Re: RFC: Should the linker warn about and/or control the propagation of audit libraries ?

Nick Clifton <[email protected]> writes:

> Hi Guys,
>
>   I am using an AI tool to look for potential security issues in the
>   binutils sources.  (Note - I am not using the tool to fix any
>   problems, just report them).  It has raised an interesting issue:
>   
>     The linker automatically reads DT_AUDIT entries from all
>     input shared libraries and adds them as DT_DEPAUDIT entries
>     in the output binary, with no warning.  DT_DEPAUDIT causes
>     ld.so to load the named audit library at runtime, which can
>     intercept all symbol resolutions via the rtld-audit interface
>     (la_symbind, la_pltenter, etc.).
>
>     A malicious shared library provided as a dependency (e.g.,
>     through a compromised package repository) can cause all
>     binaries linked against it to automatically load an attacker
>     controlled audit library at runtime, without any special
>     linker flags and with no diagnostic output.  The user never
>     requested this — it is silently introduced in the output.

I'm not sure I see a problem: the same issue exists with ELF
constructors without DT_AUDIT.

>
>   I am wonder what, if anything, we should do about this.  The obvious
>   thing to do would be to add a new command line option, something like:
>
>     --audit-library-propogation=[default|silent|warn|refuse]
>

That said, the use of DT_AUDIT is so unusual that I'd find a message
about it slightly interesting.

>   which would either silently propagate the libraries (ie the current
>   behaviour) or copy them, but also issue a warning message when it does
>   so, or refuse to copy them and issue error messages instead.  The
>   default behaviour could also be controlled by a configure time option.
>
>   Is this going too far ?  Would it even be helpful ?  What do you think.
>
> Cheers
>   Nick
>

thanks,
sam

-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmpqObAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkM3n
AQCEZAm+Vb7cFKLiQRbqQOhLy3tzsgL2RuaJ3NeRTbGvggEA0XRtglobwa0a3KgK
9abg95YguP3J0DoepHYG8lK4VAg=
=6ABD
-----END PGP SIGNATURE-----