diff options
| -rw-r--r-- | Kernel/Makefile | 1 | ||||
| -rw-r--r-- | Kernel/Process.cpp | 9 | ||||
| -rw-r--r-- | Libraries/LibC/Makefile | 3 | ||||
| -rw-r--r-- | Libraries/LibELF/Image.cpp | 156 | ||||
| -rw-r--r-- | Libraries/LibELF/Image.h | 3 | ||||
| -rw-r--r-- | Libraries/LibELF/Validation.cpp | 189 | ||||
| -rw-r--r-- | Libraries/LibELF/Validation.h | 36 |
7 files changed, 234 insertions, 163 deletions
diff --git a/Kernel/Makefile b/Kernel/Makefile index dd066001cb..88ff6c46af 100644 --- a/Kernel/Makefile +++ b/Kernel/Makefile @@ -11,6 +11,7 @@ OBJS = \ ../AK/StringView.o \ ../Libraries/LibELF/Image.o \ ../Libraries/LibELF/Loader.o \ + ../Libraries/LibELF/Validation.o \ ../Libraries/LibBareMetal/Output/Console.o \ ../Libraries/LibBareMetal/Output/kprintf.o \ ../Libraries/LibBareMetal/StdLib.o \ diff --git a/Kernel/Process.cpp b/Kernel/Process.cpp index f0201e1793..9b8850793a 100644 --- a/Kernel/Process.cpp +++ b/Kernel/Process.cpp @@ -78,6 +78,7 @@ #include <LibC/limits.h> #include <LibC/signal_numbers.h> #include <LibELF/Loader.h> +#include <LibELF/Validation.h> //#define PROCESS_DEBUG //#define DEBUG_POLL_SELECT @@ -1084,14 +1085,14 @@ KResultOr<NonnullRefPtr<FileDescription>> Process::find_elf_interpreter_for_exec return KResult(-ENOEXEC); auto elf_header = (Elf32_Ehdr*)first_page; - if (!ELF::Image::validate_elf_header(*elf_header, file_size)) { + if (!ELF::validate_elf_header(*elf_header, file_size)) { dbg() << "exec(" << path << "): File has invalid ELF header"; return KResult(-ENOEXEC); } // Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD String interpreter_path; - if (!ELF::Image::validate_program_headers(*elf_header, file_size, (u8*)first_page, nread, interpreter_path)) { + if (!ELF::validate_program_headers(*elf_header, file_size, (u8*)first_page, nread, interpreter_path)) { dbg() << "exec(" << path << "): File has invalid ELF Program headers"; return KResult(-ENOEXEC); } @@ -1124,14 +1125,14 @@ KResultOr<NonnullRefPtr<FileDescription>> Process::find_elf_interpreter_for_exec return KResult(-ENOEXEC); elf_header = (Elf32_Ehdr*)first_page; - if (!ELF::Image::validate_elf_header(*elf_header, interp_metadata.size)) { + if (!ELF::validate_elf_header(*elf_header, interp_metadata.size)) { dbg() << "exec(" << path << "): Interpreter (" << interpreter_description->absolute_path() << ") has invalid ELF header"; return KResult(-ENOEXEC); } // Not using KResultOr here because we'll want to do the same thing in userspace in the RTLD String interpreter_interpreter_path; - if (!ELF::Image::validate_program_headers(*elf_header, interp_metadata.size, (u8*)first_page, nread, interpreter_interpreter_path)) { + if (!ELF::validate_program_headers(*elf_header, interp_metadata.size, (u8*)first_page, nread, interpreter_interpreter_path)) { dbg() << "exec(" << path << "): Interpreter (" << interpreter_description->absolute_path() << ") has invalid ELF Program headers"; return KResult(-ENOEXEC); } diff --git a/Libraries/LibC/Makefile b/Libraries/LibC/Makefile index 8182fb8e40..8ab97b13f5 100644 --- a/Libraries/LibC/Makefile +++ b/Libraries/LibC/Makefile @@ -64,7 +64,8 @@ ELF_OBJS = \ ../LibELF/DynamicObject.o \ ../LibELF/DynamicLoader.o \ ../LibELF/Loader.o \ - ../LibELF/Image.o + ../LibELF/Image.o \ + ../LibELF/Validation.o OBJS = $(AK_OBJS) $(LIBC_OBJS) $(ELF_OBJS) diff --git a/Libraries/LibELF/Image.cpp b/Libraries/LibELF/Image.cpp index c265e3a9b8..eae3c11e16 100644 --- a/Libraries/LibELF/Image.cpp +++ b/Libraries/LibELF/Image.cpp @@ -28,6 +28,7 @@ #include <AK/StringBuilder.h> #include <AK/StringView.h> #include <LibELF/Image.h> +#include <LibELF/Validation.h> namespace ELF { @@ -261,161 +262,6 @@ const Image::Section Image::lookup_section(const String& name) const return section(0); } -bool Image::validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size) -{ - if (!IS_ELF(elf_header)) { - dbgputstr("File is not an ELF file.