elf/dl-tunables.c

   1 /* The tunable framework.  See the README.tunables to know how to use the
   2    tunable in a glibc module.
   3
   4    Copyright (C) 2016-2017 Free Software Foundation, Inc.
   5    This file is part of the GNU C Library.
   6
   7    The GNU C Library is free software; you can redistribute it and/or
   8    modify it under the terms of the GNU Lesser General Public
   9    License as published by the Free Software Foundation; either
  10    version 2.1 of the License, or (at your option) any later version.
  11
  12    The GNU C Library is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15    Lesser General Public License for more details.
  16
  17    You should have received a copy of the GNU Lesser General Public
  18    License along with the GNU C Library; if not, see
  19    <http://www.gnu.org/licenses/>.  */
  20
  21 #include <startup.h>
  22 #include <stdint.h>
  23 #include <stdbool.h>
  24 #include <unistd.h>
  25 #include <stdlib.h>
  26 #include <sysdep.h>
  27 #include <fcntl.h>
  28 #include <ldsodefs.h>
  29
  30 #define TUNABLES_INTERNAL 1
  31 #include "dl-tunables.h"
  32
  33 #include <not-errno.h>
  34
  35 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  36 # define GLIBC_TUNABLES "GLIBC_TUNABLES"
  37 #endif
  38
  39 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  40 static char *
  41 tunables_strdup (const char *in)
  42 {
  43   size_t i = 0;
  44
  45   while (in[i++] != '\0');
  46   char *out = __sbrk (i);
  47
  48   /* FIXME: In reality if the allocation fails, __sbrk will crash attempting to
  49      set the thread-local errno since the TCB has not yet been set up.  This
  50      needs to be fixed with an __sbrk implementation that does not set
  51      errno.  */
  52   if (out == (void *)-1)
  53     return NULL;
  54
  55   i--;
  56
  57   while (i-- > 0)
  58     out[i] = in[i];
  59
  60   return out;
  61 }
  62 #endif
  63
  64 static char **
  65 get_next_env (char **envp, char **name, size_t *namelen, char **val,
  66               char ***prev_envp)
  67 {
  68   while (envp != NULL && *envp != NULL)
  69     {
  70       char **prev = envp;
  71       char *envline = *envp++;
  72       int len = 0;
  73
  74       while (envline[len] != '\0' && envline[len] != '=')
  75         len++;
  76
  77       /* Just the name and no value, go to the next one.  */
  78       if (envline[len] == '\0')
  79         continue;
  80
  81       *name = envline;
  82       *namelen = len;
  83       *val = &envline[len + 1];
  84       *prev_envp = prev;
  85
  86       return envp;
  87     }
  88
  89   return NULL;
  90 }
  91
  92 #define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type)                  \
  93 ({                                                                            \
  94   __type min = (__cur)->type.min;                                             \
  95   __type max = (__cur)->type.max;                                             \
  96                                                                               \
  97   if ((__type) (__val) >= min && (__type) (val) <= max)                       \
  98     {                                                                         \
  99       (__cur)->val.numval = val;                                              \
 100       (__cur)->initialized = true;                                            \
 101     }                                                                         \
 102 })
 103
 104 static void
 105 do_tunable_update_val (tunable_t *cur, const void *valp)
 106 {
 107   uint64_t val;
 108
 109   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 110     val = *((int64_t *) valp);
 111
 112   switch (cur->type.type_code)
 113     {
 114     case TUNABLE_TYPE_INT_32:
 115         {
 116           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t);
 117           break;
 118         }
 119     case TUNABLE_TYPE_UINT_64:
 120         {
 121           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);
 122           break;
 123         }
 124     case TUNABLE_TYPE_SIZE_T:
 125         {
 126           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);
 127           break;
 128         }
 129     case TUNABLE_TYPE_STRING:
 130         {
 131           cur->val.strval = valp;
 132           break;
 133         }
 134     default:
 135       __builtin_unreachable ();
 136     }
 137 }
 138
 139 /* Validate range of the input value and initialize the tunable CUR if it looks
 140    good.  */
 141 static void
 142 tunable_initialize (tunable_t *cur, const char *strval)
