[PATCH] D19995: Optimize access to global variable references in PIE mode when linker supports copy relocations for PIE

[H.J. Lu via llvm-commits]

On Sun, May 8, 2016 at 8:40 AM, Joerg Sonnenberger via llvm-commits
<llvm-commits at lists.llvm.org> wrote:
> On Sun, May 08, 2016 at 08:12:30AM -0700, H.J. Lu wrote:
>> Lazy binding in PLT has indirect branch to the writable GOT slot.
>> Both have security consequences.  Is it desirable to update x86
>> psABI to make copy relocation and PLT optional to tighten security?
>
> Lazy PLT binding can be handled differently by the dynamic linker, there
> are different options like replacing the full slot with a 16byte cmpxchg
> to turn it into a single call instruction. With kernel assistance, that
> can be done without userland-writeable PLT. Copy relocations should
> just be verboten for PIE, all the performance improvements can be
> realised without them.
>

If the GOT slot can be updated after main () is entered, it is a potential
security risk.  Make the whole GOT read-only after relocation will make
programs more secure.  Change PLT layout or require kernel changes
have their own risks.  Some Linux distros have disabled lazy binding.
I didn't notice any significant startup time impact.  In fact, I only
discovered that lazy binding was disabled by accident on my desktop
machine.


-- 
H.J.