Skip to content

Ubuntu 22.04 breaks glibc-provided features #66

Description

@noproto

Ubuntu 22.04 patched ld.so with local-disable-ld_audit.diff, a patch that offers:

  • No security benefits - what it is aiming to prevent is already offered by other components of glibc making it trivial to bypass, and the patch itself relies on invalid assumptions about current glibc security countermeasures in an effort to mitigate a decade-old (patched) security vulnerability
  • Breaks glibc-provided features - patch mentions that it is unlikely to be merged upstream due to breaking changes limiting the auditing features of the linker
  • No configuration options - breaks LD_AUDIT fundamentally including recent (2020) binary flags that would be otherwise unaffected if the patch was better designed

Despite this unfortunate change, there are two paths forward:

  • Offer WhiteBeam repositories that provide a patched libc6 package on Ubuntu 22.04, which is helpful for out of date ARM systems regardless (all Ubuntu versions prior to 22.04 ship with < glibc 2.35 which has audit fixes and v2 of the API)
  • Inform Ubuntu developers that one of the 9 patches of glibc causes breaking changes and to revert it, or to add configuration options to not fundamentally break LD_AUDIT for SUID binaries

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions