mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-27 11:43:34 +08:00
dfb8e514cf
Some tunable values and their minimum/maximum values must be determinted at run-time. Add TUNABLE_SET_WITH_BOUNDS and TUNABLE_SET_WITH_BOUNDS_FULL to update tunable value together with minimum and maximum values. __tunable_set_val is updated to set tunable value as well as min/max values.
439 lines
11 KiB
C
439 lines
11 KiB
C
/* The tunable framework. See the README.tunables to know how to use the
|
|
tunable in a glibc module.
|
|
|
|
Copyright (C) 2016-2020 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<https://www.gnu.org/licenses/>. */
|
|
|
|
#include <startup.h>
|
|
#include <stdint.h>
|
|
#include <stdbool.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
#include <sysdep.h>
|
|
#include <fcntl.h>
|
|
#include <ldsodefs.h>
|
|
|
|
#define TUNABLES_INTERNAL 1
|
|
#include "dl-tunables.h"
|
|
|
|
#include <not-errno.h>
|
|
|
|
#if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
|
|
# define GLIBC_TUNABLES "GLIBC_TUNABLES"
|
|
#endif
|
|
|
|
#if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
|
|
static char *
|
|
tunables_strdup (const char *in)
|
|
{
|
|
size_t i = 0;
|
|
|
|
while (in[i++] != '\0');
|
|
char *out = __sbrk (i);
|
|
|
|
/* For most of the tunables code, we ignore user errors. However,
|
|
this is a system error - and running out of memory at program
|
|
startup should be reported, so we do. */
|
|
if (out == (void *)-1)
|
|
_dl_fatal_printf ("sbrk() failure while processing tunables\n");
|
|
|
|
i--;
|
|
|
|
while (i-- > 0)
|
|
out[i] = in[i];
|
|
|
|
return out;
|
|
}
|
|
#endif
|
|
|
|
static char **
|
|
get_next_env (char **envp, char **name, size_t *namelen, char **val,
|
|
char ***prev_envp)
|
|
{
|
|
while (envp != NULL && *envp != NULL)
|
|
{
|
|
char **prev = envp;
|
|
char *envline = *envp++;
|
|
int len = 0;
|
|
|
|
while (envline[len] != '\0' && envline[len] != '=')
|
|
len++;
|
|
|
|
/* Just the name and no value, go to the next one. */
|
|
if (envline[len] == '\0')
|
|
continue;
|
|
|
|
*name = envline;
|
|
*namelen = len;
|
|
*val = &envline[len + 1];
|
|
*prev_envp = prev;
|
|
|
|
return envp;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
#define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type) \
|
|
({ \
|
|
__type min = (__cur)->type.min; \
|
|
__type max = (__cur)->type.max; \
|
|
\
|
|
if ((__type) (__val) >= min && (__type) (__val) <= max) \
|
|
{ \
|
|
(__cur)->val.numval = (__val); \
|
|
(__cur)->initialized = true; \
|
|
} \
|
|
})
|
|
|
|
#define TUNABLE_SET_BOUNDS_IF_VALID(__cur, __minp, __maxp, __type) \
|
|
({ \
|
|
if (__minp != NULL) \
|
|
{ \
|
|
/* MIN is specified. */ \
|
|
__type min = *((__type *) __minp); \
|
|
if (__maxp != NULL) \
|
|
{ \
|
|
/* Both MIN and MAX are specified. */ \
|
|
__type max = *((__type *) __maxp); \
|
|
if (max >= min \
|
|
&& max <= (__cur)->type.max \
|
|
&& min >= (__cur)->type.min) \
|
|
{ \
|
|
(__cur)->type.min = min; \
|
|
(__cur)->type.max = max; \
|
|
} \
|
|
} \
|
|
else if (min > (__cur)->type.min && min <= (__cur)->type.max) \
|
|
{ \
|
|
/* Only MIN is specified. */ \
|
|
(__cur)->type.min = min; \
|
|
} \
|
|
} \
|
|
else if (__maxp != NULL) \
|
|
{ \
|
|
/* Only MAX is specified. */ \
|
|
__type max = *((__type *) __maxp); \
|
|
if (max < (__cur)->type.max && max >= (__cur)->type.min) \
|
|
(__cur)->type.max = max; \
|
|
} \
|
|
})
|
|
|
|
static void
|
|
do_tunable_update_val (tunable_t *cur, const void *valp,
|
|
const void *minp, const void *maxp)
|
|
{
|
|
uint64_t val;
|
|
|
|
if (cur->type.type_code != TUNABLE_TYPE_STRING)
|
|
val = *((int64_t *) valp);
|
|
|
|
switch (cur->type.type_code)
|
|
{
|
|
case TUNABLE_TYPE_INT_32:
|
|
{
|
|
