (1); 1167 } 1168 if (pnavl_recorded(&nfavl, nname, hash, &nfavlwhere)) { 1169 /* 1170 * For dlopen() and dlsym() fall backs, indicate that 1171 * a registered not-found path has indicated that this 1172 * object does not exist. If this path has been 1173 * constructed as part of expanding a CAPABILITY 1174 * directory, this is a silent failure, where no 1175 * rejection message is created. 1176 */ 1177 if (in_nfavl) 1178 (*in_nfavl)++; 1179 return (0); 1180 } 1181 } 1182 1183 if ((err == 0) && ((rtld_stat(nname, &status)) != -1)) { 1184 char path[PATH_MAX]; 1185 int fd, size, added; 1186 1187 /* 1188 * If this path has been constructed as part of expanding a 1189 * CAPABILITY directory, ignore any subdirectories. As this 1190 * is a silent failure, no rejection message is created. For 1191 * any other reference that expands to a directory, fall 1192 * through to construct a meaningful rejection message. 1193 */ 1194 if ((flags & FLG_RT_CAP) && 1195 ((status.st_mode & S_IFMT) == S_IFDIR)) 1196 return (0); 1197 1198 /* 1199 * If this is a directory (which can't be mmap()'ed) generate a 1200 * precise error message. 1201 */ 1202 if ((status.st_mode & S_IFMT) == S_IFDIR) { 1203 rej->rej_name = nname; 1204 if (fdp->fd_flags & FLG_FD_ALTER) 1205 rej->rej_flags = FLG_REJ_ALTER; 1206 rej->rej_type = SGS_REJ_STR; 1207 rej->rej_str = strerror(EISDIR); 1208 DBG_CALL(Dbg_file_rejected(lml, rej, M_MACH)); 1209 return (0); 1210 } 1211 1212 /* 1213 * Resolve the filename and determine whether the resolved name 1214 * is already known. Typically, the previous fpavl_loaded() 1215 * will have caught this, as both NAME() and PATHNAME() for a 1216 * link-map are recorded in the FullPathNode AVL tree. However, 1217 * instances exist where a file can be replaced (loop-back 1218 * mounts, bfu, etc.), and reference is made to the original 1219 * file through a symbolic link. By checking the pathname here, 1220 * we don't fall through to the dev/inode check and conclude 1221 * that a new file should be loaded. 1222 */ 1223 if ((nname[0] == '/') && 1224 ((size = resolvepath(nname, path, (PATH_MAX - 1))) > 0)) { 1225 path[size] = '\0'; 1226 1227 fdp->fd_flags |= FLG_FD_RESOLVED; 1228 1229 if (strcmp(nname, path)) { 1230 if ((nlmp = 1231 fpavl_recorded(lml, path, 0, 0)) != NULL) { 1232 added = 0; 1233 1234 if (append_alias(nlmp, nname, 1235 &added) == 0) 1236 return (0); 1237 /* BEGIN CSTYLED */ 1238 if (added) 1239 DBG_CALL(Dbg_file_skip(LIST(clmp), 1240 NAME(nlmp), nname)); 1241 /* END CSTYLED */ 1242 fdp->fd_lmp = nlmp; 1243 return (1); 1244 } 1245 1246 /* 1247 * If this pathname hasn't been loaded, save 1248 * the resolved pathname so that it doesn't 1249 * have to be recomputed as part of fullpath() 1250 * processing. 1251 */ 1252 if ((fdp->fd_pname = stravl_insert(path, 0, 1253 (size + 1), 0)) == NULL) 1254 return (0); 1255 } 1256 } 1257 1258 if (nlmp = is_devinode_loaded(&status, lml, nname, flags)) { 1259 if (flags & FLG_RT_AUDIT) { 1260 /* 1261 * If we've been requested to load an auditor, 1262 * and an auditor of the same name already 1263 * exists, then the original auditor is used. 1264 */ 1265 DBG_CALL(Dbg_audit_skip(LIST(clmp), 1266 NAME(nlmp), LIST(nlmp)->lm_lmidstr)); 1267 } else { 1268 /* 1269 * Otherwise, if an alternatively named file 1270 * has been found for the same dev/inode, add 1271 * a new name alias. Insert any alias full path 1272 * name in the FullPathNode AVL tree. 1273 */ 1274 added = 0; 1275 1276 if (append_alias(nlmp, nname, &added) == 0) 1277 return (0); 1278 if (added) { 1279 if ((nname[0] == '/') && 1280 (fpavl_insert(lml, nlmp, 1281 nname, 0) == 0)) 1282 return (0); 1283 DBG_CALL(Dbg_file_skip(LIST(clmp), 1284 NAME(nlmp), nname)); 1285 } 1286 } 1287 1288 /* 1289 * Record in the file descriptor the existing object 1290 * that satisfies this open request. 1291 */ 1292 fdp->fd_lmp = nlmp; 1293 return (1); 1294 } 1295 1296 if ((fd = open(nname, O_RDONLY, 0)) == -1) { 1297 /* 1298 * As the file must exist for the previous stat() to 1299 * have succeeded, record the error condition. 1300 */ 1301 rej->rej_type = SGS_REJ_STR; 1302 rej->rej_str = strerror(errno); 1303 } else { 1304 /* 1305 * Map the object. A successful return indicates that 1306 * the object is appropriate for ld.so.1 processing. 1307 */ 1308 fdp->fd_ftp = map_obj(lml, fdp, status.st_size, nname, 1309 fd, rej); 1310 (void) close(fd); 1311 1312 if (fdp->fd_ftp != NULL) { 1313 fdp->fd_dev = status.st_dev; 1314 fdp->fd_ino = status.st_ino; 1315 return (1); 1316 } 1317 } 1318 1319 } else if (errno != ENOENT) { 1320 /* 1321 * If the open() failed for anything other than the file not 1322 * existing, record the error condition. 1323 */ 1324 rej->rej_type = SGS_REJ_STR; 1325 rej->rej_str = strerror(errno); 1326 } 1327 1328 /* 1329 * Regardless of error, duplicate and record any full path names that 1330 * can't be used on the "not-found" AVL tree. 1331 */ 1332 if (nname[0] == '/') 1333 nfavl_insert(nname, nfavlwhere); 1334 1335 /* 1336 * Indicate any rejection. 1337 */ 1338 if (rej->rej_type) { 1339 rej->rej_name = nname; 1340 if (fdp->fd_flags & FLG_FD_ALTER) 1341 rej->rej_flags = FLG_REJ_ALTER; 1342 DBG_CALL(Dbg_file_rejected(lml, rej, M_MACH)); 1343 } 1344 return (0); 1345 } 1346 1347 /* 1348 * Find a full pathname (it contains a "/"). 1349 */ 1350 int 1351 find_path(Lm_list *lml, Rt_map *clmp, uint_t flags, Fdesc *fdp, Rej_desc *rej, 1352 int *in_nfavl) 1353 { 1354 const char *oname = fdp->fd_oname; 1355 int err = 0; 1356 1357 /* 1358 * If directory configuration exists determine if this path is known. 1359 */ 1360 if (rtld_flags & RT_FL_DIRCFG) { 1361 Rtc_obj *obj; 1362 const char *aname; 1363 1364 if ((obj = elf_config_ent(oname, (Word)elf_hash(oname), 1365 0, &aname)) != 0) { 1366 /* 1367 * If the configuration file states that this path is a 1368 * directory, or the path is explicitly defined as 1369 * non-existent (ie. a unused platform specific 1370 * library), then go no further. 1371 */ 1372 if (obj->co_flags & RTC_OBJ_DIRENT) { 1373 err = EISDIR; 1374 } else if ((obj->co_flags & 1375 (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) == 1376 RTC_OBJ_NOEXIST) { 1377 err = ENOENT; 1378 } else if ((obj->co_flags & RTC_OBJ_ALTER) && 1379 (rtld_flags & RT_FL_OBJALT) && (lml == &lml_main)) { 1380 int ret; 1381 1382 fdp->fd_flags |= FLG_FD_ALTER; 1383 fdp->fd_nname = aname; 1384 1385 /* 1386 * Attempt to open the alternative path. If 1387 * this fails, and the alternative is flagged 1388 * as optional, fall through to open the 1389 * original path. 1390 */ 1391 DBG_CALL(Dbg_libs_found(lml, aname, 1392 FLG_FD_ALTER)); 1393 ret = file_open(0, lml, clmp, flags, fdp, 1394 rej, in_nfavl); 1395 if (ret || ((obj->co_flags & 1396 RTC_OBJ_OPTINAL) == 0)) 1397 return (ret); 1398 1399 fdp->fd_flags &= ~FLG_FD_ALTER; 1400 } 1401 } 1402 } 1403 DBG_CALL(Dbg_libs_found(lml, oname, 0)); 1404 fdp->fd_nname = oname; 1405 return (file_open(err, lml, clmp, flags, fdp, rej, in_nfavl)); 1406 } 1407 1408 /* 1409 * Find a simple filename (it doesn't contain a "/"). 1410 */ 1411 static int 1412 _find_file(Lm_list *lml, Rt_map *clmp, uint_t flags, Fdesc *fdp, Rej_desc *rej, 1413 Pdesc *pdp, int aflag, int *in_nfavl) 1414 { 1415 const char *nname = fdp->fd_nname; 1416 1417 DBG_CALL(Dbg_libs_found(lml, nname, aflag)); 1418 if ((lml->lm_flags & LML_FLG_TRC_SEARCH) && 1419 ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) { 1420 (void) printf(MSG_INTL(MSG_LDD_PTH_TRYING), nname, aflag ? 1421 MSG_INTL(MSG_LDD_FIL_ALTER) : MSG_ORIG(MSG_STR_EMPTY)); 1422 } 1423 1424 /* 1425 * If we're being audited tell the audit library of the file we're about 1426 * to go search for. The audit library may offer an alternative 1427 * dependency, or indicate that this dependency should be ignored. 1428 */ 1429 if ((lml->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_OBJSEARCH) { 1430 char *aname; 1431 1432 if ((aname = audit_objsearch(clmp, nname, 1433 (pdp->pd_flags & LA_SER_MASK))) == NULL) { 1434 DBG_CALL(Dbg_audit_terminate(lml, nname)); 1435 return (0); 1436 } 1437 1438 if (aname != nname) { 1439 fdp->fd_flags &= ~FLG_FD_SLASH; 1440 fdp->fd_nname = aname; 1441 } 1442 } 1443 return (file_open(0, lml, clmp, flags, fdp, rej, in_nfavl)); 1444 } 1445 1446 static int 1447 find_file(Lm_list *lml, Rt_map *clmp, uint_t flags, Fdesc *fdp, Rej_desc *rej, 1448 Pdesc *pdp, Word *strhash, int *in_nfavl) 1449 { 1450 static Rtc_obj Obj = { 0 }; 1451 Rtc_obj *dobj; 1452 const char *oname = fdp->fd_oname; 1453 size_t olen = strlen(oname); 1454 1455 if (pdp->pd_pname == NULL) 1456 return (0); 1457 if (pdp->pd_info) { 1458 dobj = (Rtc_obj *)pdp->pd_info; 1459 if ((dobj->co_flags & 1460 (RTC_OBJ_NOEXIST | RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST) 1461 return (0); 1462 } else 1463 dobj = NULL; 1464 1465 /* 1466 * If configuration information exists see if this directory/file 1467 * combination exists. 