Add support for GNU RELRO.

Submitted by:	John Marino <draco marino st>
MFC after:	2 weeks

3 files changed, 28 insertions, 0 deletions

diff --git a/libexec/rtld-elf/map_object.c b/libexec/rtld-elf/map_object.c
index aca1b2d..6a13692 100644
--- a/libexec/rtld-elf/map_object.c
+++ b/libexec/rtld-elf/map_object.c
@@ -84,6 +84,8 @@ map_object(int fd, const char *path, const struct stat *sb)
     Elf_Addr bss_vlimit;
     caddr_t bss_addr;
     Elf_Word stack_flags;
+    Elf_Addr relro_page;
+    size_t relro_size;
 
     hdr = get_elf_header(fd, path);
     if (hdr == NULL)
@@ -100,6 +102,8 @@ map_object(int fd, const char *path, const struct stat *sb)
     nsegs = -1;
     phdyn = phinterp = phtls = NULL;
     phdr_vaddr = 0;
+    relro_page = 0;
+    relro_size = 0;
     segs = alloca(sizeof(segs[0]) * hdr->e_phnum);
     stack_flags = RTLD_DEFAULT_STACK_PF_EXEC | PF_R | PF_W;
     while (phdr < phlimit) {
@@ -134,6 +138,11 @@ map_object(int fd, const char *path, const struct stat *sb)
 	case PT_GNU_STACK:
 	    stack_flags = phdr->p_flags;
 	    break;
+
+	case PT_GNU_RELRO:
+	    relro_page = phdr->p_vaddr;
+	    relro_size = phdr->p_memsz;
+	    break;
 	}
 
 	++phdr;
@@ -269,6 +278,9 @@ map_object(int fd, const char *path, const struct stat *sb)
 	obj->tlsinit = mapbase + phtls->p_vaddr;
     }
     obj->stack_flags = stack_flags;
+    obj->relro_page = obj->relocbase + trunc_page(relro_page);
+    obj->relro_size = round_page(relro_size);
+
     return obj;
 }
 
diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index c6eea1a..53e44d5 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -1114,6 +1114,11 @@ digest_phdr(const Elf_Phdr *phdr, int phnum, caddr_t entry, const char *path)
 	case PT_GNU_STACK:
 	    obj->stack_flags = ph->p_flags;
 	    break;
+
+	case PT_GNU_RELRO:
+	    obj->relro_page = obj->relocbase + trunc_page(ph->p_vaddr);
+	    obj->relro_size = round_page(ph->p_memsz);
+	    break;
 	}
     }
     if (nsegs < 1) {
@@ -2007,6 +2012,14 @@ relocate_objects(Obj_Entry *first, bool bind_now, Obj_Entry *rtldobj,
 	    if (reloc_jmpslots(obj, lockstate) == -1)
 		return -1;
 
+	if (obj->relro_size > 0) {
+	    if (mprotect(obj->relro_page, obj->relro_size, PROT_READ) == -1) {
+		_rtld_error("%s: Cannot enforce relro protection: %s",
+		  obj->path, strerror(errno));
+		return -1;
+	    }
+	}
+
 	/*
 	 * Set up the magic number and version in the Obj_Entry.  These
 	 * were checked in the crt1.o from the original ElfKit, so we
diff --git a/libexec/rtld-elf/rtld.h b/libexec/rtld-elf/rtld.h
index e969d36..d8a3a39 100644
--- a/libexec/rtld-elf/rtld.h
+++ b/libexec/rtld-elf/rtld.h
@@ -168,6 +168,9 @@ typedef struct Struct_Obj_Entry {
     size_t tlsoffset;		/* Offset of static TLS block for this module */
     size_t tlsalign;		/* Alignment of static TLS block */
 
+    caddr_t relro_page;
+    size_t relro_size;
+
     /* Items from the dynamic section. */
     Elf_Addr *pltgot;		/* PLT or GOT, depending on architecture */
     const Elf_Rel *rel;		/* Relocation entries */