1 | /* The tunable framework. See the README.tunables to know how to use the |
2 | tunable in a glibc module. |
3 | |
4 | Copyright (C) 2016-2019 Free Software Foundation, Inc. |
5 | This file is part of the GNU C Library. |
6 | |
7 | The GNU C Library is free software; you can redistribute it and/or |
8 | modify it under the terms of the GNU Lesser General Public |
9 | License as published by the Free Software Foundation; either |
10 | version 2.1 of the License, or (at your option) any later version. |
11 | |
12 | The GNU C Library is distributed in the hope that it will be useful, |
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
15 | Lesser General Public License for more details. |
16 | |
17 | You should have received a copy of the GNU Lesser General Public |
18 | License along with the GNU C Library; if not, see |
19 | <http://www.gnu.org/licenses/>. */ |
20 | |
21 | #include <startup.h> |
22 | #include <stdint.h> |
23 | #include <stdbool.h> |
24 | #include <unistd.h> |
25 | #include <stdlib.h> |
26 | #include <sysdep.h> |
27 | #include <fcntl.h> |
28 | #include <ldsodefs.h> |
29 | |
30 | #define TUNABLES_INTERNAL 1 |
31 | #include "dl-tunables.h" |
32 | |
33 | #include <not-errno.h> |
34 | |
35 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
36 | # define GLIBC_TUNABLES "GLIBC_TUNABLES" |
37 | #endif |
38 | |
39 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
40 | static char * |
41 | tunables_strdup (const char *in) |
42 | { |
43 | size_t i = 0; |
44 | |
45 | while (in[i++] != '\0'); |
46 | char *out = __sbrk (i); |
47 | |
48 | /* FIXME: In reality if the allocation fails, __sbrk will crash attempting to |
49 | set the thread-local errno since the TCB has not yet been set up. This |
50 | needs to be fixed with an __sbrk implementation that does not set |
51 | errno. */ |
52 | if (out == (void *)-1) |
53 | return NULL; |
54 | |
55 | i--; |
56 | |
57 | while (i-- > 0) |
58 | out[i] = in[i]; |
59 | |
60 | return out; |
61 | } |
62 | #endif |
63 | |
64 | static char ** |
65 | get_next_env (char **envp, char **name, size_t *namelen, char **val, |
66 | char ***prev_envp) |
67 | { |
68 | while (envp != NULL && *envp != NULL) |
69 | { |
70 | char **prev = envp; |
71 | char *envline = *envp++; |
72 | int len = 0; |
73 | |
74 | while (envline[len] != '\0' && envline[len] != '=') |
75 | len++; |
76 | |
77 | /* Just the name and no value, go to the next one. */ |
78 | if (envline[len] == '\0') |
79 | continue; |
80 | |
81 | *name = envline; |
82 | *namelen = len; |
83 | *val = &envline[len + 1]; |
84 | *prev_envp = prev; |
85 | |
86 | return envp; |
87 | } |
88 | |
89 | return NULL; |
90 | } |
91 | |
92 | #define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type) \ |
93 | ({ \ |
94 | __type min = (__cur)->type.min; \ |
95 | __type max = (__cur)->type.max; \ |
96 | \ |
97 | if ((__type) (__val) >= min && (__type) (val) <= max) \ |
98 | { \ |
99 | (__cur)->val.numval = val; \ |
100 | (__cur)->initialized = true; \ |
101 | } \ |
102 | }) |
103 | |
104 | static void |
105 | do_tunable_update_val (tunable_t *cur, const void *valp) |
106 | { |
107 | uint64_t val; |
108 | |
109 | if (cur->type.type_code != TUNABLE_TYPE_STRING) |
110 | val = *((int64_t *) valp); |
111 | |
112 | switch (cur->type.type_code) |
113 | { |
114 | case TUNABLE_TYPE_INT_32: |
115 | { |
116 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t); |
117 | break; |
118 | } |
119 | case TUNABLE_TYPE_UINT_64: |
120 | { |
121 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t); |
122 | break; |
123 | } |
124 | case TUNABLE_TYPE_SIZE_T: |
125 | { |
126 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t); |
127 | break; |
128 | } |
129 | case TUNABLE_TYPE_STRING: |
130 | { |
131 | cur->val.strval = valp; |
132 | break; |
133 | } |
134 | default: |
135 | __builtin_unreachable (); |
136 | } |
137 | } |
138 | |
139 | /* Validate range of the input value and initialize the tunable CUR if it looks |
