> backed by its own ELF loader (x86-64 and aarch64) and a glibc ABI bridge

Yacks

mananaysiempre 2 hours ago | parent | next [-]

If you want to load the OpenGL/Vulkan vendor driver then unfortunately you don’t have much of a choice: those are linked against glibc, and I believe generally also against libwayland so screw off if you want a different protocol library (I might be wrong about the latter part). If you instead want to load plugins or whatnot into your statically linked executable, then personally I’d argue that you shouldn’t be emulating Linux dynamic linking semantics at all, because the whole late-bound global namespace thing is silly and wrong. (Solaris, which is where Glibc took this model from, moved away from it[1] as much as compatibility allowed, and so did Darwin[2], whereas Windows never made the mistake to begin with, but Glibc persisted and Musl copied it.)

[1] https://www.linker-aliens.org/blogs/rie/entry/direct_binding...

[2] https://web.archive.org/web/20011004090044/http://developer....

▲

fabiensanglard 2 hours ago | parent | prev | next [-]

Please elaborate and explain to people with less knowledge why this is bad.

▲

arjvik 2 hours ago | parent [-]

Mapping parts of files into executable memory, and then executing them, had better be bulletproof! Exploiting this seems like a direct path to RCE, and it's likely that this sort of library is used by privileged code.

Purely academically, this is a very cool piece of code! Just hoping that it gets a thorough vetting before used by privileged/security-critical software :)

	▲	pg83 24 minutes ago \| parent [-]
		Well, ld.so already does this, and it's no big deal. The Python interpreter also does this when executing a .py script (code is code, whether it's machine-readable or human-readable). In any case, we take testing very seriously—every glibc shim we've written is covered with tests, and we run our loader against 1000 of the most popular Debian packages. The project has 100% code coverage. Perhaps, if I have the time, I'll also do some fuzzing on this thing.

▲

lunixbochs 2 hours ago | parent | prev [-]

similar energy to my https://github.com/lunixbochs/crossldso

	▲	pg83 2 hours ago \| parent [-]
		Oh, cool, another prior art I didn't know :)