1 | /* The tunable framework. See the README.tunables to know how to use the |
2 | tunable in a glibc module. |
3 | |
4 | Copyright (C) 2016-2020 Free Software Foundation, Inc. |
5 | This file is part of the GNU C Library. |
6 | |
7 | The GNU C Library is free software; you can redistribute it and/or |
8 | modify it under the terms of the GNU Lesser General Public |
9 | License as published by the Free Software Foundation; either |
10 | version 2.1 of the License, or (at your option) any later version. |
11 | |
12 | The GNU C Library is distributed in the hope that it will be useful, |
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
15 | Lesser General Public License for more details. |
16 | |
17 | You should have received a copy of the GNU Lesser General Public |
18 | License along with the GNU C Library; if not, see |
19 | <https://www.gnu.org/licenses/>. */ |
20 | |
21 | #include <startup.h> |
22 | #include <stdint.h> |
23 | #include <stdbool.h> |
24 | #include <unistd.h> |
25 | #include <stdlib.h> |
26 | #include <sysdep.h> |
27 | #include <fcntl.h> |
28 | #include <ldsodefs.h> |
29 | |
30 | #define TUNABLES_INTERNAL 1 |
31 | #include "dl-tunables.h" |
32 | |
33 | #include <not-errno.h> |
34 | |
35 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
36 | # define GLIBC_TUNABLES "GLIBC_TUNABLES" |
37 | #endif |
38 | |
39 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
40 | static char * |
41 | tunables_strdup (const char *in) |
42 | { |
43 | size_t i = 0; |
44 | |
45 | while (in[i++] != '\0'); |
46 | char *out = __sbrk (i); |
47 | |
48 | /* For most of the tunables code, we ignore user errors. However, |
49 | this is a system error - and running out of memory at program |
50 | startup should be reported, so we do. */ |
51 | if (out == (void *)-1) |
52 | _dl_fatal_printf ("sbrk() failure while processing tunables\n" ); |
53 | |
54 | i--; |
55 | |
56 | while (i-- > 0) |
57 | out[i] = in[i]; |
58 | |
59 | return out; |
60 | } |
61 | #endif |
62 | |
63 | static char ** |
64 | get_next_env (char **envp, char **name, size_t *namelen, char **val, |
65 | char ***prev_envp) |
66 | { |
67 | while (envp != NULL && *envp != NULL) |
68 | { |
69 | char **prev = envp; |
70 | char *envline = *envp++; |
71 | int len = 0; |
72 | |
73 | while (envline[len] != '\0' && envline[len] != '=') |
74 | len++; |
75 | |
76 | /* Just the name and no value, go to the next one. */ |
77 | if (envline[len] == '\0') |
78 | continue; |
79 | |
80 | *name = envline; |
81 | *namelen = len; |
82 | *val = &envline[len + 1]; |
83 | *prev_envp = prev; |
84 | |
85 | return envp; |
86 | } |
87 | |
88 | return NULL; |
89 | } |
90 | |
91 | #define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type) \ |
92 | ({ \ |
93 | __type min = (__cur)->type.min; \ |
94 | __type max = (__cur)->type.max; \ |
95 | \ |
96 | if ((__type) (__val) >= min && (__type) (val) <= max) \ |
97 | { \ |
98 | (__cur)->val.numval = val; \ |
99 | (__cur)->initialized = true; \ |
100 | } \ |
101 | }) |
102 | |
103 | static void |
104 | do_tunable_update_val (tunable_t *cur, const void *valp) |
105 | { |
106 | uint64_t val; |
107 | |
108 | if (cur->type.type_code != TUNABLE_TYPE_STRING) |
109 | val = *((int64_t *) valp); |
110 | |
111 | switch (cur->type.type_code) |
112 | { |
113 | case TUNABLE_TYPE_INT_32: |
114 | { |
115 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t); |
116 | break; |
117 | } |
118 | case TUNABLE_TYPE_UINT_64: |
119 | { |
120 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t); |
121 | break; |
122 | } |
123 | case TUNABLE_TYPE_SIZE_T: |
124 | { |
125 | TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t); |
126 | break; |
127 | } |
128 | case TUNABLE_TYPE_STRING: |
129 | { |
130 | cur->val.strval = valp; |
131 | break; |
132 | } |
133 | default: |
134 | __builtin_unreachable (); |
135 | } |
136 | } |
137 | |
138 | /* Validate range of the input value and initialize the tunable CUR if it looks |
139 | good. */ |
140 | static void |
141 | tunable_initialize (tunable_t *cur, const char *strval) |
142 | { |
143 | uint64_t val; |
144 | const void *valp; |
145 | |
146 | if (cur->type.type_code != TUNABLE_TYPE_STRING) |
147 | { |
148 | val = _dl_strtoul (strval, NULL); |
149 | valp = &val; |
150 | } |
151 | else |
152 | { |
153 | cur->initialized = true; |
154 | valp = strval; |
155 | } |
156 | do_tunable_update_val (cur, valp); |
157 | } |
158 | |
159 | void |
160 | __tunable_set_val (tunable_id_t id, void *valp) |
161 | { |
162 | tunable_t *cur = &tunable_list[id]; |
163 | |
164 | do_tunable_update_val (cur, valp); |
165 | } |
166 | |
167 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
168 | /* Parse the tunable string TUNESTR and adjust it to drop any tunables that may |
169 | be unsafe for AT_SECURE processes so that it can be used as the new |
170 | environment variable value for GLIBC_TUNABLES. VALSTRING is the original |
171 | environment variable string which we use to make NULL terminated values so |
172 | that we don't have to allocate memory again for it. */ |
173 | static void |
174 | parse_tunables (char *tunestr, char *valstring) |
175 | { |
176 | if (tunestr == NULL || *tunestr == '\0') |
177 | return; |
178 | |
179 | char *p = tunestr; |
180 | |
181 | while (true) |
182 | { |
183 | char *name = p; |
184 | size_t len = 0; |
185 | |
186 | /* First, find where the name ends. */ |
187 | while (p[len] != '=' && p[len] != ':' && p[len] != '\0') |
188 | len++; |
189 | |
190 | /* If we reach the end of the string before getting a valid name-value |
191 | pair, bail out. */ |
192 | if (p[len] == '\0') |
193 | return; |
194 | |
195 | /* We did not find a valid name-value pair before encountering the |
196 | colon. */ |
197 | if (p[len]== ':') |
198 | { |
199 | p += len + 1; |
200 | continue; |
201 | } |
202 | |
203 | p += len + 1; |
204 | |
205 | /* Take the value from the valstring since we need to NULL terminate it. */ |
206 | char *value = &valstring[p - tunestr]; |
207 | len = 0; |
208 | |
209 | while (p[len] != ':' && p[len] != '\0') |
210 | len++; |
211 | |
212 | /* Add the tunable if it exists. */ |
213 | for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++) |
214 | { |
215 | tunable_t *cur = &tunable_list[i]; |
216 | |
217 | if (tunable_is_name (cur->name, name)) |
218 | { |
219 | /* If we are in a secure context (AT_SECURE) then ignore the tunable |
220 | unless it is explicitly marked as secure. Tunable values take |
221 | precendence over their envvar aliases. */ |
222 | if (__libc_enable_secure) |
223 | { |
224 | if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE) |
225 | { |
226 | if (p[len] == '\0') |
227 | { |
228 | /* Last tunable in the valstring. Null-terminate and |
229 | return. */ |
230 | *name = '\0'; |
231 | return; |
232 | } |
233 | else |
234 | { |
235 | /* Remove the current tunable from the string. We do |
236 | this by overwriting the string starting from NAME |
237 | (which is where the current tunable begins) with |
238 | the remainder of the string. We then have P point |
239 | to NAME so that we continue in the correct |
240 | position in the valstring. */ |
241 | char *q = &p[len + 1]; |
242 | p = name; |
243 | while (*q != '\0') |
244 | *name++ = *q++; |
245 | name[0] = '\0'; |
246 | len = 0; |
247 | } |
248 | } |
249 | |
250 | if (cur->security_level != TUNABLE_SECLEVEL_NONE) |
251 | break; |
252 | } |
253 | |
254 | value[len] = '\0'; |
255 | tunable_initialize (cur, value); |
256 | break; |
257 | } |
258 | } |
259 | |
260 | if (p[len] == '\0') |
261 | return; |
262 | else |
263 | p += len + 1; |
264 | } |
265 | } |
266 | #endif |
267 | |
268 | /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when |
269 | the system administrator has created the /etc/suid-debug file. This is a |
270 | special case where we want to conditionally enable/disable a tunable even |
