Re: [Bug] modules zsh/tcp, zsh/zftp unloadable, probably affecting most modern Linuxes

[Jun T <takimoto-j@xxxxxxxxxxxxxxxxx>]

> 2023/06/06 5:07, Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx> wrote:
> 
> As I understand it that symbol will only be defined by tcp.c if it's
> not available from libc or other linked library, so it's not actually
> overwriting an identically-named symbol.

Yes, I agree, and I think the problem is not in 'freehostent'.
I guess the error 'undefined symbol: freehostent' just indicates
that 'freehostent' was the _first_ symbol the loader couldn't resolve
(and the loader gave up, not trying to resolve other symbols such
as zsh_getipnodebyname etc.).

But, first of all, why these symbols need be resolved when loading
zftp.so, because dlopen() is called as:
  dlopen("zftp.so", RTLD_LAZY | RTLD_GLOBAL)  (module.c:1596)
i.e., with the flag RTLD_LAZY?

If I build zsh by myself on Debian/Ubuntu/Fedora/CentOS
then 'zmodload zsh/zftp' works fine.

I don't know how the packages (deb/rpm) are built, but I found
a build log of zsh5.9 for Fedora38:
https://kojipkgs.fedoraproject.org//packages/zsh/5.9/5.fc38/data/logs/x86_64/build.log

The part of the log for creating zftp.so is:

gcc -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now \
 (snip)
  -z lazy -shared -o zftp.so   zftp..o \
  -lpcre -ldl -lncursesw -lrt -lm  -lc 

I think the problem is '-Wl,-z,now'. man ld(1) says:

   now When generating an executable or shared library, mark it to
       tell the dynamic linker to resolve all symbols when the program
       is started, or when the shared library is loaded by dlopen,
       instead of deferring function call resolution to the point when
       the function is first called.

It seems this option has the higher precedence than the option
'-z lazy' in the same command line, or the RTLD_LAZY for dlopen().

On Fedora-38:
% readelf --dynamic /usr/lib64/zsh/5.9/zsh/zftp.so | grep FLAG
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW

I think this flag in zftp.so is the result of '-z now'

On Debian-11, /usr/lib/x86_64-linux-gnu/zsh/5.8/zsh/zftp.so has the
same flag. I guess Debian binary package is also built with '-z now'.

The zftp.so built by myself does not have this flag.

Why '-z now' is used when building binary packages? For security?