From: guenther <guenther@openbsd.org>
Date: Wed, 10 Aug 2016 02:58:44 +0000 (+0000)
Subject: Cover your kid's remaining eye and lock up the pets for the great old ones
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=7310f5ffd2bd10e53f6320b063e2fe1b96b1e682;p=openbsd

Cover your kid's remaining eye and lock up the pets for the great old ones
have been disturbed: rework the linker script and then enable RELRO support
on all but mips64 (something something padding) and m88k (untested).
This extends the RO coverage from just .got and .cdtors to also include
.openbsd.randomdata, .jcr, .dynamic, and .data.rel.ro., and moves more
segments from the text section to the rodata section.  Depends on the
previous csu and ld.so work; reinstall those *before* rebuilding ld, or
just get a snapshot.

clues from kettenis
assistance testing and ok deraadt@
---

diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/armelf_obsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/armelf_obsd.sh
index a2f193b7546..13a9239f8f7 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/armelf_obsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/armelf_obsd.sh
@@ -1,8 +1,10 @@
 . ${srcdir}/emulparams/armelf.sh
-. ${srcdir}/emulparams/elf_obsd.sh
 
 MAXPAGESIZE=0x8000
+COMMONPAGESIZE=0x1000
 TEXT_START_ADDR=0x00008000
 TARGET2_TYPE=got-rel
 
 unset EMBEDDED
+
+. ${srcdir}/emulparams/elf_obsd.sh
diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf32ppc_obsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf32ppc_obsd.sh
index 5fbc163f875..4620a7ac1df 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf32ppc_obsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf32ppc_obsd.sh
@@ -1,7 +1,14 @@
-. ${srcdir}/emulparams/elf32ppccommon.sh
-# We deliberately keep the traditional OpenBSD W^X layout for both the
-# old BSS-PLT and the new Secure-PLT ABI.
-BSS_PLT=
-OTHER_TEXT_SECTIONS="*(.glink)"
-EXTRA_EM_FILE=ppc32elf
+. ${srcdir}/emulparams/elf32ppc.sh
 . ${srcdir}/emulparams/elf_obsd.sh
+
+# override these to put the padding *in* the output section
+sdata_GOT=".got          ${RELOCATING-0} : SPECIAL {
+    *(.got)
+    ${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}
+  }"
+bss_PLT="
+  .plt          ${RELOCATING-0} : SPECIAL {
+    ${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}
+    *(.plt)
+    ${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}
+  }"
diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64btsmip_obsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64btsmip_obsd.sh
index f34e0ececd7..71dad530261 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64btsmip_obsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64btsmip_obsd.sh
@@ -1,5 +1,6 @@
 . ${srcdir}/emulparams/elf64btsmip.sh
 MAXPAGESIZE=0x10000
+COMMONPAGESIZE=0x1000
 TEXT_START_ADDR="0x10000000"
 . ${srcdir}/emulparams/elf_obsd.sh
 # XXX causes GOT oflows
diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64ltsmip_obsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64ltsmip_obsd.sh
index f2561ea766e..dfe851cd26d 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64ltsmip_obsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/elf64ltsmip_obsd.sh
@@ -1,5 +1,6 @@
 . ${srcdir}/emulparams/elf64ltsmip.sh
 MAXPAGESIZE=0x10000
+COMMONPAGESIZE=0x1000
 TEXT_START_ADDR="0x10000000"
 . ${srcdir}/emulparams/elf_obsd.sh
 # XXX causes GOT oflows
diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/hppaobsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/hppaobsd.sh
index 16f5a62ba40..32ac7ca268c 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/hppaobsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/hppaobsd.sh
@@ -7,6 +7,7 @@ OUTPUT_FORMAT="elf32-hppa"
 
