|
 |
2aacef |
From cc318cd6ccfe9833ab9c1cde4041ac5dd9f97a3b Mon Sep 17 00:00:00 2001
|
|
|
2aacef |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
2aacef |
Date: Tue, 21 Feb 2023 09:16:29 +0100
|
|
|
2aacef |
Subject: [PATCH] efi: drop executable-stack bit from .elf file
|
|
|
2aacef |
MIME-Version: 1.0
|
|
|
2aacef |
Content-Type: text/plain; charset=UTF-8
|
|
|
2aacef |
Content-Transfer-Encoding: 8bit
|
|
|
2aacef |
|
|
|
2aacef |
An rpminspect test in Fedora/RHEL is flagging our stub files as having an
|
|
|
2aacef |
executable stack. The check is correct:
|
|
|
2aacef |
|
|
|
2aacef |
$ readelf --wide --program-headers build/src/boot/efi/linuxx64.elf.stub | rg -i stack
|
|
|
2aacef |
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RWE 0x10
|
|
|
2aacef |
|
|
|
2aacef |
It seems to be just an omission in the linker script… None of the objects that
|
|
|
2aacef |
are linked into the stub are marked as requiring an executable stack:
|
|
|
2aacef |
|
|
|
2aacef |
$ readelf --wide --sections build/src/boot/efi/*.c.o \
|
|
|
2aacef |
/usr/lib/gnuefi/x64/libgnuefi.a \
|
|
|
2aacef |
/usr/lib/gnuefi/x64/libefi.a \
|
|
|
2aacef |
/usr/lib/gcc/x86_64-redhat-linux/12/libgcc.a \
|
|
|
2aacef |
| rg '.note.GNU-stack.*X'
|
|
|
2aacef |
(nothing)
|
|
|
2aacef |
|
|
|
2aacef |
On aarch64 we end up with a nonexecutable stack, but on ia32 and x64 we get one,
|
|
|
2aacef |
so this might be just a matter of defaults in the linker. It doesn't matter
|
|
|
2aacef |
greatly, but let's mark the stack as non-executable to avoid the warning.
|
|
|
2aacef |
|
|
|
2aacef |
Note: '-Wl,-z' is not needed, things work with just '-z'.
|
|
|
2aacef |
|
|
|
2aacef |
RHEL-only
|
|
|
2aacef |
for now, as the patch is not yet in upstream
|
|
|
2aacef |
https://github.com/systemd/systemd/pull/26511
|
|
|
2aacef |
|
|
|
2aacef |
Related: #2140646
|
|
|
2aacef |
---
|
|
|
2aacef |
src/boot/efi/meson.build | 1 +
|
|
|
2aacef |
1 file changed, 1 insertion(+)
|
|
|
2aacef |
|
|
|
2aacef |
diff --git a/src/boot/efi/meson.build b/src/boot/efi/meson.build
|
|
|
2aacef |
index 0de43993a4..00f3361d66 100644
|
|
|
2aacef |
--- a/src/boot/efi/meson.build
|
|
|
2aacef |
+++ b/src/boot/efi/meson.build
|
|
|
2aacef |
@@ -266,6 +266,7 @@ efi_ldflags = [
|
|
|
2aacef |
'-Wl,--warn-common',
|
|
|
2aacef |
'-Wl,-Bsymbolic',
|
|
|
2aacef |
'-z', 'nocombreloc',
|
|
|
2aacef |
+ '-z', 'noexecstack',
|
|
|
2aacef |
efi_crt0,
|
|
|
2aacef |
]
|
|
|
2aacef |
|