 143 {
 144   uint64_t val;
 145   const void *valp;
 146
 147   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 148     {
 149       val = _dl_strtoul (strval, NULL);
 150       valp = &val;
 151     }
 152   else
 153     {
 154       cur->initialized = true;
 155       valp = strval;
 156     }
 157   do_tunable_update_val (cur, valp);
 158 }
 159
 160 void
 161 __tunable_set_val (tunable_id_t id, void *valp)
 162 {
 163   tunable_t *cur = &tunable_list[id];
 164
 165   do_tunable_update_val (cur, valp);
 166 }
 167
 168 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 169 /* Parse the tunable string TUNESTR and adjust it to drop any tunables that may
 170    be unsafe for AT_SECURE processes so that it can be used as the new
 171    environment variable value for GLIBC_TUNABLES.  VALSTRING is the original
 172    environment variable string which we use to make NULL terminated values so
 173    that we don't have to allocate memory again for it.  */
 174 static void
 175 parse_tunables (char *tunestr, char *valstring)
 176 {
 177   if (tunestr == NULL || *tunestr == '\0')
 178     return;
 179
 180   char *p = tunestr;
 181
 182   while (true)
 183     {
 184       char *name = p;
 185       size_t len = 0;
 186
 187       /* First, find where the name ends.  */
 188       while (p[len] != '=' && p[len] != ':' && p[len] != '\0')
 189         len++;
 190
 191       /* If we reach the end of the string before getting a valid name-value
 192          pair, bail out.  */
 193       if (p[len] == '\0')
 194         return;
 195
 196       /* We did not find a valid name-value pair before encountering the
 197          colon.  */
 198       if (p[len]== ':')
 199         {
 200           p += len + 1;
 201           continue;
 202         }
 203
 204       p += len + 1;
 205
 206       /* Take the value from the valstring since we need to NULL terminate it.  */
 207       char *value = &valstring[p - tunestr];
 208       len = 0;
 209
 210       while (p[len] != ':' && p[len] != '\0')
 211         len++;
 212
 213       /* Add the tunable if it exists.  */
 214       for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 215         {
 216           tunable_t *cur = &tunable_list[i];
 217
 218           if (tunable_is_name (cur->name, name))
 219             {
 220               /* If we are in a secure context (AT_SECURE) then ignore the tunable
 221                  unless it is explicitly marked as secure.  Tunable values take
 222                  precendence over their envvar aliases.  */
 223               if (__libc_enable_secure)
 224                 {
 225                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 226                     {
 227                       if (p[len] == '\0')
 228                         {
 229                           /* Last tunable in the valstring.  Null-terminate and
 230                              return.  */
 231                           *name = '\0';
 232                           return;
 233                         }
 234                       else
 235                         {
 236                           /* Remove the current tunable from the string.  We do
 237                              this by overwriting the string starting from NAME
 238                              (which is where the current tunable begins) with
 239                              the remainder of the string.  We then have P point
 240                              to NAME so that we continue in the correct
 241                              position in the valstring.  */
 242                           char *q = &p[len + 1];
 243                           p = name;
 244                           while (*q != '\0')
 245                             *name++ = *q++;
 246                           name[0] = '\0';
 247                           len = 0;
 248                         }
 249                     }
 250
 251                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 252                     break;
 253                 }
 254
 255               value[len] = '\0';
 256               tunable_initialize (cur, value);
 257               break;
 258             }
 259         }
 260
 261       if (p[len] == '\0')
 262         return;
 263       else
 264         p += len + 1;
 265     }
 266 }
 267 #endif
 268
 269 /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
 270    the system administrator has created the /etc/suid-debug file.  This is a
 271    special case where we want to conditionally enable/disable a tunable even
 272    for setuid binaries.  We use the special version of access() to avoid
