xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/util.c (revision 7f9dc0eec05dc1280e3a494124572c5814e7aef9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
27  */
28 
29 /*
30  * Copyright (c) 2014 by Delphix. All rights reserved.
31  */
32 
33 /*
34  * Utility routines for run-time linker.  some are duplicated here from libc
35  * (with different names) to avoid name space collisions.
36  */
37 #include	<sys/systeminfo.h>
38 #include	<stdio.h>
39 #include	<sys/time.h>
40 #include	<sys/types.h>
41 #include	<sys/mman.h>
42 #include	<sys/lwp.h>
43 #include	<sys/debug.h>
44 #include	<stdarg.h>
45 #include	<fcntl.h>
46 #include	<string.h>
47 #include	<dlfcn.h>
48 #include	<unistd.h>
49 #include	<stdlib.h>
50 #include	<sys/auxv.h>
51 #include	<limits.h>
52 #include	<debug.h>
53 #include	<conv.h>
54 #include	<upanic.h>
55 #include	"_rtld.h"
56 #include	"_audit.h"
57 #include	"_elf.h"
58 #include	"msg.h"
59 
60 /*
61  * Null function used as place where a debugger can set a breakpoint.
62  */
63 void
rtld_db_dlactivity(Lm_list * lml)64 rtld_db_dlactivity(Lm_list *lml)
65 {
66 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
67 	    r_debug.rtd_rdebug.r_state));
68 }
69 
70 /*
71  * Null function used as place where debugger can set a pre .init
72  * processing breakpoint.
73  */
74 void
rtld_db_preinit(Lm_list * lml)75 rtld_db_preinit(Lm_list *lml)
76 {
77 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
78 	    r_debug.rtd_rdebug.r_state));
79 }
80 
81 /*
82  * Null function used as place where debugger can set a post .init
83  * processing breakpoint.
84  */
85 void
rtld_db_postinit(Lm_list * lml)86 rtld_db_postinit(Lm_list *lml)
87 {
88 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
89 	    r_debug.rtd_rdebug.r_state));
90 }
91 
92 /*
93  * Debugger Event Notification
94  *
95  * This function centralizes all debugger event notification (ala rtld_db).
96  *
97  * There's a simple intent, focused on insuring the primary link-map control
98  * list (or each link-map list) is consistent, and the indication that objects
99  * have been added or deleted from this list.  Although an RD_ADD and RD_DELETE
100  * event are posted for each of these, most debuggers don't care, as their
101  * view is that these events simply convey an "inconsistent" state.
102  *
103  * We also don't want to trigger multiple RD_ADD/RD_DELETE events any time we
104  * enter ld.so.1.
105  *
106  * Set an RD_ADD/RD_DELETE event and indicate that an RD_CONSISTENT event is
107  * required later (RT_FL_DBNOTIF):
108  *
109  *  i.	the first time we add or delete an object to the primary link-map
110  *	control list.
111  *  ii.	the first time we move a secondary link-map control list to the primary
112  *	link-map control list (effectively, this is like adding a group of
113  *	objects to the primary link-map control list).
114  *
115  * Set an RD_CONSISTENT event when it is required (RT_FL_DBNOTIF is set):
116  *
117  *  i.	each time we leave the runtime linker.
118  */
119 void
rd_event(Lm_list * lml,rd_event_e event,r_state_e state)120 rd_event(Lm_list *lml, rd_event_e event, r_state_e state)
121 {
122 	void	(*fptr)(Lm_list *);
123 
124 	switch (event) {
125 	case RD_PREINIT:
126 		fptr = rtld_db_preinit;
127 		break;
128 	case RD_POSTINIT:
129 		fptr = rtld_db_postinit;
130 		break;
131 	case RD_DLACTIVITY:
132 		switch (state) {
133 		case RT_CONSISTENT:
134 			/*
135 			 * Do we need to send a notification?
136 			 */
137 			if ((rtld_flags & RT_FL_DBNOTIF) == 0)
138 				return;
139 			rtld_flags &= ~RT_FL_DBNOTIF;
140 			break;
141 		case RT_ADD:
142 		case RT_DELETE:
143 			/*
144 			 * If we are already in an inconsistent state, no
145 			 * notification is required.
146 			 */
147 			if (rtld_flags & RT_FL_DBNOTIF)
148 				return;
149 			rtld_flags |= RT_FL_DBNOTIF;
150 			break;
151 		};
152 		fptr = rtld_db_dlactivity;
153 		break;
154 	default:
155 		/*
156 		 * RD_NONE - do nothing
157 		 */
158 		break;
159 	};
160 
161 	/*
162 	 * Set event state and call 'notification' function.
163 	 *
164 	 * The debugging clients have previously been told about these
165 	 * notification functions and have set breakpoints on them if they
166 	 * are interested in the notification.
167 	 */
168 	r_debug.rtd_rdebug.r_state = state;
169 	r_debug.rtd_rdebug.r_rdevent = event;
170 	fptr(lml);
171 	r_debug.rtd_rdebug.r_rdevent = RD_NONE;
172 }
173 
174 #if	defined(__sparc) || defined(__x86)
175 /*
176  * Stack Cleanup.
177  *
178  * This function is invoked to 'remove' arguments that were passed in on the
179  * stack.  This is most likely if ld.so.1 was invoked directly.  In that case
180  * we want to remove ld.so.1 as well as it's arguments from the argv[] array.
181  * Which means we then need to slide everything above it on the stack down
182  * accordingly.
183  *
184  * While the stack layout is platform specific - it just so happens that __x86,
185  * and __sparc platforms share the following initial stack layout.
186  *
187  *	!_______________________!  high addresses
188  *	!			!
189  *	!	Information	!
190  *	!	Block		!
191  *	!	(size varies)	!
192  *	!_______________________!
193  *	!	0 word		!
194  *	!_______________________!
195  *	!	Auxiliary	!
196  *	!	vector		!
197  *	!	2 word entries	!
198  *	!			!
199  *	!_______________________!
200  *	!	0 word		!
201  *	!_______________________!
202  *	!	Environment	!
203  *	!	pointers	!
204  *	!	...		!
205  *	!	(one word each)	!
206  *	!_______________________!
207  *	!	0 word		!
208  *	!_______________________!
209  *	!	Argument	! low addresses
210  *	!	pointers	!
211  *	!	Argc words	!
212  *	!_______________________!
213  *	!			!
214  *	!	Argc		!
215  *	!_______________________!
216  *	!	...		!
217  *
218  */
219 static void
stack_cleanup(char ** argv,char *** envp,auxv_t ** auxv,int rmcnt)220 stack_cleanup(char **argv, char ***envp, auxv_t **auxv, int rmcnt)
221 {
222 	int		ndx;
223 	long		*argc;
224 	char		**oargv, **nargv;
225 	char		**oenvp, **nenvp;
226 	auxv_t		*oauxv, *nauxv;
227 
228 	/*
229 	 * Slide ARGV[] and update argc.  The argv pointer remains the same,
230 	 * however slide the applications arguments over the arguments to
231 	 * ld.so.1.
232 	 */
233 	nargv = &argv[0];
234 	oargv = &argv[rmcnt];
235 
236 	for (ndx = 0; oargv[ndx]; ndx++)
237 		nargv[ndx] = oargv[ndx];
238 	nargv[ndx] = oargv[ndx];
239 
240 	argc = (long *)((uintptr_t)argv - sizeof (long *));
241 	*argc -= rmcnt;
242 
243 	/*
244 	 * Slide ENVP[], and update the environment array pointer.
245 	 */
246 	ndx++;
247 	nenvp = &nargv[ndx];
248 	oenvp = &oargv[ndx];
249 	*envp = nenvp;
250 
251 	for (ndx = 0; oenvp[ndx]; ndx++)
252 		nenvp[ndx] = oenvp[ndx];
253 	nenvp[ndx] = oenvp[ndx];
254 
255 	/*
256 	 * Slide AUXV[], and update the aux vector pointer.
257 	 */
258 	ndx++;
259 	nauxv = (auxv_t *)&nenvp[ndx];
260 	oauxv = (auxv_t *)&oenvp[ndx];
261 	*auxv = nauxv;
262 
263 	for (ndx = 0; (oauxv[ndx].a_type != AT_NULL); ndx++)
264 		nauxv[ndx] = oauxv[ndx];
265 	nauxv[ndx] = oauxv[ndx];
266 }
267 #else
268 /*
269  * Verify that the above routine is appropriate for any new platforms.
270  */
271 #error	unsupported architecture!
272 #endif
273 
274 /*
275  * Compare function for PathNode AVL tree.
276  */
277 static int
pnavl_compare(const void * n1,const void * n2)278 pnavl_compare(const void *n1, const void *n2)
279 {
280 	uint_t		hash1, hash2;
281 	const char	*st1, *st2;
282 	int		rc;
283 
284 	hash1 = ((PathNode *)n1)->pn_hash;
285 	hash2 = ((PathNode *)n2)->pn_hash;
286 
287 	if (hash1 > hash2)
288 		return (1);
289 	if (hash1 < hash2)
290 		return (-1);
291 
292 	st1 = ((PathNode *)n1)->pn_name;
293 	st2 = ((PathNode *)n2)->pn_name;
294 
295 	rc = strcmp(st1, st2);
296 	if (rc > 0)
297 		return (1);
298 	if (rc < 0)
299 		return (-1);
300 	return (0);
301 }
302 
303 /*
304  * Create an AVL tree.
305  */
306 static avl_tree_t *
pnavl_create(size_t size)307 pnavl_create(size_t size)
308 {
309 	avl_tree_t	*avlt;
310 
311 	if ((avlt = malloc(sizeof (avl_tree_t))) == NULL)
312 		return (NULL);
313 	avl_create(avlt, pnavl_compare, size, SGSOFFSETOF(PathNode, pn_avl));
314 	return (avlt);
315 }
316 
317 /*
318  * Determine whether a PathNode is recorded.
319  */
320 int
pnavl_recorded(avl_tree_t ** pnavl,const char * name,uint_t hash,avl_index_t * where)321 pnavl_recorded(avl_tree_t **pnavl, const char *name, uint_t hash,
322     avl_index_t *where)
323 {
324 	PathNode	pn;
325 
326 	/*
327 	 * Create the avl tree if required.
328 	 */
329 	if ((*pnavl == NULL) &&
330 	    ((*pnavl = pnavl_create(sizeof (PathNode))) == NULL))
331 		return (0);
332 
333 	pn.pn_name = name;
334 	if ((pn.pn_hash = hash) == 0)
335 		pn.pn_hash = sgs_str_hash(name);
336 
337 	if (avl_find(*pnavl, &pn, where) == NULL)
338 		return (0);
339 
340 	return (1);
341 }
342 
343 /*
344  * Determine if a pathname has already been recorded on the full path name
345  * AVL tree.  This tree maintains a node for each path name that ld.so.1 has
346  * successfully loaded.  If the path name does not exist in this AVL tree, then
347  * the next insertion point is deposited in "where".  This value can be used by
348  * fpavl_insert() to expedite the insertion.
349  */
350 Rt_map *
fpavl_recorded(Lm_list * lml,const char * name,uint_t hash,avl_index_t * where)351 fpavl_recorded(Lm_list *lml, const char *name, uint_t hash, avl_index_t *where)
352 {
353 	FullPathNode	fpn, *fpnp;
354 
355 	/*
356 	 * Create the avl tree if required.
357 	 */
358 	if ((lml->lm_fpavl == NULL) &&
359 	    ((lml->lm_fpavl = pnavl_create(sizeof (FullPathNode))) == NULL))
360 		return (NULL);
361 
362 	fpn.fpn_node.pn_name = name;
363 	if ((fpn.fpn_node.pn_hash = hash) == 0)
364 		fpn.fpn_node.pn_hash = sgs_str_hash(name);
365 
366 	if ((fpnp = avl_find(lml->lm_fpavl, &fpn, where)) == NULL)
367 		return (NULL);
368 
369 	return (fpnp->fpn_lmp);
370 }
371 
372 /*
373  * Insert a name into the FullPathNode AVL tree for the link-map list.  The
374  * objects NAME() is the path that would have originally been searched for, and
375  * is therefore the name to associate with any "where" value.  If the object has
376  * a different PATHNAME(), perhaps because it has resolved to a different file
377  * (see fullpath()), then this name will be recorded as a separate FullPathNode
378  * (see load_file()).
379  */
380 int
fpavl_insert(Lm_list * lml,Rt_map * lmp,const char * name,avl_index_t where)381 fpavl_insert(Lm_list *lml, Rt_map *lmp, const char *name, avl_index_t where)
382 {
383 	FullPathNode	*fpnp;
384 	uint_t		hash = sgs_str_hash(name);
385 
386 	if (where == 0) {
387 		Rt_map	*_lmp __maybe_unused;
388 
389 		_lmp = fpavl_recorded(lml, name, hash, &where);
390 
391 		/*
392 		 * We better not get a hit now, we do not want duplicates in
393 		 * the tree.
394 		 */
395 		ASSERT(_lmp == NULL);
396 	}
397 
398 	/*
399 	 * Insert new node in tree.
400 	 */
401 	if ((fpnp = calloc(1, sizeof (FullPathNode))) == NULL)
402 		return (0);
403 
404 	fpnp->fpn_node.pn_name = name;
405 	fpnp->fpn_node.pn_hash = hash;
406 	fpnp->fpn_lmp = lmp;
407 
408 	if (aplist_append(&FPNODE(lmp), fpnp, AL_CNT_FPNODE) == NULL) {
409 		free(fpnp);
410 		return (0);
411 	}
412 
413 	ASSERT(lml->lm_fpavl != NULL);
414 	avl_insert(lml->lm_fpavl, fpnp, where);
415 	return (1);
416 }
417 
418 /*
419  * Remove an object from the FullPathNode AVL tree.
420  */
421 void
fpavl_remove(Rt_map * lmp)422 fpavl_remove(Rt_map *lmp)
423 {
424 	FullPathNode	*fpnp;
425 	Aliste		idx;
426 
427 	for (APLIST_TRAVERSE(FPNODE(lmp), idx, fpnp)) {
428 		avl_remove(LIST(lmp)->lm_fpavl, fpnp);
429 		free(fpnp);
430 	}
431 	free(FPNODE(lmp));
432 	FPNODE(lmp) = NULL;
433 }
434 
435 /*
436  * Insert a path name into the not-found AVL tree.
437  *
438  * This tree maintains a node for each path name that ld.so.1 has explicitly
439  * inspected, but has failed to load during a single ld.so.1 operation.  If the
440  * path name does not exist in this AVL tree, then the next insertion point is
441  * deposited in "where".  This value can be used by nfavl_insert() to expedite
442  * the insertion.
443  */
444 void
nfavl_insert(const char * name,avl_index_t where)445 nfavl_insert(const char *name, avl_index_t where)
446 {
447 	PathNode	*pnp;
448 	uint_t		hash = sgs_str_hash(name);
449 
450 	if (where == 0) {
451 		int	in_nfavl __maybe_unused;
452 
453 		in_nfavl = pnavl_recorded(&nfavl, name, hash, &where);
454 
455 		/*
456 		 * We better not get a hit now, we do not want duplicates in
457 		 * the tree.
458 		 */
459 		ASSERT(in_nfavl == 0);
460 	}
461 
462 	/*
463 	 * Insert new node in tree.
464 	 */
465 	if ((pnp = calloc(1, sizeof (PathNode))) != NULL) {
466 		pnp->pn_name = name;
467 		pnp->pn_hash = hash;
468 		avl_insert(nfavl, pnp, where);
469 	}
470 }
471 
472 /*
473  * Insert the directory name, of a full path name, into the secure path AVL
474  * tree.
475  *
476  * This tree is used to maintain a list of directories in which the dependencies
477  * of a secure process have been found.  This list provides a fall-back in the
478  * case that a $ORIGIN expansion is deemed insecure, when the expansion results
479  * in a path name that has already provided dependencies.
480  */
481 void
spavl_insert(const char * name)482 spavl_insert(const char *name)
483 {
484 	char		buffer[PATH_MAX], *str;
485 	size_t		size;
486 	avl_index_t	where;
487 	PathNode	*pnp;
488 	uint_t		hash;
489 
490 	/*
491 	 * Separate the directory name from the path name.
492 	 */
493 	if ((str = strrchr(name, '/')) == name)
494 		size = 1;
495 	else
496 		size = str - name;
497 
498 	(void) strncpy(buffer, name, size);
499 	buffer[size] = '\0';
500 	hash = sgs_str_hash(buffer);
501 
502 	/*
503 	 * Determine whether this directory name is already recorded, or if
504 	 * not, 'where" will provide the insertion point for the new string.
505 	 */
506 	if (pnavl_recorded(&spavl, buffer, hash, &where))
507 		return;
508 
509 	/*
510 	 * Insert new node in tree.
511 	 */
512 	if ((pnp = calloc(1, sizeof (PathNode))) != NULL) {
513 		pnp->pn_name = strdup(buffer);
514 		pnp->pn_hash = hash;
515 		avl_insert(spavl, pnp, where);
516 	}
517 }
518 
519 /*
520  * Inspect the generic string AVL tree for the given string.  If the string is
521  * not present, duplicate it, and insert the string in the AVL tree.  Return the
522  * duplicated string to the caller.
523  *
524  * These strings are maintained for the life of ld.so.1 and represent path
525  * names, file names, and search paths.  All other AVL trees that maintain
526  * FullPathNode and not-found path names use the same string pointer
527  * established for this string.
528  */
529 static avl_tree_t	*stravl = NULL;
530 static char		*strbuf = NULL;
531 static PathNode		*pnbuf = NULL;
532 static size_t		strsize = 0, pnsize = 0;
533 
534 const char *
stravl_insert(const char * name,uint_t hash,size_t nsize,int substr)535 stravl_insert(const char *name, uint_t hash, size_t nsize, int substr)
536 {
537 	char		str[PATH_MAX];
538 	PathNode	*pnp;
539 	avl_index_t	where;
540 
541 	/*
542 	 * Create the avl tree if required.
543 	 */
544 	if ((stravl == NULL) &&
545 	    ((stravl = pnavl_create(sizeof (PathNode))) == NULL))
546 		return (NULL);
547 
548 	/*
549 	 * Determine the string size if not provided by the caller.
550 	 */
551 	if (nsize == 0)
552 		nsize = strlen(name) + 1;
553 	else if (substr) {
554 		/*
555 		 * The string passed to us may be a multiple path string for
556 		 * which we only need the first component.  Using the provided
557 		 * size, strip out the required string.
558 		 */
559 		(void) strncpy(str, name, nsize);
560 		str[nsize - 1] = '\0';
561 		name = str;
562 	}
563 
564 	/*
565 	 * Allocate a PathNode buffer if one doesn't exist, or any existing
566 	 * buffer has been used up.
567 	 */
568 	if ((pnbuf == NULL) || (sizeof (PathNode) > pnsize)) {
569 		pnsize = syspagsz;
570 		if ((pnbuf = dz_map(0, 0, pnsize, (PROT_READ | PROT_WRITE),
571 		    MAP_PRIVATE)) == MAP_FAILED)
572 			return (NULL);
573 	}
574 	/*
575 	 * Determine whether this string already exists.
576 	 */
577 	pnbuf->pn_name = name;
578 	if ((pnbuf->pn_hash = hash) == 0)
579 		pnbuf->pn_hash = sgs_str_hash(name);
580 
581 	if ((pnp = avl_find(stravl, pnbuf, &where)) != NULL)
582 		return (pnp->pn_name);
583 
584 	/*
585 	 * Allocate a string buffer if one does not exist, or if there is
586 	 * insufficient space for the new string in any existing buffer.
587 	 */
588 	if ((strbuf == NULL) || (nsize > strsize)) {
589 		strsize = S_ROUND(nsize, syspagsz);
590 
591 		if ((strbuf = dz_map(0, 0, strsize, (PROT_READ | PROT_WRITE),
592 		    MAP_PRIVATE)) == MAP_FAILED)
593 			return (NULL);
594 	}
595 
596 	(void) memcpy(strbuf, name, nsize);
597 	pnp = pnbuf;
598 	pnp->pn_name = strbuf;
599 	avl_insert(stravl, pnp, where);
600 
601 	strbuf += nsize;
602 	strsize -= nsize;
603 	pnbuf++;
604 	pnsize -= sizeof (PathNode);
605 	return (pnp->pn_name);
606 }
607 
608 /*
609  * Prior to calling an object, either via a .plt or through dlsym(), make sure
610  * its .init has fired.  Through topological sorting, ld.so.1 attempts to fire
611  * init's in the correct order, however, this order is typically based on needed
612  * dependencies and non-lazy relocation bindings.  Lazy relocations (.plts) can
613  * still occur and result in bindings that were not captured during topological
614  * sorting.  This routine compensates for this lack of binding information, and
615  * provides for dynamic .init firing.
616  */
617 void
is_dep_init(Rt_map * dlmp,Rt_map * clmp)618 is_dep_init(Rt_map *dlmp, Rt_map *clmp)
619 {
620 	Rt_map	**tobj;
621 
622 	/*
623 	 * If the caller is an auditor, and the destination isn't, then don't
624 	 * run any .inits (see comments in load_completion()).
625 	 */
626 	if ((LIST(clmp)->lm_tflags & LML_TFLG_NOAUDIT) &&
627 	    ((LIST(dlmp)->lm_tflags & LML_TFLG_NOAUDIT) == 0))
628 		return;
629 
630 	if ((dlmp == clmp) || (rtld_flags & RT_FL_INITFIRST))
631 		return;
632 
633 	(void) rt_mutex_lock(&dlmp->rt_lock);
634 	while (dlmp->rt_init_thread != rt_thr_self() && (FLAGS(dlmp) &
635 	    (FLG_RT_RELOCED | FLG_RT_INITCALL | FLG_RT_INITDONE)) ==
636 	    (FLG_RT_RELOCED | FLG_RT_INITCALL)) {
637 		leave(LIST(dlmp), 0);
638 		(void) _lwp_cond_wait(&dlmp->rt_cv, (mutex_t *)&dlmp->rt_lock);
639 		(void) rt_mutex_unlock(&dlmp->rt_lock);
640 		(void) enter(0);
641 		(void) rt_mutex_lock(&dlmp->rt_lock);
642 	}
643 	(void) rt_mutex_unlock(&dlmp->rt_lock);
644 
645 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITDONE)) ==
646 	    (FLG_RT_RELOCED | FLG_RT_INITDONE))
647 		return;
648 
649 	if ((tobj = calloc(2, sizeof (Rt_map *))) != NULL) {
650 		tobj[0] = dlmp;
651 		call_init(tobj, DBG_INIT_DYN);
652 	}
653 }
654 
655 /*
656  * Execute .{preinit|init|fini}array sections
657  */
658 void
call_array(Addr * array,uint_t arraysz,Rt_map * lmp,Word shtype)659 call_array(Addr *array, uint_t arraysz, Rt_map *lmp, Word shtype)
660 {
661 	int	start, stop, incr, ndx;
662 	uint_t	arraycnt = (uint_t)(arraysz / sizeof (Addr));
663 
664 	if (array == NULL)
665 		return;
666 
667 	/*
668 	 * initarray & preinitarray are walked from beginning to end - while
669 	 * finiarray is walked from end to beginning.
670 	 */
671 	if (shtype == SHT_FINI_ARRAY) {
672 		start = arraycnt - 1;
673 		stop = incr = -1;
674 	} else {
675 		start = 0;
676 		stop = arraycnt;
677 		incr = 1;
678 	}
679 
680 	/*
681 	 * Call the .*array[] entries
682 	 */
683 	for (ndx = start; ndx != stop; ndx += incr) {
684 		uint_t	rtldflags;
685 		void	(*fptr)(void) = (void(*)())array[ndx];
686 
687 		DBG_CALL(Dbg_util_call_array(lmp, (void *)fptr, ndx, shtype));
688 
689 		APPLICATION_ENTER(rtldflags);
690 		leave(LIST(lmp), 0);
691 		(*fptr)();
692 		(void) enter(0);
693 		APPLICATION_RETURN(rtldflags);
694 	}
695 }
696 
697 /*
698  * Execute any .init sections.  These are passed to us in an lmp array which
699  * (by default) will have been sorted.
700  */
701 void
call_init(Rt_map ** tobj,int flag)702 call_init(Rt_map **tobj, int flag)
703 {
704 	Rt_map		**_tobj, **_nobj;
705 	static APlist	*pending = NULL;
706 
707 	/*
708 	 * If we're in the middle of an INITFIRST, this must complete before
709 	 * any new init's are fired.  In this case add the object list to the
710 	 * pending queue and return.  We'll pick up the queue after any
711 	 * INITFIRST objects have their init's fired.
712 	 */
713 	if (rtld_flags & RT_FL_INITFIRST) {
714 		(void) aplist_append(&pending, tobj, AL_CNT_PENDING);
715 		return;
716 	}
717 
718 	/*
719 	 * Traverse the tobj array firing each objects init.
720 	 */
721 	for (_tobj = _nobj = tobj, _nobj++; *_tobj != NULL; _tobj++, _nobj++) {
722 		Rt_map	*lmp = *_tobj;
723 		void	(*iptr)() = INIT(lmp);
724 
725 		if (FLAGS(lmp) & FLG_RT_INITCALL)
726 			continue;
727 
728 		FLAGS(lmp) |= FLG_RT_INITCALL;
729 		lmp->rt_init_thread = rt_thr_self();
730 
731 		/*
732 		 * Establish an initfirst state if necessary - no other inits
733 		 * will be fired (because of additional relocation bindings)
734 		 * when in this state.
735 		 */
736 		if (FLAGS(lmp) & FLG_RT_INITFRST)
737 			rtld_flags |= RT_FL_INITFIRST;
738 
739 		if (INITARRAY(lmp) || iptr)
740 			DBG_CALL(Dbg_util_call_init(lmp, flag));
741 
742 		if (iptr) {
743 			uint_t	rtldflags;
744 
745 			APPLICATION_ENTER(rtldflags);
746 			leave(LIST(lmp), 0);
747 			(*iptr)();
748 			(void) enter(0);
749 			APPLICATION_RETURN(rtldflags);
750 		}
751 
752 		call_array(INITARRAY(lmp), INITARRAYSZ(lmp), lmp,
753 		    SHT_INIT_ARRAY);
754 
755 		if (INITARRAY(lmp) || iptr)
756 			DBG_CALL(Dbg_util_call_init(lmp, DBG_INIT_DONE));
757 
758 		/*
759 		 * Set the initdone flag regardless of whether this object
760 		 * actually contains an .init section.  This flag prevents us
761 		 * from processing this section again for an .init and also
762 		 * signifies that a .fini must be called should it exist.
763 		 * Clear the sort field for use in later .fini processing.
764 		 */
765 		(void) rt_mutex_lock(&lmp->rt_lock);
766 		FLAGS(lmp) |= FLG_RT_INITDONE;
767 		lmp->rt_init_thread = (thread_t)0;
768 		(void) _lwp_cond_broadcast(&lmp->rt_cv);
769 		(void) rt_mutex_unlock(&lmp->rt_lock);
770 		SORTVAL(lmp) = -1;
771 
772 		/*
773 		 * If we're firing an INITFIRST object, and other objects must
774 		 * be fired which are not INITFIRST, make sure we grab any
775 		 * pending objects that might have been delayed as this
776 		 * INITFIRST was processed.
777 		 */
778 		if ((rtld_flags & RT_FL_INITFIRST) &&
779 		    ((*_nobj == NULL) || !(FLAGS(*_nobj) & FLG_RT_INITFRST))) {
780 			Aliste	idx;
781 			Rt_map	**pobj;
782 
783 			rtld_flags &= ~RT_FL_INITFIRST;
784 
785 			for (APLIST_TRAVERSE(pending, idx, pobj)) {
786 				aplist_delete(pending, &idx);
787 				call_init(pobj, DBG_INIT_PEND);
788 			}
789 		}
790 	}
791 	free(tobj);
792 }
793 
794 /*
795  * Call .fini sections for the topologically sorted list of objects.  This
796  * routine is called from remove_hdl() for any objects being torn down as part
797  * of a dlclose() operation, and from atexit() processing for all the remaining
798  * objects within the process.
799  */
800 void
call_fini(Lm_list * lml,Rt_map ** tobj,Rt_map * clmp)801 call_fini(Lm_list *lml, Rt_map **tobj, Rt_map *clmp)
802 {
803 	Rt_map **_tobj;
804 
805 	for (_tobj = tobj; *_tobj != NULL; _tobj++) {
806 		Rt_map		*lmp = *_tobj;
807 
808 		/*
809 		 * Only fire a .fini if the objects corresponding .init has
810 		 * completed.  We collect all .fini sections of objects that
811 		 * had their .init collected, but that doesn't mean that at
812 		 * the time of collection, that the .init had completed.
813 		 */
814 		if (FLAGS(lmp) & FLG_RT_INITDONE) {
815 			void	(*fptr)(void) = FINI(lmp);
816 
817 			if (FINIARRAY(lmp) || fptr)
818 				DBG_CALL(Dbg_util_call_fini(lmp));
819 
820 			call_array(FINIARRAY(lmp), FINIARRAYSZ(lmp), lmp,
821 			    SHT_FINI_ARRAY);
822 
823 			if (fptr) {
824 				uint_t	rtldflags;
825 
826 				APPLICATION_ENTER(rtldflags);
827 				leave(lml, 0);
828 				(*fptr)();
829 				(void) enter(0);
830 				APPLICATION_RETURN(rtldflags);
831 			}
832 		}
833 
834 		/*
835 		 * Skip main, this is explicitly called last in atexit_fini().
836 		 */
837 		if (FLAGS(lmp) & FLG_RT_ISMAIN)
838 			continue;
839 
840 		/*
841 		 * This object has exercised its last instructions (regardless
842 		 * of whether it will be unmapped or not).  Audit this closure.
843 		 */
844 		if ((lml->lm_tflags & LML_TFLG_NOAUDIT) == 0)
845 			audit_objclose(lmp, clmp);
846 	}
847 
848 	DBG_CALL(Dbg_bind_plt_summary(lml, M_MACH, pltcnt21d, pltcnt24d,
849 	    pltcntu32, pltcntu44, pltcntfull, pltcntfar));
850 
851 	free(tobj);
852 }
853 
854 /*
855  * Function called by atexit(3C).  Calls all .fini sections within the objects
856  * that make up the process.  As .fini processing is the last opportunity for
857  * any new bindings to be established, this is also a convenient location to
858  * check for unused objects.
859  */
860 void
atexit_fini()861 atexit_fini()
862 {
863 	Rt_map	**tobj, *lmp;
864 	Lm_list	*lml;
865 	Aliste	idx;
866 
867 	(void) enter(0);
868 
869 	rtld_flags |= RT_FL_ATEXIT;
870 
871 	lml = &lml_main;
872 	lml->lm_flags |= LML_FLG_ATEXIT;
873 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
874 	lmp = (Rt_map *)lml->lm_head;
875 
876 	/*
877 	 * Reverse topologically sort the main link-map for .fini execution.
878 	 */
879 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
880 	    (tobj != (Rt_map **)S_ERROR))
881 		call_fini(lml, tobj, NULL);
882 
883 	/*
884 	 * Now that all .fini code has been run, see what unreferenced objects
885 	 * remain.
886 	 */
887 	unused(lml);
888 
889 	/*
890 	 * Traverse any alternative link-map lists, looking for non-auditors.
891 	 */
892 	for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
893 		/*
894 		 * Ignore the base-link-map list, which has already been
895 		 * processed, the runtime linkers link-map list, which is
896 		 * processed last, and any auditors.
897 		 */
898 		if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) ||
899 		    (lml->lm_tflags & LML_TFLG_AUD_MASK) ||
900 		    ((lmp = (Rt_map *)lml->lm_head) == NULL))
901 			continue;
902 
903 		lml->lm_flags |= LML_FLG_ATEXIT;
904 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
905 
906 		/*
907 		 * Reverse topologically sort the link-map for .fini execution.
908 		 */
909 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
910 		    (tobj != (Rt_map **)S_ERROR))
911 			call_fini(lml, tobj, NULL);
912 
913 		unused(lml);
914 	}
915 
916 	/*
917 	 * Add an explicit close to main and ld.so.1.  Although main's .fini is
918 	 * collected in call_fini() to provide for FINITARRAY processing, its
919 	 * audit_objclose is explicitly skipped.  This provides for it to be
920 	 * called last, here.  This is the reverse of the explicit calls to
921 	 * audit_objopen() made in setup().
922 	 */
923 	lml = &lml_main;
924 	lmp = (Rt_map *)lml->lm_head;
925 
926 	if ((lml->lm_tflags | AFLAGS(lmp)) & LML_TFLG_AUD_MASK) {
927 		audit_objclose((Rt_map *)lml_rtld.lm_head, lmp);
928 		audit_objclose(lmp, lmp);
929 	}
930 
931 	/*
932 	 * Traverse any alternative link-map lists, looking for non-auditors.
933 	 */
934 	for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
935 		/*
936 		 * Ignore the base-link-map list, which has already been
937 		 * processed, the runtime linkers link-map list, which is
938 		 * processed last, and any non-auditors.
939 		 */
940 		if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) ||
941 		    ((lml->lm_tflags & LML_TFLG_AUD_MASK) == 0) ||
942 		    ((lmp = (Rt_map *)lml->lm_head) == NULL))
943 			continue;
944 
945 		lml->lm_flags |= LML_FLG_ATEXIT;
946 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
947 
948 		/*
949 		 * Reverse topologically sort the link-map for .fini execution.
950 		 */
951 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
952 		    (tobj != (Rt_map **)S_ERROR))
953 			call_fini(lml, tobj, NULL);
954 
955 		unused(lml);
956 	}
957 
958 	/*
959 	 * Finally reverse topologically sort the runtime linkers link-map for
960 	 * .fini execution.
961 	 */
962 	lml = &lml_rtld;
963 	lml->lm_flags |= LML_FLG_ATEXIT;
964 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
965 	lmp = (Rt_map *)lml->lm_head;
966 
967 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
968 	    (tobj != (Rt_map **)S_ERROR))
969 		call_fini(lml, tobj, NULL);
970 
971 	leave(&lml_main, 0);
972 }
973 
974 /*
975  * This routine is called to complete any runtime linker activity which may have
976  * resulted in objects being loaded.  This is called from all user entry points
977  * and from any internal dl*() requests.
978  */
979 void
load_completion(Rt_map * nlmp)980 load_completion(Rt_map *nlmp)
981 {
982 	Rt_map	**tobj = NULL;
983 	Lm_list	*nlml;
984 
985 	/*
986 	 * Establish any .init processing.  Note, in a world of lazy loading,
987 	 * objects may have been loaded regardless of whether the users request
988 	 * was fulfilled (i.e., a dlsym() request may have failed to find a
989 	 * symbol but objects might have been loaded during its search).  Thus,
990 	 * any tsorting starts from the nlmp (new link-maps) pointer and not
991 	 * necessarily from the link-map that may have satisfied the request.
992 	 *
993 	 * Note, the primary link-map has an initialization phase where dynamic
994 	 * .init firing is suppressed.  This provides for a simple and clean
995 	 * handshake with the primary link-maps libc, which is important for
996 	 * establishing uberdata.  In addition, auditors often obtain handles
997 	 * to primary link-map objects as the objects are loaded, so as to
998 	 * inspect the link-map for symbols.  This inspection is allowed without
999 	 * running any code on the primary link-map, as running this code may
1000 	 * reenter the auditor, who may not yet have finished its own
1001 	 * initialization.
1002 	 */
1003 	if (nlmp)
1004 		nlml = LIST(nlmp);
1005 
1006 	if (nlmp && nlml->lm_init && ((nlml != &lml_main) ||
1007 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
1008 		if ((tobj = tsort(nlmp, nlml->lm_init,
1009 		    RT_SORT_REV)) == (Rt_map **)S_ERROR)
1010 			tobj = NULL;
1011 	}
1012 
1013 	/*
1014 	 * Make sure any alternative link-map retrieves any external interfaces
1015 	 * and initializes threads.
1016 	 */
1017 	if (nlmp && (nlml != &lml_main)) {
1018 		(void) rt_get_extern(nlml, nlmp);
1019 		rt_thr_init(nlml);
1020 	}
1021 
1022 	/*
1023 	 * Traverse the list of new link-maps and register any dynamic TLS.
1024 	 * This storage is established for any objects not on the primary
1025 	 * link-map, and for any objects added to the primary link-map after
1026 	 * static TLS has been registered.
1027 	 */
1028 	if (nlmp && nlml->lm_tls && ((nlml != &lml_main) ||
1029 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
1030 		Rt_map	*lmp;
1031 
1032 		for (lmp = nlmp; lmp; lmp = NEXT_RT_MAP(lmp)) {
1033 			if (PTTLS(lmp) && PTTLS(lmp)->p_memsz)
1034 				tls_modaddrem(lmp, TM_FLG_MODADD);
1035 		}
1036 		nlml->lm_tls = 0;
1037 	}
1038 
1039 	/*
1040 	 * Fire any .init's.
1041 	 */
1042 	if (tobj)
1043 		call_init(tobj, DBG_INIT_SORT);
1044 }
1045 
1046 /*
1047  * Append an item to the specified link map control list.
1048  */
1049 void
lm_append(Lm_list * lml,Aliste lmco,Rt_map * lmp)1050 lm_append(Lm_list *lml, Aliste lmco, Rt_map *lmp)
1051 {
1052 	Lm_cntl	*lmc;
1053 	int	add = 1;
1054 
1055 	/*
1056 	 * Indicate that this link-map list has a new object.
1057 	 */
1058 	(lml->lm_obj)++;
1059 
1060 	/*
1061 	 * If we're about to add a new object to the main link-map control
1062 	 * list, alert the debuggers.  Additions of individual objects to the
1063 	 * main link-map control list occur during initial setup as the
1064 	 * applications immediate dependencies are loaded.  Additional objects
1065 	 * are loaded on the main link-map control list after they have been
1066 	 * fully initialized on an alternative link-map control list.  See
1067 	 * lm_move().
1068 	 */
1069 	if (lmco == ALIST_OFF_DATA)
1070 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1071 
1072 	/* LINTED */
1073 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, lmco);
1074 
1075 	/*
1076 	 * A link-map list header points to one of more link-map control lists
1077 	 * (see include/rtld.h).  The initial list, pointed to by lm_cntl, is
1078 	 * the list of relocated objects.  Other lists maintain objects that
1079 	 * are still being analyzed or relocated.  This list provides the core
1080 	 * link-map list information used by all ld.so.1 routines.
1081 	 */
1082 	if (lmc->lc_head == NULL) {
1083 		/*
1084 		 * If this is the first link-map for the given control list,
1085 		 * initialize the list.
1086 		 */
1087 		lmc->lc_head = lmc->lc_tail = lmp;
1088 		add = 0;
1089 
1090 	} else if (FLAGS(lmp) & FLG_RT_OBJINTPO) {
1091 		Rt_map	*tlmp;
1092 
1093 		/*
1094 		 * If this is an interposer then append the link-map following
1095 		 * any other interposers (these are objects that have been
1096 		 * previously preloaded, or were identified with -z interpose).
1097 		 * Interposers can only be inserted on the first link-map
1098 		 * control list, as once relocation has started, interposition
1099 		 * from new interposers can't be guaranteed.
1100 		 *
1101 		 * NOTE: We do not interpose on the head of a list.  This model
1102 		 * evolved because dynamic executables have already been fully
1103 		 * relocated within themselves and thus can't be interposed on.
1104 		 * Nowadays it's possible to have shared objects at the head of
1105 		 * a list, which conceptually means they could be interposed on.
1106 		 * But, shared objects can be created via dldump() and may only
1107 		 * be partially relocated (just relatives), in which case they
1108 		 * are interposable, but are marked as fixed (ET_EXEC).
1109 		 *
1110 		 * Thus we really don't have a clear method of deciding when the
1111 		 * head of a link-map is interposable.  So, to be consistent,
1112 		 * for now only add interposers after the link-map lists head
1113 		 * object.
1114 		 */
1115 		for (tlmp = NEXT_RT_MAP(lmc->lc_head); tlmp;
1116 		    tlmp = NEXT_RT_MAP(tlmp)) {
1117 
1118 			if (FLAGS(tlmp) & FLG_RT_OBJINTPO)
1119 				continue;
1120 
1121 			/*
1122 			 * Insert the new link-map before this non-interposer,
1123 			 * and indicate an interposer is found.
1124 			 */
1125 			NEXT(PREV_RT_MAP(tlmp)) = (Link_map *)lmp;
1126 			PREV(lmp) = PREV(tlmp);
1127 
1128 			NEXT(lmp) = (Link_map *)tlmp;
1129 			PREV(tlmp) = (Link_map *)lmp;
1130 
1131 			lmc->lc_flags |= LMC_FLG_REANALYZE;
1132 			add = 0;
1133 			break;
1134 		}
1135 	}
1136 
1137 	/*
1138 	 * Fall through to appending the new link map to the tail of the list.
1139 	 * If we're processing the initial objects of this link-map list, add
1140 	 * them to the backward compatibility list.
1141 	 */
1142 	if (add) {
1143 		NEXT(lmc->lc_tail) = (Link_map *)lmp;
1144 		PREV(lmp) = (Link_map *)lmc->lc_tail;
1145 		lmc->lc_tail = lmp;
1146 	}
1147 
1148 	/*
1149 	 * Having added this link-map to a control list, indicate which control
1150 	 * list the link-map belongs to.  Note, control list information is
1151 	 * always maintained as an offset, as the Alist can be reallocated.
1152 	 */
1153 	CNTL(lmp) = lmco;
1154 
1155 	/*
1156 	 * Indicate if an interposer is found.  Note that the first object on a
1157 	 * link-map can be explicitly defined as an interposer so that it can
1158 	 * provide interposition over direct binding requests.
1159 	 */
1160 	if (FLAGS(lmp) & MSK_RT_INTPOSE)
1161 		lml->lm_flags |= LML_FLG_INTRPOSE;
1162 
1163 	/*
1164 	 * For backward compatibility with debuggers, the link-map list contains
1165 	 * pointers to the main control list.
1166 	 */
1167 	if (lmco == ALIST_OFF_DATA) {
1168 		lml->lm_head = lmc->lc_head;
1169 		lml->lm_tail = lmc->lc_tail;
1170 	}
1171 }
1172 
1173 /*
1174  * Delete an item from the specified link map control list.
1175  */
1176 void
lm_delete(Lm_list * lml,Rt_map * lmp,Rt_map * clmp)1177 lm_delete(Lm_list *lml, Rt_map *lmp, Rt_map *clmp)
1178 {
1179 	Lm_cntl	*lmc;
1180 
1181 	/*
1182 	 * If the control list pointer hasn't been initialized, this object
1183 	 * never got added to a link-map list.
1184 	 */
1185 	if (CNTL(lmp) == 0)
1186 		return;
1187 
1188 	/*
1189 	 * If we're about to delete an object from the main link-map control
1190 	 * list, alert the debuggers.
1191 	 */
1192 	if (CNTL(lmp) == ALIST_OFF_DATA)
1193 		rd_event(lml, RD_DLACTIVITY, RT_DELETE);
1194 
1195 	/*
1196 	 * If we're being audited tell the audit library that we're
1197 	 * about to go deleting dependencies.
1198 	 */
1199 	if (clmp && (aud_activity ||
1200 	    ((LIST(clmp)->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_ACTIVITY)))
1201 		audit_activity(clmp, LA_ACT_DELETE);
1202 
1203 	/* LINTED */
1204 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, CNTL(lmp));
1205 
1206 	if (lmc->lc_head == lmp)
1207 		lmc->lc_head = NEXT_RT_MAP(lmp);
1208 	else
1209 		NEXT(PREV_RT_MAP(lmp)) = (void *)NEXT(lmp);
1210 
1211 	if (lmc->lc_tail == lmp)
1212 		lmc->lc_tail = PREV_RT_MAP(lmp);
1213 	else
1214 		PREV(NEXT_RT_MAP(lmp)) = PREV(lmp);
1215 
1216 	/*
1217 	 * For backward compatibility with debuggers, the link-map list contains
1218 	 * pointers to the main control list.
1219 	 */
1220 	if (lmc == (Lm_cntl *)&lml->lm_lists->al_data) {
1221 		lml->lm_head = lmc->lc_head;
1222 		lml->lm_tail = lmc->lc_tail;
1223 	}
1224 
1225 	/*
1226 	 * Indicate we have one less object on this control list.
1227 	 */
1228 	(lml->lm_obj)--;
1229 }
1230 
1231 /*
1232  * Move a link-map control list to another.  Objects that are being relocated
1233  * are maintained on secondary control lists.  Once their relocation is
1234  * complete, the entire list is appended to the previous control list, as this
1235  * list must have been the trigger for generating the new control list.
1236  */
1237 void
lm_move(Lm_list * lml,Aliste nlmco,Aliste plmco,Lm_cntl * nlmc,Lm_cntl * plmc)1238 lm_move(Lm_list *lml, Aliste nlmco, Aliste plmco, Lm_cntl *nlmc, Lm_cntl *plmc)
1239 {
1240 	Rt_map	*lmp;
1241 
1242 	/*
1243 	 * If we're about to add a new family of objects to the main link-map
1244 	 * control list, alert the debuggers.  Additions of object families to
1245 	 * the main link-map control list occur during lazy loading, filtering
1246 	 * and dlopen().
1247 	 */
1248 	if (plmco == ALIST_OFF_DATA)
1249 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1250 
1251 	DBG_CALL(Dbg_file_cntl(lml, nlmco, plmco));
1252 
1253 	/*
1254 	 * Indicate each new link-map has been moved to the previous link-map
1255 	 * control list.
1256 	 */
1257 	for (lmp = nlmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
1258 		CNTL(lmp) = plmco;
1259 
1260 		/*
1261 		 * If these objects are being added to the main link-map
1262 		 * control list, indicate that there are init's available
1263 		 * for harvesting.
1264 		 */
1265 		if (plmco == ALIST_OFF_DATA) {
1266 			lml->lm_init++;
1267 			lml->lm_flags |= LML_FLG_OBJADDED;
1268 		}
1269 	}
1270 
1271 	/*
1272 	 * Move the new link-map control list, to the callers link-map control
1273 	 * list.
1274 	 */
1275 	if (plmc->lc_head == NULL) {
1276 		plmc->lc_head = nlmc->lc_head;
1277 		PREV(nlmc->lc_head) = NULL;
1278 	} else {
1279 		NEXT(plmc->lc_tail) = (Link_map *)nlmc->lc_head;
1280 		PREV(nlmc->lc_head) = (Link_map *)plmc->lc_tail;
1281 	}
1282 
1283 	plmc->lc_tail = nlmc->lc_tail;
1284 	nlmc->lc_head = nlmc->lc_tail = NULL;
1285 
1286 	/*
1287 	 * For backward compatibility with debuggers, the link-map list contains
1288 	 * pointers to the main control list.
1289 	 */
1290 	if (plmco == ALIST_OFF_DATA) {
1291 		lml->lm_head = plmc->lc_head;
1292 		lml->lm_tail = plmc->lc_tail;
1293 	}
1294 }
1295 
1296 /*
1297  * Create, or assign a link-map control list.  Each link-map list contains a
1298  * main control list, which has an Alist offset of ALIST_OFF_DATA (see the
1299  * description in include/rtld.h).  During the initial construction of a
1300  * process, objects are added to this main control list.  This control list is
1301  * never deleted, unless an alternate link-map list has been requested (say for
1302  * auditors), and the associated objects could not be loaded or relocated.
1303  *
1304  * Once relocation has started, any lazy loadable objects, or filtees, are
1305  * processed on a new, temporary control list.  Only when these objects have
1306  * been fully relocated, are they moved to the main link-map control list.
1307  * Once the objects are moved, this temporary control list is deleted (see
1308  * remove_cntl()).
1309  *
1310  * A dlopen() always requires a new temporary link-map control list.
1311  * Typically, a dlopen() occurs on a link-map list that had already started
1312  * relocation, however, auditors can dlopen() objects on the main link-map
1313  * list while under initial construction, before any relocation has begun.
1314  * Hence, dlopen() requests are explicitly flagged.
1315  */
1316 Aliste
create_cntl(Lm_list * lml,int dlopen)1317 create_cntl(Lm_list *lml, int dlopen)
1318 {
1319 	/*
1320 	 * If the head link-map object has already been relocated, create a
1321 	 * new, temporary, control list.
1322 	 */
1323 	if (dlopen || (lml->lm_head == NULL) ||
1324 	    (FLAGS(lml->lm_head) & FLG_RT_RELOCED)) {
1325 		Lm_cntl *lmc;
1326 
1327 		if ((lmc = alist_append(&lml->lm_lists, NULL, sizeof (Lm_cntl),
1328 		    AL_CNT_LMLISTS)) == NULL)
1329 			return (0);
1330 
1331 		return ((Aliste)((char *)lmc - (char *)lml->lm_lists));
1332 	}
1333 
1334 	return (ALIST_OFF_DATA);
1335 }
1336 
1337 /*
1338  * Environment variables can have a variety of defined permutations, and thus
1339  * the following infrastructure exists to allow this variety and to select the
1340  * required definition.
1341  *
1342  * Environment variables can be defined as 32- or 64-bit specific, and if so
1343  * they will take precedence over any instruction set neutral form.  Typically
1344  * this is only useful when the environment value is an informational string.
1345  *
1346  * Environment variables may be obtained from the standard user environment or
1347  * from a configuration file.  The latter provides a fallback if no user
1348  * environment setting is found, and can take two forms:
1349  *
1350  *  -	a replaceable definition - this will be used if no user environment
1351  *	setting has been seen, or
1352  *
1353  *  -	an permanent definition - this will be used no matter what user
1354  *	environment setting is seen.  In the case of list variables it will be
1355  *	appended to any process environment setting seen.
1356  *
1357  * Environment variables can be defined without a value (ie. LD_XXXX=) so as to
1358  * override any replaceable environment variables from a configuration file.
1359  */
1360 static	u_longlong_t		rplgen = 0;	/* replaceable generic */
1361 						/*	variables */
1362 static	u_longlong_t		rplisa = 0;	/* replaceable ISA specific */
1363 						/*	variables */
1364 static	u_longlong_t		prmgen = 0;	/* permanent generic */
1365 						/*	variables */
1366 static	u_longlong_t		prmisa = 0;	/* permanent ISA specific */
1367 						/*	variables */
1368 static	u_longlong_t		cmdgen = 0;	/* command line (-e) generic */
1369 						/*	variables */
1370 static	u_longlong_t		cmdisa = 0;	/* command line (-e) ISA */
1371 						/*	specific variables */
1372 
1373 /*
1374  * Classify an environment variables type.
1375  */
1376 #define	ENV_TYP_IGNORE		0x01		/* ignore - variable is for */
1377 						/*	the wrong ISA */
1378 #define	ENV_TYP_ISA		0x02		/* variable is ISA specific */
1379 #define	ENV_TYP_CONFIG		0x04		/* variable obtained from a */
1380 						/*	config file */
1381 #define	ENV_TYP_PERMANT		0x08		/* variable is permanent */
1382 #define	ENV_TYP_CMDLINE		0x10		/* variable provide with -e */
1383 #define	ENV_TYP_NULL		0x20		/* variable is null */
1384 
1385 /*
1386  * Identify all environment variables.
1387  */
1388 #define	ENV_FLG_AUDIT		0x0000000000001ULL
1389 #define	ENV_FLG_AUDIT_ARGS	0x0000000000002ULL
1390 #define	ENV_FLG_BIND_NOW	0x0000000000004ULL
1391 #define	ENV_FLG_BIND_NOT	0x0000000000008ULL
1392 #define	ENV_FLG_BINDINGS	0x0000000000010ULL
1393 #define	ENV_FLG_CONFGEN		0x0000000000020ULL
1394 #define	ENV_FLG_CONFIG		0x0000000000040ULL
1395 #define	ENV_FLG_DEBUG		0x0000000000080ULL
1396 #define	ENV_FLG_DEBUG_OUTPUT	0x0000000000100ULL
1397 #define	ENV_FLG_DEMANGLE	0x0000000000200ULL
1398 #define	ENV_FLG_FLAGS		0x0000000000400ULL
1399 #define	ENV_FLG_INIT		0x0000000000800ULL
1400 #define	ENV_FLG_LIBPATH		0x0000000001000ULL
1401 #define	ENV_FLG_LOADAVAIL	0x0000000002000ULL
1402 #define	ENV_FLG_LOADFLTR	0x0000000004000ULL
1403 #define	ENV_FLG_NOAUDIT		0x0000000008000ULL
1404 #define	ENV_FLG_NOAUXFLTR	0x0000000010000ULL
1405 #define	ENV_FLG_NOBAPLT		0x0000000020000ULL
1406 #define	ENV_FLG_NOCONFIG	0x0000000040000ULL
1407 #define	ENV_FLG_NODIRCONFIG	0x0000000080000ULL
1408 #define	ENV_FLG_NODIRECT	0x0000000100000ULL
1409 #define	ENV_FLG_NOENVCONFIG	0x0000000200000ULL
1410 #define	ENV_FLG_NOLAZY		0x0000000400000ULL
1411 #define	ENV_FLG_NOOBJALTER	0x0000000800000ULL
1412 #define	ENV_FLG_NOVERSION	0x0000001000000ULL
1413 #define	ENV_FLG_PRELOAD		0x0000002000000ULL
1414 #define	ENV_FLG_PROFILE		0x0000004000000ULL
1415 #define	ENV_FLG_PROFILE_OUTPUT	0x0000008000000ULL
1416 #define	ENV_FLG_SIGNAL		0x0000010000000ULL
1417 #define	ENV_FLG_TRACE_OBJS	0x0000020000000ULL
1418 #define	ENV_FLG_TRACE_PTHS	0x0000040000000ULL
1419 #define	ENV_FLG_UNREF		0x0000080000000ULL
1420 #define	ENV_FLG_UNUSED		0x0000100000000ULL
1421 #define	ENV_FLG_VERBOSE		0x0000200000000ULL
1422 #define	ENV_FLG_WARN		0x0000400000000ULL
1423 #define	ENV_FLG_NOFLTCONFIG	0x0000800000000ULL
1424 #define	ENV_FLG_BIND_LAZY	0x0001000000000ULL
1425 #define	ENV_FLG_NOUNRESWEAK	0x0002000000000ULL
1426 #define	ENV_FLG_NOPAREXT	0x0004000000000ULL
1427 #define	ENV_FLG_HWCAP		0x0008000000000ULL
1428 #define	ENV_FLG_SFCAP		0x0010000000000ULL
1429 #define	ENV_FLG_MACHCAP		0x0020000000000ULL
1430 #define	ENV_FLG_PLATCAP		0x0040000000000ULL
1431 #define	ENV_FLG_CAP_FILES	0x0080000000000ULL
1432 #define	ENV_FLG_DEFERRED	0x0100000000000ULL
1433 #define	ENV_FLG_NOENVIRON	0x0200000000000ULL
1434 
1435 #define	SEL_REPLACE		0x0001
1436 #define	SEL_PERMANT		0x0002
1437 #define	SEL_ACT_RT		0x0100	/* setting rtld_flags */
1438 #define	SEL_ACT_RT2		0x0200	/* setting rtld_flags2 */
1439 #define	SEL_ACT_STR		0x0400	/* setting string value */
1440 #define	SEL_ACT_LML		0x0800	/* setting lml_flags */
1441 #define	SEL_ACT_LMLT		0x1000	/* setting lml_tflags */
1442 #define	SEL_ACT_SPEC_1		0x2000	/* for FLG_{FLAGS, LIBPATH} */
1443 #define	SEL_ACT_SPEC_2		0x4000	/* need special handling */
1444 
1445 /*
1446  * Pattern match an LD_XXXX environment variable.  s1 points to the XXXX part
1447  * and len specifies its length (comparing a strings length before the string
1448  * itself speed things up).  s2 points to the token itself which has already
1449  * had any leading white-space removed.
1450  */
1451 static void
ld_generic_env(const char * s1,size_t len,const char * s2,Word * lmflags,Word * lmtflags,uint_t env_flags)1452 ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
1453     Word *lmtflags, uint_t env_flags)
1454 {
1455 	u_longlong_t	variable = 0;
1456 	ushort_t	select = 0;
1457 	const char	**str;
1458 	Word		val = 0;
1459 
1460 	/*
1461 	 * Determine whether we're dealing with a replaceable or permanent
1462 	 * string.
1463 	 */
1464 	if (env_flags & ENV_TYP_PERMANT) {
1465 		/*
1466 		 * If the string is from a configuration file and defined as
1467 		 * permanent, assign it as permanent.
1468 		 */
1469 		select |= SEL_PERMANT;
1470 	} else
1471 		select |= SEL_REPLACE;
1472 
1473 	/*
1474 	 * Parse the variable given.
1475 	 *
1476 	 * The LD_AUDIT family.
1477 	 */
1478 	if (*s1 == 'A') {
1479 		if ((len == MSG_LD_AUDIT_SIZE) && (strncmp(s1,
1480 		    MSG_ORIG(MSG_LD_AUDIT), MSG_LD_AUDIT_SIZE) == 0)) {
1481 			/*
1482 			 * Replaceable and permanent audit objects can exist.
