Make functions in the Linux vdso file interposable #1091
Description
Some functions that are called frequently are placed in Linux's vdso file for efficiency reasons. This vdso file gets statically embedded at the top of program binary's at compile time, making it possibly difficult to interpose.
On my machine, I was able to inspect the vdso like:
$ readelf -s /lib/modules/5.10.8-100.fc32.x86_64/vdso/vdso64.so
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000990 432 FUNC WEAK DEFAULT 11 clock_gettime@@LINUX_2.6
2: 0000000000000820 316 FUNC GLOBAL DEFAULT 11 __vdso_gettimeofday@@LINUX_2.6
3: 0000000000000b40 96 FUNC WEAK DEFAULT 11 clock_getres@@LINUX_2.6
4: 0000000000000b40 96 FUNC GLOBAL DEFAULT 11 __vdso_clock_getres@@LINUX_2.6
5: 0000000000000820 316 FUNC WEAK DEFAULT 11 gettimeofday@@LINUX_2.6
6: 0000000000000960 41 FUNC GLOBAL DEFAULT 11 __vdso_time@@LINUX_2.6
7: 0000000000000960 41 FUNC WEAK DEFAULT 11 time@@LINUX_2.6
8: 0000000000000990 432 FUNC GLOBAL DEFAULT 11 __vdso_clock_gettime@@LINUX_2.6
9: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6
10: 0000000000000ba0 37 FUNC GLOBAL DEFAULT 11 __vdso_getcpu@@LINUX_2.6
11: 0000000000000ba0 37 FUNC WEAK DEFAULT 11 getcpu@@LINUX_2.6
which shows several time related functions as well as getcpu.
We could overwrite this code dynamically to make sure the syscall version gets called when running in shadow. Here is some code we could use to do it: