使用ELF Statifier 在不同的linux系统间使用可执行文件

这篇文章是我在linux.com上看到的一篇文章，感觉满有用的(有时间大致翻译下)

作者在最下面有介绍。

ELF Statifier主要是将一些依赖动态库的二进制可执行文件转换成静态可执行文件来实现不同平台之间的快速“移植”的，而且还大致介绍了移动后可能会遇到的问题，不多说了看文章先：

Shared librariesthat are dynamically linked make more efficient use of disk space thanthose that are statically linked, and more importantly allow you toperform security updates in a more efficient manner, but executablescompiled against a particular version of a dynamic library expect thatversion of the shared library to be available on the machine they runon. If you are running machines with both Fedora 9 and openSUSE 11, theversions of some shared libraries are likely to be slightly different,and if you copy an executable between the machines, the file might failto execute because of these version differences. With ELF Statifieryou can create a statically linked version of an executable, so theexecutable includes the shared libraries instead of seeking them at runtime. A staticly linked executable is much more likely to run on adifferent Linux distribution or a different version of the samedistribution.

Ofcourse, to do this you sacrifice some disk space, because thestatically linked executable includes a copy of the shared librariesthat it needs, but in these days of terabyte disks the spaceconsideration is less important than the security one. Consider whathappens if your executables are dynamically linked to a shared library,say libfoo, and there is a security update to libfoo. When yourapplications are dynamically linked you can just update the shared copyof libfoo and your applications will no longer be vulnerable to thesecurity issue in the older libfoo. If on the other hand you have astatically linked executable, it will still include and use its ownprivate copy of the old libfoo. You'll have to recreate the staticallylinked executable to get the newer libfoo and security update.

Still, there are times when you want to take a daemon you compiledon a Fedora machine and run it on your openSUSE machine without havingto recompile it and all its dependencies. Sometimes you just want it toexecute now and can rebuild it later if desired. Of course,the machine you copy the executable from and the one on which you wantto run it must have the same architecture.

ELF Statifier is packaged as a 1-Clickinstall for openSUSE 10.3 but not for Ubuntu Hardy or Fedora. I'll useversion 1.6.14 of ELF Statifier and build it from source on a Fedora 9x86 machine. ELF Statifier does not use autotools, so you compile bysimply invoking make. Compilation and installation is shown below.

$ tar xzvf statifier-1.6.14.tar.gz 
$ cd ./statifier-*
$ make
$ sudo make install

As an example of how to use the utility, I'll create a statically linked version of the lsbinary in the commands shown below. First I create a personal copy ofthe dynamically linked executable and inspect it to see what itdynamically links to. You run statifier with the path to thedynamically linked executable as the first argument and the path whereyou want to create the statically linked executable as the secondargument. Notice that the ldd command reports that nodynamically linked libraries are required by ls-static. The nextcommand shows that the binary size has grown significantly for thestatic version of ls.

$ mkdir  test
$ cd ./test
$ cp -a /bin/ls ls-dynamic
$ ls -lh
-rwxr-xr-x 1 ben ben 112K 2008-08-01 04:05 ls-dynamic
$ ldd ls-dynamic 
linux-gate.so.1 =>  (0x00110000)
librt.so.1 => /lib/librt.so.1 (0x00a3a000)
libselinux.so.1 => /lib/libselinux.so.1 (0x00a06000)
libacl.so.1 => /lib/libacl.so.1 (0x00d8a000)
libc.so.6 => /lib/libc.so.6 (0x0084e000)
libpthread.so.0 => /lib/libpthread.so.0 (0x009eb000)
/lib/ld-linux.so.2 (0x0082e000)
libdl.so.2 => /lib/libdl.so.2 (0x009e4000)
libattr.so.1 => /lib/libattr.so.1 (0x0606d000)

$ statifier ls-dynamic  ls-static
$ ldd ls-static 
not a dynamic executable

$ ls -lh ls-static 
-rwxr-x--- 1 ben ben 2.0M 2008-10-03 12:05 ls-static

$ ls-static /tmp
...
$ ls-static -lh
Segmentation fault

As you can see above, the statified ls crashes when you run it with the -l option. If you get segmentation faults when running your statified executables you should disable stack randomizationand recreate the statified executable. The stack and address spacerandomization feature of the Linux kernel makes the locations used forthe stack and other important parts of an executable change every timeit is executed. Randomizing things each time you run a binary hindersattacks such as the return-to-libc attack because the location of libc functions changes all the time.

You are giving away some security by changing the randomize_va_spaceparameter as shown below. The change to randomize_va_space affects notonly attacks on the executables themselves but also exploit attemptsthat rely on buffer overflows to compromise the system. Withoutrandomization, both attacks become more straightforward. If you setrandomize_va_space to zero as shown below and recreate the ls-staticbinary, things should work as expected. You'll have to leave the stackrandomization feature disabled in order to execute the statifiedexecutable.

# cd /proc/sys/kernel
# cat randomize_va_space 
2
# echo -n 0 >| randomize_va_space
# cat randomize_va_space
0

There are a few other tricks up statifier's sleeve: you can set orunset environment variables for the statified executable, and includeadditional libraries (LD_PRELOAD libraries) into the static executable.Being able to set additional environment variables for a staticexecutable is useful when the binary you are statifying relies onfinding additional resources like configuration files. If the binaryallows you to tell it where to find its resources through environmentvariables, you can include these settings directly into the statifiedexecutable.

The ability to include preloaded shared libraries into the statifiedbinary (LD_PRELOADing) is probably a less commonly used feature. Oneuse is including additional functionality such as making the staticallylinked executable "trashcan friendly" by default, perhaps using delsafe, but without needing to install any additional software on the machine that is running the statically linked executable.

Security measures that randomize the address spaceof binaries might interfere with ELF Statifier and cause it not towork. But when you just want to move the execution of an application toanother Linux machine, ELF Statifier might get you up and runningwithout the hassle of a recompile.

作者简介：

BenMartin has been working on filesystems for more than 10 years. Hecompleted his Ph.D. and now offers consulting services focused onlibferris, filesystems, and search solutions.