From 16c3159a6550acf2dd8a83412634fcb1be5b3bc3 Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 11:45:22 -0500 Subject: [PATCH 1/7] ignore collector lib env vars in secure execution case --- src/ittnotify/ittnotify_config.h | 43 ++++++++++++++++++++++++++++++++ src/ittnotify/ittnotify_static.c | 2 +- src/ittnotify/jitprofiling.c | 7 ++++++ 3 files changed, 51 insertions(+), 1 deletion(-) diff --git a/src/ittnotify/ittnotify_config.h b/src/ittnotify/ittnotify_config.h index deab689..1d3991c 100644 --- a/src/ittnotify/ittnotify_config.h +++ b/src/ittnotify/ittnotify_config.h @@ -380,6 +380,49 @@ pthread_t pthread_self(void) __attribute__((weak)); #endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */ +/* A process which gained privileges on exec() - setuid/setgid, file + * capabilities, MAC transition - keeps the environment of the less privileged + * user who started it, so it must not take the library to load from there. + */ +#if ITT_PLATFORM==ITT_PLATFORM_WIN + +#define __itt_is_secure_execution_context() (0) + +#else /* ITT_PLATFORM!=ITT_PLATFORM_WIN */ + +#include + +#if ITT_PLATFORM==ITT_PLATFORM_MAC || ITT_PLATFORM==ITT_PLATFORM_FREEBSD || ITT_PLATFORM==ITT_PLATFORM_OPENBSD +#define ITT_ISSETUGID_AVAILABLE 1 +#elif defined(__has_include) +#if __has_include() +#include +#define ITT_GETAUXVAL_AVAILABLE 1 +#endif +#elif defined(__GLIBC__) && (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 16)) +#include +#define ITT_GETAUXVAL_AVAILABLE 1 +#endif + +#if defined(ITT_GETAUXVAL_AVAILABLE) && !defined(AT_SECURE) +#define AT_SECURE 23 /* as defined by */ +#endif + +ITT_INLINE int __itt_is_secure_execution_context(void) ITT_INLINE_ATTRIBUTE; +ITT_INLINE int __itt_is_secure_execution_context(void) +{ +#if defined(ITT_ISSETUGID_AVAILABLE) + if (issetugid() != 0) + return 1; +#elif defined(ITT_GETAUXVAL_AVAILABLE) + if (getauxval(AT_SECURE) != 0) + return 1; +#endif + return (getuid() != geteuid() || getgid() != getegid()) ? 1 : 0; +} + +#endif /* ITT_PLATFORM==ITT_PLATFORM_WIN */ + /* strdup() is not included into C99 which results in a compiler warning about * implicitly declared symbol. To avoid the issue strdup is implemented * manually. diff --git a/src/ittnotify/ittnotify_static.c b/src/ittnotify/ittnotify_static.c index 494f230..f7795f7 100644 --- a/src/ittnotify/ittnotify_static.c +++ b/src/ittnotify/ittnotify_static.c @@ -1200,7 +1200,7 @@ static const char* __itt_get_env_var(const char* name) static char env_buff[MAX_ENV_VALUE_SIZE]; static char* env_value = (char*)env_buff; - if (name != NULL) + if (name != NULL && !__itt_is_secure_execution_context()) { #if ITT_PLATFORM==ITT_PLATFORM_WIN size_t max_len = MAX_ENV_VALUE_SIZE - (size_t)(env_value - env_buff); diff --git a/src/ittnotify/jitprofiling.c b/src/ittnotify/jitprofiling.c index 406f196..76e0031 100644 --- a/src/ittnotify/jitprofiling.c +++ b/src/ittnotify/jitprofiling.c @@ -173,6 +173,13 @@ static int loadiJIT_Funcs() m_libHandle = NULL; } + /* The agent is named by an environment variable, see + * __itt_is_secure_execution_context(). */ + if (__itt_is_secure_execution_context()) + { + return 0; + } + /* Try to get the dll name from the environment */ #if ITT_PLATFORM==ITT_PLATFORM_WIN dNameLength = GetEnvironmentVariableA(NEW_DLL_ENVIRONMENT_VAR, NULL, 0); From 0a7f1c430dc6d9d3f3ea818e27a469d1084e7018 Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 11:46:17 -0500 Subject: [PATCH 2/7] cover refcol lib loading --- src/ittnotify_refcol/itt_refcol_impl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/ittnotify_refcol/itt_refcol_impl.c b/src/ittnotify_refcol/itt_refcol_impl.c index caa44a9..bc7fda4 100644 --- a/src/ittnotify_refcol/itt_refcol_impl.c +++ b/src/ittnotify_refcol/itt_refcol_impl.c @@ -97,10 +97,11 @@ static void ref_collector_init(void) if (!g_ref_collector_logger.init_state) { static char file_name_buffer[LOG_BUFFER_MAX_SIZE*2]; - char* gen_json = getenv(env_gen_json); + int env_trusted = !__itt_is_secure_execution_context(); + char* gen_json = env_trusted ? getenv(env_gen_json) : NULL; g_ref_collector_logger.gen_json = (gen_json != NULL && atoi(gen_json) != 0); - char* log_dir = getenv(env_log_dir); + char* log_dir = env_trusted ? getenv(env_log_dir) : NULL; char* log_file = generate_output_file_name(); if (log_file == NULL) { From 49ed6a0b93809ad52aac868e9ddf3f9b22c31981 Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 12:13:32 -0500 Subject: [PATCH 3/7] cover advisor --- include/advisor-annotate.h | 37 +++++++++++++++++++++++++++- include/fortran/advisor_annotate.f90 | 32 ++++++++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-) diff --git a/include/advisor-annotate.h b/include/advisor-annotate.h index 85d03a0..7e8eb9e 100644 --- a/include/advisor-annotate.h +++ b/include/advisor-annotate.h @@ -118,6 +118,8 @@ typedef HMODULE lib_t; #define __itt_load_lib(name) LoadLibraryA(name) #define __itt_unload_lib(handle) FreeLibrary(handle) #define __itt_system_error() (int)GetLastError() + +#define __annotate_is_secure_execution_context() (0) #endif /* ANNOTATE_DECLARE */ #else /* defined(WIN32) || defined(_WIN32) */ @@ -129,6 +131,7 @@ typedef HMODULE lib_t; #include #include #include +#include typedef void* lib_t; @@ -136,6 +139,36 @@ typedef void* lib_t; #define __itt_load_lib(name) dlopen(name, RTLD_LAZY) #define __itt_unload_lib(handle) dlclose(handle) #define __itt_system_error() errno + +#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) +#define __ANNOTATE_ISSETUGID_AVAILABLE 1 +#elif defined(__has_include) +#if __has_include() +#include +#define __ANNOTATE_GETAUXVAL_AVAILABLE 1 +#endif +#elif defined(__GLIBC__) && (__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 16)) +#include +#define __ANNOTATE_GETAUXVAL_AVAILABLE 1 +#endif + +#if defined(__ANNOTATE_GETAUXVAL_AVAILABLE) && !defined(AT_SECURE) +#define AT_SECURE 23 /* as defined by */ +#endif + +/* A process which gained privileges on exec() keeps the environment of the less + * privileged user who started it, so it must not take the library from there. */ +static __inline int __annotate_is_secure_execution_context(void) +{ +#if defined(__ANNOTATE_ISSETUGID_AVAILABLE) + if (issetugid() != 0) + return 1; +#elif defined(__ANNOTATE_GETAUXVAL_AVAILABLE) + if (getauxval(AT_SECURE) != 0) + return 1; +#endif + return (getuid() != geteuid() || getgid() != getegid()) ? 1 : 0; +} #endif /* ANNOTATE_DECLARE */ #endif /* defined(WIN32) || defined(_WIN32) */ @@ -301,7 +334,9 @@ __annotate_routines_init(struct __annotate_routines* itt) { char* lib_name = NULL; lib_t itt_notify = 0; - lib_name = getenv("INTEL_LIBITTNOTIFY64"); + if (!__annotate_is_secure_execution_context()) { + lib_name = getenv("INTEL_LIBITTNOTIFY64"); + } if (lib_name) { itt_notify = __itt_load_lib(lib_name); diff --git a/include/fortran/advisor_annotate.f90 b/include/fortran/advisor_annotate.f90 index 3bc6872..7aff318 100644 --- a/include/fortran/advisor_annotate.f90 +++ b/include/fortran/advisor_annotate.f90 @@ -209,6 +209,28 @@ function get_library_entry(library, proc_name) bind(C, name="dlsym") character(kind=C_CHAR), dimension(*), intent(in) :: proc_name end function get_library_entry + ! Process credentials, used to detect a privilege elevated process. + + function get_real_uid() bind(C, name="getuid") + import + integer(kind=C_INT) :: get_real_uid + end function get_real_uid + + function get_effective_uid() bind(C, name="geteuid") + import + integer(kind=C_INT) :: get_effective_uid + end function get_effective_uid + + function get_real_gid() bind(C, name="getgid") + import + integer(kind=C_INT) :: get_real_gid + end function get_real_gid + + function get_effective_gid() bind(C, name="getegid") + import + integer(kind=C_INT) :: get_effective_gid + end function get_effective_gid + !dec$ endif end interface @@ -637,7 +659,17 @@ subroutine load_itt_library type(C_PTR) :: library character*1024 ittnotify_path + ittnotify_path = '' +!dec$ if defined(WIN32) .or. defined(_WIN32) call getenv('INTEL_LIBITTNOTIFY64',ittnotify_path) +!dec$ else + ! A process which gained privileges on exec() keeps the environment of + ! the less privileged user who started it. + if (get_real_uid() == get_effective_uid() .and. & + get_real_gid() == get_effective_gid()) then + call getenv('INTEL_LIBITTNOTIFY64',ittnotify_path) + endif +!dec$ endif if ( ittnotify_path /= '' ) then ! print *,' libpath: "'//trim(ittnotify_path)//'"' !dec$ if defined(WIN32) .or. defined(_WIN32) From 7306dc7072b2b1075c2617adf7e5b029947d1544 Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 12:32:21 -0500 Subject: [PATCH 4/7] cleanup --- include/advisor-annotate.h | 1 - src/ittnotify/jitprofiling.c | 2 -- 2 files changed, 3 deletions(-) diff --git a/include/advisor-annotate.h b/include/advisor-annotate.h index 7e8eb9e..272c6be 100644 --- a/include/advisor-annotate.h +++ b/include/advisor-annotate.h @@ -118,7 +118,6 @@ typedef HMODULE lib_t; #define __itt_load_lib(name) LoadLibraryA(name) #define __itt_unload_lib(handle) FreeLibrary(handle) #define __itt_system_error() (int)GetLastError() - #define __annotate_is_secure_execution_context() (0) #endif /* ANNOTATE_DECLARE */ diff --git a/src/ittnotify/jitprofiling.c b/src/ittnotify/jitprofiling.c index 76e0031..0d82fa0 100644 --- a/src/ittnotify/jitprofiling.c +++ b/src/ittnotify/jitprofiling.c @@ -173,8 +173,6 @@ static int loadiJIT_Funcs() m_libHandle = NULL; } - /* The agent is named by an environment variable, see - * __itt_is_secure_execution_context(). */ if (__itt_is_secure_execution_context()) { return 0; From 8ae41888ce3ed801216f2eb5cbc859d7233480b4 Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 13:33:38 -0500 Subject: [PATCH 5/7] fix UB: passing a signed char to isalpha() --- src/ittnotify/jitprofiling.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ittnotify/jitprofiling.c b/src/ittnotify/jitprofiling.c index 0d82fa0..1bdb5a4 100644 --- a/src/ittnotify/jitprofiling.c +++ b/src/ittnotify/jitprofiling.c @@ -128,7 +128,7 @@ static int isValidAbsolutePath(char *path, size_t maxPathLength) if (pathLength > 2) { - if (isalpha(path[0]) && path[1] == ':' && path[2] == '\\') + if (isalpha((unsigned char)path[0]) && path[1] == ':' && path[2] == '\\') { return 1; } From 1eeea8dcf2771362a4021801a4628a96ce6ca1ee Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Thu, 3 Sep 2026 13:34:58 -0500 Subject: [PATCH 6/7] bump api version --- src/ittnotify/ittnotify_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ittnotify/ittnotify_config.h b/src/ittnotify/ittnotify_config.h index 1d3991c..b43697f 100644 --- a/src/ittnotify/ittnotify_config.h +++ b/src/ittnotify/ittnotify_config.h @@ -198,10 +198,10 @@ #define ITT_MAGIC { 0xED, 0xAB, 0xAB, 0xEC, 0x0D, 0xEE, 0xDA, 0x30 } /* Replace with snapshot date YYYYMMDD for promotion build. */ -#define API_VERSION_BUILD 20260603 +#define API_VERSION_BUILD 20260903 #ifndef API_VERSION_NUM -#define API_VERSION_NUM 3.28.2 +#define API_VERSION_NUM 3.28.3 #endif /* API_VERSION_NUM */ #define API_VERSION "ITT-API-Version " ITT_TO_STR(API_VERSION_NUM) \ From a67fe44fb58ba8e9a3055c4ce430868bcd9c13ba Mon Sep 17 00:00:00 2001 From: "Parshutin, Eugeny" Date: Mon, 7 Sep 2026 12:04:45 -0500 Subject: [PATCH 7/7] add __itt_error_env_ignored --- include/ittnotify.h | 4 +++- src/ittnotify/ittnotify_static.c | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/include/ittnotify.h b/include/ittnotify.h index 8162ac8..f3ac43f 100644 --- a/include/ittnotify.h +++ b/include/ittnotify.h @@ -4670,8 +4670,10 @@ typedef enum __itt_error_code /* %1$s -- env var name, %2$d -- system error. */ __itt_error_env_too_long = 5, /*!< variable value too long */ /* %1$s -- env var name, %2$d -- actual length of the var, %3$d -- max allowed length. */ - __itt_error_system = 6 /*!< pthread_mutexattr_init or pthread_mutex_init failed */ + __itt_error_system = 6, /*!< pthread_mutexattr_init or pthread_mutex_init failed */ /* %1$s -- function name, %2$d -- errno. */ + __itt_error_env_ignored = 7 /*!< env var ignored in a privilege elevated process */ + /* %1$s -- env var name. */ } __itt_error_code; typedef void (__itt_error_handler_t)(__itt_error_code code, va_list); diff --git a/src/ittnotify/ittnotify_static.c b/src/ittnotify/ittnotify_static.c index f7795f7..4c93c7b 100644 --- a/src/ittnotify/ittnotify_static.c +++ b/src/ittnotify/ittnotify_static.c @@ -1200,8 +1200,13 @@ static const char* __itt_get_env_var(const char* name) static char env_buff[MAX_ENV_VALUE_SIZE]; static char* env_value = (char*)env_buff; - if (name != NULL && !__itt_is_secure_execution_context()) + if (name != NULL) { + if (__itt_is_secure_execution_context()) + { + __itt_report_error(__itt_error_env_ignored, name); + return NULL; + } #if ITT_PLATFORM==ITT_PLATFORM_WIN size_t max_len = MAX_ENV_VALUE_SIZE - (size_t)(env_value - env_buff); DWORD rc = GetEnvironmentVariableA(name, env_value, (DWORD)max_len);