140 | good. */ |
141 | static void |
142 | tunable_initialize (tunable_t *cur, const char *strval) |
143 | { |
144 | uint64_t val; |
145 | const void *valp; |
146 | |
147 | if (cur->type.type_code != TUNABLE_TYPE_STRING) |
148 | { |
149 | val = _dl_strtoul (strval, NULL); |
150 | valp = &val; |
151 | } |
152 | else |
153 | { |
154 | cur->initialized = true; |
155 | valp = strval; |
156 | } |
157 | do_tunable_update_val (cur, valp); |
158 | } |
159 | |
160 | void |
161 | __tunable_set_val (tunable_id_t id, void *valp) |
162 | { |
163 | tunable_t *cur = &tunable_list[id]; |
164 | |
165 | do_tunable_update_val (cur, valp); |
166 | } |
167 | |
168 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
169 | /* Parse the tunable string TUNESTR and adjust it to drop any tunables that may |
170 | be unsafe for AT_SECURE processes so that it can be used as the new |
171 | environment variable value for GLIBC_TUNABLES. VALSTRING is the original |
172 | environment variable string which we use to make NULL terminated values so |
173 | that we don't have to allocate memory again for it. */ |
174 | static void |
175 | parse_tunables (char *tunestr, char *valstring) |
176 | { |
177 | if (tunestr == NULL || *tunestr == '\0') |
178 | return; |
179 | |
180 | char *p = tunestr; |
181 | |
182 | while (true) |
183 | { |
184 | char *name = p; |
185 | size_t len = 0; |
186 | |
187 | /* First, find where the name ends. */ |
188 | while (p[len] != '=' && p[len] != ':' && p[len] != '\0') |
189 | len++; |
190 | |
191 | /* If we reach the end of the string before getting a valid name-value |
192 | pair, bail out. */ |
193 | if (p[len] == '\0') |
194 | return; |
195 | |
196 | /* We did not find a valid name-value pair before encountering the |
197 | colon. */ |
198 | if (p[len]== ':') |
199 | { |
200 | p += len + 1; |
201 | continue; |
202 | } |
203 | |
204 | p += len + 1; |
205 | |
206 | /* Take the value from the valstring since we need to NULL terminate it. */ |
207 | char *value = &valstring[p - tunestr]; |
208 | len = 0; |
209 | |
210 | while (p[len] != ':' && p[len] != '\0') |
211 | len++; |
212 | |
213 | /* Add the tunable if it exists. */ |
214 | for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++) |
215 | { |
216 | tunable_t *cur = &tunable_list[i]; |
217 | |
218 | if (tunable_is_name (cur->name, name)) |
219 | { |
220 | /* If we are in a secure context (AT_SECURE) then ignore the tunable |
221 | unless it is explicitly marked as secure. Tunable values take |
222 | precendence over their envvar aliases. */ |
223 | if (__libc_enable_secure) |
224 | { |
225 | if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE) |
226 | { |
227 | if (p[len] == '\0') |
228 | { |
229 | /* Last tunable in the valstring. Null-terminate and |
230 | return. */ |
231 | *name = '\0'; |
232 | return; |
233 | } |
234 | else |
235 | { |
236 | /* Remove the current tunable from the string. We do |
237 | this by overwriting the string starting from NAME |
238 | (which is where the current tunable begins) with |
239 | the remainder of the string. We then have P point |
240 | to NAME so that we continue in the correct |
241 | position in the valstring. */ |
242 | char *q = &p[len + 1]; |
243 | p = name; |
244 | while (*q != '\0') |
245 | *name++ = *q++; |
246 | name[0] = '\0'; |
247 | len = 0; |
248 | } |
249 | } |
250 | |
251 | if (cur->security_level != TUNABLE_SECLEVEL_NONE) |
252 | break; |
253 | } |
254 | |
255 | value[len] = '\0'; |
256 | tunable_initialize (cur, value); |
257 | break; |
258 | } |
259 | } |
260 | |
261 | if (p[len] == '\0') |
262 | return; |
263 | else |
264 | p += len + 1; |
265 | } |
266 | } |
267 | #endif |
268 | |
269 | /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when |
270 | the system administrator has created the /etc/suid-debug file. This is a |
271 | special case where we want to conditionally enable/disable a tunable even |