TUNABLE_SET_BOUNDS_IF_VALID (cur, minp, maxp, int64_t);
|
|
TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t);
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_UINT_64:
|
|
{
|
|
TUNABLE_SET_BOUNDS_IF_VALID (cur, minp, maxp, uint64_t);
|
|
TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_SIZE_T:
|
|
{
|
|
TUNABLE_SET_BOUNDS_IF_VALID (cur, minp, maxp, uint64_t);
|
|
TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_STRING:
|
|
{
|
|
cur->val.strval = valp;
|
|
break;
|
|
}
|
|
default:
|
|
__builtin_unreachable ();
|
|
}
|
|
}
|
|
|
|
/* Validate range of the input value and initialize the tunable CUR if it looks
|
|
good. */
|
|
static void
|
|
tunable_initialize (tunable_t *cur, const char *strval)
|
|
{
|
|
uint64_t val;
|
|
const void *valp;
|
|
|
|
if (cur->type.type_code != TUNABLE_TYPE_STRING)
|
|
{
|
|
val = _dl_strtoul (strval, NULL);
|
|
valp = &val;
|
|
}
|
|
else
|
|
{
|
|
cur->initialized = true;
|
|
valp = strval;
|
|
}
|
|
do_tunable_update_val (cur, valp, NULL, NULL);
|
|
}
|
|
|
|
void
|
|
__tunable_set_val (tunable_id_t id, void *valp, void *minp, void *maxp)
|
|
{
|
|
tunable_t *cur = &tunable_list[id];
|
|
|
|
do_tunable_update_val (cur, valp, minp, maxp);
|
|
}
|
|
|
|
#if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
|
|
/* Parse the tunable string TUNESTR and adjust it to drop any tunables that may
|
|
be unsafe for AT_SECURE processes so that it can be used as the new
|
|
environment variable value for GLIBC_TUNABLES. VALSTRING is the original
|
|
environment variable string which we use to make NULL terminated values so
|
|
that we don't have to allocate memory again for it. */
|
|
static void
|
|
parse_tunables (char *tunestr, char *valstring)
|
|
{
|
|
if (tunestr == NULL || *tunestr == '\0')
|
|
return;
|
|
|
|
char *p = tunestr;
|
|
|
|
while (true)
|
|
{
|
|
char *name = p;
|
|
size_t len = 0;
|
|
|
|
/* First, find where the name ends. */
|
|
while (p[len] != '=' && p[len] != ':' && p[len] != '\0')
|
|
len++;
|
|
|
|
/* If we reach the end of the string before getting a valid name-value
|
|
pair, bail out. */
|
|
if (p[len] == '\0')
|
|
return;
|
|
|
|
/* We did not find a valid name-value pair before encountering the
|
|
colon. */
|
|
if (p[len]== ':')
|
|
{
|
|
p += len + 1;
|
|
continue;
|
|
}
|
|
|
|
p += len + 1;
|
|
|
|
/* Take the value from the valstring since we need to NULL terminate it. */
|
|
char *value = &valstring[p - tunestr];
|
|
len = 0;
|
|
|
|
while (p[len] != ':' && p[len] != '\0')
|
|
len++;
|
|
|
|
/* Add the tunable if it exists. */
|
|
for (size_t i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
|
|
{
|
|
tunable_t *cur = &tunable_list[i];
|
|
|
|
if (tunable_is_name (cur->name, name))
|
|
{
|
|
/* If we are in a secure context (AT_SECURE) then ignore the tunable
|
|
unless it is explicitly marked as secure. Tunable values take
|
|
precedence over their envvar aliases. */
|
|
if (__libc_enable_secure)
|
|
{
|
|
if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
|
|
{
|
|
if (p[len] == '\0')
|
|
{
|
|
/* Last tunable in the valstring. Null-terminate and
|
|
return. */
|
|
*name = '\0';
|
|
return;
|
|
}
|
|
else
|
|
{
|
|
/* Remove the current tunable from the string. We do
|
|
this by overwriting the string starting from NAME
|
|
(which is where the current tunable begins) with
|
|
the remainder of the string. We then have P point
|
|
to NAME so that we continue in the correct
|
|
position in the valstring. */
|
|
char *q = &p[len + 1];
|
|
p = name;
|
|
while (*q != '\0')
|
|
*name++ = *q++;
|
|
name[0] = '\0';
|
|
len = 0;
|
|
}
|
|
}
|
|
|
|
if (cur->security_level != TUNABLE_SECLEVEL_NONE)
|
|
break;
|
|
}
|
|
|
|
value[len] = '\0';
|
|
tunable_initialize (cur, value);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (p[len] == '\0')