\n"); - return false; - } - - if (ELFCLASS32 != elf_header.e_ident[EI_CLASS]) { - dbgputstr("File is not a 32 bit ELF file.\n"); - return false; - } - - if (ELFDATA2LSB != elf_header.e_ident[EI_DATA]) { - dbgputstr("File is not a little endian ELF file.\n"); - return false; - } - - if (EV_CURRENT != elf_header.e_ident[EI_VERSION]) { - dbgprintf("File has unrecognized ELF version (%d), expected (%d)!\n", elf_header.e_ident[EI_VERSION], EV_CURRENT); - return false; - } - - if (ELFOSABI_SYSV != elf_header.e_ident[EI_OSABI]) { - dbgprintf("File has unknown OS ABI (%d), expected SYSV(0)!\n", elf_header.e_ident[EI_OSABI]); - return false; - } - - if (0 != elf_header.e_ident[EI_ABIVERSION]) { - dbgprintf("File has unknown SYSV ABI version (%d)!\n", elf_header.e_ident[EI_ABIVERSION]); - return false; - } - - if (EM_386 != elf_header.e_machine) { - dbgprintf("File has unknown machine (%d), expected i386 (3)!\n", elf_header.e_machine); - return false; - } - - if (ET_EXEC != elf_header.e_type && ET_DYN != elf_header.e_type && ET_REL != elf_header.e_type) { - dbgprintf("File has unloadable ELF type (%d), expected REL (1), EXEC (2) or DYN (3)!\n", elf_header.e_type); - return false; - } - - if (EV_CURRENT != elf_header.e_version) { - dbgprintf("File has unrecognized ELF version (%d), expected (%d)!\n", elf_header.e_version, EV_CURRENT); - return false; - } - - if (sizeof(Elf32_Ehdr) != elf_header.e_ehsize) { - dbgprintf("File has incorrect ELF header size..? (%d), expected (%d)!\n", elf_header.e_ehsize, sizeof(Elf32_Ehdr)); - return false; - } - - if (elf_header.e_phoff > file_size || elf_header.e_shoff > file_size) { - dbgprintf("SHENANIGANS! program header offset (%d) or section header offset (%d) are past the end of the file!\n", - elf_header.e_phoff, elf_header.e_shoff); - return false; - } - - if (elf_header.e_phnum != 0 && elf_header.e_phoff != elf_header.e_ehsize) { - dbgprintf("File does not have program headers directly after the ELF header? program header offset (%d), expected (%d).\n", - elf_header.e_phoff, elf_header.e_ehsize); - return false; - } - - if (0 != elf_header.e_flags) { - dbgprintf("File has incorrect ELF header flags...? (%d), expected (%d).\n", elf_header.e_flags, 0); - return false; - } - - if (0 != elf_header.e_phnum && sizeof(Elf32_Phdr) != elf_header.e_phentsize) { - dbgprintf("File has incorrect program header size..? (%d), expected (%d).\n", elf_header.e_phentsize, sizeof(Elf32_Phdr)); - return false; - } - - if (sizeof(Elf32_Shdr) != elf_header.e_shentsize) { - dbgprintf("File has incorrect section header size..? (%d), expected (%d).\n", elf_header.e_shentsize, sizeof(Elf32_Shdr)); - return false; - } - - size_t end_of_last_program_header = elf_header.e_phoff + (elf_header.e_phnum * elf_header.e_phentsize); - if (end_of_last_program_header > file_size) { - dbgprintf("SHENANIGANS! End of last program header (%d) is past the end of the file!\n", end_of_last_program_header); - return false; - } - - size_t end_of_last_section_header = elf_header.e_shoff + (elf_header.e_shnum * elf_header.e_shentsize); - if (end_of_last_section_header > file_size) { - dbgprintf("SHENANIGANS! End of last section header (%d) is past the end of the file!\n", end_of_last_section_header); - return false; - } - - if (elf_header.e_shstrndx >= elf_header.e_shnum) { - dbgprintf("SHENANIGANS! Section header string table index (%d) is not a valid index given we have %d section headers!\n", elf_header.e_shstrndx, elf_header.e_shnum); - return false; - } - - return true; -} - -bool Image::validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8* buffer, size_t buffer_size, String& interpreter_path) -{ - // Can we actually parse all the program headers in the given buffer? - size_t end_of_last_program_header = elf_header.e_phoff + (elf_header.e_phnum * elf_header.e_phentsize); - if (end_of_last_program_header > buffer_size) { - dbgprintf("Unable to parse program headers from buffer, buffer too small! Buffer size: %zu, End of program headers %zu\n", - buffer_size, end_of_last_program_header); - return false; - } - - if (file_size < buffer_size) { - dbgputstr("We somehow read more from a file than was in the file in the first place!\n"); - ASSERT_NOT_REACHED(); - } - - size_t num_program_headers = elf_header.e_phnum; - auto program_header_begin = (const Elf32_Phdr*)&(buffer[elf_header.e_phoff]); - - for (size_t header_index = 0; header_index < num_program_headers; ++header_index) { - auto& program_header = program_header_begin[header_index]; - switch (program_header.p_type) { - case PT_INTERP: - if (ET_DYN != elf_header.e_type) { - dbgprintf("Found PT_INTERP header (%d) in non-DYN ELF object! What? We can't handle this!\n", header_index); - return false; - } - // We checked above that file_size was >= buffer size. We only care about buffer size anyway, we're trying to read this! - if (program_header.p_offset + program_header.p_filesz > buffer_size) { - dbgprintf("Found PT_INTERP header (%d), but the .interp section was not within our buffer :( Your program will not be loaded today.\n", header_index); - return false; - } - interpreter_path = String((const char*)&buffer[program_header.p_offset], program_header.p_filesz - 1); - break; - case PT_LOAD: - case PT_DYNAMIC: - case PT_NOTE: - case PT_PHDR: - case PT_TLS: - if (program_header.p_offset + program_header.p_filesz > file_size) { - dbgprintf("SHENANIGANS! Program header %d segment leaks beyond end of file!\n", header_index); - return false; - } - if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) { - dbgprintf("SHENANIGANS! Program header %d segment is marked write and execute\n", header_index); - return false; - } - break; - default: - // Not handling other program header types in other code so... let's not surprise them - dbgprintf("Found program header (%d) of unrecognized type %x!\n", header_index, program_header.p_type); - return false; - } - } - return true; -} - StringView Image::Symbol::raw_data() const { auto& section = this->section(); diff --git a/Libraries/LibELF/Image.h b/Libraries/LibELF/Image.h index 7d0df2813a..a4e5497431 100644 --- a/Libraries/LibELF/Image.h +++ b/Libraries/LibELF/Image.h @@ -203,9 +203,6 @@ public: VirtualAddress entry() const { return VirtualAddress(header().e_entry); } - static bool validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size); - static bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8* buffer, size_t buffer_size, String& interpreter_path); - private: bool parse_header(); const char* raw_data(unsigned offset) const; diff --git a/Libraries/LibELF/Validation.cpp b/Libraries/LibELF/Validation.cpp new file mode 100644 index 0000000000..e4e5c5ba9e --- /dev/null +++ b/Libraries/LibELF/Validation.cpp @@ -0,0 +1,189 @@ +/* + * Copyright (c) 2020, Andrew Kaster <andrewdkaster@gmail.com> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include <AK/Assertions.h> +#include <AK/String.h> +#include <LibELF/exec_elf.h> +#include <LibELF/Validation.h> + +namespace ELF { + +bool validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size) +{ + if (!IS_ELF(elf_header)) { + dbgputstr("File is not an ELF file.