onelf 0.2.8

Packer CLI for creating onelf single-binary packages
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

/// Pre-compiled bootstrap payloads for the relative-interpreter technique.

pub const BOOTSTRAP_X86_64: &[u8] = include_bytes!("payload/bootstrap_x86_64.bin");
pub const BOOTSTRAP_AARCH64: &[u8] = include_bytes!("payload/bootstrap_aarch64.bin");

/// Freestanding onelf-env constructor shared objects, one per arch.
///
/// Bundled into a package's lib/ and injected as a DT_NEEDED of the
/// entrypoint so `.onelf/env` / `.onelf/preload` are re-applied on every
/// exec (survives a sandboxed `clearenv()` + re-exec). Built from
/// `payload/onelf_env.c` by `payload/Makefile`.
///
/// These are prebuilt blobs checked into the repo (like the bootstrap
/// blobs). A blob that hasn't been built for an arch is an empty
/// placeholder; [`onelf_env_blob`] returns `None` for it and the
/// bundler falls back to runtime-only env for that target.
pub const ONELF_ENV_X86_64: &[u8] = include_bytes!("payload/onelf_env_x86_64.so");
pub const ONELF_ENV_AARCH64: &[u8] = include_bytes!("payload/onelf_env_aarch64.so");

/// Soname / bundled filename of the onelf-env constructor library.
pub const ONELF_ENV_SONAME: &str = "libonelf-env.so";

/// Return the onelf-env blob for `e_machine` (ELF `EM_*`), or `None` if
/// the architecture is unsupported or its blob wasn't built. The blob is
/// validated as an ELF object of the requested machine so an empty or
/// stale placeholder never gets injected.
pub fn onelf_env_blob(e_machine: u16) -> Option<&'static [u8]> {
    const EM_X86_64: u16 = 62;
    const EM_AARCH64: u16 = 183;
    let blob = match e_machine {
        EM_X86_64 => ONELF_ENV_X86_64,
        EM_AARCH64 => ONELF_ENV_AARCH64,
        _ => return None,
    };
    // ELF magic + 64-bit + machine field (e_machine at offset 18).
    if blob.len() < 20 || &blob[0..4] != b"\x7fELF" {
        return None;
    }
    let m = u16::from_le_bytes([blob[18], blob[19]]);
    if m != e_machine {
        return None;
    }
    Some(blob)
}

// x86_64: `lea XX(%rip), %rsi` at offset 0x0a, displacement at 0x0d, RIP at 0x11.
pub const X86_64_METADATA_LEA_DISP_OFFSET: usize = 0x0d;
pub const X86_64_METADATA_LEA_RIP: usize = 0x11;

// aarch64: `adr x1, _onelf_metadata` at offset 0x10.
// Encodes a 21-bit signed PC-relative offset in the instruction word.
pub const AARCH64_METADATA_ADR_OFFSET: usize = 0x10;

/// Patch the aarch64 `adr` instruction's immediate to point at
/// `target_offset` relative to the instruction at `AARCH64_METADATA_ADR_OFFSET`.
pub fn patch_aarch64_adr(blob: &mut [u8], target_offset: usize) {
    let pc = AARCH64_METADATA_ADR_OFFSET;
    let offset = (target_offset as i64) - (pc as i64);
    assert!(
        (-1048576..=1048575).contains(&offset),
        "adr offset out of range"
    );
    let off = offset as u32;
    let immlo = off & 0x3;
    let immhi = (off >> 2) & 0x7ffff;
    // Read existing instruction, preserve rd and opcode, patch imm fields.
    let mut insn = u32::from_le_bytes(blob[pc..pc + 4].try_into().unwrap());
    insn = (insn & 0x9f00001f) | (immlo << 29) | (immhi << 5);
    blob[pc..pc + 4].copy_from_slice(&insn.to_le_bytes());
}

#[cfg(test)]
mod tests {
    use super::*;

    const EM_X86_64: u16 = 62;
    const EM_AARCH64: u16 = 183;

    #[test]
    fn blobs_are_valid_elf_for_their_machine() {
        for em in [EM_X86_64, EM_AARCH64] {
            let blob = onelf_env_blob(em)
                .unwrap_or_else(|| panic!("onelf-env blob for EM {em} must be built/committed"));
            assert_eq!(&blob[0..4], b"\x7fELF");
            assert_eq!(u16::from_le_bytes([blob[18], blob[19]]), em);
        }
    }

    #[test]
    fn unknown_arch_returns_none() {
        // Unbuilt arches ship as an empty placeholder (-> None); an
        // unsupported machine is also None. Neither is ever injected.
        assert!(onelf_env_blob(0xffff).is_none());
    }

    #[test]
    fn machine_mismatch_is_rejected() {
        // Asking for aarch64 must never hand back the x86_64 blob.
        if let Some(b) = onelf_env_blob(EM_AARCH64) {
            assert_eq!(u16::from_le_bytes([b[18], b[19]]), EM_AARCH64);
        }
    }
}