Skip to content

Do not use RTLD_DEEPBIND if dlmopen is available #18612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

danog
Copy link
Contributor

@danog danog commented May 21, 2025

This pull request disables usage of RTLD_DEEPBIND if dlmopen is available.

Context:

After careful consideration, I believe this is the best approach, after considering the following alternatives:

  • Making a PR based on Add zend.dlopen_deepbind php.ini directive #11094, disabling deepbind by default via an ini default except when using the embed SAPI, changing the ini value in php_embed_init; this is still SAPI-dependent behavior, which will still cause the same segfaults if jemalloc is used with the embed SAPI.
  • Writing a wrapper for the embed SAPI which dlmopens the real libphp.so within a new namespace (essentially what @dstogov intended with his suggestion, except with RTLD_DEEPBIND the isolation is not propagated, with dlmopen namespaces it is)

I opted for the much cleaner approach of completely disabling RTLD_DEEPBIND if dlmopen with LM_ID_NEWLM is available, leaving to users the resposibility of isolating libphp.so when including it by using dlmopen(LM_ID_NEWLM, "libphp.so", RTLD_LAZY); instead of dlopen("libphp.so", RTLD_LAZY|RTLD_DEEPBIND);.

dlmopen provides full recursive isolation for all symbols both in the opened library, and in libraries opened by that library, avoiding symbol conflict issues even more effectively than RTLD_DEEPBIND, which is not recursive.

Per #10670 (comment), to archieve full real isolation, real-world apache usecases still need to patch apache (libapr) to enable RTLD_DEEPBIND when dlopening libphp.so, as dso_load does not allow passing the RTLD_DEEPBIND flag, so it would not change much for usecases which currently use isolation, just a tweak to the patch that currently adds the RTLD_DEEPBIND flag to libapr to use dlmopen(LM_ID_NEWLM, ...);, instead.

On platforms where GNU extensions aren't available (and dlmopen thus isn't available), RTLD_DEEPBIND is left enabled; if equivalent namespace isolation methods are available on other platforms, they can be added with later pull requests if needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant