xref: /illumos-gate/usr/src/cmd/sgs/rtld/common/util.c (revision 67d74cc3)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1988 AT&T
24  *	  All Rights Reserved
25  *
26  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
27  */
28 
29 /*
30  * Copyright (c) 2014 by Delphix. All rights reserved.
31  */
32 
33 /*
34  * Utility routines for run-time linker.  some are duplicated here from libc
35  * (with different names) to avoid name space collisions.
36  */
37 #include	<sys/systeminfo.h>
38 #include	<stdio.h>
39 #include	<sys/time.h>
40 #include	<sys/types.h>
41 #include	<sys/mman.h>
42 #include	<sys/lwp.h>
43 #include	<sys/debug.h>
44 #include	<stdarg.h>
45 #include	<fcntl.h>
46 #include	<string.h>
47 #include	<dlfcn.h>
48 #include	<unistd.h>
49 #include	<stdlib.h>
50 #include	<sys/auxv.h>
51 #include	<limits.h>
52 #include	<debug.h>
53 #include	<conv.h>
54 #include	"_rtld.h"
55 #include	"_audit.h"
56 #include	"_elf.h"
57 #include	"msg.h"
58 
59 /*
60  * Null function used as place where a debugger can set a breakpoint.
61  */
62 void
rtld_db_dlactivity(Lm_list * lml)63 rtld_db_dlactivity(Lm_list *lml)
64 {
65 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
66 	    r_debug.rtd_rdebug.r_state));
67 }
68 
69 /*
70  * Null function used as place where debugger can set a pre .init
71  * processing breakpoint.
72  */
73 void
rtld_db_preinit(Lm_list * lml)74 rtld_db_preinit(Lm_list *lml)
75 {
76 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
77 	    r_debug.rtd_rdebug.r_state));
78 }
79 
80 /*
81  * Null function used as place where debugger can set a post .init
82  * processing breakpoint.
83  */
84 void
rtld_db_postinit(Lm_list * lml)85 rtld_db_postinit(Lm_list *lml)
86 {
87 	DBG_CALL(Dbg_util_dbnotify(lml, r_debug.rtd_rdebug.r_rdevent,
88 	    r_debug.rtd_rdebug.r_state));
89 }
90 
91 /*
92  * Debugger Event Notification
93  *
94  * This function centralizes all debugger event notification (ala rtld_db).
95  *
96  * There's a simple intent, focused on insuring the primary link-map control
97  * list (or each link-map list) is consistent, and the indication that objects
98  * have been added or deleted from this list.  Although an RD_ADD and RD_DELETE
99  * event are posted for each of these, most debuggers don't care, as their
100  * view is that these events simply convey an "inconsistent" state.
101  *
102  * We also don't want to trigger multiple RD_ADD/RD_DELETE events any time we
103  * enter ld.so.1.
104  *
105  * Set an RD_ADD/RD_DELETE event and indicate that an RD_CONSISTENT event is
106  * required later (RT_FL_DBNOTIF):
107  *
108  *  i.	the first time we add or delete an object to the primary link-map
109  *	control list.
110  *  ii.	the first time we move a secondary link-map control list to the primary
111  *	link-map control list (effectively, this is like adding a group of
112  *	objects to the primary link-map control list).
113  *
114  * Set an RD_CONSISTENT event when it is required (RT_FL_DBNOTIF is set):
115  *
116  *  i.	each time we leave the runtime linker.
117  */
118 void
rd_event(Lm_list * lml,rd_event_e event,r_state_e state)119 rd_event(Lm_list *lml, rd_event_e event, r_state_e state)
120 {
121 	void	(*fptr)(Lm_list *);
122 
123 	switch (event) {
124 	case RD_PREINIT:
125 		fptr = rtld_db_preinit;
126 		break;
127 	case RD_POSTINIT:
128 		fptr = rtld_db_postinit;
129 		break;
130 	case RD_DLACTIVITY:
131 		switch (state) {
132 		case RT_CONSISTENT:
133 			/*
134 			 * Do we need to send a notification?
135 			 */
136 			if ((rtld_flags & RT_FL_DBNOTIF) == 0)
137 				return;
138 			rtld_flags &= ~RT_FL_DBNOTIF;
139 			break;
140 		case RT_ADD:
141 		case RT_DELETE:
142 			/*
143 			 * If we are already in an inconsistent state, no
144 			 * notification is required.
145 			 */
146 			if (rtld_flags & RT_FL_DBNOTIF)
147 				return;
148 			rtld_flags |= RT_FL_DBNOTIF;
149 			break;
150 		};
151 		fptr = rtld_db_dlactivity;
152 		break;
153 	default:
154 		/*
155 		 * RD_NONE - do nothing
156 		 */
157 		break;
158 	};
159 
160 	/*
161 	 * Set event state and call 'notification' function.
162 	 *
163 	 * The debugging clients have previously been told about these
164 	 * notification functions and have set breakpoints on them if they
165 	 * are interested in the notification.
166 	 */
167 	r_debug.rtd_rdebug.r_state = state;
168 	r_debug.rtd_rdebug.r_rdevent = event;
169 	fptr(lml);
170 	r_debug.rtd_rdebug.r_rdevent = RD_NONE;
171 }
172 
173 #if	defined(__sparc) || defined(__x86)
174 /*
175  * Stack Cleanup.
176  *
177  * This function is invoked to 'remove' arguments that were passed in on the
178  * stack.  This is most likely if ld.so.1 was invoked directly.  In that case
179  * we want to remove ld.so.1 as well as it's arguments from the argv[] array.
180  * Which means we then need to slide everything above it on the stack down
181  * accordingly.
182  *
183  * While the stack layout is platform specific - it just so happens that __x86,
184  * and __sparc platforms share the following initial stack layout.
185  *
186  *	!_______________________!  high addresses
187  *	!			!
188  *	!	Information	!
189  *	!	Block		!
190  *	!	(size varies)	!
191  *	!_______________________!
192  *	!	0 word		!
193  *	!_______________________!
194  *	!	Auxiliary	!
195  *	!	vector		!
196  *	!	2 word entries	!
197  *	!			!
198  *	!_______________________!
199  *	!	0 word		!
200  *	!_______________________!
201  *	!	Environment	!
202  *	!	pointers	!
203  *	!	...		!
204  *	!	(one word each)	!
205  *	!_______________________!
206  *	!	0 word		!
207  *	!_______________________!
208  *	!	Argument	! low addresses
209  *	!	pointers	!
210  *	!	Argc words	!
211  *	!_______________________!
212  *	!			!
213  *	!	Argc		!
214  *	!_______________________!
215  *	!	...		!
216  *
217  */
218 static void
stack_cleanup(char ** argv,char *** envp,auxv_t ** auxv,int rmcnt)219 stack_cleanup(char **argv, char ***envp, auxv_t **auxv, int rmcnt)
220 {
221 	int		ndx;
222 	long		*argc;
223 	char		**oargv, **nargv;
224 	char		**oenvp, **nenvp;
225 	auxv_t		*oauxv, *nauxv;
226 
227 	/*
228 	 * Slide ARGV[] and update argc.  The argv pointer remains the same,
229 	 * however slide the applications arguments over the arguments to
230 	 * ld.so.1.
231 	 */
232 	nargv = &argv[0];
233 	oargv = &argv[rmcnt];
234 
235 	for (ndx = 0; oargv[ndx]; ndx++)
236 		nargv[ndx] = oargv[ndx];
237 	nargv[ndx] = oargv[ndx];
238 
239 	argc = (long *)((uintptr_t)argv - sizeof (long *));
240 	*argc -= rmcnt;
241 
242 	/*
243 	 * Slide ENVP[], and update the environment array pointer.
244 	 */
245 	ndx++;
246 	nenvp = &nargv[ndx];
247 	oenvp = &oargv[ndx];
248 	*envp = nenvp;
249 
250 	for (ndx = 0; oenvp[ndx]; ndx++)
251 		nenvp[ndx] = oenvp[ndx];
252 	nenvp[ndx] = oenvp[ndx];
253 
254 	/*
255 	 * Slide AUXV[], and update the aux vector pointer.
256 	 */
257 	ndx++;
258 	nauxv = (auxv_t *)&nenvp[ndx];
259 	oauxv = (auxv_t *)&oenvp[ndx];
260 	*auxv = nauxv;
261 
262 	for (ndx = 0; (oauxv[ndx].a_type != AT_NULL); ndx++)
263 		nauxv[ndx] = oauxv[ndx];
264 	nauxv[ndx] = oauxv[ndx];
265 }
266 #else
267 /*
268  * Verify that the above routine is appropriate for any new platforms.
269  */
270 #error	unsupported architecture!
271 #endif
272 
273 /*
274  * Compare function for PathNode AVL tree.
275  */
276 static int
pnavl_compare(const void * n1,const void * n2)277 pnavl_compare(const void *n1, const void *n2)
278 {
279 	uint_t		hash1, hash2;
280 	const char	*st1, *st2;
281 	int		rc;
282 
283 	hash1 = ((PathNode *)n1)->pn_hash;
284 	hash2 = ((PathNode *)n2)->pn_hash;
285 
286 	if (hash1 > hash2)
287 		return (1);
288 	if (hash1 < hash2)
289 		return (-1);
290 
291 	st1 = ((PathNode *)n1)->pn_name;
292 	st2 = ((PathNode *)n2)->pn_name;
293 
294 	rc = strcmp(st1, st2);
295 	if (rc > 0)
296 		return (1);
297 	if (rc < 0)
298 		return (-1);
299 	return (0);
300 }
301 
302 /*
303  * Create an AVL tree.
304  */
305 static avl_tree_t *
pnavl_create(size_t size)306 pnavl_create(size_t size)
307 {
308 	avl_tree_t	*avlt;
309 
310 	if ((avlt = malloc(sizeof (avl_tree_t))) == NULL)
311 		return (NULL);
312 	avl_create(avlt, pnavl_compare, size, SGSOFFSETOF(PathNode, pn_avl));
313 	return (avlt);
314 }
315 
316 /*
317  * Determine whether a PathNode is recorded.
318  */
319 int
pnavl_recorded(avl_tree_t ** pnavl,const char * name,uint_t hash,avl_index_t * where)320 pnavl_recorded(avl_tree_t **pnavl, const char *name, uint_t hash,
321     avl_index_t *where)
322 {
323 	PathNode	pn;
324 
325 	/*
326 	 * Create the avl tree if required.
327 	 */
328 	if ((*pnavl == NULL) &&
329 	    ((*pnavl = pnavl_create(sizeof (PathNode))) == NULL))
330 		return (0);
331 
332 	pn.pn_name = name;
333 	if ((pn.pn_hash = hash) == 0)
334 		pn.pn_hash = sgs_str_hash(name);
335 
336 	if (avl_find(*pnavl, &pn, where) == NULL)
337 		return (0);
338 
339 	return (1);
340 }
341 
342 /*
343  * Determine if a pathname has already been recorded on the full path name
344  * AVL tree.  This tree maintains a node for each path name that ld.so.1 has
345  * successfully loaded.  If the path name does not exist in this AVL tree, then
346  * the next insertion point is deposited in "where".  This value can be used by
347  * fpavl_insert() to expedite the insertion.
348  */
349 Rt_map *
fpavl_recorded(Lm_list * lml,const char * name,uint_t hash,avl_index_t * where)350 fpavl_recorded(Lm_list *lml, const char *name, uint_t hash, avl_index_t *where)
351 {
352 	FullPathNode	fpn, *fpnp;
353 
354 	/*
355 	 * Create the avl tree if required.
356 	 */
357 	if ((lml->lm_fpavl == NULL) &&
358 	    ((lml->lm_fpavl = pnavl_create(sizeof (FullPathNode))) == NULL))
359 		return (NULL);
360 
361 	fpn.fpn_node.pn_name = name;
362 	if ((fpn.fpn_node.pn_hash = hash) == 0)
363 		fpn.fpn_node.pn_hash = sgs_str_hash(name);
364 
365 	if ((fpnp = avl_find(lml->lm_fpavl, &fpn, where)) == NULL)
366 		return (NULL);
367 
368 	return (fpnp->fpn_lmp);
369 }
370 
371 /*
372  * Insert a name into the FullPathNode AVL tree for the link-map list.  The
373  * objects NAME() is the path that would have originally been searched for, and
374  * is therefore the name to associate with any "where" value.  If the object has
375  * a different PATHNAME(), perhaps because it has resolved to a different file
376  * (see fullpath()), then this name will be recorded as a separate FullPathNode
377  * (see load_file()).
378  */
379 int
fpavl_insert(Lm_list * lml,Rt_map * lmp,const char * name,avl_index_t where)380 fpavl_insert(Lm_list *lml, Rt_map *lmp, const char *name, avl_index_t where)
381 {
382 	FullPathNode	*fpnp;
383 	uint_t		hash = sgs_str_hash(name);
384 
385 	if (where == 0) {
386 		/* LINTED */
387 		Rt_map	*_lmp = fpavl_recorded(lml, name, hash, &where);
388 
389 		/*
390 		 * We better not get a hit now, we do not want duplicates in
391 		 * the tree.
392 		 */
393 		ASSERT(_lmp == NULL);
394 	}
395 
396 	/*
397 	 * Insert new node in tree.
398 	 */
399 	if ((fpnp = calloc(sizeof (FullPathNode), 1)) == NULL)
400 		return (0);
401 
402 	fpnp->fpn_node.pn_name = name;
403 	fpnp->fpn_node.pn_hash = hash;
404 	fpnp->fpn_lmp = lmp;
405 
406 	if (aplist_append(&FPNODE(lmp), fpnp, AL_CNT_FPNODE) == NULL) {
407 		free(fpnp);
408 		return (0);
409 	}
410 
411 	ASSERT(lml->lm_fpavl != NULL);
412 	avl_insert(lml->lm_fpavl, fpnp, where);
413 	return (1);
414 }
415 
416 /*
417  * Remove an object from the FullPathNode AVL tree.
418  */
419 void
fpavl_remove(Rt_map * lmp)420 fpavl_remove(Rt_map *lmp)
421 {
422 	FullPathNode	*fpnp;
423 	Aliste		idx;
424 
425 	for (APLIST_TRAVERSE(FPNODE(lmp), idx, fpnp)) {
426 		avl_remove(LIST(lmp)->lm_fpavl, fpnp);
427 		free(fpnp);
428 	}
429 	free(FPNODE(lmp));
430 	FPNODE(lmp) = NULL;
431 }
432 
433 /*
434  * Insert a path name into the not-found AVL tree.
435  *
436  * This tree maintains a node for each path name that ld.so.1 has explicitly
437  * inspected, but has failed to load during a single ld.so.1 operation.  If the
438  * path name does not exist in this AVL tree, then the next insertion point is
439  * deposited in "where".  This value can be used by nfavl_insert() to expedite
440  * the insertion.
441  */
442 void
nfavl_insert(const char * name,avl_index_t where)443 nfavl_insert(const char *name, avl_index_t where)
444 {
445 	PathNode	*pnp;
446 	uint_t		hash = sgs_str_hash(name);
447 
448 	if (where == 0) {
449 		/* LINTED */
450 		int	in_nfavl = pnavl_recorded(&nfavl, name, hash, &where);
451 
452 		/*
453 		 * We better not get a hit now, we do not want duplicates in
454 		 * the tree.
455 		 */
456 		ASSERT(in_nfavl == 0);
457 	}
458 
459 	/*
460 	 * Insert new node in tree.
461 	 */
462 	if ((pnp = calloc(sizeof (PathNode), 1)) != NULL) {
463 		pnp->pn_name = name;
464 		pnp->pn_hash = hash;
465 		avl_insert(nfavl, pnp, where);
466 	}
467 }
468 
469 /*
470  * Insert the directory name, of a full path name, into the secure path AVL
471  * tree.
472  *
473  * This tree is used to maintain a list of directories in which the dependencies
474  * of a secure process have been found.  This list provides a fall-back in the
475  * case that a $ORIGIN expansion is deemed insecure, when the expansion results
476  * in a path name that has already provided dependencies.
477  */
478 void
spavl_insert(const char * name)479 spavl_insert(const char *name)
480 {
481 	char		buffer[PATH_MAX], *str;
482 	size_t		size;
483 	avl_index_t	where;
484 	PathNode	*pnp;
485 	uint_t		hash;
486 
487 	/*
488 	 * Separate the directory name from the path name.
489 	 */
490 	if ((str = strrchr(name, '/')) == name)
491 		size = 1;
492 	else
493 		size = str - name;
494 
495 	(void) strncpy(buffer, name, size);
496 	buffer[size] = '\0';
497 	hash = sgs_str_hash(buffer);
498 
499 	/*
500 	 * Determine whether this directory name is already recorded, or if
501 	 * not, 'where" will provide the insertion point for the new string.
502 	 */
503 	if (pnavl_recorded(&spavl, buffer, hash, &where))
504 		return;
505 
506 	/*
507 	 * Insert new node in tree.
508 	 */
509 	if ((pnp = calloc(sizeof (PathNode), 1)) != NULL) {
510 		pnp->pn_name = strdup(buffer);
511 		pnp->pn_hash = hash;
512 		avl_insert(spavl, pnp, where);
513 	}
514 }
515 
516 /*
517  * Inspect the generic string AVL tree for the given string.  If the string is
518  * not present, duplicate it, and insert the string in the AVL tree.  Return the
519  * duplicated string to the caller.
520  *
521  * These strings are maintained for the life of ld.so.1 and represent path
522  * names, file names, and search paths.  All other AVL trees that maintain
523  * FullPathNode and not-found path names use the same string pointer
524  * established for this string.
525  */
526 static avl_tree_t	*stravl = NULL;
527 static char		*strbuf = NULL;
528 static PathNode		*pnbuf = NULL;
529 static size_t		strsize = 0, pnsize = 0;
530 
531 const char *
stravl_insert(const char * name,uint_t hash,size_t nsize,int substr)532 stravl_insert(const char *name, uint_t hash, size_t nsize, int substr)
533 {
534 	char		str[PATH_MAX];
535 	PathNode	*pnp;
536 	avl_index_t	where;
537 
538 	/*
539 	 * Create the avl tree if required.
540 	 */
541 	if ((stravl == NULL) &&
542 	    ((stravl = pnavl_create(sizeof (PathNode))) == NULL))
543 		return (NULL);
544 
545 	/*
546 	 * Determine the string size if not provided by the caller.
547 	 */
548 	if (nsize == 0)
549 		nsize = strlen(name) + 1;
550 	else if (substr) {
551 		/*
552 		 * The string passed to us may be a multiple path string for
553 		 * which we only need the first component.  Using the provided
554 		 * size, strip out the required string.
555 		 */
556 		(void) strncpy(str, name, nsize);
557 		str[nsize - 1] = '\0';
558 		name = str;
559 	}
560 
561 	/*
562 	 * Allocate a PathNode buffer if one doesn't exist, or any existing
563 	 * buffer has been used up.
564 	 */
565 	if ((pnbuf == NULL) || (sizeof (PathNode) > pnsize)) {
566 		pnsize = syspagsz;
567 		if ((pnbuf = dz_map(0, 0, pnsize, (PROT_READ | PROT_WRITE),
568 		    MAP_PRIVATE)) == MAP_FAILED)
569 			return (NULL);
570 	}
571 	/*
572 	 * Determine whether this string already exists.
573 	 */
574 	pnbuf->pn_name = name;
575 	if ((pnbuf->pn_hash = hash) == 0)
576 		pnbuf->pn_hash = sgs_str_hash(name);
577 
578 	if ((pnp = avl_find(stravl, pnbuf, &where)) != NULL)
579 		return (pnp->pn_name);
580 
581 	/*
582 	 * Allocate a string buffer if one does not exist, or if there is
583 	 * insufficient space for the new string in any existing buffer.
