Back to index

glibc  2.9
dl-load.c
Go to the documentation of this file.
00001 /* Map in a shared object's segments from the file.
00002    Copyright (C) 1995-2005, 2006, 2007  Free Software Foundation, Inc.
00003    This file is part of the GNU C Library.
00004 
00005    The GNU C Library is free software; you can redistribute it and/or
00006    modify it under the terms of the GNU Lesser General Public
00007    License as published by the Free Software Foundation; either
00008    version 2.1 of the License, or (at your option) any later version.
00009 
00010    The GNU C Library is distributed in the hope that it will be useful,
00011    but WITHOUT ANY WARRANTY; without even the implied warranty of
00012    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
00013    Lesser General Public License for more details.
00014 
00015    You should have received a copy of the GNU Lesser General Public
00016    License along with the GNU C Library; if not, write to the Free
00017    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
00018    02111-1307 USA.  */
00019 
00020 #include <elf.h>
00021 #include <errno.h>
00022 #include <fcntl.h>
00023 #include <libintl.h>
00024 #include <stdbool.h>
00025 #include <stdlib.h>
00026 #include <string.h>
00027 #include <unistd.h>
00028 #include <ldsodefs.h>
00029 #include <bits/wordsize.h>
00030 #include <sys/mman.h>
00031 #include <sys/param.h>
00032 #include <sys/stat.h>
00033 #include <sys/types.h>
00034 #include "dynamic-link.h"
00035 #include <abi-tag.h>
00036 #include <stackinfo.h>
00037 #include <caller.h>
00038 #include <sysdep.h>
00039 
00040 #include <dl-dst.h>
00041 
00042 /* On some systems, no flag bits are given to specify file mapping.  */
00043 #ifndef MAP_FILE
00044 # define MAP_FILE    0
00045 #endif
00046 
00047 /* The right way to map in the shared library files is MAP_COPY, which
00048    makes a virtual copy of the data at the time of the mmap call; this
00049    guarantees the mapped pages will be consistent even if the file is
00050    overwritten.  Some losing VM systems like Linux's lack MAP_COPY.  All we
00051    get is MAP_PRIVATE, which copies each page when it is modified; this
00052    means if the file is overwritten, we may at some point get some pages
00053    from the new version after starting with pages from the old version.
00054 
00055    To make up for the lack and avoid the overwriting problem,
00056    what Linux does have is MAP_DENYWRITE.  This prevents anyone
00057    from modifying the file while we have it mapped.  */
00058 #ifndef MAP_COPY
00059 # ifdef MAP_DENYWRITE
00060 #  define MAP_COPY   (MAP_PRIVATE | MAP_DENYWRITE)
00061 # else
00062 #  define MAP_COPY   MAP_PRIVATE
00063 # endif
00064 #endif
00065 
00066 /* Some systems link their relocatable objects for another base address
00067    than 0.  We want to know the base address for these such that we can
00068    subtract this address from the segment addresses during mapping.
00069    This results in a more efficient address space usage.  Defaults to
00070    zero for almost all systems.  */
00071 #ifndef MAP_BASE_ADDR
00072 # define MAP_BASE_ADDR(l)   0
00073 #endif
00074 
00075 
00076 #include <endian.h>
00077 #if BYTE_ORDER == BIG_ENDIAN
00078 # define byteorder ELFDATA2MSB
00079 #elif BYTE_ORDER == LITTLE_ENDIAN
00080 # define byteorder ELFDATA2LSB
00081 #else
00082 # error "Unknown BYTE_ORDER " BYTE_ORDER
00083 # define byteorder ELFDATANONE
00084 #endif
00085 
00086 #define STRING(x) __STRING (x)
00087 
00088 #ifdef MAP_ANON
00089 /* The fd is not examined when using MAP_ANON.  */
00090 # define ANONFD -1
00091 #else
00092 int _dl_zerofd = -1;
00093 # define ANONFD _dl_zerofd
00094 #endif
00095 
00096 /* Handle situations where we have a preferred location in memory for
00097    the shared objects.  */
00098 #ifdef ELF_PREFERRED_ADDRESS_DATA
00099 ELF_PREFERRED_ADDRESS_DATA;
00100 #endif
00101 #ifndef ELF_PREFERRED_ADDRESS
00102 # define ELF_PREFERRED_ADDRESS(loader, maplength, mapstartpref) (mapstartpref)
00103 #endif
00104 #ifndef ELF_FIXED_ADDRESS
00105 # define ELF_FIXED_ADDRESS(loader, mapstart) ((void) 0)
00106 #endif
00107 
00108 
00109 int __stack_prot attribute_hidden attribute_relro
00110 #if _STACK_GROWS_DOWN && defined PROT_GROWSDOWN
00111   = PROT_GROWSDOWN;
00112 #elif _STACK_GROWS_UP && defined PROT_GROWSUP
00113   = PROT_GROWSUP;
00114 #else
00115   = 0;
00116 #endif
00117 
00118 
00119 /* Type for the buffer we put the ELF header and hopefully the program
00120    header.  This buffer does not really have to be too large.  In most
00121    cases the program header follows the ELF header directly.  If this
00122    is not the case all bets are off and we can make the header
00123    arbitrarily large and still won't get it read.  This means the only
00124    question is how large are the ELF and program header combined.  The
00125    ELF header 32-bit files is 52 bytes long and in 64-bit files is 64
00126    bytes long.  Each program header entry is again 32 and 56 bytes
00127    long respectively.  I.e., even with a file which has 10 program
00128    header entries we only have to read 372B/624B respectively.  Add to
00129    this a bit of margin for program notes and reading 512B and 832B
00130    for 32-bit and 64-bit files respecitvely is enough.  If this
00131    heuristic should really fail for some file the code in
00132    `_dl_map_object_from_fd' knows how to recover.  */
00133 struct filebuf
00134 {
00135   ssize_t len;
00136 #if __WORDSIZE == 32
00137 # define FILEBUF_SIZE 512
00138 #else
00139 # define FILEBUF_SIZE 832
00140 #endif
00141   char buf[FILEBUF_SIZE] __attribute__ ((aligned (__alignof (ElfW(Ehdr)))));
00142 };
00143 
00144 /* This is the decomposed LD_LIBRARY_PATH search path.  */
00145 static struct r_search_path_struct env_path_list attribute_relro;
00146 
00147 /* List of the hardware capabilities we might end up using.  */
00148 static const struct r_strlenpair *capstr attribute_relro;
00149 static size_t ncapstr attribute_relro;
00150 static size_t max_capstrlen attribute_relro;
00151 
00152 
00153 /* Get the generated information about the trusted directories.  */
00154 #include "trusted-dirs.h"
00155 
00156 static const char system_dirs[] = SYSTEM_DIRS;
00157 static const size_t system_dirs_len[] =
00158 {
00159   SYSTEM_DIRS_LEN
00160 };
00161 #define nsystem_dirs_len \
00162   (sizeof (system_dirs_len) / sizeof (system_dirs_len[0]))
00163 
00164 
00165 /* Local version of `strdup' function.  */
00166 static char *
00167 local_strdup (const char *s)
00168 {
00169   size_t len = strlen (s) + 1;
00170   void *new = malloc (len);
00171 
00172   if (new == NULL)
00173     return NULL;
00174 
00175   return (char *) memcpy (new, s, len);
00176 }
00177 
00178 
00179 static size_t
00180 is_dst (const char *start, const char *name, const char *str,
00181        int is_path, int secure)
00182 {
00183   size_t len;
00184   bool is_curly = false;
00185 
00186   if (name[0] == '{')
00187     {
00188       is_curly = true;
00189       ++name;
00190     }
00191 
00192   len = 0;
00193   while (name[len] == str[len] && name[len] != '\0')
00194     ++len;
00195 
00196   if (is_curly)
00197     {
00198       if (name[len] != '}')
00199        return 0;
00200 
00201       /* Point again at the beginning of the name.  */
00202       --name;
00203       /* Skip over closing curly brace and adjust for the --name.  */
00204       len += 2;
00205     }
00206   else if (name[len] != '\0' && name[len] != '/'
00207           && (!is_path || name[len] != ':'))
00208     return 0;
00209 
00210   if (__builtin_expect (secure, 0)
00211       && ((name[len] != '\0' && (!is_path || name[len] != ':'))
00212          || (name != start + 1 && (!is_path || name[-2] != ':'))))
00213     return 0;
00214 
00215   return len;
00216 }
00217 
00218 
00219 size_t
00220 _dl_dst_count (const char *name, int is_path)
00221 {
00222   const char *const start = name;
00223   size_t cnt = 0;
00224 
00225   do
00226     {
00227       size_t len;
00228 
00229       /* $ORIGIN is not expanded for SUID/GUID programs (except if it
00230         is $ORIGIN alone) and it must always appear first in path.  */
00231       ++name;
00232       if ((len = is_dst (start, name, "ORIGIN", is_path,
00233                       INTUSE(__libc_enable_secure))) != 0
00234          || (len = is_dst (start, name, "PLATFORM", is_path, 0)) != 0
00235          || (len = is_dst (start, name, "LIB", is_path, 0)) != 0)
00236        ++cnt;
00237 
00238       name = strchr (name + len, '$');
00239     }
00240   while (name != NULL);
00241 
00242   return cnt;
00243 }
00244 
00245 
00246 char *
00247 _dl_dst_substitute (struct link_map *l, const char *name, char *result,
00248                   int is_path)
00249 {
00250   const char *const start = name;
00251   char *last_elem, *wp;
00252 
00253   /* Now fill the result path.  While copying over the string we keep
00254      track of the start of the last path element.  When we come accross
00255      a DST we copy over the value or (if the value is not available)
00256      leave the entire path element out.  */
00257   last_elem = wp = result;
00258 
00259   do
00260     {
00261       if (__builtin_expect (*name == '$', 0))
00262        {
00263          const char *repl = NULL;
00264          size_t len;
00265 
00266          ++name;
00267          if ((len = is_dst (start, name, "ORIGIN", is_path,
00268                           INTUSE(__libc_enable_secure))) != 0)
00269            {
00270 #ifndef SHARED
00271              if (l == NULL)
00272               repl = _dl_get_origin ();
00273              else
00274 #endif
00275               repl = l->l_origin;
00276            }
00277          else if ((len = is_dst (start, name, "PLATFORM", is_path, 0)) != 0)
00278            repl = GLRO(dl_platform);
00279          else if ((len = is_dst (start, name, "LIB", is_path, 0)) != 0)
00280            repl = DL_DST_LIB;
00281 
00282          if (repl != NULL && repl != (const char *) -1)
00283            {
00284              wp = __stpcpy (wp, repl);
00285              name += len;
00286            }
00287          else if (len > 1)
00288            {
00289              /* We cannot use this path element, the value of the
00290                replacement is unknown.  */
00291              wp = last_elem;
00292              name += len;
00293              while (*name != '\0' && (!is_path || *name != ':'))
00294               ++name;
00295            }
00296          else
00297            /* No DST we recognize.  */
00298            *wp++ = '$';
00299        }
00300       else
00301        {
00302          *wp++ = *name++;
00303          if (is_path && *name == ':')
00304            last_elem = wp;
00305        }
00306     }
00307   while (*name != '\0');
00308 
00309   *wp = '\0';
00310 
00311   return result;
00312 }
00313 
00314 
00315 /* Return copy of argument with all recognized dynamic string tokens
00316    ($ORIGIN and $PLATFORM for now) replaced.  On some platforms it
00317    might not be possible to determine the path from which the object
00318    belonging to the map is loaded.  In this case the path element
00319    containing $ORIGIN is left out.  */
00320 static char *
00321 expand_dynamic_string_token (struct link_map *l, const char *s)
00322 {
00323   /* We make two runs over the string.  First we determine how large the
00324      resulting string is and then we copy it over.  Since this is now
00325      frequently executed operation we are looking here not for performance
00326      but rather for code size.  */
00327   size_t cnt;
00328   size_t total;
00329   char *result;
00330 
00331   /* Determine the number of DST elements.  */
00332   cnt = DL_DST_COUNT (s, 1);
00333 
00334   /* If we do not have to replace anything simply copy the string.  */
00335   if (__builtin_expect (cnt, 0) == 0)
00336     return local_strdup (s);
00337 
00338   /* Determine the length of the substituted string.  */
00339   total = DL_DST_REQUIRED (l, s, strlen (s), cnt);
00340 
00341   /* Allocate the necessary memory.  */
00342   result = (char *) malloc (total + 1);
00343   if (result == NULL)
00344     return NULL;
00345 
00346   return _dl_dst_substitute (l, s, result, 1);
00347 }
00348 
00349 
00350 /* Add `name' to the list of names for a particular shared object.
00351    `name' is expected to have been allocated with malloc and will
00352    be freed if the shared object already has this name.
00353    Returns false if the object already had this name.  */
00354 static void
00355 internal_function
00356 add_name_to_object (struct link_map *l, const char *name)
00357 {
00358   struct libname_list *lnp, *lastp;
00359   struct libname_list *newname;
00360   size_t name_len;
00361 
00362   lastp = NULL;
00363   for (lnp = l->l_libname; lnp != NULL; lastp = lnp, lnp = lnp->next)
00364     if (strcmp (name, lnp->name) == 0)
00365       return;
00366 
00367   name_len = strlen (name) + 1;
00368   newname = (struct libname_list *) malloc (sizeof *newname + name_len);
00369   if (newname == NULL)
00370     {
00371       /* No more memory.  */
00372       _dl_signal_error (ENOMEM, name, NULL, N_("cannot allocate name record"));
00373       return;
00374     }
00375   /* The object should have a libname set from _dl_new_object.  */
00376   assert (lastp != NULL);
00377 
00378   newname->name = memcpy (newname + 1, name, name_len);
00379   newname->next = NULL;
00380   newname->dont_free = 0;
00381   lastp->next = newname;
00382 }
00383 
00384 /* Standard search directories.  */
00385 static struct r_search_path_struct rtld_search_dirs attribute_relro;
00386 
00387 static size_t max_dirnamelen;
00388 
00389 static struct r_search_path_elem **
00390 fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
00391              int check_trusted, const char *what, const char *where)
00392 {
00393   char *cp;
00394   size_t nelems = 0;
00395 
00396   while ((cp = __strsep (&rpath, sep)) != NULL)
00397     {
00398       struct r_search_path_elem *dirp;
00399       size_t len = strlen (cp);
00400 
00401       /* `strsep' can pass an empty string.  This has to be
00402          interpreted as `use the current directory'. */
00403       if (len == 0)
00404        {
00405          static const char curwd[] = "./";
00406          cp = (char *) curwd;
00407        }
00408 
00409       /* Remove trailing slashes (except for "/").  */
00410       while (len > 1 && cp[len - 1] == '/')
00411        --len;
00412 
00413       /* Now add one if there is none so far.  */
00414       if (len > 0 && cp[len - 1] != '/')
00415        cp[len++] = '/';
00416 
00417       /* Make sure we don't use untrusted directories if we run SUID.  */
00418       if (__builtin_expect (check_trusted, 0))
00419        {
00420          const char *trun = system_dirs;
00421          size_t idx;
00422          int unsecure = 1;
00423 
00424          /* All trusted directories must be complete names.  */
00425          if (cp[0] == '/')
00426            {
00427              for (idx = 0; idx < nsystem_dirs_len; ++idx)
00428               {
00429                 if (len == system_dirs_len[idx]
00430                     && memcmp (trun, cp, len) == 0)
00431                   {
00432                     /* Found it.  */
00433                     unsecure = 0;
00434                     break;
00435                   }
00436 
00437                 trun += system_dirs_len[idx] + 1;
00438               }
00439            }
00440 
00441          if (unsecure)
00442            /* Simply drop this directory.  */
00443            continue;
00444        }
00445 
00446       /* See if this directory is already known.  */
00447       for (dirp = GL(dl_all_dirs); dirp != NULL; dirp = dirp->next)
00448        if (dirp->dirnamelen == len && memcmp (cp, dirp->dirname, len) == 0)
00449          break;
00450 
00451       if (dirp != NULL)
00452        {
00453          /* It is available, see whether it's on our own list.  */
00454          size_t cnt;
00455          for (cnt = 0; cnt < nelems; ++cnt)
00456            if (result[cnt] == dirp)
00457              break;
00458 
00459          if (cnt == nelems)
00460            result[nelems++] = dirp;
00461        }
00462       else
00463        {
00464          size_t cnt;
00465          enum r_dir_status init_val;
00466          size_t where_len = where ? strlen (where) + 1 : 0;
00467 
00468          /* It's a new directory.  Create an entry and add it.  */
00469          dirp = (struct r_search_path_elem *)
00470            malloc (sizeof (*dirp) + ncapstr * sizeof (enum r_dir_status)
00471                   + where_len + len + 1);
00472          if (dirp == NULL)
00473            _dl_signal_error (ENOMEM, NULL, NULL,
00474                            N_("cannot create cache for search path"));
00475 
00476          dirp->dirname = ((char *) dirp + sizeof (*dirp)
00477                         + ncapstr * sizeof (enum r_dir_status));
00478          *((char *) __mempcpy ((char *) dirp->dirname, cp, len)) = '\0';
00479          dirp->dirnamelen = len;
00480 
00481          if (len > max_dirnamelen)
00482            max_dirnamelen = len;
00483 
00484          /* We have to make sure all the relative directories are
00485             never ignored.  The current directory might change and
00486             all our saved information would be void.  */
00487          init_val = cp[0] != '/' ? existing : unknown;
00488          for (cnt = 0; cnt < ncapstr; ++cnt)
00489            dirp->status[cnt] = init_val;
00490 
00491          dirp->what = what;
00492          if (__builtin_expect (where != NULL, 1))
00493            dirp->where = memcpy ((char *) dirp + sizeof (*dirp) + len + 1
00494                               + (ncapstr * sizeof (enum r_dir_status)),
00495                               where, where_len);
00496          else
00497            dirp->where = NULL;
00498 
00499          dirp->next = GL(dl_all_dirs);
00500          GL(dl_all_dirs) = dirp;
00501 
00502          /* Put it in the result array.  */
00503          result[nelems++] = dirp;
00504        }
00505     }
00506 
00507   /* Terminate the array.  */
00508   result[nelems] = NULL;
00509 
00510   return result;
00511 }
00512 
00513 
00514 static bool
00515 internal_function
00516 decompose_rpath (struct r_search_path_struct *sps,
00517                const char *rpath, struct link_map *l, const char *what)
00518 {
00519   /* Make a copy we can work with.  */
00520   const char *where = l->l_name;
00521   char *copy;
00522   char *cp;
00523   struct r_search_path_elem **result;
00524   size_t nelems;
00525   /* Initialize to please the compiler.  */
00526   const char *errstring = NULL;
00527 
00528   /* First see whether we must forget the RUNPATH and RPATH from this
00529      object.  */
00530   if (__builtin_expect (GLRO(dl_inhibit_rpath) != NULL, 0)
00531       && !INTUSE(__libc_enable_secure))
00532     {
00533       const char *inhp = GLRO(dl_inhibit_rpath);
00534 
00535       do
00536        {
00537          const char *wp = where;
00538 
00539          while (*inhp == *wp && *wp != '\0')
00540            {
00541              ++inhp;
00542              ++wp;
00543            }
00544 
00545          if (*wp == '\0' && (*inhp == '\0' || *inhp == ':'))
00546            {
00547              /* This object is on the list of objects for which the
00548                RUNPATH and RPATH must not be used.  */
00549              sps->dirs = (void *) -1;
00550              return false;
00551            }
00552 
00553          while (*inhp != '\0')
00554            if (*inhp++ == ':')
00555              break;
00556        }
00557       while (*inhp != '\0');
00558     }
00559 
00560   /* Make a writable copy.  At the same time expand possible dynamic
00561      string tokens.  */
00562   copy = expand_dynamic_string_token (l, rpath);
00563   if (copy == NULL)
00564     {
00565       errstring = N_("cannot create RUNPATH/RPATH copy");
00566       goto signal_error;
00567     }
00568 
00569   /* Count the number of necessary elements in the result array.  */
00570   nelems = 0;
00571   for (cp = copy; *cp != '\0'; ++cp)
00572     if (*cp == ':')
00573       ++nelems;
00574 
00575   /* Allocate room for the result.  NELEMS + 1 is an upper limit for the
00576      number of necessary entries.  */
00577   result = (struct r_search_path_elem **) malloc ((nelems + 1 + 1)
00578                                             * sizeof (*result));
00579   if (result == NULL)
00580     {
00581       free (copy);
00582       errstring = N_("cannot create cache for search path");
00583     signal_error:
00584       _dl_signal_error (ENOMEM, NULL, NULL, errstring);
00585     }
00586 
00587   fillin_rpath (copy, result, ":", 0, what, where);
00588 
00589   /* Free the copied RPATH string.  `fillin_rpath' make own copies if
00590      necessary.  */
00591   free (copy);
00592 
00593   sps->dirs = result;
00594   /* The caller will change this value if we haven't used a real malloc.  */
00595   sps->malloced = 1;
00596   return true;
00597 }
00598 
00599 /* Make sure cached path information is stored in *SP
00600    and return true if there are any paths to search there.  */
00601 static bool
00602 cache_rpath (struct link_map *l,
00603             struct r_search_path_struct *sp,
00604             int tag,
00605             const char *what)
00606 {
00607   if (sp->dirs == (void *) -1)
00608     return false;
00609 
00610   if (sp->dirs != NULL)
00611     return true;