272 | for setuid binaries. We use the special version of access() to avoid |
273 | setting ERRNO, which is a TLS variable since TLS has not yet been set |
274 | up. */ |
275 | static __always_inline void |
276 | maybe_enable_malloc_check (void) |
277 | { |
278 | tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check); |
279 | if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug" , F_OK) == 0) |
280 | tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE; |
281 | } |
282 | |
283 | /* Initialize the tunables list from the environment. For now we only use the |
284 | ENV_ALIAS to find values. Later we will also use the tunable names to find |
285 | values. */ |
286 | void |
287 | __tunables_init (char **envp) |
288 | { |
289 | char *envname = NULL; |
290 | char *envval = NULL; |
291 | size_t len = 0; |
292 | char **prev_envp = envp; |
293 | |
294 | maybe_enable_malloc_check (); |
295 | |
296 | while ((envp = get_next_env (envp, &envname, &len, &envval, |
297 | &prev_envp)) != NULL) |
298 | { |
299 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
300 | if (tunable_is_name (GLIBC_TUNABLES, envname)) |
301 | { |
302 | char *new_env = tunables_strdup (envname); |
303 | if (new_env != NULL) |
304 | parse_tunables (new_env + len + 1, envval); |
305 | /* Put in the updated envval. */ |
306 | *prev_envp = new_env; |
307 | continue; |
308 | } |
309 | #endif |
310 | |
311 | for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++) |
312 | { |
313 | tunable_t *cur = &tunable_list[i]; |
314 | |
315 | /* Skip over tunables that have either been set already or should be |
316 | skipped. */ |
317 | if (cur->initialized || cur->env_alias == NULL) |
318 | continue; |
319 | |
320 | const char *name = cur->env_alias; |
321 | |
322 | /* We have a match. Initialize and move on to the next line. */ |
323 | if (tunable_is_name (name, envname)) |
324 | { |
325 | /* For AT_SECURE binaries, we need to check the security settings of |
326 | the tunable and decide whether we read the value and also whether |
327 | we erase the value so that child processes don't inherit them in |
328 | the environment. */ |
329 | if (__libc_enable_secure) |
330 | { |
331 | if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE) |
332 | { |
333 | /* Erase the environment variable. */ |
334 | char **ep = prev_envp; |
335 | |
336 | while (*ep != NULL) |
337 | { |
338 | if (tunable_is_name (name, *ep)) |
339 | { |
340 | char **dp = ep; |
341 | |
342 | do |
343 | dp[0] = dp[1]; |
344 | while (*dp++); |
345 | } |
346 | else |
347 | ++ep; |
348 | } |
349 | /* Reset the iterator so that we read the environment again |
350 | from the point we erased. */ |
351 | envp = prev_envp; |
352 | } |
353 | |
354 | if (cur->security_level != TUNABLE_SECLEVEL_NONE) |
355 | continue; |
356 | } |
357 | |
358 | tunable_initialize (cur, envval); |
359 | break; |
360 | } |
361 | } |
362 | } |
363 | } |
364 | |
365 | /* Set the tunable value. This is called by the module that the tunable exists |
366 | in. */ |
367 | void |
368 | __tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback) |
369 | { |
370 | tunable_t *cur = &tunable_list[id]; |
371 | |
372 | switch (cur->type.type_code) |
373 | { |
374 | case TUNABLE_TYPE_UINT_64: |
375 | { |
376 | *((uint64_t *) valp) = (uint64_t) cur->val.numval; |
377 | break; |
378 | } |
379 | case TUNABLE_TYPE_INT_32: |
380 | { |
381 | *((int32_t *) valp) = (int32_t) cur->val.numval; |
382 | break; |
383 | } |
384 | case TUNABLE_TYPE_SIZE_T: |
385 | { |
386 | *((size_t *) valp) = (size_t) cur->val.numval; |
387 | break; |
388 | } |
389 | case TUNABLE_TYPE_STRING: |
390 | { |
391 | *((const char **)valp) = cur->val.strval; |
392 | break; |
393 | } |
394 | default: |
395 | __builtin_unreachable (); |
396 | } |
397 | |
398 | if (cur->initialized && callback != NULL) |
399 | callback (&cur->val); |
400 | } |
401 | |
402 | rtld_hidden_def (__tunable_get_val) |
403 | |