1 /*
2 * Copyright (C) 2010 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
29 #include "linker_environ.h"
31 #include <linux/auxvec.h>
32 #include <stddef.h>
33 #include <stdlib.h>
34 #include <unistd.h>
36 static char** _envp;
37 static bool _AT_SECURE_value = true;
39 bool get_AT_SECURE() {
40 return _AT_SECURE_value;
41 }
43 static void __init_AT_SECURE(unsigned* auxv) {
44 // Check auxv for AT_SECURE first to see if program is setuid, setgid,
45 // has file caps, or caused a SELinux/AppArmor domain transition.
46 for (unsigned* v = auxv; v[0]; v += 2) {
47 if (v[0] == AT_SECURE) {
48 // Kernel told us whether to enable secure mode.
49 _AT_SECURE_value = v[1];
50 return;
51 }
52 }
54 // We don't support ancient kernels.
55 const char* msg = "FATAL: kernel did not supply AT_SECURE\n";
56 write(2, msg, strlen(msg));
57 exit(EXIT_FAILURE);
58 }
60 // Check if the environment variable definition at 'envstr'
61 // starts with '<name>=', and if so return the address of the
62 // first character after the equal sign. Otherwise return NULL.
63 static const char* env_match(const char* envstr, const char* name) {
64 size_t i = 0;
66 while (envstr[i] == name[i] && name[i] != '\0') {
67 ++i;
68 }
70 if (name[i] == '\0' && envstr[i] == '=') {
71 return envstr + i + 1;
72 }
74 return NULL;
75 }
77 static bool __is_valid_environment_variable(const char* name) {
78 // According to its sources, the kernel uses 32*PAGE_SIZE by default
79 // as the maximum size for an env. variable definition.
80 const int MAX_ENV_LEN = 32*4096;
82 if (name == NULL) {
83 return false;
84 }
86 // Parse the string, looking for the first '=' there, and its size.
87 int pos = 0;
88 int first_equal_pos = -1;
89 while (pos < MAX_ENV_LEN) {
90 if (name[pos] == '\0') {
91 break;
92 }
93 if (name[pos] == '=' && first_equal_pos < 0) {
94 first_equal_pos = pos;
95 }
96 pos++;
97 }
99 // Check that it's smaller than MAX_ENV_LEN (to detect non-zero terminated strings).
100 if (pos >= MAX_ENV_LEN) {
101 return false;
102 }
104 // Check that it contains at least one equal sign that is not the first character
105 if (first_equal_pos < 1) {
106 return false;
107 }
109 return true;
110 }
112 static bool __is_unsafe_environment_variable(const char* name) {
113 // None of these should be allowed in setuid programs.
114 static const char* const UNSAFE_VARIABLE_NAMES[] = {
115 "GCONV_PATH",
116 "GETCONF_DIR",
117 "HOSTALIASES",
118 "LD_AOUT_LIBRARY_PATH",
119 "LD_AOUT_PRELOAD",
120 "LD_AUDIT",
121 "LD_DEBUG",
122 "LD_DEBUG_OUTPUT",
123 "LD_DYNAMIC_WEAK",
124 "LD_LIBRARY_PATH",
125 "LD_ORIGIN_PATH",
126 "LD_PRELOAD",
127 "LD_PROFILE",
128 "LD_SHOW_AUXV",
129 "LD_USE_LOAD_BIAS",
130 "LOCALDOMAIN",
131 "LOCPATH",
132 "MALLOC_CHECK_",
133 "MALLOC_TRACE",
134 "NIS_PATH",
135 "NLSPATH",
136 "RESOLV_HOST_CONF",
137 "RES_OPTIONS",
138 "TMPDIR",
139 "TZDIR",
140 NULL
141 };
142 for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != NULL; ++i) {
143 if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != NULL) {
144 return true;
145 }
146 }
147 return false;
148 }
150 static void __sanitize_environment_variables() {
151 char** src = _envp;
152 char** dst = _envp;
153 for (; src[0] != NULL; ++src) {
154 if (!__is_valid_environment_variable(src[0])) {
155 continue;
156 }
157 // Remove various unsafe environment variables if we're loading a setuid program.
158 if (get_AT_SECURE() && __is_unsafe_environment_variable(src[0])) {
159 continue;
160 }
161 dst[0] = src[0];
162 ++dst;
163 }
164 dst[0] = NULL;
165 }
167 unsigned* linker_env_init(unsigned* environment_and_aux_vectors) {
168 // Store environment pointer - can't be NULL.
169 _envp = reinterpret_cast<char**>(environment_and_aux_vectors);
171 // Skip over all environment variable definitions.
172 // The end of the environment block is marked by two NULL pointers.
173 unsigned* aux_vectors = environment_and_aux_vectors;
174 while (aux_vectors[0] != 0) {
175 ++aux_vectors;
176 }
177 ++aux_vectors;
179 __init_AT_SECURE(aux_vectors);
180 __sanitize_environment_variables();
182 return aux_vectors;
183 }
185 const char* linker_env_get(const char* name) {
186 if (name == NULL || name[0] == '\0') {
187 return NULL;
188 }
190 for (char** p = _envp; p[0] != NULL; ++p) {
191 const char* val = env_match(p[0], name);
192 if (val != NULL) {
193 if (val[0] == '\0') {
194 return NULL; // Return NULL for empty strings.
195 }
196 return val;
197 }
198 }
199 return NULL;
200 }