elf/dl-tunables.c

   1 /* The tunable framework.  See the README.tunables to know how to use the
   2    tunable in a glibc module.
   3
   4    Copyright (C) 2016-2017 Free Software Foundation, Inc.
   5    This file is part of the GNU C Library.
   6
   7    The GNU C Library is free software; you can redistribute it and/or
   8    modify it under the terms of the GNU Lesser General Public
   9    License as published by the Free Software Foundation; either
  10    version 2.1 of the License, or (at your option) any later version.
  11
  12    The GNU C Library is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15    Lesser General Public License for more details.
  16
  17    You should have received a copy of the GNU Lesser General Public
  18    License along with the GNU C Library; if not, see
  19    <http://www.gnu.org/licenses/>.  */
  20
  21 #include <stdint.h>
  22 #include <stdbool.h>
  23 #include <unistd.h>
  24 #include <stdlib.h>
  25 #include <sysdep.h>
  26 #include <fcntl.h>
  27 #include <ldsodefs.h>
  28
  29 #define TUNABLES_INTERNAL 1
  30 #include "dl-tunables.h"
  31
  32 #include <not-errno.h>
  33
  34 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  35 # define GLIBC_TUNABLES "GLIBC_TUNABLES"
  36 #endif
  37
  38 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  39 static char *
  40 tunables_strdup (const char *in)
  41 {
  42   size_t i = 0;
  43
  44   while (in[i++] != '\0');
  45   char *out = __sbrk (i);
  46
  47   /* FIXME: In reality if the allocation fails, __sbrk will crash attempting to
  48      set the thread-local errno since the TCB has not yet been set up.  This
  49      needs to be fixed with an __sbrk implementation that does not set
  50      errno.  */
  51   if (out == (void *)-1)
  52     return NULL;
  53
  54   i--;
  55
  56   while (i-- > 0)
  57     out[i] = in[i];
  58
  59   return out;
  60 }
  61 #endif
  62
  63 static char **
  64 get_next_env (char **envp, char **name, size_t *namelen, char **val,
  65               char ***prev_envp)
  66 {
  67   while (envp != NULL && *envp != NULL)
  68     {
  69       char **prev = envp;
  70       char *envline = *envp++;
  71       int len = 0;
  72
  73       while (envline[len] != '\0' && envline[len] != '=')
  74         len++;
  75
  76       /* Just the name and no value, go to the next one.  */
  77       if (envline[len] == '\0')
  78         continue;
  79
  80       *name = envline;
  81       *namelen = len;
  82       *val = &envline[len + 1];
  83       *prev_envp = prev;
  84
  85       return envp;
  86     }
  87
  88   return NULL;
  89 }
  90
  91 #define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type, __default_min, \
  92                                        __default_max)                         \
  93 ({                                                                            \
  94   __type min = (__cur)->type.min;                                             \
  95   __type max = (__cur)->type.max;                                             \
  96                                                                               \
  97   if (min == max)                                                             \
  98     {                                                                         \
  99       min = __default_min;                                                    \
 100       max = __default_max;                                                    \
 101     }                                                                         \
 102                                                                               \
 103   if ((__type) (__val) >= min && (__type) (val) <= max)                       \
 104     {                                                                         \
 105       (__cur)->val.numval = val;                                              \
 106       (__cur)->initialized = true;                                            \
 107     }                                                                         \
 108 })
 109
 110 static void
 111 do_tunable_update_val (tunable_t *cur, const void *valp)
 112 {
 113   uint64_t val;
 114
 115   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 116     val = *((int64_t *) valp);
 117
 118   switch (cur->type.type_code)
 119     {
 120     case TUNABLE_TYPE_INT_32:
 121         {
 122           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t, INT32_MIN, INT32_MAX);
 123           break;
 124         }
 125     case TUNABLE_TYPE_UINT_64:
 126         {
 127           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, UINT64_MAX);
 128           break;
 129         }
 130     case TUNABLE_TYPE_SIZE_T:
 131         {
 132           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, SIZE_MAX);
