5 ms·

Great article. Although I’ve been a Linux user since the time when stack of Slackware floppies was the prevailing installation media, I just recently learned th

Great article. Although I’ve been a Linux user since the time when stack of Slackware floppies was the prevailing installation media, I just recently learned that libc.so is also an executable.

jagged-chisel 2y ago
In what sense do you mean “executable?” Does it include a main() and can you launch it? Or do you mean because its code is invoked before your own executable’s code?
- olalonde 2y ago
  It's in the article, it includes a main(): icterid$ /usr/lib/x86_64-linux-gnu/libc.so.6 GNU C Library (Debian GLIBC 2.36-9+deb12u7) stable release version 2.36. Copyright (C) 2022 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled by GNU CC version 12.2.0. libc ABIs: UNIQUE IFUNC ABSOLUTE Minimum supported kernel: 3.2.0 For bug reporting instructions, please see: <http://www.debian.org/Bugs/>.
  - deleted 2y ago
    [deleted]
  - rzzzt 2y ago
    Both the Makefile as well as the source file were linked from the article, ld's "-e" flag is used to set a custom entry point to "__libc_main".
kstrauser 2y ago
Fun trivia: so is /lib/ld-*.so*. I busted that out in an interview at a FAANG when the question was "how could you recover from accidentally running 'chmod a-x /bin/*'"? My answer: '/lib/ld.so /bin/chmod a+x /bin/*'. The interviewer paused to get out his laptop and confirm it because he had never heard of it. After a fun detour of geeking out over something new an interesting, the followup question was modified to "How else would you do it?" It's spelled "/lib/ld-linux-aarch64.so.1" on my nearest Linux box but is still executable today.
- mandarax8 2y ago
  What was the solution he was looking for?
  - Filligree 2y ago
    There’s a couple. One would be to run a Python interpreter and fix it with that.
    - zbentley 2y ago
      How would you launch the python interpreter if its binary is missing execute permissions?
      - kstrauser 2y ago
        It’s traditionally been in /usr/bin.
        t-3 2y ago
        On quite a few systems I've seen /usr/bin is a symlink to /bin or /bin is a symlink to /usr/bin (and /sbin is a symlink to /bin).
        kstrauser 2y ago
        That’s a relatively new phenomenon, and not uncontroversial.
  - t-3 2y ago
    In the unlikely case that you actually have a static sbin and not just a symlink you could hack together a one-liner using file or objdump to check headers and set correct perms... but considering that everything in the dir should be either an executable or a directory, chmod a+x would work just as well. If /usr/bin isn't a symlink to /bin or vice-versa, then you should have tools there to do the same thing. If you somehow still have a working C compiler (or access to another language that can do syscalls or has C bindings), it's pretty easy to write a wrapper for the syscall. If there's an rsync daemon, nfs share, etc. running, you can copy over a static busybox and fix the system that way. If you're allowed to take the system down, it's really easy - just boot up a live image and change the permissions.
cxr 2y ago
It's possible to achieve a similar effect in the browser. The <script> element doesn't have any Content-Type restrictions; it won't reject something outright solely on the basis you serve it something other than application/javascript. So if you managed to point it at an HTML file that's also valid JS (and you can manage to do that, since the set of all possible HTML inputs and the set of all possible JS programs isn't disjoint)... You can use components and libraries in your app that are pages/programs unto themselves, and in particular ones that are self-describing. Imagine having in front of you a webpage that doesn't work the way you want. You use View Source in your browser, find the URL of some component written in JS that probably contains the offending logic, navigate to that URL, and the source code for that library unfolds on your screen and is free to do whatever it wants to best present itself to you for your understanding. This could include doing syntax highlighting for you (rather than the default black-on-white text that most browsers use when showing you a JS file), putting helper widgets on the screen (e.g. object/configuration inspectors), other on-screen editor components e.g. for any DSLs used in the file, base64-encoded data, etc. Or imagine a file that knows that it was compiled from TypeScript and knows where the TypeScript source that it was compiled from lives. When you open the URL for the compiled form in your browser, when it loads it dynamically fetches the original .ts sources from elsewhere on the server and then puts that on the screen—maybe even going so far as to put it inside an editor that forms a TypeScript playground.

