elf/dl-tunables.c

   1 /* The tunable framework.  See the README.tunables to know how to use the
   2    tunable in a glibc module.
   3
   4    Copyright (C) 2016-2017 Free Software Foundation, Inc.
   5    This file is part of the GNU C Library.
   6
   7    The GNU C Library is free software; you can redistribute it and/or
   8    modify it under the terms of the GNU Lesser General Public
   9    License as published by the Free Software Foundation; either
  10    version 2.1 of the License, or (at your option) any later version.
  11
  12    The GNU C Library is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15    Lesser General Public License for more details.
  16
  17    You should have received a copy of the GNU Lesser General Public
  18    License along with the GNU C Library; if not, see
  19    <http://www.gnu.org/licenses/>.  */
  20
  21 #include <startup.h>
  22 #include <stdint.h>
  23 #include <stdbool.h>
  24 #include <unistd.h>
  25 #include <stdlib.h>
  26 #include <sysdep.h>
  27 #include <fcntl.h>
  28 #include <ldsodefs.h>
  29
  30 #define TUNABLES_INTERNAL 1
  31 #include "dl-tunables.h"
  32
  33 #include <not-errno.h>
  34
  35 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  36 # define GLIBC_TUNABLES "GLIBC_TUNABLES"
  37 #endif
  38
  39 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
  40 static char *
  41 tunables_strdup (const char *in)
  42 {
  43   size_t i = 0;
  44
  45   while (in[i++] != '\0');
  46   char *out = __sbrk (i);
  47
  48   /* FIXME: In reality if the allocation fails, __sbrk will crash attempting to
  49      set the thread-local errno since the TCB has not yet been set up.  This
  50      needs to be fixed with an __sbrk implementation that does not set
  51      errno.  */
  52   if (out == (void *)-1)
  53     return NULL;
  54
  55   i--;
  56
  57   while (i-- > 0)
  58     out[i] = in[i];
  59
  60   return out;
  61 }
  62 #endif
  63
  64 static char **
  65 get_next_env (char **envp, char **name, size_t *namelen, char **val,
  66               char ***prev_envp)
  67 {
  68   while (envp != NULL && *envp != NULL)
  69     {
  70       char **prev = envp;
  71       char *envline = *envp++;
  72       int len = 0;
  73
  74       while (envline[len] != '\0' && envline[len] != '=')
  75         len++;
  76
  77       /* Just the name and no value, go to the next one.  */
  78       if (envline[len] == '\0')
  79         continue;
  80
  81       *name = envline;
  82       *namelen = len;
  83       *val = &envline[len + 1];
  84       *prev_envp = prev;
  85
  86       return envp;
  87     }
  88
  89   return NULL;
  90 }
  91
  92 #define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type, __default_min, \
  93                                        __default_max)                         \
  94 ({                                                                            \
  95   __type min = (__cur)->type.min;                                             \
  96   __type max = (__cur)->type.max;                                             \
  97                                                                               \
  98   if (min == max)                                                             \
  99     {                                                                         \
 100       min = __default_min;                                                    \
 101       max = __default_max;                                                    \
 102     }                                                                         \
 103                                                                               \
 104   if ((__type) (__val) >= min && (__type) (val) <= max)                       \
 105     {                                                                         \
 106       (__cur)->val.numval = val;                                              \
 107       (__cur)->initialized = true;                                            \
 108     }                                                                         \
 109 })
 110
 111 static void
 112 do_tunable_update_val (tunable_t *cur, const void *valp)
 113 {
 114   uint64_t val;
 115
 116   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 117     val = *((int64_t *) valp);
 118
 119   switch (cur->type.type_code)
 120     {
 121     case TUNABLE_TYPE_INT_32:
 122         {
 123           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t, INT32_MIN, INT32_MAX);
 124           break;
 125         }
 126     case TUNABLE_TYPE_UINT_64:
 127         {
 128           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, UINT64_MAX);
 129           break;
 130         }
 131     case TUNABLE_TYPE_SIZE_T:
 132         {
 133           TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, SIZE_MAX);
