lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v3 7/7] x86/boot: Check that there are no runtime relocations
    On Mon, 29 Jun 2020 at 19:37, Fangrui Song <maskray@google.com> wrote:
    >
    > On 2020-06-29, Arvind Sankar wrote:
    > >On Mon, Jun 29, 2020 at 09:20:31AM -0700, Kees Cook wrote:
    > >> On Mon, Jun 29, 2020 at 06:11:59PM +0200, Ard Biesheuvel wrote:
    > >> > On Mon, 29 Jun 2020 at 18:09, Kees Cook <keescook@chromium.org> wrote:
    > >> > >
    > >> > > On Mon, Jun 29, 2020 at 10:09:28AM -0400, Arvind Sankar wrote:
    > >> > > > Add a linker script check that there are no runtime relocations, and
    > >> > > > remove the old one that tries to check via looking for specially-named
    > >> > > > sections in the object files.
    > >> > > >
    > >> > > > Drop the tests for -fPIE compiler option and -pie linker option, as they
    > >> > > > are available in all supported gcc and binutils versions (as well as
    > >> > > > clang and lld).
    > >> > > >
    > >> > > > Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
    > >> > > > Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
    > >> > > > Reviewed-by: Fangrui Song <maskray@google.com>
    > >> > > > ---
    > >> > > > arch/x86/boot/compressed/Makefile | 28 +++-----------------------
    > >> > > > arch/x86/boot/compressed/vmlinux.lds.S | 8 ++++++++
    > >> > > > 2 files changed, 11 insertions(+), 25 deletions(-)
    > >> > >
    > >> > > Reviewed-by: Kees Cook <keescook@chromium.org>
    > >> > >
    > >> > > question below ...
    > >> > >
    > >> > > > diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S
    > >> > > > index a4a4a59a2628..a78510046eec 100644
    > >> > > > --- a/arch/x86/boot/compressed/vmlinux.lds.S
    > >> > > > +++ b/arch/x86/boot/compressed/vmlinux.lds.S
    > >> > > > @@ -42,6 +42,12 @@ SECTIONS
    > >> > > > *(.rodata.*)
    > >> > > > _erodata = . ;
    > >> > > > }
    > >> > > > + .rel.dyn : {
    > >> > > > + *(.rel.*)
    > >> > > > + }
    > >> > > > + .rela.dyn : {
    > >> > > > + *(.rela.*)
    > >> > > > + }
    > >> > > > .got : {
    > >> > > > *(.got)
    > >> > > > }
    > >> > >
    > >> > > Should these be marked (INFO) as well?
    > >> > >
    > >> >
    > >> > Given that sections marked as (INFO) will still be emitted into the
    > >> > ELF image, it does not really make a difference to do this for zero
    > >> > sized sections.
    > >>
    > >> Oh, I misunderstood -- I though they were _not_ emitted; I see now what
    > >> you said was not allocated. So, disk space used for the .got.plt case,
    > >> but not memory space used. Sorry for the confusion!
    > >>
    > >> -Kees
    >
    > About output section type (INFO):
    > https://sourceware.org/binutils/docs/ld/Output-Section-Type.html#Output-Section-Type
    > says "These type names are supported for backward compatibility, and are
    > rarely used."
    >
    > If all input section don't have the SHF_ALLOC flag, the output section
    > will not have this flag as well. This type is not useful...
    >
    > If .got and .got.plt were used, they should be considered dynamic
    > relocations which should be part of the loadable image. So they should
    > have the SHF_ALLOC flag. (INFO) will not be applicable anyway.
    >

    I don't care deeply either way, but Kees indicated that he would like
    to get rid of the 24 bytes of .got.plt magic entries that we have no
    need for.

    In fact, a lot of this mangling is caused by the fact that the linker
    is creating a relocatable binary, and assumes that it is a hosted
    binary that is loaded by a dynamic loader. It would actually be much
    better if the compiler and linker would take -ffreestanding into
    account, and suppress GOT entries, PLTs, dynamic program headers for
    shared libraries altogether.

    \
     
     \ /
      Last update: 2020-06-29 23:25    [W:4.102 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site