Great article. Although I’ve been a Linux user since the time when stack of Slackware floppies was the prevailing installation media, I just recently learned that libc.so is also an executable.

jagged-chisel 2y ago

In what sense do you mean “executable?” Does it include a main() and can you launch it? Or do you mean because its code is invoked before your own executable’s code?

olalonde 2y ago
It's in the article, it includes a main(): icterid$ /usr/lib/x86_64-linux-gnu/libc.so.6 GNU C Library (Debian GLIBC 2.36-9+deb12u7) stable release version 2.36. Copyright (C) 2022 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled by GNU CC version 12.2.0. libc ABIs: UNIQUE IFUNC ABSOLUTE Minimum supported kernel: 3.2.0 For bug reporting instructions, please see: <http://www.debian.org/Bugs/>.
- deleted 2y ago
  [deleted]
- rzzzt 2y ago
  Both the Makefile as well as the source file were linked from the article, ld's "-e" flag is used to set a custom entry point to "__libc_main".

kstrauser 2y ago

Fun trivia: so is /lib/ld-*.so*. I busted that out in an interview at a FAANG when the question was "how could you recover from accidentally running 'chmod a-x /bin/*'"? My answer: '/lib/ld.so /bin/chmod a+x /bin/*'. The interviewer paused to get out his laptop and confirm it because he had never heard of it. After a fun detour of geeking out over something new an interesting, the followup question was modified to "How else would you do it?" It's spelled "/lib/ld-linux-aarch64.so.1" on my nearest Linux box but is still executable today.

mandarax8 2y ago
What was the solution he was looking for?
- Filligree 2y ago
  There’s a couple. One would be to run a Python interpreter and fix it with that.
  - zbentley 2y ago
    How would you launch the python interpreter if its binary is missing execute permissions?
    - kstrauser 2y ago
      It’s traditionally been in /usr/bin.
      - t-3 2y ago
        On quite a few systems I've seen /usr/bin is a symlink to /bin or /bin is a symlink to /usr/bin (and /sbin is a symlink to /bin).
        kstrauser 2y ago
        That’s a relatively new phenomenon, and not uncontroversial.
- t-3 2y ago
  In the unlikely case that you actually have a static sbin and not just a symlink you could hack together a one-liner using file or objdump to check headers and set correct perms... but considering that everything in the dir should be either an executable or a directory, chmod a+x would work just as well. If /usr/bin isn't a symlink to /bin or vice-versa, then you should have tools there to do the same thing. If you somehow still have a working C compiler (or access to another language that can do syscalls or has C bindings), it's pretty easy to write a wrapper for the syscall. If there's an rsync daemon, nfs share, etc. running, you can copy over a static busybox and fix the system that way. If you're allowed to take the system down, it's really easy - just boot up a live image and change the permissions.

cxr 2y ago

It's possible to achieve a similar effect in the browser. The <script> element doesn't have any Content-Type restrictions; it won't reject something outright solely on the basis you serve it something other than application/javascript. So if you managed to point it at an HTML file that's also valid JS (and you can manage to do that, since the set of all possible HTML inputs and the set of all possible JS programs isn't disjoint)... You can use components and libraries in your app that are pages/programs unto themselves, and in particular ones that are self-describing. Imagine having in front of you a webpage that doesn't work the way you want. You use View Source in your browser, find the URL of some component written in JS that probably contains the offending logic, navigate to that URL, and the source code for that library unfolds on your screen and is free to do whatever it wants to best present itself to you for your understanding. This could include doing syntax highlighting for you (rather than the default black-on-white text that most browsers use when showing you a JS file), putting helper widgets on the screen (e.g. object/configuration inspectors), other on-screen editor components e.g. for any DSLs used in the file, base64-encoded data, etc. Or imagine a file that knows that it was compiled from TypeScript and knows where the TypeScript source that it was compiled from lives. When you open the URL for the compiled form in your browser, when it loads it dynamically fetches the original .ts sources from elsewhere on the server and then puts that on the screen—maybe even going so far as to put it inside an editor that forms a TypeScript playground.