[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 11 Dec 2019 08:19:50 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: RTLD_LAZY deferred symbol binding
On Wed, Dec 11, 2019 at 02:55:48PM +0300, Scherbatiy Alexander wrote:
> Thank you. It works.
>
> I looked at the ld help on linux Alpine and it shows
> > ld --help
> > -z lazy Mark object lazy runtime binding (default)
>
> Should the lazy option be used by default
No, it's really a bug to be relying on this behavior, as it precludes
much-wanted hardening and is not well-defined per the supported
standards. Deferred binding was added for the sake of a very small but
important and stubborn set of software (i.e. Xorg) that was depending
on lazy binding and where musl-based dists were needing messy hacks to
make it work without (explicit load order of modules in xorg.conf).
The software that needs this behavior can be built with -z lazy as
needed. This is not unique to musl; it applies to hardened glibc
toolchains/distros where bindnow is default, too.
> or the documentation needs to be updated?
That's the documentation for ld, which applies if you invoke ld as a
command. That's not how you link hosted software. It's linked by
invoking $(CC) (e.g. gcc) which may be the part passing -z now; I
forget. If the default is actually changed in ld, then yes ld should
be patched to print the default it was configured with accurately (and
I would think such a patch would be acceptable for upstream).
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