 134           break;
 135         }
 136     case TUNABLE_TYPE_STRING:
 137         {
 138           cur->val.strval = valp;
 139           break;
 140         }
 141     default:
 142       __builtin_unreachable ();
 143     }
 144 }
 145
 146 /* Validate range of the input value and initialize the tunable CUR if it looks
 147    good.  */
 148 static void
 149 tunable_initialize (tunable_t *cur, const char *strval)
 150 {
 151   uint64_t val;
 152   const void *valp;
 153
 154   if (cur->type.type_code != TUNABLE_TYPE_STRING)
 155     {
 156       val = _dl_strtoul (strval, NULL);
 157       valp = &val;
 158     }
 159   else
 160     {
 161       cur->initialized = true;
 162       valp = strval;
 163     }
 164   do_tunable_update_val (cur, valp);
 165 }
 166
 167 void
 168 __tunable_set_val (tunable_id_t id, void *valp)
 169 {
 170   tunable_t *cur = &tunable_list[id];
 171
 172   do_tunable_update_val (cur, valp);
 173 }
 174
 175 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 176 /* Parse the tunable string TUNESTR and adjust it to drop any tunables that may
 177    be unsafe for AT_SECURE processes so that it can be used as the new
 178    environment variable value for GLIBC_TUNABLES.  VALSTRING is the original
 179    environment variable string which we use to make NULL terminated values so
 180    that we don't have to allocate memory again for it.  */
 181 static void
 182 parse_tunables (char *tunestr, char *valstring)
 183 {
 184   if (tunestr == NULL || *tunestr == '\0')
 185     return;
 186
 187   char *p = tunestr;
 188
 189   while (true)
 190     {
 191       char *name = p;
 192       size_t len = 0;
 193
 194       /* First, find where the name ends.  */
 195       while (p[len] != '=' && p[len] != ':' && p[len] != '\0')
 196         len++;
 197
 198       /* If we reach the end of the string before getting a valid name-value
 199          pair, bail out.  */
 200       if (p[len] == '\0')
 201         return;
 202
 203       /* We did not find a valid name-value pair before encountering the
 204          colon.  */
 205       if (p[len]== ':')
 206         {
 207           p += len + 1;
 208           continue;
 209         }
 210
 211       p += len + 1;
 212
 213       /* Take the value from the valstring since we need to NULL terminate it.  */
 214       char *value = &valstring[p - tunestr];
 215       len = 0;
 216
 217       while (p[len] != ':' && p[len] != '\0')
 218         len++;
 219
 220       /* Add the tunable if it exists.  */
 221       for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 222         {
 223           tunable_t *cur = &tunable_list[i];
 224
 225           if (tunable_is_name (cur->name, name))
 226             {
 227               /* If we are in a secure context (AT_SECURE) then ignore the tunable
 228                  unless it is explicitly marked as secure.  Tunable values take
 229                  precendence over their envvar aliases.  */
 230               if (__libc_enable_secure)
 231                 {
 232                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 233                     {
 234                       if (p[len] == '\0')
 235                         {
 236                           /* Last tunable in the valstring.  Null-terminate and
 237                              return.  */
 238                           *name = '\0';
 239                           return;
 240                         }
 241                       else
 242                         {
 243                           /* Remove the current tunable from the string.  We do
 244                              this by overwriting the string starting from NAME
 245                              (which is where the current tunable begins) with
 246                              the remainder of the string.  We then have P point
 247                              to NAME so that we continue in the correct
 248                              position in the valstring.  */
 249                           char *q = &p[len + 1];
 250                           p = name;
 251                           while (*q != '\0')
 252                             *name++ = *q++;
 253                           name[0] = '\0';
 254                           len = 0;
 255                         }
 256                     }
 257
 258                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 259                     break;
 260                 }
 261
 262               value[len] = '\0';
 263               tunable_initialize (cur, value);
 264               break;
 265             }
 266         }
 267
 268       if (p[len] == '\0')
 269         return;
 270       else
 271         p += len + 1;
 272     }
 273 }
 274 #endif
 275
 276 /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
