search

GrapheneOS / hardened_malloc

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability / integration over time.
https://grapheneos.org/
MIT License
1.26k stars 96 forks source link

ping throws a weird error when used with light config #196

Closed ghost closed 2 years ago

ghost commented 2 years ago 
# LD_PRELOAD=libhardened_malloc-light.so /bin/ping
ERROR: ld.so: object 'libhardened_malloc-light.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
/bin/ping: usage error: Destination address required

Using normal config doesn't have this issue.

# LD_PRELOAD=libhardened_malloc.so /bin/ping
/bin/ping: usage error: Destination address required

Reported by @Wonderfall

thestinger commented 2 years ago

You should pass the full path for LD_PRELOAD.

ghost commented 2 years ago

I believe they said the issue happens even if the full path is in their ld.so.preload file.

Wonderfall commented 2 years ago

Yeah, happens with the full path for me.

cat /etc/ld.so.preload :

/usr/local/lib/libhardened_malloc-light.so

I can see it being preloaded with ldd /usr/bin/ping, and I couldn't find any other binary with that behavior at the moment. I'm trying other things to see if I can narrow down the issue.

thestinger commented 2 years ago

It's probably because it's a setuid or setcap binary instead of the more modern approach not requiring it.

thestinger commented 2 years ago

It says Ignored, which is likely intentional.

Wonderfall commented 2 years ago

It's a fresh Arch install and doesn't seem to be setuid/setgid: 

-rwxr-xr-x 1 root root    76568 Dec 22 11:10  ping

And getcap /usr/bin/ping returns nothing. Unless that's the wrong command...

Wonderfall commented 2 years ago

I suspect it's the default AppArmor profile for ping. I'm going to study the profile in question to confirm.

thestinger commented 2 years ago

Check if it's setcap (CAP_NET_RAW). There's another way to do it but setcap would break this too.

Wonderfall commented 2 years ago

I can confirm it was the default AppArmor profile. Sorry for causing trouble. Most likely because the default profile includes the base restrictions which expect /etc to be read-only.