1483 			 */
1484 			select |= SEL_ACT_STR;
1485 			str = (select & SEL_REPLACE) ? &rpl_audit : &prm_audit;
1486 			variable = ENV_FLG_AUDIT;
1487 		} else if ((len == MSG_LD_AUDIT_ARGS_SIZE) &&
1488 		    (strncmp(s1, MSG_ORIG(MSG_LD_AUDIT_ARGS),
1489 		    MSG_LD_AUDIT_ARGS_SIZE) == 0)) {
1490 			/*
1491 			 * A specialized variable for plt_exit() use, not
1492 			 * documented for general use.
1493 			 */
1494 			select |= SEL_ACT_SPEC_2;
1495 			variable = ENV_FLG_AUDIT_ARGS;
1496 		}
1497 	}
1498 	/*
1499 	 * The LD_BIND family.
1500 	 */
1501 	else if (*s1 == 'B') {
1502 		if ((len == MSG_LD_BIND_LAZY_SIZE) && (strncmp(s1,
1503 		    MSG_ORIG(MSG_LD_BIND_LAZY),
1504 		    MSG_LD_BIND_LAZY_SIZE) == 0)) {
1505 			select |= SEL_ACT_RT2;
1506 			val = RT_FL2_BINDLAZY;
1507 			variable = ENV_FLG_BIND_LAZY;
1508 		} else if ((len == MSG_LD_BIND_NOW_SIZE) && (strncmp(s1,
1509 		    MSG_ORIG(MSG_LD_BIND_NOW), MSG_LD_BIND_NOW_SIZE) == 0)) {
1510 			select |= SEL_ACT_RT2;
1511 			val = RT_FL2_BINDNOW;
1512 			variable = ENV_FLG_BIND_NOW;
1513 		} else if ((len == MSG_LD_BIND_NOT_SIZE) && (strncmp(s1,
1514 		    MSG_ORIG(MSG_LD_BIND_NOT), MSG_LD_BIND_NOT_SIZE) == 0)) {
1515 			/*
1516 			 * Another trick, initially implemented to help debug
1517 			 * a.out executables under SunOS 4 binary
1518 			 * compatibility (now removed), not documented for
1519 			 * general use, but still useful for debugging around
1520 			 * the PLT, etc.
1521 			 */
1522 			select |= SEL_ACT_RT;
1523 			val = RT_FL_NOBIND;
1524 			variable = ENV_FLG_BIND_NOT;
1525 		} else if ((len == MSG_LD_BINDINGS_SIZE) && (strncmp(s1,
1526 		    MSG_ORIG(MSG_LD_BINDINGS), MSG_LD_BINDINGS_SIZE) == 0)) {
1527 			/*
1528 			 * This variable is simply for backward compatibility.
1529 			 * If this and LD_DEBUG are both specified, only one of
1530 			 * the strings is going to get processed.
1531 			 */
1532 			select |= SEL_ACT_SPEC_2;
1533 			variable = ENV_FLG_BINDINGS;
1534 		}
1535 	}
1536 	/*
1537 	 * LD_CAP_FILES and LD_CONFIG family.
1538 	 */
1539 	else if (*s1 == 'C') {
1540 		if ((len == MSG_LD_CAP_FILES_SIZE) && (strncmp(s1,
1541 		    MSG_ORIG(MSG_LD_CAP_FILES), MSG_LD_CAP_FILES_SIZE) == 0)) {
1542 			select |= SEL_ACT_STR;
1543 			str = (select & SEL_REPLACE) ?
1544 			    &rpl_cap_files : &prm_cap_files;
1545 			variable = ENV_FLG_CAP_FILES;
1546 		} else if ((len == MSG_LD_CONFGEN_SIZE) && (strncmp(s1,
1547 		    MSG_ORIG(MSG_LD_CONFGEN), MSG_LD_CONFGEN_SIZE) == 0)) {
1548 			/*
1549 			 * This variable is not documented for general use.
1550 			 * Although originaly designed for internal use with
1551 			 * crle(1), this variable is in use by the Studio
1552 			 * auditing tools.  Hence, it can't be removed.
1553 			 */
1554 			select |= SEL_ACT_SPEC_2;
1555 			variable = ENV_FLG_CONFGEN;
1556 		} else if ((len == MSG_LD_CONFIG_SIZE) && (strncmp(s1,
1557 		    MSG_ORIG(MSG_LD_CONFIG), MSG_LD_CONFIG_SIZE) == 0)) {
1558 			/*
1559 			 * Secure applications must use a default configuration
1560 			 * file.  A setting from a configuration file doesn't
1561 			 * make sense (given we must be reading a configuration
1562 			 * file to have gotten this).
1563 			 */
1564 			if ((rtld_flags & RT_FL_SECURE) ||
1565 			    (env_flags & ENV_TYP_CONFIG))
1566 				return;
1567 			select |= SEL_ACT_STR;
1568 			str = &config->c_name;
1569 			variable = ENV_FLG_CONFIG;
1570 		}
1571 	}
1572 	/*
1573 	 * The LD_DEBUG family, LD_DEFERRED (internal, used by ldd(1)), and
1574 	 * LD_DEMANGLE.
1575 	 */
1576 	else if (*s1 == 'D') {
1577 		if ((len == MSG_LD_DEBUG_SIZE) && (strncmp(s1,
1578 		    MSG_ORIG(MSG_LD_DEBUG), MSG_LD_DEBUG_SIZE) == 0)) {
1579 			select |= SEL_ACT_STR;
1580 			str = (select & SEL_REPLACE) ? &rpl_debug : &prm_debug;
1581 			variable = ENV_FLG_DEBUG;
1582 		} else if ((len == MSG_LD_DEBUG_OUTPUT_SIZE) && (strncmp(s1,
1583 		    MSG_ORIG(MSG_LD_DEBUG_OUTPUT),
1584 		    MSG_LD_DEBUG_OUTPUT_SIZE) == 0)) {
1585 			select |= SEL_ACT_STR;
1586 			str = &dbg_file;
1587 			variable = ENV_FLG_DEBUG_OUTPUT;
1588 		} else if ((len == MSG_LD_DEFERRED_SIZE) && (strncmp(s1,
1589 		    MSG_ORIG(MSG_LD_DEFERRED), MSG_LD_DEFERRED_SIZE) == 0)) {
1590 			select |= SEL_ACT_RT;
1591 			val = RT_FL_DEFERRED;
1592 			variable = ENV_FLG_DEFERRED;
1593 		} else if ((len == MSG_LD_DEMANGLE_SIZE) && (strncmp(s1,
1594 		    MSG_ORIG(MSG_LD_DEMANGLE), MSG_LD_DEMANGLE_SIZE) == 0)) {
1595 			select |= SEL_ACT_RT;
1596 			val = RT_FL_DEMANGLE;
1597 			variable = ENV_FLG_DEMANGLE;
1598 		}
1599 	}
1600 	/*
1601 	 * LD_FLAGS - collect the best variable definition.  On completion of
1602 	 * environment variable processing pass the result to ld_flags_env()
1603 	 * where they'll be decomposed and passed back to this routine.
1604 	 */
1605 	else if (*s1 == 'F') {
1606 		if ((len == MSG_LD_FLAGS_SIZE) && (strncmp(s1,
1607 		    MSG_ORIG(MSG_LD_FLAGS), MSG_LD_FLAGS_SIZE) == 0)) {
1608 			select |= SEL_ACT_SPEC_1;
1609 			str = (select & SEL_REPLACE) ? &rpl_ldflags :
1610 			    &prm_ldflags;
1611 			variable = ENV_FLG_FLAGS;
1612 		}
1613 	}
1614 	/*
1615 	 * LD_HWCAP.
1616 	 */
1617 	else if (*s1 == 'H') {
1618 		if ((len == MSG_LD_HWCAP_SIZE) && (strncmp(s1,
1619 		    MSG_ORIG(MSG_LD_HWCAP), MSG_LD_HWCAP_SIZE) == 0)) {
1620 			select |= SEL_ACT_STR;
1621 			str = (select & SEL_REPLACE) ?
1622 			    &rpl_hwcap : &prm_hwcap;
1623 			variable = ENV_FLG_HWCAP;
1624 		}
1625 	}
1626 	/*
1627 	 * LD_INIT (internal, used by ldd(1)).
1628 	 */
1629 	else if (*s1 == 'I') {
1630 		if ((len == MSG_LD_INIT_SIZE) && (strncmp(s1,
1631 		    MSG_ORIG(MSG_LD_INIT), MSG_LD_INIT_SIZE) == 0)) {
1632 			select |= SEL_ACT_LML;
1633 			val = LML_FLG_TRC_INIT;
1634 			variable = ENV_FLG_INIT;
1635 		}
1636 	}
1637 	/*
1638 	 * The LD_LIBRARY_PATH and LD_LOAD families.
1639 	 */
1640 	else if (*s1 == 'L') {
1641 		if ((len == MSG_LD_LIBPATH_SIZE) && (strncmp(s1,
1642 		    MSG_ORIG(MSG_LD_LIBPATH), MSG_LD_LIBPATH_SIZE) == 0)) {
1643 			select |= SEL_ACT_SPEC_1;
1644 			str = (select & SEL_REPLACE) ? &rpl_libpath :
1645 			    &prm_libpath;
1646 			variable = ENV_FLG_LIBPATH;
1647 		} else if ((len == MSG_LD_LOADAVAIL_SIZE) && (strncmp(s1,
1648 		    MSG_ORIG(MSG_LD_LOADAVAIL), MSG_LD_LOADAVAIL_SIZE) == 0)) {
1649 			/*
1650 			 * This variable is not documented for general use.
1651 			 * Although originaly designed for internal use with
1652 			 * crle(1), this variable is in use by the Studio
1653 			 * auditing tools.  Hence, it can't be removed.
1654 			 */
1655 			select |= SEL_ACT_LML;
1656 			val = LML_FLG_LOADAVAIL;
1657 			variable = ENV_FLG_LOADAVAIL;
1658 		} else if ((len == MSG_LD_LOADFLTR_SIZE) && (strncmp(s1,
1659 		    MSG_ORIG(MSG_LD_LOADFLTR), MSG_LD_LOADFLTR_SIZE) == 0)) {
1660 			select |= SEL_ACT_SPEC_2;
1661 			variable = ENV_FLG_LOADFLTR;
1662 		}
1663 	}
1664 	/*
1665 	 * LD_MACHCAP.
1666 	 */
1667 	else if (*s1 == 'M') {
1668 		if ((len == MSG_LD_MACHCAP_SIZE) && (strncmp(s1,
1669 		    MSG_ORIG(MSG_LD_MACHCAP), MSG_LD_MACHCAP_SIZE) == 0)) {
1670 			select |= SEL_ACT_STR;
1671 			str = (select & SEL_REPLACE) ?
1672 			    &rpl_machcap : &prm_machcap;
1673 			variable = ENV_FLG_MACHCAP;
1674 		}
1675 	}
1676 	/*
1677 	 * The LD_NO family.
1678 	 */
1679 	else if (*s1 == 'N') {
1680 		if ((len == MSG_LD_NOAUDIT_SIZE) && (strncmp(s1,
1681 		    MSG_ORIG(MSG_LD_NOAUDIT), MSG_LD_NOAUDIT_SIZE) == 0)) {
1682 			select |= SEL_ACT_RT;
1683 			val = RT_FL_NOAUDIT;
1684 			variable = ENV_FLG_NOAUDIT;
1685 		} else if ((len == MSG_LD_NOAUXFLTR_SIZE) && (strncmp(s1,
1686 		    MSG_ORIG(MSG_LD_NOAUXFLTR), MSG_LD_NOAUXFLTR_SIZE) == 0)) {
1687 			select |= SEL_ACT_RT;
1688 			val = RT_FL_NOAUXFLTR;
1689 			variable = ENV_FLG_NOAUXFLTR;
1690 		} else if ((len == MSG_LD_NOBAPLT_SIZE) && (strncmp(s1,
1691 		    MSG_ORIG(MSG_LD_NOBAPLT), MSG_LD_NOBAPLT_SIZE) == 0)) {
1692 			select |= SEL_ACT_RT;
1693 			val = RT_FL_NOBAPLT;
1694 			variable = ENV_FLG_NOBAPLT;
1695 		} else if ((len == MSG_LD_NOCONFIG_SIZE) && (strncmp(s1,
1696 		    MSG_ORIG(MSG_LD_NOCONFIG), MSG_LD_NOCONFIG_SIZE) == 0)) {
1697 			select |= SEL_ACT_RT;
1698 			val = RT_FL_NOCFG;
1699 			variable = ENV_FLG_NOCONFIG;
1700 		} else if ((len == MSG_LD_NODIRCONFIG_SIZE) && (strncmp(s1,
1701 		    MSG_ORIG(MSG_LD_NODIRCONFIG),
1702 		    MSG_LD_NODIRCONFIG_SIZE) == 0)) {
1703 			select |= SEL_ACT_RT;
1704 			val = RT_FL_NODIRCFG;
1705 			variable = ENV_FLG_NODIRCONFIG;
1706 		} else if ((len == MSG_LD_NODIRECT_SIZE) && (strncmp(s1,
1707 		    MSG_ORIG(MSG_LD_NODIRECT), MSG_LD_NODIRECT_SIZE) == 0)) {
1708 			select |= SEL_ACT_LMLT;
1709 			val = LML_TFLG_NODIRECT;
1710 			variable = ENV_FLG_NODIRECT;
1711 		} else if ((len == MSG_LD_NOENVCONFIG_SIZE) && (strncmp(s1,
1712 		    MSG_ORIG(MSG_LD_NOENVCONFIG),
1713 		    MSG_LD_NOENVCONFIG_SIZE) == 0)) {
1714 			select |= SEL_ACT_RT;
1715 			val = RT_FL_NOENVCFG;
1716 			variable = ENV_FLG_NOENVCONFIG;
1717 		} else if ((len == MSG_LD_NOFLTCONFIG_SIZE) && (strncmp(s1,
1718 		    MSG_ORIG(MSG_LD_NOFLTCONFIG),
1719 		    MSG_LD_NOFLTCONFIG_SIZE) == 0)) {
1720 			select |= SEL_ACT_RT2;
1721 			val = RT_FL2_NOFLTCFG;
1722 			variable = ENV_FLG_NOFLTCONFIG;
1723 		} else if ((len == MSG_LD_NOLAZY_SIZE) && (strncmp(s1,
1724 		    MSG_ORIG(MSG_LD_NOLAZY), MSG_LD_NOLAZY_SIZE) == 0)) {
1725 			select |= SEL_ACT_LMLT;
1726 			val = LML_TFLG_NOLAZYLD;
1727 			variable = ENV_FLG_NOLAZY;
1728 		} else if ((len == MSG_LD_NOOBJALTER_SIZE) && (strncmp(s1,
1729 		    MSG_ORIG(MSG_LD_NOOBJALTER),
1730 		    MSG_LD_NOOBJALTER_SIZE) == 0)) {
1731 			select |= SEL_ACT_RT;
1732 			val = RT_FL_NOOBJALT;
1733 			variable = ENV_FLG_NOOBJALTER;
1734 		} else if ((len == MSG_LD_NOVERSION_SIZE) && (strncmp(s1,
1735 		    MSG_ORIG(MSG_LD_NOVERSION), MSG_LD_NOVERSION_SIZE) == 0)) {
1736 			select |= SEL_ACT_RT;
1737 			val = RT_FL_NOVERSION;
1738 			variable = ENV_FLG_NOVERSION;
1739 		} else if ((len == MSG_LD_NOUNRESWEAK_SIZE) && (strncmp(s1,
1740 		    MSG_ORIG(MSG_LD_NOUNRESWEAK),
1741 		    MSG_LD_NOUNRESWEAK_SIZE) == 0)) {
1742 			/*
1743 			 * LD_NOUNRESWEAK (internal, used by ldd(1)).
1744 			 */
1745 			select |= SEL_ACT_LML;
1746 			val = LML_FLG_TRC_NOUNRESWEAK;
1747 			variable = ENV_FLG_NOUNRESWEAK;
1748 		} else if ((len == MSG_LD_NOPAREXT_SIZE) && (strncmp(s1,
1749 		    MSG_ORIG(MSG_LD_NOPAREXT), MSG_LD_NOPAREXT_SIZE) == 0)) {
1750 			select |= SEL_ACT_LML;
1751 			val = LML_FLG_TRC_NOPAREXT;
1752 			variable = ENV_FLG_NOPAREXT;
1753 		} else if ((len == MSG_LD_NOENVIRON_SIZE) && (strncmp(s1,
1754 		    MSG_ORIG(MSG_LD_NOENVIRON), MSG_LD_NOENVIRON_SIZE) == 0)) {
1755 			/*
1756 			 * LD_NOENVIRON can only be set with ld.so.1 -e.
1757 			 */
1758 			select |= SEL_ACT_RT;
1759 			val = RT_FL_NOENVIRON;
1760 			variable = ENV_FLG_NOENVIRON;
1761 		}
1762 	}
1763 	/*
1764 	 * LD_PLATCAP, LD_PRELOAD and LD_PROFILE family.
1765 	 */
1766 	else if (*s1 == 'P') {
1767 		if ((len == MSG_LD_PLATCAP_SIZE) && (strncmp(s1,
1768 		    MSG_ORIG(MSG_LD_PLATCAP), MSG_LD_PLATCAP_SIZE) == 0)) {
1769 			select |= SEL_ACT_STR;
1770 			str = (select & SEL_REPLACE) ?
1771 			    &rpl_platcap : &prm_platcap;
1772 			variable = ENV_FLG_PLATCAP;
1773 		} else if ((len == MSG_LD_PRELOAD_SIZE) && (strncmp(s1,
1774 		    MSG_ORIG(MSG_LD_PRELOAD), MSG_LD_PRELOAD_SIZE) == 0)) {
1775 			select |= SEL_ACT_STR;
1776 			str = (select & SEL_REPLACE) ? &rpl_preload :
1777 			    &prm_preload;
1778 			variable = ENV_FLG_PRELOAD;
1779 		} else if ((len == MSG_LD_PROFILE_SIZE) && (strncmp(s1,
1780 		    MSG_ORIG(MSG_LD_PROFILE), MSG_LD_PROFILE_SIZE) == 0)) {
1781 			/*
1782 			 * Only one user library can be profiled at a time.
1783 			 */
1784 			select |= SEL_ACT_SPEC_2;
1785 			variable = ENV_FLG_PROFILE;
1786 		} else if ((len == MSG_LD_PROFILE_OUTPUT_SIZE) && (strncmp(s1,
1787 		    MSG_ORIG(MSG_LD_PROFILE_OUTPUT),
1788 		    MSG_LD_PROFILE_OUTPUT_SIZE) == 0)) {
1789 			/*
1790 			 * Only one user library can be profiled at a time.
1791 			 */
1792 			select |= SEL_ACT_STR;
1793 			str = &profile_out;
1794 			variable = ENV_FLG_PROFILE_OUTPUT;
1795 		}
1796 	}
1797 	/*
1798 	 * LD_SFCAP and LD_SIGNAL.
1799 	 */
1800 	else if (*s1 == 'S') {
1801 		if ((len == MSG_LD_SFCAP_SIZE) && (strncmp(s1,
1802 		    MSG_ORIG(MSG_LD_SFCAP), MSG_LD_SFCAP_SIZE) == 0)) {
1803 			select |= SEL_ACT_STR;
1804 			str = (select & SEL_REPLACE) ?
1805 			    &rpl_sfcap : &prm_sfcap;
1806 			variable = ENV_FLG_SFCAP;
1807 		} else if ((len == MSG_LD_SIGNAL_SIZE) &&
1808 		    (strncmp(s1, MSG_ORIG(MSG_LD_SIGNAL),
1809 		    MSG_LD_SIGNAL_SIZE) == 0) &&
1810 		    ((rtld_flags & RT_FL_SECURE) == 0)) {
1811 			select |= SEL_ACT_SPEC_2;
1812 			variable = ENV_FLG_SIGNAL;
1813 		}
1814 	}
1815 	/*
1816 	 * The LD_TRACE family (internal, used by ldd(1)).  This definition is
1817 	 * the key to enabling all other ldd(1) specific environment variables.
1818 	 * In case an auditor is called, which in turn might exec(2) a
1819 	 * subprocess, this variable is disabled, so that any subprocess
1820 	 * escapes ldd(1) processing.
1821 	 */
1822 	else if (*s1 == 'T') {
1823 		if (((len == MSG_LD_TRACE_OBJS_SIZE) &&
1824 		    (strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS),
1825 		    MSG_LD_TRACE_OBJS_SIZE) == 0)) ||
1826 		    ((len == MSG_LD_TRACE_OBJS_E_SIZE) &&
1827 		    (strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_E),
1828 		    MSG_LD_TRACE_OBJS_E_SIZE) == 0))) {
1829 			char	*s0 = (char *)s1;
1830 
1831 			select |= SEL_ACT_SPEC_2;
1832 			variable = ENV_FLG_TRACE_OBJS;
1833 
1834 #if	defined(__sparc) || defined(__x86)
1835 			/*
1836 			 * The simplest way to "disable" this variable is to
1837 			 * truncate this string to "LD_'\0'". This string is
1838 			 * ignored by any ld.so.1 environment processing.
1839 			 * Use of such interfaces as unsetenv(3c) are overkill,
1840 			 * and would drag too much libc implementation detail
1841 			 * into ld.so.1.
1842 			 */
1843 			*s0 = '\0';
1844 #else
1845 /*
1846  * Verify that the above write is appropriate for any new platforms.
1847  */
1848 #error	unsupported architecture!
1849 #endif
1850 		} else if ((len == MSG_LD_TRACE_PTHS_SIZE) && (strncmp(s1,
1851 		    MSG_ORIG(MSG_LD_TRACE_PTHS),
1852 		    MSG_LD_TRACE_PTHS_SIZE) == 0)) {
1853 			select |= SEL_ACT_LML;
1854 			val = LML_FLG_TRC_SEARCH;
1855 			variable = ENV_FLG_TRACE_PTHS;
1856 		}
1857 	}
1858 	/*
1859 	 * LD_UNREF and LD_UNUSED (internal, used by ldd(1)).
1860 	 */
1861 	else if (*s1 == 'U') {
1862 		if ((len == MSG_LD_UNREF_SIZE) && (strncmp(s1,
1863 		    MSG_ORIG(MSG_LD_UNREF), MSG_LD_UNREF_SIZE) == 0)) {
1864 			select |= SEL_ACT_LML;
1865 			val = LML_FLG_TRC_UNREF;
1866 			variable = ENV_FLG_UNREF;
1867 		} else if ((len == MSG_LD_UNUSED_SIZE) && (strncmp(s1,
1868 		    MSG_ORIG(MSG_LD_UNUSED), MSG_LD_UNUSED_SIZE) == 0)) {
1869 			select |= SEL_ACT_LML;
1870 			val = LML_FLG_TRC_UNUSED;
1871 			variable = ENV_FLG_UNUSED;
1872 		}
1873 	}
1874 	/*
1875 	 * LD_VERBOSE (internal, used by ldd(1)).
1876 	 */
1877 	else if (*s1 == 'V') {
1878 		if ((len == MSG_LD_VERBOSE_SIZE) && (strncmp(s1,
1879 		    MSG_ORIG(MSG_LD_VERBOSE), MSG_LD_VERBOSE_SIZE) == 0)) {
1880 			select |= SEL_ACT_LML;
1881 			val = LML_FLG_TRC_VERBOSE;
1882 			variable = ENV_FLG_VERBOSE;
1883 		}
1884 	}
1885 	/*
1886 	 * LD_WARN (internal, used by ldd(1)).
1887 	 */
1888 	else if (*s1 == 'W') {
1889 		if ((len == MSG_LD_WARN_SIZE) && (strncmp(s1,
1890 		    MSG_ORIG(MSG_LD_WARN), MSG_LD_WARN_SIZE) == 0)) {
1891 			select |= SEL_ACT_LML;
1892 			val = LML_FLG_TRC_WARN;
1893 			variable = ENV_FLG_WARN;
1894 		}
1895 	}
1896 
1897 	if (variable == 0)
1898 		return;
1899 
1900 	/*
1901 	 * If the variable is already processed with and ISA specific variable,
1902 	 * no further processing is needed.
1903 	 */
1904 	if (((select & SEL_REPLACE) && (rplisa & variable)) ||
1905 	    ((select & SEL_PERMANT) && (prmisa & variable)))
1906 		return;
1907 
1908 	/*
1909 	 * If this variable has already been set via the command line, then
1910 	 * ignore this variable.  The command line, -e, takes precedence.
1911 	 */
1912 	if (env_flags & ENV_TYP_ISA) {
1913 		if (cmdisa & variable)
1914 			return;
1915 		if (env_flags & ENV_TYP_CMDLINE)
1916 			cmdisa |= variable;
1917 	} else {
1918 		if (cmdgen & variable)
1919 			return;
1920 		if (env_flags & ENV_TYP_CMDLINE)
1921 			cmdgen |= variable;
1922 	}
1923 
1924 	/*
1925 	 * Mark the appropriate variables.
1926 	 */
1927 	if (env_flags & ENV_TYP_ISA) {
1928 		/*
1929 		 * This is an ISA setting.
1930 		 */
1931 		if (select & SEL_REPLACE) {
1932 			if (rplisa & variable)
1933 				return;
1934 			rplisa |= variable;
1935 		} else {
1936 			prmisa |= variable;
1937 		}
1938 	} else {
1939 		/*
1940 		 * This is a non-ISA setting.
1941 		 */
1942 		if (select & SEL_REPLACE) {
1943 			if (rplgen & variable)
1944 				return;
1945 			rplgen |= variable;
1946 		} else
1947 			prmgen |= variable;
1948 	}
1949 
1950 	/*
1951 	 * Now perform the setting.
1952 	 */
1953 	if (select & SEL_ACT_RT) {
1954 		if (s2)
1955 			rtld_flags |= val;
1956 		else
1957 			rtld_flags &= ~val;
1958 	} else if (select & SEL_ACT_RT2) {
1959 		if (s2)
1960 			rtld_flags2 |= val;
1961 		else
1962 			rtld_flags2 &= ~val;
1963 	} else if (select & SEL_ACT_STR) {
1964 		if (env_flags & ENV_TYP_NULL)
1965 			*str = NULL;
1966 		else
1967 			*str = s2;
1968 	} else if (select & SEL_ACT_LML) {
1969 		if (s2)
1970 			*lmflags |= val;
1971 		else
1972 			*lmflags &= ~val;
1973 	} else if (select & SEL_ACT_LMLT) {
1974 		if (s2)
1975 			*lmtflags |= val;
1976 		else
1977 			*lmtflags &= ~val;
1978 	} else if (select & SEL_ACT_SPEC_1) {
1979 		/*
1980 		 * variable is either ENV_FLG_FLAGS or ENV_FLG_LIBPATH
1981 		 */
1982 		if (env_flags & ENV_TYP_NULL)
1983 			*str = NULL;
1984 		else
1985 			*str = s2;
1986 		if ((select & SEL_REPLACE) && (env_flags & ENV_TYP_CONFIG)) {
1987 			if (s2) {
1988 				if (variable == ENV_FLG_FLAGS)
1989 					env_info |= ENV_INF_FLAGCFG;
1990 				else
1991 					env_info |= ENV_INF_PATHCFG;
1992 			} else {
1993 				if (variable == ENV_FLG_FLAGS)
1994 					env_info &= ~ENV_INF_FLAGCFG;
1995 				else
1996 					env_info &= ~ENV_INF_PATHCFG;
1997 			}
1998 		}
1999 	} else if (select & SEL_ACT_SPEC_2) {
2000 		/*
2001 		 * variables can be: ENV_FLG_
2002 		 *	AUDIT_ARGS, BINDING, CONFGEN, LOADFLTR, PROFILE,
2003 		 *	SIGNAL, TRACE_OBJS
2004 		 */
2005 		switch (variable) {
2006 		case ENV_FLG_AUDIT_ARGS:
2007 			if (s2) {
2008 				audit_argcnt = atoi(s2);
2009 				audit_argcnt += audit_argcnt % 2;
2010 			} else
2011 				audit_argcnt = 0;
2012 			break;
2013 		case ENV_FLG_BINDINGS:
2014 			if (s2)
2015 				rpl_debug = MSG_ORIG(MSG_TKN_BINDINGS);
2016 			else
2017 				rpl_debug = NULL;
2018 			break;
2019 		case ENV_FLG_CONFGEN:
2020 			if (s2) {
2021 				rtld_flags |= RT_FL_CONFGEN;
2022 				*lmflags |= LML_FLG_IGNRELERR;
2023 			} else {
2024 				rtld_flags &= ~RT_FL_CONFGEN;
2025 				*lmflags &= ~LML_FLG_IGNRELERR;
2026 			}
2027 			break;
2028 		case ENV_FLG_LOADFLTR:
2029 			if (s2) {
2030 				*lmtflags |= LML_TFLG_LOADFLTR;
2031 				if (*s2 == '2')
2032 					rtld_flags |= RT_FL_WARNFLTR;
2033 			} else {
2034 				*lmtflags &= ~LML_TFLG_LOADFLTR;
2035 				rtld_flags &= ~RT_FL_WARNFLTR;
2036 			}
2037 			break;
2038 		case ENV_FLG_PROFILE:
2039 			profile_name = s2;
2040 			if (s2) {
2041 				if (strcmp(s2, MSG_ORIG(MSG_FIL_RTLD)) == 0) {
2042 					return;
2043 				}
2044 				/* BEGIN CSTYLED */
2045 				if (rtld_flags & RT_FL_SECURE) {
2046 					profile_lib =
2047 #if	defined(_ELF64)
2048 					    MSG_ORIG(MSG_PTH_LDPROFSE_64);
2049 #else
2050 					    MSG_ORIG(MSG_PTH_LDPROFSE);
2051 #endif
2052 				} else {
2053 					profile_lib =
2054 #if	defined(_ELF64)
2055 					    MSG_ORIG(MSG_PTH_LDPROF_64);
2056 #else
2057 					    MSG_ORIG(MSG_PTH_LDPROF);
2058 #endif
2059 				}
2060 				/* END CSTYLED */
2061 			} else
2062 				profile_lib = NULL;
2063 			break;
2064 		case ENV_FLG_SIGNAL:
2065 			killsig = s2 ? atoi(s2) : SIGKILL;
2066 			break;
2067 		case ENV_FLG_TRACE_OBJS:
2068 			if (s2) {
2069 				*lmflags |= LML_FLG_TRC_ENABLE;
2070 				if (*s2 == '2')
2071 					*lmflags |= LML_FLG_TRC_LDDSTUB;
2072 			} else
2073 				*lmflags &=
2074 				    ~(LML_FLG_TRC_ENABLE | LML_FLG_TRC_LDDSTUB);
2075 			break;
2076 		}
2077 	}
2078 }
2079 
2080 /*
2081  * Determine whether we have an architecture specific environment variable.
2082  * If we do, and we're the wrong architecture, it'll just get ignored.
2083  * Otherwise the variable is processed in it's architecture neutral form.
2084  */
2085 static int
ld_arch_env(const char * s1,size_t * len)2086 ld_arch_env(const char *s1, size_t *len)
2087 {
2088 	size_t	_len = *len - 3;
2089 
2090 	if (s1[_len++] == '_') {
2091 		if ((s1[_len] == '3') && (s1[_len + 1] == '2')) {
2092 #if	defined(_ELF64)
2093 			return (ENV_TYP_IGNORE);
2094 #else
2095 			*len = *len - 3;
2096 			return (ENV_TYP_ISA);
2097 #endif
2098 		}
2099 		if ((s1[_len] == '6') && (s1[_len + 1] == '4')) {
2100 #if	defined(_ELF64)
2101 			*len = *len - 3;
2102 			return (ENV_TYP_ISA);
2103 #else
2104 			return (ENV_TYP_IGNORE);
2105 #endif
2106 		}
2107 	}
2108 	return (0);
2109 }
2110 
2111 /*
2112  * Process an LD_FLAGS environment variable.  The value can be a comma
2113  * separated set of tokens, which are sent (in upper case) into the generic
2114  * LD_XXXX environment variable engine.  For example:
2115  *
2116  *	LD_FLAGS=bind_now=		->	LD_BIND_NOW=
2117  *	LD_FLAGS=bind_now		->	LD_BIND_NOW=1
2118  *	LD_FLAGS=library_path=		->	LD_LIBRARY_PATH=
2119  *	LD_FLAGS=library_path=/foo:.	->	LD_LIBRARY_PATH=/foo:.
2120  *	LD_FLAGS=debug=files:detail	->	LD_DEBUG=files:detail
2121  * or
2122  *	LD_FLAGS=bind_now,library_path=/foo:.,debug=files:detail
2123  */
2124 static int
ld_flags_env(const char * str,Word * lmflags,Word * lmtflags,uint_t env_flags)2125 ld_flags_env(const char *str, Word *lmflags, Word *lmtflags,
2126     uint_t env_flags)
2127 {
2128 	char	*nstr, *sstr, *estr = NULL;
2129 	size_t	nlen, len;
2130 
2131 	if (str == NULL)
2132 		return (0);
2133 
2134 	/*
2135 	 * Create a new string as we're going to transform the token(s) into
2136 	 * uppercase and separate tokens with nulls.
2137 	 */
2138 	len = strlen(str);
2139 	if ((nstr = malloc(len + 1)) == NULL)
2140 		return (1);
2141 	(void) strcpy(nstr, str);
2142 
2143 	for (sstr = nstr; sstr; sstr++, len--) {
2144 		int	flags = 0;
2145 
2146 		if ((*sstr != '\0') && (*sstr != ',')) {
2147 			if (estr == NULL) {
2148 				if (*sstr == '=')
2149 					estr = sstr;
2150 				else {
2151 					/*
2152 					 * Translate token to uppercase.  Don't
2153 					 * use toupper(3C) as including this
2154 					 * code doubles the size of ld.so.1.
2155 					 */
2156 					if ((*sstr >= 'a') && (*sstr <= 'z'))
2157 						*sstr = *sstr - ('a' - 'A');
2158 				}
2159 			}
2160 			continue;
2161 		}
2162 
2163 		*sstr = '\0';
2164 
2165 		/*
2166 		 * Have we discovered an "=" string.
2167 		 */
2168 		if (estr) {
2169 			nlen = estr - nstr;
2170 
2171 			/*
2172 			 * If this is an unqualified "=", then this variable
2173 			 * is intended to ensure a feature is disabled.
2174 			 */
2175 			if ((*++estr == '\0') || (*estr == ','))
2176 				estr = NULL;
2177 		} else {
2178 			nlen = sstr - nstr;
2179 
2180 			/*
2181 			 * If there is no "=" found, fabricate a boolean
2182 			 * definition for any unqualified variable.  Thus,
2183 			 * LD_FLAGS=bind_now is represented as BIND_NOW=1.
2184 			 * The value "1" is sufficient to assert any boolean
2185 			 * variables.  Setting of ENV_TYP_NULL ensures any
2186 			 * string usage is reset to a NULL string, thus
2187 			 * LD_FLAGS=library_path is equivalent to
2188 			 * LIBRARY_PATH='\0'.
2189 			 */
2190 			flags |= ENV_TYP_NULL;
2191 			estr = (char *)MSG_ORIG(MSG_STR_ONE);
2192 		}
2193 
2194 		/*
2195 		 * Determine whether the environment variable is 32- or 64-bit
2196 		 * specific.  The length, len, will reflect the architecture
2197 		 * neutral portion of the string.
2198 		 */
2199 		if ((flags |= ld_arch_env(nstr, &nlen)) != ENV_TYP_IGNORE) {
2200 			ld_generic_env(nstr, nlen, estr, lmflags,
2201 			    lmtflags, (env_flags | flags));
2202 		}
2203 		if (len == 0)
2204 			break;
2205 
2206 		nstr = sstr + 1;
2207 		estr = NULL;
2208 	}
2209 
2210 	return (0);
2211 }
2212 
2213 /*
2214  * Variant of getopt(), intended for use when ld.so.1 is invoked directly
2215  * from the command line.  The only command line option allowed is -e followed
2216  * by a runtime linker environment variable.
2217  */
2218 int
rtld_getopt(char ** argv,char *** envp,auxv_t ** auxv,Word * lmflags,Word * lmtflags)2219 rtld_getopt(char **argv, char ***envp, auxv_t **auxv, Word *lmflags,
2220     Word *lmtflags)
2221 {
2222 	int	ndx;
2223 
2224 	for (ndx = 1; argv[ndx]; ndx++) {
2225 		char	*str;
2226 
2227 		if (argv[ndx][0] != '-')
2228 			break;
2229 
2230 		if (argv[ndx][1] == '\0') {
2231 			ndx++;
2232 			break;
2233 		}
2234 
2235 		if (argv[ndx][1] != 'e')
2236 			return (1);
2237 
2238 		if (argv[ndx][2] == '\0') {
2239 			ndx++;
2240 			if (argv[ndx] == NULL)
2241 				return (1);
2242 			str = argv[ndx];
2243 		} else
2244 			str = &argv[ndx][2];
2245 
2246 		/*
2247 		 * If the environment variable starts with LD_, strip the LD_.
2248 		 * Otherwise, take things as is.  Indicate that this variable
2249 		 * originates from the command line, as these variables take
2250 		 * precedence over any environment variables, or configuration
2251 		 * file variables.
2252 		 */
2253 		if ((str[0] == 'L') && (str[1] == 'D') && (str[2] == '_') &&
2254 		    (str[3] != '\0'))
2255 			str += 3;
2256 		if (ld_flags_env(str, lmflags, lmtflags,
2257 		    ENV_TYP_CMDLINE) == 1)
2258 			return (1);
2259 	}
2260 
2261 	/*
2262 	 * Make sure an object file has been specified.
2263 	 */
2264 	if (argv[ndx] == NULL)
2265 		return (1);
2266 
2267 	/*
2268 	 * Having gotten the arguments, clean ourselves off of the stack.
2269 	 * This results in a process that looks as if it was executed directly
2270 	 * from the application.
2271 	 */
2272 	stack_cleanup(argv, envp, auxv, ndx);
2273 	return (0);
2274 }
2275 
2276 /*
2277  * Process a single LD_XXXX string.
2278  */
2279 static void
ld_str_env(const char * s1,Word * lmflags,Word * lmtflags,uint_t env_flags)2280 ld_str_env(const char *s1, Word *lmflags, Word *lmtflags, uint_t env_flags)
2281 {
2282 	const char	*s2;
2283 	size_t		len;
2284 	int		flags;
2285 
2286 	/*
2287 	 * In a branded process we must ignore all LD_XXXX variables because
2288 	 * they are intended for the brand's linker.  To affect the native
2289 	 * linker, use LD_BRAND_XXXX instead.
