1	/* Map in a shared object's segments from the file.
2	Copyright (C) 1995-2024 Free Software Foundation, Inc.
3	Copyright The GNU Toolchain Authors.
4	This file is part of the GNU C Library.
5
6	The GNU C Library is free software; you can redistribute it and/or
7	modify it under the terms of the GNU Lesser General Public
8	License as published by the Free Software Foundation; either
9	version 2.1 of the License, or (at your option) any later version.
10
11	The GNU C Library is distributed in the hope that it will be useful,
12	but WITHOUT ANY WARRANTY; without even the implied warranty of
13	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	Lesser General Public License for more details.
15
16	You should have received a copy of the GNU Lesser General Public
17	License along with the GNU C Library; if not, see
18	<https://www.gnu.org/licenses/>. */
19
20	#include <elf.h>
21	#include <errno.h>
22	#include <fcntl.h>
23	#include <libintl.h>
24	#include <stdbool.h>
25	#include <stdlib.h>
26	#include <string.h>
27	#include <unistd.h>
28	#include <ldsodefs.h>
29	#include <bits/wordsize.h>
30	#include <sys/mman.h>
31	#include <sys/param.h>
32	#include <sys/stat.h>
33	#include <sys/types.h>
34	#include <gnu/lib-names.h>
35
36	/* Type for the buffer we put the ELF header and hopefully the program
37	header. This buffer does not really have to be too large. In most
38	cases the program header follows the ELF header directly. If this
39	is not the case all bets are off and we can make the header
40	arbitrarily large and still won't get it read. This means the only
41	question is how large are the ELF and program header combined. The
42	ELF header 32-bit files is 52 bytes long and in 64-bit files is 64
43	bytes long. Each program header entry is again 32 and 56 bytes
44	long respectively. I.e., even with a file which has 10 program
45	header entries we only have to read 372B/624B respectively. Add to
46	this a bit of margin for program notes and reading 512B and 832B
47	for 32-bit and 64-bit files respectively is enough. If this
48	heuristic should really fail for some file the code in
49	`_dl_map_object_from_fd' knows how to recover. */
50	struct filebuf
51	{
52	ssize_t len;
53	#if __WORDSIZE == 32
54	# define FILEBUF_SIZE 512
55	#else
56	# define FILEBUF_SIZE 832
57	#endif
58	char buf[FILEBUF_SIZE] __attribute__ ((aligned (__alignof (ElfW(Ehdr)))));
59	};
60
61	#include "dynamic-link.h"
62	#include "get-dynamic-info.h"
63	#include <abi-tag.h>
64	#include <stackinfo.h>
65	#include <sysdep.h>
66	#include <stap-probe.h>
67	#include <libc-pointer-arith.h>
68	#include <array_length.h>
69
70	#include <dl-dst.h>
71	#include <dl-load.h>
72	#include <dl-map-segments.h>
73	#include <dl-unmap-segments.h>
74	#include <dl-machine-reject-phdr.h>
75	#include <dl-sysdep-open.h>
76	#include <dl-prop.h>
77	#include <not-cancel.h>
78
79	#include <endian.h>
80	#if BYTE_ORDER == BIG_ENDIAN
81	# define byteorder ELFDATA2MSB
82	#elif BYTE_ORDER == LITTLE_ENDIAN
83	# define byteorder ELFDATA2LSB
84	#else
85	# error "Unknown BYTE_ORDER " BYTE_ORDER
86	# define byteorder ELFDATANONE
87	#endif
88
89	#define STRING(x) __STRING (x)
90
91
92	int __stack_prot attribute_hidden attribute_relro
93	#if _STACK_GROWS_DOWN && defined PROT_GROWSDOWN
94	= PROT_GROWSDOWN;
95	#elif _STACK_GROWS_UP && defined PROT_GROWSUP
96	= PROT_GROWSUP;
97	#else
98	= 0;
99	#endif
100
101
102	/* This is the decomposed LD_LIBRARY_PATH search path. */
103	struct r_search_path_struct __rtld_env_path_list attribute_relro;
104
105	/* List of the hardware capabilities we might end up using. */
106	#ifdef SHARED
107	static const struct r_strlenpair *capstr attribute_relro;
108	static size_t ncapstr attribute_relro;
109	static size_t max_capstrlen attribute_relro;
110	#else
111	enum { ncapstr = 1, max_capstrlen = 0 };
112	#endif
113
114
115	/* Get the generated information about the trusted directories. Use
116	an array of concatenated strings to avoid relocations. See
117	gen-trusted-dirs.awk. */
118	#include "trusted-dirs.h"
119
120	static const char system_dirs[] = SYSTEM_DIRS;
121	static const size_t system_dirs_len[] =
122	{
123	SYSTEM_DIRS_LEN
124	};
125	#define nsystem_dirs_len array_length (system_dirs_len)
126
127	static bool
128	is_trusted_path_normalize (const char *path, size_t len)
129	{
130	if (len == 0)
131	return false;
132
133	char *npath = (char *) alloca (len + 2);
134	char *wnp = npath;
135	while (*path != '\0')
136	{
137	if (path[0] == '/')
138	{
139	if (path[1] == '.')
140	{
141	if (path[2] == '.' && (path[3] == '/' || path[3] == '\0'))
142	{
143	while (wnp > npath && *--wnp != '/')
144	;
145	path += 3;
146	continue;
147	}
148	else if (path[2] == '/' || path[2] == '\0')
149	{
150	path += 2;
151	continue;
152	}
153	}
154
155	if (wnp > npath && wnp[-1] == '/')
156	{
157	++path;
158	continue;
159	}
160	}
161
162	*wnp++ = *path++;
163	}
164
165	if (wnp == npath || wnp[-1] != '/')
166	*wnp++ = '/';
167
168	const char *trun = system_dirs;
169
170	for (size_t idx = 0; idx < nsystem_dirs_len; ++idx)
171	{
172	if (wnp - npath >= system_dirs_len[idx]
173	&& memcmp (trun, npath, system_dirs_len[idx]) == 0)
174	/* Found it. */
175	return true;
176
177	trun += system_dirs_len[idx] + 1;
178	}
179
180	return false;
181	}
182
183	/* Given a substring starting at INPUT, just after the DST '$' start
184	token, determine if INPUT contains DST token REF, following the
185	ELF gABI rules for DSTs:
186
187	* Longest possible sequence using the rules (greedy).
188
189	* Must start with a $ (enforced by caller).
190
191	* Must follow $ with one underscore or ASCII [A-Za-z] (caller
192	follows these rules for REF) or '{' (start curly quoted name).
193
194	* Must follow first two characters with zero or more [A-Za-z0-9_]
195	(enforced by caller) or '}' (end curly quoted name).
196
197	If the sequence is a DST matching REF then the length of the DST
198	(excluding the $ sign but including curly braces, if any) is
199	returned, otherwise 0. */
200	static size_t
201	is_dst (const char *input, const char *ref)
202	{
203	bool is_curly = false;
204
205	/* Is a ${...} input sequence? */
206	if (input[0] == '{')
207	{
208	is_curly = true;
209	++input;
210	}
211
212	/* Check for matching name, following closing curly brace (if
213	required), or trailing characters which are part of an
214	identifier. */
215	size_t rlen = strlen (ref);
216	if (strncmp (input, ref, rlen) != 0
217	|| (is_curly && input[rlen] != '}')
218	|| ((input[rlen] >= 'A' && input[rlen] <= 'Z')
219	|| (input[rlen] >= 'a' && input[rlen] <= 'z')
220	|| (input[rlen] >= '0' && input[rlen] <= '9')
221	|| (input[rlen] == '_')))
222	return 0;
223
224	if (is_curly)
225	/* Count the two curly braces. */
226	return rlen + 2;
227	else
228	return rlen;
229	}
230
231	/* INPUT should be the start of a path e.g DT_RPATH or name e.g.
232	DT_NEEDED. The return value is the number of known DSTs found. We
233	count all known DSTs regardless of __libc_enable_secure; the caller
234	is responsible for enforcing the security of the substitution rules
235	(usually _dl_dst_substitute). */
236	size_t
237	_dl_dst_count (const char *input)
238	{
239	size_t cnt = 0;
240
241	input = strchr (input, '$');
242
243	/* Most likely there is no DST. */
244	if (__glibc_likely (input == NULL))
245	return 0;
246
247	do
248	{
249	size_t len;
250
251	++input;
252	/* All DSTs must follow ELF gABI rules, see is_dst (). */
253	if ((len = is_dst (input, ref: "ORIGIN")) != 0
254	|| (len = is_dst (input, ref: "PLATFORM")) != 0
255	|| (len = is_dst (input, ref: "LIB")) != 0)
256	++cnt;
257
258	/* There may be more than one DST in the input. */
259	input = strchr (input + len, '$');
260	}
261	while (input != NULL);
262
263	return cnt;
264	}
265
266	/* Process INPUT for DSTs and store in RESULT using the information
267	from link map L to resolve the DSTs. This function only handles one
268	path at a time and does not handle colon-separated path lists (see
269	fillin_rpath ()). Lastly the size of result in bytes should be at
270	least equal to the value returned by DL_DST_REQUIRED. Note that it
271	is possible for a DT_NEEDED, DT_AUXILIARY, and DT_FILTER entries to
272	have colons, but we treat those as literal colons here, not as path
273	list delimiters. */
274	char *
275	_dl_dst_substitute (struct link_map *l, const char *input, char *result)
276	{
277	/* Copy character-by-character from input into the working pointer
278	looking for any DSTs. We track the start of input and if we are
279	going to check for trusted paths, all of which are part of $ORIGIN
280	handling in SUID/SGID cases (see below). In some cases, like when
281	a DST cannot be replaced, we may set result to an empty string and
282	return. */
283	char *wp = result;
284	const char *start = input;
285	bool check_for_trusted = false;
286
287	do
288	{
289	if (__glibc_unlikely (*input == '$'))
290	{
291	const char *repl = NULL;
292	size_t len;
293
294	++input;
295	if ((len = is_dst (input, ref: "ORIGIN")) != 0)
296	{
297	/* For SUID/GUID programs we normally ignore the path with
298	$ORIGIN in DT_RUNPATH, or DT_RPATH. However, there is
299	one exception to this rule, and it is:
300
301	* $ORIGIN appears as the first path element, and is
302	the only string in the path or is immediately
303	followed by a path separator and the rest of the
304	path,
305
306	and ...
307
308	* The path is rooted in a trusted directory.
309
310	This exception allows such programs to reference
311	shared libraries in subdirectories of trusted
312	directories. The use case is one of general
313	organization and deployment flexibility.