584 	 */
585 	if ((strbuf == NULL) || (nsize > strsize)) {
586 		strsize = S_ROUND(nsize, syspagsz);
587 
588 		if ((strbuf = dz_map(0, 0, strsize, (PROT_READ | PROT_WRITE),
589 		    MAP_PRIVATE)) == MAP_FAILED)
590 			return (NULL);
591 	}
592 
593 	(void) memcpy(strbuf, name, nsize);
594 	pnp = pnbuf;
595 	pnp->pn_name = strbuf;
596 	avl_insert(stravl, pnp, where);
597 
598 	strbuf += nsize;
599 	strsize -= nsize;
600 	pnbuf++;
601 	pnsize -= sizeof (PathNode);
602 	return (pnp->pn_name);
603 }
604 
605 /*
606  * Prior to calling an object, either via a .plt or through dlsym(), make sure
607  * its .init has fired.  Through topological sorting, ld.so.1 attempts to fire
608  * init's in the correct order, however, this order is typically based on needed
609  * dependencies and non-lazy relocation bindings.  Lazy relocations (.plts) can
610  * still occur and result in bindings that were not captured during topological
611  * sorting.  This routine compensates for this lack of binding information, and
612  * provides for dynamic .init firing.
613  */
614 void
is_dep_init(Rt_map * dlmp,Rt_map * clmp)615 is_dep_init(Rt_map *dlmp, Rt_map *clmp)
616 {
617 	Rt_map	**tobj;
618 
619 	/*
620 	 * If the caller is an auditor, and the destination isn't, then don't
621 	 * run any .inits (see comments in load_completion()).
622 	 */
623 	if ((LIST(clmp)->lm_tflags & LML_TFLG_NOAUDIT) &&
624 	    ((LIST(dlmp)->lm_tflags & LML_TFLG_NOAUDIT) == 0))
625 		return;
626 
627 	if ((dlmp == clmp) || (rtld_flags & RT_FL_INITFIRST))
628 		return;
629 
630 	(void) rt_mutex_lock(&dlmp->rt_lock);
631 	while (dlmp->rt_init_thread != rt_thr_self() && (FLAGS(dlmp) &
632 	    (FLG_RT_RELOCED | FLG_RT_INITCALL | FLG_RT_INITDONE)) ==
633 	    (FLG_RT_RELOCED | FLG_RT_INITCALL)) {
634 		leave(LIST(dlmp), 0);
635 		(void) _lwp_cond_wait(&dlmp->rt_cv, (mutex_t *)&dlmp->rt_lock);
636 		(void) rt_mutex_unlock(&dlmp->rt_lock);
637 		(void) enter(0);
638 		(void) rt_mutex_lock(&dlmp->rt_lock);
639 	}
640 	(void) rt_mutex_unlock(&dlmp->rt_lock);
641 
642 	if ((FLAGS(dlmp) & (FLG_RT_RELOCED | FLG_RT_INITDONE)) ==
643 	    (FLG_RT_RELOCED | FLG_RT_INITDONE))
644 		return;
645 
646 	if ((tobj = calloc(2, sizeof (Rt_map *))) != NULL) {
647 		tobj[0] = dlmp;
648 		call_init(tobj, DBG_INIT_DYN);
649 	}
650 }
651 
652 /*
653  * Execute .{preinit|init|fini}array sections
654  */
655 void
call_array(Addr * array,uint_t arraysz,Rt_map * lmp,Word shtype)656 call_array(Addr *array, uint_t arraysz, Rt_map *lmp, Word shtype)
657 {
658 	int	start, stop, incr, ndx;
659 	uint_t	arraycnt = (uint_t)(arraysz / sizeof (Addr));
660 
661 	if (array == NULL)
662 		return;
663 
664 	/*
665 	 * initarray & preinitarray are walked from beginning to end - while
666 	 * finiarray is walked from end to beginning.
667 	 */
668 	if (shtype == SHT_FINI_ARRAY) {
669 		start = arraycnt - 1;
670 		stop = incr = -1;
671 	} else {
672 		start = 0;
673 		stop = arraycnt;
674 		incr = 1;
675 	}
676 
677 	/*
678 	 * Call the .*array[] entries
679 	 */
680 	for (ndx = start; ndx != stop; ndx += incr) {
681 		uint_t	rtldflags;
682 		void	(*fptr)(void) = (void(*)())array[ndx];
683 
684 		DBG_CALL(Dbg_util_call_array(lmp, (void *)fptr, ndx, shtype));
685 
686 		APPLICATION_ENTER(rtldflags);
687 		leave(LIST(lmp), 0);
688 		(*fptr)();
689 		(void) enter(0);
690 		APPLICATION_RETURN(rtldflags);
691 	}
692 }
693 
694 /*
695  * Execute any .init sections.  These are passed to us in an lmp array which
696  * (by default) will have been sorted.
697  */
698 void
call_init(Rt_map ** tobj,int flag)699 call_init(Rt_map **tobj, int flag)
700 {
701 	Rt_map		**_tobj, **_nobj;
702 	static APlist	*pending = NULL;
703 
704 	/*
705 	 * If we're in the middle of an INITFIRST, this must complete before
706 	 * any new init's are fired.  In this case add the object list to the
707 	 * pending queue and return.  We'll pick up the queue after any
708 	 * INITFIRST objects have their init's fired.
709 	 */
710 	if (rtld_flags & RT_FL_INITFIRST) {
711 		(void) aplist_append(&pending, tobj, AL_CNT_PENDING);
712 		return;
713 	}
714 
715 	/*
716 	 * Traverse the tobj array firing each objects init.
717 	 */
718 	for (_tobj = _nobj = tobj, _nobj++; *_tobj != NULL; _tobj++, _nobj++) {
719 		Rt_map	*lmp = *_tobj;
720 		void	(*iptr)() = INIT(lmp);
721 
722 		if (FLAGS(lmp) & FLG_RT_INITCALL)
723 			continue;
724 
725 		FLAGS(lmp) |= FLG_RT_INITCALL;
726 		lmp->rt_init_thread = rt_thr_self();
727 
728 		/*
729 		 * Establish an initfirst state if necessary - no other inits
730 		 * will be fired (because of additional relocation bindings)
731 		 * when in this state.
732 		 */
733 		if (FLAGS(lmp) & FLG_RT_INITFRST)
734 			rtld_flags |= RT_FL_INITFIRST;
735 
736 		if (INITARRAY(lmp) || iptr)
737 			DBG_CALL(Dbg_util_call_init(lmp, flag));
738 
739 		if (iptr) {
740 			uint_t	rtldflags;
741 
742 			APPLICATION_ENTER(rtldflags);
743 			leave(LIST(lmp), 0);
744 			(*iptr)();
745 			(void) enter(0);
746 			APPLICATION_RETURN(rtldflags);
747 		}
748 
749 		call_array(INITARRAY(lmp), INITARRAYSZ(lmp), lmp,
750 		    SHT_INIT_ARRAY);
751 
752 		if (INITARRAY(lmp) || iptr)
753 			DBG_CALL(Dbg_util_call_init(lmp, DBG_INIT_DONE));
754 
755 		/*
756 		 * Set the initdone flag regardless of whether this object
757 		 * actually contains an .init section.  This flag prevents us
758 		 * from processing this section again for an .init and also
759 		 * signifies that a .fini must be called should it exist.
760 		 * Clear the sort field for use in later .fini processing.
761 		 */
762 		(void) rt_mutex_lock(&lmp->rt_lock);
763 		FLAGS(lmp) |= FLG_RT_INITDONE;
764 		lmp->rt_init_thread = (thread_t)0;
765 		(void) _lwp_cond_broadcast(&lmp->rt_cv);
766 		(void) rt_mutex_unlock(&lmp->rt_lock);
767 		SORTVAL(lmp) = -1;
768 
769 		/*
770 		 * If we're firing an INITFIRST object, and other objects must
771 		 * be fired which are not INITFIRST, make sure we grab any
772 		 * pending objects that might have been delayed as this
773 		 * INITFIRST was processed.
774 		 */
775 		if ((rtld_flags & RT_FL_INITFIRST) &&
776 		    ((*_nobj == NULL) || !(FLAGS(*_nobj) & FLG_RT_INITFRST))) {
777 			Aliste	idx;
778 			Rt_map	**pobj;
779 
780 			rtld_flags &= ~RT_FL_INITFIRST;
781 
782 			for (APLIST_TRAVERSE(pending, idx, pobj)) {
783 				aplist_delete(pending, &idx);
784 				call_init(pobj, DBG_INIT_PEND);
785 			}
786 		}
787 	}
788 	free(tobj);
789 }
790 
791 /*
792  * Call .fini sections for the topologically sorted list of objects.  This
793  * routine is called from remove_hdl() for any objects being torn down as part
794  * of a dlclose() operation, and from atexit() processing for all the remaining
795  * objects within the process.
796  */
797 void
call_fini(Lm_list * lml,Rt_map ** tobj,Rt_map * clmp)798 call_fini(Lm_list *lml, Rt_map **tobj, Rt_map *clmp)
799 {
800 	Rt_map **_tobj;
801 
802 	for (_tobj = tobj; *_tobj != NULL; _tobj++) {
803 		Rt_map		*lmp = *_tobj;
804 
805 		/*
806 		 * Only fire a .fini if the objects corresponding .init has
807 		 * completed.  We collect all .fini sections of objects that
808 		 * had their .init collected, but that doesn't mean that at
809 		 * the time of collection, that the .init had completed.
810 		 */
811 		if (FLAGS(lmp) & FLG_RT_INITDONE) {
812 			void	(*fptr)(void) = FINI(lmp);
813 
814 			if (FINIARRAY(lmp) || fptr)
815 				DBG_CALL(Dbg_util_call_fini(lmp));
816 
817 			call_array(FINIARRAY(lmp), FINIARRAYSZ(lmp), lmp,
818 			    SHT_FINI_ARRAY);
819 
820 			if (fptr) {
821 				uint_t	rtldflags;
822 
823 				APPLICATION_ENTER(rtldflags);
824 				leave(lml, 0);
825 				(*fptr)();
826 				(void) enter(0);
827 				APPLICATION_RETURN(rtldflags);
828 			}
829 		}
830 
831 		/*
832 		 * Skip main, this is explicitly called last in atexit_fini().
833 		 */
834 		if (FLAGS(lmp) & FLG_RT_ISMAIN)
835 			continue;
836 
837 		/*
838 		 * This object has exercised its last instructions (regardless
839 		 * of whether it will be unmapped or not).  Audit this closure.
840 		 */
841 		if ((lml->lm_tflags & LML_TFLG_NOAUDIT) == 0)
842 			audit_objclose(lmp, clmp);
843 	}
844 
845 	DBG_CALL(Dbg_bind_plt_summary(lml, M_MACH, pltcnt21d, pltcnt24d,
846 	    pltcntu32, pltcntu44, pltcntfull, pltcntfar));
847 
848 	free(tobj);
849 }
850 
851 /*
852  * Function called by atexit(3C).  Calls all .fini sections within the objects
853  * that make up the process.  As .fini processing is the last opportunity for
854  * any new bindings to be established, this is also a convenient location to
855  * check for unused objects.
856  */
857 void
atexit_fini()858 atexit_fini()
859 {
860 	Rt_map	**tobj, *lmp;
861 	Lm_list	*lml;
862 	Aliste	idx;
863 
864 	(void) enter(0);
865 
866 	rtld_flags |= RT_FL_ATEXIT;
867 
868 	lml = &lml_main;
869 	lml->lm_flags |= LML_FLG_ATEXIT;
870 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
871 	lmp = (Rt_map *)lml->lm_head;
872 
873 	/*
874 	 * Reverse topologically sort the main link-map for .fini execution.
875 	 */
876 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
877 	    (tobj != (Rt_map **)S_ERROR))
878 		call_fini(lml, tobj, NULL);
879 
880 	/*
881 	 * Now that all .fini code has been run, see what unreferenced objects
882 	 * remain.
883 	 */
884 	unused(lml);
885 
886 	/*
887 	 * Traverse any alternative link-map lists, looking for non-auditors.
888 	 */
889 	for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
890 		/*
891 		 * Ignore the base-link-map list, which has already been
892 		 * processed, the runtime linkers link-map list, which is
893 		 * processed last, and any auditors.
894 		 */
895 		if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) ||
896 		    (lml->lm_tflags & LML_TFLG_AUD_MASK) ||
897 		    ((lmp = (Rt_map *)lml->lm_head) == NULL))
898 			continue;
899 
900 		lml->lm_flags |= LML_FLG_ATEXIT;
901 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
902 
903 		/*
904 		 * Reverse topologically sort the link-map for .fini execution.
905 		 */
906 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
907 		    (tobj != (Rt_map **)S_ERROR))
908 			call_fini(lml, tobj, NULL);
909 
910 		unused(lml);
911 	}
912 
913 	/*
914 	 * Add an explicit close to main and ld.so.1.  Although main's .fini is
915 	 * collected in call_fini() to provide for FINITARRAY processing, its
916 	 * audit_objclose is explicitly skipped.  This provides for it to be
917 	 * called last, here.  This is the reverse of the explicit calls to
918 	 * audit_objopen() made in setup().
919 	 */
920 	lml = &lml_main;
921 	lmp = (Rt_map *)lml->lm_head;
922 
923 	if ((lml->lm_tflags | AFLAGS(lmp)) & LML_TFLG_AUD_MASK) {
924 		audit_objclose((Rt_map *)lml_rtld.lm_head, lmp);
925 		audit_objclose(lmp, lmp);
926 	}
927 
928 	/*
929 	 * Traverse any alternative link-map lists, looking for non-auditors.
930 	 */
931 	for (APLIST_TRAVERSE(dynlm_list, idx, lml)) {
932 		/*
933 		 * Ignore the base-link-map list, which has already been
934 		 * processed, the runtime linkers link-map list, which is
935 		 * processed last, and any non-auditors.
936 		 */
937 		if ((lml->lm_flags & (LML_FLG_BASELM | LML_FLG_RTLDLM)) ||
938 		    ((lml->lm_tflags & LML_TFLG_AUD_MASK) == 0) ||
939 		    ((lmp = (Rt_map *)lml->lm_head) == NULL))
940 			continue;
941 
942 		lml->lm_flags |= LML_FLG_ATEXIT;
943 		lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
944 
945 		/*
946 		 * Reverse topologically sort the link-map for .fini execution.
947 		 */
948 		if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
949 		    (tobj != (Rt_map **)S_ERROR))
950 			call_fini(lml, tobj, NULL);
951 
952 		unused(lml);
953 	}
954 
955 	/*
956 	 * Finally reverse topologically sort the runtime linkers link-map for
957 	 * .fini execution.
958 	 */
959 	lml = &lml_rtld;
960 	lml->lm_flags |= LML_FLG_ATEXIT;
961 	lml->lm_flags &= ~LML_FLG_INTRPOSETSORT;
962 	lmp = (Rt_map *)lml->lm_head;
963 
964 	if (((tobj = tsort(lmp, lml->lm_obj, RT_SORT_FWD)) != NULL) &&
965 	    (tobj != (Rt_map **)S_ERROR))
966 		call_fini(lml, tobj, NULL);
967 
968 	leave(&lml_main, 0);
969 }
970 
971 /*
972  * This routine is called to complete any runtime linker activity which may have
973  * resulted in objects being loaded.  This is called from all user entry points
974  * and from any internal dl*() requests.
975  */
976 void
load_completion(Rt_map * nlmp)977 load_completion(Rt_map *nlmp)
978 {
979 	Rt_map	**tobj = NULL;
980 	Lm_list	*nlml;
981 
982 	/*
983 	 * Establish any .init processing.  Note, in a world of lazy loading,
984 	 * objects may have been loaded regardless of whether the users request
985 	 * was fulfilled (i.e., a dlsym() request may have failed to find a
986 	 * symbol but objects might have been loaded during its search).  Thus,
987 	 * any tsorting starts from the nlmp (new link-maps) pointer and not
988 	 * necessarily from the link-map that may have satisfied the request.
989 	 *
990 	 * Note, the primary link-map has an initialization phase where dynamic
991 	 * .init firing is suppressed.  This provides for a simple and clean
992 	 * handshake with the primary link-maps libc, which is important for
993 	 * establishing uberdata.  In addition, auditors often obtain handles
994 	 * to primary link-map objects as the objects are loaded, so as to
995 	 * inspect the link-map for symbols.  This inspection is allowed without
996 	 * running any code on the primary link-map, as running this code may
997 	 * reenter the auditor, who may not yet have finished its own
998 	 * initialization.
999 	 */
1000 	if (nlmp)
1001 		nlml = LIST(nlmp);
1002 
1003 	if (nlmp && nlml->lm_init && ((nlml != &lml_main) ||
1004 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
1005 		if ((tobj = tsort(nlmp, nlml->lm_init,
1006 		    RT_SORT_REV)) == (Rt_map **)S_ERROR)
1007 			tobj = NULL;
1008 	}
1009 
1010 	/*
1011 	 * Make sure any alternative link-map retrieves any external interfaces
1012 	 * and initializes threads.
1013 	 */
1014 	if (nlmp && (nlml != &lml_main)) {
1015 		(void) rt_get_extern(nlml, nlmp);
1016 		rt_thr_init(nlml);
1017 	}
1018 
1019 	/*
1020 	 * Traverse the list of new link-maps and register any dynamic TLS.
1021 	 * This storage is established for any objects not on the primary
1022 	 * link-map, and for any objects added to the primary link-map after
1023 	 * static TLS has been registered.
1024 	 */
1025 	if (nlmp && nlml->lm_tls && ((nlml != &lml_main) ||
1026 	    (rtld_flags2 & (RT_FL2_PLMSETUP | RT_FL2_NOPLM)))) {
1027 		Rt_map	*lmp;
1028 
1029 		for (lmp = nlmp; lmp; lmp = NEXT_RT_MAP(lmp)) {
1030 			if (PTTLS(lmp) && PTTLS(lmp)->p_memsz)
1031 				tls_modaddrem(lmp, TM_FLG_MODADD);
1032 		}
1033 		nlml->lm_tls = 0;
1034 	}
1035 
1036 	/*
1037 	 * Fire any .init's.
1038 	 */
1039 	if (tobj)
1040 		call_init(tobj, DBG_INIT_SORT);
1041 }
1042 
1043 /*
1044  * Append an item to the specified link map control list.
1045  */
1046 void
lm_append(Lm_list * lml,Aliste lmco,Rt_map * lmp)1047 lm_append(Lm_list *lml, Aliste lmco, Rt_map *lmp)
1048 {
1049 	Lm_cntl	*lmc;
1050 	int	add = 1;
1051 
1052 	/*
1053 	 * Indicate that this link-map list has a new object.
1054 	 */
1055 	(lml->lm_obj)++;
1056 
1057 	/*
1058 	 * If we're about to add a new object to the main link-map control
1059 	 * list, alert the debuggers.  Additions of individual objects to the
1060 	 * main link-map control list occur during initial setup as the
1061 	 * applications immediate dependencies are loaded.  Additional objects
1062 	 * are loaded on the main link-map control list after they have been
1063 	 * fully initialized on an alternative link-map control list.  See
1064 	 * lm_move().
1065 	 */
1066 	if (lmco == ALIST_OFF_DATA)
1067 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1068 
1069 	/* LINTED */
1070 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, lmco);
1071 
1072 	/*
1073 	 * A link-map list header points to one of more link-map control lists
1074 	 * (see include/rtld.h).  The initial list, pointed to by lm_cntl, is
1075 	 * the list of relocated objects.  Other lists maintain objects that
1076 	 * are still being analyzed or relocated.  This list provides the core
1077 	 * link-map list information used by all ld.so.1 routines.
1078 	 */
1079 	if (lmc->lc_head == NULL) {
1080 		/*
1081 		 * If this is the first link-map for the given control list,
1082 		 * initialize the list.
1083 		 */
1084 		lmc->lc_head = lmc->lc_tail = lmp;
1085 		add = 0;
1086 
1087 	} else if (FLAGS(lmp) & FLG_RT_OBJINTPO) {
1088 		Rt_map	*tlmp;
1089 
1090 		/*
1091 		 * If this is an interposer then append the link-map following
1092 		 * any other interposers (these are objects that have been
1093 		 * previously preloaded, or were identified with -z interpose).
1094 		 * Interposers can only be inserted on the first link-map
1095 		 * control list, as once relocation has started, interposition
1096 		 * from new interposers can't be guaranteed.
1097 		 *
1098 		 * NOTE: We do not interpose on the head of a list.  This model
1099 		 * evolved because dynamic executables have already been fully
1100 		 * relocated within themselves and thus can't be interposed on.
1101 		 * Nowadays it's possible to have shared objects at the head of
1102 		 * a list, which conceptually means they could be interposed on.
1103 		 * But, shared objects can be created via dldump() and may only
1104 		 * be partially relocated (just relatives), in which case they
1105 		 * are interposable, but are marked as fixed (ET_EXEC).
1106 		 *
1107 		 * Thus we really don't have a clear method of deciding when the
1108 		 * head of a link-map is interposable.  So, to be consistent,
1109 		 * for now only add interposers after the link-map lists head
1110 		 * object.
1111 		 */
1112 		for (tlmp = NEXT_RT_MAP(lmc->lc_head); tlmp;
1113 		    tlmp = NEXT_RT_MAP(tlmp)) {
1114 
1115 			if (FLAGS(tlmp) & FLG_RT_OBJINTPO)
1116 				continue;
1117 
1118 			/*
1119 			 * Insert the new link-map before this non-interposer,
1120 			 * and indicate an interposer is found.
1121 			 */
1122 			NEXT(PREV_RT_MAP(tlmp)) = (Link_map *)lmp;
1123 			PREV(lmp) = PREV(tlmp);
1124 
1125 			NEXT(lmp) = (Link_map *)tlmp;
1126 			PREV(tlmp) = (Link_map *)lmp;
1127 
1128 			lmc->lc_flags |= LMC_FLG_REANALYZE;
1129 			add = 0;
1130 			break;
1131 		}
1132 	}
1133 
1134 	/*
1135 	 * Fall through to appending the new link map to the tail of the list.
1136 	 * If we're processing the initial objects of this link-map list, add
1137 	 * them to the backward compatibility list.
1138 	 */
1139 	if (add) {
1140 		NEXT(lmc->lc_tail) = (Link_map *)lmp;
1141 		PREV(lmp) = (Link_map *)lmc->lc_tail;
1142 		lmc->lc_tail = lmp;
1143 	}
1144 
1145 	/*
1146 	 * Having added this link-map to a control list, indicate which control
1147 	 * list the link-map belongs to.  Note, control list information is
1148 	 * always maintained as an offset, as the Alist can be reallocated.
1149 	 */
1150 	CNTL(lmp) = lmco;
1151 
1152 	/*
1153 	 * Indicate if an interposer is found.  Note that the first object on a
1154 	 * link-map can be explicitly defined as an interposer so that it can
1155 	 * provide interposition over direct binding requests.
1156 	 */
1157 	if (FLAGS(lmp) & MSK_RT_INTPOSE)
1158 		lml->lm_flags |= LML_FLG_INTRPOSE;
1159 
1160 	/*
1161 	 * For backward compatibility with debuggers, the link-map list contains
1162 	 * pointers to the main control list.
1163 	 */
1164 	if (lmco == ALIST_OFF_DATA) {
1165 		lml->lm_head = lmc->lc_head;
1166 		lml->lm_tail = lmc->lc_tail;
1167 	}
1168 }
1169 
1170 /*
1171  * Delete an item from the specified link map control list.
1172  */
1173 void
lm_delete(Lm_list * lml,Rt_map * lmp,Rt_map * clmp)1174 lm_delete(Lm_list *lml, Rt_map *lmp, Rt_map *clmp)
1175 {
1176 	Lm_cntl	*lmc;
1177 
1178 	/*
1179 	 * If the control list pointer hasn't been initialized, this object
1180 	 * never got added to a link-map list.
1181 	 */
1182 	if (CNTL(lmp) == 0)
1183 		return;
1184 
1185 	/*
1186 	 * If we're about to delete an object from the main link-map control
1187 	 * list, alert the debuggers.
1188 	 */
1189 	if (CNTL(lmp) == ALIST_OFF_DATA)
1190 		rd_event(lml, RD_DLACTIVITY, RT_DELETE);
1191 
1192 	/*
1193 	 * If we're being audited tell the audit library that we're
1194 	 * about to go deleting dependencies.
1195 	 */
1196 	if (clmp && (aud_activity ||
1197 	    ((LIST(clmp)->lm_tflags | AFLAGS(clmp)) & LML_TFLG_AUD_ACTIVITY)))
1198 		audit_activity(clmp, LA_ACT_DELETE);
1199 
1200 	/* LINTED */
1201 	lmc = (Lm_cntl *)alist_item_by_offset(lml->lm_lists, CNTL(lmp));
1202 
1203 	if (lmc->lc_head == lmp)
1204 		lmc->lc_head = NEXT_RT_MAP(lmp);
1205 	else
1206 		NEXT(PREV_RT_MAP(lmp)) = (void *)NEXT(lmp);
1207 
1208 	if (lmc->lc_tail == lmp)
1209 		lmc->lc_tail = PREV_RT_MAP(lmp);
1210 	else
1211 		PREV(NEXT_RT_MAP(lmp)) = PREV(lmp);
1212 
1213 	/*
1214 	 * For backward compatibility with debuggers, the link-map list contains
1215 	 * pointers to the main control list.
1216 	 */
1217 	if (lmc == (Lm_cntl *)&lml->lm_lists->al_data) {
1218 		lml->lm_head = lmc->lc_head;
1219 		lml->lm_tail = lmc->lc_tail;
1220 	}
1221 
1222 	/*
1223 	 * Indicate we have one less object on this control list.
1224 	 */
1225 	(lml->lm_obj)--;
1226 }
1227 
1228 /*
1229  * Move a link-map control list to another.  Objects that are being relocated
1230  * are maintained on secondary control lists.  Once their relocation is
1231  * complete, the entire list is appended to the previous control list, as this
1232  * list must have been the trigger for generating the new control list.
1233  */
1234 void
lm_move(Lm_list * lml,Aliste nlmco,Aliste plmco,Lm_cntl * nlmc,Lm_cntl * plmc)1235 lm_move(Lm_list *lml, Aliste nlmco, Aliste plmco, Lm_cntl *nlmc, Lm_cntl *plmc)
1236 {
1237 	Rt_map	*lmp;
1238 
1239 	/*
1240 	 * If we're about to add a new family of objects to the main link-map
1241 	 * control list, alert the debuggers.  Additions of object families to
1242 	 * the main link-map control list occur during lazy loading, filtering
1243 	 * and dlopen().
1244 	 */
1245 	if (plmco == ALIST_OFF_DATA)
1246 		rd_event(lml, RD_DLACTIVITY, RT_ADD);
1247 
1248 	DBG_CALL(Dbg_file_cntl(lml, nlmco, plmco));
1249 
1250 	/*
1251 	 * Indicate each new link-map has been moved to the previous link-map
1252 	 * control list.
1253 	 */
1254 	for (lmp = nlmc->lc_head; lmp; lmp = NEXT_RT_MAP(lmp)) {
1255 		CNTL(lmp) = plmco;
1256 
1257 		/*
1258 		 * If these objects are being added to the main link-map
1259 		 * control list, indicate that there are init's available
1260 		 * for harvesting.
1261 		 */
1262 		if (plmco == ALIST_OFF_DATA) {
1263 			lml->lm_init++;
1264 			lml->lm_flags |= LML_FLG_OBJADDED;
1265 		}
1266 	}
1267 
1268 	/*
1269 	 * Move the new link-map control list, to the callers link-map control
1270 	 * list.
1271 	 */
1272 	if (plmc->lc_head == NULL) {
1273 		plmc->lc_head = nlmc->lc_head;
1274 		PREV(nlmc->lc_head) = NULL;
1275 	} else {
1276 		NEXT(plmc->lc_tail) = (Link_map *)nlmc->lc_head;
1277 		PREV(nlmc->lc_head) = (Link_map *)plmc->lc_tail;
1278 	}
1279 
1280 	plmc->lc_tail = nlmc->lc_tail;
1281 	nlmc->lc_head = nlmc->lc_tail = NULL;
1282 
1283 	/*
1284 	 * For backward compatibility with debuggers, the link-map list contains
1285 	 * pointers to the main control list.
1286 	 */
1287 	if (plmco == ALIST_OFF_DATA) {
1288 		lml->lm_head = plmc->lc_head;
1289 		lml->lm_tail = plmc->lc_tail;
1290 	}
1291 }
1292 
1293 /*
1294  * Create, or assign a link-map control list.  Each link-map list contains a
1295  * main control list, which has an Alist offset of ALIST_OFF_DATA (see the
1296  * description in include/rtld.h).  During the initial construction of a
1297  * process, objects are added to this main control list.  This control list is
1298  * never deleted, unless an alternate link-map list has been requested (say for
1299  * auditors), and the associated objects could not be loaded or relocated.
1300  *
1301  * Once relocation has started, any lazy loadable objects, or filtees, are
1302  * processed on a new, temporary control list.  Only when these objects have
1303  * been fully relocated, are they moved to the main link-map control list.
1304  * Once the objects are moved, this temporary control list is deleted (see
1305  * remove_cntl()).
1306  *
1307  * A dlopen() always requires a new temporary link-map control list.
1308  * Typically, a dlopen() occurs on a link-map list that had already started
1309  * relocation, however, auditors can dlopen() objects on the main link-map
1310  * list while under initial construction, before any relocation has begun.
1311  * Hence, dlopen() requests are explicitly flagged.
1312  */
1313 Aliste
create_cntl(Lm_list * lml,int dlopen)1314 create_cntl(Lm_list *lml, int dlopen)
1315 {
1316 	/*
1317 	 * If the head link-map object has already been relocated, create a
1318 	 * new, temporary, control list.
1319 	 */
1320 	if (dlopen || (lml->lm_head == NULL) ||
1321 	    (FLAGS(lml->lm_head) & FLG_RT_RELOCED)) {
1322 		Lm_cntl *lmc;
1323 
1324 		if ((lmc = alist_append(&lml->lm_lists, NULL, sizeof (Lm_cntl),
1325 		    AL_CNT_LMLISTS)) == NULL)
1326 			return (0);
1327 
1328 		return ((Aliste)((char *)lmc - (char *)lml->lm_lists));
1329 	}
1330 
1331 	return (ALIST_OFF_DATA);
1332 }
1333 
1334 /*
1335  * Environment variables can have a variety of defined permutations, and thus
1336  * the following infrastructure exists to allow this variety and to select the
1337  * required definition.
1338  *
1339  * Environment variables can be defined as 32- or 64-bit specific, and if so
1340  * they will take precedence over any instruction set neutral form.  Typically
1341  * this is only useful when the environment value is an informational string.
1342  *
1343  * Environment variables may be obtained from the standard user environment or
1344  * from a configuration file.  The latter provides a fallback if no user
1345  * environment setting is found, and can take two forms:
1346  *
1347  *  -	a replaceable definition - this will be used if no user environment
1348  *	setting has been seen, or
1349  *
1350  *  -	an permanent definition - this will be used no matter what user
1351  *	environment setting is seen.  In the case of list variables it will be
1352  *	appended to any process environment setting seen.
1353  *
1354  * Environment variables can be defined without a value (ie. LD_XXXX=) so as to
1355  * override any replaceable environment variables from a configuration file.
1356  */
1357 static	u_longlong_t		rplgen = 0;	/* replaceable generic */
1358 						/*	variables */
1359 static	u_longlong_t		rplisa = 0;	/* replaceable ISA specific */
1360 						/*	variables */
1361 static	u_longlong_t		prmgen = 0;	/* permanent generic */
1362 						/*	variables */
1363 static	u_longlong_t		prmisa = 0;	/* permanent ISA specific */
1364 						/*	variables */
1365 static	u_longlong_t		cmdgen = 0;	/* command line (-e) generic */
1366 						/*	variables */
1367 static	u_longlong_t		cmdisa = 0;	/* command line (-e) ISA */
1368 						/*	specific variables */
1369 
1370 /*
1371  * Classify an environment variables type.
1372  */
1373 #define	ENV_TYP_IGNORE		0x01		/* ignore - variable is for */
1374 						/*	the wrong ISA */
1375 #define	ENV_TYP_ISA		0x02		/* variable is ISA specific */
1376 #define	ENV_TYP_CONFIG		0x04		/* variable obtained from a */
1377 						/*	config file */
1378 #define	ENV_TYP_PERMANT		0x08		/* variable is permanent */
1379 #define	ENV_TYP_CMDLINE		0x10		/* variable provide with -e */
1380 #define	ENV_TYP_NULL		0x20		/* variable is null */
1381 
1382 /*
1383  * Identify all environment variables.
1384  */
1385 #define	ENV_FLG_AUDIT		0x0000000000001ULL
1386 #define	ENV_FLG_AUDIT_ARGS	0x0000000000002ULL
1387 #define	ENV_FLG_BIND_NOW	0x0000000000004ULL
1388 #define	ENV_FLG_BIND_NOT	0x0000000000008ULL
1389 #define	ENV_FLG_BINDINGS	0x0000000000010ULL
1390 #define	ENV_FLG_CONFGEN		0x0000000000020ULL
1391 #define	ENV_FLG_CONFIG		0x0000000000040ULL
1392 #define	ENV_FLG_DEBUG		0x0000000000080ULL
1393 #define	ENV_FLG_DEBUG_OUTPUT	0x0000000000100ULL
1394 #define	ENV_FLG_DEMANGLE	0x0000000000200ULL
1395 #define	ENV_FLG_FLAGS		0x0000000000400ULL
1396 #define	ENV_FLG_INIT		0x0000000000800ULL
1397 #define	ENV_FLG_LIBPATH		0x0000000001000ULL
1398 #define	ENV_FLG_LOADAVAIL	0x0000000002000ULL
1399 #define	ENV_FLG_LOADFLTR	0x0000000004000ULL
1400 #define	ENV_FLG_NOAUDIT		0x0000000008000ULL
1401 #define	ENV_FLG_NOAUXFLTR	0x0000000010000ULL
1402 #define	ENV_FLG_NOBAPLT		0x0000000020000ULL
1403 #define	ENV_FLG_NOCONFIG	0x0000000040000ULL
1404 #define	ENV_FLG_NODIRCONFIG	0x0000000080000ULL
1405 #define	ENV_FLG_NODIRECT	0x0000000100000ULL
1406 #define	ENV_FLG_NOENVCONFIG	0x0000000200000ULL
1407 #define	ENV_FLG_NOLAZY		0x0000000400000ULL
1408 #define	ENV_FLG_NOOBJALTER	0x0000000800000ULL
1409 #define	ENV_FLG_NOVERSION	0x0000001000000ULL
1410 #define	ENV_FLG_PRELOAD		0x0000002000000ULL
1411 #define	ENV_FLG_PROFILE		0x0000004000000ULL
1412 #define	ENV_FLG_PROFILE_OUTPUT	0x0000008000000ULL
1413 #define	ENV_FLG_SIGNAL		0x0000010000000ULL
1414 #define	ENV_FLG_TRACE_OBJS	0x0000020000000ULL
1415 #define	ENV_FLG_TRACE_PTHS	0x0000040000000ULL
1416 #define	ENV_FLG_UNREF		0x0000080000000ULL
1417 #define	ENV_FLG_UNUSED		0x0000100000000ULL
1418 #define	ENV_FLG_VERBOSE		0x0000200000000ULL
1419 #define	ENV_FLG_WARN		0x0000400000000ULL
1420 #define	ENV_FLG_NOFLTCONFIG	0x0000800000000ULL
1421 #define	ENV_FLG_BIND_LAZY	0x0001000000000ULL
1422 #define	ENV_FLG_NOUNRESWEAK	0x0002000000000ULL
1423 #define	ENV_FLG_NOPAREXT	0x0004000000000ULL
1424 #define	ENV_FLG_HWCAP		0x0008000000000ULL
1425 #define	ENV_FLG_SFCAP		0x0010000000000ULL
1426 #define	ENV_FLG_MACHCAP		0x0020000000000ULL
1427 #define	ENV_FLG_PLATCAP		0x0040000000000ULL
1428 #define	ENV_FLG_CAP_FILES	0x0080000000000ULL
1429 #define	ENV_FLG_DEFERRED	0x0100000000000ULL
1430 #define	ENV_FLG_NOENVIRON	0x0200000000000ULL
1431 
1432 #define	SEL_REPLACE		0x0001
1433 #define	SEL_PERMANT		0x0002
1434 #define	SEL_ACT_RT		0x0100	/* setting rtld_flags */
1435 #define	SEL_ACT_RT2		0x0200	/* setting rtld_flags2 */
1436 #define	SEL_ACT_STR		0x0400	/* setting string value */
1437 #define	SEL_ACT_LML		0x0800	/* setting lml_flags */
1438 #define	SEL_ACT_LMLT		0x1000	/* setting lml_tflags */
1439 #define	SEL_ACT_SPEC_1		0x2000	/* for FLG_{FLAGS, LIBPATH} */
1440 #define	SEL_ACT_SPEC_2		0x4000	/* need special handling */
1441 
1442 /*
1443  * Pattern match an LD_XXXX environment variable.  s1 points to the XXXX part
1444  * and len specifies its length (comparing a strings length before the string
1445  * itself speed things up).  s2 points to the token itself which has already
1446  * had any leading white-space removed.
1447  */
1448 static void
ld_generic_env(const char * s1,size_t len,const char * s2,Word * lmflags,Word * lmtflags,uint_t env_flags,int aout)1449 ld_generic_env(const char *s1, size_t len, const char *s2, Word *lmflags,
1450     Word *lmtflags, uint_t env_flags, int aout)
1451 {
1452 	u_longlong_t	variable = 0;
1453 	ushort_t	select = 0;
1454 	const char	**str;
1455 	Word		val = 0;
1456 
1457 	/*
1458 	 * Determine whether we're dealing with a replaceable or permanent
1459 	 * string.
1460 	 */
1461 	if (env_flags & ENV_TYP_PERMANT) {
1462 		/*
1463 		 * If the string is from a configuration file and defined as
1464 		 * permanent, assign it as permanent.
1465 		 */
1466 		select |= SEL_PERMANT;
1467 	} else
1468 		select |= SEL_REPLACE;
1469 
1470 	/*
1471 	 * Parse the variable given.
1472 	 *
1473 	 * The LD_AUDIT family.
1474 	 */
1475 	if (*s1 == 'A') {
1476 		if ((len == MSG_LD_AUDIT_SIZE) && (strncmp(s1,
1477 		    MSG_ORIG(MSG_LD_AUDIT), MSG_LD_AUDIT_SIZE) == 0)) {
1478 			/*
1479 			 * Replaceable and permanent audit objects can exist.