 # other necessary defines, similar but not the same as linux.
 MAXPAGESIZE=0x1000
+COMMONPAGESIZE=0x1000
 ENTRY="__start"
 MACHINE=hppa1.1    # We use 1.1 specific features.
 OTHER_READONLY_SECTIONS=".PARISC.unwind ${RELOCATING-0} : { *(.PARISC.unwind) }"
diff --git a/gnu/usr.bin/binutils-2.17/ld/emulparams/shelf_obsd.sh b/gnu/usr.bin/binutils-2.17/ld/emulparams/shelf_obsd.sh
index 2fa0f7157dc..262fe529ef7 100644
--- a/gnu/usr.bin/binutils-2.17/ld/emulparams/shelf_obsd.sh
+++ b/gnu/usr.bin/binutils-2.17/ld/emulparams/shelf_obsd.sh
@@ -2,11 +2,11 @@
 # shlelf_obsd.sh
 
 . ${srcdir}/emulparams/shelf.sh
-. ${srcdir}/emulparams/elf_obsd.sh
 
 OUTPUT_FORMAT="elf32-sh-obsd"
 TEXT_START_ADDR=0x400000
 MAXPAGESIZE=0x10000
+COMMONPAGESIZE=0x1000
 
 DATA_START_SYMBOLS='__data_start = . ;';
 
@@ -14,3 +14,8 @@ ENTRY=__start
 
 unset EMBEDDED
 unset OTHER_SECTIONS
+
+. ${srcdir}/emulparams/elf_obsd.sh
+
+# No nx bit, so don't bother to pad between .text and .rodata
+unset PAD_RO
diff --git a/gnu/usr.bin/binutils-2.17/ld/ldmain.c b/gnu/usr.bin/binutils-2.17/ld/ldmain.c
index e927bc97f16..fc82e3e401b 100644
--- a/gnu/usr.bin/binutils-2.17/ld/ldmain.c
+++ b/gnu/usr.bin/binutils-2.17/ld/ldmain.c
@@ -299,7 +299,11 @@ main (int argc, char **argv)
   link_info.new_dtags = FALSE;
   link_info.combreloc = TRUE;
   link_info.eh_frame_hdr = FALSE;
+#if defined(__mips64__) || defined(__m88k__)
   link_info.relro = FALSE;
+#else
+  link_info.relro = TRUE;
+#endif
   link_info.strip_discarded = TRUE;
   link_info.strip = strip_none;
   link_info.discard = discard_sec_merge;
diff --git a/gnu/usr.bin/binutils-2.17/ld/scripttempl/elf.sc b/gnu/usr.bin/binutils-2.17/ld/scripttempl/elf.sc
index d036c6318f0..c92ea878340 100644
--- a/gnu/usr.bin/binutils-2.17/ld/scripttempl/elf.sc
+++ b/gnu/usr.bin/binutils-2.17/ld/scripttempl/elf.sc
@@ -193,8 +193,8 @@ RODATA_ALIGN_ADD_VAL="${CREATE_SHLIB-${RODATA_ALIGN_ADD:-0}} ${CREATE_SHLIB+0}"
 test "$LD_FLAG" = "n" || test "$LD_FLAG" = "N" || test "${LD_FLAG%%(cpie|pie)}" = "Z" || NO_PAD="y"
 if test "$NO_PAD" = "y" ; then
   PAD_RO0="${RELOCATING+${RODATA_ALIGN} + ${RODATA_ALIGN_ADD_VAL};}"
-  PAD_PLT0="${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));} .pltpad0 ${RELOCATING-0} : { ${RELOCATING+__plt_start = .;} }"
-  PAD_PLT1=".pltpad1 ${RELOCATING-0} : { ${RELOCATING+__plt_end = .;}} ${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}"
+  PAD_PLT0="${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}"
+  PAD_PLT1="${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}"
   PAD_GOT0="${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));} .gotpad0 ${RELOCATING-0} : { ${RELOCATING+__got_start = .;} }"
   PAD_GOT1=".gotpad1 ${RELOCATING-0} : { ${RELOCATING+__got_end = .;}} ${RELOCATING+. = ALIGN(${MAXPAGESIZE}) + (. & (${MAXPAGESIZE} - 1));}"
   test "$NO_PAD_CDTOR" = "y" || PAD_CDTOR=
@@ -248,6 +248,8 @@ else
 fi
 
 cat <<EOF
+/* DATA_GOT=${DATA_GET+y} SDATA_GOT=${SDATA_GOT+y} SEPARATE_GOTPLT=${SEPARATE_GOTPLT+y} */
+/* DATA_PLT=${DATA_PLT+y} BSS_PLT=${BSS_PLT+y} DATA_NONEXEC_PLT=${DATA_NONEXEC_PLT+y} */
 OUTPUT_FORMAT("${OUTPUT_FORMAT}", "${BIG_OUTPUT_FORMAT}",
 	      "${LITTLE_OUTPUT_FORMAT}")
 OUTPUT_ARCH(${OUTPUT_ARCH})
@@ -267,6 +269,35 @@ SECTIONS
   ${CREATE_SHLIB-${CREATE_PIE-${RELOCATING+PROVIDE (__executable_start = ${TEXT_START_ADDR}); . = ${TEXT_BASE_ADDRESS};}}}
   ${CREATE_SHLIB+${RELOCATING+. = ${SHLIB_TEXT_START_ADDR:-0} + SIZEOF_HEADERS;}}
   ${CREATE_PIE+${RELOCATING+. = ${SHLIB_TEXT_START_ADDR:-0} + SIZEOF_HEADERS;}}
+  .init         ${RELOCATING-0} : 
+  { 
+    ${RELOCATING+${INIT_START}}
+    KEEP (*(.init))
+    ${RELOCATING+${INIT_END}}
+  } =${NOP-0}
+
+  ${TEXT_PLT+${PLT}}
+  ${TINY_READONLY_SECTION}
+  .text         ${RELOCATING-0} :
+  {
+    ${RELOCATING+${TEXT_START_SYMBOLS}}
+    *(.text .stub${RELOCATING+ .text.* .gnu.linkonce.t.*})
+    KEEP (*(.text.*personality*))
+    /* .gnu.warning sections are handled specially by elf32.em.  */
+    *(.gnu.warning)
+    ${RELOCATING+${OTHER_TEXT_SECTIONS}}
+  } =${NOP-0}
+  .fini         ${RELOCATING-0} :
+  {
+    ${RELOCATING+${FINI_START}}
+    KEEP (*(.fini))
+    ${RELOCATING+${FINI_END}}
+  } =${NOP-0}
+  ${RELOCATING+PROVIDE (__${ETEXT_NAME} = .);}
+  ${RELOCATING+PROVIDE (_${ETEXT_NAME} = .);}
+  ${RELOCATING+PROVIDE (${ETEXT_NAME} = .);}
+
+  ${PAD_RO+${PAD_RO0}}
   ${CREATE_SHLIB-${INTERP}}
   ${INITIAL_READONLY_SECTIONS}
   ${TEXT_DYNAMIC+${DYNAMIC}}
@@ -337,34 +368,6 @@ cat <<EOF
   .rela.plt     ${RELOCATING-0} : { *(.rela.plt) }
   ${OTHER_PLT_RELOC_SECTIONS}
 
-  .init         ${RELOCATING-0} : 
-  { 
-    ${RELOCATING+${INIT_START}}
-    KEEP (*(.init))
-    ${RELOCATING+${INIT_END}}
-  } =${NOP-0}
-
-  ${TEXT_PLT+${PLT}}
-  ${TINY_READONLY_SECTION}
-  .text         ${RELOCATING-0} :
-  {
-    ${RELOCATING+${TEXT_START_SYMBOLS}}
-    *(.text .stub${RELOCATING+ .text.* .gnu.linkonce.t.*})
-    KEEP (*(.text.*personality*))
-    /* .gnu.warning sections are handled specially by elf32.em.  */
-    *(.gnu.warning)
-    ${RELOCATING+${OTHER_TEXT_SECTIONS}}
-  } =${NOP-0}
-  .fini         ${RELOCATING-0} :
-  {
-    ${RELOCATING+${FINI_START}}
-    KEEP (*(.fini))
-    ${RELOCATING+${FINI_END}}
-  } =${NOP-0}
-  ${RELOCATING+PROVIDE (__${ETEXT_NAME} = .);}
-  ${RELOCATING+PROVIDE (_${ETEXT_NAME} = .);}
-  ${RELOCATING+PROVIDE (${ETEXT_NAME} = .);}
-  ${PAD_RO+${PAD_RO0}}
   ${WRITABLE_RODATA-${RODATA}}
   .rodata1      ${RELOCATING-0} : { *(.rodata1) }
   ${CREATE_SHLIB-${SDATA2}}
@@ -374,11 +377,22 @@ cat <<EOF
   .eh_frame     ${RELOCATING-0} : ONLY_IF_RO { KEEP (*(.eh_frame)) }
   .gcc_except_table ${RELOCATING-0} : ONLY_IF_RO { *(.gcc_except_table .gcc_except_table.*) }
 
+  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT-${PAD_PLT+${PAD_PLT0}}}}}
+  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT-${PLT}}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${PAD_GOT+${PAD_GOT0}}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${PLT}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${RELOCATING+${OTHER_GOT_SYMBOLS}}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${sdata_GOT-${GOT}}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${OTHER_GOT_SECTIONS}}}
+  ${DATA_NONEXEC_PLT+${SDATA_GOT+${PAD_GOT+${PAD_GOT1}}}}
+
   /* Adjust the address for the data segment.  We want to adjust up to
      the same address within the page on the next page up.  */
   ${CREATE_SHLIB-${CREATE_PIE-${RELOCATING+. = ${DATA_ADDR-${DATA_SEGMENT_ALIGN}};}}}
   ${CREATE_SHLIB+${RELOCATING+. = ${SHLIB_DATA_ADDR-${DATA_SEGMENT_ALIGN}};}}
   ${CREATE_PIE+${RELOCATING+. = ${SHLIB_DATA_ADDR-${DATA_SEGMENT_ALIGN}};}}
+  ${DATA_GOT+${PAD_GOT+${RELOCATING+PROVIDE_HIDDEN(__got_start = .);}}}
+  ${SDATA_GOT+${PAD_GOT+${RELOCATING+PROVIDE_HIDDEN(__got_start = .);}}}
 
   /* Exception handling  */
   .eh_frame     ${RELOCATING-0} : ONLY_IF_RW { KEEP (*(.eh_frame)) }
@@ -419,28 +433,46 @@ cat <<EOF
   ${RELOCATING+${DATARELRO}}
   ${OTHER_RELRO_SECTIONS}
   ${TEXT_DYNAMIC-${DYNAMIC}}
-  ${DATA_GOT+${PAD_GOT+${PAD_GOT0}}}
-  ${DATA_GOT+${DATA_NONEXEC_PLT+${PLT}}}
-  ${DATA_GOT+${RELRO_NOW+${GOT}}}
-  ${DATA_GOT+${RELRO_NOW+${GOTPLT}}}
-  ${DATA_GOT+${RELRO_NOW+${PAD_GOT+${PAD_GOT1}}}}
-  ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT+${GOT}}}}
+  ${DATA_GOT+${RELRO_NOW-${PAD_GOT+${PAD_GOT0}}}}
   /* If PAD_CDTOR, and separate .got and .got.plt sections, CTOR and DTOR
      are relocated here to receive the same mprotect protection as .got */
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT+${PAD_CDTOR+${RELOCATING+${CTOR}}}}}}
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT+${PAD_CDTOR+${RELOCATING+${DTOR}}}}}}
+  ${DATA_GOT+${RELRO_NOW+${PAD_CDTOR+${RELOCATING+${CTOR}}}}}
+  ${DATA_GOT+${RELRO_NOW+${PAD_CDTOR+${RELOCATING+${DTOR}}}}}
+  ${DATA_GOT+${DATA_NONEXEC_PLT+${PLT}}}
+  ${DATA_GOT+${RELRO_NOW+${GOT}}}
+  ${DATA_GOT+${RELRO_NOW+${GOTPLT}}}
+  ${DATA_GOT+${RELRO_NOW+${SDATA_GOT-${PAD_GOT+${RELOCATING+PROVIDE_HIDDEN(__got_end = .);}}}}}
+  ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT+${GOT}}}}
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT+${PAD_GOT+${PAD_GOT1}}}}}
+
+  ${DATA_NONEXEC_PLT+${DATA_GOT-${PAD_CDTOR+${RELOCATING+${CTOR}}}}}
+  ${DATA_NONEXEC_PLT+${DATA_GOT-${PAD_CDTOR+${RELOCATING+${DTOR}}}}}
+  ${DATA_NONEXEC_PLT-${DATA_GOT-${PAD_CDTOR+${RELOCATING+${CTOR}}}}}
+  ${DATA_NONEXEC_PLT-${DATA_GOT-${PAD_CDTOR+${RELOCATING+${DTOR}}}}}
+
+  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT+${PLT}}}}
+  ${DATA_NONEXEC_PLT-${SDATA_GOT+${RELOCATING+${OTHER_GOT_SYMBOLS}}}}
+  ${DATA_NONEXEC_PLT-${SDATA_GOT+${sdata_GOT-${GOT}}}}
+
+  ${DATA_NONEXEC_PLT-${SDATA_GOT+${OTHER_GOT_SECTIONS}}}
+  ${DATA_NONEXEC_PLT-${SDATA_GOT+${RELRO_NOW+${RELOCATING+PROVIDE_HIDDEN(__got_end = .);}}}}
+  ${DATA_NONEXEC_PLT-${SDATA_GOT+${RELRO_NOW-${RELOCATING+${PAD_GOT1}}}}}
+
+  ${BSS_PLT+${bss_PLT-${PLT}}}
+
   ${RELOCATING+${DATA_SEGMENT_RELRO_END}}
+
+  ${SDATA}
+  ${OTHER_SDATA_SECTIONS}
+
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT-${GOT}}}}
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT-${PAD_CDTOR+${RELOCATING+${CTOR}}}}}}
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT-${PAD_CDTOR+${RELOCATING+${DTOR}}}}}}
   ${DATA_GOT+${RELRO_NOW-${SEPARATE_GOTPLT-${PAD_GOT+${PAD_GOT1}}}}}
   ${DATA_GOT+${RELRO_NOW-${GOTPLT}}}
 
