Why is the return value of personality(2) in a Go program sometimes incorrect?

I've written a Go program that is supposed to disable ASLR by passing ADDR_NO_RANDOMIZE as the persona argument to the personality(2) system call. It uses the unix.Syscall function from the golang.org/x/sys/unix package to do so.

After disabling ASLR, the program runs an infinite loop, in which it gets the current persona without changing it by calling personality(2) with a persona argument of 0xffffffff (as described in the man page) and reports whether the ADDR_NO_RANDOMIZE bit is set.

When the program is run, the persona seems to go back and forth between 0x00040000 (the expected value with the ADDR_NO_RANDOMIZE bit set) and 0x00000000 (no bits set, which is unexpected).

Sample output of the program:

good - ASLR is disabled (0x00040000)
good - ASLR is disabled (0x00040000)
good - ASLR is disabled (0x00040000)
... [Repeats many times]
bad - ASLR is not disabled (0x00000000)
bad - ASLR is not disabled (0x00000000)
bad - ASLR is not disabled (0x00000000)
... [Repeats many times]
good - ASLR is disabled (0x00040000)
good - ASLR is disabled (0x00040000)
good - ASLR is disabled (0x00040000)
... [Repeats many times]
... [And so on]

Here is the source code for the program:

package main

import (
	"fmt"
	"syscall"

	"golang.org/x/sys/unix"
)

// https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/personality.h
const addrNoRandomize = 0x0040000

func main() {
	disableAslr()

	for {
		curPersona := getCurrentPersona()
		if curPersona&addrNoRandomize != 0 {
			fmt.Printf("good - ASLR is disabled (0x%08x)\n", curPersona)
		} else {
			fmt.Printf("bad - ASLR is not disabled (0x%08x)\n", curPersona)
		}
	}
}

func disableAslr() {
	persona := getCurrentPersona()

	if persona&addrNoRandomize == 0 {
		ret, _, errno := unix.Syscall(syscall.SYS_PERSONALITY, uintptr(persona|addrNoRandomize), 0, 0)
		if int(ret) == -1 {
			panic(fmt.Errorf("disable aslr: %v", errno))
		}
	}
}

func getCurrentPersona() int {
	persona, _, errno := unix.RawSyscall(syscall.SYS_PERSONALITY, uintptr(0xffffffff), 0, 0)
	if int(persona) == -1 {
		panic(fmt.Errorf("get current persona: %v", errno))
	}
	return int(persona)
}

This behavior is unexpected because:

1. The man page says nothing to suggest that the personality should go back and forth like this
2. An equivalent C program consistently shows the personality being set to 0x00040000 - it never reverts back to 0
3. Watching /proc/<PID>/personality for the PID of the Go program consistently shows 00040000. It never goes back to 0. This suggests to me that ADDR_NO_RANDOMIZE is indeed set properly, but the program is reporting it incorrectly
4. Using strace on the Go program shows that personality(2) is only called with an argument of 0x00040000 (to disable ASLR) or 0xffffffff (to get the current persona without changing it). There are no other calls changing it back to 0

I don't see any detail about this in the man page for personality(2), but this seems to
be the same issue as why setuid() and friends were not supported by Go, under Linux, for a very long time.

Go's idea of threading is not easy to reason about. You can force a single OS thread to follow the execution of a single sequence of code with runtime.LockOSThread(), but getting all OS threads in a Go program to share many kernel maintained attributes is sometimes difficult and non-obvious.

There is a package, kernel.org/pub/linux/libs/security/libcap/psx, that mirrors system calls over all OS threads. In cases like this it addresses the problem you are seeing.

Rewriting your application (prog.go) to use the psx package, controlled with a command line flag, makes it work as you expect:

package main
import (
"flag"
"fmt"
"os"
"runtime"
"syscall"
"kernel.org/pub/linux/libs/security/libcap/psx"
)
var wPSX = flag.Bool("psx", false, "disable ASLR with PSX thread mirroring")
// https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/personality.h
const addrNoRandomize = 0x0040000
func main() {
flag.Parse()
disableAslr()
for i := 0; i < 100; i++ {
runtime.LockOSThread()
curPersona := getCurrentPersona()
tid := syscall.Gettid()
runtime.UnlockOSThread()
if curPersona&addrNoRandomize != 0 {
fmt.Printf("%d: good - ASLR is disabled (0x%08x)\n", tid, curPersona)
} else {
fmt.Printf("%d: bad - ASLR is not disabled (0x%08x)\n", tid, curPersona)
os.Exit(1)
}
go func() {
// Cause one OS thread to exit.
runtime.LockOSThread()
}()
// Allow this code to run on a different thread.
runtime.Gosched()
}
}
func disableAslr() {
persona := getCurrentPersona()
if persona&addrNoRandomize != 0 {
return
}
var ret uintptr
var errno syscall.Errno
if *wPSX {
ret, _, errno = psx.Syscall3(syscall.SYS_PERSONALITY, uintptr(persona|addrNoRandomize), 0, 0)
} else {
ret, _, errno = syscall.Syscall(syscall.SYS_PERSONALITY, uintptr(persona|addrNoRandomize), 0, 0)
}
if int(ret) == -1 {
panic(fmt.Errorf("disable aslr: %v", errno))
}
}
func getCurrentPersona() int {
persona, _, errno := syscall.RawSyscall(syscall.SYS_PERSONALITY, uintptr(0xffffffff), 0, 0)
if int(persona) == -1 {
panic(fmt.Errorf("get current persona: %v", errno))
}
return int(persona)
}

I've dropped the unix package as it doesn't help with anything in this case, and you are already including the syscall package.

$ go mod init prog
$ go mod tidy
$ go build
$ ./prog --psx=false
24381: good - ASLR is disabled (0x00040000)
24381: good - ASLR is disabled (0x00040000)
24381: good - ASLR is disabled (0x00040000)
24387: bad - ASLR is not disabled (0x00000000)
$ ./prog --psx=true
24368: good - ASLR is disabled (0x00040000)
24369: good - ASLR is disabled (0x00040000)
24370: good - ASLR is disabled (0x00040000)
24371: good - ASLR is disabled (0x00040000)
24372: good - ASLR is disabled (0x00040000)
24374: good - ASLR is disabled (0x00040000)
24373: good - ASLR is disabled (0x00040000)
...
$

I hate to rain on the parade, but, it just occurred to me ...

1. Disabling ASLR [if enabled] for the current program will have little effect, because it happens too late in the loading process. The kernel [and, possibly, the ELF interpreter] has already applied ASLR.
2. Disabling ASLR will only have an effect on a program that we do execvp on.
3. To disable ASLR for the current program requires that we disable it, and, then, do exec of the current program and its args.

Note that a C program doesn't have to do this for threads because they haven't been created yet.

For a go program, we may have to do what Tinkerer did in his answer (e.g. using psx, etc., to catch all threads).

Since I'm not too familiar with go, here is a C program (and we need the equivalent in go):

#include <unistd.h>
#include <sys/personality.h>
int
disableAslr(void)
{
// get current state
unsigned int pers = personality(0xFFFFFFFF);
// decide if we need to disable (and exec)
int doexec = ((pers & ADDR_NO_RANDOMIZE) == 0);
// disable ASLR (for child of execvp)
if (doexec)
personality(pers | ADDR_NO_RANDOMIZE);
return doexec;
}
int
main(int argc,char **argv)
{
// disable ASLR and self exec [if necessary]
if (disableAslr())
execvp(argv[0],argv);
// real stuff ...
return 0;
}