1480 			 */
1481 			select |= SEL_ACT_STR;
1482 			str = (select & SEL_REPLACE) ? &rpl_audit : &prm_audit;
1483 			variable = ENV_FLG_AUDIT;
1484 		} else if ((len == MSG_LD_AUDIT_ARGS_SIZE) &&
1485 		    (strncmp(s1, MSG_ORIG(MSG_LD_AUDIT_ARGS),
1486 		    MSG_LD_AUDIT_ARGS_SIZE) == 0)) {
1487 			/*
1488 			 * A specialized variable for plt_exit() use, not
1489 			 * documented for general use.
1490 			 */
1491 			select |= SEL_ACT_SPEC_2;
1492 			variable = ENV_FLG_AUDIT_ARGS;
1493 		}
1494 	}
1495 	/*
1496 	 * The LD_BIND family.
1497 	 */
1498 	else if (*s1 == 'B') {
1499 		if ((len == MSG_LD_BIND_LAZY_SIZE) && (strncmp(s1,
1500 		    MSG_ORIG(MSG_LD_BIND_LAZY),
1501 		    MSG_LD_BIND_LAZY_SIZE) == 0)) {
1502 			select |= SEL_ACT_RT2;
1503 			val = RT_FL2_BINDLAZY;
1504 			variable = ENV_FLG_BIND_LAZY;
1505 		} else if ((len == MSG_LD_BIND_NOW_SIZE) && (strncmp(s1,
1506 		    MSG_ORIG(MSG_LD_BIND_NOW), MSG_LD_BIND_NOW_SIZE) == 0)) {
1507 			select |= SEL_ACT_RT2;
1508 			val = RT_FL2_BINDNOW;
1509 			variable = ENV_FLG_BIND_NOW;
1510 		} else if ((len == MSG_LD_BIND_NOT_SIZE) && (strncmp(s1,
1511 		    MSG_ORIG(MSG_LD_BIND_NOT), MSG_LD_BIND_NOT_SIZE) == 0)) {
1512 			/*
1513 			 * Another trick, enabled to help debug AOUT
1514 			 * applications under BCP, but not documented for
1515 			 * general use.
1516 			 */
1517 			select |= SEL_ACT_RT;
1518 			val = RT_FL_NOBIND;
1519 			variable = ENV_FLG_BIND_NOT;
1520 		} else if ((len == MSG_LD_BINDINGS_SIZE) && (strncmp(s1,
1521 		    MSG_ORIG(MSG_LD_BINDINGS), MSG_LD_BINDINGS_SIZE) == 0)) {
1522 			/*
1523 			 * This variable is simply for backward compatibility.
1524 			 * If this and LD_DEBUG are both specified, only one of
1525 			 * the strings is going to get processed.
1526 			 */
1527 			select |= SEL_ACT_SPEC_2;
1528 			variable = ENV_FLG_BINDINGS;
1529 		}
1530 	}
1531 	/*
1532 	 * LD_CAP_FILES and LD_CONFIG family.
1533 	 */
1534 	else if (*s1 == 'C') {
1535 		if ((len == MSG_LD_CAP_FILES_SIZE) && (strncmp(s1,
1536 		    MSG_ORIG(MSG_LD_CAP_FILES), MSG_LD_CAP_FILES_SIZE) == 0)) {
1537 			select |= SEL_ACT_STR;
1538 			str = (select & SEL_REPLACE) ?
1539 			    &rpl_cap_files : &prm_cap_files;
1540 			variable = ENV_FLG_CAP_FILES;
1541 		} else if ((len == MSG_LD_CONFGEN_SIZE) && (strncmp(s1,
1542 		    MSG_ORIG(MSG_LD_CONFGEN), MSG_LD_CONFGEN_SIZE) == 0)) {
1543 			/*
1544 			 * This variable is not documented for general use.
1545 			 * Although originaly designed for internal use with
1546 			 * crle(1), this variable is in use by the Studio
1547 			 * auditing tools.  Hence, it can't be removed.
1548 			 */
1549 			select |= SEL_ACT_SPEC_2;
1550 			variable = ENV_FLG_CONFGEN;
1551 		} else if ((len == MSG_LD_CONFIG_SIZE) && (strncmp(s1,
1552 		    MSG_ORIG(MSG_LD_CONFIG), MSG_LD_CONFIG_SIZE) == 0)) {
1553 			/*
1554 			 * Secure applications must use a default configuration
1555 			 * file.  A setting from a configuration file doesn't
1556 			 * make sense (given we must be reading a configuration
1557 			 * file to have gotten this).
1558 			 */
1559 			if ((rtld_flags & RT_FL_SECURE) ||
1560 			    (env_flags & ENV_TYP_CONFIG))
1561 				return;
1562 			select |= SEL_ACT_STR;
1563 			str = &config->c_name;
1564 			variable = ENV_FLG_CONFIG;
1565 		}
1566 	}
1567 	/*
1568 	 * The LD_DEBUG family, LD_DEFERRED (internal, used by ldd(1)), and
1569 	 * LD_DEMANGLE.
1570 	 */
1571 	else if (*s1 == 'D') {
1572 		if ((len == MSG_LD_DEBUG_SIZE) && (strncmp(s1,
1573 		    MSG_ORIG(MSG_LD_DEBUG), MSG_LD_DEBUG_SIZE) == 0)) {
1574 			select |= SEL_ACT_STR;
1575 			str = (select & SEL_REPLACE) ? &rpl_debug : &prm_debug;
1576 			variable = ENV_FLG_DEBUG;
1577 		} else if ((len == MSG_LD_DEBUG_OUTPUT_SIZE) && (strncmp(s1,
1578 		    MSG_ORIG(MSG_LD_DEBUG_OUTPUT),
1579 		    MSG_LD_DEBUG_OUTPUT_SIZE) == 0)) {
1580 			select |= SEL_ACT_STR;
1581 			str = &dbg_file;
1582 			variable = ENV_FLG_DEBUG_OUTPUT;
1583 		} else if ((len == MSG_LD_DEFERRED_SIZE) && (strncmp(s1,
1584 		    MSG_ORIG(MSG_LD_DEFERRED), MSG_LD_DEFERRED_SIZE) == 0)) {
1585 			select |= SEL_ACT_RT;
1586 			val = RT_FL_DEFERRED;
1587 			variable = ENV_FLG_DEFERRED;
1588 		} else if ((len == MSG_LD_DEMANGLE_SIZE) && (strncmp(s1,
1589 		    MSG_ORIG(MSG_LD_DEMANGLE), MSG_LD_DEMANGLE_SIZE) == 0)) {
1590 			select |= SEL_ACT_RT;
1591 			val = RT_FL_DEMANGLE;
1592 			variable = ENV_FLG_DEMANGLE;
1593 		}
1594 	}
1595 	/*
1596 	 * LD_FLAGS - collect the best variable definition.  On completion of
1597 	 * environment variable processing pass the result to ld_flags_env()
1598 	 * where they'll be decomposed and passed back to this routine.
1599 	 */
1600 	else if (*s1 == 'F') {
1601 		if ((len == MSG_LD_FLAGS_SIZE) && (strncmp(s1,
1602 		    MSG_ORIG(MSG_LD_FLAGS), MSG_LD_FLAGS_SIZE) == 0)) {
1603 			select |= SEL_ACT_SPEC_1;
1604 			str = (select & SEL_REPLACE) ? &rpl_ldflags :
1605 			    &prm_ldflags;
1606 			variable = ENV_FLG_FLAGS;
1607 		}
1608 	}
1609 	/*
1610 	 * LD_HWCAP.
1611 	 */
1612 	else if (*s1 == 'H') {
1613 		if ((len == MSG_LD_HWCAP_SIZE) && (strncmp(s1,
1614 		    MSG_ORIG(MSG_LD_HWCAP), MSG_LD_HWCAP_SIZE) == 0)) {
1615 			select |= SEL_ACT_STR;
1616 			str = (select & SEL_REPLACE) ?
1617 			    &rpl_hwcap : &prm_hwcap;
1618 			variable = ENV_FLG_HWCAP;
1619 		}
1620 	}
1621 	/*
1622 	 * LD_INIT (internal, used by ldd(1)).
1623 	 */
1624 	else if (*s1 == 'I') {
1625 		if ((len == MSG_LD_INIT_SIZE) && (strncmp(s1,
1626 		    MSG_ORIG(MSG_LD_INIT), MSG_LD_INIT_SIZE) == 0)) {
1627 			select |= SEL_ACT_LML;
1628 			val = LML_FLG_TRC_INIT;
1629 			variable = ENV_FLG_INIT;
1630 		}
1631 	}
1632 	/*
1633 	 * The LD_LIBRARY_PATH and LD_LOAD families.
1634 	 */
1635 	else if (*s1 == 'L') {
1636 		if ((len == MSG_LD_LIBPATH_SIZE) && (strncmp(s1,
1637 		    MSG_ORIG(MSG_LD_LIBPATH), MSG_LD_LIBPATH_SIZE) == 0)) {
1638 			select |= SEL_ACT_SPEC_1;
1639 			str = (select & SEL_REPLACE) ? &rpl_libpath :
1640 			    &prm_libpath;
1641 			variable = ENV_FLG_LIBPATH;
1642 		} else if ((len == MSG_LD_LOADAVAIL_SIZE) && (strncmp(s1,
1643 		    MSG_ORIG(MSG_LD_LOADAVAIL), MSG_LD_LOADAVAIL_SIZE) == 0)) {
1644 			/*
1645 			 * This variable is not documented for general use.
1646 			 * Although originaly designed for internal use with
1647 			 * crle(1), this variable is in use by the Studio
1648 			 * auditing tools.  Hence, it can't be removed.
1649 			 */
1650 			select |= SEL_ACT_LML;
1651 			val = LML_FLG_LOADAVAIL;
1652 			variable = ENV_FLG_LOADAVAIL;
1653 		} else if ((len == MSG_LD_LOADFLTR_SIZE) && (strncmp(s1,
1654 		    MSG_ORIG(MSG_LD_LOADFLTR), MSG_LD_LOADFLTR_SIZE) == 0)) {
1655 			select |= SEL_ACT_SPEC_2;
1656 			variable = ENV_FLG_LOADFLTR;
1657 		}
1658 	}
1659 	/*
1660 	 * LD_MACHCAP.
1661 	 */
1662 	else if (*s1 == 'M') {
1663 		if ((len == MSG_LD_MACHCAP_SIZE) && (strncmp(s1,
1664 		    MSG_ORIG(MSG_LD_MACHCAP), MSG_LD_MACHCAP_SIZE) == 0)) {
1665 			select |= SEL_ACT_STR;
1666 			str = (select & SEL_REPLACE) ?
1667 			    &rpl_machcap : &prm_machcap;
1668 			variable = ENV_FLG_MACHCAP;
1669 		}
1670 	}
1671 	/*
1672 	 * The LD_NO family.
1673 	 */
1674 	else if (*s1 == 'N') {
1675 		if ((len == MSG_LD_NOAUDIT_SIZE) && (strncmp(s1,
1676 		    MSG_ORIG(MSG_LD_NOAUDIT), MSG_LD_NOAUDIT_SIZE) == 0)) {
1677 			select |= SEL_ACT_RT;
1678 			val = RT_FL_NOAUDIT;
1679 			variable = ENV_FLG_NOAUDIT;
1680 		} else if ((len == MSG_LD_NOAUXFLTR_SIZE) && (strncmp(s1,
1681 		    MSG_ORIG(MSG_LD_NOAUXFLTR), MSG_LD_NOAUXFLTR_SIZE) == 0)) {
1682 			select |= SEL_ACT_RT;
1683 			val = RT_FL_NOAUXFLTR;
1684 			variable = ENV_FLG_NOAUXFLTR;
1685 		} else if ((len == MSG_LD_NOBAPLT_SIZE) && (strncmp(s1,
1686 		    MSG_ORIG(MSG_LD_NOBAPLT), MSG_LD_NOBAPLT_SIZE) == 0)) {
1687 			select |= SEL_ACT_RT;
1688 			val = RT_FL_NOBAPLT;
1689 			variable = ENV_FLG_NOBAPLT;
1690 		} else if ((len == MSG_LD_NOCONFIG_SIZE) && (strncmp(s1,
1691 		    MSG_ORIG(MSG_LD_NOCONFIG), MSG_LD_NOCONFIG_SIZE) == 0)) {
1692 			select |= SEL_ACT_RT;
1693 			val = RT_FL_NOCFG;
1694 			variable = ENV_FLG_NOCONFIG;
1695 		} else if ((len == MSG_LD_NODIRCONFIG_SIZE) && (strncmp(s1,
1696 		    MSG_ORIG(MSG_LD_NODIRCONFIG),
1697 		    MSG_LD_NODIRCONFIG_SIZE) == 0)) {
1698 			select |= SEL_ACT_RT;
1699 			val = RT_FL_NODIRCFG;
1700 			variable = ENV_FLG_NODIRCONFIG;
1701 		} else if ((len == MSG_LD_NODIRECT_SIZE) && (strncmp(s1,
1702 		    MSG_ORIG(MSG_LD_NODIRECT), MSG_LD_NODIRECT_SIZE) == 0)) {
1703 			select |= SEL_ACT_LMLT;
1704 			val = LML_TFLG_NODIRECT;
1705 			variable = ENV_FLG_NODIRECT;
1706 		} else if ((len == MSG_LD_NOENVCONFIG_SIZE) && (strncmp(s1,
1707 		    MSG_ORIG(MSG_LD_NOENVCONFIG),
1708 		    MSG_LD_NOENVCONFIG_SIZE) == 0)) {
1709 			select |= SEL_ACT_RT;
1710 			val = RT_FL_NOENVCFG;
1711 			variable = ENV_FLG_NOENVCONFIG;
1712 		} else if ((len == MSG_LD_NOFLTCONFIG_SIZE) && (strncmp(s1,
1713 		    MSG_ORIG(MSG_LD_NOFLTCONFIG),
1714 		    MSG_LD_NOFLTCONFIG_SIZE) == 0)) {
1715 			select |= SEL_ACT_RT2;
1716 			val = RT_FL2_NOFLTCFG;
1717 			variable = ENV_FLG_NOFLTCONFIG;
1718 		} else if ((len == MSG_LD_NOLAZY_SIZE) && (strncmp(s1,
1719 		    MSG_ORIG(MSG_LD_NOLAZY), MSG_LD_NOLAZY_SIZE) == 0)) {
1720 			select |= SEL_ACT_LMLT;
1721 			val = LML_TFLG_NOLAZYLD;
1722 			variable = ENV_FLG_NOLAZY;
1723 		} else if ((len == MSG_LD_NOOBJALTER_SIZE) && (strncmp(s1,
1724 		    MSG_ORIG(MSG_LD_NOOBJALTER),
1725 		    MSG_LD_NOOBJALTER_SIZE) == 0)) {
1726 			select |= SEL_ACT_RT;
1727 			val = RT_FL_NOOBJALT;
1728 			variable = ENV_FLG_NOOBJALTER;
1729 		} else if ((len == MSG_LD_NOVERSION_SIZE) && (strncmp(s1,
1730 		    MSG_ORIG(MSG_LD_NOVERSION), MSG_LD_NOVERSION_SIZE) == 0)) {
1731 			select |= SEL_ACT_RT;
1732 			val = RT_FL_NOVERSION;
1733 			variable = ENV_FLG_NOVERSION;
1734 		} else if ((len == MSG_LD_NOUNRESWEAK_SIZE) && (strncmp(s1,
1735 		    MSG_ORIG(MSG_LD_NOUNRESWEAK),
1736 		    MSG_LD_NOUNRESWEAK_SIZE) == 0)) {
1737 			/*
1738 			 * LD_NOUNRESWEAK (internal, used by ldd(1)).
1739 			 */
1740 			select |= SEL_ACT_LML;
1741 			val = LML_FLG_TRC_NOUNRESWEAK;
1742 			variable = ENV_FLG_NOUNRESWEAK;
1743 		} else if ((len == MSG_LD_NOPAREXT_SIZE) && (strncmp(s1,
1744 		    MSG_ORIG(MSG_LD_NOPAREXT), MSG_LD_NOPAREXT_SIZE) == 0)) {
1745 			select |= SEL_ACT_LML;
1746 			val = LML_FLG_TRC_NOPAREXT;
1747 			variable = ENV_FLG_NOPAREXT;
1748 		} else if ((len == MSG_LD_NOENVIRON_SIZE) && (strncmp(s1,
1749 		    MSG_ORIG(MSG_LD_NOENVIRON), MSG_LD_NOENVIRON_SIZE) == 0)) {
1750 			/*
1751 			 * LD_NOENVIRON can only be set with ld.so.1 -e.
1752 			 */
1753 			select |= SEL_ACT_RT;
1754 			val = RT_FL_NOENVIRON;
1755 			variable = ENV_FLG_NOENVIRON;
1756 		}
1757 	}
1758 	/*
1759 	 * LD_PLATCAP, LD_PRELOAD and LD_PROFILE family.
1760 	 */
1761 	else if (*s1 == 'P') {
1762 		if ((len == MSG_LD_PLATCAP_SIZE) && (strncmp(s1,
1763 		    MSG_ORIG(MSG_LD_PLATCAP), MSG_LD_PLATCAP_SIZE) == 0)) {
1764 			select |= SEL_ACT_STR;
1765 			str = (select & SEL_REPLACE) ?
1766 			    &rpl_platcap : &prm_platcap;
1767 			variable = ENV_FLG_PLATCAP;
1768 		} else if ((len == MSG_LD_PRELOAD_SIZE) && (strncmp(s1,
1769 		    MSG_ORIG(MSG_LD_PRELOAD), MSG_LD_PRELOAD_SIZE) == 0)) {
1770 			select |= SEL_ACT_STR;
1771 			str = (select & SEL_REPLACE) ? &rpl_preload :
1772 			    &prm_preload;
1773 			variable = ENV_FLG_PRELOAD;
1774 		} else if ((len == MSG_LD_PROFILE_SIZE) && (strncmp(s1,
1775 		    MSG_ORIG(MSG_LD_PROFILE), MSG_LD_PROFILE_SIZE) == 0)) {
1776 			/*
1777 			 * Only one user library can be profiled at a time.
1778 			 */
1779 			select |= SEL_ACT_SPEC_2;
1780 			variable = ENV_FLG_PROFILE;
1781 		} else if ((len == MSG_LD_PROFILE_OUTPUT_SIZE) && (strncmp(s1,
1782 		    MSG_ORIG(MSG_LD_PROFILE_OUTPUT),
1783 		    MSG_LD_PROFILE_OUTPUT_SIZE) == 0)) {
1784 			/*
1785 			 * Only one user library can be profiled at a time.
1786 			 */
1787 			select |= SEL_ACT_STR;
1788 			str = &profile_out;
1789 			variable = ENV_FLG_PROFILE_OUTPUT;
1790 		}
1791 	}
1792 	/*
1793 	 * LD_SFCAP and LD_SIGNAL.
1794 	 */
1795 	else if (*s1 == 'S') {
1796 		if ((len == MSG_LD_SFCAP_SIZE) && (strncmp(s1,
1797 		    MSG_ORIG(MSG_LD_SFCAP), MSG_LD_SFCAP_SIZE) == 0)) {
1798 			select |= SEL_ACT_STR;
1799 			str = (select & SEL_REPLACE) ?
