Re: binutils as policy checker (was: RFC: Add a linker warning when creating segments with RWX permissions)

[Sam James <sam@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1755 bytes --]



> On 28 Apr 2022, at 10:46, Nick Clifton via Binutils <binutils@sourceware.org> wrote:
> 
> Hi Guys,
> 
>  OK, attached is v2 of my proposed patch.  The main features of this
>  new version are:
> 
>    * There are now configure options which can turn off the generation
>      of linker warnings about the creation of executable segments and
>      the creation of executable stacks.  By default however not using
>      these configure options will result in the creation of a linker
>      with all of the warnings enabled.
> 
>    * There is new linker command line option: --no-warn-rwx-segments
>      which disables the warnings about executable segments.
> 
>    * There are tests for the new features, plus extra regexps in the
>      testsuite's pruning proc to remove the warnings from the linker's
>      output for normal tests.
> 
>    * The creation of a TLS segment with eXecute permission will trigger
>      a warning, regardless of whether it has the read and/or write
>      permissions set.
> 
>    * There is a new configure time option which will disable the
>      creation of an executable stack simply because an input file is
>      missing a .note-GNU-stack section (for those architectures where
>      such a creation is the normal behaviour).  This option is not
>      enabled by default however.  At least not yet.
> 
>  I think that this represents the best compromise between helping to
>  promote secure builds whilst also allowing toolchain creators and
>  program builders the option to disable the features if they wish.
> 
>  Any comments ?

WFM and thanks for taking my comments into account -- much appreciated!

> 
> Cheers
>  Nick<ld-rwx-warn.patch>

best,
sam


[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 618 bytes --]