1468 */ 1469 if ((rtld_flags & RT_FL_DIRCFG) && 1470 ((dobj == NULL) || (dobj->co_id != 0))) { 1471 Rtc_obj *fobj; 1472 const char *aname = NULL; 1473 1474 /* 1475 * If this object descriptor has not yet been searched for in 1476 * the configuration file go find it. 1477 */ 1478 if (dobj == NULL) { 1479 dobj = elf_config_ent(pdp->pd_pname, 1480 (Word)elf_hash(pdp->pd_pname), 0, 0); 1481 if (dobj == NULL) 1482 dobj = &Obj; 1483 pdp->pd_info = (void *)dobj; 1484 1485 if ((dobj->co_flags & (RTC_OBJ_NOEXIST | 1486 RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST) 1487 return (0); 1488 } 1489 1490 /* 1491 * If we found a directory search for the file. 1492 */ 1493 if (dobj->co_id != 0) { 1494 if (*strhash == NULL) 1495 *strhash = (Word)elf_hash(oname); 1496 fobj = elf_config_ent(oname, *strhash, 1497 dobj->co_id, &aname); 1498 1499 /* 1500 * If this object specifically does not exist, or the 1501 * object can't be found in a know-all-entries 1502 * directory, continue looking. If the object does 1503 * exist determine if an alternative object exists. 1504 */ 1505 if (fobj == NULL) { 1506 if (dobj->co_flags & RTC_OBJ_ALLENTS) 1507 return (0); 1508 } else { 1509 if ((fobj->co_flags & (RTC_OBJ_NOEXIST | 1510 RTC_OBJ_ALTER)) == RTC_OBJ_NOEXIST) 1511 return (0); 1512 1513 if ((fobj->co_flags & RTC_OBJ_ALTER) && 1514 (rtld_flags & RT_FL_OBJALT) && 1515 (lml == &lml_main)) { 1516 int ret; 1517 1518 fdp->fd_flags |= FLG_FD_ALTER; 1519 fdp->fd_nname = aname; 1520 1521 /* 1522 * Attempt to open the alternative path. 1523 * If this fails, and the alternative is 1524 * flagged as optional, fall through to 1525 * open the original path. 1526 */ 1527 ret = _find_file(lml, clmp, flags, fdp, 1528 rej, pdp, 1, in_nfavl); 1529 if (ret || ((fobj->co_flags & 1530 RTC_OBJ_OPTINAL) == 0)) 1531 return (ret); 1532 1533 fdp->fd_flags &= ~FLG_FD_ALTER; 1534 } 1535 } 1536 } 1537 } 1538 1539 /* 1540 * Protect ourselves from building an invalid pathname. 1541 */ 1542 if ((olen + pdp->pd_plen + 1) >= PATH_MAX) { 1543 eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN), oname, 1544 strerror(ENAMETOOLONG)); 1545 return (0); 1546 } 1547 if ((fdp->fd_nname = (LM_GET_SO(clmp)(pdp->pd_pname, oname, 1548 pdp->pd_plen, olen))) == NULL) 1549 return (0); 1550 1551 return (_find_file(lml, clmp, flags, fdp, rej, pdp, 0, in_nfavl)); 1552 } 1553 1554 static Fct *Vector[] = { 1555 &elf_fct, 1556 #ifdef A_OUT 1557 &aout_fct, 1558 #endif 1559 0 1560 }; 1561 1562 /* 1563 * Remap the first page of a file to provide a better diagnostic as to why 1564 * an mmapobj(2) operation on this file failed. Sadly, mmapobj(), and all 1565 * system calls for that matter, only pass back a generic failure in errno. 1566 * Hopefully one day this will be improved, but in the mean time we repeat 1567 * the kernels ELF verification to try and provide more detailed information. 1568 */ 1569 static int 1570 map_fail(Fdesc *fdp, size_t fsize, const char *name, int fd, Rej_desc *rej) 1571 { 1572 caddr_t addr; 1573 int vnum; 1574 size_t size; 1575 1576 /* 1577 * Use the original file size to determine what to map, and catch the 1578 * obvious error of a zero sized file. 1579 */ 1580 if (fsize == 0) { 1581 rej->rej_type = SGS_REJ_UNKFILE; 1582 return (1); 1583 } else if (fsize < syspagsz) 1584 size = fsize; 1585 else 1586 size = syspagsz; 1587 1588 if ((addr = mmap(0, size, PROT_READ, MAP_PRIVATE, fd, 0)) == MAP_FAILED) 1589 return (0); 1590 1591 rej->rej_type = 0; 1592 1593 /* 1594 * Validate the file against each supported file type. Should a 1595 * characteristic of the file be found invalid for this platform, a 1596 * rejection message will have been recorded. 1597 */ 1598 for (vnum = 0; Vector[vnum]; vnum++) { 1599 if (((Vector[vnum]->fct_verify_file)(addr, size, 1600 fdp, name, rej) == 0) && rej->rej_type) 1601 break; 1602 } 1603 1604 /* 1605 * If no rejection message has been recorded, then this is simply an 1606 * unknown file type. 1607 */ 1608 if (rej->rej_type == 0) 1609 rej->rej_type = SGS_REJ_UNKFILE; 1610 1611 (void) munmap(addr, size); 1612 return (1); 1613 } 1614 1615 /* 1616 * Unmap a file. 1617 */ 1618 void 1619 unmap_obj(mmapobj_result_t *mpp, uint_t mapnum) 1620 { 1621 uint_t num; 1622 1623 for (num = 0; num < mapnum; num++) { 1624 /* LINTED */ 1625 (void) munmap((void *)(uintptr_t)mpp[num].mr_addr, 1626 mpp[num].mr_msize); 1627 } 1628 cnt_unmap++; 1629 } 1630 1631 /* 1632 * Map a file. 1633 */ 1634 Fct * 1635 map_obj(Lm_list *lml, Fdesc *fdp, size_t fsize, const char *name, int fd, 1636 Rej_desc *rej) 1637 { 1638 static mmapobj_result_t *smpp = NULL; 1639 static uint_t smapnum; 1640 mmapobj_result_t *mpp; 1641 uint_t mnum, mapnum, mflags; 1642 void *padding; 1643 1644 /* 1645 * Allocate an initial mapping array. The initial size should be large 1646 * enough to handle the normal ELF objects we come across. 1647 */ 1648 if (smpp == NULL) { 1649 smpp = malloc(sizeof (mmapobj_result_t) * MMAPFD_NUM); 1650 if (smpp == NULL) 1651 return (NULL); 1652 smapnum = MMAPFD_NUM; 1653 } 1654 1655 /* 1656 * If object padding is required, set the necessary flags. 1657 */ 1658 if (r_debug.rtd_objpad) { 1659 mflags = MMOBJ_INTERPRET | MMOBJ_PADDING; 1660 padding = &r_debug.rtd_objpad; 1661 } else { 1662 mflags = MMOBJ_INTERPRET; 1663 padding = NULL; 1664 } 1665 1666 /* 1667 * Map the file. If the number of mappings required by this file 1668 * exceeds the present mapping structure, an error indicating the 1669 * return data is too big is returned. Bail on any other error. 1670 */ 1671 mapnum = smapnum; 1672 if (mmapobj(fd, mflags, smpp, &mapnum, padding) == -1) { 1673 if (errno != E2BIG) { 1674 int err = errno; 1675 1676 /* 1677 * An unsupported error indicates that there's something 1678 * incompatible with this ELF file, and the process that 1679 * is already running. Map the first page of the file 1680 * and see if we can generate a better error message. 1681 */ 1682 if ((errno == ENOTSUP) && map_fail(fdp, fsize, name, 1683 fd, rej)) 1684 return (NULL); 1685 1686 rej->rej_type = SGS_REJ_STR; 1687 rej->rej_str = strerror(err); 1688 return (NULL); 1689 } 1690 1691 /* 1692 * The mapping requirement exceeds the present mapping 1693 * structure, however the number of mapping required is 1694 * available in the mapping number. 1695 */ 1696 free((void *)smpp); 1697 if ((smpp = malloc(sizeof (mmapobj_result_t) * mapnum)) == NULL) 1698 return (NULL); 1699 smapnum = mapnum; 1700 1701 /* 1702 * With the appropriate mapping structure, try the mapping 1703 * request again. 1704 */ 1705 if (mmapobj(fd, mflags, smpp, &mapnum, padding) == -1) { 1706 rej->rej_type = SGS_REJ_STR; 1707 rej->rej_str = strerror(errno); 1708 return (NULL); 1709 } 1710 } 1711 ASSERT(mapnum != 0); 1712 1713 /* 1714 * Traverse the mappings in search of a file type ld.so.1 can process. 1715 * If the file type is verified as one ld.so.1 can process, retain the 1716 * mapping information, and the number of mappings this object uses, 1717 * and clear the static mapping pointer for the next map_obj() use of 1718 * mmapobj(). 1719 */ 1720 DBG_CALL(Dbg_file_mmapobj(lml, name, smpp, mapnum)); 1721 cnt_map++; 1722 1723 for (mnum = 0, mpp = smpp; mnum < mapnum; mnum++, mpp++) { 1724 uint_t flags = (mpp->mr_flags & MR_TYPE_MASK); 1725 Fct *fptr = NULL; 1726 1727 if (flags == MR_HDR_ELF) { 1728 fptr = elf_verify((mpp->mr_addr + mpp->mr_offset), 1729 mpp->mr_fsize, fdp, name, rej); 1730 } 1731 #ifdef A_OUT 1732 if (flags == MR_HDR_AOUT) { 1733 fptr = aout_verify((mpp->mr_addr + mpp->mr_offset), 1734 mpp->mr_fsize, fdp, name, rej); 1735 } 1736 #endif 1737 if (fptr) { 1738 fdp->fd_mapn = mapnum; 1739 fdp->fd_mapp = smpp; 1740 1741 smpp = NULL; 1742 1743 return (fptr); 1744 } 1745 } 1746 1747 /* 1748 * If the mapped file is inappropriate, indicate that the file type is 1749 * unknown, and free the mapping. 1750 */ 1751 if (rej->rej_type == 0) 1752 rej->rej_type = SGS_REJ_UNKFILE; 1753 unmap_obj(smpp, mapnum); 1754 1755 return (NULL); 1756 } 1757 1758 /* 1759 * A unique file has been opened. Create a link-map to represent it, and 1760 * process the various names by which it can be referenced. 