2290 	 */
2291 	if (rtld_flags2 & RT_FL2_BRANDED) {
2292 		if (strncmp(s1, MSG_ORIG(MSG_LD_BRAND_PREFIX),
2293 		    MSG_LD_BRAND_PREFIX_SIZE) != 0)
2294 			return;
2295 		s1 += MSG_LD_BRAND_PREFIX_SIZE;
2296 	}
2297 
2298 	/*
2299 	 * Variables with no value (ie. LD_XXXX=) turn a capability off.
2300 	 */
2301 	if ((s2 = strchr(s1, '=')) == NULL) {
2302 		len = strlen(s1);
2303 		s2 = NULL;
2304 	} else if (*++s2 == '\0') {
2305 		len = strlen(s1) - 1;
2306 		s2 = NULL;
2307 	} else {
2308 		len = s2 - s1 - 1;
2309 		while (conv_strproc_isspace(*s2))
2310 			s2++;
2311 	}
2312 
2313 	/*
2314 	 * Determine whether the environment variable is 32-bit or 64-bit
2315 	 * specific.  The length, len, will reflect the architecture neutral
2316 	 * portion of the string.
2317 	 */
2318 	if ((flags = ld_arch_env(s1, &len)) == ENV_TYP_IGNORE)
2319 		return;
2320 	env_flags |= flags;
2321 
2322 	ld_generic_env(s1, len, s2, lmflags, lmtflags, env_flags);
2323 }
2324 
2325 /*
2326  * Internal getenv routine.  Called immediately after ld.so.1 initializes
2327  * itself to process any locale specific environment variables, and collect
2328  * any LD_XXXX variables for later processing.
2329  */
2330 #define	LOC_LANG	1
2331 #define	LOC_MESG	2
2332 #define	LOC_ALL		3
2333 
2334 int
readenv_user(const char ** envp,APlist ** ealpp)2335 readenv_user(const char **envp, APlist **ealpp)
2336 {
2337 	char		*locale;
2338 	const char	*s1;
2339 	int		loc = 0;
2340 
2341 	for (s1 = *envp; s1; envp++, s1 = *envp) {
2342 		const char	*s2;
2343 
2344 		if (*s1++ != 'L')
2345 			continue;
2346 
2347 		/*
2348 		 * See if we have any locale environment settings.  These
2349 		 * environment variables have a precedence, LC_ALL is higher
2350 		 * than LC_MESSAGES which is higher than LANG.
2351 		 */
2352 		s2 = s1;
2353 		if ((*s2++ == 'C') && (*s2++ == '_') && (*s2 != '\0')) {
2354 			if (strncmp(s2, MSG_ORIG(MSG_LC_ALL),
2355 			    MSG_LC_ALL_SIZE) == 0) {
2356 				s2 += MSG_LC_ALL_SIZE;
2357 				if ((*s2 != '\0') && (loc < LOC_ALL)) {
2358 					glcs[CI_LCMESSAGES].lc_un.lc_ptr =
2359 					    (char *)s2;
2360 					loc = LOC_ALL;
2361 				}
2362 			} else if (strncmp(s2, MSG_ORIG(MSG_LC_MESSAGES),
2363 			    MSG_LC_MESSAGES_SIZE) == 0) {
2364 				s2 += MSG_LC_MESSAGES_SIZE;
2365 				if ((*s2 != '\0') && (loc < LOC_MESG)) {
2366 					glcs[CI_LCMESSAGES].lc_un.lc_ptr =
2367 					    (char *)s2;
2368 					loc = LOC_MESG;
2369 				}
2370 			}
2371 			continue;
2372 		}
2373 
2374 		s2 = s1;
2375 		if ((*s2++ == 'A') && (*s2++ == 'N') && (*s2++ == 'G') &&
2376 		    (*s2++ == '=') && (*s2 != '\0') && (loc < LOC_LANG)) {
2377 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2378 			loc = LOC_LANG;
2379 			continue;
2380 		}
2381 
2382 		/*
2383 		 * Pick off any LD_XXXX environment variables.
2384 		 */
2385 		if ((*s1++ == 'D') && (*s1++ == '_') && (*s1 != '\0')) {
2386 			if (aplist_append(ealpp, s1, AL_CNT_ENVIRON) == NULL)
2387 				return (1);
2388 		}
2389 	}
2390 
2391 	/*
2392 	 * If we have a locale setting make sure it's worth processing further.
2393 	 * C and POSIX locales don't need any processing.  In addition, to
2394 	 * ensure no one escapes the /usr/lib/locale hierarchy, don't allow
2395 	 * the locale to contain a segment that leads upward in the file system
2396 	 * hierarchy (i.e. no '..' segments).   Given that we'll be confined to
2397 	 * the /usr/lib/locale hierarchy, there is no need to extensively
2398 	 * validate the mode or ownership of any message file (as libc's
2399 	 * generic handling of message files does), or be concerned with
2400 	 * symbolic links that might otherwise send us elsewhere.  Duplicate
2401 	 * the string so that new locale setting can generically cleanup any
2402 	 * previous locales.
2403 	 */
2404 	if ((locale = glcs[CI_LCMESSAGES].lc_un.lc_ptr) != NULL) {
2405 		if (((*locale == 'C') && (*(locale + 1) == '\0')) ||
2406 		    (strcmp(locale, MSG_ORIG(MSG_TKN_POSIX)) == 0) ||
2407 		    (strstr(locale, MSG_ORIG(MSG_TKN_DOTDOT)) != NULL))
2408 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = NULL;
2409 		else
2410 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = strdup(locale);
2411 	}
2412 	return (0);
2413 }
2414 
2415 /*
2416  * Process any LD_XXXX environment variables collected by readenv_user().
2417  */
2418 int
procenv_user(APlist * ealp,Word * lmflags,Word * lmtflags)2419 procenv_user(APlist *ealp, Word *lmflags, Word *lmtflags)
2420 {
2421 	Aliste		idx;
2422 	const char	*s1;
2423 
2424 	for (APLIST_TRAVERSE(ealp, idx, s1))
2425 		ld_str_env(s1, lmflags, lmtflags, 0);
2426 
2427 	/*
2428 	 * Having collected the best representation of any LD_FLAGS, process
2429 	 * these strings.
2430 	 */
2431 	if (rpl_ldflags) {
2432 		if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0) == 1)
2433 			return (1);
2434 		rpl_ldflags = NULL;
2435 	}
2436 
2437 	/*
2438 	 * Don't allow environment controlled auditing when tracing or if
2439 	 * explicitly disabled.  Trigger all tracing modes from
2440 	 * LML_FLG_TRC_ENABLE.
2441 	 */
2442 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2443 		rpl_audit = profile_lib = profile_name = NULL;
2444 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2445 		*lmflags &= ~LML_MSK_TRC;
2446 
2447 	/*
2448 	 * If both LD_BIND_NOW and LD_BIND_LAZY are specified, the former wins.
2449 	 */
2450 	if ((rtld_flags2 & (RT_FL2_BINDNOW | RT_FL2_BINDLAZY)) ==
2451 	    (RT_FL2_BINDNOW | RT_FL2_BINDLAZY))
2452 		rtld_flags2 &= ~RT_FL2_BINDLAZY;
2453 
2454 	/*
2455 	 * When using ldd(1) -r or -d against an executable, assert -p.
2456 	 */
2457 	if ((*lmflags &
2458 	    (LML_FLG_TRC_WARN | LML_FLG_TRC_LDDSTUB)) == LML_FLG_TRC_WARN)
2459 		*lmflags |= LML_FLG_TRC_NOPAREXT;
2460 
2461 	return (0);
2462 }
2463 
2464 /*
2465  * Configuration environment processing.  Called after the executable has been
2466  * processed (as the executable can specify its own configuration file).
2467  */
2468 int
readenv_config(Rtc_env * envtbl,Addr addr)2469 readenv_config(Rtc_env * envtbl, Addr addr)
2470 {
2471 	Word		*lmflags = &(lml_main.lm_flags);
2472 	Word		*lmtflags = &(lml_main.lm_tflags);
2473 
2474 	if (envtbl == NULL)
2475 		return (0);
2476 
2477 	while (envtbl->env_str) {
2478 		uint_t		env_flags = ENV_TYP_CONFIG;
2479 		const char	*s1 = (const char *)(envtbl->env_str + addr);
2480 
2481 		if (envtbl->env_flags & RTC_ENV_PERMANT)
2482 			env_flags |= ENV_TYP_PERMANT;
2483 
2484 		if ((*s1++ == 'L') && (*s1++ == 'D') &&
2485 		    (*s1++ == '_') && (*s1 != '\0'))
2486 			ld_str_env(s1, lmflags, lmtflags, env_flags);
2487 
2488 		envtbl++;
2489 	}
2490 
2491 	/*
2492 	 * Having collected the best representation of any LD_FLAGS, process
2493 	 * these strings.
2494 	 */
2495 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0) == 1)
2496 		return (1);
2497 	if (ld_flags_env(prm_ldflags, lmflags, lmtflags,
2498 	    ENV_TYP_CONFIG) == 1)
2499 		return (1);
2500 
2501 	/*
2502 	 * Don't allow environment controlled auditing when tracing or if
2503 	 * explicitly disabled.  Trigger all tracing modes from
2504 	 * LML_FLG_TRC_ENABLE.
2505 	 */
2506 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2507 		prm_audit = profile_lib = profile_name = NULL;
2508 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2509 		*lmflags &= ~LML_MSK_TRC;
2510 
2511 	return (0);
2512 }
2513 
2514 int
dowrite(Prfbuf * prf)2515 dowrite(Prfbuf * prf)
2516 {
2517 	/*
2518 	 * We do not have a valid file descriptor, so we are unable
2519 	 * to flush the buffer.
2520 	 */
2521 	if (prf->pr_fd == -1)
2522 		return (0);
2523 	(void) write(prf->pr_fd, prf->pr_buf, prf->pr_cur - prf->pr_buf);
2524 	prf->pr_cur = prf->pr_buf;
2525 	return (1);
2526 }
2527 
2528 /*
2529  * Simplified printing.  The following conversion specifications are supported:
2530  *
2531  *	% [#] [-] [min field width] [. precision] s|d|x|c
2532  *
2533  *
2534  * dorprf takes the output buffer in the form of Prfbuf which permits
2535  * the verification of the output buffer size and the concatenation
2536  * of data to an already existing output buffer.  The Prfbuf
2537  * structure contains the following:
2538  *
2539  *  pr_buf	pointer to the beginning of the output buffer.
2540  *  pr_cur	pointer to the next available byte in the output buffer.  By
2541  *		setting pr_cur ahead of pr_buf you can append to an already
2542  *		existing buffer.
2543  *  pr_len	the size of the output buffer.  By setting pr_len to '0' you
2544  *		disable protection from overflows in the output buffer.
2545  *  pr_fd	a pointer to the file-descriptor the buffer will eventually be
2546  *		output to.  If pr_fd is set to '-1' then it's assumed there is
2547  *		no output buffer, and doprf() will return with an error to
2548  *		indicate an output buffer overflow.  If pr_fd is > -1 then when
2549  *		the output buffer is filled it will be flushed to pr_fd and will
2550  *		then be	available for additional data.
2551  */
2552 #define	FLG_UT_MINUS	0x0001	/* - */
2553 #define	FLG_UT_SHARP	0x0002	/* # */
2554 #define	FLG_UT_DOTSEEN	0x0008	/* dot appeared in format spec */
2555 
2556 /*
2557  * This macro is for use from within doprf only.  It is to be used for checking
2558  * the output buffer size and placing characters into the buffer.
2559  */
2560 #define	PUTC(c) \
2561 	{ \
2562 		char tmpc; \
2563 		\
2564 		tmpc = (c); \
2565 		if (bufsiz && (bp >= bufend)) { \
2566 			prf->pr_cur = bp; \
2567 			if (dowrite(prf) == 0) \
2568 				return (0); \
2569 			bp = prf->pr_cur; \
2570 		} \
2571 		*bp++ = tmpc; \
2572 	}
2573 
2574 /*
2575  * Define a local buffer size for building a numeric value - large enough to
2576  * hold a 64-bit value.
2577  */
2578 #define	NUM_SIZE	22
2579 
2580 size_t
doprf(const char * format,va_list args,Prfbuf * prf)2581 doprf(const char *format, va_list args, Prfbuf *prf)
2582 {
2583 	char	c;
2584 	char	*bp = prf->pr_cur;
2585 	char	*bufend = prf->pr_buf + prf->pr_len;
2586 	size_t	bufsiz = prf->pr_len;
2587 
2588 	while ((c = *format++) != '\0') {
2589 		if (c != '%') {
2590 			PUTC(c);
2591 		} else {
2592 			int	base = 0, flag = 0, width = 0, prec = 0;
2593 			size_t	_i;
2594 			int	_c, _n;
2595 			char	*_s;
2596 			int	ls = 0;
2597 again:
2598 			c = *format++;
2599 			switch (c) {
2600 			case '-':
2601 				flag |= FLG_UT_MINUS;
2602 				goto again;
2603 			case '#':
2604 				flag |= FLG_UT_SHARP;
2605 				goto again;
2606 			case '.':
2607 				flag |= FLG_UT_DOTSEEN;
2608 				goto again;
2609 			case '0':
2610 			case '1':
2611 			case '2':
2612 			case '3':
2613 			case '4':
2614 			case '5':
2615 			case '6':
2616 			case '7':
2617 			case '8':
2618 			case '9':
2619 				if (flag & FLG_UT_DOTSEEN)
2620 					prec = (prec * 10) + c - '0';
2621 				else
2622 					width = (width * 10) + c - '0';
2623 				goto again;
2624 			case 'x':
2625 			case 'X':
2626 				base = 16;
2627 				break;
2628 			case 'd':
2629 			case 'D':
2630 			case 'u':
2631 				base = 10;
2632 				flag &= ~FLG_UT_SHARP;
2633 				break;
2634 			case 'l':
2635 				base = 10;
2636 				ls++; /* number of l's (long or long long) */
2637 				if ((*format == 'l') ||
2638 				    (*format == 'd') || (*format == 'D') ||
2639 				    (*format == 'x') || (*format == 'X') ||
2640 				    (*format == 'o') || (*format == 'O') ||
2641 				    (*format == 'u') || (*format == 'U'))
2642 					goto again;
2643 				break;
2644 			case 'o':
2645 			case 'O':
2646 				base = 8;
2647 				break;
2648 			case 'c':
2649 				_c = va_arg(args, int);
2650 
2651 				for (_i = 24; _i > 0; _i -= 8) {
2652 					if ((c = ((_c >> _i) & 0x7f)) != 0) {
2653 						PUTC(c);
2654 					}
2655 				}
2656 				if ((c = ((_c >> _i) & 0x7f)) != 0) {
2657 					PUTC(c);
2658 				}
2659 				break;
2660 			case 's':
2661 				_s = va_arg(args, char *);
2662 				_i = strlen(_s);
2663 				/* LINTED */
2664 				_n = (int)(width - _i);
2665 				if (!prec)
2666 					/* LINTED */
2667 					prec = (int)_i;
2668 
2669 				if (width && !(flag & FLG_UT_MINUS)) {
2670 					while (_n-- > 0)
2671 						PUTC(' ');
2672 				}
2673 				while (((c = *_s++) != 0) && prec--) {
2674 					PUTC(c);
2675 				}
2676 				if (width && (flag & FLG_UT_MINUS)) {
2677 					while (_n-- > 0)
2678 						PUTC(' ');
2679 				}
2680 				break;
2681 			case '%':
2682 				PUTC('%');
2683 				break;
2684 			default:
2685 				break;
2686 			}
2687 
2688 			/*
2689 			 * Numeric processing
2690 			 */
2691 			if (base) {
2692 				char		local[NUM_SIZE];
2693 				size_t		ssize = 0, psize = 0;
2694 				const char	*string =
2695 				    MSG_ORIG(MSG_STR_HEXNUM);
2696 				const char	*prefix =
2697 				    MSG_ORIG(MSG_STR_EMPTY);
2698 				u_longlong_t	num;
2699 
2700 				switch (ls) {
2701 				case 0:	/* int */
2702 					num = (u_longlong_t)
2703 					    va_arg(args, uint_t);
2704 					break;
2705 				case 1:	/* long */
2706 					num = (u_longlong_t)
2707 					    va_arg(args, ulong_t);
2708 					break;
2709 				case 2:	/* long long */
2710 					num = va_arg(args, u_longlong_t);
2711 					break;
2712 				}
2713 
2714 				if (flag & FLG_UT_SHARP) {
2715 					if (base == 16) {
2716 						prefix = MSG_ORIG(MSG_STR_HEX);
2717 						psize = 2;
2718 					} else {
2719 						prefix = MSG_ORIG(MSG_STR_ZERO);
2720 						psize = 1;
2721 					}
2722 				}
2723 				if ((base == 10) && (long)num < 0) {
2724 					prefix = MSG_ORIG(MSG_STR_NEGATE);
2725 					psize = MSG_STR_NEGATE_SIZE;
2726 					num = (u_longlong_t)(-(longlong_t)num);
2727 				}
2728 
2729 				/*
2730 				 * Convert the numeric value into a local
2731 				 * string (stored in reverse order).
2732 				 */
2733 				_s = local;
2734 				do {
2735 					*_s++ = string[num % base];
2736 					num /= base;
2737 					ssize++;
2738 				} while (num);
2739 
2740 				ASSERT(ssize < sizeof (local));
2741 
2742 				/*
2743 				 * Provide any precision or width padding.
2744 				 */
2745 				if (prec) {
2746 					/* LINTED */
2747 					_n = (int)(prec - ssize);
2748 					while ((_n-- > 0) &&
2749 					    (ssize < sizeof (local))) {
2750 						*_s++ = '0';
2751 						ssize++;
2752 					}
2753 				}
2754 				if (width && !(flag & FLG_UT_MINUS)) {
2755 					/* LINTED */
2756 					_n = (int)(width - ssize - psize);
2757 					while (_n-- > 0) {
2758 						PUTC(' ');
2759 					}
2760 				}
2761 
2762 				/*
2763 				 * Print any prefix and the numeric string
2764 				 */
2765 				while (*prefix)
2766 					PUTC(*prefix++);
2767 				do {
2768 					PUTC(*--_s);
2769 				} while (_s > local);
2770 
2771 				/*
2772 				 * Provide any width padding.
2773 				 */
2774 				if (width && (flag & FLG_UT_MINUS)) {
2775 					/* LINTED */
2776 					_n = (int)(width - ssize - psize);
2777 					while (_n-- > 0)
2778 						PUTC(' ');
2779 				}
2780 			}
2781 		}
2782 	}
2783 
2784 	PUTC('\0');
2785 	prf->pr_cur = bp;
2786 	return (1);
2787 }
2788 
2789 static int
doprintf(const char * format,va_list args,Prfbuf * prf)2790 doprintf(const char *format, va_list args, Prfbuf *prf)
2791 {
2792 	char	*ocur = prf->pr_cur;
2793 
2794 	if (doprf(format, args, prf) == 0)
2795 		return (0);
2796 	/* LINTED */
2797 	return ((int)(prf->pr_cur - ocur));
2798 }
2799 
2800 /* VARARGS2 */
2801 int
sprintf(char * buf,const char * format,...)2802 sprintf(char *buf, const char *format, ...)