 273    setting ERRNO, which is a TLS variable since TLS has not yet been set
 274    up.  */
 275 static inline void
 276 __always_inline
 277 maybe_enable_malloc_check (void)
 278 {
 279   tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check);
 280   if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug", F_OK) == 0)
 281     tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE;
 282 }
 283
 284 /* Initialize the tunables list from the environment.  For now we only use the
 285    ENV_ALIAS to find values.  Later we will also use the tunable names to find
 286    values.  */
 287 void
 288 __tunables_init (char **envp)
 289 {
 290   char *envname = NULL;
 291   char *envval = NULL;
 292   size_t len = 0;
 293   char **prev_envp = envp;
 294
 295   maybe_enable_malloc_check ();
 296
 297   while ((envp = get_next_env (envp, &envname, &len, &envval,
 298                                &prev_envp)) != NULL)
 299     {
 300 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 301       if (tunable_is_name (GLIBC_TUNABLES, envname))
 302         {
 303           char *new_env = tunables_strdup (envname);
 304           if (new_env != NULL)
 305             parse_tunables (new_env + len + 1, envval);
 306           /* Put in the updated envval.  */
 307           *prev_envp = new_env;
 308           continue;
 309         }
 310 #endif
 311
 312       for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 313         {
 314           tunable_t *cur = &tunable_list[i];
 315
 316           /* Skip over tunables that have either been set already or should be
 317              skipped.  */
 318           if (cur->initialized || cur->env_alias == NULL)
 319             continue;
 320
 321           const char *name = cur->env_alias;
 322
 323           /* We have a match.  Initialize and move on to the next line.  */
 324           if (tunable_is_name (name, envname))
 325             {
 326               /* For AT_SECURE binaries, we need to check the security settings of
 327                  the tunable and decide whether we read the value and also whether
 328                  we erase the value so that child processes don't inherit them in
 329                  the environment.  */
 330               if (__libc_enable_secure)
 331                 {
 332                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 333                     {
 334                       /* Erase the environment variable.  */
 335                       char **ep = prev_envp;
 336
 337                       while (*ep != NULL)
 338                         {
 339                           if (tunable_is_name (name, *ep))
 340                             {
 341                               char **dp = ep;
 342
 343                               do
 344                                 dp[0] = dp[1];
 345                               while (*dp++);
 346                             }
 347                           else
 348                             ++ep;
 349                         }
 350                       /* Reset the iterator so that we read the environment again
 351                          from the point we erased.  */
 352                       envp = prev_envp;
 353                     }
 354
 355                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 356                     continue;
 357                 }
 358
 359               tunable_initialize (cur, envval);
 360               break;
 361             }
 362         }
 363     }
 364 }
 365
 366 /* Set the tunable value.  This is called by the module that the tunable exists
 367    in. */
 368 void
 369 __tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback)
 370 {
 371   tunable_t *cur = &tunable_list[id];
 372
 373   switch (cur->type.type_code)
 374     {
 375     case TUNABLE_TYPE_UINT_64:
 376         {
 377           *((uint64_t *) valp) = (uint64_t) cur->val.numval;
 378           break;
 379         }
 380     case TUNABLE_TYPE_INT_32:
 381         {
 382           *((int32_t *) valp) = (int32_t) cur->val.numval;
 383           break;
 384         }
 385     case TUNABLE_TYPE_SIZE_T:
 386         {
 387           *((size_t *) valp) = (size_t) cur->val.numval;
 388           break;
 389         }
 390     case TUNABLE_TYPE_STRING:
 391         {
 392           *((const char **)valp) = cur->val.strval;
 393           break;
 394         }
 395     default:
 396       __builtin_unreachable ();
 397     }
 398
 399   if (cur->initialized && callback != NULL)
 400     callback (&cur->val);
 401 }
 402
 403 rtld_hidden_def (__tunable_get_val)