Re: noexecstack

[orc <orc@sibserver.ru>]

On Sun, 5 Aug 2012 23:35:36 +0200
Daniel Cegiełka <daniel.cegielka@gmail.com> wrote:

> Vasily Kulikov published a patch for nonexecutable stack for glibc in
> Owl.
> 
> http://openwall.com/lists/owl-dev/2012/08/05/1
> http://openwall.com/lists/owl-dev/2012/08/05/3
> 
> Should we support this in the musl?
> 
> The patch for musl asm files is attached...
> 
> best regards,
> Daniel

Correct me if I'm wrong, but this is ugly stuff.

- binutils ld has -z noexecstack command line option.
- this (GNU_STACK) is binutils-specific (tinycc, for example, does not
  generate ELFs with that section, and future direction should be on
  that plain ELFs without any gnuish extensions IMO)
- Kernel sets executable stack by default, kernel can be patched not to
  do that (that's one line patch per architecture)
- binutils can be patched to not produce ELFs with executable stack by
  default

While some of options I listed here may harm some GCC or binutils
internals (I don't know), I see an utility that comes with grsecurity
patches (paxctl) that operates that section (GNU_STACK), converting it
into it's own.
I tested a system with patched binutils and kernel (but binutils patch
here will be enough) without any problems.