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT-${PAD_PLT+${PAD_PLT0}}}}}
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT-${PLT}}}}
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT-${PAD_PLT+${PAD_PLT1}}}}}
-
   .data         ${RELOCATING-0} :
   {
     ${RELOCATING+${DATA_START_SYMBOLS}}
@@ -454,32 +486,10 @@ cat <<EOF
   ${PAD_CDTOR-${SMALL_DATA_CTOR+${RELOCATING+${CTOR}}}}
   ${PAD_CDTOR-${SMALL_DATA_DTOR+${RELOCATING+${DTOR}}}}
 
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT+${PAD_PLT+${PAD_PLT0}}}}}
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT+${PLT}}}}
-  ${DATA_NONEXEC_PLT-${DATA_PLT+${PLT_BEFORE_GOT+${PAD_PLT+${PAD_PLT1}}}}}
-  ${SDATA_GOT+${PAD_GOT+${PAD_GOT0}}}
-  ${SDATA_GOT+${DATA_NONEXEC_PLT+${PLT}}}
-  ${SDATA_GOT+${RELOCATING+${OTHER_GOT_SYMBOLS}}}
-  ${SDATA_GOT+${GOT}}
-
-  ${DATA_GOT+${RELRO_NOW+${PAD_CDTOR+${RELOCATING+${CTOR}}}}}
-  ${DATA_GOT+${RELRO_NOW+${PAD_CDTOR+${RELOCATING+${DTOR}}}}}
-  ${DATA_GOT-${PAD_CDTOR+${RELOCATING+${CTOR}}}}
-  ${DATA_GOT-${PAD_CDTOR+${RELOCATING+${DTOR}}}}
-
-  ${SDATA_GOT+${OTHER_GOT_SECTIONS}}
-  ${SDATA_GOT+${PAD_GOT+${PAD_GOT1}}}
-
-  ${SDATA}
-  ${OTHER_SDATA_SECTIONS}
-
   ${RELOCATING+${DATA_END_SYMBOLS-_edata = .; PROVIDE (edata = .);}}
   ${RELOCATING+__bss_start = .;}
   ${RELOCATING+${OTHER_BSS_SYMBOLS}}
   ${SBSS}
-  ${BSS_PLT+${PAD_PLT+${PAD_PLT0}}}
-  ${BSS_PLT+${PLT}}
-  ${BSS_PLT+${PAD_PLT+${PAD_PLT1}}}
   .bss          ${RELOCATING-0} :
   {
    *(.dynbss)