1761 */ 1762 Rt_map * 1763 load_file(Lm_list *lml, Aliste lmco, Fdesc *fdp, int *in_nfavl) 1764 { 1765 mmapobj_result_t *fpmpp = NULL, *fmpp = NULL, *lpmpp, *lmpp; 1766 mmapobj_result_t *hmpp, *mpp, *ompp = fdp->fd_mapp; 1767 uint_t mnum, omapnum = fdp->fd_mapn; 1768 const char *nname = fdp->fd_nname; 1769 Rt_map *nlmp; 1770 Ehdr *ehdr = NULL; 1771 1772 /* 1773 * Traverse the mappings for the input file to capture generic mapping 1774 * information, and create a link-map to represent the file. 1775 */ 1776 for (mnum = 0, mpp = ompp; mnum < omapnum; mnum++, mpp++) { 1777 uint_t flags = (mpp->mr_flags & MR_TYPE_MASK); 1778 1779 /* 1780 * Keep track of the first and last mappings that may include 1781 * padding. 1782 */ 1783 if (fpmpp == NULL) 1784 fpmpp = mpp; 1785 lpmpp = mpp; 1786 1787 /* 1788 * Keep track of the first and last mappings that do not include 1789 * padding. 1790 */ 1791 if (flags != MR_PADDING) { 1792 if (fmpp == NULL) 1793 fmpp = mpp; 1794 lmpp = mpp; 1795 } 1796 if (flags == MR_HDR_ELF) { 1797 /* LINTED */ 1798 ehdr = (Ehdr *)(mpp->mr_addr + mpp->mr_offset); 1799 hmpp = mpp; 1800 } else if (flags == MR_HDR_AOUT) 1801 hmpp = mpp; 1802 } 1803 1804 /* 1805 * The only ELF files we can handle are ET_EXEC, ET_DYN, and ET_REL. 1806 * 1807 * ET_REL must be processed by ld(1) to create an in-memory ET_DYN. 1808 * The initial processing carried out by elf_obj_file() creates a 1809 * temporary link-map, that acts as a place holder, until the objects 1810 * processing is finished with elf_obj_fini(). 1811 */ 1812 if (ehdr && (ehdr->e_type == ET_REL)) { 1813 if ((nlmp = elf_obj_file(lml, lmco, nname, hmpp, ompp, 1814 omapnum)) == NULL) 1815 return (nlmp); 1816 } else { 1817 Addr addr; 1818 size_t msize; 1819 1820 /* 1821 * The size of the total reservation, and the padding range, 1822 * are a historic artifact required by debuggers. Although 1823 * these values express the range of the associated mappings, 1824 * there can be holes between segments (in which small objects 1825 * could be mapped). Anyone who needs to verify offsets 1826 * against segments should analyze all the object mappings, 1827 * rather than relying on these address ranges. 1828 */ 1829 addr = (Addr)(hmpp->mr_addr + hmpp->mr_offset); 1830 msize = lmpp->mr_addr + lmpp->mr_msize - fmpp->mr_addr; 1831 1832 if ((nlmp = ((fdp->fd_ftp)->fct_new_lmp)(lml, lmco, fdp, addr, 1833 msize, NULL, in_nfavl)) == NULL) 1834 return (NULL); 1835 1836 /* 1837 * Save generic mapping information. 1838 */ 1839 MMAPS(nlmp) = ompp; 1840 MMAPCNT(nlmp) = omapnum; 1841 PADSTART(nlmp) = (ulong_t)fpmpp->mr_addr; 1842 PADIMLEN(nlmp) = lpmpp->mr_addr + lpmpp->mr_msize - 1843 fpmpp->mr_addr; 1844 } 1845 1846 /* 1847 * Save the dev/inode information for later comparisons, and identify 1848 * this as a new object. 1849 */ 1850 STDEV(nlmp) = fdp->fd_dev; 1851 STINO(nlmp) = fdp->fd_ino; 1852 FLAGS(nlmp) |= FLG_RT_NEWLOAD; 1853 1854 /* 1855 * If this is ELF relocatable object, we're done for now. 1856 */ 1857 if (ehdr && (ehdr->e_type == ET_REL)) 1858 return (nlmp); 1859 1860 /* 1861 * Insert the names of this link-map into the FullPathNode AVL tree. 1862 * Save both the NAME() and PATHNAME() if the names differ. 1863 */ 1864 (void) fullpath(nlmp, fdp); 1865 1866 if ((NAME(nlmp)[0] == '/') && (fpavl_insert(lml, nlmp, NAME(nlmp), 1867 fdp->fd_avlwhere) == 0)) { 1868 remove_so(lml, nlmp); 1869 return (NULL); 1870 } 1871 if (((NAME(nlmp)[0] != '/') || (NAME(nlmp) != PATHNAME(nlmp))) && 1872 (fpavl_insert(lml, nlmp, PATHNAME(nlmp), 0) == 0)) { 1873 remove_so(lml, nlmp); 1874 return (NULL); 1875 } 1876 1877 /* 1878 * If this is a secure application, record any full path name directory 1879 * in which this dependency has been found. This directory can be 1880 * deemed safe (as we've already found a dependency here). This 1881 * recording provides a fall-back should another objects $ORIGIN 1882 * definition expands to this directory, an expansion that would 1883 * ordinarily be deemed insecure. 1884 */ 1885 if (rtld_flags & RT_FL_SECURE) { 1886 if (NAME(nlmp)[0] == '/') 1887 spavl_insert(NAME(nlmp)); 1888 if ((NAME(nlmp) != PATHNAME(nlmp)) && 1889 (PATHNAME(nlmp)[0] == '/')) 1890 spavl_insert(PATHNAME(nlmp)); 1891 } 1892 1893 /* 1894 * If we're processing an alternative object reset the original name 1895 * for possible $ORIGIN processing. 1896 */ 1897 if (fdp->fd_flags & FLG_FD_ALTER) { 1898 const char *odir, *ndir; 1899 size_t olen; 1900 1901 FLAGS(nlmp) |= FLG_RT_ALTER; 1902 1903 /* 1904 * If we were given a pathname containing a slash then the 1905 * original name is still in oname. Otherwise the original 1906 * directory is in dir->p_name (which is all we need for 1907 * $ORIGIN). 1908 */ 1909 if (fdp->fd_flags & FLG_FD_SLASH) { 1910 char *ofil; 1911 1912 odir = fdp->fd_oname; 1913 ofil = strrchr(fdp->fd_oname, '/'); 1914 olen = ofil - odir + 1; 1915 } else { 1916 odir = fdp->fd_odir; 1917 olen = strlen(odir) + 1; 1918 } 1919 if ((ndir = stravl_insert(odir, 0, olen, 1)) == NULL) { 1920 remove_so(lml, nlmp); 1921 return (NULL); 1922 } 1923 ORIGNAME(nlmp) = ndir; 1924 DIRSZ(nlmp) = --olen; 1925 } 1926 1927 return (nlmp); 1928 } 1929 1930 /* 1931 * This function loads the named file and returns a pointer to its link map. 1932 * It is assumed that the caller has already checked that the file is not 1933 * already loaded before calling this function (refer is_so_loaded()). 1934 * Find and open the file, map it into memory, add it to the end of the list 1935 * of link maps and return a pointer to the new link map. Return 0 on error. 1936 */ 1937 static Rt_map * 1938 load_so(Lm_list *lml, Aliste lmco, Rt_map *clmp, uint_t flags, 1939 Fdesc *fdp, Rej_desc *rej, int *in_nfavl) 1940 { 1941 const char *oname = fdp->fd_oname; 1942 Pdesc *pdp; 1943 1944 /* 1945 * If this path name hasn't already been identified as containing a 1946 * slash, check the path name. Most paths have been constructed 1947 * through appending a file name to a search path, and/or have been 1948 * inspected by expand(), and thus have a slash. However, we can 1949 * receive path names via auditors or configuration files, and thus 1950 * an evaluation here catches these instances. 1951 */ 1952 if ((fdp->fd_flags & FLG_FD_SLASH) == 0) { 1953 const char *str; 1954 1955 for (str = oname; *str; str++) { 1956 if (*str == '/') { 1957 fdp->fd_flags |= FLG_FD_SLASH; 1958 break; 1959 } 1960 } 1961 } 1962 1963 /* 1964 * If we are passed a 'null' link-map this means that this is the first 1965 * object to be loaded on this link-map list. In that case we set the 1966 * link-map to ld.so.1's link-map. 1967 * 1968 * This link-map is referenced to determine what lookup rules to use 1969 * when searching for files. By using ld.so.1's we are defaulting to 1970 * ELF look-up rules. 1971 * 1972 * Note: This case happens when loading the first object onto 1973 * the plt_tracing link-map. 1974 */ 1975 if (clmp == 0) 1976 clmp = lml_rtld.lm_head; 1977 1978 /* 1979 * If this path resulted from a $CAPABILITY specification, then the 1980 * best capability object has already been establish, and is available 1981 * in the calling file descriptor. Perform some minor book-keeping so 1982 * that we can fall through into common code. 1983 */ 1984 if (flags & FLG_RT_CAP) { 1985 /* 1986 * If this object is already loaded, we're done. 1987 */ 1988 if (fdp->fd_lmp) 1989 return (fdp->fd_lmp); 1990 1991 /* 1992 * Obtain the avl index for this object. 1993 */ 1994 (void) fpavl_recorded(lml, fdp->fd_nname, 0, 1995 &(fdp->fd_avlwhere)); 1996 1997 } else if (fdp->fd_flags & FLG_FD_SLASH) { 1998 Rej_desc _rej = { 0 }; 1999 2000 if (find_path(lml, clmp, flags, fdp, &_rej, in_nfavl) == 0) { 2001 rejection_inherit(rej, &_rej); 2002 return (NULL); 2003 } 2004 2005 /* 2006 * If this object is already loaded, we're done. 2007 */ 2008 if (fdp->fd_lmp) 2009 return (fdp->fd_lmp); 2010 2011 } else { 2012 /* 2013 * No '/' - for each directory on list, make a pathname using 2014 * that directory and filename and try to open that file. 2015 */ 2016 Spath_desc sd = { search_rules, NULL, 0 }; 2017 Word strhash = 0; 2018 int found = 0; 2019 2020 DBG_CALL(Dbg_libs_find(lml, oname)); 2021 2022 /* 2023 * Traverse the search path lists, creating full pathnames and 2024 * attempt to load each path. 2025 */ 2026 for (pdp = get_next_dir(&sd, clmp, flags); pdp; 2027 pdp = get_next_dir(&sd, clmp, flags)) { 2028 Rej_desc _rej = { 0 }; 2029 Fdesc fd = { 0 }; 2030 2031 /* 2032 * Under debugging, duplicate path name entries are 2033 * tagged but remain part of the search path list so 2034 * that they can be diagnosed under "unused" processing. 2035 * Skip these entries, as this path would have already 2036 * been attempted. 2037 */ 2038 if (pdp->pd_flags & PD_FLG_DUPLICAT) 2039 continue; 2040 2041 fd = *fdp; 2042 2043 /* 2044 * Try and locate this file. Make sure to clean up 2045 * any rejection information should the file have 2046 * been found, but not appropriate. 2047 */ 2048 if (find_file(lml, clmp, flags, &fd, &_rej, pdp, 2049 &strhash, in_nfavl) == 0) { 2050 rejection_inherit(rej, &_rej); 2051 continue; 2052 } 2053 2054 /* 2055 * Indicate that this search path has been used. If 2056 * this is an LD_LIBRARY_PATH setting, ignore any use 2057 * by ld.so.1 itself. 2058 */ 2059 if (((pdp->pd_flags & LA_SER_LIBPATH) == 0) || 2060 ((lml->lm_flags & LML_FLG_RTLDLM) == 0)) 2061 pdp->pd_flags |= PD_FLG_USED; 2062 2063 /* 2064 * If this object is already loaded, we're done. 2065 */ 2066 *fdp = fd; 2067 if (fdp->fd_lmp) 2068 return (fdp->fd_lmp); 2069 2070 fdp->fd_odir = pdp->pd_pname; 2071 found = 1; 2072 break; 2073 } 2074 2075 /* 2076 * If the file couldn't be loaded, do another comparison of 2077 * loaded files using just the basename. This catches folks 2078 * who may have loaded multiple full pathname files (possibly 2079 * from setxid applications) to satisfy dependency relationships 2080 * (i.e., a file might have a dependency on foo.so.1 which has 2081 * already been opened using its full pathname). 2082 */ 2083 if (found == 0) 2084 return (is_so_loaded(lml, oname, in_nfavl)); 2085 } 2086 2087 /* 2088 * Trace that this successfully opened file is about to be processed. 2089 * Note, as part of processing a family of hardware capabilities filtees 2090 * a number of candidates may have been opened and mapped to determine 2091 * their capability requirements. At this point we've decided which 2092 * of the candidates to use. 2093 */ 2094 if (lml->lm_flags & LML_FLG_TRC_ENABLE) { 2095 trace_so(clmp, 0, fdp->fd_oname, fdp->fd_nname, 2096 (fdp->fd_flags & FLG_FD_ALTER), 0); 2097 } 2098 2099 /* 2100 * Finish mapping the file and return the link-map descriptor. 2101 */ 2102 return (load_file(lml, lmco, fdp, in_nfavl)); 2103 } 2104 2105 /* 2106 * Trace an attempt to load an object, and seed the originating name. 2107 */ 2108 const char * 2109 load_trace(Lm_list *lml, Pdesc *pdp, Rt_map *clmp, Fdesc *fdp) 2110 { 2111 const char *name = pdp->pd_pname; 2112 2113 /* 2114 * First generate any ldd(1) diagnostics. 2115 */ 2116 if ((lml->lm_flags & (LML_FLG_TRC_VERBOSE | LML_FLG_TRC_SEARCH)) && 2117 ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) 2118 (void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name, NAME(clmp)); 2119 2120 /* 2121 * Propagate any knowledge of a slash within the path name. 2122 */ 2123 if (pdp->pd_flags & PD_FLG_PNSLASH) 2124 fdp->fd_flags |= FLG_FD_SLASH; 2125 2126 /* 2127 * If we're being audited tell the audit library of the file we're 2128 * about to go search for. 2129 */ 2130 if (((lml->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_ACTIVITY) && 2131 (lml == LIST(clmp))) 2132 audit_activity(clmp, LA_ACT_ADD); 2133 2134 if ((lml->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_OBJSEARCH) { 2135 char *aname; 2136 2137 /* 2138 * The auditor can indicate that this object should be ignored. 2139 */ 2140 if ((aname = 2141 audit_objsearch(clmp, name, LA_SER_ORIG)) == NULL) { 2142 DBG_CALL(Dbg_audit_terminate(lml, name)); 2143 return (NULL); 2144 } 2145 2146 if (name != aname) { 2147 fdp->fd_flags &= ~FLG_FD_SLASH; 2148 name = aname; 2149 } 2150 } 2151 fdp->fd_oname = name; 2152 return (name); 2153 } 2154 2155 /* 2156 * Having loaded an object and created a link-map to describe it, finish 2157 * processing this stage, including verifying any versioning requirements, 2158 * updating the objects mode, creating a handle if necessary, and adding this 2159 * object to existing handles if required. 2160 */ 2161 static int 2162 load_finish(Lm_list *lml, const char *name, Rt_map *clmp, int nmode, 2163 uint_t flags, Grp_hdl **hdl, Rt_map *nlmp) 2164 { 2165 Aliste idx1; 2166 Grp_hdl *ghp; 2167 int promote; 2168 uint_t rdflags; 2169 2170 /* 2171 * If this dependency is associated with a required version ensure that 2172 * the version is present in the loaded file. 2173 */ 2174 if (((rtld_flags & RT_FL_NOVERSION) == 0) && THIS_IS_ELF(clmp) && 2175 VERNEED(clmp) && (elf_verify_vers(name, clmp, nlmp) == 0)) 2176 return (0); 2177 2178 /* 2179 * If this object has indicated that it should be isolated as a group 2180 * (DT_FLAGS_1 contains DF_1_GROUP - object was built with -B group), 2181 * or if the callers direct bindings indicate it should be isolated as 2182 * a group (DYNINFO flags contains FLG_DI_GROUP - dependency following 2183 * -zgroupperm), establish the appropriate mode. 2184 * 2185 * The intent of an object defining itself as a group is to isolate the 2186 * relocation of the group within its own members, however, unless 2187 * opened through dlopen(), in which case we assume dlsym() will be used 2188 * to locate symbols in the new object, we still need to associate the 2189 * new object with the caller so that the caller can bind to this new 2190 * object. This is equivalent to a dlopen(RTLD_GROUP) and dlsym() 2191 * using the returned handle. 2192 */ 2193 if ((FLAGS(nlmp) | flags) & FLG_RT_SETGROUP) { 2194 nmode &= ~RTLD_WORLD; 2195 nmode |= RTLD_GROUP; 2196 2197 /* 2198 * If the object wasn't explicitly dlopen()'ed, in which case a 2199 * handle would have been requested, associate the object with 2200 * the parent. 2201 */ 2202 if ((flags & FLG_RT_PUBHDL) == 0) 2203 nmode |= RTLD_PARENT; 2204 } 2205 2206 /* 2207 * Establish new mode and flags. 2208 */ 2209 promote = update_mode(nlmp, MODE(nlmp), nmode); 2210 FLAGS(nlmp) |= flags; 2211 2212 /* 2213 * Establish the flags for any referenced dependency descriptors 2214 * (Grp_desc). 2215 * 2216 * - The referenced object is available for dlsym(). 2217 * - The referenced object is available to relocate against. 2218 * - The referenced object should have it's dependencies 2219 * added to this handle 2220 */ 2221 rdflags = (GPD_DLSYM | GPD_RELOC | GPD_ADDEPS); 2222 2223 /* 2224 * If we've been asked to establish a handle create one for this object. 2225 * Or, if this object has already been analyzed, but this reference 2226 * requires that the mode of the object be promoted, create a private 2227 * handle to propagate the new modes to all this objects dependencies. 2228 */ 2229 if ((FLAGS(nlmp) & (FLG_RT_PUBHDL | FLG_RT_PRIHDL)) || 2230 (promote && (FLAGS(nlmp) & FLG_RT_ANALYZED))) { 2231 uint_t oflags, hflags, cdflags = 0; 2232 2233 /* 2234 * Establish any flags for the handle (Grp_hdl). 2235 * 2236 * - Public handles establish dependencies between objects 2237 * that must be taken into account when dlclose()'ing 2238 * objects. Private handles provide for collecting 2239 * dependencies, but do not affect dlclose(). Note that 2240 * a handle may already exist, but the public/private 2241 * state is set to trigger the required propagation of the 2242 * handle's flags and any dependency gathering. 2243 * - Use of the RTLD_FIRST flag indicates that only the first 2244 * dependency on the handle (the new object) can be used 2245 * to satisfy dlsym() requests. 2246 */ 2247 if (FLAGS(nlmp) & FLG_RT_PUBHDL) 2248 hflags = GPH_PUBLIC; 2249 else 2250 hflags = GPH_PRIVATE; 2251 2252 if (nmode & RTLD_FIRST) 2253 hflags |= GPH_FIRST; 2254 2255 /* 2256 * Establish the flags for this callers dependency descriptor 2257 * (Grp_desc). 2258 * 2259 * - The creation of a public handle creates a descriptor 2260 * for the referenced object and the caller (parent). 2261 * Typically, the handle is created for dlopen() or for 2262 * filtering. A private handle does not need to maintain 2263 * a descriptor to the parent. 2264 * - Use of the RTLD_PARENT flag indicates that the parent 2265 * can be relocated against. 2266 */ 2267 if (FLAGS(nlmp) & FLG_RT_PUBHDL) { 2268 cdflags |= GPD_PARENT; 2269 if (nmode & RTLD_PARENT) 2270 cdflags |= GPD_RELOC; 2271 } 2272 2273 /* 2274 * Now that the handle flags have been established, remove any 2275 * handle definition from the referenced object so that the 2276 * definitions don't mistakenly get inherited by a dependency. 2277 */ 2278 oflags = FLAGS(nlmp); 2279 FLAGS(nlmp) &= ~(FLG_RT_PUBHDL | FLG_RT_PRIHDL); 2280 2281 DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD)); 2282 if ((ghp = hdl_create(lml, nlmp, clmp, hflags, rdflags, 2283 cdflags)) == NULL) 2284 return (0); 2285 2286 /* 2287 * Add any dependencies that are already loaded, to the handle. 2288 */ 2289 if (hdl_initialize(ghp, nlmp, nmode, promote) == 0) 2290 return (0); 2291 2292 if (hdl) 2293 *hdl = ghp; 2294 2295 /* 2296 * If we were asked to create a public handle, we're done. 2297 * 2298 * If this is a private handle request, then the handle is left 2299 * intact with a GPH_PRIVATE identifier. This handle is a 2300 * convenience for processing the dependencies of this object, 2301 * but does not affect how this object might be dlclose()'d. 2302 * For a private handle, fall through to carry out any group 2303 * processing. 2304 */ 2305 if (oflags & FLG_RT_PUBHDL) 2306 return (1); 2307 } 2308 2309 /* 2310 * If the caller isn't part of a group we're done. 2311 */ 2312 if (GROUPS(clmp) == NULL) 2313 return (1); 2314 2315 /* 2316 * Determine if our caller is already associated with a handle, if so 2317 * we need to add this object to any handles that already exist. 2318 * Traverse the list of groups our caller is a member of and add this 2319 * new link-map to those groups. 2320 */ 2321 for (APLIST_TRAVERSE(GROUPS(clmp), idx1, ghp)) { 2322 Aliste idx2; 2323 Grp_desc *gdp; 2324 int ale; 2325 Rt_map *dlmp1; 2326 APlist *lmalp = NULL; 2327 2328 DBG_CALL(Dbg_file_hdl_title(DBG_HDL_ADD)); 2329 2330 /* 2331 * If the caller doesn't indicate that its dependencies should 2332 * be added to a handle, ignore it. This case identifies a 2333 * parent of a dlopen(RTLD_PARENT) request. 2334 */ 2335 for (ALIST_TRAVERSE(ghp->gh_depends, idx2, gdp)) { 2336 if (gdp->gd_depend == clmp) 2337 break; 2338 } 2339 if ((gdp->gd_flags & GPD_ADDEPS) == 0) 2340 continue; 2341 2342 if ((gdp = hdl_add(ghp, nlmp, rdflags, &ale)) == NULL) 2343 return (0); 2344 2345 /* 2346 * If this member already exists then its dependencies will 2347 * have already been processed. 2348 */ 2349 if (ale == ALE_EXISTS) 2350 continue; 2351 2352 /* 2353 * If the object we've added has just been opened, it will not 2354 * yet have been processed for its dependencies, these will be 2355 * added on later calls to load_one(). If it doesn't have any 2356 * dependencies we're also done. 2357 */ 2358 if (((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0) || 2359 (DEPENDS(nlmp) == NULL)) 2360 continue; 2361 2362 /* 2363 * Otherwise, this object exists and has dependencies, so add 2364 * all of its dependencies to the handle were operating on. 2365 */ 2366 if (aplist_append(&lmalp, nlmp, AL_CNT_DEPCLCT) == NULL) 2367 return (0); 2368 2369 for (APLIST_TRAVERSE(lmalp, idx2, dlmp1)) { 2370 Aliste idx3; 2371 Bnd_desc *bdp; 2372 2373 /* 2374 * Add any dependencies of this dependency to the 2375 * dynamic dependency list so they can be further 2376 * processed. 2377 */ 2378 for (APLIST_TRAVERSE(DEPENDS(dlmp1), idx3, bdp)) { 2379 Rt_map *dlmp2 = bdp->b_depend; 2380 2381 if ((bdp->b_flags & BND_NEEDED) == 0) 2382 continue; 2383 2384 if (aplist_test(&lmalp, dlmp2, 2385 AL_CNT_DEPCLCT) == 0) { 2386 free(lmalp); 2387 return (0); 2388 } 2389 } 2390 2391 if (nlmp == dlmp1) 2392 continue; 2393 2394 if ((gdp = 2395 hdl_add(ghp, dlmp1, rdflags, &ale)) == NULL) { 2396 free(lmalp); 2397 return (0); 2398 } 2399 2400 if (ale == ALE_CREATE) 2401 (void) update_mode(dlmp1, MODE(dlmp1), nmode); 2402 } 2403 free(lmalp); 2404 } 2405 return (1); 2406 } 2407 2408 /* 2409 * The central routine for loading shared objects. Insures ldd() diagnostics, 2410 * handles and any other related additions are all done in one place. 2411 */ 2412 Rt_map * 2413 load_path(Lm_list *lml, Aliste lmco, Rt_map *clmp, int nmode, uint_t flags, 2414 Grp_hdl **hdl, Fdesc *fdp, Rej_desc *rej, int *in_nfavl) 2415 { 2416 const char *name = fdp->fd_oname; 2417 Rt_map *nlmp; 2418 2419 if ((nmode & RTLD_NOLOAD) == 0) { 2420 int oin_nfavl; 2421 2422 /* 2423 * Keep track of the number of not-found loads. 2424 */ 2425 if (in_nfavl) 2426 oin_nfavl = *in_nfavl; 2427 2428 /* 2429 * If this isn't a noload request attempt to load the file. 2430 */ 2431 if ((nlmp = load_so(lml, lmco, clmp, flags, fdp, rej, 2432 in_nfavl)) == NULL) 2433 return (NULL); 2434 2435 /* 2436 * If this file has been found, reset the not-found load count. 2437 * Although a search for this file might have inspected a number 2438 * of non-existent path names, the file has been found so there 2439 * is no need to accumulate a non-found count, as this may 2440 * trigger unnecessary fall back (retry) processing. 2441 */ 2442 if (in_nfavl) 2443 *in_nfavl = oin_nfavl; 2444 2445 /* 2446 * If we've loaded a library which identifies itself as not 2447 * being dlopen()'able catch it here. Let non-dlopen()'able 2448 * objects through under RTLD_CONFGEN as they're only being 2449 * mapped to be dldump()'ed. 2450 */ 2451 if ((rtld_flags & RT_FL_APPLIC) && ((FLAGS(nlmp) & 2452 (FLG_RT_NOOPEN | FLG_RT_RELOCED)) == FLG_RT_NOOPEN) && 2453 ((nmode & RTLD_CONFGEN) == 0)) { 2454 Rej_desc _rej = { 0 }; 2455 2456 _rej.rej_name = name; 2457 _rej.rej_type = SGS_REJ_STR; 2458 _rej.rej_str = MSG_INTL(MSG_GEN_NOOPEN); 2459 DBG_CALL(Dbg_file_rejected(lml, &_rej, M_MACH)); 2460 rejection_inherit(rej, &_rej); 2461 remove_so(lml, nlmp); 2462 return (NULL); 2463 } 2464 } else { 2465 /* 2466 * If it's a NOLOAD request - check to see if the object 2467 * has already been loaded. 2468 */ 2469 /* LINTED */ 2470 if (nlmp = is_so_loaded(lml, name, in_nfavl)) { 2471 if ((lml->lm_flags & LML_FLG_TRC_VERBOSE) && 2472 ((FLAGS1(clmp) & FL1_RT_LDDSTUB) == 0)) { 2473 (void) printf(MSG_INTL(MSG_LDD_FIL_FIND), name, 2474 NAME(clmp)); 2475 /* BEGIN CSTYLED */ 2476 if (*name == '/') 2477 (void) printf(MSG_ORIG(MSG_LDD_FIL_PATH), 2478 name, MSG_ORIG(MSG_STR_EMPTY), 2479 MSG_ORIG(MSG_STR_EMPTY)); 2480 else 2481 (void) printf(MSG_ORIG(MSG_LDD_FIL_EQUIV), 2482 name, NAME(nlmp), 2483 MSG_ORIG(MSG_STR_EMPTY), 2484 MSG_ORIG(MSG_STR_EMPTY)); 2485 /* END CSTYLED */ 2486 } 2487 } else { 2488 Rej_desc _rej = { 0 }; 2489 2490 _rej.rej_name = name; 2491 _rej.rej_type = SGS_REJ_STR; 2492 _rej.rej_str = strerror(ENOENT); 2493 DBG_CALL(Dbg_file_rejected(lml, &_rej, M_MACH)); 2494 rejection_inherit(rej, &_rej); 2495 return (NULL); 2496 } 2497 } 2498 2499 /* 2500 * Finish processing this loaded object. 2501 */ 2502 if (load_finish(lml, name, clmp, nmode, flags, hdl, nlmp) == 0) { 2503 FLAGS(nlmp) &= ~FLG_RT_NEWLOAD; 2504 2505 /* 2506 * If this object has already been analyzed, then it is in use, 2507 * so even though this operation has failed, it should not be 2508 * torn down. 2509 */ 2510 if ((FLAGS(nlmp) & FLG_RT_ANALYZED) == 0) 2511 remove_so(lml, nlmp); 2512 return (NULL); 2513 } 2514 2515 /* 2516 * If this object is new, and we're being audited, tell the audit 2517 * library of the file we've just opened. Note, if the new link-map 2518 * requires local auditing of its dependencies we also register its 2519 * opening. 2520 */ 2521 if (FLAGS(nlmp) & FLG_RT_NEWLOAD) { 2522 FLAGS(nlmp) &= ~FLG_RT_NEWLOAD; 2523 2524 if (((lml->lm_tflags | AFLAGS(clmp) | AFLAGS(nlmp)) & 2525 LML_TFLG_AUD_MASK) && (((lml->lm_flags | 2526 LIST(clmp)->lm_flags) & LML_FLG_NOAUDIT) == 0)) { 2527 if (audit_objopen(clmp, nlmp) == 0) { 2528 remove_so(lml, nlmp); 2529 return (NULL); 2530 } 2531 } 2532 } 2533 return (nlmp); 2534 } 2535 2536 /* 2537 * Load one object from a possible list of objects. Typically, for requests 2538 * such as NEEDED's, only one object is specified. However, this object could 2539 * be specified using $ISALIST or $CAPABILITY, in which case only the first 2540 * object that can be loaded is used (ie. the best). 2541 */ 2542 Rt_map * 2543 load_one(Lm_list *lml, Aliste lmco, Alist *palp, Rt_map *clmp, int mode, 2544 uint_t flags, Grp_hdl **hdl, int *in_nfavl) 2545 { 2546 Rej_desc rej = { 0 }; 2547 Aliste idx; 2548 Pdesc *pdp; 2549 const char *name; 2550 2551 for (ALIST_TRAVERSE(palp, idx, pdp)) { 2552 Rt_map *lmp = NULL; 2553 2554 /* 2555 * A $CAPABILITY/$HWCAP requirement can expand into a number of 2556 * candidates. 2557 */ 2558 if (pdp->pd_flags & PD_TKN_CAP) { 2559 lmp = load_cap(lml, lmco, pdp->pd_pname, clmp, 2560 mode, (flags | FLG_RT_CAP), hdl, &rej, in_nfavl); 2561 } else { 2562 Fdesc fd = { 0 }; 2563 2564 /* 2565 * Trace the inspection of this file, determine any 2566 * auditor substitution, and seed the file descriptor 2567 * with the originating name. 2568 */ 2569 if (load_trace(lml, pdp, clmp, &fd) == NULL) 2570 continue; 2571 2572 /* 2573 * Locate and load the file. 2574 */ 2575 lmp = load_path(lml, lmco, clmp, mode, flags, hdl, &fd, 2576 &rej, in_nfavl); 2577 } 2578 if (lmp) 2579 return (lmp); 2580 } 2581 2582 /* 2583 * If no objects can be found, use the first path name from the Alist 2584 * to provide a diagnostic. If this pathname originated from an 2585 * expanded token, use the original name for any diagnostic output. 2586 */ 2587 pdp = alist_item(palp, 0); 2588 2589 if ((name = pdp->pd_oname) == 0) 2590 name = pdp->pd_pname; 2591 2592 file_notfound(lml, name, clmp, flags, &rej); 2593 return (NULL); 2594 } 2595 2596 /* 2597 * Determine whether a symbol is defined as an interposer. 2598 */ 2599 int 2600 is_sym_interposer(Rt_map *lmp, Sym *sym) 2601 { 2602 Syminfo *sip = SYMINFO(lmp); 2603 2604 if (sip) { 2605 ulong_t ndx; 2606 2607 ndx = (((ulong_t)sym - (ulong_t)SYMTAB(lmp)) / SYMENT(lmp)); 2608 /* LINTED */ 2609 sip = (Syminfo *)((char *)sip + (ndx * SYMINENT(lmp))); 2610 if (sip->si_flags & SYMINFO_FLG_INTERPOSE) 2611 return (1); 2612 } 2613 return (0); 2614 } 2615 2616 /* 2617 * While processing direct or group bindings, determine whether the object to 2618 * which we've bound can be interposed upon. In this context, copy relocations 2619 * are a form of interposition. 2620 */ 2621 static int 2622 lookup_sym_interpose(Slookup *slp, Sresult *srp, uint_t *binfo, int *in_nfavl) 2623 { 2624 Rt_map *lmp, *clmp, *dlmp = srp->sr_dmap; 2625 Sym *osym = srp->sr_sym; 2626 Slookup sl; 2627 Lm_list *lml; 2628 2629 /* 2630 * If we've bound to a copy relocation definition then we need to assign 2631 * this binding to the original copy reference. Fabricate an inter- 2632 * position diagnostic, as this is a legitimate form of interposition. 2633 */ 2634 if (osym && (FLAGS1(dlmp) & FL1_RT_COPYTOOK)) { 2635 Rel_copy *rcp; 2636 Aliste idx; 2637 2638 for (ALIST_TRAVERSE(COPY_R(dlmp), idx, rcp)) { 2639 if ((osym == rcp->r_dsym) || (osym->st_value && 2640 (osym->st_value == rcp->r_dsym->st_value))) { 2641 srp->sr_dmap = rcp->r_rlmp; 2642 srp->sr_sym = rcp->r_rsym; 2643 *binfo |= 2644 (DBG_BINFO_INTERPOSE | DBG_BINFO_COPYREF); 2645 return (1); 2646 } 2647 } 2648 } 2649 2650 /* 2651 * If a symbol binding has been established, inspect the link-map list 2652 * of the destination object, otherwise use the link-map list of the 2653 * original caller. 2654 */ 2655 if (osym) 2656 clmp = dlmp; 2657 else 2658 clmp = slp->sl_cmap; 2659 2660 lml = LIST(clmp); 2661 lmp = lml->lm_head; 2662 2663 /* 2664 * Prior to Solaris 8, external references from an executable that were 2665 * bound to an uninitialized variable (.bss) within a shared object did 2666 * not establish a copy relocation. This was thought to be an 2667 * optimization, to prevent copying zero's to zero's. Typically, 2668 * interposition took its course, with the shared object binding to the 2669 * executables data definition. 2670 * 2671 * This scenario can be broken when this old executable runs against a 2672 * new shared object that is directly bound. With no copy-relocation 2673 * record, ld.so.1 has no data to trigger the normal vectoring of the 2674 * binding to the executable. 2675 * 2676 * Starting with Solaris 8, a DT_FLAGS entry is written to all objects, 2677 * regardless of there being any DF_ flags entries. Therefore, an 2678 * object without this dynamic tag is susceptible to the copy relocation 2679 * issue. If the executable has no DT_FLAGS tag, and contains the same 2680 * .bss symbol definition as has been directly bound to, redirect the 2681 * binding to the executables data definition. 2682 */ 2683 if (osym && ((FLAGS1(lmp) & FL1_RT_DTFLAGS) == 0) && 2684 (FCT(lmp) == &elf_fct) && 2685 (ELF_ST_TYPE(osym->st_info) != STT_FUNC) && 2686 are_bits_zero(dlmp, osym, 0)) { 2687 Sresult sr; 2688 2689 /* 2690 * Initialize a local symbol result descriptor, using the 2691 * original symbol name. Initialize a local symbol lookup 2692 * descriptor, using the original lookup information, and a 2693 * new initial link-map. 2694 */ 2695 SRESULT_INIT(sr, slp->sl_name); 2696 sl = *slp; 2697 sl.sl_imap = lmp; 2698 2699 /* 2700 * Determine whether the same symbol name exists within the 2701 * executable, that the size and type of symbol are the same, 2702 * and that the symbol is also associated with .bss. 2703 */ 2704 if (SYMINTP(lmp)(&sl, &sr, binfo, in_nfavl)) { 2705 Sym *isym = sr.sr_sym; 2706 2707 if ((isym->st_size == osym->st_size) && 2708 (isym->st_info == osym->st_info) && 2709 are_bits_zero(lmp, isym, 1)) { 2710 *srp = sr; 2711 *binfo |= 2712 (DBG_BINFO_INTERPOSE | DBG_BINFO_COPYREF); 2713 return (1); 2714 } 2715 } 2716 } 2717 2718 if ((lml->lm_flags & LML_FLG_INTRPOSE) == 0) 2719 return (NULL); 2720 2721 /* 2722 * Traverse the list of known interposers to determine whether any 2723 * offer the same symbol. Note, the head of the link-map could be 2724 * identified as an interposer. Otherwise, skip the head of the 2725 * link-map, so that we don't bind to any .plt references, or 2726 * copy-relocation destinations unintentionally. 2727 */ 2728 lmp = lml->lm_head; 2729 sl = *slp; 2730 2731 if (((FLAGS(lmp) & MSK_RT_INTPOSE) == 0) || (sl.sl_flags & LKUP_COPY)) 2732 lmp = NEXT_RT_MAP(lmp); 2733 2734 for (; lmp; lmp = NEXT_RT_MAP(lmp)) { 2735 if (FLAGS(lmp) & FLG_RT_DELETE) 2736 continue; 2737 if ((FLAGS(lmp) & MSK_RT_INTPOSE) == 0) 2738 break; 2739 2740 /* 2741 * If we had already bound to this object, there's no point in 2742 * searching it again, we're done. 2743 */ 2744 if (lmp == dlmp) 2745 break; 2746 2747 /* 2748 * If this interposer can be inspected by the caller, look for 2749 * the symbol within the interposer. 2750 */ 2751 if (callable(clmp, lmp, 0, sl.sl_flags)) { 2752 Sresult sr; 2753 2754 /* 2755 * Initialize a local symbol result descriptor, using 2756 * the original symbol name. Initialize a local symbol 2757 * lookup descriptor, using the original lookup 2758 * information, and a new initial link-map. 2759 */ 2760 SRESULT_INIT(sr, slp->sl_name); 2761 sl.sl_imap = lmp; 2762 2763 if (SYMINTP(lmp)(&sl, &sr, binfo, in_nfavl)) { 2764 Sym *isym = sr.sr_sym; 2765 Rt_map *ilmp = sr.sr_dmap; 2766 2767 /* 2768 * If this object provides individual symbol 2769 * interposers, make sure that the symbol we 2770 * have found is tagged as an interposer. 2771 */ 2772 if ((FLAGS(ilmp) & FLG_RT_SYMINTPO) && 2773 (is_sym_interposer(ilmp, isym) == 0)) 2774 continue; 2775 2776 /* 2777 * Indicate this binding has occurred to an 2778 * interposer, and return the symbol. 2779 */ 2780 *srp = sr; 2781 *binfo |= DBG_BINFO_INTERPOSE; 2782 return (1); 2783 } 2784 } 2785 } 2786 return (0); 2787 } 2788 2789 /* 2790 * If an object specifies direct bindings (it contains a syminfo structure 2791 * describing where each binding was established during link-editing, and the 2792 * object was built -Bdirect), then look for the symbol in the specific object. 2793 */ 2794 static int 2795 lookup_sym_direct(Slookup *slp, Sresult *srp, uint_t *binfo, Syminfo *sip, 2796 Rt_map *lmp, int *in_nfavl) 2797 { 2798 Rt_map *dlmp, *clmp = slp->sl_cmap; 2799 int ret; 2800 Slookup sl; 2801 2802 /* 2803 * If a direct binding resolves to the definition of a copy relocated 2804 * variable, it must be redirected to the copy (in the executable) that 2805 * will eventually be made. Typically, this redirection occurs in 2806 * lookup_sym_interpose(). But, there's an edge condition. If a 2807 * directly bound executable contains pic code, there may be a 2808 * reference to a definition that will eventually have a copy made. 2809 * However, this copy relocation may not yet have occurred, because 2810 * the relocation making this reference comes before the relocation 2811 * that will create the copy. 2812 * Under direct bindings, the syminfo indicates that a copy will be 2813 * taken (SYMINFO_FLG_COPY). This can only be set in an executable. 2814 * Thus, the caller must be the executable, so bind to the destination 2815 * of the copy within the executable. 2816 */ 2817 if (((slp->sl_flags & LKUP_COPY) == 0) && 2818 (sip->si_flags & SYMINFO_FLG_COPY)) { 2819 slp->sl_imap = LIST(clmp)->lm_head; 2820 2821 if (ret = SYMINTP(clmp)(slp, srp, binfo, in_nfavl)) 2822 *binfo |= (DBG_BINFO_DIRECT | DBG_BINFO_COPYREF); 2823 return (ret); 2824 } 2825 2826 /* 2827 * If we need to directly bind to our parent, start looking in each 2828 * callers link map. 2829 */ 2830 sl = *slp; 2831 sl.sl_flags |= LKUP_DIRECT; 2832 ret = 0; 2833 2834 if (sip->si_boundto == SYMINFO_BT_PARENT) { 2835 Aliste idx1; 2836 Bnd_desc *bdp; 2837 Grp_hdl *ghp; 2838 2839 /* 2840 * Determine the parent of this explicit dependency from its 2841 * CALLERS()'s list. 2842 */ 2843 for (APLIST_TRAVERSE(CALLERS(clmp), idx1, bdp)) { 2844 sl.sl_imap = lmp = bdp->b_caller; 2845 if (ret = SYMINTP(lmp)(&sl, srp, binfo, in_nfavl)) 2846 goto found; 2847 } 2848 2849 /* 2850 * A caller can also be defined as the parent of a dlopen() 2851 * call. Determine whether this object has any handles. The 2852 * dependencies maintained with the handle represent the 2853 * explicit dependencies of the dlopen()'ed object, and the 2854 * calling parent. 