Public bug reported:

Hello,

I noticed that ldd gives wrong results when run
a) with the LD_LIBRARY_PATH environment variable set to some folder and
b) on a binary that will be launched in "secure execution mode" by ld.so (see 
"man ld.so").

Steps to reproduce:
1. Create a file hello_world.c:
#include <stdio.h>
int main() {
        puts("Hello, World!");
        puts("Press enter to quit");
        scanf("%*c");
}
2. Compile:
$ gcc -o hello_world hello_world.c
3. Attach a capability to the compiled binary, in order to trigger secure 
execution mode:
$ sudo setcap CAP_NET_BIND_SERVICE=ep hello_world
4. Make the system's libc available somewhere else:
$ cp /lib/x86_64-linux-gnu/libc.so.6 .

In this setup, when you run LD_LIBRARY_PATH=. ldd hello_world, then ldd will 
report that the binary will use the libc in the local folder.
Actual output:
$ LD_LIBRARY_PATH=. ldd hello_world
        linux-vdso.so.1 =>  (0x00007ffdbb76a000)
        libc.so.6 => ./libc.so.6 (0x00007f68a182a000)
        /lib64/ld-linux-x86-64.so.2 (0x00005651d2ef7000)

However, when you actually run the binary with
$ LD_LIBRARY_PATH=. ./hello_world
then the binary will use the standard library search path and _not_ use 
./libc.so.6 .
You can see this by starting the binary in one terminal, and running the 
following command in another terminal while the binary is still running:
$ sudo cat /proc/$(pidof hello_world)/maps

This gives me an output like:
[...]
7f76193d5000-7f7619595000 r-xp 00000000 fc:00 2494866                    
/lib/x86_64-linux-gnu/libc-2.23.so
7f7619595000-7f7619795000 ---p 001c0000 fc:00 2494866                    
/lib/x86_64-linux-gnu/libc-2.23.so
7f7619795000-7f7619799000 r--p 001c0000 fc:00 2494866                    
/lib/x86_64-linux-gnu/libc-2.23.so
7f7619799000-7f761979b000 rw-p 001c4000 fc:00 2494866                    
/lib/x86_64-linux-gnu/libc-2.23.so
[...]

I believe that this is due to the secure execution mode mentioned in the
ld.so man page, so this probably also affects set-uid binaries and
possibly some other environment variables that control the linker
behaviour.

I'm using Ubuntu 16.04.2 (LTS). ldd is on version "ldd (Ubuntu GLIBC
2.23-0ubuntu9) 2.23". The libc-bin package (containing ldd) has version
"2.23-0ubuntu9".

Best regards!

** Affects: ubuntu
     Importance: Undecided
         Status: New


** Tags: bot-comment

** Attachment added: "the hello_world.c file and a Makefile"
   https://bugs.launchpad.net/bugs/1700272/+attachment/4902313/+files/demo.zip

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1700272

Title:
  ldd secure execution mode

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/1700272/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to