sea: keep ELF segments on separate pages in --build-sea output

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
  {},
  SPrintF("Failed to create new ELF note %s", note_name)};
  }
+ // Left to itself LIEF moves a non-PIE executable's program headers into
+ // the largest gap between two PT_LOADs and extends the earlier one over it,
+ // which can leave that segment sharing a page with the next; kernels that
+ // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+ // to run the file. After .bss every segment keeps its own pages.
+ if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+ binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+ 0) {
+ return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+ }
  binary->add(*new_note);
 
  LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+ common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2); // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+ const at = phoff + i * phentsize;
+ if (elf.readUInt32LE(at) !== 1) continue; // PT_LOAD
+ const vaddr = elf.readBigUInt64LE(at + 0x10);
+ const memsz = elf.readBigUInt64LE(at + 0x28);
+ if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+ assert(loads[i].first > loads[i - 1].last,
+ `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+ `which PT_LOAD ${i - 1} already covers`);
+}