Re: caps in elf, next itteration (the hack get's bigger)

Albert D. Cahalan (acahalan@cs.uml.edu)
Fri, 9 Apr 1999 19:23:36 -0400 (EDT)


Ulrich Drepper writes:

> I've not seen this patch but I've seen a bit of the old patches. I've
> a big problem with changing the signalture (the first four bytes).
> This should not be done and definitely is completely unnecessary.

The need: No existing kernel can run the executable.

> What should be done instead is registering an OS ABI and an ABI
> version. The draft for the ELF standard revision defines bytes 7 and
> 8 of the ELF header for this purpose. This information is as easy to
> read the the signature in the first four bytes.

Great, but only if existing kernels check the version.
If not, there would be a huge security hole.

I expect that the header must be mangled, unless you have some other
way to stop old (unpatched) kernels from running the executable.

> So, any solution should there be implemented as follows:
>
> - register ELFOSABI_LINUX
>
> I could probably do this if it's wanted

As you may have guessed (by the tack-it-on-the-end hack), ELF format
knowledge is surprisingly hard to find. Help is welcome. I and several
other people will be abusing the format this weekend.

Q: What is the easiest way to modify an ELF section, adding it if it
does not already exist? Are there naming or ordering rules?

> For more information see the ELF draft or elf.h in glibc 2.1.

I hope that is on the web somewhere.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/