|
|
return;
|
|
else
|
|
p += len + 1;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
|
|
the system administrator has created the /etc/suid-debug file. This is a
|
|
special case where we want to conditionally enable/disable a tunable even
|
|
for setuid binaries. We use the special version of access() to avoid
|
|
setting ERRNO, which is a TLS variable since TLS has not yet been set
|
|
up. */
|
|
static __always_inline void
|
|
maybe_enable_malloc_check (void)
|
|
{
|
|
tunable_id_t id = TUNABLE_ENUM_NAME (glibc, malloc, check);
|
|
if (__libc_enable_secure && __access_noerrno ("/etc/suid-debug", F_OK) == 0)
|
|
tunable_list[id].security_level = TUNABLE_SECLEVEL_NONE;
|
|
}
|
|
|
|
/* Initialize the tunables list from the environment. For now we only use the
|
|
ENV_ALIAS to find values. Later we will also use the tunable names to find
|
|
values. */
|
|
void
|
|
__tunables_init (char **envp)
|
|
{
|
|
char *envname = NULL;
|
|
char *envval = NULL;
|
|
size_t len = 0;
|
|
char **prev_envp = envp;
|
|
|
|
maybe_enable_malloc_check ();
|
|
|
|
while ((envp = get_next_env (envp, &envname, &len, &envval,
|
|
&prev_envp)) != NULL)
|
|
{
|
|
#if TUNABLES_FRONTEND == TUNABLES_FRONTEND_valstring
|
|
if (tunable_is_name (GLIBC_TUNABLES, envname))
|
|
{
|
|
char *new_env = tunables_strdup (envname);
|
|
if (new_env != NULL)
|
|
parse_tunables (new_env + len + 1, envval);
|
|
/* Put in the updated envval. */
|
|
*prev_envp = new_env;
|
|
continue;
|
|
}
|
|
#endif
|
|
|
|
for (int i = 0; i < sizeof (tunable_list) / sizeof (tunable_t); i++)
|
|
{
|
|
tunable_t *cur = &tunable_list[i];
|
|
|
|
/* Skip over tunables that have either been set already or should be
|
|
skipped. */
|
|
if (cur->initialized || cur->env_alias == NULL)
|
|
continue;
|
|
|
|
const char *name = cur->env_alias;
|
|
|
|
/* We have a match. Initialize and move on to the next line. */
|
|
if (tunable_is_name (name, envname))
|
|
{
|
|
/* For AT_SECURE binaries, we need to check the security settings of
|
|
the tunable and decide whether we read the value and also whether
|
|
we erase the value so that child processes don't inherit them in
|
|
the environment. */
|
|
if (__libc_enable_secure)
|
|
{
|
|
if (cur->security_level == TUNABLE_SECLEVEL_SXID_ERASE)
|
|
{
|
|
/* Erase the environment variable. */
|
|
char **ep = prev_envp;
|
|
|
|
while (*ep != NULL)
|
|
{
|
|
if (tunable_is_name (name, *ep))
|
|
{
|
|
char **dp = ep;
|
|
|
|
do
|
|
dp[0] = dp[1];
|
|
while (*dp++);
|
|
}
|
|
else
|
|
++ep;
|
|
}
|
|
/* Reset the iterator so that we read the environment again
|
|
from the point we erased. */
|
|
envp = prev_envp;
|
|
}
|
|
|
|
if (cur->security_level != TUNABLE_SECLEVEL_NONE)
|
|
continue;
|
|
}
|
|
|
|
tunable_initialize (cur, envval);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Set the tunable value. This is called by the module that the tunable exists
|
|
in. */
|
|
void
|
|
__tunable_get_val (tunable_id_t id, void *valp, tunable_callback_t callback)
|
|
{
|
|
tunable_t *cur = &tunable_list[id];
|
|
|
|
switch (cur->type.type_code)
|
|
{
|
|
case TUNABLE_TYPE_UINT_64:
|
|
{
|
|
*((uint64_t *) valp) = (uint64_t) cur->val.numval;
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_INT_32:
|
|
{
|
|
*((int32_t *) valp) = (int32_t) cur->val.numval;
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_SIZE_T:
|
|
{
|
|
*((size_t *) valp) = (size_t) cur->val.numval;
|
|
break;
|
|
}
|
|
case TUNABLE_TYPE_STRING:
|
|
{
|
|
*((const char **)valp) = cur->val.strval;
|
|
break;
|
|
}
|
|
default:
|
|
__builtin_unreachable ();
|
|
}
|
|
|
|
if (cur->initialized && callback != NULL)
|
|
callback (&cur->val);
|
|
}
|
|
|
|
rtld_hidden_def (__tunable_get_val)
|