debug: Improve '%n' fortify detection (BZ 30932)

The 7bb8045ec0 path made the '%n' fortify check ignore EMFILE errors
while trying to open /proc/self/maps, and this added a security
issue where EMFILE can be attacker-controlled thus making it
ineffective for some cases.

The EMFILE failure is reinstated but with a different error
message.  Also, to improve the false positive of the hardening for
the cases where no new files can be opened, the
_dl_readonly_area now uses  _dl_find_object to check if the
memory area is within a writable ELF segment.  The procfs method is
still used as fallback.

Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: Arjun Shankar <arjun@redhat.com>

1 files changed, 8 insertions, 13 deletions

diff --git a/sysdeps/unix/sysv/linux/readonly-area.c b/sysdeps/unix/sysv/linux/readonly-area-fallback.c
index 62d2070..c93ad2a 100644
--- a/sysdeps/unix/sysv/linux/readonly-area.c
+++ b/sysdeps/unix/sysv/linux/readonly-area-fallback.c
@@ -23,11 +23,8 @@
 #include <string.h>
 #include "libio/libioP.h"
 
-/* Return 1 if the whole area PTR .. PTR+SIZE is not writable.
-   Return -1 if it is writable.  */
-
-int
-__readonly_area (const char *ptr, size_t size)
+enum readonly_error_type
+__readonly_area_fallback (const void *ptr, size_t size)
 {
   const void *ptr_end = ptr + size;
 
@@ -42,11 +39,11 @@ __readonly_area (const char *ptr, size_t size)
 	     to the /proc filesystem if it is set[ug]id.  There has
 	     been no willingness to change this in the kernel so
 	     far.  */
-	  || errno == EACCES
-	  /* Process has reached the maximum number of open files.  */
-	  || errno == EMFILE)
-	return 1;
-      return -1;
+	  || errno == EACCES)
+	return readonly_procfs_inaccessible;
+      /* Process has reached the maximum number of open files or another
+	 unusual error.  */
+      return readonly_procfs_open_fail;
     }
 
   /* We need no locking.  */
@@ -98,7 +95,5 @@ __readonly_area (const char *ptr, size_t size)
   fclose (fp);
   free (line);
 
-  /* If the whole area between ptr and ptr_end is covered by read-only
-     VMAs, return 1.  Otherwise return -1.  */
-  return size == 0 ? 1 : -1;
+  return size == 0 ? readonly_noerror : readonly_area_writable;
 }