Re: noexecstack

["Daniel Cegiełka" <daniel.cegielka@gmail.com>]

2012/8/6 orc <orc@sibserver.ru>:
> On Sun, 5 Aug 2012 23:35:36 +0200

> Correct me if I'm wrong, but this is ugly stuff.
>
> - binutils ld has -z noexecstack command line option.
> - this (GNU_STACK) is binutils-specific (tinycc, for example, does not
>   generate ELFs with that section, and future direction should be on
>   that plain ELFs without any gnuish extensions IMO)
> - Kernel sets executable stack by default, kernel can be patched not to
>   do that (that's one line patch per architecture)

Can you give some example of how to do it? It might be worthwhile to
introduce it into the main repository of Linux. What do you think?

> - binutils can be patched to not produce ELFs with executable stack by
>   default
>
> While some of options I listed here may harm some GCC or binutils
> internals (I don't know), I see an utility that comes with grsecurity
> patches (paxctl) that operates that section (GNU_STACK), converting it
> into it's own.
> I tested a system with patched binutils and kernel (but binutils patch
> here will be enough) without any problems.

It would be very nice if we could solve this problem in this way. I'm
currently using this patch, but this is not the best solution in my
opinion. Ideally if the system (kernel, binutils, libc) enforce
noexecstack by default... definitely worth look closer at this issue.

Thanks,
Daniel