2855 */ 2856 for (APLIST_TRAVERSE(HANDLES(clmp), idx1, ghp)) { 2857 Grp_desc *gdp; 2858 Aliste idx2; 2859 2860 for (ALIST_TRAVERSE(ghp->gh_depends, idx2, gdp)) { 2861 if ((gdp->gd_flags & GPD_PARENT) == 0) 2862 continue; 2863 sl.sl_imap = lmp = gdp->gd_depend; 2864 if (ret = SYMINTP(lmp)(&sl, srp, binfo, 2865 in_nfavl)) 2866 goto found; 2867 } 2868 } 2869 } else { 2870 /* 2871 * If we need to direct bind to anything else look in the 2872 * link map associated with this symbol reference. 2873 */ 2874 if (sip->si_boundto == SYMINFO_BT_SELF) 2875 sl.sl_imap = lmp = clmp; 2876 else 2877 sl.sl_imap = lmp; 2878 2879 if (lmp) 2880 ret = SYMINTP(lmp)(&sl, srp, binfo, in_nfavl); 2881 } 2882 found: 2883 if (ret) 2884 *binfo |= DBG_BINFO_DIRECT; 2885 2886 /* 2887 * If a reference to a directly bound symbol can't be satisfied, then 2888 * determine whether an interposer can provide the missing symbol. If 2889 * a reference to a directly bound symbol is satisfied, then determine 2890 * whether that object can be interposed upon for this symbol. 2891 */ 2892 dlmp = srp->sr_dmap; 2893 if ((ret == 0) || (dlmp && (LIST(dlmp)->lm_head != dlmp) && 2894 (LIST(dlmp) == LIST(clmp)))) { 2895 if (lookup_sym_interpose(slp, srp, binfo, in_nfavl)) 2896 return (1); 2897 } 2898 2899 return (ret); 2900 } 2901 2902 static int 2903 core_lookup_sym(Rt_map *ilmp, Slookup *slp, Sresult *srp, uint_t *binfo, 2904 Aliste off, int *in_nfavl) 2905 { 2906 Rt_map *lmp; 2907 2908 /* 2909 * Copy relocations should start their search after the head of the 2910 * main link-map control list. 2911 */ 2912 if ((off == ALIST_OFF_DATA) && (slp->sl_flags & LKUP_COPY) && ilmp) 2913 lmp = NEXT_RT_MAP(ilmp); 2914 else 2915 lmp = ilmp; 2916 2917 for (; lmp; lmp = NEXT_RT_MAP(lmp)) { 2918 if (callable(slp->sl_cmap, lmp, 0, slp->sl_flags)) { 2919 2920 slp->sl_imap = lmp; 2921 if ((SYMINTP(lmp)(slp, srp, binfo, in_nfavl)) || 2922 (*binfo & BINFO_MSK_TRYAGAIN)) 2923 return (1); 2924 } 2925 } 2926 return (0); 2927 } 2928 2929 static int 2930 rescan_lazy_find_sym(Rt_map *ilmp, Slookup *slp, Sresult *srp, uint_t *binfo, 2931 int *in_nfavl) 2932 { 2933 Rt_map *lmp; 2934 2935 for (lmp = ilmp; lmp; lmp = NEXT_RT_MAP(lmp)) { 2936 if (LAZY(lmp) == 0) 2937 continue; 2938 if (callable(slp->sl_cmap, lmp, 0, slp->sl_flags)) { 2939 2940 slp->sl_imap = lmp; 2941 if (elf_lazy_find_sym(slp, srp, binfo, in_nfavl)) 2942 return (1); 2943 } 2944 } 2945 return (0); 2946 } 2947 2948 static int 2949 _lookup_sym(Slookup *slp, Sresult *srp, uint_t *binfo, int *in_nfavl) 2950 { 2951 const char *name = slp->sl_name; 2952 Rt_map *clmp = slp->sl_cmap; 2953 Lm_list *lml = LIST(clmp); 2954 Rt_map *ilmp = slp->sl_imap, *lmp; 2955 ulong_t rsymndx; 2956 int ret; 2957 Syminfo *sip; 2958 Slookup sl; 2959 2960 /* 2961 * Search the initial link map for the required symbol (this category is 2962 * selected by dlsym(), where individual link maps are searched for a 2963 * required symbol. Therefore, we know we have permission to look at 2964 * the link map). 2965 */ 2966 if (slp->sl_flags & LKUP_FIRST) 2967 return (SYMINTP(ilmp)(slp, srp, binfo, in_nfavl)); 2968 2969 /* 2970 * Determine whether this lookup can be satisfied by an objects direct, 2971 * or lazy binding information. This is triggered by a relocation from 2972 * the object (hence rsymndx is set). 2973 */ 2974 if (((rsymndx = slp->sl_rsymndx) != 0) && 2975 ((sip = SYMINFO(clmp)) != NULL)) { 2976 uint_t bound; 2977 2978 /* 2979 * Find the corresponding Syminfo entry for the original 2980 * referencing symbol. 2981 */ 2982 /* LINTED */ 2983 sip = (Syminfo *)((char *)sip + (rsymndx * SYMINENT(clmp))); 2984 bound = sip->si_boundto; 2985 2986 /* 2987 * Identify any EXTERN or PARENT references for ldd(1). 2988 */ 2989 if ((lml->lm_flags & LML_FLG_TRC_WARN) && 2990 (bound > SYMINFO_BT_LOWRESERVE)) { 2991 if (bound == SYMINFO_BT_PARENT) 2992 *binfo |= DBG_BINFO_REF_PARENT; 2993 if (bound == SYMINFO_BT_EXTERN) 2994 *binfo |= DBG_BINFO_REF_EXTERN; 2995 } 2996 2997 /* 2998 * If the symbol information indicates a direct binding, 2999 * determine the link map that is required to satisfy the 3000 * binding. Note, if the dependency can not be found, but a 3001 * direct binding isn't required, we will still fall through 3002 * to perform any default symbol search. 3003 */ 3004 if (sip->si_flags & SYMINFO_FLG_DIRECT) { 3005 3006 lmp = 0; 3007 if (bound < SYMINFO_BT_LOWRESERVE) 3008 lmp = elf_lazy_load(clmp, slp, bound, 3009 name, 0, NULL, in_nfavl); 3010 3011 /* 3012 * If direct bindings have been disabled, and this isn't 3013 * a translator, skip any direct binding now that we've 3014 * ensured the resolving object has been loaded. 3015 * 3016 * If we need to direct bind to anything, we look in 3017 * ourselves, our parent, or in the link map we've just 3018 * loaded. Otherwise, even though we may have lazily 3019 * loaded an object we still continue to search for 3020 * symbols from the head of the link map list. 3021 */ 3022 if (((FLAGS(clmp) & FLG_RT_TRANS) || 3023 (((lml->lm_tflags & LML_TFLG_NODIRECT) == 0) && 3024 ((slp->sl_flags & LKUP_SINGLETON) == 0))) && 3025 ((FLAGS1(clmp) & FL1_RT_DIRECT) || 3026 (sip->si_flags & SYMINFO_FLG_DIRECTBIND))) { 3027 ret = lookup_sym_direct(slp, srp, binfo, 3028 sip, lmp, in_nfavl); 3029 3030 /* 3031 * Determine whether this direct binding has 3032 * been rejected. If we've bound to a singleton 3033 * without following a singleton search, then 3034 * return. The caller detects this condition 3035 * and will trigger a new singleton search. 3036 * 3037 * For any other rejection (such as binding to 3038 * a symbol labeled as nodirect - presumably 3039 * because the symbol definition has been 3040 * changed since the referring object was last 3041 * built), fall through to a standard symbol 3042 * search. 3043 */ 3044 if (((*binfo & BINFO_MSK_REJECTED) == 0) || 3045 (*binfo & BINFO_MSK_TRYAGAIN)) 3046 return (ret); 3047 3048 *binfo &= ~BINFO_MSK_REJECTED; 3049 } 3050 } 3051 } 3052 3053 /* 3054 * Duplicate the lookup information, as we'll need to modify this 3055 * information for some of the following searches. 3056 */ 3057 sl = *slp; 3058 3059 /* 3060 * If the referencing object has the DF_SYMBOLIC flag set, look in the 3061 * referencing object for the symbol first. Failing that, fall back to 3062 * our generic search. 3063 */ 3064 if ((FLAGS1(clmp) & FL1_RT_SYMBOLIC) && 3065 ((sl.sl_flags & LKUP_SINGLETON) == 0)) { 3066 3067 sl.sl_imap = clmp; 3068 if (SYMINTP(clmp)(&sl, srp, binfo, in_nfavl)) { 3069 Rt_map *dlmp = srp->sr_dmap; 3070 ulong_t dsymndx = (((ulong_t)srp->sr_sym - 3071 (ulong_t)SYMTAB(dlmp)) / SYMENT(dlmp)); 3072 3073 /* 3074 * Make sure this symbol hasn't explicitly been defined 3075 * as nodirect. 3076 */ 3077 if (((sip = SYMINFO(dlmp)) == 0) || 3078 /* LINTED */ 3079 ((sip = (Syminfo *)((char *)sip + 3080 (dsymndx * SYMINENT(dlmp)))) == 0) || 3081 ((sip->si_flags & SYMINFO_FLG_NOEXTDIRECT) == 0)) 3082 return (1); 3083 } 3084 } 3085 3086 sl.sl_flags |= LKUP_STANDARD; 3087 3088 /* 3089 * If this lookup originates from a standard relocation, then traverse 3090 * all link-map control lists, inspecting any object that is available 3091 * to this caller. Otherwise, traverse the link-map control list 3092 * associated with the caller. 3093 */ 3094 if (sl.sl_flags & LKUP_STDRELOC) { 3095 Aliste off; 3096 Lm_cntl *lmc; 3097 3098 ret = 0; 3099 3100 for (ALIST_TRAVERSE_BY_OFFSET(lml->lm_lists, off, lmc)) { 3101 if (((ret = core_lookup_sym(lmc->lc_head, &sl, srp, 3102 binfo, off, in_nfavl)) != 0) || 3103 (*binfo & BINFO_MSK_TRYAGAIN)) 3104 break; 3105 } 3106 } else 3107 ret = core_lookup_sym(ilmp, &sl, srp, binfo, ALIST_OFF_DATA, 3108 in_nfavl); 3109 3110 /* 3111 * If a symbol binding should be retried, return so that the search can 3112 * be repeated. 