 277    the system administrator has created the /etc/suid-debug file.  This is a
 278    special case where we want to conditionally enable/disable a tunable even
 279    for setuid binaries.  We use the special version of access() to avoid
 280    setting ERRNO, which is a TLS variable since TLS has not yet been set
 281    up.  */
 282 static inline void
 283 __always_inline
 284 maybe_enable_malloc_check (void)
 285 {
 286   tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check);
 287   if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug", F_OK) == 0)
 288     tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE;
 289 }
 290
 291 /* Initialize the tunables list from the environment.  For now we only use the
 292    ENV_ALIAS to find values.  Later we will also use the tunable names to find
 293    values.  */
 294 void
 295 __tunables_init (char **envp)
 296 {
 297   char *envname = NULL;
 298   char *envval = NULL;
 299   size_t len = 0;
 300   char **prev_envp = envp;
 301
 302   maybe_enable_malloc_check ();
 303
 304   while ((envp = get_next_env (envp, &envname, &len, &envval,
 305                                &prev_envp)) != NULL)
 306     {
 307 #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
 308       if (tunable_is_name (GLIBC_TUNABLES, envname))
 309         {
 310           char *new_env = tunables_strdup (envname);
 311           if (new_env != NULL)
 312             parse_tunables (new_env + len + 1, envval);
 313           /* Put in the updated envval.  */
 314           *prev_envp = new_env;
 315           continue;
 316         }
 317 #endif
 318
 319       for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
 320         {
 321           tunable_t *cur = &tunable_list[i];
 322
 323           /* Skip over tunables that have either been set already or should be
 324              skipped.  */
 325           if (cur->initialized || cur->env_alias == NULL)
 326             continue;
 327
 328           const char *name = cur->env_alias;
 329
 330           /* We have a match.  Initialize and move on to the next line.  */
 331           if (tunable_is_name (name, envname))
 332             {
 333               /* For AT_SECURE binaries, we need to check the security settings of
 334                  the tunable and decide whether we read the value and also whether
 335                  we erase the value so that child processes don't inherit them in
 336                  the environment.  */
 337               if (__libc_enable_secure)
 338                 {
 339                   if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
 340                     {
 341                       /* Erase the environment variable.  */
 342                       char **ep = prev_envp;
 343
 344                       while (*ep != NULL)
 345                         {
 346                           if (tunable_is_name (name, *ep))
 347                             {
 348                               char **dp = ep;
 349
 350                               do
 351                                 dp[0] = dp[1];
 352                               while (*dp++);
 353                             }
 354                           else
 355                             ++ep;
 356                         }
 357                       /* Reset the iterator so that we read the environment again
 358                          from the point we erased.  */
 359                       envp = prev_envp;
 360                     }
 361
 362                   if (cur->security_level != TUNABLE_SECLEVEL_NONE)
 363                     continue;
 364                 }
 365
 366               tunable_initialize (cur, envval);
 367               break;
 368             }
 369         }
 370     }
 371 }
 372
 373 /* Set the tunable value.  This is called by the module that the tunable exists
 374    in. */
 375 void
 376 __tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback)
 377 {
 378   tunable_t *cur = &tunable_list[id];
 379
 380   switch (cur->type.type_code)
 381     {
 382     case TUNABLE_TYPE_UINT_64:
 383         {
 384           *((uint64_t *) valp) = (uint64_t) cur->val.numval;
 385           break;
 386         }
 387     case TUNABLE_TYPE_INT_32:
 388         {
 389           *((int32_t *) valp) = (int32_t) cur->val.numval;
 390           break;
 391         }
 392     case TUNABLE_TYPE_SIZE_T:
 393         {
 394           *((size_t *) valp) = (size_t) cur->val.numval;
 395           break;
 396         }
 397     case TUNABLE_TYPE_STRING:
 398         {
 399           *((const char **)valp) = cur->val.strval;
 400           break;
 401         }
 402     default:
 403       __builtin_unreachable ();
 404     }
 405
 406   if (cur->initialized && callback != NULL)
 407     callback (&cur->val);
 408 }
 409
 410 rtld_hidden_def (__tunable_get_val)