RFR: 8268129: LibraryLookup::ofDefault leaks symbols from loaded libraries

[Maurizio Cimadamore]

On Wed, 2 Jun 2021 17:19:06 GMT, Maurizio Cimadamore <mcimadamore at openjdk.org> wrote:

> This patch overhauls the library loading mechanism used by the Foreign Linker API. We realized that, while handy, the *default* lookup abstraction (`LibraryLookup::ofDefault`) was behaving inconsistentlt across platforms.
> 
> This patch replaces `LibraryLookup` with a simpler `SymbolLookup` abstraction, a functional interface. Crucially, `SymbolLookup` does not concern with library loading, only symbol lookup. For this reason, two factories are added:
> 
> * `SymbolLookup::loaderLookup` - which obtains a lookup that can be used to lookup symbols in libraries loaded by current loader
> * `CLinker::systemLookup` - a more stable replacement for the *default* lookup, which looks for symbols in libc.so (or its equivalent in other platforms). The contents of this lookup are unspecified.
> 
> Both factories are *restricted*, so they can only be called when `--enable-native-access` is set.

> _Mailing list message from [Chapman Flack](mailto:chap at anastigmatix.net) on [security-dev](mailto:security-dev at mail.openjdk.java.net):_
> 
> On 06/02/21 13:30, Maurizio Cimadamore wrote:
> 
> > This patch replaces `LibraryLookup` with a simpler `SymbolLookup`
> > abstraction, a functional interface. Crucially, `SymbolLookup` does not
> > concern with library loading, only symbol lookup. For this reason, two
> > factories are added:
> 
> Hi,
> 
> While I am thinking about this, what will be the behavior when the JVM
> itself has been dynamically loaded into an embedding application, and
> launched with the JNI invocation API?
> 
> Will there be a *Lookup flavor that is able to find any exported symbol
> known in the embedding environment the JVM was loaded into? (This is the
> sort of condition the Mac OS linker checks when given the -bundle_loader
> option.)
> 
> Regards,
> Chapman Flack (maintainer of a project that happens to work that way)

Hi,
at the moment we don't have plans to add such a lookup, but I believe it should be possible to build such a lookup using `dlopen` and the linker API. I have provided an example elsewhere of how easy it easy to build a wrapper lookup around dlopen/dlsym:

https://gist.github.com/mcimadamore/0883ea6f4836ae0c1d2a31c48197da1a

Perhaps something like that could be useful in the use case you mention?

-------------

PR: https://git.openjdk.java.net/jdk/pull/4316