3113 */ 3114 if (*binfo & BINFO_MSK_TRYAGAIN) 3115 return (0); 3116 3117 /* 3118 * To allow transitioning into a world of lazy loading dependencies see 3119 * if this link map contains objects that have lazy dependencies still 3120 * outstanding. If so, and we haven't been able to locate a non-weak 3121 * symbol reference, start bringing in any lazy dependencies to see if 3122 * the reference can be satisfied. Use of dlsym(RTLD_PROBE) sets the 3123 * LKUP_NOFALLBACK flag, and this flag disables this fall back. 3124 */ 3125 if ((ret == 0) && ((sl.sl_flags & LKUP_NOFALLBACK) == 0)) { 3126 if ((lmp = ilmp) == 0) 3127 lmp = LIST(clmp)->lm_head; 3128 3129 lml = LIST(lmp); 3130 if ((sl.sl_flags & LKUP_WEAK) || (lml->lm_lazy == 0)) 3131 return (NULL); 3132 3133 DBG_CALL(Dbg_syms_lazy_rescan(lml, name)); 3134 3135 /* 3136 * If this request originated from a dlsym(RTLD_NEXT) then start 3137 * looking for dependencies from the caller, otherwise use the 3138 * initial link-map. 3139 */ 3140 if (sl.sl_flags & LKUP_NEXT) 3141 ret = rescan_lazy_find_sym(clmp, &sl, srp, binfo, 3142 in_nfavl); 3143 else { 3144 Aliste idx; 3145 Lm_cntl *lmc; 3146 3147 for (ALIST_TRAVERSE(lml->lm_lists, idx, lmc)) { 3148 sl.sl_flags |= LKUP_NOFALLBACK; 3149 if (ret = rescan_lazy_find_sym(lmc->lc_head, 3150 &sl, srp, binfo, in_nfavl)) 3151 break; 3152 } 3153 } 3154 } 3155 return (ret); 3156 } 3157 3158 /* 3159 * Symbol lookup routine. Takes an ELF symbol name, and a list of link maps to 3160 * search. If successful, return a pointer to the symbol table entry, a 3161 * pointer to the link map of the enclosing object, and information relating 3162 * to the type of binding. Else return a null pointer. 3163 * 3164 * To improve ELF performance, we first compute the ELF hash value and pass 3165 * it to each _lookup_sym() routine. The ELF function will use this value to 3166 * locate the symbol, the a.out function will simply ignore it. 3167 */ 3168 int 3169 lookup_sym(Slookup *slp, Sresult *srp, uint_t *binfo, int *in_nfavl) 3170 { 3171 Rt_map *clmp = slp->sl_cmap; 3172 Sym *rsym = slp->sl_rsym; 3173 uchar_t rtype = slp->sl_rtype, vis; 3174 int ret, mode; 3175 3176 if (slp->sl_hash == 0) 3177 slp->sl_hash = elf_hash(slp->sl_name); 3178 *binfo = 0; 3179 3180 if (rsym) { 3181 vis = ELF_ST_VISIBILITY(rsym->st_other); 3182 3183 /* 3184 * Symbols that are defined as protected, or hidden, within an 3185 * object usually have any relocation references from within 3186 * the same object bound at link-edit time. Therefore, ld.so.1 3187 * is not involved. However, if a reference is to a 3188 * capabilities symbol, this reference must be resolved at 3189 * runtime. In this case look directly within the calling 3190 * object, and only within the calling object, for these 3191 * symbols. Note, an object may still use dlsym() to search 3192 * externally for a symbol which is defined as protected within 3193 * the same object. 3194 */ 3195 if ((rsym->st_shndx != SHN_UNDEF) && 3196 ((slp->sl_flags & LKUP_DLSYM) == 0) && 3197 ((vis == STV_PROTECTED) || (vis == STV_HIDDEN))) { 3198 slp->sl_imap = clmp; 3199 return (SYMINTP(clmp)(slp, srp, binfo, in_nfavl)); 3200 } 3201 3202 /* 3203 * Establish any state that might be associated with a symbol 3204 * reference. 3205 */ 3206 if ((slp->sl_flags & LKUP_STDRELOC) && 3207 (ELF_ST_BIND(rsym->st_info) == STB_WEAK)) 3208 slp->sl_flags |= LKUP_WEAK; 3209 3210 if (vis == STV_SINGLETON) 3211 slp->sl_flags |= LKUP_SINGLETON; 3212 } 3213 3214 /* 3215 * Establish any lookup state required for this type of relocation. 3216 */ 3217 if ((slp->sl_flags & LKUP_STDRELOC) && rtype) { 3218 if (rtype == M_R_COPY) 3219 slp->sl_flags |= LKUP_COPY; 3220 3221 if (rtype != M_R_JMP_SLOT) 3222 slp->sl_flags |= LKUP_SPEC; 3223 } 3224 3225 /* 3226 * Under ldd -w, any unresolved weak references are diagnosed. Set the 3227 * symbol binding as global to trigger a relocation error if the symbol 3228 * can not be found. 3229 */ 3230 if (rsym) { 3231 if (LIST(slp->sl_cmap)->lm_flags & LML_FLG_TRC_NOUNRESWEAK) 3232 slp->sl_bind = STB_GLOBAL; 3233 else if ((slp->sl_bind = ELF_ST_BIND(rsym->st_info)) == 3234 STB_WEAK) 3235 slp->sl_flags |= LKUP_WEAK; 3236 } 3237 3238 /* 3239 * Save the callers MODE(). 3240 */ 3241 mode = MODE(clmp); 3242 3243 /* 3244 * Carry out an initial symbol search. This search takes into account 3245 * all the modes of the requested search. 3246 */ 3247 if (((ret = _lookup_sym(slp, srp, binfo, in_nfavl)) == 0) && 3248 (*binfo & BINFO_MSK_TRYAGAIN)) { 3249 Slookup sl = *slp; 3250 3251 /* 3252 * Try the symbol search again. This retry can be necessary if: 3253 * 3254 * - a binding has been rejected because of binding to a 3255 * singleton without going through a singleton search. 3256 * - a group binding has resulted in binding to a symbol 3257 * that indicates no-direct binding. 3258 * 3259 * Reset the lookup data, and try again. 3260 */ 3261 sl.sl_imap = LIST(sl.sl_cmap)->lm_head; 3262 sl.sl_flags &= ~(LKUP_FIRST | LKUP_SELF | LKUP_NEXT); 3263 sl.sl_rsymndx = 0; 3264 3265 if (*binfo & BINFO_REJSINGLE) 3266 sl.sl_flags |= LKUP_SINGLETON; 3267 if (*binfo & BINFO_REJGROUP) { 3268 sl.sl_flags |= LKUP_WORLD; 3269 mode |= RTLD_WORLD; 3270 } 3271 *binfo &= ~BINFO_MSK_REJECTED; 3272 3273 ret = _lookup_sym(&sl, srp, binfo, in_nfavl); 3274 } 3275 3276 /* 3277 * If the caller is restricted to a symbol search within its group, 3278 * determine if it is necessary to follow a binding from outside of 3279 * the group. 3280 */ 3281 if (((mode & (RTLD_GROUP | RTLD_WORLD)) == RTLD_GROUP) && 3282 (lookup_sym_interpose(slp, srp, binfo, in_nfavl))) 3283 return (1); 3284 3285 return (ret); 3286 } 3287 3288 /* 3289 * Associate a binding descriptor with a caller and its dependency, or update 3290 * an existing descriptor. 3291 */ 3292 int 3293 bind_one(Rt_map *clmp, Rt_map *dlmp, uint_t flags) 3294 { 3295 Bnd_desc *bdp; 3296 Aliste idx; 3297 int found = ALE_CREATE; 3298 3299 /* 3300 * Determine whether a binding descriptor already exists between the 3301 * two objects. 3302 */ 3303 for (APLIST_TRAVERSE(DEPENDS(clmp), idx, bdp)) { 3304 if (bdp->b_depend == dlmp) { 3305 found = ALE_EXISTS; 3306 break; 3307 } 3308 } 3309 3310 if (found == ALE_CREATE) { 3311 /* 3312 * Create a new binding descriptor. 3313 */ 3314 if ((bdp = malloc(sizeof (Bnd_desc))) == NULL) 3315 return (0); 3316 3317 bdp->b_caller = clmp; 3318 bdp->b_depend = dlmp; 3319 bdp->b_flags = 0; 3320 3321 /* 3322 * Append the binding descriptor to the caller and the 3323 * dependency. 3324 */ 3325 if (aplist_append(&DEPENDS(clmp), bdp, AL_CNT_DEPENDS) == NULL) 3326 return (0); 3327 3328 if (aplist_append(&CALLERS(dlmp), bdp, AL_CNT_CALLERS) == NULL) 3329 return (0); 3330 } 3331 3332 if ((found == ALE_CREATE) || ((bdp->b_flags & flags) != flags)) { 3333 bdp->b_flags |= flags; 3334 3335 if (flags & BND_REFER) 3336 FLAGS1(dlmp) |= FL1_RT_USED; 3337 3338 DBG_CALL(Dbg_file_bind_entry(LIST(clmp), bdp)); 3339 } 3340 return (found); 3341 } 3342 3343 /* 3344 * Cleanup after relocation processing. 3345 */ 3346 int 3347 relocate_finish(Rt_map *lmp, APlist *bound, int ret) 3348 { 3349 DBG_CALL(Dbg_reloc_run(lmp, 0, ret, DBG_REL_FINISH)); 3350 3351 /* 3352 * Establish bindings to all objects that have been bound to. 3353 */ 3354 if (bound) { 3355 Rt_map *_lmp; 3356 Word used; 3357 3358 /* 3359 * Only create bindings if the callers relocation was 3360 * successful (ret != 0), otherwise the object will eventually 3361 * be torn down. Create these bindings if running under ldd(1) 3362 * with the -U/-u options regardless of relocation errors, as 3363 * the unused processing needs to traverse these bindings to 3364 * diagnose unused objects. 3365 */ 3366 used = LIST(lmp)->lm_flags & 3367 (LML_FLG_TRC_UNREF | LML_FLG_TRC_UNUSED); 3368 3369 if (ret || used) { 3370 Aliste idx; 3371 3372 for (APLIST_TRAVERSE(bound, idx, _lmp)) { 3373 if (bind_one(lmp, _lmp, BND_REFER) || used) 3374 continue; 3375 3376 ret = 0; 3377 break; 3378 } 3379 } 3380 free(bound); 3381 } 3382 3383 return (ret); 3384 } 3385 3386 /* 3387 * Function to correct protection settings. Segments are all mapped initially 3388 * with permissions as given in the segment header. We need to turn on write 3389 * permissions on a text segment if there are any relocations against that 3390 * segment, and then turn write permission back off again before returning 3391 * control to the caller. This function turns the permission on or off 3392 * depending on the value of the permission argument. 3393 */ 3394 int 3395 set_prot(Rt_map *lmp, mmapobj_result_t *mpp, int perm) 3396 { 3397 int prot; 3398 3399 /* 3400 * If this is an allocated image (ie. a relocatable object) we can't 3401 * mprotect() anything. 3402 */ 3403 if (FLAGS(lmp) & FLG_RT_IMGALLOC) 3404 return (1); 3405 3406 DBG_CALL(Dbg_file_prot(lmp, perm)); 3407 3408 if (perm) 3409 prot = mpp->mr_prot | PROT_WRITE; 3410 else 3411 prot = mpp->mr_prot & ~PROT_WRITE; 3412 3413 if (mprotect((void *)(uintptr_t)mpp->mr_addr, 3414 mpp->mr_msize, prot) == -1) { 3415 int err = errno; 3416 eprintf(LIST(lmp), ERR_FATAL, MSG_INTL(MSG_SYS_MPROT), 3417 NAME(lmp), strerror(err)); 3418 return (0); 3419 } 3420 mpp->mr_prot = prot; 3421 return (1); 3422 } 3423