314	Trusted directories are usually such paths as "/lib64"
315	or "/usr/lib64", and the usual RPATHs take the form of
316	[$ORIGIN/../$LIB/somedir]. */
317	if (__glibc_unlikely (__libc_enable_secure)
318	&& !(input == start + 1
319	&& (input[len] == '\0' || input[len] == '/')))
320	repl = (const char *) -1;
321	else
322	repl = l->l_origin;
323
324	check_for_trusted = (__libc_enable_secure
325	&& l->l_type == lt_executable);
326	}
327	else if ((len = is_dst (input, ref: "PLATFORM")) != 0)
328	repl = GLRO(dl_platform);
329	else if ((len = is_dst (input, ref: "LIB")) != 0)
330	repl = DL_DST_LIB;
331
332	if (repl != NULL && repl != (const char *) -1)
333	{
334	wp = __stpcpy (wp, repl);
335	input += len;
336	}
337	else if (len != 0)
338	{
339	/* We found a valid DST that we know about, but we could
340	not find a replacement value for it, therefore we
341	cannot use this path and discard it. */
342	*result = '\0';
343	return result;
344	}
345	else
346	/* No DST we recognize. */
347	*wp++ = '$';
348	}
349	else
350	{
351	*wp++ = *input++;
352	}
353	}
354	while (*input != '\0');
355
356	/* In SUID/SGID programs, after $ORIGIN expansion the normalized
357	path must be rooted in one of the trusted directories. The $LIB
358	and $PLATFORM DST cannot in any way be manipulated by the caller
359	because they are fixed values that are set by the dynamic loader
360	and therefore any paths using just $LIB or $PLATFORM need not be
361	checked for trust, the authors of the binaries themselves are
362	trusted to have designed this correctly. Only $ORIGIN is tested in
363	this way because it may be manipulated in some ways with hard
364	links. */
365	if (__glibc_unlikely (check_for_trusted)
366	&& !is_trusted_path_normalize (path: result, len: wp - result))
367	{
368	*result = '\0';
369	return result;
370	}
371
372	*wp = '\0';
373
374	return result;
375	}
376
377
378	/* Return a malloc allocated copy of INPUT with all recognized DSTs
379	replaced. On some platforms it might not be possible to determine the
380	path from which the object belonging to the map is loaded. In this
381	case the path containing the DST is left out. On error NULL
382	is returned. */
383	static char *
384	expand_dynamic_string_token (struct link_map *l, const char *input)
385	{
386	/* We make two runs over the string. First we determine how large the
387	resulting string is and then we copy it over. Since this is no
388	frequently executed operation we are looking here not for performance
389	but rather for code size. */
390	size_t cnt;
391	size_t total;
392	char *result;
393
394	/* Determine the number of DSTs. */
395	cnt = _dl_dst_count (input);
396
397	/* If we do not have to replace anything simply copy the string. */
398	if (__glibc_likely (cnt == 0))
399	return __strdup (input);
400
401	/* Determine the length of the substituted string. */
402	total = DL_DST_REQUIRED (l, input, strlen (input), cnt);
403
404	/* Allocate the necessary memory. */
405	result = (char *) malloc (size: total + 1);
406	if (result == NULL)
407	return NULL;
408
409	return _dl_dst_substitute (l, input, result);
410	}
411
412
413	/* Add `name' to the list of names for a particular shared object.
414	`name' is expected to have been allocated with malloc and will
415	be freed if the shared object already has this name.
416	Returns false if the object already had this name. */
417	static void
418	add_name_to_object (struct link_map *l, const char *name)
419	{
420	struct libname_list *lnp, *lastp;
421	struct libname_list *newname;
422	size_t name_len;
423
424	lastp = NULL;
425	for (lnp = l->l_libname; lnp != NULL; lastp = lnp, lnp = lnp->next)
426	if (strcmp (name, lnp->name) == 0)
427	return;
428
429	name_len = strlen (name) + 1;
430	newname = (struct libname_list *) malloc (size: sizeof *newname + name_len);
431	if (newname == NULL)
432	{
433	/* No more memory. */
434	_dl_signal_error (ENOMEM, object: name, NULL, N_("cannot allocate name record"));
435	return;
436	}
437	/* The object should have a libname set from _dl_new_object. */
438	assert (lastp != NULL);
439
440	newname->name = memcpy (newname + 1, name, name_len);
441	newname->next = NULL;
442	newname->dont_free = 0;
443	/* CONCURRENCY NOTES:
444
445	Make sure the initialization of newname happens before its address is
446	read from the lastp->next store below.
447
448	GL(dl_load_lock) is held here (and by other writers, e.g. dlclose), so
449	readers of libname_list->next (e.g. _dl_check_caller or the reads above)
450	can use that for synchronization, however the read in _dl_name_match_p
451	may be executed without holding the lock during _dl_runtime_resolve
452	(i.e. lazy symbol resolution when a function of library l is called).
453
454	The release MO store below synchronizes with the acquire MO load in
455	_dl_name_match_p. Other writes need to synchronize with that load too,
456	however those happen either early when the process is single threaded
457	(dl_main) or when the library is unloaded (dlclose) and the user has to
458	synchronize library calls with unloading. */
459	atomic_store_release (&lastp->next, newname);
460	}
461
462	/* Standard search directories. */
463	struct r_search_path_struct __rtld_search_dirs attribute_relro;
464
465	static size_t max_dirnamelen;
466
467	static struct r_search_path_elem **
468	fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,
469	const char *what, const char *where, struct link_map *l)
470	{
471	char *cp;
472	size_t nelems = 0;
473
474	while ((cp = __strsep (&rpath, sep)) != NULL)
475	{
476	struct r_search_path_elem *dirp;
477	char *to_free = NULL;
478	size_t len = 0;
479
480	/* `strsep' can pass an empty string. */
481	if (*cp != '\0')
482	{
483	to_free = cp = expand_dynamic_string_token (l, input: cp);
484
485	/* expand_dynamic_string_token can return NULL in case of empty
486	path or memory allocation failure. */
487	if (cp == NULL)
488	continue;
489
490	/* Compute the length after dynamic string token expansion and
491	ignore empty paths. */
492	len = strlen (cp);
493	if (len == 0)
494	{
495	free (ptr: to_free);
496	continue;
497	}
498
499	/* Remove trailing slashes (except for "/"). */
500	while (len > 1 && cp[len - 1] == '/')
501	--len;
502
503	/* Now add one if there is none so far. */
504	if (len > 0 && cp[len - 1] != '/')
505	cp[len++] = '/';
506	}
507
508	/* See if this directory is already known. */
509	for (dirp = GL(dl_all_dirs); dirp != NULL; dirp = dirp->next)
510	if (dirp->dirnamelen == len && memcmp (cp, dirp->dirname, len) == 0)
511	break;
512
513	if (dirp != NULL)
514	{
515	/* It is available, see whether it's on our own list. */
516	size_t cnt;
517	for (cnt = 0; cnt < nelems; ++cnt)
518	if (result[cnt] == dirp)
519	break;
520
521	if (cnt == nelems)
522	result[nelems++] = dirp;
523	}
524	else
525	{
526	size_t cnt;
527	enum r_dir_status init_val;
528	size_t where_len = where ? strlen (where) + 1 : 0;
529
530	/* It's a new directory. Create an entry and add it. */
531	dirp = (struct r_search_path_elem *)
532	malloc (size: sizeof (*dirp) + ncapstr * sizeof (enum r_dir_status)
533	+ where_len + len + 1);
534	if (dirp == NULL)
535	_dl_signal_error (ENOMEM, NULL, NULL,
536	N_("cannot create cache for search path"));
537
538	dirp->dirname = ((char *) dirp + sizeof (*dirp)
539	+ ncapstr * sizeof (enum r_dir_status));
540	*((char *) __mempcpy ((char *) dirp->dirname, cp, len)) = '\0';
541	dirp->dirnamelen = len;
542
543	if (len > max_dirnamelen)
544	max_dirnamelen = len;
545
546	/* We have to make sure all the relative directories are
547	never ignored. The current directory might change and
548	all our saved information would be void. */
549	init_val = cp[0] != '/' ? existing : unknown;
550	for (cnt = 0; cnt < ncapstr; ++cnt)
551	dirp->status[cnt] = init_val;
552
553	dirp->what = what;
554	if (__glibc_likely (where != NULL))
555	dirp->where = memcpy ((char *) dirp + sizeof (*dirp) + len + 1
556	+ (ncapstr * sizeof (enum r_dir_status)),
557	where, where_len);
558	else
559	dirp->where = NULL;
560
561	dirp->next = GL(dl_all_dirs);
562	GL(dl_all_dirs) = dirp;
563
564	/* Put it in the result array. */
565	result[nelems++] = dirp;
566	}
567	free (ptr: to_free);
568	}
569
570	/* Terminate the array. */
571	result[nelems] = NULL;
572
573	return result;
574	}
575
576
577	static bool
578	decompose_rpath (struct r_search_path_struct *sps,
579	const char *rpath, struct link_map *l, const char *what)
580	{
581	/* Make a copy we can work with. */
582	const char *where = l->l_name;
583	char *cp;
584	struct r_search_path_elem **result;
585	size_t nelems;
586	/* Initialize to please the compiler. */
587	const char *errstring = NULL;
588
589	/* First see whether we must forget the RUNPATH and RPATH from this
590	object. */
591	if (__glibc_unlikely (GLRO(dl_inhibit_rpath) != NULL)
592	&& !__libc_enable_secure)
593	{
594	const char *inhp = GLRO(dl_inhibit_rpath);
595
596	do
597	{
598	const char *wp = where;
599
600	while (*inhp == *wp && *wp != '\0')
601	{
602	++inhp;
603	++wp;
604	}
605
606	if (*wp == '\0' && (*inhp == '\0' || *inhp == ':'))
607	{
608	/* This object is on the list of objects for which the
609	RUNPATH and RPATH must not be used. */
610	sps->dirs = (void *) -1;
611	return false;
612	}
613
614	while (*inhp != '\0')
615	if (*inhp++ == ':')
616	break;
617	}
618	while (*inhp != '\0');
619	}
620
621	/* Ignore empty rpaths. */
622	if (*rpath == '\0')
623	{
624	sps->dirs = (struct r_search_path_elem **) -1;
625	return false;
626	}
627
628	/* Make a writable copy. */
629	char *copy = __strdup (rpath);
630	if (copy == NULL)
631	{
632	errstring = N_("cannot create RUNPATH/RPATH copy");
633	goto signal_error;
634	}
635
636	/* Count the number of necessary elements in the result array. */
637	nelems = 0;
638	for (cp = copy; *cp != '\0'; ++cp)
639	if (*cp == ':')
640	++nelems;
641
642	/* Allocate room for the result. NELEMS + 1 is an upper limit for the
643	number of necessary entries. */
644	result = (struct r_search_path_elem **) malloc (size: (nelems + 1 + 1)
645	* sizeof (*result));
646	if (result == NULL)
647	{
648	free (ptr: copy);
649	errstring = N_("cannot create cache for search path");
650	signal_error:
651	_dl_signal_error (ENOMEM, NULL, NULL, errstring);
652	}
653
654	fillin_rpath (rpath: copy, result, sep: ":", what, where, l);
655
656	/* Free the copied RPATH string. `fillin_rpath' make own copies if
657	necessary. */
658	free (ptr: copy);
659
660	/* There is no path after expansion. */
661	if (result[0] == NULL)
662	{
663	free (ptr: result);
664	sps->dirs = (struct r_search_path_elem **) -1;
665	return false;
666	}
667
668	sps->dirs = result;
669	/* The caller will change this value if we haven't used a real malloc. */
670	sps->malloced = 1;
671	return true;
672	}
673
674	/* Make sure cached path information is stored in *SP
675	and return true if there are any paths to search there. */
676	static bool
677	cache_rpath (struct link_map *l,
678	struct r_search_path_struct *sp,
679	int tag,
680	const char *what)
681	{
682	if (sp->dirs == (void *) -1)
683	return false;
684
685	if (sp->dirs != NULL)
686	return true;
687
688	if (l->l_info[tag] == NULL)
689	{
690	/* There is no path. */
691	sp->dirs = (void *) -1;
692	return false;
693	}
694
695	/* Make sure the cache information is available. */
696	return decompose_rpath (sps: sp, rpath: (const char *) (D_PTR (l, l_info[DT_STRTAB])
697	+ l->l_info[tag]->d_un.d_val),
698	l, what);
699	}
700
701
702	void
703	_dl_init_paths (const char *llp, const char *source,
704	const char *glibc_hwcaps_prepend,
705	const char *glibc_hwcaps_mask)
706	{
707	size_t idx;
708	const char *strp;
709	struct r_search_path_elem *pelem, **aelem;
710	size_t round_size;
711	struct link_map __attribute__ ((unused)) *l = NULL;
712	/* Initialize to please the compiler. */
713	const char *errstring = NULL;
714
715	/* Fill in the information about the application's RPATH and the
716	directories addressed by the LD_LIBRARY_PATH environment variable. */
717
718	#ifdef SHARED
719	/* Get the capabilities. */
720	capstr = _dl_important_hwcaps (glibc_hwcaps_prepend, glibc_hwcaps_mask,
721	&ncapstr, &max_capstrlen);
722	#endif
723
724	/* First set up the rest of the default search directory entries. */
725	aelem = __rtld_search_dirs.dirs = (struct r_search_path_elem **)
726	malloc ((nsystem_dirs_len + 1) * sizeof (struct r_search_path_elem *));
727	if (__rtld_search_dirs.dirs == NULL)
728	{
729	errstring = N_("cannot create search path array");
730	signal_error:
731	_dl_signal_error (ENOMEM, NULL, NULL, errstring);
732	}
733
734	round_size = ((2 * sizeof (struct r_search_path_elem) - 1
735	+ ncapstr * sizeof (enum r_dir_status))
736	/ sizeof (struct r_search_path_elem));
737
738	__rtld_search_dirs.dirs[0]
739	= malloc (nsystem_dirs_len * round_size
740	* sizeof (*__rtld_search_dirs.dirs[0]));
741	if (__rtld_search_dirs.dirs[0] == NULL)
742	{
743	errstring = N_("cannot create cache for search path");
744	goto signal_error;
745	}
746
747	__rtld_search_dirs.malloced = 0;
748	pelem = GL(dl_all_dirs) = __rtld_search_dirs.dirs[0];
749	strp = system_dirs;
750	idx = 0;
751
752	do
753	{
754	size_t cnt;
755
756	*aelem++ = pelem;
757
758	pelem->what = "system search path";
759	pelem->where = NULL;
760
761	pelem->dirname = strp;
762	pelem->dirnamelen = system_dirs_len[idx];
763	strp += system_dirs_len[idx] + 1;
764
765	/* System paths must be absolute. */
766	assert (pelem->dirname[0] == '/');
767	for (cnt = 0; cnt < ncapstr; ++cnt)
768	pelem->status[cnt] = unknown;
769
770	pelem->next = (++idx == nsystem_dirs_len ? NULL : (pelem + round_size));
771
772	pelem += round_size;
773	}
774	while (idx < nsystem_dirs_len);
775
776	max_dirnamelen = SYSTEM_DIRS_MAX_LEN;
777	*aelem = NULL;
778
779	/* This points to the map of the main object. If there is no main
780	object (e.g., under --help, use the dynamic loader itself as a
781	stand-in. */
782	l = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
783	#ifdef SHARED
784	if (l == NULL)
785	l = &GL (dl_rtld_map);
786	#endif
787	assert (l->l_type != lt_loaded);
788
789	if (l->l_info[DT_RUNPATH])
790	{
791	/* Allocate room for the search path and fill in information
792	from RUNPATH. */
793	decompose_rpath (sps: &l->l_runpath_dirs,
794	rpath: (const void *) (D_PTR (l, l_info[DT_STRTAB])
795	+ l->l_info[DT_RUNPATH]->d_un.d_val),
796	l, what: "RUNPATH");
797	/* During rtld init the memory is allocated by the stub malloc,
798	prevent any attempt to free it by the normal malloc. */
799	l->l_runpath_dirs.malloced = 0;
800
801	/* The RPATH is ignored. */
802	l->l_rpath_dirs.dirs = (void *) -1;
803	}
804	else
805	{
806	l->l_runpath_dirs.dirs = (void *) -1;
807
808	if (l->l_info[DT_RPATH])
809	{
810	/* Allocate room for the search path and fill in information
811	from RPATH. */
812	decompose_rpath (sps: &l->l_rpath_dirs,
813	rpath: (const void *) (D_PTR (l, l_info[DT_STRTAB])
814	+ l->l_info[DT_RPATH]->d_un.d_val),
815	l, what: "RPATH");
816	/* During rtld init the memory is allocated by the stub
817	malloc, prevent any attempt to free it by the normal
818	malloc. */
819	l->l_rpath_dirs.malloced = 0;
820	}
821	else
822	l->l_rpath_dirs.dirs = (void *) -1;
823	}
824
825	if (llp != NULL && *llp != '\0')
826	{
827	char *llp_tmp = strdupa (llp);
828
829	/* Decompose the LD_LIBRARY_PATH contents. First determine how many
830	elements it has. */
831	size_t nllp = 1;
832	for (const char *cp = llp_tmp; *cp != '\0'; ++cp)
833	if (*cp == ':' || *cp == ';')
834	++nllp;
835
836	__rtld_env_path_list.dirs = (struct r_search_path_elem **)
837	malloc (size: (nllp + 1) * sizeof (struct r_search_path_elem *));
838	if (__rtld_env_path_list.dirs == NULL)
839	{
840	errstring = N_("cannot create cache for search path");
841	goto signal_error;
842	}
843
844	(void) fillin_rpath (rpath: llp_tmp, result: __rtld_env_path_list.dirs, sep: ":;",
845	what: source, NULL, l);
846
847	if (__rtld_env_path_list.dirs[0] == NULL)
848	{
849	free (ptr: __rtld_env_path_list.dirs);
850	__rtld_env_path_list.dirs = (void *) -1;
851	}
852
853	__rtld_env_path_list.malloced = 0;
854	}
855	else
856	__rtld_env_path_list.dirs = (void *) -1;
857	}
858
859
860	/* Process PT_GNU_PROPERTY program header PH in module L after
861	PT_LOAD segments are mapped. Only one NT_GNU_PROPERTY_TYPE_0
862	note is handled which contains processor specific properties.
863	FD is -1 for the kernel mapped main executable otherwise it is
864	the fd used for loading module L. */
865
866	void
867	_dl_process_pt_gnu_property (struct link_map *l, int fd, const ElfW(Phdr) *ph)
868	{
869	const ElfW(Nhdr) *note = (const void *) (ph->p_vaddr + l->l_addr);
870	const ElfW(Addr) size = ph->p_memsz;
871	const ElfW(Addr) align = ph->p_align;
872
873	/* The NT_GNU_PROPERTY_TYPE_0 note must be aligned to 4 bytes in
874	32-bit objects and to 8 bytes in 64-bit objects. Skip notes
875	with incorrect alignment. */
876	if (align != (__ELF_NATIVE_CLASS / 8))
877	return;
878
879	const ElfW(Addr) start = (ElfW(Addr)) note;
880	unsigned int last_type = 0;
881
882	while ((ElfW(Addr)) (note + 1) - start < size)
883	{
884	/* Find the NT_GNU_PROPERTY_TYPE_0 note. */
885	if (note->n_namesz == 4
886	&& note->n_type == NT_GNU_PROPERTY_TYPE_0
887	&& memcmp (note + 1, "GNU", 4) == 0)
888	{
889	/* Check for invalid property. */
890	if (note->n_descsz < 8
891	|| (note->n_descsz % sizeof (ElfW(Addr))) != 0)
892	return;
893
894	/* Start and end of property array. */
895	unsigned char *ptr = (unsigned char *) (note + 1) + 4;
896	unsigned char *ptr_end = ptr + note->n_descsz;
897
898	do
899	{
900	unsigned int type = *(unsigned int *) ptr;
901	unsigned int datasz = *(unsigned int *) (ptr + 4);
902
903	/* Property type must be in ascending order. */
904	if (type < last_type)
905	return;
906
907	ptr += 8;
908	if ((ptr + datasz) > ptr_end)
909	return;
910
911	last_type = type;
912
913	/* Target specific property processing. */
914	if (_dl_process_gnu_property (l, fd, type, datasz, data: ptr) == 0)
915	return;
916
917	/* Check the next property item. */
918	ptr += ALIGN_UP (datasz, sizeof (ElfW(Addr)));
919	}
920	while ((ptr_end - ptr) >= 8);
921
922	/* Only handle one NT_GNU_PROPERTY_TYPE_0. */
923	return;
924	}
925
926	note = ((const void *) note
927	+ ELF_NOTE_NEXT_OFFSET (note->n_namesz, note->n_descsz,
928	align));
929	}
930	}
931
932	static void
933	_dl_notify_new_object (int mode, Lmid_t nsid, struct link_map *l)
934	{
935	/* Signal that we are going to add new objects. */
936	struct r_debug *r = _dl_debug_update (ns: nsid);
937	if (r->r_state == RT_CONSISTENT)
938	{
939	#ifdef SHARED
940	/* Auditing checkpoint: we are going to add new objects. Since this
941	is called after _dl_add_to_namespace_list the namespace is guaranteed
942	to not be empty. */
943	if ((mode & __RTLD_AUDIT) == 0)
944	_dl_audit_activity_nsid (nsid, LA_ACT_ADD);
945	#endif
946
947	/* Notify the debugger we have added some objects. We need to
948	call _dl_debug_initialize in a static program in case dynamic
949	linking has not been used before. */
950	_dl_debug_change_state (r, state: RT_ADD);
951	LIBC_PROBE (map_start, 2, nsid, r);
952	}
953	else
954	assert (r->r_state == RT_ADD);
955
956	#ifdef SHARED
957	/* Auditing checkpoint: we have a new object. */
958	if (!GL(dl_ns)[l->l_ns]._ns_loaded->l_auditing)
959	_dl_audit_objopen (l, nsid);
960	#endif
961	}
962
963	/* Map in the shared object NAME, actually located in REALNAME, and already
964	opened on FD. */
965
966	#ifndef EXTERNAL_MAP_FROM_FD
967	static
968	#endif
969	struct link_map *
970	_dl_map_object_from_fd (const char *name, const char *origname, int fd,
971	struct filebuf *fbp, char *realname,
972	struct link_map *loader, int l_type, int mode,
973	void **stack_endp, Lmid_t nsid)
974	{
975	struct link_map *l = NULL;
976	const ElfW(Ehdr) *header;
977	const ElfW(Phdr) *phdr;
978	const ElfW(Phdr) *ph;
979	size_t maplength;
980	int type;
981	/* Initialize to keep the compiler happy. */
982	const char *errstring = NULL;
983	int errval = 0;
984
985	/* Get file information. To match the kernel behavior, do not fill
986	in this information for the executable in case of an explicit
987	loader invocation. */
988	struct r_file_id id;
989	if (mode & __RTLD_OPENEXEC)
990	{
991	assert (nsid == LM_ID_BASE);
992	memset (&id, 0, sizeof (id));
993	}
994	else
995	{
996	if (__glibc_unlikely (!_dl_get_file_id (fd, &id)))
997	{
998	errstring = N_("cannot stat shared object");
999	lose_errno:
1000	errval = errno;
1001	lose:
1002	/* The file might already be closed. */
1003	if (fd != -1)
1004	__close_nocancel (fd);
1005	if (l != NULL && l->l_map_start != 0)
1006	_dl_unmap_segments (l);
1007	if (l != NULL && l->l_origin != (char *) -1l)
1008	free (ptr: (char *) l->l_origin);
1009	if (l != NULL && !l->l_libname->dont_free)
1010	free (ptr: l->l_libname);
1011	if (l != NULL && l->l_phdr_allocated)
1012	free (ptr: (void *) l->l_phdr);
1013	free (ptr: l);
1014	free (ptr: realname);
1015	_dl_signal_error (errcode: errval, object: name, NULL, errstring);
1016	}
1017
1018	/* Look again to see if the real name matched another already loaded. */
1019	for (l = GL(dl_ns)[nsid]._ns_loaded; l != NULL; l = l->l_next)
1020	if (!l->l_removed && _dl_file_id_match_p (a: &l->l_file_id, b: &id))
1021	{
1022	/* The object is already loaded.
1023	Just bump its reference count and return it. */
1024	__close_nocancel (fd);
1025
1026	/* If the name is not in the list of names for this object add
1027	it. */
1028	free (ptr: realname);
1029	add_name_to_object (l, name);
1030
1031	return l;
1032	}
1033	}
1034
1035	#ifdef SHARED
1036	/* When loading into a namespace other than the base one we must
1037	avoid loading ld.so since there can only be one copy. Ever. */
1038	if (__glibc_unlikely (nsid != LM_ID_BASE)
1039	&& (_dl_file_id_match_p (&id, &GL(dl_rtld_map).l_file_id)
1040	|| _dl_name_match_p (name, &GL(dl_rtld_map))))
1041	{
1042	/* This is indeed ld.so. Create a new link_map which refers to
1043	the real one for almost everything. */
1044	l = _dl_new_object (realname, name, l_type, loader, mode, nsid);
1045	if (l == NULL)
1046	goto fail_new;
1047
1048	/* Refer to the real descriptor. */
1049	l->l_real = &GL(dl_rtld_map);
1050
1051	/* Copy l_addr and l_ld to avoid a GDB warning with dlmopen(). */
1052	l->l_addr = l->l_real->l_addr;
1053	l->l_ld = l->l_real->l_ld;
1054
1055	/* No need to bump the refcount of the real object, ld.so will
1056	never be unloaded. */
1057	__close_nocancel (fd);
1058
1059	/* Add the map for the mirrored object to the object list. */
1060	_dl_add_to_namespace_list (l, nsid);
1061
1062	_dl_notify_new_object (mode, nsid, l);
1063
1064	return l;
1065	}
1066	#endif
1067
1068	if (mode & RTLD_NOLOAD)
1069	{
1070	/* We are not supposed to load the object unless it is already
1071	loaded. So return now. */
1072	free (ptr: realname);
1073	__close_nocancel (fd);
1074	return NULL;
1075	}
1076
1077	/* Print debugging message. */
1078	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_FILES))
1079	_dl_debug_printf (fmt: "file=%s [%lu]; generating link map\n", name, nsid);
1080
1081	/* This is the ELF header. We read it in `open_verify'. */
1082	header = (void *) fbp->buf;
1083
1084	/* Enter the new object in the list of loaded objects. */
1085	l = _dl_new_object (realname, libname: name, type: l_type, loader, mode, nsid);
1086	if (__glibc_unlikely (l == NULL))
1087	{
1088	#ifdef SHARED
1089	fail_new:
1090	#endif
1091	errstring = N_("cannot create shared object descriptor");
1092	goto lose_errno;
1093	}
1094
1095	/* Extract the remaining details we need from the ELF header
1096	and then read in the program header table. */
1097	l->l_entry = header->e_entry;
1098	type = header->e_type;
1099	l->l_phnum = header->e_phnum;
1100
1101	maplength = header->e_phnum * sizeof (ElfW(Phdr));
1102	if (header->e_phoff + maplength <= (size_t) fbp->len)
1103	phdr = (void *) (fbp->buf + header->e_phoff);
1104	else
1105	{
1106	phdr = alloca (maplength);
1107	if ((size_t) __pread64_nocancel (fd, (void *) phdr, maplength,
1108	header->e_phoff) != maplength)
1109	{
1110	errstring = N_("cannot read file data");
1111	goto lose_errno;
1112	}
1113	}
1114
1115	/* On most platforms presume that PT_GNU_STACK is absent and the stack is
1116	* executable. Other platforms default to a nonexecutable stack and don't
1117	* need PT_GNU_STACK to do so. */
1118	unsigned int stack_flags = DEFAULT_STACK_PERMS;
1119
1120	{
1121	/* Scan the program header table, collecting its load commands. */
1122	struct loadcmd loadcmds[l->l_phnum];
1123	size_t nloadcmds = 0;
1124	bool has_holes = false;
1125	bool empty_dynamic = false;
1126	ElfW(Addr) p_align_max = 0;
1127
1128	/* The struct is initialized to zero so this is not necessary:
1129	l->l_ld = 0;
1130	l->l_phdr = 0;
1131	l->l_addr = 0; */
1132	for (ph = phdr; ph < &phdr[l->l_phnum]; ++ph)
1133	switch (ph->p_type)
1134	{
1135	/* These entries tell us where to find things once the file's
1136	segments are mapped in. We record the addresses it says
1137	verbatim, and later correct for the run-time load address. */
1138	case PT_DYNAMIC:
1139	if (ph->p_filesz == 0)
1140	empty_dynamic = true; /* Usually separate debuginfo. */
1141	else
1142	{
1143	/* Debuginfo only files from "objcopy --only-keep-debug"
1144	contain a PT_DYNAMIC segment with p_filesz == 0. Skip
1145	such a segment to avoid a crash later. */
1146	l->l_ld = (void *) ph->p_vaddr;
1147	l->l_ldnum = ph->p_memsz / sizeof (ElfW(Dyn));
1148	l->l_ld_readonly = (ph->p_flags & PF_W) == 0;
1149	}
1150	break;
1151
1152	case PT_PHDR:
1153	l->l_phdr = (void *) ph->p_vaddr;
1154	break;
1155
1156	case PT_LOAD:
1157	/* A load command tells us to map in part of the file.
1158	We record the load commands and process them all later. */
1159	if (__glibc_unlikely (((ph->p_vaddr - ph->p_offset)
1160	& (GLRO(dl_pagesize) - 1)) != 0))
1161	{
1162	errstring
1163	= N_("ELF load command address/offset not page-aligned");
1164	goto lose;
1165	}
1166
1167	struct loadcmd *c = &loadcmds[nloadcmds++];
1168	c->mapstart = ALIGN_DOWN (ph->p_vaddr, GLRO(dl_pagesize));
1169	c->mapend = ALIGN_UP (ph->p_vaddr + ph->p_filesz, GLRO(dl_pagesize));
1170	c->dataend = ph->p_vaddr + ph->p_filesz;
1171	c->allocend = ph->p_vaddr + ph->p_memsz;
1172	/* Remember the maximum p_align. */
1173	if (powerof2 (ph->p_align) && ph->p_align > p_align_max)
1174	p_align_max = ph->p_align;
1175	c->mapoff = ALIGN_DOWN (ph->p_offset, GLRO(dl_pagesize));
1176
1177	DIAG_PUSH_NEEDS_COMMENT;
1178
1179	#if __GNUC_PREREQ (11, 0)
1180	/* Suppress invalid GCC warning:
1181	‘(((char *)loadcmds.113_68 + _933 + 16))[329406144173384849].mapend’ may be used uninitialized [-Wmaybe-uninitialized]
1182	See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106008
1183	*/
1184	DIAG_IGNORE_NEEDS_COMMENT (11, "-Wmaybe-uninitialized");
1185	#endif
1186	/* Determine whether there is a gap between the last segment
1187	and this one. */
1188	if (nloadcmds > 1 && c[-1].mapend != c->mapstart)
1189	has_holes = true;
1190	DIAG_POP_NEEDS_COMMENT;
1191
1192	/* Optimize a common case. */
1193	#if (PF_R | PF_W | PF_X) == 7 && (PROT_READ | PROT_WRITE | PROT_EXEC) == 7
1194	c->prot = (PF_TO_PROT
1195	>> ((ph->p_flags & (PF_R | PF_W | PF_X)) * 4)) & 0xf;
1196	#else
1197	c->prot = 0;
1198	if (ph->p_flags & PF_R)
1199	c->prot |= PROT_READ;
1200	if (ph->p_flags & PF_W)
1201	c->prot |= PROT_WRITE;
1202	if (ph->p_flags & PF_X)
1203	c->prot |= PROT_EXEC;
1204	#endif
1205	break;
1206
1207	case PT_TLS:
1208	if (ph->p_memsz == 0)
1209	/* Nothing to do for an empty segment. */
1210	break;
1211
1212	l->l_tls_blocksize = ph->p_memsz;
1213	l->l_tls_align = ph->p_align;
1214	if (ph->p_align == 0)
1215	l->l_tls_firstbyte_offset = 0;
1216	else
1217	l->l_tls_firstbyte_offset = ph->p_vaddr & (ph->p_align - 1);
1218	l->l_tls_initimage_size = ph->p_filesz;
1219	/* Since we don't know the load address yet only store the
1220	offset. We will adjust it later. */
1221	l->l_tls_initimage = (void *) ph->p_vaddr;
1222
1223	/* l->l_tls_modid is assigned below, once there is no
1224	possibility for failure. */
1225
1226	if (l->l_type != lt_library
1227	&& GL(dl_tls_dtv_slotinfo_list) == NULL)
1228	{
1229	#ifdef SHARED
1230	/* We are loading the executable itself when the dynamic
1231	linker was executed directly. The setup will happen
1232	later. */
1233	assert (l->l_prev == NULL || (mode & __RTLD_AUDIT) != 0);
1234	#else
1235	assert (false && "TLS not initialized in static application");
1236	#endif
1237	}
1238	break;
1239
1240	case PT_GNU_STACK:
1241	stack_flags = ph->p_flags;
1242	break;
1243
1244	case PT_GNU_RELRO:
1245	l->l_relro_addr = ph->p_vaddr;
1246	l->l_relro_size = ph->p_memsz;
1247	break;
1248	}
1249
1250	if (__glibc_unlikely (nloadcmds == 0))
1251	{
1252	/* This only happens for a bogus object that will be caught with
1253	another error below. But we don't want to go through the
1254	calculations below using NLOADCMDS - 1. */
1255	errstring = N_("object file has no loadable segments");
1256	goto lose;
1257	}
1258
1259	/* Align all PT_LOAD segments to the maximum p_align. */
1260	for (size_t i = 0; i < nloadcmds; i++)
1261	loadcmds[i].mapalign = p_align_max;
1262
1263	/* dlopen of an executable is not valid because it is not possible
1264	to perform proper relocations, handle static TLS, or run the
1265	ELF constructors. For PIE, the check needs the dynamic
1266	section, so there is another check below. */
1267	if (__glibc_unlikely (type != ET_DYN)
1268	&& __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0))
1269	{
1270	/* This object is loaded at a fixed address. This must never
1271	happen for objects loaded with dlopen. */
1272	errstring = N_("cannot dynamically load executable");
1273	goto lose;
1274	}
1275
1276	/* This check recognizes most separate debuginfo files. */
1277	if (__glibc_unlikely ((l->l_ld == 0 && type == ET_DYN) || empty_dynamic))
1278	{
1279	errstring = N_("object file has no dynamic section");
1280	goto lose;
1281	}
1282
1283	/* Length of the sections to be loaded. */
1284	maplength = loadcmds[nloadcmds - 1].allocend - loadcmds[0].mapstart;
1285
1286	/* Now process the load commands and map segments into memory.
1287	This is responsible for filling in:
1288	l_map_start, l_map_end, l_addr, l_contiguous, l_phdr
1289	*/
1290	errstring = _dl_map_segments (l, fd, header, type, loadcmds, nloadcmds,
1291	maplength, has_holes, loader);
1292	if (__glibc_unlikely (errstring != NULL))
1293	{
1294	/* Mappings can be in an inconsistent state: avoid unmap. */
1295	l->l_map_start = l->l_map_end = 0;
1296	goto lose;
1297	}
1298	}
1299
1300	if (l->l_ld != 0)
1301	l->l_ld = (ElfW(Dyn) *) ((ElfW(Addr)) l->l_ld + l->l_addr);
1302
1303	elf_get_dynamic_info (l, false, false);
1304
1305	/* Make sure we are not dlopen'ing an object that has the
1306	DF_1_NOOPEN flag set, or a PIE object. */
1307	if ((__glibc_unlikely (l->l_flags_1 & DF_1_NOOPEN)
1308	&& (mode & __RTLD_DLOPEN))
1309	|| (__glibc_unlikely (l->l_flags_1 & DF_1_PIE)
1310	&& __glibc_unlikely ((mode & __RTLD_OPENEXEC) == 0)))
1311	{
1312	if (l->l_flags_1 & DF_1_PIE)
1313	errstring
1314	= N_("cannot dynamically load position-independent executable");
1315	else
1316	errstring = N_("shared object cannot be dlopen()ed");
1317	goto lose;
1318	}
1319
1320	if (l->l_phdr == NULL)
1321	{
1322	/* The program header is not contained in any of the segments.
1323	We have to allocate memory ourself and copy it over from out
1324	temporary place. */
1325	ElfW(Phdr) *newp = (ElfW(Phdr) *) malloc (size: header->e_phnum
1326	* sizeof (ElfW(Phdr)));
1327	if (newp == NULL)
1328	{
1329	errstring = N_("cannot allocate memory for program header");
1330	goto lose_errno;
1331	}
1332
1333	l->l_phdr = memcpy (newp, phdr,
1334	(header->e_phnum * sizeof (ElfW(Phdr))));
1335	l->l_phdr_allocated = 1;
1336	}
1337	else
1338	/* Adjust the PT_PHDR value by the runtime load address. */
1339	l->l_phdr = (ElfW(Phdr) *) ((ElfW(Addr)) l->l_phdr + l->l_addr);
1340
1341	if (__glibc_unlikely ((stack_flags &~ GL(dl_stack_flags)) & PF_X))
1342	{
1343	/* The stack is presently not executable, but this module
1344	requires that it be executable. We must change the
1345	protection of the variable which contains the flags used in
1346	the mprotect calls. */
1347	#ifdef SHARED
1348	if ((mode & (__RTLD_DLOPEN | __RTLD_AUDIT)) == __RTLD_DLOPEN)
1349	{
1350	const uintptr_t p = (uintptr_t) &__stack_prot & -GLRO(dl_pagesize);
1351	const size_t s = (uintptr_t) (&__stack_prot + 1) - p;
1352
1353	struct link_map *const m = &GL(dl_rtld_map);
1354	const uintptr_t relro_end = ((m->l_addr + m->l_relro_addr
1355	+ m->l_relro_size)
1356	& -GLRO(dl_pagesize));
1357	if (__glibc_likely (p + s <= relro_end))
1358	{
1359	/* The variable lies in the region protected by RELRO. */
1360	if (__mprotect ((void *) p, s, PROT_READ|PROT_WRITE) < 0)
1361	{
1362	errstring = N_("cannot change memory protections");
1363	goto lose_errno;
1364	}
1365	__stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
1366	__mprotect ((void *) p, s, PROT_READ);
1367	}
1368	else
1369	__stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
1370	}
1371	else
1372	#endif
1373	__stack_prot |= PROT_READ|PROT_WRITE|PROT_EXEC;
1374
1375	#ifdef check_consistency
1376	check_consistency ();
1377	#endif
1378
1379	#if PTHREAD_IN_LIBC
1380	errval = _dl_make_stacks_executable (stack_endp);
1381	#else
1382	errval = (*GL(dl_make_stack_executable_hook)) (stack_endp);
1383	#endif
1384	if (errval)
1385	{
1386	errstring = N_("\
1387	cannot enable executable stack as shared object requires");
1388	goto lose;
1389	}
1390	}
1391
1392	/* Adjust the address of the TLS initialization image. */
1393	if (l->l_tls_initimage != NULL)
1394	l->l_tls_initimage = (char *) l->l_tls_initimage + l->l_addr;
1395
1396	/* Process program headers again after load segments are mapped in
1397	case processing requires accessing those segments. Scan program
1398	headers backward so that PT_NOTE can be skipped if PT_GNU_PROPERTY
1399	exits. */
1400	for (ph = &l->l_phdr[l->l_phnum]; ph != l->l_phdr; --ph)
1401	switch (ph[-1].p_type)
1402	{
1403	case PT_NOTE:
1404	_dl_process_pt_note (l, fd, ph: &ph[-1]);
1405	break;
1406	case PT_GNU_PROPERTY:
1407	_dl_process_pt_gnu_property (l, fd, ph: &ph[-1]);
1408	break;
1409	}
1410
1411	/* We are done mapping in the file. We no longer need the descriptor. */
1412	if (__glibc_unlikely (__close_nocancel (fd) != 0))
1413	{
1414	errstring = N_("cannot close file descriptor");
1415	goto lose_errno;
1416	}
1417	/* Signal that we closed the file. */
1418	fd = -1;
1419
1420	/* Failures before this point are handled locally via lose.
1421	There are no more failures in this function until return,
1422	to change that the cleanup handling needs to be updated. */
1423
1424	/* If this is ET_EXEC, we should have loaded it as lt_executable. */
1425	assert (type != ET_EXEC || l->l_type == lt_executable);
1426
1427	l->l_entry += l->l_addr;
1428
1429	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_FILES))
1430	_dl_debug_printf (fmt: "\
1431	dynamic: 0x%0*lx base: 0x%0*lx size: 0x%0*zx\n\
1432	entry: 0x%0*lx phdr: 0x%0*lx phnum: %*u\n\n",
1433	(int) sizeof (void *) * 2,
1434	(unsigned long int) l->l_ld,
1435	(int) sizeof (void *) * 2,
1436	(unsigned long int) l->l_addr,
1437	(int) sizeof (void *) * 2, maplength,
1438	(int) sizeof (void *) * 2,
1439	(unsigned long int) l->l_entry,
1440	(int) sizeof (void *) * 2,
1441	(unsigned long int) l->l_phdr,
1442	(int) sizeof (void *) * 2, l->l_phnum);
1443
1444	/* Set up the symbol hash table. */
1445	_dl_setup_hash (map: l);
1446
1447	/* If this object has DT_SYMBOLIC set modify now its scope. We don't
1448	have to do this for the main map. */
1449	if ((mode & RTLD_DEEPBIND) == 0
1450	&& __glibc_unlikely (l->l_info[DT_SYMBOLIC] != NULL)
1451	&& &l->l_searchlist != l->l_scope[0])
1452	{
1453	/* Create an appropriate searchlist. It contains only this map.
1454	This is the definition of DT_SYMBOLIC in SysVr4. */
1455	l->l_symbolic_searchlist.r_list[0] = l;
1456	l->l_symbolic_searchlist.r_nlist = 1;
1457
1458	/* Now move the existing entries one back. */
1459	memmove (&l->l_scope[1], &l->l_scope[0],
1460	(l->l_scope_max - 1) * sizeof (l->l_scope[0]));
1461
1462	/* Now add the new entry. */
1463	l->l_scope[0] = &l->l_symbolic_searchlist;
1464	}
1465
1466	/* Remember whether this object must be initialized first. */
1467	if (l->l_flags_1 & DF_1_INITFIRST)
1468	GL(dl_initfirst) = l;
1469
1470	/* Finally the file information. */
1471	l->l_file_id = id;
1472
1473	#ifdef SHARED
1474	/* When auditing is used the recorded names might not include the
1475	name by which the DSO is actually known. Add that as well. */
1476	if (__glibc_unlikely (origname != NULL))
1477	add_name_to_object (l, origname);
1478
1479	/* When we profile the SONAME might be needed for something else but
1480	loading. Add it right away. */
1481	if (__glibc_unlikely (GLRO(dl_profile) != NULL)
1482	&& l->l_info[DT_SONAME] != NULL)
1483	add_name_to_object (l, ((const char *) D_PTR (l, l_info[DT_STRTAB])
1484	+ l->l_info[DT_SONAME]->d_un.d_val));
1485	#else
1486	/* Audit modules only exist when linking is dynamic so ORIGNAME
1487	cannot be non-NULL. */
1488	assert (origname == NULL);
1489	#endif
1490
1491	/* If we have newly loaded libc.so, update the namespace
1492	description. */
1493	if (GL(dl_ns)[nsid].libc_map == NULL
1494	&& l->l_info[DT_SONAME] != NULL
1495	&& strcmp (((const char *) D_PTR (l, l_info[DT_STRTAB])
1496	+ l->l_info[DT_SONAME]->d_un.d_val), LIBC_SO) == 0)
1497	GL(dl_ns)[nsid].libc_map = l;
1498
1499	/* _dl_close can only eventually undo the module ID assignment (via
1500	remove_slotinfo) if this function returns a pointer to a link
1501	map. Therefore, delay this step until all possibilities for
1502	failure have been excluded. */
1503	if (l->l_tls_blocksize > 0
1504	&& (__glibc_likely (l->l_type == lt_library)
1505	/* If GL(dl_tls_dtv_slotinfo_list) == NULL, then rtld.c did
1506	not set up TLS data structures, so don't use them now. */
1507	|| __glibc_likely (GL(dl_tls_dtv_slotinfo_list) != NULL)))
1508	/* Assign the next available module ID. */
1509	_dl_assign_tls_modid (l);
1510
1511	#ifdef DL_AFTER_LOAD
1512	DL_AFTER_LOAD (l);
1513	#endif
1514
1515	/* Now that the object is fully initialized add it to the object list. */
1516	_dl_add_to_namespace_list (new: l, nsid);
1517
1518	/* Skip auditing and debugger notification when called from 'sprof'. */
1519	if (mode & __RTLD_SPROF)
1520	return l;
1521
1522	_dl_notify_new_object (mode, nsid, l);
1523
1524	return l;
1525	}
1526
1527	/* Print search path. */
1528	static void
1529	print_search_path (struct r_search_path_elem **list,
1530	const char *what, const char *name)
1531	{
1532	char buf[max_dirnamelen + max_capstrlen];
1533	int first = 1;
1534
1535	_dl_debug_printf (fmt: " search path=");
1536
1537	while (*list != NULL && (*list)->what == what) /* Yes, ==. */
1538	{
1539	char *endp = __mempcpy (buf, (*list)->dirname, (*list)->dirnamelen);
1540	size_t cnt;
1541
1542	for (cnt = 0; cnt < ncapstr; ++cnt)
1543	if ((*list)->status[cnt] != nonexisting)
1544	{
1545	#ifdef SHARED
1546	char *cp = __mempcpy (endp, capstr[cnt].str, capstr[cnt].len);
1547	if (cp == buf || (cp == buf + 1 && buf[0] == '/'))
1548	cp[0] = '\0';
1549	else
1550	cp[-1] = '\0';
1551	#else
1552	*endp = '\0';
1553	#endif
1554
1555	_dl_debug_printf_c (fmt: first ? "%s" : ":%s", buf);
1556	first = 0;
1557	}
1558
1559	++list;
1560	}
1561
1562	if (name != NULL)
1563	_dl_debug_printf_c (fmt: "\t\t(%s from file %s)\n", what,
1564	DSO_FILENAME (name));
1565	else
1566	_dl_debug_printf_c (fmt: "\t\t(%s)\n", what);
1567	}
1568
1569	/* Open a file and verify it is an ELF file for this architecture. We
1570	ignore only ELF files for other architectures. Non-ELF files and
1571	ELF files with different header information cause fatal errors since
1572	this could mean there is something wrong in the installation and the
1573	user might want to know about this.
1574
1575	If FD is not -1, then the file is already open and FD refers to it.
1576	In that case, FD is consumed for both successful and error returns. */
1577	static int
1578	open_verify (const char *name, int fd,
1579	struct filebuf *fbp, struct link_map *loader,
1580	int whatcode, int mode, bool *found_other_class, bool free_name)
1581	{
1582	/* This is the expected ELF header. */
1583	#define ELF32_CLASS ELFCLASS32
1584	#define ELF64_CLASS ELFCLASS64
1585	#ifndef VALID_ELF_HEADER
1586	# define VALID_ELF_HEADER(hdr,exp,size) (memcmp (hdr, exp, size) == 0)
1587	# define VALID_ELF_OSABI(osabi) (osabi == ELFOSABI_SYSV)
1588	# define VALID_ELF_ABIVERSION(osabi,ver) (ver == 0)
1589	#elif defined MORE_ELF_HEADER_DATA
1590	MORE_ELF_HEADER_DATA;
1591	#endif
1592	static const unsigned char expected[EI_NIDENT] =
1593	{
1594	[EI_MAG0] = ELFMAG0,
1595	[EI_MAG1] = ELFMAG1,
1596	[EI_MAG2] = ELFMAG2,
1597	[EI_MAG3] = ELFMAG3,
1598	[EI_CLASS] = ELFW(CLASS),
1599	[EI_DATA] = byteorder,
1600	[EI_VERSION] = EV_CURRENT,
1601	[EI_OSABI] = ELFOSABI_SYSV,
1602	[EI_ABIVERSION] = 0
1603	};
1604	/* Initialize it to make the compiler happy. */
1605	const char *errstring = NULL;
1606	int errval = 0;
1607
1608	#ifdef SHARED
1609	/* Give the auditing libraries a chance. */
1610	if (__glibc_unlikely (GLRO(dl_naudit) > 0))
1611	{
1612	const char *original_name = name;
1613	name = _dl_audit_objsearch (name, loader, whatcode);
1614	if (name == NULL)
1615	return -1;
1616
1617	if (fd != -1 && name != original_name && strcmp (name, original_name))
1618	{
1619	/* An audit library changed what we're supposed to open,
1620	so FD no longer matches it. */
1621	__close_nocancel (fd);
1622	fd = -1;
1623	}
1624	}
1625	#endif
1626
1627	if (fd == -1)
1628	/* Open the file. We always open files read-only. */
1629	fd = __open64_nocancel (name, O_RDONLY | O_CLOEXEC);
1630
1631	if (fd != -1)
1632	{
1633	ElfW(Ehdr) *ehdr;
1634	ElfW(Phdr) *phdr;
1635	size_t maplength;
1636
1637	/* We successfully opened the file. Now verify it is a file
1638	we can use. */
1639	__set_errno (0);
1640	fbp->len = 0;
1641	assert (sizeof (fbp->buf) > sizeof (ElfW(Ehdr)));
1642	/* Read in the header. */
1643	do
1644	{
1645	ssize_t retlen = __read_nocancel (fd, fbp->buf + fbp->len,
1646	sizeof (fbp->buf) - fbp->len);
1647	if (retlen <= 0)
1648	break;
1649	fbp->len += retlen;
1650	}
1651	while (__glibc_unlikely (fbp->len < sizeof (ElfW(Ehdr))));
1652
1653	/* This is where the ELF header is loaded. */
1654	ehdr = (ElfW(Ehdr) *) fbp->buf;
1655
1656	/* Now run the tests. */
1657	if (__glibc_unlikely (fbp->len < (ssize_t) sizeof (ElfW(Ehdr))))
1658	{
1659	errval = errno;
1660	errstring = (errval == 0
1661	? N_("file too short") : N_("cannot read file data"));
1662	lose:
1663	if (free_name)
1664	{
1665	char *realname = (char *) name;
1666	name = strdupa (realname);
1667	free (ptr: realname);
1668	}
1669	__close_nocancel (fd);
1670	_dl_signal_error (errcode: errval, object: name, NULL, errstring);
1671	}
1672
1673	/* See whether the ELF header is what we expect. */
1674	if (__glibc_unlikely (! VALID_ELF_HEADER (ehdr->e_ident, expected,
1675	EI_ABIVERSION)
1676	|| !VALID_ELF_ABIVERSION (ehdr->e_ident[EI_OSABI],
1677	ehdr->e_ident[EI_ABIVERSION])
1678	|| memcmp (&ehdr->e_ident[EI_PAD],
1679	&expected[EI_PAD],
1680	EI_NIDENT - EI_PAD) != 0))
1681	{
1682	/* Something is wrong. */
1683	const Elf32_Word *magp = (const void *) ehdr->e_ident;
1684	if (*magp !=
1685	#if BYTE_ORDER == LITTLE_ENDIAN
1686	((ELFMAG0 << (EI_MAG0 * 8))
1687	| (ELFMAG1 << (EI_MAG1 * 8))
1688	| (ELFMAG2 << (EI_MAG2 * 8))
1689	| (ELFMAG3 << (EI_MAG3 * 8)))
1690	#else
1691	((ELFMAG0 << (EI_MAG3 * 8))
1692	| (ELFMAG1 << (EI_MAG2 * 8))
1693	| (ELFMAG2 << (EI_MAG1 * 8))
1694	| (ELFMAG3 << (EI_MAG0 * 8)))
1695	#endif
1696	)
1697	errstring = N_("invalid ELF header");
1698
1699	else if (ehdr->e_ident[EI_CLASS] != ELFW(CLASS))
1700	{
1701	/* This is not a fatal error. On architectures where
1702	32-bit and 64-bit binaries can be run this might
1703	happen. */
1704	*found_other_class = true;
1705	__close_nocancel (fd);
1706	__set_errno (ENOENT);
1707	return -1;
1708	}
1709	else if (ehdr->e_ident[EI_DATA] != byteorder)
1710	{
1711	if (BYTE_ORDER == BIG_ENDIAN)
1712	errstring = N_("ELF file data encoding not big-endian");
1713	else
1714	errstring = N_("ELF file data encoding not little-endian");
1715	}
1716	else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT)
1717	errstring
1718	= N_("ELF file version ident does not match current one");
1719	/* XXX We should be able so set system specific versions which are
1720	allowed here. */
1721	else if (!VALID_ELF_OSABI (ehdr->e_ident[EI_OSABI]))
1722	errstring = N_("ELF file OS ABI invalid");
1723	else if (!VALID_ELF_ABIVERSION (ehdr->e_ident[EI_OSABI],
1724	ehdr->e_ident[EI_ABIVERSION]))
1725	errstring = N_("ELF file ABI version invalid");
1726	else if (memcmp (&ehdr->e_ident[EI_PAD], &expected[EI_PAD],
1727	EI_NIDENT - EI_PAD) != 0)
1728	errstring = N_("nonzero padding in e_ident");
1729	else
1730	/* Otherwise we don't know what went wrong. */
1731	errstring = N_("internal error");
1732
1733	goto lose;
1734	}
1735
1736	if (__glibc_unlikely (ehdr->e_version != EV_CURRENT))
1737	{
1738	errstring = N_("ELF file version does not match current one");
1739	goto lose;
1740	}
1741	if (! __glibc_likely (elf_machine_matches_host (ehdr)))
1742	{
1743	__close_nocancel (fd);
1744	__set_errno (ENOENT);
1745	return -1;
1746	}
1747	else if (__glibc_unlikely (ehdr->e_type != ET_DYN
1748	&& ehdr->e_type != ET_EXEC))
1749	{
1750	errstring = N_("only ET_DYN and ET_EXEC can be loaded");
1751	goto lose;
1752	}
1753	else if (__glibc_unlikely (ehdr->e_phentsize != sizeof (ElfW(Phdr))))
1754	{
1755	errstring = N_("ELF file's phentsize not the expected size");
1756	goto lose;
1757	}
1758
1759	maplength = ehdr->e_phnum * sizeof (ElfW(Phdr));
1760	if (ehdr->e_phoff + maplength <= (size_t) fbp->len)
1761	phdr = (void *) (fbp->buf + ehdr->e_phoff);
1762	else
1763	{
1764	phdr = alloca (maplength);
1765	if ((size_t) __pread64_nocancel (fd, (void *) phdr, maplength,
1766	ehdr->e_phoff) != maplength)
1767	{
1768	errval = errno;
1769	errstring = N_("cannot read file data");
1770	goto lose;
1771	}
1772	}
1773
1774	if (__glibc_unlikely (elf_machine_reject_phdr_p
1775	(phdr, ehdr->e_phnum, fbp->buf, fbp->len,
1776	loader, fd)))
1777	{
1778	__close_nocancel (fd);
1779	__set_errno (ENOENT);
1780	return -1;
1781	}
1782
1783	}
1784
1785	return fd;
1786	}
1787
1788	/* Try to open NAME in one of the directories in SPS. Return the fd, or -1.
1789	If successful, fill in *REALNAME with the malloc'd full directory name. If
1790	it turns out that none of the directories in SPS exists, SPS->DIRS is
1791	replaced with (void *) -1, and the old value is free()d if SPS->MALLOCED is
1792	true. */
1793
1794	static int
1795	open_path (const char *name, size_t namelen, int mode,
1796	struct r_search_path_struct *sps, char **realname,
1797	struct filebuf *fbp, struct link_map *loader, int whatcode,
1798	bool *found_other_class)
1799	{
1800	struct r_search_path_elem **dirs = sps->dirs;
1801	char *buf;
1802	int fd = -1;
1803	const char *current_what = NULL;
1804	int any = 0;
1805
1806	if (__glibc_unlikely (dirs == NULL))
1807	/* We're called before _dl_init_paths when loading the main executable
1808	given on the command line when rtld is run directly. */
1809	return -1;
1810
1811	buf = alloca (max_dirnamelen + max_capstrlen + namelen);
1812	do
1813	{
1814	struct r_search_path_elem *this_dir = *dirs;
1815	size_t buflen = 0;
1816	size_t cnt;
1817	char *edp;
1818	int here_any = 0;
1819
1820	/* If we are debugging the search for libraries print the path
1821	now if it hasn't happened now. */
1822	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS)
1823	&& current_what != this_dir->what)
1824	{
1825	current_what = this_dir->what;
1826	print_search_path (list: dirs, what: current_what, name: this_dir->where);
1827	}
1828
1829	edp = (char *) __mempcpy (buf, this_dir->dirname, this_dir->dirnamelen);
1830	for (cnt = 0; fd == -1 && cnt < ncapstr; ++cnt)
1831	{
1832	/* Skip this directory if we know it does not exist. */
1833	if (this_dir->status[cnt] == nonexisting)
1834	continue;
1835
1836	#ifdef SHARED
1837	buflen =
1838	((char *) __mempcpy (__mempcpy (edp, capstr[cnt].str,
1839	capstr[cnt].len),
1840	name, namelen)
1841	- buf);
1842	#else
1843	buflen = (char *) __mempcpy (edp, name, namelen) - buf;
1844	#endif
1845
1846	/* Print name we try if this is wanted. */
1847	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS))
1848	_dl_debug_printf (fmt: " trying file=%s\n", buf);
1849
1850	fd = open_verify (name: buf, fd: -1, fbp, loader, whatcode, mode,
1851	found_other_class, false);
1852	if (this_dir->status[cnt] == unknown)
1853	{
1854	if (fd != -1)
1855	this_dir->status[cnt] = existing;
1856	/* Do not update the directory information when loading
1857	auditing code. We must try to disturb the program as
1858	little as possible. */
1859	else if (loader == NULL
1860	|| GL(dl_ns)[loader->l_ns]._ns_loaded->l_auditing == 0)
1861	{
1862	/* We failed to open machine dependent library. Let's
1863	test whether there is any directory at all. */
1864	struct __stat64_t64 st;
1865
1866	buf[buflen - namelen] = '\0';
1867
1868	if (__stat64_time64 (buf, &st) != 0
1869	|| ! S_ISDIR (st.st_mode))
1870	/* The directory does not exist or it is no directory. */
1871	this_dir->status[cnt] = nonexisting;
1872	else
1873	this_dir->status[cnt] = existing;
1874	}
1875	}
1876
1877	/* Remember whether we found any existing directory. */
1878	here_any |= this_dir->status[cnt] != nonexisting;
1879
1880	if (fd != -1 && __glibc_unlikely (mode & __RTLD_SECURE)
1881	&& __libc_enable_secure)
1882	{
1883	/* This is an extra security effort to make sure nobody can
1884	preload broken shared objects which are in the trusted
1885	directories and so exploit the bugs. */
1886	struct __stat64_t64 st;
1887
1888	if (__fstat64_time64 (fd, &st) != 0
1889	|| (st.st_mode & S_ISUID) == 0)
1890	{
1891	/* The shared object cannot be tested for being SUID
1892	or this bit is not set. In this case we must not
1893	use this object. */
1894	__close_nocancel (fd);
1895	fd = -1;
1896	/* We simply ignore the file, signal this by setting
1897	the error value which would have been set by `open'. */
1898	errno = ENOENT;
1899	}
1900	}
1901	}
1902
1903	if (fd != -1)
1904	{
1905	*realname = (char *) malloc (size: buflen);
1906	if (*realname != NULL)
1907	{
1908	memcpy (*realname, buf, buflen);
1909	return fd;
1910	}
1911	else
1912	{
1913	/* No memory for the name, we certainly won't be able
1914	to load and link it. */
1915	__close_nocancel (fd);
1916	return -1;
1917	}
1918	}
1919
1920	/* Continue the search if the file does not exist (ENOENT), if it can
1921	not be accessed (EACCES), or if the a component in the path is not a
1922	directory (for instance, if the component is a existing file meaning
1923	essentially that the pathname is invalid - ENOTDIR). */
1924	if (here_any && errno != ENOENT && errno != EACCES && errno != ENOTDIR)
1925	return -1;
1926
1927	/* Remember whether we found anything. */
1928	any |= here_any;
1929	}
1930	while (*++dirs != NULL);
1931
1932	/* Remove the whole path if none of the directories exists. */
1933	if (__glibc_unlikely (! any))
1934	{
1935	/* Paths which were allocated using the minimal malloc() in ld.so
1936	must not be freed using the general free() in libc. */
1937	if (sps->malloced)
1938	free (ptr: sps->dirs);
1939
1940	/* __rtld_search_dirs and __rtld_env_path_list are
1941	attribute_relro, therefore avoid writing to them. */
1942	if (sps != &__rtld_search_dirs && sps != &__rtld_env_path_list)
1943	sps->dirs = (void *) -1;
1944	}
1945
1946	return -1;
1947	}
1948
1949	/* Map in the shared object file NAME. */
1950
1951	struct link_map *
1952	_dl_map_object (struct link_map *loader, const char *name,
1953	int type, int trace_mode, int mode, Lmid_t nsid)
1954	{
1955	int fd;
1956	const char *origname = NULL;
1957	char *realname;
1958	char *name_copy;
1959	struct link_map *l;
1960	struct filebuf fb;
1961
1962	assert (nsid >= 0);
1963	assert (nsid < GL(dl_nns));
1964
1965	/* Look for this name among those already loaded. */
1966	for (l = GL(dl_ns)[nsid]._ns_loaded; l; l = l->l_next)
1967	{
1968	/* If the requested name matches the soname of a loaded object,
1969	use that object. Elide this check for names that have not
1970	yet been opened. */
1971	if (__glibc_unlikely ((l->l_faked | l->l_removed) != 0))
1972	continue;
1973	if (!_dl_name_match_p (name: name, map: l))
1974	{
1975	const char *soname;
1976
1977	if (__glibc_likely (l->l_soname_added)
1978	|| l->l_info[DT_SONAME] == NULL)
1979	continue;
1980
1981	soname = ((const char *) D_PTR (l, l_info[DT_STRTAB])
1982	+ l->l_info[DT_SONAME]->d_un.d_val);
1983	if (strcmp (name, soname) != 0)
1984	continue;
1985
1986	/* We have a match on a new name -- cache it. */
1987	add_name_to_object (l, name: soname);
1988	l->l_soname_added = 1;
1989	}
1990
1991	/* We have a match. */
1992	return l;
1993	}
1994
1995	/* Display information if we are debugging. */
1996	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_FILES)
1997	&& loader != NULL)
1998	_dl_debug_printf (fmt: (mode & __RTLD_CALLMAP) == 0
1999	? "\nfile=%s [%lu]; needed by %s [%lu]\n"
2000	: "\nfile=%s [%lu]; dynamically loaded by %s [%lu]\n",
2001	name, nsid, DSO_FILENAME (loader->l_name), loader->l_ns);
2002
2003	#ifdef SHARED
2004	/* Give the auditing libraries a chance to change the name before we
2005	try anything. */
2006	if (__glibc_unlikely (GLRO(dl_naudit) > 0))
2007	{
2008	const char *before = name;
2009	name = _dl_audit_objsearch (name, loader, LA_SER_ORIG);
2010	if (name == NULL)
2011	{
2012	fd = -1;
2013	goto no_file;
2014	}
2015	if (before != name && strcmp (before, name) != 0)
2016	origname = before;
2017	}
2018	#endif
2019
2020	/* Will be true if we found a DSO which is of the other ELF class. */
2021	bool found_other_class = false;
2022
2023	if (strchr (name, '/') == NULL)
2024	{
2025	/* Search for NAME in several places. */
2026
2027	size_t namelen = strlen (name) + 1;
2028
2029	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS))
2030	_dl_debug_printf (fmt: "find library=%s [%lu]; searching\n", name, nsid);
2031
2032	fd = -1;
2033
2034	/* When the object has the RUNPATH information we don't use any
2035	RPATHs. */
2036	if (loader == NULL || loader->l_info[DT_RUNPATH] == NULL)
2037	{
2038	/* This is the executable's map (if there is one). Make sure that
2039	we do not look at it twice. */
2040	struct link_map *main_map = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
2041	bool did_main_map = false;
2042
2043	/* First try the DT_RPATH of the dependent object that caused NAME
2044	to be loaded. Then that object's dependent, and on up. */
2045	for (l = loader; l; l = l->l_loader)
2046	if (cache_rpath (l, sp: &l->l_rpath_dirs, DT_RPATH, what: "RPATH"))
2047	{
2048	fd = open_path (name, namelen, mode,
2049	sps: &l->l_rpath_dirs,
2050	realname: &realname, fbp: &fb, loader, whatcode: LA_SER_RUNPATH,
2051	found_other_class: &found_other_class);
2052	if (fd != -1)
2053	break;
2054
2055	did_main_map |= l == main_map;
2056	}
2057
2058	/* If dynamically linked, try the DT_RPATH of the executable
2059	itself. NB: we do this for lookups in any namespace. */
2060	if (fd == -1 && !did_main_map
2061	&& main_map != NULL && main_map->l_type != lt_loaded
2062	&& cache_rpath (l: main_map, sp: &main_map->l_rpath_dirs, DT_RPATH,
2063	what: "RPATH"))
2064	fd = open_path (name, namelen, mode,
2065	sps: &main_map->l_rpath_dirs,
2066	realname: &realname, fbp: &fb, loader: loader ?: main_map, whatcode: LA_SER_RUNPATH,
2067	found_other_class: &found_other_class);
2068
2069	/* Also try DT_RUNPATH in the executable for LD_AUDIT dlopen
2070	call. */
2071	if (__glibc_unlikely (mode & __RTLD_AUDIT)
2072	&& fd == -1 && !did_main_map
2073	&& main_map != NULL && main_map->l_type != lt_loaded)
2074	{
2075	struct r_search_path_struct l_rpath_dirs;
2076	l_rpath_dirs.dirs = NULL;
2077	if (cache_rpath (l: main_map, sp: &l_rpath_dirs,
2078	DT_RUNPATH, what: "RUNPATH"))
2079	fd = open_path (name, namelen, mode, sps: &l_rpath_dirs,
2080	realname: &realname, fbp: &fb, loader: loader ?: main_map,
2081	whatcode: LA_SER_RUNPATH, found_other_class: &found_other_class);
2082	}
2083	}
2084
2085	/* Try the LD_LIBRARY_PATH environment variable. */
2086	if (fd == -1 && __rtld_env_path_list.dirs != (void *) -1)
2087	fd = open_path (name, namelen, mode, sps: &__rtld_env_path_list,
2088	realname: &realname, fbp: &fb,
2089	loader: loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded,
2090	whatcode: LA_SER_LIBPATH, found_other_class: &found_other_class);
2091
2092	/* Look at the RUNPATH information for this binary. */
2093	if (fd == -1 && loader != NULL
2094	&& cache_rpath (l: loader, sp: &loader->l_runpath_dirs,
2095	DT_RUNPATH, what: "RUNPATH"))
2096	fd = open_path (name, namelen, mode,
2097	sps: &loader->l_runpath_dirs, realname: &realname, fbp: &fb, loader,
2098	whatcode: LA_SER_RUNPATH, found_other_class: &found_other_class);
2099
2100	if (fd == -1)
2101	{
2102	realname = _dl_sysdep_open_object (name, namelen, fd: &fd);
2103	if (realname != NULL)
2104	{
2105	fd = open_verify (name: realname, fd,
2106	fbp: &fb, loader: loader ?: GL(dl_ns)[nsid]._ns_loaded,
2107	whatcode: LA_SER_CONFIG, mode, found_other_class: &found_other_class,
2108	false);
2109	if (fd == -1)
2110	free (ptr: realname);
2111	}
2112	}
2113
2114	#ifdef USE_LDCONFIG
2115	if (fd == -1
2116	&& (__glibc_likely ((mode & __RTLD_SECURE) == 0)
2117	|| ! __libc_enable_secure)
2118	&& __glibc_likely (GLRO(dl_inhibit_cache) == 0))
2119	{
2120	/* Check the list of libraries in the file /etc/ld.so.cache,
2121	for compatibility with Linux's ldconfig program. */
2122	char *cached = _dl_load_cache_lookup (name);
2123
2124	if (cached != NULL)
2125	{
2126	// XXX Correct to unconditionally default to namespace 0?
2127	l = (loader
2128	?: GL(dl_ns)[LM_ID_BASE]._ns_loaded
2129	# ifdef SHARED
2130	?: &GL(dl_rtld_map)
2131	# endif
2132	);
2133
2134	/* If the loader has the DF_1_NODEFLIB flag set we must not
2135	use a cache entry from any of these directories. */
2136	if (__glibc_unlikely (l->l_flags_1 & DF_1_NODEFLIB))
2137	{
2138	const char *dirp = system_dirs;
2139	unsigned int cnt = 0;
2140
2141	do
2142	{
2143	if (memcmp (cached, dirp, system_dirs_len[cnt]) == 0)
2144	{
2145	/* The prefix matches. Don't use the entry. */
2146	free (ptr: cached);
2147	cached = NULL;
2148	break;
2149	}
2150
2151	dirp += system_dirs_len[cnt] + 1;
2152	++cnt;
2153	}
2154	while (cnt < nsystem_dirs_len);
2155	}
2156
2157	if (cached != NULL)
2158	{
2159	fd = open_verify (name: cached, fd: -1,
2160	fbp: &fb, loader: loader ?: GL(dl_ns)[nsid]._ns_loaded,
2161	whatcode: LA_SER_CONFIG, mode, found_other_class: &found_other_class,
2162	false);
2163	if (__glibc_likely (fd != -1))
2164	realname = cached;
2165	else
2166	free (ptr: cached);
2167	}
2168	}
2169	}
2170	#endif
2171
2172	/* Finally, try the default path. */
2173	if (fd == -1
2174	&& ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL
2175	|| __glibc_likely (!(l->l_flags_1 & DF_1_NODEFLIB)))
2176	&& __rtld_search_dirs.dirs != (void *) -1)
2177	fd = open_path (name, namelen, mode, sps: &__rtld_search_dirs,
2178	realname: &realname, fbp: &fb, loader: l, whatcode: LA_SER_DEFAULT, found_other_class: &found_other_class);
2179
2180	/* Add another newline when we are tracing the library loading. */
2181	if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS))
2182	_dl_debug_printf (fmt: "\n");
2183	}
2184	else
2185	{
2186	/* The path may contain dynamic string tokens. */
2187	realname = (loader
2188	? expand_dynamic_string_token (l: loader, input: name)
2189	: __strdup (name));
2190	if (realname == NULL)
2191	fd = -1;
2192	else
2193	{
2194	fd = open_verify (name: realname, fd: -1, fbp: &fb,
2195	loader: loader ?: GL(dl_ns)[nsid]._ns_loaded, whatcode: 0, mode,
2196	found_other_class: &found_other_class, true);
2197	if (__glibc_unlikely (fd == -1))
2198	free (ptr: realname);
2199	}
2200	}
2201
2202	#ifdef SHARED
2203	no_file:
2204	#endif
2205	/* In case the LOADER information has only been provided to get to
2206	the appropriate RUNPATH/RPATH information we do not need it
2207	anymore. */
2208	if (mode & __RTLD_CALLMAP)
2209	loader = NULL;
2210
2211	if (__glibc_unlikely (fd == -1))
2212	{
2213	if (trace_mode)
2214	{
2215	/* We haven't found an appropriate library. But since we
2216	are only interested in the list of libraries this isn't
2217	so severe. Fake an entry with all the information we
2218	have. */
2219	static const Elf_Symndx dummy_bucket = STN_UNDEF;
2220
2221	/* Allocate a new object map. */
2222	if ((name_copy = __strdup (name)) == NULL
2223	|| (l = _dl_new_object (realname: name_copy, libname: name, type, loader,
2224	mode, nsid)) == NULL)
2225	{
2226	free (ptr: name_copy);
2227	_dl_signal_error (ENOMEM, object: name, NULL,
2228	N_("cannot create shared object descriptor"));
2229	}
2230	/* Signal that this is a faked entry. */
2231	l->l_faked = 1;
2232	/* Since the descriptor is initialized with zero we do not
2233	have do this here.
2234	l->l_reserved = 0; */
2235	l->l_buckets = &dummy_bucket;
2236	l->l_nbuckets = 1;
2237	l->l_relocated = 1;
2238
2239	/* Enter the object in the object list. */
2240	_dl_add_to_namespace_list (new: l, nsid);
2241
2242	return l;
2243	}
2244	else if (found_other_class)
2245	_dl_signal_error (errcode: 0, object: name, NULL,
2246	ELFW(CLASS) == ELFCLASS32
2247	? N_("wrong ELF class: ELFCLASS64")
2248	: N_("wrong ELF class: ELFCLASS32"));
2249	else
2250	_dl_signal_error (errno, object: name, NULL,
2251	N_("cannot open shared object file"));
2252	}
2253
2254	void *stack_end = __libc_stack_end;
2255	return _dl_map_object_from_fd (name, origname, fd, fbp: &fb, realname, loader,
2256	l_type: type, mode, stack_endp: &stack_end, nsid);
2257	}
2258
2259	struct add_path_state
2260	{
2261	bool counting;
2262	unsigned int idx;
2263	Dl_serinfo *si;
2264	char *allocptr;
2265	};
2266
2267	static void
2268	add_path (struct add_path_state *p, const struct r_search_path_struct *sps,
2269	unsigned int flags)
2270	{
2271	if (sps->dirs != (void *) -1)
2272	{
2273	struct r_search_path_elem **dirs = sps->dirs;
2274	do
2275	{
2276	const struct r_search_path_elem *const r = *dirs++;
2277	if (p->counting)
2278	{
2279	p->si->dls_cnt++;
2280	p->si->dls_size += MAX (2, r->dirnamelen);
2281	}
2282	else
2283	{
2284	Dl_serpath *const sp = &p->si->dls_serpath[p->idx++];
2285	sp->dls_name = p->allocptr;
2286	if (r->dirnamelen < 2)
2287	*p->allocptr++ = r->dirnamelen ? '/' : '.';
2288	else
2289	p->allocptr = __mempcpy (p->allocptr,
2290	r->dirname, r->dirnamelen - 1);
2291	*p->allocptr++ = '\0';
2292	sp->dls_flags = flags;
2293	}
2294	}
2295	while (*dirs != NULL);
2296	}
2297	}
2298
2299	void
2300	_dl_rtld_di_serinfo (struct link_map *loader, Dl_serinfo *si, bool counting)
2301	{
2302	if (counting)
2303	{
2304	si->dls_cnt = 0;
2305	si->dls_size = 0;
2306	}
2307
2308	struct add_path_state p =
2309	{
2310	.counting = counting,
2311	.idx = 0,
2312	.si = si,
2313	.allocptr = (char *) &si->dls_serpath[si->dls_cnt]
2314	};
2315
2316	# define add_path(p, sps, flags) add_path(p, sps, 0) /* XXX */
2317
2318	/* When the object has the RUNPATH information we don't use any RPATHs. */
2319	if (loader->l_info[DT_RUNPATH] == NULL)
2320	{
2321	/* First try the DT_RPATH of the dependent object that caused NAME
2322	to be loaded. Then that object's dependent, and on up. */
2323
2324	struct link_map *l = loader;
2325	do
2326	{
2327	if (cache_rpath (l, sp: &l->l_rpath_dirs, DT_RPATH, what: "RPATH"))
2328	add_path (&p, &l->l_rpath_dirs, XXX_RPATH);
2329	l = l->l_loader;
2330	}
2331	while (l != NULL);
2332
2333	/* If dynamically linked, try the DT_RPATH of the executable itself. */
2334	if (loader->l_ns == LM_ID_BASE)
2335	{
2336	l = GL(dl_ns)[LM_ID_BASE]._ns_loaded;
2337	if (l != NULL && l->l_type != lt_loaded && l != loader)
2338	if (cache_rpath (l, sp: &l->l_rpath_dirs, DT_RPATH, what: "RPATH"))
2339	add_path (&p, &l->l_rpath_dirs, XXX_RPATH);
2340	}
2341	}
2342
2343	/* Try the LD_LIBRARY_PATH environment variable. */
2344	add_path (&p, &__rtld_env_path_list, XXX_ENV);
2345
2346	/* Look at the RUNPATH information for this binary. */
2347	if (cache_rpath (l: loader, sp: &loader->l_runpath_dirs, DT_RUNPATH, what: "RUNPATH"))
2348	add_path (&p, &loader->l_runpath_dirs, XXX_RUNPATH);
2349
2350	/* XXX
2351	Here is where ld.so.cache gets checked, but we don't have
2352	a way to indicate that in the results for Dl_serinfo. */
2353
2354	/* Finally, try the default path. */
2355	if (!(loader->l_flags_1 & DF_1_NODEFLIB))
2356	add_path (&p, &__rtld_search_dirs, XXX_default);
2357
2358	if (counting)
2359	/* Count the struct size before the string area, which we didn't
2360	know before we completed dls_cnt. */
2361	si->dls_size += (char *) &si->dls_serpath[si->dls_cnt] - (char *) si;
2362	}
2363