2803 {
2804 	va_list	args;
2805 	int	len;
2806 	Prfbuf	prf;
2807 
2808 	va_start(args, format);
2809 	prf.pr_buf = prf.pr_cur = buf;
2810 	prf.pr_len = 0;
2811 	prf.pr_fd = -1;
2812 	len = doprintf(format, args, &prf);
2813 	va_end(args);
2814 
2815 	/*
2816 	 * sprintf() return value excludes the terminating null byte.
2817 	 */
2818 	return (len - 1);
2819 }
2820 
2821 /* VARARGS3 */
2822 int
snprintf(char * buf,size_t n,const char * format,...)2823 snprintf(char *buf, size_t n, const char *format, ...)
2824 {
2825 	va_list	args;
2826 	int	len;
2827 	Prfbuf	prf;
2828 
2829 	va_start(args, format);
2830 	prf.pr_buf = prf.pr_cur = buf;
2831 	prf.pr_len = n;
2832 	prf.pr_fd = -1;
2833 	len = doprintf(format, args, &prf);
2834 	va_end(args);
2835 
2836 	return (len);
2837 }
2838 
2839 /* VARARGS2 */
2840 int
bufprint(Prfbuf * prf,const char * format,...)2841 bufprint(Prfbuf *prf, const char *format, ...)
2842 {
2843 	va_list	args;
2844 	int	len;
2845 
2846 	va_start(args, format);
2847 	len = doprintf(format, args, prf);
2848 	va_end(args);
2849 
2850 	return (len);
2851 }
2852 
2853 /*PRINTFLIKE1*/
2854 int
printf(const char * format,...)2855 printf(const char *format, ...)
2856 {
2857 	va_list	args;
2858 	char	buffer[ERRSIZE];
2859 	Prfbuf	prf;
2860 
2861 	va_start(args, format);
2862 	prf.pr_buf = prf.pr_cur = buffer;
2863 	prf.pr_len = ERRSIZE;
2864 	prf.pr_fd = 1;
2865 	(void) doprf(format, args, &prf);
2866 	va_end(args);
2867 	/*
2868 	 * Trim trailing '\0' form buffer
2869 	 */
2870 	prf.pr_cur--;
2871 	return (dowrite(&prf));
2872 }
2873 
2874 static char	errbuf[ERRSIZE], *nextptr = errbuf, *prevptr = NULL;
2875 
2876 /*
2877  * All error messages go through eprintf().  During process initialization,
2878  * these messages are directed to the standard error, however once control has
2879  * been passed to the applications code these messages are stored in an internal
2880  * buffer for use with dlerror().  Note, fatal error conditions that may occur
2881  * while running the application will still cause a standard error message, see
2882  * rtldexit() in this file for details.
2883  * The RT_FL_APPLIC flag serves to indicate the transition between process
2884  * initialization and when the applications code is running.
2885  */
2886 void
veprintf(Lm_list * lml,Error error,const char * format,va_list args)2887 veprintf(Lm_list *lml, Error error, const char *format, va_list args)
2888 {
2889 	int		overflow = 0;
2890 	static int	lock = 0;
2891 	Prfbuf		prf;
2892 
2893 	if (lock || (nextptr == (errbuf + ERRSIZE)))
2894 		return;
2895 
2896 	/*
2897 	 * Note: this lock is here to prevent the same thread from recursively
2898 	 * entering itself during a eprintf.  ie: during eprintf malloc() fails
2899 	 * and we try and call eprintf ... and then malloc() fails ....
2900 	 */
2901 	lock = 1;
2902 
2903 	/*
2904 	 * If we have completed startup initialization, all error messages
2905 	 * must be saved.  These are reported through dlerror().  If we're
2906 	 * still in the initialization stage, output the error directly and
2907 	 * add a newline.
2908 	 */
2909 	prf.pr_buf = prf.pr_cur = nextptr;
2910 	prf.pr_len = ERRSIZE - (nextptr - errbuf);
2911 
2912 	if ((rtld_flags & RT_FL_APPLIC) == 0)
2913 		prf.pr_fd = 2;
2914 	else
2915 		prf.pr_fd = -1;
2916 
2917 	if (error > ERR_NONE) {
2918 		if ((error == ERR_FATAL) && (rtld_flags2 & RT_FL2_FTL2WARN))
2919 			error = ERR_WARNING;
2920 		switch (error) {
2921 		case ERR_WARNING_NF:
2922 			if (err_strs[ERR_WARNING_NF] == NULL)
2923 				err_strs[ERR_WARNING_NF] =
2924 				    MSG_INTL(MSG_ERR_WARNING);
2925 			break;
2926 		case ERR_WARNING:
2927 			if (err_strs[ERR_WARNING] == NULL)
2928 				err_strs[ERR_WARNING] =
2929 				    MSG_INTL(MSG_ERR_WARNING);
2930 			break;
2931 		case ERR_GUIDANCE:
2932 			if (err_strs[ERR_GUIDANCE] == NULL)
2933 				err_strs[ERR_GUIDANCE] =
2934 				    MSG_INTL(MSG_ERR_GUIDANCE);
2935 			break;
2936 		case ERR_ELF:
2937 			if (err_strs[ERR_ELF] == NULL)
2938 				err_strs[ERR_ELF] = MSG_INTL(MSG_ERR_ELF);
2939 			break;
2940 		/* If this API is mis-used, create a fatal error */
2941 		case ERR_FATAL:
2942 		default:
2943 			if (err_strs[ERR_FATAL] == NULL)
2944 				err_strs[ERR_FATAL] = MSG_INTL(MSG_ERR_FATAL);
2945 			break;
2946 
2947 		}
2948 		if (procname) {
2949 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR1),
2950 			    rtldname, procname, err_strs[error]) == 0)
2951 				overflow = 1;
2952 		} else {
2953 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2954 			    rtldname, err_strs[error]) == 0)
2955 				overflow = 1;
2956 		}
2957 		if (overflow == 0) {
2958 			/*
2959 			 * Remove the terminating '\0'.
2960 			 */
2961 			prf.pr_cur--;
2962 		}
2963 	}
2964 
2965 	if ((overflow == 0) && doprf(format, args, &prf) == 0)
2966 		overflow = 1;
2967 
2968 	/*
2969 	 * If this is an ELF error, it will have been generated by a support
2970 	 * object that has a dependency on libelf.  ld.so.1 doesn't generate any
2971 	 * ELF error messages as it doesn't interact with libelf.  Determine the
2972 	 * ELF error string.
2973 	 */
2974 	if ((overflow == 0) && (error == ERR_ELF)) {
2975 		static int		(*elfeno)() = 0;
2976 		static const char	*(*elfemg)();
2977 		const char		*emsg;
2978 		Rt_map			*dlmp, *lmp = lml_rtld.lm_head;
2979 
2980 		if (NEXT(lmp) && (elfeno == 0)) {
2981 			if (((elfemg = (const char *(*)())dlsym_intn(RTLD_NEXT,
2982 			    MSG_ORIG(MSG_SYM_ELFERRMSG),
2983 			    lmp, &dlmp)) == NULL) ||
2984 			    ((elfeno = (int (*)())dlsym_intn(RTLD_NEXT,
2985 			    MSG_ORIG(MSG_SYM_ELFERRNO), lmp, &dlmp)) == NULL))
2986 				elfeno = 0;
2987 		}
2988 
2989 		/*
2990 		 * Lookup the message; equivalent to elf_errmsg(elf_errno()).
2991 		 */
2992 		if (elfeno && ((emsg = (* elfemg)((* elfeno)())) != NULL)) {
2993 			prf.pr_cur--;
2994 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2995 			    emsg) == 0)
2996 				overflow = 1;
2997 		}
2998 	}
2999 
3000 	/*
3001 	 * Push out any message that's been built.  Note, in the case of an
3002 	 * overflow condition, this message may be incomplete, in which case
3003 	 * make sure any partial string is null terminated.
3004 	 */
3005 	if ((rtld_flags & (RT_FL_APPLIC | RT_FL_SILENCERR)) == 0) {
3006 		*(prf.pr_cur - 1) = '\n';
3007 		(void) dowrite(&prf);
3008 	}
3009 	if (overflow)
3010 		*(prf.pr_cur - 1) = '\0';
3011 
3012 	DBG_CALL(Dbg_util_str(lml, nextptr));
3013 
3014 	/*
3015 	 * Determine if there was insufficient space left in the buffer to
3016 	 * complete the message.  If so, we'll have printed out as much as had
3017 	 * been processed if we're not yet executing the application.
3018 	 * Otherwise, there will be some debugging diagnostic indicating
3019 	 * as much of the error message as possible.  Write out a final buffer
3020 	 * overflow diagnostic - unlocalized, so we don't chance more errors.
3021 	 */
3022 	if (overflow) {
3023 		char	*str = (char *)MSG_INTL(MSG_EMG_BUFOVRFLW);
3024 
3025 		if ((rtld_flags & RT_FL_SILENCERR) == 0) {
3026 			lasterr = str;
3027 
3028 			if ((rtld_flags & RT_FL_APPLIC) == 0) {
3029 				(void) write(2, str, strlen(str));
3030 				(void) write(2, MSG_ORIG(MSG_STR_NL),
3031 				    MSG_STR_NL_SIZE);
3032 			}
3033 		}
3034 		DBG_CALL(Dbg_util_str(lml, str));
3035 
3036 		lock = 0;
3037 		nextptr = errbuf + ERRSIZE;
3038 		return;
3039 	}
3040 
3041 	/*
3042 	 * If the application has started, then error messages are being saved
3043 	 * for retrieval by dlerror(), or possible flushing from rtldexit() in
3044 	 * the case of a fatal error.  In this case, establish the next error
3045 	 * pointer.  If we haven't started the application, the whole message
3046 	 * buffer can be reused.
3047 	 */
3048 	if ((rtld_flags & RT_FL_SILENCERR) == 0) {
3049 		lasterr = nextptr;
3050 
3051 		/*
3052 		 * Note, should we encounter an error such as ENOMEM, there may
3053 		 * be a number of the same error messages (ie. an operation
3054 		 * fails with ENOMEM, and then the attempts to construct the
3055 		 * error message itself, which incurs additional ENOMEM errors).
3056 		 * Compare any previous error message with the one we've just
3057 		 * created to prevent any duplication clutter.
3058 		 */
3059 		if ((rtld_flags & RT_FL_APPLIC) &&
3060 		    ((prevptr == NULL) || (strcmp(prevptr, nextptr) != 0))) {
3061 			prevptr = nextptr;
3062 			nextptr = prf.pr_cur;
3063 			*nextptr = '\0';
3064 		}
3065 	}
3066 	lock = 0;
3067 }
3068 
3069 /*PRINTFLIKE3*/
3070 void
eprintf(Lm_list * lml,Error error,const char * format,...)3071 eprintf(Lm_list *lml, Error error, const char *format, ...)
3072 {
3073 	va_list		args;
3074 
3075 	va_start(args, format);
3076 	veprintf(lml, error, format, args);
3077 	va_end(args);
3078 }
3079 
3080 static const char rtld_panicstr[] = "rtld assertion failure";
3081 
3082 /*
3083  * Provide assfail() for ASSERT() statements.  See <sys/debug.h> for further
3084  * details.
3085  */
3086 void
assfail(const char * a,const char * f,int l)3087 assfail(const char *a, const char *f, int l)
3088 {
3089 	(void) printf("assertion failed: %s, file: %s, line: %d\n", a, f, l);
3090 	(void) _lwp_kill(_lwp_self(), SIGABRT);
3091 	upanic(rtld_panicstr, sizeof (rtld_panicstr));
3092 }
3093 
3094 void
assfail3(const char * msg,uintmax_t a,const char * op,uintmax_t b,const char * f,int l)3095 assfail3(const char *msg, uintmax_t a, const char *op, uintmax_t b,
3096     const char *f, int l)
3097 {
3098 	(void) printf("assertion failed: %s (0x%llx %s 0x%llx), "
3099 	    "file: %s, line: %d\n", msg, (unsigned long long)a, op,
3100 	    (unsigned long long)b, f, l);
3101 	(void) _lwp_kill(_lwp_self(), SIGABRT);
3102 	upanic(rtld_panicstr, sizeof (rtld_panicstr));
3103 }
3104 
3105 /*
3106  * Exit.  If we arrive here with a non zero status it's because of a fatal
3107  * error condition (most commonly a relocation error).  If the application has
3108  * already had control, then the actual fatal error message will have been
3109  * recorded in the dlerror() message buffer.  Print the message before really
3110  * exiting.
3111  */
3112 void
rtldexit(Lm_list * lml,int status)3113 rtldexit(Lm_list * lml, int status)
3114 {
3115 	if (status) {
3116 		if (rtld_flags & RT_FL_APPLIC) {
3117 			/*
3118 			 * If the error buffer has been used, write out all
3119 			 * pending messages - lasterr is simply a pointer to
3120 			 * the last message in this buffer.  However, if the
3121 			 * buffer couldn't be created at all, lasterr points
3122 			 * to a constant error message string.
3123 			 */
3124 			if (*errbuf) {
3125 				char	*errptr = errbuf;
3126 				char	*errend = errbuf + ERRSIZE;
3127 
3128 				while ((errptr < errend) && *errptr) {
3129 					size_t	size = strlen(errptr);
3130 					(void) write(2, errptr, size);
3131 					(void) write(2, MSG_ORIG(MSG_STR_NL),
3132 					    MSG_STR_NL_SIZE);
3133 					errptr += (size + 1);
3134 				}
3135 			}
3136 			if (lasterr && ((lasterr < errbuf) ||
3137 			    (lasterr > (errbuf + ERRSIZE)))) {
3138 				(void) write(2, lasterr, strlen(lasterr));
3139 				(void) write(2, MSG_ORIG(MSG_STR_NL),
3140 				    MSG_STR_NL_SIZE);
3141 			}
3142 		}
3143 		leave(lml, 0);
3144 		(void) _lwp_kill(_lwp_self(), killsig);
3145 	}
3146 	_exit(status);
3147 }
3148 
3149 /*
3150  * Map anonymous memory via MAP_ANON (added in Solaris 8).
3151  */
3152 void *
dz_map(Lm_list * lml,caddr_t addr,size_t len,int prot,int flags)3153 dz_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3154 {
3155 	caddr_t	va;
3156 
3157 	if ((va = (caddr_t)mmap(addr, len, prot,
3158 	    (flags | MAP_ANON), -1, 0)) == MAP_FAILED) {
3159 		int	err = errno;
3160 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAPANON),
3161 		    strerror(err));
3162 		return (MAP_FAILED);
3163 	}
3164 	return (va);
3165 }
3166 
3167 static int	nu_fd = FD_UNAVAIL;
3168 
3169 void *
nu_map(Lm_list * lml,caddr_t addr,size_t len,int prot,int flags)3170 nu_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3171 {
3172 	caddr_t	va;
3173 	int	err;
3174 
3175 	if (nu_fd == FD_UNAVAIL) {
3176 		if ((nu_fd = open(MSG_ORIG(MSG_PTH_DEVNULL),
3177 		    O_RDONLY)) == FD_UNAVAIL) {
3178 			err = errno;
3179 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3180 			    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3181 			return (MAP_FAILED);
3182 		}
3183 	}
3184 
3185 	if ((va = (caddr_t)mmap(addr, len, prot, flags, nu_fd, 0)) ==
3186 	    MAP_FAILED) {
3187 		err = errno;
3188 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3189 		    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3190 	}
3191 	return (va);
3192 }
3193 
3194 /*
3195  * Generic entry point from user code - simply grabs a lock, and bumps the
3196  * entrance count.
3197  */
3198 int
enter(int flags)3199 enter(int flags)
3200 {
3201 	if (rt_bind_guard(THR_FLG_RTLD | thr_flg_nolock | flags)) {
3202 		if (!thr_flg_nolock)
3203 			(void) rt_mutex_lock(&rtldlock);
3204 		if (rtld_flags & RT_FL_OPERATION) {
3205 			ld_entry_cnt++;
3206 
3207 			/*
3208 			 * Reset the diagnostic time information for each new
3209 			 * "operation".  Thus timing diagnostics are relative
3210 			 * to entering ld.so.1.
3211 			 */
3212 			if (DBG_ISTIME() &&
3213 			    (gettimeofday(&DBG_TOTALTIME, NULL) == 0)) {
3214 				DBG_DELTATIME = DBG_TOTALTIME;
3215 				DBG_ONRESET();
3216 			}
3217 		}
3218 		return (1);
3219 	}
3220 	return (0);
3221 }
3222 
3223 /*
3224  * Determine whether a search path has been used.
3225  */
3226 static void
is_path_used(Lm_list * lml,Word unref,int * nl,Alist * alp,const char * obj)3227 is_path_used(Lm_list *lml, Word unref, int *nl, Alist *alp, const char *obj)
3228 {
3229 	Pdesc	*pdp;
3230 	Aliste	idx;
3231 
3232 	for (ALIST_TRAVERSE(alp, idx, pdp)) {
3233 		const char	*fmt, *name;
3234 
3235 		if ((pdp->pd_plen == 0) || (pdp->pd_flags & PD_FLG_USED))
3236 			continue;
3237 
3238 		/*
3239 		 * If this pathname originated from an expanded token, use the
3240 		 * original for any diagnostic output.
3241 		 */
3242 		if ((name = pdp->pd_oname) == NULL)
3243 			name = pdp->pd_pname;
3244 
3245 		if (unref == 0) {
3246 			if ((*nl)++ == 0)
3247 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3248 			DBG_CALL(Dbg_unused_path(lml, name, pdp->pd_flags,
3249 			    (pdp->pd_flags & PD_FLG_DUPLICAT), obj));
3250 			continue;
3251 		}
3252 
3253 		if (pdp->pd_flags & LA_SER_LIBPATH) {
3254 			if (pdp->pd_flags & LA_SER_CONFIG) {
3255 				if (pdp->pd_flags & PD_FLG_DUPLICAT)
3256 					fmt = MSG_INTL(MSG_DUP_LDLIBPATHC);
3257 				else
3258 					fmt = MSG_INTL(MSG_USD_LDLIBPATHC);
3259 			} else {
3260 				if (pdp->pd_flags & PD_FLG_DUPLICAT)
3261 					fmt = MSG_INTL(MSG_DUP_LDLIBPATH);
3262 				else
3263 					fmt = MSG_INTL(MSG_USD_LDLIBPATH);
3264 			}
3265 		} else if (pdp->pd_flags & LA_SER_RUNPATH) {
3266 			fmt = MSG_INTL(MSG_USD_RUNPATH);
3267 		} else
3268 			continue;
3269 
3270 		if ((*nl)++ == 0)
3271 			(void) printf(MSG_ORIG(MSG_STR_NL));
3272 		(void) printf(fmt, name, obj);
3273 	}
3274 }
3275 
3276 /*
3277  * Generate diagnostics as to whether an object has been used.  A symbolic
3278  * reference that gets bound to an object marks it as used.  Dependencies that
3279  * are unused when RTLD_NOW is in effect should be removed from future builds
3280  * of an object.  Dependencies that are unused without RTLD_NOW in effect are
3281  * candidates for lazy-loading.