 133           break;
 134         }
 135     case TUNABLE_TYPE_STRING:
 136         {
 137           cur->val.strval = valp;
 138           break;
 139         }
 140     default:
 141       __builtin_unreachable ();
 142     }
 143 }
 144
 145 /* Validate range of the input value and initialize the tunable CUR if it looks
 146    good.  */
 147 static void
 148 tunable_initialize (tunable_t *cur, const char *strval)
 149 {
 150   uint64_t val;
 151   const void *valp;
 152
 153   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 154     {
 155       val = _dl_strtoul (strval, NULL);
 156       valp = &val;
 157     }
 158   else
 159     {
 160       cur->initialized = true;
 161       valp = strval;
 162     }
 163   do_tunable_update_val (cur, valp);
 164 }
 165
 166 void
 167 __tunable_set_val (tunable_id_t id, void *valp)
 168 {
 169   tunable_t *cur = &tunable_list[id];
 170
 171   do_tunable_update_val (cur, valp);
 172 }
 173
 174 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 175 /* Parse the tunable string TUNESTR and adjust it to drop any tunables that may
 176    be unsafe for AT_SECURE processes so that it can be used as the new
 177    environment variable value for GLIBC_TUNABLES.  VALSTRING is the original
 178    environment variable string which we use to make NULL terminated values so
 179    that we don't have to allocate memory again for it.  */
 180 static void
 181 parse_tunables (char *tunestr, char *valstring)
 182 {
 183   if (tunestr == NULL || *tunestr == '\0')
 184     return;
 185
 186   char *p = tunestr;
 187
 188   while (true)
 189     {
 190       char *name = p;
 191       size_t len = 0;
 192
 193       /* First, find where the name ends.  */
 194       while (p[len] != '=' && p[len] != ':' && p[len] != '\0')
 195         len++;
 196
 197       /* If we reach the end of the string before getting a valid name-value
 198          pair, bail out.  */
 199       if (p[len] == '\0')
 200         return;
 201
 202       /* We did not find a valid name-value pair before encountering the
 203          colon.  */
 204       if (p[len]== ':')
 205         {
 206           p += len + 1;
 207           continue;
 208         }
 209
 210       p += len + 1;
 211
 212       /* Take the value from the valstring since we need to NULL terminate it.  */
 213       char *value = &valstring[p - tunestr];
 214       len = 0;
 215
 216       while (p[len] != ':' && p[len] != '\0')
 217         len++;
 218
 219       /* Add the tunable if it exists.  */
 220       for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 221         {
 222           tunable_t *cur = &tunable_list[i];
 223
 224           if (tunable_is_name (cur->name, name))
 225             {
 226               /* If we are in a secure context (AT_SECURE) then ignore the tunable
 227                  unless it is explicitly marked as secure.  Tunable values take
 228                  precendence over their envvar aliases.  */
 229               if (__libc_enable_secure)
 230                 {
 231                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 232                     {
 233                       if (p[len] == '\0')
 234                         {
 235                           /* Last tunable in the valstring.  Null-terminate and
 236                              return.  */
 237                           *name = '\0';
 238                           return;
 239                         }
 240                       else
 241                         {
 242                           /* Remove the current tunable from the string.  We do
 243                              this by overwriting the string starting from NAME
 244                              (which is where the current tunable begins) with
 245                              the remainder of the string.  We then have P point
 246                              to NAME so that we continue in the correct
 247                              position in the valstring.  */
 248                           char *q = &p[len + 1];
 249                           p = name;
 250                           while (*q != '\0')
 251                             *name++ = *q++;
 252                           name[0] = '\0';
 253                           len = 0;
 254                         }
 255                     }
 256
 257                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 258                     break;
 259                 }
 260
 261               value[len] = '\0';
 262               tunable_initialize (cur, value);
 263               break;
 264             }
 265         }
 266
 267       if (p[len] == '\0')
 268         return;
 269       else
 270         p += len + 1;
 271     }
 272 }
 273 #endif
 274
 275 /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
 276    the system administrator has created the /etc/suid-debug file.  This is a
 277    special case where we want to conditionally enable/disable a tunable even
 278    for setuid binaries.  We use the special version of access() to avoid
 279    setting ERRNO, which is a TLS variable since TLS has not yet been set
 280    up.  */
 281 static inline void
 282 __always_inline
 283 maybe_enable_malloc_check (void)
 284 {
 285   tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check);
 286   if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug", F_OK) == 0)
 287     tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE;
 288 }
 289
 290 /* Initialize the tunables list from the environment.  For now we only use the
 291    ENV_ALIAS to find values.  Later we will also use the tunable names to find
 292    values.  */
 293 void
 294 __tunables_init (char **envp)
 295 {
 296   char *envname = NULL;
 297   char *envval = NULL;
 298   size_t len = 0;
 299   char **prev_envp = envp;
 300
 301   maybe_enable_malloc_check ();
 302
 303   while ((envp = get_next_env (envp, &envname, &len, &envval,
 304                                &prev_envp)) != NULL)
 305     {
 306 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 307       if (tunable_is_name (GLIBC_TUNABLES, envname))
 308         {
 309           char *new_env = tunables_strdup (envname);
 310           if (new_env != NULL)
 311             parse_tunables (new_env + len + 1, envval);
 312           /* Put in the updated envval.  */
 313           *prev_envp = new_env;
 314           continue;
 315         }
 316 #endif
 317
 318       for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 319         {
 320           tunable_t *cur = &tunable_list[i];
 321
 322           /* Skip over tunables that have either been set already or should be
 323              skipped.  */
 324           if (cur->initialized || cur->env_alias == NULL)
 325             continue;
 326
 327           const char *name = cur->env_alias;
 328
 329           /* We have a match.  Initialize and move on to the next line.  */
 330           if (tunable_is_name (name, envname))
 331             {
 332               /* For AT_SECURE binaries, we need to check the security settings of
 333                  the tunable and decide whether we read the value and also whether
 334                  we erase the value so that child processes don't inherit them in
 335                  the environment.  */
 336               if (__libc_enable_secure)
 337                 {
 338                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 339                     {
 340                       /* Erase the environment variable.  */
 341                       char **ep = prev_envp;
 342
 343                       while (*ep != NULL)
 344                         {
 345                           if (tunable_is_name (name, *ep))
 346                             {
 347                               char **dp = ep;
 348
 349                               do
 350                                 dp[0] = dp[1];
 351                               while (*dp++);
 352                             }
 353                           else
 354                             ++ep;
 355                         }
 356                       /* Reset the iterator so that we read the environment again
 357                          from the point we erased.  */
 358                       envp = prev_envp;
 359                     }
 360
 361                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 362                     continue;
 363                 }
 364
 365               tunable_initialize (cur, envval);
 366               break;
 367             }
 368         }
 369     }
 370 }
 371
 372 /* Set the tunable value.  This is called by the module that the tunable exists
 373    in. */
 374 void
 375 __tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback)
 376 {
 377   tunable_t *cur = &tunable_list[id];
 378
 379   switch (cur->type.type_code)
 380     {
 381     case TUNABLE_TYPE_UINT_64:
 382         {
 383           *((uint64_t *) valp) = (uint64_t) cur->val.numval;
 384           break;
 385         }
 386     case TUNABLE_TYPE_INT_32:
 387         {
 388           *((int32_t *) valp) = (int32_t) cur->val.numval;
 389           break;
 390         }
 391     case TUNABLE_TYPE_SIZE_T:
 392         {
 393           *((size_t *) valp) = (size_t) cur->val.numval;
 394           break;
 395         }
 396     case TUNABLE_TYPE_STRING:
 397         {
 398           *((const char **)valp) = cur->val.strval;
 399           break;
 400         }
 401     default:
 402       __builtin_unreachable ();
 403     }
 404
 405   if (cur->initialized && callback != NULL)
 406     callback (&cur->val);
 407 }
 408
 409 rtld_hidden_def (__tunable_get_val)