271 | for setuid binaries. We use the special version of access() to avoid |
272 | setting ERRNO, which is a TLS variable since TLS has not yet been set |
273 | up. */ |
274 | static __always_inline void |
275 | maybe_enable_malloc_check (void) |
276 | { |
277 | tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check); |
278 | if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug" , F_OK) == 0) |
279 | tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE; |
280 | } |
281 | |
282 | /* Initialize the tunables list from the environment. For now we only use the |
283 | ENV_ALIAS to find values. Later we will also use the tunable names to find |
284 | values. */ |
285 | void |
286 | __tunables_init (char **envp) |
287 | { |
288 | char *envname = NULL; |
289 | char *envval = NULL; |
290 | size_t len = 0; |
291 | char **prev_envp = envp; |
292 | |
293 | maybe_enable_malloc_check (); |
294 | |
295 | while ((envp = get_next_env (envp, &envname, &len, &envval, |
296 | &prev_envp)) != NULL) |
297 | { |
298 | #if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring |
299 | if (tunable_is_name (GLIBC_TUNABLES, envname)) |
300 | { |
301 | char *new_env = tunables_strdup (envname); |
302 | if (new_env != NULL) |
303 | parse_tunables (new_env + len + 1, envval); |
304 | /* Put in the updated envval. */ |
305 | *prev_envp = new_env; |
306 | continue; |
307 | } |
308 | #endif |
309 | |
310 | for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++) |
311 | { |
312 | tunable_t *cur = &tunable_list[i]; |
313 | |
314 | /* Skip over tunables that have either been set already or should be |
315 | skipped. */ |
316 | if (cur->initialized || cur->env_alias == NULL) |
317 | continue; |
318 | |
319 | const char *name = cur->env_alias; |
320 | |
321 | /* We have a match. Initialize and move on to the next line. */ |
322 | if (tunable_is_name (name, envname)) |
323 | { |
324 | /* For AT_SECURE binaries, we need to check the security settings of |
325 | the tunable and decide whether we read the value and also whether |
326 | we erase the value so that child processes don't inherit them in |
327 | the environment. */ |
328 | if (__libc_enable_secure) |
329 | { |
330 | if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE) |
331 | { |
332 | /* Erase the environment variable. */ |
333 | char **ep = prev_envp; |
334 | |
335 | while (*ep != NULL) |
336 | { |
337 | if (tunable_is_name (name, *ep)) |
338 | { |
339 | char **dp = ep; |
340 | |
341 | do |
342 | dp[0] = dp[1]; |
343 | while (*dp++); |
344 | } |
345 | else |
346 | ++ep; |
347 | } |
348 | /* Reset the iterator so that we read the environment again |
349 | from the point we erased. */ |
350 | envp = prev_envp; |
351 | } |
352 | |
353 | if (cur->security_level != TUNABLE_SECLEVEL_NONE) |
354 | continue; |
355 | } |
356 | |
357 | tunable_initialize (cur, envval); |
358 | break; |
359 | } |
360 | } |
361 | } |
362 | } |
363 | |
364 | /* Set the tunable value. This is called by the module that the tunable exists |
365 | in. */ |
366 | void |
367 | __tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback) |
368 | { |
369 | tunable_t *cur = &tunable_list[id]; |
370 | |
371 | switch (cur->type.type_code) |
372 | { |
373 | case TUNABLE_TYPE_UINT_64: |
374 | { |
375 | *((uint64_t *) valp) = (uint64_t) cur->val.numval; |
376 | break; |
377 | } |
378 | case TUNABLE_TYPE_INT_32: |
379 | { |
380 | *((int32_t *) valp) = (int32_t) cur->val.numval; |
381 | break; |
382 | } |
383 | case TUNABLE_TYPE_SIZE_T: |
384 | { |
385 | *((size_t *) valp) = (size_t) cur->val.numval; |
386 | break; |
387 | } |
388 | case TUNABLE_TYPE_STRING: |
389 | { |
390 | *((const char **)valp) = cur->val.strval; |
391 | break; |
392 | } |
393 | default: |
394 | __builtin_unreachable (); |
395 | } |
396 | |
397 | if (cur->initialized && callback != NULL) |
398 | callback (&cur->val); |
399 | } |
400 | |
401 | rtld_hidden_def (__tunable_get_val) |
402 | |