3282  *
3283  * Unreferenced objects identify objects that are defined as dependencies but
3284  * are unreferenced by the caller.  These unreferenced objects may however be
3285  * referenced by other objects within the process, and therefore don't qualify
3286  * as completely unused.  They are still an unnecessary overhead.
3287  *
3288  * Unreferenced runpaths are also captured under ldd -U, or "unused,detail"
3289  * debugging.
3290  */
3291 void
unused(Lm_list * lml)3292 unused(Lm_list *lml)
3293 {
3294 	Rt_map		*lmp;
3295 	int		nl = 0;
3296 	Word		unref, unuse;
3297 
3298 	/*
3299 	 * If we're not tracing unused references or dependencies, or debugging
3300 	 * there's nothing to do.
3301 	 */
3302 	unref = lml->lm_flags & LML_FLG_TRC_UNREF;
3303 	unuse = lml->lm_flags & LML_FLG_TRC_UNUSED;
3304 
3305 	if ((unref == 0) && (unuse == 0) && (DBG_ENABLED == 0))
3306 		return;
3307 
3308 	/*
3309 	 * Detect unused global search paths.
3310 	 */
3311 	if (rpl_libdirs)
3312 		is_path_used(lml, unref, &nl, rpl_libdirs, config->c_name);
3313 	if (prm_libdirs)
3314 		is_path_used(lml, unref, &nl, prm_libdirs, config->c_name);
3315 
3316 	nl = 0;
3317 	lmp = lml->lm_head;
3318 	if (RLIST(lmp))
3319 		is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3320 
3321 	/*
3322 	 * Traverse the link-maps looking for unreferenced or unused
3323 	 * dependencies.  Ignore the first object on a link-map list, as this
3324 	 * is always used.
3325 	 */
3326 	nl = 0;
3327 	for (lmp = NEXT_RT_MAP(lmp); lmp; lmp = NEXT_RT_MAP(lmp)) {
3328 		/*
3329 		 * Determine if this object contains any runpaths that have
3330 		 * not been used.
3331 		 */
3332 		if (RLIST(lmp))
3333 			is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3334 
3335 		/*
3336 		 * If tracing unreferenced objects, or under debugging,
3337 		 * determine whether any of this objects callers haven't
3338 		 * referenced it.
3339 		 */
3340 		if (unref || DBG_ENABLED) {
3341 			Bnd_desc	*bdp;
3342 			Aliste		idx;
3343 
3344 			for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
3345 				Rt_map	*clmp;
3346 
3347 				if (bdp->b_flags & BND_REFER)
3348 					continue;
3349 
3350 				clmp = bdp->b_caller;
3351 				if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
3352 					continue;
3353 
3354 				/* BEGIN CSTYLED */
3355 				if (nl++ == 0) {
3356 					if (unref)
3357 					    (void) printf(MSG_ORIG(MSG_STR_NL));
3358 					else
3359 					    DBG_CALL(Dbg_util_nl(lml,
3360 						DBG_NL_STD));
3361 				}
3362 
3363 				if (unref)
3364 				    (void) printf(MSG_INTL(MSG_LDD_UNREF_FMT),
3365 					NAME(lmp), NAME(clmp));
3366 				else
3367 				    DBG_CALL(Dbg_unused_unref(lmp, NAME(clmp)));
3368 				/* END CSTYLED */
3369 			}
3370 		}
3371 
3372 		/*
3373 		 * If tracing unused objects simply display those objects that
3374 		 * haven't been referenced by anyone.
3375 		 */
3376 		if (FLAGS1(lmp) & FL1_RT_USED)
3377 			continue;
3378 
3379 		if (nl++ == 0) {
3380 			if (unref || unuse)
3381 				(void) printf(MSG_ORIG(MSG_STR_NL));
3382 			else
3383 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3384 		}
3385 		if (CYCGROUP(lmp)) {
3386 			if (unref || unuse)
3387 				(void) printf(MSG_INTL(MSG_LDD_UNCYC_FMT),
3388 				    NAME(lmp), CYCGROUP(lmp));
3389 			else
3390 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0,
3391 				    CYCGROUP(lmp)));
3392 		} else {
3393 			if (unref || unuse)
3394 				(void) printf(MSG_INTL(MSG_LDD_UNUSED_FMT),
3395 				    NAME(lmp));
3396 			else
3397 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0, 0));
3398 		}
3399 	}
3400 
3401 	DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3402 }
3403 
3404 /*
3405  * Generic cleanup routine called prior to returning control to the user.
3406  * Ensures that any ld.so.1 specific file descriptors or temporary mapping are
3407  * released, and any locks dropped.
3408  */
3409 void
leave(Lm_list * lml,int flags)3410 leave(Lm_list *lml, int flags)
3411 {
3412 	/*
3413 	 * Alert the debuggers that the link-maps are consistent.
3414 	 */
3415 	rd_event(lml, RD_DLACTIVITY, RT_CONSISTENT);
3416 
3417 	/*
3418 	 * Alert any auditors that the link-maps are consistent.
3419 	 */
3420 	if (lml->lm_flags & LML_FLG_ACTAUDIT) {
3421 		audit_activity(lml->lm_head, LA_ACT_CONSISTENT);
3422 		lml->lm_flags &= ~LML_FLG_ACTAUDIT;
3423 	}
3424 
3425 	if (nu_fd != FD_UNAVAIL) {
3426 		(void) close(nu_fd);
3427 		nu_fd = FD_UNAVAIL;
3428 	}
3429 
3430 	/*
3431 	 * Reinitialize error message pointer, and any overflow indication.
3432 	 */
3433 	nextptr = errbuf;
3434 	prevptr = NULL;
3435 
3436 	/*
3437 	 * Defragment any freed memory.
3438 	 */
3439 	if (aplist_nitems(free_alp))
3440 		defrag();
3441 
3442 	/*
3443 	 * Don't drop our lock if we are running on our link-map list as
3444 	 * there's little point in doing so since we are single-threaded.
3445 	 *
3446 	 * LML_FLG_HOLDLOCK is set for:
3447 	 *  -	 The ld.so.1's link-map list.
3448 	 *  -	 The auditor's link-map if the environment is pre-UPM.
3449 	 */
3450 	if (lml->lm_flags & LML_FLG_HOLDLOCK)
3451 		return;
3452 
3453 	if (rt_bind_clear(0) & THR_FLG_RTLD) {
3454 		if (!thr_flg_nolock)
3455 			(void) rt_mutex_unlock(&rtldlock);
3456 		(void) rt_bind_clear(THR_FLG_RTLD | thr_flg_nolock | flags);
3457 	}
3458 }
3459 
3460 int
callable(Rt_map * clmp,Rt_map * dlmp,Grp_hdl * ghp,uint_t slflags)3461 callable(Rt_map *clmp, Rt_map *dlmp, Grp_hdl *ghp, uint_t slflags)
3462 {
3463 	APlist		*calp, *dalp;
3464 	Aliste		idx1, idx2;
3465 	Grp_hdl		*ghp1, *ghp2;
3466 
3467 	/*
3468 	 * An object can always find symbols within itself.
3469 	 */
3470 	if (clmp == dlmp)
3471 		return (1);
3472 
3473 	/*
3474 	 * The search for a singleton must look in every loaded object.
3475 	 */
3476 	if (slflags & LKUP_SINGLETON)
3477 		return (1);
3478 
3479 	/*
3480 	 * Don't allow an object to bind to an object that is being deleted
3481 	 * unless the binder is also being deleted.
3482 	 */
3483 	if ((FLAGS(dlmp) & FLG_RT_DELETE) &&
3484 	    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
3485 		return (0);
3486 
3487 	/*
3488 	 * An object with world access can always bind to an object with global
3489 	 * visibility.
3490 	 */
3491 	if (((MODE(clmp) & RTLD_WORLD) || (slflags & LKUP_WORLD)) &&
3492 	    (MODE(dlmp) & RTLD_GLOBAL))
3493 		return (1);
3494 
3495 	/*
3496 	 * An object with local access can only bind to an object that is a
3497 	 * member of the same group.
3498 	 */
3499 	if (((MODE(clmp) & RTLD_GROUP) == 0) ||
3500 	    ((calp = GROUPS(clmp)) == NULL) || ((dalp = GROUPS(dlmp)) == NULL))
3501 		return (0);
3502 
3503 	/*
3504 	 * Traverse the list of groups the caller is a part of.
3505 	 */
3506 	for (APLIST_TRAVERSE(calp, idx1, ghp1)) {
3507 		/*
3508 		 * If we're testing for the ability of two objects to bind to
3509 		 * each other regardless of a specific group, ignore that group.
3510 		 */
3511 		if (ghp && (ghp1 == ghp))
3512 			continue;
3513 
3514 		/*
3515 		 * Traverse the list of groups the destination is a part of.
3516 		 */
3517 		for (APLIST_TRAVERSE(dalp, idx2, ghp2)) {
3518 			Grp_desc	*gdp;
3519 			Aliste		idx3;
3520 
3521 			if (ghp1 != ghp2)
3522 				continue;
3523 
3524 			/*
3525 			 * Make sure the relationship between the destination
3526 			 * and the caller provide symbols for relocation.
3527 			 * Parents are maintained as callers, but unless the
3528 			 * destination object was opened with RTLD_PARENT, the
3529 			 * parent doesn't provide symbols for the destination
3530 			 * to relocate against.
3531 			 */
3532 			for (ALIST_TRAVERSE(ghp2->gh_depends, idx3, gdp)) {
3533 				if (dlmp != gdp->gd_depend)
3534 					continue;
3535 
3536 				if (gdp->gd_flags & GPD_RELOC)
3537 					return (1);
3538 			}
3539 		}
3540 	}
3541 	return (0);
3542 }
3543 
3544 /*
3545  * Initialize the environ symbol.  Traditionally this is carried out by the crt
3546  * code prior to jumping to main.  However, init sections get fired before this
3547  * variable is initialized, so ld.so.1 sets this directly from the AUX vector
3548  * information.  In addition, a process may have multiple link-maps (ld.so.1's
3549  * debugging and preloading objects), and link auditing, and each may need an
3550  * environ variable set.
3551  *
3552  * This routine is called after a relocation() pass, and thus provides for:
3553  *
3554  *  -	setting environ on the main link-map after the initial application and
3555  *	its dependencies have been established.  Typically environ lives in the
3556  *	application (provided by its crt), but in older applications it might
3557  *	be in libc.  Who knows what's expected of applications not built on
3558  *	Solaris.
3559  *
3560  *  -	after loading a new shared object.  We can add shared objects to various
3561  *	link-maps, and any link-map dependencies requiring getopt() require
3562  *	their own environ.  In addition, lazy loading might bring in the
3563  *	supplier of environ (libc used to be a lazy loading candidate) after
3564  *	the link-map has been established and other objects are present.
3565  *
3566  * This routine handles all these scenarios, without adding unnecessary overhead
3567  * to ld.so.1.
3568  */
3569 void
set_environ(Lm_list * lml)3570 set_environ(Lm_list *lml)
3571 {
3572 	Slookup		sl;
3573 	Sresult		sr;
3574 	uint_t		binfo;
3575 
3576 	/*
3577 	 * Initialize the symbol lookup, and symbol result, data structures.
3578 	 */
3579 	SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_ENVIRON), lml->lm_head, lml->lm_head,
3580 	    ld_entry_cnt, 0, 0, 0, 0, LKUP_WEAK);
3581 	SRESULT_INIT(sr, MSG_ORIG(MSG_SYM_ENVIRON));
3582 
3583 	if (LM_LOOKUP_SYM(lml->lm_head)(&sl, &sr, &binfo, 0)) {
3584 		Rt_map	*dlmp = sr.sr_dmap;
3585 
3586 		lml->lm_environ = (char ***)sr.sr_sym->st_value;
3587 
3588 		if (!(FLAGS(dlmp) & FLG_RT_FIXED))
3589 			lml->lm_environ =
3590 			    (char ***)((uintptr_t)lml->lm_environ +
3591 			    (uintptr_t)ADDR(dlmp));
3592 		*(lml->lm_environ) = (char **)environ;
3593 		lml->lm_flags |= LML_FLG_ENVIRON;
3594 	}
3595 }
3596 
3597 /*
3598  * Determine whether we have a secure executable.  Uid and gid information
3599  * can be passed to us via the aux vector, however if these values are -1
3600  * then use the appropriate system call to obtain them.
3601  *
3602  *  -	If the user is the root they can do anything
3603  *
3604  *  -	If the real and effective uid's don't match, or the real and
3605  *	effective gid's don't match then this is determined to be a `secure'
3606  *	application.
3607  *
3608  * This function is called prior to any dependency processing (see _setup.c).
3609  * Any secure setting will remain in effect for the life of the process.
3610  */
3611 void
security(uid_t uid,uid_t euid,gid_t gid,gid_t egid,int auxflags)3612 security(uid_t uid, uid_t euid, gid_t gid, gid_t egid, int auxflags)
3613 {
3614 	if (auxflags != -1) {
3615 		if ((auxflags & AF_SUN_SETUGID) != 0)
3616 			rtld_flags |= RT_FL_SECURE;
3617 		return;
3618 	}
3619 
3620 	if (uid == (uid_t)-1)
3621 		uid = getuid();
3622 	if (uid) {
3623 		if (euid == (uid_t)-1)
3624 			euid = geteuid();
3625 		if (uid != euid)
3626 			rtld_flags |= RT_FL_SECURE;
3627 		else {
3628 			if (gid == (gid_t)-1)
3629 				gid = getgid();
3630 			if (egid == (gid_t)-1)
3631 				egid = getegid();
3632 			if (gid != egid)
3633 				rtld_flags |= RT_FL_SECURE;
3634 		}
3635 	}
3636 }
3637 
3638 /*
3639  * Determine whether ld.so.1 itself is owned by root and has its mode setuid.
3640  */
3641 int
is_rtld_setuid()3642 is_rtld_setuid()
3643 {
3644 	rtld_stat_t	status;
3645 	const char	*name;
3646 
3647 	if (rtld_flags2 & RT_FL2_SETUID)
3648 		return (1);
3649 
3650 	if (interp && interp->i_name)
3651 		name = interp->i_name;
3652 	else
3653 		name = NAME(lml_rtld.lm_head);
3654 
3655 	if (((rtld_stat(name, &status) == 0) &&
3656 	    (status.st_uid == 0) && (status.st_mode & S_ISUID))) {
3657 		rtld_flags2 |= RT_FL2_SETUID;
3658 		return (1);
3659 	}
3660 	return (0);
3661 }
3662 
3663 /*
3664  * Determine that systems platform name.  Normally, this name is provided from
3665  * the AT_SUN_PLATFORM aux vector from the kernel.  This routine provides a
3666  * fall back.
3667  */
3668 void
platform_name(Syscapset * scapset)3669 platform_name(Syscapset *scapset)
3670 {
3671 	char	info[SYS_NMLN];
3672 	size_t	size;
3673 
3674 	if ((scapset->sc_platsz = size =
3675 	    sysinfo(SI_PLATFORM, info, SYS_NMLN)) == (size_t)-1)
3676 		return;
3677 
3678 	if ((scapset->sc_plat = malloc(size)) == NULL) {
3679 		scapset->sc_platsz = (size_t)-1;
3680 		return;
3681 	}
3682 	(void) strcpy(scapset->sc_plat, info);
3683 }
3684 
3685 /*
3686  * Determine that systems machine name.  Normally, this name is provided from
3687  * the AT_SUN_MACHINE aux vector from the kernel.  This routine provides a
3688  * fall back.
3689  */
3690 void
machine_name(Syscapset * scapset)3691 machine_name(Syscapset *scapset)
3692 {
3693 	char	info[SYS_NMLN];
3694 	size_t	size;
3695 
3696 	if ((scapset->sc_machsz = size =
3697 	    sysinfo(SI_MACHINE, info, SYS_NMLN)) == (size_t)-1)
3698 		return;
3699 
3700 	if ((scapset->sc_mach = malloc(size)) == NULL) {
3701 		scapset->sc_machsz = (size_t)-1;
3702 		return;
3703 	}
3704 	(void) strcpy(scapset->sc_mach, info);
3705 }
3706 
3707 /*
3708  * _REENTRANT code gets errno redefined to a function so provide for return
3709  * of the thread errno if applicable.  This has no meaning in ld.so.1 which
3710  * is basically singled threaded.  Provide the interface for our dependencies.
3711  */
3712 #undef errno
3713 int *
___errno()3714 ___errno()
3715 {
3716 	extern	int	errno;
3717 
3718 	return (&errno);
3719 }
3720 
3721 /*
3722  * Determine whether a symbol name should be demangled.
3723  */
3724 const char *
demangle(const char * name)3725 demangle(const char *name)
3726 {
3727 	if (rtld_flags & RT_FL_DEMANGLE)
3728 		return (conv_demangle_name(name));
3729 	else
3730 		return (name);
3731 }
3732 
3733 #ifndef _LP64
3734 /*
3735  * Wrappers on stat() and fstat() for 32-bit rtld that uses stat64()
3736  * underneath while preserving the object size limits of a non-largefile
3737  * enabled 32-bit process. The purpose of this is to prevent large inode
3738  * values from causing stat() to fail.
3739  */
3740 inline static int
rtld_stat_process(int r,struct stat64 * lbuf,rtld_stat_t * restrict buf)3741 rtld_stat_process(int r, struct stat64 *lbuf, rtld_stat_t *restrict buf)
3742 {
3743 	extern int	errno;
3744 
3745 	/*
3746 	 * Although we used a 64-bit capable stat(), the 32-bit rtld
3747 	 * can only handle objects < 2GB in size. If this object is
3748 	 * too big, turn the success into an overflow error.
3749 	 */
3750 	if ((lbuf->st_size & 0xffffffff80000000) != 0) {
3751 		errno = EOVERFLOW;
3752 		return (-1);
3753 	}
3754 
3755 	/*
3756 	 * Transfer the information needed by rtld into a rtld_stat_t
3757 	 * structure that preserves the non-largile types for everything
3758 	 * except inode.
3759 	 */
3760 	buf->st_dev = lbuf->st_dev;
3761 	buf->st_ino = lbuf->st_ino;
3762 	buf->st_mode = lbuf->st_mode;
3763 	buf->st_uid = lbuf->st_uid;
3764 	buf->st_size = (off_t)lbuf->st_size;
3765 	buf->st_mtim = lbuf->st_mtim;
3766 #ifdef sparc
3767 	buf->st_blksize = lbuf->st_blksize;
3768 #endif
3769 
3770 	return (r);
3771 }
3772 
3773 int
rtld_stat(const char * restrict path,rtld_stat_t * restrict buf)3774 rtld_stat(const char *restrict path, rtld_stat_t *restrict buf)
3775 {
3776 	struct stat64	lbuf;
3777 	int		r;
3778 
3779 	r = stat64(path, &lbuf);
3780 	if (r != -1)
3781 		r = rtld_stat_process(r, &lbuf, buf);
3782 	return (r);
3783 }
3784 
3785 int
rtld_fstat(int fildes,rtld_stat_t * restrict buf)3786 rtld_fstat(int fildes, rtld_stat_t *restrict buf)
3787 {
3788 	struct stat64	lbuf;
3789 	int		r;
3790 
3791 	r = fstat64(fildes, &lbuf);
3792 	if (r != -1)
3793 		r = rtld_stat_process(r, &lbuf, buf);
3794 	return (r);
3795 }
3796 #endif
3797