00612 
00613   if (l->l_info[tag] == NULL)
00614     {
00615       /* There is no path.  */
00616       sp->dirs = (void *) -1;
00617       return false;
00618     }
00619 
00620   /* Make sure the cache information is available.  */
00621   return decompose_rpath (sp, (const char *) (D_PTR (l, l_info[DT_STRTAB])
00622                                          + l->l_info[tag]->d_un.d_val),
00623                        l, what);
00624 }
00625 
00626 
00627 void
00628 internal_function
00629 _dl_init_paths (const char *llp)
00630 {
00631   size_t idx;
00632   const char *strp;
00633   struct r_search_path_elem *pelem, **aelem;
00634   size_t round_size;
00635 #ifdef SHARED
00636   struct link_map *l;
00637 #endif
00638   /* Initialize to please the compiler.  */
00639   const char *errstring = NULL;
00640 
00641   /* Fill in the information about the application's RPATH and the
00642      directories addressed by the LD_LIBRARY_PATH environment variable.  */
00643 
00644   /* Get the capabilities.  */
00645   capstr = _dl_important_hwcaps (GLRO(dl_platform), GLRO(dl_platformlen),
00646                              &ncapstr, &max_capstrlen);
00647 
00648   /* First set up the rest of the default search directory entries.  */
00649   aelem = rtld_search_dirs.dirs = (struct r_search_path_elem **)
00650     malloc ((nsystem_dirs_len + 1) * sizeof (struct r_search_path_elem *));
00651   if (rtld_search_dirs.dirs == NULL)
00652     {
00653       errstring = N_("cannot create search path array");
00654     signal_error:
00655       _dl_signal_error (ENOMEM, NULL, NULL, errstring);
00656     }
00657 
00658   round_size = ((2 * sizeof (struct r_search_path_elem) - 1
00659                + ncapstr * sizeof (enum r_dir_status))
00660               / sizeof (struct r_search_path_elem));
00661 
00662   rtld_search_dirs.dirs[0] = (struct r_search_path_elem *)
00663     malloc ((sizeof (system_dirs) / sizeof (system_dirs[0]))
00664            * round_size * sizeof (struct r_search_path_elem));
00665   if (rtld_search_dirs.dirs[0] == NULL)
00666     {
00667       errstring = N_("cannot create cache for search path");
00668       goto signal_error;
00669     }
00670 
00671   rtld_search_dirs.malloced = 0;
00672   pelem = GL(dl_all_dirs) = rtld_search_dirs.dirs[0];
00673   strp = system_dirs;
00674   idx = 0;
00675 
00676   do
00677     {
00678       size_t cnt;
00679 
00680       *aelem++ = pelem;
00681 
00682       pelem->what = "system search path";
00683       pelem->where = NULL;
00684 
00685       pelem->dirname = strp;
00686       pelem->dirnamelen = system_dirs_len[idx];
00687       strp += system_dirs_len[idx] + 1;
00688 
00689       /* System paths must be absolute.  */
00690       assert (pelem->dirname[0] == '/');
00691       for (cnt = 0; cnt < ncapstr; ++cnt)
00692        pelem->status[cnt] = unknown;
00693 
00694       pelem->next = (++idx == nsystem_dirs_len ? NULL : (pelem + round_size));
00695 
00696       pelem += round_size;
00697     }
00698   while (idx < nsystem_dirs_len);
00699 
00700   max_dirnamelen = SYSTEM_DIRS_MAX_LEN;
00701   *aelem = NULL;
00702 
00703 #ifdef SHARED
00704   /* This points to the map of the main object.  */
00705   l = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
00706   if (l != NULL)
00707     {
00708       assert (l->l_type != lt_loaded);
00709 
00710       if (l->l_info[DT_RUNPATH])
00711        {
00712          /* Allocate room for the search path and fill in information
00713             from RUNPATH.  */
00714          decompose_rpath (&l->l_runpath_dirs,
00715                         (const void *) (D_PTR (l, l_info[DT_STRTAB])
00716                                       + l->l_info[DT_RUNPATH]->d_un.d_val),
00717                         l, "RUNPATH");
00718 
00719          /* The RPATH is ignored.  */
00720          l->l_rpath_dirs.dirs = (void *) -1;
00721        }
00722       else
00723        {
00724          l->l_runpath_dirs.dirs = (void *) -1;
00725 
00726          if (l->l_info[DT_RPATH])
00727            {
00728              /* Allocate room for the search path and fill in information
00729                from RPATH.  */
00730              decompose_rpath (&l->l_rpath_dirs,
00731                             (const void *) (D_PTR (l, l_info[DT_STRTAB])
00732                                           + l->l_info[DT_RPATH]->d_un.d_val),
00733                             l, "RPATH");
00734              l->l_rpath_dirs.malloced = 0;
00735            }
00736          else
00737            l->l_rpath_dirs.dirs = (void *) -1;
00738        }
00739     }
00740 #endif /* SHARED */
00741 
00742   if (llp != NULL && *llp != '\0')
00743     {
00744       size_t nllp;
00745       const char *cp = llp;
00746       char *llp_tmp;
00747 
00748 #ifdef SHARED
00749       /* Expand DSTs.  */
00750       size_t cnt = DL_DST_COUNT (llp, 1);
00751       if (__builtin_expect (cnt == 0, 1))
00752        llp_tmp = strdupa (llp);
00753       else
00754        {
00755          /* Determine the length of the substituted string.  */
00756          size_t total = DL_DST_REQUIRED (l, llp, strlen (llp), cnt);
00757 
00758          /* Allocate the necessary memory.  */
00759          llp_tmp = (char *) alloca (total + 1);
00760          llp_tmp = _dl_dst_substitute (l, llp, llp_tmp, 1);
00761        }
00762 #else
00763       llp_tmp = strdupa (llp);
00764 #endif
00765 
00766       /* Decompose the LD_LIBRARY_PATH contents.  First determine how many
00767         elements it has.  */
00768       nllp = 1;
00769       while (*cp)
00770        {
00771          if (*cp == ':' || *cp == ';')
00772            ++nllp;
00773          ++cp;
00774        }
00775 
00776       env_path_list.dirs = (struct r_search_path_elem **)
00777        malloc ((nllp + 1) * sizeof (struct r_search_path_elem *));
00778       if (env_path_list.dirs == NULL)
00779        {
00780          errstring = N_("cannot create cache for search path");
00781          goto signal_error;
00782        }
00783 
00784       (void) fillin_rpath (llp_tmp, env_path_list.dirs, ":;",
00785                         INTUSE(__libc_enable_secure), "LD_LIBRARY_PATH",
00786                         NULL);
00787 
00788       if (env_path_list.dirs[0] == NULL)
00789        {
00790          free (env_path_list.dirs);
00791          env_path_list.dirs = (void *) -1;
00792        }
00793 
00794       env_path_list.malloced = 0;
00795     }
00796   else
00797     env_path_list.dirs = (void *) -1;
00798 
00799   /* Remember the last search directory added at startup.  */
00800   GLRO(dl_init_all_dirs) = GL(dl_all_dirs);
00801 }
00802 
00803 
00804 static void
00805 __attribute__ ((noreturn, noinline))
00806 lose (int code, int fd, const char *name, char *realname, struct link_map *l,
00807       const char *msg, struct r_debug *r)
00808 {
00809   /* The file might already be closed.  */
00810   if (fd != -1)
00811     (void) __close (fd);
00812   if (l != NULL)
00813     {
00814       /* Remove the stillborn object from the list and free it.  */
00815       assert (l->l_next == NULL);
00816       if (l->l_prev == NULL)
00817        /* No other module loaded. This happens only in the static library,
00818           or in rtld under --verify.  */
00819        GL(dl_ns)[l->l_ns]._ns_loaded = NULL;
00820       else
00821        l->l_prev->l_next = NULL;
00822       --GL(dl_ns)[l->l_ns]._ns_nloaded;
00823       free (l);
00824     }
00825   free (realname);
00826 
00827   if (r != NULL)
00828     {
00829       r->r_state = RT_CONSISTENT;
00830       _dl_debug_state ();
00831     }
00832 
00833   _dl_signal_error (code, name, NULL, msg);
00834 }
00835 
00836 
00837 /* Map in the shared object NAME, actually located in REALNAME, and already
00838    opened on FD.  */
00839 
00840 #ifndef EXTERNAL_MAP_FROM_FD
00841 static
00842 #endif
00843 struct link_map *
00844 _dl_map_object_from_fd (const char *name, int fd, struct filebuf *fbp,
00845                      char *realname, struct link_map *loader, int l_type,
00846                      int mode, void **stack_endp, Lmid_t nsid)
00847 {
00848   struct link_map *l = NULL;
00849   const ElfW(Ehdr) *header;
00850   const ElfW(Phdr) *phdr;
00851   const ElfW(Phdr) *ph;
00852   size_t maplength;
00853   int type;
00854   struct stat64 st;
00855   /* Initialize to keep the compiler happy.  */
00856   const char *errstring = NULL;
00857   int errval = 0;
00858   struct r_debug *r = _dl_debug_initialize (0, nsid);
00859   bool make_consistent = false;
00860 
00861   /* Get file information.  */
00862   if (__builtin_expect (__fxstat64 (_STAT_VER, fd, &st) < 0, 0))
00863     {
00864       errstring = N_("cannot stat shared object");
00865     call_lose_errno:
00866       errval = errno;
00867     call_lose:
00868       lose (errval, fd, name, realname, l, errstring,
00869            make_consistent ? r : NULL);
00870     }
00871 
00872   /* Look again to see if the real name matched another already loaded.  */
00873   for (l = GL(dl_ns)[nsid]._ns_loaded; l; l = l->l_next)
00874     if (l->l_removed == 0 && l->l_ino == st.st_ino && l->l_dev == st.st_dev)
00875       {
00876        /* The object is already loaded.
00877           Just bump its reference count and return it.  */
00878        __close (fd);
00879 
00880        /* If the name is not in the list of names for this object add
00881           it.  */
00882        free (realname);
00883        add_name_to_object (l, name);
00884 
00885        return l;
00886       }
00887 
00888 #ifdef SHARED
00889   /* When loading into a namespace other than the base one we must
00890      avoid loading ld.so since there can only be one copy.  Ever.  */
00891   if (__builtin_expect (nsid != LM_ID_BASE, 0)
00892       && ((st.st_ino == GL(dl_rtld_map).l_ino
00893           && st.st_dev == GL(dl_rtld_map).l_dev)
00894          || _dl_name_match_p (name, &GL(dl_rtld_map))))
00895     {
00896       /* This is indeed ld.so.  Create a new link_map which refers to
00897         the real one for almost everything.  */
00898       l = _dl_new_object (realname, name, l_type, loader, mode, nsid);
00899       if (l == NULL)
00900        goto fail_new;
00901 
00902       /* Refer to the real descriptor.  */
00903       l->l_real = &GL(dl_rtld_map);
00904 
00905       /* No need to bump the refcount of the real object, ld.so will
00906         never be unloaded.  */
00907       __close (fd);
00908 
00909       return l;
00910     }
00911 #endif
00912 
00913   if (mode & RTLD_NOLOAD)
00914     /* We are not supposed to load the object unless it is already
00915        loaded.  So return now.  */
00916     return NULL;
00917 
00918   /* Print debugging message.  */
00919   if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_FILES, 0))
00920     _dl_debug_printf ("file=%s [%lu];  generating link map\n", name, nsid);
00921 
00922   /* This is the ELF header.  We read it in `open_verify'.  */
00923   header = (void *) fbp->buf;
00924 
00925 #ifndef MAP_ANON
00926 # define MAP_ANON 0
00927   if (_dl_zerofd == -1)
00928     {
00929       _dl_zerofd = _dl_sysdep_open_zero_fill ();
00930       if (_dl_zerofd == -1)
00931        {
00932          __close (fd);
00933          _dl_signal_error (errno, NULL, NULL,
00934                          N_("cannot open zero fill device"));
00935        }
00936     }
00937 #endif
00938 
00939   /* Signal that we are going to add new objects.  */
00940   if (r->r_state == RT_CONSISTENT)
00941     {
00942 #ifdef SHARED
00943       /* Auditing checkpoint: we are going to add new objects.  */
00944       if (__builtin_expect (GLRO(dl_naudit) > 0, 0))
00945        {
00946          struct link_map *head = GL(dl_ns)[nsid]._ns_loaded;
00947          /* Do not call the functions for any auditing object.  */
00948          if (head->l_auditing == 0)
00949            {
00950              struct audit_ifaces *afct = GLRO(dl_audit);
00951              for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
00952               {
00953                 if (afct->activity != NULL)
00954                   afct->activity (&head->l_audit[cnt].cookie, LA_ACT_ADD);
00955 
00956                 afct = afct->next;
00957               }
00958            }
00959        }
00960 #endif
00961 
00962       /* Notify the debugger we have added some objects.  We need to
00963         call _dl_debug_initialize in a static program in case dynamic
00964         linking has not been used before.  */
00965       r->r_state = RT_ADD;
00966       _dl_debug_state ();
00967       make_consistent = true;
00968     }
00969   else
00970     assert (r->r_state == RT_ADD);
00971 
00972   /* Enter the new object in the list of loaded objects.  */
00973   l = _dl_new_object (realname, name, l_type, loader, mode, nsid);
00974   if (__builtin_expect (l == NULL, 0))
00975     {
00976 #ifdef SHARED
00977     fail_new:
00978 #endif
00979       errstring = N_("cannot create shared object descriptor");
00980       goto call_lose_errno;
00981     }
00982 
00983   /* Extract the remaining details we need from the ELF header
00984      and then read in the program header table.  */
00985   l->l_entry = header->e_entry;
00986   type = header->e_type;
00987   l->l_phnum = header->e_phnum;
00988 
00989   maplength = header->e_phnum * sizeof (ElfW(Phdr));
00990   if (header->e_phoff + maplength <= (size_t) fbp->len)
00991     phdr = (void *) (fbp->buf + header->e_phoff);
00992   else
00993     {
00994       phdr = alloca (maplength);
00995       __lseek (fd, header->e_phoff, SEEK_SET);
00996       if ((size_t) __libc_read (fd, (void *) phdr, maplength) != maplength)
00997        {
00998          errstring = N_("cannot read file data");
00999          goto call_lose_errno;
01000        }
01001     }
01002 
01003   /* Presumed absent PT_GNU_STACK.  */
01004   uint_fast16_t stack_flags = PF_R|PF_W|PF_X;
01005 
01006   {
01007     /* Scan the program header table, collecting its load commands.  */
01008     struct loadcmd
01009       {
01010        ElfW(Addr) mapstart, mapend, dataend, allocend;
01011        off_t mapoff;
01012        int prot;
01013       } loadcmds[l->l_phnum], *c;
01014     size_t nloadcmds = 0;
01015     bool has_holes = false;
01016 
01017     /* The struct is initialized to zero so this is not necessary:
01018     l->l_ld = 0;
01019     l->l_phdr = 0;
01020     l->l_addr = 0; */
01021     for (ph = phdr; ph < &phdr[l->l_phnum]; ++ph)
01022       switch (ph->p_type)
01023        {
01024          /* These entries tell us where to find things once the file's
01025             segments are mapped in.  We record the addresses it says
01026             verbatim, and later correct for the run-time load address.  */
01027        case PT_DYNAMIC:
01028          l->l_ld = (void *) ph->p_vaddr;
01029          l->l_ldnum = ph->p_memsz / sizeof (ElfW(Dyn));
01030          break;
01031 
01032        case PT_PHDR:
01033          l->l_phdr = (void *) ph->p_vaddr;
01034          break;
01035 
01036        case PT_LOAD:
01037          /* A load command tells us to map in part of the file.
01038             We record the load commands and process them all later.  */
01039          if (__builtin_expect ((ph->p_align & (GLRO(dl_pagesize) - 1)) != 0,
01040                             0))
01041            {
01042              errstring = N_("ELF load command alignment not page-aligned");
01043              goto call_lose;
01044            }
01045          if (__builtin_expect (((ph->p_vaddr - ph->p_offset)
01046                              & (ph->p_align - 1)) != 0, 0))
01047            {
01048              errstring
01049               = N_("ELF load command address/offset not properly aligned");
01050              goto call_lose;
01051            }
01052 
01053          c = &loadcmds[nloadcmds++];
01054          c->mapstart = ph->p_vaddr & ~(GLRO(dl_pagesize) - 1);
01055          c->mapend = ((ph->p_vaddr + ph->p_filesz + GLRO(dl_pagesize) - 1)
01056                      & ~(GLRO(dl_pagesize) - 1));
01057          c->dataend = ph->p_vaddr + ph->p_filesz;
01058          c->allocend = ph->p_vaddr + ph->p_memsz;
01059          c->mapoff = ph->p_offset & ~(GLRO(dl_pagesize) - 1);
01060 
01061          /* Determine whether there is a gap between the last segment
01062             and this one.  */
01063          if (nloadcmds > 1 && c[-1].mapend != c->mapstart)
01064            has_holes = true;
01065 
01066          /* Optimize a common case.  */
01067 #if (PF_R | PF_W | PF_X) == 7 && (PROT_READ | PROT_WRITE | PROT_EXEC) == 7
01068          c->prot = (PF_TO_PROT
01069                    >> ((ph->p_flags & (PF_R | PF_W | PF_X)) * 4)) & 0xf;
01070 #else
01071          c->prot = 0;
01072          if (ph->p_flags & PF_R)
01073            c->prot |= PROT_READ;
01074          if (ph->p_flags & PF_W)
01075            c->prot |= PROT_WRITE;
01076          if (ph->p_flags & PF_X)
01077            c->prot |= PROT_EXEC;
01078 #endif
01079          break;
01080 
01081        case PT_TLS:
01082          if (ph->p_memsz == 0)
01083            /* Nothing to do for an empty segment.  */
01084            break;
01085 
01086          l->l_tls_blocksize = ph->p_memsz;
01087          l->l_tls_align = ph->p_align;
01088          if (ph->p_align == 0)
01089            l->l_tls_firstbyte_offset = 0;
01090          else
01091            l->l_tls_firstbyte_offset = ph->p_vaddr & (ph->p_align - 1);
01092          l->l_tls_initimage_size = ph->p_filesz;
01093          /* Since we don't know the load address yet only store the
01094             offset.  We will adjust it later.  */
01095          l->l_tls_initimage = (void *) ph->p_vaddr;
01096 
01097          /* If not loading the initial set of shared libraries,
01098             check whether we should permit loading a TLS segment.  */
01099          if (__builtin_expect (l->l_type == lt_library, 1)
01100              /* If GL(dl_tls_dtv_slotinfo_list) == NULL, then rtld.c did
01101                not set up TLS data structures, so don't use them now.  */
01102              || __builtin_expect (GL(dl_tls_dtv_slotinfo_list) != NULL, 1))
01103            {
01104              /* Assign the next available module ID.  */
01105              l->l_tls_modid = _dl_next_tls_modid ();
01106              break;
01107            }
01108 
01109 #ifdef SHARED
01110          if (l->l_prev == NULL || (mode & __RTLD_AUDIT) != 0)
01111            /* We are loading the executable itself when the dynamic linker
01112               was executed directly.  The setup will happen later.  */
01113            break;
01114 
01115          /* In a static binary there is no way to tell if we dynamically
01116             loaded libpthread.  */
01117          if (GL(dl_error_catch_tsd) == &_dl_initial_error_catch_tsd)
01118 #endif
01119            {
01120              /* We have not yet loaded libpthread.
01121                We can do the TLS setup right now!  */
01122 
01123              void *tcb;
01124 
01125              /* The first call allocates TLS bookkeeping data structures.
01126                Then we allocate the TCB for the initial thread.  */
01127              if (__builtin_expect (_dl_tls_setup (), 0)
01128                 || __builtin_expect ((tcb = _dl_allocate_tls (NULL)) == NULL,
01129                                    0))
01130               {
01131                 errval = ENOMEM;
01132                 errstring = N_("\
01133 cannot allocate TLS data structures for initial thread");
01134                 goto call_lose;
01135               }
01136 
01137              /* Now we install the TCB in the thread register.  */
01138              errstring = TLS_INIT_TP (tcb, 0);
01139              if (__builtin_expect (errstring == NULL, 1))
01140               {
01141                 /* Now we are all good.  */
01142                 l->l_tls_modid = ++GL(dl_tls_max_dtv_idx);
01143                 break;
01144               }
01145 
01146              /* The kernel is too old or somesuch.  */
01147              errval = 0;
01148              _dl_deallocate_tls (tcb, 1);
01149              goto call_lose;
01150            }
01151 
01152          /* Uh-oh, the binary expects TLS support but we cannot
01153             provide it.  */
01154          errval = 0;
01155          errstring = N_("cannot handle TLS data");
01156          goto call_lose;
01157          break;
01158 
01159        case PT_GNU_STACK:
01160          stack_flags = ph->p_flags;
01161          break;
01162 
01163        case PT_GNU_RELRO:
01164          l->l_relro_addr = ph->p_vaddr;
01165          l->l_relro_size = ph->p_memsz;
01166          break;
01167        }
01168 
01169     if (__builtin_expect (nloadcmds == 0, 0))
01170       {
01171        /* This only happens for a bogus object that will be caught with
01172           another error below.  But we don't want to go through the
01173           calculations below using NLOADCMDS - 1.  */
01174        errstring = N_("object file has no loadable segments");
01175        goto call_lose;
01176       }
01177 
01178     /* Now process the load commands and map segments into memory.  */
01179     c = loadcmds;
01180 
01181     /* Length of the sections to be loaded.  */
01182     maplength = loadcmds[nloadcmds - 1].allocend - c->mapstart;
01183 
01184     if (__builtin_expect (type, ET_DYN) == ET_DYN)
01185       {
01186        /* This is a position-independent shared object.  We can let the
01187           kernel map it anywhere it likes, but we must have space for all
01188           the segments in their specified positions relative to the first.
01189           So we map the first segment without MAP_FIXED, but with its
01190           extent increased to cover all the segments.  Then we remove
01191           access from excess portion, and there is known sufficient space
01192           there to remap from the later segments.
01193 
01194           As a refinement, sometimes we have an address that we would
01195           prefer to map such objects at; but this is only a preference,
01196           the OS can do whatever it likes. */
01197        ElfW(Addr) mappref;
01198        mappref = (ELF_PREFERRED_ADDRESS (loader, maplength,
01199                                      c->mapstart & GLRO(dl_use_load_bias))
01200                  - MAP_BASE_ADDR (l));
01201 
01202        /* Remember which part of the address space this object uses.  */
01203        l->l_map_start = (ElfW(Addr)) __mmap ((void *) mappref, maplength,
01204                                          c->prot,
01205                                          MAP_COPY|MAP_FILE,
01206                                          fd, c->mapoff);
01207        if (__builtin_expect ((void *) l->l_map_start == MAP_FAILED, 0))
01208          {
01209          map_error:
01210            errstring = N_("failed to map segment from shared object");
01211            goto call_lose_errno;
01212          }
01213 
01214        l->l_map_end = l->l_map_start + maplength;
01215        l->l_addr = l->l_map_start - c->mapstart;
01216 
01217        if (has_holes)
01218          /* Change protection on the excess portion to disallow all access;
01219             the portions we do not remap later will be inaccessible as if
01220             unallocated.  Then jump into the normal segment-mapping loop to
01221             handle the portion of the segment past the end of the file
01222             mapping.  */
01223          __mprotect ((caddr_t) (l->l_addr + c->mapend),
01224                     loadcmds[nloadcmds - 1].mapstart - c->mapend,
01225                     PROT_NONE);
01226 
01227        l->l_contiguous = 1;
01228 
01229        goto postmap;
01230       }
01231 
01232     /* This object is loaded at a fixed address.  This must never
01233        happen for objects loaded with dlopen().  */
01234     if (__builtin_expect ((mode & __RTLD_OPENEXEC) == 0, 0))
01235       {
01236        errstring = N_("cannot dynamically load executable");
01237        goto call_lose;
01238       }
01239 
01240     /* Notify ELF_PREFERRED_ADDRESS that we have to load this one
01241        fixed.  */
01242     ELF_FIXED_ADDRESS (loader, c->mapstart);
01243 
01244 
01245     /* Remember which part of the address space this object uses.  */
01246     l->l_map_start = c->mapstart + l->l_addr;
01247     l->l_map_end = l->l_map_start + maplength;
01248     l->l_contiguous = !has_holes;
01249 
01250     while (c < &loadcmds[nloadcmds])
01251       {
01252        if (c->mapend > c->mapstart
01253            /* Map the segment contents from the file.  */
01254            && (__mmap ((void *) (l->l_addr + c->mapstart),
01255                      c->mapend - c->mapstart, c->prot,
01256                      MAP_FIXED|MAP_COPY|MAP_FILE,
01257                      fd, c->mapoff)
01258               == MAP_FAILED))
01259          goto map_error;
01260 
01261       postmap:
01262        if (c->prot & PROT_EXEC)
01263          l->l_text_end = l->l_addr + c->mapend;
01264 
01265        if (l->l_phdr == 0
01266            && (ElfW(Off)) c->mapoff <= header->e_phoff
01267            && ((size_t) (c->mapend - c->mapstart + c->mapoff)
01268               >= header->e_phoff + header->e_phnum * sizeof (ElfW(Phdr))))
01269          /* Found the program header in this segment.  */
01270          l->l_phdr = (void *) (c->mapstart + header->e_phoff - c->mapoff);
01271 
01272        if (c->allocend > c->dataend)
01273          {
01274            /* Extra zero pages should appear at the end of this segment,
01275               after the data mapped from the file.   */
01276            ElfW(Addr) zero, zeroend, zeropage;
01277 
01278            zero = l->l_addr + c->dataend;
01279            zeroend = l->l_addr + c->allocend;
01280            zeropage = ((zero + GLRO(dl_pagesize) - 1)
01281                      & ~(GLRO(dl_pagesize) - 1));
01282 
01283            if (zeroend < zeropage)
01284              /* All the extra data is in the last page of the segment.
01285                We can just zero it.  */
01286              zeropage = zeroend;
01287 
01288            if (zeropage > zero)
01289              {
01290               /* Zero the final part of the last page of the segment.  */
01291               if (__builtin_expect ((c->prot & PROT_WRITE) == 0, 0))
01292                 {
01293                   /* Dag nab it.  */
01294                   if (__mprotect ((caddr_t) (zero
01295                                           & ~(GLRO(dl_pagesize) - 1)),
01296                                 GLRO(dl_pagesize), c->prot|PROT_WRITE) < 0)
01297                     {
01298                      errstring = N_("cannot change memory protections");
01299                      goto call_lose_errno;
01300                     }
01301                 }
01302               memset ((void *) zero, '\0', zeropage - zero);
01303               if (__builtin_expect ((c->prot & PROT_WRITE) == 0, 0))
01304                 __mprotect ((caddr_t) (zero & ~(GLRO(dl_pagesize) - 1)),
01305                            GLRO(dl_pagesize), c->prot);
01306              }
01307 
01308            if (zeroend > zeropage)
01309              {
01310               /* Map the remaining zero pages in from the zero fill FD.  */
01311               caddr_t mapat;
01312               mapat = __mmap ((caddr_t) zeropage, zeroend - zeropage,
01313                             c->prot, MAP_ANON|MAP_PRIVATE|MAP_FIXED,
01314                             ANONFD, 0);
01315               if (__builtin_expect (mapat == MAP_FAILED, 0))
01316                 {
01317                   errstring = N_("cannot map zero-fill pages");
01318                   goto call_lose_errno;
01319                 }
01320              }
01321          }
01322 
01323        ++c;
01324       }
01325   }
01326 
01327   if (l->l_ld == 0)
01328     {
01329       if (__builtin_expect (type == ET_DYN, 0))
01330        {
01331          errstring = N_("object file has no dynamic section");
01332          goto call_lose;
01333        }
01334     }
01335   else
01336     l->l_ld = (ElfW(Dyn) *) ((ElfW(Addr)) l->l_ld + l->l_addr);
01337 
01338   elf_get_dynamic_info (l, NULL);
01339 
01340   /* Make sure we are not dlopen'ing an object that has the
01341      DF_1_NOOPEN flag set.  */
01342   if (__builtin_expect (l->l_flags_1 & DF_1_NOOPEN, 0)
01343       && (mode & __RTLD_DLOPEN))
01344     {
01345       /* We are not supposed to load this object.  Free all resources.  */
01346       __munmap ((void *) l->l_map_start, l->l_map_end - l->l_map_start);
01347 
01348       if (!l->l_libname->dont_free)
01349        free (l->l_libname);
01350 
01351       if (l->l_phdr_allocated)
01352        free ((void *) l->l_phdr);
01353 
01354       errstring = N_("shared object cannot be dlopen()ed");
01355       goto call_lose;
01356     }
01357 
01358   if (l->l_phdr == NULL)
01359     {
01360       /* The program header is not contained in any of the segments.
01361         We have to allocate memory ourself and copy it over from out
01362         temporary place.  */
01363       ElfW(Phdr) *newp = (ElfW(Phdr) *) malloc (header->e_phnum
01364                                           * sizeof (ElfW(Phdr)));
01365       if (newp == NULL)
01366        {
01367          errstring = N_("cannot allocate memory for program header");
01368          goto call_lose_errno;
01369        }
01370 
01371       l->l_phdr = memcpy (newp, phdr,
01372                        (header->e_phnum * sizeof (ElfW(Phdr))));
01373       l->l_phdr_allocated = 1;
01374     }
01375   else
01376     /* Adjust the PT_PHDR value by the runtime load address.  */
01377     l->l_phdr = (ElfW(Phdr) *) ((ElfW(Addr)) l->l_phdr + l->l_addr);
01378 
01379   if (__builtin_expect ((stack_flags &~ GL(dl_stack_flags)) & PF_X, 0))
01380     {
01381       if (__builtin_expect (__check_caller (RETURN_ADDRESS (0), allow_ldso),
01382                          0) != 0)
01383        {
01384          errstring = N_("invalid caller");
01385          goto call_lose;
01386        }
01387 
01388       /* The stack is presently not executable, but this module
01389         requires that it be executable.  We must change the
01390         protection of the variable which contains the flags used in
01391         the mprotect calls.  */
01392 #ifdef SHARED
01393       if ((mode & (__RTLD_DLOPEN | __RTLD_AUDIT)) == __RTLD_DLOPEN)
01394        {
01395          const uintptr_t p = (uintptr_t) &__stack_prot & -GLRO(dl_pagesize);
01396          const size_t s = (uintptr_t) (&__stack_prot + 1) - p;
01397 
01398          struct link_map *const m = &GL(dl_rtld_map);
01399          const uintptr_t relro_end = ((m->l_addr + m->l_relro_addr
01400                                    + m->l_relro_size)
01401                                    & -GLRO(dl_pagesize));
01402          if (__builtin_expect (p + s <= relro_end, 1))
01403            {
01404              /* The variable lies in the region protected by RELRO.  */
01405              __mprotect ((void *) p, s, PROT_READ|PROT_WRITE);
01406              __stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
01407              __mprotect ((void *) p, s, PROT_READ);
01408            }
01409          else
01410            __stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
01411        }
01412       else
01413 #endif
01414        __stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
01415 
01416 #ifdef check_consistency
01417       check_consistency ();
01418 #endif
01419 
01420       errval = (*GL(dl_make_stack_executable_hook)) (stack_endp);
01421       if (errval)
01422        {
01423          errstring = N_("\
01424 cannot enable executable stack as shared object requires");
01425          goto call_lose;
01426        }
01427     }
01428 
01429   /* Adjust the address of the TLS initialization image.  */
01430   if (l->l_tls_initimage != NULL)
01431     l->l_tls_initimage = (char *) l->l_tls_initimage + l->l_addr;
01432 
01433   /* We are done mapping in the file.  We no longer need the descriptor.  */
01434   if (__builtin_expect (__close (fd) != 0, 0))
01435     {
01436       errstring = N_("cannot close file descriptor");
01437       goto call_lose_errno;
01438     }
01439   /* Signal that we closed the file.  */
01440   fd = -1;
01441 
01442   if (l->l_type == lt_library && type == ET_EXEC)
01443     l->l_type = lt_executable;
01444 
01445   l->l_entry += l->l_addr;
01446 
01447   if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_FILES, 0))
01448     _dl_debug_printf ("\
01449   dynamic: 0x%0*lx  base: 0x%0*lx   size: 0x%0*Zx\n\
01450     entry: 0x%0*lx  phdr: 0x%0*lx  phnum:   %*u\n\n",
01451                         (int) sizeof (void *) * 2,
01452                         (unsigned long int) l->l_ld,
01453                         (int) sizeof (void *) * 2,
01454                         (unsigned long int) l->l_addr,
01455                         (int) sizeof (void *) * 2, maplength,
01456                         (int) sizeof (void *) * 2,
01457                         (unsigned long int) l->l_entry,
01458                         (int) sizeof (void *) * 2,
01459                         (unsigned long int) l->l_phdr,
01460                         (int) sizeof (void *) * 2, l->l_phnum);
01461 
01462   /* Set up the symbol hash table.  */
01463   _dl_setup_hash (l);
01464 
01465   /* If this object has DT_SYMBOLIC set modify now its scope.  We don't
01466      have to do this for the main map.  */
01467   if ((mode & RTLD_DEEPBIND) == 0
01468       && __builtin_expect (l->l_info[DT_SYMBOLIC] != NULL, 0)
01469       && &l->l_searchlist != l->l_scope[0])
01470     {
01471       /* Create an appropriate searchlist.  It contains only this map.
01472         This is the definition of DT_SYMBOLIC in SysVr4.  */
01473       l->l_symbolic_searchlist.r_list[0] = l;
01474       l->l_symbolic_searchlist.r_nlist = 1;
01475 
01476       /* Now move the existing entries one back.  */
01477       memmove (&l->l_scope[1], &l->l_scope[0],
01478               (l->l_scope_max - 1) * sizeof (l->l_scope[0]));
01479 
01480       /* Now add the new entry.  */
01481       l->l_scope[0] = &l->l_symbolic_searchlist;
01482     }
01483 
01484   /* Remember whether this object must be initialized first.  */
01485   if (l->l_flags_1 & DF_1_INITFIRST)
01486     GL(dl_initfirst) = l;
01487 
01488   /* Finally the file information.  */
01489   l->l_dev = st.st_dev;
01490   l->l_ino = st.st_ino;
01491 
01492   /* When we profile the SONAME might be needed for something else but
01493      loading.  Add it right away.  */
01494   if (__builtin_expect (GLRO(dl_profile) != NULL, 0)
01495       && l->l_info[DT_SONAME] != NULL)
01496     add_name_to_object (l, ((const char *) D_PTR (l, l_info[DT_STRTAB])
01497                          + l->l_info[DT_SONAME]->d_un.d_val));
01498 
01499 #ifdef SHARED
01500   /* Auditing checkpoint: we have a new object.  */
01501   if (__builtin_expect (GLRO(dl_naudit) > 0, 0)
01502       && !GL(dl_ns)[l->l_ns]._ns_loaded->l_auditing)
01503     {
01504       struct audit_ifaces *afct = GLRO(dl_audit);
01505       for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
01506        {
01507          if (afct->objopen != NULL)
01508            {
01509              l->l_audit[cnt].bindflags
01510               = afct->objopen (l, nsid, &l->l_audit[cnt].cookie);
01511 
01512              l->l_audit_any_plt |= l->l_audit[cnt].bindflags != 0;
01513            }
01514 
01515          afct = afct->next;
01516        }
01517     }
01518 #endif
01519 
01520   return l;
01521 }
01522 
01523 /* Print search path.  */
01524 static void
01525 print_search_path (struct r_search_path_elem **list,
01526                    const char *what, const char *name)
01527 {
01528   char buf[max_dirnamelen + max_capstrlen];
01529   int first = 1;
01530 
01531   _dl_debug_printf (" search path=");
01532 
01533   while (*list != NULL && (*list)->what == what) /* Yes, ==.  */
01534     {
01535       char *endp = __mempcpy (buf, (*list)->dirname, (*list)->dirnamelen);
01536       size_t cnt;
01537 
01538       for (cnt = 0; cnt < ncapstr; ++cnt)
01539        if ((*list)->status[cnt] != nonexisting)
01540          {
01541            char *cp = __mempcpy (endp, capstr[cnt].str, capstr[cnt].len);
01542            if (cp == buf || (cp == buf + 1 && buf[0] == '/'))
01543              cp[0] = '\0';
01544            else
01545              cp[-1] = '\0';
01546 
01547            _dl_debug_printf_c (first ? "%s" : ":%s", buf);
01548            first = 0;
01549          }
01550 
01551       ++list;
01552     }
01553 
01554   if (name != NULL)
01555     _dl_debug_printf_c ("\t\t(%s from file %s)\n", what,
01556                      name[0] ? name : rtld_progname);
01557   else
01558     _dl_debug_printf_c ("\t\t(%s)\n", what);
01559 }
01560 
01561 /* Open a file and verify it is an ELF file for this architecture.  We
01562    ignore only ELF files for other architectures.  Non-ELF files and
01563    ELF files with different header information cause fatal errors since
01564    this could mean there is something wrong in the installation and the
01565    user might want to know about this.  */
01566 static int
01567 open_verify (const char *name, struct filebuf *fbp, struct link_map *loader,
01568             int whatcode, bool *found_other_class, bool free_name)
01569 {
01570   /* This is the expected ELF header.  */
01571 #define ELF32_CLASS ELFCLASS32
01572 #define ELF64_CLASS ELFCLASS64
01573 #ifndef VALID_ELF_HEADER
01574 # define VALID_ELF_HEADER(hdr,exp,size)   (memcmp (hdr, exp, size) == 0)
01575 # define VALID_ELF_OSABI(osabi)           (osabi == ELFOSABI_SYSV)
01576 # define VALID_ELF_ABIVERSION(ver) (ver == 0)
01577 #endif
01578   static const unsigned char expected[EI_PAD] =
01579   {
01580     [EI_MAG0] = ELFMAG0,
01581     [EI_MAG1] = ELFMAG1,
01582     [EI_MAG2] = ELFMAG2,
01583     [EI_MAG3] = ELFMAG3,
01584     [EI_CLASS] = ELFW(CLASS),
01585     [EI_DATA] = byteorder,
01586     [EI_VERSION] = EV_CURRENT,
01587     [EI_OSABI] = ELFOSABI_SYSV,
01588     [EI_ABIVERSION] = 0
01589   };
01590   static const struct
01591   {
01592     ElfW(Word) vendorlen;
01593     ElfW(Word) datalen;
01594     ElfW(Word) type;
01595     char vendor[4];
01596   } expected_note = { 4, 16, 1, "GNU" };
01597   /* Initialize it to make the compiler happy.  */
01598   const char *errstring = NULL;
01599   int errval = 0;
01600 
01601 #ifdef SHARED
01602   /* Give the auditing libraries a chance.  */
01603   if (__builtin_expect (GLRO(dl_naudit) > 0, 0) && whatcode != 0
01604       && loader->l_auditing == 0)
01605     {
01606       struct audit_ifaces *afct = GLRO(dl_audit);
01607       for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
01608        {
01609          if (afct->objsearch != NULL)
01610            {
01611              name = afct->objsearch (name, &loader->l_audit[cnt].cookie,
01612                                   whatcode);
01613              if (name == NULL)
01614               /* Ignore the path.  */
01615               return -1;
01616            }
01617 
01618          afct = afct->next;
01619        }
01620     }
01621 #endif
01622 
01623   /* Open the file.  We always open files read-only.  */
01624   int fd = __open (name, O_RDONLY);
01625   if (fd != -1)
01626     {
01627       ElfW(Ehdr) *ehdr;
01628       ElfW(Phdr) *phdr, *ph;
01629       ElfW(Word) *abi_note;
01630       unsigned int osversion;
01631       size_t maplength;
01632 
01633       /* We successfully openened the file.  Now verify it is a file
01634         we can use.  */
01635       __set_errno (0);
01636       fbp->len = __libc_read (fd, fbp->buf, sizeof (fbp->buf));
01637 
01638       /* This is where the ELF header is loaded.  */
01639       assert (sizeof (fbp->buf) > sizeof (ElfW(Ehdr)));
01640       ehdr = (ElfW(Ehdr) *) fbp->buf;
01641 
01642       /* Now run the tests.  */
01643       if (__builtin_expect (fbp->len < (ssize_t) sizeof (ElfW(Ehdr)), 0))
01644        {
01645          errval = errno;
01646          errstring = (errval == 0
01647                      ? N_("file too short") : N_("cannot read file data"));
01648        call_lose:
01649          if (free_name)
01650            {
01651              char *realname = (char *) name;
01652              name = strdupa (realname);
01653              free (realname);
01654            }
01655          lose (errval, fd, name, NULL, NULL, errstring, NULL);
01656        }
01657 
01658       /* See whether the ELF header is what we expect.  */
01659       if (__builtin_expect (! VALID_ELF_HEADER (ehdr->e_ident, expected,
01660                                           EI_PAD), 0))
01661        {
01662          /* Something is wrong.  */
01663          if (*(Elf32_Word *) &ehdr->e_ident !=
01664 #if BYTE_ORDER == LITTLE_ENDIAN
01665              ((ELFMAG0 << (EI_MAG0 * 8)) |
01666               (ELFMAG1 << (EI_MAG1 * 8)) |
01667               (ELFMAG2 << (EI_MAG2 * 8)) |
01668               (ELFMAG3 << (EI_MAG3 * 8)))
01669 #else
01670              ((ELFMAG0 << (EI_MAG3 * 8)) |
01671               (ELFMAG1 << (EI_MAG2 * 8)) |
01672               (ELFMAG2 << (EI_MAG1 * 8)) |
01673               (ELFMAG3 << (EI_MAG0 * 8)))
01674 #endif
01675              )
01676            errstring = N_("invalid ELF header");
01677          else if (ehdr->e_ident[EI_CLASS] != ELFW(CLASS))
01678            {
01679              /* This is not a fatal error.  On architectures where
01680                32-bit and 64-bit binaries can be run this might
01681                happen.  */
01682              *found_other_class = true;
01683              goto close_and_out;
01684            }
01685          else if (ehdr->e_ident[EI_DATA] != byteorder)
01686            {
01687              if (BYTE_ORDER == BIG_ENDIAN)
01688               errstring = N_("ELF file data encoding not big-endian");
01689              else
01690               errstring = N_("ELF file data encoding not little-endian");
01691            }
01692          else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT)
01693            errstring
01694              = N_("ELF file version ident does not match current one");
01695          /* XXX We should be able so set system specific versions which are
01696             allowed here.  */
01697          else if (!VALID_ELF_OSABI (ehdr->e_ident[EI_OSABI]))
01698            errstring = N_("ELF file OS ABI invalid");
01699          else if (!VALID_ELF_ABIVERSION (ehdr->e_ident[EI_ABIVERSION]))
01700            errstring = N_("ELF file ABI version invalid");
01701          else
01702            /* Otherwise we don't know what went wrong.  */
01703            errstring = N_("internal error");
01704 
01705          goto call_lose;
01706        }
01707 
01708       if (__builtin_expect (ehdr->e_version, EV_CURRENT) != EV_CURRENT)
01709        {
01710          errstring = N_("ELF file version does not match current one");
01711          goto call_lose;
01712        }
01713       if (! __builtin_expect (elf_machine_matches_host (ehdr), 1))
01714        goto close_and_out;
01715       else if (__builtin_expect (ehdr->e_type, ET_DYN) != ET_DYN
01716               && __builtin_expect (ehdr->e_type, ET_EXEC) != ET_EXEC)
01717        {
01718          errstring = N_("only ET_DYN and ET_EXEC can be loaded");
01719          goto call_lose;
01720        }
01721       else if (__builtin_expect (ehdr->e_phentsize, sizeof (ElfW(Phdr)))
01722               != sizeof (ElfW(Phdr)))
01723        {
01724          errstring = N_("ELF file's phentsize not the expected size");
01725          goto call_lose;
01726        }
01727 
01728       maplength = ehdr->e_phnum * sizeof (ElfW(Phdr));
01729       if (ehdr->e_phoff + maplength <= (size_t) fbp->len)
01730        phdr = (void *) (fbp->buf + ehdr->e_phoff);
01731       else
01732        {
01733          phdr = alloca (maplength);
01734          __lseek (fd, ehdr->e_phoff, SEEK_SET);
01735          if ((size_t) __libc_read (fd, (void *) phdr, maplength) != maplength)
01736            {
01737            read_error:
01738              errval = errno;
01739              errstring = N_("cannot read file data");
01740              goto call_lose;
01741            }
01742        }
01743 
01744       /* Check .note.ABI-tag if present.  */
01745       for (ph = phdr; ph < &phdr[ehdr->e_phnum]; ++ph)
01746        if (ph->p_type == PT_NOTE && ph->p_filesz >= 32 && ph->p_align >= 4)
01747          {
01748            ElfW(Addr) size = ph->p_filesz;
01749 
01750            if (ph->p_offset + size <= (size_t) fbp->len)
01751              abi_note = (void *) (fbp->buf + ph->p_offset);
01752            else
01753              {
01754               abi_note = alloca (size);
01755               __lseek (fd, ph->p_offset, SEEK_SET);
01756               if (__libc_read (fd, (void *) abi_note, size) != size)
01757                 goto read_error;
01758              }
01759 
01760            while (memcmp (abi_note, &expected_note, sizeof (expected_note)))
01761              {
01762 #define ROUND(len) (((len) + sizeof (ElfW(Word)) - 1) & -sizeof (ElfW(Word)))
01763               ElfW(Addr) note_size = 3 * sizeof (ElfW(Word))
01764                                    + ROUND (abi_note[0])
01765                                    + ROUND (abi_note[1]);
01766 
01767               if (size - 32 < note_size)
01768                 {
01769                   size = 0;
01770                   break;
01771                 }
01772               size -= note_size;
01773               abi_note = (void *) abi_note + note_size;
01774              }
01775 
01776            if (size == 0)
01777              continue;
01778 
01779            osversion = (abi_note[5] & 0xff) * 65536
01780                      + (abi_note[6] & 0xff) * 256
01781                      + (abi_note[7] & 0xff);
01782            if (abi_note[4] != __ABI_TAG_OS
01783               || (GLRO(dl_osversion) && GLRO(dl_osversion) < osversion))
01784              {
01785              close_and_out:
01786               __close (fd);
01787               __set_errno (ENOENT);
01788               fd = -1;
01789              }
01790 
01791            break;
01792          }
01793     }
01794 
01795   return fd;
01796 }
01797 
01798 /* Try to open NAME in one of the directories in *DIRSP.