1800 			    &rpl_sfcap : &prm_sfcap;
1801 			variable = ENV_FLG_SFCAP;
1802 		} else if ((len == MSG_LD_SIGNAL_SIZE) &&
1803 		    (strncmp(s1, MSG_ORIG(MSG_LD_SIGNAL),
1804 		    MSG_LD_SIGNAL_SIZE) == 0) &&
1805 		    ((rtld_flags & RT_FL_SECURE) == 0)) {
1806 			select |= SEL_ACT_SPEC_2;
1807 			variable = ENV_FLG_SIGNAL;
1808 		}
1809 	}
1810 	/*
1811 	 * The LD_TRACE family (internal, used by ldd(1)).  This definition is
1812 	 * the key to enabling all other ldd(1) specific environment variables.
1813 	 * In case an auditor is called, which in turn might exec(2) a
1814 	 * subprocess, this variable is disabled, so that any subprocess
1815 	 * escapes ldd(1) processing.
1816 	 */
1817 	else if (*s1 == 'T') {
1818 		if (((len == MSG_LD_TRACE_OBJS_SIZE) &&
1819 		    (strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS),
1820 		    MSG_LD_TRACE_OBJS_SIZE) == 0)) ||
1821 		    ((len == MSG_LD_TRACE_OBJS_E_SIZE) &&
1822 		    (((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_E),
1823 		    MSG_LD_TRACE_OBJS_E_SIZE) == 0) && !aout) ||
1824 		    ((strncmp(s1, MSG_ORIG(MSG_LD_TRACE_OBJS_A),
1825 		    MSG_LD_TRACE_OBJS_A_SIZE) == 0) && aout)))) {
1826 			char	*s0 = (char *)s1;
1827 
1828 			select |= SEL_ACT_SPEC_2;
1829 			variable = ENV_FLG_TRACE_OBJS;
1830 
1831 #if	defined(__sparc) || defined(__x86)
1832 			/*
1833 			 * The simplest way to "disable" this variable is to
1834 			 * truncate this string to "LD_'\0'". This string is
1835 			 * ignored by any ld.so.1 environment processing.
1836 			 * Use of such interfaces as unsetenv(3c) are overkill,
1837 			 * and would drag too much libc implementation detail
1838 			 * into ld.so.1.
1839 			 */
1840 			*s0 = '\0';
1841 #else
1842 /*
1843  * Verify that the above write is appropriate for any new platforms.
1844  */
1845 #error	unsupported architecture!
1846 #endif
1847 		} else if ((len == MSG_LD_TRACE_PTHS_SIZE) && (strncmp(s1,
1848 		    MSG_ORIG(MSG_LD_TRACE_PTHS),
1849 		    MSG_LD_TRACE_PTHS_SIZE) == 0)) {
1850 			select |= SEL_ACT_LML;
1851 			val = LML_FLG_TRC_SEARCH;
1852 			variable = ENV_FLG_TRACE_PTHS;
1853 		}
1854 	}
1855 	/*
1856 	 * LD_UNREF and LD_UNUSED (internal, used by ldd(1)).
1857 	 */
1858 	else if (*s1 == 'U') {
1859 		if ((len == MSG_LD_UNREF_SIZE) && (strncmp(s1,
1860 		    MSG_ORIG(MSG_LD_UNREF), MSG_LD_UNREF_SIZE) == 0)) {
1861 			select |= SEL_ACT_LML;
1862 			val = LML_FLG_TRC_UNREF;
1863 			variable = ENV_FLG_UNREF;
1864 		} else if ((len == MSG_LD_UNUSED_SIZE) && (strncmp(s1,
1865 		    MSG_ORIG(MSG_LD_UNUSED), MSG_LD_UNUSED_SIZE) == 0)) {
1866 			select |= SEL_ACT_LML;
1867 			val = LML_FLG_TRC_UNUSED;
1868 			variable = ENV_FLG_UNUSED;
1869 		}
1870 	}
1871 	/*
1872 	 * LD_VERBOSE (internal, used by ldd(1)).
1873 	 */
1874 	else if (*s1 == 'V') {
1875 		if ((len == MSG_LD_VERBOSE_SIZE) && (strncmp(s1,
1876 		    MSG_ORIG(MSG_LD_VERBOSE), MSG_LD_VERBOSE_SIZE) == 0)) {
1877 			select |= SEL_ACT_LML;
1878 			val = LML_FLG_TRC_VERBOSE;
1879 			variable = ENV_FLG_VERBOSE;
1880 		}
1881 	}
1882 	/*
1883 	 * LD_WARN (internal, used by ldd(1)).
1884 	 */
1885 	else if (*s1 == 'W') {
1886 		if ((len == MSG_LD_WARN_SIZE) && (strncmp(s1,
1887 		    MSG_ORIG(MSG_LD_WARN), MSG_LD_WARN_SIZE) == 0)) {
1888 			select |= SEL_ACT_LML;
1889 			val = LML_FLG_TRC_WARN;
1890 			variable = ENV_FLG_WARN;
1891 		}
1892 	}
1893 
1894 	if (variable == 0)
1895 		return;
1896 
1897 	/*
1898 	 * If the variable is already processed with and ISA specific variable,
1899 	 * no further processing is needed.
1900 	 */
1901 	if (((select & SEL_REPLACE) && (rplisa & variable)) ||
1902 	    ((select & SEL_PERMANT) && (prmisa & variable)))
1903 		return;
1904 
1905 	/*
1906 	 * If this variable has already been set via the command line, then
1907 	 * ignore this variable.  The command line, -e, takes precedence.
1908 	 */
1909 	if (env_flags & ENV_TYP_ISA) {
1910 		if (cmdisa & variable)
1911 			return;
1912 		if (env_flags & ENV_TYP_CMDLINE)
1913 			cmdisa |= variable;
1914 	} else {
1915 		if (cmdgen & variable)
1916 			return;
1917 		if (env_flags & ENV_TYP_CMDLINE)
1918 			cmdgen |= variable;
1919 	}
1920 
1921 	/*
1922 	 * Mark the appropriate variables.
1923 	 */
1924 	if (env_flags & ENV_TYP_ISA) {
1925 		/*
1926 		 * This is an ISA setting.
1927 		 */
1928 		if (select & SEL_REPLACE) {
1929 			if (rplisa & variable)
1930 				return;
1931 			rplisa |= variable;
1932 		} else {
1933 			prmisa |= variable;
1934 		}
1935 	} else {
1936 		/*
1937 		 * This is a non-ISA setting.
1938 		 */
1939 		if (select & SEL_REPLACE) {
1940 			if (rplgen & variable)
1941 				return;
1942 			rplgen |= variable;
1943 		} else
1944 			prmgen |= variable;
1945 	}
1946 
1947 	/*
1948 	 * Now perform the setting.
1949 	 */
1950 	if (select & SEL_ACT_RT) {
1951 		if (s2)
1952 			rtld_flags |= val;
1953 		else
1954 			rtld_flags &= ~val;
1955 	} else if (select & SEL_ACT_RT2) {
1956 		if (s2)
1957 			rtld_flags2 |= val;
1958 		else
1959 			rtld_flags2 &= ~val;
1960 	} else if (select & SEL_ACT_STR) {
1961 		if (env_flags & ENV_TYP_NULL)
1962 			*str = NULL;
1963 		else
1964 			*str = s2;
1965 	} else if (select & SEL_ACT_LML) {
1966 		if (s2)
1967 			*lmflags |= val;
1968 		else
1969 			*lmflags &= ~val;
1970 	} else if (select & SEL_ACT_LMLT) {
1971 		if (s2)
1972 			*lmtflags |= val;
1973 		else
1974 			*lmtflags &= ~val;
1975 	} else if (select & SEL_ACT_SPEC_1) {
1976 		/*
1977 		 * variable is either ENV_FLG_FLAGS or ENV_FLG_LIBPATH
1978 		 */
1979 		if (env_flags & ENV_TYP_NULL)
1980 			*str = NULL;
1981 		else
1982 			*str = s2;
1983 		if ((select & SEL_REPLACE) && (env_flags & ENV_TYP_CONFIG)) {
1984 			if (s2) {
1985 				if (variable == ENV_FLG_FLAGS)
1986 					env_info |= ENV_INF_FLAGCFG;
1987 				else
1988 					env_info |= ENV_INF_PATHCFG;
1989 			} else {
1990 				if (variable == ENV_FLG_FLAGS)
1991 					env_info &= ~ENV_INF_FLAGCFG;
1992 				else
1993 					env_info &= ~ENV_INF_PATHCFG;
1994 			}
1995 		}
1996 	} else if (select & SEL_ACT_SPEC_2) {
1997 		/*
1998 		 * variables can be: ENV_FLG_
1999 		 *	AUDIT_ARGS, BINDING, CONFGEN, LOADFLTR, PROFILE,
2000 		 *	SIGNAL, TRACE_OBJS
2001 		 */
2002 		switch (variable) {
2003 		case ENV_FLG_AUDIT_ARGS:
2004 			if (s2) {
2005 				audit_argcnt = atoi(s2);
2006 				audit_argcnt += audit_argcnt % 2;
2007 			} else
2008 				audit_argcnt = 0;
2009 			break;
2010 		case ENV_FLG_BINDINGS:
2011 			if (s2)
2012 				rpl_debug = MSG_ORIG(MSG_TKN_BINDINGS);
2013 			else
2014 				rpl_debug = NULL;
2015 			break;
2016 		case ENV_FLG_CONFGEN:
2017 			if (s2) {
2018 				rtld_flags |= RT_FL_CONFGEN;
2019 				*lmflags |= LML_FLG_IGNRELERR;
2020 			} else {
2021 				rtld_flags &= ~RT_FL_CONFGEN;
2022 				*lmflags &= ~LML_FLG_IGNRELERR;
2023 			}
2024 			break;
2025 		case ENV_FLG_LOADFLTR:
2026 			if (s2) {
2027 				*lmtflags |= LML_TFLG_LOADFLTR;
2028 				if (*s2 == '2')
2029 					rtld_flags |= RT_FL_WARNFLTR;
2030 			} else {
2031 				*lmtflags &= ~LML_TFLG_LOADFLTR;
2032 				rtld_flags &= ~RT_FL_WARNFLTR;
2033 			}
2034 			break;
2035 		case ENV_FLG_PROFILE:
2036 			profile_name = s2;
2037 			if (s2) {
2038 				if (strcmp(s2, MSG_ORIG(MSG_FIL_RTLD)) == 0) {
2039 					return;
2040 				}
2041 				/* BEGIN CSTYLED */
2042 				if (rtld_flags & RT_FL_SECURE) {
2043 					profile_lib =
2044 #if	defined(_ELF64)
2045 					    MSG_ORIG(MSG_PTH_LDPROFSE_64);
2046 #else
2047 					    MSG_ORIG(MSG_PTH_LDPROFSE);
2048 #endif
2049 				} else {
2050 					profile_lib =
2051 #if	defined(_ELF64)
2052 					    MSG_ORIG(MSG_PTH_LDPROF_64);
2053 #else
2054 					    MSG_ORIG(MSG_PTH_LDPROF);
2055 #endif
2056 				}
2057 				/* END CSTYLED */
2058 			} else
2059 				profile_lib = NULL;
2060 			break;
2061 		case ENV_FLG_SIGNAL:
2062 			killsig = s2 ? atoi(s2) : SIGKILL;
2063 			break;
2064 		case ENV_FLG_TRACE_OBJS:
2065 			if (s2) {
2066 				*lmflags |= LML_FLG_TRC_ENABLE;
2067 				if (*s2 == '2')
2068 					*lmflags |= LML_FLG_TRC_LDDSTUB;
2069 			} else
2070 				*lmflags &=
2071 				    ~(LML_FLG_TRC_ENABLE | LML_FLG_TRC_LDDSTUB);
2072 			break;
2073 		}
2074 	}
2075 }
2076 
2077 /*
2078  * Determine whether we have an architecture specific environment variable.
2079  * If we do, and we're the wrong architecture, it'll just get ignored.
2080  * Otherwise the variable is processed in it's architecture neutral form.
2081  */
2082 static int
ld_arch_env(const char * s1,size_t * len)2083 ld_arch_env(const char *s1, size_t *len)
2084 {
2085 	size_t	_len = *len - 3;
2086 
2087 	if (s1[_len++] == '_') {
2088 		if ((s1[_len] == '3') && (s1[_len + 1] == '2')) {
2089 #if	defined(_ELF64)
2090 			return (ENV_TYP_IGNORE);
2091 #else
2092 			*len = *len - 3;
2093 			return (ENV_TYP_ISA);
2094 #endif
2095 		}
2096 		if ((s1[_len] == '6') && (s1[_len + 1] == '4')) {
2097 #if	defined(_ELF64)
2098 			*len = *len - 3;
2099 			return (ENV_TYP_ISA);
2100 #else
2101 			return (ENV_TYP_IGNORE);
2102 #endif
2103 		}
2104 	}
2105 	return (0);
2106 }
2107 
2108 /*
2109  * Process an LD_FLAGS environment variable.  The value can be a comma
2110  * separated set of tokens, which are sent (in upper case) into the generic
2111  * LD_XXXX environment variable engine.  For example:
2112  *
2113  *	LD_FLAGS=bind_now=		->	LD_BIND_NOW=
2114  *	LD_FLAGS=bind_now		->	LD_BIND_NOW=1
2115  *	LD_FLAGS=library_path=		->	LD_LIBRARY_PATH=
2116  *	LD_FLAGS=library_path=/foo:.	->	LD_LIBRARY_PATH=/foo:.
2117  *	LD_FLAGS=debug=files:detail	->	LD_DEBUG=files:detail
2118  * or
2119  *	LD_FLAGS=bind_now,library_path=/foo:.,debug=files:detail
2120  */
2121 static int
ld_flags_env(const char * str,Word * lmflags,Word * lmtflags,uint_t env_flags,int aout)2122 ld_flags_env(const char *str, Word *lmflags, Word *lmtflags,
2123     uint_t env_flags, int aout)
2124 {
2125 	char	*nstr, *sstr, *estr = NULL;
2126 	size_t	nlen, len;
2127 
2128 	if (str == NULL)
2129 		return (0);
2130 
2131 	/*
2132 	 * Create a new string as we're going to transform the token(s) into
2133 	 * uppercase and separate tokens with nulls.
2134 	 */
2135 	len = strlen(str);
2136 	if ((nstr = malloc(len + 1)) == NULL)
2137 		return (1);
2138 	(void) strcpy(nstr, str);
2139 
2140 	for (sstr = nstr; sstr; sstr++, len--) {
2141 		int	flags = 0;
2142 
2143 		if ((*sstr != '\0') && (*sstr != ',')) {
2144 			if (estr == NULL) {
2145 				if (*sstr == '=')
2146 					estr = sstr;
2147 				else {
2148 					/*
2149 					 * Translate token to uppercase.  Don't
2150 					 * use toupper(3C) as including this
2151 					 * code doubles the size of ld.so.1.
2152 					 */
2153 					if ((*sstr >= 'a') && (*sstr <= 'z'))
2154 						*sstr = *sstr - ('a' - 'A');
2155 				}
2156 			}
2157 			continue;
2158 		}
2159 
2160 		*sstr = '\0';
2161 
2162 		/*
2163 		 * Have we discovered an "=" string.
2164 		 */
2165 		if (estr) {
2166 			nlen = estr - nstr;
2167 
2168 			/*
2169 			 * If this is an unqualified "=", then this variable
2170 			 * is intended to ensure a feature is disabled.
2171 			 */
2172 			if ((*++estr == '\0') || (*estr == ','))
2173 				estr = NULL;
2174 		} else {
2175 			nlen = sstr - nstr;
2176 
2177 			/*
2178 			 * If there is no "=" found, fabricate a boolean
2179 			 * definition for any unqualified variable.  Thus,
2180 			 * LD_FLAGS=bind_now is represented as BIND_NOW=1.
2181 			 * The value "1" is sufficient to assert any boolean
2182 			 * variables.  Setting of ENV_TYP_NULL ensures any
2183 			 * string usage is reset to a NULL string, thus
2184 			 * LD_FLAGS=library_path is equivalent to
2185 			 * LIBRARY_PATH='\0'.
2186 			 */
2187 			flags |= ENV_TYP_NULL;
2188 			estr = (char *)MSG_ORIG(MSG_STR_ONE);
2189 		}
2190 
2191 		/*
2192 		 * Determine whether the environment variable is 32- or 64-bit
2193 		 * specific.  The length, len, will reflect the architecture
2194 		 * neutral portion of the string.
2195 		 */
2196 		if ((flags |= ld_arch_env(nstr, &nlen)) != ENV_TYP_IGNORE) {
2197 			ld_generic_env(nstr, nlen, estr, lmflags,
2198 			    lmtflags, (env_flags | flags), aout);
2199 		}
2200 		if (len == 0)
2201 			break;
2202 
2203 		nstr = sstr + 1;
2204 		estr = NULL;
2205 	}
2206 
2207 	return (0);
2208 }
2209 
2210 /*
2211  * Variant of getopt(), intended for use when ld.so.1 is invoked directly
2212  * from the command line.  The only command line option allowed is -e followed
2213  * by a runtime linker environment variable.
2214  */
2215 int
rtld_getopt(char ** argv,char *** envp,auxv_t ** auxv,Word * lmflags,Word * lmtflags,int aout)2216 rtld_getopt(char **argv, char ***envp, auxv_t **auxv, Word *lmflags,
2217     Word *lmtflags, int aout)
2218 {
2219 	int	ndx;
2220 
2221 	for (ndx = 1; argv[ndx]; ndx++) {
2222 		char	*str;
2223 
2224 		if (argv[ndx][0] != '-')
2225 			break;
2226 
2227 		if (argv[ndx][1] == '\0') {
2228 			ndx++;
2229 			break;
2230 		}
2231 
2232 		if (argv[ndx][1] != 'e')
2233 			return (1);
2234 
2235 		if (argv[ndx][2] == '\0') {
2236 			ndx++;
2237 			if (argv[ndx] == NULL)
2238 				return (1);
2239 			str = argv[ndx];
2240 		} else
2241 			str = &argv[ndx][2];
2242 
2243 		/*
2244 		 * If the environment variable starts with LD_, strip the LD_.
2245 		 * Otherwise, take things as is.  Indicate that this variable
2246 		 * originates from the command line, as these variables take
2247 		 * precedence over any environment variables, or configuration
2248 		 * file variables.
2249 		 */
2250 		if ((str[0] == 'L') && (str[1] == 'D') && (str[2] == '_') &&
2251 		    (str[3] != '\0'))
2252 			str += 3;
2253 		if (ld_flags_env(str, lmflags, lmtflags,
2254 		    ENV_TYP_CMDLINE, aout) == 1)
2255 			return (1);
2256 	}
2257 
2258 	/*
2259 	 * Make sure an object file has been specified.
2260 	 */
2261 	if (argv[ndx] == NULL)
2262 		return (1);
2263 
2264 	/*
2265 	 * Having gotten the arguments, clean ourselves off of the stack.
2266 	 * This results in a process that looks as if it was executed directly
2267 	 * from the application.
2268 	 */
2269 	stack_cleanup(argv, envp, auxv, ndx);
2270 	return (0);
2271 }
2272 
2273 /*
2274  * Process a single LD_XXXX string.
2275  */
2276 static void
ld_str_env(const char * s1,Word * lmflags,Word * lmtflags,uint_t env_flags,int aout)2277 ld_str_env(const char *s1, Word *lmflags, Word *lmtflags, uint_t env_flags,
2278     int aout)
2279 {
2280 	const char	*s2;
2281 	size_t		len;
2282 	int		flags;
2283 
2284 	/*
2285 	 * In a branded process we must ignore all LD_XXXX variables because
2286 	 * they are intended for the brand's linker.  To affect the native
2287 	 * linker, use LD_BRAND_XXXX instead.
2288 	 */
2289 	if (rtld_flags2 & RT_FL2_BRANDED) {
2290 		if (strncmp(s1, MSG_ORIG(MSG_LD_BRAND_PREFIX),
2291 		    MSG_LD_BRAND_PREFIX_SIZE) != 0)
2292 			return;
2293 		s1 += MSG_LD_BRAND_PREFIX_SIZE;
2294 	}
2295 
2296 	/*
2297 	 * Variables with no value (ie. LD_XXXX=) turn a capability off.
2298 	 */
2299 	if ((s2 = strchr(s1, '=')) == NULL) {
2300 		len = strlen(s1);
2301 		s2 = NULL;
2302 	} else if (*++s2 == '\0') {
2303 		len = strlen(s1) - 1;
2304 		s2 = NULL;
2305 	} else {
2306 		len = s2 - s1 - 1;
2307 		while (conv_strproc_isspace(*s2))
2308 			s2++;
2309 	}
2310 
2311 	/*
2312 	 * Determine whether the environment variable is 32-bit or 64-bit
2313 	 * specific.  The length, len, will reflect the architecture neutral
2314 	 * portion of the string.
2315 	 */
2316 	if ((flags = ld_arch_env(s1, &len)) == ENV_TYP_IGNORE)
2317 		return;
2318 	env_flags |= flags;
2319 
2320 	ld_generic_env(s1, len, s2, lmflags, lmtflags, env_flags, aout);
2321 }
2322 
2323 /*
2324  * Internal getenv routine.  Called immediately after ld.so.1 initializes
2325  * itself to process any locale specific environment variables, and collect
2326  * any LD_XXXX variables for later processing.
2327  */
2328 #define	LOC_LANG	1
2329 #define	LOC_MESG	2
2330 #define	LOC_ALL		3
2331 
2332 int
readenv_user(const char ** envp,APlist ** ealpp)2333 readenv_user(const char **envp, APlist **ealpp)
2334 {
2335 	char		*locale;
2336 	const char	*s1;
2337 	int		loc = 0;
2338 
2339 	for (s1 = *envp; s1; envp++, s1 = *envp) {
2340 		const char	*s2;
2341 
2342 		if (*s1++ != 'L')
2343 			continue;
2344 
2345 		/*
2346 		 * See if we have any locale environment settings.  These
2347 		 * environment variables have a precedence, LC_ALL is higher
2348 		 * than LC_MESSAGES which is higher than LANG.
2349 		 */
2350 		s2 = s1;
2351 		if ((*s2++ == 'C') && (*s2++ == '_') && (*s2 != '\0')) {
2352 			if (strncmp(s2, MSG_ORIG(MSG_LC_ALL),
2353 			    MSG_LC_ALL_SIZE) == 0) {
2354 				s2 += MSG_LC_ALL_SIZE;
2355 				if ((*s2 != '\0') && (loc < LOC_ALL)) {
2356 					glcs[CI_LCMESSAGES].lc_un.lc_ptr =
2357 					    (char *)s2;
2358 					loc = LOC_ALL;
2359 				}
2360 			} else if (strncmp(s2, MSG_ORIG(MSG_LC_MESSAGES),
2361 			    MSG_LC_MESSAGES_SIZE) == 0) {
2362 				s2 += MSG_LC_MESSAGES_SIZE;
2363 				if ((*s2 != '\0') && (loc < LOC_MESG)) {
2364 					glcs[CI_LCMESSAGES].lc_un.lc_ptr =
2365 					    (char *)s2;
2366 					loc = LOC_MESG;
2367 				}
2368 			}
2369 			continue;
2370 		}
2371 
2372 		s2 = s1;
2373 		if ((*s2++ == 'A') && (*s2++ == 'N') && (*s2++ == 'G') &&
2374 		    (*s2++ == '=') && (*s2 != '\0') && (loc < LOC_LANG)) {
2375 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = (char *)s2;
2376 			loc = LOC_LANG;
2377 			continue;
2378 		}
2379 
2380 		/*
2381 		 * Pick off any LD_XXXX environment variables.
2382 		 */
2383 		if ((*s1++ == 'D') && (*s1++ == '_') && (*s1 != '\0')) {
2384 			if (aplist_append(ealpp, s1, AL_CNT_ENVIRON) == NULL)
2385 				return (1);
2386 		}
2387 	}
2388 
2389 	/*
2390 	 * If we have a locale setting make sure it's worth processing further.
2391 	 * C and POSIX locales don't need any processing.  In addition, to
2392 	 * ensure no one escapes the /usr/lib/locale hierarchy, don't allow
2393 	 * the locale to contain a segment that leads upward in the file system
2394 	 * hierarchy (i.e. no '..' segments).   Given that we'll be confined to
2395 	 * the /usr/lib/locale hierarchy, there is no need to extensively
2396 	 * validate the mode or ownership of any message file (as libc's
2397 	 * generic handling of message files does), or be concerned with
2398 	 * symbolic links that might otherwise send us elsewhere.  Duplicate
2399 	 * the string so that new locale setting can generically cleanup any
2400 	 * previous locales.
2401 	 */
2402 	if ((locale = glcs[CI_LCMESSAGES].lc_un.lc_ptr) != NULL) {
2403 		if (((*locale == 'C') && (*(locale + 1) == '\0')) ||
2404 		    (strcmp(locale, MSG_ORIG(MSG_TKN_POSIX)) == 0) ||
2405 		    (strstr(locale, MSG_ORIG(MSG_TKN_DOTDOT)) != NULL))
2406 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = NULL;
2407 		else
2408 			glcs[CI_LCMESSAGES].lc_un.lc_ptr = strdup(locale);
2409 	}
2410 	return (0);
2411 }
2412 
2413 /*
2414  * Process any LD_XXXX environment variables collected by readenv_user().
2415  */
2416 int
procenv_user(APlist * ealp,Word * lmflags,Word * lmtflags,int aout)2417 procenv_user(APlist *ealp, Word *lmflags, Word *lmtflags, int aout)
2418 {
2419 	Aliste		idx;
2420 	const char	*s1;
2421 
2422 	for (APLIST_TRAVERSE(ealp, idx, s1))
2423 		ld_str_env(s1, lmflags, lmtflags, 0, aout);
2424 
2425 	/*
2426 	 * Having collected the best representation of any LD_FLAGS, process
2427 	 * these strings.
2428 	 */
2429 	if (rpl_ldflags) {
2430 		if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2431 			return (1);
2432 		rpl_ldflags = NULL;
2433 	}
2434 
2435 	/*
2436 	 * Don't allow environment controlled auditing when tracing or if
2437 	 * explicitly disabled.  Trigger all tracing modes from
2438 	 * LML_FLG_TRC_ENABLE.
2439 	 */
2440 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2441 		rpl_audit = profile_lib = profile_name = NULL;
2442 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2443 		*lmflags &= ~LML_MSK_TRC;
2444 
2445 	/*
2446 	 * If both LD_BIND_NOW and LD_BIND_LAZY are specified, the former wins.
2447 	 */
2448 	if ((rtld_flags2 & (RT_FL2_BINDNOW | RT_FL2_BINDLAZY)) ==
2449 	    (RT_FL2_BINDNOW | RT_FL2_BINDLAZY))
2450 		rtld_flags2 &= ~RT_FL2_BINDLAZY;
2451 
2452 	/*
2453 	 * When using ldd(1) -r or -d against an executable, assert -p.
2454 	 */
2455 	if ((*lmflags &
2456 	    (LML_FLG_TRC_WARN | LML_FLG_TRC_LDDSTUB)) == LML_FLG_TRC_WARN)
2457 		*lmflags |= LML_FLG_TRC_NOPAREXT;
2458 
2459 	return (0);
2460 }
2461 
2462 /*
2463  * Configuration environment processing.  Called after the a.out has been
2464  * processed (as the a.out can specify its own configuration file).
2465  */
2466 int
readenv_config(Rtc_env * envtbl,Addr addr,int aout)2467 readenv_config(Rtc_env * envtbl, Addr addr, int aout)
2468 {
2469 	Word		*lmflags = &(lml_main.lm_flags);
2470 	Word		*lmtflags = &(lml_main.lm_tflags);
2471 
2472 	if (envtbl == NULL)
2473 		return (0);
2474 
2475 	while (envtbl->env_str) {
2476 		uint_t		env_flags = ENV_TYP_CONFIG;
2477 		const char	*s1 = (const char *)(envtbl->env_str + addr);
2478 
2479 		if (envtbl->env_flags & RTC_ENV_PERMANT)
2480 			env_flags |= ENV_TYP_PERMANT;
2481 
2482 		if ((*s1++ == 'L') && (*s1++ == 'D') &&
2483 		    (*s1++ == '_') && (*s1 != '\0'))
2484 			ld_str_env(s1, lmflags, lmtflags, env_flags, 0);
2485 
2486 		envtbl++;
2487 	}
2488 
2489 	/*
2490 	 * Having collected the best representation of any LD_FLAGS, process
2491 	 * these strings.
2492 	 */
2493 	if (ld_flags_env(rpl_ldflags, lmflags, lmtflags, 0, aout) == 1)
2494 		return (1);
2495 	if (ld_flags_env(prm_ldflags, lmflags, lmtflags, ENV_TYP_CONFIG,
2496 	    aout) == 1)
2497 		return (1);
2498 
2499 	/*
2500 	 * Don't allow environment controlled auditing when tracing or if
2501 	 * explicitly disabled.  Trigger all tracing modes from
2502 	 * LML_FLG_TRC_ENABLE.
2503 	 */
2504 	if ((*lmflags & LML_FLG_TRC_ENABLE) || (rtld_flags & RT_FL_NOAUDIT))
2505 		prm_audit = profile_lib = profile_name = NULL;
2506 	if ((*lmflags & LML_FLG_TRC_ENABLE) == 0)
2507 		*lmflags &= ~LML_MSK_TRC;
2508 
2509 	return (0);
2510 }
2511 
2512 int
dowrite(Prfbuf * prf)2513 dowrite(Prfbuf * prf)
2514 {
2515 	/*
2516 	 * We do not have a valid file descriptor, so we are unable
2517 	 * to flush the buffer.
2518 	 */
2519 	if (prf->pr_fd == -1)
2520 		return (0);
2521 	(void) write(prf->pr_fd, prf->pr_buf, prf->pr_cur - prf->pr_buf);
2522 	prf->pr_cur = prf->pr_buf;
2523 	return (1);
2524 }
2525 
2526 /*
2527  * Simplified printing.  The following conversion specifications are supported:
2528  *
2529  *	% [#] [-] [min field width] [. precision] s|d|x|c
2530  *
2531  *
2532  * dorprf takes the output buffer in the form of Prfbuf which permits
2533  * the verification of the output buffer size and the concatenation
2534  * of data to an already existing output buffer.  The Prfbuf
2535  * structure contains the following:
2536  *
2537  *  pr_buf	pointer to the beginning of the output buffer.
2538  *  pr_cur	pointer to the next available byte in the output buffer.  By
2539  *		setting pr_cur ahead of pr_buf you can append to an already
2540  *		existing buffer.
2541  *  pr_len	the size of the output buffer.  By setting pr_len to '0' you
2542  *		disable protection from overflows in the output buffer.
2543  *  pr_fd	a pointer to the file-descriptor the buffer will eventually be
2544  *		output to.  If pr_fd is set to '-1' then it's assumed there is
2545  *		no output buffer, and doprf() will return with an error to
2546  *		indicate an output buffer overflow.  If pr_fd is > -1 then when
2547  *		the output buffer is filled it will be flushed to pr_fd and will
2548  *		then be	available for additional data.
2549  */
2550 #define	FLG_UT_MINUS	0x0001	/* - */
2551 #define	FLG_UT_SHARP	0x0002	/* # */
2552 #define	FLG_UT_DOTSEEN	0x0008	/* dot appeared in format spec */
2553 
2554 /*
2555  * This macro is for use from within doprf only.  It is to be used for checking
2556  * the output buffer size and placing characters into the buffer.
2557  */
2558 #define	PUTC(c) \
2559 	{ \
2560 		char tmpc; \
2561 		\
2562 		tmpc = (c); \
2563 		if (bufsiz && (bp >= bufend)) { \
2564 			prf->pr_cur = bp; \
2565 			if (dowrite(prf) == 0) \
2566 				return (0); \
2567 			bp = prf->pr_cur; \
2568 		} \
2569 		*bp++ = tmpc; \
2570 	}
2571 
2572 /*
2573  * Define a local buffer size for building a numeric value - large enough to
2574  * hold a 64-bit value.
2575  */
2576 #define	NUM_SIZE	22
2577 
2578 size_t
doprf(const char * format,va_list args,Prfbuf * prf)2579 doprf(const char *format, va_list args, Prfbuf *prf)
2580 {
2581 	char	c;
2582 	char	*bp = prf->pr_cur;
2583 	char	*bufend = prf->pr_buf + prf->pr_len;
2584 	size_t	bufsiz = prf->pr_len;
2585 
2586 	while ((c = *format++) != '\0') {
2587 		if (c != '%') {
2588 			PUTC(c);
2589 		} else {
2590 			int	base = 0, flag = 0, width = 0, prec = 0;
2591 			size_t	_i;
2592 			int	_c, _n;
2593 			char	*_s;
2594 			int	ls = 0;
2595 again:
2596 			c = *format++;
2597 			switch (c) {
2598 			case '-':
2599 				flag |= FLG_UT_MINUS;
2600 				goto again;
2601 			case '#':
2602 				flag |= FLG_UT_SHARP;
2603 				goto again;
2604 			case '.':
2605 				flag |= FLG_UT_DOTSEEN;
2606 				goto again;
2607 			case '0':
2608 			case '1':
2609 			case '2':
2610 			case '3':
2611 			case '4':
2612 			case '5':
2613 			case '6':
2614 			case '7':
2615 			case '8':
2616 			case '9':
2617 				if (flag & FLG_UT_DOTSEEN)
2618 					prec = (prec * 10) + c - '0';
2619 				else
2620 					width = (width * 10) + c - '0';
2621 				goto again;
2622 			case 'x':
2623 			case 'X':
2624 				base = 16;
2625 				break;
2626 			case 'd':
2627 			case 'D':
2628 			case 'u':
2629 				base = 10;
2630 				flag &= ~FLG_UT_SHARP;
2631 				break;
2632 			case 'l':
2633 				base = 10;
2634 				ls++; /* number of l's (long or long long) */
2635 				if ((*format == 'l') ||
2636 				    (*format == 'd') || (*format == 'D') ||
2637 				    (*format == 'x') || (*format == 'X') ||
2638 				    (*format == 'o') || (*format == 'O') ||
2639 				    (*format == 'u') || (*format == 'U'))
2640 					goto again;
2641 				break;
2642 			case 'o':
2643 			case 'O':
2644 				base = 8;
2645 				break;
2646 			case 'c':
2647 				_c = va_arg(args, int);
2648 
2649 				for (_i = 24; _i > 0; _i -= 8) {
2650 					if ((c = ((_c >> _i) & 0x7f)) != 0) {
2651 						PUTC(c);
2652 					}
2653 				}
2654 				if ((c = ((_c >> _i) & 0x7f)) != 0) {
2655 					PUTC(c);
2656 				}
2657 				break;
2658 			case 's':
2659 				_s = va_arg(args, char *);
2660 				_i = strlen(_s);
2661 				/* LINTED */
2662 				_n = (int)(width - _i);
2663 				if (!prec)
2664 					/* LINTED */
2665 					prec = (int)_i;
2666 
2667 				if (width && !(flag & FLG_UT_MINUS)) {
2668 					while (_n-- > 0)
2669 						PUTC(' ');
2670 				}
2671 				while (((c = *_s++) != 0) && prec--) {
2672 					PUTC(c);
2673 				}
2674 				if (width && (flag & FLG_UT_MINUS)) {
2675 					while (_n-- > 0)
2676 						PUTC(' ');
2677 				}
2678 				break;
2679 			case '%':
2680 				PUTC('%');
2681 				break;
2682 			default:
2683 				break;
2684 			}
2685 
2686 			/*
2687 			 * Numeric processing
2688 			 */
2689 			if (base) {
2690 				char		local[NUM_SIZE];
2691 				size_t		ssize = 0, psize = 0;
2692 				const char	*string =
2693 				    MSG_ORIG(MSG_STR_HEXNUM);
2694 				const char	*prefix =
2695 				    MSG_ORIG(MSG_STR_EMPTY);
2696 				u_longlong_t	num;
2697 
2698 				switch (ls) {
2699 				case 0:	/* int */
2700 					num = (u_longlong_t)
2701 					    va_arg(args, uint_t);
2702 					break;
2703 				case 1:	/* long */
2704 					num = (u_longlong_t)
2705 					    va_arg(args, ulong_t);
2706 					break;
2707 				case 2:	/* long long */
2708 					num = va_arg(args, u_longlong_t);
2709 					break;
2710 				}
2711 
2712 				if (flag & FLG_UT_SHARP) {
2713 					if (base == 16) {
2714 						prefix = MSG_ORIG(MSG_STR_HEX);
2715 						psize = 2;
2716 					} else {
2717 						prefix = MSG_ORIG(MSG_STR_ZERO);
2718 						psize = 1;
2719 					}
2720 				}
2721 				if ((base == 10) && (long)num < 0) {
2722 					prefix = MSG_ORIG(MSG_STR_NEGATE);
2723 					psize = MSG_STR_NEGATE_SIZE;
2724 					num = (u_longlong_t)(-(longlong_t)num);
2725 				}
2726 
2727 				/*
2728 				 * Convert the numeric value into a local
2729 				 * string (stored in reverse order).
2730 				 */
2731 				_s = local;
2732 				do {
2733 					*_s++ = string[num % base];
2734 					num /= base;
2735 					ssize++;
2736 				} while (num);
2737 
2738 				ASSERT(ssize < sizeof (local));
2739 
2740 				/*
2741 				 * Provide any precision or width padding.
2742 				 */
2743 				if (prec) {
2744 					/* LINTED */
2745 					_n = (int)(prec - ssize);
2746 					while ((_n-- > 0) &&
2747 					    (ssize < sizeof (local))) {
2748 						*_s++ = '0';
2749 						ssize++;
2750 					}
2751 				}
2752 				if (width && !(flag & FLG_UT_MINUS)) {
2753 					/* LINTED */
2754 					_n = (int)(width - ssize - psize);
2755 					while (_n-- > 0) {
2756 						PUTC(' ');
2757 					}
2758 				}
2759 
2760 				/*
2761 				 * Print any prefix and the numeric string
2762 				 */
2763 				while (*prefix)
2764 					PUTC(*prefix++);
2765 				do {
2766 					PUTC(*--_s);
2767 				} while (_s > local);
2768 
2769 				/*
2770 				 * Provide any width padding.
2771 				 */
2772 				if (width && (flag & FLG_UT_MINUS)) {
2773 					/* LINTED */
2774 					_n = (int)(width - ssize - psize);
2775 					while (_n-- > 0)
2776 						PUTC(' ');
2777 				}
2778 			}
2779 		}
2780 	}
2781 
2782 	PUTC('\0');
2783 	prf->pr_cur = bp;
2784 	return (1);
2785 }
2786 
2787 static int
doprintf(const char * format,va_list args,Prfbuf * prf)2788 doprintf(const char *format, va_list args, Prfbuf *prf)
2789 {
2790 	char	*ocur = prf->pr_cur;
2791 
2792 	if (doprf(format, args, prf) == 0)
2793 		return (0);
2794 	/* LINTED */
2795 	return ((int)(prf->pr_cur - ocur));
2796 }
2797 
2798 /* VARARGS2 */
2799 int
sprintf(char * buf,const char * format,...)2800 sprintf(char *buf, const char *format, ...)
2801 {
2802 	va_list	args;
2803 	int	len;
2804 	Prfbuf	prf;
2805 
2806 	va_start(args, format);
2807 	prf.pr_buf = prf.pr_cur = buf;
2808 	prf.pr_len = 0;
2809 	prf.pr_fd = -1;
2810 	len = doprintf(format, args, &prf);
2811 	va_end(args);
2812 
2813 	/*
2814 	 * sprintf() return value excludes the terminating null byte.
2815 	 */
2816 	return (len - 1);
2817 }
2818 
2819 /* VARARGS3 */
2820 int
snprintf(char * buf,size_t n,const char * format,...)2821 snprintf(char *buf, size_t n, const char *format, ...)
2822 {
2823 	va_list	args;
2824 	int	len;
2825 	Prfbuf	prf;
2826 
2827 	va_start(args, format);
2828 	prf.pr_buf = prf.pr_cur = buf;
2829 	prf.pr_len = n;
2830 	prf.pr_fd = -1;
2831 	len = doprintf(format, args, &prf);
2832 	va_end(args);
2833 
2834 	return (len);
2835 }
2836 
2837 /* VARARGS2 */
2838 int
bufprint(Prfbuf * prf,const char * format,...)2839 bufprint(Prfbuf *prf, const char *format, ...)
2840 {
2841 	va_list	args;
2842 	int	len;
2843 
2844 	va_start(args, format);
2845 	len = doprintf(format, args, prf);
2846 	va_end(args);
2847 
2848 	return (len);
2849 }
2850 
2851 /*PRINTFLIKE1*/
2852 int
printf(const char * format,...)2853 printf(const char *format, ...)
2854 {
2855 	va_list	args;
2856 	char	buffer[ERRSIZE];
2857 	Prfbuf	prf;
2858 
2859 	va_start(args, format);
2860 	prf.pr_buf = prf.pr_cur = buffer;
2861 	prf.pr_len = ERRSIZE;
2862 	prf.pr_fd = 1;
2863 	(void) doprf(format, args, &prf);
2864 	va_end(args);
2865 	/*
2866 	 * Trim trailing '\0' form buffer
2867 	 */
2868 	prf.pr_cur--;
2869 	return (dowrite(&prf));
2870 }
2871 
2872 static char	errbuf[ERRSIZE], *nextptr = errbuf, *prevptr = NULL;
2873 
2874 /*
2875  * All error messages go through eprintf().  During process initialization,
2876  * these messages are directed to the standard error, however once control has
2877  * been passed to the applications code these messages are stored in an internal
2878  * buffer for use with dlerror().  Note, fatal error conditions that may occur
2879  * while running the application will still cause a standard error message, see
2880  * rtldexit() in this file for details.
2881  * The RT_FL_APPLIC flag serves to indicate the transition between process
2882  * initialization and when the applications code is running.
2883  */
2884 void
veprintf(Lm_list * lml,Error error,const char * format,va_list args)2885 veprintf(Lm_list *lml, Error error, const char *format, va_list args)
2886 {
2887 	int		overflow = 0;
2888 	static int	lock = 0;
2889 	Prfbuf		prf;
2890 
2891 	if (lock || (nextptr == (errbuf + ERRSIZE)))
2892 		return;
2893 
2894 	/*
2895 	 * Note: this lock is here to prevent the same thread from recursively
2896 	 * entering itself during a eprintf.  ie: during eprintf malloc() fails
2897 	 * and we try and call eprintf ... and then malloc() fails ....
2898 	 */
2899 	lock = 1;
2900 
2901 	/*
2902 	 * If we have completed startup initialization, all error messages
2903 	 * must be saved.  These are reported through dlerror().  If we're
2904 	 * still in the initialization stage, output the error directly and
2905 	 * add a newline.
2906 	 */
2907 	prf.pr_buf = prf.pr_cur = nextptr;
2908 	prf.pr_len = ERRSIZE - (nextptr - errbuf);
2909 
2910 	if ((rtld_flags & RT_FL_APPLIC) == 0)
2911 		prf.pr_fd = 2;
2912 	else
2913 		prf.pr_fd = -1;
2914 
2915 	if (error > ERR_NONE) {
2916 		if ((error == ERR_FATAL) && (rtld_flags2 & RT_FL2_FTL2WARN))
2917 			error = ERR_WARNING;
2918 		switch (error) {
2919 		case ERR_WARNING_NF:
2920 			if (err_strs[ERR_WARNING_NF] == NULL)
2921 				err_strs[ERR_WARNING_NF] =
2922 				    MSG_INTL(MSG_ERR_WARNING);
2923 			break;
2924 		case ERR_WARNING:
2925 			if (err_strs[ERR_WARNING] == NULL)
2926 				err_strs[ERR_WARNING] =
2927 				    MSG_INTL(MSG_ERR_WARNING);
2928 			break;
2929 		case ERR_GUIDANCE:
2930 			if (err_strs[ERR_GUIDANCE] == NULL)
2931 				err_strs[ERR_GUIDANCE] =
2932 				    MSG_INTL(MSG_ERR_GUIDANCE);
2933 			break;
2934 		case ERR_FATAL:
2935 			if (err_strs[ERR_FATAL] == NULL)
2936 				err_strs[ERR_FATAL] = MSG_INTL(MSG_ERR_FATAL);
2937 			break;
2938 		case ERR_ELF:
2939 			if (err_strs[ERR_ELF] == NULL)
2940 				err_strs[ERR_ELF] = MSG_INTL(MSG_ERR_ELF);
2941 			break;
2942 		}
2943 		if (procname) {
2944 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR1),
2945 			    rtldname, procname, err_strs[error]) == 0)
2946 				overflow = 1;
2947 		} else {
2948 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2949 			    rtldname, err_strs[error]) == 0)
2950 				overflow = 1;
2951 		}
2952 		if (overflow == 0) {
2953 			/*
2954 			 * Remove the terminating '\0'.
2955 			 */
2956 			prf.pr_cur--;
2957 		}
2958 	}
2959 
2960 	if ((overflow == 0) && doprf(format, args, &prf) == 0)
2961 		overflow = 1;
2962 
2963 	/*
2964 	 * If this is an ELF error, it will have been generated by a support
2965 	 * object that has a dependency on libelf.  ld.so.1 doesn't generate any
2966 	 * ELF error messages as it doesn't interact with libelf.  Determine the
2967 	 * ELF error string.
2968 	 */
2969 	if ((overflow == 0) && (error == ERR_ELF)) {
2970 		static int		(*elfeno)() = 0;
2971 		static const char	*(*elfemg)();
2972 		const char		*emsg;
2973 		Rt_map			*dlmp, *lmp = lml_rtld.lm_head;
2974 
2975 		if (NEXT(lmp) && (elfeno == 0)) {
2976 			if (((elfemg = (const char *(*)())dlsym_intn(RTLD_NEXT,
2977 			    MSG_ORIG(MSG_SYM_ELFERRMSG),
2978 			    lmp, &dlmp)) == NULL) ||
2979 			    ((elfeno = (int (*)())dlsym_intn(RTLD_NEXT,
2980 			    MSG_ORIG(MSG_SYM_ELFERRNO), lmp, &dlmp)) == NULL))
2981 				elfeno = 0;
2982 		}
2983 
2984 		/*
2985 		 * Lookup the message; equivalent to elf_errmsg(elf_errno()).
2986 		 */
2987 		if (elfeno && ((emsg = (* elfemg)((* elfeno)())) != NULL)) {
2988 			prf.pr_cur--;
2989 			if (bufprint(&prf, MSG_ORIG(MSG_STR_EMSGFOR2),
2990 			    emsg) == 0)
2991 				overflow = 1;
2992 		}
2993 	}
2994 
2995 	/*
2996 	 * Push out any message that's been built.  Note, in the case of an
2997 	 * overflow condition, this message may be incomplete, in which case
2998 	 * make sure any partial string is null terminated.
2999 	 */
3000 	if ((rtld_flags & (RT_FL_APPLIC | RT_FL_SILENCERR)) == 0) {
3001 		*(prf.pr_cur - 1) = '\n';
3002 		(void) dowrite(&prf);
3003 	}
3004 	if (overflow)
3005 		*(prf.pr_cur - 1) = '\0';
3006 
3007 	DBG_CALL(Dbg_util_str(lml, nextptr));
3008 
3009 	/*
3010 	 * Determine if there was insufficient space left in the buffer to
3011 	 * complete the message.  If so, we'll have printed out as much as had
3012 	 * been processed if we're not yet executing the application.
3013 	 * Otherwise, there will be some debugging diagnostic indicating
3014 	 * as much of the error message as possible.  Write out a final buffer
3015 	 * overflow diagnostic - unlocalized, so we don't chance more errors.
3016 	 */
3017 	if (overflow) {
3018 		char	*str = (char *)MSG_INTL(MSG_EMG_BUFOVRFLW);
3019 
3020 		if ((rtld_flags & RT_FL_SILENCERR) == 0) {
3021 			lasterr = str;
3022 
3023 			if ((rtld_flags & RT_FL_APPLIC) == 0) {
3024 				(void) write(2, str, strlen(str));
3025 				(void) write(2, MSG_ORIG(MSG_STR_NL),
3026 				    MSG_STR_NL_SIZE);
3027 			}
3028 		}
3029 		DBG_CALL(Dbg_util_str(lml, str));
3030 
3031 		lock = 0;
3032 		nextptr = errbuf + ERRSIZE;
3033 		return;
3034 	}
3035 
3036 	/*
3037 	 * If the application has started, then error messages are being saved
3038 	 * for retrieval by dlerror(), or possible flushing from rtldexit() in
3039 	 * the case of a fatal error.  In this case, establish the next error
3040 	 * pointer.  If we haven't started the application, the whole message
3041 	 * buffer can be reused.
3042 	 */
3043 	if ((rtld_flags & RT_FL_SILENCERR) == 0) {
3044 		lasterr = nextptr;
3045 
3046 		/*
3047 		 * Note, should we encounter an error such as ENOMEM, there may
3048 		 * be a number of the same error messages (ie. an operation
3049 		 * fails with ENOMEM, and then the attempts to construct the
3050 		 * error message itself, which incurs additional ENOMEM errors).
3051 		 * Compare any previous error message with the one we've just
3052 		 * created to prevent any duplication clutter.
3053 		 */
3054 		if ((rtld_flags & RT_FL_APPLIC) &&
3055 		    ((prevptr == NULL) || (strcmp(prevptr, nextptr) != 0))) {
3056 			prevptr = nextptr;
3057 			nextptr = prf.pr_cur;
3058 			*nextptr = '\0';
3059 		}
3060 	}
3061 	lock = 0;
3062 }
3063 
3064 /*PRINTFLIKE3*/
3065 void
eprintf(Lm_list * lml,Error error,const char * format,...)3066 eprintf(Lm_list *lml, Error error, const char *format, ...)
3067 {
3068 	va_list		args;
3069 
3070 	va_start(args, format);
3071 	veprintf(lml, error, format, args);
3072 	va_end(args);
3073 }
3074 
3075 /*
3076  * Provide assfail() for ASSERT() statements.  See <sys/debug.h> for further
3077  * details.
3078  */
3079 int
assfail(const char * a,const char * f,int l)3080 assfail(const char *a, const char *f, int l)
3081 {
3082 	(void) printf("assertion failed: %s, file: %s, line: %d\n", a, f, l);
3083 	(void) _lwp_kill(_lwp_self(), SIGABRT);
3084 	return (0);
3085 }
3086 
3087 void
assfail3(const char * msg,uintmax_t a,const char * op,uintmax_t b,const char * f,int l)3088 assfail3(const char *msg, uintmax_t a, const char *op, uintmax_t b,
3089     const char *f, int l)
3090 {
3091 	(void) printf("assertion failed: %s (0x%llx %s 0x%llx), "
3092 	    "file: %s, line: %d\n", msg, (unsigned long long)a, op,
3093 	    (unsigned long long)b, f, l);
3094 	(void) _lwp_kill(_lwp_self(), SIGABRT);
3095 }
3096 
3097 /*
3098  * Exit.  If we arrive here with a non zero status it's because of a fatal
3099  * error condition (most commonly a relocation error).  If the application has
3100  * already had control, then the actual fatal error message will have been
3101  * recorded in the dlerror() message buffer.  Print the message before really
3102  * exiting.
3103  */
3104 void
rtldexit(Lm_list * lml,int status)3105 rtldexit(Lm_list * lml, int status)
3106 {
3107 	if (status) {
3108 		if (rtld_flags & RT_FL_APPLIC) {
3109 			/*
3110 			 * If the error buffer has been used, write out all
3111 			 * pending messages - lasterr is simply a pointer to
3112 			 * the last message in this buffer.  However, if the
3113 			 * buffer couldn't be created at all, lasterr points
3114 			 * to a constant error message string.
3115 			 */
3116 			if (*errbuf) {
3117 				char	*errptr = errbuf;
3118 				char	*errend = errbuf + ERRSIZE;
3119 
3120 				while ((errptr < errend) && *errptr) {
3121 					size_t	size = strlen(errptr);
3122 					(void) write(2, errptr, size);
3123 					(void) write(2, MSG_ORIG(MSG_STR_NL),
3124 					    MSG_STR_NL_SIZE);
3125 					errptr += (size + 1);
3126 				}
3127 			}
3128 			if (lasterr && ((lasterr < errbuf) ||
3129 			    (lasterr > (errbuf + ERRSIZE)))) {
3130 				(void) write(2, lasterr, strlen(lasterr));
3131 				(void) write(2, MSG_ORIG(MSG_STR_NL),
3132 				    MSG_STR_NL_SIZE);
3133 			}
3134 		}
3135 		leave(lml, 0);
3136 		(void) _lwp_kill(_lwp_self(), killsig);
3137 	}
3138 	_exit(status);
3139 }
3140 
3141 /*
3142  * Map anonymous memory via MAP_ANON (added in Solaris 8).
3143  */
3144 void *
dz_map(Lm_list * lml,caddr_t addr,size_t len,int prot,int flags)3145 dz_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3146 {
3147 	caddr_t	va;
3148 
3149 	if ((va = (caddr_t)mmap(addr, len, prot,
3150 	    (flags | MAP_ANON), -1, 0)) == MAP_FAILED) {
3151 		int	err = errno;
3152 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAPANON),
3153 		    strerror(err));
3154 		return (MAP_FAILED);
3155 	}
3156 	return (va);
3157 }
3158 
3159 static int	nu_fd = FD_UNAVAIL;
3160 
3161 void *
nu_map(Lm_list * lml,caddr_t addr,size_t len,int prot,int flags)3162 nu_map(Lm_list *lml, caddr_t addr, size_t len, int prot, int flags)
3163 {
3164 	caddr_t	va;
3165 	int	err;
3166 
3167 	if (nu_fd == FD_UNAVAIL) {
3168 		if ((nu_fd = open(MSG_ORIG(MSG_PTH_DEVNULL),
3169 		    O_RDONLY)) == FD_UNAVAIL) {
3170 			err = errno;
3171 			eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_OPEN),
3172 			    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3173 			return (MAP_FAILED);
3174 		}
3175 	}
3176 
3177 	if ((va = (caddr_t)mmap(addr, len, prot, flags, nu_fd, 0)) ==
3178 	    MAP_FAILED) {
3179 		err = errno;
3180 		eprintf(lml, ERR_FATAL, MSG_INTL(MSG_SYS_MMAP),
3181 		    MSG_ORIG(MSG_PTH_DEVNULL), strerror(err));
3182 	}
3183 	return (va);
3184 }
3185 
3186 /*
3187  * Generic entry point from user code - simply grabs a lock, and bumps the
3188  * entrance count.
3189  */
3190 int
enter(int flags)3191 enter(int flags)
3192 {
3193 	if (rt_bind_guard(THR_FLG_RTLD | thr_flg_nolock | flags)) {
3194 		if (!thr_flg_nolock)
3195 			(void) rt_mutex_lock(&rtldlock);
3196 		if (rtld_flags & RT_FL_OPERATION) {
3197 			ld_entry_cnt++;
3198 
3199 			/*
3200 			 * Reset the diagnostic time information for each new
3201 			 * "operation".  Thus timing diagnostics are relative
3202 			 * to entering ld.so.1.
3203 			 */
3204 			if (DBG_ISTIME() &&
3205 			    (gettimeofday(&DBG_TOTALTIME, NULL) == 0)) {
3206 				DBG_DELTATIME = DBG_TOTALTIME;
3207 				DBG_ONRESET();
3208 			}
3209 		}
3210 		return (1);
3211 	}
3212 	return (0);
3213 }
3214 
3215 /*
3216  * Determine whether a search path has been used.
3217  */
3218 static void
is_path_used(Lm_list * lml,Word unref,int * nl,Alist * alp,const char * obj)3219 is_path_used(Lm_list *lml, Word unref, int *nl, Alist *alp, const char *obj)
3220 {
3221 	Pdesc	*pdp;
3222 	Aliste	idx;
3223 
3224 	for (ALIST_TRAVERSE(alp, idx, pdp)) {
3225 		const char	*fmt, *name;
3226 
3227 		if ((pdp->pd_plen == 0) || (pdp->pd_flags & PD_FLG_USED))
3228 			continue;
3229 
3230 		/*
3231 		 * If this pathname originated from an expanded token, use the
3232 		 * original for any diagnostic output.
3233 		 */
3234 		if ((name = pdp->pd_oname) == NULL)
3235 			name = pdp->pd_pname;
3236 
3237 		if (unref == 0) {
3238 			if ((*nl)++ == 0)
3239 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3240 			DBG_CALL(Dbg_unused_path(lml, name, pdp->pd_flags,
3241 			    (pdp->pd_flags & PD_FLG_DUPLICAT), obj));
3242 			continue;
3243 		}
3244 
3245 		if (pdp->pd_flags & LA_SER_LIBPATH) {
3246 			if (pdp->pd_flags & LA_SER_CONFIG) {
3247 				if (pdp->pd_flags & PD_FLG_DUPLICAT)
3248 					fmt = MSG_INTL(MSG_DUP_LDLIBPATHC);
3249 				else
3250 					fmt = MSG_INTL(MSG_USD_LDLIBPATHC);
3251 			} else {
3252 				if (pdp->pd_flags & PD_FLG_DUPLICAT)
3253 					fmt = MSG_INTL(MSG_DUP_LDLIBPATH);
3254 				else
3255 					fmt = MSG_INTL(MSG_USD_LDLIBPATH);
3256 			}
3257 		} else if (pdp->pd_flags & LA_SER_RUNPATH) {
3258 			fmt = MSG_INTL(MSG_USD_RUNPATH);
3259 		} else
3260 			continue;
3261 
3262 		if ((*nl)++ == 0)
3263 			(void) printf(MSG_ORIG(MSG_STR_NL));
3264 		(void) printf(fmt, name, obj);
3265 	}
3266 }
3267 
3268 /*
3269  * Generate diagnostics as to whether an object has been used.  A symbolic
3270  * reference that gets bound to an object marks it as used.  Dependencies that
3271  * are unused when RTLD_NOW is in effect should be removed from future builds
3272  * of an object.  Dependencies that are unused without RTLD_NOW in effect are
3273  * candidates for lazy-loading.
3274  *
3275  * Unreferenced objects identify objects that are defined as dependencies but
3276  * are unreferenced by the caller.  These unreferenced objects may however be
3277  * referenced by other objects within the process, and therefore don't qualify
3278  * as completely unused.  They are still an unnecessary overhead.
3279  *
3280  * Unreferenced runpaths are also captured under ldd -U, or "unused,detail"
3281  * debugging.
3282  */
3283 void
unused(Lm_list * lml)3284 unused(Lm_list *lml)
3285 {
3286 	Rt_map		*lmp;
3287 	int		nl = 0;
3288 	Word		unref, unuse;
3289 
3290 	/*
3291 	 * If we're not tracing unused references or dependencies, or debugging
3292 	 * there's nothing to do.
3293 	 */
3294 	unref = lml->lm_flags & LML_FLG_TRC_UNREF;
3295 	unuse = lml->lm_flags & LML_FLG_TRC_UNUSED;
3296 
3297 	if ((unref == 0) && (unuse == 0) && (DBG_ENABLED == 0))
3298 		return;
3299 
3300 	/*
3301 	 * Detect unused global search paths.
3302 	 */
3303 	if (rpl_libdirs)
3304 		is_path_used(lml, unref, &nl, rpl_libdirs, config->c_name);
3305 	if (prm_libdirs)
3306 		is_path_used(lml, unref, &nl, prm_libdirs, config->c_name);
3307 
3308 	nl = 0;
3309 	lmp = lml->lm_head;
3310 	if (RLIST(lmp))
3311 		is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3312 
3313 	/*
3314 	 * Traverse the link-maps looking for unreferenced or unused
3315 	 * dependencies.  Ignore the first object on a link-map list, as this
3316 	 * is always used.
3317 	 */
3318 	nl = 0;
3319 	for (lmp = NEXT_RT_MAP(lmp); lmp; lmp = NEXT_RT_MAP(lmp)) {
3320 		/*
3321 		 * Determine if this object contains any runpaths that have
3322 		 * not been used.
3323 		 */
3324 		if (RLIST(lmp))
3325 			is_path_used(lml, unref, &nl, RLIST(lmp), NAME(lmp));
3326 
3327 		/*
3328 		 * If tracing unreferenced objects, or under debugging,
3329 		 * determine whether any of this objects callers haven't
3330 		 * referenced it.
3331 		 */
3332 		if (unref || DBG_ENABLED) {
3333 			Bnd_desc	*bdp;
3334 			Aliste		idx;
3335 
3336 			for (APLIST_TRAVERSE(CALLERS(lmp), idx, bdp)) {
3337 				Rt_map	*clmp;
3338 
3339 				if (bdp->b_flags & BND_REFER)
3340 					continue;
3341 
3342 				clmp = bdp->b_caller;
3343 				if (FLAGS1(clmp) & FL1_RT_LDDSTUB)
3344 					continue;
3345 
3346 				/* BEGIN CSTYLED */
3347 				if (nl++ == 0) {
3348 					if (unref)
3349 					    (void) printf(MSG_ORIG(MSG_STR_NL));
3350 					else
3351 					    DBG_CALL(Dbg_util_nl(lml,
3352 						DBG_NL_STD));
3353 				}
3354 
3355 				if (unref)
3356 				    (void) printf(MSG_INTL(MSG_LDD_UNREF_FMT),
3357 					NAME(lmp), NAME(clmp));
3358 				else
3359 				    DBG_CALL(Dbg_unused_unref(lmp, NAME(clmp)));
3360 				/* END CSTYLED */
3361 			}
3362 		}
3363 
3364 		/*
3365 		 * If tracing unused objects simply display those objects that
3366 		 * haven't been referenced by anyone.
3367 		 */
3368 		if (FLAGS1(lmp) & FL1_RT_USED)
3369 			continue;
3370 
3371 		if (nl++ == 0) {
3372 			if (unref || unuse)
3373 				(void) printf(MSG_ORIG(MSG_STR_NL));
3374 			else
3375 				DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3376 		}
3377 		if (CYCGROUP(lmp)) {
3378 			if (unref || unuse)
3379 				(void) printf(MSG_INTL(MSG_LDD_UNCYC_FMT),
3380 				    NAME(lmp), CYCGROUP(lmp));
3381 			else
3382 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0,
3383 				    CYCGROUP(lmp)));
3384 		} else {
3385 			if (unref || unuse)
3386 				(void) printf(MSG_INTL(MSG_LDD_UNUSED_FMT),
3387 				    NAME(lmp));
3388 			else
3389 				DBG_CALL(Dbg_unused_file(lml, NAME(lmp), 0, 0));
3390 		}
3391 	}
3392 
3393 	DBG_CALL(Dbg_util_nl(lml, DBG_NL_STD));
3394 }
3395 
3396 /*
3397  * Generic cleanup routine called prior to returning control to the user.
3398  * Ensures that any ld.so.1 specific file descriptors or temporary mapping are
3399  * released, and any locks dropped.
3400  */
3401 void
leave(Lm_list * lml,int flags)3402 leave(Lm_list *lml, int flags)
3403 {
3404 	/*
3405 	 * Alert the debuggers that the link-maps are consistent.
3406 	 */
3407 	rd_event(lml, RD_DLACTIVITY, RT_CONSISTENT);
3408 
3409 	/*
3410 	 * Alert any auditors that the link-maps are consistent.
3411 	 */
3412 	if (lml->lm_flags & LML_FLG_ACTAUDIT) {
3413 		audit_activity(lml->lm_head, LA_ACT_CONSISTENT);
3414 		lml->lm_flags &= ~LML_FLG_ACTAUDIT;
3415 	}
3416 
3417 	if (nu_fd != FD_UNAVAIL) {
3418 		(void) close(nu_fd);
3419 		nu_fd = FD_UNAVAIL;
3420 	}
3421 
3422 	/*
3423 	 * Reinitialize error message pointer, and any overflow indication.
3424 	 */
3425 	nextptr = errbuf;
3426 	prevptr = NULL;
3427 
3428 	/*
3429 	 * Defragment any freed memory.
3430 	 */
3431 	if (aplist_nitems(free_alp))
3432 		defrag();
3433 
3434 	/*
3435 	 * Don't drop our lock if we are running on our link-map list as
3436 	 * there's little point in doing so since we are single-threaded.
3437 	 *
3438 	 * LML_FLG_HOLDLOCK is set for:
3439 	 *  -	 The ld.so.1's link-map list.
3440 	 *  -	 The auditor's link-map if the environment is pre-UPM.
3441 	 */
3442 	if (lml->lm_flags & LML_FLG_HOLDLOCK)
3443 		return;
3444 
3445 	if (rt_bind_clear(0) & THR_FLG_RTLD) {
3446 		if (!thr_flg_nolock)
3447 			(void) rt_mutex_unlock(&rtldlock);
3448 		(void) rt_bind_clear(THR_FLG_RTLD | thr_flg_nolock | flags);
3449 	}
3450 }
3451 
3452 int
callable(Rt_map * clmp,Rt_map * dlmp,Grp_hdl * ghp,uint_t slflags)3453 callable(Rt_map *clmp, Rt_map *dlmp, Grp_hdl *ghp, uint_t slflags)
3454 {
3455 	APlist		*calp, *dalp;
3456 	Aliste		idx1, idx2;
3457 	Grp_hdl		*ghp1, *ghp2;
3458 
3459 	/*
3460 	 * An object can always find symbols within itself.
3461 	 */
3462 	if (clmp == dlmp)
3463 		return (1);
3464 
3465 	/*
3466 	 * The search for a singleton must look in every loaded object.
3467 	 */
3468 	if (slflags & LKUP_SINGLETON)
3469 		return (1);
3470 
3471 	/*
3472 	 * Don't allow an object to bind to an object that is being deleted
3473 	 * unless the binder is also being deleted.
3474 	 */
3475 	if ((FLAGS(dlmp) & FLG_RT_DELETE) &&
3476 	    ((FLAGS(clmp) & FLG_RT_DELETE) == 0))
3477 		return (0);
3478 
3479 	/*
3480 	 * An object with world access can always bind to an object with global
3481 	 * visibility.
3482 	 */
3483 	if (((MODE(clmp) & RTLD_WORLD) || (slflags & LKUP_WORLD)) &&
3484 	    (MODE(dlmp) & RTLD_GLOBAL))
3485 		return (1);
3486 
3487 	/*
3488 	 * An object with local access can only bind to an object that is a
3489 	 * member of the same group.
3490 	 */
3491 	if (((MODE(clmp) & RTLD_GROUP) == 0) ||
3492 	    ((calp = GROUPS(clmp)) == NULL) || ((dalp = GROUPS(dlmp)) == NULL))
3493 		return (0);
3494 
3495 	/*
3496 	 * Traverse the list of groups the caller is a part of.
3497 	 */
3498 	for (APLIST_TRAVERSE(calp, idx1, ghp1)) {
3499 		/*
3500 		 * If we're testing for the ability of two objects to bind to
3501 		 * each other regardless of a specific group, ignore that group.
3502 		 */
3503 		if (ghp && (ghp1 == ghp))
3504 			continue;
3505 
3506 		/*
3507 		 * Traverse the list of groups the destination is a part of.
3508 		 */
3509 		for (APLIST_TRAVERSE(dalp, idx2, ghp2)) {
3510 			Grp_desc	*gdp;
3511 			Aliste		idx3;
3512 
3513 			if (ghp1 != ghp2)
3514 				continue;
3515 
3516 			/*
3517 			 * Make sure the relationship between the destination
3518 			 * and the caller provide symbols for relocation.
3519 			 * Parents are maintained as callers, but unless the
3520 			 * destination object was opened with RTLD_PARENT, the
3521 			 * parent doesn't provide symbols for the destination
3522 			 * to relocate against.
3523 			 */
3524 			for (ALIST_TRAVERSE(ghp2->gh_depends, idx3, gdp)) {
3525 				if (dlmp != gdp->gd_depend)
3526 					continue;
3527 
3528 				if (gdp->gd_flags & GPD_RELOC)
3529 					return (1);
3530 			}
3531 		}
3532 	}
3533 	return (0);
3534 }
3535 
3536 /*
3537  * Initialize the environ symbol.  Traditionally this is carried out by the crt
3538  * code prior to jumping to main.  However, init sections get fired before this
3539  * variable is initialized, so ld.so.1 sets this directly from the AUX vector
3540  * information.  In addition, a process may have multiple link-maps (ld.so.1's
3541  * debugging and preloading objects), and link auditing, and each may need an
3542  * environ variable set.
3543  *
3544  * This routine is called after a relocation() pass, and thus provides for:
3545  *
3546  *  -	setting environ on the main link-map after the initial application and
3547  *	its dependencies have been established.  Typically environ lives in the
3548  *	application (provided by its crt), but in older applications it might
3549  *	be in libc.  Who knows what's expected of applications not built on
3550  *	Solaris.
3551  *
3552  *  -	after loading a new shared object.  We can add shared objects to various
3553  *	link-maps, and any link-map dependencies requiring getopt() require
3554  *	their own environ.  In addition, lazy loading might bring in the
3555  *	supplier of environ (libc used to be a lazy loading candidate) after
3556  *	the link-map has been established and other objects are present.
3557  *
3558  * This routine handles all these scenarios, without adding unnecessary overhead
3559  * to ld.so.1.
3560  */
3561 void
set_environ(Lm_list * lml)3562 set_environ(Lm_list *lml)
3563 {
3564 	Slookup		sl;
3565 	Sresult		sr;
3566 	uint_t		binfo;
3567 
3568 	/*
3569 	 * Initialize the symbol lookup, and symbol result, data structures.
3570 	 */
3571 	SLOOKUP_INIT(sl, MSG_ORIG(MSG_SYM_ENVIRON), lml->lm_head, lml->lm_head,
3572 	    ld_entry_cnt, 0, 0, 0, 0, LKUP_WEAK);
3573 	SRESULT_INIT(sr, MSG_ORIG(MSG_SYM_ENVIRON));
3574 
3575 	if (LM_LOOKUP_SYM(lml->lm_head)(&sl, &sr, &binfo, 0)) {
3576 		Rt_map	*dlmp = sr.sr_dmap;
3577 
3578 		lml->lm_environ = (char ***)sr.sr_sym->st_value;
3579 
3580 		if (!(FLAGS(dlmp) & FLG_RT_FIXED))
3581 			lml->lm_environ =
3582 			    (char ***)((uintptr_t)lml->lm_environ +
3583 			    (uintptr_t)ADDR(dlmp));
3584 		*(lml->lm_environ) = (char **)environ;
3585 		lml->lm_flags |= LML_FLG_ENVIRON;
3586 	}
3587 }
3588 
3589 /*
3590  * Determine whether we have a secure executable.  Uid and gid information
3591  * can be passed to us via the aux vector, however if these values are -1
3592  * then use the appropriate system call to obtain them.
3593  *
3594  *  -	If the user is the root they can do anything
3595  *
3596  *  -	If the real and effective uid's don't match, or the real and
3597  *	effective gid's don't match then this is determined to be a `secure'
3598  *	application.
3599  *
3600  * This function is called prior to any dependency processing (see _setup.c).
3601  * Any secure setting will remain in effect for the life of the process.
3602  */
3603 void
security(uid_t uid,uid_t euid,gid_t gid,gid_t egid,int auxflags)3604 security(uid_t uid, uid_t euid, gid_t gid, gid_t egid, int auxflags)
3605 {
3606 	if (auxflags != -1) {
3607 		if ((auxflags & AF_SUN_SETUGID) != 0)
3608 			rtld_flags |= RT_FL_SECURE;
3609 		return;
3610 	}
3611 
3612 	if (uid == (uid_t)-1)
3613 		uid = getuid();
3614 	if (uid) {
3615 		if (euid == (uid_t)-1)
3616 			euid = geteuid();
3617 		if (uid != euid)
3618 			rtld_flags |= RT_FL_SECURE;
3619 		else {
3620 			if (gid == (gid_t)-1)
3621 				gid = getgid();
3622 			if (egid == (gid_t)-1)
3623 				egid = getegid();
3624 			if (gid != egid)
3625 				rtld_flags |= RT_FL_SECURE;
3626 		}
3627 	}
3628 }
3629 
3630 /*
3631  * Determine whether ld.so.1 itself is owned by root and has its mode setuid.
3632  */
3633 int
is_rtld_setuid()3634 is_rtld_setuid()
3635 {
3636 	rtld_stat_t	status;
3637 	const char	*name;
3638 
3639 	if (rtld_flags2 & RT_FL2_SETUID)
3640 		return (1);
3641 
3642 	if (interp && interp->i_name)
3643 		name = interp->i_name;
3644 	else
3645 		name = NAME(lml_rtld.lm_head);
3646 
3647 	if (((rtld_stat(name, &status) == 0) &&
3648 	    (status.st_uid == 0) && (status.st_mode & S_ISUID))) {
3649 		rtld_flags2 |= RT_FL2_SETUID;
3650 		return (1);
3651 	}
3652 	return (0);
3653 }
3654 
3655 /*
3656  * Determine that systems platform name.  Normally, this name is provided from
3657  * the AT_SUN_PLATFORM aux vector from the kernel.  This routine provides a
3658  * fall back.
3659  */
3660 void
platform_name(Syscapset * scapset)3661 platform_name(Syscapset *scapset)
3662 {
3663 	char	info[SYS_NMLN];
3664 	size_t	size;
3665 
3666 	if ((scapset->sc_platsz = size =
3667 	    sysinfo(SI_PLATFORM, info, SYS_NMLN)) == (size_t)-1)
3668 		return;
3669 
3670 	if ((scapset->sc_plat = malloc(size)) == NULL) {
3671 		scapset->sc_platsz = (size_t)-1;
3672 		return;
3673 	}
3674 	(void) strcpy(scapset->sc_plat, info);
3675 }
3676 
3677 /*
3678  * Determine that systems machine name.  Normally, this name is provided from
3679  * the AT_SUN_MACHINE aux vector from the kernel.  This routine provides a
3680  * fall back.
3681  */
3682 void
machine_name(Syscapset * scapset)3683 machine_name(Syscapset *scapset)
3684 {
3685 	char	info[SYS_NMLN];
3686 	size_t	size;
3687 
3688 	if ((scapset->sc_machsz = size =
3689 	    sysinfo(SI_MACHINE, info, SYS_NMLN)) == (size_t)-1)
3690 		return;
3691 
3692 	if ((scapset->sc_mach = malloc(size)) == NULL) {
3693 		scapset->sc_machsz = (size_t)-1;
3694 		return;
3695 	}
3696 	(void) strcpy(scapset->sc_mach, info);
3697 }
3698 
3699 /*
3700  * _REENTRANT code gets errno redefined to a function so provide for return
3701  * of the thread errno if applicable.  This has no meaning in ld.so.1 which
3702  * is basically singled threaded.  Provide the interface for our dependencies.
3703  */
3704 #undef errno
3705 int *
___errno()3706 ___errno()
3707 {
3708 	extern	int	errno;
3709 
3710 	return (&errno);
3711 }
3712 
3713 /*
3714  * Determine whether a symbol name should be demangled.
3715  */
3716 const char *
demangle(const char * name)3717 demangle(const char *name)
3718 {
3719 	if (rtld_flags & RT_FL_DEMANGLE)
3720 		return (conv_demangle_name(name));
3721 	else
3722 		return (name);
3723 }
3724 
3725 #ifndef _LP64
3726 /*
3727  * Wrappers on stat() and fstat() for 32-bit rtld that uses stat64()
3728  * underneath while preserving the object size limits of a non-largefile
3729  * enabled 32-bit process. The purpose of this is to prevent large inode
3730  * values from causing stat() to fail.
3731  */
3732 inline static int
rtld_stat_process(int r,struct stat64 * lbuf,rtld_stat_t * restrict buf)3733 rtld_stat_process(int r, struct stat64 *lbuf, rtld_stat_t *restrict buf)
3734 {
3735 	extern int	errno;
3736 
3737 	/*
3738 	 * Although we used a 64-bit capable stat(), the 32-bit rtld
3739 	 * can only handle objects < 2GB in size. If this object is
3740 	 * too big, turn the success into an overflow error.
3741 	 */
3742 	if ((lbuf->st_size & 0xffffffff80000000) != 0) {
3743 		errno = EOVERFLOW;
3744 		return (-1);
3745 	}
3746 
3747 	/*
3748 	 * Transfer the information needed by rtld into a rtld_stat_t
3749 	 * structure that preserves the non-largile types for everything
3750 	 * except inode.
3751 	 */
3752 	buf->st_dev = lbuf->st_dev;
3753 	buf->st_ino = lbuf->st_ino;
3754 	buf->st_mode = lbuf->st_mode;
3755 	buf->st_uid = lbuf->st_uid;
3756 	buf->st_size = (off_t)lbuf->st_size;
3757 	buf->st_mtim = lbuf->st_mtim;
3758 #ifdef sparc
3759 	buf->st_blksize = lbuf->st_blksize;
3760 #endif
3761 
3762 	return (r);
3763 }
3764 
3765 int
rtld_stat(const char * restrict path,rtld_stat_t * restrict buf)3766 rtld_stat(const char *restrict path, rtld_stat_t *restrict buf)
3767 {
3768 	struct stat64	lbuf;
3769 	int		r;
3770 
3771 	r = stat64(path, &lbuf);
3772 	if (r != -1)
3773 		r = rtld_stat_process(r, &lbuf, buf);
3774 	return (r);
3775 }
3776 
3777 int
rtld_fstat(int fildes,rtld_stat_t * restrict buf)3778 rtld_fstat(int fildes, rtld_stat_t *restrict buf)
3779 {
3780 	struct stat64	lbuf;
3781 	int		r;
3782 
3783 	r = fstat64(fildes, &lbuf);
3784 	if (r != -1)
3785 		r = rtld_stat_process(r, &lbuf, buf);
3786 	return (r);
3787 }
3788 #endif
3789