\n"); + return false; + } + + if (ELFCLASS32 != elf_header.e_ident[EI_CLASS]) { + dbgputstr("File is not a 32 bit ELF file.\n"); + return false; + } + + if (ELFDATA2LSB != elf_header.e_ident[EI_DATA]) { + dbgputstr("File is not a little endian ELF file.\n"); + return false; + } + + if (EV_CURRENT != elf_header.e_ident[EI_VERSION]) { + dbgprintf("File has unrecognized ELF version (%d), expected (%d)!\n", elf_header.e_ident[EI_VERSION], EV_CURRENT); + return false; + } + + if (ELFOSABI_SYSV != elf_header.e_ident[EI_OSABI]) { + dbgprintf("File has unknown OS ABI (%d), expected SYSV(0)!\n", elf_header.e_ident[EI_OSABI]); + return false; + } + + if (0 != elf_header.e_ident[EI_ABIVERSION]) { + dbgprintf("File has unknown SYSV ABI version (%d)!\n", elf_header.e_ident[EI_ABIVERSION]); + return false; + } + + if (EM_386 != elf_header.e_machine) { + dbgprintf("File has unknown machine (%d), expected i386 (3)!\n", elf_header.e_machine); + return false; + } + + if (ET_EXEC != elf_header.e_type && ET_DYN != elf_header.e_type && ET_REL != elf_header.e_type) { + dbgprintf("File has unloadable ELF type (%d), expected REL (1), EXEC (2) or DYN (3)!\n", elf_header.e_type); + return false; + } + + if (EV_CURRENT != elf_header.e_version) { + dbgprintf("File has unrecognized ELF version (%d), expected (%d)!\n", elf_header.e_version, EV_CURRENT); + return false; + } + + if (sizeof(Elf32_Ehdr) != elf_header.e_ehsize) { + dbgprintf("File has incorrect ELF header size..? (%d), expected (%d)!\n", elf_header.e_ehsize, sizeof(Elf32_Ehdr)); + return false; + } + + if (elf_header.e_phoff > file_size || elf_header.e_shoff > file_size) { + dbgprintf("SHENANIGANS! program header offset (%d) or section header offset (%d) are past the end of the file!\n", + elf_header.e_phoff, elf_header.e_shoff); + return false; + } + + if (elf_header.e_phnum != 0 && elf_header.e_phoff != elf_header.e_ehsize) { + dbgprintf("File does not have program headers directly after the ELF header? program header offset (%d), expected (%d).\n", + elf_header.e_phoff, elf_header.e_ehsize); + return false; + } + + if (0 != elf_header.e_flags) { + dbgprintf("File has incorrect ELF header flags...? (%d), expected (%d).\n", elf_header.e_flags, 0); + return false; + } + + if (0 != elf_header.e_phnum && sizeof(Elf32_Phdr) != elf_header.e_phentsize) { + dbgprintf("File has incorrect program header size..? (%d), expected (%d).\n", elf_header.e_phentsize, sizeof(Elf32_Phdr)); + return false; + } + + if (sizeof(Elf32_Shdr) != elf_header.e_shentsize) { + dbgprintf("File has incorrect section header size..? (%d), expected (%d).\n", elf_header.e_shentsize, sizeof(Elf32_Shdr)); + return false; + } + + size_t end_of_last_program_header = elf_header.e_phoff + (elf_header.e_phnum * elf_header.e_phentsize); + if (end_of_last_program_header > file_size) { + dbgprintf("SHENANIGANS! End of last program header (%d) is past the end of the file!