01799    Return the fd, or -1.  If successful, fill in *REALNAME
01800    with the malloc'd full directory name.  If it turns out
01801    that none of the directories in *DIRSP exists, *DIRSP is
01802    replaced with (void *) -1, and the old value is free()d
01803    if MAY_FREE_DIRS is true.  */
01804 
01805 static int
01806 open_path (const char *name, size_t namelen, int preloaded,
01807           struct r_search_path_struct *sps, char **realname,
01808           struct filebuf *fbp, struct link_map *loader, int whatcode,
01809           bool *found_other_class)
01810 {
01811   struct r_search_path_elem **dirs = sps->dirs;
01812   char *buf;
01813   int fd = -1;
01814   const char *current_what = NULL;
01815   int any = 0;
01816 
01817   if (__builtin_expect (dirs == NULL, 0))
01818     /* We're called before _dl_init_paths when loading the main executable
01819        given on the command line when rtld is run directly.  */
01820     return -1;
01821 
01822   buf = alloca (max_dirnamelen + max_capstrlen + namelen);
01823   do
01824     {
01825       struct r_search_path_elem *this_dir = *dirs;
01826       size_t buflen = 0;
01827       size_t cnt;
01828       char *edp;
01829       int here_any = 0;
01830       int err;
01831 
01832       /* If we are debugging the search for libraries print the path
01833         now if it hasn't happened now.  */
01834       if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0)
01835          && current_what != this_dir->what)
01836        {
01837          current_what = this_dir->what;
01838          print_search_path (dirs, current_what, this_dir->where);
01839        }
01840 
01841       edp = (char *) __mempcpy (buf, this_dir->dirname, this_dir->dirnamelen);
01842       for (cnt = 0; fd == -1 && cnt < ncapstr; ++cnt)
01843        {
01844          /* Skip this directory if we know it does not exist.  */
01845          if (this_dir->status[cnt] == nonexisting)
01846            continue;
01847 
01848          buflen =
01849            ((char *) __mempcpy (__mempcpy (edp, capstr[cnt].str,
01850                                        capstr[cnt].len),
01851                              name, namelen)
01852             - buf);
01853 
01854          /* Print name we try if this is wanted.  */
01855          if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))
01856            _dl_debug_printf ("  trying file=%s\n", buf);
01857 
01858          fd = open_verify (buf, fbp, loader, whatcode, found_other_class,
01859                          false);
01860          if (this_dir->status[cnt] == unknown)
01861            {
01862              if (fd != -1)
01863               this_dir->status[cnt] = existing;
01864              /* Do not update the directory information when loading
01865                auditing code.  We must try to disturb the program as
01866                little as possible.  */
01867              else if (loader == NULL
01868                      || GL(dl_ns)[loader->l_ns]._ns_loaded->l_auditing == 0)
01869               {
01870                 /* We failed to open machine dependent library.  Let's
01871                    test whether there is any directory at all.  */
01872                 struct stat64 st;
01873 
01874                 buf[buflen - namelen - 1] = '\0';
01875 
01876                 if (__xstat64 (_STAT_VER, buf, &st) != 0
01877                     || ! S_ISDIR (st.st_mode))
01878                   /* The directory does not exist or it is no directory.  */
01879                   this_dir->status[cnt] = nonexisting;
01880                 else
01881                   this_dir->status[cnt] = existing;
01882               }
01883            }
01884 
01885          /* Remember whether we found any existing directory.  */
01886          here_any |= this_dir->status[cnt] != nonexisting;
01887 
01888          if (fd != -1 && __builtin_expect (preloaded, 0)
01889              && INTUSE(__libc_enable_secure))
01890            {
01891              /* This is an extra security effort to make sure nobody can
01892                preload broken shared objects which are in the trusted
01893                directories and so exploit the bugs.  */
01894              struct stat64 st;
01895 
01896              if (__fxstat64 (_STAT_VER, fd, &st) != 0
01897                 || (st.st_mode & S_ISUID) == 0)
01898               {
01899                 /* The shared object cannot be tested for being SUID
01900                    or this bit is not set.  In this case we must not
01901                    use this object.  */
01902                 __close (fd);
01903                 fd = -1;
01904                 /* We simply ignore the file, signal this by setting
01905                    the error value which would have been set by `open'.  */
01906                 errno = ENOENT;
01907               }
01908            }
01909        }
01910 
01911       if (fd != -1)
01912        {
01913          *realname = (char *) malloc (buflen);
01914          if (*realname != NULL)
01915            {
01916              memcpy (*realname, buf, buflen);
01917              return fd;
01918            }
01919          else
01920            {
01921              /* No memory for the name, we certainly won't be able
01922                to load and link it.  */
01923              __close (fd);
01924              return -1;
01925            }
01926        }
01927       if (here_any && (err = errno) != ENOENT && err != EACCES)
01928        /* The file exists and is readable, but something went wrong.  */
01929        return -1;
01930 
01931       /* Remember whether we found anything.  */
01932       any |= here_any;
01933     }
01934   while (*++dirs != NULL);
01935 
01936   /* Remove the whole path if none of the directories exists.  */
01937   if (__builtin_expect (! any, 0))
01938     {
01939       /* Paths which were allocated using the minimal malloc() in ld.so
01940         must not be freed using the general free() in libc.  */
01941       if (sps->malloced)
01942        free (sps->dirs);
01943 
01944       /* rtld_search_dirs is attribute_relro, therefore avoid writing
01945         into it.  */
01946       if (sps != &rtld_search_dirs)
01947        sps->dirs = (void *) -1;
01948     }
01949 
01950   return -1;
01951 }
01952 
01953 /* Map in the shared object file NAME.  */
01954 
01955 struct link_map *
01956 internal_function
01957 _dl_map_object (struct link_map *loader, const char *name, int preloaded,
01958               int type, int trace_mode, int mode, Lmid_t nsid)
01959 {
01960   int fd;
01961   char *realname;
01962   char *name_copy;
01963   struct link_map *l;
01964   struct filebuf fb;
01965 
01966   assert (nsid >= 0);
01967   assert (nsid < DL_NNS);
01968 
01969   /* Look for this name among those already loaded.  */
01970   for (l = GL(dl_ns)[nsid]._ns_loaded; l; l = l->l_next)
01971     {
01972       /* If the requested name matches the soname of a loaded object,
01973         use that object.  Elide this check for names that have not
01974         yet been opened.  */
01975       if (__builtin_expect (l->l_faked, 0) != 0
01976          || __builtin_expect (l->l_removed, 0) != 0)
01977        continue;
01978       if (!_dl_name_match_p (name, l))
01979        {
01980          const char *soname;
01981 
01982          if (__builtin_expect (l->l_soname_added, 1)
01983              || l->l_info[DT_SONAME] == NULL)
01984            continue;
01985 
01986          soname = ((const char *) D_PTR (l, l_info[DT_STRTAB])
01987                   + l->l_info[DT_SONAME]->d_un.d_val);
01988          if (strcmp (name, soname) != 0)
01989            continue;
01990 
01991          /* We have a match on a new name -- cache it.  */
01992          add_name_to_object (l, soname);
01993          l->l_soname_added = 1;
01994        }
01995 
01996       /* We have a match.  */
01997       return l;
01998     }
01999 
02000   /* Display information if we are debugging.  */
02001   if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_FILES, 0)
02002       && loader != NULL)
02003     _dl_debug_printf ("\nfile=%s [%lu];  needed by %s [%lu]\n", name, nsid,
02004                            loader->l_name[0]
02005                            ? loader->l_name : rtld_progname, loader->l_ns);
02006 
02007 #ifdef SHARED
02008   /* Give the auditing libraries a chance to change the name before we
02009      try anything.  */
02010   if (__builtin_expect (GLRO(dl_naudit) > 0, 0)
02011       && (loader == NULL || loader->l_auditing == 0))
02012     {
02013       struct audit_ifaces *afct = GLRO(dl_audit);
02014       for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
02015        {
02016          if (afct->objsearch != NULL)
02017            {
02018              name = afct->objsearch (name, &loader->l_audit[cnt].cookie,
02019                                   LA_SER_ORIG);
02020              if (name == NULL)
02021               {
02022                 /* Do not try anything further.  */
02023                 fd = -1;
02024                 goto no_file;
02025               }
02026            }
02027 
02028          afct = afct->next;
02029        }
02030     }
02031 #endif
02032 
02033   /* Will be true if we found a DSO which is of the other ELF class.  */
02034   bool found_other_class = false;
02035 
02036   if (strchr (name, '/') == NULL)
02037     {
02038       /* Search for NAME in several places.  */
02039 
02040       size_t namelen = strlen (name) + 1;
02041 
02042       if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))
02043        _dl_debug_printf ("find library=%s [%lu]; searching\n", name, nsid);
02044 
02045       fd = -1;
02046 
02047       /* When the object has the RUNPATH information we don't use any
02048          RPATHs.  */
02049       if (loader == NULL || loader->l_info[DT_RUNPATH] == NULL)
02050        {
02051          /* This is the executable's map (if there is one).  Make sure that
02052             we do not look at it twice.  */
02053          struct link_map *main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
02054          bool did_main_map = false;
02055 
02056          /* First try the DT_RPATH of the dependent object that caused NAME
02057             to be loaded.  Then that object's dependent, and on up.  */
02058          for (l = loader; l; l = l->l_loader)
02059            if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH"))
02060              {
02061               fd = open_path (name, namelen, preloaded, &l->l_rpath_dirs,
02062                             &realname, &fb, loader, LA_SER_RUNPATH,
02063                             &found_other_class);
02064               if (fd != -1)
02065                 break;
02066 
02067               did_main_map |= l == main_map;
02068              }
02069 
02070          /* If dynamically linked, try the DT_RPATH of the executable
02071              itself.  NB: we do this for lookups in any namespace.  */
02072          if (fd == -1 && !did_main_map
02073              && main_map != NULL && main_map->l_type != lt_loaded
02074              && cache_rpath (main_map, &main_map->l_rpath_dirs, DT_RPATH,
02075                            "RPATH"))
02076            fd = open_path (name, namelen, preloaded, &main_map->l_rpath_dirs,
02077                          &realname, &fb, loader ?: main_map, LA_SER_RUNPATH,
02078                          &found_other_class);
02079        }
02080 
02081       /* Try the LD_LIBRARY_PATH environment variable.  */
02082       if (fd == -1 && env_path_list.dirs != (void *) -1)
02083        fd = open_path (name, namelen, preloaded, &env_path_list,
02084                      &realname, &fb,
02085                      loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded,
02086                      LA_SER_LIBPATH, &found_other_class);
02087 
02088       /* Look at the RUNPATH information for this binary.  */
02089       if (fd == -1 && loader != NULL
02090          && cache_rpath (loader, &loader->l_runpath_dirs,
02091                        DT_RUNPATH, "RUNPATH"))
02092        fd = open_path (name, namelen, preloaded,
02093                      &loader->l_runpath_dirs, &realname, &fb, loader,
02094                      LA_SER_RUNPATH, &found_other_class);
02095 
02096       if (fd == -1
02097          && (__builtin_expect (! preloaded, 1)
02098              || ! INTUSE(__libc_enable_secure)))
02099        {
02100          /* Check the list of libraries in the file /etc/ld.so.cache,
02101             for compatibility with Linux's ldconfig program.  */
02102          const char *cached = _dl_load_cache_lookup (name);
02103 
02104          if (cached != NULL)
02105            {
02106 #ifdef SHARED
02107              // XXX Correct to unconditionally default to namespace 0?
