Bug 62083 - RTLD_GLOBAL should not be used for loading modules
Summary: RTLD_GLOBAL should not be used for loading modules
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_so (show other bugs)
Version: 2.4.10
Hardware: PC Linux
: P2 major (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-02-07 06:48 UTC by Alejandro Perez
Modified: 2018-02-07 09:36 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alejandro Perez 2018-02-07 06:48:23 UTC
Apache HTTPD uses "apr_dso_load" to load modules, which in turn only allows the use of RTLD_GLOBAL.

This generates a number of problems in my set up, and potentially in many others. In particular, if two modules define symbols with similar names, one of them gets overwritten, resulting into SIGSEGV.

In my setup, I have a module that makes use of libjansson.so for JSON processing. However, the PHP5 module make use of json-c.so. The problem is that both export some symbols with identical names. When my module is going to process JSON, it ends up calling json-c.so functions rather than jansson ones, crashing unavoidably.

I've tried re-building "apr_dso_load" using RTLD_LOCAL and the problem seems fixed.

I acknowledge that the fact of only being able to use RTLD_GLOBAL in libapr is already marked as a bug, and belongs there, but using libapr is http-2  Even more, when (if) libapr allows other ldopen flags, http-2 should provide the means for selecting one or the other.

Thanks
Comment 1 Joe Orton 2018-02-07 08:52:45 UTC
Though we've tried to remove inter-module symbol dependencies there are still cases where modules depend on symbols of another (mod_proxy_* in particular) so even if APR allowed use of RTLD_LOCAL, httpd couldn't enable it everywhere.

Which version of PHP are you using?  I thought it used RTLD_DEEPBIND by default now which fixed these issues - alternatively you could patch apr_dso_open to do the same.
Comment 2 Alejandro Perez 2018-02-07 09:36:08 UTC
(In reply to Joe Orton from comment #1)
> Though we've tried to remove inter-module symbol dependencies there are
> still cases where modules depend on symbols of another (mod_proxy_* in
> particular) so even if APR allowed use of RTLD_LOCAL, httpd couldn't enable
> it everywhere.

I see. I didn't think of it, but you are right.

> 
> Which version of PHP are you using?  

PHP5

>I thought it used RTLD_DEEPBIND by
> default now which fixed these issues 

Umm, at least apr 1.6.3 does not seem to use DEEPBIND, that might fix the issue, yes. A simple "grep DEEP * -R" gives nothing.

>alternatively you could patch
> apr_dso_open to do the same.

That's what I did, but instead replacing RTLD_GLOBAL with RTLD_LOCAL, and it seemed to work. It seems to work as well with RTLD_DEEPBIND.

Thanks