\n", end_of_last_program_header); + return false; + } + + size_t end_of_last_section_header = elf_header.e_shoff + (elf_header.e_shnum * elf_header.e_shentsize); + if (end_of_last_section_header > file_size) { + dbgprintf("SHENANIGANS! End of last section header (%d) is past the end of the file!\n", end_of_last_section_header); + return false; + } + + if (elf_header.e_shstrndx >= elf_header.e_shnum) { + dbgprintf("SHENANIGANS! Section header string table index (%d) is not a valid index given we have %d section headers!\n", elf_header.e_shstrndx, elf_header.e_shnum); + return false; + } + + return true; +} + +bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8* buffer, size_t buffer_size, String& interpreter_path) +{ + // Can we actually parse all the program headers in the given buffer? + size_t end_of_last_program_header = elf_header.e_phoff + (elf_header.e_phnum * elf_header.e_phentsize); + if (end_of_last_program_header > buffer_size) { + dbgprintf("Unable to parse program headers from buffer, buffer too small! Buffer size: %zu, End of program headers %zu\n", + buffer_size, end_of_last_program_header); + return false; + } + + if (file_size < buffer_size) { + dbgputstr("We somehow read more from a file than was in the file in the first place!\n"); + ASSERT_NOT_REACHED(); + } + + size_t num_program_headers = elf_header.e_phnum; + auto program_header_begin = (const Elf32_Phdr*)&(buffer[elf_header.e_phoff]); + + for (size_t header_index = 0; header_index < num_program_headers; ++header_index) { + auto& program_header = program_header_begin[header_index]; + switch (program_header.p_type) { + case PT_INTERP: + if (ET_DYN != elf_header.e_type) { + dbgprintf("Found PT_INTERP header (%d) in non-DYN ELF object! What? We can't handle this!\n", header_index); + return false; + } + // We checked above that file_size was >= buffer size. We only care about buffer size anyway, we're trying to read this! + if (program_header.p_offset + program_header.p_filesz > buffer_size) { + dbgprintf("Found PT_INTERP header (%d), but the .interp section was not within our buffer :( Your program will not be loaded today.\n", header_index); + return false; + } + interpreter_path = String((const char*)&buffer[program_header.p_offset], program_header.p_filesz - 1); + break; + case PT_LOAD: + case PT_DYNAMIC: + case PT_NOTE: + case PT_PHDR: + case PT_TLS: + if (program_header.p_offset + program_header.p_filesz > file_size) { + dbgprintf("SHENANIGANS! Program header %d segment leaks beyond end of file!\n", header_index); + return false; + } + if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) { + dbgprintf("SHENANIGANS! Program header %d segment is marked write and execute\n", header_index); + return false; + } + break; + default: + // Not handling other program header types in other code so... let's not surprise them + dbgprintf("Found program header (%d) of unrecognized type %x!\n", header_index, program_header.p_type); + return false; + } + } + return true; +} + +} // end namespace ELF diff --git a/Libraries/LibELF/Validation.h b/Libraries/LibELF/Validation.h new file mode 100644 index 0000000000..7e3af66ac0 --- /dev/null +++ b/Libraries/LibELF/Validation.h @@ -0,0 +1,36 @@ +/* + * Copyright (c) 2020, Andrew Kaster <andrewdkaster@gmail.com> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#pragma once + +#include <LibELF/exec_elf.h> + +namespace ELF { + +bool validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size); +bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, u8* buffer, size_t buffer_size, String& interpreter_path); + +} // end namespace ELF |