02108              l = loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded;
02109 #else
02110              l = loader;
02111 #endif
02112 
02113              /* If the loader has the DF_1_NODEFLIB flag set we must not
02114                use a cache entry from any of these directories.  */
02115              if (
02116 #ifndef SHARED
02117                 /* 'l' is always != NULL for dynamically linked objects.  */
02118                 l != NULL &&
02119 #endif
02120                 __builtin_expect (l->l_flags_1 & DF_1_NODEFLIB, 0))
02121               {
02122                 const char *dirp = system_dirs;
02123                 unsigned int cnt = 0;
02124 
02125                 do
02126                   {
02127                     if (memcmp (cached, dirp, system_dirs_len[cnt]) == 0)
02128                      {
02129                        /* The prefix matches.  Don't use the entry.  */
02130                        cached = NULL;
02131                        break;
02132                      }
02133 
02134                     dirp += system_dirs_len[cnt] + 1;
02135                     ++cnt;
02136                   }
02137                 while (cnt < nsystem_dirs_len);
02138               }
02139 
02140              if (cached != NULL)
02141               {
02142                 fd = open_verify (cached,
02143                                 &fb, loader ?: GL(dl_ns)[nsid]._ns_loaded,
02144                                 LA_SER_CONFIG, &found_other_class, false);
02145                 if (__builtin_expect (fd != -1, 1))
02146                   {
02147                     realname = local_strdup (cached);
02148                     if (realname == NULL)
02149                      {
02150                        __close (fd);
02151                        fd = -1;
02152                      }
02153                   }
02154               }
02155            }
02156        }
02157 
02158       /* Finally, try the default path.  */
02159       if (fd == -1
02160          && ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL
02161              || __builtin_expect (!(l->l_flags_1 & DF_1_NODEFLIB), 1))
02162          && rtld_search_dirs.dirs != (void *) -1)
02163        fd = open_path (name, namelen, preloaded, &rtld_search_dirs,
02164                      &realname, &fb, l, LA_SER_DEFAULT, &found_other_class);
02165 
02166       /* Add another newline when we are tracing the library loading.  */
02167       if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))
02168         _dl_debug_printf ("\n");
02169     }
02170   else
02171     {
02172       /* The path may contain dynamic string tokens.  */
02173       realname = (loader
02174                 ? expand_dynamic_string_token (loader, name)
02175                 : local_strdup (name));
02176       if (realname == NULL)
02177        fd = -1;
02178       else
02179        {
02180          fd = open_verify (realname, &fb,
02181                          loader ?: GL(dl_ns)[nsid]._ns_loaded, 0,
02182                          &found_other_class, true);
02183          if (__builtin_expect (fd, 0) == -1)
02184            free (realname);
02185        }
02186     }
02187 
02188 #ifdef SHARED
02189  no_file:
02190 #endif
02191   /* In case the LOADER information has only been provided to get to
02192      the appropriate RUNPATH/RPATH information we do not need it
02193      anymore.  */
02194   if (mode & __RTLD_CALLMAP)
02195     loader = NULL;
02196 
02197   if (__builtin_expect (fd, 0) == -1)
02198     {
02199       if (trace_mode
02200          && __builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_PRELINK, 0) == 0)
02201        {
02202          /* We haven't found an appropriate library.  But since we
02203             are only interested in the list of libraries this isn't
02204             so severe.  Fake an entry with all the information we
02205             have.  */
02206          static const Elf_Symndx dummy_bucket = STN_UNDEF;
02207 
02208          /* Enter the new object in the list of loaded objects.  */
02209          if ((name_copy = local_strdup (name)) == NULL
02210              || (l = _dl_new_object (name_copy, name, type, loader,
02211                                   mode, nsid)) == NULL)
02212            {
02213              free (name_copy);
02214              _dl_signal_error (ENOMEM, name, NULL,
02215                             N_("cannot create shared object descriptor"));
02216            }
02217          /* Signal that this is a faked entry.  */
02218          l->l_faked = 1;
02219          /* Since the descriptor is initialized with zero we do not
02220             have do this here.
02221          l->l_reserved = 0; */
02222          l->l_buckets = &dummy_bucket;
02223          l->l_nbuckets = 1;
02224          l->l_relocated = 1;
02225 
02226          return l;
02227        }
02228       else if (found_other_class)
02229        _dl_signal_error (0, name, NULL,
02230                        ELFW(CLASS) == ELFCLASS32
02231                        ? N_("wrong ELF class: ELFCLASS64")
02232                        : N_("wrong ELF class: ELFCLASS32"));
02233       else
02234        _dl_signal_error (errno, name, NULL,
02235                        N_("cannot open shared object file"));
02236     }
02237 
02238   void *stack_end = __libc_stack_end;
02239   return _dl_map_object_from_fd (name, fd, &fb, realname, loader, type, mode,
02240                              &stack_end, nsid);
02241 }
02242 
02243 
02244 void
02245 internal_function
02246 _dl_rtld_di_serinfo (struct link_map *loader, Dl_serinfo *si, bool counting)
02247 {
02248   if (counting)
02249     {
02250       si->dls_cnt = 0;
02251       si->dls_size = 0;
02252     }
02253 
02254   unsigned int idx = 0;
02255   char *allocptr = (char *) &si->dls_serpath[si->dls_cnt];
02256   void add_path (const struct r_search_path_struct *sps, unsigned int flags)
02257 # define add_path(sps, flags) add_path(sps, 0) /* XXX */
02258     {
02259       if (sps->dirs != (void *) -1)
02260        {
02261          struct r_search_path_elem **dirs = sps->dirs;
02262          do
02263            {
02264              const struct r_search_path_elem *const r = *dirs++;
02265              if (counting)
02266               {
02267                 si->dls_cnt++;
02268                 si->dls_size += MAX (2, r->dirnamelen);
02269               }
02270              else
02271               {
02272                 Dl_serpath *const sp = &si->dls_serpath[idx++];
02273                 sp->dls_name = allocptr;
02274                 if (r->dirnamelen < 2)
02275                   *allocptr++ = r->dirnamelen ? '/' : '.';
02276                 else
02277                   allocptr = __mempcpy (allocptr,
02278                                      r->dirname, r->dirnamelen - 1);
02279                 *allocptr++ = '\0';
02280                 sp->dls_flags = flags;
02281               }
02282            }
02283          while (*dirs != NULL);
02284        }
02285     }
02286 
02287   /* When the object has the RUNPATH information we don't use any RPATHs.  */
02288   if (loader->l_info[DT_RUNPATH] == NULL)
02289     {
02290       /* First try the DT_RPATH of the dependent object that caused NAME
02291         to be loaded.  Then that object's dependent, and on up.  */
02292 
02293       struct link_map *l = loader;
02294       do
02295        {
02296          if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH"))
02297            add_path (&l->l_rpath_dirs, XXX_RPATH);
02298          l = l->l_loader;
02299        }
02300       while (l != NULL);
02301 
02302       /* If dynamically linked, try the DT_RPATH of the executable itself.  */
02303       if (loader->l_ns == LM_ID_BASE)
02304        {
02305          l = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
02306          if (l != NULL && l->l_type != lt_loaded && l != loader)
02307            if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH"))
02308              add_path (&l->l_rpath_dirs, XXX_RPATH);
02309        }
02310     }
02311 
02312   /* Try the LD_LIBRARY_PATH environment variable.  */
02313   add_path (&env_path_list, XXX_ENV);
02314 
02315   /* Look at the RUNPATH information for this binary.  */
02316   if (cache_rpath (loader, &loader->l_runpath_dirs, DT_RUNPATH, "RUNPATH"))
02317     add_path (&loader->l_runpath_dirs, XXX_RUNPATH);
02318 
02319   /* XXX
02320      Here is where ld.so.cache gets checked, but we don't have
02321      a way to indicate that in the results for Dl_serinfo.  */
02322 
02323   /* Finally, try the default path.  */
02324   if (!(loader->l_flags_1 & DF_1_NODEFLIB))
02325     add_path (&rtld_search_dirs, XXX_default);
02326 
02327   if (counting)
02328     /* Count the struct size before the string area, which we didn't
02329        know before we completed dls_cnt.  */
02330     si->dls_size += (char *) &si->dls_serpath[si->dls_cnt] - (char *) si;
02331 }