Created attachment 999663 [details]
reproducer.tar.gz

Description of problem:

Binaries generated by ld sometimes lack relro protection, although it has explicitly been requested on the command line.

This has potential security implications, please treat this as embargoed for now.  We will decide how to disclose this once we better understand this issue.

Version-Release number of selected component (if applicable):

binutils-2.23.52.0.1-16.el7.x86_64

How reproducible:

Always (with the reproducer).

Steps to Reproduce:

tar xf reproducer.tar.gz 
cd reproducer
cmd="/usr/bin/ld --eh-frame-hdr --build-id -m elf_x86_64 -shared -o output.so -L. crti.o crtbeginS.o  winbind_krb5_locator_17.o -z relro -z now -no-undefined --export-dynamic -lpthread --as-needed -rpath XXX -Bdynamic -lwbclient  -lc  crtendS.o crtn.o"
$(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO
$cmd; eu-readelf -a output.so | grep RELRO


Actual results:

[fweimer@oldenburg reproducer]$ $(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO
  GNU_RELRO      0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R   0x1
   01      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss
   02      [RELRO: .dynamic]
   06      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got]
[fweimer@oldenburg reproducer]$ $cmd; eu-readelf -a output.so | grep RELRO
[fweimer@oldenburg reproducer]$ 

(relro only in the first case.)

Expected results:

[fweimer@oldenburg reproducer]$ $(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO
  GNU_RELRO      0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R   0x1
   01      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss
   02      [RELRO: .dynamic]
   06      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got]
[fweimer@oldenburg reproducer]$ $cmd; eu-readelf -a output.so | grep RELRO
  GNU_RELRO      0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R   0x1
   01      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss
   02      [RELRO: .dynamic]
   06      [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got]
[fweimer@oldenburg reproducer]$ 

(relro in both cases.)

Additional info:

The reproducer is constructed in such a way that it should not depend on installed system libraries; in this case, they come from RHEL 6.6.  With different libc versions, this reproducer does not show the bug, although we have seen similar issues with the RHEL 7 libc.