diff options
| author | Florian Weimer <fweimer@redhat.com> | 2020-07-07 09:58:45 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2020-07-07 09:58:45 +0200 |
| commit | 3ad5dab476205d6e16156cf0511fa6884b3b0fc4 (patch) | |
| tree | 475e0e5a8a6bd645d664ee989c86c191d1877042 | |
| parent | 08538f360f14dbe2e3b04a30148e342f248d9de5 (diff) | |
elf: Do not signal LA_ACT_CONSISTENT for an empty namespace [BZ #26076]
The auditing interface identifies namespaces by their first loaded
module. Once the namespace is empty, it is no longer possible to signal
LA_ACT_CONSISTENT for it because the first loaded module is already gone
at that point.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
| -rw-r--r-- | elf/dl-close.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/elf/dl-close.c b/elf/dl-close.c index 73b2817bbf..8e146ecee1 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -781,8 +781,14 @@ _dl_close_worker (struct link_map *map, bool force) if (__glibc_unlikely (do_audit)) { struct link_map *head = ns->_ns_loaded; - /* Do not call the functions for any auditing object. */ - if (head->l_auditing == 0) + /* If head is NULL, the namespace has become empty, and the + audit interface does not give us a way to signal + LA_ACT_CONSISTENT for it because the first loaded module is + used to identify the namespace. + + Furthermore, do not notify auditors of the cleanup of a + failed audit module loading attempt. */ + if (head != NULL && head->l_auditing == 0) { struct audit_ifaces *afct = GLRO(dl_audit); for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |